Function at 0x10006d97
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
mov eax, dword [esi + 0xc0]
mov dword [ebp - 0x14], ebx
cmp eax, ebx
mov dword [ebp - 0x2c], ebx
call fcn.100059d3
sub ebx, eax
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10003765
cmp eax, ecx
jae 0x10003747
mov edx, dword [esp + 4]
sub edx, dword [eax + 0xc]
cmp edx, 0x1000b810
jb 0x1000371f
add eax, 0x14
xor eax, eax
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp - 0x34]
call fcn.1000324f
mov byte [ebp - 0x78], 0x9c
push dword [ebp - 0x38]
call fcn.1000324f
mov dword [ebp - 0x70], edi
xor eax, ebx
call fcn.10003ed3
cmp dword [ebp - 0x6c], 0x10000002
jne 0x100037ba
cmp eax, dword [ebp + 8]
push 0x32
mov esi, eax
pop ecx
jne 0x100037c2
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
lea eax, [edx + ecx]
cmp ecx, eax
je 0x100037dc
mov edi, dword [ebp + 8]
add dword [ebp + 8], ebx
mov esi, dword [ebp + 0x10]
cmp dword [ebp + 8], eax
push 0x32
pop ecx
jne 0x100037ce
mov esi, dword [ebp - 4]
push dword [ebp - 0x28]
call fcn.1000324f
sub eax, ebx
push dword [ebp - 0x28]
call fcn.1000324f
or esi, edi
mov dword [ebp - 0x7c], ebx
push dword [ebp - 0x34]
call fcn.1000324f
or eax, dword [ebp - 0x54]
or eax, dword [ebp - 0x7c]
push dword [ebp - 0x38]
call fcn.1000324f
and ecx, dword [ebp - 0x78]
call fcn.1000469f
add ebx, ecx
and ecx, dword [ebp - 0x70]
lea edi, [ebp - 0x28]
push edi
call fcn.10003290
add edi, ecx
push dword [ebp - 0x28]
call fcn.1000324f
cmp dword [ebp - 0x24], 0x10000002
jne 0x10003840
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.OLEAUT32.dll_VarR8FromUI1]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], esi
cmp dword [eax + 0x10], esi
jbe 0x10003895
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x38]
push dword [ecx + eax + 8]
lea ecx, [ebp - 0x28]
call 0x10007232
mov ecx, dword [ebp - 0x28]
push dword [ebp - 0x38]
call fcn.1000324f
lea ebx, [eax + ecx*2 + 0x712]
xor eax, ebx
mov ecx, dword [ebp - 0x34]
lea esi, [ebp - 0x38]
or ebx, edi
add edi, dword [ebp - 0x7c]
push esi
xor edi, dword [ebp - 0x8c]
lea edi, [edx]
push ecx
xor ebx, dword [ebp - 0x40]
cmp dword [ebp - 0x24], 0
je 0x100038c3
add ecx, 0x1000be0b
mov ecx, dword [ebp - 0x10]
add ecx, 0x1000bdf0
mov ecx, dword [ebp - 0x10]
add ecx, 0x1000b605
mov ecx, dword [ebp - 0x10]
add ecx, 0x1000b881
mov ecx, dword [ebp - 0x10]
add ecx, 0x1000bab1
mov eax, 0x1000b2a4
lea ecx, [ebp - 0x28]
mov eax, 0x1000bfea
call fcn.10003302
cmp dword [ebp - 0x6c], 0x10000002
jne 0x100038ee
cmp dword [ebp + 0xc], ecx
jne 0x10003931
pop edi
pop esi
pop ebx
push esi
mov esi, dword [esp + 8]
push edi
or edi, 0xffffffff
mov eax, dword [esi + 0xc]
test al, 0x40
je 0x1000388c
or eax, 0xffffffff
test al, 0x83
push dword [ebp - 0x38]
call fcn.1000324f
cmp dword [ebp - 0x6c], 1
je 0x10003911
lea esi, [ebp - 0x38]
mov dword [ebp - 0x58], 0xb33
push esi
test dword [ebp - 0x24], 0
je 0x10003953
mov ecx, dword [eax]
mov eax, dword [ecx - 8]
mov edx, dword [ecx - 4]
mov eax, dword [esp + 4]
add dword [eax], 4
mov eax, dword [eax]
mov ax, word [eax - 4]
mov eax, dword [0x1000b223]
test eax, eax
je 0x1000396c
push dword [esp + 4]
call eax
test eax, eax
pop ecx
je 0x100038d8
push 1
pop eax
xor eax, eax
push dword [ebp - 0x38]
lea edx, [edi]
call fcn.10003467
mov byte [ebp - 0x8c], 0xbf
push dword [ebp - 0x38]
call fcn.1000324f
and edi, dword [ebp - 0x40]
xor ecx, dword [ebp - 0x58]
mov esi, dword [ebp - 0x28]
lea edi, [ebp - 0x34]
and eax, edx
add eax, dword [ebp - 0x88]
push edi
cmp dword [ebp - 0x24], 0x6b
jne 0x100039aa
cmp dword [esi], ecx
push ecx
jle 0x100039c9
push 1
push ecx
push 0x1000b389
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
add byte [eax], dl
pop esi
mov edx, dword [esp + 4]
xor al, al
shr edx, 0x10
test dx, dx
jne 0x10003a14
push esi
mov dword [ebp - 0x58], edi
call fcn.10003302
test dword [ebp - 0x24], 0
je 0x100039ea
call fcn.1000403c
test eax, eax
pop ecx
cmp al, bl
pop ecx
je 0x10003950
push ebx
push dword [esp + 0x38]
push 0x1000be3f
push ebp
call esi
mov byte [esp + 0x13], 1
inc dword [esp + 0x34]
push ebx
push dword [esp + 0x38]
push 0x1000bdfb
push ebp
push dword [ebp - 0x34]
call fcn.1000324f
mov eax, esi
sub edi, ecx
push dword [ebp - 0x34]
call fcn.1000324f
cmp dword [ebp - 0x6c], 0xffffffba
jne 0x10003a2a
push edi
push esi
call 0x1000497f
pop ecx
mov edi, dword [ebp + 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 8], ecx
dec eax
je 0x10003a46
sub eax, 0x10e
jne 0x10003a50
mov eax, dword [edi + 0x1c]
push eax
push esi
mov dword [ebp + 8], eax
and eax, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x70]
mov edi, dword [ebp - 0x64]
add dword [ebp - 0x48], esi
push dword [edi]
xor dword [ebp - 0x78], 0x1ef
add dword [ebp - 0x64], 8
sub esi, dword [ebp - 0x88]
or edx, dword [ebp - 0x78]
ret
mov dword [ebp - 0x3c], ebx
add ecx, dword [ebp - 0x58]
or edi, dword [ebp - 0x70]
add edi, eax
sub dword [ebp - 0x64], 4
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10003a84
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
mov eax, 0x1000b3f9
lea ecx, [ebp - 0x14]
mov eax, 0x1000b281
int3
mov eax, dword [ebp - 0x64]
or esi, dword [ebp - 0x88]
and edi, dword [ebp - 0x88]
pop dword [eax]
push dword [ebp - 0x30]
call fcn.1000324f
and dword [ebp - 0x48], edi
cmp dword [ebp - 0x6c], 1
je 0x10003ad4
push esi
call dword [ebp + 8]
test eax, eax
jne 0x10003aca
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1000bad6
call fcn.10007fde
pop ecx
push ebx
push 0
call fcn.10005772
pop ecx
pop ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x64]
lea ebx, [ebp - 0x30]
or eax, ebx
push ebx
add edi, dword [ebp - 0x58]
push ecx
add word [ebp - 0x80], 0xb9e
call fcn.10003302
sub esi, dword [ebp - 0x70]
push dword [ebp - 0x38]
call fcn.1000324f
and ecx, dword [ebp - 0x3c]
push dword [ebp - 0x34]
call fcn.1000324f
add dword [ebp - 0x88], edi
sub ebx, dword [ebp - 0x84]
mov edi, dword [ebp - 0x64]
add esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x28]
add dword [ebp - 0x24], 0
je 0x10003b3f
mov ecx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], edi
call fcn.100055f7
mov esi, eax
mov eax, dword [ebp + 8]
sub eax, 0x6b1
mov dword [ebp - 0x28], esi
je 0x10006266
dec eax
sub edi, 0x10
add eax, edx
mov edx, dword [edi + 0x1c]
mov dword [ebp - 0x28], edx
and ecx, dword [ebp - 0x80]
cmp dword [ebp - 0x24], 0x56
jne 0x10003b8e
push eax
call fcn.10005fd4
push dword [ebp + 0xc]
call fcn.100045ab
push eax
lea eax, [ebp - 0x1d0]
push dword [ebp + 0xc]
push eax
call 0x1000637c
add esp, 0x1c
cmp dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
jle 0x10003b82
cmp byte [ebp - 1], 0
jne 0x10003baf
mov eax, dword [esi + 4]
add eax, ebx
push eax
lea eax, [ebp - 0x1d0]
mov edi, dword [ebp - 0x28]
mov ecx, ebx
xor word [ebp - 0x28], di
add ecx, 0xba50
mov esi, dword [ebp - 0x28]
lea edx, [ebp - 0x34]
or eax, dword [ebp - 0x88]
cmp dword [ebp - 0x24], 0xffffffe0
jne 0x10003be1
mov dword [ebp + 0x110], ebx
push dword [esp + 0x14]
call esi
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x108]
mov ecx, dword [ebp + 0x30]
push eax
push ecx
call edi
push ebx
push eax
call esi
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x104]
mov ecx, dword [ebp + 0x30]
push eax
push ecx
push edx
mov dword [ebp - 0x58], edx
push esi
add esi, ebx
call fcn.10003302
mov dword [ebp - 0x84], 0x784
lea ecx, [ecx - 0x71]
cmp dword [ebp - 0x6c], 1
je 0x10003c25
pop ecx
test eax, eax
pop ecx
jl 0x10003bca
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x10003c04
mov eax, 0x1000b552
push eax
call fcn.10005a34
test eax, eax
pop ecx
je 0x10003bca
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
mov esi, dword [ebp - 0x30]
xor ebx, edi
mov edi, dword [ebp - 0x34]
and edx, dword [ebp - 0x84]
cmp dword [ebp - 0x6c], 0x7f
jne 0x10003c6a
test bl, bl
pop ebx
jne 0x10003c8c
test ecx, ecx
je 0x10003c0b
call fcn.100069ba
test ecx, ecx
je 0x10003c60
call 0x100046b2
push 0
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
mov dword fs:[0], ecx
push ebp
sub esi, 0x24
cmp dword [ebp - 0x24], 0xfffffff4
jne 0x10003c9c
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call ebp
mov eax, dword [esi + 0x30]
push 0x1000b426
push eax
call edi
push dword [esi + 0x7c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push 0x1000bf32
add edi, dword [esi + 0x2c]
mov dword [ebp - 0x34], edi
or ebx, eax
lea edx, [edx - 0x17]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x7c], eax
mov edx, dword [ebp - 0x38]
xor dword [ebp - 0x4c], 0xfffffffe
sub esi, 4
mov ebx, edi
sub eax, dword [ebp - 0x54]
mov edx, dword [esi + 0x3c]
mov dword [ebp - 0x38], edx
and dword [ebp - 0x7c], 0x55
add edi, 0x7c14
and dword [ebp - 0x7c], eax
cmp dword [ebp - 0x38], 0x161a07ab
je 0x10003d94
mov ebx, ecx
cmp dword [ebp - 0x24], 0x10000002
jne 0x10003d1f
pop edi
push edi
push 0
push eax
call 0x10005bbc
mov eax, dword [0x1000bb9b]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0x88
add esp, 0x18
mov ecx, dword [eax + 4]
mov eax, dword [ebx + 0x14]
test eax, eax
mov edi, 0x1000ba43
jne 0x10003d06
mov eax, edi
push ecx
push eax
call fcn.10005113
cmp dword [ebx + 0x58], 0
sub dword [ebp - 0x28], 0x10000
cmp dword [ebp - 0x6c], 1
je 0x10003d4d
push 0x1000b7e1
push eax
jmp 0x10003b9d
lea eax, [eax + 0x191e]
lea eax, [ebp - 0x34]
push eax
call fcn.10003290
add word [ebp - 0x70], 0x13d
add dword [ebp - 0x78], eax
lea edi, [ebp - 0x38]
push edi
call fcn.10003290
cmp dword [ebp - 0x24], 0x49
jne 0x10003dea
cmp dword [0x1000bdd0], ebx
jle 0x10003da9
mov eax, dword [0x1000b7e2]
mov esi, dword [esi + 0x14]
cmp esi, ebx
mov eax, dword [eax + 4]
jne 0x10003e16
mov esi, 0x1000be44
push eax
lea eax, [ebp - 0x104]
push 0x1000b9d2
push eax
push 0x1000b870
push esi
mov esi, dword [ebp - 0x30]
lea ebx, [ebx + 0x1e15]
test dword [ebp - 0x24], 0
je 0x10003e25
cmp byte [ebp - 0xd], 0
mov eax, dword [ebp - 0x2c]
je 0x10003e07
mov dword [eax], edi
mov word [eax], di
inc byte [ebp - 0x15]
inc dword [ebp + 0xc]
mov esi, dword [ebp + 0xc]
inc dword [ebp - 4]
push edi
call 0x10003e4e
mov ebx, eax
pop ecx
movzx eax, byte [esi]
inc esi
cmp eax, ebx
mov dword [ebp - 0x64], esi
or dword [ebp - 0x54], edx
xor dword [ebp - 0x50], esi
lea edi, [ebp - 0x30]
push edi
call fcn.10003290
add eax, 0x10e
add ecx, 0xa742
mov ebx, edi
mov edi, dword [ebp - 0x64]
cmp dword [ebp - 0x24], 0x7f
jne 0x10003e7e
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov ecx, dword [0x1000b917]
test ecx, ecx
jne 0x10003e22
xor eax, eax
mov eax, dword [0x1000b86d]
sub eax, ecx
sar eax, 3
xor edx, edx
push esi
test eax, eax
push edi
jle 0x10003e1e
lea esi, [ecx + 4]
push dword [edi]
xor ebx, dword [ebp - 0x48]
add ebx, edx
add dword [ebp - 0x64], 8
sub eax, ecx
xor edx, eax
ret
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x100044a9
mov eax, edi
push ecx
lea ecx, [ebp - 0x14c]
push esi
push ecx
push 0x1000bcb0
push eax
mov dword [ebp - 0x64], esp
or dword [ebp - 0x80], edi
mov esp, dword [ebp - 0x74]
xor dword [ebp - 0x54], 0x46
sub esi, dword [ebp - 0x7c]
mov dword [ebp - 0x50], esi
mov ecx, dword [ebp - 0x30]
or dword [ebp - 0x88], 0x79
mov ebx, dword [ebp - 0x28]
cmp dword [ebp - 0x6c], 1
je 0x100044cf
push eax
push 0x1000bc87
push dword [ebp - 4]
call edi
mov edi, dword [esi + 0xa8]
mov dword [ebp - 0x1c], eax
cmp edi, dword [esi + 0xac]
je 0x10006fbf
mov eax, dword [edi]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10004462
mov ecx, dword [eax]
push eax
sub ecx, 0x28
add dword [ebp - 0x24], 0
je 0x100044fe
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov dword [ecx + 0x24], ebx
add dword [ebp - 0x24], 0
je 0x1000452c
sub esp, 0x5c
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x5c]
push 1
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x6c], 0x50
jne 0x1000455f
mov eax, 0x1000bed5
inc edx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov ecx, dword [0x1000b3f8]
test ecx, ecx
jne 0x100044dc
xor eax, eax
mov eax, dword [0x1000b2aa]
sub eax, ecx
sar eax, 3
xor edx, edx
mov edi, dword [ebp - 0x30]
or word [ebp - 0x4c], 0x9db
mov eax, dword [ebp - 0x28]
lea ebx, [ebx]
sub edi, 8
test dword [ebp - 0x24], 0
je 0x1000459f
mov eax, ecx
sub eax, 0x20
je 0x10004515
sub eax, 0x20
je 0x1000453e
sub eax, 0x40
jne 0x10007bfa
mov edi, 0x1000b58c
mov edi, 0x1000bf2b
mov edi, 0x1000bbda
mov ebx, edx
mov eax, dword [edi + 4]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x6c], 1
je 0x100045c3
xor dword [ebp - 0x48], ebx
lea ecx, [ebp - 0x60]
push ecx
call fcn.10003290
add eax, 0x2399
xor dword [ebp - 0x58], edx
lea edi, [ebp - 0x34]
push edi
call fcn.10003290
or ecx, esi
and esi, dword [ebp - 0x4c]
lea edx, [ebp - 0x38]
push edx
call fcn.10003290
mov word [ebp - 0x88], 0x88b
and dword [ebp - 0x80], ecx
mov ecx, dword [ebp - 0x30]
and edx, eax
xor edx, edi
mov dword [ebp - 0x64], ecx
or edx, ebx
cmp dword [ebp - 0x24], 0xfffffff9
jne 0x1000465d
lea ecx, [esi + 0xb8]
mov byte [ebp - 4], 1
call fcn.10003fb3
mov dword [esi + 0x100], edi
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 3
mov dword [esi + 0xb4], eax
mov eax, dword [ebp + 0xc]
cmp eax, edi
mov dword [esi], 0x467320
mov dword [esi + 0x80], 0x467318
mov dword [esi + 0x34], 1
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
lea edx, [ebp - 0x30]
push edx
call fcn.10003290
add dword [ebp - 0x24], 0
je 0x10004684
xor dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x64]
add edx, dword [ebp - 0x58]
push dword [eax]
mov dword [ebp - 0x3c], esi
add dword [ebp - 0x64], 0xc
sub esi, ecx
ret
xor ebx, dword [ebp - 0x48]
xor edx, dword [ebp - 0x4c]
push ecx
add dword [ebp - 0x58], esi
call fcn.10003302
sub ecx, dword [ebp - 0x54]
add dword [ebp - 0x64], 0xfffffff8
cmp dword [ebp - 0x6c], 0x6e
jne 0x10004739
push dword [ebp - 0x38]
call fcn.1000324f
add edi, dword [ebp - 0x70]
mov dword [ebp - 0x84], ecx
push dword [ebp - 0x34]
call fcn.1000324f
mov ebx, edi
add ecx, 0x714a
push dword [ebp - 0x44]
call fcn.1000324f
or ecx, dword [ebp - 0x58]
push dword [ebp - 0x5c]
call fcn.1000324f
and esi, dword [ebp - 0x58]
and ecx, edi
push dword [ebp - 0x60]
call fcn.1000324f
mov dword [ebp - 0x3c], edx
add edx, dword [ebp - 0x8c]
or dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x30]
sub edx, dword [ebp - 0x54]
mov ebx, dword [ebp - 0x44]
add dword [ebp - 0x7c], 0x4b
sub eax, 0x20
and esi, dword [ebp - 0x40]
and ecx, dword [ebp - 0x58]
mov ebx, dword [eax + 0x28]
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x6c], 1
je 0x100047bf
cmp dword [ebp - 0x24], 0x10000002
jne 0x100047e6
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 0x40], 0xa3
mov esi, dword [ebp - 0x34]
mov byte [ebp - 0x84], 0x25
sub ecx, 0x10
and eax, edx
xor dword [ebp - 0x4c], 0x6de
mov esi, dword [ecx + 0x1c]
mov dword [ebp - 0x34], esi
and dword [ebp - 0x78], ecx
cmp dword [ebp - 0x6c], 1
je 0x1000484c
mov eax, dword [ebp - 0x44]
sub esi, dword [ebp - 0x7c]
cmp dword [ebp - 0x6c], 0x10000002
jne 0x1000487b
push eax
push edi
push dword [ebx + 0x1ac]
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x10]
lea esi, [ebx + 0xa4]
push eax
push edi
push 0x1000b747
push dword [esi]
mov esi, dword [ebp - 0x34]
cmp dword [ebp - 0x24], 0x10000002
jne 0x100048bd
lea ecx, [esi + 0x144]
call 0x10004532
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call 0x1000732c
test eax, eax
je 0x100048db
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [esi + 0x1cc], eax
mov dword [esi + 0x1cc], 0x10
and dword [ebp - 0x14], 0
sub eax, 0x3c
xor edx, edi
cmp dword [ebp - 0x24], 0x10000002
jne 0x1000490a
mov al, byte [ebp + 0xb]
lea ecx, [esi + 0x68]
xor ebx, ebx
mov byte [ecx], al
mov al, byte [ebp + 0xb]
mov dword [ebp - 4], ebx
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.10008081
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x46755c
mov dword [esi + 0x34], 1
mov eax, dword [0x1000bcda]
mov eax, dword [eax + 4]
mov dword [esi + 0x64], ebx
mov dword [esi + 0x60], eax
mov dword [esi + 0x78], ebx
mov byte [esi + 0x7c], bl
add esi, dword [eax + 0x58]
mov dword [ebp - 0x34], esi
add edi, 0x885d
or edx, edi
mov edi, eax
mov eax, dword [ebp - 0x30]
mov ecx, ebx
cmp dword [ebp - 0x6c], 1
je 0x10004942
mov dword [ebp - 4], esi
add eax, 3
and al, 0xfc
call fcn.100077c4
mov dword [ebp - 0x18], esp
mov eax, esp
mov dword [ebp - 0x1c], eax
push 1
pop eax
mov esp, dword [ebp - 0x18]
xor esi, esi
mov edi, dword [ebp - 0x34]
mov esi, edi
sub eax, 0x34
lea ecx, [edx]
cmp dword [ebp - 0x6c], 0x3c
jne 0x10004974
xor al, al
cmp al, bl
je 0x10004937
lea eax, [ebp - 0xd4]
push eax
push 0xffffffffffffffff
push 0x1000b1f8
push dword [ebp - 0x14]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x20], eax
push ebx
je 0x10004952
mov dword [eax + 0x30], edi
or esi, edx
cmp dword [ebp - 0x6c], 1
je 0x100049b4
int3
and dword [ebp - 0x80], ecx
mov eax, dword [ebp - 0x30]
or ebx, ecx
add edi, dword [ebp - 0x78]
mov esi, dword [ebp - 0x5c]
add dword [ebp - 0x24], 0
je 0x10004a01
mov dword [ebp - 0x2c], eax
jne 0x10004956
mov dword [ebp - 0x28], 0xa38
movzx eax, word [ebx + 0x58]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x14c]
push esi
push ecx
mov ecx, ebx
mov dword [ebp - 0x1c], 0x43ac34
mov dword [ebp - 0x14], 0x43ab8c
mov dword [ebp - 0x18], ebx
call dword [eax + 0x48]
lea eax, [ebp - 0x14c]
sub eax, 0x14
or edx, ebx
mov esi, dword [eax + 0x24]
mov dword [ebp - 0x5c], esi
and ecx, ebx
cmp dword [ebp - 0x24], 0x10000002
jne 0x10004a4a
mov ecx, dword [ebp - 0x44]
or dword [ebp - 0x40], esi
mov edx, dword [ebp - 0x5c]
add ebx, eax
sub ecx, 8
add eax, esi
xor eax, dword [ebp - 0x8c]
add edx, dword [ecx + 0x6c]
mov dword [ebp - 0x5c], edx
and dword [ebp - 0x40], 0x809
and esi, dword [ebp - 0x58]
sub dword [ebp - 0x5c], 4
mov byte [ebp - 0x8c], 0xcf
lea ecx, [eax + 0x1c7a]
xor dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x44]
mov edx, eax
test dword [ebp - 0x24], 0
je 0x10004ab3
mov ebx, dword [ebp - 0x38]
sub ecx, eax
sub eax, 0x20
add ecx, dword [ebp - 0x80]
mov ebx, dword [eax + 0x28]
mov dword [ebp - 0x38], ebx
or dword [ebp - 0x48], esi
xor esi, dword [ebp - 0x54]
sub dword [ebp - 0x38], 4
sub eax, ebx
and eax, ebx
mov dword [ebp - 0x60], 0
and esi, dword [ebp - 0x80]
or dword [ebp - 0x8c], 0xffffffb1
mov edi, dword [ebp - 0x30]
and ebx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x28]
and edx, dword [ebp - 0x54]
or ebx, dword [ebp - 0x40]
sub edi, 0x28
xor edx, esi
add dword [ebp - 0x3c], 0xd9a
mov ecx, dword [edi + 0x24]
mov dword [ebp - 0x28], ecx
and dword [ebp - 0x78], ebx
add dword [ebp - 0x58], esi
lea edi, [ebp - 0x28]
add dword [ebp - 0x7c], esi
push edi
or edi, ecx
test dword [ebp - 0x24], 0
je 0x10004b42
jne 0x10004ba2
mov eax, dword [esi + 0xc]
test al, 0x80
je 0x10004b6d
and al, 0xfd
mov dword [esi + 0xc], eax
or dword [esi + 0xc], 0x20
push dword [ebp - 0x38]
cmp dword [ebp - 0x24], 0x10000002
jne 0x10004b71
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
pop edi
push esi
mov esi, dword [esp + 8]
cmp esi, dword [esp + 0xc]
jae 0x10004b0d
mov eax, dword [esi]
test eax, eax
je 0x10004bb2
call eax
add esi, 4
pop esi
push ebp
mov ebp, esp
push ecx
push ecx
call fcn.1000337c
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10004ba6
push esi
call 0x10003dfc
pop ecx
push eax
push esi
lea ecx, [ebp - 0x4c]
call 0x100075b3
mov eax, dword [ebp - 0x48]
xor esi, esi
cmp eax, esi
mov byte [ebp - 4], 2
jne 0x10004b30
mov eax, 0x1000b8cd
lea ecx, [ebp - 0x34]
push ecx
mov edi, dword [ebp - 0x28]
cmp dword [ebp - 0x24], 0
je 0x10004bda
push edi
mov eax, ecx
push 5
mov esi, 0x1000b86c
pop ecx
lea edi, [ebp - 0x28]
movsw word es:[edi], word [esi]
mov esi, 0x1000be2f
lea ecx, [ebp - 0x334]
push esi
xor ebx, ebx
push ecx
mov ecx, eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 4
mov ebx, dword [ebp - 0x28]
add edx, ebx
mov ebx, dword [edi]
mov dword [ebp - 0x28], ebx
add dword [ebp - 0x84], ebx
lea esi, [ebp - 0x28]
or ebx, eax
push esi
or eax, dword [ebp - 0x54]
push dword [ebp - 0x60]
cmp dword [ebp - 0x24], 0x10000002
jne 0x10004c20
push eax
call 0x10006e58
mov eax, dword [ebp - 0x14]
cmp eax, edi
je 0x10004c4b
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0xc], edi
mov eax, dword [ebp - 0x18]
lea edx, [ebp + 8]
push edx
push dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.100033d0
sub esi, ecx
sub ecx, ebx
mov edx, dword [ebp - 0x30]
xor ecx, dword [ebp - 0x88]
mov ebx, dword [ebp - 0x28]
cmp dword [ebp - 0x6c], 1
je 0x10004c60
call 0x100060dd
mov esi, 0x1000b712
push esi
call 0x10005728
pop ecx
push eax
push esi
lea ecx, [ebp - 0x20]
call fcn.10003d5b
push dword [ebp + 8]
call 0x10003c39
pop ecx
push eax
sub edx, 0x14
xor ecx, dword [ebp - 0x78]
mov dword [edx + 0xc], ebx
mov word [ebp - 0x54], 0x4a9
add edi, esi
add dword [ebp - 0x24], 0
je 0x10004cbd
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
add ecx, 0x68
mov eax, 0x1000b1a6
int3
add ecx, 0x38
mov eax, 0x1000b2c8
lea ecx, [ebp - 0x30]
lea ecx, [ebp - 0x150]
lea ecx, [ebp - 0x110]
lea ecx, [ebp - 0x1c]
mov ecx, dword [ebp - 0xb4]
lea ecx, [ebp - 0xb0]
lea ecx, [ebp - 0x90]
mov ebx, dword [ebp - 0x44]
or dword [ebp - 0x48], ebx
mov edx, dword [ebp - 0x34]
sub esi, dword [ebp - 0x80]
sub ebx, 8
mov dword [ebp - 0x58], 0x576
mov edx, dword [ebx + 0x18]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x8c], esi
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x24], 0x10000002
jne 0x10004d20
call dword [eax + 0x48]
lea eax, [ebp - 0x14c]
push eax
call 0x100044a3
cmp eax, 0x3c
pop ecx
jbe 0x10004d46
mov eax, dword [0x1000b47c]
mov ecx, dword [eax + 4]
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x10004cfd
mov eax, edi
push ecx
lea ecx, [ebp - 0x14c]
push esi
push ecx
push 0x1000bcbd
push eax
push esi
test dword [ebp - 0x24], 0
je 0x10004d51
int3
lea ecx, [ebp - 0x10]
lea ecx, [ebp + 8]
mov eax, 0x1000b72b
push dword [ebp - 0x34]
sub ecx, dword [ebp - 0x8c]
cmp dword [ebp - 0x24], 0x6c
jne 0x10004d81
mov esi, ecx
push 0xffffffffffffffff
push 0x1000b3cd
push dword [esi + 4]
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
push 1
push eax
mov ecx, esi
call fcn.1000539a
push 1
pop eax
pop esi
push ebp
call fcn.10003467
mov edi, ecx
mov ebx, dword [ebp - 0x5c]
xor dword [ebp - 0x80], 0x910
and ecx, 0
xor ecx, 0x328e84
xor ecx, 0x32fe84
mov ecx, ebx
mov ecx, edi
mov ecx, ebx
and esi, dword [ebp - 0x3c]
cmp dword [ebp - 0x24], 0x44
jne 0x10004ddd
push ecx
push eax
call fcn.1000736e
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExitThread]
sub ecx, 0x20
mov edx, dword [ebp - 0x28]
and dword [ebp - 0x84], 0x491
mov dword [ecx + 0x20], edx
add dword [ebp - 0x58], 0x32
lea ecx, [esi + eax*2 + 0x41]
sub dword [ebp - 0x5c], 4
and edi, dword [ebp - 0x84]
xor dword [ebp - 0x88], 0xa25
mov eax, dword [ebp - 0x28]
lea esi, [ebp - 0x60]
xor ebx, dword [ebp - 0x40]
add edx, dword [ebp - 0x4c]
push esi
xor ecx, dword [ebp - 0x54]
lea edi, [esi]
push eax
xor edi, dword [ebp - 0x80]
cmp dword [ebp - 0x6c], 0x4a
jne 0x10004e55
call fcn.10003302
cmp dword [ebp - 0x6c], 0xffffffc8
jne 0x10004e93
cmp dword [ebp - 0x6c], 1
je 0x10004eca
push 0x1000be0c
push 0xfffffffffffffffc
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiDeleteDeviceInfo]
mov dword [0x1000b55c], eax
pop esi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [esi]
push dword [ebp + 8]
mov edi, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp eax, edi
jne 0x10004eac
sub dword [ebp - 0x64], 4
xor dword [ebp - 0x48], 0x6a1
mov ecx, dword [ebp - 0x64]
cmp dword [ebp - 0x6c], 1
je 0x10004f11
mov ecx, dword [ebp - 0x10]
add ecx, 0x1000b523
mov ecx, dword [ebp - 0x10]
add ecx, 0x1000b5f3
mov ecx, dword [ebp - 0x10]
add ecx, 0x1000be9d
mov ecx, dword [ebp - 0x10]
add ecx, 0x1000bff2
mov eax, 0x1000b41e
int3
sub edx, edx
xor edx, 0x7320188
xor edx, 0x732fe88
lea ebx, [edi + 0xeff]
mov dword [ecx], edx
add dword [ebp - 0x54], esi
add eax, dword [ebp - 0x54]
cmp dword [ebp - 0x24], 0x10000002
jne 0x10004f5f
lea eax, [ebp - 0x34]
push eax
call fcn.10003290
cmp dword [ebp - 0x6c], 0xffffffb8
jne 0x10004fa6
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10004fdd
push eax
call 0x10004e99
pop ecx
pop ecx
mov dword [esi + 8], 1
mov eax, esi
pop edi
pop esi
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov dword [esi], 0x46a04c
mov eax, dword [edi + 8]
test eax, eax
mov dword [esi + 8], eax
je 0x10004fc8
push dword [edi + 4]
mov ebx, dword [ebp - 0x30]
or ecx, dword [ebp - 0x3c]
cmp dword [ebp - 0x6c], 0x7d
jne 0x10005010
sub esp, 0x14
and byte [ebp - 0xe], 0
push ebx
push esi
mov esi, ecx
push dword [esi + 0x74]
call 0x10006d97
mov ebx, eax
test ebx, ebx
je 0x100060ae
mov eax, dword [ebx]
and byte [ebp - 0xd], 0
lea ecx, [ebp - 0x1c]
push edi
mov esi, dword [ebp - 0x28]
add dword [ebp - 0x88], esi
sub ebx, 0x14
cmp dword [ebp - 0x6c], 1
je 0x1000503c
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x28], esi
mov esi, eax
xor dword [ebp - 0x7c], 0xffffff8d
xor esi, ebx
xor dword [ebp - 0x84], ebx
mov ecx, dword [ebp - 0x34]
add esi, dword [ebp - 0x7c]
and dword [ebp - 0x28], ecx
or edi, dword [ebp - 0x40]
mov dword [ebp - 0x78], esi
sub dword [ebp - 0x64], 4
lea edi, [edx + 0x9d]
mov edi, dword [ebp - 0x64]
sub ebx, eax
xor dword [ebp - 0x78], edx
and esi, 0
xor esi, 0x332fe80
xor esi, 0x332fe88
xor dword [ebp - 0x80], ebx
mov dword [edi], esi
mov word [ebp - 0x58], 0xaee
push dword [ebp - 0x28]
call fcn.1000324f
cmp dword [ebp - 0x6c], 0x7d
jne 0x100050d3
call fcn.1000839d
cmp dword [ebp - 0x6c], 1
je 0x10005106
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
mov eax, 0x1000be48
lea ecx, [ebp - 0x40]
lea ecx, [ebp - 0xc4]
lea ecx, [ebp - 0x84]
lea ecx, [ebp - 0x10]
lea ecx, [ebp - 0x18]
lea ecx, [ebp - 0x44]
mov eax, 0x1000bf22
sub ecx, dword [ebp - 0x80]
sub dword [ebp - 0x64], 4
cmp dword [ebp - 0x6c], 0xfffffff4
jne 0x10005146
mov edx, dword [ebp - 0x64]
cmp dword [ebp - 0x24], 0
je 0x10005190
lea eax, [ebp - 0x1c]
lea ecx, [esi + 0xb8]
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], ebx
call 0x1000726f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
call 0x10005491
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push dword [ebp - 0x1c]
mov byte [ebp - 4], 3
call dword [sym.imp.SETUPAPI.dll_SetupDiSetSelectedDriverW]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x104]
and ebx, 0
xor ebx, 0x732fe58
xor ebx, 0x732fe88
sub edi, dword [ebp - 0x78]
cmp dword [ebp - 0x6c], 0x10000002
jne 0x100051d8
call fcn.10005fd4
mov ecx, esi
call fcn.10006c3a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
push esi
mov esi, ecx
call fcn.1000566c
test byte [esp + 8], 1
je 0x100051bd
mov dword [edx], ebx
sub eax, dword [ebp - 0x78]
or edi, dword [ebp - 0x88]
xor eax, dword [ebp - 0x80]
lea eax, [ebp - 0x34]
push eax
call fcn.10003290
and eax, dword [ebp - 0x3c]
sub ebx, dword [ebp - 0x58]
cmp dword [ebp - 0x6c], 1
je 0x10005221
mov esi, dword [ebp - 0x34]
xor edx, eax
cmp dword [ebp - 0x28], esi
jb 0x10005599
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10005262
mov al, byte [ebp - 6]
and eax, 0xf
or al, 0x10
mov word [ebp - 6], ax
mov eax, 0x1000ba20
cmp ecx, eax
jge 0x10005289
sub eax, ecx
test byte [ebp - 0xc], bl
je 0x100052a2
test esi, esi
jne 0x10005297
mov esi, ebx
shr dword [ebp - 0xc], 1
test byte [ebp - 8], bl
je 0x10005273
add ecx, 0x1371
mov edx, dword [ebp - 0x30]
cmp dword [ebp - 0x6c], 1
je 0x100052a4
mov dword fs:[0], ecx
pop ebx
mov eax, dword [esp + 4]
push esi
mov esi, ecx
cmp dword [esi + 0x34], 2
mov dword [esi + 0x30], eax
jne 0x100052d9
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, esi
mov dword [esi + 0x48], eax
call fcn.10004a17
and dword [esi + 0x48], 0
pop esi
push esi
mov esi, ecx
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x6c], 0xffffffcf
jne 0x100052db
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [esi + 0x18]
call ebp
mov eax, dword [edi]
push dword [esi + 0x28]
dec eax
push eax
push dword [esi + 0x18]
call ebp
push dword [esp + 0x2c]
push dword [esi + 0x18]
call ebx
mov ecx, dword [esp + 0x10]
push 1
push esi
call 0x10006119
push 1
sub edx, 0x2c
and dword [ebp - 0x80], 0xc4d
mov ecx, dword [edx + 0x24]
mov dword [ebp - 0x28], ecx
and ebx, dword [ebp - 0x40]
or ebx, esi
cmp dword [ebp - 0x6c], 1
je 0x10005322
pop edi
push edi
push eax
push ebx
call 0x10007063
add esp, 0xc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], edi
pop edi
je 0x10005319
or dword [esi + 0xc], 0x20
mov eax, dword [ebp + 8]
and eax, 0xff
or al, 0x20
mov dword [esi + 0xc], eax
or eax, 0xffffffff
pop esi
pop ebx
pop ebp
sub dword [ebp - 0x64], 4
or dword [ebp - 0x70], esi
mov edx, dword [ebp - 0x64]
cmp dword [ebp - 0x24], 0x10000002
jne 0x1000534e
sub ecx, ecx
xor ecx, 0x7320e88
xor ecx, 0x732fe88
or ebx, esi
mov dword [edx], ecx
lea eax, [ecx]
cmp dword [ebp - 0x6c], 1
je 0x1000538b
call dword [ecx + 0x60]
mov eax, dword [ebp - 0x20]
lea edx, [esi + 0xc]
push edx
push edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x58]
inc edi
add esi, 4
cmp edi, 3
jl 0x100053bc
mov eax, dword [ebp - 0x20]
test al, 0x10
je 0x10005312
mov eax, dword [edi]
lea ebx, [ebp - 0x34]
push ebx
call fcn.10003290
cmp dword [ebp - 0x6c], 1
je 0x100053cc
int3
add edi, 0xff83
mov ecx, ebx
mov esi, dword [ebp - 0x34]
cmp dword [ebp - 0x6c], 1
je 0x100053fd
and dword [ebp - 0x28], esi
add dword [ebp - 0x24], 0
je 0x1000542e
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x469f68
and dword [ebp - 4], 0
push 1
lea ecx, [esi + 0xc]
call 0x10006ed6
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call 0x10003dbb
mov ecx, dword [ebp - 0xc]
pop esi
add dword [ebp - 0x24], 0
je 0x10005466
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp edi, esi
je 0x10007dfc
mov dword [ebp - 4], 1
add eax, 3
and al, 0xfc
call fcn.10006f8e
mov dword [ebp - 0x18], esp
mov ebx, esp
mov dword [ebp - 0x24], ebx
or dword [ebp - 4], 0xffffffff
push 1
pop eax
mov esp, dword [ebp - 0x18]
xor esi, esi
sub dword [ebp - 0x64], 4
add edx, ebx
mov eax, dword [ebp - 0x64]
xor dword [ebp - 0x8c], 0x7e3
push 0
pop ebx
xor ebx, 0x232fe84
xor ebx, 0x232fe88
test dword [ebp - 0x24], 0
je 0x100054be
add dword [ebp + 0xc], 4
add eax, 4
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x10005441
mov eax, dword [esi + 8]
mov ecx, eax
mov ebx, eax
sub ecx, dword [ebp + 8]
sar ecx, 2
sub edi, ecx
je 0x100054ea
test ebx, ebx
je 0x1000543b
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.10004e2b
mov dword [eax], ebx
lea esi, [esi + edi*8 - 0x22]
push dword [ebp - 0x28]
call fcn.1000324f
or ebx, ecx
cmp dword [ebp - 0x24], 0xffffff80
jne 0x10005514
mov dword fs:[0], ecx
mov eax, 0x1000b455
call 0x10004c3b
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x468a28
mov dword [esi + 0x80], 0x468a20
mov eax, dword [esi + 0xb0]
mov dword [ebp - 4], 3
test eax, eax
je 0x100054db
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.1000839d
or word [ebp - 0x58], 0x76b
add ebx, dword [ebp - 0x3c]
add dword [ebp - 0x28], 1
and word [ebp - 0x50], 0xf65
and dword [ebp - 0x4c], ebx
cmp dword [ebp - 0x28], 5
jbe 0x10005574
xor esi, edi
xor edi, edx
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x6c], 1
je 0x10005574
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x24], edx
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x28], edx
mov edx, dword [ebp + 8]
mov dword [eax + 0x2c], edx
mov edx, dword [ebp + 0x18]
mov dword [eax + 0x30], edx
mov edx, dword [ebp + 0x20]
mov dword [eax + 0x38], edx
mov edx, dword [ebp + 0x24]
lea esi, [ebp - 0x38]
mov word [ebp - 0x88], 0xc39
push esi
xor ecx, edx
and esi, eax
push dword [ebp - 0x28]
and word [ebp - 0x40], 0x436
call fcn.100033d0
sub ebx, dword [ebp - 0x40]
or esi, dword [ebp - 0x48]
sub dword [ebp - 0x38], 4
jne 0x10004adf
or ecx, dword [ebp - 0x4c]
xor ebx, dword [ebp - 0x40]
mov edi, dword [ebp - 0x30]
add dword [ebp - 0x58], ebx
mov eax, dword [ebp - 0x28]
or dword [ebp - 0x40], esi
sub edi, 4
cmp dword [ebp - 0x24], 0xffffffc0
jne 0x100055e2
mov eax, dword [edi]
mov dword [ebp - 0x28], eax
xor dword [ebp - 0x50], 0
mov ebx, edx
lea edx, [ebp - 0x28]
cmp dword [ebp - 0x6c], 1
je 0x10005626
push edx
add esi, dword [ebp - 0x58]
and edi, dword [ebp - 0x78]
push dword [ebp - 0x38]
cmp dword [ebp - 0x6c], 0x6b
jne 0x1000565e
dec dword [ebp - 0x8f73]
invalid
call fcn.1000337c
test dword [ebp - 0x24], 0
je 0x1000568a
mov esi, dword [ebp - 0x28]
or dword [ebp - 0x4c], edi
mov edi, dword [ebp - 0x28]
cmp dword [ebp - 0x24], 0
je 0x100056c5
mov edi, dword [esi]
mov dword [ebp - 0x28], edi
and dword [ebp - 0x48], ecx
add esi, eax
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x6c], 0xffffffac
jne 0x100056f5
push dword [ebp + 0x18]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
cmp eax, ebx
je 0x10005741
push dword [ebp + 0x14]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
push eax
add esi, dword [ebp - 0x40]
and esi, dword [ebp - 0x84]
push dword [ebp - 0x60]
and eax, dword [ebp - 0x50]
call fcn.100033d0
add dword [ebp - 0x70], ebx
mov dword [ebp - 0x3c], edx
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x54], ebx
mov esi, dword [ebp - 0x28]
and dword [ebp - 0x7c], edx
sub edx, 0x20
cmp dword [ebp - 0x6c], 0x10000002
jne 0x1000575d
call 0x1000637c
push edi
push esi
push 0x1000b1e4
push 0x1000b328
push ebx
call 0x10003b53
push edi
push esi
push 0x1000bc6b
push 0x1000b1ad
push ebx
call fcn.10006252
push edi
push esi
push 0x1000b9ba
push 0x1000bf53
xor esi, dword [edx + 0x30]
mov dword [ebp - 0x28], esi
or dword [ebp - 0x84], edx
lea edi, [ebp - 0x5c]
cmp dword [ebp - 0x24], 0x41
jne 0x100057a2
push edi
and edi, dword [ebp - 0x70]
push dword [ebp - 0x38]
mov dword [ebp - 0x50], ecx
call fcn.1000337c
or ecx, dword [ebp - 0x8c]
mov ebx, dword [ebp - 0x5c]
xor esi, eax
push 0
pop edi
xor edi, 0x32da84
xor edi, 0x32fe84
mov edi, ebx
mov edi, edx
mov edi, ebx
xor dword [ebp - 0x88], edi
sub edi, 0x4f
mov edx, dword [ebp - 0x28]
cmp dword [ebp - 0x24], 0
je 0x10005809
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x1000584d
mov eax, edi
push ecx
lea ecx, [ebp - 0x14c]
push esi
push ecx
push 0x1000bb60
push eax
call fcn.10006ad8
add esp, 0x14
lea eax, [ebp - 0x14c]
mov dword [edi + 0x4f], edx
add edi, dword [ebp - 0x50]
xor dword [ebp - 0x78], 0xffffff9a
add edx, ecx
cmp dword [ebp - 0x6c], 1
je 0x10005852
mov edx, 0x1000bdbd
mov dword [eax], edx
mov dword [ecx], edx
mov dword [ecx + 4], 0xf1
add eax, 0x1000
add ecx, 8
dec dword [ebp - 4]
jne 0x10005886
mov dword [0x1000b17f], edi
lea eax, [edi + 0x2018]
cmp ecx, eax
jae 0x100057fb
cmp dword [ecx], 0xffffffff
je 0x1000587d
add ecx, 8
cmp ecx, eax
lea esi, [ebp - 0x60]
push esi
call fcn.10003290
add esi, 0xa5d4
cmp dword [ebp - 0x6c], 1
je 0x10005896
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
push dword [eax]
call 0x1000741a
mov eax, dword [eax]
mov dword [ebp - 4], 1
test eax, eax
je 0x100058e4
mov eax, dword [eax]
xor eax, eax
push eax
lea eax, [ebp - 0x30]
push eax
call 0x100052f6
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
or word [ebp - 0x8c], 0x474
lea ebx, [ebp - 0x5c]
push ebx
call fcn.10003290
add eax, ebx
xor word [ebp - 0x40], 0x26a
lea edi, [ebp - 0x44]
push edi
call fcn.10003290
cmp dword [ebp - 0x6c], 1
je 0x10005901
mov dword [ebp - 0x10], esp
mov edi, dword [esi + 0xa8]
cmp edi, dword [esi + 0xac]
je 0x100058d8
mov eax, dword [edi]
xor ebx, ebx
cmp eax, ebx
je 0x1000586a
push eax
mov ecx, esi
call 0x1000637c
test eax, eax
je 0x100058d2
mov dword [esi + 0x118], 1
mov dword [esi + 0x114], 1
add edi, 4
cmp edi, dword [esi + 0xac]
xor ecx, dword [ebp - 0x78]
lea esi, [ebp - 0x34]
push esi
call fcn.10003290
sub ecx, dword [ebp - 0x48]
xor edi, dword [ebp - 0x80]
and dword [ebp - 0x54], eax
lea esi, [ebp - 0x38]
push esi
call fcn.10003290
mov edi, eax
mov edi, dword [ebp - 0x30]
xor ebx, dword [ebp - 0x8c]
add esi, dword [ebp - 0x70]
mov dword [ebp - 0x64], edi
add dword [ebp - 0x50], edx
test dword [ebp - 0x24], 0
je 0x1000595e
mov eax, 0x1000baaf
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, 0x84
neg ecx
sbb ecx, ecx
and ecx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x1000bae1
lea ecx, [ebp - 0x30]
push ecx
call fcn.10003290
and edi, esi
xor esi, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x64]
cmp dword [ebp - 0x24], 0x10000002
jne 0x10005993
push dword [esi]
and dword [ebp - 0x84], ebx
add dword [ebp - 0x64], 0x10
cmp dword [ebp - 0x6c], 0x10000002
jne 0x100059ce
ret
mov dword [0x1000bb8b], eax
mov dword [0x1000b87d], eax
mov dword [0x1000bd83], eax
sub edi, 0x28
xor esi, ebx
and dword [ebp - 0x48], 0x12
add edx, dword [edi + 0x7c]
mov dword [ebp - 0x28], edx
sub edi, ecx
or esi, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x24], 0x10000002
jne 0x100060f6
push esi
mov esi, ecx
call fcn.100059ee
test byte [esp + 8], 1
je 0x100060c0
push esi
call 0x1000485b
pop ecx
mov eax, esi
pop esi
mov esi, dword [ebp - 0x28]
xor ebx, dword [ebp - 0x40]
mov esi, dword [ecx]
mov dword [ebp - 0x28], esi
xor ebx, dword [ebp - 0x50]
or edi, dword [ebp - 0x88]
mov edi, dword [ebp - 0x28]
add ebx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x28]
cmp dword [ebp - 0x6c], 1
je 0x10006155
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x138], edi
mov dword [esi + 0x13c], edi
mov dword [esi + 0x140], edi
mov dword [esi + 0x110], edi
mov dword [esi + 0x114], edi
mov dword [esi + 0x118], edi
mov dword [esi + 0x11c], edi
mov dword [esi + 0x120], edi
mov edx, dword [edi]
mov dword [ebp - 0x28], edx
xor ebx, dword [ebp - 0x4c]
and dword [ebp - 0x88], 0x1b
mov ecx, dword [ebp - 0x28]
lea ebx, [ebp - 0x38]
lea edx, [ebx + eax*8 + 0x4e]
xor eax, edi
push ebx
cmp dword [ebp - 0x24], 0x10000002
jne 0x1000619e
lea ecx, [ebp + 0x14]
mov eax, 0x1000bdf7
int3
push ecx
test dword [ebp - 0x24], 0
je 0x100061df
call fcn.10003302
test dword [ebp - 0x24], 0
je 0x1000621e
jne 0x10006186
mov esi, 0x1000bf87
push eax
lea eax, [ebp - 0x104]
push 0x1000b7d0
push eax
push 0x1000b267
push esi
call fcn.10005c21
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x20]
call fcn.1000509c
mov eax, dword [ebp + 0x1c]
add word [ebp - 0x48], 0xf61
mov ecx, 0xff
mov esi, edx
and dword [ebp - 0x28], ecx
or esi, dword [ebp - 0x78]
or ebx, dword [ebp - 0x7c]
add eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x28], 0x55
je 0x100062ac
sub ebx, edi
or ebx, dword [ebp - 0x8c]
cmp dword [ebp - 0x24], 0
je 0x10006271
push esi
mov dword [ebp + 8], edi
call 0x10006284
pop ecx
pop ecx
cmp dword [ebp - 0x28], 0x8b
je 0x100062ac
cmp dword [ebp - 0x24], 0xf
jne 0x1000629d
test ebx, ebx
mov dword [ebp + 8], ebx
je 0x10006213
push ebx
call 0x10006803
pop ecx
mov ecx, dword [ebx + 0x10]
mov dword [ecx], eax
mov eax, dword [ebx + 0x10]
cmp dword [eax], 0xffffffff
jmp 0x10007214
add dword [ebp - 0x48], eax
mov esi, 0xff0000
add dword [ebp - 0x54], esi
and dword [ebp - 0x38], esi
or dword [ebp - 0x8c], esi
add eax, 0x6c11
cmp dword [ebp - 0x24], 0x10000002
jne 0x100062eb
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
mov eax, 0x1000b970
lea ecx, [ebp - 0x14]
mov eax, 0x1000b77c
int3
sub dword [ebp - 0x64], 4
xor esi, edi
mov ecx, dword [ebp - 0x64]
add edx, dword [ebp - 0x8c]
push 0
pop ebx
xor ebx, 0x267fe88
xor ebx, 0x232fe88
mov dword [ebp - 0x88], ebx
mov dword [ecx], ebx
add edi, dword [ebp - 0x40]
add edi, ecx
xor esi, dword [ebp - 0x58]
lea ebx, [ebp - 0x34]
push ebx
call fcn.10003290
add dword [ebp - 0x24], 0
je 0x10006349
lea ecx, [esi + 0x84]
call 0x10006bf3
push ebx
push ebx
push 0x1000bc95
mov dword [ebp - 0x1c], ebx
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
je 0x10006314
push ebx
push eax
sub edx, eax
or dword [ebp - 0x48], edi
cmp dword [ebp - 0x28], 0x8b
jne 0x10006b0e
add eax, dword [ebp - 0x70]
or eax, dword [ebp - 0x70]
or dword [ebp - 0x70], esi
mov edx, dword [ebp - 0x34]
or dword [ebp - 0x7c], edi
cmp dword [ebp - 0x38], edx
je 0x10006b0e
and esi, dword [ebp - 0x4c]
cmp dword [ebp - 0x6c], 1
je 0x100063ab
push 0
push eax
call 0x10007ede
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x1c]
call fcn.10004e60
pop edi
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
push ebp
mov ebp, esp
sub esp, 0x1000bdb0
mov dword [ebp - 0x38], 4
xor dword [ebp - 0x70], 0xffffffae
cmp dword [ebp - 0x6c], 1
je 0x100063e3
push 0x1000bf96
push dword [ebp + 8]
push 0x1000bf47
push ecx
push eax
call 0x10006119
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
jne 0x1000637f
and dword [ebx + 0x78], eax
push eax
mov ecx, ebx
mov dword [ebp - 0x5c], 0xc
xor dword [ebp - 0x88], edi
mov ebx, edx
xor ebx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x24], 0x19
jne 0x10006437
push eax
push 0x1000b8e4
mov dword [ecx], eax
push dword [esp + 0x18]
call edi
mov ecx, esi
mov dword [esi + 0x108], eax
call 0x10005da6
cmp dword [esi + 0xb8], 0
je 0x1000648e
mov ecx, esi
call 0x1000436b
mov ecx, esi
call fcn.10004a17
pop edi
pop esi
push esi
push 0
push 0
mov edi, dword [ebp - 0x28]
and ecx, dword [ebp - 0x48]
xor edx, dword [ebp - 0x40]
sub eax, 0x30
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10006476
int3
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
call 0x100062cf
pop ecx
mov edi, dword [eax + 0x3c]
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x24], 0xfffffff7
jne 0x1000649a
fsub st(1)
ftst
wait
fnstsw word [ebp - 0xa0]
fcos
jne 0x1000646d
push dword [ebp - 0x30]
call fcn.1000324f
cmp dword [ebp - 0x24], 0x10000002
jne 0x100064e2
jl 0x100064c9
mov esi, eax
cmp dword [0x1000bc49], esi
jge 0x1000646a
mov edi, 0x1000bb51
push 0x1000b18b
call fcn.1000539a
test eax, eax
pop ecx
je 0x100064f5
add dword [0x1000bd96], 0x20
mov dword [edi], eax
lea ecx, [eax + 0x100]
cmp eax, ecx
jae 0x100064d4
and byte [eax + 4], 0
mov ecx, dword [ebp - 0x64]
lea esi, [ebp - 0x30]
xor edx, dword [ebp - 0x8c]
push esi
cmp dword [ebp - 0x24], 0
je 0x1000652c
test cl, 4
je 0x10006504
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], 0xc000008e
or dword [eax + 4], 8
test cl, 8
je 0x1000656f
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], 0xc0000090
or dword [eax + 4], 0x10
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 2
mov ecx, dword [esi]
mov edx, dword [eax + 8]
not ecx
and ecx, ebx
push ecx
sub edx, dword [ebp - 0x40]
and dword [ebp - 0x70], 0xecc
call fcn.10003302
sub edi, edx
and ebx, dword [ebp - 0x58]
sub dword [ebp - 0x64], 0x20
or edi, edx
sub edi, dword [ebp - 0x40]
cmp dword [ebp - 0x6c], 1
je 0x10006580
add ecx, 0x38
mov eax, 0x1000b871
mov ecx, dword [ebp - 0x10]
mov eax, 0x1000b3f3
int3
mov edi, dword [ebp - 0x60]
xor dword [ebp - 0x3c], esi
mov ebx, dword [ebp - 0x28]
cmp dword [ebp - 0x6c], 1
je 0x100065b5
sub edi, 0x30
mov edx, eax
add ebx, dword [edi + 0x84]
mov dword [ebp - 0x28], ebx
add esi, dword [ebp - 0x88]
sub dword [ebp - 0x28], 0x1c
and dword [ebp - 0x54], 0x10
lea ebx, [ebp - 0x28]
and edi, dword [ebp - 0x50]
and word [ebp - 0x54], 0x3f4
push ebx
or dword [ebp - 0x3c], 0xe6
push dword [ebp - 0x5c]
xor dword [ebp - 0x50], 0xffffffda
call fcn.1000337c
cmp dword [ebp - 0x6c], 1
je 0x10006621
mov esi, dword [ebp - 0x28]
cmp dword [ebp - 0x24], 0
je 0x1000665a
mov eax, 0x1000b971
call 0x10005cc1
sub esp, 0x28
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x18], ebx
mov eax, dword [esi]
mov dword [esi + 0x120], ebx
call dword [eax + 0xec]
mov ecx, dword [esi + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [ebp - 0x44]
xor dword [ebp - 0x58], edi
mov edi, dword [esi]
mov dword [ebp - 0x44], edi
cmp dword [ebp - 0x6c], 1
je 0x10006699
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor edi, edi
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x10]
mov dword [ebp - 4], edi
push eax
push 0x1000bd8c
push 5
push edi
push 0x1000b4c7
mov dword [ebp - 0x10], edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, edi
jge 0x10006643
push eax
lea eax, [ebp - 0x20]
push eax
cmp dword [ebp - 0x24], 0x10000002
jne 0x100066be
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10006701
test byte [ebp + 0xd], 4
je 0x10006694
mov eax, dword [ebp + 0x1c]
cmp eax, esi
je 0x100066e2
cmp eax, edi
mov ebx, dword [ebp - 0x44]
or ecx, dword [ebp - 0x78]
xor edi, dword [ebp - 0x58]
or dword [ebp - 0x44], ebx
jne 0x100066fb
xor edi, eax
add eax, edi
mov edx, dword [ebp - 0x28]
and dword [ebp - 0x88], esi
mov eax, dword [ebp - 0x44]
sub ecx, edx
xor dword [ebp - 0x3c], 0x11
sub edx, 0x18
and edi, dword [ebp - 0x70]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x44], eax
add ebx, 0x8798
sub edi, dword [ebp - 0x78]
add ebx, 0xde35
or eax, dword [ebp - 0x4c]
push dword [ebp - 0x80]
call fcn.1000315f
add dword [ebp - 0x78], 0xffffffec
mov ebx, dword [ebp - 0x64]
xor ecx, dword [ebp - 0x84]
and dword [ebp - 0x4c], 0xa82
and edi, 0
xor edi, 0x132fe88
xor edi, 0x132fe88
cmp dword [ebp - 0x6c], 0xffffffca
jne 0x10006758
mov dword [ebx], edi
add dword [ebp - 0x78], 0x18
mov edi, edx
cmp dword [ebp - 0x6c], 1
je 0x1000678d
sub dword [ebp - 0x64], 4
or dword [ebp - 0x58], 0xffe
mov esi, dword [ebp - 0x64]
and eax, dword [ebp - 0x70]
test dword [ebp - 0x24], 0
je 0x100067d3
sub eax, eax
xor eax, 0x232fe88
xor eax, 0x232fe88
sub ebx, ecx
or dword [ebp - 0x78], esi
mov dword [esi], eax
and word [ebp - 0x78], 0xde
mov dword [ebp - 0x74], esp
and word [ebp - 0x80], 0xc87
mov esp, dword [ebp - 0x64]
cmp dword [ebp - 0x24], 0x10000002
jne 0x10006824
pop ecx
test eax, eax
pop ecx
jl 0x1000682f
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jne 0x1000682e
mov esi, dword [ebp - 0x44]
cmp dword [ebp - 0x6c], 1
je 0x10006851
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1000684a
call esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], edx
xor dword [ebp - 0x58], ecx
mov dword [ebp - 0x64], esp
sub esi, edi
or word [ebp - 0x84], 0x285
mov esp, dword [ebp - 0x74]
cmp dword [ebp - 0x6c], 1
je 0x100068ac
cmp dword [ebp - 0x24], 0xfffffff2
jne 0x10006b2c
sub dword [ebp - 0x64], 4
cmp dword [ebp - 0x24], 0
je 0x10006b5d
push ecx
lea ecx, [ebp - 0x104]
push 0x1000bc64
push ecx
push 0x1000b644
push eax
call fcn.10006df4
add esp, 0x14
inc dword [0x47af50]
lea eax, [ebp - 0x104]
mov esi, dword [ebp - 0x64]
add ebx, 0x1c66
or dword [ebp - 0x4c], eax
or ecx, 0xffffffff
not ecx
xor ecx, 0x15e92ec
xor ecx, 0x132fe88
or eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x80]
mov dword [esi], ecx
cmp dword [ebp - 0x6c], 0x61
jne 0x10006baa
and word [ebp - 0x88], 0xae0
sub dword [ebp - 0x64], 4
cmp dword [ebp - 0x6c], 1
je 0x10006bea
lea ecx, [ebp - 0x70]
mov eax, 0x1000b66d
int3
int3
mov edi, dword [ebp - 0x64]
add dword [ebp - 0x24], 0
je 0x10006c1e
fstp st(0)
fstp st(0)
fld xword [0x475a10]
mov eax, 1
fld st(0)
frndint
fcomp st(1)
mov cl, 0
wait
fnstsw ax
sahf
jne 0x10006bdc
fmul qword [0x475820]
inc cl
fld st(0)
frndint
fcompp
or ecx, 0xffffffff
inc ecx
xor ecx, 0x2f00cde4
xor ecx, 0x132fe88
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10006c64
test esi, esi
je 0x100046ef
mov eax, dword [0x1000b9d0]
mov dword [edi], ecx
add word [ebp - 0x7c], 0x4f2
or dword [ebp - 0x7c], 0x6b
xor dword [ebp - 0x50], ebx
sub dword [ebp - 0x64], 4
and edx, dword [ebp - 0x70]
mov ebx, dword [ebp - 0x64]
add eax, dword [ebp - 0x40]
or esi, 0xffffffff
not esi
xor esi, 0x6c5796fb
xor esi, 0x32fe88
xor dword [ebp - 0x48], ecx
mov dword [ebx], esi
mov ecx, edx
add ecx, ebx
mov ecx, dword [ebp - 0x64]
mov dword [ecx - 4], ecx
push 0xffffffffffffffb0
call fcn.1000315f
cmp dword [ebp - 0x24], 0x10000002
jne 0x10006cd1
push eax
push esi
mov edi, 0x1000b475
adc byte [edx + 8], ch
push edi
cmp dword [ebp - 0x24], 0x10000002
jne 0x10006d04
lea eax, [ebp - 0xa0]
push esi
push eax
mov dword [ebp - 4], esi
call 0x10004ceb
add esp, 0xc
lea eax, [ebp - 0x5c]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xa0], edi
push eax
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xa0]
push eax
mov ecx, dword [ebp - 0x30]
and edx, dword [ebp - 0x70]
xor edx, dword [ebp - 0x84]
mov edi, dword [ebp - 0x28]
cmp dword [ebp - 0x6c], 1
je 0x10006d35
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
jne 0x10006cc7
mov ecx, 0x1000b600
push edx
lea edx, [esp + 0x354]
push 0x1000b4cc
push edx
push eax
push ecx
sub ecx, 0x10
add edx, dword [ebp - 0x78]
or dword [ebp - 0x88], eax
mov edi, dword [ecx + 0x1c]
mov dword [ebp - 0x28], edi
add dword [ebp - 0x24], 0
je 0x10006d71
and ebx, 0x3f
or ebx, 0x20
add ebx, 1
mov ecx, ebx
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x30]
and ebx, 0x1000bae5
and eax, 0x8000
or ebx, eax
mov dword [esp + 0x18], ebx
and edi, ebx
mov ebx, dword [ebp - 0x60]
add esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
add edi, 0x9bc4
sub ebx, 0xc
sub edx, dword [ebp - 0x8c]
add eax, dword [ebx + 0x58]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x6c], 0x1b
jne 0x10006dd2
je 0x10006e0b
mov ecx, dword [esi]
cmp ecx, edi
je 0x10006df6
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x5b], 0xff1000b3
mov eax, dword [ecx]
jne 0x10006d6b
push dword [ebp + 8]
call dword [eax + 0xa0]
test eax, eax
jne 0x10006d60
push 1
push edi
push dword [ebx + 0x30]
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call dword [eax + 0x9c]
add esi, 0x18
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x28]
xor dword [ebp - 0x80], 0xffffffd4
mov ebx, dword [ebp - 0x44]
xor dword [ebp - 0x54], 0x35a
mov ebx, dword [esi]
mov dword [ebp - 0x44], ebx
xor ebx, dword [ebp - 0x8c]
cmp dword [ebp - 0x24], 0x4f
jne 0x10006e14
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call 0x10007063
pop ecx
test eax, eax
pop ecx
jl 0x10006db8
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x10006e74
mov eax, 0x1000ba60
mov dword [ebp - 0x74], esp
mov dword [ebp - 0x3c], edi
mov esp, dword [ebp - 0x64]
and eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x6c], 1
je 0x10006e47
call ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10006e84
mov dword [ebp + 0x110], 1
mov eax, dword [ebp + 0x30]
mov ecx, ebp
mov dword [esp + 0x10], eax
mov eax, dword [ebp]
call dword [eax + 0xf0]
push eax
push dword [esp + 0x14]
call edi
mov dword [esp + 0x10], eax
mov eax, dword [ebp]
mov ecx, ebp
mov dword [ebp - 0x64], esp
xor eax, dword [ebp - 0x58]
lea ecx, [eax + esi*8 + 0xc1]
mov esp, dword [ebp - 0x74]
or eax, dword [ebp - 0x48]
or edi, dword [ebp - 0x58]
add dword [ebp - 0x64], 0xc
and ebx, dword [ebp - 0x7c]
or eax, edi
mov edx, dword [ebp - 0x28]
lea esi, [ebp - 0x5c]
add ecx, edx
push esi
add ecx, dword [ebp - 0x88]
push edx
xor dword [ebp - 0x84], eax
call fcn.10003302
sub eax, dword [ebp - 0x84]
and dword [ebp - 0x7c], edx
lea edx, [ebp - 0x38]
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10006f0e
lea edi, [ebp - 0x1a4]
call fcn.10008652
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10006f4c
lea eax, [ebp - 0x1a4]
push eax
call 0x10007d7c
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1000ba2d
push edi
call fcn.10006df4
push edx
xor word [ebp - 0x50], 0xf9
push dword [ebp - 0x38]
sub edi, edx
add edi, edx
call fcn.10003467
or dword [ebp - 0x58], ecx
add edx, dword [ebp - 0x50]
sub dword [ebp - 0x64], 4
cmp dword [ebp - 0x6c], 0xffffffef
jne 0x10006f4d
int3
mov ebx, dword [ebp - 0x64]
and edi, esi
and eax, esi
or eax, 0xffffffff
inc eax
xor eax, 0x32ffc3
xor eax, 0x32fe88
or ecx, eax
add word [ebp - 0x50], 0xaaa
mov dword [ebx], eax
or dword [ebp - 0x7c], 0x461
xor dword [ebp - 0x58], ecx
push dword [ebp - 0x5c]
call fcn.1000324f
sub esi, dword [ebp - 0x80]
and eax, edi
cmp dword [ebp - 0x24], 0xffffffee
jne 0x10006fc0
push eax
mov esi, dword [ebp - 0x30]
and dword [ebp - 0x4c], 0xa3b
mov ebx, dword [ebp - 0x28]
and eax, edi
sub esi, 0x1c
and edi, dword [ebp - 0x84]
mov ebx, dword [esi + 0x28]
mov dword [ebp - 0x28], ebx
sub ecx, eax
mov ecx, esi
cmp dword [ebp - 0x6c], 0xfffffff8
jne 0x10006ffd
cmp eax, 0x10
ja 0x10006ff7
je 0x1000706b
mov ecx, eax
dec ecx
je 0x10006ff2
dec ecx
je 0x10007046
dec ecx
dec ecx
je 0x10006feb
push 4
mov edx, dword [ebp - 0x60]
or edi, dword [ebp - 0x80]
mov eax, dword [ebp - 0x28]
add esi, dword [ebp - 0x4c]
sub edx, 0x3c
or ebx, dword [ebp - 0x84]
add eax, dword [edx + 0x8c]
mov dword [ebp - 0x28], eax
add esi, ecx
mov ebx, dword [ebp - 0x28]
cmp dword [ebp - 0x24], 0x74
jne 0x10007057
push 0x1000b3b2
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov eax, dword [esp + 0x14]
pop esi
and dword [eax], 0
xor eax, eax
and dword [ecx + 0x20], 0
cmp dword [ecx + 0x24], 0
jne 0x10007063
push dword [ecx + 4]
call dword [sym.imp.OLEAUT32.dll_VarR8FromUI1]
push dword [esp + 0xc]
push dword [esp + 0xc]
mov edx, dword [ebp - 0x44]
test dword [ebp - 0x24], 0
je 0x10007086
cmp ecx, eax
je 0x10003d47
xor ebx, ebx
cmp dword [esi + 8], ebx
jne 0x100044bd
mov edi, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
cmp edi, eax
jb 0x100070a0
sub edi, eax
xor edi, edi
cmp edi, ebx
mov edx, dword [ebx]
mov dword [ebp - 0x44], edx
xor dword [ebp - 0x3c], edi
cmp dword [ebp - 0x24], 0xffffffa8
jne 0x100070b9
push dword [ebp + 8]
call edi
mov dword [ebp - 0x1c], eax
mov ecx, dword [esi + 0xa8]
mov eax, dword [esi + 0xac]
cmp ecx, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x74], esp
cmp dword [ebp - 0x24], 0xffffffae
jne 0x100070ed
xor eax, eax
push eax
call fcn.100043b1
mov esi, eax
pop ecx
cmp esi, ebx
je 0x10007131
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push 0x1000b901
push esi
mov dword [ebp - 0x14], ebx
call dword [eax]
cmp eax, ebx
jl 0x10007132
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x1000712d
mov esp, dword [ebp - 0x64]
sub ebx, edx
add ebx, dword [ebp - 0x54]
mov esi, dword [ebp - 0x44]
mov edi, edx
call esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], edx
or edi, esi
xor dword [ebp - 0x54], edx
mov dword [ebp - 0x64], esp
or edx, dword [ebp - 0x48]
sub ebx, dword [ebp - 0x70]
mov esp, dword [ebp - 0x74]
cmp dword [ebp - 0x6c], 0x1b
jne 0x10007144
mov ecx, esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], ebx
call 0x1000662a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov eax, dword [esp + 4]
push esi
mov esi, ecx
cmp dword [esi + 0x34], 2
mov esi, dword [ebp - 0x28]
sub edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x28]
xor eax, dword [ebp - 0x4c]
and eax, dword [ebp - 0x88]
mov ecx, dword [esi]
mov dword [ebp - 0x28], ecx
or eax, dword [ebp - 0x58]
xor dword [ebp - 0x50], ecx
and ecx, dword [ebp - 0x50]
mov ecx, 0xff
cmp dword [ebp - 0x24], 0x49
jne 0x100071b2
jne 0x10007131
mov eax, dword [esi + 0x180]
mov edx, dword [esi + 0x154]
lea ecx, [esi + 0x184]
inc eax
test dword [ecx + 8], edx
je 0x100071b1
mov di, word [ecx]
mov word [ebp - 0x48], di
mov di, word [ecx + 2]
mov word [ebp - 0x46], di
mov di, word [ecx + 4]
mov word [ebp - 0x42], di
add ecx, 0x10
dec eax
jne 0x100071cb
push 0x1000b327
lea eax, [ebp - 0xfc]
push ebx
and dword [ebp - 0x28], ecx
lea ecx, [esi + ebx + 0x824]
sub esi, dword [ebp - 0x58]
cmp dword [ebp - 0x6c], 0x10000002
jne 0x100071e9
mov esi, ecx
cmp dword [esi + 0x30], 0xffffffff
je 0x1000724f
cmp dword [esi + 0x14], 0
je 0x1000719c
xor eax, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x1000716f
mov ecx, dword [esp + 0xc]
test ecx, ecx
cmp dword [ebp - 0x28], 0x55
je 0x100078be
or eax, dword [ebp - 0x58]
sub esi, dword [ebp - 0x78]
and edx, dword [ebp - 0x54]
cmp dword [ebp - 0x28], 0x8b
je 0x100078be
or eax, ecx
or ebx, dword [ebp - 0x84]
mov dword [ebp - 0x38], 3
add dword [ebp - 0x70], ebx
mov dword [ebp - 0x5c], 0xc
add dword [ebp - 0x8c], 0x54
cmp dword [ebp - 0x24], 0
je 0x1000725c
jl 0x10007280
cmp al, 0x7a
jg 0x100071d7
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x1000723d
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x122c]
push eax
call 0x10004bff
pop ecx
pop ecx
cmp eax, ebx
je 0x1000720e
push 0x2c
mov ebx, dword [ebp - 0x30]
and dword [ebp - 0x84], 0x54
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x6c], 0xffffffba
jne 0x100072a3
xor ebx, ebx
mov edx, dword [ecx + 4]
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
jne 0x100072b9
mov ecx, str.Unknown_excepti
push edx
lea edx, [esp + 0x28]
push 0x1000bbcd
push edx
push eax
push ecx
call 0x1000644c
mov esi, dword [0x1000bfe1]
add esp, 0x14
cmp dword [ebp + 0x88], ebx
je 0x100072a6
sub ebx, 0x14
sub edi, dword [ebp - 0x58]
mov ecx, dword [ebx + 0x20]
mov dword [ebp - 0x28], ecx
and dword [ebp - 0x70], ebx
cmp dword [ebp - 0x24], 0
je 0x100072e1
int3
int3
cmp dword [ebp - 0x24], 0
je 0x10007314
test ebx, ebx
je 0x10007308
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.10006a91
add ebx, 4
dec edi
jne 0x1000728a
mov edi, dword [esi + 8]
mov ebx, dword [ebp + 8]
cmp ebx, edi
je 0x10007370
push dword [ebp + 0x10]
mov ecx, ebx
call 0x1000514f
add ebx, 4
test edi, edi
mov esi, dword [ebp - 0x60]
lea ebx, [edi + 0x1b86]
mov ecx, dword [ebp - 0x28]
and edi, dword [ebp - 0x3c]
cmp dword [ebp - 0x24], 0x10000002
jne 0x1000733f
pop ecx
mov ax, word [ebp - 4]
pop esi
mov word [ebx + 0xa], ax
pop ebx
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
sub esi, 8
cmp dword [ebp - 0x6c], 1
je 0x10007362
pop edi
pop esi
mov dword fs:[0], ecx
mov eax, 0x1000bd54
call 0x10006fe8
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0x34], ecx
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10007394
hlt
push dword [ebp - 0x30]
call fcn.1000324f
cmp dword [ebp - 0x6c], 1
je 0x100073df
push 0x1000bc25
push eax
push 0x1000bbda
push dword [ebp + 8]
call 0x10006d97
lea eax, [ebp - 0x144]
push eax
call fcn.100071c8
add esp, 0x18
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.10005b62
mov esi, 0x1000bbe8
push esi
call fcn.100047a8
mov ecx, dword [ebp - 0x64]
lea esi, [ebp - 0x30]
mov eax, edi
test dword [ebp - 0x24], 0
je 0x10007413
je 0x1000741d
inc edx
add eax, 4
cmp edx, 5
jl 0x1000745b
push esi
cmp dword [ebp - 0x6c], 1
je 0x10007432
call dword [ecx + 0x28]
cmp dword [ebp - 0x14], edi
je 0x10007411
push 1
pop ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], edi
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push ecx
and edx, dword [ebp - 0x78]
call fcn.10003302
add esi, 0x810e
add eax, dword [ebp - 0x40]
sub dword [ebp - 0x64], 0x40
xor dword [ebp - 0x84], esi
cmp dword [ebp - 0x24], 0xfffffff3
jne 0x10007476
call fcn.10007809
add esp, 0xc
cmp eax, 2
je 0x1000749a
cmp eax, 3
je 0x10007408
cmp eax, 1
je 0x10007460
lea eax, [ebp - 4]
push eax
add ebx, eax
cmp dword [ebp - 0x24], 0x10000002
jne 0x1000749f
and eax, 4
test eax, eax
mov edx, dword [ebp - 0x60]
add dword [ebp - 0x8c], 0x5b
mov eax, dword [ebp - 0x28]
xor edi, dword [ebp - 0x58]
sub edx, 4
mov dword [ebp - 0x48], eax
add eax, dword [edx + 0x48]
mov dword [ebp - 0x28], eax
and ebx, esi
lea ebx, [ebp - 0x28]
and dword [ebp - 0x88], ecx
push ebx
sub ecx, dword [ebp - 0x48]
push dword [ebp - 0x5c]
and edx, dword [ebp - 0x40]
call fcn.1000337c
add dword [ebp - 0x24], 0
je 0x100074ec
mov dword [esi], eax
pop edi
mov eax, ebx
pop esi
pop ebx
push 1
call 0x10003c00
pop ecx
push ebx
push esi
mov ecx, dword [ebp - 0x28]
or dword [ebp - 0x40], eax
mov esi, dword [ebp - 0x44]
and word [ebp - 0x88], 0x63f
mov esi, dword [ecx]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x84], ecx
or dword [ebp - 0x80], ecx
mov edx, dword [ebp - 0x44]
xor esi, edi
or dword [ebp - 0x44], edx
jne 0x100075d9
and dword [ebp - 0x84], 0xb
add ebx, dword [ebp - 0x58]
sub eax, ecx
mov esi, dword [ebp - 0x28]
cmp dword [ebp - 0x24], 0
je 0x10007566
mov edx, dword [ebp - 0x44]
add dword [ebp - 0x80], esi
sub esi, 0x30
cmp dword [ebp - 0x6c], 0xffffffd6
jne 0x100075a7
mov eax, 0x1000b21e
int3
int3
mov edx, dword [esi + 0x34]
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x6c], 1
je 0x100075d9
mov ecx, dword [ebp - 0x18]
pop edi
pop esi
cmp ecx, ebx
pop ebx
je 0x1000759d
call fcn.10004074
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
push ebp
mov ebp, esp
sub esp, 0x1000be3b
push ebx
push esi
mov esi, ecx
add edx, 0x2dcb
mov esi, dword [ebp - 0x60]
or eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x34]
or ebx, dword [ebp - 0x3c]
xor ebx, dword [ebp - 0x3c]
sub esi, 0x20
xor dword [ebp - 0x78], ebx
lea ecx, [esi + 0x4c]
mov dword [ebp - 0x34], ecx
and dword [ebp - 0x3c], 0xffffffe4
push dword [ebp - 0x34]
call fcn.1000324f
sub eax, ecx
mov dword [ebp - 0x74], esp
add ebx, dword [ebp - 0x8c]
mov esp, dword [ebp - 0x64]
add ecx, dword [ebp - 0x8c]
and edi, eax
mov ecx, dword [ebp - 0x44]
sub eax, edx
add dword [ebp - 0x58], 0xffffffce
call ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], edx
add dword [ebp - 0x40], 0xffffffa5
mov dword [ebp - 0x64], esp
add dword [ebp - 0x54], edx
mov esp, dword [ebp - 0x74]
test dword [ebp - 0x24], 0
je 0x1000766d
mov eax, dword [ebp - 4]
push 0xfffffffffffffffb
pop ecx
mov edi, dword [ebp - 8]
sub ecx, dword [esi + 0x1b8]
sub edi, dword [ebp - 0x10]
add eax, ecx
mov dword [ebp - 4], eax
sub eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 8]
push dword [esi + 0x1ac]
mov edx, dword [ebp - 0x30]
mov edi, ecx
mov dword [ebp - 0x64], edx
cmp dword [ebp - 0x24], 0
je 0x1000769e
push eax
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
push esi
push eax
call edi
mov edi, dword [0x1000b1bb]
mov dword [ebp - 0x24], esi
mov eax, dword [ebx]
mov ecx, ebx
mov byte [ebp - 4], 1
call dword [eax + 0x104]
add eax, dword [ebp - 0x80]
cmp dword [ebp - 0x6c], 0x10000002
jne 0x100076cb
lea ebx, [ebp - 0x30]
push ebx
call fcn.10003290
or dword [ebp - 0x3c], 0xfffffff3
sub ebx, dword [ebp - 0x4c]
add dword [ebp - 0x5c], 0xc
or ecx, eax
xor eax, dword [ebp - 0x7c]
sub dword [ebp - 0x38], 1
jne 0x1000722c
or eax, dword [ebp - 0x50]
jmp 0x10007214
push dword [edi]
mov ecx, ebx
call 0x10004c77
test al, al
jne 0x100078a7
push dword [edi]
mov dword [eax], ecx
or esi, dword [ebp - 0x4c]
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], esp
and dword [ebp - 0x3c], 0x5c5
mov esp, dword [ebp - 0x64]
xor dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x44]
and ebx, ecx
call eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], edx
xor eax, dword [ebp - 0x8c]
xor edi, dword [ebp - 0x84]
mov dword [ebp - 0x64], esp
or dword [ebp - 0x80], 0xf93
mov esp, dword [ebp - 0x74]
cmp dword [ebp - 0x6c], 1
je 0x100078be
xor edx, edx
push esi
test eax, eax
push edi
jle 0x100078b2
lea esi, [ecx + 4]
mov edi, dword [esi]
cmp edi, dword [esp + 0xc]
je 0x10007931
inc edx
add esi, 8
cmp edx, eax
jl 0x10007872
xor eax, eax
cmp dword [ebp - 0x6c], 1
je 0x100078ee
cmp ebx, edx
jne 0x1000784e
test ecx, ecx
jne 0x10007862
shl dword [esp + 0x10], 1
cmp dword [ecx + eax*4 - 0x44], 0x1000
jbe 0x10007356
xor ebp, dword [esp + 0x10]
mov eax, dword [0x1000b714]
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x10], ebp
sub dword [ebp - 0x64], 4
or word [ebp - 0x48], 0x3ec
mov edi, dword [ebp - 0x64]
lea ebx, [ecx + 0x973]
push 0
pop ecx
xor ecx, 0x332fe5b
xor ecx, 0x332fe88
and ebx, dword [ebp - 0x48]
add dword [ebp - 0x24], 0
je 0x10007938
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
mov dword [edi], ecx
xor edi, eax
cmp dword [ebp - 0x24], 0x10000002
jne 0x1000796d
call fcn.100081ed
lea eax, [ebp - 0x104]
push 0x1000bc47
push eax
call fcn.10005afd
add esp, 0x20
neg eax
sbb eax, eax
inc eax
mov eax, 0x1000bb87
call 0x10005238
push dword [ebp - 0x5c]
call fcn.1000324f
or ecx, ebx
cmp dword [ebp - 0x6c], 1
je 0x100079b4
jne 0x10007935
or byte [0x47ae70], 1
mov ecx, 0x1000b4b1
push esi
push 1
push dword [esp + 0xc]
mov esi, ecx
call 0x100070c2
xor eax, eax
mov dword [esi + 0x34], 2
mov dword [esi + 0x60], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x6c], eax
mov dword [esi], 0x467b50
mov eax, dword [ebp - 0x30]
mov word [ebp - 0x78], 0x45f
mov edx, dword [ebp - 0x28]
sub esi, dword [ebp - 0x80]
sub eax, 8
xor ebx, dword [ebp - 0x7c]
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x28], edx
lea ebx, [edx + edi + 0x2a]
sub eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x4c]
test dword [ebp - 0x24], 0
je 0x100079ff
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], edx
movsx eax, bl
sub eax, 0x20
je 0x100079fb
sub eax, 3
je 0x10007a19
sub eax, 8
je 0x10007a08
dec eax
dec eax
mov ebx, dword [ebp - 0x60]
add eax, 0x13f1
add edx, 0x6940
mov esi, dword [ebp - 0x28]
cmp dword [ebp - 0x6c], 0xffffffcb
jne 0x10007a43
je 0x10007a70
cmp esi, 0xffffffff
jle 0x10007a21
cmp esi, dword [edi + 4]
jl 0x100079f1
call fcn.100051fb
and dword [ebp - 4], 0
mov eax, dword [edi + 8]
mov eax, dword [eax + esi*8 + 4]
test eax, eax
je 0x100079e8
push 0x1000bfc0
push ebx
push eax
call 0x10004b7f
sub ebx, 0x24
or dword [ebp - 0x84], 0x609
add esi, dword [ebx + 0x74]
mov dword [ebp - 0x28], esi
add edi, ebx
add dword [ebp - 0x58], 0x5b7
mov edi, dword [ebp - 0x28]
and esi, dword [ebp - 0x78]
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10007a84
mov al, byte [esi]
inc esi
mov bl, byte [edi]
inc edi
cmp al, bl
je 0x10007a1c
push eax
push ebx
call fcn.10004004
mov ebx, eax
add esp, 4
mov edx, dword [ebp - 0x44]
and word [ebp - 0x84], 0x8ef
mov edx, dword [edi]
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10007ac1
cmp edi, esi
jl 0x10007aae
pop edi
mov al, bl
pop esi
pop ebx
test byte [0x1000be8e], 1
jne 0x10007a58
or byte [0x47ca80], 1
push 0x1000bd51
call fcn.10005a34
mov dword [ebp - 0x74], esp
cmp dword [ebp - 0x6c], 1
je 0x10007af2
je 0x10007ab0
mov eax, ebx
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x10007aa6
mov eax, edi
test ecx, ecx
jne 0x10007b37
xor ebx, ebx
sub ebx, ecx
sar ebx, 2
add eax, ebx
test eax, eax
mov dword [ebp - 0x10], eax
jge 0x10007b64
xor eax, eax
shl eax, 2
mov esp, dword [ebp - 0x64]
add eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x44]
add dword [ebp - 0x24], 0
je 0x10007b2f
mov dword [eax + 0x1c], edx
mov dword [eax], 0x4676d4
mov dword [eax + 4], ecx
mov dword [eax + 0x20], ecx
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x1c], edi
jne 0x10006c57
mov edx, dword [ebp + 0xc]
mov eax, 0x1000b797
cmp edx, eax
jne 0x10007b73
call ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], edx
or dword [ebp - 0x50], ebx
mov dword [ebp - 0x64], esp
mov dword [ebp - 0x70], ebx
mov esp, dword [ebp - 0x74]
add ebx, eax
cmp dword [ebp - 0x24], 0x10000002
jne 0x10007b7c
call fcn.100042d8
mov ebx, dword [ebx + 0xb0]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov eax, dword [ebx]
push ecx
mov edi, dword [ebp - 0x30]
or word [ebp - 0x80], 0xaa2
mov edx, dword [ebp - 0x34]
cmp dword [ebp - 0x24], 0x4e
jne 0x10007bcb
cmp eax, esi
jb 0x10007c0a
pop esi
cmp dword [0x1000b8e8], 0
jne 0x10007bb1
push 0xfffffffffffffffd
call fcn.10004a17
pop ecx
mov dword [0x1000b8db], 1
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000b7d2
push 0x1000be67
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub edi, 0xc
sub ecx, esi
add dword [ebp - 0x50], ecx
lea edx, [edi + 8]
mov dword [ebp - 0x34], edx
lea ebx, [edx + ebx*4 + 0x11]
cmp dword [ebp - 0x6c], 1
je 0x10007c1a
push esi
mov esi, ecx
mov ecx, dword [esi]
test ecx, ecx
je 0x10007c41
call fcn.100077c4
and dword [esi], 0
pop esi
mov eax, 0x1000bcb1
call 0x10005867
sub esp, 0x1000bc49
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x30], esi
call fcn.1000386f
xor ebx, ebx
push dword [ebp - 0x34]
call fcn.1000324f
sub eax, dword [ebp - 0x8c]
add eax, edi
push dword [ebp - 0x34]
call fcn.1000324f
or eax, dword [ebp - 0x50]
cmp dword [ebp - 0x24], 0xffffffea
jne 0x10007c4a
je 0x10007bf1
mov byte [edi + edx], cl
inc edx
inc ebx
cmp ebx, eax
jl 0x10007c81
pop edi
pop esi
pop ebx
push ebp
push dword [ebp - 0x34]
call fcn.1000324f
or word [ebp - 0x48], 0x278
sub ebx, edi
cmp dword [ebp - 0x6c], 1
je 0x10007c83
test esi, esi
jle 0x10007c7e
mov bl, 1
xor edi, edi
test esi, esi
jle 0x10007c78
mov eax, dword [0x1000b944]
mov ecx, dword [eax + edi*8]
test ecx, ecx
je 0x10007c8b
mov eax, dword [ecx]
push dword [esp + 0x10]
call dword [eax + 0x50]
test al, al
push dword [ebp - 0x80]
call fcn.1000315f
add ebx, dword [ebp - 0x8c]
add dword [ebp - 0x58], 0x4c
mov ebx, dword [ebp - 0x64]
cmp dword [ebp - 0x6c], 1
je 0x10007cc2
jne 0x1000373f
xor edi, edi
cmp esi, 0xffffffe0
ja 0x10006eee
push dword [ebp + 8]
call 0x100066a2
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10004c91
sub ecx, ecx
xor ecx, 0x732fe88
xor ecx, 0x732fe88
xor edx, dword [ebp - 0x3c]
add dword [ebp - 0x24], 0
je 0x10007d08
test dl, dl
je 0x10007d05
movzx eax, byte [ecx]
movzx edi, dl
cmp eax, edi
ja 0x10007cbc
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x475880]
or byte [eax + 0x47dd01], dl
inc eax
cmp eax, edi
jbe 0x10007cea
inc ecx
inc ecx
cmp byte [ecx], 0
jne 0x10007cf9
inc dword [ebp - 4]
add ebx, 8
mov dword [ebx], ecx
cmp dword [ebp - 0x24], 0
je 0x10007d34
add esi, 4
test eax, 0x81010100
je 0x10007cb9
test dl, dl
jmp 0x10007d65
mov edx, 0xffffffff
mov dword [ebp - 0x74], esp
xor ecx, dword [ebp - 0x70]
mov esp, dword [ebp - 0x64]
cmp dword [ebp - 0x24], 0x10000002
jne 0x10007dab
mov esi, eax
xor esi, esi
and byte [ebp - 4], 0
test esi, esi
je 0x10007dfa
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xbc]
test al, al
je 0x10007d28
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xa8]
cmp byte [eax], 0
je 0x10007e20
mov eax, dword [ebx + 0x30]
mov edx, dword [esi]
push ebx
mov ebx, dword [ebp - 0x28]
lea eax, [edx + ecx*2 + 0x8be]
call ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x24], 0x6a
jne 0x10007deb
mov edi, edi
or al, al
je 0x10007daa
mov al, byte [esi]
inc esi
mov bl, byte [edi]
inc edi
cmp al, bl
je 0x10007d80
push eax
push ebx
call fcn.10006988
mov ebx, eax
add esp, 4
call 0x10007be3
add esp, 4
cmp bl, al
je 0x10007e2d
mov dword [ebp - 0x64], esp
cmp dword [ebp - 0x6c], 1
je 0x10007e0e
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x1c]
push ebx
push esi
xor esi, esi
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 8], esi
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov esp, dword [ebp - 0x74]
add word [ebp - 0x54], 0xb69
or ebx, dword [ebp - 0x3c]
cmp dword [ebp - 0x6c], 1
je 0x10007e49
mov dword [esp + 0x10], eax
mov eax, dword [ebp]
call dword [eax + 0xfc]
push eax
push dword [esp + 0x14]
call edi
mov dword [esp + 0x10], eax
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x100]
mov ecx, dword [0x1000b3d3]
mov edx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x58]
or dword [ebp - 0x34], edx
jne 0x10007e66
add dword [ebp - 0x84], ecx
jmp 0x10007214
xor dword [ebp - 0x88], 0x41
lea ebx, [ebp - 0x60]
push ebx
call fcn.10003290
cmp dword [ebp - 0x6c], 1
je 0x10007ea4
xor edx, dword [ebp - 0x50]
lea edi, [ebp - 0x5c]
push edi
call fcn.10003290
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10007ed8
call fcn.10007e7c
xor eax, eax
push dword [esp + 0x18]
push eax
call fcn.10004e60
pop ecx
test eax, eax
pop ecx
je 0x100070d6
cmp edi, ebx
je 0x10007ef0
cmp dword [ebp - 0x24], 0xfffffff7
jne 0x10007f04
clc
add dword [ebp - 0x13], esi
or ch, ch
je 0x10007ea4
fchs
fstp st(0)
fstp st(0)
pop eax
ftst
wait
fnstsw word [ebp - 0xa0]
wait
test byte [ebp - 0x9f], 1
jne 0x10007f0f
fstp st(0)
fld xword [0x57bc7d8d]
lea edi, [ebp - 0x44]
push edi
call fcn.10003290
or ecx, eax
cmp dword [ebp - 0x6c], 1
je 0x10007f36
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [ebx]
push dword [ebp + 0x10]
push ecx
push dword [eax + esi]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
lea edi, [ebp - 0x34]
push edi
call fcn.10003290
and ebx, dword [ebp - 0x48]
xor edi, esi
or word [ebp - 0x4c], 0xafb
lea ecx, [ebp - 0x38]
push ecx
call fcn.10003290
and ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x30]
xor ecx, dword [ebp - 0x84]
mov dword [ebp - 0x64], eax
xor esi, dword [ebp - 0x8c]
xor edi, esi
or esi, dword [ebp - 0x58]
lea ebx, [ebp - 0x30]
push ebx
call fcn.10003290
add dword [ebp - 0x24], 0
je 0x10007fa8
neg cl
sbb ecx, ecx
neg ecx
add ecx, eax
mov dword [ebp - 8], ecx
test edx, edx
je 0x10007f53
mov eax, dword [ebp - 4]
mov dword [edx], eax
test byte [ebp + 0x14], 2
je 0x10007f59
mov eax, dword [ebp - 8]
neg eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10007fb2
or dword [ebp - 0x54], edi
mov esi, dword [ebp - 0x64]
sub ebx, eax
push dword [esi]
and ecx, esi
and word [ebp - 0x48], 0xe3
add dword [ebp - 0x64], 0xc
add eax, dword [ebp - 0x84]
and dword [ebp - 0x7c], esi
ret