Function at 0x10008b89
Capabilities:
Check os version
Create process on windows
Get common file path
Get memory capacity
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b19b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd88
push esi
push edi
mov dword [ebp - 0x50], 0x76b0f738
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0xb40], 1
mov dword [ebp - 0xb3c], 1
mov dword [ebp - 0xb38], 1
mov dword [ebp - 0xb34], 1
push 4
lea ecx, [ebp - 0xaac]
call fcn.10016a6e
and dword [ebp - 4], 0
mov dword [ebp - 0x3c], 0
jmp 0x10008c00
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x10008c16
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x184], 0x70f9e3d3
jmp 0x10008bf9
mov dword [ebp - 0x3c], 0
jmp 0x10008c26
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x10008c3c
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xa30], 1
jmp 0x10008c1f
mov dword [ebp - 0x3c], 0
jmp 0x10008c4c
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x10008c68
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xaac]
call fcn.10016adb
mov dword [eax], 0xfffffffb
jmp 0x10008c45
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x10008d71
cmp dword [ebp - 0x50], 0xffffffff
jae 0x10008c8b
mov dword [ebp - 0x788], 1
jmp 0x10008c92
and dword [ebp - 0x788], 0
cmp dword [ebp - 0x58], 0xb6917ab6
ja 0x10008ca7
mov dword [ebp - 0x84c], 1
jmp 0x10008cae
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xcfc], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x58], eax
jl 0x10008cd1
mov dword [ebp - 0x7e0], 1
jmp 0x10008cd8
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x788]
cmp eax, dword [ebp - 0x7e0]
jle 0x10008cf2
mov dword [ebp - 0x2d4], 1
jmp 0x10008cf9
and dword [ebp - 0x2d4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2d4]
mov dword [ebp + eax - 0x184], ecx
cmp dword [ebp - 0x2d4], 0x213e
je 0x10008d24
mov dword [ebp - 0x7e8], 1
jmp 0x10008d2b
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x7e8], eax
jl 0x10008d42
mov dword [ebp - 0x7f0], 1
jmp 0x10008d49
and dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 0x7ad53a38
jl 0x10008d71
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x184], 0
je 0x10008d71
mov dword [ebp - 0x8c0], 1
jmp 0x10008d78
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xbe8], eax
cmp dword [ebp - 0x50], 0xffffffff
jle 0x10008d93
mov dword [ebp - 0x7f8], 1
jmp 0x10008d9a
and dword [ebp - 0x7f8], 0
cmp dword [ebp - 0x7f8], 0x3dec
jg 0x10008db2
mov dword [ebp - 0x8c8], 1
jmp 0x10008db9
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xcbc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x184]
mov dword [ebp - 0xbf0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x184]
mov dword [ebp - 0xcb0], eax
cmp dword [ebp - 0x58], 0
je 0x10008eeb
mov dword [ebp - 0x50], 0
jmp 0x10008e02
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x36
jg 0x10008ee6
mov dword [ebp - 0x17c], 1
mov dword [ebp - 0x58], 0xfffffff7
jmp 0x10008e26
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jne 0x10008e7b
mov dword [ebp - 0x270], 0xfffffffa
mov dword [ebp - 0x8d0], 0xfffffffb
mov dword [ebp - 0x270], 0
jmp 0x10008e59
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 8
jge 0x10008e79
mov dword [ebp - 0x8d0], 1
cmp dword [ebp - 0x17c], 0
je 0x10008e77
jmp 0x10008e79
jmp 0x10008e4c
jmp 0x10008e1f
mov dword [ebp - 0x17c], 0
jmp 0x10008e94
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jg 0x10008ee1
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x10008ebe
push 0
push 0xcb6
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x10008edf
push 0
push 0xcb6
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x10008e87
jmp 0x10008dfb
jmp 0x100090dd
mov dword [ebp - 0x1c4], 0x523e
push 3
lea ecx, [ebp - 0xaa0]
call fcn.10016a6e
mov byte [ebp - 4], 1
mov dword [ebp - 0x27c], 0
jmp 0x10008f1f
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 3
jge 0x10008f3e
push dword [ebp - 0x27c]
lea ecx, [ebp - 0xaa0]
call fcn.10016adb
and dword [eax], 0
jmp 0x10008f12
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xbf8], eax
cmp dword [ebp - 0x1c4], 1
jg 0x10008f5c
mov dword [ebp - 0x800], 1
jmp 0x10008f63
and dword [ebp - 0x800], 0
cmp dword [ebp - 0x800], 0x76dcb0c7
jl 0x10008f7b
mov dword [ebp - 0x808], 1
jmp 0x10008f82
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x808], eax
jle 0x10008fa2
cmp dword [ebp - 0x1c4], 0
jne 0x10008fa2
and dword [ebp - 0x818], 0
jmp 0x10008fac
mov dword [ebp - 0x818], 1
cmp dword [ebp - 0x818], 0x56eb3e19
jle 0x10008fc4
mov dword [ebp - 0x34c], 1
jmp 0x10008fcb
and dword [ebp - 0x34c], 0
push 1
lea ecx, [ebp - 0xaa0]
call fcn.10016adb
mov ecx, dword [ebp - 0x34c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x34c], eax
jle 0x10008ffa
mov dword [ebp - 0x820], 1
jmp 0x10009001
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x820]
jl 0x1000901b
mov dword [ebp - 0x354], 1
jmp 0x10009022
and dword [ebp - 0x354], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x354]
mov dword [ebp + eax - 0x184], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa30]
cmp dword [ebp - 0x354], eax
je 0x10009056
mov dword [ebp - 0x6dc], 1
jmp 0x1000905d
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x58], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa30]
cmp dword [ebp - 0x58], eax
je 0x10009084
mov dword [ebp - 0x37c], 1
jmp 0x1000908b
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x37c], eax
jg 0x100090af
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb40], 0
jne 0x100090af
and dword [ebp - 0x6e4], 0
jmp 0x100090b9
mov dword [ebp - 0x6e4], 1
push 2
lea ecx, [ebp - 0xaac]
call fcn.10016adb
mov ecx, dword [ebp - 0x6e4]
mov dword [eax], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xaa0]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaac]
call fcn.10016ad6
mov dword [ebp - 0x1f8], 0x8bbca631
mov dword [ebp - 0x330], 1
mov dword [ebp - 0xa0], 0xcb13638e
mov dword [ebp - 0x6f4], 0x3423637b
push 1
lea ecx, [ebp - 0xab8]
call fcn.10016a6e
mov dword [ebp - 4], 2
mov dword [ebp - 0x8d8], 0x137d3709
mov dword [ebp - 0x24], 0
jmp 0x10009142
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10009158
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xcd0], 6
jmp 0x1000913b
mov dword [ebp - 0x24], 0
jmp 0x10009168
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1000917e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7b8], 0
jmp 0x10009161
mov dword [ebp - 0x24], 0
jmp 0x1000918e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x100091a7
push dword [ebp - 0x24]
lea ecx, [ebp - 0xab8]
call fcn.10016adb
and dword [eax], 0
jmp 0x10009187
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
je 0x1000935b
cmp dword [ebp - 0xa0], 0
je 0x1000928b
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x330]
mov dword [ebp + eax - 0xcd0], ecx
xor eax, eax
sub eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xa0]
jge 0x100091fc
mov dword [ebp - 0x384], 1
jmp 0x10009203
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
neg eax
sub eax, 0x7209c399
cmp eax, dword [ebp - 0x330]
jl 0x1000922d
mov eax, 0x4df8e3bf
test eax, eax
je 0x1000922d
mov dword [ebp - 0x6ec], 1
jmp 0x10009234
and dword [ebp - 0x6ec], 0
imul eax, dword [ebp - 0x6ec], 0x4cc5
test eax, eax
jne 0x10009254
mov eax, 0xec1f
test eax, eax
jne 0x10009254
and dword [ebp - 0x38c], 0
jmp 0x1000925e
mov dword [ebp - 0x38c], 1
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebp - 0x6f4]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x7b8]
je 0x1000928b
mov dword [ebp - 0x394], 1
jmp 0x10009292
and dword [ebp - 0x394], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7b8]
cmp dword [ebp - 0x394], eax
je 0x100092b3
mov dword [ebp - 0x6fc], 1
jmp 0x100092ba
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0xa0]
neg eax
cmp eax, dword [ebp - 0x6fc]
jne 0x100092d6
mov dword [ebp - 0x39c], 1
jmp 0x100092dd
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0xa0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7b8]
cmp dword [ebp - 0xa0], eax
je 0x1000930a
mov dword [ebp - 0x348], 1
jmp 0x10009311
and dword [ebp - 0x348], 0
push 0
lea ecx, [ebp - 0xab8]
call fcn.10016adb
mov ecx, dword [ebp - 0x348]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7b8]
cmp dword [ebp - 0x348], eax
je 0x10009347
mov dword [ebp - 0x704], 1
jmp 0x1000934e
and dword [ebp - 0x704], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7b8]
mov dword [ebp - 0x8d8], 0xe41b0ce7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xab8]
call fcn.10016ad6
mov dword [ebp - 0xa58], 0
mov dword [ebp - 0xa54], 0
mov dword [ebp - 0xa50], 0
mov dword [ebp - 0xa4c], 0
mov dword [ebp - 0x150], 1
mov dword [ebp - 0xcc4], 0xfffffff8
mov dword [ebp - 0x1b4], 0xc8d3c891
mov dword [ebp - 0x150], 3
jmp 0x100093d3
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jl 0x10009496
mov dword [ebp - 0x3a4], 4
mov eax, dword [ebp - 0x3a4]
dec eax
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x1b4], 0
jmp 0x10009410
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 3
jg 0x10009491
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp + eax*4 - 0xa58]
mov ecx, dword [ebp - 0x150]
sub eax, dword [ebp + ecx*4 - 0xa58]
je 0x10009474
mov dword [ebp - 0x8e0], 0x15d7249a
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x8e0], eax
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x10009472
push 0
push 0
push 0x1155
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x1000948c
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1000948c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
jmp 0x10009403
jmp 0x100093c6
mov dword [ebp - 0x1f8], 3
jmp 0x100094af
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0x14
jl 0x1000a1a1
mov dword [ebp - 0xa00], 0xdd1e1e87
mov dword [ebp - 0x9fc], 0xdd1e1e87
mov dword [ebp - 0x9f8], 0xdd1e1e87
mov dword [ebp - 0x9f4], 0xdd1e1e87
mov dword [ebp - 0x284], 0
jmp 0x100094fd
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 3
jge 0x10009519
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0xd28], 1
jmp 0x100094f0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xa00], 0
jmp 0x10009544
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa00]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xa00], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa00], 2
jg 0x100095e6
mov dword [ebp - 0x18c], 1
mov dword [ebp - 0x18c], 0
jmp 0x1000957a
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jg 0x100095e1
mov dword [ebp - 0x904], 0
mov byte [ebp - 0xc7], 0
movzx eax, byte [ebp - 0xc7]
test eax, eax
je 0x100095b0
push 0
push 1
push 0x17bd
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov eax, dword [ebp - 0x18c]
cmp dword [ebp + eax*4 - 0xd28], 2
jg 0x100095cc
mov dword [ebp - 0x70c], 1
jmp 0x100095d3
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x904], eax
jmp 0x1000956d
jmp 0x1000952b
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x10009616
push 0x973
push 0xebe
push 0
push 0
push 0xb27
push 0x2267
call dword [sym.imp.USER32.dll_ToUnicode]
mov dword [ebp - 0x90c], 0x971c
mov dword [ebp - 0xc00], 0x4768c0aa
mov dword [ebp - 0x3b4], 3
push 4
lea ecx, [ebp - 0xad0]
call fcn.10016a6e
mov dword [ebp - 4], 3
mov dword [ebp - 0x15c], 0x3859
mov dword [ebp - 0x3c4], 0xfffffffd
mov dword [ebp - 0xcc0], 0xa97f51ef
mov dword [ebp - 0xc30], 0
push 1
lea ecx, [ebp - 0x964]
call fcn.10016a6e
mov byte [ebp - 4], 4
mov dword [ebp - 0xe4], 0x8f49235
mov dword [ebp - 0x3bc], 0x4643a64e
mov dword [ebp - 0x14], 0
jmp 0x100096a5
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100096bb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd94], 0x978f3c34
jmp 0x1000969e
mov dword [ebp - 0x14], 0
jmp 0x100096cb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x100096e7
push dword [ebp - 0x14]
lea ecx, [ebp - 0xad0]
call fcn.10016adb
mov dword [eax], 0x5cc2
jmp 0x100096c4
mov dword [ebp - 0x14], 0
jmp 0x100096f7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10009713
push dword [ebp - 0x14]
lea ecx, [ebp - 0x964]
call fcn.10016adb
mov dword [eax], 0x3eb61943
jmp 0x100096f0
mov dword [ebp - 0x14], 0
jmp 0x10009723
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10009739
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd40], 5
jmp 0x1000971c
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x3ac], eax
push 0
lea ecx, [ebp - 0x964]
call fcn.10016adb
mov ecx, dword [ebp - 0x3ac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3ac]
mov ecx, dword [ebp - 0xe4]
inc ecx
mov dword [ebp - 0xe4], ecx
test eax, eax
jne 0x1000981c
mov eax, dword [ebp - 0x15c]
neg eax
cmp eax, dword [ebp - 0x3b4]
jle 0x100097e1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c4]
cmp dword [ebp + eax - 0xd40], ecx
jne 0x100097a6
mov dword [ebp - 0x714], 1
jmp 0x100097ad
and dword [ebp - 0x714], 0
cmp dword [ebp - 0x714], 0x5438
jle 0x100097c5
mov dword [ebp - 0x2e0], 1
jmp 0x100097cc
and dword [ebp - 0x2e0], 0
push 0
lea ecx, [ebp - 0x964]
call fcn.10016adb
mov ecx, dword [ebp - 0x2e0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3b4]
cmp dword [ebp - 0x3bc], eax
jl 0x100097fb
mov dword [ebp - 0x71c], 1
jmp 0x10009802
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x71c]
add eax, 4
cmp dword [ebp - 0x3bc], eax
jle 0x1000981c
and dword [ebp - 0x724], 0
jmp 0x10009826
mov dword [ebp - 0x724], 1
mov eax, dword [ebp - 0x90c]
cmp eax, dword [ebp - 0x724]
jl 0x10009880
mov dword [ebp - 0x15c], 3
jmp 0x1000984d
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jl 0x1000987b
mov dword [ebp - 0x914], 0
push dword [ebp - 0x15c]
lea ecx, [ebp - 0xad0]
call fcn.10016adb
mov eax, dword [eax]
mov dword [ebp - 0x914], eax
jmp 0x10009840
jmp 0x10009940
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x100098a3
push 0
push 0xca8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 0xe4], 0
jmp 0x100098bc
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jg 0x10009940
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x100098df
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x1000993b
push 0x1a95
push 0xbb4
push 0
push 0
push 0x26d0
push 0x208f
push 0x22ac
push 0x119b
push 0x144b
push 0x1abe
push 0x1933
push 0x17d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
jmp 0x100098af
mov eax, 0x4a49
test eax, eax
je 0x1000995e
cmp dword [ebp - 0x3c4], 0
je 0x1000995e
mov dword [ebp - 0x72c], 1
jmp 0x10009965
and dword [ebp - 0x72c], 0
push 0
lea ecx, [ebp - 0x964]
call fcn.10016adb
mov ecx, dword [ebp - 0x72c]
mov dword [eax], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x964]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xad0]
call fcn.10016ad6
mov byte [ebp - 0x11d], 0
mov dword [ebp - 0x3cc], 0xb0b0
mov dword [ebp - 0x3cc], 0xffffffff
cmp dword [ebp - 0x3cc], 0
je 0x100099df
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x100099dd
push 0
push 0x8d9
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100099f9
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x100099f9
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x10009bb4
mov dword [ebp - 0x28c], 0xfffffffd
mov dword [ebp - 0xd08], 0xfa147b80
mov dword [ebp - 0xc38], 0xfffffff9
mov dword [ebp - 0xcc8], 4
mov dword [ebp - 0x200], 0
jmp 0x10009a49
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x10009a65
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0xc40], 0x624039b
jmp 0x10009a3c
mov dword [ebp - 0x28c], 0
jmp 0x10009a7e
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
jg 0x10009b7d
mov dword [ebp - 0x208], 0x976ff55e
mov dword [ebp - 0xcf8], 7
mov dword [ebp - 0xc48], 0xd1f2e966
mov dword [ebp - 0x208], 0
jmp 0x10009ac2
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jg 0x10009b78
mov dword [ebp - 0x210], 6
mov dword [ebp - 0x294], 0
jmp 0x10009af2
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 1
jge 0x10009b0e
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0xb78], 5
jmp 0x10009ae5
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x10009b38
push 0x2432
push 0
push 0
push 0
push 0x213
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x210], 0
jmp 0x10009b51
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jg 0x10009b73
mov dword [ebp - 0x734], 0x27f7b6fe
mov eax, dword [ebp - 0x734]
dec eax
mov dword [ebp - 0x734], eax
jmp 0x10009b44
jmp 0x10009ab5
jmp 0x10009a71
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x10009bac
push 0
push 0
push 0
push 0
push 0x1e5f
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
mov dword [ebp - 0x3d4], 9
mov dword [ebp - 0xb7c], 0x5dae5a60
push 4
lea ecx, [ebp - 0x974]
call fcn.10016a6e
mov dword [ebp - 4], 5
mov dword [ebp - 0x2e8], 0xfffffffb
mov dword [ebp - 0x73c], 0x7278fa8f
push 1
lea ecx, [ebp - 0xb24]
call fcn.10016a6e
mov byte [ebp - 4], 6
mov dword [ebp - 0x934], 0xe291920b
mov dword [ebp - 0x93c], 0x6fd8
mov dword [ebp - 0x68], 0
jmp 0x10009c25
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x10009c3e
push dword [ebp - 0x68]
lea ecx, [ebp - 0x974]
call fcn.10016adb
and dword [eax], 0
jmp 0x10009c1e
mov dword [ebp - 0x68], 0
jmp 0x10009c4e
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x10009c6a
push dword [ebp - 0x68]
lea ecx, [ebp - 0xb24]
call fcn.10016adb
mov dword [eax], 0x720348f4
jmp 0x10009c47
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0xb84], eax
push 0
lea ecx, [ebp - 0xb24]
call fcn.10016adb
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x320]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2e8]
imul eax, dword [ebp - 0x73c]
mov ecx, dword [ebp - 0x320]
cmp dword [ecx], eax
jle 0x10009cbd
mov dword [ebp - 0x91c], 1
jmp 0x10009cc4
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0xb8c], eax
push 0
lea ecx, [ebp - 0x974]
call fcn.10016adb
mov esi, eax
push 0
lea ecx, [ebp - 0x974]
call fcn.10016adb
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x10009cfe
mov dword [ebp - 0x924], 1
jmp 0x10009d05
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x73c], eax
jl 0x10009d2b
mov dword [ebp - 0x92c], 1
jmp 0x10009d32
and dword [ebp - 0x92c], 0
push 1
lea ecx, [ebp - 0x974]
call fcn.10016adb
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x93c], eax
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x10009d65
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb24]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x974]
call fcn.10016ad6
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1000a19c
mov dword [ebp - 0xec], 0xdb3ae355
mov dword [ebp - 0x29c], 0
jmp 0x10009dbc
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 3
jge 0x10009dd8
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0x984], 0x38ab659d
jmp 0x10009daf
mov dword [ebp - 0xec], 0
jmp 0x10009df1
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x16
je 0x1000a196
mov dword [ebp - 0x84], 6
mov dword [ebp - 0x340], 0xffffffff
mov dword [ebp - 0x84], 0
jmp 0x10009e2b
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xffffffe5
jge 0x1000a185
mov dword [ebp - 0x18], 0x2e8588d0
mov dword [ebp - 0x34], 0x1fbc9fa8
mov dword [ebp - 0x76c], 2
mov dword [ebp - 0x18], 2
jmp 0x10009e60
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1000a152
cmp dword [ebp - 0x18], 0xfaf07207
jb 0x10009e7f
mov dword [ebp - 0x744], 1
jmp 0x10009e86
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xb9c], eax
push 0xfffffffffffffffb
pop eax
cmp eax, 0x5e82
jle 0x10009ea5
mov dword [ebp - 0x3dc], 1
jmp 0x10009eac
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x3dc], eax
je 0x10009ec6
mov dword [ebp - 0x3e4], 1
jmp 0x10009ecd
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x744]
cmp eax, dword [ebp - 0x3e4]
jg 0x10009ee7
mov dword [ebp - 0x74c], 1
jmp 0x10009eee
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x984]
imul eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x18]
je 0x1000a01e
mov dword [ebp - 0x944], 0x77d6446b
mov dword [ebp - 0x34], 0x18
jmp 0x10009f28
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff2
jg 0x1000a01c
mov dword [ebp - 0x3fc], 0xe7504ed0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x984]
mov dword [ebp - 0xba4], eax
push 3
pop eax
test eax, eax
je 0x10009f6a
cmp dword [ebp - 0x944], 0
je 0x10009f6a
mov dword [ebp - 0x94c], 1
jmp 0x10009f71
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x984], 0
je 0x10009f9f
cmp dword [ebp - 0x3fc], 0
je 0x10009f9f
mov dword [ebp - 0x3ec], 1
jmp 0x10009fa6
and dword [ebp - 0x3ec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x984]
cmp dword [ebp - 0x3ec], eax
je 0x10009fc7
mov dword [ebp - 0x754], 1
jmp 0x10009fce
and dword [ebp - 0x754], 0
cmp dword [ebp - 0x754], 0
jg 0x10009fe3
mov dword [ebp - 0x3f4], 1
jmp 0x10009fea
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x3f4]
jle 0x1000a004
mov dword [ebp - 0x75c], 1
jmp 0x1000a00b
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x3fc], eax
jmp 0x10009f21
jmp 0x1000a052
mov dword [ebp - 0x34], 2
jmp 0x1000a02e
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1000a052
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x1000a050
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
jmp 0x1000a027
mov dword [ebp - 0x34], 0xfffffff5
jmp 0x1000a062
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xa
jge 0x1000a14d
mov dword [ebp - 0x954], 0xffff
cmp dword [ebp - 0xec], 0xfff9
jne 0x1000a08e
mov dword [ebp - 0x764], 1
jmp 0x1000a095
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x764]
jne 0x1000a0af
mov dword [ebp - 0x404], 1
jmp 0x1000a0b6
and dword [ebp - 0x404], 0
mov dword [ebp - 0x76c], 0xaecaa70
mov eax, dword [ebp - 0x954]
imul ecx, dword [ebp - 0x404], 0xfffb
sub eax, ecx
add eax, 0x461d0ee3
cmp dword [ebp - 0x76c], eax
jge 0x1000a0eb
mov dword [ebp - 0x40c], 1
jmp 0x1000a0f2
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x40c], eax
jne 0x1000a10c
mov dword [ebp - 0x774], 1
jmp 0x1000a113
and dword [ebp - 0x774], 0
cmp dword [ebp - 0x774], 0x4730
jne 0x1000a12b
mov dword [ebp - 0x414], 1
jmp 0x1000a132
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x984]
add eax, dword [ebp - 0x414]
mov dword [ebp - 0x340], eax
jmp 0x1000a05b
jmp 0x10009e59
mov dword [ebp - 0x18], 0x10
jmp 0x1000a162
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe7
jg 0x1000a180
cmp dword [ebp - 0x340], 0
je 0x1000a173
jmp 0x1000a180
cmp dword [ebp - 0x340], 0
je 0x1000a17e
jmp 0x1000a15b
jmp 0x1000a15b
jmp 0x10009e1e
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x84], eax
jmp 0x10009de4
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x100094a2
mov dword [ebp - 0x218], 0x8bbca631
mov dword [ebp - 0x218], 3
jmp 0x1000a1c4
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x14
jl 0x1000a201
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1000a1e7
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1000a1ff
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x1000a1b7
mov dword [ebp - 0x2a4], 0x8bbca631
mov dword [ebp - 0x2a4], 3
jmp 0x1000a224
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x14
jl 0x1000a261
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1000a247
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x1000a25f
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x1000a217
mov dword [ebp - 0xa94], 0xc285ce96
mov dword [ebp - 0xa90], 0xc285ce96
mov dword [ebp - 0xa8c], 0xc285ce96
mov dword [ebp - 0xa88], 0xc285ce96
lea ecx, [ebp - 0x341]
call fcn.10008943
push eax
lea eax, [ebp - 0xa84]
push eax
lea eax, [ebp - 0xa94]
push eax
lea ecx, [ebp - 0xd6c]
call fcn.10016aea
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2c4]
call fcn.10016ab0
mov dword [ebp - 4], 7
push 1
lea ecx, [ebp - 0x994]
call fcn.10016a6e
mov byte [ebp - 4], 8
mov dword [ebp - 0x2f0], 1
mov dword [ebp - 0xb0], 0xcb13638e
mov dword [ebp - 0x424], 0x3423637b
push 1
lea ecx, [ebp - 0xb30]
call fcn.10016a6e
mov byte [ebp - 4], 9
mov dword [ebp - 0x8b8], 0x137d3709
mov dword [ebp - 0x1c], 0
jmp 0x1000a31f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000a335
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc0c], 6
jmp 0x1000a318
mov dword [ebp - 0x1c], 0
jmp 0x1000a345
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000a35b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7c4], 0
jmp 0x1000a33e
mov dword [ebp - 0x1c], 0
jmp 0x1000a36b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000a384
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb30]
call fcn.10016adb
and dword [eax], 0
jmp 0x1000a364
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
je 0x1000a538
cmp dword [ebp - 0xb0], 0
je 0x1000a468
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp + eax - 0xc0c], ecx
xor eax, eax
sub eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0xb0]
jge 0x1000a3d9
mov dword [ebp - 0x77c], 1
jmp 0x1000a3e0
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x77c]
neg eax
sub eax, 0x7209c399
cmp eax, dword [ebp - 0x2f0]
jl 0x1000a40a
mov eax, 0x4df8e3bf
test eax, eax
je 0x1000a40a
mov dword [ebp - 0x41c], 1
jmp 0x1000a411
and dword [ebp - 0x41c], 0
imul eax, dword [ebp - 0x41c], 0x4cc5
test eax, eax
jne 0x1000a431
mov eax, 0xec1f
test eax, eax
jne 0x1000a431
and dword [ebp - 0x784], 0
jmp 0x1000a43b
mov dword [ebp - 0x784], 1
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x424]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x7c4]
je 0x1000a468
mov dword [ebp - 0x78c], 1
jmp 0x1000a46f
and dword [ebp - 0x78c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c4]
cmp dword [ebp - 0x78c], eax
je 0x1000a490
mov dword [ebp - 0x42c], 1
jmp 0x1000a497
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0xb0]
neg eax
cmp eax, dword [ebp - 0x42c]
jne 0x1000a4b3
mov dword [ebp - 0x794], 1
jmp 0x1000a4ba
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0xb0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c4]
cmp dword [ebp - 0xb0], eax
je 0x1000a4e7
mov dword [ebp - 0x328], 1
jmp 0x1000a4ee
and dword [ebp - 0x328], 0
push 0
lea ecx, [ebp - 0xb30]
call fcn.10016adb
mov ecx, dword [ebp - 0x328]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7c4]
cmp dword [ebp - 0x328], eax
je 0x1000a524
mov dword [ebp - 0x434], 1
jmp 0x1000a52b
and dword [ebp - 0x434], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7c4]
mov dword [ebp - 0x8b8], 0xe41b0ce7
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xb30]
call fcn.10016ad6
mov dword [ebp - 0x730], 1
mov dword [ebp - 0x70], 0
jmp 0x1000a56b
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1000a587
push dword [ebp - 0x70]
lea ecx, [ebp - 0x994]
call fcn.10016adb
mov dword [eax], 0x99333c7d
jmp 0x1000a564
mov dword [ebp - 0x70], 0
jmp 0x1000a597
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1000a5ad
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xcf0], 1
jmp 0x1000a590
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10016adb
mov esi, eax
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10016adb
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1000a5db
mov dword [ebp - 0x79c], 1
jmp 0x1000a5e2
and dword [ebp - 0x79c], 0
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10016adb
mov ecx, dword [ebp - 0x79c]
cmp ecx, dword [eax]
jge 0x1000a605
mov dword [ebp - 0x43c], 1
jmp 0x1000a60c
and dword [ebp - 0x43c], 0
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10016adb
mov eax, dword [eax]
cmp eax, dword [ebp - 0x43c]
jge 0x1000a62f
mov dword [ebp - 0x7a4], 1
jmp 0x1000a636
and dword [ebp - 0x7a4], 0
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10016adb
mov esi, eax
mov eax, dword [ebp - 0x7a4]
neg eax
or edi, 0xffffffff
sub edi, eax
push 3
lea ecx, [ebp - 0x2c4]
call fcn.10016adb
add edi, dword [eax]
cmp dword [esi], edi
je 0x1000a671
mov dword [ebp - 0x2f8], 1
jmp 0x1000a678
and dword [ebp - 0x2f8], 0
push 0
lea ecx, [ebp - 0x994]
call fcn.10016adb
mov ecx, dword [ebp - 0x2f8]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10016adb
mov ecx, dword [ebp - 0x2f8]
cmp ecx, dword [eax]
jle 0x1000a6b0
mov dword [ebp - 0x7ac], 1
jmp 0x1000a6b7
and dword [ebp - 0x7ac], 0
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10016adb
mov ecx, dword [ebp - 0x7ac]
cmp ecx, dword [eax]
jne 0x1000a6ec
push 0
lea ecx, [ebp - 0x994]
call fcn.10016adb
cmp dword [eax], 0
je 0x1000a6ec
mov dword [ebp - 0x448], 1
jmp 0x1000a6f3
and dword [ebp - 0x448], 0
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10016adb
mov ecx, dword [ebp - 0x448]
imul ecx, dword [eax]
mov dword [ebp - 0x730], ecx
mov esi, dword [ebp - 0x730]
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10016adb
cmp esi, dword [eax]
je 0x1000a732
mov dword [ebp - 0x8a0], 1
jmp 0x1000a739
and dword [ebp - 0x8a0], 0
or eax, 0xffffffff
je 0x1000a75c
push 0
lea ecx, [ebp - 0x994]
call fcn.10016adb
cmp dword [eax], 0
je 0x1000a75c
mov dword [ebp - 0x450], 1
jmp 0x1000a763
and dword [ebp - 0x450], 0
push 0
lea ecx, [ebp - 0x2c4]
call fcn.10016adb
mov ecx, dword [ebp - 0x450]
cmp ecx, dword [eax]
jle 0x1000a786
mov dword [ebp - 0x640], 1
jmp 0x1000a78d
and dword [ebp - 0x640], 0
push 3
lea ecx, [ebp - 0x2c4]
call fcn.10016adb
mov ecx, dword [ebp - 0x640]
imul ecx, dword [eax]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xcf0], ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x994]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c4]
call fcn.10016ad6
mov dword [ebp - 0xa80], 0xc285ce96
mov dword [ebp - 0xa7c], 0xc285ce96
mov dword [ebp - 0xa78], 0xc285ce96
mov dword [ebp - 0xa74], 0xc285ce96
lea ecx, [ebp - 0x339]
call fcn.10008943
push eax
lea eax, [ebp - 0xa70]
push eax
lea eax, [ebp - 0xa80]
push eax
lea ecx, [ebp - 0xd7c]
call fcn.10016aea
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2d0]
call fcn.10016ab0
mov dword [ebp - 4], 0xa
push 1
lea ecx, [ebp - 0x9a4]
call fcn.10016a6e
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x738], 1
mov dword [ebp - 0x8c], 0
jmp 0x1000a866
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1000a888
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x9a4]
call fcn.10016adb
mov dword [eax], 0x99333c7d
jmp 0x1000a859
mov dword [ebp - 0x8c], 0
jmp 0x1000a8a1
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1000a8bd
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xc18], 1
jmp 0x1000a894
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
mov esi, eax
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1000a8eb
mov dword [ebp - 0x458], 1
jmp 0x1000a8f2
and dword [ebp - 0x458], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
mov ecx, dword [ebp - 0x458]
cmp ecx, dword [eax]
jge 0x1000a915
mov dword [ebp - 0x81c], 1
jmp 0x1000a91c
and dword [ebp - 0x81c], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
mov eax, dword [eax]
cmp eax, dword [ebp - 0x81c]
jge 0x1000a93f
mov dword [ebp - 0x460], 1
jmp 0x1000a946
and dword [ebp - 0x460], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
mov esi, eax
mov eax, dword [ebp - 0x460]
neg eax
or edi, 0xffffffff
sub edi, eax
push 3
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
add edi, dword [eax]
cmp dword [esi], edi
je 0x1000a981
mov dword [ebp - 0x32c], 1
jmp 0x1000a988
and dword [ebp - 0x32c], 0
push 0
lea ecx, [ebp - 0x9a4]
call fcn.10016adb
mov ecx, dword [ebp - 0x32c]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
mov ecx, dword [ebp - 0x32c]
cmp ecx, dword [eax]
jle 0x1000a9c0
mov dword [ebp - 0x648], 1
jmp 0x1000a9c7
and dword [ebp - 0x648], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
mov ecx, dword [ebp - 0x648]
cmp ecx, dword [eax]
jne 0x1000a9fc
push 0
lea ecx, [ebp - 0x9a4]
call fcn.10016adb
cmp dword [eax], 0
je 0x1000a9fc
mov dword [ebp - 0x468], 1
jmp 0x1000aa03
and dword [ebp - 0x468], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
mov ecx, dword [ebp - 0x468]
imul ecx, dword [eax]
mov dword [ebp - 0x738], ecx
mov esi, dword [ebp - 0x738]
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
cmp esi, dword [eax]
je 0x1000aa42
mov dword [ebp - 0x85c], 1
jmp 0x1000aa49
and dword [ebp - 0x85c], 0
or eax, 0xffffffff
je 0x1000aa6c
push 0
lea ecx, [ebp - 0x9a4]
call fcn.10016adb
cmp dword [eax], 0
je 0x1000aa6c
mov dword [ebp - 0x470], 1
jmp 0x1000aa73
and dword [ebp - 0x470], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
mov ecx, dword [ebp - 0x470]
cmp ecx, dword [eax]
jle 0x1000aa96
mov dword [ebp - 0x650], 1
jmp 0x1000aa9d
and dword [ebp - 0x650], 0
push 3
lea ecx, [ebp - 0x2d0]
call fcn.10016adb
mov ecx, dword [ebp - 0x650]
imul ecx, dword [eax]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xc18], ecx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x9a4]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d0]
call fcn.10016ad6
push 1
lea ecx, [ebp - 0x1d8]
call fcn.10016a6e
mov dword [ebp - 4], 0xc
push 1
lea ecx, [ebp - 0xaf4]
call fcn.10016a6e
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x658], 0x635290ce
mov dword [ebp - 0x918], 0xffffffff
mov dword [ebp - 0xbb4], 0xfffffffb
mov dword [ebp - 0x7f4], 0xcd3624b6
mov dword [ebp - 0x20], 0
jmp 0x1000ab3b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1000ab51
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x830], 0x1b3c692b
jmp 0x1000ab34
mov dword [ebp - 0x20], 0
jmp 0x1000ab61
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1000ab7d
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
mov dword [eax], 0xb457102d
jmp 0x1000ab5a
mov dword [ebp - 0x20], 0
jmp 0x1000ab8d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1000aba6
push dword [ebp - 0x20]
lea ecx, [ebp - 0xaf4]
call fcn.10016adb
or dword [eax], 0xffffffff
jmp 0x1000ab86
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
and dword [eax], 0
jmp 0x1000abdc
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x478]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x478]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
cmp dword [eax], 2
jg 0x1000adf8
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x830], 0
je 0x1000ac10
jmp 0x1000adf8
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
mov esi, eax
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x830]
cmp dword [esi], eax
jle 0x1000ac45
mov dword [ebp - 0x488], 1
jmp 0x1000ac4c
and dword [ebp - 0x488], 0
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
mov esi, dword [eax]
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x830]
cmp dword [ebp + esi*4 - 0x830], eax
jle 0x1000ac86
mov dword [ebp - 0x7b0], 1
jmp 0x1000ac8d
and dword [ebp - 0x7b0], 0
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
mov ecx, dword [ebp - 0x7b0]
cmp ecx, dword [eax]
jl 0x1000acb0
mov dword [ebp - 0x300], 1
jmp 0x1000acb7
and dword [ebp - 0x300], 0
push 0
lea ecx, [ebp - 0xaf4]
call fcn.10016adb
mov ecx, dword [ebp - 0x300]
mov dword [eax], ecx
xor esi, esi
sub esi, dword [ebp - 0x300]
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
mov eax, dword [eax]
cmp esi, dword [ebp + eax*4 - 0x830]
jg 0x1000ad0e
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x830], 0
jne 0x1000ad0e
and dword [ebp - 0x480], 0
jmp 0x1000ad18
mov dword [ebp - 0x480], 1
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x658], eax
mov esi, dword [ebp - 0x658]
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
imul esi, dword [eax]
add esi, dword [ebp - 0x488]
cmp esi, 0x89ec
jl 0x1000ad54
mov dword [ebp - 0x740], 1
jmp 0x1000ad5b
and dword [ebp - 0x740], 0
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x830]
cmp dword [ebp - 0x740], eax
jg 0x1000ad85
mov dword [ebp - 0x490], 1
jmp 0x1000ad8c
and dword [ebp - 0x490], 0
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x830]
cmp dword [ebp - 0x490], eax
jge 0x1000adb6
mov dword [ebp - 0x660], 1
jmp 0x1000adbd
and dword [ebp - 0x660], 0
push 0
lea ecx, [ebp - 0x1d8]
call fcn.10016adb
mov ecx, dword [ebp - 0x660]
cmp ecx, dword [eax]
jle 0x1000ade0
mov dword [ebp - 0x498], 1
jmp 0x1000ade7
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x918], eax
jmp 0x1000abb8
mov eax, dword [ebp - 0x7f4]
inc eax
mov dword [ebp - 0x7f4], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xaf4]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d8]
call fcn.10016ad6
mov dword [ebp - 0xa6c], 0xc285ce96
mov dword [ebp - 0xa68], 0xc285ce96
mov dword [ebp - 0xa64], 0xc285ce96
mov dword [ebp - 0xa60], 0xc285ce96
lea ecx, [ebp - 0x321]
call fcn.10008943
push eax
lea eax, [ebp - 0xa5c]
push eax
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xd74]
call fcn.10016aea
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2b8]
call fcn.10016ab0
mov dword [ebp - 4], 0xe
push 1
lea ecx, [ebp - 0x9b4]
call fcn.10016a6e
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x670], 1
mov dword [ebp - 0x78], 0
jmp 0x1000aeb2
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1000aece
push dword [ebp - 0x78]
lea ecx, [ebp - 0x9b4]
call fcn.10016adb
mov dword [eax], 0x99333c7d
jmp 0x1000aeab
mov dword [ebp - 0x78], 0
jmp 0x1000aede
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x1000aef4
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xc24], 1
jmp 0x1000aed7
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016adb
mov esi, eax
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016adb
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1000af22
mov dword [ebp - 0x4a0], 1
jmp 0x1000af29
and dword [ebp - 0x4a0], 0
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016adb
mov ecx, dword [ebp - 0x4a0]
cmp ecx, dword [eax]
jge 0x1000af4c
mov dword [ebp - 0x668], 1
jmp 0x1000af53
and dword [ebp - 0x668], 0
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016adb
mov eax, dword [eax]
cmp eax, dword [ebp - 0x668]
jge 0x1000af76
mov dword [ebp - 0x4a8], 1
jmp 0x1000af7d
and dword [ebp - 0x4a8], 0
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016adb
mov esi, eax
mov eax, dword [ebp - 0x4a8]
neg eax
or edi, 0xffffffff
sub edi, eax
push 3
lea ecx, [ebp - 0x2b8]
call fcn.10016adb
add edi, dword [eax]
cmp dword [esi], edi
je 0x1000afb8
mov dword [ebp - 0x334], 1
jmp 0x1000afbf
and dword [ebp - 0x334], 0
push 0
lea ecx, [ebp - 0x9b4]
call fcn.10016adb
mov ecx, dword [ebp - 0x334]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016adb
mov ecx, dword [ebp - 0x334]
cmp ecx, dword [eax]
jle 0x1000aff7
mov dword [ebp - 0x748], 1
jmp 0x1000affe
and dword [ebp - 0x748], 0
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016adb
mov ecx, dword [ebp - 0x748]
cmp ecx, dword [eax]
jne 0x1000b033
push 0
lea ecx, [ebp - 0x9b4]
call fcn.10016adb
cmp dword [eax], 0
je 0x1000b033
mov dword [ebp - 0x4b0], 1
jmp 0x1000b03a
and dword [ebp - 0x4b0], 0
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016adb
mov ecx, dword [ebp - 0x4b0]
imul ecx, dword [eax]
mov dword [ebp - 0x670], ecx
mov esi, dword [ebp - 0x670]
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016adb
cmp esi, dword [eax]
je 0x1000b079
mov dword [ebp - 0x864], 1
jmp 0x1000b080
and dword [ebp - 0x864], 0
or eax, 0xffffffff
je 0x1000b0a3
push 0
lea ecx, [ebp - 0x9b4]
call fcn.10016adb
cmp dword [eax], 0
je 0x1000b0a3
mov dword [ebp - 0x4b8], 1
jmp 0x1000b0aa
and dword [ebp - 0x4b8], 0
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016adb
mov ecx, dword [ebp - 0x4b8]
cmp ecx, dword [eax]
jle 0x1000b0cd
mov dword [ebp - 0x7bc], 1
jmp 0x1000b0d4
and dword [ebp - 0x7bc], 0
push 3
lea ecx, [ebp - 0x2b8]
call fcn.10016adb
mov ecx, dword [ebp - 0x7bc]
imul ecx, dword [eax]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xc24], ecx
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x9b4]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b8]
call fcn.10016ad6
mov dword [ebp - 0x2ac], 4
mov dword [ebp - 0x2ac], 0xd
jmp 0x1000b138
mov eax, dword [ebp - 0x2ac]
dec eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0xffffffff
jg 0x1000b182
mov dword [ebp - 0xa04], 0xfffffffb
mov dword [ebp - 0x86c], 1
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1000b174
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0x86c], eax
jmp 0x1000b12b
push 1
lea ecx, [ebp - 0x1e8]
call fcn.10016a6e
mov dword [ebp - 4], 0x10
push 1
lea ecx, [ebp - 0xb0c]
call fcn.10016a6e
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x750], 0x635290ce
mov dword [ebp - 0x920], 0xffffffff
mov dword [ebp - 0xbbc], 0xfffffffb
mov dword [ebp - 0x688], 0xcd3624b6
mov dword [ebp - 0x28], 0
jmp 0x1000b1df
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000b1f5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x814], 0x1b3c692b
jmp 0x1000b1d8
mov dword [ebp - 0x28], 0
jmp 0x1000b205
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1000b221
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
mov dword [eax], 0xb457102d
jmp 0x1000b1fe
mov dword [ebp - 0x28], 0
jmp 0x1000b231
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1000b24a
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb0c]
call fcn.10016adb
or dword [eax], 0xffffffff
jmp 0x1000b22a
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
and dword [eax], 0
jmp 0x1000b280
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4c0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
cmp dword [eax], 2
jg 0x1000b49c
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x814], 0
je 0x1000b2b4
jmp 0x1000b49c
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
mov esi, eax
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x814]
cmp dword [esi], eax
jle 0x1000b2e9
mov dword [ebp - 0x4d0], 1
jmp 0x1000b2f0
and dword [ebp - 0x4d0], 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
mov esi, dword [eax]
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x814]
cmp dword [ebp + esi*4 - 0x814], eax
jle 0x1000b32a
mov dword [ebp - 0x678], 1
jmp 0x1000b331
and dword [ebp - 0x678], 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
mov ecx, dword [ebp - 0x678]
cmp ecx, dword [eax]
jl 0x1000b354
mov dword [ebp - 0x308], 1
jmp 0x1000b35b
and dword [ebp - 0x308], 0
push 0
lea ecx, [ebp - 0xb0c]
call fcn.10016adb
mov ecx, dword [ebp - 0x308]
mov dword [eax], ecx
xor esi, esi
sub esi, dword [ebp - 0x308]
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
mov eax, dword [eax]
cmp esi, dword [ebp + eax*4 - 0x814]
jg 0x1000b3b2
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x814], 0
jne 0x1000b3b2
and dword [ebp - 0x4c8], 0
jmp 0x1000b3bc
mov dword [ebp - 0x4c8], 1
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x750], eax
mov esi, dword [ebp - 0x750]
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
imul esi, dword [eax]
add esi, dword [ebp - 0x4d0]
cmp esi, 0x89ec
jl 0x1000b3f8
mov dword [ebp - 0x680], 1
jmp 0x1000b3ff
and dword [ebp - 0x680], 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x814]
cmp dword [ebp - 0x680], eax
jg 0x1000b429
mov dword [ebp - 0x4d8], 1
jmp 0x1000b430
and dword [ebp - 0x4d8], 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x814]
cmp dword [ebp - 0x4d8], eax
jge 0x1000b45a
mov dword [ebp - 0x7cc], 1
jmp 0x1000b461
and dword [ebp - 0x7cc], 0
push 0
lea ecx, [ebp - 0x1e8]
call fcn.10016adb
mov ecx, dword [ebp - 0x7cc]
cmp ecx, dword [eax]
jle 0x1000b484
mov dword [ebp - 0x4e0], 1
jmp 0x1000b48b
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x920], eax
jmp 0x1000b25c
mov eax, dword [ebp - 0x688]
inc eax
mov dword [ebp - 0x688], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xb0c]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e8]
call fcn.10016ad6
push 1
lea ecx, [ebp - 0x19c]
call fcn.10016a6e
mov dword [ebp - 4], 0x12
push 1
lea ecx, [ebp - 0xac4]
call fcn.10016a6e
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x690], 0x635290ce
mov dword [ebp - 0x874], 0xffffffff
mov dword [ebp - 0xbc4], 0xfffffffb
mov dword [ebp - 0x760], 0xcd3624b6
mov dword [ebp - 0x30], 0
jmp 0x1000b524
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1000b53a
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x638], 0x1b3c692b
jmp 0x1000b51d
mov dword [ebp - 0x30], 0
jmp 0x1000b54a
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1000b566
push dword [ebp - 0x30]
lea ecx, [ebp - 0x19c]
call fcn.10016adb
mov dword [eax], 0xb457102d
jmp 0x1000b543
mov dword [ebp - 0x30], 0
jmp 0x1000b576
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1000b58f
push dword [ebp - 0x30]
lea ecx, [ebp - 0xac4]
call fcn.10016adb
or dword [eax], 0xffffffff
jmp 0x1000b56f
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
and dword [eax], 0
jmp 0x1000b5c5
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x4e8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4e8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
cmp dword [eax], 2
jg 0x1000b7e1
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x638], 0
je 0x1000b5f9
jmp 0x1000b7e1
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
mov esi, eax
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x638]
cmp dword [esi], eax
jle 0x1000b62e
mov dword [ebp - 0x4f8], 1
jmp 0x1000b635
and dword [ebp - 0x4f8], 0
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
mov esi, dword [eax]
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x638]
cmp dword [ebp + esi*4 - 0x638], eax
jle 0x1000b66f
mov dword [ebp - 0x758], 1
jmp 0x1000b676
and dword [ebp - 0x758], 0
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
mov ecx, dword [ebp - 0x758]
cmp ecx, dword [eax]
jl 0x1000b699
mov dword [ebp - 0x350], 1
jmp 0x1000b6a0
and dword [ebp - 0x350], 0
push 0
lea ecx, [ebp - 0xac4]
call fcn.10016adb
mov ecx, dword [ebp - 0x350]
mov dword [eax], ecx
xor esi, esi
sub esi, dword [ebp - 0x350]
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
mov eax, dword [eax]
cmp esi, dword [ebp + eax*4 - 0x638]
jg 0x1000b6f7
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x638], 0
jne 0x1000b6f7
and dword [ebp - 0x4f0], 0
jmp 0x1000b701
mov dword [ebp - 0x4f0], 1
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x690], eax
mov esi, dword [ebp - 0x690]
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
imul esi, dword [eax]
add esi, dword [ebp - 0x4f8]
cmp esi, 0x89ec
jl 0x1000b73d
mov dword [ebp - 0x7c8], 1
jmp 0x1000b744
and dword [ebp - 0x7c8], 0
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x638]
cmp dword [ebp - 0x7c8], eax
jg 0x1000b76e
mov dword [ebp - 0x500], 1
jmp 0x1000b775
and dword [ebp - 0x500], 0
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x638]
cmp dword [ebp - 0x500], eax
jge 0x1000b79f
mov dword [ebp - 0x698], 1
jmp 0x1000b7a6
and dword [ebp - 0x698], 0
push 0
lea ecx, [ebp - 0x19c]
call fcn.10016adb
mov ecx, dword [ebp - 0x698]
cmp ecx, dword [eax]
jle 0x1000b7c9
mov dword [ebp - 0x508], 1
jmp 0x1000b7d0
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x874], eax
jmp 0x1000b5a1
mov eax, dword [ebp - 0x760]
inc eax
mov dword [ebp - 0x760], eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xac4]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c]
call fcn.10016ad6
mov dword [ebp - 0xa8], 0xbac64a68
mov dword [ebp - 0xf4], 5
mov dword [ebp - 0x518], 0xfffffffe
mov dword [ebp - 0x988], 0xdef906d8
mov dword [ebp - 0xa8], 0x15
jmp 0x1000b84d
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xffffffeb
jg 0x1000b86f
mov dword [ebp - 0x510], 0xfffffff9
mov eax, dword [ebp - 0x510]
dec eax
mov dword [ebp - 0x510], eax
jmp 0x1000b840
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], eax
je 0x1000b889
mov dword [ebp - 0x6a0], 1
jmp 0x1000b890
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
neg eax
cmp eax, dword [ebp - 0xf4]
je 0x1000b8b8
mov dword [ebp - 0x7d0], 1
jmp 0x1000b8bf
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x518]
cmp dword [ebp - 0x7d0], eax
jne 0x1000b8e5
mov dword [ebp - 0x520], 1
jmp 0x1000b8ec
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
dec eax
sub eax, dword [ebp - 0xf4]
jne 0x1000b90d
cmp dword [ebp - 0xf4], 0
jne 0x1000b90d
and dword [ebp - 0x6a8], 0
jmp 0x1000b917
mov dword [ebp - 0x6a8], 1
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x6a8], eax
jne 0x1000b931
mov dword [ebp - 0x528], 1
jmp 0x1000b938
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x528], eax
jge 0x1000b952
mov dword [ebp - 0x768], 1
jmp 0x1000b959
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x768], eax
jge 0x1000b973
mov dword [ebp - 0x530], 1
jmp 0x1000b97a
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
neg eax
mov dword [ebp - 0x988], eax
mov dword [ebp - 0x224], 4
mov dword [ebp - 0x224], 0xd
jmp 0x1000b9ab
mov eax, dword [ebp - 0x224]
dec eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xffffffff
jg 0x1000b9f5
mov dword [ebp - 0x87c], 0xfffffffb
mov dword [ebp - 0x928], 1
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x1000b9e7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x928], eax
jmp 0x1000b99e
mov dword [ebp - 0x274], 4
mov dword [ebp - 0x274], 0xd
jmp 0x1000ba18
mov eax, dword [ebp - 0x274]
dec eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jg 0x1000ba62
mov dword [ebp - 0x884], 0xfffffffb
mov dword [ebp - 0x9d8], 1
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp - 0xb8]
test eax, eax
je 0x1000ba54
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x9d8], eax
jmp 0x1000ba0b
mov dword [ebp - 0x9c], 0xbac64a68
mov dword [ebp - 0xfc], 5
mov dword [ebp - 0x7d8], 0xfffffffe
mov dword [ebp - 0x88c], 0xdef906d8
mov dword [ebp - 0x9c], 0x15
jmp 0x1000baa3
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xffffffeb
jg 0x1000bac5
mov dword [ebp - 0x6b0], 0xfffffff9
mov eax, dword [ebp - 0x6b0]
dec eax
mov dword [ebp - 0x6b0], eax
jmp 0x1000ba96
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], eax
je 0x1000badf
mov dword [ebp - 0x538], 1
jmp 0x1000bae6
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
neg eax
cmp eax, dword [ebp - 0xfc]
je 0x1000bb0e
mov dword [ebp - 0x540], 1
jmp 0x1000bb15
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x7d8]
cmp dword [ebp - 0x540], eax
jne 0x1000bb3b
mov dword [ebp - 0x6b8], 1
jmp 0x1000bb42
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x6b8]
dec eax
sub eax, dword [ebp - 0xfc]
jne 0x1000bb63
cmp dword [ebp - 0xfc], 0
jne 0x1000bb63
and dword [ebp - 0x548], 0
jmp 0x1000bb6d
mov dword [ebp - 0x548], 1
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x548], eax
jne 0x1000bb87
mov dword [ebp - 0x770], 1
jmp 0x1000bb8e
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x770], eax
jge 0x1000bba8