Function at 0x10008f94
Capabilities:
Check os version
Delete file
Modify service
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100908c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x12d0
call fcn.1008caa0
push esi
push edi
mov dword [ebp - 0x1064], 0xfffffff7
mov dword [ebp - 0x1060], 0xfffffff7
mov dword [ebp - 0x105c], 0xfffffff7
mov dword [ebp - 0x1058], 0xfffffff7
lea ecx, [ebp - 0x42d]
call fcn.10008de3
push eax
lea eax, [ebp - 0x1054]
push eax
lea eax, [ebp - 0x1064]
push eax
lea ecx, [ebp - 0x12b4]
call fcn.10019c42
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10ac]
call fcn.10019c04
and dword [ebp - 4], 0
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x7c], 0
jmp 0x10009030
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jg 0x1000917c
mov dword [ebp - 0x204], 0xfffffff9
mov byte [ebp - 0x123], 0
movzx eax, byte [ebp - 0x123]
test eax, eax
je 0x10009063
push 0xf07
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x204]
imul eax, dword [ebp - 0x7c]
test eax, eax
jne 0x10009083
mov eax, 0xfffe
test eax, eax
jne 0x10009083
and dword [ebp - 0x834], 0
jmp 0x1000908d
mov dword [ebp - 0x834], 1
mov eax, dword [ebp - 0x204]
cmp eax, dword [ebp - 0x834]
jl 0x100090a7
mov dword [ebp - 0xb28], 1
jmp 0x100090ae
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0x204]
imul eax, dword [ebp - 0xb28]
cmp eax, dword [ebp - 0x204]
jl 0x100090cf
mov dword [ebp - 0xb30], 1
jmp 0x100090d6
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0xb30], eax
jge 0x100090ed
mov dword [ebp - 0xb38], 1
jmp 0x100090f4
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0x204]
add eax, dword [ebp - 0xb38]
cmp eax, dword [ebp - 0x7c]
jne 0x10009111
mov dword [ebp - 0xb48], 1
jmp 0x10009118
and dword [ebp - 0xb48], 0
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x10ac]
call fcn.10019c33
mov dword [ebp - 0xb40], eax
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x10ac]
call fcn.10019c33
mov ecx, dword [ebp - 0xb40]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xb40]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xb48]
jge 0x10009160
mov dword [ebp - 0xb50], 1
jmp 0x10009167
and dword [ebp - 0xb50], 0
imul eax, dword [ebp - 0xb50], 0x3293
mov dword [ebp - 0x204], eax
jmp 0x10009029
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10ac]
call fcn.10019c2e
mov dword [ebp - 0xf0], 1
mov dword [ebp - 0xdb0], 7
mov dword [ebp - 0xdb8], 0x21e0bec0
mov dword [ebp - 0xf0], 0x1d
jmp 0x100091c2
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x13
je 0x100092f5
mov dword [ebp - 0x440], 0xfffffffa
mov dword [ebp - 0xb68], 1
mov dword [ebp - 0x314], 0
jmp 0x100091fc
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 1
jge 0x10009218
mov eax, dword [ebp - 0x314]
mov dword [ebp + eax*4 - 0xd18], 0xfffffff6
jmp 0x100091ef
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x100092d7
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x440]
cmp dword [ebp - 0xf0], eax
jne 0x10009249
mov dword [ebp - 0xb58], 1
jmp 0x10009250
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0xb58]
jg 0x1000926a
mov dword [ebp - 0xb60], 1
jmp 0x10009271
and dword [ebp - 0xb60], 0
mov eax, dword [ebp - 0xb60]
mov dword [ebp - 0xb68], eax
mov eax, dword [ebp - 0xf0]
sub eax, dword [ebp - 0xb68]
cmp eax, 0xb0e1b1b5
jbe 0x1000929c
mov dword [ebp - 0x438], 1
jmp 0x100092a3
and dword [ebp - 0x438], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x438]
mov dword [ebp + eax - 0xd18], ecx
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0xdb0], eax
cmp dword [ebp - 0xf0], 0
je 0x100092d7
mov dword [ebp - 0x8d8], 1
jmp 0x100092de
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x8d8]
sub eax, dword [ebp - 0x440]
mov dword [ebp - 0xdb8], eax
jmp 0x100091b5
mov dword [ebp - 0x14c], 0xe216
mov dword [ebp - 0xdd0], 0
cmp dword [ebp - 0x14c], 0x7c20
je 0x10009382
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x14c], eax
jne 0x1000932f
mov dword [ebp - 0x480], 1
jmp 0x10009336
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x14c]
sub eax, 0x9796
cmp dword [ebp - 0x480], eax
jle 0x10009355
mov dword [ebp - 0xdc0], 1
jmp 0x1000935c
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x1238], eax
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x14c], eax
jl 0x10009382
mov dword [ebp - 0x8e0], 1
jmp 0x10009389
and dword [ebp - 0x8e0], 0
cmp dword [ebp - 0x8e0], 0x461e3ff1
jg 0x100093c9
mov dword [ebp - 0xdc8], 0xffffffff
cmp dword [ebp - 0xdc8], 0xfffffff7
jbe 0x100093b4
mov dword [ebp - 0x488], 1
jmp 0x100093bb
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0xdd0], eax
jmp 0x100093f9
mov byte [ebp - 0x12a], 0
movzx eax, byte [ebp - 0x12a]
test eax, eax
je 0x100093f9
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x358], 0xffffffff
mov dword [ebp - 0x1164], 0xffffffff
mov dword [ebp - 0x30c], 0
jmp 0x10009426
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 4
jge 0x10009442
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0x12cc], 0x2403
jmp 0x10009419
mov byte [ebp - 0x12c], 0
movzx eax, byte [ebp - 0x12c]
test eax, eax
je 0x1000945c
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x358], 0
jmp 0x10009475
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 3
jg 0x1000949d
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x1000949b
push 0x251a
call dword [sym.imp.KERNEL32.dll_TlsFree]
jmp 0x10009468
push 3
lea ecx, [ebp - 0xbd0]
call fcn.10019ba5
mov dword [ebp - 4], 1
mov dword [ebp - 0x458], 1
push 1
lea ecx, [ebp - 0xc3c]
call fcn.10019ba5
mov byte [ebp - 4], 2
mov dword [ebp - 0x260], 0xb4dfecbe
mov dword [ebp - 0xde8], 0x5e3a
mov dword [ebp - 0x908], 0xa832397b
push 4
lea ecx, [ebp - 0x10c4]
call fcn.10019ba5
mov byte [ebp - 4], 3
mov dword [ebp - 0x2c], 0
jmp 0x1000950b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10009527
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xbd0]
call fcn.10019c33
mov dword [eax], 0xfffffffa
jmp 0x10009504
mov dword [ebp - 0x2c], 0
jmp 0x10009537
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10009550
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc3c]
call fcn.10019c33
and dword [eax], 0
jmp 0x10009530
mov dword [ebp - 0x2c], 0
jmp 0x10009560
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1000957c
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x10c4]
call fcn.10019c33
mov dword [eax], 0xe734f12c
jmp 0x10009559
push 2
lea ecx, [ebp - 0xbd0]
call fcn.10019c33
cmp dword [eax], 0
je 0x100095aa
mov dword [ebp - 0x8e8], 0xf251d69f
mov eax, dword [ebp - 0x8e8]
inc eax
mov dword [ebp - 0x8e8], eax
jmp 0x100096fb
mov dword [ebp - 0x220], 3
mov dword [ebp - 0x448], 1
mov dword [ebp - 0xdd8], 0x99740826
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x11f8], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x116c], eax
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x220], eax
jl 0x100095fa
mov dword [ebp - 0x490], 1
jmp 0x10009601
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0xffffffff
jge 0x10009622
mov dword [ebp - 0x8f0], 1
jmp 0x10009629
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x458]
cmp dword [ebp - 0x8f0], eax
jne 0x10009643
mov dword [ebp - 0x498], 1
jmp 0x1000964a
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x498], eax
jle 0x10009664
mov dword [ebp - 0x8f8], 1
jmp 0x1000966b
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x458]
cmp eax, dword [ebp - 0x8f8]
jg 0x10009689
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x10009689
and dword [ebp - 0x4a0], 0
jmp 0x10009693
mov dword [ebp - 0x4a0], 1
push 2
lea ecx, [ebp - 0xbd0]
call fcn.10019c33
mov ecx, dword [ebp - 0x4a0]
cmp ecx, dword [eax]
jg 0x100096c5
push 0
lea ecx, [ebp - 0xc3c]
call fcn.10019c33
cmp dword [eax], 0
jne 0x100096c5
and dword [ebp - 0x900], 0
jmp 0x100096cf
mov dword [ebp - 0x900], 1
mov eax, dword [ebp - 0x260]
add eax, dword [ebp - 0x900]
neg eax
jne 0x100096e6
cmp dword [ebp - 0x448], 0
push 0
lea ecx, [ebp - 0xc3c]
call fcn.10019c33
mov eax, dword [eax]
mov dword [ebp - 0xdd8], eax
cmp dword [ebp - 0x260], 0
jne 0x10009756
push 0
lea ecx, [ebp - 0xbd0]
call fcn.10019c33
cmp dword [eax], 0xffffffff
jle 0x10009722
mov dword [ebp - 0xde0], 1
jmp 0x10009729
and dword [ebp - 0xde0], 0
push 2
lea ecx, [ebp - 0xbd0]
call fcn.10019c33
imul eax, dword [ebp - 0xde8], 0xc1c7
test eax, eax
jne 0x10009756
cmp dword [ebp - 0x260], 0
jne 0x10009756
and dword [ebp - 0xdf0], 0
jmp 0x10009760
mov dword [ebp - 0xdf0], 1
push 2
lea ecx, [ebp - 0xbd0]
call fcn.10019c33
push 0
lea ecx, [ebp - 0xc3c]
call fcn.10019c33
cmp dword [eax], 0
jle 0x1000978b
mov dword [ebp - 0x4a8], 1
jmp 0x10009792
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0
jg 0x100097a7
mov dword [ebp - 0x450], 1
jmp 0x100097ae
and dword [ebp - 0x450], 0
push 0
lea ecx, [ebp - 0xc3c]
call fcn.10019c33
mov ecx, dword [ebp - 0x450]
mov dword [eax], ecx
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x908], eax
cmp dword [ebp - 0x908], 0x6be8
jg 0x100097e7
mov dword [ebp - 0x4b0], 1
jmp 0x100097ee
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0x6511f0b9
jne 0x10009815
push 0
lea ecx, [ebp - 0xc3c]
call fcn.10019c33
cmp dword [eax], 0
jne 0x10009815
and dword [ebp - 0x910], 0
jmp 0x1000981f
mov dword [ebp - 0x910], 1
cmp dword [ebp - 0x910], 0xffff
jne 0x1000983b
xor eax, eax
je 0x1000983b
mov dword [ebp - 0x4b8], 1
jmp 0x10009842
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x4b8], eax
jne 0x1000985c
mov dword [ebp - 0xdf8], 1
jmp 0x10009863
and dword [ebp - 0xdf8], 0
push 0
lea ecx, [ebp - 0xbd0]
call fcn.10019c33
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x1290], eax
push 1
lea ecx, [ebp - 0x10c4]
call fcn.10019c33
or dword [eax], 0xffffffff
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10c4]
call fcn.10019c2e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc3c]
call fcn.10019c2e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbd0]
call fcn.10019c2e
mov dword [ebp - 0x2f0], 0
jmp 0x100098d2
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 1
jge 0x100098ee
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x268], 0xfffffffb
jmp 0x100098c5
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x268], 0xfffffff1
jmp 0x1000991c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x268], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x268], 0xffffffea
jle 0x10009946
mov byte [ebp - 0x130], 0
movzx eax, byte [ebp - 0x130]
test eax, eax
je 0x10009944
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
jmp 0x10009901
mov dword [ebp - 0x114], 0xc45cdbe8
mov dword [ebp - 0x75c], 0x76a17913
mov dword [ebp - 0x44], 0xd313dd33
mov dword [ebp - 0x44], 0x16
jmp 0x10009971
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x1c
jg 0x10009c35
mov dword [ebp - 0xe10], 0xfffffffd
mov dword [ebp - 0x338], 0
jmp 0x1000999e
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 1
jge 0x100099ba
mov eax, dword [ebp - 0x338]
mov dword [ebp + eax*4 - 0x8c], 0xfe01bd97
jmp 0x10009991
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8c], 0xf
jmp 0x100099e8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8c], 0xfffffff8
jge 0x10009c30
mov dword [ebp - 0x1e0], 0xbc227363
mov dword [ebp - 0x918], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0xe18], 0x69029efe
mov eax, dword [ebp - 0x1e0]
add eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x918], eax
jne 0x10009a47
cmp dword [ebp - 0x44], 0
jne 0x10009a47
and dword [ebp - 0x4c0], 0
jmp 0x10009a51
mov dword [ebp - 0x4c0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
cmp dword [ebp - 0x4c0], eax
jle 0x10009a72
mov dword [ebp - 0x920], 1
jmp 0x10009a79
and dword [ebp - 0x920], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
cmp dword [ebp - 0x920], eax
jg 0x10009a9a
mov dword [ebp - 0x4c8], 1
jmp 0x10009aa1
and dword [ebp - 0x4c8], 0
cmp dword [ebp - 0x4c8], 1
ja 0x10009ab6
mov dword [ebp - 0x928], 1
jmp 0x10009abd
and dword [ebp - 0x928], 0
cmp dword [ebp - 0x928], 0x5417612d
jne 0x10009ad5
mov dword [ebp - 0x4d0], 1
jmp 0x10009adc
and dword [ebp - 0x4d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
cmp dword [ebp - 0x4d0], eax
jge 0x10009b00
cmp dword [ebp - 0x44], 0
jne 0x10009b00
and dword [ebp - 0x930], 0
jmp 0x10009b0a
mov dword [ebp - 0x930], 1
mov eax, dword [ebp - 0x1e0]
add eax, dword [ebp - 0x930]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x444], eax
je 0x10009b36
mov dword [ebp - 0xe00], 1
jmp 0x10009b3d
and dword [ebp - 0xe00], 0
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x1174], eax
cmp dword [ebp - 0x444], 0
jne 0x10009b6b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8c], 0
jne 0x10009b6b
and dword [ebp - 0x4d8], 0
jmp 0x10009b75
mov dword [ebp - 0x4d8], 1
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x4d8], eax
jle 0x10009b8f
mov dword [ebp - 0x938], 1
jmp 0x10009b96
and dword [ebp - 0x938], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
imul eax, dword [ebp - 0x938]
cmp eax, dword [ebp - 0x44]
jge 0x10009bbb
mov dword [ebp - 0x4e0], 1
jmp 0x10009bc2
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
neg eax
cmp dword [ebp - 0x44], eax
jge 0x10009bdb
mov dword [ebp - 0x940], 1
jmp 0x10009be2
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x940]
cmp eax, 0x92f644a
jge 0x10009bff
mov dword [ebp - 0xe08], 1
jmp 0x10009c06
and dword [ebp - 0xe08], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1200], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x117c], eax
mov dword [ebp - 0xe10], 0xf82966b9
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xe18], eax
jmp 0x100099cd
jmp 0x1000996a
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x9c0], 0xfffffff8
mov dword [ebp - 0xe50], 0x65a3ff56
cmp dword [ebp - 0x14], 0
jne 0x10009d0d
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
je 0x10009c6e
mov dword [ebp - 0x4e8], 1
jmp 0x10009c75
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jg 0x10009c8c
mov dword [ebp - 0xe20], 1
jmp 0x10009c93
and dword [ebp - 0xe20], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1240], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x10009cb0
mov dword [ebp - 0x948], 1
jmp 0x10009cb7
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x948]
je 0x10009cce
mov dword [ebp - 0x4f0], 1
jmp 0x10009cd5
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4f0], eax
jl 0x10009cec
mov dword [ebp - 0x950], 1
jmp 0x10009cf3
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x950]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jne 0x10009d0d
and dword [ebp - 0x4f8], 0
jmp 0x10009d17
mov dword [ebp - 0x4f8], 1
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x4f8]
cmp eax, 1
jae 0x10009d32
mov dword [ebp - 0x958], 1
jmp 0x10009d39
and dword [ebp - 0x958], 0
cmp dword [ebp - 0x958], 0x24039b64
jg 0x1000a126
mov dword [ebp - 0xe28], 0xffffffff
mov dword [ebp - 0x14], 0
jmp 0x10009d63
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x12
jg 0x1000a121
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x548], 0xb6af4a9b
mov byte [ebp - 0x132], 0
movzx eax, byte [ebp - 0x132]
test eax, eax
je 0x10009db5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x867
push 0x1faf
push 0x1ba3
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x70], 5
jmp 0x10009dc5
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x14
jg 0x1000a11c
mov dword [ebp - 0x520], 0xf5ea
mov dword [ebp - 0xe40], 9
mov dword [ebp - 0x270], 0
jmp 0x10009dfc
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 3
jge 0x10009e18
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0xbe8], 1
jmp 0x10009def
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xbe8], 5
jmp 0x10009e46
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbe8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbe8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbe8], 0x12
je 0x1000a117
mov dword [ebp - 0x970], 0xfffffff6
xor eax, eax
inc eax
je 0x10009f89
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1184], eax
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x14]
je 0x10009e99
mov eax, 0x381e
test eax, eax
je 0x10009e99
cmp dword [ebp - 0x14], 0
je 0x10009e99
mov dword [ebp - 0x500], 1
jmp 0x10009ea0
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x500]
sub eax, dword [ebp - 0xe28]
cmp eax, 0xcceb
jl 0x10009ec3
mov dword [ebp - 0x960], 1
jmp 0x10009eca
and dword [ebp - 0x960], 0
cmp dword [ebp - 0x960], 0xad05
jl 0x10009ee2
mov dword [ebp - 0x508], 1
jmp 0x10009ee9
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
sub eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x70]
jl 0x10009f03
mov dword [ebp - 0x968], 1
jmp 0x10009f0a
and dword [ebp - 0x968], 0
cmp dword [ebp - 0x968], 0
jne 0x10009f1f
mov dword [ebp - 0x510], 1
jmp 0x10009f26
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x970]
cmp dword [ebp - 0x510], eax
jg 0x10009f40
mov dword [ebp - 0x518], 1
jmp 0x10009f47
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x970]
cmp dword [ebp - 0x518], eax
jne 0x10009f61
mov dword [ebp - 0x978], 1
jmp 0x10009f68
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 0
je 0x10009f89
mov dword [ebp - 0x980], 1
jmp 0x10009f90
and dword [ebp - 0x980], 0
cmp dword [ebp - 0x980], 0x9d4
jg 0x10009fa8
mov dword [ebp - 0x528], 1
jmp 0x10009faf
and dword [ebp - 0x528], 0
cmp dword [ebp - 0x528], 0xf98e47be
ja 0x10009fc7
mov dword [ebp - 0x988], 1
jmp 0x10009fce
and dword [ebp - 0x988], 0
cmp dword [ebp - 0x988], 1
je 0x10009fe3
mov dword [ebp - 0x530], 1
jmp 0x10009fea
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x530]
jne 0x1000a001
mov dword [ebp - 0x990], 1
jmp 0x1000a008
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x990], eax
jge 0x1000a01f
mov dword [ebp - 0x538], 1
jmp 0x1000a026
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x538]
jl 0x1000a03d
mov dword [ebp - 0xe30], 1
jmp 0x1000a044
and dword [ebp - 0xe30], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbe8]
mov dword [ebp - 0x1208], eax
cmp dword [ebp - 0x70], 0
jne 0x1000a06f
mov eax, 0xb60d
test eax, eax
jne 0x1000a06f
and dword [ebp - 0x998], 0
jmp 0x1000a079
mov dword [ebp - 0x998], 1
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x998], eax
jl 0x1000a090
mov dword [ebp - 0xe38], 1
jmp 0x1000a097
and dword [ebp - 0xe38], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbe8]
mov dword [ebp - 0x118c], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xbe8]
cmp dword [ebp + eax - 0xbe8], ecx
jle 0x1000a0d1
mov dword [ebp - 0x540], 1
jmp 0x1000a0d8
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
neg eax
cmp eax, 0xe235
jge 0x1000a0f3
mov dword [ebp - 0x9a0], 1
jmp 0x1000a0fa
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0xe40], eax
jmp 0x10009e2b
jmp 0x10009dbe
jmp 0x10009d5c
jmp 0x1000a298
mov dword [ebp - 0x278], 0xfbb8
mov dword [ebp - 0x9b8], 0xf327
mov dword [ebp - 0x2f8], 0
jmp 0x1000a153
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 1
jge 0x1000a16f
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0x568], 0x69a
jmp 0x1000a146
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1270], eax
cmp dword [ebp - 0x14], 1
jne 0x1000a18f
or eax, 0xffffffff
je 0x1000a18f
mov dword [ebp - 0x9a8], 1
jmp 0x1000a196
and dword [ebp - 0x9a8], 0
cmp dword [ebp - 0x9a8], 0xfffe
ja 0x1000a1ae
mov dword [ebp - 0x550], 1
jmp 0x1000a1b5
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x278]
cmp eax, dword [ebp - 0x550]
jl 0x1000a1cf
mov dword [ebp - 0x9b0], 1
jmp 0x1000a1d6
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x9b0], eax
jne 0x1000a1f0
mov dword [ebp - 0x558], 1
jmp 0x1000a1f7
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x558]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x9b8]
jl 0x1000a214
mov dword [ebp - 0xe48], 1
jmp 0x1000a21b
and dword [ebp - 0xe48], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x11a0], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1210], eax
mov eax, dword [ebp - 0x278]
add eax, 5
jne 0x1000a241
cmp dword [ebp - 0x278], 0
je 0x1000a256
cmp dword [ebp - 0x9b8], 0
je 0x1000a256
mov dword [ebp - 0x560], 1
jmp 0x1000a25d
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x560]
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0x9c0]
sub eax, 0x7a5fbb
mov dword [ebp - 0xe50], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x568]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x568], eax
mov byte [ebp - 0x134], 0
movzx eax, byte [ebp - 0x134]
test eax, eax
je 0x1000a2b2
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 0xd7c], 0xd157
mov dword [ebp - 0x378], 0xc13fe66
mov dword [ebp - 0x9d8], 0x46b8d963
mov dword [ebp - 0x208], 0xa12afd77
push 3
lea ecx, [ebp - 0x1000]
call fcn.10019ba5
mov dword [ebp - 4], 4
mov dword [ebp - 0xe58], 5
mov dword [ebp - 0x5a8], 0xfffffffb
mov dword [ebp - 0x10e0], 0x8aff65ce
mov dword [ebp - 0x10dc], 0x8aff65ce
mov dword [ebp - 0x10d8], 0x8aff65ce
mov dword [ebp - 0x10d4], 0x8aff65ce
mov dword [ebp - 0x80], 0
jmp 0x1000a33a
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1000a34d
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x28], 0xfffffffc
jmp 0x1000a333
mov dword [ebp - 0x80], 0
jmp 0x1000a35d
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1000a379
push dword [ebp - 0x80]
lea ecx, [ebp - 0x1000]
call fcn.10019c33
mov dword [eax], 0x76cc72b7
jmp 0x1000a356
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0x11a8], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1248], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0x11b0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0
je 0x1000a3c5
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1000a3c5
mov dword [ebp - 0x9c8], 1
jmp 0x1000a3cc
and dword [ebp - 0x9c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x9c8], eax
jl 0x1000a3ea
mov dword [ebp - 0x570], 1
jmp 0x1000a3f1
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x208], eax
imul eax, dword [ebp - 0x208], 0xae9f
push 4
pop ecx
imul ecx, ecx, 0
cmp dword [ebp + ecx - 0x28], eax
jge 0x1000a41f
mov dword [ebp - 0x9d0], 1
jmp 0x1000a426
and dword [ebp - 0x9d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
imul eax, dword [ebp - 0x9d0]
test eax, eax
jne 0x1000a451
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0
jne 0x1000a451
and dword [ebp - 0x578], 0
jmp 0x1000a45b
mov dword [ebp - 0x578], 1
cmp dword [ebp - 0x578], 0xffff
jae 0x1000a473
mov dword [ebp - 0x3bc], 1
jmp 0x1000a47a
and dword [ebp - 0x3bc], 0
push 2
lea ecx, [ebp - 0x1000]
call fcn.10019c33
mov ecx, dword [ebp - 0x3bc]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x3bc], eax
jge 0x1000a4ad
mov dword [ebp - 0x580], 1
jmp 0x1000a4b4
and dword [ebp - 0x580], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x9d8], eax
mov eax, dword [ebp - 0x9d8]
cmp eax, dword [ebp - 0x580]
je 0x1000a4ea
mov dword [ebp - 0x9e0], 1
jmp 0x1000a4f1
and dword [ebp - 0x9e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x9e0], eax
jle 0x1000a50f
mov dword [ebp - 0x588], 1
jmp 0x1000a516
and dword [ebp - 0x588], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x588], eax
jle 0x1000a534
mov dword [ebp - 0x9e8], 1
jmp 0x1000a53b
and dword [ebp - 0x9e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x9e8], eax
jl 0x1000a559
mov dword [ebp - 0x590], 1
jmp 0x1000a560
and dword [ebp - 0x590], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
imul eax, dword [ebp - 0x590]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x28]
jg 0x1000a589
mov dword [ebp - 0x9f0], 1
jmp 0x1000a590
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0xe58]
cmp dword [ebp - 0x9f0], eax
jg 0x1000a5aa
mov dword [ebp - 0x598], 1
jmp 0x1000a5b1
and dword [ebp - 0x598], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x598], eax
je 0x1000a5cf
mov dword [ebp - 0x9f8], 1
jmp 0x1000a5d6
and dword [ebp - 0x9f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x9f8], eax
jge 0x1000a5fa
cmp dword [ebp - 0x208], 0
jne 0x1000a5fa
and dword [ebp - 0x5a0], 0
jmp 0x1000a604
mov dword [ebp - 0x5a0], 1
cmp dword [ebp - 0x5a0], 0x7b364fef
je 0x1000a61c
mov dword [ebp - 0xa00], 1
jmp 0x1000a623
and dword [ebp - 0xa00], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
imul eax, dword [ebp - 0xa00]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x28]
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xf4fc
jle 0x1000a675
mov dword [ebp - 0x40c], 1
jmp 0x1000a67c
and dword [ebp - 0x40c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x40c]
mov dword [ebp + eax - 0x10e0], ecx
push 2
lea ecx, [ebp - 0x1000]
call fcn.10019c33
mov ecx, dword [ebp - 0x40c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1000]
call fcn.10019c2e
push 4
lea ecx, [ebp - 0xbf8]
call fcn.10019ba5
mov dword [ebp - 4], 5
mov dword [ebp - 0xe0], 8
mov dword [ebp - 0x154], 0xcc80fc3a
mov dword [ebp - 0xa28], 1
mov dword [ebp - 0x280], 0
jmp 0x1000a6fd
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 4
jge 0x1000a71f
push dword [ebp - 0x280]
lea ecx, [ebp - 0xbf8]
call fcn.10019c33
mov dword [eax], 0xfffffff8
jmp 0x1000a6f0
mov dword [ebp - 0xe0], 0
jmp 0x1000a738
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jg 0x1000a858
push 3
lea ecx, [ebp - 0xee0]
call fcn.10019ba5
mov byte [ebp - 4], 6
mov dword [ebp - 0x300], 0
jmp 0x1000a76f
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 3
jge 0x1000a791
push dword [ebp - 0x300]
lea ecx, [ebp - 0xee0]
call fcn.10019c33
mov dword [eax], 3
jmp 0x1000a762
push dword [ebp - 0xe0]
lea ecx, [ebp - 0xbf8]
call fcn.10019c33
mov esi, 0xc000
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0xee0]
call fcn.10019c33
cmp esi, dword [eax]
jg 0x1000a7c6
mov dword [ebp - 0xa08], 1
jmp 0x1000a7cd
and dword [ebp - 0xa08], 0
push 1
lea ecx, [ebp - 0xee0]
call fcn.10019c33
cmp dword [eax], 0
je 0x1000a7eb
mov dword [ebp - 0x5b0], 1
jmp 0x1000a7f2
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0xa08]
cmp eax, dword [ebp - 0x5b0]
jl 0x1000a80c
mov dword [ebp - 0xe60], 1
jmp 0x1000a813
and dword [ebp - 0xe60], 0
push 1
lea ecx, [ebp - 0xee0]
call fcn.10019c33
cmp dword [eax], 0
jne 0x1000a831
mov dword [ebp - 0xa10], 1
jmp 0x1000a838
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0xa10]
mov dword [ebp - 0x154], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xee0]
call fcn.10019c2e
jmp 0x1000a72b
mov dword [ebp - 0xe0], 0
jmp 0x1000a871
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jg 0x1000abf1
mov dword [ebp - 0x340], 0x9c821f9
mov byte [ebp - 0x136], 0
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x1000a8ae
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
mov dword [ebp - 0x154], 0
jmp 0x1000a8c7
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jg 0x1000abec
mov dword [ebp - 0x15c], 0xffffffff
push 1
lea ecx, [ebp - 0x10b8]
call fcn.10019ba5
mov byte [ebp - 4], 7
mov dword [ebp - 0x288], 0
jmp 0x1000a908
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 1
jge 0x1000a92a
push dword [ebp - 0x288]
lea ecx, [ebp - 0x10b8]
call fcn.10019c33
mov dword [eax], 0xbe2ff5ff
jmp 0x1000a8fb
mov dword [ebp - 0x15c], 3
jmp 0x1000a943
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jl 0x1000abd8
mov dword [ebp - 0xfc], 0xc3d6c1df
mov dword [ebp - 0x240], 1
mov dword [ebp - 0xfc], 0
jmp 0x1000a97d
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jg 0x1000ab6a
mov dword [ebp - 0x434], 1
push dword [ebp - 0x154]
lea ecx, [ebp - 0xbf8]
call fcn.10019c33
push dword [ebp - 0x15c]
lea ecx, [ebp - 0xbf8]
call fcn.10019c33
mov eax, dword [eax]
add eax, 0x6bb6
neg eax
cmp eax, 0x652f093d
jle 0x1000a9d2
mov dword [ebp - 0x3c4], 1
jmp 0x1000a9d9
and dword [ebp - 0x3c4], 0
push 0
lea ecx, [ebp - 0x10b8]
call fcn.10019c33
mov ecx, dword [ebp - 0x3c4]
mov dword [eax], ecx
cmp dword [ebp - 0x3c4], 1
jg 0x1000aa03
mov dword [ebp - 0x5b8], 1
jmp 0x1000aa0a
and dword [ebp - 0x5b8], 0
push dword [ebp - 0x15c]
lea ecx, [ebp - 0xbf8]
call fcn.10019c33
imul ecx, dword [ebp - 0x5b8], 0x98c2
cmp dword [eax], ecx
jl 0x1000aa35
mov dword [ebp - 0xa18], 1
jmp 0x1000aa3c
and dword [ebp - 0xa18], 0
cmp dword [ebp - 0xa18], 4
jne 0x1000aa51
mov dword [ebp - 0x5c0], 1
jmp 0x1000aa58
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0x5c0]
jne 0x1000aa72
mov dword [ebp - 0xa20], 1
jmp 0x1000aa79
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0xa20], eax
jg 0x1000aa93
mov dword [ebp - 0x5c8], 1
jmp 0x1000aa9a
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
sub eax, dword [ebp - 0x340]
add eax, dword [ebp - 0x340]
mov dword [ebp - 0xa28], eax
mov eax, dword [ebp - 0x434]
cmp dword [ebp - 0xa28], eax
jl 0x1000aacc
mov dword [ebp - 0x5d0], 1
jmp 0x1000aad3
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x434]
cmp dword [ebp - 0x5d0], eax
je 0x1000aaed
mov dword [ebp - 0xe68], 1
jmp 0x1000aaf4
and dword [ebp - 0xe68], 0
push dword [ebp - 0x15c]
lea ecx, [ebp - 0xbf8]
call fcn.10019c33
cmp dword [ebp - 0x340], 0x5d01
jne 0x1000ab1d
mov dword [ebp - 0xa30], 1
jmp 0x1000ab24
and dword [ebp - 0xa30], 0
push 2
lea ecx, [ebp - 0xbf8]
call fcn.10019c33
mov ecx, dword [ebp - 0xa30]
cmp ecx, dword [eax]
je 0x1000ab47
mov dword [ebp - 0x5d8], 1
jmp 0x1000ab4e
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x434], 0
je 0x1000ab65
jmp 0x1000ab6a
jmp 0x1000a970
mov dword [ebp - 0xfc], 0
jmp 0x1000ab83
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jg 0x1000abd3
mov dword [ebp - 0x240], 0
jmp 0x1000aba5
mov eax, dword [ebp - 0x240]
dec eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jl 0x1000abd1
mov byte [ebp - 0x138], 0
movzx eax, byte [ebp - 0x138]
test eax, eax
je 0x1000abcf
push 0
push 0
push 0xb0d
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
jmp 0x1000ab98
jmp 0x1000ab76
jmp 0x1000a936
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10b8]
call fcn.10019c2e
jmp 0x1000a8ba
jmp 0x1000a864
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbf8]
call fcn.10019c2e
mov dword [ebp - 0x164], 0xfffffffb
mov dword [ebp - 0x360], 0x1151c3c3
mov dword [ebp - 0x610], 0xfffffffd
mov dword [ebp - 0x290], 0
jmp 0x1000ac37
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 3
jge 0x1000ac53
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0xc6c], 0xfffffffd
jmp 0x1000ac2a
mov byte [ebp - 0x13a], 0
movzx eax, byte [ebp - 0x13a]
test eax, eax
je 0x1000ac8d
push 0x158d
push 0x1216
push 0x176c
push 0x1582
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
mov dword [ebp - 0x164], 2
jmp 0x1000aca6
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jl 0x1000b05f
mov dword [ebp - 0x298], 0x1e3ff14e
mov dword [ebp - 0xe78], 0xdf11
mov dword [ebp - 0xa50], 0xffffffff
mov dword [ebp - 0xe70], 0x9ebef9f3
push 2
lea ecx, [ebp - 0xf00]
call fcn.10019ba5
mov dword [ebp - 4], 8
mov dword [ebp - 0x308], 0
jmp 0x1000ad08
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 2
jge 0x1000ad2a
push dword [ebp - 0x308]
lea ecx, [ebp - 0xf00]
call fcn.10019c33
mov dword [eax], 0xc53a
jmp 0x1000acfb
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc6c]
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jne 0x1000af17
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc6c], 1
jge 0x1000ad6f
cmp dword [ebp - 0xa50], 0
je 0x1000ad6f
mov dword [ebp - 0xa38], 1
jmp 0x1000ad76
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0xa38]
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jae 0x1000ad94
cmp dword [ebp - 0x360], 0
jne 0x1000ada4
push 6
pop eax
test eax, eax
jne 0x1000ada4
and dword [ebp - 0x5e0], 0
jmp 0x1000adae
mov dword [ebp - 0x5e0], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc6c]
cmp dword [ebp - 0x5e0], eax
jle 0x1000adce
mov dword [ebp - 0xa40], 1
jmp 0x1000add5
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0xa40], eax
jg 0x1000adef
mov dword [ebp - 0x5e8], 1
jmp 0x1000adf6
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0xe70]
cmp dword [ebp - 0x5e8], eax
je 0x1000ae10
mov dword [ebp - 0xa48], 1
jmp 0x1000ae17
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0xe78]
cmp eax, dword [ebp - 0xa48]
jle 0x1000ae31
mov dword [ebp - 0x5f0], 1
jmp 0x1000ae38
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5f0]
neg eax
cmp eax, dword [ebp - 0xa50]
je 0x1000ae54
mov dword [ebp - 0x5f8], 1
jmp 0x1000ae5b
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x5f8], eax
jle 0x1000ae75
mov dword [ebp - 0xa58], 1
jmp 0x1000ae7c
and dword [ebp - 0xa58], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc6c]
cmp dword [ebp - 0xa58], eax
jge 0x1000ae9d
mov dword [ebp - 0x600], 1
jmp 0x1000aea4
and dword [ebp - 0x600], 0
cmp dword [ebp - 0x600], 0xffffffff
je 0x1000aeb9
mov dword [ebp - 0xa60], 1
jmp 0x1000aec0
and dword [ebp - 0xa60], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc6c]
cmp dword [ebp - 0xa60], eax
jle 0x1000aee1
mov dword [ebp - 0x608], 1
jmp 0x1000aee8
and dword [ebp - 0x608], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc6c]
cmp dword [ebp - 0x608], eax
jge 0x1000af09
mov dword [ebp - 0xe80], 1
jmp 0x1000af10
and dword [ebp - 0xe80], 0
cmp dword [ebp - 0x164], 0
xor eax, eax
inc eax
cmp eax, 0x7e4ddbb7
jae 0x1000af2d
mov dword [ebp - 0xa68], 1
jmp 0x1000af34
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x360]
cmp eax, dword [ebp - 0xa68]
jne 0x1000af4e
mov dword [ebp - 0xe88], 1
jmp 0x1000af55
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp + eax*4 - 0xc6c]
mov dword [ebp - 0x1218], eax
push 0
lea ecx, [ebp - 0xf00]
call fcn.10019c33
cmp dword [eax], 0
je 0x1000af92
mov eax, dword [ebp - 0x164]
neg eax
sub eax, 0xbb1d
mov dword [ebp - 0x610], eax
jmp 0x1000b04b
push 1
lea ecx, [ebp - 0xef0]
call fcn.10019ba5
mov byte [ebp - 4], 9
mov dword [ebp - 0x2a0], 0
jmp 0x1000afbc
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 1
jge 0x1000afde
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0xef0]
call fcn.10019c33
mov dword [eax], 0xa1e2510a
jmp 0x1000afaf
push 0
lea ecx, [ebp - 0xef0]
call fcn.10019c33
cmp dword [eax], 0
je 0x1000b010
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xef0]
call fcn.10019c2e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf00]
call fcn.10019c2e
jmp 0x1000b05f
cmp dword [ebp - 0x610], 0
je 0x1000b03c
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xef0]
call fcn.10019c2e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf00]
call fcn.10019c2e
jmp 0x1000ac99
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xef0]
call fcn.10019c2e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf00]
call fcn.10019c2e
jmp 0x1000ac99
mov dword [ebp - 0x310], 0
jmp 0x1000b078
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 2
jge 0x1000b094
mov eax, dword [ebp - 0x310]
mov dword [ebp + eax*4 - 0x468], 1
jmp 0x1000b06b
mov dword [ebp - 0x228], 0xc8748afa
mov dword [ebp - 0x6c], 0xa9bacde9
mov dword [ebp - 0xe98], 0xfffffff8
mov dword [ebp - 0xea0], 1
mov dword [ebp - 0xea8], 0x2da
mov dword [ebp - 0xeb8], 0x15a8df04
mov dword [ebp - 0x2a8], 0
jmp 0x1000b0e6
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 1
jge 0x1000b102
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0xeb0], 0x1462ccd2
jmp 0x1000b0d9
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x11b8], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1288], eax
mov eax, 0x8bdf
test eax, eax
je 0x1000b13e
cmp dword [ebp - 0x6c], 0
je 0x1000b13e
mov dword [ebp - 0xa70], 1
jmp 0x1000b145
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0xa70]
jne 0x1000b15c
mov dword [ebp - 0x618], 1
jmp 0x1000b163
and dword [ebp - 0x618], 0
mov dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x228]
imul eax, dword [ebp - 0x618]
test eax, eax
jne 0x1000b190
mov eax, 0x78ac
test eax, eax
jne 0x1000b190
and dword [ebp - 0xe90], 0
jmp 0x1000b19a
mov dword [ebp - 0xe90], 1
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x11c0], eax
mov eax, dword [ebp - 0xea0]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x9a20
jg 0x1000b1c4
mov dword [ebp - 0xa78], 1
jmp 0x1000b1cb
and dword [ebp - 0xa78], 0
cmp dword [ebp - 0xa78], 0x87d6
jge 0x1000b1e3
mov dword [ebp - 0x620], 1
jmp 0x1000b1ea
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0xea8]
cmp dword [ebp - 0x620], eax
je 0x1000b204
mov dword [ebp - 0x3cc], 1
jmp 0x1000b20b
and dword [ebp - 0x3cc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp + eax - 0xeb0], ecx
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0xeb8], eax
cmp dword [ebp - 0x6c], 0
je 0x1000b249
mov dword [ebp - 0xa80], 9
mov eax, dword [ebp - 0xa80]
dec eax
mov dword [ebp - 0xa80], eax
jmp 0x1000b290
mov dword [ebp - 0x6c], 0xffffffe9
jmp 0x1000b259
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xe
jle 0x1000b290
mov dword [ebp - 0xec0], 0x17017a68
cmp dword [ebp - 0xec0], 0
je 0x1000b274
jmp 0x1000b290
mov byte [ebp - 0x13c], 0
movzx eax, byte [ebp - 0x13c]
test eax, eax
je 0x1000b28e
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
jmp 0x1000b252
mov dword [ebp - 0x114], 0
jmp 0x1000b2a9
cmp dword [ebp - 0x114], 1
jg 0x1000d18d
push 3
lea ecx, [ebp - 0xc08]
call fcn.10019ba5
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x454], 1
push 1
lea ecx, [ebp - 0xc54]
call fcn.10019ba5
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x348], 0xb4dfecbe
mov dword [ebp - 0xda8], 0x5e3a
mov dword [ebp - 0x648], 0xa832397b
push 4
lea ecx, [ebp - 0x1094]
call fcn.10019ba5
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x30], 0
jmp 0x1000b324
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1000b340
push dword [ebp - 0x30]
lea ecx, [ebp - 0xc08]
call fcn.10019c33
mov dword [eax], 0xfffffffa
jmp 0x1000b31d
mov dword [ebp - 0x30], 0
jmp 0x1000b350
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1000b369
push dword [ebp - 0x30]
lea ecx, [ebp - 0xc54]
call fcn.10019c33
and dword [eax], 0
jmp 0x1000b349
mov dword [ebp - 0x30], 0
jmp 0x1000b379
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1000b395
push dword [ebp - 0x30]
lea ecx, [ebp - 0x1094]
call fcn.10019c33
mov dword [eax], 0xe734f12c
jmp 0x1000b372
push 2
lea ecx, [ebp - 0xc08]
call fcn.10019c33
cmp dword [eax], 0
je 0x1000b3c3
mov dword [ebp - 0x628], 0xf251d69f
mov eax, dword [ebp - 0x628]
inc eax
mov dword [ebp - 0x628], eax
jmp 0x1000b514
mov dword [ebp - 0x238], 3
mov dword [ebp - 0x414], 1
mov dword [ebp - 0xec8], 0x99740826
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x10f8], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x1100], eax
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x238], eax
jl 0x1000b413
mov dword [ebp - 0xa88], 1
jmp 0x1000b41a
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0xffffffff
jge 0x1000b43b
mov dword [ebp - 0x630], 1
jmp 0x1000b442
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x454]
cmp dword [ebp - 0x630], eax
jne 0x1000b45c
mov dword [ebp - 0xa90], 1
jmp 0x1000b463
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0xa90], eax
jle 0x1000b47d
mov dword [ebp - 0x638], 1
jmp 0x1000b484
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x454]
cmp eax, dword [ebp - 0x638]
jg 0x1000b4a2
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x1000b4a2
and dword [ebp - 0xa98], 0
jmp 0x1000b4ac
mov dword [ebp - 0xa98], 1
push 2
lea ecx, [ebp - 0xc08]
call fcn.10019c33
mov ecx, dword [ebp - 0xa98]
cmp ecx, dword [eax]
jg 0x1000b4de
push 0
lea ecx, [ebp - 0xc54]
call fcn.10019c33
cmp dword [eax], 0
jne 0x1000b4de
and dword [ebp - 0x640], 0
jmp 0x1000b4e8
mov dword [ebp - 0x640], 1
mov eax, dword [ebp - 0x348]
add eax, dword [ebp - 0x640]
neg eax
jne 0x1000b4ff
cmp dword [ebp - 0x414], 0
push 0
lea ecx, [ebp - 0xc54]
call fcn.10019c33
mov eax, dword [eax]
mov dword [ebp - 0xec8], eax
cmp dword [ebp - 0x348], 0
jne 0x1000b56f
push 0
lea ecx, [ebp - 0xc08]
call fcn.10019c33
cmp dword [eax], 0xffffffff
jle 0x1000b53b
mov dword [ebp - 0xed0], 1
jmp 0x1000b542
and dword [ebp - 0xed0], 0
push 2
lea ecx, [ebp - 0xc08]
call fcn.10019c33
imul eax, dword [ebp - 0xda8], 0xc1c7
test eax, eax
jne 0x1000b56f
cmp dword [ebp - 0x348], 0
jne 0x1000b56f
and dword [ebp - 0xd24], 0
jmp 0x1000b579
mov dword [ebp - 0xd24], 1
push 2
lea ecx, [ebp - 0xc08]
call fcn.10019c33
push 0
lea ecx, [ebp - 0xc54]
call fcn.10019c33
cmp dword [eax], 0
jle 0x1000b5a4
mov dword [ebp - 0xaa0], 1
jmp 0x1000b5ab
and dword [ebp - 0xaa0], 0
cmp dword [ebp - 0xaa0], 0
jg 0x1000b5c0
mov dword [ebp - 0x3d4], 1
jmp 0x1000b5c7
and dword [ebp - 0x3d4], 0
push 0
lea ecx, [ebp - 0xc54]
call fcn.10019c33
mov ecx, dword [ebp - 0x3d4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 0x6be8
jg 0x1000b600
mov dword [ebp - 0xaa8], 1
jmp 0x1000b607
and dword [ebp - 0xaa8], 0
cmp dword [ebp - 0xaa8], 0x6511f0b9
jne 0x1000b62e
push 0
lea ecx, [ebp - 0xc54]
call fcn.10019c33
cmp dword [eax], 0
jne 0x1000b62e
and dword [ebp - 0x650], 0
jmp 0x1000b638
mov dword [ebp - 0x650], 1
cmp dword [ebp - 0x650], 0xffff
jne 0x1000b654
xor eax, eax
je 0x1000b654
mov dword [ebp - 0xab0], 1
jmp 0x1000b65b
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0xab0], eax
jne 0x1000b675
mov dword [ebp - 0xe7c], 1
jmp 0x1000b67c
and dword [ebp - 0xe7c], 0
push 0
lea ecx, [ebp - 0xc08]
call fcn.10019c33
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x1108], eax
push 1
lea ecx, [ebp - 0x1094]
call fcn.10019c33
or dword [eax], 0xffffffff
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1094]
call fcn.10019c2e
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xc54]
call fcn.10019c2e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc08]
call fcn.10019c2e
mov dword [ebp - 0x64], 0x210b999f
mov dword [ebp - 0x44c], 0xade89b93
mov dword [ebp - 0xfd0], 0xf04b2b3a
mov dword [ebp - 0xd84], 0
mov dword [ebp - 0x64], 1
jmp 0x1000b707
cmp dword [ebp - 0x64], 0
jl 0x1000caf1
mov dword [ebp - 0x2b0], 0xc13fe66
mov dword [ebp - 0x668], 0x46b8d963
mov dword [ebp - 0x1e8], 0xa12afd77
push 3
lea ecx, [ebp - 0x1030]
call fcn.10019ba5
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xd2c], 5
mov dword [ebp - 0xaf0], 0xfffffffb
mov dword [ebp - 0x10f0], 0x8aff65ce
mov dword [ebp - 0x10ec], 0x8aff65ce
mov dword [ebp - 0x10e8], 0x8aff65ce
mov dword [ebp - 0x10e4], 0x8aff65ce
mov dword [ebp - 0x94], 0
jmp 0x1000b798
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x1000b7b1
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x24], 0xfffffffc
jmp 0x1000b78b
mov dword [ebp - 0x94], 0
jmp 0x1000b7ca
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x1000b7ec
push dword [ebp - 0x94]
lea ecx, [ebp - 0x1030]
call fcn.10019c33
mov dword [eax], 0x76cc72b7
jmp 0x1000b7bd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
mov dword [ebp - 0x1110], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1118], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
mov dword [ebp - 0x1120], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0
je 0x1000b838
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1000b838
mov dword [ebp - 0x658], 1
jmp 0x1000b83f
and dword [ebp - 0x658], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp dword [ebp - 0x658], eax
jl 0x1000b85d
mov dword [ebp - 0xab8], 1
jmp 0x1000b864
and dword [ebp - 0xab8], 0
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0x1e8], eax
imul eax, dword [ebp - 0x1e8], 0xae9f
push 4
pop ecx
imul ecx, ecx, 0
cmp dword [ebp + ecx - 0x24], eax
jge 0x1000b892
mov dword [ebp - 0x660], 1
jmp 0x1000b899
and dword [ebp - 0x660], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
imul eax, dword [ebp - 0x660]
test eax, eax
jne 0x1000b8c4
mov dword [ebp - 0x10], 0xfffffff8
mov dword [ebp - 0x7dc], 0xfffffff8
mov dword [ebp - 0xfb0], 0x65a3ff56
cmp dword [ebp - 0x10], 0
jne 0x1000cbc9
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
je 0x1000cb2a
mov dword [ebp - 0xbc4], 1
jmp 0x1000cb31
and dword [ebp - 0xbc4], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jg 0x1000cb48
mov dword [ebp - 0xeac], 1
jmp 0x1000cb4f
and dword [ebp - 0xeac], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1194], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jl 0x1000cb6c
mov dword [ebp - 0x764], 1
jmp 0x1000cb73
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x764]
je 0x1000cb8a
mov dword [ebp - 0x9d4], 1
jmp 0x1000cb91
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x9d4], eax
jl 0x1000cba8
mov dword [ebp - 0x76c], 1
jmp 0x1000cbaf
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
jne 0x1000cbc9
and dword [ebp - 0xb0c], 0
jmp 0x1000cbd3
mov dword [ebp - 0xb0c], 1
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0xb0c]
cmp eax, 1
jae 0x1000cbee
mov dword [ebp - 0x774], 1
jmp 0x1000cbf5
and dword [ebp - 0x774], 0
cmp dword [ebp - 0x774], 0x24039b64
jg 0x1000cfe2
mov dword [ebp - 0xd8c], 0xffffffff
mov dword [ebp - 0x10], 0
jmp 0x1000cc1f
cmp dword [ebp - 0x10], 0x12
jg 0x1000cfdd
mov dword [ebp - 0x74], 0
mov dword [ebp - 0xbac], 0xb6af4a9b
mov byte [ebp - 0x146], 0
movzx eax, byte [ebp - 0x146]
test eax, eax
je 0x1000cc71
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x867
push 0x1faf
push 0x1ba3
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x74], 5
jmp 0x1000cc81
cmp dword [ebp - 0x74], 0x14
jg 0x1000cfd8
jmp 0x1000d154
mov dword [ebp - 0x368], 0xfbb8
mov dword [ebp - 0x7d4], 0xf327
mov dword [ebp - 0x2d8], 0
jmp 0x1000d00f
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 1
jge 0x1000d02b
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0xb74], 0x69a
jmp 0x1000d002
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x11b4], eax
cmp dword [ebp - 0x10], 1
jne 0x1000d04b
or eax, 0xffffffff
je 0x1000d04b
mov dword [ebp - 0x7c4], 1
jmp 0x1000d052
and dword [ebp - 0x7c4], 0
cmp dword [ebp - 0x7c4], 0xfffe
ja 0x1000d06a
mov dword [ebp - 0xa04], 1
jmp 0x1000d071
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0x368]
cmp eax, dword [ebp - 0xa04]
jl 0x1000d08b
mov byte [ebp - 0x185], 0
movzx eax, byte [ebp - 0x185]
test eax, eax
je 0x1000d16e
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp + eax*4 - 0x468]
mov dword [ebp + ecx*4 - 0x468], eax
jmp 0x1000b29c
mov dword [ebp - 0x1050], 0xfffffff7
mov dword [ebp - 0x104c], 0xfffffff7
mov dword [ebp - 0x1048], 0xfffffff7
mov dword [ebp - 0x1044], 0xfffffff7
lea ecx, [ebp - 0x3f9]
call fcn.10008de3
push eax
lea eax, [ebp - 0x1040]
push eax
lea eax, [ebp - 0x1050]
push eax
lea ecx, [ebp - 0x129c]
call fcn.10019c42
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1070]
call fcn.10019c04
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0xc8], 0
jmp 0x1000d214
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jg 0x1000d372
mov dword [ebp - 0x210], 0xfffffff9
mov byte [ebp - 0x18d], 0
movzx eax, byte [ebp - 0x18d]
test eax, eax
je 0x1000d24a
push 0xf07
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x210]
imul eax, dword [ebp - 0xc8]
test eax, eax
jne 0x1000d26d
mov eax, 0xfffe
test eax, eax
jne 0x1000d26d
and dword [ebp - 0x7e4], 0
jmp 0x1000d277
mov dword [ebp - 0x7e4], 1
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x7e4]
jl 0x1000d291
mov dword [ebp - 0xa14], 1
jmp 0x1000d298
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0x210]
imul eax, dword [ebp - 0xa14]
cmp eax, dword [ebp - 0x210]
jl 0x1000d2b9
mov dword [ebp - 0x7ec], 1
jmp 0x1000d2c0
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x7ec], eax
jge 0x1000d2da
mov dword [ebp - 0xb2c], 1
jmp 0x1000d2e1
and dword [ebp - 0xb2c], 0
mov eax, dword [ebp - 0x210]
add eax, dword [ebp - 0xb2c]
cmp eax, dword [ebp - 0xc8]
jne 0x1000d301
mov dword [ebp - 0xa1c], 1
jmp 0x1000d308
and dword [ebp - 0xa1c], 0
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x1070]
call fcn.10019c33
mov dword [ebp - 0x7f4], eax
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x1070]
call fcn.10019c33
mov ecx, dword [ebp - 0x7f4]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x7f4]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa1c]
jge 0x1000d356
mov dword [ebp - 0x7fc], 1
jmp 0x1000d35d
and dword [ebp - 0x7fc], 0
imul eax, dword [ebp - 0x7fc], 0x3293
mov dword [ebp - 0x210], eax
jmp 0x1000d207
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1070]
call fcn.10019c2e
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1000d3b0
push 0
push 0x1adb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
push 4
lea ecx, [ebp - 0xcf0]
call fcn.10019ba5
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0xda4], 0x5b49d585
mov dword [ebp - 0xa4], 0
jmp 0x1000d3f1
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 4
jge 0x1000d413
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xcf0]
call fcn.10019c33
mov dword [eax], 0xfffffffa
jmp 0x1000d3e4
mov dword [ebp - 0xa4], 0
jmp 0x1000d42c
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x1000d448
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x12ac], 1
jmp 0x1000d41f
mov dword [ebp - 0xf4], 3
jmp 0x1000d461
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jl 0x1000d508
mov dword [ebp - 0x3b0], 0xffffffff
push dword [ebp - 0xf4]
lea ecx, [ebp - 0xcf0]
call fcn.10019c33
cmp dword [eax], 0
jne 0x1000d4c3
push 3
lea ecx, [ebp - 0xcf0]
call fcn.10019c33
push dword [ebp - 0xf4]
lea ecx, [ebp - 0xcf0]
call fcn.10019c33
cmp dword [eax], 0
jne 0x1000d4c3
cmp dword [ebp - 0xf4], 0
jne 0x1000d4c3
and dword [ebp - 0xb78], 0
jmp 0x1000d4cd
mov dword [ebp - 0xb78], 1
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0x3b0], eax
mov esi, dword [ebp - 0x3b0]
push dword [ebp - 0xf4]
lea ecx, [ebp - 0xcf0]
call fcn.10019c33
imul esi, dword [eax]
mov dword [ebp - 0xda4], esi
mov dword [ebp - 0x3b0], 0xffffffff
jmp 0x1000d454
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf0]
call fcn.10019c2e
mov dword [ebp - 0xf8], 0xc45cdbe8
mov dword [ebp - 0xa54], 0x76a17913
mov dword [ebp - 0xec4], 0xd157
mov dword [ebp - 0x2e0], 0
jmp 0x1000d54e
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 2
jge 0x1000d56a
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0x470], 1
jmp 0x1000d541
mov dword [ebp - 0xf8], 0
jmp 0x1000d583
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jg 0x1000dc02
mov dword [ebp - 0x60], 0x210b999f
mov dword [ebp - 0x42c], 0xade89b93
mov dword [ebp - 0xdbc], 0xf04b2b3a
mov dword [ebp - 0xfc8], 0
mov dword [ebp - 0x60], 1
jmp 0x1000d5c5
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x1000dbe3
mov dword [ebp - 0xcc], 0xd00585b7
mov dword [ebp - 0xcc], 1
jmp 0x1000d5f2
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x1000dbde
mov dword [ebp - 0x1d8], 5
mov dword [ebp - 0x330], 0
jmp 0x1000d622
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 2
jge 0x1000d63e
mov eax, dword [ebp - 0x330]
mov dword [ebp + eax*4 - 0x38c], 0xfffffff8
jmp 0x1000d615
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x38c], 0
jmp 0x1000d66c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x38c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x38c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x38c], 1
jg 0x1000d6b0
mov byte [ebp - 0x147], 0
movzx eax, byte [ebp - 0x147]
test eax, eax
je 0x1000d69a
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x470]
mov dword [ebp + ecx*4 - 0x470], eax
jmp 0x1000d651
mov dword [ebp - 0x1d8], 0
jmp 0x1000d6c9
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0x14
je 0x1000dbd9
mov dword [ebp - 0x68], 0x2949f4ff
mov dword [ebp - 0x2e8], 1
mov dword [ebp - 0x68], 0
jmp 0x1000d6f7
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xffffffe9
je 0x1000da30
mov dword [ebp - 0x1d0], 0x6b6feb9e
mov dword [ebp - 0x1d0], 0
jmp 0x1000d724
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0xffffffe7
jge 0x1000da2b
mov dword [ebp - 0x22c], 0x324015fb
cmp dword [ebp - 0x60], 0
jne 0x1000da0c
cmp dword [ebp - 0x22c], 0
jae 0x1000d75a
mov dword [ebp - 0xebc], 1
jmp 0x1000d761
and dword [ebp - 0xebc], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x11cc], eax
cmp dword [ebp - 0x22c], 0
je 0x1000d788
cmp dword [ebp - 0xf8], 0
je 0x1000d788
and dword [ebp - 0x804], 0
cmp dword [ebp - 0x804], 0x5d482642
jle 0x1000d7a7
mov dword [ebp - 0x844], 1
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x844]
mov dword [ebp - 0xa54], eax
jmp 0x1000d717
jmp 0x1000d6f0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x68], 0
jne 0x1000db7e
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x11ec], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x11f4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38c], 0
je 0x1000da84
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x38c], 0
jne 0x1000da84
and dword [ebp - 0xa44], 0
jmp 0x1000da8e
mov dword [ebp - 0xa44], 1
cmp dword [ebp - 0xa44], 0xfffffffb
jg 0x1000daac
mov eax, 0x4d3e
test eax, eax
je 0x1000daac
mov dword [ebp - 0x84c], 1
jmp 0x1000dab3
and dword [ebp - 0x84c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x470]
cmp eax, dword [ebp - 0x84c]
jle 0x1000dad4
mov dword [ebp - 0xb44], 1
jmp 0x1000dadb
and dword [ebp - 0xb44], 0
cmp dword [ebp - 0xb44], 0xffff
jne 0x1000daf3
mov dword [ebp - 0xdb4], 1
jmp 0x1000dafa
and dword [ebp - 0xdb4], 0
mov eax, dword [ebp - 0xec4]
mov dword [ebp - 0x11fc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x38c]
mov dword [ebp - 0x1204], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x120c], eax
mov eax, dword [ebp - 0x1d8]
add eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x1d8]
jne 0x1000db3f
mov dword [ebp - 0x85c], 1
cmp dword [ebp - 0x85c], 0xd6242281
jae 0x1000dba0
mov dword [ebp - 0xb90], 1
jmp 0x1000dba7
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0xfc8]
cmp dword [ebp - 0xb90], eax
jle 0x1000dbc1
mov dword [ebp - 0x864], 1
jmp 0x1000dbc8
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0xa54], eax
jmp 0x1000d6bc
jmp 0x1000d5e5
jmp 0x1000d5be
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0xf8]
mov eax, dword [ebp + eax*4 - 0x470]
mov dword [ebp + ecx*4 - 0x470], eax
jmp 0x1000d576
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x1000dc31
push 0
push 0x1adb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
mov dword [ebp - 0x100], 0xc45cdbe8
mov dword [ebp - 0xb64], 0x76a17913
mov dword [ebp - 0xdd4], 0xd157
mov dword [ebp - 0x254], 0
jmp 0x1000dc68
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 2
jge 0x1000dc84
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0x460], 1
jmp 0x1000dc5b
mov dword [ebp - 0x100], 0
jmp 0x1000dc9d
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 1
jg 0x1000e31c
mov dword [ebp - 0x54], 0x210b999f
mov dword [ebp - 0x404], 0xade89b93
mov dword [ebp - 0xed4], 0xf04b2b3a
mov dword [ebp - 0xddc], 0
mov dword [ebp - 0x54], 1
jmp 0x1000dcdf
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1000e2fd
mov dword [ebp - 0xac], 0xd00585b7
mov dword [ebp - 0xac], 1
jmp 0x1000dd0c
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x1000e2f8
mov dword [ebp - 0x1e4], 5
mov dword [ebp - 0x25c], 0
jmp 0x1000dd3c
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 2
jge 0x1000dd58
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0x39c], 0xfffffff8
jmp 0x1000dd2f
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x39c], 0
jmp 0x1000dd86
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x39c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x39c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x39c], 1
jg 0x1000ddca
mov byte [ebp - 0x1c5], 0
movzx eax, byte [ebp - 0x1c5]
test eax, eax
je 0x1000ddb4
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x460]
mov dword [ebp + ecx*4 - 0x460], eax
jmp 0x1000dd6b
mov dword [ebp - 0x1e4], 0
jmp 0x1000dde3
cmp dword [ebp - 0x1e4], 0x14
je 0x1000e2f3
mov dword [ebp - 0x5c], 0x2949f4ff
mov dword [ebp - 0x264], 1
mov dword [ebp - 0x5c], 0
jmp 0x1000de11
cmp dword [ebp - 0x5c], 0xffffffe9
je 0x1000e14a
mov dword [ebp - 0x1dc], 0x6b6feb9e
mov dword [ebp - 0x1dc], 0
jmp 0x1000de3e
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x122c], eax
cmp dword [ebp - 0x5c], 0
jne 0x1000e298
jmp 0x1000dcff
jmp 0x1000dcd8
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x100]
mov eax, dword [ebp + eax*4 - 0x460]
mov dword [ebp + ecx*4 - 0x460], eax
jmp 0x1000dc90
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x1000e34b
push 0
push 0x1adb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
push 4
lea ecx, [ebp - 0xcd8]
call fcn.10019ba5
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x108], 1
mov dword [ebp - 0xf78], 0x5b49d585
mov dword [ebp - 0xd4], 0
jmp 0x1000e38c
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 4
jge 0x1000e3ae
push dword [ebp - 0xd4]
lea ecx, [ebp - 0xcd8]
call fcn.10019c33
mov dword [eax], 0xfffffffa
jmp 0x1000e37f
mov dword [ebp - 0xd4], 0
jmp 0x1000e3c7
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 2
jge 0x1000e3e3
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x12a4], 1
jmp 0x1000e3ba
mov dword [ebp - 0x108], 3
jmp 0x1000e3fc
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jl 0x1000e4a3
mov dword [ebp - 0x3b4], 0xffffffff
push dword [ebp - 0x108]
lea ecx, [ebp - 0xcd8]
call fcn.10019c33
cmp dword [eax], 0
jne 0x1000e45e
push 3
lea ecx, [ebp - 0xcd8]
call fcn.10019c33
push dword [ebp - 0x108]
lea ecx, [ebp - 0xcd8]
call fcn.10019c33
cmp dword [eax], 0
jne 0x1000e45e
cmp dword [ebp - 0x108], 0
jne 0x1000e45e
and dword [ebp - 0x8d4], 0
jmp 0x1000e468
mov dword [ebp - 0x8d4], 1
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x3b4], eax
mov esi, dword [ebp - 0x3b4]
push dword [ebp - 0x108]
lea ecx, [ebp - 0xcd8]
call fcn.10019c33
imul esi, dword [eax]
mov dword [ebp - 0xf78], esi
mov dword [ebp - 0x3b4], 0xffffffff
jmp 0x1000e3ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcd8]
call fcn.10019c2e
mov dword [ebp - 0x48], 0xfffffff7
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x26c], 0
jmp 0x1000e4d9
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x1000e4f5
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0xc98], 3
jmp 0x1000e4cc
cmp dword [ebp - 0x48], 0
je 0x1000e536
mov dword [ebp - 0x48], 0
jmp 0x1000e50b
cmp dword [ebp - 0x48], 0xfffffff3
je 0x1000e521
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x34], 0
jmp 0x1000e504
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc98]
mov dword [ebp - 0x34], eax
jmp 0x1000e7f3
mov dword [ebp - 0x184], 6
push 4
lea ecx, [ebp - 0xcb4]
call fcn.10019ba5
mov dword [ebp - 4], 0x14
push 2
lea ecx, [ebp - 0x1018]
call fcn.10019ba5
mov byte [ebp - 4], 0x15
mov dword [ebp - 0xb4], 0
jmp 0x1000e57e
cmp dword [ebp - 0xb4], 4
jge 0x1000e5a0
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xcb4]
call fcn.10019c33
mov dword [eax], 0x65c3421a
jmp 0x1000e571
mov dword [ebp - 0xb4], 0
jmp 0x1000e5b9