Function at 0x10009484
Capabilities:
Accept command line arguments
Create pipe
Create process on windows
Delete directory
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set environment variable

Disassembly:
mov eax, 0x10067856
call fcn.10067078
sub esp, 0x8f4
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0xe8cff0ea
mov esi, 0xf5d3cc11
mov byte [ebp - 0x71], dl
xor edx, edx
push 7
inc edx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x28], 0x856cd833
pop edi
mov dword [ebp - 0x5c], edx
push 5
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x3c], 0xd005
pop eax
mov dword [ebp - 0x20], 0xffffffeb
cmp dword [ebp - 0x20], 6
push 0
pop ebx
je 0x10009642
jmp 0x100094e2
xor edx, edx
inc edx
mov dword [ebp - 0x54], 0x779c63c4
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x54], ebx
je 0x1000950f
mov dword [ebp - 0x18], 0xc25b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov eax, edx
cmp dword [ebp - 0x4c], ebx
jne 0x10009511
mov eax, ebx
neg eax
je 0x10009568
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp eax, 0xec58
setg cl
cmp ecx, dword [ebp - 0x54]
jg 0x10009531
mov eax, ebx
cmp dword [ebp - 0x54], ebx
je 0x10009533
mov eax, edx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xf7bd
jl 0x10009546
mov eax, edx
cmp dword [ebp - 0x4c], ebx
jne 0x10009548
mov eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, 0x335900b
je 0x1000955c
mov eax, edx
cmp dword [ebp - 0x18], ebx
jne 0x1000955e
mov eax, ebx
dec eax
cmp eax, 0xf2f37fc0
mov eax, edx
jbe 0x1000956a
mov eax, ebx
xor edx, edx
cmp eax, 9
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
cmp edx, eax
setge cl
xor edx, edx
imul ecx, dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xffffffee
jl 0x10009632
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x4c], ebx
cmp dword [ebp - 0x4c], 3
jge 0x100095cb
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x318], ecx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 3
jl 0x100095b8
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x318]
mov ecx, dword [ebp - 0x310]
mov eax, dword [ebp - 0x318]
cmp eax, ecx
mov eax, dword [ebp - 0x318]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x54]
push 0
setne bl
xor ecx, ecx
cmp ebx, eax
pop ebx
sete cl
xor eax, eax
imul ecx, dword [ebp - 0x318]
test ecx, ecx
setns al
xor ecx, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, 0x52b3
setne cl
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
jge 0x100095a9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 6
push 5
pop eax
jne 0x100094df
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x20]
cmp eax, edi
je 0x10009659
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov edi, 0x3c1d
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x28]
sub eax, edi
neg eax
push 0xffffffffffffffeb
sbb eax, eax
neg eax
inc eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x5c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x5c], edx
xor edx, edx
mov dword [ebp - 0x20], 0xe8cff0ea
inc edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x54], 0x856cd833
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x3c], 0xd005
pop esi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], 6
je 0x10009830
jmp 0x100096cc
xor edx, edx
inc edx
mov dword [ebp - 0x4c], 0x779c63c4
mov dword [ebp - 0x18], 7
push 5
mov dword [ebp - 0x5c], 6
pop eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x4c], ebx
je 0x10009700
mov dword [ebp - 0x18], 0xc25b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x5c], eax
mov eax, edx
cmp dword [ebp - 0x5c], ebx
jne 0x10009702
mov eax, ebx
neg eax
je 0x10009759
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x54]
cmp eax, 0xec58
setg cl
cmp ecx, dword [ebp - 0x4c]
jg 0x10009722
mov eax, ebx
cmp dword [ebp - 0x4c], ebx
je 0x10009724
mov eax, edx
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xf7bd
jl 0x10009737
mov eax, edx
cmp dword [ebp - 0x5c], ebx
jne 0x10009739
mov eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, 0x335900b
je 0x1000974d
mov eax, edx
cmp dword [ebp - 0x18], ebx
jne 0x1000974f
mov eax, ebx
dec eax
cmp eax, 0xf2f37fc0
mov eax, edx
jbe 0x1000975b
mov eax, ebx
xor edx, edx
cmp eax, 9
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
cmp edx, eax
setge cl
xor edx, edx
imul ecx, dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xffffffee
jl 0x10009823
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x5c], ebx
cmp dword [ebp - 0x5c], 3
jge 0x100097bc
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x25c], ecx
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 3
jl 0x100097a9
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x254]
mov eax, dword [ebp - 0x25c]
cmp eax, ecx
mov eax, dword [ebp - 0x25c]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x4c]
push 0
setne bl
xor ecx, ecx
cmp ebx, eax
pop ebx
sete cl
xor eax, eax
imul ecx, dword [ebp - 0x25c]
test ecx, ecx
setns al
xor ecx, ecx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
cmp eax, 0x52b3
setne cl
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
jge 0x1000979a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 6
jne 0x100096c9
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x20]
cmp eax, 7
je 0x10009848
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x54]
sub eax, edi
neg eax
sbb eax, eax
neg eax
inc eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
inc edx
or eax, 0xffffffff
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x328], eax
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], 0x71b35d56
mov dword [ebp - 0x3c], 0xf0ebf903
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x1c
jmp 0x10009913
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x10], 0x97515801
cmp dword [ebp - 0x32c], 0xfffffff9
je 0x100098e1
cmp dword [ebp - 0x328], ebx
jne 0x100098e1
mov eax, ebx
jmp 0x100098e4
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x324]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
test eax, eax
sets dl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x100098be
push 4
pop esi
push esi
lea ecx, [ebp - 0x188]
call fcn.100166bf
xor edx, edx
inc edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x5c], ebx
jmp 0x10009945
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x188]
mov dword [eax + ecx*4], 0x9c17
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], esi
jl 0x10009932
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000996b
push 0x7ed
push 0x1543
push 0x51b
call dword [sym.imp.USER32.dll_SetWindowLongA]
xor edx, edx
inc edx
mov edi, dword [ebp - 0x188]
cmp dword [edi + 0xc], 0x3622ba39
jne 0x100099a3
mov dword [ebp - 0x5c], 0x7f759609
mov dword [ebp - 0x5c], ebx
jmp 0x10009998
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10009995
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
dec dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0xffffffed
jne 0x10009986
jmp 0x10009ab9
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x3c], 0x8fb0b4
mov dword [ebp - 0x3c], 0x3bdf78b1
mov dword [ebp - 0x3c], 0xc5cecce0
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 3
jg 0x10009ab9
jmp 0x100099d1
xor edx, edx
inc edx
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x188]
cmp dword [edx + eax*4], ebx
je 0x10009a5e
mov edx, dword [edx + 4]
sub edx, dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jne 0x10009a19
mov eax, dword [ebp - 0x1c]
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add eax, ecx
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x188]
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ecx + esi*4]
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, dword [edi + 0xc]
mov dword [ebp - 0x3c], eax
setle cl
cmp dword [ebp - 0x3c], ecx
jne 0x10009a5e
xor eax, eax
lea ebx, [eax + 1]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x188]
push 0
cmp ebx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x1c]
setge dl
xor ebx, ebx
cmp edx, dword [ecx + esi*4]
setne bl
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0x188]
imul ebx, dword [eax]
mov eax, dword [ebp - 0x1c]
cmp ebx, 0xfff8
pop ebx
setne dl
xor ecx, ecx
cmp edx, eax
push 4
setge cl
add ecx, 0x2cf3
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
pop esi
jle 0x100099ce
lea ecx, [ebp - 0x188]
call fcn.100167a4
mov dword [ebp - 0x5c], 0x97f6af11
mov dword [ebp - 0x5c], 0xfffffffa
jmp 0x10009afa
mov dword [ebp - 0x3c], 0x75c19c5a
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10009af2
push ebx
push ebx
push 0x13fc
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp dword [ebp - 0x3c], ebx
jne 0x10009b00
dec dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0xffffffe9
je 0x10009ad4
mov dword [ebp - 0x28], 0xe8cff0ea
xor eax, eax
mov dword [ebp - 0x3c], ebx
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0xbc75286e
mov dword [ebp - 0x3c], 0xff55e00f
mov dword [ebp - 0x3c], 0x61c0f806
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x5c], ebx
jmp 0x10009b45
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x7f8], esi
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 2
jl 0x10009b38
dec dword [ebp - 0x3c]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10009b63
push ebx
push 0x135c
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x5e48d327
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10009b8c
push ebx
push ebx
push 0xfbc
push ebx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
inc eax
mov dword [ebp - 0x5c], ebx
jmp 0x10009b9c
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], ebx
jne 0x10009ba2
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0x19
jne 0x10009b91
mov dword [ebp - 0x30], 0x856cd833
lea ecx, [ebp - 0x6dc]
mov dword [ebp - 0x3c], 0x8b13eca4
mov dword [ebp - 0x3c], 0xbf34fda
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0xfffffffe
push esi
call fcn.100166bf
xor edi, edi
inc edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x5c], ebx
jmp 0x10009beb
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x6dc]
mov dword [eax + ecx*4], 0x708ef6b8
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], esi
jl 0x10009bd8
dec dword [ebp - 0x3c]
lea ecx, [ebp - 0x6dc]
call fcn.100167a4
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0xa
cmp dword [ebp - 0x20], 0xfffffff4
jne 0x10009e1e
push 2
lea ecx, [ebp - 0x384]
call fcn.100166bf
mov dword [ebp - 4], ebx
mov dword [ebp - 0x3c], 0x206f
cmp dword [ebp - 0x3c], 0xd78
jge 0x10009d1f
lea eax, [ebp - 0xbc]
push eax
push 0x10007724
call fcn.1004edeb
pop ecx
pop ecx
lea eax, [ebp - 0x320]
mov dword [ebp - 0x320], ebx
push eax
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x444]
call fcn.100167ef
mov eax, ebx
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x3c], eax
mov ebx, dword [ebp - 0xbc]
test ebx, ebx
jle 0x10009ccc
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x130]
push eax
push 0x10007728
call fcn.1004edeb
mov eax, dword [ebp - 0x130]
add esp, 0xc
sub eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x444]
add eax, eax
mov dword [ecx + edi*4], eax
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x158]
add esi, dword [ebp - 0x130]
inc edi
mov ebx, dword [ebp - 0xbc]
mov dword [ebp - 0x3c], eax
cmp edi, ebx
jl 0x10009c7d
sub esi, eax
push 0
pop eax
mov edi, eax
mov edx, esi
jns 0x10009cd9
neg edx
mov ecx, eax
test ebx, ebx
jle 0x10009d02
mov ebx, dword [ebp - 0x444]
mov eax, esi
sub eax, dword [ebx + ecx*4]
mov ebx, dword [ebp - 0xbc]
jns 0x10009cf4
neg eax
cmp eax, edx
jle 0x10009cfd
lea edi, [ecx + 1]
mov edx, eax
inc ecx
cmp ecx, ebx
jl 0x10009cdf
push edi
push 0x10007730
call fcn.1004f4dc
pop ecx
pop ecx
lea ecx, [ebp - 0x444]
call fcn.100167a4
xor edi, edi
xor ebx, ebx
inc edi
push 2
lea ecx, [ebp - 0x450]
call fcn.100166bf
push 0xfffffffffffffff9
pop esi
mov dword [ebp - 0x24], esi
push 2
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x10009d4c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x384]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10009d3d
mov dword [ebp - 0x1c], ebx
jmp 0x10009d69
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x450]
mov dword [eax + ecx*4], 0x88a137b1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10009d56
mov esi, dword [ebp - 0x450]
mov dword [esi + 4], ebx
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x3c], 0x437f1bd5
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
je 0x10009d93
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebp - 0x384]
cmp dword [eax + ecx*4], ebx
mov eax, dword [ebp - 0x20]
setge dl
imul edx, ecx
imul ecx, edx, 0x7e0f
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov ecx, dword [esi + 4]
mov eax, dword [ebp - 0x384]
setge dl
sub edx, dword [eax + ecx*4]
add edx, 0x7e3b31b3
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0xba00b6fb
setne cl
inc dword [esi + 4]
mov dword [ebp - 0x3c], ecx
cmp dword [esi + 4], edi
jle 0x10009d77
lea ecx, [ebp - 0x450]
call fcn.100167a4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x384]
call fcn.100167a4
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff4
je 0x10009c15
push 4
pop esi
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0xf5d3cc11
mov dword [ebp - 0x3c], 0xd005
push esi
call fcn.100166bf
mov dword [ebp - 0x5c], ebx
jmp 0x10009e56
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x558]
mov dword [eax + ecx*4], 0xa049fe38
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], esi
jl 0x10009e43
mov edi, dword [sym.imp.USER32.dll_MessageBeep]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10009e71
push 0x13c
call edi
mov esi, dword [ebp - 0x558]
xor edx, edx
inc edx
mov dword [esi + 0xc], 0xfffffff8
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], 0x9dce
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x28], 0x17
jmp 0x10009fb1
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x5c], ebx
jmp 0x10009eb7
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x6f0], 0x9f23e525
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 2
jl 0x10009ea6
mov dword [ebp - 0x1c], ebx
jmp 0x10009fa4
mov dword [ebp - 0x20], 9
xor ecx, ecx
mov dword [ebp - 0x50], 0xffffffff
mov eax, dword [ebp - 0x6ec]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setl cl
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1c]
imul eax, eax, 0xffff
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
jb 0x10009f0c
mov eax, edx
cmp dword [ebp - 0x18], ebx
jne 0x10009f0e
mov eax, ebx
cmp eax, dword [ebp - 0x50]
jg 0x10009f67
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0x23
jne 0x10009f62
mov dword [ebp - 0x20], ebx
jmp 0x10009f36
cmp byte [ebp - 0x11], 0
je 0x10009f33
push ebx
push 0xbb9
call dword [sym.imp.USER32.dll_EndPaint]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x3c
mov byte [ebp - 0x11], bl
jg 0x10009f21
cmp byte [ebp - 0x11], 0
je 0x10009f56
push 0x62e
push 0x392
push ebx
call dword [sym.imp.GDI32.dll_OffsetRgn]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x23
je 0x10009f1c
xor edx, edx
inc edx
mov eax, dword [ebp - 0x50]
jmp 0x10009fa1
mov dword [ebp - 0x3c], 4
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
cmp eax, 0x5674
mov eax, dword [ebp - 0x50]
setle cl
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
inc edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], edx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffef
jge 0x10009ec5
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x12
jge 0x10009e9a
inc dword [esi + 0xc]
cmp dword [esi + 0xc], 0xffffffff
jle 0x10009e81
lea ecx, [ebp - 0x558]
call fcn.100167a4
mov dword [ebp - 0x28], 0xffffffeb
mov esi, 0xffff
cmp dword [ebp - 0x28], 6
je 0x1000aa5d
jmp 0x10009ff0
mov esi, 0xffff
mov dword [ebp - 0x34], 0xe8cff0ea
xor eax, eax
mov dword [ebp - 0x1c], 0xb51f
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x3c], 0xd863e320
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 0xfffffffb
jne 0x1000a274
push 4
pop esi
mov dword [ebp - 0x18], 0xfffffffe
lea ecx, [ebp - 0x480]
push esi
call fcn.100166bf
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x3c], 0x4191
mov dword [ebp - 0x5c], ebx
cmp dword [ebp - 0x5c], esi
jge 0x1000a06f
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x480]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], esi
jl 0x1000a054
xor eax, eax
inc eax
mov dword [ebp - 0x18], ebx
jmp 0x1000a231
push eax
lea ecx, [ebp - 0x278]
call fcn.100166bf
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x510]
mov dword [ebp - 0x54], 0xbef7d651
push esi
call fcn.100166bf
xor edx, edx
mov byte [ebp - 4], 3
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x1000a0b6
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x278]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1000a0a6
mov dword [ebp - 0x20], ebx
jmp 0x1000a0d3
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x510]
mov dword [eax + ecx*4], 0xf5d3cc11
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000a0c0
mov eax, dword [ebp - 0x278]
cmp dword [eax], ebx
jne 0x1000a23d
mov dword [ebp - 0x54], ebx
cmp dword [ebp - 0x54], ebx
jl 0x1000a20f
xor edi, edi
inc edi
mov dword [ebp - 0x5c], 0xe5c285ce
xor ecx, ecx
mov dword [ebp - 0x50], 0xf2a6add3
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x278]
mov edx, dword [eax]
or eax, 0xffffffff
sub eax, edx
cmp eax, edx
setge cl
xor eax, eax
add ecx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0x54]
sbb eax, eax
neg eax
sub ecx, eax
sub ecx, dword [ebp - 0x18]
jne 0x1000a13f
mov edx, ebx
cmp dword [ebp - 0x18], ebx
je 0x1000a141
mov edx, edi
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x407858f9
setl al
cmp dword [ebp - 0x5c], eax
jne 0x1000a1eb
cmp dword [ebp - 0x34], ebx
je 0x1000a1eb
push 2
lea ecx, [ebp - 0x468]
call fcn.100166bf
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x5c], ebx
jmp 0x1000a194
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x468]
mov dword [eax + ecx*4], 0x938140a9
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 2
jl 0x1000a181
mov eax, dword [ebp - 0x468]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x480]
cmp ecx, dword [eax + 0xc]
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp eax, 0xb08
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x468]
call fcn.100167a4
xor edi, edi
inc edi
jmp 0x1000a1fd
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a1fd
push ebx
push 0x58
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
inc dword [ebp - 0x3c]
dec dword [ebp - 0x54]
jns 0x1000a0f5
mov edi, dword [sym.imp.USER32.dll_MessageBeep]
lea ecx, [ebp - 0x510]
call fcn.100167a4
xor eax, eax
lea ecx, [ebp - 0x278]
inc eax
mov byte [ebp - 4], al
call fcn.100167a4
dec dword [ebp - 0x18]
push 1
pop eax
cmp dword [ebp - 0x18], 0xffffffe6
jle 0x1000a077
jmp 0x1000a253
lea ecx, [ebp - 0x510]
call fcn.100167a4
lea ecx, [ebp - 0x278]
call fcn.100167a4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x480]
call fcn.100167a4
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffffb
je 0x1000a025
mov esi, 0xffff
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a293
push ebx
push 0x12c8
push 0x2562
push 0x24b0
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
mov dword [ebp - 0x50], 0x779c63c4
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x3c], 0x5720
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a2b8
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a2c9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [ebp - 0x1c], 6
xor ecx, ecx
mov dword [ebp - 0x34], 0xc70bb743
inc ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x5c], ebx
jmp 0x1000a2ef
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xb4], ebx
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], ecx
jl 0x1000a2e2
mov dword [ebp - 0x34], ebx
jmp 0x1000a3e4
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x20], 0x67e307b5
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1000a338
mov dword [ebp - 0x5c], ebx
jmp 0x1000a328
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x138], 0xc427
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], ecx
jl 0x1000a317
inc dword [ebp - 0x138]
dec dword [ebp - 0x18]
jns 0x1000a312
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jg 0x1000a3e1
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xb4], ebx
jne 0x1000a36d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb4]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xb4]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a3d2
push 0x540
push 0x2003
push 0x16e8
push 0xbd1
push 0x2421
call dword [sym.imp.GDI32.dll_IntersectClipRect]
inc dword [ebp - 0x20]
push 1
pop ecx
cmp dword [ebp - 0x20], ebx
jle 0x1000a344
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x1000a2fc
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a406
push 0x2bb
push 0x19b9
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 5
pop eax
xor edx, edx
mov dword [ebp - 0x34], eax
inc edx
push 2
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x5c], ebx
pop ecx
jmp 0x1000a42b
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x704], 0xf6af
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], ecx
jl 0x1000a41a
mov dword [ebp - 0x34], ebx
jmp 0x1000a442
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x704], esi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x1000a435
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a459
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor edx, edx
inc edx
cmp dword [ebp - 0x50], ebx
je 0x1000a472
mov dword [ebp - 0x54], 0xc25b
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1c], eax
mov eax, edx
cmp dword [ebp - 0x1c], ebx
jne 0x1000a474
mov eax, ebx
neg eax
je 0x1000a4cb
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
cmp eax, 0xec58
setg cl
cmp ecx, dword [ebp - 0x50]
jg 0x1000a494
mov eax, ebx
cmp dword [ebp - 0x50], ebx
je 0x1000a496
mov eax, edx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xf7bd
jl 0x1000a4a9
mov eax, edx
cmp dword [ebp - 0x1c], ebx
jne 0x1000a4ab
mov eax, ebx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
sub eax, 0x335900b
je 0x1000a4bf
mov eax, edx
cmp dword [ebp - 0x54], ebx
jne 0x1000a4c1
mov eax, ebx
dec eax
cmp eax, 0xf2f37fc0
mov eax, edx
jbe 0x1000a4cd
mov eax, ebx
xor edx, edx
cmp eax, 9
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
cmp edx, eax
setge cl
xor edx, edx
imul ecx, dword [ebp - 0x28]
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 0xffffffee
jl 0x1000aa50
mov edi, 0x1000773c
mov dword [ebp - 0x3c], 0x1d79
cmp dword [ebp - 0x3c], 0x69e
jge 0x1000a5c3
lea eax, [ebp - 0xc8]
mov esi, 0x10007724
push eax
push esi
call fcn.1004edeb
mov eax, dword [ebp - 0xc8]
pop ecx
pop ecx
test eax, eax
je 0x1000a5bc
jmp 0x1000a54a
mov esi, 0x10007724
dec eax
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0x120]
push eax
push esi
call fcn.1004edeb
lea eax, [ebp - 0x2ac]
push eax
push esi
call fcn.1004edeb
xor eax, eax
add esp, 0x10
inc eax
mov esi, eax
cmp dword [ebp - 0x120], eax
jle 0x1000a597
lea eax, [ebp - 0x300]
push eax
push 0x10007724
call fcn.1004edeb
inc esi
pop ecx
pop ecx
cmp esi, dword [ebp - 0x120]
jl 0x1000a57b
mov eax, dword [ebp - 0x2ac]
mov ecx, 0x10007738
cmp eax, dword [ebp - 0x300]
cmovge ecx, edi
push ecx
call fcn.1004f7e7
mov eax, dword [ebp - 0xc8]
pop ecx
test eax, eax
jne 0x1000a545
dec eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x18], 0x9ad59e57
mov dword [ebp - 0x5c], ebx
jmp 0x1000a5e0
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x79c], 0xfffffffe
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 3
jl 0x1000a5cf
mov dword [ebp - 0x18], ebx
jmp 0x1000a622
mov dword [ebp - 0x5c], 0xa290be4
mov dword [ebp - 0x5c], 2
cmp dword [ebp - 0x5c], ebx
jl 0x1000a613
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a60e
push ebx
call dword [sym.imp.GDI32.dll_GetObjectType]
dec dword [ebp - 0x5c]
jns 0x1000a5fe
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x79c], ebx
jne 0x1000a628
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1000a5eb
cmp dword [ebp - 0x18], ebx
mov byte [ebp - 0x11], bl
je 0x1000a644
cmp byte [ebp - 0x11], 0
je 0x1000a65e
push ebx
push 0xb03
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x1000a65e
cmp byte [ebp - 0x11], 0
je 0x1000a65e
push ebx
push ebx
push ebx
push ebx
push 0x288
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0xa
jmp 0x1000a779
push 2
lea ecx, [ebp - 0x3b4]
call fcn.100166bf
push 2
lea ecx, [ebp - 0x588]
mov dword [ebp - 4], 4
call fcn.100166bf
push 0xfffffffffffffff9
pop esi
mov dword [ebp - 0x5c], esi
push 2
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x1000a6b1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3b4]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1000a6a2
mov dword [ebp - 0x1c], ebx
jmp 0x1000a6ce
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x588]
mov dword [eax + ecx*4], 0x88a137b1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1000a6bb
mov esi, dword [ebp - 0x588]
mov dword [esi + 4], ebx
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x3c], 0x437f1bd5
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
je 0x1000a6f8
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebp - 0x3b4]
cmp dword [eax + ecx*4], ebx
mov eax, dword [ebp - 0x20]
setge dl
imul edx, ecx
imul ecx, edx, 0x7e0f
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov ecx, dword [esi + 4]
mov eax, dword [ebp - 0x3b4]
setge dl
sub edx, dword [eax + ecx*4]
add edx, 0x7e3b31b3
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0xba00b6fb
setne cl
inc dword [esi + 4]
xor eax, eax
mov dword [ebp - 0x3c], ecx
inc eax
cmp dword [esi + 4], eax
jle 0x1000a6dc
lea ecx, [ebp - 0x588]
call fcn.100167a4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b4]
call fcn.100167a4
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff4
je 0x1000a670
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x5c], 0xdf7cd95d
mov dword [ebp - 0x20], 0x9b2b534
mov dword [ebp - 0x3c], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, 0xac46
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, 0x7689351f
setg cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20], 9
sub edx, eax
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x18], ebx
je 0x1000a87d
push 5
pop eax
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x5c], ebx
inc ecx
jmp 0x1000a815
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x2bc], 0x72ee72c3
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], ecx
jl 0x1000a804
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x5c], 0xfffffff7
mov ecx, dword [ebp - 0x2bc]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, 0xffff
setge dl
cmp eax, edx
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5c]
cmp eax, edx
setge cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a890
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1000a890
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a890
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 3
xor esi, esi
mov dword [ebp - 0x5c], ebx
pop ecx
inc esi
cmp dword [ebp - 0x5c], ecx
jge 0x1000a8ad
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x288], esi
inc dword [ebp - 0x5c]
jmp 0x1000a899
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x5c], 9
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x6cf6
mov dword [ebp - 0x18], 0xfffffff5
jmp 0x1000a950
mov dword [ebp - 0x20], 0xf40f
lea ecx, [ebp - 0x61c]
mov dword [ebp - 0x5c], 0xcea445a8
push 2
call fcn.100166bf
mov dword [ebp - 0x5c], 0xf06e85fc
mov dword [ebp - 0x5c], 0xf59f89f2
mov dword [ebp - 0x5c], 0xfffffffb
mov dword [ebp - 0x5c], ebx
jmp 0x1000a925
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x61c]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 2
jl 0x1000a912
mov ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, esi
lea ecx, [ebp - 0x61c]
sete al
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x5c], eax
call fcn.100167a4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 6
je 0x1000a8dd
mov dword [ebp - 0x5c], ebx
jmp 0x1000a9d9
xor eax, eax
mov dword [ebp - 0x18], 2
inc eax
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x6bc]
mov dword [ebp - 0x18], 0x3e8ea471
push eax
call fcn.100166bf
xor edx, edx
mov dword [ebp - 0x18], 0x56a96dad
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x1000a9a8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6bc]
mov dword [eax + ecx*4], 0xa259c42f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1000a995
mov dword [ebp - 0x20], ebx
jmp 0x1000a9c3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x668], 0xa770aacc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1000a9b2
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0x6bc]
call fcn.100167a4
dec dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0xfffffff3
jl 0x1000a95b
mov eax, dword [ebp - 0x54]
xor edx, edx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x280]
mov eax, dword [ebp - 0x288]
cmp eax, ecx
mov eax, dword [ebp - 0x288]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x50]
push 0
setne bl
xor ecx, ecx
cmp ebx, eax
pop ebx
sete cl
xor eax, eax
imul ecx, dword [ebp - 0x288]
test ecx, ecx
setns al
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x52b3
setne cl
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffee
jge 0x1000a511
mov edi, dword [sym.imp.USER32.dll_MessageBeep]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 6
jne 0x10009feb
mov dword [ebp - 0x20], 0xac204e2d
mov dword [ebp - 0x20], ebx
jmp 0x1000aa9e
mov dword [ebp - 0x30], 0x7f0a
mov dword [ebp - 0x30], 0xe17ca002
cmp dword [ebp - 0x30], ebx
je 0x1000aa9b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000aa9b
push ebx
push 0x1c09
push 0x1a12
push 0x1e44
call dword [sym.imp.GDI32.dll_SetPixel]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
jg 0x1000aa69
mov dword [ebp - 0x20], 0x1a
jmp 0x1000aaca
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0x3e95aad8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe9
jg 0x1000aaad
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x28]
cmp eax, 7
je 0x1000aae8
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov esi, 0x1afd
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x30]
sub eax, 0x3c1d
neg eax
sbb eax, eax
neg eax
inc eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x4c]
imul ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
inc ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x24], 0x89ec0021
mov dword [ebp - 0x10], ebx
jmp 0x1000ab55
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1b8], 0x826fbd10
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000ab44
cmp dword [ebp - 0x1c], ecx
jne 0x1000ab67
mov eax, ecx
cmp dword [ebp - 0x3c], ebx
jne 0x1000ab69
mov eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 9
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
sub eax, edx
je 0x1000abb1
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x10], ecx
inc edx
jmp 0x1000aba1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11c], 0x1649
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000ab90
dec dword [ebp - 0x11c]
jmp 0x1000ac6c
xor ecx, ecx
mov dword [ebp - 0x3c], 0x9be9
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 2
jg 0x1000ac55
mov dword [ebp - 0x10], 0xfffffff6
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1b8]
cmp eax, 5
mov eax, dword [ebp - 0x1c]
setle cl
sub ecx, dword [ebp + eax*4 - 0x1b8]
je 0x1000ac34
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1b8]
cmp ecx, eax
mov eax, dword [ebp - 0x1b8]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
cmp ecx, dword [ebp + eax*4 - 0x1b8]
jle 0x1000ac34
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1b8], 0
je 0x1000ac34
xor eax, eax
lea edx, [eax + 1]
jmp 0x1000ac36
xor edx, edx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1000abc7
xor ecx, ecx
mov byte [ebp - 0x11], cl
cmp byte [ebp - 0x11], 0
je 0x1000ac69
push 0x8aa
push ecx
push ecx
call ebx
xor ecx, ecx
xor edx, edx
inc edx
or eax, 0xffffffff
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x3c], 0x71b35d56
mov dword [ebp - 0x3c], 0xf0ebf903
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0x1c
cmp dword [ebp - 0x4c], 0xffffffeb
jge 0x1000ad0c
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x24], 0x97515801
cmp dword [ebp - 0x340], 0xfffffff9
je 0x1000accf
mov eax, ecx
cmp dword [ebp - 0x33c], ecx
je 0x1000acd1
mov eax, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x338]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
test eax, eax
push 0
sets dl
sub edx, ecx
neg edx
pop ecx
sbb edx, edx
inc edx
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xffffffeb
push 1
pop edx
jl 0x1000acae
mov dword [ebp - 0x10], 0x5e48d327
mov byte [ebp - 0x11], cl
cmp byte [ebp - 0x11], 0
je 0x1000ad31
push ecx
push ecx
push 0xfbc
xor eax, eax
push ecx
inc eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor ecx, ecx
mov dword [ebp - 0x10], ecx
jmp 0x1000ad41
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], ecx
jne 0x1000ad47
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x19
jne 0x1000ad36
xor edx, edx
inc edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x24], 0x89ec0021
mov dword [ebp - 0x10], ecx
jmp 0x1000ad74
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1ac], 0x826fbd10
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000ad63
cmp dword [ebp - 0x1c], edx
jne 0x1000ad86
mov eax, edx
cmp dword [ebp - 0x3c], ecx
jne 0x1000ad88
mov eax, ecx
cmp eax, 9
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
sub eax, edx
je 0x1000adca
xor ebx, ebx
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x1000adba
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12c], 0x1649
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000ada9
dec dword [ebp - 0x12c]
jmp 0x1000ae85
xor eax, eax
mov dword [ebp - 0x3c], 0x9be9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1000ae6e
mov dword [ebp - 0x10], 0xfffffff6
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1ac]
cmp eax, 5
mov eax, dword [ebp - 0x1c]
setle cl
sub ecx, dword [ebp + eax*4 - 0x1ac]
je 0x1000ae4d
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x1ac]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1ac]
cmp ecx, eax
mov eax, dword [ebp - 0x1ac]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
cmp ecx, dword [ebp + eax*4 - 0x1ac]
jle 0x1000ae4d
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1ac], 0
je 0x1000ae4d
xor eax, eax
lea edx, [eax + 1]
jmp 0x1000ae4f
xor edx, edx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1000ade0
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000ae80
push 0x8aa
push eax
push eax
call ebx
xor edx, edx
xor ebx, ebx
inc edx
mov dword [ebp - 0x18], 0xa4f833fc
or esi, 0xffffffff
mov dword [ebp - 0x3c], 0x6a3735b2
mov dword [ebp - 0x3c], 0x2038e85a
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x3c], 0x302aff63
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], ebx
jmp 0x1000aec7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x108], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1000aeb6
mov dword [ebp - 0x20], ebx
jmp 0x1000aee2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x5f4], 0x4157736
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1000aed1
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jg 0x1000af73
lea esi, [ebp - 0x744]
lea edi, [ebp - 0x734]
movdqa xmm0, xmmword [0x10007d00]
push ecx
push edi
push esi
lea ecx, [ebp - 0x634]
movdqu xmmword [ebp - 0x744], xmm0
call fcn.1001677e
mov ecx, dword [ebp - 0x634]
xor edx, edx
inc edx
mov dword [ecx + 8], ebx
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x4c], ebx
jmp 0x1000af46
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x108], 0xf14c
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edx
jl 0x1000af35
inc dword [ecx + 8]
cmp dword [ecx + 8], 0
jle 0x1000af29
lea ecx, [ebp - 0x634]
call fcn.100167a4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1000aeff
mov edi, dword [sym.imp.USER32.dll_MessageBeep]
xor edx, edx
inc edx
or esi, 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x1000afc1
mov dword [ebp - 0x10], 0xfd947597
mov dword [ebp - 0x24], 0xf3e76e5b
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], 0x74e80031
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x1000afbb
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x108], ebx
jne 0x1000afbb
dec dword [ebp - 0x10]
jns 0x1000afaa
inc dword [ebp - 0x3c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1000af78
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x10], ebx
jmp 0x1000afdf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6fc], 0x90da1152
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000afce
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 6
jmp 0x1000b094
mov dword [ebp - 0x18], 0xc4530722
mov dword [ebp - 0x10], 0x9855
mov dword [ebp - 0x3c], 0x331c587c
mov dword [ebp - 0x18], ebx
jmp 0x1000b06e
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
je 0x1000b02f
mov ecx, edx
cmp dword [ebp - 0x10], ebx
jne 0x1000b031
mov ecx, ebx
mov eax, dword [ebp - 0x24]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jne 0x1000b04d
mov eax, dword [ebp - 0x6f8]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, 0xb168f92
mov eax, dword [ebp - 0x18]
setle cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xc
jne 0x1000b014
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b091
push 0x1d86
push 0x10a4
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
xor edx, edx
inc edx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x11
jg 0x1000affa
mov dword [ebp - 0x358], esi
mov dword [ebp - 0x354], esi
mov dword [ebp - 0x350], esi
mov dword [ebp - 0x34c], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x3c], 0x2d9e
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x28], ebx
jmp 0x1000b0e7
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x8a0], 2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1000b0d6
mov dword [ebp - 0x28], ebx
jmp 0x1000b103
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x888], 0x9ba07e4f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1000b0f2
mov dword [ebp - 0x28], ebx
jmp 0x1000b11f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x134], 0xf12f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1000b10e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b137
push 0x13c
call edi
xor edx, edx
inc edx
mov dword [ebp - 0x10], ebx
jmp 0x1000b179
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x3c], 0xf4c59cdc
mov dword [ebp - 0x3c], 0x6c2e7ccc
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x3c], 0x6fd43ddc
dec dword [ebp - 0x134]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1000b13c
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x528]
mov dword [ebp - 0x3c], 0x71b35d56
push 7
pop eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x5cc], eax
mov dword [ebp - 0x5c8], eax
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5c0], eax
push edx
call fcn.100166bf
push 5
pop eax
xor edx, edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x1000b1d4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x528]
mov dword [eax + ecx*4], 0x3eb61943
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000b1c1
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov esi, 0xfff6
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne bl
xor ecx, ecx
cmp eax, 0x768c
setne cl
cmp ecx, ebx
je 0x1000b215
xor ebx, ebx
cmp dword [ebp - 0x1c], ebx
jne 0x1000b220
jmp 0x1000b217
xor ebx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1000b2a5
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffffc
inc eax
lea ecx, [ebp - 0x498]
push eax
call fcn.100166bf
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x1000b24d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x498]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000b23e
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp eax, 0x5d56
mov eax, dword [ebp - 0x3c]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, 0x9dce
setl cl
sub eax, ecx
sub eax, dword [ebp - 0x1c]
cmp esi, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x498]
setge cl
mov dword [eax], ecx
lea ecx, [ebp - 0x498]
call fcn.100167a4
jmp 0x1000b329
push 3
mov dword [ebp - 0x3c], 0x942796a4
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x1000b315
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x20], ebx
jmp 0x1000b2d1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x5cc], 0x1d7feae2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000b2c0
mov dword [ebp - 0x20], ebx
jmp 0x1000b30d
mov dword [ebp - 0x10], 0x4a7d2ae8
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b2f2
push ebx
call edi
push 3
pop edx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x1000b30a
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x528]
mov dword [eax], ecx
dec dword [ebp - 0x10]
jns 0x1000b2fd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1000b2dc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1000b2b4
imul eax, dword [ebp - 0x3c], 0xc197
add eax, 0xe7ea
mov dword [ebp - 0x3c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x528]
call fcn.100167a4
mov dword [ebp - 0x3c], 0xf0ebf903
lea ecx, [ebp - 0x64c]
push 2
call fcn.100166bf
mov dword [ebp - 0x10], 0x4801897a
mov dword [ebp - 0x10], ebx
jmp 0x1000b367
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x64c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000b358
xor eax, eax
mov dword [ebp - 0x10], ebx
inc eax
jmp 0x1000b3d0