Function at 0x10008fa4
Capabilities:
Check for time delay via gettickcount
Check os version
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008d8ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1720
call fcn.10089270
push esi
push edi
mov dword [ebp - 0x230], 0x90c4d8e5
push 4
lea ecx, [ebp - 0x13e4]
call fcn.1001ae23
and dword [ebp - 4], 0
mov dword [ebp - 0xd0], 0
jmp 0x10008ffc
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jge 0x10009018
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x360], 0xdf75
jmp 0x10008fef
mov dword [ebp - 0xd0], 0
jmp 0x10009031
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 4
jge 0x10009053
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x13e4]
call fcn.1001aec1
mov dword [eax], 0xa912e755
jmp 0x10009024
mov dword [ebp - 0x230], 0
jmp 0x1000906c
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jl 0x10009242
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0xdd8], 0
mov dword [ebp - 0xd80], 0x889a278c
mov dword [ebp - 0x21c], 0
jmp 0x100090b0
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jg 0x1000923d
mov dword [ebp - 0x330], 0x478144ad
mov dword [ebp - 0xf94], 0xfffffff9
mov dword [ebp - 0x330], 0
jmp 0x100090ea
mov eax, dword [ebp - 0x330]
dec eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
jl 0x1000921c
mov dword [ebp - 0x1528], 0xdcc590f0
mov dword [ebp - 0x100c], 0xad7d711e
push 2
lea ecx, [ebp - 0x139c]
call fcn.1001ae23
mov byte [ebp - 4], 1
mov dword [ebp - 0x288], 0
jmp 0x10009135
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jge 0x10009157
push dword [ebp - 0x288]
lea ecx, [ebp - 0x139c]
call fcn.1001aec1
mov dword [eax], 0xcacff8ee
jmp 0x10009128
mov eax, dword [ebp - 0xd80]
dec eax
mov dword [ebp - 0xd80], eax
mov eax, dword [ebp - 0x230]
mov eax, dword [ebp + eax*4 - 0x360]
mov dword [ebp - 0xdd0], eax
push 0
lea ecx, [ebp - 0x139c]
call fcn.1001aec1
mov ecx, dword [ebp - 0xdd0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x21c]
mov ecx, dword [ebp + ecx*4 - 0x360]
sub ecx, dword [ebp - 0xdd0]
cmp ecx, dword [ebp + eax*4 - 0x360]
je 0x100091ba
mov dword [ebp - 0xde0], 1
jmp 0x100091c1
and dword [ebp - 0xde0], 0
mov eax, dword [ebp - 0xf94]
mov dword [ebp - 0x1474], eax
mov eax, dword [ebp - 0xdd8]
sub eax, dword [ebp - 0xdd8]
mov ecx, dword [ebp - 0xde0]
add ecx, eax
mov dword [ebp - 0xde8], ecx
push 0
lea ecx, [ebp - 0x13e4]
call fcn.1001aec1
mov ecx, dword [ebp - 0xde8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xde8]
mov dword [ebp - 0x100c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x139c]
call fcn.1001aea5
jmp 0x100090dd
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x10009238
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x100090a3
jmp 0x1000905f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13e4]
call fcn.1001aea5
mov dword [ebp - 0x258], 0x90c4d8e5
push 4
lea ecx, [ebp - 0x1378]
call fcn.1001ae23
mov dword [ebp - 4], 2
mov dword [ebp - 0xac], 0
jmp 0x10009288
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x100092a4
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x418], 0xdf75
jmp 0x1000927b
mov dword [ebp - 0xac], 0
jmp 0x100092bd
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 4
jge 0x100092df
push dword [ebp - 0xac]
lea ecx, [ebp - 0x1378]
call fcn.1001aec1
mov dword [eax], 0xa912e755
jmp 0x100092b0
mov dword [ebp - 0x258], 0
jmp 0x100092f8
mov eax, dword [ebp - 0x258]
dec eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
jl 0x100094ce
mov dword [ebp - 0x210], 0xffffffff
mov dword [ebp - 0xe00], 0
mov dword [ebp - 0xdf0], 0x889a278c
mov dword [ebp - 0x210], 0
jmp 0x1000933c
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jg 0x100094c9
mov dword [ebp - 0x2f0], 0x478144ad
mov dword [ebp - 0x1014], 0xfffffff9
mov dword [ebp - 0x2f0], 0
jmp 0x10009376
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0
jl 0x100094a8
mov dword [ebp - 0x157c], 0xdcc590f0
mov dword [ebp - 0x101c], 0xad7d711e
push 2
lea ecx, [ebp - 0x1390]
call fcn.1001ae23
mov byte [ebp - 4], 3
mov dword [ebp - 0x290], 0
jmp 0x100093c1
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 2
jge 0x100093e3
push dword [ebp - 0x290]
lea ecx, [ebp - 0x1390]
call fcn.1001aec1
mov dword [eax], 0xcacff8ee
jmp 0x100093b4
mov eax, dword [ebp - 0xdf0]
dec eax
mov dword [ebp - 0xdf0], eax
mov eax, dword [ebp - 0x258]
mov eax, dword [ebp + eax*4 - 0x418]
mov dword [ebp - 0xdf8], eax
push 0
lea ecx, [ebp - 0x1390]
call fcn.1001aec1
mov ecx, dword [ebp - 0xdf8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x210]
mov ecx, dword [ebp + ecx*4 - 0x418]
sub ecx, dword [ebp - 0xdf8]
cmp ecx, dword [ebp + eax*4 - 0x418]
je 0x10009446
mov dword [ebp - 0xe34], 1
jmp 0x1000944d
and dword [ebp - 0xe34], 0
mov eax, dword [ebp - 0x1014]
mov dword [ebp - 0x147c], eax
mov eax, dword [ebp - 0xe00]
sub eax, dword [ebp - 0xe00]
mov ecx, dword [ebp - 0xe34]
add ecx, eax
mov dword [ebp - 0xe3c], ecx
push 0
lea ecx, [ebp - 0x1378]
call fcn.1001aec1
mov ecx, dword [ebp - 0xe3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe3c]
mov dword [ebp - 0x101c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1390]
call fcn.1001aea5
jmp 0x10009369
mov byte [ebp - 0x1c9], 0
movzx eax, byte [ebp - 0x1c9]
test eax, eax
je 0x100094c4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1000932f
jmp 0x100092eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1378]
call fcn.1001aea5
mov dword [ebp - 0x134], 0xcea5d6c0
mov dword [ebp - 0x134], 0
jmp 0x10009500
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 5
jle 0x1000955d
mov dword [ebp - 0x104c], 0xdd03248c
mov dword [ebp - 0x348], 0
jmp 0x1000952c
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 1
jge 0x10009548
mov eax, dword [ebp - 0x348]
mov dword [ebp + eax*4 - 0x1054], 0xfffffff6
jmp 0x1000951f
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x104c]
mov dword [ebp + eax - 0x1054], ecx
jmp 0x100094f3
mov dword [ebp - 0x134], 0xffffffe6
jmp 0x10009576
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xb
je 0x10009675
mov dword [ebp - 0x228], 0xef307d7
push 3
lea ecx, [ebp - 0x12d0]
call fcn.1001ae23
mov dword [ebp - 4], 4
mov dword [ebp - 0x298], 0
jmp 0x100095ba
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 3
jge 0x100095dc
push dword [ebp - 0x298]
lea ecx, [ebp - 0x12d0]
call fcn.1001aec1
mov dword [eax], 0x44a75432
jmp 0x100095ad
cmp dword [ebp - 0x228], 0
je 0x100095ff
mov byte [ebp - 0x173], 0
movzx eax, byte [ebp - 0x173]
test eax, eax
je 0x100095fd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x10009661
mov dword [ebp - 0x105c], 1
mov dword [ebp - 0x228], 0
jmp 0x10009622
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jg 0x10009647
mov byte [ebp - 0x191], 0
movzx eax, byte [ebp - 0x191]
test eax, eax
je 0x10009645
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x10009615
cmp dword [ebp - 0x105c], 0
je 0x10009661
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12d0]
call fcn.1001aea5
jmp 0x10009675
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12d0]
call fcn.1001aea5
jmp 0x10009569
push 2
lea ecx, [ebp - 0x15b8]
call fcn.1001ae23
mov dword [ebp - 4], 5
mov dword [ebp - 0x2a0], 0x9bdba76a
mov dword [ebp - 0x161c], 0xadae8c9f
mov dword [ebp - 0x2f8], 0
jmp 0x100096b6
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 2
jge 0x100096d8
push dword [ebp - 0x2f8]
lea ecx, [ebp - 0x15b8]
call fcn.1001aec1
mov dword [eax], 7
jmp 0x100096a9
mov dword [ebp - 0x2a0], 0
jmp 0x100096f1
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 1
jg 0x10009713
mov dword [ebp - 0xe44], 0x7f2fb5a5
mov eax, dword [ebp - 0xe44]
dec eax
mov dword [ebp - 0xe44], eax
jmp 0x100096e4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15b8]
call fcn.1001aea5
mov dword [ebp - 0xec], 1
mov dword [ebp - 0x328], 0
jmp 0x10009745
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 1
jge 0x10009761
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0x368], 0xb0647dc4
jmp 0x10009738
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x10009779
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0xec], 0
jmp 0x10009792
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x19
jge 0x10009b1a
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x6c], 0xfffffff7
mov dword [ebp - 0x107c], 2
mov dword [ebp - 0x54], 0
jmp 0x100097c7
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jg 0x10009932
mov eax, dword [ebp - 0x54]
dec eax
cmp eax, dword [ebp - 0x54]
jle 0x100097e6
mov dword [ebp - 0xe4c], 1
jmp 0x100097ed
and dword [ebp - 0xe4c], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x368]
mov ecx, dword [ebp - 0x54]
imul eax, dword [ebp + ecx*4 - 0x368]
sub eax, dword [ebp - 0xec]
add eax, dword [ebp - 0xe4c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 0
jmp 0x10009821
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jg 0x1000992d
mov dword [ebp - 0x300], 0x3c67ee39
push 2
lea ecx, [ebp - 0x13b4]
call fcn.1001ae23
mov dword [ebp - 4], 6
mov dword [ebp - 0x2a8], 0
jmp 0x10009862
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 2
jge 0x10009881
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0x13b4]
call fcn.1001aec1
or dword [eax], 0xffffffff
jmp 0x10009855
mov dword [ebp - 0x300], 0
jmp 0x1000989a
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0
jl 0x10009919
mov dword [ebp - 0x1064], 0
push 1
lea ecx, [ebp - 0x13b4]
call fcn.1001aec1
mov dword [eax], 0x5fff839e
mov eax, 0x5fff839e
test eax, eax
je 0x100098e2
mov eax, dword [ebp - 0x6c]
cmp dword [ebp + eax*4 - 0x368], 0
je 0x100098e2
mov dword [ebp - 0xe08], 1
jmp 0x100098e9
and dword [ebp - 0xe08], 0
cmp dword [ebp - 0xe08], 0xbb9
jne 0x10009901
mov dword [ebp - 0xa04], 1
jmp 0x10009908
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0x1064], eax
jmp 0x1000988d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13b4]
call fcn.1001aea5
jmp 0x1000981a
jmp 0x100097c0
mov dword [ebp - 0x54], 0
jmp 0x10009942
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jl 0x10009b15
mov dword [ebp - 0x1074], 0x68927649
mov dword [ebp - 0x6c], 0
jmp 0x10009966
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 9
jg 0x10009b10
mov dword [ebp - 0x340], 9
mov dword [ebp - 0x42c], 1
push 3
lea ecx, [ebp - 0x12e8]
call fcn.1001ae23
mov dword [ebp - 4], 7
mov dword [ebp - 0x2b0], 0
jmp 0x100099b1
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 3
jge 0x100099d3
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0x12e8]
call fcn.1001aec1
mov dword [eax], 0xdc4b54c5
jmp 0x100099a4
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0xffffffff
jle 0x10009a00
mov dword [ebp - 0x106c], 1
jmp 0x10009a07
and dword [ebp - 0x106c], 0
cmp dword [ebp - 0xec], 0
je 0x10009a51
mov eax, dword [ebp - 0x1074]
mov dword [ebp - 0x1484], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x1584], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x148c], eax
cmp dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x42c]
add eax, 0x2059515e
je 0x10009a51
mov dword [ebp - 0x524], 1
jmp 0x10009a58
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x524], eax
jne 0x10009a6f
mov dword [ebp - 0xa0c], 1
jmp 0x10009a76
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0xa0c]
sub eax, dword [ebp - 0x54]
cmp eax, 0xfffffffb
jge 0x10009a94
xor eax, eax
je 0x10009a94
mov dword [ebp - 0x52c], 1
jmp 0x10009a9b
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0xec]
imul eax, dword [ebp - 0x52c]
add eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x107c]
cmp eax, dword [ebp - 0xec]
je 0x10009ac6
mov dword [ebp - 0xa14], 1
jmp 0x10009acd
and dword [ebp - 0xa14], 0
push 0
lea ecx, [ebp - 0x12e8]
call fcn.1001aec1
mov ecx, dword [ebp - 0xa14]
mov dword [eax], ecx
mov byte [ebp - 0x1b9], 0
movzx eax, byte [ebp - 0x1b9]
test eax, eax
je 0x10009afc
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12e8]
call fcn.1001aea5
jmp 0x1000995f
jmp 0x1000993b
jmp 0x10009785
mov dword [ebp - 0x238], 0x90c4d8e5
push 4
lea ecx, [ebp - 0x1300]
call fcn.1001ae23
mov dword [ebp - 4], 8
push 1
lea ecx, [ebp - 0x1f8]
call fcn.1001ae23
mov byte [ebp - 4], 9
mov dword [ebp - 0xa4c], 0xf844ba92
mov dword [ebp - 0x1084], 0xffffffff
mov dword [ebp - 0xb4], 0
jmp 0x10009b76
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x10009b98
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
mov dword [eax], 0xae8c9f36
jmp 0x10009b69
mov dword [ebp - 0xb4], 0
jmp 0x10009bb1
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x10009bcd
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x1670], 1
jmp 0x10009ba4
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
cmp dword [eax], 0
jne 0x10009beb
mov dword [ebp - 0x534], 1
jmp 0x10009bf2
and dword [ebp - 0x534], 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
mov esi, dword [ebp - 0x534]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
cmp esi, dword [eax]
je 0x10009c24
mov dword [ebp - 0xa1c], 1
jmp 0x10009c2b
and dword [ebp - 0xa1c], 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa1c]
jge 0x10009c4e
mov dword [ebp - 0x53c], 1
jmp 0x10009c55
and dword [ebp - 0x53c], 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
mov ecx, dword [ebp - 0x53c]
cmp ecx, dword [eax]
jl 0x10009c78
mov dword [ebp - 0xa24], 1
jmp 0x10009c7f
and dword [ebp - 0xa24], 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
mov esi, dword [ebp - 0xa24]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
cmp esi, dword [eax]
je 0x10009cb1
mov dword [ebp - 0x544], 1
jmp 0x10009cb8
and dword [ebp - 0x544], 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
mov ecx, dword [ebp - 0x544]
cmp ecx, dword [eax]
je 0x10009cdb
mov dword [ebp - 0xa2c], 1
jmp 0x10009ce2
and dword [ebp - 0xa2c], 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
mov ecx, dword [ebp - 0xa2c]
cmp ecx, dword [eax]
jle 0x10009d14
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
cmp dword [eax], 0
jne 0x10009d14
and dword [ebp - 0x54c], 0
jmp 0x10009d1e
mov dword [ebp - 0x54c], 1
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
mov eax, dword [eax]
cmp eax, dword [ebp - 0x54c]
jge 0x10009d41
mov dword [ebp - 0xa34], 1
jmp 0x10009d48
and dword [ebp - 0xa34], 0
cmp dword [ebp - 0xa34], 0xffffffff
jle 0x10009d5d
mov dword [ebp - 0x554], 1
jmp 0x10009d64
and dword [ebp - 0x554], 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
mov ecx, dword [ebp - 0x554]
cmp ecx, dword [eax]
jge 0x10009d87
mov dword [ebp - 0xa3c], 1
jmp 0x10009d8e
and dword [ebp - 0xa3c], 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
mov esi, dword [ebp - 0xa3c]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
cmp esi, dword [eax]
je 0x10009dc0
mov dword [ebp - 0x55c], 1
jmp 0x10009dc7
and dword [ebp - 0x55c], 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
mov ecx, dword [ebp - 0x55c]
cmp ecx, dword [eax]
jle 0x10009dea
mov dword [ebp - 0xa44], 1
jmp 0x10009df1
and dword [ebp - 0xa44], 0
cmp dword [ebp - 0xa44], 0x2d29
je 0x10009e09
mov dword [ebp - 0x564], 1
jmp 0x10009e10
and dword [ebp - 0x564], 0
imul eax, dword [ebp - 0x564], 0x7d41
mov dword [ebp - 0xa4c], eax
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
mov esi, eax
mov edi, dword [ebp - 0xa4c]
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
add edi, dword [eax]
cmp dword [esi], edi
je 0x10009e54
mov dword [ebp - 0x370], 1
jmp 0x10009e5b
and dword [ebp - 0x370], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x370]
mov dword [ebp + eax - 0x1670], ecx
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
mov esi, dword [ebp - 0x370]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x1f8]
call fcn.1001aec1
sub esi, dword [eax]
mov dword [ebp - 0x1084], esi
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1f8]
call fcn.1001aea5
mov dword [ebp - 0x10c], 0
jmp 0x10009ec0
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x10009edc
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x380], 0xdf75
jmp 0x10009eb3
mov dword [ebp - 0x10c], 0
jmp 0x10009ef5
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 4
jge 0x10009f17
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x1300]
call fcn.1001aec1
mov dword [eax], 0xa912e755
jmp 0x10009ee8
mov dword [ebp - 0x238], 0
jmp 0x10009f30
mov eax, dword [ebp - 0x238]
dec eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jl 0x1000a106
mov dword [ebp - 0x224], 0xffffffff
mov dword [ebp - 0x574], 0
mov dword [ebp - 0x56c], 0x889a278c
mov dword [ebp - 0x224], 0
jmp 0x10009f74
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jg 0x1000a101
mov dword [ebp - 0x2b8], 0x478144ad
mov dword [ebp - 0x108c], 0xfffffff9
mov dword [ebp - 0x2b8], 0
jmp 0x10009fae
mov eax, dword [ebp - 0x2b8]
dec eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jl 0x1000a0e0
mov dword [ebp - 0x15fc], 0xdcc590f0
mov dword [ebp - 0x1094], 0xad7d711e
push 2
lea ecx, [ebp - 0x13cc]
call fcn.1001ae23
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x308], 0
jmp 0x10009ff9
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 2
jge 0x1000a01b
push dword [ebp - 0x308]
lea ecx, [ebp - 0x13cc]
call fcn.1001aec1
mov dword [eax], 0xcacff8ee
jmp 0x10009fec
mov eax, dword [ebp - 0x56c]
dec eax
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x238]
mov eax, dword [ebp + eax*4 - 0x380]
mov dword [ebp - 0xa54], eax
push 0
lea ecx, [ebp - 0x13cc]
call fcn.1001aec1
mov ecx, dword [ebp - 0xa54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x224]
mov ecx, dword [ebp + ecx*4 - 0x380]
sub ecx, dword [ebp - 0xa54]
cmp ecx, dword [ebp + eax*4 - 0x380]
je 0x1000a07e
mov dword [ebp - 0xa5c], 1
jmp 0x1000a085
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0x108c]
mov dword [ebp - 0x14c8], eax
mov eax, dword [ebp - 0x574]
sub eax, dword [ebp - 0x574]
mov ecx, dword [ebp - 0xa5c]
add ecx, eax
mov dword [ebp - 0x57c], ecx
push 0
lea ecx, [ebp - 0x1300]
call fcn.1001aec1
mov ecx, dword [ebp - 0x57c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x1094], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x13cc]
call fcn.1001aea5
jmp 0x10009fa1
mov byte [ebp - 0x177], 0
movzx eax, byte [ebp - 0x177]
test eax, eax
je 0x1000a0fc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x10009f67
jmp 0x10009f23
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1300]
call fcn.1001aea5
mov dword [ebp - 0x154], 0xcea5d6c0
mov dword [ebp - 0x154], 0
jmp 0x1000a138
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 5
jle 0x1000a195
mov dword [ebp - 0x109c], 0xdd03248c
mov dword [ebp - 0x2c0], 0
jmp 0x1000a164
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 1
jge 0x1000a180
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x10a4], 0xfffffff6
jmp 0x1000a157
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x109c]
mov dword [ebp + eax - 0x10a4], ecx
jmp 0x1000a12b
mov dword [ebp - 0x154], 0xffffffe6
jmp 0x1000a1ae
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xb
je 0x1000a2ad
mov dword [ebp - 0x278], 0xef307d7
push 3
lea ecx, [ebp - 0x13c0]
call fcn.1001ae23
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x280], 0
jmp 0x1000a1f2
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
jge 0x1000a214
push dword [ebp - 0x280]
lea ecx, [ebp - 0x13c0]
call fcn.1001aec1
mov dword [eax], 0x44a75432
jmp 0x1000a1e5
cmp dword [ebp - 0x278], 0
je 0x1000a237
mov byte [ebp - 0x199], 0
movzx eax, byte [ebp - 0x199]
test eax, eax
je 0x1000a235
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1000a299
mov dword [ebp - 0x10ac], 1
mov dword [ebp - 0x278], 0
jmp 0x1000a25a
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 2
jg 0x1000a27f
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x1000a27d
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x1000a24d
cmp dword [ebp - 0x10ac], 0
je 0x1000a299
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c0]
call fcn.1001aea5
jmp 0x1000a2ad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c0]
call fcn.1001aea5
jmp 0x1000a1a1
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x188], 0x90e69cd1
push 1
lea ecx, [ebp - 0x1318]
call fcn.1001ae23
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xbc], 0
jmp 0x1000a2eb
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x1000a307
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x4c0], 0xfffffffe
jmp 0x1000a2de
mov dword [ebp - 0xbc], 0
jmp 0x1000a320
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x1000a342
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x1318]
call fcn.1001aec1
mov dword [eax], 0x8fb5c4ce
jmp 0x1000a313
mov dword [ebp - 0x48], 2
jmp 0x1000a352
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x1000a615
mov dword [ebp - 0x94], 0x76ff55e0
mov dword [ebp - 0x94], 2
jmp 0x1000a37f
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x1000a5b1
mov dword [ebp - 0x384], 0x51c8
mov dword [ebp - 0x358], 0xa0e1c2a9
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4c0], 0
je 0x1000a3c8
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x4c0], 0
je 0x1000a3c8
mov dword [ebp - 0xa64], 1
jmp 0x1000a3cf
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x4c0]
cmp dword [ebp - 0xa64], eax
jge 0x1000a3f3
cmp dword [ebp - 0x94], 0
jne 0x1000a3f3
and dword [ebp - 0x584], 0
jmp 0x1000a3fd
mov dword [ebp - 0x584], 1
cmp dword [ebp - 0x584], 1
jl 0x1000a412
mov dword [ebp - 0x10b4], 1
jmp 0x1000a419
and dword [ebp - 0x10b4], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x4c0]
mov dword [ebp - 0x1628], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x4c0]
imul ecx, dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x48]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x4c0]
cmp dword [ebp + eax*4 - 0x4c0], ecx
jl 0x1000a45f
mov dword [ebp - 0x378], 1
jmp 0x1000a466
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x378]
mov dword [ebp + eax*4 - 0x4c0], ecx
cmp dword [ebp - 0x378], 0xfffffff9
jle 0x1000a48b
mov dword [ebp - 0xa6c], 1
jmp 0x1000a492
and dword [ebp - 0xa6c], 0
cmp dword [ebp - 0xa6c], 0xb060
jge 0x1000a4aa
mov dword [ebp - 0x58c], 1
jmp 0x1000a4b1
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x384]
cmp dword [ebp - 0x58c], eax
jg 0x1000a4cb
mov dword [ebp - 0xa74], 1
jmp 0x1000a4d2
and dword [ebp - 0xa74], 0
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x384]
cmp dword [ebp - 0x188], eax
je 0x1000a4f8
mov dword [ebp - 0x594], 1
jmp 0x1000a4ff
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
sub eax, dword [ebp - 0x48]
cmp eax, 0xfffffffe
jbe 0x1000a519
mov dword [ebp - 0xa7c], 1
jmp 0x1000a520
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xa7c], eax
je 0x1000a537
mov dword [ebp - 0x59c], 1
jmp 0x1000a53e
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x59c], eax
jg 0x1000a55a
or eax, 0xffffffff
je 0x1000a55a
mov dword [ebp - 0xa84], 1
jmp 0x1000a561
and dword [ebp - 0xa84], 0
cmp dword [ebp - 0xa84], 0
jne 0x1000a576
mov dword [ebp - 0x5a4], 1
jmp 0x1000a57d
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x358], eax
mov esi, dword [ebp - 0x358]
push 0
lea ecx, [ebp - 0x1318]
call fcn.1001aec1
mov dword [eax], esi
cmp dword [ebp - 0x358], 0
je 0x1000a5ac
jmp 0x1000a372
jmp 0x1000a372
mov dword [ebp - 0x94], 0
jmp 0x1000a5ca
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jg 0x1000a610
mov dword [ebp - 0x188], 0
jmp 0x1000a5ec
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x1000a60e
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x4bc]
mov dword [ebp + ecx*4 - 0x4c0], eax
jmp 0x1000a5df
jmp 0x1000a5bd
jmp 0x1000a34b
mov byte [ebp - 0x1d9], 0
movzx eax, byte [ebp - 0x1d9]
test eax, eax
je 0x1000a63e
push 0
push 0x26a5
push 0x1046
push 0x18e9
call dword [sym.imp.KERNEL32.dll_RaiseException]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1318]
call fcn.1001aea5
mov dword [ebp - 0x13c], 0xcea5d6c0
mov dword [ebp - 0x13c], 0
jmp 0x1000a670
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 5
jle 0x1000a6cd
mov dword [ebp - 0x10bc], 0xdd03248c
mov dword [ebp - 0x2c8], 0
jmp 0x1000a69c
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jge 0x1000a6b8
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0x10c4], 0xfffffff6
jmp 0x1000a68f
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10bc]
mov dword [ebp + eax - 0x10c4], ecx
jmp 0x1000a663
mov dword [ebp - 0x13c], 0xffffffe6
jmp 0x1000a6e6
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xb
je 0x1000a7e5
mov dword [ebp - 0x240], 0xef307d7
push 3
lea ecx, [ebp - 0x13a8]
call fcn.1001ae23
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x310], 0
jmp 0x1000a72a
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 3
jge 0x1000a74c
push dword [ebp - 0x310]
lea ecx, [ebp - 0x13a8]
call fcn.1001aec1
mov dword [eax], 0x44a75432
jmp 0x1000a71d
cmp dword [ebp - 0x240], 0
je 0x1000a76f
mov byte [ebp - 0x17b], 0
movzx eax, byte [ebp - 0x17b]
test eax, eax
je 0x1000a76d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1000a7d1
mov dword [ebp - 0x10cc], 1
mov dword [ebp - 0x240], 0
jmp 0x1000a792
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jg 0x1000a7b7
mov byte [ebp - 0x1a1], 0
movzx eax, byte [ebp - 0x1a1]
test eax, eax
je 0x1000a7b5
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x1000a785
cmp dword [ebp - 0x10cc], 0
je 0x1000a7d1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13a8]
call fcn.1001aea5
jmp 0x1000a7e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13a8]
call fcn.1001aea5
jmp 0x1000a6d9
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x10dc], 3
mov dword [ebp - 0x5c4], 8
mov dword [ebp - 0x10e4], 0x3cbf
mov dword [ebp - 0xab4], 0x9fdb81fd
mov dword [ebp - 0x10ec], 0xfffffffd
mov dword [ebp - 0x5c], 0
jmp 0x1000a82e
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xffffffe4
jne 0x1000a84b
mov dword [ebp - 0x10d4], 0xe871
cmp dword [ebp - 0x10d4], 0
je 0x1000a849
jmp 0x1000a84b
jmp 0x1000a827
mov dword [ebp - 0x5c], 0
jmp 0x1000a85b
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffff9
jle 0x1000aa0a
mov dword [ebp - 0x2d0], 0xb6fe6d39
mov dword [ebp - 0x5b4], 0x1300ca3c
cmp dword [ebp - 0x5c], 0
je 0x1000a8c6
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x10dc], eax
cmp dword [ebp - 0x5b4], 0x78c9dffb
jne 0x1000a8a0
mov dword [ebp - 0xa8c], 1
jmp 0x1000a8a7
and dword [ebp - 0xa8c], 0
cmp dword [ebp - 0xa8c], 1
ja 0x1000a8bc
mov dword [ebp - 0x5ac], 1
jmp 0x1000a8c3
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x2d0]
sub eax, 0xc4ce
cmp eax, dword [ebp - 0x5c]
jl 0x1000a8e2
mov dword [ebp - 0xa94], 1
jmp 0x1000a8e9
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0x2d0]
sub eax, dword [ebp - 0xa94]
jne 0x1000a8fe
cmp dword [ebp - 0x2d0], 0
or eax, 0xffffffff
neg eax
cmp eax, dword [ebp - 0x2d0]
jl 0x1000a920
cmp dword [ebp - 0x5b4], 0
je 0x1000a920
mov dword [ebp - 0xa9c], 1
jmp 0x1000a927
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0xa9c], eax
jne 0x1000a93e
mov dword [ebp - 0x5bc], 1
jmp 0x1000a945
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0x4356
jne 0x1000a95d
mov dword [ebp - 0xaa4], 1
jmp 0x1000a964
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0xaa4]
mov dword [ebp - 0x5c4], eax
mov eax, dword [ebp - 0x5c4]
sub eax, dword [ebp - 0x10e4]
jne 0x1000a990
cmp dword [ebp - 0xab4], 0
jne 0x1000a990
and dword [ebp - 0xaac], 0
jmp 0x1000a99a
mov dword [ebp - 0xaac], 1
cmp dword [ebp - 0xaac], 0xbe86de1f
jb 0x1000a9b2
mov dword [ebp - 0x5cc], 1
jmp 0x1000a9b9
and dword [ebp - 0x5cc], 0
cmp dword [ebp - 0x5cc], 0x17c264f8
jle 0x1000a9d1
mov dword [ebp - 0x5d4], 1
jmp 0x1000a9d8
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0xab4]
cmp dword [ebp - 0x5d4], eax
jge 0x1000a9f2
mov dword [ebp - 0xabc], 1
jmp 0x1000a9f9
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0x10ec], eax
jmp 0x1000a854
mov dword [ebp - 0x58], 6
mov dword [ebp - 0x190], 0x90e69cd1
push 1
lea ecx, [ebp - 0x1330]
call fcn.1001ae23
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xf4], 0
jmp 0x1000aa48
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 3
jge 0x1000aa64
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x4d8], 0xfffffffe
jmp 0x1000aa3b
mov dword [ebp - 0xf4], 0
jmp 0x1000aa7d
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x1000aa9f
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x1330]
call fcn.1001aec1
mov dword [eax], 0x8fb5c4ce
jmp 0x1000aa70
mov dword [ebp - 0x58], 2
jmp 0x1000aaaf
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x1000ad72
mov dword [ebp - 0xc4], 0x76ff55e0
mov dword [ebp - 0xc4], 2
jmp 0x1000aadc
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jl 0x1000ad0e
mov dword [ebp - 0x388], 0x51c8
mov dword [ebp - 0x434], 0xa0e1c2a9
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4d8], 0
je 0x1000ab25
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x4d8], 0
je 0x1000ab25
mov dword [ebp - 0x5dc], 1
jmp 0x1000ab2c
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x4d8]
cmp dword [ebp - 0x5dc], eax
jge 0x1000ab50
cmp dword [ebp - 0xc4], 0
jne 0x1000ab50
and dword [ebp - 0xac4], 0
jmp 0x1000ab5a
mov dword [ebp - 0xac4], 1
cmp dword [ebp - 0xac4], 1
jl 0x1000ab6f
mov dword [ebp - 0x10f4], 1
jmp 0x1000ab76
and dword [ebp - 0x10f4], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x4d8]
mov dword [ebp - 0x14d4], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x4d8]
imul ecx, dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x58]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x4d8]
cmp dword [ebp + eax*4 - 0x4d8], ecx
jl 0x1000abbc
mov dword [ebp - 0x38c], 1
jmp 0x1000abc3
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x38c]
mov dword [ebp + eax*4 - 0x4d8], ecx
cmp dword [ebp - 0x38c], 0xfffffff9
jle 0x1000abe8
mov dword [ebp - 0x5e4], 1
jmp 0x1000abef
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 0xb060
jge 0x1000ac07
mov dword [ebp - 0xacc], 1
jmp 0x1000ac0e
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0xacc], eax
jg 0x1000ac28
mov dword [ebp - 0x5ec], 1
jmp 0x1000ac2f
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x190], eax
je 0x1000ac55
mov dword [ebp - 0xad4], 1
jmp 0x1000ac5c
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0xad4]
sub eax, dword [ebp - 0x58]
cmp eax, 0xfffffffe
jbe 0x1000ac76
mov dword [ebp - 0x5f4], 1
jmp 0x1000ac7d
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x5f4], eax
je 0x1000ac94
mov dword [ebp - 0xadc], 1
jmp 0x1000ac9b
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0xadc], eax
jg 0x1000acb7
or eax, 0xffffffff
je 0x1000acb7
mov dword [ebp - 0x5fc], 1
jmp 0x1000acbe
and dword [ebp - 0x5fc], 0
cmp dword [ebp - 0x5fc], 0
jne 0x1000acd3
mov dword [ebp - 0xae4], 1
jmp 0x1000acda
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0x434], eax
mov esi, dword [ebp - 0x434]
push 0
lea ecx, [ebp - 0x1330]
call fcn.1001aec1
mov dword [eax], esi
cmp dword [ebp - 0x434], 0
je 0x1000ad09
jmp 0x1000aacf
jmp 0x1000aacf
mov dword [ebp - 0xc4], 0
jmp 0x1000ad27
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jg 0x1000ad6d
mov dword [ebp - 0x190], 0
jmp 0x1000ad49
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jl 0x1000ad6b
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x4d4]
mov dword [ebp + ecx*4 - 0x4d8], eax
jmp 0x1000ad3c
jmp 0x1000ad1a
jmp 0x1000aaa8
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x1000ad9b
push 0
push 0x26a5
push 0x1046
push 0x18e9
call dword [sym.imp.KERNEL32.dll_RaiseException]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1330]
call fcn.1001aea5
mov dword [ebp - 0x260], 0x46db5052
mov dword [ebp - 0x220], 0xfffffff6
push 1
lea ecx, [ebp - 0x121c]
call fcn.1001ae23
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x350], 0
jmp 0x1000adeb
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 1
jge 0x1000ae0d
push dword [ebp - 0x350]
lea ecx, [ebp - 0x121c]
call fcn.1001aec1
mov dword [eax], 1
jmp 0x1000adde
cmp dword [ebp - 0x260], 0x1f66
jg 0x1000ae25
mov dword [ebp - 0x604], 1
jmp 0x1000ae2c
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x220], 0
jmp 0x1000ae51
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jge 0x1000b2f6
push 2
lea ecx, [ebp - 0x1240]
call fcn.1001ae23
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x614], 0x9c2b2e5f
mov dword [ebp - 0x2d8], 0
jmp 0x1000ae92
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 2
jge 0x1000aeb4
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0x1240]
call fcn.1001aec1
mov dword [eax], 0xf5f49900
jmp 0x1000ae85
mov byte [ebp - 0x1c1], 0
movzx eax, byte [ebp - 0x1c1]
test eax, eax
je 0x1000aedc
push 0
push 0
push 0x15b5
push 0x26ac
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov dword [ebp - 0x260], 0
jmp 0x1000aef5
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0xa
jle 0x1000b2e2
mov dword [ebp - 0x11c], 0xfffffffd
mov dword [ebp - 0x11c], 1
jmp 0x1000af25
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jl 0x1000b2ca
mov dword [ebp - 0x12a0], 0xdfa831eb
mov dword [ebp - 0x129c], 0xdfa831eb
mov dword [ebp - 0x1298], 0xdfa831eb
mov dword [ebp - 0x1294], 0xdfa831eb
lea ecx, [ebp - 0x49a]
call fcn.10008d63
push eax
lea eax, [ebp - 0x1290]
push eax
lea eax, [ebp - 0x12a0]
push eax
lea ecx, [ebp - 0x16cc]
call fcn.1001aed0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xec4]
call fcn.1001ae7f
mov byte [ebp - 4], 0x11
push 2
lea ecx, [ebp - 0x118c]
call fcn.1001ae23
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x1124], 0
mov dword [ebp - 0x318], 0
jmp 0x1000afc7
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 2
jge 0x1000afe6
push dword [ebp - 0x318]
lea ecx, [ebp - 0x118c]
call fcn.1001aec1
or dword [eax], 0xffffffff
jmp 0x1000afba
push 2
lea ecx, [ebp - 0xec4]
call fcn.1001aec1
and dword [eax], 0
jmp 0x1000b01c
push 2
lea ecx, [ebp - 0xec4]
call fcn.1001aec1
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xaec]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xaec]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xec4]
call fcn.1001aec1
cmp dword [eax], 1
jg 0x1000b2a7
mov dword [ebp - 0x248], 0x35edade0
mov dword [ebp - 0x60c], 1
mov dword [ebp - 0x248], 1
jmp 0x1000b05f
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jl 0x1000b2a2
push 1
lea ecx, [ebp - 0x118c]
call fcn.1001aec1
cmp dword [eax], 0
jne 0x1000b143
push 2
lea ecx, [ebp - 0xec4]
call fcn.1001aec1
mov eax, dword [eax]
mov dword [ebp - 0x60c], eax
xor eax, eax
inc eax
je 0x1000b0b1
cmp dword [ebp - 0x60c], 0
je 0x1000b0b1
mov dword [ebp - 0xaf4], 1
jmp 0x1000b0b8
and dword [ebp - 0xaf4], 0
mov eax, dword [ebp - 0xaf4]
sub eax, dword [ebp - 0x11c]
cmp eax, 0x7fd0
je 0x1000b0d7
mov dword [ebp - 0x10fc], 1
jmp 0x1000b0de
and dword [ebp - 0x10fc], 0
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x1594], eax
push 1
lea ecx, [ebp - 0xec4]
call fcn.1001aec1
push 1
lea ecx, [ebp - 0x118c]
call fcn.1001aec1
mov esi, eax
push 0
lea ecx, [ebp - 0xec4]
call fcn.1001aec1
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x1000b125
mov dword [ebp - 0xafc], 1
jmp 0x1000b12c
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0x614]
add eax, dword [ebp - 0xafc]
jne 0x1000b143
and dword [ebp - 0x61c], 0
jmp 0x1000b14d
mov dword [ebp - 0x61c], 1
cmp dword [ebp - 0x61c], 0
jb 0x1000b162
mov dword [ebp - 0x1104], 1
jmp 0x1000b169
and dword [ebp - 0x1104], 0
push dword [ebp - 0x248]
lea ecx, [ebp - 0x1240]
call fcn.1001aec1
mov dword [ebp - 0xb04], eax
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x1240]
call fcn.1001aec1
mov ecx, dword [ebp - 0xb04]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0xb04]
cmp dword [ecx], eax
jl 0x1000b1b7
mov dword [ebp - 0x624], 1
jmp 0x1000b1be
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 0x19d88c83
jge 0x1000b1df
mov eax, 0xa703
test eax, eax
je 0x1000b1df
mov dword [ebp - 0xb0c], 1
jmp 0x1000b1e6
and dword [ebp - 0xb0c], 0
cmp dword [ebp - 0xb0c], 0x1efae07d
jg 0x1000b1fe
mov dword [ebp - 0x62c], 1
jmp 0x1000b205
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 0xfffffffe
jg 0x1000b21a
mov dword [ebp - 0xb14], 1
jmp 0x1000b221
and dword [ebp - 0xb14], 0
push 0
lea ecx, [ebp - 0x118c]
call fcn.1001aec1
mov ecx, dword [ebp - 0xb14]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x220]
jne 0x1000b24a
mov dword [ebp - 0x390], 1
jmp 0x1000b251
and dword [ebp - 0x390], 0
push 0
lea ecx, [ebp - 0x121c]
call fcn.1001aec1
mov ecx, dword [ebp - 0x390]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x390], eax
jge 0x1000b280
mov dword [ebp - 0x111c], 1
jmp 0x1000b287
and dword [ebp - 0x111c], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x14dc], eax
mov dword [ebp - 0x1124], 0xfffffffd
jmp 0x1000b052
jmp 0x1000aff8
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x118c]
call fcn.1001aea5
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xec4]
call fcn.1001aea5
jmp 0x1000af18
push 0
lea ecx, [ebp - 0x121c]
call fcn.1001aec1
mov dword [eax], 0x7e05af84
jmp 0x1000aee8
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1240]
call fcn.1001aea5
jmp 0x1000ae44
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x121c]
call fcn.1001aea5
mov dword [ebp - 0x8c], 9
push 1
lea ecx, [ebp - 0x13d8]
call fcn.1001ae23
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x1604], 0xd3e99730
mov dword [ebp - 0x14e4], 0xfffffffa
mov dword [ebp - 0x159c], 0x2377d644
mov dword [ebp - 0x644], 0xf5291260
push 3
lea ecx, [ebp - 0x119c]
call fcn.1001ae23
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x112c], 0x314648a5
mov dword [ebp - 0x50], 0
jmp 0x1000b376
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x1000b392
push dword [ebp - 0x50]
lea ecx, [ebp - 0x13d8]
call fcn.1001aec1
mov dword [eax], 0x82b4746a
jmp 0x1000b36f
mov dword [ebp - 0x50], 0
jmp 0x1000b3a2
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x1000b3b8
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x172c], 0x8f6a1c3d
jmp 0x1000b39b
mov dword [ebp - 0x50], 0
jmp 0x1000b3c8
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1000b3e4
push dword [ebp - 0x50]
lea ecx, [ebp - 0x119c]
call fcn.1001aec1
mov dword [eax], 0x3cd4
jmp 0x1000b3c1
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x14ec], eax
cmp dword [ebp - 0x8c], 0xfffffff9
jne 0x1000b405
mov dword [ebp - 0x634], 1
jmp 0x1000b40c
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xb1c], eax
push 0
lea ecx, [ebp - 0x13d8]
call fcn.1001aec1
mov ecx, dword [ebp - 0xb1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x634]
mov ecx, dword [ebp - 0xb1c]
imul ecx, eax
mov dword [ebp - 0x63c], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x63c]
mov dword [ebp + eax - 0x172c], ecx
mov eax, dword [ebp - 0x63c]
sub eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x8c]
jge 0x1000b47b
mov dword [ebp - 0xb24], 1
jmp 0x1000b482
and dword [ebp - 0xb24], 0
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp - 0xb24]
imul eax, eax, 0xd0d3
add eax, dword [ebp - 0x8c]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x644]
add eax, 0xefe8
cmp eax, dword [ebp - 0x8c]
jle 0x1000b4c0
mov dword [ebp - 0xb2c], 1
jmp 0x1000b4c7
and dword [ebp - 0xb2c], 0
push 0
lea ecx, [ebp - 0x119c]
call fcn.1001aec1
mov ecx, dword [ebp - 0xb2c]
cmp ecx, dword [eax]
jg 0x1000b4ea
mov dword [ebp - 0x64c], 1
jmp 0x1000b4f1
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x64c], eax
je 0x1000b50b
mov dword [ebp - 0xb34], 1
jmp 0x1000b512
and dword [ebp - 0xb34], 0
push 2
lea ecx, [ebp - 0x119c]
call fcn.1001aec1
mov ecx, dword [ebp - 0xb34]
cmp ecx, dword [eax]
jl 0x1000b535
mov dword [ebp - 0x654], 1
jmp 0x1000b53c
and dword [ebp - 0x654], 0
push 2
lea ecx, [ebp - 0x119c]
call fcn.1001aec1
mov ecx, dword [ebp - 0x654]
sub ecx, dword [eax]
mov dword [ebp - 0x112c], ecx
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x119c]
call fcn.1001aea5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13d8]
call fcn.1001aea5
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x198], 0x90e69cd1
push 1
lea ecx, [ebp - 0x1348]
call fcn.1001ae23
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x98], 0
jmp 0x1000b5b3
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1000b5cf
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x4b4], 0xfffffffe
jmp 0x1000b5a6
mov dword [ebp - 0x98], 0
jmp 0x1000b5e8
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1000b60a
push dword [ebp - 0x98]
lea ecx, [ebp - 0x1348]
call fcn.1001aec1
mov dword [eax], 0x8fb5c4ce
jmp 0x1000b5db
mov dword [ebp - 0x3c], 2
jmp 0x1000b61a
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x1000b8dd
mov dword [ebp - 0x9c], 0x76ff55e0
mov dword [ebp - 0x9c], 2
jmp 0x1000b647
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x1000b879
mov dword [ebp - 0x398], 0x51c8
mov dword [ebp - 0x468], 0xa0e1c2a9
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4b4], 0
je 0x1000b690
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x4b4], 0
je 0x1000b690
mov dword [ebp - 0xb3c], 1
jmp 0x1000b697
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x4b4]
cmp dword [ebp - 0xb3c], eax
jge 0x1000b6bb
cmp dword [ebp - 0x9c], 0
jne 0x1000b6bb
and dword [ebp - 0x65c], 0
jmp 0x1000b6c5
mov dword [ebp - 0x65c], 1
cmp dword [ebp - 0x65c], 1
jl 0x1000b6da
mov dword [ebp - 0x1134], 1
jmp 0x1000b6e1
and dword [ebp - 0x1134], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x4b4]
mov dword [ebp - 0x1624], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x4b4]
imul ecx, dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x3c]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x4b4]
cmp dword [ebp + eax*4 - 0x4b4], ecx
jl 0x1000b727
mov dword [ebp - 0x428], 1
jmp 0x1000b72e
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x428]
mov dword [ebp + eax*4 - 0x4b4], ecx
cmp dword [ebp - 0x428], 0xfffffff9
jle 0x1000b753
mov dword [ebp - 0xb44], 1
jmp 0x1000b75a
and dword [ebp - 0xb44], 0
cmp dword [ebp - 0xb44], 0xb060
jge 0x1000b772
mov dword [ebp - 0x664], 1
jmp 0x1000b779
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x664], eax
jg 0x1000b793
mov dword [ebp - 0xb4c], 1
jmp 0x1000b79a
and dword [ebp - 0xb4c], 0
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x198], eax
je 0x1000b7c0
mov dword [ebp - 0x66c], 1
jmp 0x1000b7c7
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x66c]
sub eax, dword [ebp - 0x3c]
cmp eax, 0xfffffffe
jbe 0x1000b7e1
mov dword [ebp - 0xb54], 1
jmp 0x1000b7e8
and dword [ebp - 0xb54], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xb54], eax
je 0x1000b7ff
mov dword [ebp - 0x674], 1
jmp 0x1000b806
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x674], eax
jg 0x1000b822
or eax, 0xffffffff
je 0x1000b822
mov dword [ebp - 0xb5c], 1
jmp 0x1000b829
and dword [ebp - 0xb5c], 0
cmp dword [ebp - 0xb5c], 0
jne 0x1000b83e
mov dword [ebp - 0x67c], 1
jmp 0x1000b845
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 0x468], eax
mov esi, dword [ebp - 0x468]
push 0
lea ecx, [ebp - 0x1348]
call fcn.1001aec1
mov dword [eax], esi
cmp dword [ebp - 0x468], 0
je 0x1000b874
jmp 0x1000b63a
jmp 0x1000b63a
mov dword [ebp - 0x9c], 0
jmp 0x1000b892
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jg 0x1000b8d8
mov dword [ebp - 0x198], 0
jmp 0x1000b8b4
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jl 0x1000b8d6
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x4b0]
mov dword [ebp + ecx*4 - 0x4b4], eax
jmp 0x1000b8a7
jmp 0x1000b885
jmp 0x1000b613
mov byte [ebp - 0x17f], 0
movzx eax, byte [ebp - 0x17f]
test eax, eax
je 0x1000b906
push 0
push 0x26a5
push 0x1046
push 0x18e9
call dword [sym.imp.KERNEL32.dll_RaiseException]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1348]
call fcn.1001aea5
push 3
lea ecx, [ebp - 0xe7c]
call fcn.1001ae23
mov dword [ebp - 4], 0x16
push 1
lea ecx, [ebp - 0x4cc]
call fcn.1001ae23
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xcc], 0
jmp 0x1000b953
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x1000b975
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xe7c]
call fcn.1001aec1
mov dword [eax], 0x63185299
jmp 0x1000b946
mov dword [ebp - 0xcc], 0
jmp 0x1000b98e
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x1000b9b0
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x4cc]
call fcn.1001aec1
mov dword [eax], 1
jmp 0x1000b981
push 0
lea ecx, [ebp - 0x4cc]
call fcn.1001aec1
and dword [eax], 0
jmp 0x1000b9e6
push 0
lea ecx, [ebp - 0x4cc]
call fcn.1001aec1
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp - 0xb64]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xb64]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x4cc]
call fcn.1001aec1
cmp dword [eax], 2
jg 0x1000bb6e
mov dword [ebp - 0x113c], 0xfffffff9
mov dword [ebp - 0x2e0], 0
jmp 0x1000ba1f
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 3
jge 0x1000ba3b
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0x167c], 0xa7fe64fd
jmp 0x1000ba12
push 0
lea ecx, [ebp - 0x4cc]
call fcn.1001aec1
push dword [eax]
lea ecx, [ebp - 0xe7c]
call fcn.1001aec1
mov esi, eax
push 0
lea ecx, [ebp - 0x4cc]
call fcn.1001aec1
push dword [eax]
lea ecx, [ebp - 0xe7c]
call fcn.1001aec1
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x1000ba95
push 0
lea ecx, [ebp - 0x4cc]
call fcn.1001aec1
cmp dword [eax], 0xfffffffa
jne 0x1000ba95
mov dword [ebp - 0x684], 1
jmp 0x1000ba9c
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x684], 0x4a90
je 0x1000bab4
mov dword [ebp - 0x68c], 1
jmp 0x1000babb
and dword [ebp - 0x68c], 0
push 0
lea ecx, [ebp - 0x4cc]
call fcn.1001aec1
push dword [eax]
lea ecx, [ebp - 0xe7c]
call fcn.1001aec1
mov eax, dword [eax]
add eax, 0x707
mov dword [ebp - 0xb6c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb6c]
mov dword [ebp + eax - 0x167c], ecx
mov eax, dword [ebp - 0xb6c]
cmp eax, dword [ebp - 0x68c]
jge 0x1000bb0f
mov dword [ebp - 0xb74], 1
jmp 0x1000bb16
and dword [ebp - 0xb74], 0
push 0
lea ecx, [ebp - 0x4cc]
call fcn.1001aec1
push dword [eax]
lea ecx, [ebp - 0xe7c]
call fcn.1001aec1
mov esi, dword [ebp - 0xb74]
imul esi, dword [eax]
push 2
lea ecx, [ebp - 0xe7c]
call fcn.1001aec1
cmp esi, dword [eax]
jge 0x1000bb56
mov dword [ebp - 0x694], 1
jmp 0x1000bb5d
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x113c], eax
jmp 0x1000b9c2
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x4cc]
call fcn.1001aea5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe7c]
call fcn.1001aea5
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x114c], 3
mov dword [ebp - 0x6b4], 8
mov dword [ebp - 0x1154], 0x3cbf
mov dword [ebp - 0xba4], 0x9fdb81fd
mov dword [ebp - 0x115c], 0xfffffffd
mov dword [ebp - 0x60], 0
jmp 0x1000bbd5
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xffffffe4
jne 0x1000bbf2
mov dword [ebp - 0x1144], 0xe871
cmp dword [ebp - 0x1144], 0
je 0x1000bbf0
jmp 0x1000bbf2
jmp 0x1000bbce
mov dword [ebp - 0x60], 0
jmp 0x1000bc02
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xfffffff9
jle 0x1000bdb1
mov dword [ebp - 0x338], 0xb6fe6d39
mov dword [ebp - 0x6a4], 0x1300ca3c
cmp dword [ebp - 0x60], 0
je 0x1000bc6d
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x114c], eax
cmp dword [ebp - 0x6a4], 0x78c9dffb
jne 0x1000bc47
mov dword [ebp - 0xb7c], 1
jmp 0x1000bc4e
and dword [ebp - 0xb7c], 0
cmp dword [ebp - 0xb7c], 1
ja 0x1000bc63
mov dword [ebp - 0x69c], 1
jmp 0x1000bc6a
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x338]
sub eax, 0xc4ce
cmp eax, dword [ebp - 0x60]
jl 0x1000bc89
mov dword [ebp - 0xb84], 1
jmp 0x1000bc90
and dword [ebp - 0xb84], 0
mov eax, dword [ebp - 0x338]
sub eax, dword [ebp - 0xb84]
jne 0x1000bca5
cmp dword [ebp - 0x338], 0
or eax, 0xffffffff
neg eax
cmp eax, dword [ebp - 0x338]
jl 0x1000bcc7
cmp dword [ebp - 0x6a4], 0
je 0x1000bcc7
mov dword [ebp - 0xb8c], 1
jmp 0x1000bcce
and dword [ebp - 0xb8c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0xb8c], eax
jne 0x1000bce5
mov dword [ebp - 0x6ac], 1
jmp 0x1000bcec
and dword [ebp - 0x6ac], 0
cmp dword [ebp - 0x6ac], 0x4356
jne 0x1000bd04
mov dword [ebp - 0xb94], 1
jmp 0x1000bd0b
and dword [ebp - 0xb94], 0
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x6b4]
sub eax, dword [ebp - 0x1154]
jne 0x1000bd37
cmp dword [ebp - 0xba4], 0
jne 0x1000bd37
and dword [ebp - 0xb9c], 0
jmp 0x1000bd41
mov dword [ebp - 0xb9c], 1
cmp dword [ebp - 0xb9c], 0xbe86de1f
jb 0x1000bd59
mov dword [ebp - 0x6bc], 1
jmp 0x1000bd60
and dword [ebp - 0x6bc], 0
cmp dword [ebp - 0x6bc], 0x17c264f8
jle 0x1000bd78
mov dword [ebp - 0x6c4], 1
jmp 0x1000bd7f
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0xba4]
cmp dword [ebp - 0x6c4], eax
jge 0x1000bd99
mov dword [ebp - 0xbac], 1
jmp 0x1000bda0
and dword [ebp - 0xbac], 0
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0x115c], eax
jmp 0x1000bbfb
mov dword [ebp - 0x6d4], 0xffffffff
mov dword [ebp - 0x2e8], 0x8c9dffbe
mov dword [ebp - 0x3a0], 0xb597857
mov dword [ebp - 0x1a0], 0x3f0e26a2
mov dword [ebp - 0x6fc], 0xa2b52f10
mov dword [ebp - 0x714], 0x72f548f9
push 1
lea ecx, [ebp - 0x11b4]
call fcn.1001ae23
mov dword [ebp - 4], 0x18
mov dword [ebp - 0xc0c], 1
mov dword [ebp - 0x72c], 0xfffffffa
mov dword [ebp - 0x116c], 4
mov dword [ebp - 0x14], 0
jmp 0x1000be2f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1000be42
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7c], 0x869ec427
jmp 0x1000be28
mov dword [ebp - 0x14], 0
jmp 0x1000be52
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1000be68
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x13f4], 0xfffffffe
jmp 0x1000be4b
mov dword [ebp - 0x14], 0
jmp 0x1000be78
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000be8e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1694], 0xfffffffa
jmp 0x1000be71
mov dword [ebp - 0x14], 0
jmp 0x1000be9e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000beb4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1254], 0x6ac8
jmp 0x1000be97
mov dword [ebp - 0x14], 0
jmp 0x1000bec4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1000bee0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x11b4]
call fcn.1001aec1
mov dword [eax], 0xfffd
jmp 0x1000bebd
mov dword [ebp - 0x14], 0
jmp 0x1000bef0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000bf06
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1498], 0xf0cdbbf8
jmp 0x1000bee9
mov dword [ebp - 0x14], 0
jmp 0x1000bf16
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1000bf2c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1644], 0xf156de04
jmp 0x1000bf0f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c]
mov dword [ebp - 0x14f4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7c], 0
jne 0x1000c26e
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x1a0]
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0x13f4]
je 0x1000bf8b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13f4], 0
je 0x1000bf8b
mov dword [ebp - 0x6cc], 1
jmp 0x1000bf92
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 0x81fd
jne 0x1000bfaa
mov dword [ebp - 0xbb4], 1
jmp 0x1000bfb1
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0xbb4], eax
jg 0x1000bfcb
mov dword [ebp - 0x430], 1
jmp 0x1000bfd2
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x6d4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x430]
mov dword [ebp + eax - 0x1694], ecx
imul eax, dword [ebp - 0x430], 0x8aea
mov ecx, dword [ebp - 0x6d4]
add ecx, eax
cmp ecx, 0x6845925f
je 0x1000c016
mov dword [ebp - 0xbbc], 1
jmp 0x1000c01d
and dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0xbbc]
neg eax
jne 0x1000c033
mov dword [ebp - 0x70c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c]
cmp dword [ebp - 0x70c], eax
je 0x1000c296
mov dword [ebp - 0xbf4], 1
jmp 0x1000c29d
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0x714], eax
mov esi, dword [ebp - 0x714]
push 0
lea ecx, [ebp - 0x11b4]
call fcn.1001aec1
cmp esi, dword [eax]
jle 0x1000c2cc
mov dword [ebp - 0xbfc], 1
jmp 0x1000c2d3
and dword [ebp - 0xbfc], 0
push 0
lea ecx, [ebp - 0x11b4]
call fcn.1001aec1
mov ecx, dword [ebp - 0xbfc]
cmp ecx, dword [eax]
jg 0x1000c2f6
mov dword [ebp - 0x71c], 1
jmp 0x1000c2fd
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x71c], eax
jne 0x1000c317
mov dword [ebp - 0xc04], 1
jmp 0x1000c31e
and dword [ebp - 0xc04], 0
cmp dword [ebp - 0xc04], 0xfffffffb
jae 0x1000c333