Function at 0x1004e902
Capabilities:
Create directory
Create process on windows
Enumerate gui resources
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008a598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x820
push esi
push edi
mov dword [ebp - 0xfc], 0x477862fd
push 1
lea ecx, [ebp - 0x6d8]
call fcn.10017107
and dword [ebp - 4], 0
mov dword [ebp - 0x6fc], 0x4dcc80fc
mov dword [ebp - 0x30], 0
jmp 0x1004e957
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1004e96d
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x7d0], 0xade2167f
jmp 0x1004e950
mov dword [ebp - 0x30], 0
jmp 0x1004e97d
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1004e999
push dword [ebp - 0x30]
lea ecx, [ebp - 0x6d8]
call fcn.100171a5
mov dword [eax], 1
jmp 0x1004e976
mov dword [ebp - 0xfc], 0
jmp 0x1004e9b2
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xffffffff
jle 0x1004ea4e
mov dword [ebp - 0x77c], 0xa756
mov dword [ebp - 0x760], 1
mov dword [ebp - 0x6c4], 2
mov dword [ebp - 0x75c], 9
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x100], 0
jmp 0x1004ea0a
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x1004ea26
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x820], 5
jmp 0x1004e9fd
mov byte [ebp - 0x6f], 0
movzx eax, byte [ebp - 0x6f]
test eax, eax
je 0x1004ea3c
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x258]
dec eax
mov dword [ebp - 0x258], eax
jmp 0x1004e9a5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6d8]
call fcn.10017189
mov dword [ebp - 0xb8], 0xfb871c7b
mov dword [ebp - 0xac], 0x5c82f744
mov dword [ebp - 0x484], 0xfffffff8
mov dword [ebp - 0x6cc], 0xfffffffb
mov dword [ebp - 0x63c], 0xffffffff
mov dword [ebp - 0x644], 5
mov dword [ebp - 0x64c], 0x364f2ca1
mov dword [ebp - 0x654], 0xfffffff8
mov dword [ebp - 0x65c], 0xe85dc32c
mov dword [ebp - 0x664], 0xffffffff
push 2
lea ecx, [ebp - 0x6f8]
call fcn.10017107
mov dword [ebp - 4], 1
mov dword [ebp - 0x50], 0
jmp 0x1004eae5
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1004eafb
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x5e0], 0x64a6847d
jmp 0x1004eade
mov dword [ebp - 0x50], 0
jmp 0x1004eb0b
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1004eb27
push dword [ebp - 0x50]
lea ecx, [ebp - 0x6f8]
call fcn.100171a5
mov dword [eax], 0x49f7fae0
jmp 0x1004eb04
mov byte [ebp - 0x7c], 0
movzx eax, byte [ebp - 0x7c]
test eax, eax
je 0x1004eb49
push 0
push 0
push 0x1c44
push 0x7b9
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
mov dword [ebp - 0xb8], 2
jmp 0x1004eb62
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x1004ee69
mov dword [ebp - 0x5c], 0x443250e6
mov dword [ebp - 0x55c], 0x924f
mov dword [ebp - 0x558], 0x924f
mov dword [ebp - 0x554], 0x924f
mov dword [ebp - 0x550], 0x924f
push 4
lea ecx, [ebp - 0x6e8]
call fcn.10017107
mov byte [ebp - 4], 2
mov dword [ebp - 0x66c], 9
mov dword [ebp - 0x158], 0
jmp 0x1004ebd2
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 4
jge 0x1004ebf4
push dword [ebp - 0x158]
lea ecx, [ebp - 0x6e8]
call fcn.100171a5
mov dword [eax], 7
jmp 0x1004ebc5
mov dword [ebp - 0x5c], 0
jmp 0x1004ec04
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jg 0x1004ed8d
mov dword [ebp - 0x84], 0x39ecf4a
mov dword [ebp - 0x47c], 0xed55c59c
cmp dword [ebp - 0x84], 0
je 0x1004ec36
push 5
pop eax
test eax, eax
jne 0x1004ece2
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0xb8]
cmp eax, 0xe224
je 0x1004ec55
mov dword [ebp - 0x424], 1
jmp 0x1004ec5c
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x424]
jl 0x1004ec73
mov dword [ebp - 0x494], 1
jmp 0x1004ec7a
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x84]
cmp eax, 0xf8609561
jb 0x1004ecab
cmp dword [ebp - 0x84], 0
jne 0x1004ecab
and dword [ebp - 0x42c], 0
jmp 0x1004ecb5
mov dword [ebp - 0x42c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x55c]
cmp dword [ebp - 0x42c], eax
jl 0x1004ecd9
cmp dword [ebp - 0x5c], 0
jne 0x1004ecd9
cmp dword [ebp - 0x84], 0
jne 0x1004ece2
and dword [ebp - 0x434], 0
jmp 0x1004ecec
mov dword [ebp - 0x434], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x55c]
cmp dword [ebp - 0x434], eax
jg 0x1004ed0d
mov dword [ebp - 0x474], 1
jmp 0x1004ed14
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x5e0]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x43c]
mov dword [ebp + eax*4 - 0x5e0], ecx
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x43c], eax
jg 0x1004ed4e
mov dword [ebp - 0x444], 1
jmp 0x1004ed55
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
sub eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x47c]
jge 0x1004ed75
mov dword [ebp - 0x44c], 1
jmp 0x1004ed7c
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x484], eax
jmp 0x1004ebfd
mov dword [ebp - 0xac], 2
jmp 0x1004eda6
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x1004ee55
push 1
lea ecx, [ebp - 0x628]
call fcn.10017107
mov byte [ebp - 4], 3
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x108], 0
jmp 0x1004edf1
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jge 0x1004ee13
push dword [ebp - 0x108]
lea ecx, [ebp - 0x628]
call fcn.100171a5
mov dword [eax], 0xb9cbadbe
jmp 0x1004ede4
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0x5e0], 0
je 0x1004ee34
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x628]
call fcn.10017189
jmp 0x1004ee55
mov eax, dword [ebp - 0x454]
inc eax
mov dword [ebp - 0x454], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x628]
call fcn.10017189
jmp 0x1004ed99
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6e8]
call fcn.10017189
jmp 0x1004eb55
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f8]
call fcn.10017189
mov dword [ebp - 0x120], 0x477862fd
mov dword [ebp - 0x684], 0
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x1004eea7
push 0
push 0x2e3
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1004eebe
push 0x16fc
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
push 1
lea ecx, [ebp - 0x728]
call fcn.10017107
mov dword [ebp - 4], 4
mov dword [ebp - 0x1c], 0xa4f833fc
mov dword [ebp - 0x214], 0xa1efe0c2
mov dword [ebp - 0x594], 0xfffffffb
mov dword [ebp - 0x590], 0xfffffffb
mov dword [ebp - 0x58c], 0xfffffffb
mov dword [ebp - 0x588], 0xfffffffb
lea ecx, [ebp - 0x1b9]
call fcn.10009433
push eax
lea eax, [ebp - 0x584]
push eax
lea eax, [ebp - 0x594]
push eax
lea ecx, [ebp - 0x7e8]
call fcn.100171b4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.10017163
mov byte [ebp - 4], 5
mov dword [ebp - 0x15c], 0
jmp 0x1004ef5d
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jge 0x1004ef76
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x38], 4
jmp 0x1004ef50
mov dword [ebp - 0x1c], 0
jmp 0x1004ef86
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1004efa5
mov dword [ebp - 0x48c], 0x68876942
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x38]
mov dword [ebp - 0x48c], eax
jmp 0x1004ef7f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38], 0
je 0x1004efc4
cmp dword [ebp - 0x1c], 0
je 0x1004efc4
mov dword [ebp - 0x41c], 1
jmp 0x1004efcb
and dword [ebp - 0x41c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x38]
cmp dword [ebp - 0x41c], eax
jle 0x1004efe9
mov dword [ebp - 0x1f4], 1
jmp 0x1004eff0
and dword [ebp - 0x1f4], 0
cmp dword [ebp - 0x1f4], 0x13ca
jge 0x1004f008
mov dword [ebp - 0x324], 1
jmp 0x1004f00f
and dword [ebp - 0x324], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x324]
sub ecx, dword [ebp + eax - 0x38]
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp + eax - 0x38]
cmp ecx, 0x8ec
je 0x1004f03e
mov dword [ebp - 0x1fc], 1
jmp 0x1004f045
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0x1c]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x38]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x38]
je 0x1004f070
mov dword [ebp - 0x3bc], 1
jmp 0x1004f077
and dword [ebp - 0x3bc], 0
cmp dword [ebp - 0x3bc], 0xfffffff6
jge 0x1004f08c
mov dword [ebp - 0x204], 1
jmp 0x1004f093
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x204]
cmp eax, 0x1418
jle 0x1004f0af
mov dword [ebp - 0x32c], 1
jmp 0x1004f0b6
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x32c]
cmp eax, 9
jle 0x1004f0d1
mov dword [ebp - 0x20c], 1
jmp 0x1004f0d8
and dword [ebp - 0x20c], 0
cmp dword [ebp - 0x20c], 1
jl 0x1004f0f6
mov eax, 0x39b8842b
test eax, eax
je 0x1004f0f6
mov dword [ebp - 0x404], 1
jmp 0x1004f0fd
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x214]
cmp dword [ebp - 0x1c], eax
jg 0x1004f123
mov dword [ebp - 0x334], 1
jmp 0x1004f12a
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x1c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38], 5
je 0x1004f14c
mov dword [ebp - 0x21c], 1
jmp 0x1004f153
and dword [ebp - 0x21c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x38]
cmp dword [ebp - 0x21c], eax
jge 0x1004f171
mov dword [ebp - 0x3c4], 1
jmp 0x1004f178
and dword [ebp - 0x3c4], 0
push 3
lea ecx, [ebp - 0x708]
call fcn.100171a5
mov ecx, dword [ebp - 0x3c4]
mov dword [eax], ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x708]
call fcn.10017189
mov dword [ebp - 0x68c], 0x4dcc80fc
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0x58], 0xfffffffc
mov dword [ebp - 0x468], 0x4498b94b
mov dword [ebp - 0x140], 0x783518f
mov eax, dword [ebp - 0xc0]
neg eax
mov dword [ebp - 0x58], eax
je 0x1004f358
mov dword [ebp - 0x1c4], 0x6eda
mov dword [ebp - 0x49c], 0xfffffff6
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x1c3a
jle 0x1004f2e5
cmp dword [ebp - 0xc0], 0x7b30
jne 0x1004f224
cmp dword [ebp - 0x58], 0
je 0x1004f224
mov dword [ebp - 0x224], 1
jmp 0x1004f22b
and dword [ebp - 0x224], 0
cmp dword [ebp - 0x224], 0xd8ff8cd3
jne 0x1004f243
mov dword [ebp - 0x33c], 1
jmp 0x1004f24a
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x1c4]
imul eax, dword [ebp - 0x33c]
cmp eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
shl eax, 3
cmp dword [ebp - 0x1c4], eax
jle 0x1004f280
mov eax, 0xcd95ff79
test eax, eax
jne 0x1004f280
and dword [ebp - 0x22c], 0
jmp 0x1004f28a
mov dword [ebp - 0x22c], 1
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0x22c], eax
je 0x1004f2a4
mov dword [ebp - 0x450], 1
jmp 0x1004f2ab
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x450]
jl 0x1004f2c2
mov dword [ebp - 0x234], 1
jmp 0x1004f2c9
and dword [ebp - 0x234], 0
cmp dword [ebp - 0x234], 0xfffffff8
jne 0x1004f2de
mov dword [ebp - 0x344], 1
jmp 0x1004f2e5
and dword [ebp - 0x344], 0
cmp dword [ebp - 0x58], 0
je 0x1004f300
cmp dword [ebp - 0x1c4], 0
je 0x1004f300
mov dword [ebp - 0x23c], 1
jmp 0x1004f307
and dword [ebp - 0x23c], 0
cmp dword [ebp - 0x23c], 0x65f5
jge 0x1004f31f
mov dword [ebp - 0x3cc], 1
jmp 0x1004f326
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x49c]
cmp dword [ebp - 0x3cc], eax
jge 0x1004f340
mov dword [ebp - 0x244], 1
jmp 0x1004f347
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x140], eax
jmp 0x1004f4c5
push 2
lea ecx, [ebp - 0x5d4]
call fcn.10017107
mov byte [ebp - 4], 6
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x110], 0
jmp 0x1004f38c
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jge 0x1004f3ab
push dword [ebp - 0x110]
lea ecx, [ebp - 0x5d4]
call fcn.100171a5
or dword [eax], 0xffffffff
jmp 0x1004f37f
cmp dword [ebp - 0xcc], 0
jge 0x1004f3c0
mov dword [ebp - 0x34c], 1
jmp 0x1004f3c7
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x34c]
cmp eax, 0xc64e
jge 0x1004f3e3
mov dword [ebp - 0x24c], 1
jmp 0x1004f3ea
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x24c], eax
je 0x1004f404
mov dword [ebp - 0x418], 1
jmp 0x1004f40b
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
sub eax, dword [ebp - 0x140]
cmp eax, 0x7dd7d552
jl 0x1004f42a
mov dword [ebp - 0x4a4], 1
jmp 0x1004f431
and dword [ebp - 0x4a4], 0
xor eax, eax
add eax, 0x45329433
je 0x1004f443
cmp dword [ebp - 0xcc], 0
jne 0x1004f455
cmp dword [ebp - 0x140], 0
jne 0x1004f455
and dword [ebp - 0x354], 0
jmp 0x1004f45f
mov dword [ebp - 0x354], 1
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x254], eax
push 1
lea ecx, [ebp - 0x5d4]
call fcn.100171a5
mov ecx, dword [ebp - 0x254]
mov dword [eax], ecx
mov eax, dword [ebp - 0x254]
cmp eax, dword [ebp - 0x354]
je 0x1004f49a
mov dword [ebp - 0x25c], 1
jmp 0x1004f4a1
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x5d4]
call fcn.10017189
mov dword [ebp - 0x40], 0
jmp 0x1004f4d5
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1004f4eb
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x7e0], 0xade2167f
jmp 0x1004f4ce
mov dword [ebp - 0x40], 0
jmp 0x1004f4fb
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1004f517
push dword [ebp - 0x40]
lea ecx, [ebp - 0x728]
call fcn.100171a5
mov dword [eax], 1
jmp 0x1004f4f4
push 2
lea ecx, [ebp - 0x5ec]
call fcn.10017107
mov byte [ebp - 4], 7
mov dword [ebp - 0xc8], 0xfffffffb
mov dword [ebp - 0x118], 0
jmp 0x1004f54b
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 2
jge 0x1004f56d
push dword [ebp - 0x118]
lea ecx, [ebp - 0x5ec]
call fcn.100171a5
mov dword [eax], 0x5b57
jmp 0x1004f53e
mov dword [ebp - 0xc8], 0
jmp 0x1004f586
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jg 0x1004f62c
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x4ac], 0xef9d7865
mov dword [ebp - 0x144], 1
jmp 0x1004f5c0
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jl 0x1004f627
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x5ec]
call fcn.100171a5
cmp dword [eax], 0xcf09
je 0x1004f5ee
mov dword [ebp - 0x3d4], 1
jmp 0x1004f5f5
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x4ac], eax
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1004f625
push 0x7b8
push 0
push 0x238e
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x1004f5b3
jmp 0x1004f579
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x5ec]
call fcn.10017189
mov dword [ebp - 0x120], 0
jmp 0x1004f654
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffff
jle 0x10050be5
push 1
lea ecx, [ebp - 0x184]
call fcn.10017107
mov byte [ebp - 4], 8
mov dword [ebp - 0x1cc], 0xffffffff
push 4
lea ecx, [ebp - 0x410]
call fcn.10017107
mov byte [ebp - 4], 9
mov dword [ebp - 0x37c], 0xc4ce10b4
mov dword [ebp - 0x4f8], 0x5d8d3410
mov dword [ebp - 0x54], 0
jmp 0x1004f6b1
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x1004f6cd
push dword [ebp - 0x54]
lea ecx, [ebp - 0x184]
call fcn.100171a5
mov dword [eax], 7
jmp 0x1004f6aa
mov dword [ebp - 0x54], 0
jmp 0x1004f6dd
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x1004f6f9
push dword [ebp - 0x54]
lea ecx, [ebp - 0x410]
call fcn.100171a5
mov dword [eax], 0xffff
jmp 0x1004f6d6
push 0
lea ecx, [ebp - 0x184]
call fcn.100171a5
cmp dword [eax], 0
jne 0x1004f942
push 0
lea ecx, [ebp - 0x184]
call fcn.100171a5
cmp dword [eax], 0
jne 0x1004f7a6
push 0
lea ecx, [ebp - 0x184]
call fcn.100171a5
push 0
lea ecx, [ebp - 0x184]
call fcn.100171a5
push 0
lea ecx, [ebp - 0x184]
call fcn.100171a5
cmp dword [eax], 0x8cb6
jge 0x1004f760
mov dword [ebp - 0x264], 1
jmp 0x1004f767
and dword [ebp - 0x264], 0
push 0
lea ecx, [ebp - 0x184]
call fcn.100171a5
mov ecx, dword [ebp - 0x264]
cmp ecx, dword [eax]
jg 0x1004f78a
mov dword [ebp - 0x35c], 1
jmp 0x1004f791
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 0xfffa
jb 0x1004f7a6
and dword [ebp - 0x26c], 0
jmp 0x1004f7b0
mov dword [ebp - 0x26c], 1
push 0
lea ecx, [ebp - 0x184]
call fcn.100171a5
mov ecx, dword [ebp - 0x26c]
cmp ecx, dword [eax]
je 0x1004f7d3
mov dword [ebp - 0x438], 1
jmp 0x1004f7da
and dword [ebp - 0x438], 0
cmp dword [ebp - 0x438], 0x2c51
jl 0x1004f7f2
mov dword [ebp - 0x274], 1
jmp 0x1004f7f9
and dword [ebp - 0x274], 0
push 0
lea ecx, [ebp - 0x184]
call fcn.100171a5
mov ecx, dword [ebp - 0x274]
sub ecx, dword [eax]
cmp ecx, 0x4151
jle 0x1004f822
mov dword [ebp - 0x364], 1
jmp 0x1004f829
and dword [ebp - 0x364], 0
push 0
lea ecx, [ebp - 0x184]
call fcn.100171a5
mov ecx, dword [ebp - 0x364]
cmp ecx, dword [eax]
jle 0x1004f84c
mov dword [ebp - 0x27c], 1
jmp 0x1004f853
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x27c], eax
jne 0x1004f86d
mov dword [ebp - 0x3dc], 1
jmp 0x1004f874
and dword [ebp - 0x3dc], 0
push 1
lea ecx, [ebp - 0x410]
call fcn.100171a5
mov ecx, dword [ebp - 0x3dc]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x1cc]
jle 0x1004f89d
mov dword [ebp - 0x284], 1
jmp 0x1004f8a4
and dword [ebp - 0x284], 0
push 1
lea ecx, [ebp - 0x410]
call fcn.100171a5
mov ecx, dword [ebp - 0x284]
cmp ecx, dword [eax]
jne 0x1004f8c7
mov dword [ebp - 0x36c], 1
jmp 0x1004f8ce
and dword [ebp - 0x36c], 0
push 0
lea ecx, [ebp - 0x184]
call fcn.100171a5
mov ecx, dword [ebp - 0x36c]
cmp ecx, dword [eax]
je 0x1004f8f1
mov dword [ebp - 0x28c], 1
jmp 0x1004f8f8
and dword [ebp - 0x28c], 0
push 3
lea ecx, [ebp - 0x410]
call fcn.100171a5
mov ecx, dword [ebp - 0x28c]
cmp ecx, dword [eax]
jg 0x1004f91b
mov dword [ebp - 0x420], 1
jmp 0x1004f922
and dword [ebp - 0x420], 0
push 0
lea ecx, [ebp - 0x410]
call fcn.100171a5
mov ecx, dword [ebp - 0x420]
cmp ecx, dword [eax]
jne 0x1004f942
and dword [ebp - 0x294], 0
jmp 0x1004f94c
mov dword [ebp - 0x294], 1
cmp dword [ebp - 0x294], 0xc4185a1f
jb 0x1004f964
mov dword [ebp - 0x374], 1
jmp 0x1004f96b
and dword [ebp - 0x374], 0
cmp dword [ebp - 0x374], 0xa296
jge 0x1004f983
mov dword [ebp - 0x29c], 1
jmp 0x1004f98a
and dword [ebp - 0x29c], 0
cmp dword [ebp - 0x29c], 1
jl 0x1004f99f
mov dword [ebp - 0x3e4], 1
jmp 0x1004f9a6
and dword [ebp - 0x3e4], 0
push 0
lea ecx, [ebp - 0x184]
call fcn.100171a5
mov ecx, dword [ebp - 0x3e4]
cmp ecx, dword [eax]
je 0x1004f9c9
mov dword [ebp - 0x2a4], 1
jmp 0x1004f9d0
and dword [ebp - 0x2a4], 0
mov esi, dword [ebp - 0x2a4]
add esi, 0xa9
push 1
lea ecx, [ebp - 0x410]
call fcn.100171a5
imul esi, dword [eax]
sub esi, dword [ebp - 0x1cc]
mov dword [ebp - 0x37c], esi
mov esi, dword [ebp - 0x37c]
push 1
lea ecx, [ebp - 0x410]
call fcn.100171a5
cmp esi, dword [eax]
jne 0x1004fa1b
mov dword [ebp - 0x2ac], 1
jmp 0x1004fa22
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x4f8], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x410]
call fcn.10017189
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x184]
call fcn.10017189
mov dword [ebp - 0x694], 0xa756
mov dword [ebp - 0x5bc], 3
mov dword [ebp - 0x5b8], 3
mov dword [ebp - 0x5b4], 3
mov dword [ebp - 0x5b0], 3
lea ecx, [ebp - 0x1a9]
call fcn.10009433
push eax
lea eax, [ebp - 0x5ac]
push eax
lea eax, [ebp - 0x5bc]
push eax
lea ecx, [ebp - 0x7f8]
call fcn.100171b4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7a4]
call fcn.10017163
mov dword [ebp - 0x14c], 0x9000d4e7
mov dword [ebp - 0x14c], 3
jmp 0x1004fad6
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jl 0x1004fb03
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x1004fb01
push 0
push 0
push 0x436
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1004fac9
lea ecx, [ebp - 0x7a4]
call fcn.10017189
mov dword [ebp - 0x69c], 1
mov dword [ebp - 0x6a4], 1
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1004fb44
push 0x22b3
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 0x73], 0
movzx eax, byte [ebp - 0x73]
test eax, eax
je 0x1004fb58
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [ebp - 0x6ac], 2
mov dword [ebp - 0x6b4], 9
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x128], 9
mov dword [ebp - 0x74c], 7
mov dword [ebp - 0x6b8], 4
mov dword [ebp - 0x6c0], 0xffffffff
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x778], 0xc660f7e7
mov dword [ebp - 0x780], 0x711e7bff
mov dword [ebp - 0x788], 0xfffffffb
mov dword [ebp - 0x790], 0x9a278c00
mov dword [ebp - 0x48], 0
jmp 0x1004fbe0
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1004fbf6
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x808], 0x89f42c60
jmp 0x1004fbd9
mov dword [ebp - 0x48], 0
jmp 0x1004fc06
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1004fc1c
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x814], 0x5f4e
jmp 0x1004fbff
mov dword [ebp - 0x128], 0
jmp 0x1004fc35
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xf
jg 0x1004fd1a
mov dword [ebp - 0x798], 0x7a3a
mov dword [ebp - 0x5a8], 0xa912
mov dword [ebp - 0x5a4], 0xa912
mov dword [ebp - 0x5a0], 0xa912
mov dword [ebp - 0x59c], 0xa912
lea ecx, [ebp - 0x19d]
call fcn.10009433
push eax
lea eax, [ebp - 0x598]
push eax
lea eax, [ebp - 0x5a8]
push eax
lea ecx, [ebp - 0x7f0]
call fcn.100171b4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x718]
call fcn.10017163
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x154], 0
jmp 0x1004fcc6
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x1004fce2
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x800], 0x1ad67a4b
jmp 0x1004fcb9
push 0
lea ecx, [ebp - 0x718]
call fcn.100171a5
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x448]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x448]
mov dword [ecx], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x718]
call fcn.10017189
jmp 0x1004fc28
mov dword [ebp - 0x130], 0
jmp 0x1004fd33
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 3
jge 0x1004fd4f
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x82c], 5
jmp 0x1004fd26
push 3
lea ecx, [ebp - 0x1e4]
call fcn.10017107
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x160], 0
jmp 0x1004fd8a
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jge 0x1004fdac
push dword [ebp - 0x160]
lea ecx, [ebp - 0x1e4]
call fcn.100171a5
mov dword [eax], 0x2fd41e55
jmp 0x1004fd7d
mov dword [ebp - 0x24], 0
jmp 0x1004fdbc
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x1004ff80
mov dword [ebp - 0xa8], 0x5c62e089
mov dword [ebp - 0x384], 0xffffffff
mov dword [ebp - 0xa8], 0
jmp 0x1004fdf3
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jg 0x1004fe43
mov dword [ebp - 0xc4], 0x5ed9a924
mov dword [ebp - 0xc4], 0
jmp 0x1004fe1f
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x1004fe41
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x1e4]
call fcn.100171a5
mov dword [eax], 0x11151c
jmp 0x1004fe12
jmp 0x1004fde6
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1e4]
call fcn.100171a5
cmp dword [eax], 0
jne 0x1004fe62
mov dword [ebp - 0x2b4], 1
jmp 0x1004fe69
and dword [ebp - 0x2b4], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1e4]
call fcn.100171a5
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2b4]
je 0x1004fe8d
mov dword [ebp - 0x2bc], 1
jmp 0x1004fe94
and dword [ebp - 0x2bc], 0
mov dword [ebp - 0x384], 1
mov eax, dword [ebp - 0x384]
sub eax, 0x856d
jne 0x1004feb7
xor eax, eax
inc eax
jne 0x1004feb7
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x1004fecc
mov eax, 0xfffa
test eax, eax
je 0x1004fecc
mov dword [ebp - 0x3ec], 1
jmp 0x1004fed3
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x2bc]
cmp eax, dword [ebp - 0x3ec]
jle 0x1004feed
mov dword [ebp - 0x2c4], 1
jmp 0x1004fef4
and dword [ebp - 0x2c4], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1e4]
call fcn.100171a5
mov eax, dword [eax]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x2c4]
jle 0x1004ff26
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1e4]
call fcn.100171a5
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1e4]
call fcn.100171a5
mov esi, eax
push 2
lea ecx, [ebp - 0x1e4]
call fcn.100171a5
mov edi, eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1e4]
call fcn.100171a5
mov ecx, dword [edi]
imul ecx, dword [eax]
cmp dword [esi], ecx
jl 0x1004ff68
mov dword [ebp - 0x38c], 1
jmp 0x1004ff6f
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x528], eax
jmp 0x1004fdb5
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1e4]
call fcn.10017189
mov byte [ebp - 0x8d], 0
mov dword [ebp - 0x168], 0xffffffff
mov dword [ebp - 0x764], 0xa927213e
mov dword [ebp - 0x6bc], 0x7d50f82b
mov dword [ebp - 0x640], 0x9edca8fe
mov dword [ebp - 0x768], 1
mov dword [ebp - 0x508], 0xffffffff
mov dword [ebp - 0x138], 0x515466bc
mov dword [ebp - 0x510], 0xb6f9b691
mov dword [ebp - 0x1a8], 8
push 1
lea ecx, [ebp - 0x4bc]
call fcn.10017107
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xd4], 0x4668
mov dword [ebp - 0x520], 0x67d
mov dword [ebp - 0x28], 0
jmp 0x10050025
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1005003b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x470], 3
jmp 0x1005001e
mov dword [ebp - 0x28], 0
jmp 0x1005004b
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x10050067
push dword [ebp - 0x28]
lea ecx, [ebp - 0x4bc]
call fcn.100171a5
mov dword [eax], 0xf7c2f5a2
jmp 0x10050044
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x478], 0xfffffffb
jl 0x10050095
mov dword [ebp - 0x428], 1
jmp 0x1005009c
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd4]
dec ecx
mov dword [ebp - 0xd4], ecx
test eax, eax
je 0x100501c4
push 0
lea ecx, [ebp - 0x4bc]
call fcn.100171a5
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x648], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x470], 0
jg 0x100500ec
mov dword [ebp - 0x1c8], 1
jmp 0x100500f3
and dword [ebp - 0x1c8], 0
push 0
lea ecx, [ebp - 0x4bc]
call fcn.100171a5
mov ecx, dword [ebp - 0x1c8]
mov dword [eax], ecx
cmp dword [ebp - 0x1c8], 0
jne 0x1005011f
xor eax, eax
inc eax
jne 0x1005011f
and dword [ebp - 0x480], 0
jmp 0x10050129
mov dword [ebp - 0x480], 1
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x770], eax
push 0
lea ecx, [ebp - 0x4bc]
call fcn.100171a5
cmp dword [eax], 0
jne 0x10050171
cmp dword [ebp - 0xd4], 0
jne 0x10050171
and dword [ebp - 0x2cc], 0
jmp 0x1005017b
mov dword [ebp - 0x2cc], 1
mov eax, dword [ebp - 0x2cc]
sub eax, dword [ebp - 0x168]
je 0x1005019e
cmp dword [ebp - 0x138], 0
je 0x1005019e
mov dword [ebp - 0x488], 1
jmp 0x100501a5
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x658], eax
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x100501c4
mov dword [ebp - 0x2d4], 1
jmp 0x100501cb
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x428]
add eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x138]
jne 0x100501eb
mov dword [ebp - 0x394], 1
jmp 0x100501f2
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x394], eax
je 0x1005020c
mov dword [ebp - 0x2dc], 1
jmp 0x10050213
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x168]
imul eax, dword [ebp - 0x2dc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x470]
jl 0x1005023b
mov dword [ebp - 0x3f4], 1
jmp 0x10050242
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
shl eax, 2
cmp eax, 0xffffffff
je 0x10050261
or eax, 0xffffffff
je 0x10050261
mov dword [ebp - 0x2e4], 1
jmp 0x10050268
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x168]
add eax, dword [ebp - 0x2e4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x470]
jne 0x1005028f
mov dword [ebp - 0x39c], 1
jmp 0x10050296
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x168], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x4bc]
call fcn.10017189
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x10050a0e
mov dword [ebp - 0x8c], 0xc74a
mov dword [ebp - 0x60], 0xffffffff
push 2
lea ecx, [ebp - 0xec]
call fcn.10017107
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x14], 0xd9cd4431
mov dword [ebp - 0x1ec], 0x762969fb
mov dword [ebp - 0x1c0], 0x8a1b
mov dword [ebp - 0x240], 0xfffffffa
mov dword [ebp - 0x4a0], 1
mov dword [ebp - 0xf0], 0
jmp 0x1005032a
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jge 0x1005034c
push dword [ebp - 0xf0]
lea ecx, [ebp - 0xec]
call fcn.100171a5
mov dword [eax], 0xfa51669
jmp 0x1005031d
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x1005036b
push 0
push 0
push 0x1b4c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, 0xffffc794
test eax, eax
je 0x10050411
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xf47a6dee
jae 0x10050396
mov dword [ebp - 0x1b0], 1
jmp 0x1005039d
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x8c]
add eax, 3
cmp eax, dword [ebp - 0x8c]
jge 0x100503ba
mov dword [ebp - 0x2ec], 1
jmp 0x100503c1
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x8c]
sub eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x8c]
test eax, eax
jne 0x100503e2
cmp dword [ebp - 0x14], 0
push 1
lea ecx, [ebp - 0xec]
call fcn.100171a5
mov ecx, dword [ebp - 0x1b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1b0]
sub eax, dword [ebp - 0x8c]
je 0x10050411
mov dword [ebp - 0x440], 1
jmp 0x10050418
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
add eax, 0x5fe8887
jne 0x1005043b
push 1
lea ecx, [ebp - 0xec]
call fcn.100171a5
cmp dword [eax], 0
je 0x10050617
mov dword [ebp - 0xd0], 5
mov dword [ebp - 0x530], 0xffffffff
mov dword [ebp - 0x314], 0
push 2
lea ecx, [ebp - 0x604]
call fcn.10017107
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x170], 0
jmp 0x10050483
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x100504a5
push dword [ebp - 0x170]
lea ecx, [ebp - 0x604]
call fcn.100171a5
mov dword [eax], 0x767dbf12
jmp 0x10050476
mov eax, dword [ebp - 0xd0]
neg eax
jne 0x100505f1
cmp dword [ebp - 0xd0], 0
je 0x10050558
cmp dword [ebp - 0xd0], 0xffffffff
jne 0x100504d5
mov dword [ebp - 0x2f4], 1
jmp 0x100504dc
and dword [ebp - 0x2f4], 0
imul eax, dword [ebp - 0x2f4], 9
cmp eax, dword [ebp - 0x60]
jne 0x100504f4
mov dword [ebp - 0x3a4], 1
jmp 0x100504fb
and dword [ebp - 0x3a4], 0
cmp dword [ebp - 0x3a4], 0xe2499e68
je 0x10050513
mov dword [ebp - 0x2fc], 1
jmp 0x1005051a
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x2fc], eax
je 0x10050534
mov dword [ebp - 0x3fc], 1
jmp 0x1005053b
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0xd0]
imul eax, dword [ebp - 0x3fc]
test eax, eax
je 0x10050558
mov dword [ebp - 0x490], 1
jmp 0x1005055f
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x60], 0xffff
jb 0x10050574
mov dword [ebp - 0x304], 1
jmp 0x1005057b
and dword [ebp - 0x304], 0
cmp dword [ebp - 0x304], 0x89d68482
jae 0x10050593
mov dword [ebp - 0x3ac], 1
jmp 0x1005059a
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x530]
cmp dword [ebp - 0x3ac], eax
jl 0x100505b4
mov dword [ebp - 0x30c], 1
jmp 0x100505bb
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x30c], eax
jne 0x100505d5
mov dword [ebp - 0x430], 1
jmp 0x100505dc
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x314], eax
mov esi, dword [ebp - 0x60]
push 1
lea ecx, [ebp - 0x604]
call fcn.100171a5
mov dword [eax], esi
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x604]
call fcn.10017189
jmp 0x100509f5
mov dword [ebp - 0x94], 8
mov dword [ebp - 0x148], 0x1b5b3a04
mov dword [ebp - 0x230], 0x25a44896
mov dword [ebp - 0x2c], 0
jmp 0x10050645
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1005065b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7bc], 1
jmp 0x1005063e
mov dword [ebp - 0x2c], 0
jmp 0x1005066b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10050681
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7b0], 0xec372b4d
jmp 0x10050664
mov dword [ebp - 0x14], 0
jmp 0x10050691
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x100509f5
mov dword [ebp - 0x238], 0x373e763f
mov esi, dword [ebp - 0x94]
push dword [ebp - 0x14]
lea ecx, [ebp - 0xec]
call fcn.100171a5
cmp esi, dword [eax]
jg 0x100506c9
mov dword [ebp - 0x3b4], 1
jmp 0x100506d0
and dword [ebp - 0x3b4], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xec]
call fcn.100171a5
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3b4]
jne 0x100506f4
mov dword [ebp - 0x31c], 1
jmp 0x100506fb
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x31c], eax
jle 0x1005087c
push dword [ebp - 0x14]
lea ecx, [ebp - 0xec]
call fcn.100171a5
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x5834d56b
jne 0x10050740
mov dword [ebp - 0x1f0], 1
jmp 0x10050747
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x1f0], eax
jg 0x10050761
mov dword [ebp - 0x1f8], 1
jmp 0x10050768
and dword [ebp - 0x1f8], 0
cmp dword [ebp - 0x1f8], 6
jne 0x1005077d
mov dword [ebp - 0x200], 1
jmp 0x10050784
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x200], eax
jg 0x1005079b
mov dword [ebp - 0x208], 1
jmp 0x100507a2
and dword [ebp - 0x208], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xec]
call fcn.100171a5
mov ecx, dword [ebp - 0x208]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x94]
jge 0x100507d2
mov eax, 0x3e26
test eax, eax
jne 0x100507d2
and dword [ebp - 0x210], 0
jmp 0x100507dc
mov dword [ebp - 0x210], 1
cmp dword [ebp - 0x210], 0xb3df
jge 0x100507f4
mov dword [ebp - 0x218], 1
jmp 0x100507fb
and dword [ebp - 0x218], 0
imul eax, dword [ebp - 0x218], 6
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
je 0x10050830
push dword [ebp - 0x14]
lea ecx, [ebp - 0xec]
call fcn.100171a5
cmp dword [eax], 0
je 0x10050830
mov dword [ebp - 0x498], 1
jmp 0x10050837
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x6ec], eax
cmp dword [ebp - 0x240], 0
je 0x1005085c
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1005085c
mov dword [ebp - 0x220], 1
jmp 0x10050863
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
neg eax
cmp eax, 0xffffffff
jg 0x1005087c
mov dword [ebp - 0x4f4], 1
jmp 0x10050883
and dword [ebp - 0x4f4], 0
push 1
lea ecx, [ebp - 0xec]
call fcn.100171a5
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x660], eax
push 1
lea ecx, [ebp - 0xec]
call fcn.100171a5
mov esi, eax
push 0
lea ecx, [ebp - 0xec]
call fcn.100171a5
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x148], eax
je 0x100508ee
mov dword [ebp - 0x228], 1
jmp 0x100508f5
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jne 0x10050931
mov eax, 0x13c5
test eax, eax
jne 0x10050931
cmp dword [ebp - 0x240], 0
jne 0x10050931
and dword [ebp - 0x248], 0
jmp 0x1005093b
mov dword [ebp - 0x248], 1
push dword [ebp - 0x14]
lea ecx, [ebp - 0xec]
call fcn.100171a5
mov eax, dword [eax]
cmp eax, dword [ebp - 0x248]
jl 0x1005095f
mov dword [ebp - 0x250], 1
jmp 0x10050966
and dword [ebp - 0x250], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xec]
call fcn.100171a5
mov esi, eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0xec]
call fcn.100171a5
mov eax, dword [eax]
imul eax, dword [ebp - 0x250]
sub eax, dword [ebp - 0x94]
cmp dword [esi], eax
jge 0x100509a3
mov dword [ebp - 0x1e8], 1
jmp 0x100509aa
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x1e8], eax
jge 0x100509c4
mov dword [ebp - 0x1b8], 1
jmp 0x100509cb
and dword [ebp - 0x1b8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1b8]
mov dword [ebp + eax - 0x7bc], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b8]
mov dword [ebp + eax - 0x7b0], ecx
jmp 0x1005068a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xec]
call fcn.10017189
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x6c], 0xfcf33f23
mov dword [ebp - 0x150], 0xb9e9d60a
mov dword [ebp - 0x4a8], 0xffffffff
push 1
lea ecx, [ebp - 0x61c]
call fcn.10017107
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x164], 0
jmp 0x10050a5a
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x10050a7c
push dword [ebp - 0x164]
lea ecx, [ebp - 0x61c]
call fcn.100171a5
mov dword [eax], 0xfffffff8
jmp 0x10050a4d
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x64], 0
je 0x10050aa0
mov eax, 0x5d9b
test eax, eax
je 0x10050aa0
mov dword [ebp - 0x260], 1
jmp 0x10050aa7
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xe973
je 0x10050ad2
mov dword [ebp - 0x4fc], 1
jmp 0x10050ad9
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x260], eax
jl 0x10050af3
mov dword [ebp - 0x268], 1
jmp 0x10050afa
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x268]
cmp eax, dword [ebp - 0x64]
jle 0x10050b14
mov dword [ebp - 0x270], 1
jmp 0x10050b1b
and dword [ebp - 0x270], 0
cmp dword [ebp - 0x270], 0x5f88
jl 0x10050b33
mov dword [ebp - 0x278], 1
jmp 0x10050b3a
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x278], eax
jle 0x10050b51
mov dword [ebp - 0x280], 1
jmp 0x10050b58
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x280]
jne 0x10050b6a
cmp dword [ebp - 0x150], 0
cmp dword [ebp - 0x6c], 0
jne 0x10050b82
mov eax, 0x6038
test eax, eax
jne 0x10050b82
and dword [ebp - 0x288], 0
jmp 0x10050b8c
mov dword [ebp - 0x288], 1
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x6c], 0
jmp 0x10050ba8
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x10050bc4
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x61c]
call fcn.100171a5
mov dword [eax], 0xfffffff8
jmp 0x10050ba1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x61c]
call fcn.10017189
mov eax, dword [ebp - 0x290]
dec eax
mov dword [ebp - 0x290], eax
jmp 0x1004f647
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x728]
call fcn.10017189
mov byte [ebp - 0x7f], 0
movzx eax, byte [ebp - 0x7f]
test eax, eax
je 0x1005218b
push 2
lea ecx, [ebp - 0x738]
call fcn.10017107
mov dword [ebp - 4], 0x10
push 1
lea ecx, [ebp - 0x4dc]
call fcn.10017107
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x18], 0
jmp 0x10050c39
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10050c55
push dword [ebp - 0x18]
lea ecx, [ebp - 0x738]
call fcn.100171a5
mov dword [eax], 1
jmp 0x10050c32
mov dword [ebp - 0x18], 0
jmp 0x10050c65
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10050c81
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4dc]
call fcn.100171a5
mov dword [eax], 0xfb871c7b
jmp 0x10050c5e
mov dword [ebp - 0x18], 0
jmp 0x10050c91
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10050ca7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7c8], 0xffffffff
jmp 0x10050c8a
push 0
lea ecx, [ebp - 0x4dc]
call fcn.100171a5
mov dword [eax], 1
jmp 0x10050ce0
push 0
lea ecx, [ebp - 0x4dc]
call fcn.100171a5
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x298]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x4dc]
call fcn.100171a5
cmp dword [eax], 0
jl 0x10050df1
mov dword [ebp - 0xf8], 0x2086bd08
mov dword [ebp - 0x174], 0
jmp 0x10050d19
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x10050d35
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x4cc], 0xfffffffb
jmp 0x10050d0c
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x4cc], 0
jmp 0x10050d60
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x4cc]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x4cc], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4cc], 1
jg 0x10050d9a
mov byte [ebp - 0x77], 0
movzx eax, byte [ebp - 0x77]
test eax, eax
je 0x10050d98
push 0
push 0
push 0
push 0
push 0x1c0c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10050d47
mov dword [ebp - 0xf8], 1
jmp 0x10050db3
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jl 0x10050dec
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x4cc], 0xfffffff9
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x10050dea
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
jmp 0x10050da6
jmp 0x10050cbc
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x7c8], 0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x4dc]
call fcn.10017189
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x738]
call fcn.10017189
mov dword [ebp - 0x638], 0xfffffff9
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x10050e40
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x10050e5a
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x20], 0xfffffffe
push 2
lea ecx, [ebp - 0xe0]
call fcn.10017107
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xf4], 0
jmp 0x10050e8e
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x10050eb0
push dword [ebp - 0xf4]
lea ecx, [ebp - 0xe0]
call fcn.100171a5
mov dword [eax], 0x89b54615
jmp 0x10050e81
mov dword [ebp - 0x20], 0xfffffff7
jmp 0x10050ec0
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xd
je 0x10051213
push 3
lea ecx, [ebp - 0x190]
call fcn.10017107
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x2d0], 1
mov dword [ebp - 0x104], 0x64ea33a4
push 2
lea ecx, [ebp - 0x634]
call fcn.10017107
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x34], 0
jmp 0x10050f10
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10050f2c
push dword [ebp - 0x34]
lea ecx, [ebp - 0x190]
call fcn.100171a5
mov dword [eax], 0xfffffffa
jmp 0x10050f09
mov dword [ebp - 0x34], 0
jmp 0x10050f3c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10050f58
push dword [ebp - 0x34]
lea ecx, [ebp - 0x634]
call fcn.100171a5
mov dword [eax], 0xfffffffd
jmp 0x10050f35
push 0
lea ecx, [ebp - 0x190]
call fcn.100171a5
and dword [eax], 0
jmp 0x10050f8e
push 0
lea ecx, [ebp - 0x190]
call fcn.100171a5
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2a0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x190]
call fcn.100171a5
cmp dword [eax], 1
jg 0x100511d5
mov dword [ebp - 0x2b0], 0xe11a796d
mov dword [ebp - 0x504], 1
push 0
lea ecx, [ebp - 0x190]
call fcn.100171a5
push dword [eax]
lea ecx, [ebp - 0xe0]
call fcn.100171a5
push 2
pop eax
test eax, eax
je 0x1005108f
push 0
lea ecx, [ebp - 0x190]
call fcn.100171a5
push dword [eax]
lea ecx, [ebp - 0xe0]
call fcn.100171a5
mov ecx, dword [ebp - 0x104]
cmp dword [eax], ecx
jle 0x1005100d
mov dword [ebp - 0x2a8], 1
jmp 0x10051014
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x2b0], eax
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x104]
push 2
lea ecx, [ebp - 0x190]
call fcn.100171a5
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x190]
call fcn.100171a5
push dword [eax]
lea ecx, [ebp - 0xe0]
call fcn.100171a5
cmp esi, dword [eax]
jne 0x10051065
mov dword [ebp - 0x2b8], 1
jmp 0x1005106c
and dword [ebp - 0x2b8], 0
push 2
lea ecx, [ebp - 0x190]
call fcn.100171a5
mov ecx, dword [ebp - 0x2b8]
cmp ecx, dword [eax]
jne 0x1005108f
mov dword [ebp - 0x2c0], 1
jmp 0x10051096
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2c0], eax
jl 0x100510ad
mov dword [ebp - 0x2c8], 1
jmp 0x100510b4
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x76c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x678], eax
push 0
lea ecx, [ebp - 0x190]
call fcn.100171a5
mov esi, dword [ebp - 0x2d0]
push 0
lea ecx, [ebp - 0xe0]
call fcn.100171a5
sub esi, dword [eax]
cmp esi, 0xb5c6eff3
jb 0x10051117
mov dword [ebp - 0x2d8], 1
jmp 0x1005111e
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2d8], eax
jge 0x10051135
mov dword [ebp - 0x2e0], 1
jmp 0x1005113c
and dword [ebp - 0x2e0], 0
push 1
lea ecx, [ebp - 0xe0]
call fcn.100171a5
mov ecx, dword [ebp - 0x2e0]
cmp ecx, dword [eax]
jle 0x1005115f
mov dword [ebp - 0x2e8], 1
jmp 0x10051166
and dword [ebp - 0x2e8], 0
push 0
lea ecx, [ebp - 0x634]
call fcn.100171a5
mov ecx, dword [ebp - 0x2e8]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x190]
call fcn.100171a5
cmp dword [eax], 0
jne 0x10051199
mov dword [ebp - 0x2f0], 1
jmp 0x100511a0
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x504], eax
push 0
lea ecx, [ebp - 0x190]
call fcn.100171a5
push dword [eax]
lea ecx, [ebp - 0xe0]
call fcn.100171a5
cmp dword [eax], 0
je 0x100511d0
jmp 0x10050f6a
jmp 0x10050f6a
mov byte [ebp - 0x7b], 0
movzx eax, byte [ebp - 0x7b]
test eax, eax
je 0x100511f0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x634]
call fcn.10017189
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x190]
call fcn.10017189
jmp 0x10050eb9
mov dword [ebp - 0x20], 1
jmp 0x10051223
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1005148d
mov dword [ebp - 0x318], 0x93dcedb1
mov dword [ebp - 0x320], 0xfffffff6
mov dword [ebp - 0x10c], 0
jmp 0x1005125a
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 4
jge 0x10051276
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x464], 5
jmp 0x1005124d
mov byte [ebp - 0x6e], 0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x1005128c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x464], 0
jmp 0x100512ba
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x464]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x464], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x464], 1
jg 0x10051488
mov dword [ebp - 0x4b0], 0x512e
mov dword [ebp - 0x4c0], 0
mov byte [ebp - 0x70], 0
movzx eax, byte [ebp - 0x70]
test eax, eax
je 0x10051301
push 0
push 0
push 0x1b4c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0
lea ecx, [ebp - 0xe0]
call fcn.100171a5
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp + eax - 0x464]
push 0
lea ecx, [ebp - 0xe0]
call fcn.100171a5
cmp esi, dword [eax]
jl 0x10051338
mov dword [ebp - 0x2f8], 1
jmp 0x1005133f
and dword [ebp - 0x2f8], 0
cmp dword [ebp - 0x2f8], 5
jbe 0x10051354
mov dword [ebp - 0x300], 1
jmp 0x1005135b
and dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 0xffe61709
jne 0x10051379
mov eax, 0x4f8a3d35
test eax, eax
jne 0x10051379
and dword [ebp - 0x308], 0
jmp 0x10051383
mov dword [ebp - 0x308], 1
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x464]
lea ecx, [ebp - 0xe0]
call fcn.100171a5
mov eax, dword [eax]
imul eax, dword [ebp - 0x308]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x464]
cmp eax, dword [ebp - 0x4b0]
je 0x100513c4
mov dword [ebp - 0x310], 1
jmp 0x100513cb
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x310]
add eax, 0x270bb1dc
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x320], eax
mov esi, dword [ebp - 0x320]
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x464]
lea ecx, [ebp - 0xe0]
call fcn.100171a5
cmp esi, dword [eax]
je 0x10051416
mov dword [ebp - 0x50c], 1
jmp 0x1005141d
and dword [ebp - 0x50c], 0
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x464]
lea ecx, [ebp - 0xe0]
call fcn.100171a5
push 0
lea ecx, [ebp - 0xe0]
call fcn.100171a5
cmp dword [eax], 0
je 0x10051470
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x464]
lea ecx, [ebp - 0xe0]
call fcn.100171a5
cmp dword [eax], 0
je 0x10051470
mov dword [ebp - 0x328], 1
jmp 0x10051477
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x4c0], eax
jmp 0x1005129f
jmp 0x1005121c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0]
call fcn.10017189
mov dword [ebp - 0xbc], 0xfb871c7b
mov dword [ebp - 0xb4], 0xd149febb
mov dword [ebp - 0x338], 0xfffffff7
mov dword [ebp - 0x348], 0x30f888c5
mov dword [ebp - 0x114], 0
jmp 0x100514dd
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x100514f9
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x9c], 0x2beaa32b
jmp 0x100514d0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb4], 0x12
jmp 0x10051525
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xa
jl 0x10051750
push 2
lea ecx, [ebp - 0x4ec]
call fcn.10017107
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x580], 0x21fbb9
mov dword [ebp - 0x57c], 0x21fbb9
mov dword [ebp - 0x578], 0x21fbb9
mov dword [ebp - 0x574], 0x21fbb9
lea ecx, [ebp - 0x1b1]
call fcn.10009433
push eax
lea eax, [ebp - 0x570]
push eax
lea eax, [ebp - 0x580]
push eax
lea ecx, [ebp - 0x7d8]
call fcn.100171b4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5c8]
call fcn.10017163
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x11c], 0
jmp 0x100515c0
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jge 0x100515e2
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x4ec]
call fcn.100171a5
mov dword [eax], 0xfffffffa
jmp 0x100515b3
push 1
lea ecx, [ebp - 0x4ec]
call fcn.100171a5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp - 0x70c], eax
push 0
lea ecx, [ebp - 0x4ec]
call fcn.100171a5
cmp dword [eax], 0xff60
jge 0x10051623
mov dword [ebp - 0x514], 1
jmp 0x1005162a
and dword [ebp - 0x514], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp - 0x680], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp - 0x784], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x9c]
cmp dword [ebp + eax - 0x9c], ecx
jne 0x10051678
mov dword [ebp - 0x1a4], 1
jmp 0x1005167f
and dword [ebp - 0x1a4], 0
push 2
lea ecx, [ebp - 0x5c8]
call fcn.100171a5
mov ecx, dword [ebp - 0x1a4]
mov dword [eax], ecx
cmp dword [ebp - 0x1a4], 0xfffffffb
jbe 0x100516a9
mov dword [ebp - 0x330], 1
jmp 0x100516b0
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x330]
sub eax, 0xffff
imul eax, eax, 7
mov esi, dword [ebp - 0x338]
imul esi, eax
push 1
lea ecx, [ebp - 0x4ec]
call fcn.100171a5
cmp dword [eax], esi
jge 0x100516f0
mov dword [ebp - 0x340], 1
jmp 0x100516f7
and dword [ebp - 0x340], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
sub eax, 0x105bd4b8
imul eax, dword [ebp - 0x340]
mov dword [ebp - 0x348], eax
push 2
lea ecx, [ebp - 0x5c8]
call fcn.100171a5
mov dword [ebp - 0x348], 0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x5c8]
call fcn.10017189
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4ec]
call fcn.10017189
jmp 0x10051518
mov dword [ebp - 0xb0], 0x5c82f744
mov dword [ebp - 0x12c], 0x25b9b55b
push 2
lea ecx, [ebp - 0x540]
call fcn.10017107
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x124], 0
jmp 0x10051791
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jge 0x100517b0
push dword [ebp - 0x124]
lea ecx, [ebp - 0x540]
call fcn.100171a5
or dword [eax], 0xffffffff
jmp 0x10051784
mov dword [ebp - 0x12c], 0x10
jmp 0x100517c9
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xfffffff2
jle 0x100518b0
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x3c], 0
jmp 0x100517ed
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x1005187f
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 0x134], 1
jmp 0x1005181a
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jl 0x1005183b
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp - 0x72]
test eax, eax
je 0x10051839
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
jmp 0x1005180d
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x540]
call fcn.100171a5
mov ecx, 0x1a17e59
sub ecx, dword [eax]
je 0x10051868
push 0
lea ecx, [ebp - 0x540]
call fcn.100171a5
cmp dword [eax], 0
je 0x10051866
jmp 0x1005187f
jmp 0x1005187a
mov byte [ebp - 0x74], 0
movzx eax, byte [ebp - 0x74]
test eax, eax
je 0x1005187a
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
jmp 0x100517e6
mov dword [ebp - 0x3c], 0
jmp 0x1005188f
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x100518ab
mov byte [ebp - 0x76], 0
movzx eax, byte [ebp - 0x76]
test eax, eax
je 0x100518a9
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x10051888
jmp 0x100517bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x540]
call fcn.10017189
mov dword [ebp - 0x524], 0xfffffff8
mov dword [ebp - 0x688], 0xfffffffb
mov dword [ebp - 0x71c], 0xffffffff
mov dword [ebp - 0x690], 5
mov dword [ebp - 0x774], 0x364f2ca1
mov dword [ebp - 0x698], 0xfffffff8
mov dword [ebp - 0x72c], 0xe85dc32c
mov dword [ebp - 0x6a0], 0xffffffff
push 2
lea ecx, [ebp - 0x758]
call fcn.10017107
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x44], 0
jmp 0x10051933
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x10051949
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x610], 0x64a6847d
jmp 0x1005192c
mov dword [ebp - 0x44], 0
jmp 0x10051959
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10051975
push dword [ebp - 0x44]
lea ecx, [ebp - 0x758]
call fcn.100171a5
mov dword [eax], 0x49f7fae0
jmp 0x10051952
mov byte [ebp - 0x78], 0
movzx eax, byte [ebp - 0x78]
test eax, eax
je 0x10051997
push 0
push 0
push 0x1c44
push 0x7b9
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
mov dword [ebp - 0xbc], 2
jmp 0x100519b0
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x10051cb7
mov dword [ebp - 0x68], 0x443250e6
mov dword [ebp - 0x56c], 0x924f
mov dword [ebp - 0x568], 0x924f
mov dword [ebp - 0x564], 0x924f
mov dword [ebp - 0x560], 0x924f
push 4
lea ecx, [ebp - 0x748]
call fcn.10017107
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x794], 9
mov dword [ebp - 0x13c], 0
jmp 0x10051a20
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 4
jge 0x10051a42
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x748]
call fcn.100171a5
mov dword [eax], 7
jmp 0x10051a13
mov dword [ebp - 0x68], 0
jmp 0x10051a52
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jg 0x10051bdb
mov dword [ebp - 0xa4], 0x39ecf4a
mov dword [ebp - 0x4e0], 0xed55c59c
cmp dword [ebp - 0xa4], 0
je 0x10051a84
push 5
pop eax
test eax, eax
jne 0x10051b30
mov eax, dword [ebp - 0xbc]
add eax, dword [ebp - 0xbc]
cmp eax, 0xe224
je 0x10051aa3
mov dword [ebp - 0x350], 1
jmp 0x10051aaa
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x350]
jl 0x10051ac1
mov dword [ebp - 0x4d0], 1
jmp 0x10051ac8
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0xa4]
cmp eax, 0xf8609561
jb 0x10051af9
cmp dword [ebp - 0xa4], 0
jne 0x10051af9
and dword [ebp - 0x358], 0
jmp 0x10051b03
mov dword [ebp - 0x358], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x56c]
cmp dword [ebp - 0x358], eax
jl 0x10051b27
cmp dword [ebp - 0x68], 0
jne 0x10051b27
cmp dword [ebp - 0xa4], 0
jne 0x10051b30
and dword [ebp - 0x360], 0
jmp 0x10051b3a
mov dword [ebp - 0x360], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x56c]
cmp dword [ebp - 0x360], eax
jg 0x10051b5b
mov dword [ebp - 0x51c], 1
jmp 0x10051b62
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x610]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x368]
mov dword [ebp + eax*4 - 0x610], ecx
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x368], eax
jg 0x10051b9c
mov dword [ebp - 0x370], 1
jmp 0x10051ba3
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
sub eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x4e0]
jge 0x10051bc3
mov dword [ebp - 0x378], 1
jmp 0x10051bca
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x524], eax
jmp 0x10051a4b
mov dword [ebp - 0xb0], 2
jmp 0x10051bf4
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x10051ca3
push 1
lea ecx, [ebp - 0x5f8]
call fcn.10017107
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x73c], 0
mov dword [ebp - 0x380], 0
mov dword [ebp - 0x178], 0
jmp 0x10051c3f
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x10051c61
push dword [ebp - 0x178]
lea ecx, [ebp - 0x5f8]
call fcn.100171a5
mov dword [eax], 0xb9cbadbe
jmp 0x10051c32
mov eax, dword [ebp - 0xb0]
cmp dword [ebp + eax*4 - 0x610], 0
je 0x10051c82
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x5f8]
call fcn.10017189
jmp 0x10051ca3
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x5f8]
call fcn.10017189
jmp 0x10051be7
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x748]
call fcn.10017189
jmp 0x100519a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x758]
call fcn.10017189
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x518], 0
push 3
lea ecx, [ebp - 0x54c]
call fcn.10017107
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x500], 0xffff
mov dword [ebp - 0x16c], 0
jmp 0x10051d0e
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x10051d2d
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x54c]
call fcn.100171a5
and dword [eax], 0
jmp 0x10051d01
mov dword [ebp - 0x10], 0x18
jmp 0x10051d3d
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x15
jl 0x10052172
push 1
lea ecx, [ebp - 0x1d8]
call fcn.10017107
mov byte [ebp - 4], 0x1c
push 3
lea ecx, [ebp - 0x19c]
call fcn.10017107
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x3b8], 3
mov dword [ebp - 0x4c], 0
jmp 0x10051d83
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x10051d9f
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1d8]
call fcn.100171a5
mov dword [eax], 0x57e8b72f
jmp 0x10051d7c
mov dword [ebp - 0x4c], 0
jmp 0x10051daf
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x10051dcb
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x19c]
call fcn.100171a5
mov dword [eax], 0xdc7555b7
jmp 0x10051da8
push 2
lea ecx, [ebp - 0x19c]
call fcn.100171a5
and dword [eax], 0
jmp 0x10051e01
push 2
lea ecx, [ebp - 0x19c]
call fcn.100171a5
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x388]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x19c]
call fcn.100171a5
cmp dword [eax], 0
jg 0x1005212f
mov dword [ebp - 0x3a0], 0x1b55e973
cmp dword [ebp - 0x10], 0
jne 0x10051e36
cmp dword [ebp - 0x10], 0
jne 0x10051e36
and dword [ebp - 0x4f0], 0
jmp 0x10051e40
mov dword [ebp - 0x4f0], 1
push 2
lea ecx, [ebp - 0x19c]
call fcn.100171a5
mov ecx, dword [ebp - 0x3a0]
cmp dword [eax], ecx
jle 0x10051e63
mov dword [ebp - 0x52c], 1
jmp 0x10051e6a
and dword [ebp - 0x52c], 0
push 2
lea ecx, [ebp - 0x19c]
call fcn.100171a5
push dword [eax]
lea ecx, [ebp - 0x1d8]
call fcn.100171a5
cmp dword [ebp - 0x10], 0xba09
jg 0x10051e99
mov dword [ebp - 0x390], 1
jmp 0x10051ea0
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x390], eax
jg 0x10051eb7
mov dword [ebp - 0x398], 1
jmp 0x10051ebe
and dword [ebp - 0x398], 0
push 0
lea ecx, [ebp - 0x1d8]
call fcn.100171a5
mov ecx, dword [ebp - 0x398]
cmp ecx, dword [eax]
jl 0x10051ee1
mov dword [ebp - 0x534], 1
jmp 0x10051ee8
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x3a0]
cmp dword [ebp - 0x10], eax
jle 0x10051f08
mov dword [ebp - 0x3a8], 1
jmp 0x10051f0f
and dword [ebp - 0x3a8], 0
cmp dword [ebp - 0x3a8], 1
jne 0x10051f24
mov dword [ebp - 0x3b0], 1
jmp 0x10051f2b
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x3b8], eax
mov esi, dword [ebp - 0x3b8]
push 2
lea ecx, [ebp - 0x19c]
call fcn.100171a5
push dword [eax]
lea ecx, [ebp - 0x1d8]
call fcn.100171a5
cmp esi, dword [eax]
je 0x10051f67
mov dword [ebp - 0x3c0], 1
jmp 0x10051f6e
and dword [ebp - 0x3c0], 0
push 2
lea ecx, [ebp - 0x19c]
call fcn.100171a5
push dword [eax]
lea ecx, [ebp - 0x1d8]
call fcn.100171a5
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3c0]
jg 0x10051f9e
mov dword [ebp - 0x3c8], 1
jmp 0x10051fa5
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x3c8]
cmp eax, dword [ebp - 0x518]
jge 0x10051fc3
mov dword [ebp - 0x3d0], 1
jmp 0x10051fca
and dword [ebp - 0x3d0], 0
cmp dword [ebp - 0x3d0], 0
ja 0x10051fdf
mov dword [ebp - 0x3d8], 1
jmp 0x10051fe6
and dword [ebp - 0x3d8], 0
push 2
lea ecx, [ebp - 0x19c]
call fcn.100171a5
push dword [eax]
lea ecx, [ebp - 0x1d8]
call fcn.100171a5
mov eax, dword [eax]
imul eax, dword [ebp - 0x3d8]
cmp eax, dword [ebp - 0x10]
je 0x1005201a
mov dword [ebp - 0x3e0], 1
jmp 0x10052021
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x3e0], eax
jg 0x1005203e
push 2
lea ecx, [ebp - 0x54c]
call fcn.100171a5
cmp dword [eax], 0
je 0x10052066
push 2
lea ecx, [ebp - 0x19c]
call fcn.100171a5
push dword [eax]
lea ecx, [ebp - 0x1d8]
call fcn.100171a5
cmp dword [eax], 0
je 0x10052066
and dword [ebp - 0x3e8], 0
jmp 0x10052070
mov dword [ebp - 0x3e8], 1
mov eax, dword [ebp - 0x3e8]
neg eax
cmp eax, dword [ebp - 0x10]
jne 0x10052089
mov dword [ebp - 0x3f0], 1
jmp 0x10052090
and dword [ebp - 0x3f0], 0
cmp dword [ebp - 0x3f0], 0x6c14
je 0x100520a8
mov dword [ebp - 0x3f8], 1
jmp 0x100520af
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x3f8], eax
jne 0x100520c6
mov dword [ebp - 0x400], 1
jmp 0x100520cd
and dword [ebp - 0x400], 0
mov esi, dword [ebp - 0x400]
sub esi, 0xffff
push 2
lea ecx, [ebp - 0x19c]
call fcn.100171a5
push dword [eax]
lea ecx, [ebp - 0x1d8]
call fcn.100171a5
cmp esi, dword [eax]
jl 0x10052103
mov dword [ebp - 0x414], 1
jmp 0x1005210a
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x500], eax
mov byte [ebp - 0x7a], 0
movzx eax, byte [ebp - 0x7a]
test eax, eax
je 0x1005212a
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10051ddd
push 2
lea ecx, [ebp - 0x54c]
call fcn.100171a5
mov esi, eax
push 0
lea ecx, [ebp - 0x1d8]
call fcn.100171a5
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x19c]
call fcn.10017189
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1d8]
call fcn.10017189
jmp 0x10051d36
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54c]
call fcn.10017189
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret