Function at 0x100099fd
Capabilities:
Clear file content
Delete registry value
Enumerate gui resources
Get common file path
Get disk information
Terminate process

Disassembly:
mov eax, 0x10069f15
call fcn.1006960c
mov eax, 0x159c
call fcn.100652e0
push ebx
mov dword [ebp - 0x60], ecx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], 6
xor ecx, ecx
mov dword [ebp - 0x3c], 8
inc ecx
push edi
mov byte [ebp - 0x61], dl
mov esi, 0xa8e
mov dword [ebp - 0x24], ebx
jmp 0x10009a44
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x848], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10009a37
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jg 0x10009a70
mov byte [ebp - 0x4d], bl
cmp byte [ebp - 0x4d], bl
je 0x10009a65
push ebx
push ebx
push ebx
push ebx
call edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10009a57
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], 7
jmp 0x10009a88
mov dword [ebp - 0x20], 4
cmp dword [ebp - 0x20], ebx
jne 0x10009a8e
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
jge 0x10009a79
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x24], ebx
jmp 0x10009aae
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x858], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10009aa1
mov dword [ebp - 0x10], ebx
jmp 0x10009ac9
mov byte [ebp - 0x4d], bl
cmp byte [ebp - 0x4d], bl
je 0x10009ac6
push ebx
push ebx
push ebx
push ebx
call edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10009ab8
mov dword [ebp - 0x10], 7
jmp 0x10009ae6
mov dword [ebp - 0x20], 4
cmp dword [ebp - 0x20], ebx
jne 0x10009aec
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
jge 0x10009ad7
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x28], 0x11
jmp 0x10009b19
cmp dword [ebp - 0x28], ebx
jne 0x10009b1f
mov byte [ebp - 0x4d], bl
cmp byte [ebp - 0x4d], bl
je 0x10009b16
push ebx
push 0x230a
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffea
je 0x10009afc
xor eax, eax
inc eax
push 0xfffffffffffffffe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ebx
pop ecx
jmp 0x10009b62
mov dword [ebp - 0x28], 0x22124f84
mov dword [ebp - 0x28], ecx
jmp 0x10009b59
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], ebx
jmp 0x10009b50
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jne 0x10009b56
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xf
jne 0x10009b45
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xb
jne 0x10009b39
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
je 0x10009b2d
mov dword [ebp - 0x34], 6
lea ecx, [ebp - 0x604]
push 2
call fcn.100177e1
xor edx, edx
mov dword [ebp - 0x1c], 0x13532fe2
mov dword [ebp - 0x24], ebx
inc edx
cmp dword [ebp - 0x24], 2
jge 0x10009b9f
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x604]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x24]
jmp 0x10009b88
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], ebx
jl 0x10009bce
mov dword [ebp - 0x28], 0x252604
mov dword [ebp - 0x28], ebx
jmp 0x10009bc4
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x604]
cmp dword [eax + ecx*4], ebx
jne 0x10009bc9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jle 0x10009bb3
dec dword [ebp - 0x1c]
jns 0x10009ba7
lea ecx, [ebp - 0x604]
call fcn.1001795f
xor ecx, ecx
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x24], ebx
inc ecx
jmp 0x10009bf5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7f8], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10009be8
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], ebx
jg 0x1000a008
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x20], 0xb8f6c218
mov dword [ebp - 0x2c], 0x16
cmp dword [ebp - 0x2c], 4
jge 0x10009d8d
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], 0x5165352f
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], ebx
jmp 0x10009d52
push ecx
lea ecx, [ebp - 0x6d0]
call fcn.100177e1
mov dword [ebp - 4], ebx
xor edx, edx
mov dword [ebp - 0x44], 0xe80d
inc edx
mov dword [ebp - 0x14], ebx
jmp 0x10009c6f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x6d0]
mov dword [eax + ecx*4], 0xac45
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10009c5c
mov dword [ebp - 0x14], ebx
jmp 0x10009c8a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x194], 0x3126ff23
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10009c79
mov dword [ebp - 0x14], ebx
jmp 0x10009ca6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7c8], 0x16a205b2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10009c95
mov dword [ebp - 0x190], ebx
cmp dword [ebp - 0x190], ebx
jg 0x10009d0f
xor edi, edi
inc edi
push 3
lea ecx, [ebp - 0x61c]
call fcn.100177e1
mov dword [ebp - 0x24], ebx
jmp 0x10009ce1
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x61c]
mov dword [eax + ecx*4], 0x9c3d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10009cce
mov eax, dword [ebp - 0x61c]
lea ecx, [ebp - 0x61c]
inc dword [eax + 8]
mov dword [ebp - 0x20], edi
call fcn.1001795f
inc dword [ebp - 0x190]
cmp dword [ebp - 0x190], ebx
jle 0x10009cbc
xor edx, edx
inc edx
mov dword [ebp - 0x24], ebx
jmp 0x10009d38
cmp dword [ebp - 0x44], ebx
jne 0x10009d3d
mov byte [ebp - 0x4d], bl
cmp byte [ebp - 0x4d], 0
je 0x10009d35
push 0x1db7
push 0x78b
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
xor edx, edx
inc edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
je 0x10009d14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6d0]
call fcn.1001795f
dec dword [ebp - 0x28]
push 1
pop ecx
cmp dword [ebp - 0x28], 0xffffffe4
jl 0x10009c3e
mov byte [ebp - 0x4d], bl
cmp byte [ebp - 0x4d], 0
je 0x10009d77
push ebx
push 0x1f60
push ebx
push 0xafc
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
push 1
pop ecx
jl 0x10009c25
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 2
pop esi
push esi
lea ecx, [ebp - 0x634]
call fcn.100177e1
xor edx, edx
mov dword [ebp - 0x1c], 0x13532fe2
mov dword [ebp - 0x24], ebx
inc edx
cmp dword [ebp - 0x24], esi
jge 0x10009dbf
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x634]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x24]
jmp 0x10009da9
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], ebx
jl 0x10009dee
mov dword [ebp - 0x28], 0x252604
mov dword [ebp - 0x28], ebx
jmp 0x10009de4
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x634]
cmp dword [eax + ecx*4], ebx
jne 0x10009de9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jle 0x10009dd3
dec dword [ebp - 0x1c]
jns 0x10009dc7
lea ecx, [ebp - 0x634]
call fcn.1001795f
mov byte [ebp - 0x15], bl
lea ecx, [ebp - 0x2c0]
mov dword [ebp - 0x14], 0xfffffffe
push 3
call fcn.100177e1
mov dword [ebp - 0x58], 0x79655965
mov dword [ebp - 0x10], 0xfffffffc
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], ebx
jmp 0x10009e3d
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c0]
mov dword [eax + ecx*4], 0xbf889e02
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10009e2a
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
test eax, eax
setns cl
xor edx, edx
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
imul ecx, ecx, 0xbf9f
add ecx, esi
cmp eax, ecx
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov esi, dword [ebp - 0x2c0]
setle cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [esi + 8]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [ebp - 0x2c0]
setle cl
imul ecx, dword [eax]
cmp ecx, edx
jl 0x10009f4b
mov dword [ebp - 0x2c], 0xadc1094d
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x2c], 0xb1b0cadf
mov eax, dword [ebp - 0x10]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
cmp dword [ebp - 0x14], ecx
jge 0x10009ed7
xor eax, eax
inc eax
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x30]
jmp 0x10009fc7
push 2
mov dword [ebp - 0x48], 0xad38
mov dword [ebp - 0x10], ebx
pop esi
jmp 0x10009f44
mov dword [ebp - 0x30], 0x7c1b
mov dword [ebp - 0x20], 0xb5bcdcec
mov dword [ebp - 0x2c], ebx
jmp 0x10009f3c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x10]
neg edx
mov eax, dword [ebp - 0x2c0]
sbb edx, edx
inc edx
mov dword [eax + ecx*4], edx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x30], ebx
jne 0x10009f41
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x10009ef9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x10009ee6
jmp 0x10009fc7
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x14], ebx
jmp 0x10009f64
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x444], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10009f57
xor ecx, ecx
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x10009f83
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x380], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10009f72
mov edx, dword [ebp - 0x444]
mov ecx, dword [ebp - 0x444]
neg edx
mov eax, dword [ebp - 0x30]
sbb edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x20]
neg edx
add eax, edx
mov dword [esi + 8], ecx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x380], eax
mov byte [ebp - 0x4d], bl
cmp byte [ebp - 0x4d], 0
je 0x10009fe2
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [ebp - 0x2c0]
call fcn.1001795f
cmp byte [ebp - 0x15], 0
je 0x10009ff9
push ebx
push ebx
push ebx
push ebx
call edi
inc dword [ebp - 0x34]
push 1
pop ecx
cmp dword [ebp - 0x34], ebx
jle 0x10009c06
push ecx
lea ecx, [ebp - 0x758]
call fcn.100177e1
push 3
xor eax, eax
lea ecx, [ebp - 0x41c]
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0xfffffffe
pop edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x28], 0xa2b3b7be
mov dword [ebp - 0x3c], 0xa927213e
mov dword [ebp - 0x20], 0xd50f82ba
push 2
mov dword [ebp - 0x1c], 0xffffffff
pop esi
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x58], eax
push edi
call fcn.100177e1
mov dword [ebp - 0x30], 0xec6f
xor edx, edx
mov dword [ebp - 0x44], 0x523e24b1
inc edx
mov dword [ebp - 0x2c], 0x84bb
mov dword [ebp - 0x10], ebx
jmp 0x1000a093
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x758]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000a083
mov dword [ebp - 0x10], ebx
jmp 0x1000a0b0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x41c]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000a09d
mov dword [ebp - 0x10], ebx
jmp 0x1000a0f6
mov dword [ebp - 0x3c], 0xc3099cfe
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0xfffffff6
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x24], ebx
jmp 0x1000a0eb
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa28], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000a0de
dec dword [ebp - 0x30]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1000a0ba
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x41c]
cmp dword [eax], edx
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x10]
sub edx, 0x531d
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x41c]
mov dword [eax + 4], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x4c]
cmp eax, 7
setg cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x10], 5
test eax, eax
jne 0x1000a162
cmp dword [ebp - 0x28], ebx
je 0x1000a165
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x41c]
imul eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
call fcn.1001795f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x758]
call fcn.1001795f
mov dword [ebp - 0x34], 7
jmp 0x1000a225
mov dword [ebp - 0x20], 4
lea ecx, [ebp - 0x670]
push esi
call fcn.100177e1
mov dword [ebp - 0x28], 0xdf1febae
mov dword [ebp - 0x24], ebx
jmp 0x1000a1c7
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x670]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000a1b4
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jl 0x1000a212
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], ebx
jmp 0x1000a203
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x670]
cmp dword [eax + ecx*4], ebx
jne 0x1000a20a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000a1fd
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
inc dword [ebp - 0x24]
xor eax, eax
inc eax
cmp dword [ebp - 0x24], eax
jle 0x1000a1df
jmp 0x1000a20d
xor eax, eax
inc eax
dec dword [ebp - 0x28]
jns 0x1000a1d7
lea ecx, [ebp - 0x670]
call fcn.1001795f
cmp dword [ebp - 0x20], ebx
jne 0x1000a22f
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffff
jge 0x1000a195
mov dword [ebp - 0x24], 0xffffffff
mov esi, 0x4f833fcb
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
jmp 0x1000a26c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xaa8], 0x951fe77d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1000a25b
inc dword [ebp - 0x30]
push 0xfffffffffffffff2
mov dword [ebp - 0x24], ebx
pop edi
jmp 0x1000a295
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000a292
push ebx
push ebx
push 0x1b0e
call dword [sym.imp.USER32.dll_SetWindowRgn]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x1000a27c
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
jmp 0x1000a2d2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xae4], 0x951fe77d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1000a2c1
inc dword [ebp - 0x30]
mov dword [ebp - 0x24], ebx
jmp 0x1000a2f9
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000a2f6
push ebx
push ebx
push 0x1b0e
call dword [sym.imp.USER32.dll_SetWindowRgn]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x1000a2e0
push 2
pop esi
mov dword [ebp - 0x24], 0x53b26bdd
mov dword [ebp - 0x24], esi
jmp 0x1000a34c
mov dword [ebp - 0x28], 0x318d5816
cmp dword [ebp - 0x28], ebx
jne 0x1000a352
mov dword [ebp - 0x28], ebx
jmp 0x1000a343
mov dword [ebp - 0x20], 0x60d00585
cmp dword [ebp - 0x20], ebx
jne 0x1000a349
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000a340
push 0x16b7
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jne 0x1000a31e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1d
je 0x1000a30d
mov dword [ebp - 0x24], 0x53b26bdd
mov dword [ebp - 0x24], esi
jmp 0x1000a39d
mov dword [ebp - 0x28], 0x318d5816
cmp dword [ebp - 0x28], ebx
jne 0x1000a3a3
mov dword [ebp - 0x28], ebx
jmp 0x1000a394
mov dword [ebp - 0x20], 0x60d00585
cmp dword [ebp - 0x20], ebx
jne 0x1000a39a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000a391
push 0x16b7
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jne 0x1000a36f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1d
je 0x1000a35e
push 3
pop edi
push edi
lea ecx, [ebp - 0x2d0]
call fcn.100177e1
xor eax, eax
mov dword [ebp - 4], esi
movdqa xmm0, xmmword [0x100081b0]
lea ecx, [ebp - 0x910]
inc eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x900]
push ecx
push eax
push ecx
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x6e8]
movdqu xmmword [ebp - 0x910], xmm0
call fcn.10017894
mov dword [ebp - 0x20], 0x1683
cmp dword [ebp - 0x20], 0xc36
jge 0x1000a491
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], ebx
push eax
push 0x10007b80
call fcn.1005076b
mov edi, ebx
mov dword [ebp - 0x1bc], ebx
and dword [ebp - 0x30], edi
mov esi, 0x90
pop ecx
pop ecx
cmp dword [ebp - 0x118], edi
jle 0x1000a4a0
lea eax, [ebp - 0x1bc]
push eax
push 0x10007b80
call fcn.1005076b
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1bc]
mov eax, ecx
add edi, ecx
and eax, 0x80000001
jns 0x1000a45a
dec eax
or eax, 0xfffffffe
inc eax
xor edx, edx
inc edx
cmp eax, edx
jne 0x1000a467
inc ebx
cmp ecx, esi
cmovl esi, ecx
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, dword [ebp - 0x118]
jl 0x1000a431
cmp esi, 0x90
jle 0x1000a4a3
push 0x10007b88
call fcn.10051176
pop ecx
push 2
pop esi
push 3
xor ebx, ebx
pop edi
xor edx, edx
inc edx
mov dword [ebp - 0x24], 0xe50714ba
mov dword [ebp - 0x10], ebx
jmp 0x1000a4dd
xor edx, edx
inc edx
and ebx, 0x80000001
jns 0x1000a4b0
dec ebx
or ebx, 0xfffffffe
inc ebx
jne 0x1000a4c2
sub edi, esi
push edi
push 0x10007b8c
call fcn.10050db3
pop ecx
jmp 0x1000a488
cmp ebx, edx
je 0x1000a4b4
push 2
pop esi
push 3
xor ebx, ebx
pop edi
jmp 0x1000a494
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x37c], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000a4d0
mov dword [ebp - 0x10], ebx
jmp 0x1000a4fa
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2d0]
mov dword [eax + ecx*4], 0x1897a4a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000a4e7
mov ecx, dword [ebp - 0x2d0]
mov dword [ecx + 4], ebx
mov dword [ebp - 0x28], 0x7555b7ce
mov dword [ebp - 0x28], ebx
jmp 0x1000a521
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x37c], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1000a514
inc dword [ecx + 4]
cmp dword [ecx + 4], esi
jle 0x1000a508
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], ebx
jl 0x1000a660
mov edi, dword [ebp - 0x6e8]
mov dword [ebp - 0x10], 0xe5d5ec7e
mov dword [ebp - 0x2c], 0xffffffff
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2d0]
mov edx, dword [ebp - 0x2d0]
mov eax, dword [eax + ecx*4]
mov dword [edx + esi*4], eax
test eax, eax
je 0x1000a582
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x378]
cmp dword [ebp - 0x14], ebx
je 0x1000a582
xor esi, esi
inc esi
mov edx, esi
jmp 0x1000a587
xor esi, esi
mov edx, ebx
inc esi
mov eax, dword [ebp - 0x37c]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [edi + 8], ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], ebx
je 0x1000a5a6
mov eax, esi
cmp dword [ebp - 0x34], ebx
jne 0x1000a5a8
mov eax, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], 0xfffffff7
jge 0x1000a654
push 2
pop esi
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], ebx
jl 0x1000a647
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x37c], ebx
je 0x1000a601
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000a642
push 0x1731
push ebx
push 0x4dd
push 0x219e
push 0x229f
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x1000a642
mov dword [ebp - 0x10], ebx
jmp 0x1000a63d
mov dword [ebp - 0x14], ebx
jmp 0x1000a635
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x37c], ebx
jne 0x1000a63a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000a632
push ebx
push ebx
push 0x904
push 0x802
call dword [sym.imp.USER32.dll_SendMessageW]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1000a60b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x1000a606
dec dword [ebp - 0x24]
jns 0x1000a5cf
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff7
jl 0x1000a5c7
dec dword [ebp - 0x34]
jns 0x1000a540
push 3
pop edi
lea ecx, [ebp - 0x6e8]
call fcn.1001795f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d0]
call fcn.1001795f
mov dword [ebp - 0x34], 0x1c2a2c7c
xor edx, edx
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], 0x955a
mov dword [ebp - 0x20], 0xfa014801
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setne dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 0xfffffffb
sbb eax, eax
neg eax
jne 0x1000a6c8
cmp dword [ebp - 0x28], ebx
je 0x1000a6c8
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1000a6ca
mov ecx, ebx
xor eax, eax
test ecx, ecx
setns al
sub eax, 6
add eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
add eax, 0x26dbd90e
neg eax
sbb eax, eax
inc eax
cmp eax, 0xfffffff7
jb 0x1000a6f5
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setne dl
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x2c], ebx
jmp 0x1000a720
mov dword [ebp - 0x28], 0x7ba96689
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x2c
jne 0x1000a710
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x700]
mov dword [ebp - 0x48], 0x20f89b54
mov dword [ebp - 0x2c], ebx
push edi
call fcn.100177e1
lea ecx, [ebp - 0x8d0]
mov dword [ebp - 4], edi
movdqa xmm0, xmmword [0x10008220]
lea eax, [ebp - 0x8c0]
push ecx
push eax
push ecx
mov dword [ebp - 0x20], 0x364d64ea
lea ecx, [ebp - 0x770]
mov dword [ebp - 0x3c], 0x2da3c3d2
movdqu xmmword [ebp - 0x8d0], xmm0
call fcn.10017894
mov dword [ebp - 0x3c], 0x56fe
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x44], 0xde47
mov dword [ebp - 0x10], ebx
jmp 0x1000a7a7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x700]
mov dword [eax + ecx*4], 0x369bd69
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000a794
mov dword [ebp - 0x10], ebx
jmp 0x1000a7c2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x950], 0x858905b8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000a7b1
mov eax, dword [ebp - 0x48]
xor edx, edx
mov esi, dword [ebp - 0x770]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
inc edx
mov eax, dword [ebp - 0x2c]
cmp eax, edx
setl cl
mov dword [esi + 4], ecx
cmp dword [ebp - 0x2c], edx
jge 0x1000a826
inc dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [esi + 4]
setne dl
mov dword [ebp - 0x950], edx
add eax, edx
mov ecx, dword [ebp - 0x48]
imul ecx, eax
mov eax, dword [ebp - 0x2c]
sub eax, ecx
cmp eax, dword [ebp - 0x20]
jle 0x1000a81d
cmp dword [ebp - 0x48], ebx
jne 0x1000a81d
mov eax, ebx
jmp 0x1000a820
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
je 0x1000a833
cmp dword [ebp - 0x950], ebx
jne 0x1000a838
cmp dword [ebp - 0x44], ebx
je 0x1000a844
mov dword [ebp - 0x30], 0xffffffff
dec dword [ebp - 0x30]
jmp 0x1000a85a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000a85a
push 0xa50
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea ecx, [ebp - 0x770]
call fcn.1001795f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x700]
call fcn.1001795f
mov dword [ebp - 0x3c], 0x4f833fcb
xor edx, edx
mov dword [ebp - 0x3c], 0xfffffffb
inc edx
mov dword [ebp - 0x34], 0xb9f9b31
push 4
pop esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x20], 0xa6ca0cec
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 0xfffffffe
jne 0x1000a8f6
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
je 0x1000a8d3
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov ecx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
cmp ecx, 7
jl 0x1000a8ec
mov eax, ebx
cmp dword [ebp - 0x48], ebx
je 0x1000a8ee
mov eax, edx
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x34]
jmp 0x1000a8a3
mov dword [ebp - 0x3c], 0xffffffff
lea ecx, [ebp - 0x344]
mov dword [ebp - 0x2c], 9
push edx
call fcn.100177e1
mov dword [ebp - 4], esi
xor edx, edx
mov dword [ebp - 0x34], 0x8e045dce
inc edx
mov dword [ebp - 0x30], 0x8af16de6
mov dword [ebp - 0x48], 0x2657
mov dword [ebp - 0x24], ebx
jmp 0x1000a943
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x344]
mov dword [eax + ecx*4], 0x3f0d3ecf
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1000a930
mov dword [ebp - 0x2c], 0x14
cmp dword [ebp - 0x2c], 0xfffffff4
jg 0x1000aada
jmp 0x1000a95e
xor edx, edx
inc edx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
jmp 0x1000a977
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x90], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1000a966
cmp dword [ebp - 0x90], ebx
jne 0x1000a9a0
mov eax, dword [ebp - 0x344]
mov ecx, edx
sub ecx, dword [eax]
xor eax, eax
cmp ecx, 0x5f9c7104
setne al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x90], edx
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x66ef
jg 0x1000aa10
mov dword [ebp - 0x8c], edx
cmp dword [ebp - 0x48], edx
jge 0x1000a9e5
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x344]
imul eax, dword [eax], 6
test eax, eax
je 0x1000a9ef
mov ecx, edx
cmp dword [ebp - 0x8c], ebx
jne 0x1000a9f1
mov ecx, ebx
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x28], ecx
jmp 0x1000aacd
mov dword [ebp - 0x20], edx
lea ecx, [ebp - 0x64c]
mov dword [ebp - 0x58], 0xd45eb447
push edi
call fcn.100177e1
mov dword [ebp - 0x24], ebx
jmp 0x1000aa3e
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x64c]
mov dword [eax + ecx*4], 0x2a44bf8e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1000aa2b
mov eax, dword [ebp - 0x28]
mov ecx, 0xfffc
mov eax, dword [ebp - 0x28]
sub ecx, eax
jne 0x1000aa5e
cmp dword [ebp - 0x48], ebx
jne 0x1000aa5e
xor esi, esi
mov edx, ebx
inc esi
jmp 0x1000aa63
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ebp - 0x344]
xor ecx, ecx
push 0
cmp edx, dword [eax]
mov eax, dword [ebp - 0x90]
setne cl
sub eax, ecx
mov eax, dword [ebp - 0x48]
pop ecx
sets cl
add eax, ecx
cmp eax, dword [ebp - 0x8c]
jle 0x1000aa92
mov edx, esi
cmp dword [ebp - 0x2c], ebx
jne 0x1000aa94
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
sete cl
imul ecx, dword [ebp - 0x20]
mov dword [ebp - 0x8c], ecx
lea ecx, [ebp - 0x64c]
mov dword [ebp - 0x58], 0xb0b030bf
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x64c]
mov dword [eax + 4], 0x9b5f
call fcn.1001795f
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff4
jle 0x1000a95b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344]
call fcn.1001795f
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x14], 0x1f2c29a
mov dword [ebp - 0x20], 0x1e43
cmp dword [ebp - 0x20], 0x871
jge 0x1000aba9
lea eax, [ebp - 0x198]
push eax
push 0x10007b80
call fcn.1005076b
pop ecx
pop ecx
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x198], ecx
jl 0x1000abac
call fcn.10009888
mov esi, eax
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x1b0]
push eax
push 0x10007b80
call fcn.1005076b
pop ecx
xor eax, eax
mov edi, ebx
pop ecx
mov ecx, esi
mov esi, dword [ebp - 0x1b0]
lea ebx, [eax + 1]
cmp ecx, esi
jge 0x1000ab7d
lea eax, [ecx + edi]
add edi, ecx
sub esi, eax
inc ebx
mov ecx, ebx
call fcn.10009888
mov ecx, eax
lea edx, [ecx + edi]
cmp edx, esi
jl 0x1000ab5f
mov dword [ebp - 0x1b0], esi
mov ecx, esi
call fcn.100098a0
push eax
push 0x10007b8c
call fcn.10050db3
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x20]
inc eax
pop ecx
pop ecx
push 0
mov dword [ebp - 0x30], eax
pop ebx
cmp eax, dword [ebp - 0x198]
jle 0x1000ab39
push 3
pop edi
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], ebx
jmp 0x1000abbe
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x410], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1000abb1
push 2
mov dword [ebp - 0x14], ebx
pop esi
cmp dword [ebp - 0x14], esi
jg 0x1000af95
jmp 0x1000abd7
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], 0x54fddd3f
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], esi
jg 0x1000af74
jmp 0x1000abef
xor ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x788]
push edi
call fcn.100177e1
mov dword [ebp - 0x24], ebx
jmp 0x1000ac16
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x788]
mov dword [eax + ecx*4], 0x38330377
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1000ac03
mov dword [ebp - 0x2c], ebx
jmp 0x1000af54
mov dword [ebp - 0x20], 0x217b
cmp dword [ebp - 0x20], 0x1324
jge 0x1000aea3
xor eax, eax
inc eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x84]
push eax
push 0x10007b80
call fcn.1005076b
mov edx, dword [ebp - 0x84]
pop ecx
pop ecx
test edx, edx
je 0x1000aea3
mov eax, ebx
mov dword [ebp - 0x30], eax
test edx, edx
jle 0x1000ac9f
mov ebx, 0x1065efa0
xor edi, edi
test edx, edx
jle 0x1000ac92
mov esi, ebx
push esi
push 0x10007b80
call fcn.1005076b
mov edx, dword [ebp - 0x84]
inc edi
pop ecx
add esi, 4
pop ecx
cmp edi, edx
jl 0x1000ac74
mov eax, dword [ebp - 0x30]
inc eax
add ebx, 0x7c
mov dword [ebp - 0x30], eax
cmp eax, edx
jl 0x1000ac6c
xor ebx, ebx
mov esi, ebx
test edx, edx
jle 0x1000acbf
mov ecx, 0x1065daa0
mov ebx, edx
mov eax, ecx
mov edi, edx
inc esi
mov dword [eax], esi
lea eax, [eax + 4]
dec edi
jne 0x1000acb0
add ecx, 0x7c
dec ebx
jne 0x1000acac
xor eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x28], eax
mov ebx, edx
mov dword [ebp - 0x30], ebx
test edx, edx
jle 0x1000ae52
mov dword [ebp - 0x4c], ecx
mov esi, ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x48], ecx
test al, al
je 0x1000ae52
cmp byte [ebp - 0x28], 0
mov ecx, 0x10007b94
mov ebx, dword [ebp - 0x54]
mov eax, 0x10007b90
cmove eax, ecx
push eax
push ebx
push 0x10007b98
call fcn.10050db3
add esp, 0xc
lea eax, [ebp - 0x84]
inc ebx
mov dword [ebp - 0x54], ebx
push eax
push 0x10007b80
call fcn.1005076b
mov edx, dword [ebp - 0x84]
pop ecx
pop ecx
push 0
pop ebx
test edx, edx
jne 0x1000ac5e
mov dword [ebp - 0x34], 0x8a012e1d
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], ebx
jmp 0x1000af13
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x410], ebx
jne 0x1000af18
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x410]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x1000aefa
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], ebx
jl 0x1000af51
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x30], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x410]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x410], ecx
dec dword [ebp - 0x30]
dec dword [ebp - 0x34]
jns 0x1000af20
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x1000ac23
lea ecx, [ebp - 0x788]
call fcn.1001795f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x1000abec
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000af89
push 0xe26
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1000abd4
mov eax, 0x7412df3d
mov dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x264], eax
lea ecx, [ebp - 0x478]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
xor eax, eax
inc eax
push eax
call fcn.100177e1
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x10], ebx
jmp 0x1000afe5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x690], 0xed9ba07e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000afd4
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x1000b002
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x478]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000aff3
dec dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x264]
mov eax, dword [ebp - 0x68c]
mov eax, dword [ebp - 0x688]
dec dword [ebp - 0x264]
mov eax, dword [ebp - 0x264]
mov eax, dword [ebp - 0x690]
cmp eax, 0x12f3
mov dword [ebp - 0x688], eax
setge cl
xor ebx, ebx
imul ecx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x478]
cmp ecx, edx
mov edx, dword [ebp - 0x1c]
setl bl
xor ecx, ecx
mov dword [eax], ebx
sub edx, ebx
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x478]
call fcn.1001795f
xor ebx, ebx
mov dword [ebp - 0x24], ebx
jmp 0x1000b089
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa9c], 0x951fe77d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1000b078
mov dword [ebp - 0x34], 0x43eb
mov dword [ebp - 0x10], 0x46a1
mov dword [ebp - 0x30], 0xc28cae2f
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
inc eax
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x2aa9
mov eax, 0x83111739
setge cl
xor edx, edx
sub eax, ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x34]
je 0x1000b11d
mov dword [ebp - 0x30], 0xffff
dec dword [ebp - 0x30]
jmp 0x1000b25d
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x48], 0x9622cfb6
mov dword [ebp - 0x58], 0xfecf
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1000b142
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov dword [ebp - 0x10], 0xffffffe3
cmp dword [ebp - 0x10], 0x21
jge 0x1000b25d
xor eax, eax
lea ecx, [ebp - 0x2e0]
inc eax
push eax
call fcn.100177e1
mov dword [ebp - 0x4c], 0x62a4b15
xor edx, edx
mov dword [ebp - 0x30], 0x9b2c3978
inc edx
mov dword [ebp - 0x30], 0xa4d24406
mov dword [ebp - 0x24], ebx
jmp 0x1000b192
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2e0]
mov dword [eax + ecx*4], 0xae8b0121
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1000b17f
mov eax, dword [ebp - 0x2e0]
xor ecx, ecx
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0x2fc53d8b
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
cmp eax, 0x52e2
setge cl
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
inc ecx
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp eax, ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2e0]
setl bl
xor edx, edx
cmp ecx, dword [eax]
setl dl
xor eax, eax
cmp ebx, edx
setge al
xor edx, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setge dl
imul edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2e0]
add edx, dword [eax]
xor eax, eax
cmp edx, 0x5691f3a4
setg al
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x58]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x2e0]
call fcn.1001795f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x21
push 0
pop ebx
jl 0x1000b153
inc dword [ebp - 0x44]
lea ecx, [ebp - 0x598]
push esi
call fcn.100177e1
push 4
lea ecx, [ebp - 0x490]
mov dword [ebp - 4], 5
call fcn.100177e1
push edi
lea ecx, [ebp - 0x610]
mov byte [ebp - 4], 6
call fcn.100177e1
mov dword [ebp - 0x14], ebx
jmp 0x1000b2a8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x598]
mov dword [eax + ecx*4], 0xa87013dc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000b295
mov dword [ebp - 0x14], ebx
jmp 0x1000b2c5
cmp dword [ebp - 0x14], 4
jl 0x1000b2b2