Function at 0x10008d59
Capabilities:
Create pipe
Delete file
Set registry value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007ce0e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1338
call fcn.10079000
push esi
push edi
mov dword [ebp - 0x3a4], 0x256915a
mov dword [ebp - 0x3a0], 0x256915a
mov dword [ebp - 0x39c], 0x256915a
mov dword [ebp - 0x398], 0x256915a
mov dword [ebp - 0xb0], 0xcd7d
mov dword [ebp - 0x1fc], 0
jmp 0x10008dc8
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 1
jge 0x10008de4
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0xb8c], 1
jmp 0x10008dbb
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x3a4], 0
jmp 0x10008e0f
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x3a4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3a4], 0
jl 0x10008ead
mov dword [ebp - 0x12b0], 0xffffffff
push 1
lea ecx, [ebp - 0x117c]
call fcn.100176ef
and dword [ebp - 4], 0
mov dword [ebp - 0x1010], 0x53061ece
mov dword [ebp - 0x554], 1
mov dword [ebp - 0x1f4], 0
jmp 0x10008e6a
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 1
jge 0x10008e8c
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0x117c]
call fcn.1001778d
mov dword [eax], 1
jmp 0x10008e5d
mov eax, dword [ebp - 0x554]
dec eax
mov dword [ebp - 0x554], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x117c]
call fcn.10017771
jmp 0x10008df6
mov dword [ebp - 0xb0], 0
jmp 0x10008ec6
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jg 0x1000916d
mov dword [ebp - 0x60], 0x72585faf
mov dword [ebp - 0x924], 0xeca5
mov dword [ebp - 0x3e4], 0xd9140931
mov dword [ebp - 0x60], 3
jmp 0x10008efe
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x10008f46
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x10008f23
push 0
push 0x172a
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x10008f44
push 0
push 0x1445
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x10008ef7
mov dword [ebp - 0x60], 3
jmp 0x10008f56
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x10009168
mov dword [ebp - 0xa8c], 1
mov dword [ebp - 0xa7c], 0xa832a49e
mov dword [ebp - 0x3dc], 0xfffffffa
mov eax, dword [ebp - 0xb0]
cmp dword [ebp + eax*4 - 0x3a4], 0
ja 0x10008f9a
mov dword [ebp - 0x3c4], 1
jmp 0x10008fa1
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0xa7c], eax
cmp dword [ebp - 0xa7c], 0
jne 0x10008fdb
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
mov dword [ebp - 0xa84], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa84]
mov dword [ebp + eax - 0xb8c], ecx
cmp dword [ebp - 0xa8c], 0xae22781
jne 0x10008ff4
xor eax, eax
jne 0x10008ff4
and dword [ebp - 0xa94], 0
jmp 0x10008ffe
mov dword [ebp - 0xa94], 1
cmp dword [ebp - 0xa94], 0
jle 0x10009013
mov dword [ebp - 0xafc], 1
jmp 0x1000901a
and dword [ebp - 0xafc], 0
cmp dword [ebp - 0xafc], 1
jl 0x1000903b
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3a4], 0
jne 0x1000903b
and dword [ebp - 0xb04], 0
jmp 0x10009045
mov dword [ebp - 0xb04], 1
mov eax, dword [ebp - 0xb04]
neg eax
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x3a4]
jle 0x10009067
mov dword [ebp - 0x968], 1
jmp 0x1000906e
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x968]
cmp eax, dword [ebp - 0x924]
jg 0x1000908e
mov dword [ebp - 0x914], 1
jmp 0x10009095
and dword [ebp - 0x914], 0
cmp dword [ebp - 0x914], 6
jne 0x100090aa
mov dword [ebp - 0x91c], 1
jmp 0x100090b1
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0x91c]
jne 0x100090cb
mov dword [ebp - 0x3cc], 1
jmp 0x100090d2
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x3cc], eax
jg 0x100090f2
cmp dword [ebp - 0x3dc], 0
jne 0x100090f2
and dword [ebp - 0x3d4], 0
jmp 0x100090fc
mov dword [ebp - 0x3d4], 1
mov eax, dword [ebp - 0x924]
cmp dword [ebp - 0x3d4], eax
jge 0x10009116
mov dword [ebp - 0x92c], 1
jmp 0x1000911d
and dword [ebp - 0x92c], 0
push 8
pop eax
sub eax, dword [ebp - 0x92c]
sub eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x3dc]
jne 0x1000913d
mov dword [ebp - 0x934], 1
jmp 0x10009144
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp + eax*4 - 0x3a4], ecx
jmp 0x10008f4f
jmp 0x10008eb9
mov dword [ebp - 0x3b4], 0x256915a
mov dword [ebp - 0x3b0], 0x256915a
mov dword [ebp - 0x3ac], 0x256915a
mov dword [ebp - 0x3a8], 0x256915a
mov dword [ebp - 0xe0], 0xcd7d
mov dword [ebp - 0x1f8], 0
jmp 0x100091b8
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 1
jge 0x100091d4
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0xbac], 1
jmp 0x100091ab
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x3b4], 0
jmp 0x100091ff
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b4]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x3b4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3b4], 0
jl 0x100092a0
mov dword [ebp - 0x1018], 0xffffffff
push 1
lea ecx, [ebp - 0x118c]
call fcn.100176ef
mov dword [ebp - 4], 1
mov dword [ebp - 0x1020], 0x53061ece
mov dword [ebp - 0x93c], 1
mov dword [ebp - 0x27c], 0
jmp 0x1000925d
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 1
jge 0x1000927f
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x118c]
call fcn.1001778d
mov dword [eax], 1
jmp 0x10009250
mov eax, dword [ebp - 0x93c]
dec eax
mov dword [ebp - 0x93c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118c]
call fcn.10017771
jmp 0x100091e6
mov dword [ebp - 0xe0], 0
jmp 0x100092b9
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jg 0x1000957e
mov dword [ebp - 0x94], 0x72585faf
mov dword [ebp - 0x96c], 0xeca5
mov dword [ebp - 0x42c], 0xd9140931
mov dword [ebp - 0x94], 3
jmp 0x100092fd
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x10009348
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x10009325
push 0
push 0x172a
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x10009346
push 0
push 0x1445
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x100092f0
mov dword [ebp - 0x94], 3
jmp 0x10009361
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x10009579
mov dword [ebp - 0x3f4], 1
mov dword [ebp - 0x3ec], 0xa832a49e
mov dword [ebp - 0x424], 0xfffffffa
mov eax, dword [ebp - 0xe0]
cmp dword [ebp + eax*4 - 0x3b4], 0
ja 0x100093a8
mov dword [ebp - 0x40c], 1
jmp 0x100093af
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0
jne 0x100093e9
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b4]
mov dword [ebp - 0x944], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x944]
mov dword [ebp + eax - 0xbac], ecx
cmp dword [ebp - 0x3f4], 0xae22781
jne 0x10009402
xor eax, eax
jne 0x10009402
and dword [ebp - 0x94c], 0
jmp 0x1000940c
mov dword [ebp - 0x94c], 1
cmp dword [ebp - 0x94c], 0
jle 0x10009421
mov dword [ebp - 0x3fc], 1
jmp 0x10009428
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 1
jl 0x10009449
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3b4], 0
jne 0x10009449
and dword [ebp - 0x954], 0
jmp 0x10009453
mov dword [ebp - 0x954], 1
mov eax, dword [ebp - 0x954]
neg eax
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x3b4]
jle 0x10009475
mov dword [ebp - 0x404], 1
jmp 0x1000947c
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x404]
cmp eax, dword [ebp - 0x96c]
jg 0x1000949c
mov dword [ebp - 0x95c], 1
jmp 0x100094a3
and dword [ebp - 0x95c], 0
cmp dword [ebp - 0x95c], 6
jne 0x100094b8
mov dword [ebp - 0x964], 1
jmp 0x100094bf
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x40c]
cmp eax, dword [ebp - 0x964]
jne 0x100094d9
mov dword [ebp - 0x414], 1
jmp 0x100094e0
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x414], eax
jg 0x10009500
cmp dword [ebp - 0x424], 0
jne 0x10009500
and dword [ebp - 0x41c], 0
jmp 0x1000950a
mov dword [ebp - 0x41c], 1
mov eax, dword [ebp - 0x96c]
cmp dword [ebp - 0x41c], eax
jge 0x10009524
mov dword [ebp - 0x974], 1
jmp 0x1000952b
and dword [ebp - 0x974], 0
push 8
pop eax
sub eax, dword [ebp - 0x974]
sub eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x424]
jne 0x1000954e
mov dword [ebp - 0x97c], 1
jmp 0x10009555
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0x42c]
mov dword [ebp + eax*4 - 0x3b4], ecx
jmp 0x10009354
jmp 0x100092ac
push 4
lea ecx, [ebp - 0xaa4]
call fcn.100176ef
mov dword [ebp - 4], 2
mov dword [ebp - 0xc0], 0x532fe223
mov dword [ebp - 0x68], 0
jmp 0x100095ac
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x100095c8
push dword [ebp - 0x68]
lea ecx, [ebp - 0xaa4]
call fcn.1001778d
mov dword [eax], 0xb9b5
jmp 0x100095a5
mov dword [ebp - 0x68], 0
jmp 0x100095d8
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x100095ee
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xf20], 0xfffffff9
jmp 0x100095d1
mov dword [ebp - 0xc0], 0
jmp 0x10009607
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jg 0x100097cd
mov dword [ebp - 0xdb4], 0x2526041
mov dword [ebp - 0xdb0], 0x2526041
mov dword [ebp - 0xdac], 0x2526041
mov dword [ebp - 0xda8], 0x2526041
mov dword [ebp - 0x43c], 8
mov dword [ebp - 0xbb4], 0xfffffffa
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xdb4], 0
jmp 0x1000967e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdb4]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xdb4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdb4], 3
jg 0x100097af
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xaa4]
call fcn.1001778d
cmp dword [eax], 0
je 0x1000977d
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xaa4]
call fcn.1001778d
mov esi, eax
push 1
lea ecx, [ebp - 0xaa4]
call fcn.1001778d
mov esi, dword [esi]
imul esi, dword [eax]
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xaa4]
call fcn.1001778d
cmp esi, dword [eax]
jle 0x100096f2
mov dword [ebp - 0x984], 1
jmp 0x100096f9
and dword [ebp - 0x984], 0
push 3
lea ecx, [ebp - 0xaa4]
call fcn.1001778d
mov ecx, dword [ebp - 0x984]
cmp ecx, dword [eax]
jg 0x10009732
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xaa4]
call fcn.1001778d
cmp dword [eax], 0
jne 0x10009732
mov dword [ebp - 0x434], 1
jmp 0x10009739
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 1
jge 0x1000974e
mov dword [ebp - 0x98c], 1
jmp 0x10009755
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0xb0ad8ea5
jne 0x10009771
xor eax, eax
je 0x1000977d
mov dword [ebp - 0x994], 1
jmp 0x10009784
and dword [ebp - 0x994], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x994]
mov dword [ebp + eax - 0xf20], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbb4]
mov dword [ebp + eax - 0xf20], ecx
jmp 0x10009663
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0xf20]
mov dword [ebp + ecx - 0xf20], eax
jmp 0x100095fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaa4]
call fcn.10017771
mov dword [ebp - 0x1028], 0xfffffff7
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x10009800
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x1000981a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [ebp - 0x1cc], 0xa61928c1
mov dword [ebp - 0x1cc], 0x14
jmp 0x1000983d
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0x11
jge 0x1000989a
cmp dword [ebp - 0x1cc], 0
je 0x1000986b
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x10009869
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x10009898
mov byte [ebp - 0xf8], 0
movzx eax, byte [ebp - 0xf8]
test eax, eax
je 0x10009898
push 0x864
push 0
push 0xd2a
push 0xd30
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10009830
mov dword [ebp - 0x394], 0x256915a
mov dword [ebp - 0x390], 0x256915a
mov dword [ebp - 0x38c], 0x256915a
mov dword [ebp - 0x388], 0x256915a
mov dword [ebp - 0xd8], 2
mov dword [ebp - 0xe68], 0x29
mov dword [ebp - 0xe64], 0x29
mov dword [ebp - 0xe60], 0x29
mov dword [ebp - 0xe5c], 0x29
lea ecx, [ebp - 0x31d]
call fcn.10008ba3
push eax
lea eax, [ebp - 0xe58]
push eax
lea eax, [ebp - 0xe68]
push eax
lea ecx, [ebp - 0x130c]
call fcn.1001779c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe10]
call fcn.1001774b
mov dword [ebp - 4], 3
mov dword [ebp - 0x360], 0x2cc9105f
mov dword [ebp - 0x2e0], 0xa6b719d8
mov dword [ebp - 0x1030], 0x3888
mov dword [ebp - 0x200], 0
jmp 0x10009967
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x10009983
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x12e0], 0xfffffffe
jmp 0x1000995a
mov dword [ebp - 0xd8], 0xa
jmp 0x1000999c
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xffffffee
jle 0x10009a49
mov dword [ebp - 0x284], 0
jmp 0x100099c2
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 2
jge 0x100099de
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0x1148], 0xbea12209
jmp 0x100099b5
push 4
pop eax
shl eax, 0
lea eax, [ebp + eax - 0x1148]
mov dword [ebp - 0x444], eax
push 0
lea ecx, [ebp - 0xe10]
call fcn.1001778d
mov ecx, dword [ebp - 0x444]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x444]
mov ecx, dword [ecx]
mov dword [ebp + eax - 0x12e0], ecx
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x10009a44
push 0
push 0
push 0x1d10
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1000998f
mov dword [ebp - 0xd8], 0xfffffff0
jmp 0x10009a62
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xfffffff5
jle 0x10009baa
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x9b4], 0xe7b1
mov dword [ebp - 0xbbc], 0xfffffff7
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x1038], eax
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x1040], eax
push 2
lea ecx, [ebp - 0xe10]
call fcn.1001778d
mov ecx, dword [ebp - 0x360]
cmp dword [eax], ecx
jge 0x10009ac8
mov dword [ebp - 0x99c], 1
jmp 0x10009acf
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x99c], eax
jg 0x10009ae9
mov dword [ebp - 0x44c], 1
jmp 0x10009af0
and dword [ebp - 0x44c], 0
push 0
lea ecx, [ebp - 0xe10]
call fcn.1001778d
mov ecx, dword [ebp - 0x44c]
cmp ecx, dword [eax]
jg 0x10009b13
mov dword [ebp - 0x9a4], 1
jmp 0x10009b1a
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x2c8]
cmp eax, dword [ebp - 0x9a4]
jge 0x10009b34
mov dword [ebp - 0x454], 1
jmp 0x10009b3b
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0xf341
je 0x10009b5f
mov dword [ebp - 0x9ac], 1
jmp 0x10009b66
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x9b4]
cmp dword [ebp - 0x9ac], eax
jl 0x10009b80
mov dword [ebp - 0x45c], 1
jmp 0x10009b87
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
sub eax, dword [ebp - 0x9b4]
mov dword [ebp - 0xbbc], eax
jmp 0x10009a55
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe10]
call fcn.10017771
mov dword [ebp - 0xc8], 0xcd7d
mov dword [ebp - 0x9bc], 0xffffffff
mov dword [ebp - 0xbdc], 0xa20a2982
mov dword [ebp - 0x1048], 0x3fc4b03e
mov dword [ebp - 0x1050], 0x3dda37bb
mov dword [ebp - 0x9c4], 1
mov dword [ebp - 0x328], 0xddcef989
mov dword [ebp - 0x1058], 3
mov dword [ebp - 0x1060], 0xb151
mov dword [ebp - 0xbc4], 3
push 3
lea ecx, [ebp - 0xf04]
call fcn.100176ef
mov dword [ebp - 4], 4
mov dword [ebp - 0x24], 0
jmp 0x10009c41
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10009c57
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xea4], 0xffffffff
jmp 0x10009c3a
mov dword [ebp - 0x24], 0
jmp 0x10009c67
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x10009c7d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xbe4], 0x37aced45
jmp 0x10009c60
mov dword [ebp - 0x24], 0
jmp 0x10009c8d
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10009ca9
push dword [ebp - 0x24]
lea ecx, [ebp - 0xf04]
call fcn.1001778d
mov dword [eax], 0x3205f5a2
jmp 0x10009c86
cmp dword [ebp - 0x328], 0
jne 0x10009cc4
mov eax, 0x9820
test eax, eax
jne 0x10009cc4
and dword [ebp - 0x464], 0
jmp 0x10009cce
mov dword [ebp - 0x464], 1
push 2
lea ecx, [ebp - 0xf04]
call fcn.1001778d
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
mov eax, dword [eax]
sub eax, dword [ebp - 0x464]
mov dword [ebp - 0xbcc], eax
mov eax, dword [ebp - 0xbc4]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0x2e8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2e8]
mov dword [ecx], eax
mov eax, dword [ebp - 0xbcc]
cmp eax, dword [ebp - 0xbd4]
jle 0x10009d2c
mov dword [ebp - 0x46c], 1
jmp 0x10009d33
and dword [ebp - 0x46c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xea4]
mov dword [ebp - 0x9bc], eax
mov eax, dword [ebp - 0x9bc]
mov dword [ebp - 0x1068], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp - 0x9c4]
mov dword [ebp - 0x1070], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xea4]
mov dword [ebp - 0x1078], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xea4]
mov dword [ebp - 0x1080], eax
mov dword [ebp - 0x328], 0x786
mov eax, dword [ebp - 0x328]
sub eax, dword [ebp - 0xbdc]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbe4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf04]
call fcn.10017771
mov dword [ebp - 0x208], 0
jmp 0x10009dda
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jge 0x10009df6
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0xbec], 1
jmp 0x10009dcd
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x394], 0
jmp 0x10009e21
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x394]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x394], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x394], 0
jl 0x10009ec2
mov dword [ebp - 0x1088], 0xffffffff
push 1
lea ecx, [ebp - 0x119c]
call fcn.100176ef
mov dword [ebp - 4], 5
mov dword [ebp - 0x1090], 0x53061ece
mov dword [ebp - 0x474], 1
mov dword [ebp - 0x28c], 0
jmp 0x10009e7f
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 1
jge 0x10009ea1
push dword [ebp - 0x28c]
lea ecx, [ebp - 0x119c]
call fcn.1001778d
mov dword [eax], 1
jmp 0x10009e72
mov eax, dword [ebp - 0x474]
dec eax
mov dword [ebp - 0x474], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x119c]
call fcn.10017771
jmp 0x10009e08
mov dword [ebp - 0xc8], 0
jmp 0x10009edb
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jg 0x1000a1a0
mov dword [ebp - 0x9c], 0x72585faf
mov dword [ebp - 0x4a4], 0xeca5
mov dword [ebp - 0xa0c], 0xd9140931
mov dword [ebp - 0x9c], 3
jmp 0x10009f1f
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x10009f6a
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x10009f47
push 0
push 0x172a
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x10009f68
push 0
push 0x1445
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x10009f12
mov dword [ebp - 0x9c], 3
jmp 0x10009f83
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x1000a19b
mov dword [ebp - 0x9d4], 1
mov dword [ebp - 0x9cc], 0xa832a49e
mov dword [ebp - 0xa04], 0xfffffffa
mov eax, dword [ebp - 0xc8]
cmp dword [ebp + eax*4 - 0x394], 0
ja 0x10009fca
mov dword [ebp - 0x9ec], 1
jmp 0x10009fd1
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x9d4]
mov dword [ebp - 0x9cc], eax
cmp dword [ebp - 0x9cc], 0
jne 0x1000a00b
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x394]
mov dword [ebp - 0x47c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x47c]
mov dword [ebp + eax - 0xbec], ecx
cmp dword [ebp - 0x9d4], 0xae22781
jne 0x1000a024
xor eax, eax
jne 0x1000a024
and dword [ebp - 0x484], 0
jmp 0x1000a02e
mov dword [ebp - 0x484], 1
cmp dword [ebp - 0x484], 0
jle 0x1000a043
mov dword [ebp - 0x9dc], 1
jmp 0x1000a04a
and dword [ebp - 0x9dc], 0
cmp dword [ebp - 0x9dc], 1
jl 0x1000a06b
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x394], 0
jne 0x1000a06b
and dword [ebp - 0x48c], 0
jmp 0x1000a075
mov dword [ebp - 0x48c], 1
mov eax, dword [ebp - 0x48c]
neg eax
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x394]
jle 0x1000a097
mov dword [ebp - 0x9e4], 1
jmp 0x1000a09e
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0xc8]
add eax, dword [ebp - 0x9e4]
cmp eax, dword [ebp - 0x4a4]
jg 0x1000a0be
mov dword [ebp - 0x494], 1
jmp 0x1000a0c5
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 6
jne 0x1000a0da
mov dword [ebp - 0x49c], 1
jmp 0x1000a0e1
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x9ec]
cmp eax, dword [ebp - 0x49c]
jne 0x1000a0fb
mov dword [ebp - 0x9f4], 1
jmp 0x1000a102
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x9f4], eax
jg 0x1000a122
cmp dword [ebp - 0xa04], 0
jne 0x1000a122
and dword [ebp - 0x9fc], 0
jmp 0x1000a12c
mov dword [ebp - 0x9fc], 1
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x9fc], eax
jge 0x1000a146
mov dword [ebp - 0x4ac], 1
jmp 0x1000a14d
and dword [ebp - 0x4ac], 0
push 8
pop eax
sub eax, dword [ebp - 0x4ac]
sub eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0xa04]
jne 0x1000a170
mov dword [ebp - 0x4b4], 1
jmp 0x1000a177
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0xa0c], eax
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xa0c]
mov dword [ebp + eax*4 - 0x394], ecx
jmp 0x10009f76
jmp 0x10009ece
mov dword [ebp - 0x10c], 0xfffffffd
mov dword [ebp - 0x2f0], 0xffffffff
mov dword [ebp - 0x294], 0x2aa6
mov dword [ebp - 0xa24], 0xfffffffb
mov dword [ebp - 0x348], 0x168aa2d3
mov dword [ebp - 0x210], 0
jmp 0x1000a1eb
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x1000a207
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0xc1c], 0xfffffff7
jmp 0x1000a1de
cmp dword [ebp - 0x10c], 0
je 0x1000a2b5
mov eax, dword [ebp - 0x294]
imul eax, dword [ebp - 0x10c]
imul eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x294]
jl 0x1000a23c
mov dword [ebp - 0x4bc], 1
jmp 0x1000a243
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x4bc], eax
jl 0x1000a25d
mov dword [ebp - 0xa14], 1
jmp 0x1000a264
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0xa14]
jge 0x1000a28a
mov dword [ebp - 0xbf4], 1
jmp 0x1000a291
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x1098], eax
mov eax, 0xd21dfe4
cmp eax, 0x8939f5fa
je 0x1000a2b5
mov dword [ebp - 0x4c4], 1
jmp 0x1000a2bc
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x4c4]
je 0x1000a2df
cmp dword [ebp - 0x2f0], 0
je 0x1000a2df
mov dword [ebp - 0xa1c], 1
jmp 0x1000a2e6
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0x294]
cmp dword [ebp - 0xa1c], eax
jle 0x1000a300
mov dword [ebp - 0x4cc], 1
jmp 0x1000a307
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0xa24], eax
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0x348], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x348]
mov dword [ebp + eax - 0xc1c], ecx
cmp dword [ebp - 0x10c], 0
jne 0x1000a353
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc1c], 0
jne 0x1000a353
and dword [ebp - 0x4d4], 0
jmp 0x1000a35d
mov dword [ebp - 0x4d4], 1
cmp dword [ebp - 0x4d4], 0xfffffffd
jle 0x1000a372
mov dword [ebp - 0xa2c], 1
jmp 0x1000a379
and dword [ebp - 0xa2c], 0
cmp dword [ebp - 0xa2c], 0xfffffffc
jne 0x1000a38e
mov dword [ebp - 0x4dc], 1
jmp 0x1000a395
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 0xdd1edb6b
jb 0x1000a3ad
mov dword [ebp - 0xbfc], 1
jmp 0x1000a3b4
and dword [ebp - 0xbfc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc1c]
cmp dword [ebp - 0x348], eax
jl 0x1000a3d4
mov dword [ebp - 0xa34], 1
jmp 0x1000a3db
and dword [ebp - 0xa34], 0
cmp dword [ebp - 0xa34], 1
jne 0x1000a3f0
mov dword [ebp - 0x4e4], 1
jmp 0x1000a3f7
and dword [ebp - 0x4e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc1c]
cmp dword [ebp - 0x4e4], eax
jle 0x1000a418
mov dword [ebp - 0xa3c], 1
jmp 0x1000a41f
and dword [ebp - 0xa3c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa3c]
mov dword [ebp + eax - 0xc1c], ecx
push 4
lea ecx, [ebp - 0xab4]
call fcn.100176ef
mov dword [ebp - 4], 6
mov dword [ebp - 0xe8], 0x532fe223
mov dword [ebp - 0x70], 0
jmp 0x1000a45f
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1000a47b
push dword [ebp - 0x70]
lea ecx, [ebp - 0xab4]
call fcn.1001778d
mov dword [eax], 0xb9b5
jmp 0x1000a458
mov dword [ebp - 0x70], 0
jmp 0x1000a48b
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1000a4a1
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xfc0], 0xfffffff9
jmp 0x1000a484
mov dword [ebp - 0xe8], 0
jmp 0x1000a4ba
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 3
jg 0x1000a680
mov dword [ebp - 0xdc8], 0x2526041
mov dword [ebp - 0xdc4], 0x2526041
mov dword [ebp - 0xdc0], 0x2526041
mov dword [ebp - 0xdbc], 0x2526041
mov dword [ebp - 0xa4c], 8
mov dword [ebp - 0xc04], 0xfffffffa
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xdc8], 0
jmp 0x1000a531
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdc8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xdc8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdc8], 3
jg 0x1000a662
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xab4]
call fcn.1001778d
cmp dword [eax], 0
je 0x1000a630
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xab4]
call fcn.1001778d
mov esi, eax
push 1
lea ecx, [ebp - 0xab4]
call fcn.1001778d
mov esi, dword [esi]
imul esi, dword [eax]
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xab4]
call fcn.1001778d
cmp esi, dword [eax]
jle 0x1000a5a5
mov dword [ebp - 0x4ec], 1
jmp 0x1000a5ac
and dword [ebp - 0x4ec], 0
push 3
lea ecx, [ebp - 0xab4]
call fcn.1001778d
mov ecx, dword [ebp - 0x4ec]
cmp ecx, dword [eax]
jg 0x1000a5e5
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xab4]
call fcn.1001778d
cmp dword [eax], 0
jne 0x1000a5e5
mov dword [ebp - 0xa44], 1
jmp 0x1000a5ec
and dword [ebp - 0xa44], 0
cmp dword [ebp - 0xa44], 1
jge 0x1000a601
mov dword [ebp - 0x4f4], 1
jmp 0x1000a608
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0xa4c], eax
cmp dword [ebp - 0xa4c], 0xb0ad8ea5
jne 0x1000a624
xor eax, eax
je 0x1000a630
mov dword [ebp - 0x4fc], 1
jmp 0x1000a637
and dword [ebp - 0x4fc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp + eax - 0xfc0], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc04]
mov dword [ebp + eax - 0xfc0], ecx
jmp 0x1000a516
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0xfc0]
mov dword [ebp + ecx - 0xfc0], eax
jmp 0x1000a4ad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xab4]
call fcn.10017771
push 3
lea ecx, [ebp - 0xe1c]
call fcn.100176ef
mov dword [ebp - 4], 7
mov dword [ebp - 0x170], 0x432a2768
mov dword [ebp - 0x10a0], 0xac46ddcd
mov dword [ebp - 0x218], 0
jmp 0x1000a6d0
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 3
jge 0x1000a6f2
push dword [ebp - 0x218]
lea ecx, [ebp - 0xe1c]
call fcn.1001778d
mov dword [eax], 0xbb2c2135
jmp 0x1000a6c3
mov dword [ebp - 0x170], 0
jmp 0x1000a70b
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jg 0x1000a81b
push 1
lea ecx, [ebp - 0xc2c]
call fcn.100176ef
mov byte [ebp - 4], 8
mov dword [ebp - 0x29c], 0
jmp 0x1000a742
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jge 0x1000a761
push dword [ebp - 0x29c]
lea ecx, [ebp - 0xc2c]
call fcn.1001778d
or dword [eax], 0xffffffff
jmp 0x1000a735
push 0
lea ecx, [ebp - 0xc2c]
call fcn.1001778d
mov dword [eax], 2
jmp 0x1000a79a
push 0
lea ecx, [ebp - 0xc2c]
call fcn.1001778d
mov dword [ebp - 0xa54], eax
mov eax, dword [ebp - 0xa54]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xa54]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xc2c]
call fcn.1001778d
cmp dword [eax], 0
jl 0x1000a807
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x220], 0
jmp 0x1000a7cf
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jg 0x1000a802
push dword [ebp - 0x170]
lea ecx, [ebp - 0xe1c]
call fcn.1001778d
mov esi, eax
push dword [ebp - 0x170]
lea ecx, [ebp - 0xe1c]
call fcn.1001778d
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000a7c2
jmp 0x1000a776
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc2c]
call fcn.10017771
jmp 0x1000a6fe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe1c]
call fcn.10017771
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xa5c], 0x193208af
mov dword [ebp - 0x2f8], 0xb35b6890
mov dword [ebp - 0x530], 0xfffffffe
mov dword [ebp - 0x2a4], 0
jmp 0x1000a868
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 4
jge 0x1000a884
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0xb34], 0xffffffff
jmp 0x1000a85b
mov dword [ebp - 0x18], 3
jmp 0x1000a894
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1000a8b6
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x1000a8b4
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1000a88d
mov dword [ebp - 0x18], 0
jmp 0x1000a8c6
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x1000ab9b
mov dword [ebp - 0xc0c], 1
mov dword [ebp - 0x184], 0xc88f
mov dword [ebp - 0xd68], 0xb656
mov dword [ebp - 0x228], 0
jmp 0x1000a907
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 4
jge 0x1000a923
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x1344], 0xffffffff
jmp 0x1000a8fa
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xb34]
mov dword [ebp - 0x10a8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb34]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0xb34]
sub ecx, 0x6b44b761
add eax, ecx
jne 0x1000a96a
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xb34], 0
jne 0x1000a96a
and dword [ebp - 0x504], 0
jmp 0x1000a974
mov dword [ebp - 0x504], 1
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0xa5c], eax
mov eax, dword [ebp - 0xa5c]
imul eax, dword [ebp - 0x2f8]
mov ecx, dword [ebp - 0x18]
cmp eax, dword [ebp + ecx*4 - 0xb34]
jne 0x1000a9a5
mov dword [ebp - 0x50c], 1
jmp 0x1000a9ac
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0x50c], eax
jl 0x1000a9c6
mov dword [ebp - 0xa64], 1
jmp 0x1000a9cd
and dword [ebp - 0xa64], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb34]
cmp dword [ebp - 0xa64], eax
jl 0x1000a9ee
mov dword [ebp - 0x514], 1
jmp 0x1000a9f5
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x514]
sub ecx, dword [ebp - 0xc0c]
cmp dword [ebp + eax*4 - 0xb34], ecx
jge 0x1000aa19
mov dword [ebp - 0xa6c], 1
jmp 0x1000aa20
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0xa6c]
sub eax, 0x21b1
cmp eax, dword [ebp - 0x184]
jle 0x1000aa3f
mov dword [ebp - 0xa74], 1
jmp 0x1000aa46
and dword [ebp - 0xa74], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb34]
cmp dword [ebp - 0xa74], eax
jg 0x1000aa67
mov dword [ebp - 0x53c], 1
jmp 0x1000aa6e
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
sub eax, dword [ebp - 0x18]
cmp eax, 0xffff
je 0x1000aa8a
mov dword [ebp - 0xd60], 1
jmp 0x1000aa91
and dword [ebp - 0xd60], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jg 0x1000aaa5
mov dword [ebp - 0x534], 1
jmp 0x1000aaac
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
neg eax
mov ecx, dword [ebp - 0x18]
imul eax, dword [ebp + ecx*4 - 0xb34]
test eax, eax
je 0x1000aadc
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xb34], 0
je 0x1000aadc
mov dword [ebp - 0x528], 1
jmp 0x1000aae3
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0x528], eax
jge 0x1000aafd
mov dword [ebp - 0x330], 1
jmp 0x1000ab04
and dword [ebp - 0x330], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x330]
mov dword [ebp + eax - 0x1344], ecx
mov eax, dword [ebp - 0xd68]
cmp dword [ebp - 0x330], eax
je 0x1000ab31
mov dword [ebp - 0x800], 1
jmp 0x1000ab38
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x184], 0
jmp 0x1000ab5d
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jg 0x1000ab96
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x1000ab89
push 0x16f6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
cmp dword [ebp - 0x530], 0
je 0x1000ab94
jmp 0x1000ab50
jmp 0x1000ab50
jmp 0x1000a8bf
mov dword [ebp - 0x114], 0xfffffffd
mov dword [ebp - 0x300], 0xffffffff
mov dword [ebp - 0x230], 0x2aa6
mov dword [ebp - 0x548], 0xfffffffb
mov dword [ebp - 0x358], 0x168aa2d3
mov dword [ebp - 0x2ac], 0
jmp 0x1000abe6
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 3
jge 0x1000ac02
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0xc3c], 0xfffffff7
jmp 0x1000abd9
cmp dword [ebp - 0x114], 0
je 0x1000acb0
mov eax, dword [ebp - 0x230]
imul eax, dword [ebp - 0x114]
imul eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x230]
jl 0x1000ac37
mov dword [ebp - 0xa20], 1
jmp 0x1000ac3e
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0xa20], eax
jl 0x1000ac58
mov dword [ebp - 0x538], 1
jmp 0x1000ac5f
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
cmp eax, dword [ebp - 0x538]
jge 0x1000ac85
mov dword [ebp - 0xd70], 1
jmp 0x1000ac8c
and dword [ebp - 0xd70], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x10b0], eax
mov eax, 0xd21dfe4
cmp eax, 0x8939f5fa
je 0x1000acb0
mov dword [ebp - 0x808], 1
jmp 0x1000acb7
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x808]
je 0x1000acda
cmp dword [ebp - 0x300], 0
je 0x1000acda
mov dword [ebp - 0x540], 1
jmp 0x1000ace1
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x540], eax
jle 0x1000acfb
mov dword [ebp - 0x970], 1
jmp 0x1000ad02
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x358], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x358]
mov dword [ebp + eax - 0xc3c], ecx
cmp dword [ebp - 0x114], 0
jne 0x1000ad4e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc3c], 0
jne 0x1000ad4e
and dword [ebp - 0x810], 0
jmp 0x1000ad58
mov dword [ebp - 0x810], 1
cmp dword [ebp - 0x810], 0xfffffffd
jle 0x1000ad6d
mov dword [ebp - 0x550], 1
jmp 0x1000ad74
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0xfffffffc
jne 0x1000ad89
mov dword [ebp - 0xab8], 1
jmp 0x1000ad90
and dword [ebp - 0xab8], 0
cmp dword [ebp - 0xab8], 0xdd1edb6b
jb 0x1000ada8
mov dword [ebp - 0xd78], 1
jmp 0x1000adaf
and dword [ebp - 0xd78], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc3c]
cmp dword [ebp - 0x358], eax
jl 0x1000adcf
mov dword [ebp - 0x558], 1
jmp 0x1000add6
and dword [ebp - 0x558], 0
cmp dword [ebp - 0x558], 1
jne 0x1000adeb
mov dword [ebp - 0x818], 1
jmp 0x1000adf2
and dword [ebp - 0x818], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc3c]
cmp dword [ebp - 0x818], eax
jle 0x1000ae13
mov dword [ebp - 0x560], 1
jmp 0x1000ae1a
and dword [ebp - 0x560], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x560]
mov dword [ebp + eax - 0xc3c], ecx
mov dword [ebp - 0x11c], 0x68206240
mov dword [ebp - 0x828], 0xa296
mov dword [ebp - 0x598], 0xb83de37d
mov dword [ebp - 0x11c], 0
jmp 0x1000ae63
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffef
je 0x1000b161
mov dword [ebp - 0x194], 0x976ff55e
push 4
lea ecx, [ebp - 0xc4c]
call fcn.100176ef
mov dword [ebp - 4], 9
mov dword [ebp - 0xb78], 0x6f1fdbd0
mov dword [ebp - 0xb74], 0x6f1fdbd0
mov dword [ebp - 0xb70], 0x6f1fdbd0
mov dword [ebp - 0xb6c], 0x6f1fdbd0
mov dword [ebp - 0x2b4], 0
jmp 0x1000aecf
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 4
jge 0x1000aef1
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0xc4c]
call fcn.1001778d
mov dword [eax], 0x9008
jmp 0x1000aec2
mov dword [ebp - 0x194], 0xfffffffe
jmp 0x1000af0a
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 9
jne 0x1000b14d
mov dword [ebp - 0x980], 0x2e96673e
mov dword [ebp - 0xd80], 1
mov dword [ebp - 0xd88], 0xa911
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x10b8], eax
push 0
lea ecx, [ebp - 0xc4c]
call fcn.1001778d
push 0
lea ecx, [ebp - 0xc4c]
call fcn.1001778d
cmp dword [eax], 0x60d2
jle 0x1000af6f
mov dword [ebp - 0x978], 1
jmp 0x1000af76
and dword [ebp - 0x978], 0
push 2
lea ecx, [ebp - 0xc4c]
call fcn.1001778d
mov ecx, dword [ebp - 0x978]
cmp ecx, dword [eax]
jl 0x1000af99
mov dword [ebp - 0x568], 1
jmp 0x1000afa0
and dword [ebp - 0x568], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x568]
mov dword [ebp + eax - 0xb78], ecx
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x10c0], eax
mov eax, dword [ebp - 0xd80]
sub eax, dword [ebp - 0x194]
je 0x1000afe2
cmp dword [ebp - 0x828], 0
je 0x1000afe2
mov dword [ebp - 0x820], 1
jmp 0x1000afe9
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x820]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xb78]
jg 0x1000b00b
mov dword [ebp - 0x570], 1
jmp 0x1000b012
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0xd88]
cmp dword [ebp - 0x570], eax
jl 0x1000b02c
mov dword [ebp - 0xa28], 1
jmp 0x1000b033
and dword [ebp - 0xa28], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb78]
cmp dword [ebp - 0xa28], eax
jg 0x1000b054
mov dword [ebp - 0x578], 1
jmp 0x1000b05b
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 0x969b42c5
jbe 0x1000b073
mov dword [ebp - 0x580], 1
jmp 0x1000b07a
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x828]
cmp dword [ebp - 0x580], eax
jle 0x1000b094
mov dword [ebp - 0x588], 1
jmp 0x1000b09b
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x980]
cmp dword [ebp - 0x588], eax
jle 0x1000b0c2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb78], 0
jne 0x1000b0c2
and dword [ebp - 0x830], 0
jmp 0x1000b0cc
mov dword [ebp - 0x830], 1
cmp dword [ebp - 0x830], 1
ja 0x1000b0e1
mov dword [ebp - 0x590], 1
jmp 0x1000b0e8
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
add eax, 0x4dde99
cmp eax, 0x8064
je 0x1000b106
mov dword [ebp - 0xa80], 1
jmp 0x1000b10d
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 7
jne 0x1000b12e
mov dword [ebp - 0x838], 1
jmp 0x1000b135
and dword [ebp - 0x838], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x838]
mov dword [ebp + eax - 0xb78], ecx
jmp 0x1000aefd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4c]
call fcn.10017771
jmp 0x1000ae56
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x11c], eax
push 4
lea ecx, [ebp - 0xac4]
call fcn.100176ef
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xd0], 0x532fe223
mov dword [ebp - 0xa4], 0
jmp 0x1000b1a4
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 4
jge 0x1000b1c6
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xac4]
call fcn.1001778d
mov dword [eax], 0xb9b5
jmp 0x1000b197
mov dword [ebp - 0xa4], 0
jmp 0x1000b1df
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 4
jge 0x1000b1fb
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xfb0], 0xfffffff9
jmp 0x1000b1d2
mov dword [ebp - 0xd0], 0
jmp 0x1000b214
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jg 0x1000b3da
mov dword [ebp - 0xddc], 0x2526041
mov dword [ebp - 0xdd8], 0x2526041
mov dword [ebp - 0xdd4], 0x2526041
mov dword [ebp - 0xdd0], 0x2526041
mov dword [ebp - 0x840], 8
mov dword [ebp - 0xd90], 0xfffffffa
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xddc], 0
jmp 0x1000b28b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xddc]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xddc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xddc], 3
jg 0x1000b3bc
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xac4]
call fcn.1001778d
cmp dword [eax], 0
je 0x1000b38a
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xac4]
call fcn.1001778d
mov esi, eax
push 1
lea ecx, [ebp - 0xac4]
call fcn.1001778d
mov esi, dword [esi]
imul esi, dword [eax]
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xac4]
call fcn.1001778d
cmp esi, dword [eax]
jle 0x1000b2ff
mov dword [ebp - 0x5a0], 1
jmp 0x1000b306
and dword [ebp - 0x5a0], 0
push 3
lea ecx, [ebp - 0xac4]
call fcn.1001778d
mov ecx, dword [ebp - 0x5a0]
cmp ecx, dword [eax]
jg 0x1000b33f
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xac4]
call fcn.1001778d
cmp dword [eax], 0
jne 0x1000b33f
mov dword [ebp - 0x988], 1
jmp 0x1000b346
and dword [ebp - 0x988], 0
cmp dword [ebp - 0x988], 1
jge 0x1000b35b
mov dword [ebp - 0x5a8], 1
jmp 0x1000b362
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 0xb0ad8ea5
jne 0x1000b37e
xor eax, eax
je 0x1000b38a
mov dword [ebp - 0x5b0], 1
jmp 0x1000b391
and dword [ebp - 0x5b0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5b0]
mov dword [ebp + eax - 0xfb0], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd90]
mov dword [ebp + eax - 0xfb0], ecx
jmp 0x1000b270
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0xfb0]
mov dword [ebp + ecx - 0xfb0], eax
jmp 0x1000b207
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac4]
call fcn.10017771
mov dword [ebp - 0x238], 0
jmp 0x1000b402
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jge 0x1000b41e
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x1bc], 0xc0ae9714
jmp 0x1000b3f5
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x1000b436
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1bc], 0
jmp 0x1000b464
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1bc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1bc], 0xffffffef
jl 0x1000b488
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1bc], 0
je 0x1000b486
jmp 0x1000b488
jmp 0x1000b449
push 3
lea ecx, [ebp - 0xe28]
call fcn.100176ef
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x17c], 0x432a2768
mov dword [ebp - 0x10c8], 0xac46ddcd
mov dword [ebp - 0x2bc], 0
jmp 0x1000b4c9
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 3
jge 0x1000b4eb
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0xe28]
call fcn.1001778d
mov dword [eax], 0xbb2c2135
jmp 0x1000b4bc
mov dword [ebp - 0x17c], 0
jmp 0x1000b504
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jg 0x1000b614
push 1
lea ecx, [ebp - 0xc5c]
call fcn.100176ef
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x240], 0
jmp 0x1000b53b
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 1
jge 0x1000b55a
push dword [ebp - 0x240]
lea ecx, [ebp - 0xc5c]
call fcn.1001778d
or dword [eax], 0xffffffff
jmp 0x1000b52e
push 0
lea ecx, [ebp - 0xc5c]
call fcn.1001778d
mov dword [eax], 2
jmp 0x1000b593
push 0
lea ecx, [ebp - 0xc5c]
call fcn.1001778d
mov dword [ebp - 0xa30], eax
mov eax, dword [ebp - 0xa30]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xa30]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xc5c]
call fcn.1001778d
cmp dword [eax], 0
jl 0x1000b600
mov dword [ebp - 0x2c4], 1
mov dword [ebp - 0x2c4], 0
jmp 0x1000b5c8
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 2
jg 0x1000b5fb
push dword [ebp - 0x17c]
lea ecx, [ebp - 0xe28]
call fcn.1001778d
mov esi, eax
push dword [ebp - 0x17c]
lea ecx, [ebp - 0xe28]
call fcn.1001778d
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000b5bb
jmp 0x1000b56f
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xc5c]
call fcn.10017771
jmp 0x1000b4f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe28]
call fcn.10017771
mov dword [ebp - 0x50], 0x1c5534bf
mov dword [ebp - 0x850], 0xbf2121f9
mov dword [ebp - 0x848], 0xfad5befa
mov dword [ebp - 0x5d0], 0xffffffff
mov dword [ebp - 0x5c8], 0x6b43d271
mov dword [ebp - 0x5d8], 0
mov dword [ebp - 0xb98], 0xdd9
mov dword [ebp - 0x4c], 0
jmp 0x1000b676
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1000b68c
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xda0], 0xee491ba6
jmp 0x1000b66f
mov dword [ebp - 0x4c], 0
jmp 0x1000b69c
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1000b6b2
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xba4], 0xdab551fa
jmp 0x1000b695
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jg 0x1000b6c6
mov dword [ebp - 0x5b8], 1
jmp 0x1000b6cd
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x5b8], eax
jg 0x1000b6e4
mov dword [ebp - 0x5c0], 1
jmp 0x1000b6eb
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x50]
dec eax
cmp eax, dword [ebp - 0x50]
jg 0x1000b700
mov dword [ebp - 0xd98], 1
jmp 0x1000b707
and dword [ebp - 0xd98], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x10d0], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x10d8], eax
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0x50], eax
jne 0x1000b73c
mov dword [ebp - 0x990], 1
jmp 0x1000b743
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x990]
mov dword [ebp - 0x5c8], eax
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x5c8]
cmp dword [ebp - 0x850], eax
jl 0x1000b778
mov dword [ebp - 0x308], 1
jmp 0x1000b77f
and dword [ebp - 0x308], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x308]
mov dword [ebp + eax - 0xda0], ecx
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0x308], eax
jne 0x1000b7ac
mov dword [ebp - 0xae8], 1
jmp 0x1000b7b3
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x858], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x858]
mov dword [ebp + eax - 0xba4], ecx
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xb98], eax
movzx eax, byte [0x1066f010]
test eax, eax
je 0x1000b808
mov esi, 0x10083838
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10011382
push 4
lea ecx, [ebp - 0xad4]
call fcn.100176ef
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xb4], 0x532fe223
mov dword [ebp - 0x54], 0
jmp 0x1000b836
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x1000b852
push dword [ebp - 0x54]
lea ecx, [ebp - 0xad4]
call fcn.1001778d
mov dword [eax], 0xb9b5
jmp 0x1000b82f
mov dword [ebp - 0x54], 0
jmp 0x1000b862
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x1000b878
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xf50], 0xfffffff9
jmp 0x1000b85b
mov dword [ebp - 0xb4], 0
jmp 0x1000b891
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jg 0x1000ba57
mov dword [ebp - 0xdf0], 0x2526041
mov dword [ebp - 0xdec], 0x2526041
mov dword [ebp - 0xde8], 0x2526041
mov dword [ebp - 0xde4], 0x2526041
mov dword [ebp - 0x860], 8
mov dword [ebp - 0xd24], 0xfffffffa
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xdf0], 0
jmp 0x1000b908
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdf0]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xdf0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdf0], 3
jg 0x1000ba39
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xad4]
call fcn.1001778d
cmp dword [eax], 0
je 0x1000ba07
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xad4]
call fcn.1001778d
mov esi, eax
push 1
lea ecx, [ebp - 0xad4]
call fcn.1001778d
mov esi, dword [esi]
imul esi, dword [eax]
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xad4]
call fcn.1001778d
cmp esi, dword [eax]
jle 0x1000b97c
mov dword [ebp - 0x5e0], 1
jmp 0x1000b983
and dword [ebp - 0x5e0], 0
push 3
lea ecx, [ebp - 0xad4]
call fcn.1001778d
mov ecx, dword [ebp - 0x5e0]
cmp ecx, dword [eax]
jg 0x1000b9bc
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xad4]
call fcn.1001778d
cmp dword [eax], 0
jne 0x1000b9bc
mov dword [ebp - 0x998], 1
jmp 0x1000b9c3
and dword [ebp - 0x998], 0
cmp dword [ebp - 0x998], 1
jge 0x1000b9d8
mov dword [ebp - 0x5e8], 1
jmp 0x1000b9df
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 0xb0ad8ea5
jne 0x1000b9fb
xor eax, eax
je 0x1000ba07
mov dword [ebp - 0x5f0], 1
jmp 0x1000ba0e
and dword [ebp - 0x5f0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5f0]
mov dword [ebp + eax - 0xf50], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd24]
mov dword [ebp + eax - 0xf50], ecx
jmp 0x1000b8ed
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0xf50]
mov dword [ebp + ecx - 0xf50], eax
jmp 0x1000b884
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xad4]
call fcn.10017771
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x5f8], 0x193208af
mov dword [ebp - 0x338], 0xb35b6890
mov dword [ebp - 0x620], 0xfffffffe
mov dword [ebp - 0x248], 0
jmp 0x1000baa4
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 4
jge 0x1000bac0
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0xb24], 0xffffffff
jmp 0x1000ba97
mov dword [ebp - 0x10], 3
jmp 0x1000bad0
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1000baf2
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1000baf0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1000bac9
mov dword [ebp - 0x10], 0
jmp 0x1000bb02
cmp dword [ebp - 0x10], 3
jg 0x1000bdd7
mov dword [ebp - 0xba0], 1
mov dword [ebp - 0x19c], 0xc88f
mov dword [ebp - 0xba8], 0xb656
mov dword [ebp - 0x288], 0
jmp 0x1000bb43
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 4
jge 0x1000bb5f
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0x1334], 0xffffffff
jmp 0x1000bb36
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xb24]
mov dword [ebp - 0x10e0], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb24]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0xb24]
sub ecx, 0x6b44b761
add eax, ecx
jne 0x1000bba6
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xb24], 0
jne 0x1000bba6
and dword [ebp - 0xa38], 0
jmp 0x1000bbb0
mov dword [ebp - 0xa38], 1
mov eax, dword [ebp - 0xa38]
mov dword [ebp - 0x5f8], eax
mov eax, dword [ebp - 0x5f8]
imul eax, dword [ebp - 0x338]
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ebp + ecx*4 - 0xb24]
jne 0x1000bbe1
mov dword [ebp - 0x868], 1
jmp 0x1000bbe8
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x868], eax
jl 0x1000bc02
mov dword [ebp - 0x600], 1
jmp 0x1000bc09
and dword [ebp - 0x600], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb24]
cmp dword [ebp - 0x600], eax
jl 0x1000bc2a
mov dword [ebp - 0x9a0], 1
jmp 0x1000bc31
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x9a0]
sub ecx, dword [ebp - 0xba0]
cmp dword [ebp + eax*4 - 0xb24], ecx
jge 0x1000bc55
mov dword [ebp - 0x124], 0xfffffffd
mov dword [ebp - 0x350], 0xffffffff
mov dword [ebp - 0x2a8], 0x2aa6
mov dword [ebp - 0x638], 0xfffffffb
mov dword [ebp - 0x318], 0x168aa2d3
mov dword [ebp - 0x250], 0
jmp 0x1000be22
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x1000be3e
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0xc6c], 0xfffffff7
jmp 0x1000be15
cmp dword [ebp - 0x124], 0
je 0x1000beec
mov eax, dword [ebp - 0x2a8]
imul eax, dword [ebp - 0x124]
imul eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x2a8]
jl 0x1000be73
mov dword [ebp - 0x9a8], 1
jmp 0x1000be7a
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x9a8], eax
jl 0x1000be94
mov dword [ebp - 0x628], 1
jmp 0x1000be9b
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x350]
cmp eax, dword [ebp - 0x628]
jge 0x1000bec1
mov dword [ebp - 0xd2c], 1
jmp 0x1000bec8
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x10e8], eax
mov eax, 0xd21dfe4
cmp eax, 0x8939f5fa
je 0x1000beec
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x880]
je 0x1000bf16
cmp dword [ebp - 0x350], 0
je 0x1000bf16
mov dword [ebp - 0x630], 1
jmp 0x1000bf1d
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x630], eax
jle 0x1000bf37
mov dword [ebp - 0xa40], 1
jmp 0x1000bf3e
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0xa40]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x318], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x318]
mov dword [ebp + eax - 0xc6c], ecx
cmp dword [ebp - 0x124], 0
jne 0x1000bf8a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc6c], 0
jne 0x1000bf8a
mov dword [ebp - 0x888], 1
cmp dword [ebp - 0x888], 0xfffffffd
jle 0x1000bfa9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret