Function at 0x10008e8d
Capabilities:
Check os version
Connect pipe
Create directory
Create process on windows
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get file size
Modify service
Parse pe header
Query environment variable
Query service status
Start service
Terminate process

Disassembly:
mov eax, 0x100842e7
call fcn.10083520
mov eax, 0x153c
call fcn.1007fde0
push ebx
push esi
push edi
push 3
pop ebx
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0xd98]
mov dword [ebp - 0x28], 0xf251d69f
push ebx
mov byte [ebp - 0x71], dl
call fcn.10026565
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10008ee5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11f0], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10008ecd
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
push 1
pop ebx
jge 0x10008f09
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd98]
call fcn.100265d2
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10008ef0
mov eax, dword [ebp - 0x11ec]
lea ecx, [ebp - 0xd98]
mov dword [ebp - 0x28], eax
or esi, 0xffffffff
mov dword [ebp - 0x28], 0x37b1891f
mov dword [ebp - 4], esi
call fcn.100265cd
push ebx
lea ecx, [ebp - 0x1c4]
call fcn.10026565
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x7ed6f186
mov dword [ebp - 0x40], 0x5a8b060d
mov dword [ebp - 0x5c], 0xdde9ab5c
mov dword [ebp - 0x38], 0xc
jmp 0x10008f73
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10008f70
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffffa
je 0x10008f5f
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x5c]
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x5c]
cmp edx, eax
push 7
setge cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x58], 0x3f6a0837
pop eax
mov dword [ebp - 0x3c], 0x24a8c6a5
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x1a
push 2
pop eax
jle 0x10009125
jmp 0x10008fc4
push 2
pop eax
push eax
lea ecx, [ebp - 0x40c]
call fcn.10026565
push 2
pop ecx
xor eax, eax
mov byte [ebp - 4], cl
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10008ff6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf34], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10008fe1
xor eax, eax
mov dword [ebp - 0x10], eax
push 2
pop esi
cmp dword [ebp - 0x10], ecx
jge 0x1000901a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40c]
call fcn.100265d2
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10009001
push ebx
lea ecx, [ebp - 0x40c]
call fcn.100265d2
push ebx
lea ecx, [ebp - 0x40c]
mov dword [eax], esi
call fcn.100265d2
jmp 0x100090ed
mov dword [ebp - 0x1c], 0xfffffffd
lea ecx, [ebp - 0xa0c]
push ebx
call fcn.10026565
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000907a
push 8
pop esi
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa0c]
call fcn.100265d2
mov dword [eax], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000905d
push 2
xor eax, eax
pop esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x100090bf
push ebx
lea ecx, [ebp - 0x40c]
call fcn.100265d2
mov esi, eax
lea ecx, [ebp - 0xa0c]
xor eax, eax
push eax
call fcn.100265d2
mov ecx, dword [esi]
mov ecx, dword [ebp + ecx*4 - 0xf34]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x100090ba
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
dec dword [ebp - 0x1c]
jns 0x10009082
push 2
pop eax
lea ecx, [ebp - 0xa0c]
mov byte [ebp - 4], al
call fcn.100265cd
push ebx
lea ecx, [ebp - 0x40c]
call fcn.100265d2
push ebx
lea ecx, [ebp - 0x40c]
dec dword [eax]
call fcn.100265d2
push 2
pop esi
cmp dword [eax], 0
jge 0x10009039
xor eax, eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40c]
cmp dword [ebp - 0xf2c], eax
jne 0x10009120
call fcn.100265cd
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x1a
push 0xffffffffffffffff
pop esi
jg 0x10008fc1
jmp 0x10009125
call fcn.100265cd
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10009152
push eax
push 0x1b43
push 0x83b
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10009178
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c4]
call fcn.100265d2
mov dword [eax], 0x97f6af11
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000915a
xor eax, eax
push eax
lea ecx, [ebp - 0x1c4]
call fcn.100265d2
mov dword [eax], 0xffffffee
jmp 0x100094c4
push 2
mov dword [ebp - 0x44], 0x28c176b0
lea ecx, [ebp - 0xdb0]
pop eax
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x44], 0x2b165808
mov dword [ebp - 0x2c], 0xfffffff9
push eax
call fcn.10026565
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x28], 0x57863718
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100091e9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x140c], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100091d0
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x10009215
push dword [ebp - 0x10]
lea ecx, [ebp - 0xdb0]
call fcn.100265d2
push 2
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], eax
jl 0x100091f4
xor eax, eax
inc dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
jmp 0x10009232
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000922f
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x12
jge 0x1000921d
lea ecx, [ebp - 0xdb0]
mov byte [ebp - 4], bl
call fcn.100265cd
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x38], eax
or esi, 0xffffffff
push 5
pop eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x44], 0x94964a53
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], 0x849f845d
mov dword [ebp - 0x28], 0x3050
mov dword [ebp - 0x44], 0x30385d06
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1000929c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1424], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10009284
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x100092b9
push 7
pop edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x143c], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100092a7
inc dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x838]
call fcn.10026565
push 5
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x50], 0xeaba4a2c
mov dword [ebp - 0x28], eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x100092fd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x134], 0x3fa75c19
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100092e5
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10009325
push dword [ebp - 0x10]
lea ecx, [ebp - 0x838]
call fcn.100265d2
mov dword [eax], 0x93dd61fb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10009306
xor eax, eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xfffffff1
jl 0x10009454
push 0x10
pop ebx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], ebx
jge 0x10009363
jmp 0x1000934a
xor eax, eax
push eax
lea ecx, [ebp - 0x1c4]
call fcn.100265d2
cmp dword [eax], 0
jne 0x10009363
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jl 0x10009348
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfcc013ce
push 2
sbb eax, eax
xor ecx, ecx
neg eax
imul eax, eax, 0xfff7
cmp eax, 0x279e56e
pop eax
setne cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x838]
mov esi, dword [ebp - 0x38]
push eax
call fcn.100265d2
lea ecx, [ebp - 0x1c4]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.100265d2
cmp esi, dword [eax]
jle 0x100093b6
mov eax, dword [ebp - 0x38]
xor eax, eax
lea ecx, [ebp - 0x1c4]
push eax
call fcn.100265d2
mov ecx, dword [ebp - 0x48]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1c4]
setl bl
sub ebx, 0x9298
neg ebx
sbb ebx, ebx
xor eax, eax
push eax
inc ebx
call fcn.100265d2
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0x134]
imul edx, ebx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x134]
jne 0x10009404
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x130]
lea ecx, [ebp - 0x1c4]
xor eax, eax
push eax
call fcn.100265d2
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp ecx, dword [eax]
setge dl
xor eax, eax
cmp edx, dword [ebp - 0x28]
jge 0x10009435
cmp dword [ebp - 0x58], eax
je 0x10009435
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x10009438
xor ebx, ebx
inc ebx
push 0
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x130]
cmp dword [ebp - 0x130], 0xfffffff1
pop eax
push 0xffffffffffffffff
pop esi
jge 0x10009338
cmp dword [ebp - 0x130], 0x31234912
jne 0x1000946c
push eax
lea ecx, [ebp - 0x1c4]
call fcn.100265d2
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x38], ebx
xor ebx, ebx
mov eax, dword [ebp - 0x38]
cmp eax, ecx
push 2
pop eax
push eax
lea ecx, [ebp - 0x838]
setle bl
call fcn.100265d2
mov ecx, dword [ebp - 0x58]
mov esi, eax
imul edx, ebx, 0xe8f5
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0x838]
setge al
xor ebx, ebx
imul eax, dword [esi]
inc ebx
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], bl
call fcn.100265cd
xor eax, eax
lea ecx, [ebp - 0x1c4]
push eax
call fcn.100265d2
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x1c4]
push eax
call fcn.100265d2
cmp dword [eax], 0x12
jg 0x1000918f
or esi, 0xffffffff
lea ecx, [ebp - 0x1c4]
mov dword [ebp - 4], esi
call fcn.100265cd
push ebx
lea ecx, [ebp - 0x1e8]
call fcn.10026565
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x3c], 0x3f6a0837
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000952e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1e8]
call fcn.100265d2
mov dword [eax], 0x97f6af11
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10009510
xor eax, eax
push eax
lea ecx, [ebp - 0x1e8]
call fcn.100265d2
lea ecx, [ebp - 0x1e8]
mov dword [eax], 0xffffffee
xor eax, eax
push eax
call fcn.100265d2
cmp dword [eax], 0x12
jle 0x10009783
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x8bc]
push 3
call fcn.10026565
push 7
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x50], 0xeaba4a2c
mov dword [ebp - 0x28], eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1000959f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13c], 0x3fa75c19
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10009587
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100095c7
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8bc]
call fcn.100265d2
mov dword [eax], 0x93dd61fb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100095a8
xor eax, eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xfffffff1
jl 0x100096f6
push 0x10
pop ebx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], ebx
jge 0x10009605
jmp 0x100095ec
xor eax, eax
push eax
lea ecx, [ebp - 0x1e8]
call fcn.100265d2
cmp dword [eax], 0
jne 0x10009605
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jl 0x100095ea
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfcc013ce
push 2
sbb eax, eax
xor ecx, ecx
neg eax
imul eax, eax, 0xfff7
cmp eax, 0x279e56e
pop eax
setne cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x8bc]
mov esi, dword [ebp - 0x38]
push eax
call fcn.100265d2
lea ecx, [ebp - 0x1e8]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.100265d2
cmp esi, dword [eax]
jle 0x10009658
mov eax, dword [ebp - 0x38]
xor eax, eax
lea ecx, [ebp - 0x1e8]
push eax
call fcn.100265d2
mov ecx, dword [ebp - 0x48]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1e8]
setl bl
sub ebx, 0x9298
neg ebx
sbb ebx, ebx
xor eax, eax
push eax
inc ebx
call fcn.100265d2
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0x13c]
imul edx, ebx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x13c]
jne 0x100096a6
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x138]
lea ecx, [ebp - 0x1e8]
xor eax, eax
push eax
call fcn.100265d2
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp ecx, dword [eax]
setge dl
xor eax, eax
cmp edx, dword [ebp - 0x28]
jge 0x100096d7
cmp dword [ebp - 0x3c], eax
je 0x100096d7
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x100096da
xor ebx, ebx
inc ebx
push 0
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x138]
cmp dword [ebp - 0x138], 0xfffffff1
pop eax
push 0xffffffffffffffff
pop esi
jge 0x100095da
cmp dword [ebp - 0x138], 0x31234912
jne 0x1000970e
push eax
lea ecx, [ebp - 0x1e8]
call fcn.100265d2
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x38], ebx
xor ebx, ebx
mov eax, dword [ebp - 0x38]
cmp eax, ecx
push 2
pop eax
push eax
lea ecx, [ebp - 0x8bc]
setle bl
call fcn.100265d2
mov ecx, dword [ebp - 0x3c]
mov esi, eax
imul edx, ebx, 0xe8f5
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0x8bc]
setge al
imul eax, dword [esi]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 6
call fcn.100265cd
xor eax, eax
lea ecx, [ebp - 0x1e8]
push eax
call fcn.100265d2
lea ecx, [ebp - 0x1e8]
inc dword [eax]
xor eax, eax
push eax
call fcn.100265d2
push 1
pop ebx
push 0xffffffffffffffff
cmp dword [eax], 0x12
pop esi
jg 0x10009557
or esi, esi
lea ecx, [ebp - 0x1e8]
mov dword [ebp - 4], esi
call fcn.100265cd
push ebx
lea ecx, [ebp - 0x1d0]
call fcn.10026565
push 8
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3c], 0x3f6a0837
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x100097d2
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1d0]
call fcn.100265d2
mov dword [eax], 0x97f6af11
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x100097b4
xor eax, eax
push eax
lea ecx, [ebp - 0x1d0]
call fcn.100265d2
lea ecx, [ebp - 0x1d0]
mov dword [eax], 0xffffffee
xor eax, eax
push eax
call fcn.100265d2
cmp dword [eax], 0x12
jle 0x10009a27
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x8f8]
push 3
call fcn.10026565
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x50], 0xeaba4a2c
mov dword [ebp - 0x28], eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10009841
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12c], 0x3fa75c19
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10009829
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10009869
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8f8]
call fcn.100265d2
mov dword [eax], 0x93dd61fb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000984a
xor eax, eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xfffffff1
jl 0x10009998
push 0x10
pop ebx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], ebx
jge 0x100098a7
jmp 0x1000988e
xor eax, eax
push eax
lea ecx, [ebp - 0x1d0]
call fcn.100265d2
cmp dword [eax], 0
jne 0x100098a7
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], ebx
jl 0x1000988c
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfcc013ce
push 2
sbb eax, eax
xor ecx, ecx
neg eax
imul eax, eax, 0xfff7
cmp eax, 0x279e56e
pop eax
setne cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x8f8]
mov esi, dword [ebp - 0x38]
push eax
call fcn.100265d2
lea ecx, [ebp - 0x1d0]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.100265d2
cmp esi, dword [eax]
jle 0x100098fa
mov eax, dword [ebp - 0x38]
xor eax, eax
lea ecx, [ebp - 0x1d0]
push eax
call fcn.100265d2
mov ecx, dword [ebp - 0x48]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1d0]
setl bl
sub ebx, 0x9298
neg ebx
sbb ebx, ebx
xor eax, eax
push eax
inc ebx
call fcn.100265d2
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0x12c]
imul edx, ebx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x12c]
jne 0x10009948
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x128]
lea ecx, [ebp - 0x1d0]
xor eax, eax
push eax
call fcn.100265d2
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp ecx, dword [eax]
setge dl
xor eax, eax
cmp edx, dword [ebp - 0x28]
jge 0x10009979
cmp dword [ebp - 0x3c], eax
je 0x10009979
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1000997c
xor ebx, ebx
inc ebx
push 0
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x128]
cmp dword [ebp - 0x128], 0xfffffff1
pop eax
push 0xffffffffffffffff
pop esi
jge 0x1000987c
cmp dword [ebp - 0x128], 0x31234912
jne 0x100099b0
push eax
lea ecx, [ebp - 0x1d0]
call fcn.100265d2
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x38], ebx
xor ebx, ebx
mov eax, dword [ebp - 0x38]
cmp eax, ecx
push 2
pop eax
push eax
lea ecx, [ebp - 0x8f8]
setle bl
call fcn.100265d2
mov ecx, dword [ebp - 0x3c]
mov esi, eax
imul edx, ebx, 0xe8f5
xor eax, eax
push 8
cmp ecx, edx
lea ecx, [ebp - 0x8f8]
setge al
imul eax, dword [esi]
mov dword [ebp - 0x3c], eax
pop eax
mov byte [ebp - 4], al
call fcn.100265cd
xor eax, eax
lea ecx, [ebp - 0x1d0]
push eax
call fcn.100265d2
lea ecx, [ebp - 0x1d0]
inc dword [eax]
xor eax, eax
push eax
call fcn.100265d2
push 1
pop ebx
push 0xffffffffffffffff
cmp dword [eax], 0x12
pop esi
jg 0x100097fb
or esi, esi
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 4], esi
call fcn.100265cd
push 7
pop eax
mov dword [ebp - 0x3c], eax
mov esi, 0x8d13
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffffb
je 0x10009b3a
push 2
pop eax
push eax
lea ecx, [ebp - 0x538]
call fcn.10026565
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0xca0], esi
mov dword [ebp - 0xc9c], esi
mov dword [ebp - 0xc98], esi
mov dword [ebp - 0xc94], esi
mov dword [ebp - 0x50], 0xa37bb008
mov dword [ebp - 0x2c], eax
jmp 0x10009a9c
push dword [ebp - 0x2c]
call fcn.100265d2
mov dword [eax], 0xa18885c6
inc dword [ebp - 0x2c]
push 2
pop eax
lea ecx, [ebp - 0x538]
cmp dword [ebp - 0x2c], eax
jl 0x10009a8b
push ebx
call fcn.100265d2
and dword [eax], 0
jmp 0x10009b09
push 3
mov dword [ebp - 0x38], 0x23d1bca9
xor eax, eax
pop ecx
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], eax
jl 0x10009b1a
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x10009ae4
mov dword [ebp - 0x50], 0x4b03e386
dec dword [ebp - 0x1c]
jns 0x10009ad8
mov eax, dword [ebp - 0x38]
push 0
mov eax, dword [ebp + eax*4 - 0xca0]
dec dword [ebp - 0x38]
pop eax
jns 0x10009ac9
cmp dword [ebp - 0x38], eax
jne 0x10009b1a
push ebx
lea ecx, [ebp - 0x538]
call fcn.100265d2
inc dword [eax]
push ebx
lea ecx, [ebp - 0x538]
call fcn.100265d2
cmp dword [eax], 0x14
jg 0x10009ab5
or eax, 0xffffffff
lea ecx, [ebp - 0x538]
mov dword [ebp - 4], eax
call fcn.100265cd
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffffb
jne 0x10009a4f
xor eax, eax
mov dword [ebp - 0x58], 0xf9b3198a
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x28], 0xd1299d62
mov dword [ebp - 0x44], 0x6402d6fa
push 2
mov dword [ebp - 0x2c], eax
pop ecx
cmp dword [ebp - 0x2c], ecx
jge 0x10009b75
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xe4], 4
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x10009b5d
xor eax, eax
mov dword [ebp - 0x58], 0xffffffe9
or esi, 0xffffffff
cmp dword [ebp - 0x58], 0x17
jg 0x10009cd4
jmp 0x10009b90
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x48], 0x8bb4
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x38], 0xa42bbd4a
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0x23e6
mov dword [ebp - 0x2c], eax
jmp 0x10009bc8
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7a8], 0x413e458c
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x10009bb7
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x10009bde
dec dword [ebp - 0x40]
mov edx, eax
je 0x10009be0
mov edx, ebx
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x7a4]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xe0]
cmp eax, 0xfffffffb
mov eax, dword [ebp - 0xe0]
setle cl
add eax, edx
add eax, ecx
xor ecx, ecx
cmp eax, 0x1cd4
setne cl
cmp ecx, dword [ebp - 0x34]
jne 0x10009c28
mov eax, dword [ebp - 0x7a4]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x58]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
sub ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0xe0]
test ecx, ecx
je 0x10009c61
mov ecx, ebx
cmp dword [ebp - 0x10], eax
jne 0x10009c63
mov ecx, eax
mov eax, dword [ebp - 0xe0]
sub ecx, eax
mov dword [ebp - 0xe4], ecx
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x10009cc7
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xe4], 0
je 0x10009d1b
xor eax, eax
push 2
mov dword [ebp - 0x38], eax
pop ecx
cmp dword [ebp - 0x38], ecx
jge 0x10009cb1
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xe4], 0xfffffffd
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x10009c99
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10009cc2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
dec dword [ebp - 0x10]
jns 0x10009c7b
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 0x17
jle 0x10009b8b
dec dword [ebp - 0x28]
lea ecx, [ebp - 0xff0]
mov dword [ebp - 0x28], 0xf251d69f
push 3
call fcn.10026565
xor eax, eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10009d16
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1250], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10009cfd
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10009d95
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jg 0x10009caf
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x10009d71
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xe4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp eax, edx
mov eax, dword [ebp - 0x10]
setle cl
neg ecx
mov dword [ebp + eax*4 - 0x7a8], ecx
dec dword [ebp - 0x1c]
jns 0x10009d30
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10009d83
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
inc dword [ebp - 0x34]
jmp 0x10009d23
push dword [ebp - 0x10]
call fcn.100265d2
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0xff0]
jl 0x10009d88
mov eax, dword [ebp - 0x124c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x37b1891f
mov dword [ebp - 4], esi
call fcn.100265cd
push ebx
lea ecx, [ebp - 0x1f4]
call fcn.10026565
push 0xc
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x7ed6f186
mov dword [ebp - 0x40], 0x5a8b060d
mov dword [ebp - 0x5c], 0xdde9ab5c
mov dword [ebp - 0x38], ecx
jmp 0x10009e01
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10009dfe
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffffa
je 0x10009ded
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x5c]
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x5c]
cmp edx, eax
push 7
setge cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x58], 0x3f6a0837
pop eax
mov dword [ebp - 0x3c], 0x24a8c6a5
mov dword [ebp - 0x3c], eax
jmp 0x10009f83
push 2
pop eax
push eax
lea ecx, [ebp - 0x364]
call fcn.10026565
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10009e78
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdc8], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10009e63
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10009e8b
push dword [ebp - 0x10]
call fcn.100265d2
and dword [eax], 0
inc dword [ebp - 0x10]
push 2
pop eax
lea ecx, [ebp - 0x364]
cmp dword [ebp - 0x10], eax
jl 0x10009e7d
push ebx
call fcn.100265d2
push 2
pop esi
mov dword [eax], esi
jmp 0x10009f4f
mov dword [ebp - 0x1c], 0xfffffffd
lea ecx, [ebp - 0xbe0]
push ebx
call fcn.10026565
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x10009eea
push 8
pop esi
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xbe0]
call fcn.100265d2
mov dword [eax], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x10009ecd
push 2
xor eax, eax
pop esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x10009f32
push ebx
lea ecx, [ebp - 0x364]
call fcn.100265d2
mov esi, eax
lea ecx, [ebp - 0xbe0]
xor eax, eax
push eax
call fcn.100265d2
mov ecx, dword [esi]
mov ecx, dword [ebp + ecx*4 - 0xdc8]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10009f2a
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
dec dword [ebp - 0x1c]
jns 0x10009ef2
push 2
pop esi
lea ecx, [ebp - 0xbe0]
mov byte [ebp - 4], 0xd
call fcn.100265cd
push ebx
lea ecx, [ebp - 0x364]
call fcn.100265d2
dec dword [eax]
push ebx
lea ecx, [ebp - 0x364]
call fcn.100265d2
cmp dword [eax], 0
jge 0x10009ea9
xor eax, eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x364]
cmp dword [ebp - 0xdc0], eax
jne 0x10009f8f
call fcn.100265cd
inc dword [ebp - 0x3c]
push 0xffffffffffffffff
pop esi
cmp dword [ebp - 0x3c], 0x1a
jg 0x10009e45
jmp 0x10009f94
call fcn.100265cd
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10009fb9
push eax
push 0x1b43
push 0x83b
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
push 0xfffffffffffffffb
pop esi
push 2
mov dword [ebp - 0x44], 0x28c176b0
lea ecx, [ebp - 0xf4c]
pop eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x44], 0x2b165808
mov dword [ebp - 0x2c], 0xfffffff9
push eax
call fcn.10026565
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x28], 0x57863718
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1000a00e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1454], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10009ff9
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x1000a03d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf4c]
call fcn.100265d2
push 2
mov dword [eax], 0xfffffffa
inc dword [ebp - 0x10]
pop eax
cmp dword [ebp - 0x10], eax
jl 0x1000a019
push 2
xor eax, eax
pop esi
inc dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
jmp 0x1000a05a
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000a057
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x12
jge 0x1000a045
lea ecx, [ebp - 0xf4c]
mov byte [ebp - 4], 0xc
call fcn.100265cd
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000a097
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1f4]
call fcn.100265d2
mov dword [eax], 0x97f6af11
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000a079
xor eax, eax
push 5
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x44], 0x94964a53
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], 0x849f845d
mov dword [ebp - 0x28], 0x3050
mov dword [ebp - 0x44], 0x30385d06
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1000a0e6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13d0], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000a0ce
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1000a105
push 7
pop edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1484], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000a0f1
xor eax, eax
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x1f4]
push eax
call fcn.100265d2
lea ecx, [ebp - 0x1f4]
mov dword [eax], 0xffffffee
xor eax, eax
push eax
call fcn.100265d2
cmp dword [eax], 0x12
jle 0x1000b43c
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x38], eax
or eax, 0xffffffff
mov dword [ebp - 0x38], 0x3d06ce12
mov dword [ebp - 0x44], 0x1891f782
mov dword [ebp - 0x44], 0xaa810d21
mov dword [ebp - 0x44], eax
push 5
pop eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000a17a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7d0], 0xfffffff6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000a162
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x1000a190
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x7d0], 0x16df251d
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jl 0x1000a17f
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x940]
push 3
call fcn.10026565
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1080]
mov eax, 0xfff9
mov dword [ebp - 0x10], eax
or eax, 0xffffffff
mov dword [ebp - 0x1c], 0xf90a2337
mov dword [ebp - 0x48], eax
push 4
call fcn.10026565
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x2c], eax
jmp 0x1000a1ed
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1080]
call fcn.100265d2
mov dword [eax], 0xa7a81a82
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1000a1d6
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setge dl
cmp edx, 0x87a7525d
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
add edx, dword [ebp - 0x10]
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x10]
jle 0x1000a25d
mov dword [ebp - 0x50], 0x74da
mov dword [ebp - 0x28], 0xfd06bde6
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
jmp 0x1000a2ca
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x50], 0x95dbc2a4
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jg 0x1000a2ca
push 2
pop eax
push eax
lea ecx, [ebp - 0xde0]
call fcn.10026565
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x2c], eax
jmp 0x1000a29d
push dword [ebp - 0x2c]
call fcn.100265d2
mov dword [eax], 0x60016488
inc dword [ebp - 0x2c]
push 2
pop eax
lea ecx, [ebp - 0xde0]
cmp dword [ebp - 0x2c], eax
jl 0x1000a28c
inc dword [ebp - 0x28]
mov dword [ebp - 0x50], 0x28b983d6
mov byte [ebp - 4], 0x11
call fcn.100265cd
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 3
jle 0x1000a272
push 2
pop esi
lea ecx, [ebp - 0x1080]
mov byte [ebp - 4], 0x10
call fcn.100265cd
mov dword [ebp - 0x30], 0xeaba4a2c
or edx, 0xffffffff
push 5
pop eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x44], 0x94964a53
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], 0x849f845d
mov dword [ebp - 0x28], 0x3050
mov dword [ebp - 0x44], 0x30385d06
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1000a330
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13e8], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000a318
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1000a350
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1490], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000a338
xor eax, eax
inc dword [ebp - 0x28]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x38], 0x5732aa6
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x4c], 0x997
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x50], 0x41b6ba00
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000a391
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x68], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000a380
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1000a399
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x20], 0xffff3188
jge 0x1000a3a5
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
sub eax, 0xcd
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setg dl
add eax, edx
neg eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], eax
jg 0x1000a5f0
mov dword [ebp - 0x40], eax
xor esi, esi
mov dword [ebp - 0x1c], 0x477d717f
or eax, 0xffffffff
mov dword [ebp - 0x28], 0x819
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x68], esi
je 0x1000a427
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x68], esi
je 0x1000a427
mov edx, ebx
jmp 0x1000a42d
xor eax, eax
xor esi, esi
mov edx, eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp + eax*4 - 0x68]
imul eax, edx, 0x40cc
xor edx, edx
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x68]
setg dl
sub edx, eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x4c]
add ecx, edx
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x68]
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setle dl
xor ecx, ecx
add edx, 4
mov eax, dword [ebp + eax*4 - 0x68]
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setg cl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x68]
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setg bl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x68]
cmp eax, ebx
mov eax, dword [ebp - 0x4c]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x3830ae73
setle al
cmp eax, dword [ebp - 0x4c]
jl 0x1000a64c
mov dword [ebp - 0x1c], 0x8d4885c3
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x18]
inc ebx
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp edx, eax
setg cl
cmp ecx, 0x6546d79
jl 0x1000a4e0
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x40], ebx
jg 0x1000a4f5
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x68], esi
je 0x1000a4f5
mov ecx, ebx
jmp 0x1000a4f9
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x48]
add eax, ecx
cmp eax, dword [ebp - 0x1c]
jl 0x1000a50c
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x1000a50e
mov edx, ebx
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x68]
cmp eax, edx
mov eax, dword [ebp - 0x4c]
setne cl
mov eax, dword [ebp + eax*4 - 0x68]
add eax, 0x487b
add eax, ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000a540
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jl 0x1000a5de
mov dword [ebp - 0x40], 0x591552d4
inc dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x1000a5d5
mov dword [ebp - 0x50], 0xfffffff9
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x68]
imul eax, dword [ebp - 0x4c]
test eax, eax
jne 0x1000a57a
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
xor ebx, ebx
mov ecx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge bl
xor edx, edx
imul ebx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
add ebx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x68]
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
add edx, 0x1475504
mov eax, dword [ebp + eax*4 - 0x68]
cmp eax, edx
mov eax, dword [ebp - 0x20]
sete cl
add ecx, dword [ebp + eax*4 - 0x68]
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1000a55e
dec dword [ebp - 0x38]
jns 0x1000a54c
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
push 0
pop eax
push 1
pop ebx
jle 0x1000a3f8
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1000a613
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x124], 0x3fa75c19
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000a5fb
xor eax, eax
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x1c], 0xd1454bcd
mov dword [ebp - 0x44], 0xba832a49
mov dword [ebp - 0x44], 0x1501494d
mov dword [ebp - 0x44], 0xa1dd6b9e
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x48], 0xffffffee
jmp 0x1000a756
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], eax
jg 0x1000a53e
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x68], 0
jne 0x1000a53e
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1000a53e
inc dword [ebp - 0x48]
jmp 0x1000a651
mov dword [ebp - 0x28], 0xf81320f2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000a69f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3ec], 0x51ad
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000a687
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1000a6be
push 5
pop edx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2f4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000a6aa
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000a6db
push eax
push eax
call edi
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
push 2
xor eax, eax
pop ecx
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], eax
jl 0x1000a753
mov dword [ebp - 0x2c], eax
jmp 0x1000a6ff
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x100c], 0xe5ec3521
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1000a6ee
mov eax, dword [ebp - 0x2f0]
mov eax, dword [ebp + eax*4 - 0x3ec]
mov dword [ebp - 0x1c], 0xfffb
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000a73c
mov eax, dword [ebp - 0x2f0]
mov eax, dword [ebp + eax*4 - 0x3ec]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
sub eax, 0xc4dd
jne 0x1000a73c
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1008], ebx
dec dword [ebp - 0x2f0]
push 0
pop eax
jns 0x1000a6e9
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x1a
je 0x1000a678
mov eax, dword [ebp - 0x50]
neg eax
push 0
sbb eax, eax
neg eax
pop eax
setns al
cmp eax, 9
je 0x1000a77f
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000a781
mov eax, ebx
jmp 0x1000a781
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000a7a2
push dword [ebp - 0x10]
lea ecx, [ebp - 0x940]
call fcn.100265d2
mov dword [eax], 0x93dd61fb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000a78b
mov dword [ebp - 0x50], 0x387f
lea ecx, [ebp - 0xdf4]
mov dword [ebp - 0x44], ebx
push 3
call fcn.10026565
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x44], 0xef5d
mov dword [ebp - 0x28], 0xc54c9751
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000a7f7
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xdf4]
call fcn.100265d2
mov dword [eax], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1000a7dc
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000a809
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1000a848
or esi, 0xffffffff
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x44], 0xedf0ebf9
push 2
mov dword [ebp - 0x5c], 0x215169ff
mov dword [ebp - 0x2c], eax
pop ecx
jmp 0x1000a83b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1354], 0x4768c0aa
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1000a82a
dec dword [ebp - 0x28]
dec dword [ebp - 0x5c]
jmp 0x1000a898
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000a895
push 0x40e
push 0x1a0e
push eax
push eax
push 0x281
push 0x427
push 0x118a
push 0xe0b
push 0x13d7
push 0x102b
push 0x4a4
push 0x2162
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
or esi, 0xffffffff
lea ecx, [ebp - 0xdf4]
mov byte [ebp - 4], 0x10
call fcn.100265cd
xor eax, eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xfffffff1
jl 0x1000b185
jmp 0x1000a8c1
or esi, 0xffffffff
push ebx
lea ecx, [ebp - 0x188]
call fcn.10026565
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x40], 0x90f02349
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000a900
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x188]
call fcn.100265d2
mov dword [eax], 0xd3df75dc
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000a8e2
xor eax, eax
push eax
lea ecx, [ebp - 0x188]
call fcn.100265d2
lea ecx, [ebp - 0x188]
and dword [eax], 0
xor eax, eax
push eax
call fcn.100265d2
jmp 0x1000aa08
mov dword [ebp - 0x40], 0xedac
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x50], 0x89ced66e
mov eax, dword [ebp - 0x40]
xor eax, eax
push eax
call fcn.100265d2
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, ebx
setle cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x188]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
xor eax, eax
push eax
call fcn.100265d2
xor eax, eax
lea ecx, [ebp - 0x188]
push eax
call fcn.100265d2
mov esi, eax
lea ecx, [ebp - 0x188]
xor eax, eax
push eax
call fcn.100265d2
mov ecx, dword [esi]
sub ecx, dword [eax]
je 0x1000a991
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000a993
mov esi, ebx
jmp 0x1000a995
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x188]
call fcn.100265d2
lea ecx, [ebp - 0x188]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
call fcn.100265d2
xor ebx, ebx
lea ecx, [ebp - 0x188]
cmp esi, dword [eax]
setne bl
xor eax, eax
push eax
call fcn.100265d2
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x188]
sete dl
sub edx, ebx
xor ebx, ebx
mov dword [ebp - 0x28], edx
inc ebx
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x40], ebx
sbb eax, eax
inc eax
mov dword [ebp - 0x50], eax
xor eax, eax
push eax
call fcn.100265d2
lea ecx, [ebp - 0x188]
dec dword [eax]
xor eax, eax
push eax
call fcn.100265d2
push 0xffffffffffffffff
pop esi
cmp dword [eax], 0xffffffe3
lea ecx, [ebp - 0x188]
jg 0x1000a922
mov byte [ebp - 4], 0x10
call fcn.100265cd
or esi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x48], esi
mov ecx, 0xf11b
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x6c8], ecx
mov dword [ebp - 0x6c4], ecx
mov dword [ebp - 0x6c0], ecx
mov dword [ebp - 0x6bc], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x50], 0x51f4
mov dword [ebp - 0x18], 0xc2e3
push 2
mov dword [ebp - 0x4c], eax
pop ecx
cmp dword [ebp - 0x4c], ecx
jge 0x1000aa82
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x72c], ebx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jl 0x1000aa6e
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x1000aaa4
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x1394], 0x7384c7b
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 4
jl 0x1000aa8b
xor eax, eax
mov dword [ebp - 0x4c], eax
jmp 0x1000aaba
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x7bc], 0xdd146f1
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ebx
jl 0x1000aaa9
mov dword [ebp - 0x10], 0xd
cmp dword [ebp - 0x10], 0x11
jne 0x1000abba
mov dword [ebp - 0x20], 0x4a0d
xor edx, edx
mov dword [ebp - 0x40], ebx
mov ecx, 0xebfb2c41
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x5c], 0xfffffff9
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x6bc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
push 1
setg dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub edx, 0x51c3
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setle cl
xor ebx, ebx
cmp eax, ecx
setg bl
xor edx, edx
sub ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ebx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp eax, edx
pop ebx
setle cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x20], esi
sbb eax, eax
neg eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x20], 0xd2c298c2
mov eax, dword [ebp - 0x40]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
xor ecx, ecx
cmp edx, 0x5bb5fb49
setge cl
sub ecx, 0xc1b09c82
neg ecx
sbb ecx, ecx
imul eax, dword [ebp - 0x34], 0x95
inc ecx
sub eax, ecx
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x11
je 0x1000aad0
mov eax, dword [ebp - 0x6bc]
push 0xfffffffffffffff7
pop eax
cmp dword [ebp - 0x6c8], eax
jle 0x1000abce
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x6c0]
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setle dl
sub edx, 0xfffffffb
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, esi
setg al
add eax, 0x13599695
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1000ac07
cmp dword [ebp - 0x40], eax
je 0x1000ac09
mov eax, ebx
mov dword [ebp - 0x72c], eax
mov ecx, 0xbb1d
mov edx, dword [ebp - 0x50]
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
sub ecx, eax
xor eax, eax
cmp ecx, edx
setl al
cmp eax, dword [ebp - 0x6c8]
jle 0x1000ac88
mov dword [ebp - 0x1c], 0x7dfd
xor ecx, ecx
mov dword [ebp - 0x28], 0x9fb14be5
mov dword [ebp - 0x50], 0xfffffffd
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, esi
setle cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x72c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], ebx
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1000ac7c
mov ecx, eax
cmp dword [ebp - 0x138c], eax
je 0x1000ac7e
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x50], ecx
jmp 0x1000acac
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000aca0
push 0x18c0
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x7bc], eax
push 0x10
pop eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], eax
jge 0x1000ae54
push 2
pop esi
push 3
lea ecx, [ebp - 0x4c4]
call fcn.10026565
push 7
mov byte [ebp - 4], 0x15
pop eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000acfc
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x4c4]
call fcn.100265d2
and dword [eax], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1000ace0
xor eax, eax
push eax
lea ecx, [ebp - 0x4c4]
call fcn.100265d2
mov dword [eax], 0xe
jmp 0x1000ada9
push 4
lea ecx, [ebp - 0xa24]
call fcn.10026565
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1000ad52
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa24]
call fcn.100265d2
and dword [eax], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1000ad36
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000ad6e
push 0x2500
push 0xefc
push eax
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x1000ad84
push dword [ebp - 0x38]
call fcn.100265d2
mov dword [eax], 0xc7555b7c
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
lea ecx, [ebp - 0xa24]
jl 0x1000ad73
mov byte [ebp - 4], 0x15
call fcn.100265cd
xor eax, eax
lea ecx, [ebp - 0x4c4]
push eax
call fcn.100265d2
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4c4]
push eax
call fcn.100265d2
cmp dword [eax], 0x15
jl 0x1000ad13
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1000ae20
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000ade9
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x628], 0x38c08872
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1000add0
xor eax, eax
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 3
jge 0x1000ae1d
push dword [ebp - 0x624]
lea ecx, [ebp - 0x4c4]
call fcn.100265d2
or dword [eax], 0xffffffff
inc dword [ebp - 0x624]
cmp dword [ebp - 0x624], 3
jl 0x1000adf8
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jle 0x1000adc7
lea ecx, [ebp - 0x4c4]
mov byte [ebp - 4], 0x10
call fcn.100265cd
xor eax, eax
lea ecx, [ebp - 0x1f4]
push eax
call fcn.100265d2
cmp dword [eax], 0
jne 0x1000ae54
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x10
jl 0x1000acbe
push ebx
lea ecx, [ebp - 0x280]
call fcn.10026565
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x34], 3
push 7
pop eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], 0x74643a64
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000aea0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x280]
call fcn.100265d2
mov dword [eax], 0x22124f84
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000ae82
xor eax, eax
push eax
lea ecx, [ebp - 0x280]
call fcn.100265d2
xor eax, eax
lea ecx, [ebp - 0x280]
push eax
call fcn.100265d2
lea ecx, [ebp - 0x280]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
xor eax, eax
push eax
call fcn.100265d2
xor ebx, ebx
lea ecx, [ebp - 0x280]
cmp dword [eax], 0x87642760
sete bl
xor eax, eax
push eax
call fcn.100265d2
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor eax, eax
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x280]
push eax
call fcn.100265d2
mov esi, dword [ebp - 0x34]
lea ecx, [ebp - 0x280]
imul esi, dword [eax]
xor eax, eax
push eax
add esi, dword [ebp - 0x50]
call fcn.100265d2
lea ecx, [ebp - 0x280]
mov edi, dword [eax]
imul edi, esi
sub edi, 0xafa9
neg edi
sbb edi, edi
xor eax, eax
push eax
inc edi
call fcn.100265d2
push 0xfffffffffffffff8
mov dword [eax], edi
mov dword [ebp - 0x34], 0x15
pop edi
cmp dword [ebp - 0x34], edi
je 0x1000b085
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x50], 0x9ab
mov dword [ebp - 0x2c], eax
jmp 0x1000af6d
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x3a8], 0x17c0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000af5c
mov dword [ebp - 0x38], 9
jmp 0x1000b06d
push 3
lea ecx, [ebp - 0x880]
call fcn.10026565
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000afbf
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x880]
call fcn.100265d2
mov dword [eax], 0x2b05
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1000afa0
xor eax, eax
push eax
lea ecx, [ebp - 0x880]
call fcn.100265d2
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x280]
mov esi, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.100265d2
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x3a8]
cmp esi, eax
mov eax, dword [ebp - 0x50]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
neg eax
je 0x1000b008
mov eax, dword [ebp - 0x5c]
xor eax, eax
lea ecx, [ebp - 0x280]
push eax
call fcn.100265d2
push 2
mov ecx, 0xffff0001
sub ecx, dword [eax]
pop eax
cmp eax, ecx
mov ecx, dword [ebp - 0x34]
sbb eax, eax
xor edx, edx
neg eax
add ecx, eax
mov eax, dword [ebp - 0x3a8]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x880]
mov eax, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.100265d2
lea ecx, [ebp - 0x880]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0x17
call fcn.100265cd
dec dword [ebp - 0x38]
push 8
pop eax
cmp dword [ebp - 0x38], eax
jg 0x1000af7e
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jne 0x1000af4b
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x10
call fcn.100265cd
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfcc013ce
push 2
sbb eax, eax
xor ecx, ecx
neg eax
imul eax, eax, 0xfff7
cmp eax, 0x279e56e
pop eax
setne cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x940]
mov esi, dword [ebp - 0x38]
push eax
call fcn.100265d2
lea ecx, [ebp - 0x1f4]
mov dword [eax], esi
xor eax, eax
push eax
call fcn.100265d2
cmp esi, dword [eax]
jle 0x1000b0e7
mov eax, dword [ebp - 0x38]
xor eax, eax
lea ecx, [ebp - 0x1f4]
push eax
call fcn.100265d2
mov ecx, dword [ebp - 0x48]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1f4]
setl bl
sub ebx, 0x9298
neg ebx
sbb ebx, ebx
xor eax, eax
push eax
inc ebx
call fcn.100265d2
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0x124]
imul edx, ebx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x124]
jne 0x1000b135
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x1f4]
xor eax, eax
push eax
call fcn.100265d2
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp ecx, dword [eax]
setge dl
xor eax, eax
cmp edx, dword [ebp - 0x54]
jge 0x1000b166
cmp dword [ebp - 0x58], eax
je 0x1000b166
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x1000b169
xor ebx, ebx
inc ebx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x120]
cmp dword [ebp - 0x120], 0xfffffff1
jge 0x1000a8be
push 4
lea ecx, [ebp - 0x1dc]
call fcn.10026565
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x28], 0x19d87263
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1000b1d4
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1dc]
call fcn.100265d2
mov dword [eax], 0xac204e2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1000b1b5
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000b1e4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
pop eax
push eax
lea ecx, [ebp - 0x1dc]
call fcn.100265d2
push 2
lea ecx, [ebp - 0x1dc]
and dword [eax], 0
pop eax
push eax
call fcn.100265d2
jmp 0x1000b394
push 2
pop eax
mov dword [ebp - 0x48], 0x974a
mov dword [ebp - 0x5c], 0x8394
push eax
call fcn.100265d2
push 2
lea ecx, [ebp - 0x1dc]
imul esi, dword [eax], 0xfff7
pop eax
push eax
neg esi
sbb esi, esi
neg esi
call fcn.100265d2
xor eax, eax
lea ecx, [ebp - 0x1dc]
push eax
call fcn.100265d2
mov ecx, dword [ebp - 0x48]
xor edx, edx
push 2
cmp dword [eax], ecx
pop ecx
setl dl
xor eax, eax
cmp edx, ecx
jb 0x1000b279
cmp dword [ebp - 0x48], eax
je 0x1000b279
push ecx
lea ecx, [ebp - 0x1dc]
call fcn.100265d2
cmp dword [eax], 0
je 0x1000b277
mov eax, ebx
jmp 0x1000b279
xor eax, eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x34]
test eax, eax
je 0x1000b292
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1000b294
mov eax, ebx
jmp 0x1000b294
xor eax, eax
cmp esi, eax
je 0x1000b2dd
xor eax, eax
push 7
mov dword [ebp - 0x34], eax
pop ebx
jmp 0x1000b2b9
cmp byte [ebp - 0x21], 0
je 0x1000b2b6
push 0x1f82
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
mov byte [ebp - 0x21], al
jg 0x1000b2a2
cmp byte [ebp - 0x21], 0
je 0x1000b2f3
push eax
push eax
push eax
push eax
push 0x95e
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1000b2f3
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1000b2f3
push eax
push 0xbe
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
imul eax, dword [ebp - 0x48], 3
push 3
pop ecx
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x1dc]
push eax
call fcn.100265d2
mov edx, dword [ebp - 0x34]
neg edx
push 2
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x94ccb090
setne cl
xor ebx, ebx
cmp ecx, 0xffffffff
lea ecx, [ebp - 0x1dc]
setl bl
imul ebx, dword [ebp - 0x28]
sub ebx, 0x30bc
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, dword [eax]
pop eax
push eax
call fcn.100265d2
mov edx, dword [ebp - 0x48]
mov esi, eax
mov ecx, dword [ebp - 0x48]
xor eax, eax
cmp edx, ecx
setne al
xor ecx, ecx
cmp eax, ebx
setle cl
imul ecx, dword [esi]
test ecx, ecx
jne 0x1000b368
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x1dc]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
push 2
pop ebx
push ebx
mov dword [ebp - 0x50], eax
call fcn.100265d2
push ebx
lea ecx, [ebp - 0x1dc]
inc dword [eax]
call fcn.100265d2
push 1
pop ebx
cmp dword [eax], 4
lea ecx, [ebp - 0x1dc]
jge 0x1000b20a
mov byte [ebp - 4], 0x10
call fcn.100265cd
cmp dword [ebp - 0x120], 0x31234912
jne 0x1000b3c6
xor eax, eax
lea ecx, [ebp - 0x1f4]
push eax
call fcn.100265d2
xor eax, eax
xor ebx, ebx
inc eax
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, ecx
push 2
pop eax
push eax
lea ecx, [ebp - 0x940]
setle bl
call fcn.100265d2
mov ecx, dword [ebp - 0x58]
mov esi, eax
imul edx, ebx, 0xe8f5
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0x940]
setge al
imul eax, dword [esi]
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 0xc
call fcn.100265cd
xor eax, eax
lea ecx, [ebp - 0x1f4]
push eax
call fcn.100265d2
lea ecx, [ebp - 0x1f4]
inc dword [eax]
xor eax, eax
push eax
call fcn.100265d2
push 1
pop ebx
push 2
cmp dword [eax], 0x12
pop esi
jg 0x1000a131
or eax, 0xffffffff
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 4], eax
call fcn.100265cd
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000b472
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xb4], 0xfffffffa
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000b45a
xor eax, eax
push 0xffffffffffffffe4
mov dword [ebp - 0xb4], eax
pop esi
jmp 0x1000b4aa
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000b492
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000b4a4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
dec dword [ebp - 0xb4]
cmp dword [ebp - 0xb4], esi
jge 0x1000b47d
mov dword [ebp - 0x38], 0x17
jmp 0x1000b538
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000b4d7
push eax
push eax
push 0x1200
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor eax, eax
mov dword [ebp - 0x3c], esi
jmp 0x1000b52f
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000b4fc
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc0], 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000b4e4
xor eax, eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], eax
jg 0x1000b52c
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0xb4], 0
jne 0x1000b52a
inc dword [ebp - 0xc0]
xor eax, eax
cmp dword [ebp - 0xc0], eax
jle 0x1000b50a
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffe6
jg 0x1000b4dc
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffed
je 0x1000b4bb
push 7
pop ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], eax
jmp 0x1000b634
push 2
pop eax
push eax
lea ecx, [ebp - 0x550]
call fcn.10026565
mov dword [ebp - 4], 0x1a
mov eax, 0x8d13
mov dword [ebp - 0xce0], eax
mov dword [ebp - 0xcdc], eax
mov dword [ebp - 0xcd8], eax
mov dword [ebp - 0xcd4], eax
xor eax, eax
mov dword [ebp - 0x54], 0xa37bb008
mov dword [ebp - 0x2c], eax
jmp 0x1000b5a2
push dword [ebp - 0x2c]
call fcn.100265d2
mov dword [eax], 0xa18885c6
inc dword [ebp - 0x2c]
push 2
pop eax
lea ecx, [ebp - 0x550]
cmp dword [ebp - 0x2c], eax
jl 0x1000b591
push ebx
call fcn.100265d2
and dword [eax], 0
jmp 0x1000b60f
push 3
mov dword [ebp - 0x38], 0x23d1bca9
xor eax, eax
pop ecx
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], eax
jl 0x1000b620
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x1000b5ea
mov dword [ebp - 0x54], 0x4b03e386
dec dword [ebp - 0x1c]
jns 0x1000b5de
mov eax, dword [ebp - 0x38]
push 0
mov eax, dword [ebp + eax*4 - 0xce0]
dec dword [ebp - 0x38]
pop eax
jns 0x1000b5cf
cmp dword [ebp - 0x38], eax
jne 0x1000b620
push ebx
lea ecx, [ebp - 0x550]
call fcn.100265d2
inc dword [eax]
push ebx
lea ecx, [ebp - 0x550]
call fcn.100265d2
cmp dword [eax], 0x14
jg 0x1000b5bb
or eax, 0xffffffff
lea ecx, [ebp - 0x550]
mov dword [ebp - 4], eax
call fcn.100265cd
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffffb
jne 0x1000b550
push 3
lea ecx, [ebp - 0xb8c]
call fcn.10026565
mov dword [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x54], 0x53aa9ac7
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000b680
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb8c]
call fcn.100265d2
or dword [eax], 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1000b664
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000b698
push eax
push eax
call edi
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
push ebx
lea ecx, [ebp - 0xb8c]
call fcn.100265d2
lea ecx, [ebp - 0xb8c]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.100265cd
push 7
pop eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffffb
je 0x1000b7bf
push 2
pop eax
push eax
lea ecx, [ebp - 0x64c]
call fcn.10026565
mov dword [ebp - 4], 0x1c
mov eax, 0x8d13
mov dword [ebp - 0xcc0], eax
mov dword [ebp - 0xcbc], eax
mov dword [ebp - 0xcb8], eax
mov dword [ebp - 0xcb4], eax
xor eax, eax
mov dword [ebp - 0x54], 0xa37bb008
mov dword [ebp - 0x2c], eax
jmp 0x1000b721
push dword [ebp - 0x2c]
call fcn.100265d2
mov dword [eax], 0xa18885c6
inc dword [ebp - 0x2c]
push 2
pop eax
lea ecx, [ebp - 0x64c]
cmp dword [ebp - 0x2c], eax
jl 0x1000b710
push ebx
call fcn.100265d2
and dword [eax], 0
jmp 0x1000b78e
push 3
mov dword [ebp - 0x38], 0x23d1bca9
xor eax, eax
pop ecx
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], eax
jl 0x1000b79f
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x1000b769
mov dword [ebp - 0x54], 0x4b03e386
dec dword [ebp - 0x1c]
jns 0x1000b75d
mov eax, dword [ebp - 0x38]
push 0
mov eax, dword [ebp + eax*4 - 0xcc0]
dec dword [ebp - 0x38]
pop eax
jns 0x1000b74e
cmp dword [ebp - 0x38], eax
jne 0x1000b79f
push ebx
lea ecx, [ebp - 0x64c]
call fcn.100265d2
inc dword [eax]
push ebx
lea ecx, [ebp - 0x64c]
call fcn.100265d2
cmp dword [eax], 0x14
jg 0x1000b73a
or eax, 0xffffffff
lea ecx, [ebp - 0x64c]
mov dword [ebp - 4], eax
call fcn.100265cd
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffffb
jne 0x1000b6cf
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000b7e2
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xb0], 0xfffffffa
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000b7ca
xor eax, eax
mov dword [ebp - 0xb0], eax
jmp 0x1000b817
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000b7ff
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000b811
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
dec dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], esi
jge 0x1000b7ea
mov dword [ebp - 0x38], 0x17
jmp 0x1000b8a5
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000b844
push eax
push eax
push 0x1200
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor eax, eax
mov dword [ebp - 0x3c], esi
jmp 0x1000b89c
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000b869
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xac], 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000b851
xor eax, eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], eax
jg 0x1000b899
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0xb0], 0
jne 0x1000b897
inc dword [ebp - 0xac]
xor eax, eax
cmp dword [ebp - 0xac], eax
jle 0x1000b877
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffe6
jg 0x1000b849
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffed
je 0x1000b828
push 3
lea ecx, [ebp - 0xa3c]
call fcn.10026565
mov dword [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x54], 0x53aa9ac7
or esi, 0xffffffff
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000b8f3
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa3c]
call fcn.100265d2
mov dword [eax], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1000b8d8
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000b90b
push eax
push eax
call edi
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
push ebx
lea ecx, [ebp - 0xa3c]
call fcn.100265d2
lea ecx, [ebp - 0xa3c]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], esi
call fcn.100265cd
mov eax, 0xe8c9
lea ecx, [ebp - 0x568]
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x448], eax
push 7
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], 0x5077045b
mov dword [ebp - 0x40], 0x12d29ed7
push 4
call fcn.10026565
mov dword [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0x54], 0xb9117a54
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1000b9aa
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x568]
call fcn.100265d2
mov dword [eax], 0xe426067
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1000b98b
xor eax, eax
cmp dword [ebp - 0x450], eax
je 0x1000ba39
mov dword [ebp - 0x28], 9
lea ecx, [ebp - 0x568]
mov eax, dword [ebp - 0x450]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x450]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], ebx
push 3
call fcn.100265d2
mov ecx, dword [ebp - 0x40]
mov esi, eax
xor eax, eax
cmp ecx, 0x1305
mov ecx, dword [ebp - 0x10]
setne al
xor edx, edx
cmp eax, ecx
push 2
setge dl
imul ecx, edx, 0x907c
xor edx, edx
cmp ecx, dword [esi]
pop ecx
setne dl
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0x568]
push 3
setge al
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
neg esi
sbb esi, esi
neg esi
call fcn.100265d2
cmp esi, dword [eax]
je 0x1000ba37
mov eax, ebx
jmp 0x1000ba39
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov dword [ebp - 0x48], eax
or esi, 0xffffffff
mov eax, dword [ebp - 0x450]
mov edx, 0xfffc
cmp eax, esi
mov eax, dword [ebp - 0x54]
setle cl
sub ecx, eax
je 0x1000ba81
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000ba76
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x454], 0xfff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000ba65
jmp 0x1000bbc2
mov dword [ebp - 0x54], 0xa1ed
xor eax, eax
mov dword [ebp - 0x1c], 0xde8b3ec6
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000bab4
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7dc], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000baa0
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1e
jne 0x1000bb21
push 2
pop ecx
jmp 0x1000bac4
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1000bada
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1020], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1000bac9
mov eax, dword [ebp - 0x1020]
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xfffffff5
jne 0x1000bb18
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000bb07
call edi
xor eax, eax
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xfffffff5
je 0x1000bafa
push 2
pop ecx
mov edx, 0xfffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1e
je 0x1000bac2
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x44c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setl cl
xor ebx, ebx
sub eax, ecx
lea ecx, [ebp - 0x568]
imul eax, eax, 0x2185
test eax, eax
mov dword [ebp - 0x7dc], eax
setne bl
xor eax, eax
push eax
call fcn.100265d2
cmp ebx, 4
sbb ecx, ecx
xor ebx, ebx
neg ecx
xor edx, edx
imul ecx, dword [eax]
inc ebx
mov eax, dword [ebp - 0x10]
cmp ecx, ebx
setl dl
imul eax, edx
test eax, eax
jne 0x1000bb8b
push ebx
lea ecx, [ebp - 0x568]
call fcn.100265d2
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x28], 0x3c57
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x1c]
jne 0x1000bbbf
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x568]
mov dword [ebp - 4], esi
call fcn.100265cd
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000bbf5
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xbc], 0xfffffffa
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000bbdd
xor eax, eax
push 0xffffffffffffffe4
mov dword [ebp - 0xbc], eax
pop esi
jmp 0x1000bc31
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000bc19
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000bc2b
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
dec dword [ebp - 0xbc]
cmp dword [ebp - 0xbc], esi
jge 0x1000bc00
mov dword [ebp - 0x38], 0x17
jmp 0x1000bcbf
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1000bc5e
push eax
push eax
push 0x1200
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor eax, eax
mov dword [ebp - 0x3c], esi
jmp 0x1000bcb6
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jge 0x1000bc83
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc4], 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1000bc6b
xor eax, eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], eax
jg 0x1000bcb3
mov eax, dword [ebp - 0xc4]
cmp dword [ebp + eax*4 - 0xbc], 0
jne 0x1000bcb1
inc dword [ebp - 0xc4]
xor eax, eax
cmp dword [ebp - 0xc4], eax
jle 0x1000bc91
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffe6
jg 0x1000bc63
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffed
je 0x1000bc42
push 3
lea ecx, [ebp - 0xc04]
call fcn.10026565
mov dword [ebp - 4], 0x1f
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x28], eax
or eax, 0xffffffff
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0x974edf0e
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x40], 0xf995
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x1000bd22