Function at 0x1000a422
Capabilities:
Check os version
Encode data using xor
Get common file path

Disassembly:
push 0x23c
push 0x100c1738
call fcn.10075ce0
xor eax, eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0x3a
jge 0x1000a478
mov eax, dword [ebp - 0x230]
and eax, reloc.WS2_32.dll_accept
jns 0x1000a45d
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000a46a
inc dword [ebp - 0x214]
jmp 0x1000a470
dec dword [ebp - 0x214]
inc dword [ebp - 0x230]
jmp 0x1000a442
mov dword [ebp - 4], 0xfffffffe
call fcn.1000a4a2
xor ecx, ecx
xor esi, esi
inc esi
mov eax, ecx
cdq
push 5
pop edi
idiv edi
cmp edx, esi
je 0x1000a4bd
cmp edx, 4
je 0x1000a4bd
and dword [ebp - 0x214], ecx
jmp 0x1000a4c5
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0x35
jl 0x1000a489
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 0xa
jl 0x1000a4cd
cmp dword [ebp - 0x214], 0xffff0001
jge 0x1000a4f4
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x1000a510
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 0x15
jl 0x1000a512
cmp dword [ebp - 0x214], 0
jge 0x1000a536
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000a552
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], esi
and dword [ebp - 0x24c], 0
cmp dword [ebp - 0x24c], 9
jge 0x1000a591
mov eax, dword [ebp - 0x24c]
and eax, reloc.WS2_32.dll_accept
jns 0x1000a577
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, esi
jne 0x1000a583
inc dword [ebp - 0x214]
jmp 0x1000a589
dec dword [ebp - 0x214]
inc dword [ebp - 0x24c]
jmp 0x1000a55c
mov dword [ebp - 4], 0xfffffffe
call fcn.1000a620
mov edi, 0x100a6ea4
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
push 2
pop esi
cmp eax, esi
jl 0x1000a5ac
cmp dword [ebp - 0x214], 0
jge 0x1000a5d2
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000a5ee
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], esi
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], 8
jge 0x1000a649
mov eax, dword [ebp - 0x220]
and eax, reloc.WS2_32.dll_accept
jns 0x1000a613
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000a63b
inc dword [ebp - 0x214]
jmp 0x1000a641
dec dword [ebp - 0x214]
inc dword [ebp - 0x220]
jmp 0x1000a5f8
mov dword [ebp - 4], 0xfffffffe
call fcn.1000a6b4
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 0xe
jl 0x1000a657
cmp dword [ebp - 0x214], 0
jge 0x1000a672
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x1000a68e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
push 4
pop ebx
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x1000a6a2
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x1000a6cf
add dword [ebp - 0x214], eax
jmp 0x1000a6d5
sub dword [ebp - 0x214], eax
inc eax
cmp eax, ebx
jl 0x1000a693
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x1000a6fd
cmp edx, ebx
je 0x1000a6fd
and dword [ebp - 0x214], ecx
jmp 0x1000a705
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 6
jl 0x1000a6e4
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x1000a726
cmp edx, ebx
je 0x1000a726
and dword [ebp - 0x214], ecx
jmp 0x1000a72c
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 2
jl 0x1000a70d
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 5
jl 0x1000a746
cmp dword [ebp - 0x214], 0
jge 0x1000a76a
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test edx, edx
jne 0x1000a788
call esi
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 6
jl 0x1000a78a
cmp dword [ebp - 0x214], 0
jge 0x1000a7ae
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000a7c6
call esi
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, ebx
jl 0x1000a7c8
cmp dword [ebp - 0x214], 0
jge 0x1000a7eb
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000a803
call esi
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x1000a81f
cmp edx, 4
je 0x1000a81f
and dword [ebp - 0x214], ecx
jmp 0x1000a827
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 6
jl 0x1000a805
xor ebx, ebx
mov dword [ebp - 0x214], ebx
cmp ebx, ebx
jge 0x1000a844
mov eax, ebx
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000a85c
call esi
mov dword [ebp - 0x214], eax
push 3
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x238], ebx
cmp dword [ebp - 0x238], eax
jge 0x1000a89e
mov ecx, dword [ebp - 0x238]
and ecx, reloc.WS2_32.dll_accept
jns 0x1000a883
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x1000a890
inc dword [ebp - 0x214]
jmp 0x1000a896
dec dword [ebp - 0x214]
inc dword [ebp - 0x238]
jmp 0x1000a868
mov dword [ebp - 4], 0xfffffffe
call fcn.1000a8dd
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x1000a8f8
cmp edx, 4
je 0x1000a8f8
and dword [ebp - 0x214], ecx
jmp 0x1000a900
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 2
jl 0x1000a8be
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x1000a922
cmp edx, 4
je 0x1000a922
and dword [ebp - 0x214], ecx
jmp 0x1000a92a
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 8
jl 0x1000a908
xor ecx, ecx
push 7
pop ebx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x1000a94f
cmp edx, 4
je 0x1000a94f
and dword [ebp - 0x214], ecx
jmp 0x1000a957
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, ebx
jl 0x1000a935
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x1000a95e
cmp dword [ebp - 0x214], 0
jge 0x1000a979
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
mov ecx, ebx
idiv ecx
test edx, edx
jne 0x1000a994
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 8
jl 0x1000a996
mov esi, 0xffff0001
cmp dword [ebp - 0x214], esi
jge 0x1000a9be
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
mov ecx, ebx
idiv ecx
test edx, edx
je 0x1000a9d9
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 8
jl 0x1000a9db
cmp dword [ebp - 0x214], esi
jge 0x1000a9fe
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
mov ecx, ebx
idiv ecx
test edx, edx
je 0x1000aa19
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 6
jl 0x1000aa1b
cmp dword [ebp - 0x214], 0
jge 0x1000aa36
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
mov ecx, ebx
idiv ecx
test edx, edx
jne 0x1000aa51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, ebx
jl 0x1000aa53
cmp dword [ebp - 0x214], 0
jge 0x1000aa76
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000aa92
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 4
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 3
jge 0x1000aad6
mov eax, dword [ebp - 0x228]
and eax, reloc.WS2_32.dll_accept
jns 0x1000aabb
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000aac8
inc dword [ebp - 0x214]
jmp 0x1000aace
dec dword [ebp - 0x214]
inc dword [ebp - 0x228]
jmp 0x1000aaa0
mov dword [ebp - 4], 0xfffffffe
call fcn.1000ab05
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x1000aaf3
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x1000ab20
add dword [ebp - 0x214], eax
jmp 0x1000ab26
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 7
jl 0x1000aae4
push edi
push edi
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
call esi
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x1000ab38
cmp dword [ebp - 0x214], 0
jge 0x1000ab53
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x1000ab6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x1000ab80
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x1000ab8d
add dword [ebp - 0x214], eax
jmp 0x1000ab93
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x1000ab71
push edi
push edi
call esi
mov dword [ebp - 4], 5
and dword [ebp - 0x248], 0
cmp dword [ebp - 0x248], 2
jge 0x1000abe1
mov eax, dword [ebp - 0x248]
and eax, reloc.WS2_32.dll_accept
jns 0x1000abc6
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000abd3
inc dword [ebp - 0x214]
jmp 0x1000abd9
dec dword [ebp - 0x214]
inc dword [ebp - 0x248]
jmp 0x1000abab
mov dword [ebp - 4], 0xfffffffe
call fcn.1000aca7
xor eax, eax
and esi, eax
mov dword [ebp - 0x214], esi
inc eax
cmp eax, 5
jl 0x1000abef
test esi, esi
jns 0x1000ac0a
imul esi, esi, 0xfffffffb
mov dword [ebp - 0x214], esi
mov eax, esi
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000ac24
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x214], esi
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
xor eax, eax
sub esi, eax
mov dword [ebp - 0x214], esi
inc eax
cmp eax, 3
jl 0x1000ac34
cmp esi, 0xffff0001
jge 0x1000ac53
imul esi, esi, 0xfffffffb
mov dword [ebp - 0x214], esi
mov eax, esi
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x1000ac6b
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
and dword [ebp - 0x214], 0
push 0xfa
lea eax, [ebp - 0x210]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call esi
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x1000acc5
cmp edx, 4
je 0x1000acc5
and dword [ebp - 0x214], ecx
jmp 0x1000accb
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 3
jl 0x1000ac88
mov ebx, 0xfa
push ebx
lea eax, [ebp - 0x210]
push eax
call esi
push ebx
lea eax, [ebp - 0x210]
push eax
call esi
and dword [ebp - 0x214], 0
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x1000acf3
cmp dword [ebp - 0x214], 0xffff0001
jge 0x1000ad1a
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x1000ad36
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 6
and dword [ebp - 0x218], 0
cmp dword [ebp - 0x218], 4
jge 0x1000ad7a
mov eax, dword [ebp - 0x218]
and eax, reloc.WS2_32.dll_accept
jns 0x1000ad5f
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000ad6c
inc dword [ebp - 0x214]
jmp 0x1000ad72
dec dword [ebp - 0x214]
inc dword [ebp - 0x218]
jmp 0x1000ad44
mov dword [ebp - 4], 0xfffffffe
call fcn.1000adc1
mov dword [ebp - 4], 7
and dword [ebp - 0x240], 0
cmp dword [ebp - 0x240], 2
jge 0x1000adea
mov eax, dword [ebp - 0x240]
and eax, reloc.WS2_32.dll_accept
jns 0x1000adaf
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000addc
inc dword [ebp - 0x214]
jmp 0x1000ade2
dec dword [ebp - 0x214]
inc dword [ebp - 0x240]
jmp 0x1000ad94
mov dword [ebp - 4], 0xfffffffe
call fcn.1000ae17
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x1000ae32
cmp edx, 4
je 0x1000ae32
and dword [ebp - 0x214], ecx
jmp 0x1000ae3a
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 2
jl 0x1000adf8
cmp dword [ebp - 0x214], 0xffff0001
jge 0x1000ae5b
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x1000ae77
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
test eax, eax
jns 0x1000ae8d
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x1000aea9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 8
and dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 4
jge 0x1000aeed
mov eax, dword [ebp - 0x21c]
and eax, reloc.WS2_32.dll_accept
jns 0x1000aed2
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000aedf
inc dword [ebp - 0x214]
jmp 0x1000aee5
dec dword [ebp - 0x214]
inc dword [ebp - 0x21c]
jmp 0x1000aeb7
mov dword [ebp - 4], 0xfffffffe
call fcn.1000af34
mov dword [ebp - 4], 9
and dword [ebp - 0x224], 0
cmp dword [ebp - 0x224], 3
jge 0x1000af5d
mov eax, dword [ebp - 0x224]
and eax, reloc.WS2_32.dll_accept
jns 0x1000af22
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000af4f
inc dword [ebp - 0x214]
jmp 0x1000af55
dec dword [ebp - 0x214]
inc dword [ebp - 0x224]
jmp 0x1000af07
mov dword [ebp - 4], 0xfffffffe
call fcn.1000afcf
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x1000af6b
cmp dword [ebp - 0x214], 0xffff0001
jge 0x1000af92
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x1000afae
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x1000afea
cmp edx, 4
je 0x1000afea
and dword [ebp - 0x214], ecx
jmp 0x1000aff2
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 3
jl 0x1000afb0
mov dword [ebp - 4], 0xa
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 0
jge 0x1000b03c
mov eax, dword [ebp - 0x22c]
and eax, reloc.WS2_32.dll_accept
jns 0x1000b021
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000b02e
inc dword [ebp - 0x214]
jmp 0x1000b034
dec dword [ebp - 0x214]
inc dword [ebp - 0x22c]
jmp 0x1000b006
mov dword [ebp - 4], 0xfffffffe
call fcn.1000b326
cmp dword [ebp - 0x214], 0
jge 0x1000b057
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test edx, edx
jne 0x1000b075
call ebx
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
test eax, eax
jns 0x1000b08b
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x1000b0a3
call ebx
mov dword [ebp - 0x214], eax
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x1000b0a5
cmp dword [ebp - 0x214], 0
jge 0x1000b0c0
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x1000b0d8
call ebx
mov dword [ebp - 0x214], eax
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x1000b0da
cmp dword [ebp - 0x214], 0
jge 0x1000b0f5
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x1000b10d
call ebx
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x214], ecx
cmp ecx, 0xffff0001
jge 0x1000b12a
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x214], ecx
mov eax, ecx
cdq
push 7
pop esi
idiv esi
test edx, edx
je 0x1000b144
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x214], ecx
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
test eax, eax
jns 0x1000b16a
neg eax
mov dword [ebp - 0x214], eax
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x1000b17c
call ebx
mov dword [ebp - 0x214], eax
xor eax, eax
mov dword [ebp - 0x214], eax
jge 0x1000b18f
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
cdq
push 0xd
pop ecx
idiv ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test edx, edx
jne 0x1000b1a7
call esi
mov dword [ebp - 0x214], eax
and dword [ebp - 0x214], 0
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [ebp - 0x214], eax
jge 0x1000b1d3
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000b1e5
call esi
mov dword [ebp - 0x214], eax
xor eax, eax
mov dword [ebp - 0x214], eax
jge 0x1000b1f8
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000b20a
call esi
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x1000b20c
cmp dword [ebp - 0x214], 0
jge 0x1000b230
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000b248
call esi
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x1000b24a
cmp dword [ebp - 0x214], 0
jge 0x1000b26e
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000b286
call esi
mov dword [ebp - 0x214], eax
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x1000b288
cmp dword [ebp - 0x214], 0
jge 0x1000b2a3
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x1000b2bb
call ebx
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jge 0x1000b2d3
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000b2eb
call esi
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 0xb
and dword [ebp - 0x234], 0
cmp dword [ebp - 0x234], 4
jge 0x1000b34f