Function at 0x10009e16
Capabilities:
Check os version
Create directory
Delete directory
Delete registry value
Enumerate gui resources
Get common file path
Get disk information
Get system information on windows
Get thread local storage value
Modify service
Parse pe header
Query or enumerate registry key
Resume thread
Terminate process

Disassembly:
mov eax, 0x10082989
call fcn.10081e20
mov eax, 0x1734
call fcn.1007e240
push ebx
xor ebx, ebx
mov byte [ebp - 0x79], dl
inc ebx
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0x18], ebx
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffa
push esi
mov dword [ebp - 0x58], 0xfffffffd
push edi
mov dword [ebp - 0x20], eax
jmp 0x10009e5e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x824], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10009e51
inc dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 8
pop eax
push 2
mov dword [ebp - 0x18], 0x1a
pop esi
jmp 0x1000a088
movdqa xmm0, xmmword [0x10008240]
lea eax, [ebp - 0x1214]
push eax
lea eax, [ebp - 0x1224]
push eax
lea ecx, [ebp - 0x1518]
movdqu xmmword [ebp - 0x1224], xmm0
call fcn.10009583
lea ecx, [ebp - 0x23c]
mov esi, eax
call fcn.10009580
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x500]
push dword [esi]
call fcn.10009546
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], 0x1ac7eb23
mov dword [ebp - 0x54], 0x86f80366
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
jmp 0x10009ef1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd68], 0x72ba29f5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10009ee0
push 2
pop esi
push esi
lea ecx, [ebp - 0x500]
call fcn.10009571
and dword [eax], 0
jmp 0x1000a05c
push esi
lea ecx, [ebp - 0xabc]
call fcn.10009504
mov byte [ebp - 4], bl
mov dword [ebp - 0x28], 0xe33a79cc
mov dword [ebp - 0x30], ebx
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x20], eax
or eax, 0xffffffff
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x50], 0xd35da2a0
mov dword [ebp - 0x30], 0xe81de982
mov dword [ebp - 0x3c], 0x1b07fb07
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10009f72
or ebx, 0xffffffff
push dword [ebp - 0x20]
lea ecx, [ebp - 0xabc]
call fcn.10009571
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10009f55
xor ebx, ebx
inc ebx
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10009fcd
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x500]
push ebx
call fcn.10009571
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xabc]
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x824], eax
mov eax, dword [ebp - 0xd60]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.10009571
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x500]
mov eax, dword [ebp - 0xd60]
push esi
call fcn.10009571
mov eax, dword [ebp - 0xd60]
lea ecx, [ebp - 0xabc]
xor eax, eax
push eax
call fcn.10009571
mov dword [ebp - 0xd5c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], 0xfffffffa
cmp dword [ebp - 0x28], 7
jge 0x1000a03e
xor ebx, ebx
mov dword [ebp - 0x10], 0xfeddd8d7
mov dword [ebp - 0x50], 0x14
jmp 0x1000a029
mov dword [ebp - 0x20], 0x10
jmp 0x1000a020
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x1000a01d
push ebx
call edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1d
jge 0x1000a012
dec dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xfffffffa
je 0x1000a009
dec dword [ebp - 0x10]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 7
jl 0x10009ff9
xor ebx, ebx
inc ebx
xor eax, eax
lea ecx, [ebp - 0xabc]
mov byte [ebp - 4], al
call fcn.1000956c
push esi
lea ecx, [ebp - 0x500]
call fcn.10009571
inc dword [eax]
push esi
lea ecx, [ebp - 0x500]
call fcn.10009571
cmp dword [eax], 0xc
jne 0x10009f0e
or eax, 0xffffffff
lea ecx, [ebp - 0x500]
mov dword [ebp - 4], eax
call fcn.1000956c
dec dword [ebp - 0x18]
push 8
pop eax
cmp dword [ebp - 0x18], eax
jg 0x10009e7e
mov dword [ebp - 0x18], 0xa631
push 5
pop eax
mov dword [ebp - 0x57c], eax
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x574], eax
mov dword [ebp - 0x570], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000a0d5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3b0], 0x5cc7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a0bd
xor eax, eax
inc dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x1000a1a4
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x10], eax
jne 0x1000a10a
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x578]
cmp eax, 0x77a1
jg 0x1000a10a
xor eax, eax
mov ecx, eax
jmp 0x1000a10c
mov ecx, ebx
mov eax, dword [ebp - 0x10]
imul eax, ecx
xor ecx, ecx
sub eax, dword [ebp - 0x574]
mov edx, dword [ebp - 0x578]
cmp eax, 0x6085e071
mov eax, dword [ebp - 0x10]
setg cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x2301
mov ecx, dword [ebp - 0x578]
setg al
sub ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp + eax*4 - 0x57c], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x57c], 0xe071a051
xor eax, eax
mov dword [ebp - 0x30], 0x894ff545
mov dword [ebp - 0x20], eax
jmp 0x1000a188
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x16a8], 0x3813bf58
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1000a177
inc dword [ebp - 0x3b0]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
push 0
pop eax
jle 0x1000a0e5
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0x949f4ffc
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x58], 0x552ded14
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1000a1d4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000a1c0
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000a1ea
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa20], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000a1d9
mov eax, dword [ebp - 0x1a4]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x1a0]
cmp eax, 0x2152
jg 0x1000a221
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000a223
jmp 0x1000a225
xor eax, eax
mov ebx, eax
mov eax, dword [ebp - 0x1a4]
xor ecx, ecx
cmp ebx, 0xfffffffe
setne cl
xor ebx, ebx
cmp eax, ecx
mov eax, dword [ebp - 0x1a4]
setle bl
add eax, 0xb99
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x1a0]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0xa1c], ecx
mov ecx, dword [ebp - 0xa20]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setg dl
xor ecx, ecx
mov dword [ebp - 0xa20], edx
mov eax, dword [ebp - 0x1a4]
add eax, 0x81d6e6e
cmp eax, edx
setg cl
cmp ecx, 0x8fe4de5a
sbb eax, eax
xor ecx, ecx
neg eax
test eax, eax
mov eax, dword [ebp - 0x1a4]
setg cl
imul eax, ecx
mov dword [ebp - 0x58], eax
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x1000a2b1
mov eax, dword [ebp - 0xa1c]
mov eax, dword [ebp - 0x28]
add eax, 0x5f0e77da
je 0x1000a2c9
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1000a2cb
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x1000a2d0
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
xor eax, eax
cmp ecx, 0xd69b
mov ecx, dword [ebp - 0x28]
setne al
sub ecx, eax
neg ecx
push 0xfffffffffffffffd
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x28], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x7689351f
pop edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], edx
push 3
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1000a32d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1684], 0x7a73d2d6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000a315
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1000a349
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf94], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000a335
xor eax, eax
inc dword [ebp - 0xf8c]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000a372
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3c4], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000a35a
xor eax, eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0xfffffff9
jle 0x1000a3b6
xor ebx, ebx
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x1000a3a2
push 0x1807
push 0x1009
push ebx
push 0x680
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
dec dword [ebp - 0x3c4]
cmp dword [ebp - 0x3c4], 0xfffffff9
jg 0x1000a383
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000a3c8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x788], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a3bb
inc dword [ebp - 0x18]
mov dword [ebp - 0x18], 0x1a
jmp 0x1000a5e7
movdqa xmm0, xmmword [0x10008240]
lea eax, [ebp - 0x1114]
push eax
lea eax, [ebp - 0x1124]
push eax
lea ecx, [ebp - 0x15c0]
movdqu xmmword [ebp - 0x1124], xmm0
call fcn.10009583
lea ecx, [ebp - 0x20e]
mov esi, eax
call fcn.10009580
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x560]
push dword [esi]
call fcn.10009546
mov dword [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x48], 0x1ac7eb23
mov dword [ebp - 0x54], 0x86f80366
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
jmp 0x1000a453
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd48], 0x72ba29f5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000a442
push 2
pop esi
push esi
lea ecx, [ebp - 0x560]
call fcn.10009571
and dword [eax], 0
jmp 0x1000a5be
push esi
lea ecx, [ebp - 0xa14]
call fcn.10009504
mov byte [ebp - 4], 4
mov dword [ebp - 0x28], 0xe33a79cc
mov dword [ebp - 0x30], ebx
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x20], eax
or eax, 0xffffffff
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x50], 0xd35da2a0
mov dword [ebp - 0x30], 0xe81de982
mov dword [ebp - 0x3c], 0x1b07fb07
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000a4d5
or ebx, 0xffffffff
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa14]
call fcn.10009571
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000a4b8
xor ebx, ebx
inc ebx
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1000a530
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x560]
push ebx
call fcn.10009571
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xa14]
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x788], eax
mov eax, dword [ebp - 0xd40]
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.10009571
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x560]
mov eax, dword [ebp - 0xd40]
push esi
call fcn.10009571
mov eax, dword [ebp - 0xd40]
lea ecx, [ebp - 0xa14]
xor eax, eax
push eax
call fcn.10009571
mov dword [ebp - 0xd3c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], 0xfffffffa
cmp dword [ebp - 0x28], 7
jge 0x1000a5a1
xor ebx, ebx
mov dword [ebp - 0x10], 0xfeddd8d7
mov dword [ebp - 0x50], 0x14
jmp 0x1000a58c
mov dword [ebp - 0x20], 0x10
jmp 0x1000a583
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x1000a580
push ebx
call edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1d
jge 0x1000a575
dec dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xfffffffa
je 0x1000a56c
dec dword [ebp - 0x10]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 7
jl 0x1000a55c
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xa14]
mov byte [ebp - 4], 3
call fcn.1000956c
push esi
lea ecx, [ebp - 0x560]
call fcn.10009571
inc dword [eax]
push esi
lea ecx, [ebp - 0x560]
call fcn.10009571
cmp dword [eax], 0xc
jne 0x1000a470
or eax, 0xffffffff
lea ecx, [ebp - 0x560]
mov dword [ebp - 4], eax
call fcn.1000956c
dec dword [ebp - 0x18]
push 8
pop eax
cmp dword [ebp - 0x18], eax
jg 0x1000a3dc
mov dword [ebp - 0x30], 0xfe387fb0
xor eax, eax
mov dword [ebp - 0x58], 0xaa39ed0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000a61f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf7c], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a60b
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000a63c
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor eax, eax
inc dword [ebp - 0x58]
mov dword [ebp - 0x30], 0x68cd546
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xc328129e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000a670
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb0], 0xf1124f01
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a658
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000a693
push 0x12c7
push eax
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
mov dword [ebp - 0xb0], eax
mov ecx, 0x663c10b4
cmp dword [ebp - 0xb0], 0xb
jl 0x1000a70b
xor ebx, ebx
mov dword [ebp - 0x30], 0x32fd2d1a
mov dword [ebp - 0x30], 0xc5a74d4b
mov dword [ebp - 0xe8c], ecx
mov dword [ebp - 0xe88], ecx
mov dword [ebp - 0xe84], ecx
mov dword [ebp - 0xe80], ecx
mov eax, dword [ebp - 0xb0]
neg eax
je 0x1000a6df
mov eax, dword [ebp - 0xb0]
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x1000a6f7
push 0x1d1e
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov ecx, 0x663c10b4
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], 0xb
jge 0x1000a6a9
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x24], ebx
or ecx, 0xffffffff
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x2c], ecx
mov ecx, 0x647c2c9e
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 8
jge 0x1000a79b
mov dword [ebp - 0x38], 0x1d8b
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1000a761
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb44], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1000a748
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1000a769
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xb40]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setle dl
xor eax, eax
test edx, edx
jg 0x1000a789
cmp dword [ebp - 0xb44], eax
je 0x1000a789
mov eax, ebx
inc eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x2c]
push 8
pop eax
cmp dword [ebp - 0x2c], eax
push 0
pop eax
jl 0x1000a735
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000a7b3
push ebx
push 0x84b
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor eax, eax
mov dword [ebp - 0x54], 0xfffffffd
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
mov ecx, 0x647c2c9e
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 8
jge 0x1000a840
mov dword [ebp - 0x38], 0x1d8b
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1000a806
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb6c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1000a7ed
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1000a80e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xb68]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setle dl
xor eax, eax
test edx, edx
jg 0x1000a82e
cmp dword [ebp - 0xb6c], eax
je 0x1000a82e
mov eax, ebx
inc eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x2c]
push 8
pop eax
cmp dword [ebp - 0x2c], eax
push 0
pop eax
jl 0x1000a7da
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000a858
push ebx
push 0x84b
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1000a87d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x324], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000a869
xor eax, eax
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], eax
jl 0x1000a8ea
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x324], 0
je 0x1000a8c6
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x324]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x324]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x324]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x320]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push 0
mov eax, dword [ebp + eax*4 - 0x324]
mov eax, dword [ebp - 0x31c]
mov eax, dword [ebp - 0x324]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x18]
pop eax
jns 0x1000a889
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1000a90a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x324], 0x65ab4d25
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000a8f2
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000a91c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x798], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a90f
inc dword [ebp - 0x24]
push 8
mov dword [ebp - 0x24], 0x1a
pop eax
cmp dword [ebp - 0x24], eax
jle 0x1000ae69
movdqa xmm0, xmmword [0x10008240]
lea eax, [ebp - 0x1314]
push eax
lea eax, [ebp - 0x1324]
push eax
lea ecx, [ebp - 0x1530]
movdqu xmmword [ebp - 0x1324], xmm0
call fcn.10009583
lea ecx, [ebp - 0x219]
mov esi, eax
call fcn.10009580
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x518]
push dword [esi]
call fcn.10009546
push 5
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], 0x1ac7eb23
mov dword [ebp - 0x18], 0xa631
mov dword [ebp - 0x5cc], eax
mov dword [ebp - 0x5c8], eax
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5c0], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000a9cc
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x494], 0x5cc7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a9b4
xor eax, eax
inc dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x1000aa9b
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x10], eax
jne 0x1000aa01
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x5c8]
cmp eax, 0x77a1
jg 0x1000aa01
xor eax, eax
mov ecx, eax
jmp 0x1000aa03
mov ecx, ebx
mov eax, dword [ebp - 0x10]
imul eax, ecx
xor ecx, ecx
sub eax, dword [ebp - 0x5c4]
mov edx, dword [ebp - 0x5c8]
cmp eax, 0x6085e071
mov eax, dword [ebp - 0x10]
setg cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x2301
mov ecx, dword [ebp - 0x5c8]
setg al
sub ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp + eax*4 - 0x5cc], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5cc], 0xe071a051
xor eax, eax
mov dword [ebp - 0x30], 0x894ff545
mov dword [ebp - 0x20], eax
jmp 0x1000aa7f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x169c], 0x3813bf58
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1000aa6e
inc dword [ebp - 0x494]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
push 0
pop eax
jle 0x1000a9dc
mov dword [ebp - 0x10], 0x86f80366
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0x949f4ffc
push 2
pop esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x58], 0x552ded14
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1000aad5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1ac], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000aac1
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000aaeb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8f4], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000aada
mov eax, dword [ebp - 0x1ac]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x1a8]
cmp eax, 0x2152
jg 0x1000ab22
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000ab24
jmp 0x1000ab26
xor eax, eax
mov ebx, eax
mov eax, dword [ebp - 0x1ac]
xor ecx, ecx
cmp ebx, 0xfffffffe
setne cl
xor ebx, ebx
cmp eax, ecx
mov eax, dword [ebp - 0x1ac]
setle bl
add eax, 0xb99
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x1a8]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x8f0], ecx
mov ecx, dword [ebp - 0x8f4]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setg dl
xor ecx, ecx
mov dword [ebp - 0x8f4], edx
mov eax, dword [ebp - 0x1ac]
add eax, 0x81d6e6e
cmp eax, edx
setg cl
cmp ecx, 0x8fe4de5a
sbb eax, eax
xor ecx, ecx
neg eax
test eax, eax
mov eax, dword [ebp - 0x1ac]
setg cl
imul eax, ecx
mov dword [ebp - 0x58], eax
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x1000abb2
mov eax, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0x28]
add eax, 0x5f0e77da
je 0x1000abca
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1000abcc
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x1000abd1
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
xor eax, eax
cmp ecx, 0xd69b
mov ecx, dword [ebp - 0x28]
setne al
sub ecx, eax
neg ecx
push 3
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x28], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x7689351f
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1000ac28
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x16b4], 0x7a73d2d6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000ac10
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1000ac44
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe28], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000ac30
xor eax, eax
inc dword [ebp - 0xe20]
mov dword [ebp - 0x20], eax
jmp 0x1000ac60
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd88], 0x72ba29f5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000ac4f
push esi
lea ecx, [ebp - 0x518]
call fcn.10009571
and dword [eax], 0
jmp 0x1000ae2e
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000ac9c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x480], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000ac84
xor eax, eax
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0xfffffff9
jle 0x1000acde
xor ebx, ebx
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x1000accc
push 0x1807
push 0x1009
push ebx
push 0x680
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
dec dword [ebp - 0x480]
cmp dword [ebp - 0x480], 0xfffffff9
jg 0x1000acad
xor ebx, ebx
inc ebx
push esi
lea ecx, [ebp - 0xa2c]
call fcn.10009504
mov byte [ebp - 4], 7
mov dword [ebp - 0x28], 0xe33a79cc
mov dword [ebp - 0x30], ebx
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x20], eax
or eax, 0xffffffff
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x50], 0xd35da2a0
mov dword [ebp - 0x30], 0xe81de982
mov dword [ebp - 0x3c], 0x1b07fb07
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000ad43
or ebx, 0xffffffff
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa2c]
call fcn.10009571
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000ad26
xor ebx, ebx
inc ebx
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1000ad9e
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x518]
push ebx
call fcn.10009571
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xa2c]
add eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0xd80]
mov eax, dword [ebp - 0x40]
xor eax, eax
push eax
call fcn.10009571
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x518]
mov eax, dword [ebp - 0xd80]
push esi
call fcn.10009571
mov eax, dword [ebp - 0xd80]
lea ecx, [ebp - 0xa2c]
xor eax, eax
push eax
call fcn.10009571
mov dword [ebp - 0xd7c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], 0xfffffffa
cmp dword [ebp - 0x28], 7
jge 0x1000ae0f
xor ebx, ebx
mov dword [ebp - 0x58], 0xfeddd8d7
mov dword [ebp - 0x50], 0x14
jmp 0x1000adfa
mov dword [ebp - 0x20], 0x10
jmp 0x1000adf1
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x1000adee
push ebx
call edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1d
jge 0x1000ade3
dec dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xfffffffa
je 0x1000adda
dec dword [ebp - 0x58]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 7
jl 0x1000adca
xor ebx, ebx
inc ebx
push 5
pop eax
lea ecx, [ebp - 0xa2c]
mov byte [ebp - 4], al
call fcn.1000956c
push esi
lea ecx, [ebp - 0x518]
call fcn.10009571
inc dword [eax]
push esi
lea ecx, [ebp - 0x518]
call fcn.10009571
cmp dword [eax], 0xc
jne 0x1000ac7a
or eax, 0xffffffff
lea ecx, [ebp - 0x518]
mov dword [ebp - 4], eax
call fcn.1000956c
dec dword [ebp - 0x24]
push 8
pop eax
cmp dword [ebp - 0x24], eax
jg 0x1000a937
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000ae96
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1510], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000ae7d
xor eax, eax
mov edi, 0x1d1fc
cmp dword [ebp - 0x1c], eax
jne 0x1000aea5
cmp dword [ebp - 0x1c], edi
jle 0x1000aea7
mov eax, ebx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1510], edx
mov ecx, dword [ebp - 0x1c]
imul ecx, eax
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setl al
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xe
je 0x1000af07
xor ebx, ebx
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x1000aef9
push ebx
push 0x169c
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xe
jne 0x1000aee5
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x30], 0xfe387fb0
mov dword [ebp - 0x58], 0xaa39ed0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000af31
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe18], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000af1d
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000af4e
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor eax, eax
inc dword [ebp - 0x58]
mov dword [ebp - 0x30], 0x68cd546
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xc328129e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000af82
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb8], 0xf1124f01
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000af6a
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000af9f
push 0x12c7
push eax
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xb
jl 0x1000b012
xor ebx, ebx
mov esi, 0x663c10b4
mov dword [ebp - 0x30], 0x32fd2d1a
mov dword [ebp - 0x30], 0xc5a74d4b
mov dword [ebp - 0xebc], esi
mov dword [ebp - 0xeb8], esi
mov dword [ebp - 0xeb4], esi
mov dword [ebp - 0xeb0], esi
mov eax, dword [ebp - 0xb8]
neg eax
je 0x1000afeb
mov eax, dword [ebp - 0xb8]
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x1000affe
push 0x1d1e
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
inc dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], 0xb
jge 0x1000afb5
xor ebx, ebx
inc ebx
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
mov ecx, 0x647c2c9e
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 8
push 2
pop esi
jge 0x1000b099
mov dword [ebp - 0x38], 0x1d8b
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000b05f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xaf4], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b047
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1000b067
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xaf0]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setle dl
xor eax, eax
test edx, edx
jg 0x1000b087
cmp dword [ebp - 0xaf4], eax
je 0x1000b087
mov eax, ebx
inc eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x2c]
push 8
pop eax
cmp dword [ebp - 0x2c], eax
push 0
pop eax
jl 0x1000b035
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000b0b1
push ebx
push 0x84b
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor eax, eax
mov dword [ebp - 0x2c], ebx
or ecx, 0xffffffff
mov dword [ebp - 0x18], ecx
mov ecx, 0x647c2c9e
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 8
jge 0x1000b138
mov dword [ebp - 0x38], 0x1d8b
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000b0fe
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb04], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b0e6
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1000b106
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0xb00]
cmp eax, ecx
setle dl
xor eax, eax
test edx, edx
jg 0x1000b126
cmp dword [ebp - 0xb04], eax
je 0x1000b126
mov eax, ebx
inc eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x18]
push 8
pop eax
cmp dword [ebp - 0x18], eax
push 0
pop eax
jl 0x1000b0d4
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000b150
push ebx
push 0x84b
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor eax, eax
mov dword [ebp - 0x64], 0xfffffffa
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1000b17c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2dc], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000b168
xor eax, eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x1000b1e5
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x2dc], 0
je 0x1000b1c1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2dc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2dc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2dc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push 0
mov eax, dword [ebp + eax*4 - 0x2dc]
mov eax, dword [ebp - 0x2d4]
mov eax, dword [ebp - 0x2dc]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x18]
pop eax
jns 0x1000b184
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1000b205
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2dc], 0x65ab4d25
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000b1ed
xor eax, eax
mov dword [ebp - 0x68], 0xfffffffd
mov dword [ebp - 0x18], 0xa631
push 5
pop edx
mov dword [ebp - 0x66c], edx
mov dword [ebp - 0x668], edx
mov dword [ebp - 0x664], edx
mov dword [ebp - 0x660], edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000b24e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x390], 0x5cc7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000b236
xor eax, eax
inc dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jg 0x1000b31d
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x10], eax
jne 0x1000b282
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x668]
cmp eax, 0x77a1
jg 0x1000b282
xor eax, eax
mov ecx, eax
jmp 0x1000b284
mov ecx, ebx
mov eax, dword [ebp - 0x10]
imul eax, ecx
xor ecx, ecx
push 3
sub eax, dword [ebp - 0x664]
mov edx, dword [ebp - 0x668]
cmp eax, 0x6085e071
mov eax, dword [ebp - 0x10]
setg cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x2301
mov ecx, dword [ebp - 0x668]
setg al
sub ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp + eax*4 - 0x66c], ecx
mov eax, dword [ebp - 0x18]
pop ecx
mov dword [ebp + eax*4 - 0x66c], 0xe071a051
xor eax, eax
mov dword [ebp - 0x30], 0x894ff545
mov dword [ebp - 0x20], eax
jmp 0x1000b303
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x16e4], 0x3813bf58
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000b2f2
inc dword [ebp - 0x390]
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], ecx
jle 0x1000b25d
mov dword [ebp - 0x28], 0x949f4ffc
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x58], 0x552ded14
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1000b34a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x19c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000b336
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000b360
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x90c], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000b34f
mov eax, dword [ebp - 0x19c]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x198]
cmp eax, 0x2152
jg 0x1000b396
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000b398
jmp 0x1000b39a
xor eax, eax
mov ebx, eax
mov eax, dword [ebp - 0x19c]
xor ecx, ecx
cmp ebx, 0xfffffffe
setne cl
xor ebx, ebx
cmp eax, ecx
mov eax, dword [ebp - 0x19c]
setle bl
add eax, 0xb99
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x198]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x908], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x90c]
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x90c], edx
mov eax, dword [ebp - 0x19c]
add eax, 0x81d6e6e
cmp eax, edx
setg cl
cmp ecx, 0x8fe4de5a
sbb eax, eax
xor ecx, ecx
neg eax
test eax, eax
mov eax, dword [ebp - 0x19c]
setg cl
imul eax, ecx
mov dword [ebp - 0x58], eax
xor eax, eax
cmp dword [ebp - 0x58], eax
jne 0x1000b426
mov eax, dword [ebp - 0x908]
mov eax, dword [ebp - 0x28]
add eax, 0x5f0e77da
je 0x1000b43e
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1000b440
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x1000b445
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
xor eax, eax
cmp ecx, 0xd69b
mov ecx, dword [ebp - 0x28]
setne al
sub ecx, eax
neg ecx
push 3
sbb ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x28], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x7689351f
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x1c], eax
pop ecx
cmp dword [ebp - 0x1c], ecx
jge 0x1000b49c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1690], 0x7a73d2d6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000b484
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1000b4b8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xfac], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000b4a4
xor eax, eax
inc dword [ebp - 0xfa4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000b4da
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x81c], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000b4c6
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000b4fa
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3d8], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b4e2
xor eax, eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0xfffffff9
jle 0x1000b53e
xor ebx, ebx
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x1000b52a
push 0x1807
push 0x1009
push ebx
push 0x680
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
dec dword [ebp - 0x3d8]
cmp dword [ebp - 0x3d8], 0xfffffff9
jg 0x1000b50b
xor ebx, ebx
inc ebx
xor eax, eax
inc dword [ebp - 0x2c]
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
mov ecx, 0x647c2c9e
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 8
jge 0x1000b5c5
mov dword [ebp - 0x38], 0x1d8b
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000b58b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb14], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b573
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1000b593
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0xb10]
cmp eax, ecx
setle dl
xor eax, eax
test edx, edx
jg 0x1000b5b3
cmp dword [ebp - 0xb14], eax
je 0x1000b5b3
mov eax, ebx
inc eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x2c]
push 8
pop eax
cmp dword [ebp - 0x2c], eax
push 0
pop eax
jl 0x1000b561
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000b5db
push ebx
push 0x84b
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 8
mov dword [ebp - 0x2c], 0x1a
pop eax
cmp dword [ebp - 0x2c], eax
jle 0x1000dd74
or esi, 0xffffffff
push ebx
lea ecx, [ebp - 0x428]
call fcn.10009504
push 9
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x76fb
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000b632
push dword [ebp - 0x20]
lea ecx, [ebp - 0x428]
call fcn.10009571
mov dword [eax], 0xf6af1124
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000b614
xor eax, eax
push eax
lea ecx, [ebp - 0x428]
call fcn.10009571
lea ecx, [ebp - 0x428]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10009571
cmp dword [eax], 0xa
jl 0x1000b773
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff7
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1000b672
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor eax, eax
mov dword [ebp - 0x18], 0xb
cmp dword [ebp - 0x18], 0xfffffff7
jle 0x1000b747
jmp 0x1000b687
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000b6ad
push 0x1807
push 0x1009
push eax
push 0x680
push eax
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x428]
mov eax, dword [ebp - 0x18]
xor eax, eax
push eax
call fcn.10009571
xor eax, eax
cmp dword [ebp - 0x20], 0x159e1
jl 0x1000b6d3
mov edi, ebx
cmp dword [ebp - 0x20], eax
jne 0x1000b6d5
mov edi, eax
push eax
lea ecx, [ebp - 0x428]
call fcn.10009571
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp edi, ecx
mov esi, eax
push 0xffffffffffffffff
sete dl
xor ecx, ecx
imul edx, dword [ebp - 0x48]
cmp edx, 0x3026d8d3
setne cl
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
mov ecx, 0xfc2f92e6
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setne cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
sub eax, dword [esi]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
pop esi
jg 0x1000b685
xor eax, eax
lea ecx, [ebp - 0x428]
push eax
call fcn.10009571
lea ecx, [ebp - 0x428]
inc dword [eax]
xor eax, eax
push eax
call fcn.10009571
push 0xffffffffffffffff
pop esi
cmp dword [eax], 0xa
jge 0x1000b658
or esi, esi
lea ecx, [ebp - 0x428]
mov dword [ebp - 4], esi
call fcn.1000956c
movdqa xmm0, xmmword [0x10008240]
lea eax, [ebp - 0x1134]
push eax
lea eax, [ebp - 0x1144]
push eax
lea ecx, [ebp - 0x1460]
movdqu xmmword [ebp - 0x1144], xmm0
call fcn.10009583
lea ecx, [ebp - 0x225]
mov esi, eax
call fcn.10009580
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x50c]
push dword [esi]
call fcn.10009546
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x1468]
movdqa xmm0, xmmword [0x100081b0]
mov eax, 0xcea5d6c0
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x1234]
push eax
lea eax, [ebp - 0x1244]
push eax
movdqu xmmword [ebp - 0x1244], xmm0
call fcn.10009583
lea ecx, [ebp - 0x1c9]
mov esi, eax
call fcn.10009580
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x6c4]
push dword [esi]
call fcn.10009546
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x28], eax
or ecx, 0xffffffff
mov dword [ebp - 0x48], 0xfffffffd
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1000b864
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x13dc], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1000b84f
xor eax, eax
mov dword [ebp - 0x484], 0xe
cmp dword [ebp - 0x484], 0xffffffeb
jne 0x1000b8ef
jmp 0x1000b87b
xor eax, eax
mov dword [ebp - 0x30], 0x1f90ef30
mov dword [ebp - 0x38], 0x8e17b844
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0x1912530a
mov dword [ebp - 0x30], 0xf1c9
mov dword [ebp - 0x48], 0xf4039ee4
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
xor eax, eax
cmp dword [ebp - 0x38], eax
jne 0x1000b8bd
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x484]
lea ecx, [ebp - 0x6c4]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x484]
push ebx
call fcn.10009571
push 0xffffffffffffffff
pop ecx
mov dword [eax], ebx
dec dword [ebp - 0x484]
cmp dword [ebp - 0x484], 0xffffffeb
je 0x1000b879
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x13
push 2
pop edi
jl 0x1000b9c9
jmp 0x1000b905
xor eax, eax
mov dword [ebp - 0x20], 0xfa8f
lea ecx, [ebp - 0x6c4]
mov dword [ebp - 0x58], 0xc242ea6a
push eax
call fcn.10009571
mov ecx, dword [ebp - 0x20]
xor ebx, ebx
dec ecx
push edi
cmp dword [eax], ecx
setg bl
xor edx, edx
test ebx, ebx
mov dword [ebp - 0x484], ebx
mov eax, dword [ebp - 0x13d8]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xf079
lea ecx, [ebp - 0x6c4]
setge al
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
call fcn.10009571
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x6c4]
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
call fcn.10009571
push 3
lea ecx, [ebp - 0x6c4]
call fcn.10009571
mov edx, dword [ebp - 0x58]
mov esi, eax
mov ecx, dword [ebp - 0x20]
xor eax, eax
cmp ecx, edx
mov ecx, dword [ebp - 0x58]
setg al
xor edx, edx
cmp eax, ecx
setle dl
xor eax, eax
mov dword [esi], edx
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1000b9b9
push 0x201d
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x13
jge 0x1000b903
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x6c4]
mov byte [ebp - 4], 0xa
call fcn.1000956c
push edi
lea ecx, [ebp - 0x2c4]
call fcn.10009504
push 9
mov byte [ebp - 4], 0xc
pop eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1000ba12
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2c4]
call fcn.10009571
mov dword [eax], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000b9f8
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000bb9a
mov dword [ebp - 0x54], 0x1d91e66
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1000ba44
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x218], 0x79536444
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000ba2c
xor eax, eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], ebx
jg 0x1000bb97
mov dword [ebp - 0x1c], 0xb7161ab6
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x48], 0xac29ba1f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x1000bb3d
mov dword [ebp - 0x3c], 0x18ebdb88
lea ecx, [ebp - 0x2c4]
push dword [ebp - 0x1c]
call fcn.10009571
xor esi, esi
cmp dword [eax], esi
jne 0x1000bb15
push ebx
lea ecx, [ebp - 0x2c4]
call fcn.10009571
cmp dword [eax], esi
jne 0x1000bac8
mov ecx, dword [ebp - 0x218]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x1c]
je 0x1000bac8
mov esi, ebx
jmp 0x1000baca
xor eax, eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c4]
call fcn.10009571
cmp esi, dword [eax]
jl 0x1000bae3
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000bae5
mov eax, ebx
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x2c4]
mov esi, dword [ebp - 0x20]
push dword [ebp - 0x1c]
neg esi
sbb esi, esi
neg esi
call fcn.10009571
mov ecx, dword [ebp - 0x214]
sub ecx, dword [eax]
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x54], esi
jl 0x1000bb15
xor eax, eax
mov esi, eax
jmp 0x1000bb17
mov esi, ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c4]
call fcn.10009571
xor ecx, ecx
cmp esi, dword [eax]
setl cl
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1000ba76
xor eax, eax
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x2c4]
push eax
call fcn.10009571
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x2c4]
push dword [ebp - 0x18]
add esi, dword [eax]
call fcn.10009571
cmp dword [eax], esi
jl 0x1000bb7d
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x48], 0xfffffff7
test eax, eax
jne 0x1000bb79
cmp dword [ebp - 0x48], eax
je 0x1000bb7f
mov eax, ebx
jmp 0x1000bb7f
xor eax, eax
mov dword [ebp - 0x54], eax
inc dword [ebp - 0x218]
push 0
pop eax
cmp dword [ebp - 0x218], ebx
jle 0x1000ba56
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1000ba1a
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0xa
call fcn.1000956c
xor eax, eax
mov dword [ebp - 0x44], 0x1ac7eb23
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1000bbdd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x7e0], 0xfd3df75d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1000bbc4
xor eax, eax
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0x17
jne 0x1000bc27
xor ebx, ebx
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x1000bc15
push ebx
push 0x130b
push 0xbf6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
inc dword [ebp - 0x7e0]
cmp dword [ebp - 0x7e0], 0x17
je 0x1000bbee
xor ebx, ebx
inc ebx
movdqa xmm0, xmmword [0x100081f0]
lea eax, [ebp - 0x1154]
mov dword [ebp - 0x5c], 0x86f80366
lea ecx, [ebp - 0x1478]
mov dword [ebp - 0x78], 0xbdde
mov dword [ebp - 0x74], 0xbdde
mov dword [ebp - 0x70], 0xbdde
mov dword [ebp - 0x6c], 0xbdde
mov dword [ebp - 0x30], 0xb2cfb631
mov dword [ebp - 0x30], 0x210b999f
mov dword [ebp - 0x30], 0xfffffff7
push eax
mov dword [ebp - 0x30], 0x5a60d005
lea eax, [ebp - 0x1164]
mov dword [ebp - 0x30], 0x7c04ccb6
mov dword [ebp - 0x30], 0x88146cde
mov dword [ebp - 0x30], 0x5d9b4e94
push eax
movdqu xmmword [ebp - 0x1164], xmm0
call fcn.10009583
lea ecx, [ebp - 0x1ce]
mov esi, eax
call fcn.10009580
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x137c]
push dword [esi]
call fcn.10009546
or esi, 0xffffffff
lea ecx, [ebp - 0x137c]
mov dword [ebp - 0x58], esi
inc dword [ebp - 0x58]
call fcn.1000956c
xor eax, eax
lea ecx, [ebp - 0x548]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x1c], 0x98a8
push edi
call fcn.10009504
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x54], 0x45b0
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x48], 0xc5b1510a
mov dword [ebp - 0x30], 0x65dea311
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1000bd2e
push dword [ebp - 0x24]
lea ecx, [ebp - 0x548]
call fcn.10009571
mov dword [eax], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1000bd14
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1000bd44
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa44], 0xfff7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1000bd33
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x548]
setne bl
sub ebx, eax
xor eax, eax
push eax
call fcn.10009571
mov dword [eax], ebx
cmp ebx, dword [ebp - 0x1c]
jne 0x1000bd77
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
inc ebx
cmp dword [ebp - 0x1c], ebx
push 9
sbb eax, eax
neg eax
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x1c]
jne 0x1000bdc2
mov dword [ebp - 0x30], esi
inc dword [ebp - 0xa44]
jmp 0x1000bf98
mov dword [ebp - 0x28], 0xbd55
xor ebx, ebx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x38], 0x8afe0a4d
mov ecx, dword [ebp - 0xa44]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x18], ecx
xor eax, eax
inc ebx
cmp dword [ebp - 0x18], eax
je 0x1000be0a
mov eax, ebx
mov ecx, 0xf9eb
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x48]
cmp eax, ecx
lea ecx, [ebp - 0x548]
setle dl
xor eax, eax
push eax
add esi, edx
call fcn.10009571
mov dword [eax], esi
mov eax, dword [ebp - 0x28]
add eax, esi
cmp dword [ebp - 0x28], eax
jge 0x1000bf81
mov dword [ebp - 0x48], 0x1cc49297
lea ecx, [ebp - 0xc30]
push 4
call fcn.10009504
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000be80
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc30]
call fcn.10009571
mov dword [eax], 0x22a57d88
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000be61
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffe
cmp dword [ebp - 0x18], 0xf
je 0x1000bf74
jmp 0x1000be95
xor eax, eax
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1000bebc
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf6c], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000bea4
xor eax, eax
push eax
lea ecx, [ebp - 0x548]
call fcn.10009571
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x548]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x54]
xor eax, eax
push eax
call fcn.10009571
mov edx, dword [ebp - 0x58]
xor ecx, ecx
add edx, dword [eax]
mov eax, dword [ebp - 0xa44]
cmp edx, eax
sete cl
imul eax, ecx, 0xffff
test eax, eax
jne 0x1000befe
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp eax, 8
mov eax, 0xffff
setl cl
cmp ecx, eax
sbb eax, eax
neg eax
add eax, eax
mov dword [ebp - 0xf68], eax
je 0x1000bf33
push ebx
lea ecx, [ebp - 0x548]
call fcn.10009571
cmp dword [eax], 0
je 0x1000bf33
mov edi, ebx
jmp 0x1000bf37
xor eax, eax
mov edi, eax
push 2
lea ecx, [ebp - 0xc30]
call fcn.10009571
mov ecx, dword [ebp - 0x28]
cmp edi, 0xbb650ebf
mov esi, eax
sbb edx, edx
xor eax, eax
neg edx
cmp edx, ecx
push 2
setl al
sub eax, dword [ebp - 0x48]
neg eax
pop edi
sbb eax, eax
inc eax
mov dword [esi], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x1000be93
lea ecx, [ebp - 0xc30]
call fcn.1000956c
jmp 0x1000bf98
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x1000bf98
push 0x2e2
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 0xa
call fcn.1000956c
push edi
lea ecx, [ebp - 0x844]
call fcn.10009504
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x18], 0x506d4441
mov dword [ebp - 0x58], 0x68a9017c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1000bfed
push dword [ebp - 0x20]
lea ecx, [ebp - 0x844]
call fcn.10009571
mov dword [eax], 0x57fd5464
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000bfcf
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1000c097
mov dword [ebp - 0x48], 0x8abc106e
lea ecx, [ebp - 0x844]
mov dword [ebp - 0x58], 0x5998ab54
push dword [ebp - 0x18]
call fcn.10009571
push dword [ebp - 0x18]
lea ecx, [ebp - 0x844]
mov esi, eax
call fcn.10009571
xor edx, edx
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x18]
cmp dword [esi], ecx
setle dl
xor eax, eax
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], eax
je 0x1000c058
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x844]
push eax
call fcn.10009571
mov dword [eax], esi
test esi, esi
je 0x1000c056
mov esi, ebx
jmp 0x1000c05a
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0x58]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
xor ecx, ecx
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x58]
sub eax, 5
cmp esi, eax
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x58], ecx
dec dword [ebp - 0x18]
jns 0x1000bff9
lea ecx, [ebp - 0x844]
mov byte [ebp - 4], 0xa
call fcn.1000956c
xor eax, eax
push 4
mov dword [ebp - 0x20], eax
pop edx
cmp dword [ebp - 0x20], edx
jge 0x1000c0cb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd38], 0x72ba29f5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1000c0b3
xor eax, eax
mov dword [ebp - 0x50], 0xfffffff9
mov dword [ebp - 0x18], 0xfffffff7
push 3
pop ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 0x5bb3
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], 0xa7a7558c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000c110
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x94], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000c0f8
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x1000c130
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb24], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1000c118
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
jge 0x1000c150
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd28], 0xfffd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1000c138
xor eax, eax
or esi, 0xffffffff
cmp dword [ebp - 0x94], eax
je 0x1000c27a
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x54], 0x2bab
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x94], eax
je 0x1000c1ca
mov eax, dword [ebp - 0x94]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x94]
cmp eax, 0x46773196
setle cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x18], eax
je 0x1000c1c6
mov eax, dword [ebp - 0xb24]
mov edx, ebx
jmp 0x1000c1cc
mov edx, eax
mov eax, dword [ebp - 0x94]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
add eax, 2
add ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
mov dword [ebp - 0x28], edx
xor edx, edx
mov ecx, dword [ebp - 0xb20]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setne dl
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x20], 0xfffffff6
mov eax, dword [ebp - 0xd20]
cmp dword [ebp - 0x20], eax
jg 0x1000c24e
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
test eax, eax
jne 0x1000c223
cmp dword [ebp - 0x1c], eax
je 0x1000c225
mov eax, ebx
mov dword [ebp - 0x48], eax
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x58]
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x28]
jle 0x1000c250
cmp dword [ebp - 0x50], eax
je 0x1000c250
mov edx, ebx
jmp 0x1000c252
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x54]
sete cl
xor edx, edx
imul ecx, ecx, 0xa5cf
cmp ecx, eax
setg dl
sub edx, 0xfff7
mov dword [ebp - 0x38], edx
jmp 0x1000c370
mov edx, 0xffff
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1000c29e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x143c], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000c28a
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1000c2cf
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x1000c2ca
push eax
push eax
push 0x9e1
push 0x2567
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1000c2a6
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xd20]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x365d5a10
setge al
xor ecx, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp eax, ecx
setge bl
xor edx, edx
mov dword [ebp - 0x143c], ebx
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ecx, 0xfffffffa
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xd20]
setle dl
xor ecx, ecx
cmp edx, eax
mov edx, 0x81e2e8c4
setne cl
xor ebx, ebx
sub edx, ecx
inc ebx
cmp dword [ebp - 0x94], ebx
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
inc ecx
imul eax, ecx
sub edx, eax
sub edx, dword [ebp - 0xd1c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push edi
lea ecx, [ebp - 0x50c]
call fcn.10009571
and dword [eax], 0
jmp 0x1000dd3a
push 3
lea ecx, [ebp - 0x6d0]
call fcn.10009504
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x48], 0x2d38ca8c
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
jmp 0x1000c3b7
push dword [ebp - 0x20]
call fcn.10009571
mov dword [eax], 0xea5d6c05
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
lea ecx, [ebp - 0x6d0]
jl 0x1000c3a6
push edi
call fcn.10009571
and dword [eax], 0
jmp 0x1000c5c8
push edi
lea ecx, [ebp - 0x6d0]
call fcn.10009571
cmp dword [eax], 0xfffffff9
je 0x1000c3d1
push edi
lea ecx, [ebp - 0x50c]
call fcn.10009571
cmp dword [eax], 0xc
jne 0x1000c384
lea ecx, [ebp - 0x50c]
mov dword [ebp - 4], esi
call fcn.1000956c
dec dword [ebp - 0x2c]
push 8
pop eax
cmp dword [ebp - 0x2c], eax
jg 0x1000b5f1
push 2
mov edi, 0x1d1fc
pop esi
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000dda1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1570], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000dd88
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1000ddab
cmp dword [ebp - 0x1c], edi
jle 0x1000ddad
mov eax, ebx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1570], edx
mov ecx, dword [ebp - 0x1c]
imul ecx, eax
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setl al
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xe
je 0x1000de0d
xor ebx, ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000ddff
push ebx
push 0x169c
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xe
jne 0x1000ddeb
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x30], 0xfe387fb0
mov dword [ebp - 0x3c], 0xaa39ed0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000de37
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdfc], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000de23
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000de54
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor eax, eax
inc dword [ebp - 0x3c]
mov dword [ebp - 0x30], 0xa53d06ce
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000de70
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000de8b
push eax
push eax
push 0xb83
push eax
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000deb6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1588], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000de9d
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1000dec0
cmp dword [ebp - 0x1c], edi
jle 0x1000dec2
mov eax, ebx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1588], edx
mov ecx, dword [ebp - 0x1c]
imul ecx, eax
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setl al
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xe
je 0x1000df22
xor ebx, ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000df14
push ebx
push 0x169c
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xe
jne 0x1000df00
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffa
lea ecx, [ebp - 0xa74]
or edi, 0xffffffff
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], 0xa6dd7547
mov dword [ebp - 0x20], edi
push esi
call fcn.10009504
xor eax, eax
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1000df74
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x84], 0xc116e074
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1000df5c
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1000df96
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa74]
call fcn.10009571
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000df7c
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x16
jne 0x1000e15d
push 9
pop edi
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], 4
cmp dword [ebp - 0x24], 0xffffffe3
je 0x1000e12d
mov dword [ebp - 0x38], 0xd77cccae
mov dword [ebp - 0x5c], 0xdb40437e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000dfea
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x64c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000dfd5
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000dffc
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor eax, eax
mov dword [ebp - 0x644], 0xffffffe2
jmp 0x1000e111
mov dword [ebp - 0x3c], 0x23703acb
mov dword [ebp - 0x4c], 0x658d83f7
mov dword [ebp - 0x44], 0xc46d
mov dword [ebp - 0x10], eax
jmp 0x1000e036
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe10], 0x791f9e6a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000e025
inc dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x24]
test eax, eax
setns dl
xor ecx, ecx
mov dword [ebp - 0xe0c], edx
mov eax, dword [ebp - 0x40]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, dword [ebp - 0x40]
jge 0x1000e069
cmp dword [ebp - 0x84], eax
je 0x1000e069
mov eax, ebx
mov dword [ebp - 0x84], eax
xor ecx, ecx
mov eax, dword [ebp - 0x644]
mov eax, dword [ebp - 0x24]
cmp eax, ebx
setge cl
xor eax, eax
cmp ecx, ebx
setg al
cmp eax, dword [ebp - 0x4c]
je 0x1000e08e
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1000e09b
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x644]
mov ecx, dword [ebp - 0x644]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov ecx, dword [ebp - 0x2c]
setne dl
imul ecx, edx
sub ecx, dword [ebp - 0x5c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
imul ecx, dword [ebp - 0x644]
cmp ecx, edi
setg al
xor ecx, ecx
cmp eax, 0xc253
setle cl
cmp ecx, dword [ebp - 0x5c]
jl 0x1000e0f7
mov dword [ebp - 0x3c], 0x6ffea1e1
dec dword [ebp - 0x3c]
jmp 0x1000e108
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x1000e108
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x644]
push 0
pop eax
cmp dword [ebp - 0x644], edi
je 0x1000e00b
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe3
push 0
pop eax
jne 0x1000dfbe
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000e14d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x84], 0xfffffffb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000e135
xor eax, eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x16
je 0x1000dfa6
or edi, 0xffffffff
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x64]
add eax, 0xffff706c
add ecx, eax
mov eax, dword [ebp - 0x68]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
add ecx, 0xc4a3
cmp ecx, 0xdce64f81
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x84]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
cmp eax, ebx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x2c]
je 0x1000e209
mov edx, ebx
cmp dword [ebp - 0x40], eax
jne 0x1000e20b
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xa74]
push eax
call fcn.10009571
mov ecx, dword [ebp - 0x84]
imul ecx, dword [ebp - 0x28]
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x84]
cmp eax, ebx
setle cl
xor eax, eax
add ecx, 0xe90e
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0xa74]
push eax
call fcn.10009571
mov ecx, dword [ebp - 0x84]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0xa74]
mov eax, dword [ebp - 0x2c]
setge dl
imul eax, edx
mov dword [ebp - 0x84], eax
mov dword [ebp - 4], edi
call fcn.1000956c
mov dword [ebp - 0x28], 0x3a88e00f
lea ecx, [ebp - 0x250]
push ebx
call fcn.10009504
mov dword [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x44], 0x468a07c6
mov dword [ebp - 0x20], 0x77e0
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000e2d7
push dword [ebp - 0x10]
lea ecx, [ebp - 0x250]
call fcn.10009571
mov dword [eax], 0x1208373b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000e2b9
xor eax, eax
push eax
lea ecx, [ebp - 0x250]
call fcn.10009571
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [eax]
jne 0x1000e2fb
xor eax, eax
lea ecx, [ebp - 0x250]
push eax
call fcn.10009571
mov eax, dword [ebp - 0x20]
xor eax, eax
lea ecx, [ebp - 0x250]
push eax
call fcn.10009571
mov eax, dword [ebp - 0x48]
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0xbb9
test eax, eax
je 0x1000e34c
xor eax, eax
lea ecx, [ebp - 0x250]
push eax
call fcn.10009571
cmp dword [eax], 0
je 0x1000e34c
xor eax, eax
jmp 0x1000e350
xor eax, eax
mov ebx, eax
dec dword [ebp - 0x44]
lea ecx, [ebp - 0x250]
push eax
call fcn.10009571
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x250]
sub edi, ebx
imul edi, dword [eax]
xor eax, eax
push eax
call fcn.10009571
mov esi, dword [ebp - 0x48]
xor edx, edx
imul esi, dword [ebp - 0x20]
push 8
imul esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul esi, edi
cmp esi, ecx
setg dl
xor ecx, ecx
cmp edx, 0x351cdcb3
setne cl
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x250]
pop eax
setl bl
sub ebx, eax
xor eax, eax
push eax
call fcn.10009571
mov eax, dword [eax]
add eax, ebx
jne 0x1000e3c4
cmp dword [ebp - 0x20], eax
jne 0x1000e3c6
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x1000e3cb
xor eax, eax
xor ebx, ebx
inc ebx
mov esi, ebx
push eax
lea ecx, [ebp - 0x250]
call fcn.10009571
lea ecx, [ebp - 0x250]
mov dword [eax], esi
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.1000956c
push 4
mov dword [ebp - 0x20], 0xfffffff6
xor eax, eax
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jge 0x1000e41f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x11a4], 0xc93b4e1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000e407
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1000e43f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x808], 0xcec79e67
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1000e427
xor eax, eax
push 3
pop ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jl 0x1000e52c
mov dword [ebp - 0x2c], 0xfc07e17f
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x1000e478
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13ac], 0x4225189d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000e460
xor eax, eax
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x1000e4ab
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000e4a0
push 0xf82
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
xor eax, eax
dec dword [ebp - 0x3c]
dec dword [ebp - 0x2c]
jns 0x1000e480
push 3
pop ecx
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jl 0x1000e523
mov dword [ebp - 0x4c], 7
mov eax, 0xbda18461
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xba4], eax
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x11a4]
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0xbac], ebx
cmp dword [ebp - 0x5c], 0x16
jle 0x1000e4f9
mov eax, dword [ebp - 0xbac]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x11a4]
mov eax, dword [ebp - 0x38]
add eax, 0x13a6
add eax, ecx
mov dword [ebp - 0x13ac], eax
xor eax, eax
cmp dword [ebp - 0x5c], eax
jne 0x1000e51e
dec dword [ebp - 0x2c]
jns 0x1000e4b3
push 3
xor eax, eax
pop ecx
dec dword [ebp - 0x20]
jns 0x1000e44e
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000e54b
push eax
push eax
push 0x21c9
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x30], 0xfe387fb0
mov eax, 0xe91a049f
mov dword [ebp - 0x838], eax
mov dword [ebp - 0x834], eax
mov dword [ebp - 0x830], eax
mov dword [ebp - 0x82c], eax
xor eax, eax
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], eax
je 0x1000e59b
xor ebx, ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000e590
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
inc dword [ebp - 0x82c]
jne 0x1000e581
xor ebx, ebx
inc ebx
mov dword [ebp - 0x64], 0xaa39ed0
lea ecx, [ebp - 0x954]
push ebx
call fcn.10009504
push 2
lea ecx, [ebp - 0x380]
mov dword [ebp - 4], 0x21
call fcn.10009504
mov byte [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x4c], 0xc0001115
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x1000e5f1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x954]
call fcn.10009571
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1000e5d7
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000e607
push dword [ebp - 0x1c]
call fcn.10009571
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
lea ecx, [ebp - 0x380]
jl 0x1000e5f6
push ebx
call fcn.10009571
xor esi, esi
lea ecx, [ebp - 0x380]
push ebx
mov dword [eax], esi
call fcn.10009571
cmp dword [eax], esi
jg 0x1000e69d
xor eax, eax
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x1000e646
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x10]
jns 0x1000e63e
push ebx
lea ecx, [ebp - 0x380]
call fcn.10009571
lea ecx, [ebp - 0x954]
push dword [eax]
call fcn.10009571
push ebx
lea ecx, [ebp - 0x380]
mov esi, eax
call fcn.10009571
lea ecx, [ebp - 0x954]
push dword [eax]
call fcn.10009571
mov ecx, dword [esi]
push ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x380]
call fcn.10009571
push ebx
lea ecx, [ebp - 0x380]
inc dword [eax]
call fcn.10009571
cmp dword [eax], 0
jle 0x1000e62d
lea ecx, [ebp - 0x380]
call fcn.1000956c
or esi, 0xffffffff
lea ecx, [ebp - 0x954]
mov dword [ebp - 4], esi
call fcn.1000956c
push 0xfffffffffffffffc
mov dword [ebp - 0x18], 0xb7f3
pop eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x44], 0x5f0e77da
mov dword [ebp - 0x10], eax
jmp 0x1000e6e5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe08], 0xf8dc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000e6d4
mov eax, dword [ebp - 0x1c]
sub eax, 0x715d3c63
je 0x1000e6ff
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000e701
mov eax, ebx
jmp 0x1000e701
xor eax, eax
xor edx, edx
cmp eax, 0xb5ea
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x2324015f
setle al
imul eax, dword [ebp - 0x18]
test eax, eax
je 0x1000e72b
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
sub ecx, 0x3090
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x2a6f
setge al
xor ecx, ecx
cmp eax, 0xa9b03be4
setne cl
xor eax, eax
cmp ecx, 0x2ded1456
setge al
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, 0xfffc
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000e7a7
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000e7a1
push ebx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor eax, eax
inc dword [ebp - 0x3c]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1000e78c
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000e7cb