Function at 0x10008e74
Capabilities:
Accept command line arguments
Delete registry value
Get file size
Query or enumerate registry value
Start service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x108c
call fcn.10078450
push esi
push edi
mov dword [ebp - 0x9a0], 0xfaf425f5
mov dword [ebp - 0xc68], 1
mov dword [ebp - 0x998], 0xffffffff
mov dword [ebp - 0x9b0], 0x1480146
mov dword [ebp - 0x64], 0
jmp 0x10008ebb
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x10008ed1
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x3b8], 0x57fd5464
jmp 0x10008eb4
mov dword [ebp - 0x64], 0
jmp 0x10008ee1
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x10008ef7
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xb2c], 0x5457d670
jmp 0x10008eda
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3b8], 0
jmp 0x10008f25
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3b8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3b8], 0xfffffff6
jne 0x10009060
mov dword [ebp - 0x9a8], 0xfec1b16e
mov dword [ebp - 0x2d4], 0
jmp 0x10008f5c
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 3
jge 0x10008f78
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0xbb4], 8
jmp 0x10008f4f
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbb4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb2c], eax
cmp dword [ebp - 0x998], 0
jne 0x10008fa9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b8]
mov dword [ebp - 0xd54], eax
cmp dword [ebp - 0x9a0], 0
jne 0x10008fdd
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xbb4], 0
jne 0x10008fdd
and dword [ebp - 0x490], 0
jmp 0x10008fe7
mov dword [ebp - 0x490], 1
mov eax, dword [ebp - 0x490]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x3b8]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xbb4]
jl 0x10009017
mov dword [ebp - 0x880], 1
jmp 0x1000901e
and dword [ebp - 0x880], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb2c]
sub eax, dword [ebp - 0x880]
je 0x10009048
cmp dword [ebp - 0x9a8], 0
je 0x10009048
mov dword [ebp - 0x888], 1
jmp 0x1000904f
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x9b0], eax
jmp 0x10008f0a
mov dword [ebp - 0xdb0], 0xdcec3d7d
mov byte [ebp - 0x12a], 0
movzx eax, byte [ebp - 0x12a]
test eax, eax
je 0x10009084
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x100090a3
push 0
push 0x2442
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x210], 0xffffffef
jmp 0x100090c6
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 9
jl 0x100092a7
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x2d8], 0
jmp 0x100090f3
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 3
jge 0x1000910f
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0xd68], 0xffffffff
jmp 0x100090e6
mov dword [ebp - 0x6c], 0
jmp 0x1000911f
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jg 0x1000927c
mov dword [ebp - 0xcc], 0
jmp 0x10009142
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 4
jge 0x1000915e
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0xb6c], 1
jmp 0x10009135
mov dword [ebp - 0xcc], 0
jmp 0x10009177
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x10009193
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0xac0], 0x44accb24
jmp 0x1000916a
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xb6c], 0
jmp 0x100091c1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb6c]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xb6c], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb6c], 2
jg 0x1000921a
mov dword [ebp - 0x218], 0xfffffffc
mov dword [ebp - 0x218], 0
jmp 0x100091f4
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jg 0x10009218
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb6c]
cmp dword [ebp + eax*4 - 0xd68], 0
je 0x10009216
jmp 0x10009218
jmp 0x100091e7
jmp 0x100091a6
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xac0], 0
jmp 0x10009245
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xac0]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xac0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xac0], 3
jg 0x10009277
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x10009275
push 0
push 0x1348
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x1000922c
jmp 0x10009118
mov dword [ebp - 0x6c], 0
jmp 0x1000928c
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x100092a2
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xd68], 0xffffffff
jmp 0x10009285
jmp 0x100090b9
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x2e0], 0
jmp 0x100092ca
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 3
jge 0x100092e6
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0x1050], 0xcff0
jmp 0x100092bd
mov dword [ebp - 0x220], 0
jmp 0x100092ff
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jg 0x100093be
mov dword [ebp - 0x2e8], 0xf8256a9e
mov dword [ebp - 0xe2c], 0
mov dword [ebp - 0xe28], 0
mov dword [ebp - 0xe24], 0
mov dword [ebp - 0xe20], 0
mov dword [ebp - 0x2e8], 0
jmp 0x10009357
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 2
jg 0x100093b9
mov dword [ebp - 0x1a0], 0x99d9
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x1a0], 0
jmp 0x10009390
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 2
jg 0x100093b7
mov byte [ebp - 0x12f], 0
movzx eax, byte [ebp - 0x12f]
test eax, eax
je 0x100093b5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10009383
jmp 0x1000934a
jmp 0x100092f2
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x100093d6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x250], 0x571177e8
mov dword [ebp - 0x9c0], 0xfaf425f5
mov dword [ebp - 0xd5c], 1
mov dword [ebp - 0x9b8], 0xffffffff
mov dword [ebp - 0x9d0], 0x1480146
mov dword [ebp - 0xa8], 0
jmp 0x10009421
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1000943d
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x3c4], 0x57fd5464
jmp 0x10009414
mov dword [ebp - 0xa8], 0
jmp 0x10009456
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x10009472
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xb5c], 0x5457d670
jmp 0x10009449
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3c4], 0
jmp 0x100094a0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3c4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c4], 0xfffffff6
jne 0x100095db
mov dword [ebp - 0x9c8], 0xfec1b16e
mov dword [ebp - 0x228], 0
jmp 0x100094d7
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jge 0x100094f3
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0xb9c], 8
jmp 0x100094ca
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb9c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb5c], eax
cmp dword [ebp - 0x9b8], 0
jne 0x10009524
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c4]
mov dword [ebp - 0xdb8], eax
cmp dword [ebp - 0x9c0], 0
jne 0x10009558
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb9c], 0
jne 0x10009558
and dword [ebp - 0x890], 0
jmp 0x10009562
mov dword [ebp - 0x890], 1
mov eax, dword [ebp - 0x890]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x3c4]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xb9c]
jl 0x10009592
mov dword [ebp - 0x898], 1
jmp 0x10009599
and dword [ebp - 0x898], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb5c]
sub eax, dword [ebp - 0x898]
je 0x100095c3
cmp dword [ebp - 0x9c8], 0
je 0x100095c3
mov dword [ebp - 0x8a0], 1
jmp 0x100095ca
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x9d0], eax
jmp 0x10009485
mov dword [ebp - 0xdc], 0xfffffff7
mov dword [ebp - 0x33c], 7
mov dword [ebp - 0x1a8], 0x29b85755
mov dword [ebp - 0x178], 0xfffffff9
mov dword [ebp - 0x1c4], 0x7d02268f
mov dword [ebp - 0x2f0], 0
jmp 0x10009626
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 1
jge 0x10009642
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0xbec], 0xffff
jmp 0x10009619
cmp dword [ebp - 0xdc], 0
je 0x10009660
mov eax, 0xd8f8
test eax, eax
je 0x10009660
mov dword [ebp - 0x9d8], 1
jmp 0x10009667
and dword [ebp - 0x9d8], 0
cmp dword [ebp - 0xdc], 0xb0b4
jl 0x1000967f
mov dword [ebp - 0x8a8], 1
jmp 0x10009686
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x8a8], eax
je 0x100096a0
mov dword [ebp - 0x8b0], 1
jmp 0x100096a7
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x8b0]
add eax, 3
cmp eax, dword [ebp - 0xdc]
jg 0x100096c4
mov dword [ebp - 0x8b8], 1
jmp 0x100096cb
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x33c]
cmp dword [ebp - 0x8b8], eax
jge 0x100096e5
mov dword [ebp - 0x8c0], 1
jmp 0x100096ec
and dword [ebp - 0x8c0], 0
mov eax, 0x5b2906c9
sub eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x8c0]
jne 0x10009711
cmp dword [ebp - 0x33c], 0
jne 0x10009711
and dword [ebp - 0x9e0], 0
jmp 0x1000971b
mov dword [ebp - 0x9e0], 1
cmp dword [ebp - 0xdc], 3
ja 0x10009730
mov dword [ebp - 0x8c8], 1
jmp 0x10009737
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x33c]
cmp dword [ebp - 0x8c8], eax
jl 0x10009751
mov dword [ebp - 0x8d0], 1
jmp 0x10009758
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
add eax, dword [ebp - 0xdc]
mov dword [ebp - 0x8d8], 1
jmp 0x1000978f
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x8d8], eax
jg 0x100097a9
mov dword [ebp - 0x908], 1
jmp 0x100097b0
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x1c4]
add eax, dword [ebp - 0x908]
je 0x10009927
mov dword [ebp - 0x3b0], 0x37b30477
mov dword [ebp - 0x230], 0
jmp 0x100097e5
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x10009801
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0xb14], 0xb137d370
jmp 0x100097d8
xor eax, eax
inc eax
je 0x10009849
xor eax, eax
inc eax
sub eax, dword [ebp - 0x1c4]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xb14]
sub ecx, eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb14]
dec eax
push 4
pop edx
imul edx, edx, 0
mov dword [ebp + edx - 0xb14], eax
test ecx, ecx
je 0x10009849
mov dword [ebp - 0x7dc], 1
jmp 0x10009850
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x3b0]
imul eax, dword [ebp - 0x7dc]
cmp eax, 0xfffffffb
jne 0x1000987d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb14], 0
je 0x1000987d
mov dword [ebp - 0x878], 1
jmp 0x10009884
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0xdc]
imul eax, dword [ebp - 0x878]
cmp eax, dword [ebp - 0x1a8]
jle 0x100098a5
mov dword [ebp - 0x45c], 1
jmp 0x100098ac
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x3b0]
cmp eax, dword [ebp - 0x45c]
jle 0x100098c6
mov dword [ebp - 0x6b4], 1
jmp 0x100098cd
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x3b0]
cmp dword [ebp - 0x6b4], eax
jle 0x100098e7
mov dword [ebp - 0x464], 1
jmp 0x100098ee
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x1a8]
imul eax, dword [ebp - 0x464]
cmp eax, dword [ebp - 0x1c4]
jge 0x1000990f
mov dword [ebp - 0x874], 1
jmp 0x10009916
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x1a8], eax
jmp 0x10009a70
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x2f8], 0
jmp 0x1000994a
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 1
jge 0x10009966
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0x9e8], 6
jmp 0x1000993d
cmp dword [ebp - 0x238], 0
jne 0x10009a1e
mov eax, dword [ebp - 0x238]
add eax, dword [ebp - 0x178]
je 0x10009992
xor eax, eax
inc eax
je 0x10009992
mov dword [ebp - 0x46c], 1
jmp 0x10009999
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x238], eax
mov eax, 0xe206f6e
cmp eax, 4
jg 0x100099bb
mov dword [ebp - 0x6bc], 1
jmp 0x100099c2
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x6bc], eax
jle 0x100099dc
mov dword [ebp - 0x474], 1
jmp 0x100099e3
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x474], eax
jle 0x100099fd
mov dword [ebp - 0x7e4], 1
jmp 0x10009a04
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0x7e4]
test eax, eax
jne 0x10009a1e
and dword [ebp - 0x47c], 0
jmp 0x10009a28
mov dword [ebp - 0x47c], 1
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jne 0x10009a44
cmp dword [ebp - 0x238], 0
mov eax, 0x900d
neg eax
mov dword [ebp - 0x6c4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6c4]
mov dword [ebp + eax - 0x9e8], ecx
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x10c], 0x2364
mov dword [ebp - 0x350], 0xffffffff
mov dword [ebp - 0x43c], 0xfffffffa
mov dword [ebp - 0x348], 0xae9a07b3
mov dword [ebp - 0x48c], 0xacd4a797
mov dword [ebp - 0x9f8], 0xb370cc32
mov dword [ebp - 0x300], 0
jmp 0x10009ac5
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 3
jge 0x10009ae1
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0xee0], 0xc9fe9a5a
jmp 0x10009ab8
cmp dword [ebp - 0x10c], 0x2d67
jg 0x10009af9
mov dword [ebp - 0x7ec], 1
jmp 0x10009b00
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xbf4], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 1
jb 0x10009b39
mov dword [ebp - 0x484], 1
jmp 0x10009b40
and dword [ebp - 0x484], 0
imul eax, dword [ebp - 0x484], 0xace4
imul eax, eax, 5
cmp eax, 1
jge 0x10009b5e
mov dword [ebp - 0x8e8], 1
jmp 0x10009b65
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x8e8], eax
jge 0x10009b7f
mov dword [ebp - 0x9f0], 1
jmp 0x10009b86
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xbfc], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xc0c], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x48c], eax
jle 0x10009bd9
cmp dword [ebp - 0x43c], 0
je 0x10009bd9
mov dword [ebp - 0x6cc], 1
jmp 0x10009be0
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 0xffffffff
jle 0x10009bf5
mov dword [ebp - 0x494], 1
jmp 0x10009bfc
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
inc eax
mov ecx, dword [ebp - 0x7ec]
sub ecx, eax
mov dword [ebp - 0x49c], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x49c]
mov dword [ebp + eax - 0xee0], ecx
mov eax, dword [ebp - 0x350]
sub eax, dword [ebp - 0x49c]
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x2c], 0xc9ff7503
mov dword [ebp - 0x148], 0xfffffff6
mov dword [ebp - 0x20], 0
jmp 0x10009c63
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10009c79
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x444], 0x1020
jmp 0x10009c5c
mov dword [ebp - 0x20], 0
jmp 0x10009c89
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10009c9f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x914], 0x9b8bc588
jmp 0x10009c82
mov dword [ebp - 0x20], 0
jmp 0x10009caf
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10009cc5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb4c], 0xfffffff8
jmp 0x10009ca8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x444], 0
je 0x10009d47
mov dword [ebp - 0x1d4], 0xc29000d4
mov dword [ebp - 0x1d4], 0xffffffe5
jmp 0x10009cf8
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0xfffffffb
jl 0x10009d28
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x444]
mov dword [ebp + ecx - 0x914], eax
cmp dword [ebp - 0x1d4], 0
je 0x10009d26
jmp 0x10009d28
jmp 0x10009ceb
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x444]
mov dword [ebp + ecx - 0x914], eax
jmp 0x1000a2d6
mov dword [ebp - 0x6fc], 0x2bf35dd7
mov dword [ebp - 0x18], 0
jmp 0x10009d61
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10009d77
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb08], 0xd7d2a7e9
jmp 0x10009d5a
mov dword [ebp - 0x18], 0
jmp 0x10009d87
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10009d9d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xad8], 8
jmp 0x10009d80
mov dword [ebp - 0x18], 0
jmp 0x10009dad
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10009dc3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x438], 0xfff7
jmp 0x10009da6
cmp dword [ebp - 0x2c], 0
jne 0x10009eb4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xa00], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xad8]
mov dword [ebp - 0xa08], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xad8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xad8], eax
mov eax, dword [ebp - 0xa00]
cmp eax, dword [ebp - 0xa08]
jle 0x10009e1e
mov dword [ebp - 0x4a4], 1
jmp 0x10009e25
and dword [ebp - 0x4a4], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xb08]
cmp dword [ebp + eax - 0x444], ecx
jl 0x10009e4d
mov dword [ebp - 0x6d4], 1
jmp 0x10009e54
and dword [ebp - 0x6d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x444]
cmp dword [ebp - 0x6d4], eax
jg 0x10009e75
mov dword [ebp - 0x87c], 1
jmp 0x10009e7c
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x4a4]
cmp eax, dword [ebp - 0x87c]
jne 0x10009e96
mov dword [ebp - 0x4ac], 1
jmp 0x10009e9d
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x6fc]
add eax, dword [ebp - 0x4ac]
jne 0x10009eb4
and dword [ebp - 0x4b4], 0
jmp 0x10009ebe
mov dword [ebp - 0x4b4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb4c]
inc eax
mov dword [ebp - 0x6dc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6dc]
mov dword [ebp + eax - 0xb4c], ecx
mov eax, dword [ebp - 0x6dc]
cmp eax, dword [ebp - 0x4b4]
je 0x10009eff
mov dword [ebp - 0x7f4], 1
jmp 0x10009f06
and dword [ebp - 0x7f4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb08]
cmp dword [ebp - 0x7f4], eax
jl 0x10009f27
mov dword [ebp - 0x4bc], 1
jmp 0x10009f2e
and dword [ebp - 0x4bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x438]
imul eax, dword [ebp - 0x4bc]
add eax, 0x69be5411
cmp eax, 0xd0b182bc
jbe 0x10009f63
mov eax, 0xcebb
test eax, eax
je 0x10009f63
mov dword [ebp - 0x3bc], 1
jmp 0x10009f6a
and dword [ebp - 0x3bc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3bc]
mov dword [ebp + eax - 0xb08], ecx
cmp dword [ebp - 0x3bc], 1
jle 0x10009f92
mov dword [ebp - 0x6e4], 1
jmp 0x10009f99
and dword [ebp - 0x6e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x914]
cmp dword [ebp - 0x6e4], eax
jg 0x10009fba
mov dword [ebp - 0x4c4], 1
jmp 0x10009fc1
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 0xfffffffe
jl 0x10009fd6
mov dword [ebp - 0x8c4], 1
jmp 0x10009fdd
and dword [ebp - 0x8c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x438]
cmp dword [ebp - 0x8c4], eax
jge 0x10009ffe
mov dword [ebp - 0x4cc], 1
jmp 0x1000a005
and dword [ebp - 0x4cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x438]
cmp dword [ebp - 0x4cc], eax
jge 0x1000a026
mov dword [ebp - 0xa10], 1
jmp 0x1000a02d
and dword [ebp - 0xa10], 0
xor eax, eax
add eax, 0xffff787d
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x438]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x438]
jle 0x1000a05c
mov dword [ebp - 0x6ec], 1
jmp 0x1000a063
and dword [ebp - 0x6ec], 0
cmp dword [ebp - 0x6ec], 8
jbe 0x1000a078
mov dword [ebp - 0x4d4], 1
jmp 0x1000a07f
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 0xffffffff
jge 0x1000a094
mov dword [ebp - 0x7fc], 1
jmp 0x1000a09b
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x148]
add eax, dword [ebp - 0x7fc]
cmp eax, dword [ebp - 0x148]
jl 0x1000a2bf
mov dword [ebp - 0x148], 0
jmp 0x1000a0cc
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jg 0x1000a2bd
mov dword [ebp - 0xa5c], 0x66
mov dword [ebp - 0x240], 0
jmp 0x1000a0fc
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 4
jge 0x1000a118
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x1014], 0x1960cc19
jmp 0x1000a0ef
mov dword [ebp - 0x2c], 0
jmp 0x1000a128
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jg 0x1000a2b8
mov dword [ebp - 0x308], 0
jmp 0x1000a14b
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 3
jge 0x1000a167
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0xf4c], 0x408cdc70
jmp 0x1000a13e
cmp dword [ebp - 0x2c], 0
je 0x1000a1eb
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xad8]
cmp dword [ebp + eax - 0x444], ecx
jne 0x1000a195
mov dword [ebp - 0x4dc], 1
jmp 0x1000a19c
and dword [ebp - 0x4dc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp + ecx*4 - 0x434]
add ecx, dword [ebp - 0x4dc]
cmp dword [ebp + eax - 0x1014], ecx
jne 0x1000a1c6
mov dword [ebp - 0x6f4], 1
jmp 0x1000a1cd
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x6f4]
sub ecx, dword [ebp + eax*4 - 0x434]
je 0x1000a1eb
mov dword [ebp - 0x4e4], 1
jmp 0x1000a1f2
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x434]
cmp dword [ebp - 0x4e4], eax
je 0x1000a210
mov dword [ebp - 0x884], 1
jmp 0x1000a217
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x434]
add eax, dword [ebp - 0x884]
mov ecx, dword [ebp - 0x2c]
cmp eax, dword [ebp + ecx*4 - 0x434]
jl 0x1000a23f
mov dword [ebp - 0x4ec], 1
jmp 0x1000a246
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x434]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x4ec]
mov dword [ebp + eax*4 - 0x914], ecx
mov eax, dword [ebp - 0xa5c]
mov dword [ebp - 0xc1c], eax
cmp dword [ebp - 0x6fc], 0
je 0x1000a29a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xf4c], 0
je 0x1000a29a
mov dword [ebp - 0x4f4], 1
jmp 0x1000a2a1
and dword [ebp - 0x4f4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4f4]
mov dword [ebp + eax - 0xb08], ecx
jmp 0x1000a121
jmp 0x1000a0bf
jmp 0x1000a2d6
mov dword [ebp - 0x804], 0xf054f525
mov eax, dword [ebp - 0x804]
dec eax
mov dword [ebp - 0x804], eax
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x204], 0xeb987642
mov dword [ebp - 0x248], 0
jmp 0x1000a303
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x1000a31f
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x358], 0xe91a
jmp 0x1000a2f6
mov dword [ebp - 0x104], 0
jmp 0x1000a338
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jg 0x1000a594
mov dword [ebp - 0x310], 0
jmp 0x1000a35e
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 1
jge 0x1000a377
mov eax, dword [ebp - 0x310]
mov dword [ebp + eax*4 - 0x44], 0x84b81147
jmp 0x1000a351
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x44], 0
jmp 0x1000a39c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x44], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x44], 0
jg 0x1000a551
mov dword [ebp - 0xec], 0x9978f3c
mov dword [ebp - 0xa6c], 0xfffffff9
mov dword [ebp - 0xec], 0
jmp 0x1000a3da
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x1000a530
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp dword [ebp + eax*4 - 0x358], 0
jl 0x1000a407
mov dword [ebp - 0x4fc], 1
jmp 0x1000a40e
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x204], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0xc24], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0xc2c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x358]
mov dword [ebp - 0xc34], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xc3c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xec]
cmp dword [ebp + eax - 0x44], ecx
jne 0x1000a477
mov dword [ebp - 0x704], 1
jmp 0x1000a47e
and dword [ebp - 0x704], 0
cmp dword [ebp - 0x704], 3
jae 0x1000a493
mov dword [ebp - 0x504], 1
jmp 0x1000a49a
and dword [ebp - 0x504], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp dword [ebp - 0x504], eax
jl 0x1000a4b8
mov dword [ebp - 0xa64], 1
jmp 0x1000a4bf
and dword [ebp - 0xa64], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0xc44], eax
imul eax, dword [ebp - 0xec], 7
imul eax, dword [ebp - 0xec]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x44]
cmp eax, dword [ebp + ecx*4 - 0x358]
jg 0x1000a4fc
mov dword [ebp - 0x904], 1
jmp 0x1000a503
and dword [ebp - 0x904], 0
cmp dword [ebp - 0x904], 0
ja 0x1000a518
mov dword [ebp - 0x50c], 1
jmp 0x1000a51f
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0xa6c], eax
jmp 0x1000a3cd
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1000a54c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1000a387
mov dword [ebp - 0x204], 0
jmp 0x1000a56a
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jl 0x1000a58f
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x1000a58d
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x1000a55d
jmp 0x1000a32b
mov dword [ebp - 0x104], 0
jmp 0x1000a5ad
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jl 0x1000a5d9
mov byte [ebp - 0x11a], 0
movzx eax, byte [ebp - 0x11a]
test eax, eax
je 0x1000a5d7
push 0x17ac
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x1000a5a0
mov dword [ebp - 0x74], 0
jmp 0x1000a5e9
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x1000a5ff
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xc4c], 1
jmp 0x1000a5e2
mov dword [ebp - 0x74], 0
jmp 0x1000a60f
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1000a625
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xf9c], 0xf680299
jmp 0x1000a608
mov dword [ebp - 0x250], 0xfffffffb
jmp 0x1000a63e
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0xd
jl 0x1000b155
mov dword [ebp - 8], 1
mov dword [ebp - 0xb84], 0x7736eae1
mov dword [ebp - 0xb80], 0x7736eae1
mov dword [ebp - 0xb7c], 0x7736eae1
mov dword [ebp - 0xb78], 0x7736eae1
mov dword [ebp - 0x920], 0x553a81f6
cmp dword [ebp - 8], 0
je 0x1000a6bd
cmp dword [ebp - 8], 1
jg 0x1000a69c
mov dword [ebp - 0x70c], 1
jmp 0x1000a6a3
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x70c]
test eax, eax
je 0x1000a6bd
mov dword [ebp - 0x514], 1
jmp 0x1000a6c4
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0x985589b5
ja 0x1000a6dc
mov dword [ebp - 0x80c], 1
jmp 0x1000a6e3
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x80c], eax
jg 0x1000a6fa
mov dword [ebp - 0x51c], 1
jmp 0x1000a701
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x51c], eax
jl 0x1000a718
mov dword [ebp - 0x714], 1
jmp 0x1000a71f
and dword [ebp - 0x714], 0
mov eax, 0x8f57
sub eax, dword [ebp - 0x714]
cmp eax, dword [ebp - 8]
jne 0x1000a73b
mov dword [ebp - 0xa74], 1
jmp 0x1000a742
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc54], eax
mov eax, 0x5f27a412
test eax, eax
je 0x1000a769
mov eax, 0x5755261f
test eax, eax
je 0x1000a769
mov dword [ebp - 0x524], 1
jmp 0x1000a770
and dword [ebp - 0x524], 0
cmp dword [ebp - 0x524], 0x2ff18c9a
jge 0x1000a788
mov dword [ebp - 0x88c], 1
jmp 0x1000a78f
and dword [ebp - 0x88c], 0
cmp dword [ebp - 0x88c], 0x77dc
je 0x1000a79f
cmp dword [ebp - 8], 0
cmp dword [ebp - 8], 0x9b37d02
jl 0x1000a808
mov dword [ebp - 0x318], 0
jmp 0x1000a7c1
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 2
jge 0x1000a7dd
mov eax, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0xc88], 0xc4df8e3b
jmp 0x1000a7b4
mov dword [ebp - 8], 0
jmp 0x1000a7ed
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x1000a803
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xc88], 0xffffffff
jmp 0x1000a7e6
jmp 0x1000aa7c
mov dword [ebp - 0xaa4], 0xfffffff8
mov dword [ebp - 0xaa0], 0xfffffff8
mov dword [ebp - 0xa9c], 0xfffffff8
mov dword [ebp - 0xa98], 0xfffffff8
mov dword [ebp - 0x934], 1
mov dword [ebp - 0x258], 0
jmp 0x1000a853
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x1000a86f
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xf4], 0xfffffffb
jmp 0x1000a846
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc5c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
mov dword [ebp - 0xc64], eax
mov eax, dword [ebp - 8]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xf4]
cmp eax, 1
je 0x1000a8b9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf4], 0
jne 0x1000a8b9
and dword [ebp - 0x52c], 0
jmp 0x1000a8c3
mov dword [ebp - 0x52c], 1
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x52c], eax
jg 0x1000a8da
mov dword [ebp - 0x71c], 1
jmp 0x1000a8e1
and dword [ebp - 0x71c], 0
cmp dword [ebp - 0x71c], 3
je 0x1000a8f6
mov dword [ebp - 0x534], 1
jmp 0x1000a8fd
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x534]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x814], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x814]
mov dword [ebp + eax - 0xb84], ecx
cmp dword [ebp - 0x814], 1
jg 0x1000a93a
mov dword [ebp - 0x724], 1
jmp 0x1000a941
and dword [ebp - 0x724], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
mov dword [ebp - 0x53c], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x53c]
mov dword [ebp + eax - 0xaa4], ecx
mov eax, dword [ebp - 0x53c]
imul eax, dword [ebp - 0x724]
mov dword [ebp - 0x920], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf4], 0x558
jl 0x1000a999
mov dword [ebp - 0x92c], 1
jmp 0x1000a9a0
and dword [ebp - 0x92c], 0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xaa4], 0xffffffff
jbe 0x1000a9bc
mov dword [ebp - 0xa54], 1
jmp 0x1000a9c3
and dword [ebp - 0xa54], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
mov dword [ebp - 0xc6c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, 0xffff
sub ecx, dword [ebp + eax - 0xf4]
mov dword [ebp - 0x544], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x544]
mov dword [ebp + eax - 0xaa4], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb84]
cmp dword [ebp - 0x544], eax
jl 0x1000aa22
mov dword [ebp - 0x8cc], 1
jmp 0x1000aa29
and dword [ebp - 0x8cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
cmp dword [ebp - 0x8cc], eax
jle 0x1000aa4a
mov dword [ebp - 0x54c], 1
jmp 0x1000aa51
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 0xfffc
jae 0x1000aa69
mov dword [ebp - 0x72c], 1
jmp 0x1000aa70
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x934], eax
mov byte [ebp - 0x11c], 0
movzx eax, byte [ebp - 0x11c]
test eax, eax
je 0x1000aa9d
push 0x135b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x320], 0xc0d37ad4
mov dword [ebp - 0xc74], 1
mov dword [ebp - 0xc7c], 0
mov dword [ebp - 0xcf0], 0xdcec3d7d
mov byte [ebp - 0x11e], 0
movzx eax, byte [ebp - 0x11e]
test eax, eax
je 0x1000aadf
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x1000aafe
push 0
push 0x2442
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov dword [ebp - 0x320], 0
jmp 0x1000ab17
mov eax, dword [ebp - 0x320]
dec eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
jl 0x1000b150
mov dword [ebp - 0x260], 1
mov dword [ebp - 0x260], 0xffffffef
jmp 0x1000ab47
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 9
jl 0x1000ad28
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x328], 0
jmp 0x1000ab74
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 3
jge 0x1000ab90
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0xd78], 0xffffffff
jmp 0x1000ab67
mov dword [ebp - 0x7c], 0
jmp 0x1000aba0
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jg 0x1000acfd
mov dword [ebp - 0xb0], 0
jmp 0x1000abc3
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 4
jge 0x1000abdf
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0xb3c], 1
jmp 0x1000abb6
mov dword [ebp - 0xb0], 0
jmp 0x1000abf8
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x1000ac14
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0xaf0], 0x44accb24
jmp 0x1000abeb
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xb3c], 0
jmp 0x1000ac42
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb3c]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xb3c], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb3c], 2
jg 0x1000ac9b
mov dword [ebp - 0x268], 0xfffffffc
mov dword [ebp - 0x268], 0
jmp 0x1000ac75
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 2
jg 0x1000ac99
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb3c]
cmp dword [ebp + eax*4 - 0xd78], 0
je 0x1000ac97
jmp 0x1000ac99
jmp 0x1000ac68
jmp 0x1000ac27
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xaf0], 0
jmp 0x1000acc6
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xaf0]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xaf0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xaf0], 3
jg 0x1000acf8
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x1000acf6
push 0
push 0x1348
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x1000acad
jmp 0x1000ab99
mov dword [ebp - 0x7c], 0
jmp 0x1000ad0d
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1000ad23
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xd78], 0xffffffff
jmp 0x1000ad06
jmp 0x1000ab3a
mov dword [ebp - 0x338], 0
mov dword [ebp - 0xcf8], 0xffffffff
mov dword [ebp - 0x93c], 0xfaf425f5
mov dword [ebp - 0xd00], 1
mov dword [ebp - 0xa4c], 0xffffffff
mov dword [ebp - 0x944], 0x1480146
mov dword [ebp - 0xb8], 0
jmp 0x1000ad7d
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x1000ad99
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x3d0], 0x57fd5464
jmp 0x1000ad70
mov dword [ebp - 0xb8], 0
jmp 0x1000adb2
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x1000adce
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xb74], 0x5457d670
jmp 0x1000ada5
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3d0], 0
jmp 0x1000adfc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3d0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3d0], 0xfffffff6
jne 0x1000af37
mov dword [ebp - 0xa20], 0xfec1b16e
mov dword [ebp - 0x330], 0
jmp 0x1000ae33
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 3
jge 0x1000ae4f
mov eax, dword [ebp - 0x330]
mov dword [ebp + eax*4 - 0xb90], 8
jmp 0x1000ae26
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb90]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb74], eax
cmp dword [ebp - 0xa4c], 0
jne 0x1000ae80
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d0]
mov dword [ebp - 0xd08], eax
cmp dword [ebp - 0x93c], 0
jne 0x1000aeb4
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb90], 0
jne 0x1000aeb4
and dword [ebp - 0x554], 0
jmp 0x1000aebe
mov dword [ebp - 0x554], 1
mov eax, dword [ebp - 0x554]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x3d0]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xb90]
jl 0x1000aeee
mov dword [ebp - 0x81c], 1
jmp 0x1000aef5
and dword [ebp - 0x81c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb74]
sub eax, dword [ebp - 0x81c]
je 0x1000af1f
cmp dword [ebp - 0xa20], 0
je 0x1000af1f
mov dword [ebp - 0x55c], 1
jmp 0x1000af26
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x944], eax
jmp 0x1000ade1
mov dword [ebp - 0x338], 0
jmp 0x1000af50
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0
jg 0x1000b14b
mov dword [ebp - 0x57c], 0xf09a2b44
mov dword [ebp - 0x114], 0x2364
mov dword [ebp - 0x3c8], 0xffffffff
mov dword [ebp - 0x360], 0xfffffffa
mov dword [ebp - 0x404], 0xae9a07b3
mov dword [ebp - 0x894], 0xacd4a797
mov dword [ebp - 0x94c], 0xb370cc32
mov dword [ebp - 0x274], 0
jmp 0x1000afbc
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 3
jge 0x1000afd8
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0xf64], 0xc9fe9a5a
jmp 0x1000afaf
cmp dword [ebp - 0x114], 0x2d67
jg 0x1000aff0
mov dword [ebp - 0x574], 1
jmp 0x1000aff7
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xd10], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 1
jb 0x1000b030
mov dword [ebp - 0x734], 1
jmp 0x1000b037
and dword [ebp - 0x734], 0
imul eax, dword [ebp - 0x734], 0xace4
imul eax, eax, 5
cmp eax, 1
jge 0x1000b055
mov dword [ebp - 0x564], 1
jmp 0x1000b05c
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x564], eax
jge 0x1000b076
mov dword [ebp - 0xa70], 1
jmp 0x1000b07d
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xd18], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xd20], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xd28], eax
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x894], eax
jle 0x1000b0d0
cmp dword [ebp - 0x360], 0
je 0x1000b0d0
mov dword [ebp - 0x56c], 1
jmp 0x1000b0d7
and dword [ebp - 0x56c], 0
cmp dword [ebp - 0x56c], 0xffffffff
jle 0x1000b0ec
mov dword [ebp - 0x73c], 1
jmp 0x1000b0f3
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
inc eax
mov ecx, dword [ebp - 0x574]
sub ecx, eax
mov dword [ebp - 0x824], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x824]
mov dword [ebp + eax - 0xf64], ecx
mov eax, dword [ebp - 0x3c8]
sub eax, dword [ebp - 0x824]
mov dword [ebp - 0x94c], eax
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x57c]
dec eax
mov dword [ebp - 0x57c], eax
jmp 0x1000af43
jmp 0x1000ab0a
jmp 0x1000a631
mov dword [ebp - 0x1f0], 0x13638ecf
mov dword [ebp - 0xbd4], 0xdcda7209
mov dword [ebp - 0xbd0], 0xdcda7209
mov dword [ebp - 0xbcc], 0xdcda7209
mov dword [ebp - 0xbc8], 0xdcda7209
mov dword [ebp - 0x84], 0
jmp 0x1000b1a0
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1000b1bc
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x3dc], 0x342eb90d
jmp 0x1000b193
mov dword [ebp - 0x84], 0
jmp 0x1000b1d5
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1000b1f1
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xf7c], 0xffffffff
jmp 0x1000b1c8
mov dword [ebp - 0x1f0], 1
jmp 0x1000b20a
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
jl 0x1000b38d
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0xa8c], 0x2ff18c9a
mov dword [ebp - 0xc0], 0
jmp 0x1000b244
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jg 0x1000b388
mov dword [ebp - 0x54], 0x1a9565e0
mov dword [ebp - 0x54], 0
jmp 0x1000b268
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jg 0x1000b27f
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x3dc], 0
je 0x1000b27d
jmp 0x1000b27f
jmp 0x1000b261
mov dword [ebp - 0x54], 1
jmp 0x1000b28f
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1000b383
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0x3dc], 0
je 0x1000b2db
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x3dc]
mov ecx, dword [ebp - 0xc0]
sub eax, dword [ebp + ecx*4 - 0x3dc]
mov ecx, dword [ebp - 0xc0]
cmp eax, dword [ebp + ecx*4 - 0x3dc]
jge 0x1000b2db
mov dword [ebp - 0x744], 1
jmp 0x1000b2e2
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x744]
sub eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x1f0]
jne 0x1000b2ff
mov dword [ebp - 0xa28], 1
jmp 0x1000b306
and dword [ebp - 0xa28], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xf7c], 0xfffffff9
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0x3dc], 0xfffffff9
jg 0x1000b332
mov dword [ebp - 0x954], 1
jmp 0x1000b339
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x3dc]
mov dword [ebp - 0xd30], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa8c]
mov dword [ebp + eax - 0xbd4], ecx
mov byte [ebp - 0x136], 0
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x1000b37e
push 0xe65
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1000b288
jmp 0x1000b237
jmp 0x1000b1fd
mov dword [ebp - 0x32c], 0x571177e8
mov dword [ebp - 0x8c], 0
jmp 0x1000b3b0
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1000b3cc
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xd38], 1
jmp 0x1000b3a3
mov dword [ebp - 0x8c], 0
jmp 0x1000b3e5
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1000b401
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x1044], 0xf680299
jmp 0x1000b3d8
mov dword [ebp - 0x32c], 0xfffffffb
jmp 0x1000b41a
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0xd
jl 0x1000b4bd
mov dword [ebp - 0x27c], 0xc0d37ad4
mov dword [ebp - 0xd40], 1
mov dword [ebp - 0xd48], 0
mov dword [ebp - 0x27c], 0
jmp 0x1000b45e
mov eax, dword [ebp - 0x27c]
dec eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
jl 0x1000b4b8
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0xd50], 0xffffffff
mov dword [ebp - 0x2dc], 0
jmp 0x1000b494
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0
jg 0x1000b4b6
mov dword [ebp - 0x584], 0xf09a2b44
mov eax, dword [ebp - 0x584]
dec eax
mov dword [ebp - 0x584], eax
jmp 0x1000b487
jmp 0x1000b451
jmp 0x1000b40d
mov dword [ebp - 0x284], 0x571177e8
mov dword [ebp - 0xc8], 0
jmp 0x1000b4e0
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x1000b4fc
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0xd58], 1
jmp 0x1000b4d3
mov dword [ebp - 0xc8], 0
jmp 0x1000b515
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x1000b531
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0xff4], 0xf680299
jmp 0x1000b508
mov dword [ebp - 0x284], 0xfffffffb
jmp 0x1000b54a
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0xd
jl 0x1000b5ed
mov dword [ebp - 0x30c], 0xc0d37ad4
mov dword [ebp - 0xdd8], 1
mov dword [ebp - 0xde0], 0
mov dword [ebp - 0x30c], 0
jmp 0x1000b58e
mov eax, dword [ebp - 0x30c]
dec eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
jl 0x1000b5e8
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0xde8], 0xffffffff
mov dword [ebp - 0x28c], 0
jmp 0x1000b5c4
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
jg 0x1000b5e6
mov dword [ebp - 0x8f4], 0xf09a2b44
mov eax, dword [ebp - 0x8f4]
dec eax
mov dword [ebp - 0x8f4], eax
jmp 0x1000b5b7
jmp 0x1000b581
jmp 0x1000b53d
mov dword [ebp - 0x1e0], 0x13638ecf
mov dword [ebp - 0xbe4], 0xdcda7209
mov dword [ebp - 0xbe0], 0xdcda7209
mov dword [ebp - 0xbdc], 0xdcda7209
mov dword [ebp - 0xbd8], 0xdcda7209
mov dword [ebp - 0x94], 0
jmp 0x1000b638
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x1000b654
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x3e8], 0x342eb90d
jmp 0x1000b62b
mov dword [ebp - 0x94], 0
jmp 0x1000b66d
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x1000b689
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xf94], 0xffffffff
jmp 0x1000b660
mov dword [ebp - 0x1e0], 1
jmp 0x1000b6a2
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jl 0x1000b825
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0x964], 0x2ff18c9a
mov dword [ebp - 0xd0], 0
jmp 0x1000b6dc
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jg 0x1000b820
mov dword [ebp - 0x3c], 0x1a9565e0
mov dword [ebp - 0x3c], 0
jmp 0x1000b700
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x1000b717
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x3e8], 0
je 0x1000b715
jmp 0x1000b717
jmp 0x1000b6f9
mov dword [ebp - 0x3c], 1
jmp 0x1000b727
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x1000b81b
mov eax, dword [ebp - 0xd0]
cmp dword [ebp + eax*4 - 0x3e8], 0
je 0x1000b773
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x3e8]
mov ecx, dword [ebp - 0xd0]
sub eax, dword [ebp + ecx*4 - 0x3e8]
mov ecx, dword [ebp - 0xd0]
cmp eax, dword [ebp + ecx*4 - 0x3e8]
jge 0x1000b773
mov dword [ebp - 0x58c], 1
jmp 0x1000b77a
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x58c]
sub eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x1e0]
jne 0x1000b797
mov dword [ebp - 0x95c], 1
jmp 0x1000b79e
and dword [ebp - 0x95c], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xf94], 0xfffffff9
mov eax, dword [ebp - 0xd0]
cmp dword [ebp + eax*4 - 0x3e8], 0xfffffff9
jg 0x1000b7ca
mov dword [ebp - 0xa30], 1
jmp 0x1000b7d1
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp + eax*4 - 0x3e8]
mov dword [ebp - 0xdf0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x964]
mov dword [ebp + eax - 0xbe4], ecx
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1000b816
push 0xe65
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1000b720
jmp 0x1000b6cf
jmp 0x1000b695
movzx eax, byte [0x1066d6e0]
test eax, eax
je 0x1000b843
mov esi, 0x10081628
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x100104ce
mov dword [ebp - 0x180], 0xfffffff6
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x180], 0xffffffef
jmp 0x1000b872
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x1c
je 0x1000b957
mov dword [ebp - 0x9c], 0
jmp 0x1000b898
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x1000b8b4
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x106c], 0xffffffff
jmp 0x1000b88b
mov dword [ebp - 0x9c], 0
jmp 0x1000b8cd
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x1000b8e9
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x2e4], 0xcb03629a
jmp 0x1000b8c0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2e4], 3
jmp 0x1000b917
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2e4], 0
jl 0x1000b952
mov byte [ebp - 0x138], 0
movzx eax, byte [ebp - 0x138]
test eax, eax
je 0x1000b950
push 0x2c8
push 0x2366
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
jmp 0x1000b8fc
jmp 0x1000b865
mov dword [ebp - 0x200], 0x13638ecf
mov dword [ebp - 0xbc4], 0xdcda7209
mov dword [ebp - 0xbc0], 0xdcda7209
mov dword [ebp - 0xbbc], 0xdcda7209
mov dword [ebp - 0xbb8], 0xdcda7209
mov dword [ebp - 0xd8], 0
jmp 0x1000b9a2
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x1000b9be
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x3f4], 0x342eb90d
jmp 0x1000b995
mov dword [ebp - 0xd8], 0
jmp 0x1000b9d7
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x1000b9f3
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0xef8], 0xffffffff
jmp 0x1000b9ca
mov dword [ebp - 0x200], 1
jmp 0x1000ba0c
mov eax, dword [ebp - 0x200]
dec eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0
jl 0x1000bb8f
mov dword [ebp - 0xa4], 1
mov dword [ebp - 0xa38], 0x2ff18c9a
mov dword [ebp - 0xa4], 0
jmp 0x1000ba46
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jg 0x1000bb8a
mov dword [ebp - 0x30], 0x1a9565e0
mov dword [ebp - 0x30], 0
jmp 0x1000ba6a
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jg 0x1000ba81
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x3f4], 0
je 0x1000ba7f
jmp 0x1000ba81
jmp 0x1000ba63
mov dword [ebp - 0x30], 1
jmp 0x1000ba91
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1000bb85
mov eax, dword [ebp - 0xa4]
cmp dword [ebp + eax*4 - 0x3f4], 0
je 0x1000badd
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x3f4]
mov ecx, dword [ebp - 0xa4]
sub eax, dword [ebp + ecx*4 - 0x3f4]
mov ecx, dword [ebp - 0xa4]
cmp eax, dword [ebp + ecx*4 - 0x3f4]
jge 0x1000badd
mov dword [ebp - 0x74c], 1
jmp 0x1000bae4
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x200]
jne 0x1000bb01
mov dword [ebp - 0xa78], 1
jmp 0x1000bb08
and dword [ebp - 0xa78], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xef8], 0xfffffff9
mov eax, dword [ebp - 0xa4]
cmp dword [ebp + eax*4 - 0x3f4], 0xfffffff9
jg 0x1000bb34
mov dword [ebp - 0x96c], 1
jmp 0x1000bb3b
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp + eax*4 - 0x3f4]
mov dword [ebp - 0xdf8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa38]
mov dword [ebp + eax - 0xbc4], ecx
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x1000bb80
push 0xe65
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1000ba8a
jmp 0x1000ba39
jmp 0x1000b9ff
mov dword [ebp - 0x1b0], 0xe0cf
mov dword [ebp - 0xe40], 0xffffffff
mov dword [ebp - 0xe3c], 0xffffffff
mov dword [ebp - 0xe38], 0xffffffff
mov dword [ebp - 0xe34], 0xffffffff
mov dword [ebp - 0xe00], 0xffffffff
mov dword [ebp - 0x974], 0xa79cc099
mov dword [ebp - 0xe08], 0xffffffff
mov dword [ebp - 0xe10], 0xffffffff
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1b0], 0
jmp 0x1000bc0f
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x19
je 0x1000bd01
mov dword [ebp - 0xe18], 4
mov dword [ebp - 0xbf0], 0x5cc48b16
mov dword [ebp - 0x368], 0x5da2
mov dword [ebp - 0xd6c], 3
mov dword [ebp - 0xe54], 0x7a429adb
mov dword [ebp - 0xe50], 0x7a429adb
mov dword [ebp - 0xe4c], 0x7a429adb
mov dword [ebp - 0xe48], 0x7a429adb
mov dword [ebp - 0x294], 0
jmp 0x1000bc85
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 3
jge 0x1000bca1
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0xf70], 0
jmp 0x1000bc78
mov eax, dword [ebp - 0x368]
dec eax
mov dword [ebp - 0x368], eax
jne 0x1000bcbe
xor eax, eax
inc eax
jne 0x1000bcbe
and dword [ebp - 0x594], 0
jmp 0x1000bcc8
mov dword [ebp - 0x594], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf70]
cmp dword [ebp - 0x594], eax
jle 0x1000bce9
mov dword [ebp - 0x82c], 1
jmp 0x1000bcf0
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x974], eax
jmp 0x1000bc02
mov dword [ebp - 0x188], 0xfffffff6
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x188], 0xffffffef
jmp 0x1000bd30
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x1c
je 0x1000be15
mov dword [ebp - 0xac], 0
jmp 0x1000bd56
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 4
jge 0x1000bd72
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x107c], 0xffffffff
jmp 0x1000bd49
mov dword [ebp - 0xac], 0
jmp 0x1000bd8b
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x1000bda7
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x324], 0xcb03629a
jmp 0x1000bd7e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x324], 3
jmp 0x1000bdd5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x324], 0
jl 0x1000be10
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x1000be0e
push 0x2c8
push 0x2366
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
jmp 0x1000bdba
jmp 0x1000bd23
mov dword [ebp - 0x1b8], 0xfffffff6
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b8], 0xffffffef
jmp 0x1000be44
cmp dword [ebp - 0x1b8], 0x1c
je 0x1000bf0b
mov dword [ebp - 0x5c], 0
jmp 0x1000be61
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x1000be77
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x108c], 0xffffffff
jmp 0x1000be5a
mov dword [ebp - 0x5c], 0
jmp 0x1000be87
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1000be9d
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x29c], 0xcb03629a
jmp 0x1000be80
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x29c], 3
jmp 0x1000becb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x29c], 0
jl 0x1000bf06
mov dword [ebp - 0xbf8], 0x10081628
mov dword [ebp - 0x190], 0xe0cf
mov dword [ebp - 0xe68], 0xffffffff
mov dword [ebp - 0xe64], 0xffffffff
mov dword [ebp - 0xe60], 0xffffffff
mov dword [ebp - 0xe5c], 0xffffffff
mov dword [ebp - 0xdc0], 0xffffffff
mov dword [ebp - 0xa94], 0xa79cc099
mov dword [ebp - 0xc00], 0xffffffff
mov dword [ebp - 0xd7c], 0xffffffff
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x190], 0
jmp 0x1000bf95
cmp dword [ebp - 0x190], 0x19
je 0x1000c087
mov dword [ebp - 0xc08], 4
mov dword [ebp - 0xdc8], 0x5cc48b16
mov dword [ebp - 0x428], 0x5da2
mov dword [ebp - 0xc10], 3
mov dword [ebp - 0xe7c], 0x7a429adb
mov dword [ebp - 0xe78], 0x7a429adb
mov dword [ebp - 0xe74], 0x7a429adb
mov dword [ebp - 0xe70], 0x7a429adb
mov dword [ebp - 0x2ec], 0
jmp 0x1000c00b
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 3
jge 0x1000c027
mov eax, dword [ebp - 0x2ec]
mov dword [ebp + eax*4 - 0xf10], 0
jmp 0x1000bffe
mov eax, dword [ebp - 0x428]
dec eax
mov dword [ebp - 0x428], eax
jne 0x1000c044
xor eax, eax
inc eax
jne 0x1000c044
mov dword [ebp - 0x59c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf10]
cmp dword [ebp - 0x59c], eax
jle 0x1000c06f
mov dword [ebp - 0x2a4], 5
mov dword [ebp - 0xc4], 0
jmp 0x1000c0aa
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x1000c0c6
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0xfc4], 0xffff
jmp 0x1000c09d
mov dword [ebp - 0xc4], 0
jmp 0x1000c0df
cmp dword [ebp - 0xc4], 4
jge 0x1000c0fb
pop edi
pop esi
mov esp, ebp
pop ebp
ret