Function at 0x10008d79
Capabilities:
Compare security identifiers
Extract resource via kernel32 functions
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008596f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1178
call fcn.10082fb0
push esi
push edi
mov dword [ebp - 0x238], 0xfffffff9
mov dword [ebp - 0x2e8], 0
jmp 0x10008dc0
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 4
jge 0x10008ddc
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0xa28], 0xfffffff9
jmp 0x10008db3
mov dword [ebp - 0x238], 0
jmp 0x10008df5
mov eax, dword [ebp - 0x238]
dec eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0xfffffffc
jg 0x100091f9
mov dword [ebp - 0x14], 0x5d09ea9
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x14], 3
jmp 0x10008e23
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x100091f4
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xa28], 0xffffffff
jge 0x10008e46
mov dword [ebp - 0x8f8], 1
jmp 0x10008e4d
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xa28], ecx
je 0x10008e6e
cmp dword [ebp - 0x14], 0
je 0x10008e6e
mov dword [ebp - 0x85c], 1
jmp 0x10008e75
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xa28]
cmp dword [ebp - 0x85c], eax
jle 0x10008e93
mov dword [ebp - 0x900], 1
jmp 0x10008e9a
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x8f8]
neg eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x900]
cmp eax, ecx
jge 0x10008ebb
mov dword [ebp - 0x908], 1
jmp 0x10008ec2
and dword [ebp - 0x908], 0
cmp dword [ebp - 0x908], 0x693009c
jge 0x10008eda
mov dword [ebp - 0x910], 1
jmp 0x10008ee1
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x910]
add ecx, dword [ebp + eax*4 - 0xa28]
mov dword [ebp - 0x918], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x918]
mov dword [ebp + eax*4 - 0xa28], ecx
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x120], 0
jmp 0x10008f2c
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jg 0x100091ef
mov dword [ebp - 0x194], 0
push 2
lea ecx, [ebp - 0xe28]
call fcn.1001740b
and dword [ebp - 4], 0
mov dword [ebp - 0x370], 0
jmp 0x10008f6d
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 2
jge 0x10008f8f
push dword [ebp - 0x370]
lea ecx, [ebp - 0xe28]
call fcn.100174a9
mov dword [eax], 0x93046aa1
jmp 0x10008f60
mov dword [ebp - 0x194], 0
jmp 0x10008fa8
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jg 0x100091db
mov dword [ebp - 0x240], 0
jmp 0x10008fce
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jge 0x10008fea
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xb64], 0x973063d6
jmp 0x10008fc1
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xb64], 0
jmp 0x10009015
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb64]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xb64], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb64], 3
jg 0x100090ca
mov dword [ebp - 0x2f0], 0xc7ba3f30
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x10009051
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov dword [ebp - 0x2f0], 3
jmp 0x1000906a
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0
jl 0x100090c5
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1000908d
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 0xc7], 0
movzx eax, byte [ebp - 0xc7]
test eax, eax
je 0x100090c3
push 0
push 0x233
push 0
push 0xba1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
jmp 0x1000905d
jmp 0x10008ffc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa28], 0xfffffff8
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x1000911f
mov eax, dword [ebp - 0x194]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xa28]
cmp dword [ebp + eax*4 - 0xa28], ecx
jne 0x10009106
mov dword [ebp - 0x920], 1
jmp 0x1000910d
and dword [ebp - 0x920], 0
cmp dword [ebp - 0x920], 0
jne 0x1000911f
and dword [ebp - 0x928], 0
jmp 0x10009129
mov dword [ebp - 0x928], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x928], eax
jg 0x10009140
mov dword [ebp - 0x930], 1
jmp 0x10009147
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x930], eax
jge 0x10009161
mov dword [ebp - 0x400], 1
jmp 0x10009168
and dword [ebp - 0x400], 0
push 0
lea ecx, [ebp - 0xe28]
call fcn.100174a9
mov ecx, dword [ebp - 0x400]
mov dword [eax], ecx
cmp dword [ebp - 0x400], 0xcaa7
jne 0x10009195
mov dword [ebp - 0x938], 1
jmp 0x1000919c
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x938]
add eax, 0x71dc
je 0x100091bb
cmp dword [ebp - 0x14], 0
je 0x100091bb
mov dword [ebp - 0x958], 1
jmp 0x100091c2
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x958]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb64], eax
jmp 0x10008f9b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe28]
call fcn.1001748d
jmp 0x10008f1f
jmp 0x10008e1c
jmp 0x10008de8
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1000921d
push 0xcd8
push 0xc9d
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov dword [ebp - 0x38c], 0xfffffff9
mov dword [ebp - 0x1a0], 0x48aab564
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x150], 0xb61943ec
mov dword [ebp - 0x248], 0
jmp 0x1000925e
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 2
jge 0x1000927a
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x388], 0
jmp 0x10009251
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x388], 0xd
jmp 0x100092a8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x388]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x388], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x388], 0xffffffe4
jl 0x10009646
mov dword [ebp - 0xa4], 0xffffffff
mov dword [ebp - 0x348], 0
jmp 0x100092df
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 4
jge 0x100092fb
mov eax, dword [ebp - 0x348]
mov dword [ebp + eax*4 - 0xe9c], 0xffffffff
jmp 0x100092d2
mov dword [ebp - 0xa4], 0
jmp 0x10009314
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jg 0x10009641
mov dword [ebp - 0x1d0], 1
mov dword [ebp - 0x128], 0x7f4a7d2a
mov dword [ebp - 0x1d0], 3
jmp 0x1000934e
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jl 0x10009620
mov dword [ebp - 0x198], 0x365653d4
mov dword [ebp - 0x198], 3
jmp 0x1000937e
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jl 0x1000961b
mov dword [ebp - 0x250], 0
jmp 0x100093a4
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x100093c0
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0xf98], 0xb9567464
jmp 0x10009397
mov eax, dword [ebp - 0xa4]
cmp dword [ebp + eax*4 - 0xe9c], 0
jne 0x10009467
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov edx, 0x6974
sub edx, dword [ebp + ecx - 0xe9c]
cmp dword [ebp + eax - 0x388], edx
jge 0x10009400
mov dword [ebp - 0x968], 1
jmp 0x10009407
and dword [ebp - 0x968], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x388]
cmp dword [ebp - 0xa4], eax
jle 0x10009428
mov dword [ebp - 0x960], 1
jmp 0x1000942f
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x960], eax
jne 0x10009449
mov dword [ebp - 0x970], 1
jmp 0x10009450
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x968]
sub eax, dword [ebp - 0x970]
jne 0x10009467
and dword [ebp - 0x9ec], 0
jmp 0x10009471
mov dword [ebp - 0x9ec], 1
cmp dword [ebp - 0x9ec], 0x9953
jl 0x10009489
mov dword [ebp - 0x724], 1
jmp 0x10009490
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x5169
jle 0x100094c0
mov dword [ebp - 0x8f0], 1
jmp 0x100094c7
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0x8f0], eax
je 0x100094e1
mov dword [ebp - 0x480], 1
jmp 0x100094e8
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
sub eax, 0x1162d50c
mov ecx, dword [ebp - 0xa4]
cmp eax, dword [ebp + ecx*4 - 0xe9c]
jge 0x1000951a
mov dword [ebp - 0x728], 1
jmp 0x10009521
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0x728]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x388]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x128], 0
jmp 0x1000955b
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jg 0x10009616
mov dword [ebp - 0x1084], 3
mov dword [ebp - 0x150], 0
jmp 0x1000958b
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 4
jge 0x100095a7
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0xe9c], 0
jmp 0x1000957e
mov dword [ebp - 0x130], 3
jmp 0x100095c0
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jl 0x10009611
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf98]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf98], eax
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1000960f
push 0x1552
push 0
push 0xe08
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
jmp 0x100095b3
jmp 0x1000954e
jmp 0x10009371
jmp 0x10009341
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x1000963c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10009307
jmp 0x1000928d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x388], 1
jne 0x10009662
mov dword [ebp - 0x488], 1
jmp 0x10009669
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x488]
jg 0x10009683
mov dword [ebp - 0xa3c], 1
jmp 0x1000968a
and dword [ebp - 0xa3c], 0
mov dword [ebp - 0x1a0], 0x7bb34e4a
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1a0]
mov dword [ebp + eax - 0x388], ecx
mov dword [ebp - 0x2f8], 0
jmp 0x100096c0
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 4
jge 0x100096dc
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0xa38], 0xfffffff9
jmp 0x100096b3
push 1
lea ecx, [ebp - 0xb74]
call fcn.1001740b
mov dword [ebp - 4], 1
mov dword [ebp - 0x1088], 0
mov dword [ebp - 0x74], 0
jmp 0x1000970a
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10009720
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x944], 8
jmp 0x10009703
mov dword [ebp - 0x74], 0
jmp 0x10009730
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x10009749
push dword [ebp - 0x74]
lea ecx, [ebp - 0xb74]
call fcn.100174a9
or dword [eax], 0xffffffff
jmp 0x10009729
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x944], 0
jmp 0x10009777
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x944]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x944], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x944], 0x1d
jle 0x100099ac
mov dword [ebp - 0x1f8], 0
push 3
lea ecx, [ebp - 0xe58]
call fcn.1001740b
mov byte [ebp - 4], 2
mov dword [ebp - 0x258], 0
jmp 0x100097bf
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x100097e1
push dword [ebp - 0x258]
lea ecx, [ebp - 0xe58]
call fcn.100174a9
mov dword [eax], 0x270e7ad5
jmp 0x100097b2
mov dword [ebp - 0x1f8], 0x14
jmp 0x100097fa
mov eax, dword [ebp - 0x1f8]
dec eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0xa
jg 0x10009998
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd4], 0
jmp 0x1000982a
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jg 0x10009993
mov dword [ebp - 0xa9c], 0x82baef6e
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x1000985b
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0xd4]
lea ecx, [ebp - 0xb74]
call fcn.100174a9
cmp dword [eax], 0
je 0x100098ba
push dword [ebp - 0xd4]
lea ecx, [ebp - 0xb74]
call fcn.100174a9
mov dword [ebp - 0x914], eax
push dword [ebp - 0xd4]
lea ecx, [ebp - 0xb74]
call fcn.100174a9
mov ecx, dword [ebp - 0x914]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x914]
cmp dword [eax], 0
je 0x100098ba
mov dword [ebp - 0x72c], 1
jmp 0x100098c1
and dword [ebp - 0x72c], 0
cmp dword [ebp - 0xa9c], 0
jne 0x10009900
mov eax, dword [ebp - 0x1f8]
neg eax
cmp eax, 1
jge 0x100098e3
mov dword [ebp - 0x490], 1
jmp 0x100098ea
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x490]
add eax, 0xd5de
jne 0x10009900
and dword [ebp - 0x498], 0
jmp 0x1000990a
mov dword [ebp - 0x498], 1
mov eax, dword [ebp - 0x72c]
cmp eax, dword [ebp - 0x498]
je 0x10009924
mov dword [ebp - 0x874], 1
jmp 0x1000992b
and dword [ebp - 0x874], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x944]
cmp dword [ebp - 0x874], eax
je 0x10009953
push 9
pop eax
test eax, eax
je 0x10009953
mov dword [ebp - 0x4a0], 1
jmp 0x1000995a
and dword [ebp - 0x4a0], 0
cmp dword [ebp - 0x4a0], 0x3d3b0cf5
jl 0x10009972
mov dword [ebp - 0x734], 1
jmp 0x10009979
and dword [ebp - 0x734], 0
push 1
lea ecx, [ebp - 0xe58]
call fcn.100174a9
mov ecx, dword [ebp - 0x734]
mov dword [eax], ecx
jmp 0x1000981d
jmp 0x100097ed
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xe58]
call fcn.1001748d
jmp 0x1000975c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb74]
call fcn.1001748d
mov dword [ebp - 0x38c], 0
jmp 0x100099d4
mov eax, dword [ebp - 0x38c]
dec eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0xfffffffc
jg 0x1000a3cd
mov dword [ebp - 0x10], 0x5d09ea9
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x28], 0x32b1cecb
mov dword [ebp - 0x73c], 0
mov dword [ebp - 0xaac], 0xb72b
push 4
lea ecx, [ebp - 0xdc8]
call fcn.1001740b
mov dword [ebp - 4], 3
mov dword [ebp - 0xab4], 0xffff
mov dword [ebp - 0x6c], 0
jmp 0x10009a3b
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10009a51
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x470], 0
jmp 0x10009a34
mov dword [ebp - 0x6c], 0
jmp 0x10009a61
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10009a7d
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xdc8]
call fcn.100174a9
mov dword [eax], 9
jmp 0x10009a5a
mov dword [ebp - 0x28], 0
jmp 0x10009a8d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x10009cf9
mov dword [ebp - 0xac4], 0
mov dword [ebp - 0x260], 0
jmp 0x10009aba
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x10009ad6
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0xb84], 0xffffffff
jmp 0x10009aad
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x470]
mov dword [ebp - 0xf10], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x470]
mov dword [ebp - 0x100c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x470]
mov dword [ebp - 0xf18], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb84]
mov dword [ebp - 0x10e0], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp + ecx*4 - 0x470]
cmp dword [ebp + eax*4 - 0x470], ecx
jl 0x10009b40
mov dword [ebp - 0x4a8], 1
jmp 0x10009b47
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x28]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x470]
imul ecx, dword [ebp - 0x4a8]
cmp dword [ebp + eax*4 - 0x470], ecx
jge 0x10009b72
mov dword [ebp - 0x9e4], 1
jmp 0x10009b79
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x9e4], eax
jge 0x10009bb0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb84], 0
je 0x10009bb0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x470], 0
je 0x10009bb0
mov dword [ebp - 0xaa4], 1
jmp 0x10009bb7
and dword [ebp - 0xaa4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x470]
mov dword [ebp - 0xf20], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb84]
mov dword [ebp - 0x101c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb84], 0x7f03
jg 0x10009c02
cmp dword [ebp - 0x28], 0
je 0x10009c02
mov dword [ebp - 0x4b0], 1
jmp 0x10009c09
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
lea eax, [eax*4 + 1]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0xf28], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb84]
mov dword [ebp - 0x1090], eax
push 0xfffffffffffffffd
pop eax
sub eax, dword [ebp - 0xaac]
jne 0x10009c61
push 0
lea ecx, [ebp - 0xdc8]
call fcn.100174a9
cmp dword [eax], 0
jne 0x10009c61
and dword [ebp - 0x4b8], 0
jmp 0x10009c6b
mov dword [ebp - 0x4b8], 1
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x470]
cmp eax, dword [ebp - 0x4b8]
jl 0x10009c89
mov dword [ebp - 0x87c], 1
jmp 0x10009c90
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
sub eax, dword [ebp - 0xab4]
je 0x10009cb7
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x470], 0
je 0x10009cb7
mov dword [ebp - 0xabc], 1
jmp 0x10009cbe
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x470]
mov dword [ebp - 0xf30], eax
mov dword [ebp - 0xac4], 0xad479ea4
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x10009cf4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10009a86
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10009d21
push 0
push 0x97a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc8]
call fcn.1001748d
mov dword [ebp - 0x10], 3
jmp 0x10009d40
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1000a3c8
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xa38], 0xffffffff
jge 0x10009d63
mov dword [ebp - 0x744], 1
jmp 0x10009d6a
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xa38], ecx
je 0x10009d8b
cmp dword [ebp - 0x10], 0
je 0x10009d8b
mov dword [ebp - 0x4c0], 1
jmp 0x10009d92
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xa38]
cmp dword [ebp - 0x4c0], eax
jle 0x10009db0
mov dword [ebp - 0x4c8], 1
jmp 0x10009db7
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x744]
neg eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x4c8]
cmp eax, ecx
jge 0x10009dd8
mov dword [ebp - 0x91c], 1
jmp 0x10009ddf
and dword [ebp - 0x91c], 0
cmp dword [ebp - 0x91c], 0x693009c
jge 0x10009df7
mov dword [ebp - 0x4d0], 1
jmp 0x10009dfe
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x4d0]
add ecx, dword [ebp + eax*4 - 0xa38]
mov dword [ebp - 0x74c], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x74c]
mov dword [ebp + eax*4 - 0xa38], ecx
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x170], 0
jmp 0x10009e49
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jg 0x1000a3c3
mov dword [ebp - 0x300], 0
jmp 0x10009e6f
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 2
jge 0x10009e8b
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0xcbc], 8
jmp 0x10009e62
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcbc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xcbc], eax
mov byte [ebp - 0x10a], 0
movzx eax, byte [ebp - 0x10a]
test eax, eax
je 0x10009ec7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1a8], 0x3fa75c1
mov dword [ebp - 0x7c], 0
jmp 0x10009eeb
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x10009f01
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x184], 0xc58a
jmp 0x10009ee4
mov dword [ebp - 0x7c], 0
jmp 0x10009f11
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x10009f27
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xa44], 0x3cef3392
jmp 0x10009f0a
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1000a0df
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x102c], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0xf38], eax
cmp dword [ebp - 0x1a8], 0
jne 0x10009f6c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x184], 0
jne 0x10009f6c
and dword [ebp - 0x4d8], 0
jmp 0x10009f76
mov dword [ebp - 0x4d8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x184]
cmp dword [ebp - 0x4d8], eax
je 0x10009fa7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x184], 0
je 0x10009fa7
mov dword [ebp - 0x884], 1
jmp 0x10009fae
and dword [ebp - 0x884], 0
cmp dword [ebp - 0x884], 0x5a65
jge 0x1000a0df
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x184], 0
je 0x1000a07b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x184], 0
je 0x1000a07b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x184]
mov dword [ebp - 0x10c0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x184]
mov dword [ebp - 0xf54], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x184]
cmp dword [ebp + eax - 0x184], ecx
je 0x1000a038
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x184], 0
je 0x1000a04b
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x1000a04b
mov dword [ebp - 0x4e0], 1
jmp 0x1000a052
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
add eax, 0x3fc2
je 0x1000a07b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x184], 0
je 0x1000a07b
mov dword [ebp - 0xa40], 1
jmp 0x1000a082
and dword [ebp - 0xa40], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x184]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1050], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xa44], 0x6a08376f
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x1000a0dd
push 0x23b7
push 0x1054
push 0
push 0x2f2
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1000a114
mov dword [ebp - 0xf5c], 0xfffffff8
mov dword [ebp - 0x10a0], 0
mov dword [ebp - 0xf64], 0xb4b26d8f
mov dword [ebp - 0x754], 0xea3d8810
mov eax, dword [ebp - 0x754]
inc eax
mov dword [ebp - 0x754], eax
push 2
lea ecx, [ebp - 0xdf8]
call fcn.1001740b
mov dword [ebp - 4], 4
mov dword [ebp - 0x268], 0
jmp 0x1000a141
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 2
jge 0x1000a163
push dword [ebp - 0x268]
lea ecx, [ebp - 0xdf8]
call fcn.100174a9
mov dword [eax], 0x93046aa1
jmp 0x1000a134
mov dword [ebp - 0x1d8], 0
jmp 0x1000a17c
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jg 0x1000a3af
mov dword [ebp - 0x350], 0
jmp 0x1000a1a2
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 3
jge 0x1000a1be
mov eax, dword [ebp - 0x350]
mov dword [ebp + eax*4 - 0xb94], 0x973063d6
jmp 0x1000a195
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xb94], 0
jmp 0x1000a1e9
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb94]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xb94], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb94], 3
jg 0x1000a29e
mov dword [ebp - 0x270], 0xc7ba3f30
mov byte [ebp - 0x10c], 0
movzx eax, byte [ebp - 0x10c]
test eax, eax
je 0x1000a225
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov dword [ebp - 0x270], 3
jmp 0x1000a23e
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jl 0x1000a299
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1000a261
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x1000a297
push 0
push 0x233
push 0
push 0xba1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
jmp 0x1000a231
jmp 0x1000a1d0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa38], 0xfffffff8
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x1000a2f3
mov eax, dword [ebp - 0x1d8]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xa38]
cmp dword [ebp + eax*4 - 0xa38], ecx
jne 0x1000a2da
mov dword [ebp - 0x4e8], 1
jmp 0x1000a2e1
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0
jne 0x1000a2f3
and dword [ebp - 0x974], 0
jmp 0x1000a2fd
mov dword [ebp - 0x974], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x974], eax
jg 0x1000a314
mov dword [ebp - 0x4f0], 1
jmp 0x1000a31b
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x4f0], eax
jge 0x1000a335
mov dword [ebp - 0x3bc], 1
jmp 0x1000a33c
and dword [ebp - 0x3bc], 0
push 0
lea ecx, [ebp - 0xdf8]
call fcn.100174a9
mov ecx, dword [ebp - 0x3bc]
mov dword [eax], ecx
cmp dword [ebp - 0x3bc], 0xcaa7
jne 0x1000a369
mov dword [ebp - 0x75c], 1
jmp 0x1000a370
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
add eax, 0x71dc
je 0x1000a38f
cmp dword [ebp - 0x10], 0
je 0x1000a38f
mov dword [ebp - 0x4f8], 1
jmp 0x1000a396
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb94], eax
jmp 0x1000a16f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdf8]
call fcn.1001748d
jmp 0x10009e3c
jmp 0x10009d39
jmp 0x100099c7
mov dword [ebp - 0x1058], 0xe3556834
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1000a409
push 0
push 0x20b5
push 0x170
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
mov byte [ebp - 0x110], 0
movzx eax, byte [ebp - 0x110]
test eax, eax
je 0x1000a431
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1000a455
push 0xcd8
push 0xc9d
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov dword [ebp - 0xdc], 0x5540d7f8
mov dword [ebp - 0x88c], 5
mov dword [ebp - 0xdc], 0xfffffffb
jmp 0x1000a482
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xfffffff0
jg 0x1000a5b3
mov dword [ebp - 0x60], 0
jmp 0x1000a49f
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1000a4b5
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xc60], 1
jmp 0x1000a498
mov dword [ebp - 0x60], 0
jmp 0x1000a4c5
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1000a4db
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xf44], 0xf88039d6
jmp 0x1000a4be
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc60]
mov dword [ebp - 0x88c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc60]
cmp dword [ebp - 0x88c], eax
jne 0x1000a50e
mov dword [ebp - 0x500], 1
jmp 0x1000a515
and dword [ebp - 0x500], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc60]
cmp dword [ebp - 0xdc], eax
jge 0x1000a535
mov dword [ebp - 0x764], 1
jmp 0x1000a53c
and dword [ebp - 0x764], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x500]
imul ecx, dword [ebp - 0x764]
cmp dword [ebp + eax - 0xc60], ecx
jne 0x1000a564
mov dword [ebp - 0x508], 1
jmp 0x1000a56b
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
sub eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0xdc]
je 0x1000a594
mov eax, 0xf024
test eax, eax
je 0x1000a594
mov dword [ebp - 0x924], 1
jmp 0x1000a59b
and dword [ebp - 0x924], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x924]
mov dword [ebp + eax - 0xf44], ecx
jmp 0x1000a475
mov dword [ebp - 0x280], 0xfffffff9
mov dword [ebp - 0x404], 0xe19f23e5
mov dword [ebp - 0x308], 0
jmp 0x1000a5e0
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jge 0x1000a5f9
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0x40], 0xfffffff7
jmp 0x1000a5d3
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x40], 0
jmp 0x1000a61e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x40], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0x1c
je 0x1000a867
mov dword [ebp - 0x50], 0xffffffff
xor eax, eax
inc eax
je 0x1000a64d
cmp dword [ebp - 0x50], 0
je 0x1000a64d
mov dword [ebp - 0x510], 1
jmp 0x1000a654
and dword [ebp - 0x510], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
cmp eax, dword [ebp - 0x510]
jl 0x1000a672
mov dword [ebp - 0x894], 1
jmp 0x1000a679
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jge 0x1000a68d
mov dword [ebp - 0x76c], 1
jmp 0x1000a694
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x76c]
je 0x1000a6ab
mov dword [ebp - 0x518], 1
jmp 0x1000a6b2
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 0x3267e6aa
jg 0x1000a6ca
mov dword [ebp - 0x520], 1
jmp 0x1000a6d1
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x894]
cmp eax, dword [ebp - 0x520]
jle 0x1000a6eb
mov dword [ebp - 0x774], 1
jmp 0x1000a6f2
and dword [ebp - 0x774], 0
cmp dword [ebp - 0x774], 0x5420
jg 0x1000a70a
mov dword [ebp - 0x528], 1
jmp 0x1000a711
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x528]
cmp eax, 0xc975
jg 0x1000a72d
mov dword [ebp - 0x9c4], 1
jmp 0x1000a734
and dword [ebp - 0x9c4], 0
cmp dword [ebp - 0x9c4], 0x8018d9dc
je 0x1000a74e
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x404], eax
jmp 0x1000a862
mov dword [ebp - 0xa4c], 0xffffffff
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0xf6c], eax
cmp dword [ebp - 0xa4c], 0xffffffff
jne 0x1000a77d
mov dword [ebp - 0x530], 1
jmp 0x1000a784
and dword [ebp - 0x530], 0
mov eax, 0xf4caa5d7
sub eax, dword [ebp - 0x530]
add eax, 0xd50c
cmp eax, dword [ebp - 0x50]
jge 0x1000a7a5
mov dword [ebp - 0xa54], 1
jmp 0x1000a7ac
and dword [ebp - 0xa54], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0x10c8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 9
je 0x1000a7d5
mov dword [ebp - 0x77c], 1
jmp 0x1000a7dc
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x404]
cmp dword [ebp - 0x77c], eax
jne 0x1000a7f6
mov dword [ebp - 0x538], 1
jmp 0x1000a7fd
and dword [ebp - 0x538], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
cmp eax, dword [ebp - 0x538]
jge 0x1000a81b
mov dword [ebp - 0x89c], 1
jmp 0x1000a822
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x89c], eax
jle 0x1000a839
mov dword [ebp - 0xa5c], 1
jmp 0x1000a840
and dword [ebp - 0xa5c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0xf74], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1060], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x404], eax
jmp 0x1000a609
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x278], 0
jmp 0x1000a88a
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 2
jge 0x1000a8a6
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0x10f4], 0x8bbca631
jmp 0x1000a87d
mov dword [ebp - 0x138], 1
jmp 0x1000a8bf
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jl 0x1000a8e1
mov dword [ebp - 0x540], 2
mov eax, dword [ebp - 0x540]
dec eax
mov dword [ebp - 0x540], eax
jmp 0x1000a8b2
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x378], 0
jmp 0x1000a906
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 4
jge 0x1000a922
mov eax, dword [ebp - 0x378]
mov dword [ebp + eax*4 - 0xa18], 0xfffffff9
jmp 0x1000a8f9
mov dword [ebp - 0x280], 0
jmp 0x1000a93b
mov eax, dword [ebp - 0x280]
dec eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xfffffffc
jg 0x1000be2d
mov dword [ebp - 0x1b0], 0xffffffff
mov dword [ebp - 0x84], 0
jmp 0x1000a96b
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1000a987
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x310], 1
jmp 0x1000a95e
mov dword [ebp - 0x84], 0
jmp 0x1000a9a0
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x1000a9bc
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x1184], 0xfe6966ef
jmp 0x1000a993
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x310], 0x14
jmp 0x1000a9ea
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x310]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x310], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x310], 0x1d
jne 0x1000ac45
mov dword [ebp - 0x188], 0xeede0b40
mov dword [ebp - 0x288], 0
jmp 0x1000aa21
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 1
jge 0x1000aa3d
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0x784], 0xf307d7c1
jmp 0x1000aa14
mov dword [ebp - 0x188], 0x16
jmp 0x1000aa56
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xffffffef
je 0x1000ac40
mov dword [ebp - 0x1f0], 0xfffffff6
mov dword [ebp - 0x1f0], 0xffffffff
jmp 0x1000aa86
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x1b
jne 0x1000ac3b
mov dword [ebp - 0x548], 0x3418eb0b
mov dword [ebp - 0x358], 0
jmp 0x1000aab6
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 2
jge 0x1000aad2
mov eax, dword [ebp - 0x358]
mov dword [ebp + eax*4 - 0x430], 0xfffffffc
jmp 0x1000aaa9
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x430], 0
jmp 0x1000ab00
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x430]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x430], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x430], 0
jg 0x1000ab40
mov dword [ebp - 0xaf4], 0x23a266d2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x430]
mov eax, dword [ebp + eax*4 - 0x784]
mov dword [ebp - 0xf7c], eax
mov dword [ebp - 0xaf4], 0xb963ab1
jmp 0x1000aae5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x784]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x188], 1
jle 0x1000abe6
mov dword [ebp - 0x1b0], 0xffffffee
jmp 0x1000ab79
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xffffffe3
jl 0x1000abe4
mov dword [ebp - 0xafc], 0x3d975123
mov dword [ebp - 0x92c], 0xffffffff
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x92c], eax
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x92c], eax
jle 0x1000abc8
mov dword [ebp - 0x550], 1
jmp 0x1000abcf
and dword [ebp - 0x550], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x550]
mov dword [ebp + eax - 0x430], ecx
jmp 0x1000ab6c
jmp 0x1000ac36
mov byte [ebp - 0x112], 0
movzx eax, byte [ebp - 0x112]
test eax, eax
je 0x1000ac00
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1000ac36
push 0xbe7
push 0
push 0
push 0xce1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x1000aa79
jmp 0x1000aa49
jmp 0x1000a9cf
mov dword [ebp - 0x18], 0x5d09ea9
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x18], 3
jmp 0x1000ac66
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1000be28
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xa18], 0xffffffff
jge 0x1000ac89
mov dword [ebp - 0x558], 1
jmp 0x1000ac90
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xa18], ecx
je 0x1000acb1
cmp dword [ebp - 0x18], 0
je 0x1000acb1
mov dword [ebp - 0x78c], 1
jmp 0x1000acb8
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xa18]
cmp dword [ebp - 0x78c], eax
jle 0x1000acd6
mov dword [ebp - 0x8a4], 1
jmp 0x1000acdd
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x558]
neg eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x8a4]
cmp eax, ecx
jge 0x1000acfe
mov dword [ebp - 0x560], 1
jmp 0x1000ad05
and dword [ebp - 0x560], 0
cmp dword [ebp - 0x560], 0x693009c
jge 0x1000ad1d
mov dword [ebp - 0x794], 1
jmp 0x1000ad24
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x794]
add ecx, dword [ebp + eax*4 - 0xa18]
mov dword [ebp - 0x568], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x568]
mov dword [ebp + eax*4 - 0xa18], ecx
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x1c0], 0x48aab564
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x140], 0xb61943ec
mov dword [ebp - 0x290], 0
jmp 0x1000ad8d
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 2
jge 0x1000ada9
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0x394], 0
jmp 0x1000ad80
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x394], 0xd
jmp 0x1000add7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x394]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x394], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x394], 0xffffffe4
jl 0x1000b175
mov dword [ebp - 0x9c], 0xffffffff
mov dword [ebp - 0x318], 0
jmp 0x1000ae0e
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 4
jge 0x1000ae2a
mov eax, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0xecc], 0xffffffff
jmp 0x1000ae01
mov dword [ebp - 0x9c], 0
jmp 0x1000ae43
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jg 0x1000b170
mov dword [ebp - 0x1e0], 1
mov dword [ebp - 0x158], 0x7f4a7d2a
mov dword [ebp - 0x1e0], 3
jmp 0x1000ae7d
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jl 0x1000b14f
mov dword [ebp - 0x1b8], 0x365653d4
mov dword [ebp - 0x1b8], 3
jmp 0x1000aead
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jl 0x1000b14a
mov dword [ebp - 0x298], 0
jmp 0x1000aed3
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 3
jge 0x1000aeef
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0xfa8], 0xb9567464
jmp 0x1000aec6
mov eax, dword [ebp - 0x9c]
cmp dword [ebp + eax*4 - 0xecc], 0
jne 0x1000af96
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov edx, 0x6974
sub edx, dword [ebp + ecx - 0xecc]
cmp dword [ebp + eax - 0x394], edx
jge 0x1000af2f
mov dword [ebp - 0x570], 1
jmp 0x1000af36
and dword [ebp - 0x570], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x394]
cmp dword [ebp - 0x9c], eax
jle 0x1000af57
mov dword [ebp - 0x984], 1
jmp 0x1000af5e
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x984], eax
jne 0x1000af78
mov dword [ebp - 0x79c], 1
jmp 0x1000af7f
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x570]
sub eax, dword [ebp - 0x79c]
jne 0x1000af96
and dword [ebp - 0x578], 0
jmp 0x1000afa0
mov dword [ebp - 0x578], 1
cmp dword [ebp - 0x578], 0x9953
jl 0x1000afb8
mov dword [ebp - 0x8ac], 1
jmp 0x1000afbf
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x5169
jle 0x1000afef
mov dword [ebp - 0x580], 1
jmp 0x1000aff6
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x580], eax
je 0x1000b010
mov dword [ebp - 0x7a4], 1
jmp 0x1000b017
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
sub eax, 0x1162d50c
mov ecx, dword [ebp - 0x9c]
cmp eax, dword [ebp + ecx*4 - 0xecc]
jge 0x1000b049
mov dword [ebp - 0x588], 1
jmp 0x1000b050
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0x588]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x394]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x158], 0
jmp 0x1000b08a
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jg 0x1000b145
mov dword [ebp - 0x10a8], 3
mov dword [ebp - 0x140], 0
jmp 0x1000b0ba
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 4
jge 0x1000b0d6
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0xecc], 0
jmp 0x1000b0ad
mov dword [ebp - 0x168], 3
jmp 0x1000b0ef
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x1000b140
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xfa8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xfa8], eax
mov byte [ebp - 0x114], 0
movzx eax, byte [ebp - 0x114]
test eax, eax
je 0x1000b13e
push 0x1552
push 0
push 0xe08
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
jmp 0x1000b0e2
jmp 0x1000b07d
jmp 0x1000aea0
jmp 0x1000ae70
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1000b16b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1000ae36
jmp 0x1000adbc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x394], 1
jne 0x1000b191
mov dword [ebp - 0x934], 1
jmp 0x1000b198
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x934]
jg 0x1000b1b2
mov dword [ebp - 0xb04], 1
jmp 0x1000b1b9
and dword [ebp - 0xb04], 0
mov dword [ebp - 0x1c0], 0x7bb34e4a
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1c0]
mov dword [ebp + eax - 0x394], ecx
mov dword [ebp - 0x148], 0
jmp 0x1000b1ef
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jg 0x1000be23
mov dword [ebp - 0x190], 0
push 1
lea ecx, [ebp - 0xba4]
call fcn.1001740b
mov dword [ebp - 4], 5
mov dword [ebp - 0xf84], 0
mov dword [ebp - 0x88], 0
jmp 0x1000b23d
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1000b259
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x950], 8
jmp 0x1000b230
mov dword [ebp - 0x88], 0
jmp 0x1000b272
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1000b291
push dword [ebp - 0x88]
lea ecx, [ebp - 0xba4]
call fcn.100174a9
or dword [eax], 0xffffffff
jmp 0x1000b265
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x950], 0
jmp 0x1000b2bf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x950]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x950], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x950], 0x1d
jle 0x1000b4f4
mov dword [ebp - 0x200], 0
push 3
lea ecx, [ebp - 0xe7c]
call fcn.1001740b
mov byte [ebp - 4], 6
mov dword [ebp - 0x3a4], 0
jmp 0x1000b307
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 3
jge 0x1000b329
push dword [ebp - 0x3a4]
lea ecx, [ebp - 0xe7c]
call fcn.100174a9
mov dword [eax], 0x270e7ad5
jmp 0x1000b2fa
mov dword [ebp - 0x200], 0x14
jmp 0x1000b342
mov eax, dword [ebp - 0x200]
dec eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xa
jg 0x1000b4e0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe4], 0
jmp 0x1000b372
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jg 0x1000b4db
mov dword [ebp - 0xb0c], 0x82baef6e
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x1000b3a3
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0xe4]
lea ecx, [ebp - 0xba4]
call fcn.100174a9
cmp dword [eax], 0
je 0x1000b402
push dword [ebp - 0xe4]
lea ecx, [ebp - 0xba4]
call fcn.100174a9
mov dword [ebp - 0x590], eax
push dword [ebp - 0xe4]
lea ecx, [ebp - 0xba4]
call fcn.100174a9
mov ecx, dword [ebp - 0x590]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x590]
cmp dword [eax], 0
je 0x1000b402
mov dword [ebp - 0x598], 1
jmp 0x1000b409
and dword [ebp - 0x598], 0
cmp dword [ebp - 0xb0c], 0
jne 0x1000b448
mov eax, dword [ebp - 0x200]
neg eax
cmp eax, 1
jge 0x1000b42b
mov dword [ebp - 0x7ac], 1
jmp 0x1000b432
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7ac]
add eax, 0xd5de
jne 0x1000b448
and dword [ebp - 0x8b4], 0
jmp 0x1000b452
mov dword [ebp - 0x8b4], 1
mov eax, dword [ebp - 0x598]
cmp eax, dword [ebp - 0x8b4]
je 0x1000b46c
mov dword [ebp - 0x5a0], 1
jmp 0x1000b473
and dword [ebp - 0x5a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x950]
cmp dword [ebp - 0x5a0], eax
je 0x1000b49b
push 9
pop eax
test eax, eax
je 0x1000b49b
mov dword [ebp - 0x7b4], 1
jmp 0x1000b4a2
and dword [ebp - 0x7b4], 0
cmp dword [ebp - 0x7b4], 0x3d3b0cf5
jl 0x1000b4ba
mov dword [ebp - 0x5a8], 1
jmp 0x1000b4c1
and dword [ebp - 0x5a8], 0
push 1
lea ecx, [ebp - 0xe7c]
call fcn.100174a9
mov ecx, dword [ebp - 0x5a8]
mov dword [eax], ecx
jmp 0x1000b365
jmp 0x1000b335
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xe7c]
call fcn.1001748d
jmp 0x1000b2a4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xba4]
call fcn.1001748d
push 2
lea ecx, [ebp - 0xe40]
call fcn.1001740b
mov dword [ebp - 4], 7
mov dword [ebp - 0x1068], 0xe3556834
mov byte [ebp - 0xac], 0
movzx eax, byte [ebp - 0xac]
test eax, eax
je 0x1000b553
push 0
push 0x20b5
push 0x170
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x1000b57b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x2a0], 0
jmp 0x1000b594
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 2
jge 0x1000b5b6
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0xe40]
call fcn.100174a9
mov dword [eax], 0x93046aa1
jmp 0x1000b587
mov dword [ebp - 0x190], 0
jmp 0x1000b5cf
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jg 0x1000be0f
mov dword [ebp - 0x2c], 0x32b1cecb
mov dword [ebp - 0x5b8], 0
mov dword [ebp - 0xb1c], 0xb72b
push 4
lea ecx, [ebp - 0xde0]
call fcn.1001740b
mov byte [ebp - 4], 8
mov dword [ebp - 0xb24], 0xffff
mov dword [ebp - 0x80], 0
jmp 0x1000b622
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x1000b638
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x460], 0
jmp 0x1000b61b
mov dword [ebp - 0x80], 0
jmp 0x1000b648
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x1000b664
push dword [ebp - 0x80]
lea ecx, [ebp - 0xde0]
call fcn.100174a9
mov dword [eax], 9
jmp 0x1000b641
mov dword [ebp - 0x2c], 0
jmp 0x1000b674
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x1000b8e0
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0x320], 0
jmp 0x1000b6a1
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 3
jge 0x1000b6bd
mov eax, dword [ebp - 0x320]
mov dword [ebp + eax*4 - 0xbb4], 0xffffffff
jmp 0x1000b694
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x460]
mov dword [ebp - 0xf8c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x460]
mov dword [ebp - 0x10e8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x460]
mov dword [ebp - 0xf9c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbb4]
mov dword [ebp - 0x1070], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp + ecx*4 - 0x460]
cmp dword [ebp + eax*4 - 0x460], ecx
jl 0x1000b727
mov dword [ebp - 0x9e8], 1
jmp 0x1000b72e
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x2c]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x460]
imul ecx, dword [ebp - 0x9e8]
cmp dword [ebp + eax*4 - 0x460], ecx
jge 0x1000b759
mov dword [ebp - 0x5b0], 1
jmp 0x1000b760
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x5b0], eax
jge 0x1000b797
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbb4], 0
je 0x1000b797
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x460], 0
je 0x1000b797
mov dword [ebp - 0xb14], 1
jmp 0x1000b79e
and dword [ebp - 0xb14], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x460]
mov dword [ebp - 0xfac], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbb4]
mov dword [ebp - 0x10b0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbb4], 0x7f03
jg 0x1000b7e9
cmp dword [ebp - 0x2c], 0
je 0x1000b7e9
mov dword [ebp - 0x7bc], 1
jmp 0x1000b7f0
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x7bc]
lea eax, [eax*4 + 1]
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0xfbc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbb4]
mov dword [ebp - 0x1078], eax
push 0xfffffffffffffffd
pop eax
sub eax, dword [ebp - 0xb1c]
jne 0x1000b848
push 0
lea ecx, [ebp - 0xde0]
call fcn.100174a9
cmp dword [eax], 0
jne 0x1000b848
and dword [ebp - 0x8bc], 0
jmp 0x1000b852
mov dword [ebp - 0x8bc], 1
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x460]
cmp eax, dword [ebp - 0x8bc]
jl 0x1000b870
mov dword [ebp - 0x5c0], 1
jmp 0x1000b877
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x5c0]
sub eax, dword [ebp - 0xb24]
je 0x1000b89e
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x460], 0
je 0x1000b89e
mov dword [ebp - 0xb2c], 1
jmp 0x1000b8a5
and dword [ebp - 0xb2c], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x460]
mov dword [ebp - 0xfcc], eax
mov dword [ebp - 0xb34], 0xad479ea4
mov byte [ebp - 0xb0], 0
movzx eax, byte [ebp - 0xb0]
test eax, eax
je 0x1000b8db
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1000b66d
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x1000b908
push 0
push 0x97a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xde0]
call fcn.1001748d
mov dword [ebp - 0x2a8], 0
jmp 0x1000b930
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 3
jge 0x1000b94c
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0xbc4], 0x973063d6
jmp 0x1000b923
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xbc4], 0
jmp 0x1000b977
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbc4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xbc4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xbc4], 3
jg 0x1000bc8d
mov dword [ebp - 0x1c8], 0x3fa75c1
mov dword [ebp - 0x90], 0
jmp 0x1000b9ad
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1000b9c9
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x17c], 0xc58a
jmp 0x1000b9a0
mov dword [ebp - 0x90], 0
jmp 0x1000b9e2
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x1000b9fe
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xb44], 0x3cef3392
jmp 0x1000b9d5
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1000bbb6
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0xed4], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0xedc], eax
cmp dword [ebp - 0x1c8], 0
jne 0x1000ba43
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x17c], 0
jne 0x1000ba43
and dword [ebp - 0x7c4], 0
jmp 0x1000ba4d
mov dword [ebp - 0x7c4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x17c]
cmp dword [ebp - 0x7c4], eax
je 0x1000ba7e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x17c], 0
je 0x1000ba7e
mov dword [ebp - 0x5c8], 1
jmp 0x1000ba85
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 0x5a65
jge 0x1000bbb6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x17c], 0
je 0x1000bb52
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x17c], 0
je 0x1000bb52
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x17c]
mov dword [ebp - 0xee4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x17c]
mov dword [ebp - 0xeec], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x17c]
cmp dword [ebp + eax - 0x17c], ecx
je 0x1000bb0f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x17c], 0
je 0x1000bb22
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x1000bb22
mov dword [ebp - 0x93c], 1
jmp 0x1000bb29
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x93c]
add eax, 0x3fc2
je 0x1000bb52
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x17c], 0
je 0x1000bb52
mov dword [ebp - 0xb3c], 1
jmp 0x1000bb59
and dword [ebp - 0xb3c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x17c]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0xef4], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb44], 0x6a08376f
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x1000bbb4
push 0x23b7
push 0x1054
push 0
push 0x2f2
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1000bbeb
mov dword [ebp - 0xefc], 0xfffffff8
mov dword [ebp - 0xf04], 0
mov dword [ebp - 0xf0c], 0xb4b26d8f
mov dword [ebp - 0x5d0], 0xea3d8810
mov eax, dword [ebp - 0x5d0]
inc eax
mov dword [ebp - 0x5d0], eax
mov dword [ebp - 0x360], 0xc7ba3f30
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x1000bc14
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov dword [ebp - 0x360], 3
jmp 0x1000bc2d
mov eax, dword [ebp - 0x360]
dec eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0
jl 0x1000bc88
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp - 0xb8]
test eax, eax
je 0x1000bc50
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x1000bc86
push 0
push 0x233
push 0
push 0xba1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
jmp 0x1000bc20
jmp 0x1000b95e
mov dword [ebp - 0x2b0], 0
jmp 0x1000bca6
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 2
jge 0x1000bcc2
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0xcc4], 8
jmp 0x1000bc99
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xcc4], eax
mov byte [ebp - 0xbc], 0
movzx eax, byte [ebp - 0xbc]
test eax, eax
je 0x1000bcfe
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa18], 0xfffffff8
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x1000bd53
mov eax, dword [ebp - 0x190]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xa18]
cmp dword [ebp + eax*4 - 0xa18], ecx
jne 0x1000bd3a
mov dword [ebp - 0x7cc], 1
jmp 0x1000bd41
and dword [ebp - 0x7cc], 0
cmp dword [ebp - 0x7cc], 0
jne 0x1000bd53
and dword [ebp - 0x5d8], 0
jmp 0x1000bd5d
mov dword [ebp - 0x5d8], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x5d8], eax
jg 0x1000bd74
mov dword [ebp - 0x8c4], 1
jmp 0x1000bd7b
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x8c4], eax
jge 0x1000bd95
mov dword [ebp - 0x3c4], 1
jmp 0x1000bd9c
and dword [ebp - 0x3c4], 0
push 0
lea ecx, [ebp - 0xe40]
call fcn.100174a9
mov ecx, dword [ebp - 0x3c4]
mov dword [eax], ecx
cmp dword [ebp - 0x3c4], 0xcaa7
jne 0x1000bdc9
mov dword [ebp - 0x5e0], 1
jmp 0x1000bdd0
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
add eax, 0x71dc
je 0x1000bdef
cmp dword [ebp - 0x18], 0
je 0x1000bdef
mov dword [ebp - 0x7d4], 1
jmp 0x1000bdf6
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x7d4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbc4], eax
jmp 0x1000b5c2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe40]
call fcn.1001748d
jmp 0x1000b1e2
jmp 0x1000ac5f
jmp 0x1000a92e
mov dword [ebp - 0x428], 6
push 2
lea ecx, [ebp - 0x990]
call fcn.1001740b
mov dword [ebp - 4], 9
mov dword [ebp - 0xd08], 0xe8588d0d
mov dword [ebp - 0xd04], 0xe8588d0d
mov dword [ebp - 0xd00], 0xe8588d0d
mov dword [ebp - 0xcfc], 0xe8588d0d
lea ecx, [ebp - 0x3e5]
call fcn.10008b33
push eax
lea eax, [ebp - 0xcf8]
push eax
lea eax, [ebp - 0xd08]
push eax
lea ecx, [ebp - 0x1104]
call fcn.100174b8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x980]
call fcn.10017467
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x3cc], 0x5d3e9973
mov dword [ebp - 0x380], 7
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0xd58], 1
mov dword [ebp - 0xd54], 1
mov dword [ebp - 0xd50], 1
mov dword [ebp - 0xd4c], 1
lea ecx, [ebp - 0x3ed]
call fcn.10008b33
push eax
lea eax, [ebp - 0xd48]
push eax
lea eax, [ebp - 0xd58]
push eax
lea ecx, [ebp - 0x110c]
call fcn.100174b8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xfb8]
call fcn.10017467
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x328], 0
jmp 0x1000bf4e
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 2
jge 0x1000bf70
push dword [ebp - 0x328]
lea ecx, [ebp - 0x990]
call fcn.100174a9
mov dword [eax], 1
jmp 0x1000bf41
push 2
lea ecx, [ebp - 0x980]
call fcn.100174a9
mov dword [ebp - 0x5e8], eax
push 0
lea ecx, [ebp - 0x990]
call fcn.100174a9
mov ecx, dword [ebp - 0x5e8]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x5e8]
sub eax, dword [ecx]
jne 0x1000c11f
push 2
lea ecx, [ebp - 0x980]
call fcn.100174a9
mov dword [ebp - 0x994], eax
push 0
lea ecx, [ebp - 0x990]
call fcn.100174a9
mov ecx, dword [ebp - 0x994]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x994]
cmp dword [eax], 0
je 0x1000c118
push 2
lea ecx, [ebp - 0x980]
call fcn.100174a9
mov eax, 0x6dbc1c23
cmp eax, 0xab79ae4f
je 0x1000c01b
push 2
lea ecx, [ebp - 0x980]
call fcn.100174a9
cmp dword [eax], 0
jne 0x1000c01b
and dword [ebp - 0x5f0], 0
jmp 0x1000c025
mov dword [ebp - 0x5f0], 1
push 0
lea ecx, [ebp - 0x990]
call fcn.100174a9
mov ecx, dword [ebp - 0x5f0]
cmp ecx, dword [eax]
jg 0x1000c048
mov dword [ebp - 0x7dc], 1
jmp 0x1000c04f
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0xf14], eax
push 0
lea ecx, [ebp - 0x990]
call fcn.100174a9
mov eax, 0xac89d73a
cmp eax, 0xfffffff8
je 0x1000c08a
mov dword [ebp - 0xb4c], 1
jmp 0x1000c091
and dword [ebp - 0xb4c], 0
push 1
lea ecx, [ebp - 0x980]
call fcn.100174a9
push 2
lea ecx, [ebp - 0x980]
call fcn.100174a9
mov dword [ebp - 0x5f8], eax
push 0
lea ecx, [ebp - 0x990]
call fcn.100174a9
mov ecx, dword [ebp - 0x5f8]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x5f8]
cmp dword [ecx], eax
jg 0x1000c0e4
mov dword [ebp - 0x8cc], 1
jmp 0x1000c0eb
and dword [ebp - 0x8cc], 0
imul eax, dword [ebp - 0x8cc], 0x7504
mov dword [ebp - 0x380], eax
mov esi, dword [ebp - 0x380]
push 0
lea ecx, [ebp - 0x990]
call fcn.100174a9
add esi, dword [eax]
add esi, dword [ebp - 0x2b8]
jne 0x1000c11f
cmp dword [ebp - 0x18c], 0
mov dword [ebp - 0x2b8], 1
mov dword [ebp - 0x18c], 0
jmp 0x1000c142
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0x2a
jg 0x1000c2b9
mov dword [ebp - 0x19c], 0xfffffff6
mov dword [ebp - 0x40c], 0x39a53aa4
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x428], eax
jle 0x1000c27f
cmp dword [ebp - 0x19c], 4
je 0x1000c18a
mov dword [ebp - 0x600], 1
jmp 0x1000c191
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x40c]
cmp dword [ebp - 0x600], eax
jle 0x1000c1ab
mov dword [ebp - 0x608], 1
jmp 0x1000c1b2
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x7e4], eax
push 2
lea ecx, [ebp - 0x980]
call fcn.100174a9
mov ecx, dword [ebp - 0x7e4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7e4]
imul eax, dword [ebp - 0x608]
cmp eax, dword [ebp - 0x19c]
je 0x1000c1f4
mov dword [ebp - 0xb54], 1
jmp 0x1000c1fb
and dword [ebp - 0xb54], 0
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0xf1c], eax
cmp dword [ebp - 0x380], 0x9ffbdd2a
jne 0x1000c21f
mov dword [ebp - 0x948], 1
jmp 0x1000c226
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x19c]
add eax, dword [ebp - 0x948]
cmp eax, dword [ebp - 0x40c]
jne 0x1000c246
mov dword [ebp - 0xc44], 1
jmp 0x1000c24d
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0xf24], eax
mov esi, dword [ebp - 0x19c]
push 2
lea ecx, [ebp - 0xfb8]
call fcn.100174a9
imul esi, dword [eax]
test esi, esi
je 0x1000c27f
mov dword [ebp - 0x610], 1
jmp 0x1000c286
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x40c]
cmp dword [ebp - 0x610], eax
jge 0x1000c2a0
mov dword [ebp - 0x7ec], 1
jmp 0x1000c2a7
and dword [ebp - 0x7ec], 0
imul eax, dword [ebp - 0x7ec], 5
mov dword [ebp - 0x380], eax
jmp 0x1000c135
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xfb8]
call fcn.1001748d
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x980]
call fcn.1001748d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x990]
call fcn.1001748d
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x1000c30a
push 0xcd8
push 0xc9d
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov dword [ebp - 0xec], 0x13dd33a4
push 1
lea ecx, [ebp - 0xc84]
call fcn.1001740b
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x330], 0xe507
push 1
lea ecx, [ebp - 0xe10]
call fcn.1001740b
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x3d4], 0xffffffff
mov dword [ebp - 0xc54], 0
mov dword [ebp - 0x24], 0
jmp 0x1000c367
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000c37d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc6c], 0xd97a888a
jmp 0x1000c360
mov dword [ebp - 0x24], 0
jmp 0x1000c38d
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000c3a9
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc84]
call fcn.100174a9
mov dword [eax], 0x26128f3b
jmp 0x1000c386
mov dword [ebp - 0x24], 0
jmp 0x1000c3b9
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000c3d2
push dword [ebp - 0x24]
lea ecx, [ebp - 0xe10]
call fcn.100174a9
and dword [eax], 0
jmp 0x1000c3b2
mov dword [ebp - 0xec], 0xfffffff7
jmp 0x1000c3eb
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x15
jl 0x1000c44d
mov dword [ebp - 0x2c0], 1
mov dword [ebp - 0x2c0], 0
jmp 0x1000c417
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 2
jg 0x1000c44b
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x1000c449
push 0xc7b
push 0x815
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
jmp 0x1000c40a
jmp 0x1000c3de
cmp dword [ebp - 0xec], 0
jne 0x1000c5b2
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc6c]
cmp eax, dword [ebp - 0x330]
je 0x1000c488
mov dword [ebp - 0x618], 1
jmp 0x1000c48f
and dword [ebp - 0x618], 0
cmp dword [ebp - 0x618], 2
jge 0x1000c4a4
mov dword [ebp - 0x8d4], 1
jmp 0x1000c4ab
and dword [ebp - 0x8d4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc6c]
cmp dword [ebp - 0x8d4], eax
jg 0x1000c4cb
mov dword [ebp - 0x620], 1
jmp 0x1000c4d2
and dword [ebp - 0x620], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc6c]
cmp dword [ebp - 0x620], eax
jge 0x1000c4fc
cmp dword [ebp - 0x330], 0
je 0x1000c4fc
mov dword [ebp - 0x7f4], 1
jmp 0x1000c503
and dword [ebp - 0x7f4], 0
push 0
lea ecx, [ebp - 0xc84]
call fcn.100174a9
mov ecx, dword [ebp - 0x7f4]
cmp ecx, dword [eax]
jle 0x1000c526
mov dword [ebp - 0x628], 1
jmp 0x1000c52d
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0xec], eax
mov esi, dword [ebp - 0xec]
push 0
lea ecx, [ebp - 0xe10]
call fcn.100174a9
cmp esi, dword [eax]
jge 0x1000c55c
mov dword [ebp - 0x9d4], 1
jmp 0x1000c563
and dword [ebp - 0x9d4], 0
cmp dword [ebp - 0x9d4], 0xfffffffd
jge 0x1000c578
mov dword [ebp - 0xc4c], 1
jmp 0x1000c57f
and dword [ebp - 0xc4c], 0
cmp dword [ebp - 0x3d4], 0xfffffff8
jg 0x1000c594
mov dword [ebp - 0x630], 1
jmp 0x1000c59b
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0xc54]
cmp dword [ebp - 0x630], eax
je 0x1000c5b2
and dword [ebp - 0x7fc], 0
jmp 0x1000c5bc
mov dword [ebp - 0x7fc], 1
push 0
lea ecx, [ebp - 0xc84]
call fcn.100174a9
mov ecx, dword [ebp - 0x7fc]
cmp ecx, dword [eax]
je 0x1000c5df
mov dword [ebp - 0x638], 1
jmp 0x1000c5e6
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x3d4]
imul eax, dword [ebp - 0x638]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xc6c]
jge 0x1000c60e
mov dword [ebp - 0x8dc], 1
jmp 0x1000c615
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x8dc]
mov dword [ebp - 0x3d4], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xe10]
call fcn.1001748d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc84]
call fcn.1001748d
mov dword [ebp - 0xf4], 0x13dd33a4
push 1
lea ecx, [ebp - 0xcb4]
call fcn.1001740b
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x368], 0xe507
push 1
lea ecx, [ebp - 0xe70]
call fcn.1001740b
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x41c], 0xffffffff
mov dword [ebp - 0xa68], 0
mov dword [ebp - 0x1c], 0
jmp 0x1000c69c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1000c6b2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc9c], 0xd97a888a
jmp 0x1000c695
mov dword [ebp - 0x1c], 0
jmp 0x1000c6c2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000c6de
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xcb4]
call fcn.100174a9
mov dword [eax], 0x26128f3b
jmp 0x1000c6bb
mov dword [ebp - 0x1c], 0
jmp 0x1000c6ee
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000c707
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe70]
call fcn.100174a9
and dword [eax], 0
jmp 0x1000c6e7
mov dword [ebp - 0xf4], 0xfffffff7
jmp 0x1000c720
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x15
jl 0x1000c782
mov dword [ebp - 0x2c8], 1
mov dword [ebp - 0x2c8], 0
jmp 0x1000c74c
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 2
jg 0x1000c780
mov byte [ebp - 0xc2], 0
movzx eax, byte [ebp - 0xc2]
test eax, eax
je 0x1000c77e
push 0xc7b
push 0x815
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
jmp 0x1000c73f
jmp 0x1000c713
cmp dword [ebp - 0xf4], 0
jne 0x1000c8e7
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc9c]
cmp eax, dword [ebp - 0x368]
je 0x1000c7bd
mov dword [ebp - 0x640], 1
jmp 0x1000c7c4
and dword [ebp - 0x640], 0
cmp dword [ebp - 0x640], 2
jge 0x1000c7d9
mov dword [ebp - 0x804], 1
jmp 0x1000c7e0
and dword [ebp - 0x804], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc9c]
cmp dword [ebp - 0x804], eax
jg 0x1000c800
mov dword [ebp - 0x648], 1
jmp 0x1000c807
and dword [ebp - 0x648], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc9c]
cmp dword [ebp - 0x648], eax
jge 0x1000c831
cmp dword [ebp - 0x368], 0
je 0x1000c831
mov dword [ebp - 0x954], 1
jmp 0x1000c838
and dword [ebp - 0x954], 0
push 0
lea ecx, [ebp - 0xcb4]
call fcn.100174a9
mov ecx, dword [ebp - 0x954]
cmp ecx, dword [eax]
jle 0x1000c85b
mov dword [ebp - 0x650], 1
jmp 0x1000c862
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0xf4], eax
mov esi, dword [ebp - 0xf4]
push 0
lea ecx, [ebp - 0xe70]
call fcn.100174a9
cmp esi, dword [eax]
jge 0x1000c891
mov dword [ebp - 0x80c], 1
jmp 0x1000c898
and dword [ebp - 0x80c], 0
cmp dword [ebp - 0x80c], 0xfffffffd
jge 0x1000c8ad
mov dword [ebp - 0xc20], 1
jmp 0x1000c8b4
and dword [ebp - 0xc20], 0
cmp dword [ebp - 0x41c], 0xfffffff8
jg 0x1000c8c9
mov dword [ebp - 0x658], 1
jmp 0x1000c8d0
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0xa68]
cmp dword [ebp - 0x658], eax
je 0x1000c8e7
and dword [ebp - 0x8e4], 0
jmp 0x1000c8f1
mov dword [ebp - 0x8e4], 1
push 0
lea ecx, [ebp - 0xcb4]
call fcn.100174a9
mov ecx, dword [ebp - 0x8e4]
cmp ecx, dword [eax]
je 0x1000c914
mov dword [ebp - 0x660], 1
jmp 0x1000c91b
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x41c]
imul eax, dword [ebp - 0x660]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xc9c]
jge 0x1000c943
mov dword [ebp - 0x814], 1
jmp 0x1000c94a
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x41c], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xe70]
call fcn.1001748d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcb4]
call fcn.1001748d
mov dword [ebp - 0x668], 0xffff
mov dword [ebp - 0xa48], 0x874b28e
mov dword [ebp - 0xf2c], 0xf07c70ab
mov dword [ebp - 0xa94], 0
mov dword [ebp - 0x690], 1
mov dword [ebp - 0xf34], 0x714ffd81
mov dword [ebp - 0xf3c], 0x74579933
mov dword [ebp - 0x95c], 0x5e495761
mov dword [ebp - 0xacc], 0xfffffffb
push 2
lea ecx, [ebp - 0x9a0]
call fcn.1001740b
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x3dc], 0x537c
mov dword [ebp - 0x688], 0xfffffffc
mov dword [ebp - 0xad4], 0x6717
mov dword [ebp - 0xa58], 2
mov dword [ebp - 0x2d0], 0
jmp 0x1000ca23
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 2
jge 0x1000ca42
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0x9a0]
call fcn.100174a9
and dword [eax], 0
jmp 0x1000ca16
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0xf48], eax
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x1098], eax
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0x1048], eax
mov esi, dword [ebp - 0xa48]
push 1
lea ecx, [ebp - 0x9a0]
call fcn.100174a9
cmp esi, dword [eax]
jge 0x1000ca89
mov dword [ebp - 0x9a4], 1
jmp 0x1000ca90
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x688]
cmp dword [ebp - 0x9a4], eax
jl 0x1000caaa
mov dword [ebp - 0x670], 1
jmp 0x1000cab1
and dword [ebp - 0x670], 0
push 0
lea ecx, [ebp - 0x9a0]
call fcn.100174a9
mov ecx, dword [ebp - 0x670]
cmp ecx, dword [eax]
jle 0x1000cad4
mov dword [ebp - 0x81c], 1
jmp 0x1000cadb
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0xacc]
cmp dword [ebp - 0x81c], eax
jg 0x1000caf5
mov dword [ebp - 0x678], 1
jmp 0x1000cafc
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x3dc]
dec eax
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
imul eax, dword [ebp - 0x678]
cmp eax, 0x31d26ec1
jne 0x1000cb29
mov dword [ebp - 0x8ec], 1
jmp 0x1000cb30
and dword [ebp - 0x8ec], 0
cmp dword [ebp - 0x8ec], 0xffffffff
jge 0x1000cb45
mov dword [ebp - 0xa50], 1
jmp 0x1000cb4c
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0xf4c], eax
push 1
lea ecx, [ebp - 0x9a0]
call fcn.100174a9
cmp dword [eax], 0
je 0x1000cb7f
cmp dword [ebp - 0x95c], 0
je 0x1000cb7f
mov dword [ebp - 0x680], 1
jmp 0x1000cb86
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x690]
cmp dword [ebp - 0x680], eax
jl 0x1000cba0
mov dword [ebp - 0x824], 1
jmp 0x1000cba7
and dword [ebp - 0x824], 0
push 0
lea ecx, [ebp - 0x9a0]
call fcn.100174a9
mov ecx, dword [ebp - 0x824]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0xa58]
jge 0x1000cbe6
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x1000cbe6
push 0
lea ecx, [ebp - 0x9a0]
call fcn.100174a9
cmp dword [eax], 0
jne 0x1000cbe6
and dword [ebp - 0x414], 0
jmp 0x1000cbf0
mov dword [ebp - 0x414], 1
push 0
lea ecx, [ebp - 0x9a0]
call fcn.100174a9
mov ecx, dword [ebp - 0x414]
mov dword [eax], ecx
mov eax, dword [ebp - 0x688]
cmp dword [ebp - 0x414], eax
jle 0x1000cc1f
mov dword [ebp - 0xadc], 1
jmp 0x1000cc26
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0x690], eax
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x1000cc53
push 0x118b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9a0]
call fcn.1001748d
mov dword [ebp - 0xfc], 0x13dd33a4
push 1
lea ecx, [ebp - 0xca8]
call fcn.1001740b
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x2d8], 0xe507
push 1
lea ecx, [ebp - 0xdd4]
call fcn.1001740b
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x3e4], 0xffffffff
mov dword [ebp - 0xae4], 0
mov dword [ebp - 0x20], 0
jmp 0x1000ccbf
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1000ccd5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc78], 0xd97a888a
jmp 0x1000ccb8
mov dword [ebp - 0x20], 0
jmp 0x1000cce5
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1000cd01
push dword [ebp - 0x20]
lea ecx, [ebp - 0xca8]
call fcn.100174a9
mov dword [eax], 0x26128f3b
jmp 0x1000ccde
mov dword [ebp - 0x20], 0
jmp 0x1000cd11
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1000cd2a
push dword [ebp - 0x20]
lea ecx, [ebp - 0xdd4]
call fcn.100174a9
and dword [eax], 0
jmp 0x1000cd0a
mov dword [ebp - 0xfc], 0xfffffff7
jmp 0x1000cd43
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x15
jl 0x1000cda5
mov dword [ebp - 0x338], 1
mov dword [ebp - 0x338], 0
jmp 0x1000cd6f
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 2
jg 0x1000cda3
mov byte [ebp - 0xc6], 0
movzx eax, byte [ebp - 0xc6]
test eax, eax
je 0x1000cda1
push 0xc7b
push 0x815
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
jmp 0x1000cd62
jmp 0x1000cd36
cmp dword [ebp - 0xfc], 0
jne 0x1000cf0a
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc78]
cmp eax, dword [ebp - 0x2d8]
je 0x1000cde0
mov dword [ebp - 0x82c], 1
jmp 0x1000cde7
and dword [ebp - 0x82c], 0
cmp dword [ebp - 0x82c], 2
jge 0x1000cdfc
mov dword [ebp - 0x698], 1
jmp 0x1000ce03
and dword [ebp - 0x698], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc78]
cmp dword [ebp - 0x698], eax
jg 0x1000ce23
mov dword [ebp - 0x8f4], 1
jmp 0x1000ce2a
and dword [ebp - 0x8f4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc78]
cmp dword [ebp - 0x8f4], eax
jge 0x1000ce54
cmp dword [ebp - 0x2d8], 0
je 0x1000ce54
mov dword [ebp - 0x6a0], 1
jmp 0x1000ce5b
and dword [ebp - 0x6a0], 0
push 0
lea ecx, [ebp - 0xca8]
call fcn.100174a9
mov ecx, dword [ebp - 0x6a0]
cmp ecx, dword [eax]
jle 0x1000ce7e
mov dword [ebp - 0x834], 1
jmp 0x1000ce85
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0xfc], eax
mov esi, dword [ebp - 0xfc]
push 0
lea ecx, [ebp - 0xdd4]
call fcn.100174a9
cmp esi, dword [eax]
jge 0x1000ceb4
mov dword [ebp - 0x6a8], 1
jmp 0x1000cebb
and dword [ebp - 0x6a8], 0
cmp dword [ebp - 0x6a8], 0xfffffffd
jge 0x1000ced0
mov dword [ebp - 0xa60], 1
jmp 0x1000ced7
and dword [ebp - 0xa60], 0
cmp dword [ebp - 0x3e4], 0xfffffff8
jg 0x1000ceec
mov dword [ebp - 0x9f0], 1
jmp 0x1000cef3
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0xae4]
cmp dword [ebp - 0x9f0], eax
je 0x1000cf0a
and dword [ebp - 0x6b0], 0
jmp 0x1000cf14
mov dword [ebp - 0x6b0], 1
push 0
lea ecx, [ebp - 0xca8]
call fcn.100174a9
mov ecx, dword [ebp - 0x6b0]
cmp ecx, dword [eax]
je 0x1000cf37
mov dword [ebp - 0x83c], 1
jmp 0x1000cf3e
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x3e4]
imul eax, dword [ebp - 0x83c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xc78]
jge 0x1000cf66
mov dword [ebp - 0x6b8], 1
jmp 0x1000cf6d
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x3e4], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xdd4]
call fcn.1001748d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca8]
call fcn.1001748d
mov dword [ebp - 0x8fc], 0xffff
mov dword [ebp - 0xb40], 0x874b28e
mov dword [ebp - 0xf50], 0xf07c70ab
mov dword [ebp - 0xaec], 0
mov dword [ebp - 0x854], 1
mov dword [ebp - 0xf58], 0x714ffd81
mov dword [ebp - 0xf60], 0x74579933
mov dword [ebp - 0x6e0], 0x5e495761
mov dword [ebp - 0xa70], 0xfffffffb
push 2
lea ecx, [ebp - 0x9b0]
call fcn.1001740b
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x420], 0x537c
mov dword [ebp - 0x904], 0xfffffffc
mov dword [ebp - 0xa78], 0x6717
mov dword [ebp - 0xb48], 2
mov dword [ebp - 0x398], 0
jmp 0x1000d046
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 2
jge 0x1000d065
push dword [ebp - 0x398]
lea ecx, [ebp - 0x9b0]
call fcn.100174a9
and dword [eax], 0
jmp 0x1000d039
mov eax, dword [ebp - 0x8fc]
mov dword [ebp - 0xf68], eax
mov eax, dword [ebp - 0x8fc]
mov dword [ebp - 0xf70], eax
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xf78], eax
mov esi, dword [ebp - 0xb40]
push 1
lea ecx, [ebp - 0x9b0]
call fcn.100174a9
cmp esi, dword [eax]
jge 0x1000d0ac
mov dword [ebp - 0x6c0], 1
jmp 0x1000d0b3
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x904]
cmp dword [ebp - 0x6c0], eax
jl 0x1000d0cd
mov dword [ebp - 0x844], 1
jmp 0x1000d0d4
and dword [ebp - 0x844], 0
push 0
lea ecx, [ebp - 0x9b0]
call fcn.100174a9
mov ecx, dword [ebp - 0x844]
cmp ecx, dword [eax]
jle 0x1000d0f7
mov dword [ebp - 0x6c8], 1
jmp 0x1000d0fe
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0xa70]
cmp dword [ebp - 0x6c8], eax
jg 0x1000d118
mov dword [ebp - 0x964], 1
jmp 0x1000d11f
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x420]
dec eax
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
imul eax, dword [ebp - 0x964]
cmp eax, 0x31d26ec1
jne 0x1000d14c
mov dword [ebp - 0x6d0], 1
jmp 0x1000d153
and dword [ebp - 0x6d0], 0
cmp dword [ebp - 0x6d0], 0xffffffff
jge 0x1000d168
mov dword [ebp - 0xc24], 1
jmp 0x1000d16f
and dword [ebp - 0xc24], 0
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0xf80], eax
push 1
lea ecx, [ebp - 0x9b0]
call fcn.100174a9
cmp dword [eax], 0
je 0x1000d1a2
cmp dword [ebp - 0x6e0], 0
je 0x1000d1a2
mov dword [ebp - 0x84c], 1
jmp 0x1000d1a9
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x854]
cmp dword [ebp - 0x84c], eax
jl 0x1000d1c3
mov dword [ebp - 0x6d8], 1
jmp 0x1000d1ca
and dword [ebp - 0x6d8], 0
push 0
lea ecx, [ebp - 0x9b0]
call fcn.100174a9
mov ecx, dword [ebp - 0x6d8]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0xb48]
jge 0x1000d209
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x1000d209
push 0
lea ecx, [ebp - 0x9b0]
call fcn.100174a9
cmp dword [eax], 0
jne 0x1000d209
and dword [ebp - 0x3ec], 0
jmp 0x1000d213
mov dword [ebp - 0x3ec], 1
push 0
lea ecx, [ebp - 0x9b0]
call fcn.100174a9
mov ecx, dword [ebp - 0x3ec]
mov dword [eax], ecx
mov eax, dword [ebp - 0x904]
cmp dword [ebp - 0x3ec], eax
jle 0x1000d242
mov dword [ebp - 0xa80], 1
jmp 0x1000d249
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x854], eax
mov byte [ebp - 0xc8], 0
movzx eax, byte [ebp - 0xc8]
test eax, eax
je 0x1000d276
push 0x118b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9b0]
call fcn.1001748d
mov dword [ebp - 0xc08], 0x2afe
mov dword [ebp - 0x58], 0xfffffff8
mov dword [ebp - 0x48], 0x5c5735e4
mov dword [ebp - 0x220], 0xd8a94b2a
mov dword [ebp - 0x700], 0xffffffff
mov dword [ebp - 0x340], 2
mov dword [ebp - 0xa88], 0xfffffffb
mov eax, dword [ebp - 0xc08]
mov dword [ebp - 0xf88], eax
mov dword [ebp - 0x58], 8
cmp dword [ebp - 0x58], 0
je 0x1000d31d
xor eax, eax
jne 0x1000d2f8
mov dword [ebp - 0x58], 1
cmp dword [ebp - 0x58], 0
jne 0x1000d2f8
and dword [ebp - 0x6e8], 0
jmp 0x1000d302
mov dword [ebp - 0x6e8], 1
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x1000d31d
mov dword [ebp - 0x9b4], 1
jmp 0x1000d324
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x9b4]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x1000d51c
mov dword [ebp - 0xb50], 0xffffffff
mov dword [ebp - 0x2e0], 0
jmp 0x1000d360
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 4
jge 0x1000d37c
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0xcd4], 1
jmp 0x1000d353
mov dword [ebp - 0x48], 0
jmp 0x1000d38c
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x18
jne 0x1000d3b5
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x1000d3b3
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x1000d385
or eax, 0xffffffff
je 0x1000d3ee
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcd4]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1044], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x104c], eax
push 0xfffffffffffffff8
pop eax
dec eax
je 0x1000d3ee
mov dword [ebp - 0x6f0], 1
jmp 0x1000d3f5
and dword [ebp - 0x6f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcd4]
cmp dword [ebp - 0x6f0], eax
jl 0x1000d416
mov dword [ebp - 0x474], 1
jmp 0x1000d41d
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
add eax, 9
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xcd4]
cmp eax, 0xc36b
jg 0x1000d446
mov dword [ebp - 0x6f8], 1
jmp 0x1000d44d
and dword [ebp - 0x6f8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xcd4]
cmp dword [ebp - 0x6f8], eax
je 0x1000d46d
mov dword [ebp - 0x90c], 1
jmp 0x1000d474
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x700]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0x48], eax
jge 0x1000d4a3
mov dword [ebp - 0x864], 1
jmp 0x1000d4aa
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0xa88]
cmp dword [ebp - 0x864], eax
jl 0x1000d4c4
mov dword [ebp - 0x708], 1
jmp 0x1000d4cb
and dword [ebp - 0x708], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcd4]
imul eax, dword [ebp - 0x708]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
sub eax, 0xcc0e
je 0x1000d507
cmp dword [ebp - 0x340], 0
je 0x1000d507
mov dword [ebp - 0x96c], 1
jmp 0x1000d50e
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0xb50], eax
jmp 0x1000d584
mov dword [ebp - 0x58], 0xd
jmp 0x1000d52c
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jg 0x1000d584
mov dword [ebp - 0xa90], 0x32f82966
mov dword [ebp - 0x340], 0x71d0c0b8
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0xa90], eax
mov byte [ebp - 0xcc], 0
movzx eax, byte [ebp - 0xcc]
test eax, eax
je 0x1000d582
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x1000d525
movzx eax, byte [0x106794f8]
test eax, eax
je 0x1000d5a2
mov esi, 0x1008d834
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10011346
mov dword [ebp - 0x710], 0xffff
mov dword [ebp - 0xa98], 0x874b28e
mov dword [ebp - 0x1054], 0xf07c70ab
mov dword [ebp - 0xc2c], 0
mov dword [ebp - 0x4a4], 1
mov dword [ebp - 0x105c], 0x714ffd81
mov dword [ebp - 0x1064], 0x74579933
mov dword [ebp - 0x49c], 0x5e495761
mov dword [ebp - 0xb58], 0xfffffffb
push 2
lea ecx, [ebp - 0x9c0]
call fcn.1001740b
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x3fc], 0x537c
mov dword [ebp - 0x494], 0xfffffffc
mov dword [ebp - 0xc18], 0x6717
mov dword [ebp - 0xaa8], 2
mov dword [ebp - 0x228], 0
jmp 0x1000d651
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x1000d670
push dword [ebp - 0x228]
lea ecx, [ebp - 0x9c0]
call fcn.100174a9
and dword [eax], 0
jmp 0x1000d644
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0x106c], eax
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0x1074], eax
mov eax, dword [ebp - 0xc2c]
mov dword [ebp - 0x107c], eax
mov esi, dword [ebp - 0xa98]
push 1
lea ecx, [ebp - 0x9c0]
call fcn.100174a9
cmp esi, dword [eax]
jge 0x1000d6b7
mov dword [ebp - 0x86c], 1
jmp 0x1000d6be
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x494]
cmp dword [ebp - 0x86c], eax
jl 0x1000d6d8
mov dword [ebp - 0x718], 1
jmp 0x1000d6df
and dword [ebp - 0x718], 0
push 0
lea ecx, [ebp - 0x9c0]
call fcn.100174a9
mov ecx, dword [ebp - 0x718]
cmp ecx, dword [eax]
jle 0x1000d702
mov dword [ebp - 0x720], 1
jmp 0x1000d709
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0xb58]
cmp dword [ebp - 0x720], eax
jg 0x1000d723
mov dword [ebp - 0x478], 1
jmp 0x1000d72a
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x3fc]
dec eax
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x3fc]
imul eax, dword [ebp - 0x478]
cmp eax, 0x31d26ec1
jne 0x1000d757
mov dword [ebp - 0x47c], 1
jmp 0x1000d75e
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 0xffffffff
jge 0x1000d773
mov dword [ebp - 0xaa0], 1
jmp 0x1000d77a
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0xc18]
mov dword [ebp - 0xed0], eax
push 1
lea ecx, [ebp - 0x9c0]
call fcn.100174a9
cmp dword [eax], 0
je 0x1000d7ad
cmp dword [ebp - 0x49c], 0
je 0x1000d7ad
mov dword [ebp - 0x484], 1
jmp 0x1000d7b4
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x484], eax
jl 0x1000d7ce
mov dword [ebp - 0x48c], 1
jmp 0x1000d7d5
and dword [ebp - 0x48c], 0
push 0
lea ecx, [ebp - 0x9c0]
call fcn.100174a9
mov ecx, dword [ebp - 0x48c]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0xaa8]
jge 0x1000d814
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x1000d814
push 0
lea ecx, [ebp - 0x9c0]
call fcn.100174a9
cmp dword [eax], 0
jne 0x1000d814
and dword [ebp - 0x3f4], 0
jmp 0x1000d81e
mov dword [ebp - 0x3f4], 1
push 0
lea ecx, [ebp - 0x9c0]
call fcn.100174a9
mov ecx, dword [ebp - 0x3f4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x494]
cmp dword [ebp - 0x3f4], eax
jle 0x1000d84d
mov dword [ebp - 0xb68], 1
jmp 0x1000d854
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x4a4], eax
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x1000d881
push 0x118b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c0]
call fcn.1001748d
mov dword [ebp - 0x108c], 0x1008d834
mov dword [ebp - 0xab0], 0x2afe
mov dword [ebp - 0x44], 0xfffffff8
mov dword [ebp - 0x3c], 0x5c5735e4
mov dword [ebp - 0x23c], 0xd8a94b2a
mov dword [ebp - 0x4dc], 0xffffffff
mov dword [ebp - 0x244], 2
mov dword [ebp - 0xc34], 0xfffffffb
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0x1094], eax
mov dword [ebp - 0x44], 8
cmp dword [ebp - 0x44], 0
je 0x1000d932
xor eax, eax
jne 0x1000d90d
mov dword [ebp - 0x44], 1
cmp dword [ebp - 0x44], 0
jne 0x1000d90d
and dword [ebp - 0x4ac], 0
jmp 0x1000d917
mov dword [ebp - 0x4ac], 1
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x1000d932
mov dword [ebp - 0x4b4], 1
jmp 0x1000d939
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x1000db31
mov dword [ebp - 0xab8], 0xffffffff
mov dword [ebp - 0x234], 0
jmp 0x1000d975
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 4
jge 0x1000d991
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0xcf4], 1
jmp 0x1000d968
mov dword [ebp - 0x3c], 0
jmp 0x1000d9a1
cmp dword [ebp - 0x3c], 0x18
jne 0x1000d9ca
mov byte [ebp - 0xab], 0
movzx eax, byte [ebp - 0xab]
test eax, eax
je 0x1000d9c8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x1000d99a
or eax, 0xffffffff
je 0x1000da03
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcf4]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x109c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10a4], eax
push 0xfffffffffffffff8
pop eax
dec eax
je 0x1000da03
and dword [ebp - 0x4bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcf4]
cmp dword [ebp - 0x4bc], eax
jl 0x1000da2b
mov dword [ebp - 0x44], 0xd
jmp 0x1000db41
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x1000db99
mov dword [ebp - 0xb78], 0x32f82966
mov dword [ebp - 0x244], 0x71d0c0b8
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0xb78], eax
mov byte [ebp - 0x116], 0
movzx eax, byte [ebp - 0x116]
test eax, eax
je 0x1000db97
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x1000db3a
mov dword [ebp - 0x10ac], 0x1008d838
mov dword [ebp - 0x1b4], 0x48aab564
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x124], 0xb61943ec
mov dword [ebp - 0x24c], 0
jmp 0x1000dbda
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x1000dbf6
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x3a0], 0
jmp 0x1000dbcd
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3a0], 0xd
jmp 0x1000dc24
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a0], 0xffffffe4
jl 0x1000dfc2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret