Function at 0x100444b6
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Query service status
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100770cd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc28
and dword [ebp - 0x18], 0
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100496a7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x618], 0xfffffffb
mov dword [ebp - 0xb0], 0xffffffff
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x608], 0x3644bb32
mov dword [ebp - 0x738], 0x71c2
mov dword [ebp - 0x314], 0xffffffff
mov dword [ebp - 0x80], 0
jmp 0x10044540
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x10044556
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x2a4], 8
jmp 0x10044539
mov dword [ebp - 0x80], 0
jmp 0x10044566
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1004457c
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x96c], 1
jmp 0x1004455f
mov byte [ebp - 0xcb], 0
lea eax, [ebp - 0xcb]
push eax
push 1
call fcn.10043179
pop ecx
pop ecx
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x164]
mov dword [ebp + eax - 0x2a4], ecx
cmp dword [ebp - 0x618], 0
jne 0x1004477f
cmp dword [ebp - 0x164], 0xa24b
jg 0x100445d8
mov dword [ebp - 0x3e0], 1
jmp 0x100445df
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
jne 0x10044600
mov dword [ebp - 0x610], 1
jmp 0x10044607
and dword [ebp - 0x610], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a4]
cmp dword [ebp - 0x610], eax
je 0x10044628
mov dword [ebp - 0x620], 1
jmp 0x1004462f
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x618]
cmp dword [ebp - 0x620], eax
jg 0x10044649
mov dword [ebp - 0x628], 1
jmp 0x10044650
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x628]
neg eax
jne 0x10044668
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2a4], 0
mov eax, 0xfff8
test eax, eax
je 0x1004468d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x96c], 0
je 0x1004468d
mov dword [ebp - 0x630], 1
jmp 0x10044694
and dword [ebp - 0x630], 0
cmp dword [ebp - 0x630], 0xfffffffa
jbe 0x100446a9
mov dword [ebp - 0x664], 1
jmp 0x100446b0
and dword [ebp - 0x664], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a4]
cmp dword [ebp - 0x664], eax
jle 0x100446d1
mov dword [ebp - 0x65c], 1
jmp 0x100446d8
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x65c], eax
jne 0x100446f2
mov dword [ebp - 0x304], 1
jmp 0x100446f9
and dword [ebp - 0x304], 0
mov dword [ebp - 0x24c], 0x84257392
mov eax, dword [ebp - 0x24c]
add eax, dword [ebp - 0x304]
je 0x1004472d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2a4], 0
je 0x1004472d
mov dword [ebp - 0x784], 1
jmp 0x10044734
and dword [ebp - 0x784], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a4]
mov dword [ebp - 0x92c], eax
mov eax, 0xc3e
test eax, eax
je 0x10044765
mov eax, 0x2840
test eax, eax
je 0x10044765
mov dword [ebp - 0x600], 1
jmp 0x1004476c
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
neg eax
jne 0x1004477f
and dword [ebp - 0x4c4], 0
jmp 0x10044789
mov dword [ebp - 0x4c4], 1
cmp dword [ebp - 0x4c4], 1
jge 0x1004479e
mov dword [ebp - 0x730], 1
jmp 0x100447a5
and dword [ebp - 0x730], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a4]
mov dword [ebp - 0x908], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x910], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a4]
mov dword [ebp - 0x918], eax
imul eax, dword [ebp - 0x738], 0x2365
test eax, eax
je 0x1004495f
mov dword [ebp - 0x244], 0x4206
mov dword [ebp - 0x31c], 0xfffffffe
mov dword [ebp - 0x750], 3
mov byte [ebp - 0x9e], 0
lea eax, [ebp - 0x9e]
push eax
push 1
push 0x293b
call fcn.100431b2
add esp, 0xc
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0x24c], eax
jle 0x1004483e
mov dword [ebp - 0x30c], 1
jmp 0x10044845
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
add eax, 8
cmp eax, dword [ebp - 0x314]
jg 0x1004486b
cmp dword [ebp - 0x164], 0
je 0x1004486b
mov dword [ebp - 0x5a4], 1
jmp 0x10044872
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x5a4]
sub eax, dword [ebp - 0x244]
cmp eax, 1
ja 0x1004488f
mov dword [ebp - 0x4cc], 1
jmp 0x10044896
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x314]
cmp dword [ebp - 0x4cc], eax
jg 0x100448b0
mov dword [ebp - 0x740], 1
jmp 0x100448b7
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0xfffffffe
jg 0x100448e4
mov dword [ebp - 0x614], 1
jmp 0x100448eb
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0
jl 0x10044900
mov dword [ebp - 0x324], 1
jmp 0x10044907
and dword [ebp - 0x324], 0
cmp dword [ebp - 0x324], 0xe33a
jg 0x1004491f
mov dword [ebp - 0x4d4], 1
jmp 0x10044926
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x24c]
cmp eax, dword [ebp - 0x4d4]
je 0x10044940
mov dword [ebp - 0x748], 1
jmp 0x10044947
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x928], eax
xor eax, eax
neg eax
mov dword [ebp - 0x750], eax
jmp 0x100449b2
mov dword [ebp - 0xb0], 0xfffffffb
jmp 0x10044978
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xffffffe2
jle 0x100449b2
push 0
call fcn.10043209
pop ecx
mov byte [ebp - 0xa0], 0
movzx eax, byte [ebp - 0xa0]
test eax, eax
je 0x100449b0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
jmp 0x1004496b
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100449d0
jmp 0x100496d3
push 1
call fcn.10043209
pop ecx
mov eax, dword [ebp - 0x32c]
mov ecx, dword [ebp - 0x34]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0x230], 6
mov dword [ebp - 0x6c], 0
jmp 0x10044a04
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x10044a1a
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xbd0], 1
jmp 0x100449fd
mov dword [ebp - 0x6c], 0
jmp 0x10044a2a
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10044a40
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xc34], 0x3c4ab274
jmp 0x10044a23
mov dword [ebp - 0x230], 0
jmp 0x10044a59
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jg 0x10044b09
mov dword [ebp - 0x1e4], 0xfffffffb
mov dword [ebp - 0x930], 0x86bd085c
mov dword [ebp - 0x224], 0
jmp 0x10044a93
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 2
jge 0x10044aaf
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0xb34], 0xfffffffd
jmp 0x10044a86
mov dword [ebp - 0x1e4], 2
jmp 0x10044ac8
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0
jl 0x10044b04
mov dword [ebp - 0x5ac], 0x35ca4204
mov eax, dword [ebp - 0x5ac]
inc eax
mov dword [ebp - 0x5ac], eax
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x10044b02
push 0
call fcn.10043379
pop ecx
jmp 0x10044abb
jmp 0x10044a4c
mov byte [ebp - 0xa4], 0
movzx eax, byte [ebp - 0xa4]
test eax, eax
je 0x10044b2f
push 0x2933
push 0
push 0x1c2b
call fcn.10043cde
add esp, 0xc
mov eax, dword [ebp - 0xec]
cmp dword [eax], 0x4550
je 0x10044b42
jmp 0x100496d3
mov dword [ebp - 0xb8], 0xffffffff
mov dword [ebp - 0x334], 1
mov dword [ebp - 0x84], 0
jmp 0x10044b6f
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x10044b8b
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xac4], 0x40d7f825
jmp 0x10044b62
mov dword [ebp - 0x84], 0
jmp 0x10044ba4
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x10044bc0
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x878], 1
jmp 0x10044b97
mov dword [ebp - 0xb8], 3
jmp 0x10044bd9
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x10044df4
mov dword [ebp - 0x768], 0xfffffffa
mov dword [ebp - 0x938], 0
mov dword [ebp - 0x940], 0xffffffff
mov dword [ebp - 0x948], 0xffffffff
mov dword [ebp - 0x1a0], 0
jmp 0x10044c27
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x10044c43
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0xc0c], 0
jmp 0x10044c1a
mov eax, dword [ebp - 0xb8]
cmp dword [ebp + eax*4 - 0xac4], 0
je 0x10044d3a
mov dword [ebp - 0x1e8], 0xfffffffd
cmp dword [ebp - 0x1e8], 0
je 0x10044c7d
push 4
pop eax
test eax, eax
je 0x10044c7d
mov dword [ebp - 0x4dc], 1
jmp 0x10044c84
and dword [ebp - 0x4dc], 0
mov dword [ebp - 0x334], 0x3245
cmp dword [ebp - 0x334], 0
je 0x10044cac
cmp dword [ebp - 0x1e8], 0
je 0x10044cac
mov dword [ebp - 0x758], 1
jmp 0x10044cb3
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x950], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp + eax - 0xac4], ecx
push 6
pop eax
test eax, eax
je 0x10044cee
mov eax, 0x357257ea
test eax, eax
je 0x10044cee
mov dword [ebp - 0x760], 1
jmp 0x10044cf5
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x958], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x1e8]
cmp dword [ebp + eax*4 - 0xac4], ecx
jne 0x10044d22
mov dword [ebp - 0x33c], 1
jmp 0x10044d29
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x768], eax
jmp 0x10044dc9
mov dword [ebp - 0x960], 0x2d621ec2
mov dword [ebp - 0xa04], 0x1eca6c84
mov dword [ebp - 0xa0c], 0xa83a0f0f
mov dword [ebp - 0xa14], 0x86992f1e
mov dword [ebp - 0xa1c], 0x9d20578c
mov dword [ebp - 0xa24], 0
mov dword [ebp - 0xa2c], 0xd91f06e8
mov dword [ebp - 0xa58], 6
mov dword [ebp - 0xa60], 0x9f2e0723
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x878]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x878], eax
mov byte [ebp - 0xa6], 0
movzx eax, byte [ebp - 0xa6]
test eax, eax
je 0x10044dc9
push 1
call fcn.10043379
pop ecx
mov byte [ebp - 0xa8], 0
movzx eax, byte [ebp - 0xa8]
test eax, eax
je 0x10044def
push 0x7437
push 0x7433
push 0
call fcn.10044132
add esp, 0xc
jmp 0x10044bcc
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xec]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x16c], 0x15fdc8df
mov dword [ebp - 0x7a8], 0x2206dd2c
mov dword [ebp - 0x1a8], 0
jmp 0x10044e34
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 2
jge 0x10044e50
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x774], 0xfffffff9
jmp 0x10044e27
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x10044e6a
push 0
call fcn.100433d7
pop ecx
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0xa68], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x16c]
je 0x10044e93
mov dword [ebp - 0x660], 1
jmp 0x10044e9a
and dword [ebp - 0x660], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x774]
add eax, dword [ebp - 0x660]
cmp eax, 0xbe4438be
ja 0x10044ec0
mov dword [ebp - 0x344], 1
jmp 0x10044ec7
and dword [ebp - 0x344], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x774]
cmp dword [ebp - 0x344], eax
jl 0x10044ee8
mov dword [ebp - 0x4e4], 1
jmp 0x10044eef
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x4e4], eax
jge 0x10044f09
mov dword [ebp - 0x34c], 1
jmp 0x10044f10
and dword [ebp - 0x34c], 0
cmp dword [ebp - 0x34c], 1
jne 0x10044f35
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x774], 0
je 0x10044f35
mov dword [ebp - 0x5b4], 1
jmp 0x10044f3c
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x5b4], eax
jg 0x10044f56
mov dword [ebp - 0x354], 1
jmp 0x10044f5d
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp - 0x5c]
cmp dword [eax + 4], 0
jne 0x10044f77
jmp 0x100496d3
mov dword [ebp - 0xa70], 0xfffffffb
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x10044fa1
push 1
push 0x2fc6
call fcn.100433a3
pop ecx
pop ecx
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x10044fbb
push 1
call fcn.100433d7
pop ecx
and dword [ebp - 0x28], 0
mov dword [ebp - 0xe4], 0x92beaa32
mov dword [ebp - 0x15c], 0xfffffff9
mov dword [ebp - 0x1b8], 1
mov dword [ebp - 0x1b0], 0xbc8f9611
mov dword [ebp - 0x7d8], 0x8b4b72b4
mov dword [ebp - 0x504], 0xcbd6cd53
mov dword [ebp - 0x5c4], 0x239be99b
mov dword [ebp - 0xa78], 9
mov dword [ebp - 0x7b8], 0x563ade45
mov dword [ebp - 0x364], 0x8b5a47b6
mov dword [ebp - 0x74], 0
jmp 0x10045033
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x10045049
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x1f0], 2
jmp 0x1004502c
mov dword [ebp - 0x74], 0
jmp 0x10045059
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x1004506f
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x7b0], 0xfffffffc
jmp 0x10045052
push 0x1363
push 0x5c67
push 0x7dce
push 0
push 0xd86
lea eax, [ebp - 0x15c]
push eax
push 0x2e1c
lea eax, [ebp - 0xe4]
push eax
call fcn.10044333
add esp, 0x20
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xa80], eax
xor eax, eax
inc eax
je 0x100450c6
cmp dword [ebp - 0x15c], 0
je 0x100450c6
mov dword [ebp - 0x4ec], 1
jmp 0x100450cd
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
sub eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
sub eax, dword [ebp - 0xe4]
je 0x10045121
push 0x2f2c
lea eax, [ebp - 0x1b8]
push eax
push 0x68c7
push 0
push 0x7e62
push 0x5c74
push 0x907
push 0x4803
call fcn.10043e0e
add esp, 0x20
jmp 0x100455ed
mov dword [ebp - 0x37c], 0x649bc00e
mov dword [ebp - 0x2a8], 0x2bad479e
mov dword [ebp - 0x61c], 0x69d0863e
mov dword [ebp - 0x128], 0xa227283a
mov dword [ebp - 0x124], 0x5446ed9a
mov dword [ebp - 0x7c], 0
jmp 0x10045163
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x10045179
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x8b0], 0
jmp 0x1004515c
mov dword [ebp - 0x7c], 0
jmp 0x10045189
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1004519f
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x63c], 0xfffffffe
jmp 0x10045182
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x1b0], 0
jne 0x100451d9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7b0], 0
jne 0x100451d9
and dword [ebp - 0x35c], 0
jmp 0x100451e3
mov dword [ebp - 0x35c], 1
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x61c]
sub eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x1b0]
imul ecx, eax
imul eax, ecx, 0xffffffff
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0
je 0x1004521f
cmp dword [ebp - 0x128], 0
jne 0x10045231
cmp dword [ebp - 0x124], 0
jne 0x10045231
and dword [ebp - 0x4f4], 0
jmp 0x1004523b
mov dword [ebp - 0x4f4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x63c]
mov dword [ebp - 0xa90], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4f4]
mov dword [ebp + eax - 0x8b0], ecx
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0xaa0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f0]
mov dword [ebp - 0xaa8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x63c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x63c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1f0]
cmp dword [ebp + eax - 0x8b0], ecx
jle 0x100452cf
mov dword [ebp - 0x36c], 1
jmp 0x100452d6
and dword [ebp - 0x36c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f0]
cmp dword [ebp - 0x36c], eax
jle 0x100452f7
mov dword [ebp - 0x7c0], 1
jmp 0x100452fe
and dword [ebp - 0x7c0], 0
mov dword [ebp - 0x124], 0x1265a1b
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x2a8]
jge 0x10045328
mov dword [ebp - 0x5bc], 1
jmp 0x1004532f
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x5bc]
sub eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x1b0]
jne 0x1004534f
mov dword [ebp - 0x374], 1
jmp 0x10045356
and dword [ebp - 0x374], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f0]
cmp dword [ebp - 0x374], eax
je 0x10045377
mov dword [ebp - 0x4fc], 1
jmp 0x1004537e
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x4fc], eax
jg 0x100453a1
cmp dword [ebp - 0x37c], 0
je 0x100453a1
mov dword [ebp - 0x654], 1
jmp 0x100453a8
and dword [ebp - 0x654], 0
cmp dword [ebp - 0x654], 0x95183441
jb 0x100453c0
mov dword [ebp - 0x384], 1
jmp 0x100453c7
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x1b0], eax
imul eax, dword [ebp - 0x5c4], 0xe68
cmp dword [ebp - 0xe4], eax
jg 0x10045427
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x10045405
push 1
push 0x52a0
call fcn.100433f7
pop ecx
pop ecx
mov byte [ebp - 0x9f], 0
push 1
push 0x649e
lea eax, [ebp - 0x9f]
push eax
call fcn.1004342f
add esp, 0xc
jmp 0x100455ed
mov dword [ebp - 0x7e0], 0
mov dword [ebp - 0x7cc], 0
mov dword [ebp - 0x1f8], 0
jmp 0x10045454
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jge 0x10045470
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0x978], 7
jmp 0x10045447
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0xab0], eax
push 9
pop eax
test eax, eax
jne 0x10045589
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x63c], 0x5f43
je 0x100454a6
mov dword [ebp - 0x38c], 1
jmp 0x100454ad
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x7d8]
cmp dword [ebp - 0x38c], eax
jne 0x100454c7
mov dword [ebp - 0x394], 1
jmp 0x100454ce
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x5c4]
mov ecx, dword [ebp - 0x1b8]
add ecx, dword [ebp - 0x394]
add eax, ecx
imul eax, dword [ebp - 0x128]
add eax, dword [ebp - 0x7e0]
mov dword [ebp - 0x50c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x50c]
mov dword [ebp + eax - 0x978], ecx
cmp dword [ebp - 0x50c], 0x4641
jg 0x1004552d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x63c], 0
jne 0x1004552d
and dword [ebp - 0x39c], 0
jmp 0x10045537
mov dword [ebp - 0x39c], 1
cmp dword [ebp - 0x39c], 0x3d71
jle 0x1004554f
mov dword [ebp - 0x624], 1
jmp 0x10045556
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 1
jg 0x1004556b
mov dword [ebp - 0x3a4], 1
jmp 0x10045572
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x3a4], eax
jne 0x10045589
and dword [ebp - 0x514], 0
jmp 0x10045593
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x514], eax
jg 0x100455ad
mov dword [ebp - 0x3ac], 1
jmp 0x100455b4
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x3ac], eax
jg 0x100455ce
mov dword [ebp - 0x5cc], 1
jmp 0x100455d5
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0xec]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xec]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x200], 0x97f6af11
mov dword [ebp - 0x200], 0xfffffffe
jmp 0x1004562a
mov eax, dword [ebp - 0x200]
dec eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xfffffffd
jge 0x10045688
mov dword [ebp - 0x168], 0
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x10045657
push 1
call fcn.10043486
pop ecx
mov dword [ebp - 0x168], 0xffffffec
jmp 0x10045670
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xd
jl 0x10045686
cmp dword [ebp - 0x168], 0
je 0x10045684
jmp 0x10045686
jmp 0x10045663
jmp 0x1004561d
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x3b0]
push eax
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.1004360d
add esp, 0x14
mov dword [ebp - 0x78c], 0xbcd8c45c
mov dword [ebp - 0x6cc], 0x56f9b2cf
mov dword [ebp - 0xaf4], 0x99fb023e
mov dword [ebp - 0xab4], 0x5dae5a60
mov dword [ebp - 0xa5c], 5
mov dword [ebp - 0x3b4], 0xffffffff
mov dword [ebp - 0x1c0], 0
jmp 0x100456fd
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x10045719
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x8cc], 0xcb63e8e1
jmp 0x100456f0
push 0x735e
push 1
lea eax, [ebp - 0x78c]
push eax
lea eax, [ebp - 0x6cc]
push eax
call fcn.100434c1
add esp, 0x10
mov eax, dword [ebp - 0x3b4]
dec eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x28], 0
jne 0x1004574e
jmp 0x100496d3
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x5d4], 6
mov dword [ebp - 0x2b0], 0xa20b95ae
mov dword [ebp - 0x8c0], 0xd4a0d461
mov dword [ebp - 0x8bc], 0xd4a0d461
mov dword [ebp - 0x8b8], 0xd4a0d461
mov dword [ebp - 0x8b4], 0xd4a0d461
mov dword [ebp - 0x208], 1
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x100457bc
push 0
call fcn.10044242
pop ecx
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xffff
jbe 0x100457e1
mov dword [ebp - 0x51c], 1
jmp 0x100457e8
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x5d4]
cmp eax, dword [ebp - 0x51c]
jle 0x10045802
mov dword [ebp - 0x3c4], 1
jmp 0x10045809
and dword [ebp - 0x3c4], 0
cmp dword [ebp - 0x2b0], 0xcb0b
jg 0x10045827
mov eax, 0xfffe
test eax, eax
je 0x10045827
and dword [ebp - 0x3bc], 0
jmp 0x10045831
mov dword [ebp - 0x3bc], 1
cmp dword [ebp - 0x3bc], 0
jne 0x10045846
mov dword [ebp - 0x668], 1
jmp 0x1004584d
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x668]
add eax, 0x16c9418
cmp dword [ebp - 0x3c4], eax
jg 0x1004586c
mov dword [ebp - 0x524], 1
jmp 0x10045873
and dword [ebp - 0x524], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x524]
mov dword [ebp + eax - 0x8c0], ecx
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0xa00], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x8d4], eax
cmp dword [ebp - 0x208], 0
jne 0x100458b9
mov eax, 0x7b1466ac
test eax, eax
jne 0x100458b9
and dword [ebp - 0x3cc], 0
jmp 0x100458c3
mov dword [ebp - 0x3cc], 1
mov eax, dword [ebp - 0x3cc]
add eax, 0xe559
mov dword [ebp - 0x5d4], eax
xor ecx, ecx
call fcn.10030499
push eax
call fcn.10060738
pop ecx
mov dword [ebp - 0xaf0], 8
mov byte [ebp - 0xca], 0
lea eax, [ebp - 0xca]
push eax
push 1
push 0x72b5
call fcn.1004350e
add esp, 0xc
push 0x140c
push 1
call fcn.10043564
pop ecx
pop ecx
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x728], 0xfffffffe
mov dword [ebp - 0x53c], 1
mov dword [ebp - 0x30], 0
jmp 0x10045945
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1004595b
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x258], 0
jmp 0x1004593e
mov dword [ebp - 0x30], 0
jmp 0x1004596b
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10045981
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x688], 0x647dc4b4
jmp 0x10045964
mov dword [ebp - 0x30], 0
jmp 0x10045991
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x100459a7
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x864], 2
jmp 0x1004598a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x258]
mov dword [ebp - 0x3d4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3d4]
mov dword [ebp + eax - 0x258], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3d4]
mov dword [ebp + eax - 0x688], ecx
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x52c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x52c]
mov dword [ebp + eax - 0x688], ecx
cmp dword [ebp - 0x52c], 0
jne 0x10045a21
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x688], 0
jne 0x10045a21
and dword [ebp - 0x3e4], 0
jmp 0x10045a2b
mov dword [ebp - 0x3e4], 1
cmp dword [ebp - 0x728], 0
jne 0x10045a9d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x258]
mov dword [ebp - 0x8dc], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x864]
mov dword [ebp - 0xa08], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x258]
cmp dword [ebp + eax - 0x258], ecx
jne 0x10045a81
mov dword [ebp - 0x3dc], 1
jmp 0x10045a88
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0xf381
je 0x10045a9d
and dword [ebp - 0x62c], 0
jmp 0x10045aa7
mov dword [ebp - 0x62c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x864]
cmp dword [ebp - 0x62c], eax
jge 0x10045ac8
mov dword [ebp - 0x534], 1
jmp 0x10045acf
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x3e4]
cmp eax, dword [ebp - 0x534]
jg 0x10045ae9
mov dword [ebp - 0x3ec], 1
jmp 0x10045af0
and dword [ebp - 0x3ec], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x864]
cmp dword [ebp - 0x3ec], eax
je 0x10045b10
mov dword [ebp - 0x5dc], 1
jmp 0x10045b17
and dword [ebp - 0x5dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x258]
cmp dword [ebp - 0x5dc], eax
je 0x10045b38
mov dword [ebp - 0x3f4], 1
jmp 0x10045b3f
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x8e4], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x130], eax
jl 0x10045b86
mov eax, 0x7440271d
test eax, eax
je 0x10045b86
mov dword [ebp - 0x3fc], 1
jmp 0x10045b8d
and dword [ebp - 0x3fc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x258]
cmp dword [ebp - 0x3fc], eax
jle 0x10045bae
mov dword [ebp - 0x644], 1
jmp 0x10045bb5
and dword [ebp - 0x644], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x258]
cmp eax, dword [ebp - 0x644]
je 0x10045bd6
mov dword [ebp - 0x404], 1
jmp 0x10045bdd
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0xf26af903
jae 0x10045bf5
mov dword [ebp - 0x544], 1
jmp 0x10045bfc
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x544], eax
jne 0x10045c16
mov dword [ebp - 0x40c], 1
jmp 0x10045c1d
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 0
jne 0x10045c55
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x688], 0
je 0x10045c55
mov byte [ebp - 0xa5], 0
push 0x7187
lea eax, [ebp - 0xa5]
push eax
push 1
call fcn.100435a8
add esp, 0xc
jmp 0x10045ca1
mov dword [ebp - 0x6c4], 5
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x864]
neg eax
cmp eax, 0xdaff
jge 0x10045c80
mov dword [ebp - 0x5e4], 1
jmp 0x10045c87
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x6c4]
imul eax, dword [ebp - 0x5e4]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x258], eax
mov byte [ebp - 0x118], 3
mov byte [ebp - 0x117], 0x1b
mov byte [ebp - 0x116], 7
mov byte [ebp - 0x115], 1
mov byte [ebp - 0x114], 6
mov byte [ebp - 0x113], 7
mov byte [ebp - 0x112], 1
mov byte [ebp - 0x111], 4
mov byte [ebp - 0x110], 1
mov byte [ebp - 0x10f], 0xed
mov byte [ebp - 0x10e], 4
mov byte [ebp - 0x10d], 0xd
mov byte [ebp - 0x10c], 5
mov byte [ebp - 0x10b], 9
mov byte [ebp - 0x10a], 0
mov byte [ebp - 0x109], 0
mov byte [ebp - 0x108], 2
mov byte [ebp - 0x107], 6
mov byte [ebp - 0x106], 8
mov byte [ebp - 0x105], 7
mov byte [ebp - 0x104], 9
mov byte [ebp - 0x103], 0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x118]
or eax, 0x2c
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x118]
and ecx, 0x2c
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x118]
mov byte [ebp + ecx - 0x674], al
mov dword [ebp - 0x1c], 2
and dword [ebp - 0x150], 0
jmp 0x10045d8c
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x16
jae 0x10045e6a
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x118]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x10045dd6
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x118]
inc eax
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x118]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x1c], eax
jmp 0x10045d84
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x117]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x150]
movzx ecx, byte [ebp + ecx - 0x11a]
movsx ecx, byte [ebp + ecx - 0x674]
add eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x117]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x150]
movzx edx, byte [ebp + edx - 0x11a]
movsx edx, byte [ebp + edx - 0x674]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x117]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x150]
movzx edx, byte [ebp + edx - 0x11a]
movsx edx, byte [ebp + edx - 0x674]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x118]
mov byte [ebp + ecx - 0x674], al
and dword [ebp - 0x150], 0
jmp 0x10045d84
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x674], 0
lea eax, [ebp - 0x674]
push eax
lea ecx, [ebp - 0xc00]
call fcn.10025cb9
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x798], eax
and dword [ebp - 4], 0
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x798]
call fcn.10030459
pop ecx
mov dword [ebp - 0x70c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc00]
call fcn.10017ae5
push 0x1aa0
push 0x5348
push 0x7c6d
push 1
push 0x4e96
call fcn.1004360d
add esp, 0x14
and dword [ebp - 0x1c8], 0
jmp 0x10045ef9
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0xb
jae 0x10045f12
mov eax, dword [ebp - 0x1c8]
mov byte [ebp + eax - 0x674], 0
jmp 0x10045eec
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0x2c0], 0xa971
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x2c], 0
jmp 0x10045f40
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10045f56
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x11c], 0xfffffffc
jmp 0x10045f39
mov dword [ebp - 0x2c], 0
jmp 0x10045f66
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10045f7c
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x984], 0x4c38d679
jmp 0x10045f5f
mov dword [ebp - 0x2c], 0
jmp 0x10045f8c
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10045fa2
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x990], 0xbc906383
jmp 0x10045f85
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0x2210
call fcn.100437ce
add esp, 0x14
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x8ec], eax
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0xa10], eax
mov dword [ebp - 0x210], 0xffff
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x8f4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x11c]
cmp dword [ebp - 0x2c0], eax
je 0x10046015
mov dword [ebp - 0x414], 1
jmp 0x1004601c
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
sub eax, dword [ebp - 0xc0]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x11c]
jne 0x10046043
mov dword [ebp - 0x6dc], 1
jmp 0x1004604a
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xc0]
push 4
pop edx
imul edx, edx, 0
sub ecx, dword [ebp + edx - 0x11c]
add eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x11c]
jl 0x1004608c
mov dword [ebp - 0x2b8], 1
jmp 0x10046093
and dword [ebp - 0x2b8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp + eax - 0x984], ecx
cmp dword [ebp - 0x2b8], 0
jne 0x100460bb
mov dword [ebp - 0x7a0], 1
jmp 0x100460c2
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x8fc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x11c], 0
je 0x100460f3
cmp dword [ebp - 0x2c0], 0
je 0x100460f3
mov dword [ebp - 0x54c], 1
jmp 0x100460fa
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 0xab8a
jne 0x10046112
mov dword [ebp - 0x41c], 1
jmp 0x10046119
and dword [ebp - 0x41c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x41c]
mov dword [ebp + eax - 0x990], ecx
mov byte [ebp - 0x190], 0
mov byte [ebp - 0x18f], 0x79
mov byte [ebp - 0x18e], 0xc
mov byte [ebp - 0x18d], 0x94
mov byte [ebp - 0x18c], 0x9a
mov byte [ebp - 0x18b], 0xef
mov byte [ebp - 0x18a], 0x13
mov byte [ebp - 0x189], 0x88
mov byte [ebp - 0x188], 0xe9
mov byte [ebp - 0x187], 0x9a
mov byte [ebp - 0x186], 0x7b
mov byte [ebp - 0x185], 0x77
mov byte [ebp - 0x184], 0x79
mov byte [ebp - 0x183], 0x52
mov byte [ebp - 0x182], 0xa3
mov byte [ebp - 0x181], 2
mov byte [ebp - 0x180], 6
mov byte [ebp - 0x17f], 7
mov byte [ebp - 0x17e], 1
mov byte [ebp - 0x17d], 4
mov byte [ebp - 0x17c], 2
mov byte [ebp - 0x17b], 8
mov byte [ebp - 0x17a], 4
mov byte [ebp - 0x179], 3
mov byte [ebp - 0x178], 2
mov byte [ebp - 0x177], 1
mov byte [ebp - 0x176], 4
mov byte [ebp - 0x175], 6
mov byte [ebp - 0x174], 0xf
mov byte [ebp - 0x173], 9
mov byte [ebp - 0x172], 9
mov byte [ebp - 0x171], 5
mov byte [ebp - 0x170], 1
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x190]
or eax, 0x48
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x190]
and ecx, 0x48
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x190]
mov byte [ebp + ecx - 0x680], al
mov dword [ebp - 0x24], 2
and dword [ebp - 0x138], 0
jmp 0x10046264
mov eax, dword [ebp - 0x24]
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x21
jae 0x1004635b
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x190]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x24], eax
jne 0x100462ae
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x190]
inc eax
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x190]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x24], eax
jmp 0x1004625c
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x18f]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x138]
movzx ecx, byte [ebp + ecx - 0x192]
movsx ecx, byte [ebp + ecx - 0x680]
add eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x18f]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x138]
movzx edx, byte [ebp + edx - 0x192]
movsx edx, byte [ebp + edx - 0x680]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x18f]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x138]
movzx edx, byte [ebp + edx - 0x192]
movsx edx, byte [ebp + edx - 0x680]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x190]
mov byte [ebp + ecx - 0x680], al
push 0x507a
push 0x2b1
push 0x4fad
push 1
lea eax, [ebp - 0x138]
push eax
call fcn.100437ce
add esp, 0x14
jmp 0x1004625c
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x680], 0
push 0x5b63
push 1
call fcn.1004389c
pop ecx
pop ecx
lea eax, [ebp - 0x680]
push eax
lea ecx, [ebp - 0xb94]
call fcn.10025cb9
mov dword [ebp - 0x6e4], eax
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x7d4], eax
mov dword [ebp - 4], 1
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x7d4]
call fcn.10030459
pop ecx
mov dword [ebp - 0x7dc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb94]
call fcn.10017ae5
and dword [ebp - 0x1d0], 0
jmp 0x100463dd
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0xb
jae 0x100463f6
mov eax, dword [ebp - 0x1d0]
mov byte [ebp + eax - 0x680], 0
jmp 0x100463d0
mov dword [ebp - 0x42c], 0xfffffffb
mov dword [ebp - 0xc8], 0xffffffff
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x424], 0x3644bb32
mov dword [ebp - 0x6f4], 0x71c2
mov dword [ebp - 0x80c], 0xffffffff
mov dword [ebp - 0x60], 0
jmp 0x1004644c
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x10046462
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x29c], 8
jmp 0x10046445
mov dword [ebp - 0x60], 0
jmp 0x10046472
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x10046488
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x99c], 1
jmp 0x1004646b
mov byte [ebp - 0xa3], 0
push 0x28eb
push 1
lea eax, [ebp - 0xa3]
push eax
call fcn.10043b31
add esp, 0xc
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x160]
mov dword [ebp + eax - 0x29c], ecx
cmp dword [ebp - 0x42c], 0
jne 0x10046691
cmp dword [ebp - 0x160], 0xa24b
jg 0x100464ea
mov dword [ebp - 0x634], 1
jmp 0x100464f1
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jne 0x10046512
mov dword [ebp - 0x554], 1
jmp 0x10046519
and dword [ebp - 0x554], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c]
cmp dword [ebp - 0x554], eax
je 0x1004653a
mov dword [ebp - 0x5ec], 1
jmp 0x10046541
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x42c]
cmp dword [ebp - 0x5ec], eax
jg 0x1004655b
mov dword [ebp - 0x434], 1
jmp 0x10046562
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
neg eax
jne 0x1004657a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x29c], 0
mov eax, 0xfff8
test eax, eax
je 0x1004659f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x99c], 0
je 0x1004659f
mov dword [ebp - 0x55c], 1
jmp 0x100465a6
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 0xfffffffa
jbe 0x100465bb
mov dword [ebp - 0x43c], 1
jmp 0x100465c2
and dword [ebp - 0x43c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x29c]
cmp dword [ebp - 0x43c], eax
jle 0x100465e3
mov dword [ebp - 0x648], 1
jmp 0x100465ea
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x648], eax
jne 0x10046604
mov dword [ebp - 0x444], 1
jmp 0x1004660b
and dword [ebp - 0x444], 0
mov dword [ebp - 0x2c8], 0x84257392
mov eax, dword [ebp - 0x2c8]
add eax, dword [ebp - 0x444]
je 0x1004663f
mov dword [ebp - 0x44c], 1
cmp dword [ebp - 0x44c], 1
jge 0x100466b0
mov dword [ebp - 0x794], 1
jmp 0x100466b7
and dword [ebp - 0x794], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x29c]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xa84], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c]
mov dword [ebp - 0x90c], eax
imul eax, dword [ebp - 0x6f4], 0x2365
test eax, eax
je 0x1004676a
mov dword [ebp - 0x704], 0x4206
mov dword [ebp - 0x79c], 0xfffffffe
mov dword [ebp - 0x6fc], 3
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1004672d
call dword [sym.imp.USER32.dll_EndMenu]
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x6fc]
push eax
lea eax, [ebp - 0x79c]
push eax
push 1
lea eax, [ebp - 0x704]
push eax
call fcn.10043b88
add esp, 0x20
jmp 0x100467dd
mov dword [ebp - 0xc8], 0xfffffffb
jmp 0x10046783
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xffffffe2
jle 0x100467dd
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x100467c1
push 0x2260
push 0
push 0x51a0
push 0x7f86
push 0x56d1
push 0x2e90
call fcn.1004417b
add esp, 0x18
mov byte [ebp - 0xa7], 0
movzx eax, byte [ebp - 0xa7]
test eax, eax
je 0x100467db
push 0
call fcn.10043d7a
pop ecx
jmp 0x10046776
push dword [ebp - 0x7dc]
push dword [ebp - 0x70c]
call fcn.1004061b
pop ecx
pop ecx
mov dword [ebp - 0x57c], eax
mov dword [ebp - 0x6c0], 0x33efc07e
mov dword [ebp - 0x6bc], 0x33efc07e
mov dword [ebp - 0x6b8], 0x33efc07e
mov dword [ebp - 0x6b4], 0x33efc07e
mov dword [ebp - 0x98], 0x684a
mov dword [ebp - 0x714], 0xfffffffa
mov dword [ebp - 0x56c], 0xffffffff
mov dword [ebp - 0x45c], 0xd293e35f
mov dword [ebp - 0x824], 0xffffffff
mov dword [ebp - 0x218], 0
jmp 0x10046869
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jge 0x10046885
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0x2f0], 0x110c93b4
jmp 0x1004685c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2f0], 0
jmp 0x100468b3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2f0], 0x1c
jg 0x10046aa4
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x7a4], 0x12d2c87a
mov dword [ebp - 0x148], 0x9a325cf1
mov dword [ebp - 0xa20], 1
mov dword [ebp - 0x140], 3
jmp 0x10046908
cmp dword [ebp - 0x140], 0
jl 0x10046a9f
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x91c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2f0], 0x1012106d
jle 0x10046acf
mov dword [ebp - 0x454], 1
jmp 0x10046ad6
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x714]
imul eax, dword [ebp - 0x454]
test eax, eax
jne 0x10046af9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x718], eax
mov eax, dword [ebp - 0x718]
mov dword [ebp - 0x720], eax
mov eax, dword [ebp - 0x720]
movzx eax, byte [eax]
test eax, eax
je 0x100496d3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret