Function at 0x10009282
Capabilities:
Check os version
Clear file content
Create thread
Delete file
Enumerate gui resources
Get common file path
Get disk information
Get graphical window text
Get thread local storage value
Identify system language via api
Parse pe header
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Query service status
Set registry value
Set thread local storage value

Disassembly:
mov eax, 0x100835f2
call fcn.100826bc
mov eax, 0x1854
call fcn.1007e890
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapCreate]
xor eax, eax
push esi
mov dword [ebp - 0x60], ecx
xor esi, esi
or ecx, 0xffffffff
mov byte [ebp - 0x59], dl
mov dword [ebp - 0x28], ecx
inc esi
mov dword [ebp - 0x40], 0x25062d7b
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfce06dfe
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], 0x5f5dda30
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0xfffffff3
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
jg 0x10009449
mov dword [ebp - 0x1c], 0x888a
lea ecx, [ebp - 0xb04]
push 4
call fcn.10027b4a
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], 0xe3bc4aee
mov dword [ebp - 0x34], 0xc0e42606
mov dword [ebp - 0x14], eax
jmp 0x10009321
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb04]
call fcn.10027bb7
mov dword [eax], 0x20bd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000930a
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x28]
je 0x100093df
mov dword [ebp - 0x30], 0x105a
mov dword [ebp - 0x1c], 0xfffffff5
jmp 0x100093d3
xor eax, eax
mov dword [ebp - 0x44], 0x4b7834d8
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x1000938b
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000936a
push 0x104c
push eax
push eax
call edi
push dword [ebp - 0x44]
lea ecx, [ebp - 0xb04]
call fcn.10027bb7
cmp dword [eax], 0
jne 0x10009389
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
push 0
pop eax
jle 0x10009358
xor eax, eax
mov dword [ebp - 0x40], 0xc6076fda
cmp dword [ebp - 0x40], eax
je 0x100093af
mov eax, dword [ebp - 0x44]
sub eax, 0x15fb
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x44]
jge 0x100093ad
mov eax, esi
jmp 0x100093af
xor eax, eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x30]
sete cl
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setl cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
jg 0x10009346
jmp 0x10009423
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10009406
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x17dc], 0xefec
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100093ed
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009420
push 0x57f
push 0x2581
push 0x65f
call ebx
mov dword [ebp - 0x40], esi
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xb04]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10027bb2
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff3
jle 0x100092de
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x40], 0x25062d7b
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0xfce06dfe
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], 0x5f5dda30
mov dword [ebp - 0x28], ecx
jmp 0x100095cb
mov dword [ebp - 0x1c], 0x888a
lea ecx, [ebp - 0xd5c]
push 4
call fcn.10027b4a
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x40], 0xe3bc4aee
mov dword [ebp - 0x34], 0xc0e42606
mov dword [ebp - 0x14], eax
jmp 0x100094b2
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd5c]
call fcn.10027bb7
mov dword [eax], 0x20bd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000949b
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x28]
je 0x10009570
mov dword [ebp - 0x30], 0x105a
mov dword [ebp - 0x1c], 0xfffffff5
jmp 0x10009564
xor eax, eax
mov dword [ebp - 0x44], 0x4b7834d8
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x1000951c
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100094fb
push 0x104c
push eax
push eax
call edi
push dword [ebp - 0x44]
lea ecx, [ebp - 0xd5c]
call fcn.10027bb7
cmp dword [eax], 0
jne 0x1000951a
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
push 0
pop eax
jle 0x100094e9
xor eax, eax
mov dword [ebp - 0x40], 0xc6076fda
cmp dword [ebp - 0x40], eax
je 0x10009540
mov eax, dword [ebp - 0x44]
sub eax, 0x15fb
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x44]
jge 0x1000953e
mov eax, esi
jmp 0x10009540
xor eax, eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x30]
sete cl
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setl cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
jg 0x100094d7
jmp 0x100095b4
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10009597
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x17ac], 0xefec
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000957e
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100095b1
push 0x57f
push 0x2581
push 0x65f
call ebx
mov dword [ebp - 0x40], esi
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xd5c]
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10027bb2
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff3
jle 0x1000946f
movdqa xmm0, xmmword [0x10007ff0]
lea eax, [ebp - 0x12a0]
push eax
lea eax, [ebp - 0x12b0]
mov dword [ebp - 0x28], 0xfffffff9
push eax
lea ecx, [ebp - 0x16f8]
movdqu xmmword [ebp - 0x12b0], xmm0
call fcn.10027bc6
lea ecx, [ebp - 0x194]
mov esi, eax
call fcn.1000927a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xf00]
push dword [esi]
call fcn.10027b8c
push 2
pop eax
xor ebx, ebx
mov dword [ebp - 4], eax
inc ebx
lea ecx, [ebp - 0xb1c]
push ebx
call fcn.10027b4a
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10009660
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb1c]
call fcn.10027bb7
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10009646
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x10009691
push ebx
lea ecx, [ebp - 0xf00]
call fcn.10027bb7
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0xf00]
call fcn.10027bb7
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [eax]
jg 0x1000968f
mov ecx, ebx
jmp 0x10009693
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0xfe04
setg al
add eax, dword [ebp - 0x28]
je 0x100096ae
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x100096b0
mov esi, ebx
jmp 0x100096b2
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xb1c]
call fcn.10027bb7
mov dword [eax], esi
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x100096d7
push eax
push 0xd98
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
lea ecx, [ebp - 0xb1c]
call fcn.10027bb2
or eax, 0xffffffff
lea ecx, [ebp - 0xf00]
mov dword [ebp - 4], eax
call fcn.10027bb2
xor eax, eax
mov dword [ebp - 0x28], 0xf8067e30
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0xb34]
push 3
call fcn.10027b4a
xor eax, eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000973d
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb34]
call fcn.10027bb7
mov dword [eax], 0x60d2f38d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000971e
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000974d
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x3c], 0x9ec4279c
lea ecx, [ebp - 0xb34]
push 2
call fcn.10027bb7
mov ecx, dword [ebp - 0x28]
mov esi, eax
xor eax, eax
cmp ecx, ebx
mov ecx, dword [ebp - 0x28]
setg al
xor edx, edx
add eax, 4
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ebx, ebx
cmp edx, eax
mov edx, dword [ebp - 0x28]
setg bl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, ebx
lea ecx, [ebp - 0xb34]
setne al
or ebx, 0xffffffff
sub eax, dword [ebp - 0x28]
mov dword [esi], eax
mov dword [ebp - 4], ebx
call fcn.10027bb2
push 2
pop esi
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x2b8]
push esi
call fcn.10027b4a
mov dword [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], eax
jmp 0x100097ea
push dword [ebp - 0x14]
call fcn.10027bb7
mov dword [eax], 3
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x2b8]
cmp dword [ebp - 0x14], esi
jl 0x100097d9
xor ebx, ebx
inc ebx
push ebx
call fcn.10027bb7
push ebx
lea ecx, [ebp - 0x2b8]
and dword [eax], 0
call fcn.10027bb7
push 0xfffffffffffffff6
pop ecx
cmp dword [eax], ecx
jne 0x100098ae
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x30], 0x189f42c6
push ebx
call fcn.10027bb7
mov esi, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
add esi, dword [eax]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setg dl
cmp esi, edx
jl 0x1000984d
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x28], eax
je 0x1000984f
mov esi, ebx
push ebx
lea ecx, [ebp - 0x2b8]
call fcn.10027bb7
mov ecx, dword [ebp - 0x28]
imul ecx, esi
cmp ecx, dword [eax]
jne 0x1000986e
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x28], eax
je 0x10009870
mov esi, ebx
push ebx
lea ecx, [ebp - 0x2b8]
call fcn.10027bb7
xor ecx, ecx
push ebx
cmp esi, dword [eax]
setl cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x2b8]
call fcn.10027bb7
push ebx
lea ecx, [ebp - 0x2b8]
dec dword [eax]
call fcn.10027bb7
push 0xfffffffffffffff6
pop ecx
cmp dword [eax], ecx
je 0x10009818
push 2
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 4], eax
call fcn.10027bb2
xor eax, eax
mov dword [ebp - 0x40], 0x25062d7b
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x1044]
mov dword [ebp - 0x14], 0xd5e48d32
mov dword [ebp - 0x30], eax
push ebx
call fcn.10027b4a
mov dword [ebp - 4], 6
lea ecx, [ebp - 0xd74]
mov dword [ebp - 0x34], 0xfffffffc
or eax, 0xffffffff
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], eax
push ebx
call fcn.10027b4a
xor eax, eax
mov byte [ebp - 4], 7
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10009937
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1044]
call fcn.10027bb7
mov dword [eax], 0x194ddbc3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10009919
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10009952
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd74]
call fcn.10027bb7
push 0xfffffffffffffff6
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000993c
mov dword [ebp - 0x14], 0xe
jmp 0x1000996c
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 9
mov eax, 0xffff
jne 0x10009960
xor ebx, ebx
lea ecx, [ebp - 0xd74]
push ebx
call fcn.10027bb7
lea ecx, [ebp - 0xd74]
dec dword [eax]
call fcn.10027bb2
or eax, 0xffffffff
lea ecx, [ebp - 0x1044]
mov dword [ebp - 4], eax
call fcn.10027bb2
mov dword [ebp - 0x34], 0xfce06dfe
lea ecx, [ebp - 0x3b0]
mov dword [ebp - 0x40], esi
mov eax, 0x8ed4a55f
mov dword [ebp - 0x3c], 0xe2bbef7d
mov dword [ebp - 0x30], 0x21f1
mov dword [ebp - 0x50], 0x890c5440
mov dword [ebp - 0x6bc], eax
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x6b4], eax
mov dword [ebp - 0x6b0], eax
mov dword [ebp - 0x28], ebx
push esi
call fcn.10027b4a
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x4c], eax
inc ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10009a21
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x490], 0x1145714f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10009a09
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x10009a47
push dword [ebp - 0x20]
lea ecx, [ebp - 0x3b0]
call fcn.10027bb7
mov dword [eax], 0x4eb0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10009a29
xor eax, eax
mov dword [ebp - 0x40], eax
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, 0xfffc
setl dl
cmp edx, eax
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
test eax, eax
mov eax, 0xffff
setg cl
cmp edx, ecx
jge 0x10009aa7
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], 0xfffffff9
mov ecx, dword [ebp - 0x490]
mov eax, dword [ebp - 0x40]
dec dword [ebp - 0x490]
dec dword [ebp - 0x40]
cmp eax, ecx
jle 0x10009a9d
mov eax, ebx
jmp 0x10009a9f
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10009c4d
mov dword [ebp - 0x1c], 0xdd48
mov dword [ebp - 0x40], 0x336a
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x490]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10009acc
mov esi, ebx
cmp dword [ebp - 0x1c], eax
jne 0x10009ace
mov esi, eax
push eax
lea ecx, [ebp - 0x3b0]
call fcn.10027bb7
mov dword [eax], esi
test esi, esi
jne 0x10009ae9
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x10009aeb
mov edx, ebx
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
mov dword [ebp - 0x6b0], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
sub dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], ebx
jg 0x10009c4d
jmp 0x10009b1e
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10009b3e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1e4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10009b26
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009b5d
push eax
push 0x4eb
push 0x1812
push 0x12a
call dword [sym.imp.KERNEL32.dll_RaiseException]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x3b0]
call fcn.10027bb7
cmp dword [eax], 0
jne 0x10009c09
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x3b0]
call fcn.10027bb7
lea ecx, [ebp - 0x3b0]
mov dword [eax], 0xfffffffe
mov eax, dword [ebp - 0x1e4]
push dword [ebp - 0x4c]
call fcn.10027bb7
mov ecx, dword [ebp - 0x1e4]
cmp ecx, dword [eax]
jne 0x10009bb2
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x1e4], eax
je 0x10009bb4
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x6b0]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
add eax, ecx
je 0x10009bec
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x3b0]
call fcn.10027bb7
cmp dword [eax], 0
je 0x10009bec
mov ecx, ebx
jmp 0x10009bf0
xor eax, eax
mov ecx, eax
mov eax, 0x16590181
sub eax, ecx
sub eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x6b0]
jne 0x10009c09
mov ecx, eax
jmp 0x10009c0b
mov ecx, ebx
mov eax, dword [ebp - 0x30]
sub ecx, eax
je 0x10009c29
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x3b0]
call fcn.10027bb7
cmp dword [eax], 0
je 0x10009c29
mov eax, ebx
jmp 0x10009c2b
xor eax, eax
imul ecx, eax, 0xaec2
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setl dl
mov dword [ebp - 0x6bc], edx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ebx
jle 0x10009b1c
or esi, 0xffffffff
lea ecx, [ebp - 0x3b0]
mov dword [ebp - 4], esi
call fcn.10027bb2
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], 0x5f5dda30
mov dword [ebp - 0x28], esi
jmp 0x10009dd1
mov dword [ebp - 0x1c], 0x888a
lea ecx, [ebp - 0xb4c]
push 4
call fcn.10027b4a
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x40], 0xe3bc4aee
mov dword [ebp - 0x34], 0xc0e42606
mov dword [ebp - 0x14], eax
jmp 0x10009cb7
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb4c]
call fcn.10027bb7
mov dword [eax], 0x20bd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10009ca0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x28]
je 0x10009d75
mov dword [ebp - 0x30], 0x105a
mov dword [ebp - 0x1c], 0xfffffff5
jmp 0x10009d69
xor eax, eax
mov dword [ebp - 0x44], 0x4b7834d8
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x10009d21
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009d00
push 0x104c
push eax
push eax
call edi
push dword [ebp - 0x44]
lea ecx, [ebp - 0xb4c]
call fcn.10027bb7
cmp dword [eax], 0
jne 0x10009d1f
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
push 0
pop eax
jle 0x10009cee
xor eax, eax
mov dword [ebp - 0x40], 0xc6076fda
cmp dword [ebp - 0x40], eax
je 0x10009d45
mov eax, dword [ebp - 0x44]
sub eax, 0x15fb
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x44]
jge 0x10009d43
mov eax, ebx
jmp 0x10009d45
xor eax, eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x30]
sete cl
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setl cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
jg 0x10009cdc
jmp 0x10009dbd
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10009d9c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x17f4], 0xefec
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10009d83
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10009dba
push 0x57f
push 0x2581
push 0x65f
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [ebp - 0x40], ebx
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0xb4c]
mov dword [ebp - 4], esi
call fcn.10027bb2
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff3
jle 0x10009c70
movdqa xmm0, xmmword [0x10007fe0]
lea eax, [ebp - 0x13e0]
push eax
lea eax, [ebp - 0x13f0]
push eax
lea ecx, [ebp - 0x1708]
movdqu xmmword [ebp - 0x13f0], xmm0
call fcn.10027bc6
lea ecx, [ebp - 0x196]
mov esi, eax
call fcn.1000927a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe94]
push dword [esi]
call fcn.10027b8c
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x5f8]
xor eax, eax
mov dword [ebp - 0x2c], 0x951e
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0x919c44d4
push ebx
call fcn.10027b4a
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x14], eax
jmp 0x10009e71
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5f8]
call fcn.10027bb7
mov dword [eax], 0x36572186
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10009e5a
push ebx
lea ecx, [ebp - 0xe94]
call fcn.10027bb7
mov edx, dword [eax]
lea ecx, [edx - 1]
mov dword [eax], ecx
test edx, edx
jne 0x10009e96
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x10009e98
mov esi, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
neg eax
cmp eax, 0x244c3f4
setle cl
neg ecx
jne 0x10009eb2
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10009eb4
mov eax, ebx
mov dword [ebp - 0x44], eax
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
push ebx
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
cmp esi, edx
setl cl
xor eax, eax
add ecx, dword [ebp - 0x2c]
cmp ecx, 0x39d20578
lea ecx, [ebp - 0xe94]
setl al
mov dword [ebp - 0x40], eax
call fcn.10027bb7
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x44]
dec eax
cmp dword [ebp - 0x40], eax
jne 0x10009f03
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x44]
cmp ecx, eax
lea ecx, [ebp - 0x5f8]
setg dl
xor ebx, ebx
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
push ebx
call fcn.10027bb7
xor ecx, ecx
mov edi, 0xe1d67a3d
mov esi, edi
push ebx
cmp dword [eax], ebx
setg cl
sub esi, ecx
lea ecx, [ebp - 0x5f8]
call fcn.10027bb7
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
add ecx, esi
add edx, ecx
lea ecx, [ebp - 0x5f8]
cmp edx, dword [eax]
setg bl
xor eax, eax
push eax
call fcn.10027bb7
xor ecx, ecx
cmp ebx, dword [eax]
setne cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x5f8]
call fcn.10027bb2
or eax, 0xffffffff
lea ecx, [ebp - 0xe94]
mov dword [ebp - 4], eax
call fcn.10027bb2
movdqa xmm0, xmmword [0x10007ff0]
lea eax, [ebp - 0x12c0]
push eax
lea eax, [ebp - 0x12d0]
mov dword [ebp - 0x28], 0xfffffff9
push eax
lea ecx, [ebp - 0x16a8]
movdqu xmmword [ebp - 0x12d0], xmm0
call fcn.10027bc6
lea ecx, [ebp - 0x198]
mov esi, eax
call fcn.1000927a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xd8c]
push dword [esi]
call fcn.10027b8c
xor ebx, ebx
mov dword [ebp - 4], 0xc
inc ebx
lea ecx, [ebp - 0xb64]
push ebx
call fcn.10027b4a
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a00f
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb64]
call fcn.10027bb7
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10009ff5
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000a040
push ebx
lea ecx, [ebp - 0xd8c]
call fcn.10027bb7
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0xd8c]
call fcn.10027bb7
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [eax]
jg 0x1000a03e
mov ecx, ebx
jmp 0x1000a042
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0xfe04
setg al
add eax, dword [ebp - 0x28]
je 0x1000a05d
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000a05f
mov esi, ebx
jmp 0x1000a061
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xb64]
call fcn.10027bb7
mov dword [eax], esi
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1000a086
push eax
push 0xd98
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
lea ecx, [ebp - 0xb64]
call fcn.10027bb2
or eax, 0xffffffff
lea ecx, [ebp - 0xd8c]
mov dword [ebp - 4], eax
call fcn.10027bb2
xor eax, eax
mov dword [ebp - 0x28], 0xf8067e30
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0xb7c]
push 3
call fcn.10027b4a
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000a0ec
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb7c]
call fcn.10027bb7
mov dword [eax], 0x60d2f38d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000a0cd
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000a0fc
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x3c], 0x9ec4279c
lea ecx, [ebp - 0xb7c]
push 2
call fcn.10027bb7
mov ecx, dword [ebp - 0x28]
mov esi, eax
xor eax, eax
cmp ecx, ebx
mov ecx, dword [ebp - 0x28]
setg al
xor edx, edx
add eax, 4
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ebx, ebx
cmp edx, eax
mov edx, dword [ebp - 0x28]
setg bl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, ebx
lea ecx, [ebp - 0xb7c]
setne al
sub eax, dword [ebp - 0x28]
mov dword [esi], eax
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.10027bb2
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x2a0]
call fcn.10027b4a
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], eax
jmp 0x1000a196
push dword [ebp - 0x14]
call fcn.10027bb7
mov dword [eax], 3
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x2a0]
cmp dword [ebp - 0x14], ebx
jl 0x1000a185
xor esi, esi
inc esi
push esi
call fcn.10027bb7
push esi
lea ecx, [ebp - 0x2a0]
and dword [eax], 0
call fcn.10027bb7
push 0xfffffffffffffff6
pop ecx
cmp dword [eax], ecx
jne 0x1000a266
push ecx
pop edi
mov dword [ebp - 0x3c], esi
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 0x30], 0x189f42c6
push esi
call fcn.10027bb7
mov esi, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
add esi, dword [eax]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setg dl
cmp esi, edx
jl 0x1000a200
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1000a200
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x1000a205
xor ebx, ebx
inc ebx
mov esi, ebx
push ebx
lea ecx, [ebp - 0x2a0]
call fcn.10027bb7
mov ecx, dword [ebp - 0x28]
imul ecx, esi
cmp ecx, dword [eax]
jne 0x1000a224
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x28], eax
je 0x1000a226
mov esi, ebx
push ebx
lea ecx, [ebp - 0x2a0]
call fcn.10027bb7
xor ecx, ecx
cmp esi, dword [eax]
setl cl
xor esi, esi
mov dword [ebp - 0x30], ecx
inc esi
push esi
lea ecx, [ebp - 0x2a0]
call fcn.10027bb7
push esi
lea ecx, [ebp - 0x2a0]
dec dword [eax]
call fcn.10027bb7
cmp dword [eax], edi
je 0x1000a1c6
mov edi, 0xe1d67a3d
or ebx, 0xffffffff
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 4], ebx
call fcn.10027bb2
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x1174]
xor eax, eax
mov dword [ebp - 0x14], 0xd5e48d32
mov dword [ebp - 0x30], eax
push esi
call fcn.10027b4a
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0xedc]
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], ebx
push esi
call fcn.10027b4a
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000a2e5
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1174]
call fcn.10027bb7
mov dword [eax], 0x194ddbc3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000a2c7
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000a30d
push 0xfffffffffffffff6
pop edi
push dword [ebp - 0x20]
lea ecx, [ebp - 0xedc]
call fcn.10027bb7
mov dword [eax], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000a2f0
mov edi, 0xe1d67a3d
mov dword [ebp - 0x14], 0xe
cmp dword [ebp - 0x14], 9
je 0x1000a336
mov edi, 0xffff
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 9
jne 0x1000a31f
mov edi, 0xe1d67a3d
xor ebx, ebx
lea ecx, [ebp - 0xedc]
push ebx
call fcn.10027bb7
lea ecx, [ebp - 0xedc]
dec dword [eax]
call fcn.10027bb2
or eax, 0xffffffff
lea ecx, [ebp - 0x1174]
mov dword [ebp - 4], eax
call fcn.10027bb2
mov dword [ebp - 0x40], 0x25062d7b
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x40], 2
mov eax, 0x8ed4a55f
mov dword [ebp - 0x3c], 0xe2bbef7d
mov dword [ebp - 0x30], 0x21f1
mov dword [ebp - 0x50], 0x890c5440
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], eax
push 2
mov dword [ebp - 0x6cc], eax
mov dword [ebp - 0x28], ebx
pop ebx
push ebx
call fcn.10027b4a
mov dword [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000a3e6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x488], 0x1145714f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a3ce
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000a40c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x350]
call fcn.10027bb7
mov dword [eax], 0x4eb0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a3ee
xor eax, eax
xor edx, edx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setl dl
cmp edx, 0xfffc
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
test eax, eax
mov eax, 0xffff
setg cl
cmp edx, ecx
jge 0x1000a46b
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], 0xfffffff9
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x488]
dec dword [ebp - 0x488]
dec dword [ebp - 0x40]
cmp ecx, eax
jle 0x1000a461
mov eax, esi
jmp 0x1000a463
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1000a61b
mov dword [ebp - 0x1c], 0xdd48
mov dword [ebp - 0x40], 0x336a
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x488]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1000a48e
cmp dword [ebp - 0x1c], eax
jne 0x1000a490
mov esi, eax
push eax
lea ecx, [ebp - 0x350]
call fcn.10027bb7
mov dword [eax], esi
test esi, esi
jne 0x1000a4ae
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1000a4ae
mov edx, eax
inc esi
jmp 0x1000a4b3
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
mov dword [ebp - 0x6cc], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
sub dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], esi
jg 0x1000a61b
jmp 0x1000a4e6
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x1000a506
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x19c], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000a4ee
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000a525
push eax
push 0x4eb
push 0x1812
push 0x12a
call dword [sym.imp.KERNEL32.dll_RaiseException]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x350]
call fcn.10027bb7
xor edi, edi
cmp dword [eax], edi
jne 0x1000a5d5
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x350]
call fcn.10027bb7
lea ecx, [ebp - 0x350]
mov dword [eax], 0xfffffffe
mov eax, dword [ebp - 0x19c]
push dword [ebp - 0x4c]
call fcn.10027bb7
mov ecx, dword [ebp - 0x19c]
cmp ecx, dword [eax]
jne 0x1000a57b
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x19c], eax
je 0x1000a57d
mov ecx, esi
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x6cc]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
add eax, ecx
je 0x1000a5b4
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x350]
call fcn.10027bb7
cmp dword [eax], edi
je 0x1000a5b4
mov ecx, esi
jmp 0x1000a5ba
xor eax, eax
xor edi, edi
mov ecx, eax
mov eax, 0x16590181
sub eax, ecx
sub eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x6cc]
jne 0x1000a5d5
mov ecx, eax
xor edi, edi
jmp 0x1000a5d7
mov ecx, esi
mov eax, dword [ebp - 0x30]
sub ecx, eax
je 0x1000a5f2
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x350]
call fcn.10027bb7
cmp dword [eax], edi
mov eax, esi
jne 0x1000a5f4
mov eax, edi
imul ecx, eax, 0xaec2
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setl dl
mov dword [ebp - 0x6d8], edx
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], esi
jle 0x1000a4e4
mov edi, 0xe1d67a3d
or eax, 0xffffffff
lea ecx, [ebp - 0x350]
mov dword [ebp - 4], eax
call fcn.10027bb2
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000a656
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1544], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000a63d
xor eax, eax
mov dword [ebp - 0x14], 0x15
jmp 0x1000a6ae
mov dword [ebp - 0x28], 9
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000a689
push 0x1c0b
push eax
push 0x24f8
push 0x18d
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000a6ab
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1544], 0x7a888ada
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1000a692
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jne 0x1000a65f
mov dword [ebp - 0x34], 0xfce06dfe
lea ecx, [ebp - 0x3c8]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x4c], 0xe17b844a
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x18], eax
push ebx
call fcn.10027b4a
xor eax, eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x14], eax
jmp 0x1000a700
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3c8]
call fcn.10027bb7
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a6e9
mov eax, dword [ebp - 0x4c]
neg eax
push 0
sbb eax, eax
neg eax
pop eax
setns al
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x4c], esi
cmp dword [ebp - 0x4c], eax
jl 0x1000a8d6
push ebx
lea ecx, [ebp - 0x860]
call fcn.10027b4a
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x14], eax
jmp 0x1000a764
push dword [ebp - 0x14]
lea ecx, [ebp - 0x860]
call fcn.10027bb7
push 0xfffffffffffffff6
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a74e
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x3c8]
mov eax, dword [ebp - 0x4c]
push dword [ebp - 0x4c]
call fcn.10027bb7
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x3c8]
mov esi, eax
call fcn.10027bb7
mov ecx, dword [esi]
xor ebx, ebx
push dword [ebp - 0x4c]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x3c8]
setle bl
call fcn.10027bb7
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x4c]
imul ecx, ebx
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x3c8]
setne bl
mov dword [ebp - 0x30], ebx
call fcn.10027bb7
xor esi, esi
lea ecx, [ebp - 0x860]
inc esi
push esi
mov dword [eax], ebx
call fcn.10027bb7
xor ebx, ebx
lea ecx, [ebp - 0x860]
mov eax, dword [eax]
add eax, 0x9752
cmp dword [ebp - 0x30], eax
setne bl
xor edi, edi
push edi
call fcn.10027bb7
mov eax, dword [eax]
imul eax, ebx
cmp eax, esi
jl 0x1000a84c
mov dword [ebp - 0x1c], esi
xor eax, eax
cmp dword [ebp - 0x1c], eax
jl 0x1000a877
mov dword [ebp - 0x18], eax
jmp 0x1000a840
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000a83d
push 0x1918
push 0x7a3
push 0x15b0
push 0x209f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1000a80a
dec dword [ebp - 0x1c]
jns 0x1000a805
jmp 0x1000a877
xor eax, eax
mov dword [ebp - 0x30], 0x3f079038
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1000a866
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor eax, eax
push eax
lea ecx, [ebp - 0x3c8]
call fcn.10027bb7
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000a8b0
mov dword [ebp - 0x30], 0x270c1731
lea ecx, [ebp - 0x3c8]
push esi
call fcn.10027bb7
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1000a8ad
push 0xe63
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff5
jne 0x1000a87e
lea ecx, [ebp - 0x860]
mov byte [ebp - 4], 0x13
call fcn.10027bb2
dec dword [ebp - 0x4c]
push 2
pop ebx
jns 0x1000a737
mov edi, 0xe1d67a3d
or esi, 0xffffffff
lea ecx, [ebp - 0x3c8]
mov dword [ebp - 4], esi
call fcn.10027bb2
mov dword [ebp - 0x30], 0x5f5dda30
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], 0xfffffff3
jg 0x1000ce1b
xor edi, edi
inc edi
movdqa xmm0, xmmword [0x10008090]
lea eax, [ebp - 0x1480]
push eax
mov dword [ebp - 0x18], 7
lea eax, [ebp - 0x1490]
mov dword [ebp - 0x40], 0xb37b0480
lea ecx, [ebp - 0x16b0]
mov dword [ebp - 0x3c], 0x3ec3d4e7
mov dword [ebp - 0x3c], 0xfffffffc
push eax
movdqu xmmword [ebp - 0x1490], xmm0
call fcn.10027bc6
lea ecx, [ebp - 0x19d]
mov esi, eax
call fcn.1000927a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1c0]
push dword [esi]
call fcn.10027b8c
lea eax, [ebp - 0x12e0]
mov dword [ebp - 4], 0x15
movdqa xmm0, xmmword [0x10008050]
lea ecx, [ebp - 0x1600]
push eax
lea eax, [ebp - 0x12f0]
mov dword [ebp - 0x40], 0x4a2c6eb8
push eax
movdqu xmmword [ebp - 0x12f0], xmm0
call fcn.10027bc6
lea ecx, [ebp - 0x225]
mov esi, eax
call fcn.1000927a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xb94]
push dword [esi]
call fcn.10027b8c
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x28], 0x57e8f534
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1000a9e4
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6e4], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1000a9cf
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000aa06
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1410], 0xa5cd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000a9ed
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1000aa7c
mov ecx, dword [ebp - 0x18]
xor edx, edx
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
xor eax, eax
add edx, dword [ebp - 0x18]
cmp edx, 0x7684593f
setg al
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor ebx, ebx
imul ecx, dword [ebp - 0x18]
push ebx
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x1c0]
call fcn.10027bb7
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [eax]
jle 0x1000aa62
push ebx
lea ecx, [ebp - 0x1c0]
call fcn.10027bb7
push ebx
lea ecx, [ebp - 0x1c0]
call fcn.10027bb7
push ebx
lea ecx, [ebp - 0x1c0]
call fcn.10027bb7
xor eax, eax
push eax
lea ecx, [ebp - 0x1c0]
call fcn.10027bb7
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c0]
neg eax
sbb eax, eax
inc eax
neg eax
mov dword [ebp - 0x3c], eax
xor eax, eax
push eax
call fcn.10027bb7
mov ecx, dword [ebp - 0x3c]
xor edx, edx
cmp ecx, edi
setle dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
xor eax, eax
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], eax
je 0x1000aac1
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x6e0], eax
xor esi, esi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push esi
call fcn.10027bb7
or ecx, 0xffffffff
xor ebx, ebx
push esi
cmp dword [eax], ecx
lea ecx, [ebp - 0x1c0]
sete bl
call fcn.10027bb7
push esi
lea ecx, [ebp - 0x1c0]
sub ebx, dword [eax]
call fcn.10027bb7
push esi
lea ecx, [ebp - 0xb94]
sub ebx, dword [eax]
call fcn.10027bb7
or esi, 0xffffffff
push 3
mov dword [eax], ebx
xor eax, eax
mov dword [ebp - 0x20], 0xfffd
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jg 0x1000ac26
mov dword [ebp - 0x1c], 0xfff6
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x3c], 0x837b75ae
push eax
call fcn.10027bb7
mov esi, dword [ebp - 0x1408]
xor edx, edx
mov ecx, dword [ebp - 0x6e0]
mov edi, eax
sub esi, ecx
mov ecx, dword [ebp - 0x20]
cmp esi, ecx
sete dl
add edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x6e4]
mov eax, dword [ebp - 0x20]
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
sub ecx, dword [ebp - 0x50]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
add ecx, dword [ebp - 0x40]
cmp ecx, 0x44351d5e
setle al
xor edx, edx
imul eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
imul ecx, eax, 0x599
mov eax, dword [ebp - 0x1408]
cmp ecx, eax
setle dl
sub edx, dword [edi]
cmp edx, 0x3b0f6051
jl 0x1000abc9
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1000abc9
xor edi, edi
mov esi, eax
inc edi
jmp 0x1000abce
xor edi, edi
inc edi
mov esi, edi
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xb94]
push dword [ebp - 0x18]
call fcn.10027bb7
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, ecx
push 0
setge dl
mov dword [eax], edx
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x3c], 0xaab159bb
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], ebx
jle 0x1000ab30
or esi, 0xffffffff
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000ac3a
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x1000ac85
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000ac5f
push eax
push eax
push eax
push eax
push eax
push eax
push 0x883
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000ac80
push 0x23d6
push eax
push 0x1f78
push 0xda1
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1000ac42
lea ecx, [ebp - 0xb94]
call fcn.10027bb2
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 4], esi
call fcn.10027bb2
mov dword [ebp - 0x38], 0x888a
lea ecx, [ebp - 0x105c]
mov dword [ebp - 0x3c], esi
push 2
mov dword [ebp - 0x34], 0x3717be9f
mov dword [ebp - 0x34], ebx
pop ebx
push ebx
call fcn.10027b4a
mov dword [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1000aced
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x102c], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000acd9
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000ad03
push dword [ebp - 0x20]
call fcn.10027bb7
mov dword [eax], 5
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x105c]
cmp dword [ebp - 0x20], ebx
jl 0x1000acf2
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x40]
mov dword [ebp - 4], esi
call fcn.10027bb2
push 4
lea ecx, [ebp - 0xdd4]
call fcn.10027b4a
mov dword [ebp - 4], 0x18
lea ecx, [ebp - 0x878]
mov dword [ebp - 0x3c], 0xe3bc4aee
xor eax, eax
mov dword [ebp - 0x28], 0xcecb4571
mov dword [ebp - 0x50], 0x5b49
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], eax
push 3
call fcn.10027b4a
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x1c], eax
jmp 0x1000ad82
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x878]
call fcn.10027bb7
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000ad6b
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
jle 0x1000adac
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1000aefc
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jmp 0x1000aefc
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x40], 0xa6f
lea ecx, [ebp - 0x938]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x44], 0xf06982b3
push edi
call fcn.10027b4a
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0xf48], esi
mov dword [ebp - 0xf44], esi
mov dword [ebp - 0xf40], esi
mov dword [ebp - 0xf3c], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1000ae0d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x938]
call fcn.10027bb7
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000adf2
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000ae25
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000ae74
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x878]
sub eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
imul eax, dword [ebp - 0x3c], 0x2c93
push ebx
add eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x40]
shl eax, 2
sub esi, eax
call fcn.10027bb7
mov dword [eax], esi
mov dword [ebp - 0x44], esi
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x40]
jmp 0x1000ae76
xor ebx, ebx
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x938]
push ebx
call fcn.10027bb7
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x878]
push 2
call fcn.10027bb7
xor ecx, ecx
cmp dword [eax], ebx
setne cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
sub ecx, eax
mov eax, dword [ebp - 0xf40]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
imul eax, ecx, 0xa408
test eax, eax
je 0x1000aecb
mov eax, dword [ebp - 0x50]
push ebx
lea ecx, [ebp - 0x938]
call fcn.10027bb7
mov ecx, dword [ebp - 0x50]
mov edx, 0x843046b6
sub edx, ecx
xor ecx, ecx
cmp edx, 0x8b5a
setle cl
mov dword [eax], ecx
lea ecx, [ebp - 0x938]
call fcn.10027bb2
push 2
pop ebx
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0x18
call fcn.10027bb2
mov dword [ebp - 0x34], 0xc0e42606
xor eax, eax
mov dword [ebp - 0x44], 0x1928c176
mov dword [ebp - 0x2c], 0x515466bc
mov dword [ebp - 0x40], 0x18bd8502
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1000af3e
push 0x2595
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [ebp - 0x44], 0x16
cmp dword [ebp - 0x44], 0x19
jg 0x1000b155
jmp 0x1000af53
xor eax, eax
push 3
pop ebx
mov dword [ebp - 0x18], 0xfc3938dd
lea ecx, [ebp - 0x9f8]
mov dword [ebp - 0x4c], eax
push ebx
call fcn.10027b4a
push ebx
lea ecx, [ebp - 0xda4]
mov byte [ebp - 4], 0x1b
call fcn.10027b4a
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000afa8
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9f8]
call fcn.10027bb7
mov dword [eax], 0x105807c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000af8a
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000afce
push dword [ebp - 0x20]
lea ecx, [ebp - 0xda4]
call fcn.10027bb7
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000afb0
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000b027
mov eax, dword [ebp - 0x18]
mov ecx, 0x496e854a
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
sub ecx, eax
add ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xef6e229e
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle bl
xor ecx, ecx
cmp ebx, eax
setg cl
cmp dword [ebp - 0x44], ecx
jl 0x1000b025
mov edx, edi
jmp 0x1000b029
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 3
cmp eax, edi
jg 0x1000b0f3
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1000b0f5
mov dword [ebp - 0x4c], 0x1d
cmp dword [ebp - 0x4c], 0x1c
jge 0x1000b07c
mov dword [ebp - 0x3c], 0x5d06
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], edi
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x1c
jl 0x1000b05e
xor eax, eax
push 2
mov dword [ebp - 0x4c], eax
pop ebx
jmp 0x1000b0ec
mov dword [ebp - 0x18], eax
jmp 0x1000b0bf
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x1000b0bc
push ebx
lea ecx, [ebp - 0xda4]
call fcn.10027bb7
mov dword [eax], ebx
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1000b0b5
push 0x584
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec dword [ebp - 0x2c]
jns 0x1000b091
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1000b089
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x9f8]
call fcn.10027bb7
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x9f8]
mov esi, eax
call fcn.10027bb7
mov ecx, dword [esi]
push 0
mov dword [eax], ecx
inc dword [ebp - 0x4c]
pop eax
cmp dword [ebp - 0x4c], ebx
jle 0x1000b084
jmp 0x1000b12e
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000b10c
push 0x1f58
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000b12b
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
push 2
pop ebx
lea ecx, [ebp - 0xda4]
call fcn.10027bb2
lea ecx, [ebp - 0x9f8]
mov byte [ebp - 4], 0x18
call fcn.10027bb2
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x19
jle 0x1000af51
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x50], 0xfffffffd
mov dword [ebp - 0x44], 0xedc0
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1000b182
push eax
push eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffffd
jge 0x1000b372
mov dword [ebp - 0x40], 9
mov ecx, 0x39c01058
mov dword [ebp - 0x2c], 0x9552
mov dword [ebp - 0x6f4], ecx
mov dword [ebp - 0x6f0], ecx
mov dword [ebp - 0x6ec], ecx
mov dword [ebp - 0x6e8], ecx
cmp dword [ebp - 0x24], eax
je 0x1000b228
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov dword [ebp - 0x3c], 0x22abf7c2
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, esi
mov eax, dword [ebp - 0x2c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x6f0], ecx
jmp 0x1000b362
push 3
lea ecx, [ebp - 0x4d0]
call fcn.10027b4a
xor eax, eax
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000b260
push dword [ebp - 0x28]
lea ecx, [ebp - 0x4d0]
call fcn.10027bb7
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1000b244
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x1000b349
mov dword [ebp - 0x40], 0xb681
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, 0x2bd68e48
setne cl
sub ecx, dword [ebp - 0x6e8]
je 0x1000b313
mov dword [ebp - 0x3c], 0x74ed7b97
lea ecx, [ebp - 0x4d0]
push ebx
call fcn.10027bb7
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x4d0]
mov eax, dword [ebp - 0x6f0]
mov eax, dword [ebp - 0x44]
push ebx
call fcn.10027bb7
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setge dl
cmp edx, 0xfffffffa
jb 0x1000b2c8
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, 0x4312
mov eax, dword [ebp - 0x44]
setge cl
sub ecx, 0xae0d08f1
neg ecx
sbb ecx, ecx
inc ecx
neg ecx
mov dword [ebp + eax*4 - 0x6f4], ecx
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1000b30c
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x4d0]
call fcn.10027bb7
cmp dword [eax], 0
jne 0x1000b335
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1000b2f6
jmp 0x1000b335
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1000b335
push 0x620
push eax
push 0x15fd
push eax
push 0x614
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push ebx
lea ecx, [ebp - 0x4d0]
call fcn.10027bb7
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
jle 0x1000b268
lea ecx, [ebp - 0x4d0]
mov byte [ebp - 4], 0x18
call fcn.10027bb2
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffd
push 0
pop eax
jl 0x1000b18f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1000b39a
push dword [ebp - 0x28]
lea ecx, [ebp - 0xdd4]
call fcn.10027bb7
mov dword [eax], 0x20bd
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1000b37b
xor eax, eax
mov dword [ebp - 0x34], 0x7862fd41
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000b3b5
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000b3c5
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x14]
je 0x1000c154
mov dword [ebp - 0x38], 0x313dd33a
xor eax, eax
mov dword [ebp - 0x38], 0x1c
cmp dword [ebp - 0x38], 0xfffffffb
jl 0x1000b44b
mov dword [ebp - 0x1c], 0xfe01bd97
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1000b410
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1840], 0x7f2fb5a5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1000b3f7
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000b440
mov dword [ebp - 0x28], esi
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1000b42a
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1000b437
cmp dword [ebp - 0x28], eax
jne 0x1000b43d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jle 0x1000b42f
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
je 0x1000b415
dec dword [ebp - 0x38]
jmp 0x1000b3e1
mov dword [ebp - 0x54], 0x105a
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x34], 0x9b8bc588
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0x15e1abe8
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x5155
mov dword [ebp - 0x28], eax
jmp 0x1000b48d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x17e8], 0xdc2a82a1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1000b47c
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], 0xfffffff5
cmp dword [ebp - 0x38], 0xffffffe5
jle 0x1000cdac
push ebx
lea ecx, [ebp - 0x3ec]
call fcn.10027b4a
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xbac]
mov dword [ebp - 0x50], 0x2215256e
mov dword [ebp - 0x28], 9
push edi
call fcn.10027b4a
mov byte [ebp - 4], 0x1f
xor eax, eax
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x3c], 0xfff7
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000b525
push dword [ebp - 0x20]
lea ecx, [ebp - 0x3ec]
call fcn.10027bb7
mov dword [eax], 0x9fb023ed
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000b507
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000b541
push dword [ebp - 0x20]
lea ecx, [ebp - 0xbac]
call fcn.10027bb7
mov dword [eax], 0xf4a8fe24
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000b52a
push edi
lea ecx, [ebp - 0x3ec]
call fcn.10027bb7
xor ebx, ebx
lea ecx, [ebp - 0x3ec]
push ebx
call fcn.10027bb7
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x3ec]
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
push ebx
call fcn.10027bb7
mov ecx, dword [ebp - 0x28]
xor edx, edx
sub ecx, dword [ebp - 0x28]
cmp ecx, esi
setg dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
sub ecx, 0x389
jne 0x1000b594
mov eax, dword [ebp - 0x50]
push ebx
lea ecx, [ebp - 0x3ec]
call fcn.10027bb7
push ebx
lea ecx, [ebp - 0x3ec]
call fcn.10027bb7
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xbac]
push ebx
call fcn.10027bb7
xor ecx, ecx
cmp dword [eax], 0x28c7
setge cl
add ecx, 4
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xbac]
call fcn.10027bb2
lea ecx, [ebp - 0x3ec]
mov byte [ebp - 4], 0x18
call fcn.10027bb2
xor eax, eax
mov dword [ebp - 0x44], 0x4b7834d8
push 3
mov dword [ebp - 0x44], eax
pop ebx
cmp dword [ebp - 0x44], ebx
jg 0x1000bf8e
push 2
pop esi
push edi
lea ecx, [ebp - 0xf8]
call fcn.10027b4a
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xeac]
mov dword [ebp - 0x3c], 0x7f1a969a
push esi
call fcn.10027b4a
xor eax, eax
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1000b64c
push dword [ebp - 0x18]
lea ecx, [ebp - 0xf8]
call fcn.10027bb7
mov dword [eax], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000b632
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000b672
push dword [ebp - 0x18]
lea ecx, [ebp - 0xeac]
call fcn.10027bb7
mov dword [eax], 0xd8af8716
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000b654
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000b692
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x120c], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000b67a
xor eax, eax
push eax
lea ecx, [ebp - 0xf8]
call fcn.10027bb7
xor ebx, ebx
lea ecx, [ebp - 0xf8]
push ebx
mov esi, eax
call fcn.10027bb7
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1000b726
push ebx
lea ecx, [ebp - 0xf8]
call fcn.10027bb7
cmp dword [eax], ebx
je 0x1000b6fc
push ebx
lea ecx, [ebp - 0xf8]
call fcn.10027bb7
push ebx
lea ecx, [ebp - 0xf8]
call fcn.10027bb7
push ebx
lea ecx, [ebp - 0xf8]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
call fcn.10027bb7
push ebx
lea ecx, [ebp - 0xf8]
call fcn.10027bb7
push ebx
lea ecx, [ebp - 0xf8]
call fcn.10027bb7
push ebx
lea ecx, [ebp - 0xeac]
imul esi, dword [eax], 0x5d56
call fcn.10027bb7
mov dword [eax], esi
test esi, esi
jne 0x1000b726
xor eax, eax
mov esi, eax
jmp 0x1000b72a
mov esi, edi
xor eax, eax
push eax
lea ecx, [ebp - 0xf8]
call fcn.10027bb7
xor ebx, ebx
lea ecx, [ebp - 0xf8]
cmp esi, dword [eax]
setle bl
xor eax, eax
push eax
call fcn.10027bb7
mov eax, dword [eax]
add eax, 0x24d4fa72
add eax, ebx
jne 0x1000b76c
xor ebx, ebx
lea ecx, [ebp - 0xf8]
push ebx
call fcn.10027bb7
cmp dword [eax], ebx
jne 0x1000b76e
mov eax, ebx
jmp 0x1000b770
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0x1208], eax
lea ecx, [ebp - 0xeac]
call fcn.10027bb2
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x18
call fcn.10027bb2
push 2
pop esi
mov dword [ebp - 0x40], esi
lea ecx, [ebp - 0x3e0]
mov dword [ebp - 0x3c], 0xe2bbef7d
mov eax, 0x8ed4a55f
mov dword [ebp - 0x28], 0x21f1
mov dword [ebp - 0x50], 0x890c5440
mov dword [ebp - 0x710], eax
mov dword [ebp - 0x70c], eax
mov dword [ebp - 0x708], eax
mov dword [ebp - 0x704], eax
mov dword [ebp - 0x2c], ebx
push esi
call fcn.10027b4a
mov byte [ebp - 4], 0x22
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000b806
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x498], 0x1145714f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b7ee
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000b82c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x3e0]
call fcn.10027bb7
mov dword [eax], 0x4eb0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b80e
xor eax, eax
xor edx, edx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setl dl
cmp edx, 0xfffc
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
test eax, eax
mov eax, 0xffff
setg cl
cmp edx, ecx
jge 0x1000b88b
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0xfffffff9
mov ecx, dword [ebp - 0x498]
mov eax, dword [ebp - 0x40]
dec dword [ebp - 0x498]
dec dword [ebp - 0x40]
cmp eax, ecx
jle 0x1000b881
mov eax, edi
jmp 0x1000b883
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x1000ba34
mov dword [ebp - 0x1c], 0xdd48
mov dword [ebp - 0x40], 0x336a
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x498]
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1000b8b0
mov esi, edi
cmp dword [ebp - 0x1c], eax
jne 0x1000b8b2
mov esi, eax
push eax
lea ecx, [ebp - 0x3e0]
call fcn.10027bb7
mov dword [eax], esi
test esi, esi
jne 0x1000b8cd
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x1000b8cf
mov edx, edi
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
mov dword [ebp - 0x704], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
sub dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], edi
jg 0x1000ba31
jmp 0x1000b902
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1000b922
push 2
pop esi
lea ecx, [ebp - 0x3e0]
mov byte [ebp - 4], 0x18
call fcn.10027bb2
mov dword [ebp - 0x4c], edi
or eax, 0xffffffff
mov dword [ebp - 0x28], 0xf4039ee4
mov dword [ebp - 0x1c], 0xb653b1da
mov dword [ebp - 0x40], 0x91c84132
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x1000ba86
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa1c], 0x40b319b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000ba6e
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000baa8
push ebx
lea ecx, [ebp - 0x104]
call fcn.10027b4a
mov byte [ebp - 4], 0x27
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], eax
jmp 0x1000bfb9
push dword [ebp - 0x28]
call fcn.10027bb7
mov dword [eax], 0xc08901f2
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x104]
cmp dword [ebp - 0x28], ebx
jl 0x1000bfa8
push 2
pop ebx
push ebx
call fcn.10027bb7
push ebx
lea ecx, [ebp - 0x104]
mov esi, eax
call fcn.10027bb7
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x28], 0xb
cmp dword [ebp - 0x28], 0xfffffffc
jne 0x1000c0e7
mov dword [ebp - 0x40], 0xfffffffd
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x50], 8
push ebx
call fcn.10027bb7
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x104]
xor ebx, ebx
push ebx
call fcn.10027bb7
push 2
pop esi
push esi
lea ecx, [ebp - 0x104]
call fcn.10027bb7
push ebx
lea ecx, [ebp - 0x104]
call fcn.10027bb7
imul ecx, dword [ebp - 0x40], 0x3b26
push edi
cmp edi, ecx
sbb ecx, ecx
neg ecx
add ecx, 0x29e0465d
sub ecx, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x104]
setge bl
call fcn.10027bb7
push esi
lea ecx, [ebp - 0x104]
sub ebx, dword [eax]
call fcn.10027bb7
mov ecx, dword [ebp - 0x3c]
add ecx, ebx
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x104]
setle bl
xor eax, eax
push eax
call fcn.10027bb7
xor ecx, ecx
cmp ebx, dword [eax]
setge cl
xor eax, eax
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x104]
push eax
call fcn.10027bb7
mov edx, dword [ebp - 0x40]
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x1449c9fb
setg al
mov dword [ebp - 0x50], eax
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000c0d7
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffc
push 2
pop ebx
je 0x1000bff0
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 0x18
call fcn.10027bb2
mov dword [ebp - 0x40], 0xc6076fda
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x1000c11c
mov eax, dword [ebp - 0x44]
sub eax, 0x15fb
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x44]
jge 0x1000c11a
mov eax, edi
jmp 0x1000c11c
xor eax, eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x54]
sete cl
xor edx, edx
cmp ecx, eax
push 0xffffffffffffffff
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
cmp eax, edx
pop esi
setl cl
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe5
jg 0x1000b4c1
or esi, esi
jmp 0x1000cdac
xor eax, eax
mov dword [ebp - 0x44], 0xfffffffc
mov dword [ebp - 0x28], eax
jmp 0x1000c173
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa4], 0xfffffff9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1000c162
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xa0]
jg 0x1000c193
xor eax, eax
cmp dword [ebp - 0xa0], eax
je 0x1000c195
mov eax, edi
mov ecx, dword [ebp - 0xa0]
imul ecx, eax
mov eax, dword [ebp - 0x44]
sub ecx, eax
je 0x1000c1cd
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x1000c1c6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c1c3
push eax
push 0x133
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
xor eax, eax
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], edi
jle 0x1000c1ac
jmp 0x1000c24b
push ebx
lea ecx, [ebp - 0xbc4]
call fcn.10027b4a
xor eax, eax
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x28], eax
jmp 0x1000c1f5
push dword [ebp - 0x28]
call fcn.10027bb7
mov dword [eax], 0x6aa1c33c
inc dword [ebp - 0x28]
lea ecx, [ebp - 0xbc4]
cmp dword [ebp - 0x28], ebx
jl 0x1000c1e4
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa0]
xor eax, eax
push eax
call fcn.10027bb7
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
neg eax
cmp eax, 9
setne cl
mov dword [ebp - 0xa4], ecx
lea ecx, [ebp - 0xbc4]
mov byte [ebp - 4], 0x18
call fcn.10027bb2
mov dword [ebp - 0x54], 0x1852
lea ecx, [ebp - 0xdbc]
push edi
call fcn.10027b4a
mov byte [ebp - 4], 0x29
xor eax, eax
mov dword [ebp - 0x34], 0xc3414b5
mov dword [ebp - 0x34], 0xa1245c81
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x3c], 0x7af2c9a1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1000c2a6
push dword [ebp - 0x28]
lea ecx, [ebp - 0xdbc]
call fcn.10027bb7
mov dword [eax], 0xa439beb0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1000c288
xor eax, eax
push eax
lea ecx, [ebp - 0xdbc]
call fcn.10027bb7
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
lea ecx, [ebp - 0xdbc]
dec dword [ebp - 0x3c]
mov byte [ebp - 4], 0x18
call fcn.10027bb2
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0x890]
push ebx
call fcn.10027b4a
mov byte [ebp - 4], 0x2a
xor eax, eax
mov dword [ebp - 0x1c], 0x7a7c2039
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1000c30b
push dword [ebp - 0x28]
lea ecx, [ebp - 0x890]
call fcn.10027bb7
mov dword [eax], 0x862fd41e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1000c2ed
xor eax, eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x1000c495
jmp 0x1000c31b
xor eax, eax
mov dword [ebp - 0x38], 0x4b666a75
mov dword [ebp - 0x3c], 0x7963ba20
mov dword [ebp - 0x54], 0xdc5336de
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x44], 0x245e
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c35b
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor eax, eax
push eax
lea ecx, [ebp - 0x890]
call fcn.10027bb7
cmp dword [eax], 0
jne 0x1000c495
mov dword [ebp - 0x38], edi
xor eax, eax
cmp dword [ebp - 0x38], eax
jl 0x1000c48c
jmp 0x1000c382
xor eax, eax
mov dword [ebp - 0x34], 0x8bbd1883
mov dword [ebp - 0x28], eax
jmp 0x1000c39f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa24], 8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1000c38e
push edi
lea ecx, [ebp - 0x890]
call fcn.10027bb7
cmp dword [eax], 0
je 0x1000c3d7
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000c3cb
push 0xfaf
push eax
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov dword [ebp - 0x3c], 0xfffffff9
jmp 0x1000c483
mov dword [ebp - 0x3c], 0x4f5ac3d6
xor eax, eax
mov dword [ebp - 0x34], 0x3a60813c
mov dword [ebp - 0x50], 0xc0c8fbfc
mov dword [ebp - 0x40], 0x5300ce3
cmp dword [ebp - 0xa20], eax
jne 0x1000c48c
cmp dword [ebp - 0x54], eax
je 0x1000c43c
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x1000c418
cmp dword [ebp - 0x1c], eax
je 0x1000c418
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0xa20]
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, 0xfffffffe
setg al
cmp eax, 7
jae 0x1000c43a
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x3c], 0x7eb6652f
cmp dword [ebp - 0x50], eax
jne 0x1000c48c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1000c45f
dec dword [ebp - 0x38]
jns 0x1000c380
dec dword [ebp - 0x1c]
jns 0x1000c319
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0x18
call fcn.10027bb2
movdqa xmm0, xmmword [0x10008000]
lea eax, [ebp - 0x1300]
push eax
lea eax, [ebp - 0x1310]
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x44], 0x1fc2da8a
lea ecx, [ebp - 0x1778]
push eax
movdqu xmmword [ebp - 0x1310], xmm0
call fcn.10027bc6
lea ecx, [ebp - 0x21d]
mov esi, eax
call fcn.1000927a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x108c]
push dword [esi]
call fcn.10027b8c
xor eax, eax
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x28], eax
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setg dl
cmp edx, dword [ebp - 0x2c]
jge 0x1000c52c
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setg dl
imul eax, edx, 0x3717
cmp eax, dword [ebp - 0x44]
jne 0x1000c537
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1000c539
mov esi, edi
jmp 0x1000c53b
xor eax, eax
mov esi, eax
push 3
lea ecx, [ebp - 0x108c]
call fcn.10027bb7
xor ecx, ecx
mov edx, edi
cmp esi, dword [eax]
setle cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], eax
jne 0x1000c55d
mov edx, eax
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff
push 4
setle cl
cmp ecx, eax
pop esi
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x1c
jmp 0x1000c5ad
mov dword [ebp - 0x44], 0xffffffef
cmp dword [ebp - 0x44], 0x2a
jle 0x1000c5aa
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000c5a1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor eax, eax
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x2a
jg 0x1000c590
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1000c581
lea ecx, [ebp - 0x108c]
mov byte [ebp - 4], 0x18
call fcn.10027bb2
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1000c5d9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1830], 0xefec
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1000c5c8
push ebx
lea ecx, [ebp - 0x1204]
call fcn.10027b4a
mov byte [ebp - 4], 0x2c
xor eax, eax
mov dword [ebp - 0x38], 0x8e5ccc90
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x1000c61e
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1204]
call fcn.10027bb7
mov dword [eax], 0xdf75dcec
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1000c600
xor eax, eax
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], eax
jl 0x1000c6c9
jmp 0x1000c62e
lea ecx, [ebp - 0x1204]
mov byte [ebp - 4], 0x18
call fcn.10027bb2
movdqa xmm0, xmmword [0x10008060]
lea eax, [ebp - 0x1500]
push eax
lea eax, [ebp - 0x1510]
push eax
lea ecx, [ebp - 0x1610]
movdqu xmmword [ebp - 0x1510], xmm0
call fcn.10027bc6
lea ecx, [ebp - 0x1a8]
mov esi, eax
call fcn.1000927a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x2d0]
push dword [esi]
call fcn.10027b8c
mov byte [ebp - 4], 0x2e
xor eax, eax
mov dword [ebp - 0x40], 0x9c4ad153
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], ecx
jge 0x1000c74f
push 4
mov dword [ebp - 0x1c], 0xfffffff7
xor eax, eax
pop ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ecx
jge 0x1000cddb
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1758], 0x70ad
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1000cdc3
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000cded
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1758], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000cde0
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0xdd4]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x30]
mov dword [ebp - 4], esi
call fcn.10027bb2
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
jle 0x1000a8fe
mov edi, 0xe1d67a3d
movdqa xmm0, xmmword [0x10007fe0]
lea eax, [ebp - 0x1320]
push eax
lea eax, [ebp - 0x1330]
push eax
lea ecx, [ebp - 0x16c0]
movdqu xmmword [ebp - 0x1330], xmm0
call fcn.10027bc6
lea ecx, [ebp - 0x1a5]
mov esi, eax
call fcn.1000927a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xc0c]
push dword [esi]
call fcn.10027b8c
mov dword [ebp - 4], 0x33
lea ecx, [ebp - 0x610]
xor ebx, ebx
mov dword [ebp - 0x2c], 0x951e
xor eax, eax
inc ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0x919c44d4
push ebx
call fcn.10027b4a
mov byte [ebp - 4], 0x34
xor eax, eax
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x14], eax
jmp 0x1000ceb4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x610]
call fcn.10027bb7
mov dword [eax], 0x36572186
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000ce9d
push ebx
lea ecx, [ebp - 0xc0c]
call fcn.10027bb7
mov edx, dword [eax]
lea ecx, [edx - 1]
mov dword [eax], ecx
test edx, edx
jne 0x1000ced9
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x1000cedb
mov esi, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
neg eax
cmp eax, 0x244c3f4
setle cl
neg ecx
jne 0x1000cef5
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1000cef7
mov eax, ebx
mov dword [ebp - 0x44], eax
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
push ebx
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
cmp esi, edx
setl cl
xor eax, eax
add ecx, dword [ebp - 0x2c]
cmp ecx, 0x39d20578
lea ecx, [ebp - 0xc0c]
setl al
mov dword [ebp - 0x40], eax
call fcn.10027bb7
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x44]
dec eax
cmp dword [ebp - 0x40], eax
jne 0x1000cf46
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x44]
cmp ecx, eax
lea ecx, [ebp - 0x610]
setg dl
xor ebx, ebx
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
push ebx
call fcn.10027bb7
xor ecx, ecx
mov esi, edi
push ebx
cmp dword [eax], ebx
setg cl
sub esi, ecx
lea ecx, [ebp - 0x610]
call fcn.10027bb7
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
add ecx, esi
add edx, ecx
lea ecx, [ebp - 0x610]
cmp edx, dword [eax]
setg bl
xor eax, eax
push eax
call fcn.10027bb7
xor ecx, ecx
cmp ebx, dword [eax]
setne cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x610]
call fcn.10027bb2
or eax, 0xffffffff
lea ecx, [ebp - 0xc0c]
mov dword [ebp - 4], eax
call fcn.10027bb2
mov dword [ebp - 0x44], 0x1928c176
xor eax, eax
mov dword [ebp - 0x2c], 0x515466bc
mov dword [ebp - 0x40], 0x18bd8502
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000cfed
push 0x2595
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [ebp - 0x44], 0x16
cmp dword [ebp - 0x44], 0x19
jg 0x1000d216
or edi, 0xffffffff
jmp 0x1000d005
xor eax, eax
push 3
pop ebx
mov dword [ebp - 0x18], 0xfc3938dd
lea ecx, [ebp - 0x830]
mov dword [ebp - 0x4c], eax
push ebx
call fcn.10027b4a
push ebx
lea ecx, [ebp - 0xec4]
mov dword [ebp - 4], 0x35
call fcn.10027b4a
xor eax, eax
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000d05d
push dword [ebp - 0x20]
lea ecx, [ebp - 0x830]
call fcn.10027bb7
mov dword [eax], 0x105807c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000d03f
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000d083
push dword [ebp - 0x20]
lea ecx, [ebp - 0xec4]
call fcn.10027bb7
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000d065
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000d0df
mov eax, dword [ebp - 0x18]
mov ecx, 0x496e854a
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
sub ecx, eax
add ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xef6e229e
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle bl
xor ecx, ecx
cmp ebx, eax
setg cl
cmp dword [ebp - 0x44], ecx
jl 0x1000d0dd
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x1000d0e4
xor eax, eax
xor ebx, ebx
mov edx, eax
inc ebx
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 3
cmp eax, ebx
jg 0x1000d1b1
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1000d1b3
mov dword [ebp - 0x4c], 0x1d
cmp dword [ebp - 0x4c], 0x1c
jge 0x1000d137
mov dword [ebp - 0x54], 0x5d06
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54], ebx
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x1c
jl 0x1000d119
xor eax, eax
push 2
mov dword [ebp - 0x4c], eax
pop esi
jmp 0x1000d1aa
mov dword [ebp - 0x18], eax
jmp 0x1000d17a
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
jl 0x1000d177
push esi
lea ecx, [ebp - 0xec4]
call fcn.10027bb7
mov dword [eax], esi
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000d170
push 0x584
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec dword [ebp - 0x2c]
jns 0x1000d14c
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1000d144
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x830]
call fcn.10027bb7
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x830]
mov esi, eax
call fcn.10027bb7
mov ecx, dword [esi]
push 2
pop esi
mov dword [eax], ecx
inc dword [ebp - 0x4c]
push 0
pop eax
cmp dword [ebp - 0x4c], esi
jle 0x1000d13f
jmp 0x1000d1e9
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000d1ca
push 0x1f58
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000d1e9
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
lea ecx, [ebp - 0xec4]
call fcn.10027bb2
lea ecx, [ebp - 0x830]
mov dword [ebp - 4], edi
call fcn.10027bb2
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x19
jle 0x1000d003
mov edi, 0xe1d67a3d
jmp 0x1000d219
xor ebx, ebx
inc ebx
movdqa xmm0, xmmword [0x10007ff0]
lea eax, [ebp - 0x1420]
push eax
lea eax, [ebp - 0x1430]
mov dword [ebp - 0x28], 0xfffffff9
push eax
lea ecx, [ebp - 0x1620]
movdqu xmmword [ebp - 0x1430], xmm0
call fcn.10027bc6
lea ecx, [ebp - 0x1a7]
mov esi, eax
call fcn.1000927a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xdec]
push dword [esi]
call fcn.10027b8c
push ebx
lea ecx, [ebp - 0xc24]
mov dword [ebp - 4], 0x37
call fcn.10027b4a
xor eax, eax
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000d2a2
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc24]
call fcn.10027bb7
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000d288
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000d2d3
push ebx
lea ecx, [ebp - 0xdec]
call fcn.10027bb7
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0xdec]
call fcn.10027bb7
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [eax]
jg 0x1000d2d1
mov ecx, ebx
jmp 0x1000d2d5
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0xfe04
setg al
add eax, dword [ebp - 0x28]
je 0x1000d2f0
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000d2f2
mov esi, ebx
jmp 0x1000d2f4
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xc24]
call fcn.10027bb7
mov dword [eax], esi
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000d319
push eax
push 0xd98
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
lea ecx, [ebp - 0xc24]
call fcn.10027bb2
or eax, 0xffffffff
lea ecx, [ebp - 0xdec]
mov dword [ebp - 4], eax
call fcn.10027bb2
movdqa xmm0, xmmword [0x10008010]
lea eax, [ebp - 0x1340]
push eax
lea eax, [ebp - 0x1350]
push eax
lea ecx, [ebp - 0x1720]
movdqu xmmword [ebp - 0x1350], xmm0
call fcn.10027bc6
lea ecx, [ebp - 0x1a9]
mov esi, eax
call fcn.1000927a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x10a4]
push dword [esi]
call fcn.10027b8c
mov dword [ebp - 4], 0x39
xor eax, eax
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x34], 0x3fa75c1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1000d3b8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10a4]
call fcn.10027bb7
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000d39c
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000d3c8
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
or eax, 0xffffffff
lea ecx, [ebp - 0x10a4]
mov dword [ebp - 4], eax
call fcn.10027bb2
movdqa xmm0, xmmword [0x10007fe0]
lea eax, [ebp - 0x14a0]
push eax
lea eax, [ebp - 0x14b0]
push eax
lea ecx, [ebp - 0x1630]
movdqu xmmword [ebp - 0x14b0], xmm0
call fcn.10027bc6
lea ecx, [ebp - 0x1b1]
mov esi, eax
call fcn.1000927a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xc3c]
push dword [esi]
call fcn.10027b8c
mov dword [ebp - 4], 0x3a
lea ecx, [ebp - 0x78c]
xor eax, eax
mov dword [ebp - 0x2c], 0x951e
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0x919c44d4
push ebx
call fcn.10027b4a
mov byte [ebp - 4], 0x3b
xor eax, eax
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x14], eax
jmp 0x1000d46f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x78c]
call fcn.10027bb7
mov dword [eax], 0x36572186
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000d458
push ebx
lea ecx, [ebp - 0xc3c]
call fcn.10027bb7
mov edx, dword [eax]
lea ecx, [edx - 1]
mov dword [eax], ecx
test edx, edx
jne 0x1000d494
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x1000d496
mov esi, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
neg eax
cmp eax, 0x244c3f4
setle cl
neg ecx
jne 0x1000d4b0
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1000d4b2
mov eax, ebx
mov dword [ebp - 0x44], eax
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
push ebx
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x2c]
cmp esi, edx
setl cl
xor eax, eax
add ecx, dword [ebp - 0x2c]
cmp ecx, 0x39d20578
lea ecx, [ebp - 0xc3c]
setl al
mov dword [ebp - 0x40], eax
call fcn.10027bb7
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x44]
dec eax
cmp dword [ebp - 0x40], eax
jne 0x1000d501
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x44]
cmp ecx, eax
lea ecx, [ebp - 0x78c]
setg dl
xor ebx, ebx
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
push ebx
call fcn.10027bb7
xor ecx, ecx
mov esi, edi
push ebx
cmp dword [eax], ebx
setg cl
sub esi, ecx
lea ecx, [ebp - 0x78c]
call fcn.10027bb7
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
add ecx, esi
add edx, ecx
lea ecx, [ebp - 0x78c]
cmp edx, dword [eax]
setg bl
xor eax, eax
push eax
call fcn.10027bb7
xor ecx, ecx
cmp ebx, dword [eax]
setne cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x78c]
call fcn.10027bb2
or ebx, 0xffffffff
lea ecx, [ebp - 0xc3c]
mov dword [ebp - 4], ebx
call fcn.10027bb2
mov dword [ebp - 0x44], 0x1928c176
xor eax, eax
mov dword [ebp - 0x2c], 0x515466bc
mov dword [ebp - 0x40], 0x18bd8502
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000d5a8
push 0x2595
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
xor edi, edi
mov dword [ebp - 0x44], 0x16
inc edi
cmp dword [ebp - 0x44], 0x19
jg 0x1000d7c4
jmp 0x1000d5c0
xor eax, eax
push 3
pop ebx
mov dword [ebp - 0x18], 0xfc3938dd
lea ecx, [ebp - 0x8a8]
mov dword [ebp - 0x4c], eax
push ebx
call fcn.10027b4a
push ebx
lea ecx, [ebp - 0xe7c]
mov dword [ebp - 4], 0x3c
call fcn.10027b4a
xor eax, eax
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000d618
push dword [ebp - 0x20]
lea ecx, [ebp - 0x8a8]
call fcn.10027bb7
mov dword [eax], 0x105807c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000d5fa
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000d63e
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe7c]
call fcn.10027bb7
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000d620
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000d697
mov eax, dword [ebp - 0x18]
mov ecx, 0x496e854a
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
sub ecx, eax
add ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xef6e229e
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle bl
xor ecx, ecx
cmp ebx, eax
setg cl
cmp dword [ebp - 0x44], ecx
jl 0x1000d695
mov edx, edi
jmp 0x1000d699
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 3
cmp eax, edi
jg 0x1000d763
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1000d765
mov dword [ebp - 0x4c], 0x1d
cmp dword [ebp - 0x4c], 0x1c
jge 0x1000d6ec
mov dword [ebp - 0x54], 0x5d06
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54], edi
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x1c
jl 0x1000d6ce
xor eax, eax
push 2
mov dword [ebp - 0x4c], eax
pop ebx
jmp 0x1000d75c
mov dword [ebp - 0x18], eax
jmp 0x1000d72f
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x1000d72c
push ebx
lea ecx, [ebp - 0xe7c]
call fcn.10027bb7
mov dword [eax], ebx
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000d725
push 0x584
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec dword [ebp - 0x2c]
jns 0x1000d701
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1000d6f9
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x8a8]
call fcn.10027bb7
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x8a8]
mov esi, eax
call fcn.10027bb7
mov ecx, dword [esi]
push 0
mov dword [eax], ecx
inc dword [ebp - 0x4c]
pop eax
cmp dword [ebp - 0x4c], ebx
jle 0x1000d6f4
jmp 0x1000d79b
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000d77c
push 0x1f58
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000d79b
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
lea ecx, [ebp - 0xe7c]
call fcn.10027bb2
or ebx, 0xffffffff
lea ecx, [ebp - 0x8a8]
mov dword [ebp - 4], ebx
call fcn.10027bb2
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x19
jle 0x1000d5be
push edi
lea ecx, [ebp - 0xc54]
call fcn.10027b4a
mov dword [ebp - 4], 0x3e
xor eax, eax
mov dword [ebp - 0x28], 0x5ccc90a3
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1000d806
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc54]
call fcn.10027bb7
mov dword [eax], 0x5dcec3d7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000d7e8
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1000d830
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1000d82d
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc54]
call fcn.10027bb7
mov dword [eax], edi
dec dword [ebp - 0x14]
jns 0x1000d816
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x1000d80b
lea ecx, [ebp - 0xc54]
mov dword [ebp - 4], ebx
call fcn.10027bb2
mov dword [ebp - 0x14], edi
xor eax, eax
mov dword [ebp - 0x54], 0xfffa
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], eax
jmp 0x1000d879
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000d86d
push 0x253c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x14]
push 0
pop eax
cmp dword [ebp - 0x14], 0xfffffff1
jge 0x1000d857
movdqa xmm0, xmmword [0x10007ff0]
lea eax, [ebp - 0x1360]
push eax
lea eax, [ebp - 0x1370]
mov dword [ebp - 0x28], 0xfffffff9
push eax
lea ecx, [ebp - 0x16d0]
movdqu xmmword [ebp - 0x1370], xmm0
call fcn.10027bc6
lea ecx, [ebp - 0x1b3]
mov esi, eax
call fcn.1000927a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xc84]
push dword [esi]
call fcn.10027b8c
mov dword [ebp - 4], 0x3f
lea ecx, [ebp - 0x10bc]
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x34], 0x9ad59e57
mov dword [ebp - 0x34], 0x7ca0029b
push 3
call fcn.10027b4a
mov byte [ebp - 4], 0x40
xor eax, eax
mov dword [ebp - 0x34], 0xea122098
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x34], 0x30de9bf9
mov dword [ebp - 0x34], 0x11fc80ae
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1000d93f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10bc]
call fcn.10027bb7
push 0xfffffffffffffff6
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000d921
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
pop ebx
cmp dword [ebp - 0x18], ebx
jge 0x1000d962
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1640], 0x1b66bafc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000d94a
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1000d984
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11a4], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000d96b
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000d99a
push 0x218f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
dec dword [ebp - 0x119c]
lea ecx, [ebp - 0x10bc]
mov byte [ebp - 4], 0x3f
call fcn.10027bb2
push edi
lea ecx, [ebp - 0xe88]
call fcn.10027b4a
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xe04]
mov dword [ebp - 0x44], 0x98a8f939
mov dword [ebp - 0x1c], 0xbb4aad9d
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x38], 0xee3b919d
push 4
call fcn.10027b4a
xor eax, eax
mov byte [ebp - 4], 0x42
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edi
jge 0x1000da0e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x63c], 0x30f0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000d9f6
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000da2a
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe04]
call fcn.10027bb7
mov dword [eax], pe_nt_image_headers32
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000da13
inc dword [ebp - 0x44]
je 0x1000da4d
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x44]
je 0x1000da4d
mov eax, edi
jmp 0x1000da4f
xor eax, eax
mov ecx, dword [ebp - 0x44]
sub ecx, 0xca9d
neg ecx
sbb ecx, ecx
inc ecx
add ecx, eax
mov eax, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0xf1bf
jle 0x1000da93
mov dword [ebp - 0x54], 0x28de637c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x54], eax
jmp 0x1000dbac
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x50], 0xfffffff7
mov dword [ebp - 0x30], 0xdbb389e7
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x54], 0xfffd
mov dword [ebp - 0x30], 0xb6322a57
cmp dword [ebp - 0x40], 0xfd52a42b
jbe 0x1000dae5
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edi
mov eax, dword [ebp - 0x44]
setle cl
xor edx, edx
cmp ecx, 0xfffffffd
sete dl
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, dword [ebp - 0x24]
je 0x1000dae5
xor eax, eax
mov edx, eax
jmp 0x1000dae7
mov edx, edi
mov eax, dword [ebp - 0x24]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
sub eax, ecx
mov dword [ebp - 0x50], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1000db97
cmp dword [ebp - 0x40], eax
jne 0x1000db13
cmp dword [ebp - 0x1c], eax
je 0x1000db1a
mov ecx, edi
cmp dword [ebp - 0x24], eax
jne 0x1000db1c
mov ecx, eax
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x14]
cmp eax, ecx
jle 0x1000db2d
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x1000db2f
mov eax, edi
mov dword [ebp - 0x1c], eax
xor edx, edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x63c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [ebp - 0x40]
jle 0x1000db58
cmp dword [ebp - 0x14], eax
jne 0x1000db5f
mov esi, eax
cmp dword [ebp - 0x1c], eax
je 0x1000db61
mov esi, edi
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0xe04]
mov dword [ebp - 0x50], eax
push 3
call fcn.10027bb7
xor ecx, ecx
cmp esi, dword [eax]
setg cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
setle dl
sub edx, dword [ebp - 0x38]
jne 0x1000db97
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1000db99
mov eax, edi
mov edx, dword [ebp - 0x24]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x38]
cmp edx, eax
setl cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0xe04]
mov byte [ebp - 4], 0x41
call fcn.10027bb2
push edi
lea ecx, [ebp - 0x4f4]
call fcn.10027b4a
mov byte [ebp - 4], 0x43
xor eax, eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1000dbf6
push dword [ebp - 0x14]
lea ecx, [ebp - 0x4f4]
call fcn.10027bb7
mov dword [eax], 0x5d6c05ba
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000dbd8
xor eax, eax
push eax
lea ecx, [ebp - 0x4f4]
call fcn.10027bb7
mov dword [eax], 0xffffffe2
jmp 0x1000dc69
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1000dc31
push 0xa6c
push 0x26da
push 0xd74
push 0x5e6
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1000dc5b
push eax
push 0x10fc
push 0xad3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
xor eax, eax
push eax
lea ecx, [ebp - 0x4f4]
call fcn.10027bb7
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x4f4]
push eax
call fcn.10027bb7
cmp dword [eax], 0x11
jl 0x1000dc0a
lea ecx, [ebp - 0x4f4]
mov byte [ebp - 4], 0x41
call fcn.10027bb2
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000dca5
cmp dword [ebp - 0x14], edi
jl 0x1000dc92