Function at 0x10008e29
Capabilities:
Delete registry value
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007d872
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1148
call fcn.1007af60
push esi
push edi
mov dword [ebp - 0xdc0], 0xffffffff
mov dword [ebp - 0xfcc], 1
mov dword [ebp - 0xe98], 0x3cdf98a5
mov dword [ebp - 0x1070], 0xc07e17f7
mov dword [ebp - 0xea8], 9
mov dword [ebp - 0xfd4], 0xffffffff
mov dword [ebp - 0xee4], 0xffffffff
mov dword [ebp - 0x1038], 4
mov dword [ebp - 0xef4], 0x79e672ca
mov dword [ebp - 0xff4], 0xfffffff8
push 3
lea ecx, [ebp - 0xce0]
call fcn.100166d2
and dword [ebp - 4], 0
mov dword [ebp - 0x258], 0
jmp 0x10008edb
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x10008efd
push dword [ebp - 0x258]
lea ecx, [ebp - 0xce0]
call fcn.1001675e
mov dword [eax], 0xf1ad
jmp 0x10008ece
push 0
lea ecx, [ebp - 0xce0]
call fcn.1001675e
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x4dc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4dc]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xce0]
call fcn.10016759
mov dword [ebp - 0xf04], 0xffffffff
mov dword [ebp - 0xd6c], 1
mov dword [ebp - 0xd74], 0x3cdf98a5
mov dword [ebp - 0xd7c], 0xc07e17f7
mov dword [ebp - 0xd84], 9
mov dword [ebp - 0xd8c], 0xffffffff
mov dword [ebp - 0xd94], 0xffffffff
mov dword [ebp - 0xd9c], 4
mov dword [ebp - 0xda4], 0x79e672ca
mov dword [ebp - 0xdac], 0xfffffff8
push 3
lea ecx, [ebp - 0xd10]
call fcn.100166d2
mov dword [ebp - 4], 1
mov dword [ebp - 0x160], 0
jmp 0x10008fc1
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jge 0x10008fe3
push dword [ebp - 0x160]
lea ecx, [ebp - 0xd10]
call fcn.1001675e
mov dword [eax], 0xf1ad
jmp 0x10008fb4
push 0
lea ecx, [ebp - 0xd10]
call fcn.1001675e
mov dword [ebp - 0x8e4], eax
mov eax, dword [ebp - 0x8e4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x8e4]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd10]
call fcn.10016759
push 3
lea ecx, [ebp - 0xe54]
call fcn.100166d2
mov dword [ebp - 4], 2
mov dword [ebp - 0x168], 0x667a876e
mov dword [ebp - 0x1e0], 0
jmp 0x1000904d
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jge 0x1000906f
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0xe54]
call fcn.1001675e
mov dword [eax], 0x9ff6
jmp 0x10009040
mov dword [ebp - 0x168], 2
jmp 0x10009088
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x10009151
mov dword [ebp - 0x220], 0xfffffffd
mov dword [ebp - 0x220], 2
jmp 0x100090b8
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jl 0x10009130
mov dword [ebp - 0x170], 1
mov byte [ebp - 0xa8], 0
movzx eax, byte [ebp - 0xa8]
test eax, eax
je 0x100090e5
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x170], 2
jmp 0x100090fe
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
jl 0x1000912b
mov byte [ebp - 0xab], 0
movzx eax, byte [ebp - 0xab]
test eax, eax
je 0x10009129
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x100090f1
jmp 0x100090ab
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x1000914c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x1000907b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe54]
call fcn.10016759
mov dword [ebp - 0xdb4], 0xffffffff
push 1
lea ecx, [ebp - 0xe64]
call fcn.100166d2
mov dword [ebp - 4], 3
push 2
lea ecx, [ebp - 0xad8]
call fcn.100166d2
mov byte [ebp - 4], 4
mov dword [ebp - 0x1c], 0
jmp 0x1000919f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x100091b8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe64]
call fcn.1001675e
or dword [eax], 0xffffffff
jmp 0x10009198
mov dword [ebp - 0x1c], 0
jmp 0x100091c8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x100091e4
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xad8]
call fcn.1001675e
mov dword [eax], 0x1f2c29a
jmp 0x100091c1
mov dword [ebp - 0x1c], 0
jmp 0x100091f4
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1000920a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1090], 0xffffffff
jmp 0x100091ed
mov byte [ebp - 0xa0], 0
movzx eax, byte [ebp - 0xa0]
test eax, eax
je 0x10009229
push 0
push 0xaf3
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
push 0
lea ecx, [ebp - 0xad8]
call fcn.1001675e
and dword [eax], 0
jmp 0x1000925f
push 0
lea ecx, [ebp - 0xad8]
call fcn.1001675e
mov dword [ebp - 0x8ec], eax
mov eax, dword [ebp - 0x8ec]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x8ec]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xad8]
call fcn.1001675e
cmp dword [eax], 0
jl 0x10009283
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1090], 0xfffffffd
jmp 0x1000923b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xad8]
call fcn.10016759
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe64]
call fcn.10016759
mov dword [ebp - 0xdbc], 1
mov dword [ebp - 0x98], 0x6df3
mov dword [ebp - 0x38], 0xc8959310
mov dword [ebp - 0xc4], 0x3ccd
mov dword [ebp - 0xbe8], 0
mov dword [ebp - 0xbe4], 0
mov dword [ebp - 0xbe0], 0
mov dword [ebp - 0xbdc], 0
mov dword [ebp - 0x2c0], 0xd3d8e1ce
mov dword [ebp - 0x140], 1
mov dword [ebp - 0xa98], 0x6a391de2
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x98], eax
jne 0x10009326
mov dword [ebp - 0x8f4], 1
jmp 0x1000932d
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x8f4]
jle 0x10009347
mov dword [ebp - 0x914], 1
jmp 0x1000934e
and dword [ebp - 0x914], 0
cmp dword [ebp - 0x38], 0xffffffff
jb 0x10009360
mov dword [ebp - 0x8fc], 1
jmp 0x10009367
and dword [ebp - 0x8fc], 0
cmp dword [ebp - 0x8fc], 0xffffffff
jge 0x1000937c
mov dword [ebp - 0x904], 1
jmp 0x10009383
and dword [ebp - 0x904], 0
cmp dword [ebp - 0x904], 0xffffffff
jbe 0x10009398
mov dword [ebp - 0x90c], 1
jmp 0x1000939f
and dword [ebp - 0x90c], 0
cmp dword [ebp - 0x90c], 0x145c
jne 0x100093c0
cmp dword [ebp - 0x98], 0
je 0x100093c0
mov dword [ebp - 0x9cc], 1
jmp 0x100093c7
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xdc4], eax
cmp dword [ebp - 0x914], 0x6e9f0866
je 0x100093eb
mov dword [ebp - 0x91c], 1
jmp 0x100093f2
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x91c], eax
jl 0x100094b5
and dword [ebp - 0xc74], 0
and dword [ebp - 0xc70], 0
and dword [ebp - 0xc6c], 0
and dword [ebp - 0xc68], 0
lea ecx, [ebp - 0x281]
call fcn.10008be3
push eax
lea eax, [ebp - 0xc64]
push eax
lea eax, [ebp - 0xc74]
push eax
lea ecx, [ebp - 0x10ec]
call fcn.1001676d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe74]
call fcn.10016733
mov dword [ebp - 4], 5
mov dword [ebp - 0xc4], 3
jmp 0x10009472
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jl 0x100094a1
push 1
lea ecx, [ebp - 0xe74]
call fcn.1001675e
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0x924]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x924]
mov dword [ecx], eax
jmp 0x10009465
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe74]
call fcn.10016759
jmp 0x10009615
mov dword [ebp - 0x864], 0x34e1054
mov dword [ebp - 0x38], 0
jmp 0x100094cf
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x10009615
mov dword [ebp - 0x280], 0xb659
cmp dword [ebp - 0x864], 0
jbe 0x100094f8
mov dword [ebp - 0x874], 1
jmp 0x100094ff
and dword [ebp - 0x874], 0
cmp dword [ebp - 0x280], 0
jne 0x1000951a
mov eax, dword [ebp - 0x280]
inc eax
jne 0x1000951a
and dword [ebp - 0x880], 0
jmp 0x10009524
mov dword [ebp - 0x880], 1
cmp dword [ebp - 0x880], 0xfffffffd
jg 0x10009539
mov dword [ebp - 0x38c], 1
jmp 0x10009540
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x864]
cmp dword [ebp - 0x38c], eax
jl 0x1000955a
mov dword [ebp - 0x86c], 1
jmp 0x10009561
and dword [ebp - 0x86c], 0
cmp dword [ebp - 0x86c], 0x67c8fa1b
jl 0x10009579
mov dword [ebp - 0xa90], 1
jmp 0x10009580
and dword [ebp - 0xa90], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbe8]
mov dword [ebp - 0xdcc], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xdd4], eax
mov eax, 0x307b364f
test eax, eax
jne 0x100095b7
cmp dword [ebp - 0x38], 0
jne 0x100095b7
and dword [ebp - 0x394], 0
jmp 0x100095c1
mov dword [ebp - 0x394], 1
mov eax, dword [ebp - 0x394]
dec eax
cmp eax, dword [ebp - 0x280]
jge 0x100095dc
mov dword [ebp - 0x39c], 1
jmp 0x100095e3
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x874]
cmp eax, dword [ebp - 0x39c]
je 0x100095fd
mov dword [ebp - 0x87c], 1
jmp 0x10009604
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x2c0], eax
jmp 0x100094c8
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xddc], eax
cmp dword [ebp - 0x38], 0
je 0x10009639
cmp dword [ebp - 0x140], 0
je 0x10009639
and dword [ebp - 0x3a4], 0
jmp 0x10009643
mov dword [ebp - 0x3a4], 1
mov eax, dword [ebp - 0x3a4]
neg eax
cmp eax, 0x6a952366
jg 0x1000965e
mov dword [ebp - 0x884], 1
jmp 0x10009665
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x884]
add eax, 0xc737
imul eax, dword [ebp - 0xc4]
add eax, 3
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xbe8]
jl 0x10009695
mov dword [ebp - 0x3ac], 1
jmp 0x1000969c
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x98], eax
jg 0x100096c2
mov dword [ebp - 0x88c], 1
jmp 0x100096c9
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x88c], eax
je 0x100096e3
mov dword [ebp - 0x3b4], 1
jmp 0x100096ea
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xde4], eax
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xdec], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xdf4], eax
push 0xfffffffffffffff7
pop eax
cmp eax, 1
je 0x10009728
mov dword [ebp - 0x894], 1
jmp 0x1000972f
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x140]
add eax, dword [ebp - 0x894]
cmp eax, dword [ebp - 0x140]
jl 0x1000974f
mov dword [ebp - 0x3bc], 1
jmp 0x10009756
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0xa98], eax
mov dword [ebp - 0xdfc], 0x3cdf98a5
push 4
lea ecx, [ebp - 0xbbc]
call fcn.100166d2
mov dword [ebp - 4], 6
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x288], 0xffffffff
mov dword [ebp - 0x1e8], 0
jmp 0x100097aa
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 4
jge 0x100097cc
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0xbbc]
call fcn.1001675e
mov dword [eax], 0xdfa860b4
jmp 0x1000979d
mov dword [ebp - 0x3c], 0
jmp 0x100097dc
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x100097f5
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xbbc]
call fcn.1001675e
or dword [eax], 0xffffffff
jmp 0x100097d5
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe04], eax
cmp dword [ebp - 0x3c], 7
ja 0x10009810
mov dword [ebp - 0x89c], 1
jmp 0x10009817
and dword [ebp - 0x89c], 0
cmp dword [ebp - 0x89c], 0xffffffff
jae 0x1000982c
mov dword [ebp - 0x3c4], 1
jmp 0x10009833
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x3c4]
neg eax
cmp eax, 0xa32a17d0
jbe 0x1000984e
mov dword [ebp - 0x8a4], 1
jmp 0x10009855
and dword [ebp - 0x8a4], 0
cmp dword [ebp - 0x8a4], 0x3531f145
jl 0x1000986d
mov dword [ebp - 0x3cc], 1
jmp 0x10009874
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3cc], eax
jl 0x1000988b
mov dword [ebp - 0x3d4], 1
jmp 0x10009892
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x8ac], eax
push 3
lea ecx, [ebp - 0xbbc]
call fcn.1001675e
mov ecx, dword [ebp - 0x8ac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8ac]
cmp eax, dword [ebp - 0x3d4]
jle 0x100098d3
mov eax, 0x86fd5d70
test eax, eax
jne 0x100098d3
and dword [ebp - 0x8b4], 0
jmp 0x100098dd
mov dword [ebp - 0x8b4], 1
mov eax, dword [ebp - 0x288]
cmp dword [ebp - 0x8b4], eax
je 0x100098f7
mov dword [ebp - 0x3dc], 1
jmp 0x100098fe
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x3dc]
cmp dword [ebp - 0x288], eax
jne 0x1000991b
mov dword [ebp - 0x8bc], 1
jmp 0x10009922
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x3c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbbc]
call fcn.10016759
mov dword [ebp - 0xe0c], 0xc07e17f7
mov dword [ebp - 0xe14], 9
mov dword [ebp - 0xe1c], 0xffffffff
mov dword [ebp - 0xe24], 0xffffffff
mov dword [ebp - 0xe2c], 4
mov dword [ebp - 0xe34], 0x79e672ca
mov dword [ebp - 0xe3c], 0xfffffff8
push 3
lea ecx, [ebp - 0xcc8]
call fcn.100166d2
mov dword [ebp - 4], 7
mov dword [ebp - 0x178], 0
jmp 0x100099ad
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x100099cf
push dword [ebp - 0x178]
lea ecx, [ebp - 0xcc8]
call fcn.1001675e
mov dword [eax], 0xf1ad
jmp 0x100099a0
push 0
lea ecx, [ebp - 0xcc8]
call fcn.1001675e
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3e4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3e4]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc8]
call fcn.10016759
push 3
lea ecx, [ebp - 0xe84]
call fcn.100166d2
mov dword [ebp - 4], 8
mov dword [ebp - 0x180], 0x667a876e
mov dword [ebp - 0x240], 0
jmp 0x10009a39
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jge 0x10009a5b
push dword [ebp - 0x240]
lea ecx, [ebp - 0xe84]
call fcn.1001675e
mov dword [eax], 0x9ff6
jmp 0x10009a2c
mov dword [ebp - 0x180], 2
jmp 0x10009a74
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jl 0x10009b3d
mov dword [ebp - 0x1f0], 0xfffffffd
mov dword [ebp - 0x1f0], 2
jmp 0x10009aa4
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
jl 0x10009b1c
mov dword [ebp - 0x188], 1
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x10009ad1
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x188], 2
jmp 0x10009aea
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x10009b17
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x10009b15
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x10009add
jmp 0x10009a97
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x10009b38
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10009a67
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe84]
call fcn.10016759
mov dword [ebp - 0x10], 0xb5934215
push 3
lea ecx, [ebp - 0x364]
call fcn.100166d2
mov dword [ebp - 4], 9
mov dword [ebp - 0xf0], 0x83afd470
mov dword [ebp - 0xe44], 0
mov dword [ebp - 0xfc0], 0xffffffff
mov dword [ebp - 0xfc8], 1
mov dword [ebp - 0xfd0], 0xfffffffd
mov dword [ebp - 0xfd8], 0xfefd5227
mov dword [ebp - 0xfe8], 0x2d0b182b
mov dword [ebp - 0xff0], 4
push 2
lea ecx, [ebp - 0xe94]
call fcn.100166d2
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xff8], 0x31915e30
mov dword [ebp - 0x410], 0xdf500c33
mov dword [ebp - 0x70], 0
jmp 0x10009bec
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10009c05
push dword [ebp - 0x70]
lea ecx, [ebp - 0x364]
call fcn.1001675e
and dword [eax], 0
jmp 0x10009be5
mov dword [ebp - 0x70], 0
jmp 0x10009c15
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10009c31
push dword [ebp - 0x70]
lea ecx, [ebp - 0xe94]
call fcn.1001675e
mov dword [eax], 1
jmp 0x10009c0e
cmp dword [ebp - 0x10], 1
jne 0x10009c43
mov dword [ebp - 0x8c4], 1
jmp 0x10009c4a
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x8c4], eax
jg 0x10009c61
mov dword [ebp - 0x3ec], 1
jmp 0x10009c68
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0x10], eax
jne 0x10009c82
mov dword [ebp - 0x8cc], 1
jmp 0x10009c89
and dword [ebp - 0x8cc], 0
cmp dword [ebp - 0x8cc], 0
jae 0x10009c9e
mov dword [ebp - 0xaa0], 1
jmp 0x10009ca5
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1000], eax
push 2
lea ecx, [ebp - 0x364]
call fcn.1001675e
mov esi, dword [ebp - 0x10]
push 1
lea ecx, [ebp - 0x364]
call fcn.1001675e
mov eax, dword [eax]
lea esi, [esi + eax - 0x228a7d46]
push 2
lea ecx, [ebp - 0x364]
call fcn.1001675e
cmp esi, dword [eax]
jne 0x10009cf1
mov dword [ebp - 0x3f4], 1
jmp 0x10009cf8
and dword [ebp - 0x3f4], 0
push 0
lea ecx, [ebp - 0x364]
call fcn.1001675e
mov ecx, dword [ebp - 0x3f4]
cmp ecx, dword [eax]
jg 0x10009d1b
mov dword [ebp - 0x8d4], 1
jmp 0x10009d22
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x8d4]
jg 0x10009d39
mov dword [ebp - 0x8dc], 1
jmp 0x10009d40
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x8dc]
mov dword [ebp - 0xf0], eax
mov esi, dword [ebp - 0xf0]
add esi, dword [ebp - 0x10]
push 2
lea ecx, [ebp - 0x364]
call fcn.1001675e
add esi, dword [eax]
push 2
lea ecx, [ebp - 0x364]
call fcn.1001675e
imul esi, dword [eax]
cmp esi, dword [ebp - 0x10]
je 0x10009d85
mov dword [ebp - 0x424], 1
jmp 0x10009d8c
and dword [ebp - 0x424], 0
push 2
lea ecx, [ebp - 0x364]
call fcn.1001675e
mov ecx, dword [ebp - 0x424]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x10]
jl 0x10009e99
imul eax, dword [ebp - 0x10], 0xffffffff
cmp dword [ebp - 0x10], eax
jl 0x10009dbf
mov dword [ebp - 0x41c], 1
jmp 0x10009dc6
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x41c]
jle 0x10009ddd
mov dword [ebp - 0x408], 1
jmp 0x10009de4
and dword [ebp - 0x408], 0
cmp dword [ebp - 0x408], 0xb6a69eed
jbe 0x10009dfc
mov dword [ebp - 0x698], 1
jmp 0x10009e03
and dword [ebp - 0x698], 0
cmp dword [ebp - 0x698], 0x481d
jne 0x10009e7a
mov dword [ebp - 0x10], 0
jmp 0x10009e1f
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x10009e78
mov dword [ebp - 0xf0], 2
jmp 0x10009e3e
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jl 0x10009e76
mov byte [ebp - 0xa4], 0
movzx eax, byte [ebp - 0xa4]
test eax, eax
je 0x10009e74
push 0
push 0
push 0x24dc
push 0x1758
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x10009e31
jmp 0x10009e18
jmp 0x10009e97
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp - 0xb8]
test eax, eax
je 0x10009e97
push 0x379
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x10009eb8
mov byte [ebp - 0xa6], 0
movzx eax, byte [ebp - 0xa6]
test eax, eax
je 0x10009eb8
push 0x197d
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xe94]
call fcn.10016759
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x364]
call fcn.10016759
mov dword [ebp - 0x90], 8
mov dword [ebp - 0x190], 0x2bfb
mov dword [ebp - 0x420], 0xfffffffc
push 1
lea ecx, [ebp - 0xcd4]
call fcn.100166d2
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xaa8], 0x43b8a277
mov dword [ebp - 0x428], 0xffffffff
mov dword [ebp - 0x228], 0
jmp 0x10009f42
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x10009f64
push dword [ebp - 0x228]
lea ecx, [ebp - 0xcd4]
call fcn.1001675e
mov dword [eax], 0x1de6fc60
jmp 0x10009f35
cmp dword [ebp - 0x90], 0
je 0x1000a017
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1008], eax
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x90], eax
jne 0x10009f97
mov dword [ebp - 0x7e0], 1
jmp 0x10009f9e
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x7e0], eax
je 0x10009fb8
mov dword [ebp - 0x418], 1
jmp 0x10009fbf
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 6
jbe 0x10009fd4
mov dword [ebp - 0x6a0], 1
jmp 0x10009fdb
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x6a0]
add eax, dword [ebp - 0x90]
cmp dword [ebp - 0x90], eax
jle 0x10009ffe
cmp dword [ebp - 0x90], 0
je 0x1000a017
mov eax, 0xd927f7b6
test eax, eax
je 0x1000a017
cmp dword [ebp - 0x190], 0
je 0x1000a017
cmp dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x910], eax
push 0
lea ecx, [ebp - 0xcd4]
call fcn.1001675e
mov ecx, dword [ebp - 0x910]
mov dword [eax], ecx
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x428]
dec eax
mov dword [ebp - 0x428], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcd4]
call fcn.10016759
push 3
lea ecx, [ebp - 0xea4]
call fcn.100166d2
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x198], 0x667a876e
mov dword [ebp - 0x1f8], 0
jmp 0x1000a0a3
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x1000a0c5
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0xea4]
call fcn.1001675e
mov dword [eax], 0x9ff6
jmp 0x1000a096
mov dword [ebp - 0x198], 2
jmp 0x1000a0de
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jl 0x1000a1a7
mov dword [ebp - 0x250], 0xfffffffd
mov dword [ebp - 0x250], 2
jmp 0x1000a10e
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jl 0x1000a186
mov dword [ebp - 0x1a0], 1
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x1000a13b
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x1a0], 2
jmp 0x1000a154
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jl 0x1000a181
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x1000a17f
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x1000a147
jmp 0x1000a101
mov byte [ebp - 0xbc], 0
movzx eax, byte [ebp - 0xbc]
test eax, eax
je 0x1000a1a2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x1000a0d1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xea4]
call fcn.10016759
mov dword [ebp - 0x458], 0x3d1bca9d
mov dword [ebp - 0x2e8], 1
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x290], 0x5378470e
mov dword [ebp - 0xab8], 0xb8e136dc
mov dword [ebp - 0x7f0], 1
mov dword [ebp - 0xac8], 0xffffffff
mov dword [ebp - 0x6a8], 0
push 1
lea ecx, [ebp - 0xeb4]
call fcn.100166d2
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x1010], 0xa320
mov dword [ebp - 0x1018], 0x8c458a92
mov dword [ebp - 0x1a8], 0xbf2b8319
mov dword [ebp - 0xac0], 0
mov dword [ebp - 0x200], 0
jmp 0x1000a265
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x1000a284
push dword [ebp - 0x200]
lea ecx, [ebp - 0xeb4]
call fcn.1001675e
and dword [eax], 0
jmp 0x1000a258
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 1
ja 0x1000a2a6
mov dword [ebp - 0x430], 1
jmp 0x1000a2ad
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x6a8]
sub eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x430], eax
jg 0x1000a2d9
mov dword [ebp - 0x7e8], 1
jmp 0x1000a2e0
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x468]
imul eax, dword [ebp - 0x7e8]
cmp dword [ebp - 0x458], eax
je 0x1000a301
mov dword [ebp - 0x438], 1
jmp 0x1000a308
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x438], eax
jge 0x1000a322
mov dword [ebp - 0x6b0], 1
jmp 0x1000a329
and dword [ebp - 0x6b0], 0
cmp dword [ebp - 0x6b0], 0xa94fe87
jne 0x1000a341
mov dword [ebp - 0x440], 1
jmp 0x1000a348
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 1
jl 0x1000a35d
mov dword [ebp - 0x888], 1
jmp 0x1000a364
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x888], eax
jne 0x1000a37e
mov dword [ebp - 0x448], 1
jmp 0x1000a385
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x2e8], eax
jg 0x1000a3ab
mov dword [ebp - 0x6b8], 1
jmp 0x1000a3b2
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
inc eax
je 0x1000a3dc
cmp dword [ebp - 0x1a8], 0
je 0x1000a3dc
mov dword [ebp - 0x450], 1
jmp 0x1000a3e3
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x7f0], eax
mov eax, dword [ebp - 0x7f0]
cmp dword [ebp - 0x458], eax
jl 0x1000a409
mov dword [ebp - 0x6c0], 1
jmp 0x1000a410
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x6c0]
add eax, 0xffff
cmp eax, dword [ebp - 0x290]
jg 0x1000a42f
mov dword [ebp - 0xab0], 1
jmp 0x1000a436
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x1020], eax
mov eax, dword [ebp - 0xab8]
sub eax, 0x2c64
cmp eax, dword [ebp - 0xac0]
jl 0x1000a461
mov dword [ebp - 0x460], 1
jmp 0x1000a468
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0xac8]
cmp dword [ebp - 0x460], eax
jle 0x1000a482
mov dword [ebp - 0x8d8], 1
jmp 0x1000a489
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x8d8]
mov dword [ebp - 0x468], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeb4]
call fcn.10016759
mov dword [ebp - 0x18], 0xb5934215
push 3
lea ecx, [ebp - 0x370]
call fcn.100166d2
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xd0], 0x83afd470
mov dword [ebp - 0x1028], 0
mov dword [ebp - 0x1034], 0xffffffff
mov dword [ebp - 0x103c], 1
mov dword [ebp - 0x1044], 0xfffffffd
mov dword [ebp - 0x104c], 0xfefd5227
mov dword [ebp - 0x1054], 0x2d0b182b
mov dword [ebp - 0x1064], 4
push 2
lea ecx, [ebp - 0xec8]
call fcn.100166d2
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x106c], 0x31915e30
mov dword [ebp - 0x800], 0xdf500c33
mov dword [ebp - 0x48], 0
jmp 0x1000a544
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1000a55d
push dword [ebp - 0x48]
lea ecx, [ebp - 0x370]
call fcn.1001675e
and dword [eax], 0
jmp 0x1000a53d
mov dword [ebp - 0x48], 0
jmp 0x1000a56d
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1000a589
push dword [ebp - 0x48]
lea ecx, [ebp - 0xec8]
call fcn.1001675e
mov dword [eax], 1
jmp 0x1000a566
cmp dword [ebp - 0x18], 1
jne 0x1000a59b
mov dword [ebp - 0x6c8], 1
jmp 0x1000a5a2
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x6c8], eax
jg 0x1000a5b9
mov dword [ebp - 0x470], 1
jmp 0x1000a5c0
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x470]
cmp dword [ebp - 0x18], eax
jne 0x1000a5da
mov dword [ebp - 0x7f8], 1
jmp 0x1000a5e1
and dword [ebp - 0x7f8], 0
cmp dword [ebp - 0x7f8], 0
jae 0x1000a5f6
mov dword [ebp - 0xb60], 1
jmp 0x1000a5fd
and dword [ebp - 0xb60], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1074], eax
push 2
lea ecx, [ebp - 0x370]
call fcn.1001675e
mov esi, dword [ebp - 0x18]
push 1
lea ecx, [ebp - 0x370]
call fcn.1001675e
mov eax, dword [eax]
lea esi, [esi + eax - 0x228a7d46]
push 2
lea ecx, [ebp - 0x370]
call fcn.1001675e
cmp esi, dword [eax]
jne 0x1000a649
mov dword [ebp - 0x478], 1
jmp 0x1000a650
and dword [ebp - 0x478], 0
push 0
lea ecx, [ebp - 0x370]
call fcn.1001675e
mov ecx, dword [ebp - 0x478]
cmp ecx, dword [eax]
jg 0x1000a673
mov dword [ebp - 0x6d0], 1
jmp 0x1000a67a
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x6d0]
jg 0x1000a691
mov dword [ebp - 0x480], 1
jmp 0x1000a698
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0xd0], eax
mov esi, dword [ebp - 0xd0]
add esi, dword [ebp - 0x18]
push 2
lea ecx, [ebp - 0x370]
call fcn.1001675e
add esi, dword [eax]
push 2
lea ecx, [ebp - 0x370]
call fcn.1001675e
imul esi, dword [eax]
cmp esi, dword [ebp - 0x18]
je 0x1000a6dd
mov dword [ebp - 0x890], 1
jmp 0x1000a6e4
and dword [ebp - 0x890], 0
push 2
lea ecx, [ebp - 0x370]
call fcn.1001675e
mov ecx, dword [ebp - 0x890]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x18]
jl 0x1000a7f1
imul eax, dword [ebp - 0x18], 0xffffffff
cmp dword [ebp - 0x18], eax
jl 0x1000a717
mov dword [ebp - 0x488], 1
jmp 0x1000a71e
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x488]
jle 0x1000a735
mov dword [ebp - 0x6d8], 1
jmp 0x1000a73c
and dword [ebp - 0x6d8], 0
cmp dword [ebp - 0x6d8], 0xb6a69eed
jbe 0x1000a754
mov dword [ebp - 0x490], 1
jmp 0x1000a75b
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x490], 0x481d
jne 0x1000a7d2
mov dword [ebp - 0x18], 0
jmp 0x1000a777
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x1000a7d0
mov dword [ebp - 0xd0], 2
jmp 0x1000a796
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x1000a7ce
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x1000a7cc
push 0
push 0
push 0x24dc
push 0x1758
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x1000a789
jmp 0x1000a770
jmp 0x1000a7ef
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x1000a7ef
push 0x379
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x1000a810
mov byte [ebp - 0xaf], 0
movzx eax, byte [ebp - 0xaf]
test eax, eax
je 0x1000a810
push 0x197d
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
mov eax, dword [ebp - 0x800]
inc eax
mov dword [ebp - 0x800], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xec8]
call fcn.10016759
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x370]
call fcn.10016759
mov dword [ebp - 0x7c], 0
jmp 0x1000a84b
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1000a861
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x10b4], 0
jmp 0x1000a844
mov dword [ebp - 0x7c], 0
jmp 0x1000a871
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1000a887
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x98c], 3
jmp 0x1000a86a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x98c], 0
jmp 0x1000a8b5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x98c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x98c], 3
jge 0x1000a8df
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98c]
mov dword [ebp + eax*4 - 0x10b4], 0xd16df251
jmp 0x1000a89a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x98c], 0x88a137b1
mov dword [ebp - 0x2c], 0x57fd5464
mov dword [ebp - 0x9b8], 0x19f8c517
mov dword [ebp - 0x9b4], 0x19f8c517
mov dword [ebp - 0x9b0], 0x19f8c517
mov dword [ebp - 0x9ac], 0x19f8c517
mov dword [ebp - 0x2c8], 0xf2fe
mov dword [ebp - 0xb80], 0x25d8bac8
mov dword [ebp - 0xb90], 0x665fec6b
mov dword [ebp - 0x2c], 0x17
jmp 0x1000a94d
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x11
jg 0x1000ac32
mov dword [ebp - 0x110], 5
mov dword [ebp - 0x6e0], 0x49dcb7be
mov dword [ebp - 0x6f0], 9
mov dword [ebp - 0x4c0], 0x274cb070
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jge 0x1000a993
mov dword [ebp - 0x498], 1
jmp 0x1000a99a
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x6e0], eax
jne 0x1000a9c0
mov dword [ebp - 0x4a0], 1
jmp 0x1000a9c7
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x4a0]
jg 0x1000a9e1
mov dword [ebp - 0x900], 1
jmp 0x1000a9e8
and dword [ebp - 0x900], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9b8]
cmp dword [ebp - 0x900], eax
jg 0x1000aa09
mov dword [ebp - 0xb68], 1
jmp 0x1000aa10
and dword [ebp - 0xb68], 0
mov eax, 0x5c124380
cmp eax, 0xffffffff
jle 0x1000aa26
mov dword [ebp - 0x4a8], 1
jmp 0x1000aa2d
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0x9ac92d14
jne 0x1000aa45
mov dword [ebp - 0x6e8], 1
jmp 0x1000aa4c
and dword [ebp - 0x6e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9b8]
cmp dword [ebp - 0x6e8], eax
je 0x1000aa6d
mov dword [ebp - 0xb70], 1
jmp 0x1000aa74
and dword [ebp - 0xb70], 0
push 4
pop eax
imul eax, eax, 0x4309
test eax, eax
jne 0x1000aa91
push 6
pop eax
test eax, eax
jne 0x1000aa91
and dword [ebp - 0xb78], 0
jmp 0x1000aa9b
mov dword [ebp - 0xb78], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9b8]
mov dword [ebp - 0x107c], eax
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x2c8]
jne 0x1000aacc
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x1000aacc
and dword [ebp - 0x4b0], 0
jmp 0x1000aad6
mov dword [ebp - 0x4b0], 1
mov eax, dword [ebp - 0x110]
imul eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0x2c], eax
jle 0x1000aafb
push 3
pop eax
test eax, eax
je 0x1000aafb
mov dword [ebp - 0x808], 1
jmp 0x1000ab02
and dword [ebp - 0x808], 0
cmp dword [ebp - 0x808], 0
jb 0x1000ab18
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x9b8], 0
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x1084], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xf9c], eax
imul eax, dword [ebp - 0x2c8], 0xffff
test eax, eax
je 0x1000ab57
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9b8], 0
je 0x1000ab57
mov dword [ebp - 0x4b8], 1
jmp 0x1000ab5e
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x4c0], eax
jg 0x1000ab8d
mov dword [ebp - 0x898], 1
jmp 0x1000ab94
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x110]
add eax, dword [ebp - 0x898]
imul eax, eax, 0xc573
cmp eax, 0x98b3027f
jae 0x1000abb9
mov dword [ebp - 0x4c8], 1
jmp 0x1000abc0
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x4c8]
jle 0x1000abda
mov dword [ebp - 0x6f8], 1
jmp 0x1000abe1
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x6f8], eax
jge 0x1000abfb
mov dword [ebp - 0x4d0], 1
jmp 0x1000ac02
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0xb80]
cmp dword [ebp - 0x4d0], eax
jle 0x1000ac1c
mov dword [ebp - 0xb88], 1
jmp 0x1000ac23
and dword [ebp - 0xb88], 0
mov dword [ebp - 0xb90], 2
jmp 0x1000a946
mov dword [ebp - 0x88], 8
mov dword [ebp - 0x1b0], 0x2bfb
mov dword [ebp - 0x4e0], 0xfffffffc
push 1
lea ecx, [ebp - 0xcec]
call fcn.100166d2
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xb98], 0x43b8a277
mov dword [ebp - 0x4e8], 0xffffffff
mov dword [ebp - 0x230], 0
jmp 0x1000ac91
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x1000acb3
push dword [ebp - 0x230]
lea ecx, [ebp - 0xcec]
call fcn.1001675e
mov dword [eax], 0x1de6fc60
jmp 0x1000ac84
cmp dword [ebp - 0x88], 0
je 0x1000ad66
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xfec], eax
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x88], eax
jne 0x1000ace6
mov dword [ebp - 0x810], 1
jmp 0x1000aced
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x810], eax
je 0x1000ad07
mov dword [ebp - 0x4d8], 1
jmp 0x1000ad0e
and dword [ebp - 0x4d8], 0
cmp dword [ebp - 0x4d8], 6
jbe 0x1000ad23
mov dword [ebp - 0x700], 1
jmp 0x1000ad2a
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x700]
add eax, dword [ebp - 0x88]
cmp dword [ebp - 0x88], eax
jle 0x1000ad4d
cmp dword [ebp - 0x88], 0
je 0x1000ad66
mov eax, 0xd927f7b6
test eax, eax
je 0x1000ad66
cmp dword [ebp - 0x1b0], 0
je 0x1000ad66
cmp dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x8e0], eax
push 0
lea ecx, [ebp - 0xcec]
call fcn.1001675e
mov ecx, dword [ebp - 0x8e0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0x4e8]
dec eax
mov dword [ebp - 0x4e8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcec]
call fcn.10016759
mov dword [ebp - 0xd8], 0xfffffff7
mov dword [ebp - 0x4f0], 0xfffffff9
mov dword [ebp - 0xba0], 9
mov dword [ebp - 0x4f8], 0xfffffffb
mov dword [ebp - 0xba8], 0xffffffff
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xd70], eax
cmp dword [ebp - 0xd8], 0xe649
jne 0x1000ae17
cmp dword [ebp - 0xd8], 0
jne 0x1000ae17
and dword [ebp - 0x708], 0
jmp 0x1000ae21
mov dword [ebp - 0x708], 1
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0xd8]
imul eax, dword [ebp - 0x4f0]
push 5
pop ecx
sub ecx, eax
cmp ecx, dword [ebp - 0xba0]
je 0x1000ae53
mov dword [ebp - 0x818], 1
jmp 0x1000ae5a
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0xd8]
imul eax, dword [ebp - 0x4f8]
test eax, eax
jne 0x1000ae89
cmp dword [ebp - 0xd8], 0
jne 0x1000ae89
and dword [ebp - 0x710], 0
jmp 0x1000ae93
mov dword [ebp - 0x710], 1
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0xba8], eax
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x1000aec7
push 0
push 0
push 0x85
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
mov dword [ebp - 0xf8], 0x477862fd
mov dword [ebp - 0x944], 0x38299fa9
mov dword [ebp - 0x940], 0x38299fa9
mov dword [ebp - 0x93c], 0x38299fa9
mov dword [ebp - 0x938], 0x38299fa9
mov dword [ebp - 0x508], 0xffffffff
mov dword [ebp - 0x510], 0xd7f285f4
or dword [ebp - 0xc4c], 0xffffffff
or dword [ebp - 0xc48], 0xffffffff
or dword [ebp - 0xc44], 0xffffffff
or dword [ebp - 0xc40], 0xffffffff
lea ecx, [ebp - 0x279]
call fcn.10008be3
push eax
lea eax, [ebp - 0xc3c]
push eax
lea eax, [ebp - 0xc4c]
push eax
lea ecx, [ebp - 0x1124]
call fcn.1001676d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xfe4]
call fcn.10016733
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xb54], 1
mov dword [ebp - 0xab4], 0x2e882408
mov dword [ebp - 0x208], 0
jmp 0x1000af92
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x1000afae
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0xa58], 5
jmp 0x1000af85
mov dword [ebp - 0xf8], 0x17
jmp 0x1000afc7
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xfffffffc
jl 0x1000b366
mov dword [ebp - 0x1b8], 0
jmp 0x1000afed
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 4
jge 0x1000b009
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x328], 0xc62e0897
jmp 0x1000afe0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x328], 0
je 0x1000b329
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x328]
mov dword [ebp - 0x1080], eax
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x944], 0xe26b
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x328]
jl 0x1000b05b
mov dword [ebp - 0x500], 1
jmp 0x1000b062
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
add eax, 9
cmp dword [ebp - 0xf8], eax
jl 0x1000b07f
mov dword [ebp - 0x8a0], 1
jmp 0x1000b086
and dword [ebp - 0x8a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x328]
add eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0xfffb
jne 0x1000b0b7
mov dword [ebp - 0x718], 1
jmp 0x1000b0be
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x718]
mov dword [ebp - 0x510], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x328]
cmp dword [ebp - 0x510], eax
je 0x1000b0ea
mov dword [ebp - 0x820], 1
jmp 0x1000b0f1
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x820]
neg eax
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x328]
cmp dword [ebp - 0xf8], eax
je 0x1000b126
and dword [ebp - 0x730], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x730]
mov dword [ebp + eax - 0x328], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x328]
sub eax, dword [ebp - 0xab4]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x328], eax
jmp 0x1000afba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfe4]
call fcn.10016759
mov dword [ebp - 0x748], 0x3d1bca9d
mov dword [ebp - 0x2f8], 1
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x750], 0
mov dword [ebp - 0x2a0], 0x5378470e
mov dword [ebp - 0xa3c], 0xb8e136dc
mov dword [ebp - 0x568], 1
mov dword [ebp - 0x9e0], 0xffffffff
mov dword [ebp - 0x540], 0
push 1
lea ecx, [ebp - 0x1060]
call fcn.100166d2
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xd78], 0xa320
mov dword [ebp - 0xf14], 0x8c458a92
mov dword [ebp - 0x1c0], 0xbf2b8319
mov dword [ebp - 0x9dc], 0
mov dword [ebp - 0x248], 0
jmp 0x1000b424
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x1000b443
push dword [ebp - 0x248]
lea ecx, [ebp - 0x1060]
call fcn.1001675e
and dword [eax], 0
jmp 0x1000b417
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
ja 0x1000b465
mov dword [ebp - 0x8a8], 1
jmp 0x1000b46c
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x540]
sub eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0x8a8], eax
jg 0x1000b498
mov dword [ebp - 0x548], 1
jmp 0x1000b49f
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x750]
imul eax, dword [ebp - 0x548]
cmp dword [ebp - 0x748], eax
je 0x1000b4c0
mov dword [ebp - 0x738], 1
jmp 0x1000b4c7
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x738], eax
jge 0x1000b4e1
mov dword [ebp - 0x550], 1
jmp 0x1000b4e8
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0xa94fe87
jne 0x1000b500
mov dword [ebp - 0x830], 1
jmp 0x1000b507
and dword [ebp - 0x830], 0
cmp dword [ebp - 0x830], 1
jl 0x1000b51c