Function at 0x10014fd7
Capabilities:
Check os version
Create process on windows
Get disk information
Get file system object information
Get graphical window text
Get session user name
Query service status

Disassembly:
mov eax, 0x1006fe6c
call fcn.1006f278
sub esp, 0xb74
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov byte [ebp - 0x69], dl
xor edx, edx
mov dword [ebp - 0x14], 0xfffffffa
push esi
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0xfffffffe
push edi
mov dword [ebp - 0x64], ecx
mov edi, 0xad95
jne 0x1001507b
push 2
lea ecx, [ebp - 0x8d8]
call fcn.10011475
xor eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 2
jge 0x10015043
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x8d8]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001502b
xor eax, eax
inc eax
mov dword [ebp - 0x10], edx
jmp 0x1001505d
mov byte [ebp - 0x1d], dl
cmp byte [ebp - 0x1d], 0
je 0x1001505a
push edx
push edx
call ebx
xor eax, eax
xor edx, edx
inc eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10015048
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x8d8]
call fcn.10011c4a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffe
je 0x1001500d
xor edx, edx
push 0xffffffffffffffea
mov dword [ebp - 0x14], edx
pop esi
jmp 0x100150c1
mov dword [ebp - 0x34], 0x98f01ba0
mov dword [ebp - 0x10], edx
jmp 0x100150a0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7ac], 0x3617
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001508f
mov dword [ebp - 0x7a8], 0xfffffff7
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, 0xfffffff7
setle cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jge 0x10015083
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x14], edx
jmp 0x10015138
push 2
lea ecx, [ebp - 0x8ec]
call fcn.10011475
xor eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 2
jge 0x10015108
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x8ec]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100150f0
xor eax, eax
inc eax
mov dword [ebp - 0x10], edx
jmp 0x10015122
mov byte [ebp - 0x1d], dl
cmp byte [ebp - 0x1d], 0
je 0x1001511f
push edx
push edx
call ebx
xor eax, eax
xor edx, edx
inc eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x1001510d
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x8ec]
call fcn.10011c4a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffe
je 0x100150d2
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], esi
jl 0x10015189
push 0xfffffffffffffff7
pop edx
mov dword [ebp - 0x34], 0x98f01ba0
mov dword [ebp - 0x10], ebx
jmp 0x10015168
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7c0], 0x3617
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10015157
mov dword [ebp - 0x7bc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, edx
setle cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jge 0x1001514b
mov dword [ebp - 0x14], 0x94b4b132
lea ecx, [ebp - 0x5c8]
mov dword [ebp - 0x3c], 0x5e49
mov dword [ebp - 0x18], 0x1311e2db
mov dword [ebp - 0x40], 0xd4856cd8
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x10], 0xffffffff
push 2
call fcn.10011475
mov dword [ebp - 0x34], 0x1ec5
cmp dword [ebp - 0x34], 0x9ef
jge 0x1001525e
mov esi, 0x119d7945
push esi
push 0x10009df0
call fcn.10055d2e
push esi
call fcn.100556e0
add esp, 0xc
mov edi, eax
mov eax, ebx
push 5
pop edx
lea ecx, [eax + 0x30]
mov byte [eax + 0x10724c60], cl
inc eax
cmp eax, 5
jl 0x100151fb
push 5
pop esi
add edi, esi
cmp edi, esi
jle 0x10015247
mov ecx, 0x10724c60
mov ah, byte [ecx + edx - 1]
mov bl, byte [esi + 0x119d7940]
cmp ah, bl
jne 0x1001522c
cmp byte [ecx + edx - 2], bl
je 0x10015240
mov al, byte [edx + 0x10724c5d]
cmp al, byte [ecx + edx - 2]
jne 0x1001523c
cmp ah, bl
je 0x10015240
mov byte [ecx + edx], bl
inc edx
inc esi
cmp esi, edi
jl 0x10015218
xor ebx, ebx
push 0x10724c65
push 0x10009df4
mov byte [edx + 0x10724c60], bl
call fcn.100558e6
pop ecx
pop ecx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x1001527d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c8]
mov dword [eax + ecx*4], 0x6b2c4eb0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001526a
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
test eax, eax
mov edx, dword [ebp - 0x14]
setns cl
sub edx, ecx
xor ecx, ecx
imul edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setne cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
add eax, 7
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c8]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x3c], ebx
jne 0x1001530a
cmp dword [ebp - 0x24], ebx
jne 0x1001530a
xor esi, esi
mov eax, ebx
inc esi
jmp 0x1001530f
xor esi, esi
inc esi
mov eax, esi
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x5c8]
call fcn.10011c4a
push 4
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x10], 0x13
pop ecx
jmp 0x10015352
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1001534a
push 0x2542
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 4
pop ecx
cmp dword [ebp - 0x34], ebx
jne 0x10015358
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffed
jne 0x10015330
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0xfffffffe
jne 0x10015ea6
jmp 0x10015371
push 4
pop ecx
mov dword [ebp - 0x34], 0x32d7af2c
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x10015395
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x254], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10015384
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100153aa
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov dword [ebp - 0x24c], ebx
jmp 0x10015431
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x44], 0xfffffffa
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0x10], ebx
jne 0x100153e4
mov eax, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x254]
imul eax, eax, 0xfffe
cmp eax, dword [ebp - 0x10]
mov eax, ebx
jle 0x100153e6
mov eax, esi
add eax, 0xb94d
jne 0x100153f3
mov eax, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
sub eax, 0x7904
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x94ff
setne cl
xor eax, eax
add ecx, 0xfa81
imul ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x10]
cmp ecx, 0x8aae07ea
setne al
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x24c]
cmp dword [ebp - 0x24c], 3
je 0x100153b2
push 2
lea ecx, [ebp - 0x7b8]
call fcn.10011475
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], 0x22ed
cmp dword [ebp - 0x34], 0x930
jge 0x100155aa
push 0x10756cd4
push 0x11ae4250
push 0x10009df8
call fcn.10055d2e
add esp, 0xc
jmp 0x100155a2
mov edx, dword [0x11ae4250]
test edx, edx
je 0x100155aa
mov esi, dword [0x10756cd4]
test esi, esi
je 0x100155aa
mov eax, ebx
mov dword [ebp - 0x40], eax
test edx, edx
jle 0x100154df
mov ebx, 0x107559b0
xor edi, edi
test esi, esi
jle 0x100154d2
lea eax, [ebx + edi]
push eax
push 0x10009e00
call fcn.10055d2e
mov esi, dword [0x10756cd4]
inc edi
pop ecx
pop ecx
cmp edi, esi
jl 0x100154ae
mov edx, dword [0x11ae4250]
mov eax, dword [ebp - 0x40]
inc eax
add ebx, 0x46
mov dword [ebp - 0x40], eax
cmp eax, edx
jl 0x100154a8
xor ebx, ebx
mov eax, ebx
mov ecx, ebx
mov dword [0x10b58348], eax
mov dword [ebp - 0x3c], ecx
test edx, edx
jle 0x10015580
mov edi, 0x107559b0
mov dword [ebp - 0x10], edi
test esi, esi
jle 0x1001556b
cmp byte [edi + ebx], 0x2a
jne 0x10015566
xor eax, eax
inc eax
xor edi, edi
mov byte [0x107559aa], al
mov eax, dword [edi + 0x10009d60]
add eax, ecx
mov ecx, dword [edi + 0x10009d80]
add ecx, ebx
mov dword [0x10beb158], eax
mov dword [0x11eb4b80], ecx
test eax, eax
js 0x1001554b
cmp eax, edx
jge 0x1001554b
test ecx, ecx
js 0x1001554b
cmp ecx, esi
jge 0x1001554b
imul eax, eax, 0x46
cmp byte [eax + ecx + 0x107559b0], 0x2a
je 0x100155f2
mov ecx, dword [ebp - 0x3c]
push 4
pop eax
add edi, eax
cmp edi, 0x20
jl 0x1001550f
mov eax, dword [0x10b58348]
inc eax
mov dword [0x10b58348], eax
mov edi, dword [ebp - 0x10]
inc ebx
cmp ebx, esi
jl 0x100154ff
inc ecx
add edi, 0x46
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], edi
push 0
pop ebx
cmp ecx, edx
jl 0x100154fb
push eax
push 0x10009d18
call fcn.100558e6
push 0x10756cd4
push 0x11ae4250
push 0x10009df8
call fcn.10055d2e
add esp, 0x14
test eax, eax
jne 0x1001547e
xor eax, eax
mov dword [ebp - 0x2c], 0xfe7d8a87
inc eax
mov dword [ebp - 0x18], 0xd8607f47
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x6f4]
push eax
call fcn.10011475
push 4
xor edx, edx
mov dword [ebp - 0x34], 0x6722525a
mov dword [ebp - 0x14], ebx
inc edx
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10015606
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x11c], edx
inc dword [ebp - 0x14]
jmp 0x100155de
mov eax, dword [0x10b58348]
mov ecx, dword [ebp - 0x3c]
mov byte [0x107559aa], 0
jmp 0x10015563
mov dword [ebp - 0x14], ebx
jmp 0x1001561b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x6f4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001560b
mov dword [ebp - 0x2c], 3
cmp dword [ebp - 0x2c], ebx
jl 0x1001577a
mov dword [ebp - 0x40], 0x6cefc6e2
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x11c], ecx
test ecx, ecx
jne 0x10015757
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x110]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x2c]
jge 0x10015678
mov eax, dword [ebp - 0x118]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x2c]
jne 0x1001568d
mov edx, ebx
cmp dword [ebp - 0x10], ebx
je 0x1001568f
mov edx, ecx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x114]
setg dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setge bl
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x2c]
imul ecx, ebx
add ecx, dword [ebp + eax*4 - 0x11c]
je 0x100156d3
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jl 0x10015730
cmp dword [ebp - 0x10], ebx
je 0x10015730
xor edx, edx
inc edx
mov eax, edx
jmp 0x10015735
xor edx, edx
mov eax, ebx
inc edx
imul ecx, eax, 0xb60e
mov eax, dword [ebp - 0x6f4]
mov dword [eax], ecx
test ecx, ecx
je 0x10015753
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x11c], ebx
jne 0x10015757
mov ecx, ebx
jmp 0x10015759
mov ecx, edx
mov eax, dword [ebp - 0x40]
add eax, ecx
je 0x10015767
mov eax, edx
cmp dword [ebp - 0x40], ebx
jne 0x10015769
mov eax, ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x10], ebx
jne 0x1001577a
dec dword [ebp - 0x2c]
jns 0x10015630
mov dword [ebp - 0x18], ebx
jmp 0x1001578c
mov dword [ebp - 0x40], 0x7ab81002
inc dword [ebp - 0x40]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x1001577f
lea ecx, [ebp - 0x6f4]
call fcn.10011c4a
xor edx, edx
inc edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x10], ebx
jmp 0x100157bb
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x7b8]
mov dword [eax + ecx*4], 0xad95
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100157a8
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], edx
jg 0x10015e84
lea esi, [ebp - 0x740]
lea edi, [ebp - 0x730]
mov dword [ebp - 0x1c], 0x5d6c05ba
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x34], 0x3b1d
mov dword [ebp - 0x10], 3
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1001581e
push 0xc53
push 0xd74
push 0x1bce
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
xor edx, edx
inc edx
mov dword [ebp - 0x1c], ebx
jmp 0x100158e8
mov dword [ebp - 0x14], 0x66f5a9c4
mov dword [ebp - 0x10], ebx
jmp 0x10015843
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd4], 0xde0b4074
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10015832
mov dword [ebp - 0x14], ebx
jmp 0x100158dc
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xd4], ebx
je 0x10015885
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 0x3d7f1912
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x3c], eax
jl 0x10015878
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd4]
mov ecx, dword [ebp - 0xd4]
sub ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xd4], edx
mov dword [ebp - 0x10], 0xb
jmp 0x100158d3
cmp dword [ebp - 0x3c], ebx
jne 0x100158d9
cmp dword [ebp - 0x14], ebx
jne 0x100158d9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
je 0x100158c6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x10015851
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x12
jge 0x10015826
mov dword [ebp - 0x14], 0x60657976
lea ecx, [ebp - 0x58c]
mov dword [ebp - 0x18], 0xdb88dcfd
push edx
call fcn.10011475
xor eax, eax
push ecx
inc eax
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], al
movdqa xmm0, xmmword [0x1000a320]
push edi
push esi
movdqu xmmword [ebp - 0x740], xmm0
call fcn.1002345b
mov byte [ebp - 4], 2
xor edx, edx
mov dword [ebp - 0x34], ebx
inc edx
mov dword [ebp - 0x10], ebx
jmp 0x10015952
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x58c]
mov dword [eax + ecx*4], 0x622b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001593f
cmp dword [ebp - 0x14], ebx
je 0x10015a33
mov dword [ebp - 0x10], 0x1813
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x3c], 0x215a6091
push 2
call fcn.10011475
mov dword [ebp - 0x1c], ebx
jmp 0x10015993
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x468]
mov dword [eax + ecx*4], 0xe9e5a939
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10015980
cmp dword [ebp - 0x14], ebx
jne 0x100159b3
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setl dl
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
je 0x100159dc
mov eax, dword [ebp - 0x58c]
cmp dword [eax], ebx
je 0x100159dc
xor eax, eax
lea edx, [eax + 1]
jmp 0x100159de
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x468]
setl cl
mov dword [eax + 4], ecx
mov dword [ebp - 0x14], ebx
jmp 0x10015a1b
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10015a06
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x468]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jle 0x100159f6
lea ecx, [ebp - 0x468]
call fcn.10011c4a
jmp 0x10015ac6
mov dword [ebp - 0x10], 0xb891
mov dword [ebp - 0x44], 0x5c6a8b5f
mov dword [ebp - 0x14], 0xfffffffd
cmp dword [ebp - 0x14], 0x2c
jl 0x10015ac6
mov edi, dword [ebp - 0x810]
or ecx, 0xffffffff
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x1c], 0x1f1c18a0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jne 0x10015a90
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x10], ebx
jne 0x10015a90
mov esi, ebx
cmp dword [ebp - 0x40], ebx
je 0x10015a92
mov esi, edx
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp esi, eax
mov dword [edi + 0xc], edx
setg cl
sub edx, ecx
add edx, dword [ebp - 0x18]
je 0x10015ab5
cmp dword [ebp - 0x40], ebx
je 0x10015ab5
xor edx, edx
inc edx
mov eax, edx
jmp 0x10015aba
xor edx, edx
mov eax, ebx
inc edx
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x2c
jge 0x10015a54
lea ecx, [ebp - 0x810]
call fcn.10011c4a
lea ecx, [ebp - 0x58c]
mov byte [ebp - 4], bl
call fcn.10011c4a
mov byte [ebp - 0x1d], bl
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x54], 0xfffffffe
mov dword [ebp - 0x54], 0xffffffff
push 3
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 0xb3a4df6f
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x34], 0x1e1d82c3
mov dword [ebp - 0x68], 8
mov dword [ebp - 0x40], 0xc2e9378f
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x3c], 0x9737e0d1
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
mov dword [ebp - 0x18], 0x48dc164f
mov dword [ebp - 0x54], 0x7806aa1c
push eax
call fcn.10011475
xor edx, edx
inc edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x14], ebx
jmp 0x10015b68
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x480]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10015b59
push 4
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x10015b86
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x760], 2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10015b75
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x760]
inc dword [ebp - 0x760]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x480]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
setge dl
sub edx, eax
mov eax, dword [ebp - 0x480]
sub edx, 0xe859
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp dword [eax], edx
setne cl
xor ebx, ebx
mov dword [eax], ecx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setle bl
xor edx, edx
sub ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor ebx, ebx
add ecx, dword [ebp - 0x4c]
je 0x10015c1b
cmp dword [ebp - 0x760], ebx
je 0x10015c1b
xor eax, eax
lea edx, [eax + 1]
jmp 0x10015c1d
mov edx, ebx
mov eax, dword [ebp - 0x68]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x480]
call fcn.10011c4a
cmp byte [ebp - 0x1d], 0
je 0x10015e69
push 2
lea ecx, [ebp - 0x4ec]
call fcn.10011475
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4d4]
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x10], 0x906d8bc0
mov dword [ebp - 0x3c], 0xfffffff7
push 2
call fcn.10011475
push 4
pop eax
push 2
mov byte [ebp - 4], al
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10015c93
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4ec]
mov dword [eax + ecx*4], 0xca2c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10015c80
mov dword [ebp - 0x18], ebx
jmp 0x10015cb0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4d4]
mov dword [eax + ecx*4], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10015c9d
push 4
mov dword [ebp - 0x18], ebx
pop ecx
jmp 0x10015cce
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x98c], 0x7e906900
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10015cbd
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10015ced
push 0x22b0
push 0x1acc
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
mov edi, dword [ebp - 0x4ec]
cmp dword [edi + 4], ebx
je 0x10015d41
mov dword [ebp - 0x40], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov esi, dword [edi + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, esi
mov eax, dword [ebp - 0x4ec]
setg cl
xor edx, edx
cmp ecx, dword [eax]
setl dl
xor eax, eax
cmp edx, esi
setl al
neg eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
imul ecx, dword [edi + 4]
mov eax, dword [ebp - 0x4d4]
mov dword [eax], ecx
test ecx, ecx
je 0x10015d41
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10015d43
mov ecx, ebx
xor eax, eax
cmp ecx, dword [edi + 4]
setge al
cmp eax, 0x86095610
jae 0x10015e23
push 4
pop eax
push eax
lea ecx, [ebp - 0x64c]
call fcn.10011475
push 3
mov dword [ebp - 0x40], 0x2c752785
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10015d85
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3fc], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10015d74
mov dword [ebp - 0x18], ebx
jmp 0x10015d9e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x64c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
push 4
pop eax
cmp dword [ebp - 0x18], eax
jl 0x10015d8f
mov dword [ebp - 0x18], ebx
jmp 0x10015dbc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x96c], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10015dab
xor ecx, ecx
cmp dword [ebp - 0x3f8], ebx
jne 0x10015dde
mov eax, dword [ebp - 0x64c]
or dword [eax + 0xc], 0xffffffff
inc ecx
mov dword [ebp - 0x968], ecx
jmp 0x10015ddf
inc ecx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x98c]
mov eax, dword [ebp - 0x3fc]
mov ecx, dword [ebp - 0x40]
imul edx, eax
mov eax, dword [ebp - 0x4d4]
imul ecx, edx
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x64c]
mov eax, dword [ebp - 0x3fc]
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x10], eax
call fcn.10011c4a
jmp 0x10015e48
mov dword [ebp - 0x10], 0x1d
jmp 0x10015e42
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10015e3f
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jl 0x10015e2c
lea ecx, [ebp - 0x4d4]
call fcn.10011c4a
lea ecx, [ebp - 0x4ec]
mov byte [ebp - 4], bl
call fcn.10011c4a
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
inc dword [ebp - 0x2c]
lea esi, [ebp - 0x740]
xor edx, edx
lea edi, [ebp - 0x730]
inc edx
cmp dword [ebp - 0x2c], edx
jle 0x100157d9
mov dword [ebp - 0x2c], edx
lea ecx, [ebp - 0x7b8]
or dword [ebp - 4], 0xffffffff
call fcn.10011c4a
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffe
push 1
pop esi
je 0x1001536e
movdqa xmm0, xmmword [0x1000a2e0]
lea ecx, [ebp - 0x90c]
push ecx
lea eax, [ebp - 0x8fc]
mov dword [ebp - 0x14], 0xe9d0
push eax
push ecx
mov dword [ebp - 0x24], 2
lea ecx, [ebp - 0x1cc]
movdqu xmmword [ebp - 0x90c], xmm0
call fcn.1002345b
mov dword [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x40], 0x8cca6991
inc eax
mov dword [ebp - 0x40], 0x695cd1d2
mov dword [ebp - 0x34], eax
push 4
mov dword [ebp - 0x1c], 0x24489be6
mov dword [ebp - 0x18], ebx
pop ecx
jmp 0x10015f19
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x91c], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10015f08
mov dword [ebp - 0x18], ebx
jmp 0x10015f34
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x854], 0xb1ed3090
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10015f23
mov eax, dword [ebp - 0x14]
sub eax, 0x7a66fe7d
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 3
jg 0x10016135
mov edi, dword [ebp - 0x1cc]
mov dword [ebp - 0x3c], 0xf59f89f2
mov dword [ebp - 0x24], 0x6992f1e5
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1cc]
mov edx, dword [ebp - 0x24]
add edx, dword [eax + ecx*4]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, edx
mov eax, dword [ebp - 0x1cc]
setl cl
xor edx, edx
cmp ecx, 0x4902314a
setg dl
imul edx, dword [eax + esi*4]
test edx, edx
jne 0x10015fa9
cmp dword [edi + 0xc], ebx
jne 0x10015fa9
mov esi, ebx
jmp 0x10015fae
xor eax, eax
lea esi, [eax + 1]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x1cc]
cmp esi, dword [eax + ecx*4]
setle dl
mov dword [ebp - 0x40], edx
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
xor ebx, ebx
add edx, 0x57ea
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1cc]
cmp ecx, dword [eax + edx*4]
setne bl
xor eax, eax
cmp ebx, dword [edi + 0xc]
setg al
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [edi + 8]
setle cl
xor ebx, ebx
add ecx, 7
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x3c], ebx
je 0x10016030
mov ecx, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x1c]
add eax, dword [ecx + 4]
mov dword [ebp - 0x3c], eax
jmp 0x10016118
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x40], 0x8d9a65c8
mov dword [ebp - 0x1c], ebx
jmp 0x1001610e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1cc]
cmp dword [eax + ecx*4], ebx
je 0x10016072
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x1001610b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
jmp 0x1001610b
xor eax, eax
lea ecx, [ebp - 0x504]
inc eax
push eax
call fcn.10011475
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x10016099
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x504]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10016089
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x504]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x504]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xc702b5bd
ja 0x100160cc
cmp dword [ebp - 0x91c], ebx
jne 0x100160ce
mov edx, ebx
mov eax, dword [ebp - 0x91c]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x3c]
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setge cl
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
lea ecx, [ebp - 0x504]
setne dl
mov dword [ebp - 0x854], edx
call fcn.10011c4a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x10016046
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x10016128
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x10015f5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1cc]
call fcn.10011c4a
mov dword [ebp - 0x34], 0x15b2
cmp dword [ebp - 0x34], 0x5b1
jge 0x100163a8
mov esi, 0x11acbba0
push esi
push 0x10009df0
call fcn.10055d2e
push esi
call fcn.100556e0
mov edx, eax
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x3c], edx
xor esi, esi
mov dword [ebp - 0x40], ecx
lea eax, [edx - 2]
mov dword [ebp - 0x34], eax
test edx, edx
jle 0x100161af
mov cl, byte [esi + 0x11acbba0]
xor eax, eax
cmp cl, 0x30
sete al
add ebx, eax
xor eax, eax
cmp cl, 0x31
mov ecx, dword [ebp - 0x40]
sete al
add ecx, eax
inc esi
mov dword [ebp - 0x40], ecx
cmp esi, edx
jl 0x10016187
lea eax, [edx - 2]
movd xmm1, dword [ebp - 0x34]
mov edi, edx
cvtdq2pd xmm1, xmm1
cdq
sub edi, ecx
sub eax, edx
sub edi, ebx
mov esi, eax
sar esi, 1
sub esi, ebx
movd xmm0, ecx
mulsd xmm1, qword [0x1000a278]
push ecx
cvtdq2pd xmm0, xmm0
push ecx
lea ebx, [esi + 2]
movsd qword [ebp - 0x38], xmm1
movsd qword [ebp - 0x58], xmm0
movsd qword [esp], xmm1
call fcn.10057610
fsub qword [ebp - 0x58]
pop ecx
pop ecx
xor ecx, ecx
test ebx, ebx
fstp qword [ebp - 0x48]
cvttsd2si eax, qword [ebp - 0x48]
cmovs ebx, ecx
test eax, eax
cmovs eax, ecx
test ebx, ebx
jle 0x10016213
add eax, ebx
cmp eax, edi
jne 0x1001621e
push 0x10009e04
call fcn.10057e5c
pop ecx
movsd xmm0, qword [ebp - 0x38]
lea ebx, [esi + 1]
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10057610
fsub qword [ebp - 0x58]
xor edx, edx
test ebx, ebx
pop ecx
pop ecx
fld1
mov ecx, ebx
faddp st(1)
cmovs ecx, edx
fstp qword [ebp - 0x48]
cvttsd2si eax, qword [ebp - 0x48]
test eax, eax
cmovs eax, edx
test ecx, ecx
jg 0x10016259
test eax, eax
jle 0x1001625f
add eax, ecx
cmp eax, edi
jne 0x1001626d
mov eax, dword [ebp - 0x3c]
cmp byte [eax + 0x11acbb9f], 0x31
jne 0x10016270
jmp 0x100162b6
mov eax, dword [ebp - 0x3c]
cmp byte [eax + 0x11acbb9f], 0x3f
jne 0x100162c1
movsd xmm0, qword [ebp - 0x38]
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10057610
fsub qword [ebp - 0x58]
xor edx, edx
test ebx, ebx
pop ecx
pop ecx
mov ecx, ebx
fstp qword [ebp - 0x48]
cvttsd2si eax, qword [ebp - 0x48]
cmovs ecx, edx
test eax, eax
cmovs eax, edx
test ecx, ecx
jg 0x100162ad
test eax, eax
jle 0x100162b6
add ecx, eax
lea eax, [edi - 1]
cmp ecx, eax
jne 0x100162c1
push 0x10009e08
call fcn.10057e5c
pop ecx
movsd xmm0, qword [ebp - 0x38]
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10057610
fsub qword [ebp - 0x58]
pop ecx
pop ecx
xor ecx, ecx
test ebx, ebx
fld1
faddp st(1)
cmovs ebx, ecx
fstp qword [ebp - 0x48]
cvttsd2si eax, qword [ebp - 0x48]
test eax, eax
cmovs eax, ecx
test ebx, ebx
jg 0x100162f7
test eax, eax
jle 0x100162fd
add eax, ebx
cmp eax, edi
jne 0x1001630b
mov eax, dword [ebp - 0x3c]
cmp byte [eax + 0x11acbb9f], 0x30
jne 0x1001630e
jmp 0x10016358
mov eax, dword [ebp - 0x3c]
cmp byte [eax + 0x11acbb9f], 0x3f
jne 0x10016363
movsd xmm0, qword [ebp - 0x38]
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10057610
fsub qword [ebp - 0x58]
xor edx, edx
test esi, esi
pop ecx
pop ecx
fld1
mov ecx, esi
faddp st(1)
cmovs ecx, edx
fstp qword [ebp - 0x48]
cvttsd2si eax, qword [ebp - 0x48]
test eax, eax
cmovs eax, edx
test ecx, ecx
jg 0x1001634f
test eax, eax
jle 0x10016358
add ecx, eax
lea eax, [edi - 1]
cmp ecx, eax
jne 0x10016363
push 0x10009e0c
call fcn.10057e5c
pop ecx
movsd xmm0, qword [ebp - 0x38]
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10057610
fsub qword [ebp - 0x58]
pop ecx
pop ecx
xor ecx, ecx
test esi, esi
fadd qword [0x1000a288]
cmovs esi, ecx
fstp qword [ebp - 0x58]
cvttsd2si eax, qword [ebp - 0x58]
test eax, eax
cmovs eax, ecx
test eax, eax
jle 0x1001639d
add eax, esi
cmp eax, edi
jne 0x100163a8
push 0x10009e10
call fcn.10057e5c
pop ecx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
jmp 0x100169d9
xor eax, eax
mov dword [ebp - 0x3c], 0xa43d
inc eax
lea ecx, [ebp - 0x51c]
push eax
call fcn.10011475
mov dword [ebp - 0x1c], 0xa92bd42c
xor edx, edx
mov dword [ebp - 0x34], 0xc9ebf495
inc edx
mov dword [ebp - 0x10], ebx
jmp 0x100163f1
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x51c]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100163de
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1001640a
push 0xd94
call dword [sym.imp.USER32.dll_GetSysColor]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x51c]
sub ecx, eax
jne 0x10016425
cmp dword [edx], ebx
jne 0x10016425
mov ecx, ebx
jmp 0x1001642a
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp dword [edx], ecx
setg al
neg eax
sub eax, dword [edx]
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x51c]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
setle bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x3c]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x51c]
call fcn.10011c4a
mov dword [ebp - 0x34], 0x98f01ba0
xor ebx, ebx
mov dword [ebp - 0x14], 0xe0648261
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x10016494
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [ebp - 0x14], ebx
jmp 0x10016577
mov dword [ebp - 0x18], 0x5f5b
lea ecx, [ebp - 0x4e0]
mov dword [ebp - 0x10], 0xafb5
push 3
call fcn.10011475
mov dword [ebp - 0x1c], ebx
jmp 0x100164cf
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4e0]
mov dword [eax + ecx*4], 0xf903
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100164bc
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], ebx
je 0x10016553
mov dword [ebp - 0x1c], 0x9da9
cmp dword [ebp - 0x1c], ebx
jne 0x10016583
push 2
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x1001654c
mov dword [ebp - 0x10], ebx
jmp 0x10016544
mov dword [ebp - 0x18], ebx
jmp 0x1001653b
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4e0]
mov dword [eax + ecx*4], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10016528
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x10016523
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1001651e
jmp 0x10016569
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x10016569
push ebx
push 0x17f7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea ecx, [ebp - 0x4e0]
call fcn.10011c4a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffff
jl 0x1001649c
jmp 0x1001658e
lea ecx, [ebp - 0x4e0]
call fcn.10011c4a
push 3
lea ecx, [ebp - 0x4b0]
call fcn.10011475
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffe
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], ebx
jmp 0x100165c7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4b0]
mov dword [eax + ecx*4], 0x9841b3c6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100165b4
mov dword [ebp - 0x18], ebx
jmp 0x1001682e
mov dword [ebp - 0x10], 0xb6748f69
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100165ec
push ebx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov dword [ebp - 0x34], 0x26ca
cmp dword [ebp - 0x34], 0xf07
jge 0x1001663e
lea eax, [ebp - 0x3c4]
mov ecx, 0x10660718
push eax
call fcn.10010f2e
mov eax, dword [ebp - 0x3c4]
and eax, 0x80000001
jns 0x1001661f
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, 0x106605f8
mov edx, 0x10009e14
test eax, eax
jg 0x10016632
mov edx, 0x10009e1c
call fcn.1000d867
push eax
call fcn.10013ebe
pop ecx
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x1001682b
xor edx, edx
mov dword [ebp - 0x1c], ebx
inc edx
jmp 0x10016667
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbc], 0x5206
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10016656
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xbc], ebx
je 0x1001667e
mov ecx, edx
cmp dword [ebp - 0x10], ebx
jne 0x10016680
mov ecx, ebx
mov eax, dword [ebp - 0x4b0]
cmp ecx, dword [eax]
jl 0x10016690
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x10], 0x34c2
jl 0x100166ac
mov eax, dword [ebp - 0x4b0]
cmp dword [eax + 8], ebx
jne 0x100166ac
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xffffffff
setge al
imul eax, dword [ebp - 0xbc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0x19d7
cmp dword [ebp - 0x34], 0xe43
jge 0x100167ab
lea eax, [ebp - 0x2f8]
mov ecx, 0x10660718
push eax
call fcn.10010f2e
mov edi, dword [ebp - 0x2f8]
cmp edi, 6
jge 0x1001670f
mov edx, 0x10009e24
mov ecx, 0x106605f8
call fcn.1000d867
push eax
call fcn.10013ebe
jmp 0x1001677d
push 2
pop esi
lea ebx, [edi - 1]
cmp ebx, esi
jle 0x1001673e
push esi
push ecx
mov edx, 0x10009e28
mov ecx, 0x106605f8
call fcn.1000d867
pop ecx
mov ecx, eax
call fcn.10011129
push eax
call fcn.10013ebe
inc esi
pop ecx
cmp esi, ebx
jl 0x10016719
push ebx
push ecx
mov ebx, 0x10009e2c
mov esi, 0x106605f8
mov edx, ebx
mov ecx, esi
call fcn.1000d867
pop ecx
mov ecx, eax
call fcn.10011129
push eax
call fcn.10013ebe
pop ecx
push edi
push ecx
mov edx, ebx
mov ecx, esi
call fcn.1000d867
pop ecx
mov ecx, eax
call fcn.10011129
push eax
call fcn.10013ebe
xor ebx, ebx
pop ecx
push 2
pop esi
inc edi
cmp edi, esi
jle 0x100167ab
push esi
push ecx
mov edx, 0x10009e28
mov ecx, 0x106605f8
call fcn.1000d867
pop ecx
mov ecx, eax
call fcn.10011129
push eax
call fcn.10013ebe
inc esi
pop ecx
cmp esi, edi
jl 0x10016786
mov dword [ebp - 0x1c], ebx
jmp 0x1001680f
push 2
lea ecx, [ebp - 0x414]
call fcn.10011475
mov dword [ebp - 0x14], ebx
jmp 0x100167d1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x414]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100167c2
mov eax, dword [ebp - 0x414]
cmp dword [eax], ebx
jne 0x10016817
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10016801
push 0x687
push 0xcb
push ebx
push 0x22e
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 0x414]
call fcn.10011c4a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x100167b0
jmp 0x10016822
lea ecx, [ebp - 0x414]
call fcn.10011c4a
dec dword [ebp - 0x10]
jns 0x1001664e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x100165d5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4b0]
call fcn.10011c4a
mov dword [ebp - 0x10], ebx
jmp 0x1001685d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8ac], 0x3617
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001684c
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x14], ebx
jmp 0x10016972
push 2
lea ecx, [ebp - 0x828]
call fcn.10011475
xor edx, edx
mov dword [ebp - 4], 7
inc edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x10], ebx
jmp 0x100168a4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x828]
mov dword [eax + ecx*4], 0xad95
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10016891
mov dword [ebp - 0x10], ebx
jmp 0x10016954
mov byte [ebp - 0x1d], bl
mov dword [ebp - 0x34], 0x21d2
cmp dword [ebp - 0x34], 0xb65
jge 0x10016940
lea eax, [ebp - 0x318]
push eax
push ecx
lea eax, [ebp - 0x308]
push eax
push ecx
lea eax, [ebp - 0x3c8]
push eax
push ecx
lea eax, [ebp - 0x388]
mov ecx, 0x10660718
push eax
call fcn.10010f2e
pop ecx
mov ecx, eax
call fcn.10010f2e
pop ecx
mov ecx, eax
call fcn.10010f2e
pop ecx
mov ecx, eax
call fcn.10010f2e
mov esi, ebx
mov ecx, ebx
mov eax, ecx
cdq
idiv dword [ebp - 0x388]
imul eax, dword [ebp - 0x308]
cmp eax, dword [ebp - 0x3c8]
jge 0x1001692b
inc esi
add ecx, dword [ebp - 0x318]
jmp 0x1001690a
push esi
mov ecx, 0x106605f8
call fcn.10011129
push eax
call fcn.10013ebe
xor edx, edx
pop ecx
inc edx
cmp byte [ebp - 0x1d], 0
je 0x10016951
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor edx, edx
inc edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x100168b2
mov dword [ebp - 0x10], edx
lea ecx, [ebp - 0x828]
or dword [ebp - 4], 0xffffffff
call fcn.10011c4a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffe
je 0x10016872
push 0xfffffffffffffff7
mov dword [ebp - 0x14], ebx
pop edx
cmp dword [ebp - 0x14], 0xffffffea
jl 0x100169c3
mov dword [ebp - 0x34], 0x98f01ba0
mov dword [ebp - 0x10], ebx
jmp 0x100169a5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8a0], 0x3617
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10016994
mov dword [ebp - 0x89c], edx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, edx
setle cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x14]
jmp 0x10016982
mov dword [ebp - 0x8a8], edx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, edx
setle cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffea
jge 0x100163b2
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], 0xfffffffa
jmp 0x10016a0b
cmp dword [ebp - 0x10], ebx
jne 0x10016a11
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10016a08
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe2
jge 0x100169f3
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], 0xfffffffa
jmp 0x10016a39
cmp dword [ebp - 0x10], ebx
jne 0x10016a3f
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10016a36
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe2
jge 0x10016a21
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x10], 0x13
cmp dword [ebp - 0x10], 0xffffffed
je 0x10016a7e
push 4
pop eax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10016a70
push 0x2542
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 4
pop eax
cmp dword [ebp - 0x34], ebx
jne 0x10016a7e
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffed
jne 0x10016a56
push 0xfffffffffffffffc
pop edi
mov dword [ebp - 0x1c], edi
xor ecx, ecx
mov dword [ebp - 0x40], 0x9a924c00
inc ecx
push 2
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x10016aaa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8c0], 0x95a9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10016a99
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jg 0x10016ac8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov eax, ebx
cmp dword [ebp - 0x40], ebx
je 0x10016aca
mov eax, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], ebx
jmp 0x10016ae3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8c0], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10016ad2
push 3
lea ecx, [ebp - 0x340]
call fcn.10011475
xor eax, eax
mov dword [ebp - 4], 8
inc eax
lea ecx, [ebp - 0x3c0]
mov dword [ebp - 0x2c], eax
push 3
call fcn.10011475
push 3
mov byte [ebp - 4], 9
mov dword [ebp - 0x24], ebx
pop edx
jmp 0x10016b2e
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x340]
mov dword [eax + ecx*4], 0x33a4a9bd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10016b1b
mov dword [ebp - 0x24], ebx
jmp 0x10016b48
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c0]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10016b38
push 2
pop ecx
mov dword [ebp - 0x2c], ecx
mov esi, 0xffff
cmp dword [ebp - 0x2c], ebx
jl 0x10016e6b
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x44], 0x1871d0c0
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ecx
jg 0x10016e62
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x4c], 0x8ba54f90
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jl 0x10016e53
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x3c], 0x433ac254
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
jl 0x10016e47
mov dword [ebp - 0x10], ecx
push ecx
lea ecx, [ebp - 0x5a4]
call fcn.10011475
mov dword [ebp - 0x68], 0xe5a1ae28
mov dword [ebp - 0x10], ebx
jmp 0x10016bd7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5a4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10016bc8
mov dword [ebp - 0x34], 0x264e
cmp dword [ebp - 0x34], 0x888
jge 0x10016ce2
call fcn.100577c7
push eax
push 0x10009e30
push 0x10009e34
call fcn.10057e36
add esp, 0xc
call fcn.100577c7
add eax, 0x20
push eax
push 0x10009e3c
push 0x10009e40
call fcn.10057e36
xor eax, eax
add esp, 0xc
lea ebx, [eax + 1]
lea eax, [ebp - 0xcc]
push eax
push 0x10009d04
call fcn.10055d2e
pop ecx
pop ecx
mov ecx, dword [ebp - 0xcc]
test ecx, ecx
je 0x10016ce0
xor edx, edx
mov edi, edx
test ecx, ecx
jle 0x10016c77
lea esi, [ebp - 0xa98]
push esi
push 0x10009d04
call fcn.10055d2e
pop ecx
pop ecx
mov ecx, dword [ebp - 0xcc]
inc edi
push 4
pop eax
add esi, eax
cmp edi, ecx
jl 0x10016c58
xor edx, edx
mov eax, edx
test ecx, ecx
jle 0x10016c89
add eax, dword [ebp + edx*4 - 0xa98]
inc edx
cmp edx, ecx
jl 0x10016c7d
cdq
idiv ecx
xor edx, edx
mov edi, edx
mov esi, edx
test ecx, ecx
jle 0x10016caa
mov edx, dword [ebp + esi*4 - 0xa98]
cmp edx, eax
jle 0x10016ca5
sub edx, eax
add edi, edx
inc esi
cmp esi, ecx
jl 0x10016c96
push edi
push ebx
push 0x10009e48
call fcn.100558e6
add esp, 0xc
lea eax, [ebp - 0xcc]
inc ebx
push eax
push 0x10009d04
call fcn.10055d2e
pop ecx
pop ecx
mov ecx, dword [ebp - 0xcc]
test ecx, ecx
jne 0x10016c4a
mov esi, 0xffff
xor ebx, ebx
mov dword [ebp - 0x10], ebx
jmp 0x10016e21
mov dword [ebp - 0x18], ebx
jmp 0x10016d00
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x25c], 0x2f1fcc10
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10016cef
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x25c]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c0]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x340]
cmp esi, dword [eax + ecx*4]
mov eax, dword [ebp - 0x24]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x44]
test ecx, ecx
jne 0x10016e09
mov eax, dword [ebp - 0x3c0]
xor edx, edx
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x5a4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x340]
cmp dword [eax + ecx*4], ebx
mov eax, dword [ebp - 0x25c]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x340]
setle cl
xor edx, edx
cmp ecx, dword [eax + esi*4]
setge dl
xor ebx, ebx
cmp edx, dword [eax + edi*4]
mov eax, dword [ebp - 0x4c]
setle bl
xor ecx, ecx
cmp ebx, eax
setne cl
xor eax, eax
cmp ecx, 4
setge al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x25c]
je 0x10016dd7
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c0]
cmp dword [eax], ecx
setg dl
xor eax, eax
cmp edx, 0x61160dd4
setle al
xor ebx, ebx
cmp eax, dword [ebp - 0x25c]
jg 0x10016e09
mov ecx, ebx
jmp 0x10016e0e
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x10]
mov esi, 0xffff
add eax, 0xfffffffb
add eax, ecx
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x10016cea
lea ecx, [ebp - 0x5a4]
call fcn.10011c4a
dec dword [ebp - 0x14]
mov esi, 0xffff
push 2
pop ecx
jns 0x10016bad
dec dword [ebp - 0x1c]
jns 0x10016b97
push 0xfffffffffffffffc
pop edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x10016b7a
xor eax, eax
inc eax
dec dword [ebp - 0x2c]
jns 0x10016b64
lea ecx, [ebp - 0x3c0]
call fcn.10011c4a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x340]
call fcn.10011c4a
push 0xa
pop edi
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x54], edi
jmp 0x100176f1
cmp dword [ebp - 0x18], ebx
jne 0x10017700
mov dword [ebp - 0x10], 0xaeb9ae77
mov dword [ebp - 0x34], 0x1f67
cmp dword [ebp - 0x34], 0x1260
jge 0x1001711d
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x98]
push eax
push 0x10009d10
call fcn.10055d2e
add esp, 0xc
mov dword [ebp - 0x398], ebx
lea eax, [ebp - 0x398]
lea ecx, [ebp - 0x960]
push eax
push dword [ebp - 0x8c]
call fcn.100234f7
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x1e8]
push eax
push dword [ebp - 0x98]
mov dword [ebp - 0x1e8], ebx
mov dword [ebp - 0x1e4], ebx
mov dword [ebp - 0x1e0], ebx
call fcn.10023a10
lea ecx, [ebp - 0x960]
mov byte [ebp - 4], 0xc
call fcn.10011c4a
mov eax, dword [ebp - 0x98]
mov edx, ebx
mov dword [ebp - 0x40], edx
mov edi, ebx
test eax, eax
jle 0x10016f8e
mov ebx, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x8c]
xor esi, esi
test ecx, ecx
jle 0x10016f83
mov eax, dword [ebx]
lea eax, [eax + esi*4]
push eax
push 0x10009dec
call fcn.10055d2e
mov eax, dword [ebx]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x8c]
cmp dword [eax + esi*4], edi
cmovg edi, dword [eax + esi*4]
inc esi
cmp esi, ecx
jl 0x10016f56
mov eax, dword [ebp - 0x98]
mov edx, dword [ebp - 0x40]
inc edx
add ebx, 0xc
mov dword [ebp - 0x40], edx
cmp edx, eax
jl 0x10016f4e
add edi, 0x83
push edi
call fcn.10050ea1
mov ebx, eax
xor eax, eax
pop ecx
mov word [ebx], ax
cmp edi, 2
jle 0x10016fbb
lea ecx, [edi - 2]
inc eax
push ecx
push eax
lea ecx, [ebx + 2]
push ecx
call fcn.100559a0
add esp, 0xc
xor eax, eax
movd xmm0, edi
mov esi, eax
cvtdq2pd xmm0, xmm0
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10055de4
fstp qword [ebp - 0x38]
movsd xmm0, qword [ebp - 0x38]
comisd xmm0, xmmword [0x1000a260]
jmp 0x10017021
cmp byte [esi + ebx], 0
je 0x10016ff8
lea eax, [esi + esi]
jmp 0x10016ff4
mov byte [eax + ebx], 0
add eax, esi
cmp eax, edi
jl 0x10016fee
movd xmm0, edi
inc esi
cvtdq2pd xmm0, xmm0
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10055de4
movd xmm1, esi
cvtdq2pd xmm1, xmm1
fstp qword [ebp - 0x38]
movsd xmm0, qword [ebp - 0x38]
comisd xmm0, xmm1
pop ecx
pop ecx
ja 0x10016fe3
mov esi, dword [ebp - 0x98]
xor ecx, ecx
mov edx, dword [ebp - 0x8c]
mov eax, ecx
mov dword [ebp - 0x40], eax
test esi, esi
jle 0x10017080
mov edi, dword [ebp - 0x1e8]
jmp 0x10017046
xor ecx, ecx
test edx, edx
jle 0x10017075
mov esi, dword [edi]
xor edx, edx
mov eax, dword [esi + ecx*4]
add eax, ebx
cmp byte [eax], dl
jne 0x1001705e
inc edx
inc eax
cmp byte [eax], 0
je 0x10017057
mov dword [esi + ecx*4], edx
inc ecx
mov edx, dword [ebp - 0x8c]
cmp ecx, edx
jl 0x1001704a
mov esi, dword [ebp - 0x98]
mov eax, dword [ebp - 0x40]
inc eax
add edi, 0xc
mov dword [ebp - 0x40], eax
cmp eax, esi
jl 0x10017044
mov eax, esi
imul eax, edx
imul ecx, eax, 0x83
test esi, esi
jle 0x100170c0
mov ebx, dword [ebp - 0x1e8]
mov edi, esi
mov dword [ebp - 0x3c], esi
xor eax, eax
test edx, edx
jle 0x100170b2
mov edi, dword [ebx]
mov dword [ebp - 0x40], edx
add eax, dword [edi]
lea edi, [edi + 4]
dec dword [ebp - 0x40]
jne 0x100170a5
mov edi, dword [ebp - 0x3c]
cmp eax, ecx
cmovl ecx, eax
add ebx, 0xc
dec edi
mov dword [ebp - 0x3c], edi
jne 0x1001709a
xor eax, eax
mov ebx, eax
test edx, edx
jle 0x100170fa
mov edi, eax
test esi, esi
jle 0x100170f0
mov edx, dword [ebp - 0x1e8]
mov dword [ebp - 0x34], esi
mov eax, dword [edx]
lea edx, [edx + 0xc]
add edi, dword [eax + ebx*4]
dec esi
jne 0x100170d7
mov edx, dword [ebp - 0x8c]
xor eax, eax
mov esi, dword [ebp - 0x98]
cmp edi, ecx
cmovl ecx, edi
inc ebx
cmp ebx, edx
jl 0x100170c8
push ecx
push 0x10009e78
call fcn.100558e6
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x1e8]
call fcn.10023a7b
xor ebx, ebx
mov esi, 0xcfb11589
push 4
mov dword [ebp - 0x24], ebx
pop ecx
jmp 0x10017136
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x194], 0xfffffffd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10017125
mov dword [ebp - 0x24], ebx
jmp 0x1001714d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x134], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10017140
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x188], eax
test eax, eax
jne 0x1001716f
cmp dword [ebp - 0x194], ebx
jne 0x1001716f
mov eax, ebx
jmp 0x10017172
xor eax, eax
inc eax
xor ecx, ecx
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x134]
cmp ecx, eax
mov eax, dword [ebp - 0x134]
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x194]
setle bl
xor edx, edx
cmp ecx, eax
setge dl
add edx, 0x10dd013d
cmp edx, ebx
jl 0x100171b9
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x190]
xor ecx, ecx
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x134]
cmp eax, 0xffffffff
setge cl
xor ebx, ebx
mov dword [ebp - 0x134], ecx
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x134], ebx
je 0x1001736a
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x6ac]
push 2
call fcn.10011475
mov dword [ebp - 0x10], ebx
jmp 0x10017221
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6ac]
mov dword [eax + ecx*4], 0x20eaadaf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001720e
cmp dword [ebp - 0x194], ebx
je 0x100172d6
mov dword [ebp - 0x2a8], 0xe80a7c6d
xor ecx, ecx
mov dword [ebp - 0x2a4], 0xe80a7c6d
inc ecx
mov dword [ebp - 0x2a0], 0xe80a7c6d
mov dword [ebp - 0x29c], 0xe80a7c6d
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 0x3c]
test eax, eax
je 0x10017275
mov edx, ecx
cmp dword [ebp - 0x2a0], ebx
jne 0x10017277
mov edx, ebx
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
xor ecx, ecx
cmp eax, 6
mov eax, dword [ebp - 0x2a0]
setne cl
imul eax, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x2a4]
setge dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x14]
jne 0x100172c4
cmp dword [ebp - 0x14], ebx
je 0x100172c4
xor eax, eax
lea ecx, [eax + 1]
jmp 0x100172c6
mov ecx, ebx
mov eax, dword [ebp - 0x2a4]
add eax, ecx
mov dword [ebp - 0x29c], eax
jmp 0x10017320
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x100172f4
push 0x856
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x10], 0xfffffff9
jmp 0x1001731a
mov dword [ebp - 0x14], ebx
jmp 0x10017311
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x194], ebx
jne 0x10017317
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x10017302
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe3
jl 0x100172fd
mov eax, dword [ebp - 0x194]
xor ecx, ecx
cmp eax, 0x5dd215cd
mov eax, dword [ebp - 0x6ac]
setle cl
xor edx, edx
cmp ecx, 0x762c
setl dl
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
sub edx, eax
cmp esi, edx
sbb ecx, ecx
inc ecx
neg ecx
mov dword [ebp - 0x134], ecx
mov eax, dword [ebp - 0x14]
xor eax, eax
test ecx, ecx
lea ecx, [ebp - 0x6ac]
setle al
mov dword [ebp - 0x10], eax
jmp 0x100173ae
push 3
lea ecx, [ebp - 0x5bc]
call fcn.10011475
mov dword [ebp - 0x10], ebx
jmp 0x1001738f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5bc]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001737c
mov eax, dword [ebp - 0x5bc]
lea ecx, [ebp - 0x5bc]
imul eax, dword [eax + 4], 0x38e5
mov dword [ebp - 0x134], eax
call fcn.10011c4a
mov byte [ebp - 0x1d], bl
mov dword [ebp - 0x14], 0x4b25b3b
push 4
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0x568be135
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x34], 0x1d58
cmp dword [ebp - 0x34], 0x48e
jge 0x100174db
lea eax, [ebp - 0xb8]
push eax
push 0x10009dec
call fcn.10055d2e
mov eax, dword [ebp - 0xb8]
pop ecx
pop ecx
test eax, eax
je 0x100174d4
dec eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x1d8]
push eax
lea eax, [ebp - 0x1bc]
push eax
push 0x10009e80
call fcn.10055d2e
xor eax, eax
add esp, 0xc
mov ecx, eax
mov edx, eax
mov esi, eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1bc]
mov ebx, 0xb2
mov dword [ebp - 0x40], edx
test eax, eax
jle 0x100174a2
mov ecx, dword [ebp - 0x1d8]
xor edi, edi
test ecx, ecx
jle 0x10017497
lea eax, [ebp - 0x1f8]
push eax
push 0x10009dec
call fcn.10055d2e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1f8]
test ecx, ecx
jns 0x10017477
neg ecx
inc esi
mov dword [ebp - 0x1f8], ecx
cmp ebx, ecx
mov eax, ecx
cmovl eax, ebx
add dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1d8]
inc edi
mov ebx, eax
cmp edi, ecx
jl 0x10017451
mov eax, dword [ebp - 0x1bc]
mov edx, dword [ebp - 0x40]
inc edx
mov dword [ebp - 0x40], edx
cmp edx, eax
jl 0x1001744b
mov ecx, dword [ebp - 0x1c]
and esi, 0x80000001
jns 0x100174af
dec esi
or esi, 0xfffffffe
inc esi
imul esi, ebx
neg esi
lea eax, [ecx + esi*2]
push eax
push 0x10009e78
call fcn.100558e6
mov eax, dword [ebp - 0xb8]
pop ecx
pop ecx
test eax, eax
jne 0x10017406
xor ebx, ebx
dec eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x3f0], 0x8436
xor ecx, ecx
mov dword [ebp - 0x3ec], 0x8436
inc ecx
mov dword [ebp - 0x3e8], 0x8436
mov dword [ebp - 0x3e4], 0x8436
mov dword [ebp - 0x24], ebx
jmp 0x1001751c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc8], 0x1ea66e58
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1001750b
mov dword [ebp - 0x24], ebx
jmp 0x10017537
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x948], 0x9a4d91f0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10017526
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x10]
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
je 0x1001758a
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
cmp ecx, 0x9d20578c
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
cmp eax, 0x79dc
jl 0x1001757e
mov eax, dword [ebp - 0x940]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
inc ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x3f0]
mov eax, dword [ebp - 0x3ec]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3f0], ebx
jne 0x100175b1
mov eax, ebx
cmp dword [ebp - 0xc8], ebx
je 0x100175b3
mov eax, ecx
mov dword [ebp - 0x14], eax
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
add ecx, 0x83de
cmp ecx, eax
setne dl
mov dword [ebp - 0xc8], edx
mov dword [ebp - 0x14], edx
cmp byte [ebp - 0x1d], 0
je 0x100176eb
push 2
lea ecx, [ebp - 0x3a8]
call fcn.10011475
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x34], 0x83de37d6
mov dword [ebp - 0x24], ebx
jmp 0x1001760d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x158], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x100175fc
mov dword [ebp - 0x24], ebx
jmp 0x1001762b
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3a8]
mov dword [eax + ecx*4], 0x976f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10017618
xor edx, edx
mov dword [ebp - 0x158], ebx
inc edx
cmp dword [ebp - 0x158], 0xe
jg 0x100176a2
dec dword [ebp - 0x18]
push 0xa
pop edi
cmp dword [ebp - 0x18], 0xffffffe2
mov esi, 0xcfb11589
jge 0x10016e9e
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x10], 0x13
cmp dword [ebp - 0x10], 0xffffffed
je 0x1001773f
push 4
pop eax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10017731
push 0x2542
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 4
pop eax
cmp dword [ebp - 0x34], ebx
jne 0x1001773f
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffed
jne 0x10017717
push 2
pop esi
push 0xfffffffffffffff6
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x10], ebx
pop edi
jmp 0x1001775e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8e0], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10017751
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
mov edx, 0x272
jmp 0x100177b3
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x780], edx
mov dword [ebp - 0x77c], edx
mov dword [ebp - 0x778], edx
mov dword [ebp - 0x774], edx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], ebx
jl 0x100177a8
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x8e0], ebx
jne 0x100177a8
dec dword [ebp - 0x10]
jns 0x10017797
cmp dword [ebp - 0x77c], ebx
jne 0x100177b8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x10017770
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jl 0x100177de
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100177d1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
dec dword [ebp - 0x1c]
jns 0x100177c0
xor ecx, ecx
mov edx, 0x272
inc ecx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x100177f7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x85c], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100177ea
mov dword [ebp - 0x1c], ebx
jmp 0x10017844
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x720], edx
mov dword [ebp - 0x71c], edx
mov dword [ebp - 0x718], edx
mov dword [ebp - 0x714], edx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], ebx
jl 0x10017839
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x85c], ebx
jne 0x10017839
dec dword [ebp - 0x10]
jns 0x10017828
cmp dword [ebp - 0x71c], ebx
jne 0x10017849
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x10017801
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jl 0x1001786a
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10017862
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
dec dword [ebp - 0x1c]
jns 0x10017851
xor ecx, ecx
inc ecx
push ecx
lea ecx, [ebp - 0x358]
call fcn.10011475
mov dword [ebp - 0x40], 0x4f204795
xor edx, edx
mov dword [ebp - 0x34], 0x481f3403
inc edx
mov dword [ebp - 0x18], ebx
jmp 0x1001789f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x358]
mov dword [eax + ecx*4], 0x9dfc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1001788c
mov dword [ebp - 0x18], ebx
mov edi, 0x8abc106e
jmp 0x100178bb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x79c], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100178ae
mov dword [ebp - 0x18], ebx
jmp 0x100178d7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xec], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100178c6
mov ecx, dword [ebp - 0xec]
xor edx, edx
add ecx, dword [ebp - 0x798]
mov eax, dword [ebp - 0x358]
mov eax, dword [eax]
mov dword [ebp - 0x794], eax
mov eax, dword [ebp - 0x358]
imul ecx, dword [eax]
mov eax, dword [ebp - 0xec]
cmp ecx, eax
mov eax, dword [ebp - 0xec]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x358]
setg cl
mov dword [ebp - 0x40], ecx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x40]
imul eax, ecx
sub eax, 0xfff6
je 0x1001793a
test ecx, ecx
je 0x1001793a
xor eax, eax
inc eax
jmp 0x1001793c
mov eax, ebx
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x358]
call fcn.10011c4a
mov eax, dword [0x1007589c]
lea ecx, [ebp - 0x3d8]
push 4
mov dword [ebp - 0x3c], eax
pop eax
push eax
call fcn.10011475
push 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1001797f
cmp dword [ebp - 0x10], edx
jl 0x1001796c