Function at 0x10008f44
Capabilities:
Accept command line arguments
Allocate thread local storage
Create process on windows
Identify system language via api
Query or enumerate registry value
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080336
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1210
call fcn.1007b540
push esi
push edi
mov dword [ebp - 0x298], 0
jmp 0x10008f81
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 1
jge 0x10008f9d
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0x1150], 3
jmp 0x10008f74
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x10008fbe
push 0x21a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x10008fd6
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 0x2c4], 0
jmp 0x10008fef
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x1000900b
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0x10e8], 3
jmp 0x10008fe2
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1000902c
push 0x21a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x10009044
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 0xa0], 2
mov dword [ebp - 0xa0], 0
jmp 0x10009067
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x15
jg 0x100090bc
mov byte [ebp - 0xff], 0
movzx eax, byte [ebp - 0xff]
test eax, eax
je 0x1000909b
push 0
push 0x1a86
push 0xfdc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x100090ba
push 0x19a0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1000905a
cmp dword [ebp - 0xa0], 0xffffffff
jge 0x100090dc
push 8
pop eax
sub eax, dword [ebp - 0xa0]
je 0x100090dc
mov dword [ebp - 0x918], 1
jmp 0x100090e3
and dword [ebp - 0x918], 0
cmp dword [ebp - 0x918], 0x8974b66
jge 0x100090fb
mov dword [ebp - 0xb28], 1
jmp 0x10009102
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xfc0], eax
mov dword [ebp - 0xa0], 0xfffffff6
mov dword [ebp - 0x34], 0xfe387fb0
mov dword [ebp - 0xa9c], 0xd9dcee34
mov dword [ebp - 0x1d8], 8
mov dword [ebp - 0xab4], 0
mov dword [ebp - 0x15c], 0x4caa5d73
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10c0], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xfc8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10f0], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xfd0], eax
cmp dword [ebp - 0x34], 0
jne 0x10009180
cmp dword [ebp - 0x34], 0
jne 0x10009180
and dword [ebp - 0xa8c], 0
jmp 0x1000918a
mov dword [ebp - 0xa8c], 1
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0xa8c], eax
jg 0x100091a1
mov dword [ebp - 0xa94], 1
jmp 0x100091a8
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0
jne 0x100091d9
push 7
pop eax
test eax, eax
jne 0x100091d9
and dword [ebp - 0xaa4], 0
jmp 0x100091e3
mov dword [ebp - 0xaa4], 1
imul eax, dword [ebp - 0xaa4], 0xedf0
dec eax
jne 0x10009202
cmp dword [ebp - 0x1d8], 0
jne 0x10009202
and dword [ebp - 0xaac], 0
jmp 0x1000920c
mov dword [ebp - 0xaac], 1
mov eax, dword [ebp - 0xaac]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0xab4], eax
jne 0x10009232
mov dword [ebp - 0xabc], 1
jmp 0x10009239
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0xabc]
cmp eax, dword [ebp - 0x34]
jge 0x10009253
mov dword [ebp - 0xb30], 1
jmp 0x1000925a
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xecc], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0xed4], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
je 0x1000933b
push 2
lea ecx, [ebp - 0x102c]
call fcn.10017ff2
and dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
jmp 0x100092b2
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 2
jge 0x100092d4
push dword [ebp - 0x224]
lea ecx, [ebp - 0x102c]
call fcn.1001807e
mov dword [eax], 0xffff
jmp 0x100092a5
mov dword [ebp - 0x15c], 0
jmp 0x100092ed
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x23
jge 0x1000932a
mov dword [ebp - 0x34], 0
jmp 0x10009306
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jg 0x10009328
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x10009326
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x100092ff
jmp 0x100092e0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x102c]
call fcn.10018079
jmp 0x10009374
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x10009353
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x10009374
push 0
push 0
push 0xb6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov dword [ebp - 0x354], 0
jmp 0x1000938d
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 1
jge 0x100093a9
mov eax, dword [ebp - 0x354]
mov dword [ebp + eax*4 - 0xedc], 3
jmp 0x10009380
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x100093ca
push 0x21a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x100093e2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 0x178], 0x6b8f3d42
mov dword [ebp - 0x8a4], 0x836b16b4
mov dword [ebp - 0x424], 3
mov dword [ebp - 0xac4], 0x4f4e7975
mov dword [ebp - 0x89c], 0
mov dword [ebp - 0xb38], 1
mov dword [ebp - 0x22c], 0
jmp 0x10009437
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 2
jge 0x10009453
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0x10d4], 0x4caf14c9
jmp 0x1000942a
cmp dword [ebp - 0x178], 0x76942a1e
jge 0x1000946b
mov dword [ebp - 0x3c0], 1
jmp 0x10009472
and dword [ebp - 0x3c0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp + eax - 0x10d4], ecx
cmp dword [ebp - 0x3c0], 0xe60f
jg 0x1000949d
mov dword [ebp - 0x41c], 1
jmp 0x100094a4
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xac4]
add eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0x178]
cmp eax, 0xc9ca
jge 0x100094d6
mov dword [ebp - 0xa78], 1
jmp 0x100094dd
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0xa78], eax
jg 0x100094f7
mov dword [ebp - 0x414], 1
jmp 0x100094fe
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0x89c]
cmp dword [ebp - 0x178], eax
je 0x10009524
mov dword [ebp - 0x8ac], 1
jmp 0x1000952b
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x424]
sub eax, dword [ebp - 0x8ac]
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xac], 2
mov dword [ebp - 0xac], 0
jmp 0x10009578
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x15
jg 0x100095cd
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x100095ac
push 0
push 0x1a86
push 0xfdc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x100095cb
push 0x19a0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1000956b
cmp dword [ebp - 0xac], 0xffffffff
jge 0x100095ed
push 8
pop eax
sub eax, dword [ebp - 0xac]
je 0x100095ed
mov dword [ebp - 0x42c], 1
jmp 0x100095f4
and dword [ebp - 0x42c], 0
cmp dword [ebp - 0x42c], 0x8974b66
jge 0x1000960c
mov dword [ebp - 0xb40], 1
jmp 0x10009613
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xee4], eax
mov dword [ebp - 0xac], 0xfffffff6
mov dword [ebp - 0x160], 0x6b8f3d42
mov dword [ebp - 0x444], 0x836b16b4
mov dword [ebp - 0x8cc], 3
mov dword [ebp - 0x8b4], 0x4f4e7975
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0xb48], 1
mov dword [ebp - 0x2cc], 0
jmp 0x1000967e
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 2
jge 0x1000969a
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0xfdc], 0x4caf14c9
jmp 0x10009671
cmp dword [ebp - 0x160], 0x76942a1e
jge 0x100096b2
mov dword [ebp - 0x380], 1
jmp 0x100096b9
and dword [ebp - 0x380], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x380]
mov dword [ebp + eax - 0xfdc], ecx
cmp dword [ebp - 0x380], 0xe60f
jg 0x100096e4
mov dword [ebp - 0x8c4], 1
jmp 0x100096eb
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x8b4], eax
mov eax, dword [ebp - 0x8b4]
add eax, dword [ebp - 0x160]
imul eax, dword [ebp - 0x160]
cmp eax, 0xc9ca
jge 0x1000971d
mov dword [ebp - 0x434], 1
jmp 0x10009724
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x434], eax
jg 0x1000973e
mov dword [ebp - 0x8bc], 1
jmp 0x10009745
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x43c]
cmp dword [ebp - 0x160], eax
je 0x1000976b
mov dword [ebp - 0x44c], 1
jmp 0x10009772
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp - 0x8cc]
sub eax, dword [ebp - 0x44c]
mov dword [ebp - 0xb48], eax
mov dword [ebp - 0x200], 0xfffffff6
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x100097be
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x200], 0
jmp 0x100097d7
mov eax, dword [ebp - 0x200]
dec eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xfffffff4
jle 0x100097f8
mov dword [ebp - 0xb50], 0x32bb11ac
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0xb50], eax
jmp 0x100097ca
mov dword [ebp - 0xbc], 2
mov dword [ebp - 0xbc], 0
jmp 0x1000981b
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x15
jg 0x10009870
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1000984f
push 0
push 0x1a86
push 0xfdc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1000986e
push 0x19a0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1000980e
cmp dword [ebp - 0xbc], 0xffffffff
jge 0x10009890
push 8
pop eax
sub eax, dword [ebp - 0xbc]
je 0x10009890
mov dword [ebp - 0x8d4], 1
jmp 0x10009897
and dword [ebp - 0x8d4], 0
cmp dword [ebp - 0x8d4], 0x8974b66
jge 0x100098af
mov dword [ebp - 0xb58], 1
jmp 0x100098b6
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xeec], eax
mov dword [ebp - 0xbc], 0xfffffff6
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x50], 1
mov dword [ebp - 0xb4], 0x3b0a6d08
mov dword [ebp - 0x3bc], 0xe834ab46
mov dword [ebp - 0xb60], 5
push 4
lea ecx, [ebp - 0x3fc]
call fcn.10017ff2
mov dword [ebp - 4], 1
mov dword [ebp - 0x4c4], 2
mov dword [ebp - 0x234], 0
jmp 0x1000992f
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 4
jge 0x10009951
push dword [ebp - 0x234]
lea ecx, [ebp - 0x3fc]
call fcn.1001807e
mov dword [eax], 0x5cbf7935
jmp 0x10009922
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xef4], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
jle 0x1000996e
mov dword [ebp - 0x454], 1
jmp 0x10009975
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 0xffffffff
jne 0x1000998a
mov dword [ebp - 0x8dc], 1
jmp 0x10009991
and dword [ebp - 0x8dc], 0
cmp dword [ebp - 0x8dc], 0xc9105fa2
jb 0x100099a9
mov dword [ebp - 0x45c], 1
jmp 0x100099b0
and dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 0xffffffff
ja 0x100099c5
mov dword [ebp - 0x8e4], 1
jmp 0x100099cc
and dword [ebp - 0x8e4], 0
cmp dword [ebp - 0x8e4], 9
ja 0x100099e1
mov dword [ebp - 0x464], 1
jmp 0x100099e8
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x464], eax
jne 0x100099ff
mov dword [ebp - 0x8ec], 1
jmp 0x10009a06
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xefc], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xf04], eax
mov eax, 0xadfb
test eax, eax
jne 0x10009a4d
or eax, 0xffffffff
jne 0x10009a4d
cmp dword [ebp - 0xb4], 0
jne 0x10009a4d
and dword [ebp - 0x46c], 0
jmp 0x10009a57
mov dword [ebp - 0x46c], 1
cmp dword [ebp - 0x46c], 0x65b0
jg 0x10009a75
cmp dword [ebp - 0x50], 0
je 0x10009a75
mov dword [ebp - 0x8f4], 1
jmp 0x10009a7c
and dword [ebp - 0x8f4], 0
cmp dword [ebp - 0x8f4], 0
jg 0x10009a91
mov dword [ebp - 0x474], 1
jmp 0x10009a98
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x474], eax
jge 0x10009aaf
mov dword [ebp - 0x8fc], 1
jmp 0x10009ab6
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x8fc], eax
jg 0x10009acd
mov dword [ebp - 0x47c], 1
jmp 0x10009ad4
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x47c], eax
jne 0x10009aeb
mov dword [ebp - 0x904], 1
jmp 0x10009af2
and dword [ebp - 0x904], 0
cmp dword [ebp - 0x904], 0x985
jg 0x10009b0a
mov dword [ebp - 0x484], 1
jmp 0x10009b11
and dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 3
ja 0x10009b26
mov dword [ebp - 0x90c], 1
jmp 0x10009b2d
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x90c]
jle 0x10009b44
mov dword [ebp - 0x48c], 1
jmp 0x10009b4b
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x3bc], eax
jne 0x10009b6e
mov dword [ebp - 0x914], 1
jmp 0x10009b75
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x914], eax
je 0x10009b8c
mov dword [ebp - 0x494], 1
jmp 0x10009b93
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0xb60], eax
mov dword [ebp - 0xb4], 3
jmp 0x10009bb8
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jl 0x10009ece
mov dword [ebp - 0x4ac], 0xffffffff
mov dword [ebp - 0x924], 0
mov dword [ebp - 0x50], 3
jmp 0x10009be9
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x10009ec9
push dword [ebp - 0x50]
lea ecx, [ebp - 0x3fc]
call fcn.1001807e
mov esi, eax
push dword [ebp - 0x50]
lea ecx, [ebp - 0x3fc]
call fcn.1001807e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x10009c23
mov dword [ebp - 0x91c], 1
jmp 0x10009c2a
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x4ac]
cmp dword [ebp - 0x91c], eax
jge 0x10009c44
mov dword [ebp - 0x49c], 1
jmp 0x10009c4b
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x924]
cmp dword [ebp - 0x49c], eax
jge 0x10009c65
mov dword [ebp - 0xb68], 1
jmp 0x10009c6c
and dword [ebp - 0xb68], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x3fc]
call fcn.1001807e
push 0xfffffffffffffffc
pop eax
sub eax, 0x9de360ab
je 0x10009e8d
push 1
lea ecx, [ebp - 0xdcc]
call fcn.10017ff2
mov byte [ebp - 4], 2
mov dword [ebp - 0x31c], 0
jmp 0x10009cb2
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 1
jge 0x10009cd1
push dword [ebp - 0x31c]
lea ecx, [ebp - 0xdcc]
call fcn.1001807e
and dword [eax], 0
jmp 0x10009ca5
push 0
lea ecx, [ebp - 0x3fc]
call fcn.1001807e
mov ecx, dword [ebp - 0x924]
cmp dword [eax], ecx
jl 0x10009cf4
mov dword [ebp - 0x4a4], 1
jmp 0x10009cfb
and dword [ebp - 0x4a4], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x3fc]
call fcn.1001807e
mov ecx, dword [ebp - 0x4c4]
cmp dword [eax], ecx
jge 0x10009d1f
mov dword [ebp - 0x92c], 1
jmp 0x10009d26
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x4a4]
cmp eax, dword [ebp - 0x92c]
je 0x10009d40
mov dword [ebp - 0xb70], 1
jmp 0x10009d47
and dword [ebp - 0xb70], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x3fc]
call fcn.1001807e
push 0
lea ecx, [ebp - 0xdcc]
call fcn.1001807e
cmp dword [eax], 0xfe29
jg 0x10009d76
mov dword [ebp - 0x934], 1
jmp 0x10009d7d
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x4ac]
cmp eax, dword [ebp - 0x934]
jne 0x10009d9d
mov eax, 0xebda3fa0
test eax, eax
jne 0x10009d9d
and dword [ebp - 0x4b4], 0
jmp 0x10009da7
mov dword [ebp - 0x4b4], 1
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x4b4], eax
jg 0x10009dc1
mov dword [ebp - 0x93c], 1
jmp 0x10009dc8
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x93c]
jne 0x10009ddf
mov dword [ebp - 0x4bc], 1
jmp 0x10009de6
and dword [ebp - 0x4bc], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x3fc]
call fcn.1001807e
mov ecx, dword [ebp - 0x4bc]
sub ecx, dword [eax]
cmp ecx, 0x34d7
je 0x10009e10
mov dword [ebp - 0x944], 1
jmp 0x10009e17
and dword [ebp - 0x944], 0
cmp dword [ebp - 0x944], 0xffffffff
ja 0x10009e3f
push dword [ebp - 0x50]
lea ecx, [ebp - 0x3fc]
call fcn.1001807e
cmp dword [eax], 0
je 0x10009e3f
mov dword [ebp - 0x94c], 1
jmp 0x10009e46
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x4c4]
cmp dword [ebp - 0x94c], eax
jge 0x10009e69
mov eax, 0xffff
test eax, eax
je 0x10009e69
mov dword [ebp - 0x4cc], 1
jmp 0x10009e70
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x3bc], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdcc]
call fcn.10018079
jmp 0x10009ec4
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x10009eac
push 0x1e96
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov byte [ebp - 0xcc], 0
movzx eax, byte [ebp - 0xcc]
test eax, eax
je 0x10009ec4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x10009be2
jmp 0x10009bab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3fc]
call fcn.10018079
mov dword [ebp - 0x170], 0x6b8f3d42
mov dword [ebp - 0x4e4], 0x836b16b4
mov dword [ebp - 0x96c], 3
mov dword [ebp - 0x954], 0x4f4e7975
mov dword [ebp - 0x4dc], 0
mov dword [ebp - 0xb78], 1
mov dword [ebp - 0x23c], 0
jmp 0x10009f32
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jge 0x10009f4e
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0x10fc], 0x4caf14c9
jmp 0x10009f25
cmp dword [ebp - 0x170], 0x76942a1e
jge 0x10009f66
mov dword [ebp - 0x388], 1
jmp 0x10009f6d
and dword [ebp - 0x388], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x388]
mov dword [ebp + eax - 0x10fc], ecx
cmp dword [ebp - 0x388], 0xe60f
jg 0x10009f98
mov dword [ebp - 0x964], 1
jmp 0x10009f9f
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x954], eax
mov eax, dword [ebp - 0x954]
add eax, dword [ebp - 0x170]
imul eax, dword [ebp - 0x170]
cmp eax, 0xc9ca
jge 0x10009fd1
mov dword [ebp - 0x4d4], 1
jmp 0x10009fd8
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x4d4], eax
jg 0x10009ff2
mov dword [ebp - 0x95c], 1
jmp 0x10009ff9
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x4dc]
cmp dword [ebp - 0x170], eax
je 0x1000a01f
mov dword [ebp - 0x4ec], 1
jmp 0x1000a026
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0x96c]
sub eax, dword [ebp - 0x4ec]
mov dword [ebp - 0xb78], eax
mov dword [ebp - 0x110], 0xd562b994
mov dword [ebp - 0x244], 0xfc35327
mov dword [ebp - 0xb80], 8
mov dword [ebp - 0x390], 0xd681
push 4
lea ecx, [ebp - 0xbc8]
call fcn.10017ff2
mov dword [ebp - 4], 3
mov dword [ebp - 0x48], 0
jmp 0x1000a09c
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1000a0b2
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x1e0], 0x71b18d40
jmp 0x1000a095
mov dword [ebp - 0x48], 0
jmp 0x1000a0c2
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1000a0d8
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x1a0], 0xe7937d8e
jmp 0x1000a0bb
mov dword [ebp - 0x48], 0
jmp 0x1000a0e8
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x1000a101
push dword [ebp - 0x48]
lea ecx, [ebp - 0xbc8]
call fcn.1001807e
and dword [eax], 0
jmp 0x1000a0e1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1a0], 1
jmp 0x1000a12f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1a0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a0], 0
jl 0x1000a41b
push 3
lea ecx, [ebp - 0xc88]
call fcn.10017ff2
mov byte [ebp - 4], 4
mov dword [ebp - 0x984], 0x56a218f0
mov dword [ebp - 0x2d4], 0
jmp 0x1000a177
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 3
jge 0x1000a199
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0xc88]
call fcn.1001807e
mov dword [eax], 0xfffffff7
jmp 0x1000a16a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp dword [ebp + eax*4 - 0x1e0], 0
je 0x1000a1c4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc88]
call fcn.10018079
jmp 0x1000a41b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
mov eax, dword [ebp + eax*4 - 0x1e0]
mov dword [ebp - 0xf0c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
mov eax, dword [ebp + eax*4 - 0x1e0]
cmp dword [ebp - 0x110], eax
jge 0x1000a206
mov dword [ebp - 0x974], 1
jmp 0x1000a20d
and dword [ebp - 0x974], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a0]
add eax, dword [ebp - 0x974]
cmp eax, dword [ebp - 0x110]
jne 0x1000a234
mov dword [ebp - 0x3c4], 1
jmp 0x1000a23b
and dword [ebp - 0x3c4], 0
push 1
lea ecx, [ebp - 0xc88]
call fcn.1001807e
mov ecx, dword [ebp - 0x3c4]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
mov eax, dword [ebp + eax*4 - 0x1e0]
cmp dword [ebp - 0x3c4], eax
je 0x1000a278
mov dword [ebp - 0x4f4], 1
jmp 0x1000a27f
and dword [ebp - 0x4f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp dword [ebp - 0x4f4], eax
jle 0x1000a2a0
mov dword [ebp - 0x97c], 1
jmp 0x1000a2a7
and dword [ebp - 0x97c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x97c]
sub ecx, dword [ebp + eax - 0x1a0]
jne 0x1000a2ce
cmp dword [ebp - 0x244], 0
jne 0x1000a2ce
and dword [ebp - 0x4fc], 0
jmp 0x1000a2d8
mov dword [ebp - 0x4fc], 1
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x984], eax
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0xf14], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e0], 0xfff6
ja 0x1000a30f
mov dword [ebp - 0x504], 1
jmp 0x1000a316
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 7
jb 0x1000a331
mov eax, 0xb91
test eax, eax
jne 0x1000a331
and dword [ebp - 0x98c], 0
jmp 0x1000a33b
mov dword [ebp - 0x98c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp dword [ebp - 0x98c], eax
jl 0x1000a35c
mov dword [ebp - 0x50c], 1
jmp 0x1000a363
and dword [ebp - 0x50c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
mov eax, dword [ebp + eax*4 - 0x1e0]
cmp dword [ebp - 0x50c], eax
jne 0x1000a38b
mov dword [ebp - 0x994], 1
jmp 0x1000a392
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x994]
add eax, 0x7e2c101d
jne 0x1000a3a6
cmp dword [ebp - 0x110], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e0]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1a0]
sub eax, dword [ebp + ecx*4 - 0x1e0]
jne 0x1000a3d5
mov dword [ebp - 0x514], 1
jmp 0x1000a3dc
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0x3ae5685e
je 0x1000a3f4
mov dword [ebp - 0x99c], 1
jmp 0x1000a3fb
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0xb80], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc88]
call fcn.10018079
jmp 0x1000a114
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e0], 0
je 0x1000a58c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1a0], 0
je 0x1000a454
cmp dword [ebp - 0x110], 0
je 0x1000a454
mov dword [ebp - 0x51c], 1
jmp 0x1000a45b
and dword [ebp - 0x51c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a0]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1a0]
imul ecx, dword [ebp - 0x51c]
sub eax, ecx
mov dword [ebp - 0x390], eax
mov esi, dword [ebp - 0x390]
push 2
lea ecx, [ebp - 0xbc8]
call fcn.1001807e
cmp esi, dword [eax]
jl 0x1000a4a6
mov dword [ebp - 0x9a4], 1
jmp 0x1000a4ad
and dword [ebp - 0x9a4], 0
push 1
lea ecx, [ebp - 0xbc8]
call fcn.1001807e
mov ecx, dword [ebp - 0x9a4]
cmp ecx, dword [eax]
jl 0x1000a4d0
mov dword [ebp - 0xb88], 1
jmp 0x1000a4d7
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0xf1c], eax
mov esi, dword [ebp - 0x110]
push 0
lea ecx, [ebp - 0xbc8]
call fcn.1001807e
cmp esi, dword [eax]
jl 0x1000a506
mov dword [ebp - 0x524], 1
jmp 0x1000a50d
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x524], eax
jne 0x1000a52d
cmp dword [ebp - 0x390], 0
jne 0x1000a52d
and dword [ebp - 0x9ac], 0
jmp 0x1000a537
mov dword [ebp - 0x9ac], 1
mov eax, dword [ebp - 0x9ac]
sub eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x244]
jne 0x1000a557
mov dword [ebp - 0x52c], 1
jmp 0x1000a55e
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x244]
imul eax, dword [ebp - 0x52c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x1a0]
cmp eax, 0x9123ebaa
jb 0x1000a58c
mov dword [ebp - 0x9b4], 1
jmp 0x1000a593
and dword [ebp - 0x9b4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e0]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x9b4]
sub edx, dword [ebp + ecx - 0x1e0]
cmp eax, edx
je 0x1000a5c5
mov dword [ebp - 0x534], 1
jmp 0x1000a5cc
and dword [ebp - 0x534], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x534]
mov dword [ebp + eax - 0x1a0], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc8]
call fcn.10018079
mov dword [ebp - 0x208], 0xfffffff6
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x1000a610
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x208], 0
jmp 0x1000a629
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xfffffff4
jle 0x1000a64a
mov dword [ebp - 0xb90], 0x32bb11ac
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0xb90], eax
jmp 0x1000a61c
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0x9d4], 0x919c44d4
cmp dword [ebp - 0x1c], 0
je 0x1000a67f
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
je 0x1000a67f
mov dword [ebp - 0x9bc], 1
jmp 0x1000a686
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x9bc]
sub eax, 0x39d6
mov dword [ebp - 0x1f0], eax
je 0x1000a69f
cmp dword [ebp - 0x1c], 0
jne 0x1000a6a5
cmp dword [ebp - 0x1c], 0
je 0x1000a6ba
cmp dword [ebp - 0x1f0], 0
je 0x1000a6ba
mov dword [ebp - 0x53c], 1
jmp 0x1000a6c1
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x53c], eax
jne 0x1000a6d8
mov dword [ebp - 0xb98], 1
jmp 0x1000a6df
and dword [ebp - 0xb98], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xf24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xf2c], eax
cmp dword [ebp - 0x1f0], 0
jne 0x1000a709
cmp dword [ebp - 0x1c], 0
jne 0x1000a709
and dword [ebp - 0x9c4], 0
jmp 0x1000a713
mov dword [ebp - 0x9c4], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x9c4], eax
je 0x1000a72a
mov dword [ebp - 0x544], 1
jmp 0x1000a731
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x544], eax
jle 0x1000a748
mov dword [ebp - 0x9cc], 1
jmp 0x1000a74f
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x9cc]
cmp eax, dword [ebp - 0x1c]
jg 0x1000a769
mov dword [ebp - 0xba0], 1
jmp 0x1000a770
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xf34], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1000a78d
mov dword [ebp - 0x54c], 1
jmp 0x1000a794
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x9d4], eax
mov eax, dword [ebp - 0x9d4]
mov dword [ebp - 0xf3c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xf44], eax
cmp dword [ebp - 0x1f0], 0
je 0x1000a84b
mov dword [ebp - 0x344], 0
jmp 0x1000a7db
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 3
jge 0x1000a7f7
mov eax, dword [ebp - 0x344]
mov dword [ebp + eax*4 - 0x1168], 0xffff
jmp 0x1000a7ce
mov dword [ebp - 0x1c], 0
jmp 0x1000a807
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1000a849
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1168], 0
je 0x1000a81c
jmp 0x1000a849
mov byte [ebp - 0xd0], 0
movzx eax, byte [ebp - 0xd0]
test eax, eax
je 0x1000a847
push 0xe5c
push 0
push 0x175b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp 0x1000a800
jmp 0x1000a878
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x1000a878
push 0
push 0x2030
push 0x170b
push 0xdeb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x10], 0xbac64a68
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x168], 0xffffffff
push 4
lea ecx, [ebp - 0x104c]
call fcn.10017ff2
mov dword [ebp - 4], 5
mov dword [ebp - 0x24c], 0
jmp 0x1000a8bd
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 4
jge 0x1000a8df
push dword [ebp - 0x24c]
lea ecx, [ebp - 0x104c]
call fcn.1001807e
mov dword [eax], 0xfffffffe
jmp 0x1000a8b0
mov dword [ebp - 0x10], 0
jmp 0x1000a8ef
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 5
je 0x1000a981
mov dword [ebp - 0xd38], 1
mov dword [ebp - 0xd34], 1
mov dword [ebp - 0xd30], 1
mov dword [ebp - 0xd2c], 1
lea ecx, [ebp - 0x3d2]
call fcn.10008d03
push eax
lea eax, [ebp - 0xd28]
push eax
lea eax, [ebp - 0xd38]
push eax
lea ecx, [ebp - 0x11e4]
call fcn.1001808d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x103c]
call fcn.10018053
mov byte [ebp - 4], 6
push 2
lea ecx, [ebp - 0x103c]
call fcn.1001807e
mov dword [eax], 0x1dba3399
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x103c]
call fcn.10018079
jmp 0x1000a8e8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xf54], eax
mov eax, dword [ebp - 0x10]
add eax, 0xd705
cmp dword [ebp - 0x10], eax
jle 0x1000a9ac
mov dword [ebp - 0x554], 1
jmp 0x1000a9b3
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 0xf4a4
jle 0x1000a9cb
mov dword [ebp - 0x9dc], 1
jmp 0x1000a9d2
and dword [ebp - 0x9dc], 0
cmp dword [ebp - 0x9dc], 0xf3f17e2f
jbe 0x1000a9ea
mov dword [ebp - 0x55c], 1
jmp 0x1000a9f1
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 0xcfd66c4a
ja 0x1000aa09
mov dword [ebp - 0x9e4], 1
jmp 0x1000aa10
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x9e4], eax
jg 0x1000aa27
mov dword [ebp - 0x564], 1
jmp 0x1000aa2e
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x564]
cmp eax, dword [ebp - 0x2c]
jne 0x1000aa48
mov dword [ebp - 0x9ec], 1
jmp 0x1000aa4f
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x9ec]
sub eax, dword [ebp - 0x2c]
je 0x1000ad48
mov dword [ebp - 0x59c], 0
mov dword [ebp - 0x68], 0x38f7
cmp dword [ebp - 0x10], 0
jne 0x1000ac2d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xf5c], eax
cmp dword [ebp - 0x68], 0x364f
jge 0x1000aa97
mov dword [ebp - 0xba8], 1
jmp 0x1000aa9e
and dword [ebp - 0xba8], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xf64], eax
cmp dword [ebp - 0x2c], 0xd693
jne 0x1000aac2
cmp dword [ebp - 0x68], 0
je 0x1000aac2
mov dword [ebp - 0x56c], 1
jmp 0x1000aac9
and dword [ebp - 0x56c], 0
cmp dword [ebp - 0x56c], 0xc752
jne 0x1000aae1
mov dword [ebp - 0x9f4], 1
jmp 0x1000aae8
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x9f4], eax
jne 0x1000aaff
mov dword [ebp - 0x574], 1
jmp 0x1000ab06
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x574]
cmp eax, dword [ebp - 0x2c]
jl 0x1000ab20
mov dword [ebp - 0x9fc], 1
jmp 0x1000ab27
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x9fc], eax
jne 0x1000ab44
cmp dword [ebp - 0x2c], 0
je 0x1000ab44
mov dword [ebp - 0x57c], 1
jmp 0x1000ab4b
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x57c], eax
jle 0x1000ab62
mov dword [ebp - 0xa04], 1
jmp 0x1000ab69
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0xa04]
cmp eax, dword [ebp - 0x10]
jle 0x1000ab8d
cmp dword [ebp - 0x2c], 0
jne 0x1000ab8d
cmp dword [ebp - 0x68], 0
jne 0x1000ab8d
and dword [ebp - 0xbb0], 0
jmp 0x1000ab97
mov dword [ebp - 0xbb0], 1
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xf6c], eax
cmp dword [ebp - 0x10], 0xfffffffe
jae 0x1000abb2
mov dword [ebp - 0x584], 1
jmp 0x1000abb9
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x584], eax
jge 0x1000abd0
mov dword [ebp - 0xa0c], 1
jmp 0x1000abd7
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xa0c], eax
jl 0x1000abf4
cmp dword [ebp - 0x68], 0
je 0x1000abf4
mov dword [ebp - 0x58c], 1
jmp 0x1000abfb
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x58c], eax
jle 0x1000ac12
mov dword [ebp - 0xa14], 1
jmp 0x1000ac19
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0xa14]
sub eax, dword [ebp - 0x10]
jne 0x1000ac2d
and dword [ebp - 0x594], 0
jmp 0x1000ac37
mov dword [ebp - 0x594], 1
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jne 0x1000ac52
cmp dword [ebp - 0x68], 0
je 0x1000ac67
mov eax, 0xdfd6
test eax, eax
je 0x1000ac67
mov dword [ebp - 0xa1c], 1
jmp 0x1000ac6e
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0xa1c]
jg 0x1000ac85
mov dword [ebp - 0xbb8], 1
jmp 0x1000ac8c
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xf74], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 1
jbe 0x1000acb3
mov dword [ebp - 0xa24], 1
jmp 0x1000acba
and dword [ebp - 0xa24], 0
cmp dword [ebp - 0xa24], 0x94c655ef
jbe 0x1000acd2
mov dword [ebp - 0x5a4], 1
jmp 0x1000acd9
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], 3
jmp 0x1000acf2
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x1000ad43
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x1000ad23
push 0xcbb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x1000ad41
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
jmp 0x1000aceb
jmp 0x1000ade4
mov dword [ebp - 0x168], 2
jmp 0x1000ad61
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xfffffffd
jl 0x1000ade4
mov dword [ebp - 0x2c], 3
jmp 0x1000ad7a
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x1000addf
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x1000ada1
push 0
push 0xa06
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov dword [ebp - 0x10], 0
jmp 0x1000adb1
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x1000addd
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x1000addb
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1000adaa
jmp 0x1000ad73
jmp 0x1000ad54
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x104c]
call fcn.10018079
push 4
lea ecx, [ebp - 0xde4]
call fcn.10017ff2
mov dword [ebp - 4], 7
push 1
lea ecx, [ebp - 0xb18]
call fcn.10017ff2
mov byte [ebp - 4], 8
mov dword [ebp - 0x90], 0
jmp 0x1000ae31
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x1000ae53
push dword [ebp - 0x90]
lea ecx, [ebp - 0xde4]
call fcn.1001807e
mov dword [eax], 0x313d
jmp 0x1000ae24
mov dword [ebp - 0x90], 0
jmp 0x1000ae6c
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x1000ae8e
push dword [ebp - 0x90]
lea ecx, [ebp - 0xb18]
call fcn.1001807e
mov dword [eax], 0xdba76aab
jmp 0x1000ae5f
push 0
lea ecx, [ebp - 0xb18]
call fcn.1001807e
mov dword [eax], 3
jmp 0x1000aec7
push 0
lea ecx, [ebp - 0xb18]
call fcn.1001807e
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0xa2c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xa2c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb18]
call fcn.1001807e
cmp dword [eax], 0
jl 0x1000af47
mov dword [ebp - 0x2dc], 0x3690f1d8
mov dword [ebp - 0x2dc], 3
jmp 0x1000aefc
mov eax, dword [ebp - 0x2dc]
dec eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0
jl 0x1000af21
mov byte [ebp - 0xdc], 0
movzx eax, byte [ebp - 0xdc]
test eax, eax
je 0x1000af1f
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x1000aeef
push 0
lea ecx, [ebp - 0xb18]
call fcn.1001807e
push dword [eax]
lea ecx, [ebp - 0xde4]
call fcn.1001807e
cmp dword [eax], 0
je 0x1000af42
jmp 0x1000af47
jmp 0x1000aea3
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xb18]
call fcn.10018079
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xde4]
call fcn.10018079
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0xa4], 0x3b0a6d08
mov dword [ebp - 0x3cc], 0xe834ab46
mov dword [ebp - 0xb2c], 5
push 4
lea ecx, [ebp - 0x408]
call fcn.10017ff2
mov dword [ebp - 4], 9
mov dword [ebp - 0x870], 2
mov dword [ebp - 0x254], 0
jmp 0x1000afc8
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 4
jge 0x1000afea
push dword [ebp - 0x254]
lea ecx, [ebp - 0x408]
call fcn.1001807e
mov dword [eax], 0x5cbf7935
jmp 0x1000afbb
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xf7c], eax
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jle 0x1000b007
mov dword [ebp - 0x5ac], 1
jmp 0x1000b00e
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0xffffffff
jne 0x1000b023
mov dword [ebp - 0xa34], 1
jmp 0x1000b02a
and dword [ebp - 0xa34], 0
cmp dword [ebp - 0xa34], 0xc9105fa2
jb 0x1000b042
mov dword [ebp - 0x5b4], 1
jmp 0x1000b049
and dword [ebp - 0x5b4], 0
cmp dword [ebp - 0x5b4], 0xffffffff
ja 0x1000b05e
mov dword [ebp - 0xa3c], 1
jmp 0x1000b065
and dword [ebp - 0xa3c], 0
cmp dword [ebp - 0xa3c], 9
ja 0x1000b07a
mov dword [ebp - 0x5bc], 1
jmp 0x1000b081
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x5bc], eax
jne 0x1000b098