Function at 0x100090f9
Capabilities:
Create directory
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100831d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x11c8
call fcn.1007e340
push esi
push edi
mov dword [ebp - 0xec], 0x110c93b4
mov dword [ebp - 0x2ec], 0xfffffffd
mov dword [ebp - 0xe6c], 7
mov dword [ebp - 0x918], 9
mov dword [ebp - 0xa38], 0x8fb0b44c
mov dword [ebp - 0xb04], 0xfffffff7
mov dword [ebp - 0xa9c], 0xed40a165
mov dword [ebp - 0xa28], 0xda862840
mov dword [ebp - 0x7a4], 0x6bde64f
mov dword [ebp - 0x308], 0xffffffff
mov dword [ebp - 0xa50], 0
mov dword [ebp - 0x920], 0xcce005ab
mov dword [ebp - 0x224], 0
jmp 0x100091ae
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 4
jge 0x100091ca
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x1160], 0x7a81a82e
jmp 0x100091a1
mov dword [ebp - 0xec], 0
jmp 0x100091e3
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xfffffffb
jne 0x1000920d
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1000920b
push 0x222
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
jmp 0x100091d6
cmp dword [ebp - 0xec], 0
jne 0x1000937a
xor eax, eax
jne 0x10009343
cmp dword [ebp - 0xec], 0
jne 0x10009343
mov dword [ebp - 0x7a4], 0
cmp dword [ebp - 0x7a4], 0
je 0x10009255
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x10009255
mov dword [ebp - 0xa18], 1
jmp 0x1000925c
and dword [ebp - 0xa18], 0
cmp dword [ebp - 0xa18], 0xac3e
jle 0x10009276
xor eax, eax
inc eax
jne 0x10009276
and dword [ebp - 0xa20], 0
jmp 0x10009280
mov dword [ebp - 0xa20], 1
mov eax, dword [ebp - 0xa20]
mov dword [ebp - 0xa28], eax
cmp dword [ebp - 0xa28], 0
jne 0x100092a7
cmp dword [ebp - 0x2ec], 0
jne 0x100092a7
and dword [ebp - 0xa30], 0
jmp 0x100092b1
mov dword [ebp - 0xa30], 1
mov eax, dword [ebp - 0xa30]
mov dword [ebp - 0xa38], eax
cmp dword [ebp - 0xa38], 0
je 0x100092db
cmp dword [ebp - 0xa50], 0
je 0x100092db
mov dword [ebp - 0xa40], 1
jmp 0x100092e2
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
cmp eax, dword [ebp - 0xa40]
jne 0x10009309
mov dword [ebp - 0xa48], 1
jmp 0x10009310
and dword [ebp - 0xa48], 0
cmp dword [ebp - 0xa48], 0xfffffff6
jl 0x10009325
mov dword [ebp - 0x910], 1
jmp 0x1000932c
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0xa50]
cmp dword [ebp - 0x910], eax
jge 0x10009343
and dword [ebp - 0x424], 0
jmp 0x1000934d
mov dword [ebp - 0x424], 1
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0x424]
mov dword [ebp - 0x918], eax
jne 0x1000937a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1160], 0
jne 0x1000937a
and dword [ebp - 0x42c], 0
jmp 0x10009384
mov dword [ebp - 0x42c], 1
mov eax, dword [ebp - 0xa9c]
imul eax, dword [ebp - 0x42c]
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x2ec]
cmp dword [ebp - 0x920], eax
jl 0x100093b1
mov dword [ebp - 0x434], 1
jmp 0x100093b8
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
sub eax, dword [ebp - 0xb04]
cmp eax, 0xa684a08d
jb 0x100093d7
mov dword [ebp - 0x928], 1
jmp 0x100093de
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x2ec]
add eax, dword [ebp - 0x928]
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x43c], 0xfffffff6
mov dword [ebp - 0xde4], 0xb948214d
mov dword [ebp - 0xde0], 0xb948214d
mov dword [ebp - 0xddc], 0xb948214d
mov dword [ebp - 0xdd8], 0xb948214d
mov dword [ebp - 0x454], 1
mov dword [ebp - 0xfc], 0xffffffff
mov dword [ebp - 0x968], 0x69a4575f
mov dword [ebp - 0x484], 0
mov dword [ebp - 0xb24], 0x88a3
mov dword [ebp - 0x990], 0xa6c9
mov dword [ebp - 0x22c], 0
jmp 0x10009488
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 2
jge 0x100094a4
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xb30], 7
jmp 0x1000947b
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xe08], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x43c], eax
jg 0x100094d0
mov dword [ebp - 0x930], 1
jmp 0x100094d7
and dword [ebp - 0x930], 0
cmp dword [ebp - 0x930], 0x8af16de6
jne 0x100094ef
mov dword [ebp - 0x444], 1
jmp 0x100094f6
and dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0x3ae5
je 0x10009508
cmp dword [ebp - 0x34], 0
je 0x10009518
xor eax, eax
je 0x10009518
mov dword [ebp - 0x37c], 1
jmp 0x1000951f
and dword [ebp - 0x37c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x37c]
mov dword [ebp + eax - 0xde4], ecx
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x37c], eax
jle 0x1000954c
mov dword [ebp - 0x938], 1
jmp 0x10009553
and dword [ebp - 0x938], 0
cmp dword [ebp - 0x938], 0xb5009892
jb 0x1000956b
mov dword [ebp - 0x44c], 1
jmp 0x10009572
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
add eax, 0xfffe
cmp eax, dword [ebp - 0x34]
je 0x1000958e
mov dword [ebp - 0x940], 1
jmp 0x10009595
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x940]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x454], eax
jge 0x100095bb
mov dword [ebp - 0x948], 1
jmp 0x100095c2
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x948], eax
je 0x100095dc
mov dword [ebp - 0xb0c], 1
jmp 0x100095e3
and dword [ebp - 0xb0c], 0
cmp dword [ebp - 0x34], 1
je 0x100095f5
mov dword [ebp - 0x45c], 1
jmp 0x100095fc
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x45c], eax
jle 0x10009613
mov dword [ebp - 0xb14], 1
jmp 0x1000961a
and dword [ebp - 0xb14], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xe10], eax
mov eax, 0x5b0bb8b
test eax, eax
ja 0x1000963b
mov dword [ebp - 0x950], 1
jmp 0x10009642
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0x950]
cmp eax, dword [ebp - 0xfc]
jne 0x10009662
mov dword [ebp - 0x464], 1
jmp 0x10009669
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
sub eax, dword [ebp - 0x34]
jne 0x10009686
mov eax, 0x8a8c
test eax, eax
jne 0x10009686
and dword [ebp - 0x958], 0
jmp 0x10009690
mov dword [ebp - 0x958], 1
cmp dword [ebp - 0x958], 0xffff
jne 0x100096a8
mov dword [ebp - 0x46c], 1
jmp 0x100096af
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xf4]
sub eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0xf4]
jge 0x100096d5
mov dword [ebp - 0x960], 1
jmp 0x100096dc
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0xfc]
imul eax, dword [ebp - 0x960]
cmp eax, 0x600bf094
jg 0x100096fc
mov dword [ebp - 0x474], 1
jmp 0x10009703
and dword [ebp - 0x474], 0
cmp dword [ebp - 0x474], 0
jae 0x10009718
mov dword [ebp - 0xb1c], 1
jmp 0x1000971f
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xe18], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xe20], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x968], eax
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x47c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x47c]
mov dword [ebp + eax - 0xb30], ecx
cmp dword [ebp - 0x47c], 0xffffffff
jne 0x10009777
mov dword [ebp - 0x970], 1
jmp 0x1000977e
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0
je 0x100098af
mov dword [ebp - 0x31c], 0xdf607dbc
mov dword [ebp - 0xb68], 0xffffffff
mov dword [ebp - 0x49c], 0xf643d9d7
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0xe28], eax
mov eax, dword [ebp - 0x34]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xb30]
test eax, eax
jne 0x10009866
mov eax, dword [ebp - 0x31c]
cmp dword [ebp - 0x31c], eax
jge 0x100097fa
mov eax, 0xfd32
test eax, eax
jne 0x100097fa
and dword [ebp - 0x978], 0
jmp 0x10009804
mov dword [ebp - 0x978], 1
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x978]
cmp eax, 0x99b5
jne 0x10009820
mov dword [ebp - 0x48c], 1
jmp 0x10009827
and dword [ebp - 0x48c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb30]
cmp eax, dword [ebp - 0x48c]
jg 0x10009848
mov dword [ebp - 0x980], 1
jmp 0x1000984f
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0xb24]
cmp dword [ebp - 0x980], eax
jne 0x10009866
and dword [ebp - 0x494], 0
jmp 0x10009870
mov dword [ebp - 0x494], 1
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x494], eax
jge 0x1000988a
mov dword [ebp - 0x988], 1
jmp 0x10009891
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0xb68], eax
mov eax, dword [ebp - 0x49c]
dec eax
mov dword [ebp - 0x49c], eax
jmp 0x10009931
mov dword [ebp - 0xe30], 0xffffffff
push 2
lea ecx, [ebp - 0xd68]
call fcn.1001831b
and dword [ebp - 4], 0
mov dword [ebp - 0x2f4], 0
jmp 0x100098e3
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 2
jge 0x10009902
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0xd68]
call fcn.10018388
or dword [eax], 0xffffffff
jmp 0x100098d6
mov eax, dword [ebp - 0x990]
inc eax
mov dword [ebp - 0x990], eax
push 0
lea ecx, [ebp - 0xd68]
call fcn.10018388
mov dword [eax], 7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd68]
call fcn.10018383
push 1
lea ecx, [ebp - 0xcb0]
call fcn.1001831b
mov dword [ebp - 4], 1
mov dword [ebp - 0x7c], 0
jmp 0x10009955
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x10009971
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xcb0]
call fcn.10018388
mov dword [eax], 0x5b57fd54
jmp 0x1000994e
mov dword [ebp - 0x7c], 0
jmp 0x10009981
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x10009997
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xa98], 0x4c506d44
jmp 0x1000997a
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xa98], 0
jmp 0x100099c5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa98]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa98], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa98], 0
jg 0x10009ae6
push 4
lea ecx, [ebp - 0xa88]
call fcn.1001831b
mov byte [ebp - 4], 2
mov dword [ebp - 0x234], 0
jmp 0x10009a03
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 4
jge 0x10009a25
push dword [ebp - 0x234]
lea ecx, [ebp - 0xa88]
call fcn.10018388
mov dword [eax], 8
jmp 0x100099f6
push 3
lea ecx, [ebp - 0xa88]
call fcn.10018388
and dword [eax], 0
jmp 0x10009a5b
push 3
lea ecx, [ebp - 0xa88]
call fcn.10018388
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x4a4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4a4]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0xa88]
call fcn.10018388
cmp dword [eax], 0
jl 0x10009ad2
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10009a93
push 0
push 0x11ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 3
lea ecx, [ebp - 0xa88]
call fcn.10018388
push dword [eax]
lea ecx, [ebp - 0xcb0]
call fcn.10018388
mov esi, eax
push 3
lea ecx, [ebp - 0xa88]
call fcn.10018388
push dword [eax]
lea ecx, [ebp - 0xcb0]
call fcn.10018388
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10009a37
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa88]
call fcn.10018383
jmp 0x100099aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcb0]
call fcn.10018383
mov dword [ebp - 0x104], 0x110c93b4
mov dword [ebp - 0x23c], 0xfffffffd
mov dword [ebp - 0xe38], 7
mov dword [ebp - 0x4d4], 9
mov dword [ebp - 0x4bc], 0x8fb0b44c
mov dword [ebp - 0xb78], 0xfffffff7
mov dword [ebp - 0xb70], 0xed40a165
mov dword [ebp - 0x4b4], 0xda862840
mov dword [ebp - 0x998], 0x6bde64f
mov dword [ebp - 0x3b0], 0xffffffff
mov dword [ebp - 0x9b8], 0
mov dword [ebp - 0x4dc], 0xcce005ab
mov dword [ebp - 0x2fc], 0
jmp 0x10009b86
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 4
jge 0x10009ba2
mov eax, dword [ebp - 0x2fc]
mov dword [ebp + eax*4 - 0x1178], 0x7a81a82e
jmp 0x10009b79
mov dword [ebp - 0x104], 0
jmp 0x10009bbb
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xfffffffb
jne 0x10009be5
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x10009be3
push 0x222
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
jmp 0x10009bae
cmp dword [ebp - 0x104], 0
jne 0x10009d52
xor eax, eax
jne 0x10009d1b
cmp dword [ebp - 0x104], 0
jne 0x10009d1b
mov dword [ebp - 0x998], 0
cmp dword [ebp - 0x998], 0
je 0x10009c2d
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x10009c2d
mov dword [ebp - 0x4ac], 1
jmp 0x10009c34
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 0xac3e
jle 0x10009c4e
xor eax, eax
inc eax
jne 0x10009c4e
and dword [ebp - 0x9a0], 0
jmp 0x10009c58
mov dword [ebp - 0x9a0], 1
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 0
jne 0x10009c7f
cmp dword [ebp - 0x23c], 0
jne 0x10009c7f
and dword [ebp - 0x9a8], 0
jmp 0x10009c89
mov dword [ebp - 0x9a8], 1
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0
je 0x10009cb3
cmp dword [ebp - 0x9b8], 0
je 0x10009cb3
mov dword [ebp - 0x9b0], 1
jmp 0x10009cba
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
cmp eax, dword [ebp - 0x9b0]
jne 0x10009ce1
mov dword [ebp - 0x4c4], 1
jmp 0x10009ce8
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 0xfffffff6
jl 0x10009cfd
mov dword [ebp - 0x4cc], 1
jmp 0x10009d04
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x9b8]
cmp dword [ebp - 0x4cc], eax
jge 0x10009d1b
and dword [ebp - 0x9c0], 0
jmp 0x10009d25
mov dword [ebp - 0x9c0], 1
mov eax, dword [ebp - 0x104]
add eax, dword [ebp - 0x9c0]
mov dword [ebp - 0x4d4], eax
jne 0x10009d52
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1178], 0
jne 0x10009d52
and dword [ebp - 0x9c8], 0
jmp 0x10009d5c
mov dword [ebp - 0x9c8], 1
mov eax, dword [ebp - 0xb70]
imul eax, dword [ebp - 0x9c8]
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x23c]
cmp dword [ebp - 0x4dc], eax
jl 0x10009d89
mov dword [ebp - 0x9d0], 1
jmp 0x10009d90
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x9d0]
sub eax, dword [ebp - 0xb78]
cmp eax, 0xa684a08d
jb 0x10009daf
mov dword [ebp - 0x4e4], 1
jmp 0x10009db6
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x23c]
add eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x324], 0
push 2
lea ecx, [ebp - 0x414]
call fcn.1001831b
mov dword [ebp - 4], 3
mov dword [ebp - 0x9d8], 0x33563700
mov dword [ebp - 0x384], 4
mov dword [ebp - 0xb80], 0xffffffff
mov dword [ebp - 0x1c], 0
jmp 0x10009e14
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10009e30
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x414]
call fcn.10018388
mov dword [eax], 0x25d16df2
jmp 0x10009e0d
mov dword [ebp - 0x1c], 0
jmp 0x10009e40
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10009e56
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe5c], 0x3717be9f
jmp 0x10009e39
mov dword [ebp - 0x1c], 0
jmp 0x10009e66
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10009e7c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10fc], 0xfffffffc
jmp 0x10009e5f
mov esi, dword [ebp - 0x324]
push 1
lea ecx, [ebp - 0x414]
call fcn.10018388
mov dword [eax], esi
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x9d8], eax
mov eax, dword [ebp - 0x9d8]
add eax, dword [ebp - 0x324]
jne 0x10009ebd
push 1
lea ecx, [ebp - 0x414]
call fcn.10018388
cmp dword [eax], 0
je 0x10009ec4
cmp dword [ebp - 0x384], 0
push 1
lea ecx, [ebp - 0x414]
call fcn.10018388
mov ecx, dword [ebp - 0x384]
cmp dword [eax], ecx
jl 0x10009ee7
mov dword [ebp - 0x4ec], 1
jmp 0x10009eee
and dword [ebp - 0x4ec], 0
push 1
lea ecx, [ebp - 0x414]
call fcn.10018388
mov ecx, dword [ebp - 0x4ec]
cmp ecx, dword [eax]
jl 0x10009f11
mov dword [ebp - 0x4f4], 1
jmp 0x10009f18
and dword [ebp - 0x4f4], 0
push 4
pop eax
shl eax, 0
lea eax, [ebp + eax - 0xe5c]
mov dword [ebp - 0x9e0], eax
push 1
lea ecx, [ebp - 0x414]
call fcn.10018388
mov ecx, dword [ebp - 0x9e0]
mov eax, dword [eax]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x414]
call fcn.10018388
mov ecx, dword [ebp - 0x9e0]
mov ecx, dword [ecx]
sub ecx, dword [eax]
mov dword [ebp - 0x9e8], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9e8]
mov dword [ebp + eax - 0x10fc], ecx
mov eax, dword [ebp - 0x384]
add eax, dword [ebp - 0x4f4]
add eax, dword [ebp - 0x9e8]
cmp eax, 0xaa810d21
jbe 0x10009f97
mov dword [ebp - 0x4fc], 1
jmp 0x10009f9e
and dword [ebp - 0x4fc], 0
push 0
lea ecx, [ebp - 0x414]
call fcn.10018388
mov ecx, dword [ebp - 0x4fc]
cmp ecx, dword [eax]
jne 0x10009fc1
mov dword [ebp - 0x9f0], 1
jmp 0x10009fc8
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x9f0]
sub eax, 0x9740
mov dword [ebp - 0xb80], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10018383
mov dword [ebp - 0x7bc], 0
mov dword [ebp - 0x32c], 0xe4d9
mov dword [ebp - 0xe40], 0xfffffffc
mov dword [ebp - 0x334], 0xa8d3a18e
mov dword [ebp - 0xb88], 0xffffffff
mov dword [ebp - 0xca4], 6
mov dword [ebp - 0xca0], 6
mov dword [ebp - 0xc9c], 6
mov dword [ebp - 0xc98], 6
mov dword [ebp - 0x1cc], 0xfffe
mov dword [ebp - 0xa00], 0xfffffffd
mov dword [ebp - 0x3b4], 0x5ad058bb
mov dword [ebp - 0x52c], 0x2633
cmp dword [ebp - 0x7bc], 0
jne 0x1000a07f
mov dword [ebp - 0x51c], 1
jmp 0x1000a086
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
jne 0x1000a1aa
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0xe48], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xca4]
neg eax
je 0x1000a167
mov eax, dword [ebp - 0x334]
imul eax, dword [ebp - 0x1cc]
test eax, eax
jne 0x1000a0d7
mov dword [ebp - 0x504], 1
jmp 0x1000a0de
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x504], eax
jle 0x1000a0f8
mov dword [ebp - 0x9f8], 1
jmp 0x1000a0ff
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0xb88]
cmp dword [ebp - 0x9f8], eax
je 0x1000a119
mov dword [ebp - 0x50c], 1
jmp 0x1000a120
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x1cc]
cmp eax, dword [ebp - 0x50c]
jge 0x1000a13a
mov dword [ebp - 0xb90], 1
jmp 0x1000a141
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0xe50], eax
mov eax, dword [ebp - 0xa00]
cmp dword [ebp - 0xa00], eax
jg 0x1000a167
mov dword [ebp - 0xa10], 1
jmp 0x1000a16e
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0xa10]
neg eax
cmp eax, dword [ebp - 0x3b4]
jl 0x1000a18c
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xca4], 0
mov eax, dword [ebp - 0x3b4]
imul eax, dword [ebp - 0x334]
cmp eax, dword [ebp - 0x32c]
jl 0x1000a1aa
and dword [ebp - 0x520], 0
jmp 0x1000a1b4
mov dword [ebp - 0x520], 1
mov eax, dword [ebp - 0x3b4]
add eax, dword [ebp - 0x520]
cmp dword [ebp - 0x51c], eax
jg 0x1000a1d4
mov dword [ebp - 0x524], 1
jmp 0x1000a1db
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x7bc]
imul eax, dword [ebp - 0x524]
cmp eax, 0xfffffffc
jge 0x1000a1f9
mov dword [ebp - 0x90c], 1
jmp 0x1000a200
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x52c]
add eax, dword [ebp - 0x334]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0xca4]
je 0x1000a24a
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x1000a248
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
jmp 0x1000a264
mov byte [ebp - 0x18d], 0
movzx eax, byte [ebp - 0x18d]
test eax, eax
je 0x1000a264
push 0
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 0x124], 0x110c93b4
mov dword [ebp - 0x268], 0xfffffffd
mov dword [ebp - 0x7c4], 0x5c6e
mov dword [ebp - 0x10c], 0xfffffffe
mov dword [ebp - 0x1f0], 0xfffffffc
mov dword [ebp - 0x38c], 0xd64ea33a
mov dword [ebp - 0xa4c], 0x1914cc5c
mov dword [ebp - 0xb98], 0xffffffff
mov dword [ebp - 0xed8], 0xa68f
mov dword [ebp - 0xee0], 0xffffffff
push 4
lea ecx, [ebp - 0xff8]
call fcn.1001831b
mov dword [ebp - 4], 4
mov dword [ebp - 0xee8], 0
mov dword [ebp - 0x91c], 0
mov dword [ebp - 0x304], 0
jmp 0x1000a309
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 4
jge 0x1000a32b
push dword [ebp - 0x304]
lea ecx, [ebp - 0xff8]
call fcn.10018388
mov dword [eax], 0x50e8f7cf
jmp 0x1000a2fc
mov dword [ebp - 0x7c4], 0xa835a23e
cmp dword [ebp - 0x7c4], 0x3de0369b
jge 0x1000a34d
mov dword [ebp - 0x54c], 1
jmp 0x1000a354
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x10c]
imul eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x1f0]
jne 0x1000a37b
cmp dword [ebp - 0x10c], 0
jne 0x1000a37b
and dword [ebp - 0x534], 0
jmp 0x1000a385
mov dword [ebp - 0x534], 1
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0
je 0x1000a3af
cmp dword [ebp - 0x38c], 0
je 0x1000a3af
mov dword [ebp - 0x9b4], 1
jmp 0x1000a3b6
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x9b4], eax
jge 0x1000a3d0
mov dword [ebp - 0x53c], 1
jmp 0x1000a3d7
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 0x6d40
jg 0x1000a3ef
mov dword [ebp - 0x7cc], 1
jmp 0x1000a3f6
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7cc]
sub eax, dword [ebp - 0x1f0]
jne 0x1000a416
cmp dword [ebp - 0x1f0], 0
jne 0x1000a416
and dword [ebp - 0x544], 0
jmp 0x1000a420
mov dword [ebp - 0x544], 1
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x544], eax
jl 0x1000a43a
mov dword [ebp - 0x914], 1
jmp 0x1000a441
and dword [ebp - 0x914], 0
cmp dword [ebp - 0x914], 6
jge 0x1000a456
mov dword [ebp - 0x7d4], 1
jmp 0x1000a45d
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x54c]
sub eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x7d4]
cmp eax, dword [ebp - 0xa4c]
jne 0x1000a483
mov dword [ebp - 0x554], 1
jmp 0x1000a48a
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 0xf1540ee1
ja 0x1000a4a8
cmp dword [ebp - 0xa4c], 0
jne 0x1000a4a8
and dword [ebp - 0x55c], 0
jmp 0x1000a4b2
mov dword [ebp - 0x55c], 1
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x743c
jne 0x1000a4d6
mov dword [ebp - 0x7dc], 1
jmp 0x1000a4dd
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x7dc], eax
jle 0x1000a4f7
mov dword [ebp - 0x564], 1
jmp 0x1000a4fe
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0x91c]
inc eax
mov dword [ebp - 0x91c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xff8]
call fcn.10018383
mov dword [ebp - 0xef0], 7
mov dword [ebp - 0x70], 0xe1757117
mov dword [ebp - 0x68], 0xfffffffa
mov dword [ebp - 0x9bc], 0xfffffffc
mov dword [ebp - 0x57c], 0x66b7a7bc
mov dword [ebp - 0xef8], 0
mov dword [ebp - 0xf00], 0xff2d4e20
mov dword [ebp - 0x2f8], 0
jmp 0x1000a57f
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 2
jge 0x1000a59b
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0x1110], 0x66bd5d51
jmp 0x1000a572
mov dword [ebp - 0x70], 0
jmp 0x1000a5ab
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x18
jle 0x1000a890
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xba8], 0xfffffffc
mov dword [ebp - 0x248], 0
jmp 0x1000a5e2
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 2
jge 0x1000a5fe
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x1150], 0xbb9a67b9
jmp 0x1000a5d5
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xf08], eax
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x70]
add eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0xc8]
jne 0x1000a62a
mov dword [ebp - 0x56c], 1
jmp 0x1000a631
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x56c], eax
jge 0x1000a64b
mov dword [ebp - 0x7e4], 1
jmp 0x1000a652
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x7e4]
jne 0x1000a669
mov dword [ebp - 0x574], 1
jmp 0x1000a670
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x9bc], eax
mov eax, dword [ebp - 0x9bc]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x57c], eax
jge 0x1000a69f
mov dword [ebp - 0xba0], 1
jmp 0x1000a6a6
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xf10], eax
push 0xfffffffffffffffe
pop eax
test eax, eax
jae 0x1000a6c2
mov dword [ebp - 0x7ec], 1
jmp 0x1000a6c9
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x7ec]
jle 0x1000a6e3
cmp dword [ebp - 0x70], 0
jne 0x1000a6e3
and dword [ebp - 0x584], 0
jmp 0x1000a6ed
mov dword [ebp - 0x584], 1
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x584]
imul eax, eax, 0x5616
cmp dword [ebp - 0x70], eax
jge 0x1000a70d
mov dword [ebp - 0x924], 1
jmp 0x1000a714
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x924], eax
jle 0x1000a734
cmp dword [ebp - 0xc8], 0
jne 0x1000a734
and dword [ebp - 0x58c], 0
jmp 0x1000a73e
mov dword [ebp - 0x58c], 1
mov eax, dword [ebp - 0xc8]
imul eax, dword [ebp - 0x58c]
cmp eax, 0x4286
jl 0x1000a75e
mov dword [ebp - 0x7f4], 1
jmp 0x1000a765
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x7f4], eax
jl 0x1000a77c
mov dword [ebp - 0x594], 1
jmp 0x1000a783
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
neg eax
cmp dword [ebp - 0x70], eax
jg 0x1000a79c
mov dword [ebp - 0xa14], 1
jmp 0x1000a7a3
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0xa14], eax
je 0x1000a7bd
mov dword [ebp - 0x59c], 1
jmp 0x1000a7c4
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0x68], 0
jmp 0x1000a7e0
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jg 0x1000a88b
mov dword [ebp - 0xf18], 0xa22f0f5b
mov dword [ebp - 0xf20], 0xffffffff
mov dword [ebp - 0xf28], 1
mov dword [ebp - 0xf30], 0x85ca7db
mov dword [ebp - 0xf38], 0x9278a491
mov dword [ebp - 0xf40], 1
mov dword [ebp - 0xf48], 0xffffffff
mov dword [ebp - 0xf50], 0xca380790
mov dword [ebp - 0x7fc], 1
mov dword [ebp - 0x2a8], 0
jmp 0x1000a85d
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 2
jge 0x1000a879
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0x1140], 0xbc9ee521
jmp 0x1000a850
mov eax, dword [ebp - 0x7fc]
dec eax
mov dword [ebp - 0x7fc], eax
jmp 0x1000a7d9
jmp 0x1000a5a4
mov dword [ebp - 0x84c], 9
mov dword [ebp - 0x210], 0xb13e
mov dword [ebp - 0xf58], 8
mov dword [ebp - 0x250], 0
jmp 0x1000a8c7
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x1000a8e3
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x11b4], 0xb50bf34f
jmp 0x1000a8ba
cmp dword [ebp - 0x210], 0
je 0x1000a953
mov dword [ebp - 0x210], 0
jmp 0x1000a905
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jg 0x1000a951
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1000a92b
push 0x26ae
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1000a94f
push 0xe86
push 0x26fb
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x1000a8f8
jmp 0x1000a96a
mov dword [ebp - 0x5a4], 0x836b16b
mov eax, dword [ebp - 0x5a4]
dec eax
mov dword [ebp - 0x5a4], eax
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1000a984
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
mov dword [ebp - 0x94c], 0x8fb0b44c
mov dword [ebp - 0xab8], 0xfffffff7
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0x2d8], 0
jmp 0x1000a9bb
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 2
jge 0x1000a9d7
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0xe68], 0xf9b3
jmp 0x1000a9ae
mov dword [ebp - 0x1f8], 0
jmp 0x1000a9f0
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 1
jg 0x1000aa0d
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp + eax*4 - 0xe68], 0
je 0x1000aa0b
jmp 0x1000aa0d
jmp 0x1000a9e3
mov dword [ebp - 0xc38], 0xed40a165
mov dword [ebp - 0xf60], 1
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1000aa3b
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x1000aa57
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x83c], 0xda862840
mov dword [ebp - 0x614], 0x6bde64f
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x92c], 0xfffffff6
mov dword [ebp - 0xdf4], 0xb948214d
mov dword [ebp - 0xdf0], 0xb948214d
mov dword [ebp - 0xdec], 0xb948214d
mov dword [ebp - 0xde8], 0xb948214d
mov dword [ebp - 0x80c], 1
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0x5e4], 0x69a4575f
mov dword [ebp - 0x824], 0
mov dword [ebp - 0xbc4], 0x88a3
mov dword [ebp - 0x60c], 0xa6c9
mov dword [ebp - 0x258], 0
jmp 0x1000ab03
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 2
jge 0x1000ab1f
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xb3c], 7
jmp 0x1000aaf6
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xf68], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x92c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x92c], eax
jg 0x1000ab4b
mov dword [ebp - 0x5ac], 1
jmp 0x1000ab52
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0x8af16de6
jne 0x1000ab6a
mov dword [ebp - 0x804], 1
jmp 0x1000ab71
and dword [ebp - 0x804], 0
cmp dword [ebp - 0x804], 0x3ae5
je 0x1000ab83
cmp dword [ebp - 0x2c], 0
je 0x1000ab93
xor eax, eax
je 0x1000ab93
mov dword [ebp - 0x33c], 1
jmp 0x1000ab9a
and dword [ebp - 0x33c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x33c]
mov dword [ebp + eax - 0xdf4], ecx
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x33c], eax
jle 0x1000abc7
mov dword [ebp - 0x5b4], 1
jmp 0x1000abce
and dword [ebp - 0x5b4], 0
cmp dword [ebp - 0x5b4], 0xb5009892
jb 0x1000abe6
mov dword [ebp - 0x9c4], 1
jmp 0x1000abed
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x9c4]
add eax, 0xfffe
cmp eax, dword [ebp - 0x2c]
je 0x1000ac09
mov dword [ebp - 0x5bc], 1
jmp 0x1000ac10
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x80c], eax
jge 0x1000ac36
mov dword [ebp - 0x5c4], 1
jmp 0x1000ac3d
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x5c4], eax
je 0x1000ac57
mov dword [ebp - 0xbb0], 1
jmp 0x1000ac5e
and dword [ebp - 0xbb0], 0
cmp dword [ebp - 0x2c], 1
je 0x1000ac70
mov dword [ebp - 0x934], 1
jmp 0x1000ac77
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x934], eax
jle 0x1000ac8e
mov dword [ebp - 0xafc], 1
jmp 0x1000ac95
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xf70], eax
mov eax, 0x5b0bb8b
test eax, eax
ja 0x1000acb6
mov dword [ebp - 0x5cc], 1
jmp 0x1000acbd
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x11c]
add eax, dword [ebp - 0x5cc]
cmp eax, dword [ebp - 0x11c]
jne 0x1000acdd
mov dword [ebp - 0x814], 1
jmp 0x1000ace4
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x814]
sub eax, dword [ebp - 0x2c]
jne 0x1000ad01
mov eax, 0x8a8c
test eax, eax
jne 0x1000ad01
and dword [ebp - 0x5d4], 0
jmp 0x1000ad0b
mov dword [ebp - 0x5d4], 1
cmp dword [ebp - 0x5d4], 0xffff
jne 0x1000ad23
mov dword [ebp - 0xa3c], 1
jmp 0x1000ad2a
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x114]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x114]
jge 0x1000ad50
mov dword [ebp - 0x5dc], 1
jmp 0x1000ad57
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x11c]
imul eax, dword [ebp - 0x5dc]
cmp eax, 0x600bf094
jg 0x1000ad77
mov dword [ebp - 0x81c], 1
jmp 0x1000ad7e
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0
jae 0x1000ad93
mov dword [ebp - 0xaa8], 1
jmp 0x1000ad9a
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xf78], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xf80], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x5e4], eax
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x93c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x93c]
mov dword [ebp + eax - 0xb3c], ecx
cmp dword [ebp - 0x93c], 0xffffffff
jne 0x1000adf2
mov dword [ebp - 0x5ec], 1
jmp 0x1000adf9
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x824], 0
je 0x1000af2a
mov dword [ebp - 0x3c0], 0xdf607dbc
mov dword [ebp - 0xab0], 0xffffffff
mov dword [ebp - 0x944], 0xf643d9d7
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0xf88], eax
mov eax, dword [ebp - 0x2c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xb3c]
test eax, eax
jne 0x1000aee1
mov eax, dword [ebp - 0x3c0]
cmp dword [ebp - 0x3c0], eax
jge 0x1000ae75
mov eax, 0xfd32
test eax, eax
jne 0x1000ae75
and dword [ebp - 0x5f4], 0
jmp 0x1000ae7f
mov dword [ebp - 0x5f4], 1
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x5f4]
cmp eax, 0x99b5
jne 0x1000ae9b
mov dword [ebp - 0x9cc], 1
jmp 0x1000aea2
and dword [ebp - 0x9cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb3c]
cmp eax, dword [ebp - 0x9cc]
jg 0x1000aec3
mov dword [ebp - 0x5fc], 1
jmp 0x1000aeca
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0xbc4]
cmp dword [ebp - 0x5fc], eax
jne 0x1000aee1
and dword [ebp - 0x82c], 0
jmp 0x1000aeeb
mov dword [ebp - 0x82c], 1
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x82c], eax
jge 0x1000af05
mov dword [ebp - 0x604], 1
jmp 0x1000af0c
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0x944]
dec eax
mov dword [ebp - 0x944], eax
jmp 0x1000afaf
mov dword [ebp - 0xf90], 0xffffffff
push 2
lea ecx, [ebp - 0xd44]
call fcn.1001831b
mov dword [ebp - 4], 5
mov dword [ebp - 0x2b0], 0
jmp 0x1000af61
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 2
jge 0x1000af80
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0xd44]
call fcn.10018388
or dword [eax], 0xffffffff
jmp 0x1000af54
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
push 0
lea ecx, [ebp - 0xd44]
call fcn.10018388
mov dword [eax], 7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd44]
call fcn.10018383
mov dword [ebp - 0x344], 0xffffffff
push 1
lea ecx, [ebp - 0xcbc]
call fcn.1001831b
mov dword [ebp - 4], 6
mov dword [ebp - 0x80], 0
jmp 0x1000afdd
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1000aff9
push dword [ebp - 0x80]
lea ecx, [ebp - 0xcbc]
call fcn.10018388
mov dword [eax], 0x5b57fd54
jmp 0x1000afd6
mov dword [ebp - 0x80], 0
jmp 0x1000b009
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1000b01f
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xa90], 0x4c506d44
jmp 0x1000b002
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xa90], 0
jmp 0x1000b04d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa90]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa90], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa90], 0
jg 0x1000b16e
push 4
lea ecx, [ebp - 0xa7c]
call fcn.1001831b
mov byte [ebp - 4], 7
mov dword [ebp - 0x260], 0
jmp 0x1000b08b
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 4
jge 0x1000b0ad
push dword [ebp - 0x260]
lea ecx, [ebp - 0xa7c]
call fcn.10018388
mov dword [eax], 8
jmp 0x1000b07e
push 3
lea ecx, [ebp - 0xa7c]
call fcn.10018388
and dword [eax], 0
jmp 0x1000b0e3
push 3
lea ecx, [ebp - 0xa7c]
call fcn.10018388
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x834]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x834]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0xa7c]
call fcn.10018388
cmp dword [eax], 0
jl 0x1000b15a
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1000b11b
push 0
push 0x11ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 3
lea ecx, [ebp - 0xa7c]
call fcn.10018388
push dword [eax]
lea ecx, [ebp - 0xcbc]
call fcn.10018388
mov esi, eax
push 3
lea ecx, [ebp - 0xa7c]
call fcn.10018388
push dword [eax]
lea ecx, [ebp - 0xcbc]
call fcn.10018388
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000b0bf
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa7c]
call fcn.10018383
jmp 0x1000b032
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcbc]
call fcn.10018383
mov dword [ebp - 0x634], 0
mov dword [ebp - 0x954], 0xcce005ab
mov dword [ebp - 0x2f0], 0
jmp 0x1000b1aa
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 4
jge 0x1000b1c6
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x1130], 0x7a81a82e
jmp 0x1000b19d
mov dword [ebp - 0x124], 0
jmp 0x1000b1df
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xfffffffb
jne 0x1000b209
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1000b207
push 0x222
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
jmp 0x1000b1d2
cmp dword [ebp - 0x124], 0
jne 0x1000b376
xor eax, eax
jne 0x1000b33f
cmp dword [ebp - 0x124], 0
jne 0x1000b33f
mov dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0
je 0x1000b251
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x1000b251
mov dword [ebp - 0xa1c], 1
jmp 0x1000b258
and dword [ebp - 0xa1c], 0
cmp dword [ebp - 0xa1c], 0xac3e
jle 0x1000b272
xor eax, eax
inc eax
jne 0x1000b272
mov dword [ebp - 0x61c], 1
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x83c], eax
cmp dword [ebp - 0x83c], 0
jne 0x1000b2a3
mov dword [ebp - 0x63c], 1
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x63c]
mov dword [ebp - 0x84c], eax
jne 0x1000b376
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1130], 0
jne 0x1000b376
and dword [ebp - 0x644], 0
jmp 0x1000b380
mov dword [ebp - 0x644], 1
mov eax, dword [ebp - 0xc38]
imul eax, dword [ebp - 0x644]
mov dword [ebp - 0x954], eax
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x954], eax
jl 0x1000b3ad
mov dword [ebp - 0x64c], 1
jmp 0x1000b3b4
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
sub eax, dword [ebp - 0xab8]
cmp eax, 0xa684a08d
jb 0x1000b3d3
mov dword [ebp - 0x854], 1
jmp 0x1000b3da
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x268]
add eax, dword [ebp - 0x854]
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x1a8], 1
mov dword [ebp - 0x65c], 0xfffffffd
push 1
lea ecx, [ebp - 0xd5c]
call fcn.1001831b
mov dword [ebp - 4], 8
mov dword [ebp - 0xf98], 0xf0415773
mov dword [ebp - 0x85c], 0x514f
mov dword [ebp - 0x2b8], 0
jmp 0x1000b441
cmp dword [ebp - 0x2b8], 1
jge 0x1000b463
push dword [ebp - 0x2b8]
lea ecx, [ebp - 0xd5c]
call fcn.10018388
mov dword [eax], 0x6b471dfd
jmp 0x1000b434
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0xfa0], eax
cmp dword [ebp - 0x1a8], 0
je 0x1000b48d