Function at 0x100094b9
Capabilities:
Accept command line arguments
Check os version
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008d05c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x111c
call fcn.10089850
push esi
push edi
mov dword [ebp - 0xffc], 0
mov dword [ebp - 0xf5c], 0xfffffff9
mov dword [ebp - 0x105c], 0
mov dword [ebp - 0xf64], 1
mov dword [ebp - 0x100c], 0x1836ccb0
mov dword [ebp - 0xb80], 1
mov dword [ebp - 0xf6c], 0x4b283066
mov dword [ebp - 0x103c], 0xfffffffd
mov dword [ebp - 0x740], 0x789328a
mov dword [ebp - 0x278], 0
jmp 0x10009550
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 2
jge 0x1000956c
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0x10b8], 0x1d2250db
jmp 0x10009543
mov eax, dword [ebp - 0x740]
inc eax
mov dword [ebp - 0x740], eax
mov dword [ebp - 0xb80], 0xfffffff7
push 3
lea ecx, [ebp - 0x2f8]
call fcn.10016f54
and dword [ebp - 4], 0
mov dword [ebp - 0xf8], 0xe9bf9f36
push 1
lea ecx, [ebp - 0xb04]
call fcn.10016f54
mov byte [ebp - 4], 1
mov dword [ebp - 0x7c], 2
mov dword [ebp - 0x40], 0
jmp 0x100095c6
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x100095e2
push dword [ebp - 0x40]
lea ecx, [ebp - 0x2f8]
call fcn.10016fe2
mov dword [eax], 2
jmp 0x100095bf
mov dword [ebp - 0x40], 0
jmp 0x100095f2
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1000960e
push dword [ebp - 0x40]
lea ecx, [ebp - 0xb04]
call fcn.10016fe2
mov dword [eax], 3
jmp 0x100095eb
push 1
lea ecx, [ebp - 0x2f8]
call fcn.10016fe2
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0xab8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xab8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb04]
call fcn.10016fe2
mov dword [eax], 0xf34111d0
push 0xfffffffffffffff8
pop eax
cmp eax, 0xf34111d0
jb 0x1000965b
mov dword [ebp - 0xac0], 1
jmp 0x10009662
and dword [ebp - 0xac0], 0
cmp dword [ebp - 0xac0], 5
jae 0x10009677
mov dword [ebp - 0xac8], 1
jmp 0x1000967e
and dword [ebp - 0xac8], 0
push 1
lea ecx, [ebp - 0x2f8]
call fcn.10016fe2
mov ecx, dword [ebp - 0xac8]
cmp ecx, dword [eax]
jg 0x100096a1
mov dword [ebp - 0xad0], 1
jmp 0x100096a8
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xbf889e02
jbe 0x100096cd
push 2
pop eax
test eax, eax
je 0x100096cd
mov dword [ebp - 0x794], 1
jmp 0x100096d4
and dword [ebp - 0x794], 0
push 1
lea ecx, [ebp - 0x2f8]
call fcn.10016fe2
mov eax, dword [eax]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0x794]
jl 0x10009703
mov dword [ebp - 0x3dc], 1
jmp 0x1000970a
and dword [ebp - 0x3dc], 0
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x3dc]
cmp ecx, dword [eax]
je 0x1000973f
push 0
lea ecx, [ebp - 0xb04]
call fcn.10016fe2
cmp dword [eax], 0
je 0x1000973f
mov dword [ebp - 0x79c], 1
jmp 0x10009746
and dword [ebp - 0x79c], 0
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x79c]
cmp ecx, dword [eax]
jg 0x1000976a
push 1
lea ecx, [ebp - 0x2f8]
call fcn.10016fe2
push 1
lea ecx, [ebp - 0x2f8]
call fcn.10016fe2
imul esi, dword [eax], 0xfffffff8
push 1
lea ecx, [ebp - 0x2f8]
call fcn.10016fe2
cmp esi, dword [eax]
jge 0x1000978f
cmp dword [ebp - 0x7c], 0
mov eax, 0xf9d66de6
test eax, eax
je 0x100099b1
mov dword [ebp - 0x1cc], 0xa26cdee9
mov dword [ebp - 0x3fc], 0
mov dword [ebp - 0x3f4], 0
mov dword [ebp - 0x25c], 0
jmp 0x100097d3
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 1
jge 0x100097ef
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0xbf0], 8
jmp 0x100097c6
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10016fe2
push 0
lea ecx, [ebp - 0xb04]
call fcn.10016fe2
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0xe88], eax
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10016fe2
cmp dword [eax], 0xfd6b2214
jbe 0x10009836
mov dword [ebp - 0x3e4], 1
jmp 0x1000983d
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x1cc]
cmp eax, dword [ebp - 0x3e4]
jl 0x10009857
mov dword [ebp - 0x7a4], 1
jmp 0x1000985e
and dword [ebp - 0x7a4], 0
push 1
lea ecx, [ebp - 0x2f8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x7a4]
add ecx, dword [eax]
imul ecx, dword [ebp - 0x7c]
cmp ecx, dword [ebp - 0x3fc]
jge 0x1000989d
push 0
lea ecx, [ebp - 0xb04]
call fcn.10016fe2
cmp dword [eax], 0
je 0x1000989d
mov dword [ebp - 0x3ec], 1
jmp 0x100098a4
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 0
jg 0x100098b9
mov dword [ebp - 0x7ac], 1
jmp 0x100098c0
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x3f4], eax
jne 0x100098e6
mov dword [ebp - 0x7b4], 1
jmp 0x100098ed
and dword [ebp - 0x7b4], 0
push 2
lea ecx, [ebp - 0x2f8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x7b4]
cmp ecx, dword [eax]
jge 0x10009922
cmp dword [ebp - 0x3fc], 0
je 0x10009922
cmp dword [ebp - 0x1cc], 0
je 0x10009922
mov dword [ebp - 0x3c4], 1
jmp 0x10009929
and dword [ebp - 0x3c4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp + eax - 0xbf0], ecx
push 0
lea ecx, [ebp - 0xb04]
call fcn.10016fe2
mov ecx, dword [ebp - 0x3c4]
mov dword [eax], ecx
mov dword [ebp - 0x7c], 0xfffffffe
jmp 0x10009961
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x1c
jge 0x100099af
mov dword [ebp - 0xf8], 0
jmp 0x10009980
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jg 0x100099ad
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x100099ab
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x10009973
jmp 0x1000995a
jmp 0x10009a2d
mov dword [ebp - 0xe90], 0xfa755584
push 2
lea ecx, [ebp - 0xf90]
call fcn.10016f54
mov byte [ebp - 4], 2
mov dword [ebp - 0x7bc], 0xfe298319
mov dword [ebp - 0x2cc], 0
jmp 0x100099ef
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 2
jge 0x10009a11
push dword [ebp - 0x2cc]
lea ecx, [ebp - 0xf90]
call fcn.10016fe2
mov dword [eax], 0xf04e266b
jmp 0x100099e2
mov eax, dword [ebp - 0x7bc]
inc eax
mov dword [ebp - 0x7bc], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xf90]
call fcn.10016fdd
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb04]
call fcn.10016fdd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f8]
call fcn.10016fdd
mov dword [ebp - 0xe98], 0
mov dword [ebp - 0xea0], 0xfffffff9
mov dword [ebp - 0x370], 0x9949dfcf
mov dword [ebp - 0x404], 7
mov dword [ebp - 0x1a8], 0xffffffff
mov dword [ebp - 0x41c], 0xe54ee87f
mov dword [ebp - 0xb0], 0xcfaf
mov dword [ebp - 0x1d4], 0x12af04
mov dword [ebp - 0xbf8], 0xfffffffd
push 3
lea ecx, [ebp - 0xe0c]
call fcn.10016f54
mov dword [ebp - 4], 3
mov dword [ebp - 0x70], 0
jmp 0x10009ac9
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x10009adf
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x1070], 0x37911b9c
jmp 0x10009ac2
mov dword [ebp - 0x70], 0
jmp 0x10009aef
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10009b0b
push dword [ebp - 0x70]
lea ecx, [ebp - 0xe0c]
call fcn.10016fe2
mov dword [eax], 0x9f8c5172
jmp 0x10009ae8
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 1
jl 0x10009b38
mov dword [ebp - 0x7c4], 1
jmp 0x10009b3f
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x7c4], eax
jne 0x10009b59
mov dword [ebp - 0x424], 1
jmp 0x10009b60
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xb0]
inc ecx
mov dword [ebp - 0xb0], ecx
test eax, eax
jne 0x10009c9b
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x1d4], eax
je 0x10009b9b
cmp dword [ebp - 0x1a8], 0
jne 0x10009b9b
and dword [ebp - 0x3cc], 0
jmp 0x10009ba5
mov dword [ebp - 0x3cc], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp + eax - 0x1070], ecx
mov eax, dword [ebp - 0x3cc]
sub eax, dword [ebp - 0x1d4]
jne 0x10009be4
or eax, 0xffffffff
jne 0x10009be4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1070], 0
jne 0x10009be4
and dword [ebp - 0x40c], 0
jmp 0x10009bee
mov dword [ebp - 0x40c], 1
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x40c]
cmp eax, dword [ebp - 0xb0]
jg 0x10009c0e
mov dword [ebp - 0x7cc], 1
jmp 0x10009c15
and dword [ebp - 0x7cc], 0
cmp dword [ebp - 0x7cc], 0xffffffff
jle 0x10009c2a
mov dword [ebp - 0x414], 1
jmp 0x10009c31
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x414], eax
jge 0x10009c4b
mov dword [ebp - 0x7d4], 1
jmp 0x10009c52
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x7d4]
cmp dword [ebp - 0x41c], eax
je 0x10009c7e
mov dword [ebp - 0x7dc], 1
jmp 0x10009c85
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7dc]
add eax, 0x6896e60b
jne 0x10009c9b
and dword [ebp - 0x7e4], 0
jmp 0x10009ca5
mov dword [ebp - 0x7e4], 1
mov eax, dword [ebp - 0x424]
cmp eax, dword [ebp - 0x7e4]
je 0x10009cbf
mov dword [ebp - 0x42c], 1
jmp 0x10009cc6
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
sub eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1a8], eax
mov esi, dword [ebp - 0x1a8]
sub esi, dword [ebp - 0xbf8]
push 0
lea ecx, [ebp - 0xe0c]
call fcn.10016fe2
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0c]
call fcn.10016fdd
mov dword [ebp - 0xea8], 0
push 1
lea ecx, [ebp - 0x310]
call fcn.10016f54
mov dword [ebp - 4], 4
mov dword [ebp - 0x320], 0xffffffff
mov dword [ebp - 0x100], 0xfffffffb
mov dword [ebp - 0x130], 0xa37d7c86
mov dword [ebp - 0xb8], 0xec352115
push 2
lea ecx, [ebp - 0xcc8]
call fcn.10016f54
mov byte [ebp - 4], 5
mov dword [ebp - 0x18], 0
jmp 0x10009d69
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10009d82
push dword [ebp - 0x18]
lea ecx, [ebp - 0x310]
call fcn.10016fe2
or dword [eax], 0xffffffff
jmp 0x10009d62
mov dword [ebp - 0x18], 0
jmp 0x10009d92
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10009da8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xaf8], 0x5cb5542a
jmp 0x10009d8b
mov dword [ebp - 0x18], 0
jmp 0x10009db8
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10009dd4
push dword [ebp - 0x18]
lea ecx, [ebp - 0xcc8]
call fcn.10016fe2
mov dword [eax], 7
jmp 0x10009db1
push 0
lea ecx, [ebp - 0x310]
call fcn.10016fe2
cmp dword [eax], 0
jge 0x10009df2
mov dword [ebp - 0x7ec], 1
jmp 0x10009df9
and dword [ebp - 0x7ec], 0
mov dword [ebp - 0x320], 1
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x434], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x434]
mov dword [ebp + eax - 0xaf8], ecx
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x100], eax
mov esi, dword [ebp - 0x434]
sub esi, dword [ebp - 0x100]
push 0
lea ecx, [ebp - 0x310]
call fcn.10016fe2
cmp esi, dword [eax]
jne 0x10009e57
mov dword [ebp - 0x7f4], 1
jmp 0x10009e5e
and dword [ebp - 0x7f4], 0
push 0
lea ecx, [ebp - 0x310]
call fcn.10016fe2
mov esi, dword [ebp - 0x7f4]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x310]
call fcn.10016fe2
cmp esi, dword [eax]
jge 0x10009e91
mov dword [ebp - 0x43c], 1
jmp 0x10009e98
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0
jge 0x10009ead
mov dword [ebp - 0x7fc], 1
jmp 0x10009eb4
and dword [ebp - 0x7fc], 0
push 0
lea ecx, [ebp - 0x310]
call fcn.10016fe2
mov ecx, dword [ebp - 0x7fc]
cmp ecx, dword [eax]
jge 0x10009ed7
mov dword [ebp - 0x444], 1
jmp 0x10009ede
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffff
jbe 0x10009f02
mov dword [ebp - 0x804], 1
jmp 0x10009f09
and dword [ebp - 0x804], 0
push 0
lea ecx, [ebp - 0x310]
call fcn.10016fe2
mov ecx, dword [ebp - 0x804]
cmp ecx, dword [eax]
jl 0x10009f2c
mov dword [ebp - 0x44c], 1
jmp 0x10009f33
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 0xfffffffa
jge 0x10009f48
mov dword [ebp - 0x80c], 1
jmp 0x10009f4f
and dword [ebp - 0x80c], 0
push 0
lea ecx, [ebp - 0x310]
call fcn.10016fe2
mov ecx, dword [ebp - 0x80c]
cmp ecx, dword [eax]
jl 0x10009f72
mov dword [ebp - 0x454], 1
jmp 0x10009f79
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
add eax, 0x128abf8b
mov dword [ebp - 0xb8], eax
mov esi, dword [ebp - 0xb8]
push 0
lea ecx, [ebp - 0x310]
call fcn.10016fe2
cmp dword [eax], esi
jge 0x10009fad
mov dword [ebp - 0x814], 1
jmp 0x10009fb4
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x814]
sub eax, 0xfafb
cmp eax, 0xffffffff
jge 0x10009fd0
mov dword [ebp - 0x45c], 1
jmp 0x10009fd7
and dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 0
je 0x10009ff2
mov eax, 0xbc69
test eax, eax
jne 0x10009ff2
and dword [ebp - 0x81c], 0
jmp 0x10009ffc
mov dword [ebp - 0x81c], 1
cmp dword [ebp - 0x81c], 0x509c
je 0x1000a014
mov dword [ebp - 0x464], 1
jmp 0x1000a01b
and dword [ebp - 0x464], 0
cmp dword [ebp - 0x464], 0xfffffff6
je 0x1000a051
mov byte [ebp - 0xa8], 0
movzx eax, byte [ebp - 0xa8]
test eax, eax
je 0x1000a04c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x1000a1c7
mov dword [ebp - 0x3a0], 0xfffffff9
mov dword [ebp - 0x264], 0xc9d6c840
mov dword [ebp - 0xc00], 0xffffffff
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x100], eax
jne 0x1000a089
mov dword [ebp - 0x824], 1
jmp 0x1000a090
and dword [ebp - 0x824], 0
push 0
lea ecx, [ebp - 0xcc8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x824]
cmp ecx, dword [eax]
jle 0x1000a0b3
mov dword [ebp - 0x46c], 1
jmp 0x1000a0ba
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x3a0]
imul ecx, dword [ebp - 0xb8], 0xfffffff8
add eax, ecx
mov ecx, dword [ebp - 0x46c]
neg ecx
sub eax, ecx
mov dword [ebp - 0x82c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x82c]
mov dword [ebp + eax - 0xaf8], ecx
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x82c], eax
jg 0x1000a111
mov dword [ebp - 0x474], 1
jmp 0x1000a118
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 1
jbe 0x1000a139
mov dword [ebp - 0x834], 1
jmp 0x1000a140
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0xc00]
cmp dword [ebp - 0x834], eax
jg 0x1000a15a
mov dword [ebp - 0x47c], 1
jmp 0x1000a161
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x47c], eax
jl 0x1000a17b
mov dword [ebp - 0x83c], 1
jmp 0x1000a182
and dword [ebp - 0x83c], 0
push 0
lea ecx, [ebp - 0xcc8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x83c]
cmp ecx, dword [eax]
jl 0x1000a1a5
mov dword [ebp - 0x484], 1
jmp 0x1000a1ac
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
sub eax, 8
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x130], eax
push 0
lea ecx, [ebp - 0x310]
call fcn.10016fe2
push 0
lea ecx, [ebp - 0x310]
call fcn.10016fe2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xaf8], 0
jl 0x1000a1fd
mov dword [ebp - 0x844], 1
jmp 0x1000a204
and dword [ebp - 0x844], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaf8]
add eax, dword [ebp - 0x844]
sub eax, dword [ebp - 0x100]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0xb8], eax
jge 0x1000a23d
mov dword [ebp - 0xc08], 1
jmp 0x1000a244
and dword [ebp - 0xc08], 0
push 0
lea ecx, [ebp - 0xcc8]
call fcn.10016fe2
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xaf8]
cmp dword [ebp + eax - 0xaf8], ecx
jl 0x1000a279
mov dword [ebp - 0x48c], 1
jmp 0x1000a280
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x48c]
jge 0x1000a29a
mov dword [ebp - 0x84c], 1
jmp 0x1000a2a1
and dword [ebp - 0x84c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x84c]
mov dword [ebp + eax - 0xaf8], ecx
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xeb0], eax
mov eax, dword [ebp - 0xb8]
neg eax
mov dword [ebp - 0x130], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xcc8]
call fcn.10016fdd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x310]
call fcn.10016fdd
mov dword [ebp - 0xeb8], 1
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x170], 0
jmp 0x1000a319
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xf
je 0x1000a34e
cmp dword [ebp - 0x170], 0
je 0x1000a32d
jmp 0x1000a34e
mov byte [ebp - 0xe4], 0
movzx eax, byte [ebp - 0xe4]
test eax, eax
je 0x1000a34c
push 0x11e6
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
jmp 0x1000a30c
mov dword [ebp - 0xec0], 0x1836ccb0
mov dword [ebp - 0x874], 0x69f4
mov dword [ebp - 0xec8], 0xfb1c0380
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x378], 1
mov dword [ebp - 0xc28], 0xd7540573
mov dword [ebp - 0x884], 6
mov dword [ebp - 0xc10], 7
mov dword [ebp - 0xc18], 0x9958900f
mov dword [ebp - 0xc20], 1
mov dword [ebp - 0x88c], 0x9f5ab171
mov dword [ebp - 0x10], 0
jmp 0x1000a3cc
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1000a3e2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe48], 0x187110e6
jmp 0x1000a3c5
mov dword [ebp - 0x10], 0
jmp 0x1000a3f2
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1000a408
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x108c], 0xa44198d7
jmp 0x1000a3eb
mov dword [ebp - 0x10], 0
jmp 0x1000a418
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1000a42e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x494], 0x826f393
jmp 0x1000a411
cmp dword [ebp - 0x874], 0
jne 0x1000a5ea
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x494]
dec eax
mov dword [ebp - 0x854], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x854]
mov dword [ebp + eax - 0x494], ecx
cmp dword [ebp - 0x854], 0
je 0x1000a481
mov eax, dword [ebp - 0x4ac]
neg eax
je 0x1000a481
mov dword [ebp - 0x86c], 1
jmp 0x1000a488
and dword [ebp - 0x86c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xc10]
cmp dword [ebp + eax - 0xe48], ecx
jle 0x1000a4a8
mov dword [ebp - 0x49c], 1
jmp 0x1000a4af
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
sub eax, dword [ebp - 0x378]
je 0x1000a4d2
mov eax, 0xd437
test eax, eax
je 0x1000a4d2
mov dword [ebp - 0x85c], 1
jmp 0x1000a4d9
and dword [ebp - 0x85c], 0
cmp dword [ebp - 0x85c], 0
jne 0x1000a4ee
mov dword [ebp - 0x4a4], 1
jmp 0x1000a4f5
and dword [ebp - 0x4a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108c]
cmp eax, dword [ebp - 0x4a4]
jne 0x1000a516
mov dword [ebp - 0x864], 1
jmp 0x1000a51d
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x864]
sub eax, dword [ebp - 0x4ac]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xe48]
cmp eax, dword [ebp - 0xc18]
jge 0x1000a54b
mov dword [ebp - 0x4b4], 1
jmp 0x1000a552
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x86c]
add eax, dword [ebp - 0x4b4]
cmp dword [ebp - 0x874], eax
je 0x1000a572
mov dword [ebp - 0x4bc], 1
jmp 0x1000a579
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0xc20]
cmp dword [ebp - 0x4bc], eax
jg 0x1000a593
mov dword [ebp - 0x87c], 1
jmp 0x1000a59a
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x378]
sub eax, 0x323f
cmp eax, dword [ebp - 0x884]
je 0x1000a5c5
mov dword [ebp - 0x4c4], 1
jmp 0x1000a5cc
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x884], eax
mov eax, 0x3aa9
test eax, eax
jne 0x1000a5ea
and dword [ebp - 0x4cc], 0
jmp 0x1000a5f4
mov dword [ebp - 0x4cc], 1
mov eax, dword [ebp - 0xc28]
imul eax, dword [ebp - 0x4cc]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe48], eax
mov eax, dword [ebp - 0x88c]
dec eax
mov dword [ebp - 0x88c], eax
mov dword [ebp - 0xc50], 1
mov dword [ebp - 0xed0], 0x4b283066
mov dword [ebp - 0x54], 0x61f9
mov dword [ebp - 0x4f4], 6
mov dword [ebp - 0xc38], 0xa75015e0
cmp dword [ebp - 0x54], 0
je 0x1000a66f
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x1000a66a
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
jmp 0x1000a88f
mov dword [ebp - 0x190], 0x8555145c
mov dword [ebp - 0x38], 0xfffffffd
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xed8], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
jg 0x1000a69d
mov dword [ebp - 0x4d4], 1
jmp 0x1000a6a4
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x4d4]
je 0x1000a6bb
mov dword [ebp - 0x894], 1
jmp 0x1000a6c2
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x894], eax
jge 0x1000a6dc
cmp dword [ebp - 0x38], 0
jne 0x1000a6dc
and dword [ebp - 0x4dc], 0
jmp 0x1000a6e6
mov dword [ebp - 0x4dc], 1
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x4dc], eax
jl 0x1000a706
mov eax, 0xef8a6ebb
test eax, eax
je 0x1000a706
mov dword [ebp - 0x89c], 1
jmp 0x1000a70d
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x89c]
jne 0x1000a724
mov dword [ebp - 0xc30], 1
jmp 0x1000a72b
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xee0], eax
cmp dword [ebp - 0x38], 9
je 0x1000a746
mov dword [ebp - 0x4e4], 1
jmp 0x1000a74d
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x4e4], eax
je 0x1000a764
mov dword [ebp - 0x8a4], 1
jmp 0x1000a76b
and dword [ebp - 0x8a4], 0
cmp dword [ebp - 0x8a4], 0x1f9e
jge 0x1000a783
mov dword [ebp - 0x4ec], 1
jmp 0x1000a78a
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x4ec]
jg 0x1000a7b0
mov dword [ebp - 0x8ac], 1
jmp 0x1000a7b7
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x4f4]
add eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x54]
jg 0x1000a7dd
mov dword [ebp - 0x8b4], 1
jmp 0x1000a7e4
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x8b4]
cmp eax, 0xffff
jb 0x1000a801
mov dword [ebp - 0x4fc], 1
jmp 0x1000a808
and dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x4fc], 0xfffc
je 0x1000a820
mov dword [ebp - 0x8bc], 1
jmp 0x1000a827
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0xc38]
cmp dword [ebp - 0x8bc], eax
jl 0x1000a847
cmp dword [ebp - 0x190], 0
jne 0x1000a847
and dword [ebp - 0xc40], 0
jmp 0x1000a851
mov dword [ebp - 0xc40], 1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xee8], eax
mov eax, dword [ebp - 0x190]
imul eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff6
jg 0x1000a87f
mov eax, 0x9a1d
test eax, eax
je 0x1000a87f
mov dword [ebp - 0x504], 1
jmp 0x1000a886
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x1000a8a7
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov dword [ebp - 0xef0], 0xfffffffd
mov dword [ebp - 0xd24], 0xa5d6c05b
mov dword [ebp - 0xd20], 0xa5d6c05b
mov dword [ebp - 0xd1c], 0xa5d6c05b
mov dword [ebp - 0xd18], 0xa5d6c05b
mov dword [ebp - 0x24], 0x8da8e97e
mov dword [ebp - 0xef8], 0xffffffff
mov dword [ebp - 0x24], 3
jmp 0x1000a8fa
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1000aa9e
mov dword [ebp - 0xc0], 0xc4c8d3c8
mov dword [ebp - 0xc48], 1
mov dword [ebp - 0xc0], 0
jmp 0x1000a931
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jg 0x1000aa99
mov dword [ebp - 0x1dc], 0xfffffffb
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xd24]
mov dword [ebp - 0xf00], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xd24]
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x8c4]
mov dword [ebp + eax*4 - 0xd24], ecx
cmp dword [ebp - 0x8c4], 0
jne 0x1000a993
cmp dword [ebp - 0xc0], 0
jne 0x1000a993
and dword [ebp - 0x8dc], 0
jmp 0x1000a99d
mov dword [ebp - 0x8dc], 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc48], eax
cmp dword [ebp - 0x24], 0xffff
jb 0x1000a9bb
mov dword [ebp - 0x50c], 1
jmp 0x1000a9c2
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x50c], eax
jg 0x1000a9dc
mov dword [ebp - 0x8cc], 1
jmp 0x1000a9e3
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x8cc], eax
jne 0x1000a9fd
mov dword [ebp - 0x514], 1
jmp 0x1000aa04
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x514]
sub eax, dword [ebp - 0x1dc]
je 0x1000aa27
mov eax, 0x4ab653b1
test eax, eax
je 0x1000aa27
mov dword [ebp - 0x8d4], 1
jmp 0x1000aa2e
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x1dc], 0x67120dd9
jg 0x1000aa4c
mov dword [ebp - 0x51c], 1
jmp 0x1000aa53
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
sub eax, 0x59512e2e
cmp dword [ebp - 0x8dc], eax
jl 0x1000aa81
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xd24], 0
je 0x1000aa81
mov dword [ebp - 0x524], 1
jmp 0x1000aa88
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x1dc], eax
jmp 0x1000a924
jmp 0x1000a8f3
mov dword [ebp - 0x24], 0
jmp 0x1000aaae
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x1000aad2
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x1000aad0
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1000aaa7
mov dword [ebp - 0x8e4], 0x789328a
mov dword [ebp - 0x2ac], 0
jmp 0x1000aaf5
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 2
jge 0x1000ab11
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x1108], 0x1d2250db
jmp 0x1000aae8
mov eax, dword [ebp - 0x8e4]
inc eax
mov dword [ebp - 0x8e4], eax
mov dword [ebp - 0xc50], 0xfffffff7
mov dword [ebp - 0x108], 0xfffffffd
mov dword [ebp - 0x1e4], 2
mov dword [ebp - 0x8f4], 0x9ef72d4e
mov dword [ebp - 0x544], 0x99d94b4b
push 1
lea ecx, [ebp - 0xe24]
call fcn.10016f54
mov dword [ebp - 4], 6
mov dword [ebp - 0x3b8], 3
mov dword [ebp - 0x44], 0
jmp 0x1000ab7e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x1000ab94
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xd90], 0xfc3eee2f
jmp 0x1000ab77
mov dword [ebp - 0x44], 0
jmp 0x1000aba4
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1000abc0
push dword [ebp - 0x44]
lea ecx, [ebp - 0xe24]
call fcn.10016fe2
mov dword [eax], 0xc924b541
jmp 0x1000ab9d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd90], 0
jne 0x1000ad6d
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xf08], eax
cmp dword [ebp - 0x108], 0
jne 0x1000abf5
mov dword [ebp - 0x52c], 1
jmp 0x1000abfc
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0xfffffffa
jb 0x1000ac11
mov dword [ebp - 0x8ec], 1
jmp 0x1000ac18
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x8ec], eax
jl 0x1000ac32
mov dword [ebp - 0x534], 1
jmp 0x1000ac39
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x8f4], eax
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
add eax, dword [ebp - 0x1e4]
cmp eax, 7
jl 0x1000ac69
cmp dword [ebp - 0x108], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xd90]
cmp dword [ebp + eax - 0xd90], ecx
jl 0x1000ac8f
mov dword [ebp - 0x328], 1
jmp 0x1000ac96
and dword [ebp - 0x328], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x328]
mov dword [ebp + eax - 0xd90], ecx
mov eax, dword [ebp - 0x544]
cmp dword [ebp - 0x328], eax
jle 0x1000acc2
mov dword [ebp - 0x53c], 1
jmp 0x1000acc9
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
add eax, 5
jne 0x1000acee
xor eax, eax
inc eax
jne 0x1000acee
and dword [ebp - 0xc58], 0
jmp 0x1000acf8
mov dword [ebp - 0xc58], 1
cmp dword [ebp - 0x3b8], 1
jge 0x1000ad0d
mov dword [ebp - 0x8fc], 1
jmp 0x1000ad14
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x8fc], eax
je 0x1000ad2e
mov dword [ebp - 0x904], 1
jmp 0x1000ad35
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x544]
cmp dword [ebp - 0x904], eax
jle 0x1000ad4f
mov dword [ebp - 0x54c], 1
jmp 0x1000ad56
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
sub eax, dword [ebp - 0x108]
jne 0x1000ad6d
and dword [ebp - 0x90c], 0
jmp 0x1000ad77
mov dword [ebp - 0x90c], 1
push 0
lea ecx, [ebp - 0xe24]
call fcn.10016fe2
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x330]
mov eax, dword [eax]
add eax, dword [ebp - 0x90c]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x330]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x330]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe24]
call fcn.10016fdd
mov dword [ebp - 0xf10], 0
mov dword [ebp - 0x380], 8
mov dword [ebp - 0x554], 0
mov dword [ebp - 0xc60], 0xaad8
mov dword [ebp - 0x26c], 0
jmp 0x1000adff
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x1000ae1b
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0xf48], 0xbf9f3617
jmp 0x1000adf2
mov dword [ebp - 0x380], 0xf390197f
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0xf18], eax
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0xc60]
cmp dword [ebp - 0x554], eax
jge 0x1000ae57
mov dword [ebp - 0x914], 1
jmp 0x1000ae5e
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x380]
add eax, 0xffff
imul eax, dword [ebp - 0x914]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf48], eax
mov byte [ebp - 0xe8], 0
movzx eax, byte [ebp - 0xe8]
test eax, eax
je 0x1000ae95
call dword [sym.imp.USER32.dll_WaitMessage]
mov dword [ebp - 0xf28], 0xfffffff9
mov dword [ebp - 0xf30], 0
mov dword [ebp - 0x5c], 0x13a473eb
mov dword [ebp - 0x2c], 0x11738ab6
mov dword [ebp - 0x338], 0x52e2cc7b
mov dword [ebp - 0x64], 0
jmp 0x1000aed1
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1000aee7
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x10b0], 0xd526
jmp 0x1000aeca
mov dword [ebp - 0x64], 0
jmp 0x1000aef7
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1000af0d
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x594], 3
jmp 0x1000aef0
cmp dword [ebp - 0x5c], 7
ja 0x1000af1f
mov dword [ebp - 0x55c], 1
jmp 0x1000af26
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x5c], 2
jmp 0x1000af3f
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x1000b35b
mov dword [ebp - 0x1a0], 0xa3f30045
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x94c], 1
mov dword [ebp - 0x2c], 2
jmp 0x1000af77
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x1000b18c
mov dword [ebp - 0x178], 0xffffffff
mov dword [ebp - 0x178], 0
jmp 0x1000afa4
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jg 0x1000b187
mov dword [ebp - 0x2ec], 1
push 1
lea ecx, [ebp - 0xd9c]
call fcn.10016f54
mov dword [ebp - 4], 7
mov dword [ebp - 0x91c], 1
mov dword [ebp - 0xc68], 0xffffffff
mov dword [ebp - 0x1ec], 0
jmp 0x1000affc
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 1
jge 0x1000b01e
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0xd9c]
call fcn.10016fe2
mov dword [eax], 0xc07c2076
jmp 0x1000afef
mov dword [ebp - 0x2ec], 0
jmp 0x1000b037
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 2
jg 0x1000b173
mov dword [ebp - 0xf38], 0xfffffffe
mov dword [ebp - 0x1f4], 0
jmp 0x1000b067
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 4
jge 0x1000b083
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x10f0], 0x6d6dbc1c
jmp 0x1000b05a
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xf40], eax
push 0
lea ecx, [ebp - 0xd9c]
call fcn.10016fe2
mov eax, dword [eax]
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x91c], 0
jne 0x1000b0bc
cmp dword [ebp - 0x178], 0
jne 0x1000b0bc
and dword [ebp - 0x564], 0
jmp 0x1000b0c6
mov dword [ebp - 0x564], 1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x10f0], 0xfe81720d
cmp dword [ebp - 0x564], 0xfe81720d
je 0x1000b0ef
mov dword [ebp - 0x924], 1
jmp 0x1000b0f6
and dword [ebp - 0x924], 0
push 0
lea ecx, [ebp - 0xd9c]
call fcn.10016fe2
mov eax, dword [eax]
cmp eax, dword [ebp - 0x924]
jge 0x1000b119
mov dword [ebp - 0x56c], 1
jmp 0x1000b120
and dword [ebp - 0x56c], 0
cmp dword [ebp - 0x56c], 7
jae 0x1000b135
mov dword [ebp - 0x92c], 1
jmp 0x1000b13c
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x92c]
sub eax, dword [ebp - 0x1a0]
je 0x1000b15b
xor eax, eax
inc eax
je 0x1000b15b
mov dword [ebp - 0x574], 1
jmp 0x1000b162
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0xc68], eax
jmp 0x1000b02a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd9c]
call fcn.10016fdd
jmp 0x1000af97
jmp 0x1000af70
cmp dword [ebp - 0x180], 0
je 0x1000b343
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x180]
add eax, dword [ebp - 0x338]
je 0x1000b1c5
cmp dword [ebp - 0x1a0], 0
je 0x1000b1c5
mov dword [ebp - 0x934], 1
jmp 0x1000b1cc
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x94c]
add eax, dword [ebp - 0x934]
jne 0x1000b1e9
cmp dword [ebp - 0x2c], 0
jne 0x1000b1e9
and dword [ebp - 0x57c], 0
jmp 0x1000b1f3
mov dword [ebp - 0x57c], 1
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x57c], eax
jle 0x1000b20d
mov dword [ebp - 0x93c], 1
jmp 0x1000b214
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x93c], eax
jne 0x1000b22e
mov dword [ebp - 0x584], 1
jmp 0x1000b235
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x584], eax
jle 0x1000b24c
mov dword [ebp - 0x944], 1
jmp 0x1000b253
and dword [ebp - 0x944], 0
cmp dword [ebp - 0x944], 0xffff
jne 0x1000b26b
mov dword [ebp - 0x58c], 1
jmp 0x1000b272
and dword [ebp - 0x58c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x58c]
mov dword [ebp + eax - 0x594], ecx
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0xf4c], eax
cmp dword [ebp - 0x180], 0xfffffffa
jne 0x1000b2a1
cmp dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xf60], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xf68], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x594], 1
jbe 0x1000b2d2
mov dword [ebp - 0x954], 1
jmp 0x1000b2d9
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x1a0]
imul eax, dword [ebp - 0x954]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x10b0]
jge 0x1000b301
mov dword [ebp - 0x59c], 1
jmp 0x1000b308
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x59c]
jl 0x1000b31f
mov dword [ebp - 0xc70], 1
jmp 0x1000b326
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xf70], eax
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x2c], eax
jne 0x1000b343
mov dword [ebp - 0x95c], 1
jmp 0x1000b34a
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0x180], eax
jmp 0x1000af38
mov dword [ebp - 0xf78], 1
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x28], 0xe446df37
push 4
lea ecx, [ebp - 0xae0]
call fcn.10016f54
mov dword [ebp - 4], 8
mov dword [ebp - 0x198], 0xfffffff6
mov dword [ebp - 0x148], 0x46d7
mov dword [ebp - 0x274], 0
jmp 0x1000b3b7
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 4
jge 0x1000b3d9
push dword [ebp - 0x274]
lea ecx, [ebp - 0xae0]
call fcn.10016fe2
mov dword [eax], 0x2df3
jmp 0x1000b3aa
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x1000b520
cmp dword [ebp - 0x28], 0
je 0x1000b410
push 3
lea ecx, [ebp - 0xae0]
call fcn.10016fe2
cmp dword [eax], 0
je 0x1000b410
mov dword [ebp - 0x5a4], 1
jmp 0x1000b417
and dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x5a4], 0
jae 0x1000b42c
mov dword [ebp - 0x964], 1
jmp 0x1000b433
and dword [ebp - 0x964], 0
cmp dword [ebp - 0x964], 3
jge 0x1000b448
mov dword [ebp - 0x5ac], 1
jmp 0x1000b44f
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x5ac], eax
jge 0x1000b466
mov dword [ebp - 0x96c], 1
jmp 0x1000b46d
and dword [ebp - 0x96c], 0
push 1
lea ecx, [ebp - 0xae0]
call fcn.10016fe2
mov eax, dword [eax]
cmp eax, dword [ebp - 0x96c]
je 0x1000b490
mov dword [ebp - 0x5b4], 1
jmp 0x1000b497
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0x5b4]
jle 0x1000b4b1
mov dword [ebp - 0x974], 1
jmp 0x1000b4b8
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x974], eax
jge 0x1000b4d2
mov dword [ebp - 0x5bc], 1
jmp 0x1000b4d9
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0x5bc]
jge 0x1000b4f3
mov dword [ebp - 0x97c], 1
jmp 0x1000b4fa
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0x28], eax
mov esi, dword [ebp - 0x28]
push 1
lea ecx, [ebp - 0xae0]
call fcn.10016fe2
cmp esi, dword [eax]
je 0x1000b520
and dword [ebp - 0x5c4], 0
jmp 0x1000b52a
mov dword [ebp - 0x5c4], 1
push 1
lea ecx, [ebp - 0xae0]
call fcn.10016fe2
mov ecx, dword [ebp - 0x5c4]
add ecx, dword [eax]
je 0x1000b713
mov dword [ebp - 0x3a8], 0x9ba87a5
mov dword [ebp - 0x984], 0x72737ae9
cmp dword [ebp - 0x28], 0
jne 0x1000b58b
push 1
lea ecx, [ebp - 0xae0]
call fcn.10016fe2
mov eax, dword [eax]
mov dword [ebp - 0x984], eax
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x984], eax
jl 0x1000b58b
and dword [ebp - 0x5cc], 0
jmp 0x1000b595
mov dword [ebp - 0x5cc], 1
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x5cc]
cmp eax, 0x5f40e13f
jle 0x1000b5b2
mov dword [ebp - 0x98c], 1
jmp 0x1000b5b9
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x3a8]
mov ecx, 0xf4ea14c5
sub ecx, dword [ebp - 0x98c]
imul eax, ecx
mov dword [ebp - 0xcb0], eax
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0xcb0], 0
je 0x1000b69d
mov dword [ebp - 0xde8], 0xcc72b752
mov dword [ebp - 0xde4], 0xcc72b752
mov dword [ebp - 0xde0], 0xcc72b752
mov dword [ebp - 0xddc], 0xcc72b752
lea ecx, [ebp - 0x3b9]
call fcn.10009273
push eax
lea eax, [ebp - 0xdd8]
push eax
lea eax, [ebp - 0xde8]
push eax
lea ecx, [ebp - 0x1110]
call fcn.10016ff1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xfa0]
call fcn.10016fb3
mov byte [ebp - 4], 9
push 3
lea ecx, [ebp - 0xfa0]
call fcn.10016fe2
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x5d4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5d4]
mov dword [ecx], eax
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1000b68c
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xfa0]
call fcn.10016fdd
jmp 0x1000b70e
mov dword [ebp - 0x198], 0
jmp 0x1000b6b6
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jg 0x1000b6df
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1000b6dd
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
jmp 0x1000b6a9
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x1000b70e
push 0
push 0x1cbf
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
jmp 0x1000b820
mov dword [ebp - 0x5dc], 4
mov dword [ebp - 0xe70], 0x927db404
mov dword [ebp - 0xe6c], 0x927db404
mov dword [ebp - 0xe68], 0x927db404
mov dword [ebp - 0xe64], 0x927db404
mov dword [ebp - 0xbe8], 6
mov esi, dword [ebp - 0x148]
push 3
lea ecx, [ebp - 0xae0]
call fcn.10016fe2
cmp esi, dword [eax]
jle 0x1000b772
mov dword [ebp - 0x994], 1
jmp 0x1000b779
and dword [ebp - 0x994], 0
cmp dword [ebp - 0x994], 0xb441
je 0x1000b791
mov dword [ebp - 0xcb8], 1
jmp 0x1000b798
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0x5dc]
add eax, 0x4fc6a3f0
cmp eax, dword [ebp - 0x5dc]
jge 0x1000b7b7
mov dword [ebp - 0x340], 1
jmp 0x1000b7be
and dword [ebp - 0x340], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x340]
mov dword [ebp + eax - 0xe70], ecx
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x1000b7ec
mov dword [ebp - 0x99c], 1
jmp 0x1000b7f3
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x99c], eax
jl 0x1000b80d
mov dword [ebp - 0x5e4], 1
jmp 0x1000b814
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0xbe8], eax
mov dword [ebp - 0x148], 0
jmp 0x1000b839
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xc
jg 0x1000b863
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1000b861
push 0
push 0x121d
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x1000b82c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae0]
call fcn.10016fdd
mov dword [ebp - 0xf80], 0x1836ccb0
mov dword [ebp - 0x8c], 0xc03342eb
mov dword [ebp - 0xb8c], 0xc77dcda7
mov dword [ebp - 0xca8], 7
mov dword [ebp - 0x8c], 2
jmp 0x1000b8b3
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffef
jle 0x1000b9fc
mov dword [ebp - 0x2b4], 0xffffffff
mov dword [ebp - 0x5ec], 0
mov dword [ebp - 0x5fc], 0x589b5833
mov eax, 0xeac4
test eax, eax
je 0x1000b9b8
cmp dword [ebp - 0x2b4], 0
je 0x1000b916
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x1010], eax
mov eax, dword [ebp - 0x8c]
neg eax
je 0x1000b916
mov dword [ebp - 0x9bc], 1
jmp 0x1000b91d
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x8c], eax
je 0x1000b937
mov dword [ebp - 0x9a4], 1
jmp 0x1000b93e
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x5ec], eax
jl 0x1000b964
mov dword [ebp - 0x9ac], 1
jmp 0x1000b96b
and dword [ebp - 0x9ac], 0
cmp dword [ebp - 0x9ac], 0
jg 0x1000b980
mov dword [ebp - 0x5f4], 1
jmp 0x1000b987
and dword [ebp - 0x5f4], 0
cmp dword [ebp - 0x5f4], 0xe80d
jle 0x1000b99f
mov dword [ebp - 0x9b4], 1
jmp 0x1000b9a6
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x9b4]
mov dword [ebp - 0x5fc], eax
mov eax, dword [ebp - 0x5fc]
cmp dword [ebp - 0x8c], 0
jne 0x1000b9d3
cmp dword [ebp - 0x8c], 0
jne 0x1000b9d3
and dword [ebp - 0x604], 0
jmp 0x1000b9dd
mov dword [ebp - 0x604], 1
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0xb8c], eax
cmp dword [ebp - 0xca8], 0
je 0x1000b9f7
jmp 0x1000b8a6
jmp 0x1000b8a6
mov dword [ebp - 0xbb4], 1
mov dword [ebp - 0x1018], 0x4b283066
mov dword [ebp - 0x1020], 0xfffffffd
push 3
lea ecx, [ebp - 0x1c4]
call fcn.10016f54
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x110], 0xe9bf9f36
push 1
lea ecx, [ebp - 0xb10]
call fcn.10016f54
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x84], 2
mov dword [ebp - 0x4c], 0
jmp 0x1000ba63
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1000ba7f
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1c4]
call fcn.10016fe2
mov dword [eax], 2
jmp 0x1000ba5c
mov dword [ebp - 0x4c], 0
jmp 0x1000ba8f
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1000baab
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xb10]
call fcn.10016fe2
mov dword [eax], 3
jmp 0x1000ba88
push 1
lea ecx, [ebp - 0x1c4]
call fcn.10016fe2
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp - 0x9c4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9c4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb10]
call fcn.10016fe2
mov dword [eax], 0xf34111d0
push 0xfffffffffffffff8
pop eax
cmp eax, 0xf34111d0
jb 0x1000baf8
mov dword [ebp - 0x60c], 1
jmp 0x1000baff
and dword [ebp - 0x60c], 0
cmp dword [ebp - 0x60c], 5
jae 0x1000bb14
mov dword [ebp - 0x9cc], 1
jmp 0x1000bb1b
and dword [ebp - 0x9cc], 0
push 1
lea ecx, [ebp - 0x1c4]
call fcn.10016fe2
mov ecx, dword [ebp - 0x9cc]
cmp ecx, dword [eax]
jg 0x1000bb3e
mov dword [ebp - 0x614], 1
jmp 0x1000bb45
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xbf889e02
jbe 0x1000bb70
push 2
pop eax
test eax, eax
je 0x1000bb70
mov dword [ebp - 0x9d4], 1
jmp 0x1000bb77
and dword [ebp - 0x9d4], 0
push 1
lea ecx, [ebp - 0x1c4]
call fcn.10016fe2
mov eax, dword [eax]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x9d4]
jl 0x1000bba6
mov dword [ebp - 0x61c], 1
jmp 0x1000bbad
and dword [ebp - 0x61c], 0
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10016fe2
mov ecx, dword [ebp - 0x61c]
cmp ecx, dword [eax]
je 0x1000bbe2
push 0
lea ecx, [ebp - 0xb10]
call fcn.10016fe2
cmp dword [eax], 0
je 0x1000bbe2
mov dword [ebp - 0x9dc], 1
jmp 0x1000bbe9
and dword [ebp - 0x9dc], 0
push 0
lea ecx, [ebp - 0x1c4]
call fcn.10016fe2
mov ecx, dword [ebp - 0x9dc]
cmp ecx, dword [eax]
jg 0x1000bc0d
push 1
lea ecx, [ebp - 0x1c4]
call fcn.10016fe2
push 1
lea ecx, [ebp - 0x1c4]
call fcn.10016fe2
imul esi, dword [eax], 0xfffffff8
push 1
lea ecx, [ebp - 0x1c4]
call fcn.10016fe2
cmp esi, dword [eax]
jge 0x1000bc35
cmp dword [ebp - 0x84], 0
mov eax, 0xf9d66de6
test eax, eax
je 0x1000be66