Function at 0x10009189
Capabilities:
Check os version
Extract resource via kernel32 functions
Get disk information
Get graphical window text
Identify system language via api
Modify service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14f8
call fcn.10076120
push esi
push edi
mov dword [ebp - 0x10c], 0xac204e2
mov dword [ebp - 0xa4], 0xffffffff
mov dword [ebp - 0xdec], 0xffffffff
mov dword [ebp - 0x4d4], 0xffffffff
mov dword [ebp - 0x4ec], 0xffffffff
mov dword [ebp - 0xac8], 0x24b34d7a
mov dword [ebp - 0x10c], 0x19
jmp 0x100091ed
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x1b
jle 0x1000964a
mov dword [ebp - 0xb8], 0x90197f0a
mov dword [ebp - 0x954], 8
mov dword [ebp - 0xaa0], 0xbec
mov dword [ebp - 0xf94], 0xdcff2fd6
mov dword [ebp - 0x394], 0
jmp 0x1000923b
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 3
jge 0x10009257
mov eax, dword [ebp - 0x394]
mov dword [ebp + eax*4 - 0x4a4], 9
jmp 0x1000922e
mov dword [ebp - 0xb8], 0
jmp 0x10009270
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jg 0x10009645
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp + eax*4 - 0x4a4]
mov dword [ebp - 0x12e0], eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp + eax*4 - 0x4a4]
mov dword [ebp - 0x12b4], eax
cmp dword [ebp - 0x10c], 0
je 0x100093f5
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x12bc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4a4]
mov dword [ebp - 0x954], eax
mov eax, dword [ebp - 0x954]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xdec], eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp + eax*4 - 0x4a4]
mov dword [ebp - 0x12c4], eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp + eax*4 - 0x4a4]
mov dword [ebp - 0x12cc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4a4]
cmp dword [ebp - 0xb8], eax
jg 0x1000932e
mov dword [ebp - 0xd98], 1
jmp 0x10009335
and dword [ebp - 0xd98], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xd98], eax
jl 0x1000934f
mov dword [ebp - 0xda0], 1
jmp 0x10009356
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0xaa0]
mov ecx, dword [ebp - 0xda0]
lea eax, [ecx + eax - 3]
mov ecx, dword [ebp - 0xb8]
cmp eax, dword [ebp + ecx*4 - 0x4a4]
jne 0x10009381
mov dword [ebp - 0xce4], 1
jmp 0x10009388
and dword [ebp - 0xce4], 0
mov eax, dword [ebp - 0xce4]
sub eax, dword [ebp - 0xf94]
sub eax, 0x1494
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x4a4]
jg 0x100093b4
mov dword [ebp - 0xa90], 1
jmp 0x100093bb
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xa90], eax
je 0x100093d5
mov dword [ebp - 0x4c4], 1
jmp 0x100093dc
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
add eax, 0x2570d978
je 0x100093f5
mov dword [ebp - 0xa98], 1
jmp 0x100093fc
and dword [ebp - 0xa98], 0
cmp dword [ebp - 0xa98], 0
jle 0x1000941a
cmp dword [ebp - 0x4d4], 0
je 0x1000941a
mov dword [ebp - 0x4cc], 1
jmp 0x10009421
and dword [ebp - 0x4cc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4cc]
sub ecx, 0xffff
cmp dword [ebp + eax - 0x4a4], ecx
jle 0x10009447
mov dword [ebp - 0xf9c], 1
jmp 0x1000944e
and dword [ebp - 0xf9c], 0
mov eax, dword [ebp - 0xaa0]
mov dword [ebp - 0x12d4], eax
xor eax, eax
je 0x10009473
cmp dword [ebp - 0x4d4], 0
je 0x10009473
mov dword [ebp - 0xaa8], 1
jmp 0x1000947a
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0xaa8]
add eax, 7
cmp eax, 0xfffffff8
jb 0x1000949a
cmp dword [ebp - 0x10c], 0
jne 0x1000949a
and dword [ebp - 0xfa4], 0
jmp 0x100094a4
mov dword [ebp - 0xfa4], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ebp + ecx*4 - 0x4a4]
cmp dword [ebp + eax - 0x4a4], ecx
jne 0x100094cc
mov dword [ebp - 0x4dc], 1
jmp 0x100094d3
and dword [ebp - 0x4dc], 0
imul eax, dword [ebp - 0x4dc], 0x6bb2
test eax, eax
je 0x100095d3
mov dword [ebp - 0x4e4], 1
cmp dword [ebp - 0x4ec], 0
je 0x1000950d
cmp dword [ebp - 0x4e4], 0
je 0x1000950d
mov dword [ebp - 0xab0], 1
jmp 0x10009514
and dword [ebp - 0xab0], 0
imul eax, dword [ebp - 0xab0], 0
test eax, eax
jne 0x10009531
mov eax, 0x59458d81
test eax, eax
jne 0x10009531
and dword [ebp - 0xac0], 0
jmp 0x1000953b
mov dword [ebp - 0xac0], 1
cmp dword [ebp - 0x4e4], 0
jne 0x10009556
mov eax, 0x8dd2dc09
test eax, eax
jne 0x10009556
and dword [ebp - 0xab8], 0
jmp 0x10009560
mov dword [ebp - 0xab8], 1
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0x4ec]
cmp dword [ebp - 0xac0], eax
jl 0x10009580
mov dword [ebp - 0x4f4], 1
jmp 0x10009587
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa4], 0xd
jmp 0x100095ac
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x14
jl 0x100095d1
mov byte [ebp - 0x1dd], 0
movzx eax, byte [ebp - 0x1dd]
test eax, eax
je 0x100095cf
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
jmp 0x1000959f
jmp 0x10009640
mov byte [ebp - 0x163], 0
movzx eax, byte [ebp - 0x163]
test eax, eax
je 0x100095f6
push 0
push 0
push 0x25b6
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [ebp - 0xa4], 0
jmp 0x1000960f
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xfffffff7
jle 0x10009640
mov byte [ebp - 0x1a1], 0
movzx eax, byte [ebp - 0x1a1]
test eax, eax
je 0x1000963e
push 0x172e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10009602
jmp 0x10009263
jmp 0x100091e0
mov eax, dword [ebp - 0xac8]
dec eax
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xe8], 0xac204e2
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0xff0], 0xffffffff
mov dword [ebp - 0xaf0], 0xffffffff
mov dword [ebp - 0xb08], 0xffffffff
mov dword [ebp - 0x544], 0x24b34d7a
mov dword [ebp - 0xe8], 0x19
jmp 0x100096ac
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x1b
jle 0x10009b09
mov dword [ebp - 0xb4], 0x90197f0a
mov dword [ebp - 0x4fc], 8
mov dword [ebp - 0x51c], 0xbec
mov dword [ebp - 0xff8], 0xdcff2fd6
mov dword [ebp - 0x340], 0
jmp 0x100096fa
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 3
jge 0x10009716
mov eax, dword [ebp - 0x340]
mov dword [ebp + eax*4 - 0x4b4], 9
jmp 0x100096ed
mov dword [ebp - 0xb4], 0
jmp 0x1000972f
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jg 0x10009b04
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0x4b4]
mov dword [ebp - 0x12dc], eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0x4b4]
mov dword [ebp - 0x12e4], eax
cmp dword [ebp - 0xe8], 0
je 0x100098b4
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x12ec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4b4]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xff0], eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0x4b4]
mov dword [ebp - 0x137c], eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0x4b4]
mov dword [ebp - 0x1384], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4b4]
cmp dword [ebp - 0xb4], eax
jg 0x100097ed
mov dword [ebp - 0xad0], 1
jmp 0x100097f4
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0xad0], eax
jl 0x1000980e
mov dword [ebp - 0x504], 1
jmp 0x10009815
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x51c]
mov ecx, dword [ebp - 0x504]
lea eax, [ecx + eax - 3]
mov ecx, dword [ebp - 0xb4]
cmp eax, dword [ebp + ecx*4 - 0x4b4]
jne 0x10009840
mov dword [ebp - 0xad8], 1
jmp 0x10009847
and dword [ebp - 0xad8], 0
mov eax, dword [ebp - 0xad8]
sub eax, dword [ebp - 0xff8]
sub eax, 0x1494
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x4b4]
jg 0x10009873
mov dword [ebp - 0x50c], 1
jmp 0x1000987a
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x50c], eax
je 0x10009894
mov dword [ebp - 0xae0], 1
jmp 0x1000989b
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0xae0]
add eax, 0x2570d978
je 0x100098b4
mov dword [ebp - 0x514], 1
jmp 0x100098bb
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0
jle 0x100098d9
cmp dword [ebp - 0xaf0], 0
je 0x100098d9
mov dword [ebp - 0xae8], 1
jmp 0x100098e0
and dword [ebp - 0xae8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xae8]
sub ecx, 0xffff
cmp dword [ebp + eax - 0x4b4], ecx
jle 0x10009906
mov dword [ebp - 0x1000], 1
jmp 0x1000990d
and dword [ebp - 0x1000], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x138c], eax
xor eax, eax
je 0x10009932
cmp dword [ebp - 0xaf0], 0
je 0x10009932
mov dword [ebp - 0x524], 1
jmp 0x10009939
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
add eax, 7
cmp eax, 0xfffffff8
jb 0x10009959
cmp dword [ebp - 0xe8], 0
jne 0x10009959
and dword [ebp - 0x1008], 0
jmp 0x10009963
mov dword [ebp - 0x1008], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb4]
mov ecx, dword [ebp + ecx*4 - 0x4b4]
cmp dword [ebp + eax - 0x4b4], ecx
jne 0x1000998b
mov dword [ebp - 0xaf8], 1
jmp 0x10009992
and dword [ebp - 0xaf8], 0
imul eax, dword [ebp - 0xaf8], 0x6bb2
test eax, eax
je 0x10009a92
mov dword [ebp - 0xb00], 1
cmp dword [ebp - 0xb08], 0
je 0x100099cc
cmp dword [ebp - 0xb00], 0
je 0x100099cc
mov dword [ebp - 0x52c], 1
jmp 0x100099d3
and dword [ebp - 0x52c], 0
imul eax, dword [ebp - 0x52c], 0
test eax, eax
jne 0x100099f0
mov eax, 0x59458d81
test eax, eax
jne 0x100099f0
and dword [ebp - 0x53c], 0
jmp 0x100099fa
mov dword [ebp - 0x53c], 1
cmp dword [ebp - 0xb00], 0
jne 0x10009a15
mov eax, 0x8dd2dc09
test eax, eax
jne 0x10009a15
and dword [ebp - 0x534], 0
jmp 0x10009a1f
mov dword [ebp - 0x534], 1
mov eax, dword [ebp - 0x534]
sub eax, dword [ebp - 0xb08]
cmp dword [ebp - 0x53c], eax
jl 0x10009a3f
mov dword [ebp - 0xb10], 1
jmp 0x10009a46
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xac], 0xd
jmp 0x10009a6b
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x14
jl 0x10009a90
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x10009a8e
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
jmp 0x10009a5e
jmp 0x10009aff
mov byte [ebp - 0x1df], 0
movzx eax, byte [ebp - 0x1df]
test eax, eax
je 0x10009ab5
push 0
push 0
push 0x25b6
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [ebp - 0xac], 0
jmp 0x10009ace
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xfffffff7
jle 0x10009aff
mov byte [ebp - 0x167], 0
movzx eax, byte [ebp - 0x167]
test eax, eax
je 0x10009afd
push 0x172e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10009ac1
jmp 0x10009722
jmp 0x1000969f
mov eax, dword [ebp - 0x544]
dec eax
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x1f4], 0xfffffffd
mov dword [ebp - 0x2a0], 0
jmp 0x10009b39
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 2
jge 0x10009b55
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0x14a4], 0x4f1f13b0
jmp 0x10009b2c
mov dword [ebp - 0x1f4], 0x11
jmp 0x10009b6e
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0xfffffff7
je 0x10009d8a
mov dword [ebp - 0x1a0], 0xfffffffb
mov dword [ebp - 0x244], 8
mov dword [ebp - 0x1400], 0x2891ba80
mov dword [ebp - 0x1408], 0xffffffff
mov dword [ebp - 0x1410], 0xfffffff9
mov dword [ebp - 0x1418], 1
mov dword [ebp - 0x1420], 3
mov dword [ebp - 0x1428], 0xfffffff8
mov dword [ebp - 0x1430], 0xfffffffe
mov dword [ebp - 0xb20], 0x65e4
cmp dword [ebp - 0x1f4], 0
je 0x10009c0f
imul eax, dword [ebp - 0x1a0], 0x79cf
mov ecx, dword [ebp - 0x1a0]
dec ecx
mov dword [ebp - 0x1a0], ecx
test eax, eax
je 0x10009c0f
mov dword [ebp - 0xb18], 1
jmp 0x10009c16
and dword [ebp - 0xb18], 0
cmp dword [ebp - 0x1f4], 0x7e673292
jg 0x10009c2e
mov dword [ebp - 0x54c], 1
jmp 0x10009c35
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
add eax, dword [ebp - 0x54c]
je 0x10009d3c
mov byte [ebp - 0x1a9], 0
movzx eax, byte [ebp - 0x1a9]
test eax, eax
je 0x10009c74
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [ebp - 0x1a0], 0xffffffe6
jmp 0x10009c8d
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x29
jg 0x10009d3a
mov dword [ebp - 0x244], 1
jmp 0x10009cb3
mov eax, dword [ebp - 0x244]
dec eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jl 0x10009d35
mov dword [ebp - 0x348], 0xffffffff
mov dword [ebp - 0x348], 0
jmp 0x10009cdf
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 1
jg 0x10009d30
mov dword [ebp - 0x2a8], 0x82c32b96
mov dword [ebp - 0x2a8], 0
jmp 0x10009d0b
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 1
jg 0x10009d2e
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x10009d2c
call dword [sym.imp.USER32.dll_CreateMenu]
jmp 0x10009cfe
jmp 0x10009cd2
jmp 0x10009ca6
jmp 0x10009c80
jmp 0x10009d78
mov dword [ebp - 0x1010], 3
mov dword [ebp - 0x1004], 0xb7136239
mov eax, dword [ebp - 0x1010]
mov dword [ebp - 0x1004], eax
mov byte [ebp - 0x1e1], 0
movzx eax, byte [ebp - 0x1e1]
test eax, eax
je 0x10009d78
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov eax, dword [ebp - 0xb20]
inc eax
mov dword [ebp - 0xb20], eax
jmp 0x10009b61
mov dword [ebp - 0xf0], 0xac204e2
mov dword [ebp - 0x3ec], 0x17be1879
mov dword [ebp - 0x290], 0
mov dword [ebp - 0xf8c], 0xef51
mov dword [ebp - 0xdf8], 0x6b34
mov dword [ebp - 0xe08], 3
mov dword [ebp - 0x114], 0
jmp 0x10009ddf
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x10009dfb
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x28c], 3
jmp 0x10009dd2
mov dword [ebp - 0x114], 0
jmp 0x10009e14
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jge 0x10009e30
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x1018], 0xdac842f8
jmp 0x10009e07
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x290], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28c]
mov dword [ebp - 0x1438], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28c]
cmp dword [ebp - 0x290], eax
je 0x10009e70
mov dword [ebp - 0x554], 1
jmp 0x10009e77
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 0
jbe 0x10009e8c
mov dword [ebp - 0xb28], 1
jmp 0x10009e93
and dword [ebp - 0xb28], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28c]
cmp dword [ebp - 0xb28], eax
jge 0x10009eb4
mov dword [ebp - 0x55c], 1
jmp 0x10009ebb
and dword [ebp - 0x55c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28c]
cmp dword [ebp - 0x55c], eax
je 0x10009edc
mov dword [ebp - 0xb30], 1
jmp 0x10009ee3
and dword [ebp - 0xb30], 0
cmp dword [ebp - 0xb30], 0x528a
je 0x10009efb
mov dword [ebp - 0x564], 1
jmp 0x10009f02
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x3ec], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1018]
imul eax, dword [ebp - 0x564]
imul eax, dword [ebp - 0xf8c]
cmp dword [ebp - 0x3ec], eax
jg 0x10009f3d
mov dword [ebp - 0xb38], 1
jmp 0x10009f44
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0xdf8]
cmp dword [ebp - 0xb38], eax
jl 0x10009f5e
mov dword [ebp - 0x56c], 1
jmp 0x10009f65
and dword [ebp - 0x56c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1018]
cmp dword [ebp - 0x56c], eax
jne 0x10009fb5
mov dword [ebp - 0xb40], 0xfffffffa
mov dword [ebp - 0x1440], 0x70cc321a
mov eax, dword [ebp - 0xb40]
mov dword [ebp - 0x1448], eax
mov eax, dword [ebp - 0xb40]
mov dword [ebp - 0x1450], eax
mov dword [ebp - 0x290], 0xffff0007
jmp 0x1000a10d
mov dword [ebp - 0x448], 0xfd09
mov dword [ebp - 0xf30], 0xffffffff
cmp dword [ebp - 0x448], 1
je 0x10009fde
mov dword [ebp - 0xf28], 1
jmp 0x10009fe5
and dword [ebp - 0xf28], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28c], 0xebe66343
jne 0x1000a004
mov dword [ebp - 0xe00], 1
jmp 0x1000a00b
and dword [ebp - 0xe00], 0
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x1458], eax
mov eax, 0x9ba7
test eax, eax
je 0x1000a033
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x1000a033
mov dword [ebp - 0xfbc], 1
jmp 0x1000a03a
and dword [ebp - 0xfbc], 0
cmp dword [ebp - 0xe08], 0x8909
jge 0x1000a059
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1000a059
mov dword [ebp - 0x574], 1
jmp 0x1000a060
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 5
jle 0x1000a075
mov dword [ebp - 0xb48], 1
jmp 0x1000a07c
and dword [ebp - 0xb48], 0
cmp dword [ebp - 0xb48], 0xce8d
jle 0x1000a094
mov dword [ebp - 0x57c], 1
jmp 0x1000a09b
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x448]
cmp eax, dword [ebp - 0x57c]
jle 0x1000a0b5
mov dword [ebp - 0xb50], 1
jmp 0x1000a0bc
and dword [ebp - 0xb50], 0
mov eax, dword [ebp - 0x448]
cmp dword [ebp - 0xb50], eax
jle 0x1000a0d6
mov dword [ebp - 0x584], 1
jmp 0x1000a0dd
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0xf30], eax
mov byte [ebp - 0x16b], 0
movzx eax, byte [ebp - 0x16b]
test eax, eax
je 0x1000a10d
push 0x13fb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x98], 0xffffffff
mov dword [ebp - 0xe10], 0xffffffff
mov dword [ebp - 0x1460], 0
mov byte [ebp - 0x1b1], 0
movzx eax, byte [ebp - 0x1b1]
test eax, eax
je 0x1000a14c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x1000a177
push 0
push 0xe3c
push 0
push 0x114
push 0x117d
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov dword [ebp - 0x5ac], 0xffffffff
mov dword [ebp - 0x5c4], 0xffffffff
mov dword [ebp - 0xba0], 0x24b34d7a
mov dword [ebp - 0xf0], 0x19
jmp 0x1000a1ae
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x1b
jle 0x1000a60b
mov dword [ebp - 0xa0], 0x90197f0a
mov dword [ebp - 0xb58], 8
mov dword [ebp - 0xb78], 0xbec
mov dword [ebp - 0xffc], 0xdcff2fd6
mov dword [ebp - 0x350], 0
jmp 0x1000a1fc
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 3
jge 0x1000a218
mov eax, dword [ebp - 0x350]
mov dword [ebp + eax*4 - 0x494], 9
jmp 0x1000a1ef
mov dword [ebp - 0xa0], 0
jmp 0x1000a231
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jg 0x1000a606
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x494]
mov dword [ebp - 0x1424], eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x494]
mov dword [ebp - 0x1358], eax
cmp dword [ebp - 0xf0], 0
je 0x1000a3b6
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x12a8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x494]
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xe10], eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x494]
mov dword [ebp - 0x1108], eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x494]
mov dword [ebp - 0x141c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x494]
cmp dword [ebp - 0xa0], eax
jg 0x1000a2ef
mov dword [ebp - 0x58c], 1
jmp 0x1000a2f6
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x58c], eax
jl 0x1000a310
mov dword [ebp - 0xb60], 1
jmp 0x1000a317
and dword [ebp - 0xb60], 0
mov eax, dword [ebp - 0xb78]
mov ecx, dword [ebp - 0xb60]
lea eax, [ecx + eax - 3]
mov ecx, dword [ebp - 0xa0]
cmp eax, dword [ebp + ecx*4 - 0x494]
jne 0x1000a342
mov dword [ebp - 0x594], 1
jmp 0x1000a349
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
sub eax, dword [ebp - 0xffc]
sub eax, 0x1494
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x494]
jg 0x1000a375
mov dword [ebp - 0xb68], 1
jmp 0x1000a37c
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0xb68], eax
je 0x1000a396
mov dword [ebp - 0x59c], 1
jmp 0x1000a39d
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x59c]
add eax, 0x2570d978
je 0x1000a3b6
mov dword [ebp - 0xb70], 1
jmp 0x1000a3bd
and dword [ebp - 0xb70], 0
cmp dword [ebp - 0xb70], 0
jle 0x1000a3db
cmp dword [ebp - 0x5ac], 0
je 0x1000a3db
mov dword [ebp - 0x5a4], 1
jmp 0x1000a3e2
and dword [ebp - 0x5a4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5a4]
sub ecx, 0xffff
cmp dword [ebp + eax - 0x494], ecx
jle 0x1000a408
mov dword [ebp - 0xe18], 1
jmp 0x1000a40f
and dword [ebp - 0xe18], 0
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0x1110], eax
xor eax, eax
je 0x1000a434
cmp dword [ebp - 0x5ac], 0
je 0x1000a434
mov dword [ebp - 0xb80], 1
jmp 0x1000a43b
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0xb80]
add eax, 7
cmp eax, 0xfffffff8
jb 0x1000a45b
cmp dword [ebp - 0xf0], 0
jne 0x1000a45b
and dword [ebp - 0xf38], 0
jmp 0x1000a465
mov dword [ebp - 0xf38], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa0]
mov ecx, dword [ebp + ecx*4 - 0x494]
cmp dword [ebp + eax - 0x494], ecx
jne 0x1000a48d
mov dword [ebp - 0x5b4], 1
jmp 0x1000a494
and dword [ebp - 0x5b4], 0
imul eax, dword [ebp - 0x5b4], 0x6bb2
test eax, eax
je 0x1000a594
mov dword [ebp - 0x5bc], 1
cmp dword [ebp - 0x5c4], 0
je 0x1000a4ce
cmp dword [ebp - 0x5bc], 0
je 0x1000a4ce
mov dword [ebp - 0xb88], 1
jmp 0x1000a4d5
and dword [ebp - 0xb88], 0
imul eax, dword [ebp - 0xb88], 0
test eax, eax
jne 0x1000a4f2
mov eax, 0x59458d81
test eax, eax
jne 0x1000a4f2
and dword [ebp - 0xb98], 0
jmp 0x1000a4fc
mov dword [ebp - 0xb98], 1
cmp dword [ebp - 0x5bc], 0
jne 0x1000a517
mov eax, 0x8dd2dc09
test eax, eax
jne 0x1000a517
and dword [ebp - 0xb90], 0
jmp 0x1000a521
mov dword [ebp - 0xb90], 1
mov eax, dword [ebp - 0xb90]
sub eax, dword [ebp - 0x5c4]
cmp dword [ebp - 0xb98], eax
jl 0x1000a541
mov dword [ebp - 0x5cc], 1
jmp 0x1000a548
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x98], 0xd
jmp 0x1000a56d
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x14
jl 0x1000a592
mov byte [ebp - 0x1e3], 0
movzx eax, byte [ebp - 0x1e3]
test eax, eax
je 0x1000a590
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
jmp 0x1000a560
jmp 0x1000a601
mov byte [ebp - 0x16f], 0
movzx eax, byte [ebp - 0x16f]
test eax, eax
je 0x1000a5b7
push 0
push 0
push 0x25b6
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [ebp - 0x98], 0
jmp 0x1000a5d0
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xfffffff7
jle 0x1000a601
mov byte [ebp - 0x1b9], 0
movzx eax, byte [ebp - 0x1b9]
test eax, eax
je 0x1000a5ff
push 0x172e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1000a5c3
jmp 0x1000a224
jmp 0x1000a1a1
mov eax, dword [ebp - 0xba0]
dec eax
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0x220], 0xfffffffd
mov dword [ebp - 0x2b0], 0
jmp 0x1000a63b
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 2
jge 0x1000a657
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x14b4], 0x4f1f13b0
jmp 0x1000a62e
mov dword [ebp - 0x220], 0x11
jmp 0x1000a670
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xfffffff7
je 0x1000a88c
mov dword [ebp - 0x160], 0xfffffffb
mov dword [ebp - 0x200], 8
mov dword [ebp - 0x12b0], 0x2891ba80
mov dword [ebp - 0x1118], 0xffffffff
mov dword [ebp - 0x13b0], 0xfffffff9
mov dword [ebp - 0x1120], 1
mov dword [ebp - 0x12b8], 3
mov dword [ebp - 0x1128], 0xfffffff8
mov dword [ebp - 0x145c], 0xfffffffe
mov dword [ebp - 0x5dc], 0x65e4
cmp dword [ebp - 0x220], 0
je 0x1000a711
imul eax, dword [ebp - 0x160], 0x79cf
mov ecx, dword [ebp - 0x160]
dec ecx
mov dword [ebp - 0x160], ecx
test eax, eax
je 0x1000a711
mov dword [ebp - 0x5d4], 1
jmp 0x1000a718
and dword [ebp - 0x5d4], 0
cmp dword [ebp - 0x220], 0x7e673292
jg 0x1000a730
mov dword [ebp - 0xba8], 1
jmp 0x1000a737
and dword [ebp - 0xba8], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x200]
add eax, dword [ebp - 0xba8]
je 0x1000a83e
mov byte [ebp - 0x171], 0
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x1000a776
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [ebp - 0x160], 0xffffffe6
jmp 0x1000a78f
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x29
jg 0x1000a83c
mov dword [ebp - 0x200], 1
jmp 0x1000a7b5
mov eax, dword [ebp - 0x200]
dec eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0
jl 0x1000a837
mov dword [ebp - 0x358], 0xffffffff
mov dword [ebp - 0x358], 0
jmp 0x1000a7e1
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 1
jg 0x1000a832
mov dword [ebp - 0x2b8], 0x82c32b96
mov dword [ebp - 0x2b8], 0
jmp 0x1000a80d
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 1
jg 0x1000a830
mov byte [ebp - 0x1e5], 0
movzx eax, byte [ebp - 0x1e5]
test eax, eax
je 0x1000a82e
call dword [sym.imp.USER32.dll_CreateMenu]
jmp 0x1000a800
jmp 0x1000a7d4
jmp 0x1000a7a8
jmp 0x1000a782
jmp 0x1000a87a
mov dword [ebp - 0xe20], 3
mov dword [ebp - 0xfc4], 0xb7136239
mov eax, dword [ebp - 0xe20]
mov dword [ebp - 0xfc4], eax
mov byte [ebp - 0x173], 0
movzx eax, byte [ebp - 0x173]
test eax, eax
je 0x1000a87a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
jmp 0x1000a663
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x208], 1
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
je 0x1000a8b4
mov dword [ebp - 0xbb0], 1
jmp 0x1000a8bb
and dword [ebp - 0xbb0], 0
cmp dword [ebp - 0x14], 3
je 0x1000a8cd
mov dword [ebp - 0xe28], 1
jmp 0x1000a8d4
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1130], eax
mov eax, dword [ebp - 0x14]
neg eax
cmp dword [ebp - 0xbb0], eax
je 0x1000a8f6
mov dword [ebp - 0x5e4], 1
jmp 0x1000a8fd
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x5e4], eax
jge 0x1000a914
mov dword [ebp - 0xbb8], 1
jmp 0x1000a91b
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xbb8]
jge 0x1000a932
mov dword [ebp - 0x5ec], 1
jmp 0x1000a939
and dword [ebp - 0x5ec], 0
cmp dword [ebp - 0x5ec], 0
je 0x1000ab4f
mov dword [ebp - 0x5f4], 0xffffffff
mov dword [ebp - 0x360], 0
jmp 0x1000a969
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 1
jge 0x1000a985
mov eax, dword [ebp - 0x360]
mov dword [ebp + eax*4 - 0xbd8], 1
jmp 0x1000a95c
mov dword [ebp - 0x14], 0
jmp 0x1000a995
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe2
je 0x1000ab1e
mov dword [ebp - 0x240], 0xffffffff
mov dword [ebp - 0x240], 0xfffffff6
jmp 0x1000a9c2
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 7
jle 0x1000ab19
mov dword [ebp - 0xf40], 4
cmp dword [ebp - 0x240], 0
je 0x1000aad6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbd8], 0x51b32e26
jne 0x1000aa05
mov dword [ebp - 0xbc0], 1
jmp 0x1000aa0c
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x5f4], eax
jne 0x1000aa32
mov dword [ebp - 0xbc8], 1
jmp 0x1000aa39
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xbc8]
jl 0x1000aa50
mov dword [ebp - 0x5fc], 1
jmp 0x1000aa57
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0xf40]
cmp dword [ebp - 0x5fc], eax
jne 0x1000aa71
mov dword [ebp - 0xbd0], 1
jmp 0x1000aa78
and dword [ebp - 0xbd0], 0
cmp dword [ebp - 0xbd0], 0xce3c
jne 0x1000aa90
mov dword [ebp - 0x604], 1
jmp 0x1000aa97
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x604]
jl 0x1000aaae
mov dword [ebp - 0x60c], 1
jmp 0x1000aab5
and dword [ebp - 0x60c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbd8]
cmp dword [ebp - 0x60c], eax
jge 0x1000aad6
mov dword [ebp - 0xbe0], 1
jmp 0x1000aadd
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0x208], eax
mov byte [ebp - 0x1c1], 0
movzx eax, byte [ebp - 0x1c1]
test eax, eax
je 0x1000ab14
push 0
push 0xe3c
push 0
push 0x114
push 0x117d
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x1000a9b5
jmp 0x1000a98e
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x1000ab4d
push 0
push 0x18c7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
jmp 0x1000ab6c
mov byte [ebp - 0x1e7], 0
movzx eax, byte [ebp - 0x1e7]
test eax, eax
je 0x1000ab6c
push 0x1fba
call dword [sym.imp.USER32.dll_MessageBeep]
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x1000ab7c
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff8
jne 0x1000abee
mov dword [ebp - 0x2c0], 0
jmp 0x1000ab9b
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 2
jge 0x1000abb7
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x12f8], 0xa5d87207
jmp 0x1000ab8e
mov dword [ebp - 0x208], 0
jmp 0x1000abd0
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x1000abec
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x12f8], 0xfffffffd
jmp 0x1000abc3
jmp 0x1000ab75
mov dword [ebp - 0x12c0], 0xa6847dfa
mov byte [ebp - 0x177], 0
movzx eax, byte [ebp - 0x177]
test eax, eax
je 0x1000ac28
push 0
push 0x121b
push 0x842
push 0x126
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
mov byte [ebp - 0x1c9], 0
movzx eax, byte [ebp - 0x1c9]
test eax, eax
je 0x1000ac5f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xff7
push 0x4ce
push 0xacb
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x228], 0xfffffffd
mov dword [ebp - 0x368], 0
jmp 0x1000ac82
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 2
jge 0x1000ac9e
mov eax, dword [ebp - 0x368]
mov dword [ebp + eax*4 - 0x14ac], 0x4f1f13b0
jmp 0x1000ac75
mov dword [ebp - 0x228], 0x11
jmp 0x1000acb7
mov eax, dword [ebp - 0x228]
dec eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xfffffff7
je 0x1000aed3
mov dword [ebp - 0x1a8], 0xfffffffb
mov dword [ebp - 0x210], 8
mov dword [ebp - 0x1138], 0x2891ba80
mov dword [ebp - 0x13c0], 0xffffffff
mov dword [ebp - 0x1140], 0xfffffff9
mov dword [ebp - 0x12c8], 1
mov dword [ebp - 0x1148], 3
mov dword [ebp - 0x13e4], 0xfffffff8
mov dword [ebp - 0x1150], 0xfffffffe
mov dword [ebp - 0x61c], 0x65e4
cmp dword [ebp - 0x228], 0
je 0x1000ad58
imul eax, dword [ebp - 0x1a8], 0x79cf
mov ecx, dword [ebp - 0x1a8]
dec ecx
mov dword [ebp - 0x1a8], ecx
test eax, eax
je 0x1000ad58
mov dword [ebp - 0x614], 1
jmp 0x1000ad5f
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x228], 0x7e673292
jg 0x1000ad77
mov dword [ebp - 0xbe8], 1
jmp 0x1000ad7e
and dword [ebp - 0xbe8], 0
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
add eax, dword [ebp - 0xbe8]
je 0x1000ae85
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x1000adbd
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [ebp - 0x1a8], 0xffffffe6
jmp 0x1000add6
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x29
jg 0x1000ae83
mov dword [ebp - 0x210], 1
jmp 0x1000adfc
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jl 0x1000ae7e
mov dword [ebp - 0x2c8], 0xffffffff
mov dword [ebp - 0x2c8], 0
jmp 0x1000ae28
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jg 0x1000ae79
mov dword [ebp - 0x370], 0x82c32b96
mov dword [ebp - 0x370], 0
jmp 0x1000ae54
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 1
jg 0x1000ae77
mov byte [ebp - 0x1e9], 0
movzx eax, byte [ebp - 0x1e9]
test eax, eax
je 0x1000ae75
call dword [sym.imp.USER32.dll_CreateMenu]
jmp 0x1000ae47
jmp 0x1000ae1b
jmp 0x1000adef
jmp 0x1000adc9
jmp 0x1000aec1
mov dword [ebp - 0xe30], 3
mov dword [ebp - 0xfec], 0xb7136239
mov eax, dword [ebp - 0xe30]
mov dword [ebp - 0xfec], eax
mov byte [ebp - 0x17b], 0
movzx eax, byte [ebp - 0x17b]
test eax, eax
je 0x1000aec1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov eax, dword [ebp - 0x61c]
inc eax
mov dword [ebp - 0x61c], eax
jmp 0x1000acaa
mov dword [ebp - 0x12d0], 0xffffffff
mov byte [ebp - 0x1d1], 0
movzx eax, byte [ebp - 0x1d1]
test eax, eax
je 0x1000aef7
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x1000af11
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x218], 1
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
je 0x1000af39
mov dword [ebp - 0xbf0], 1
jmp 0x1000af40
and dword [ebp - 0xbf0], 0
cmp dword [ebp - 0x10], 3
je 0x1000af52
mov dword [ebp - 0xe38], 1
jmp 0x1000af59
and dword [ebp - 0xe38], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x10]
neg eax
cmp dword [ebp - 0xbf0], eax
je 0x1000af7b
mov dword [ebp - 0x624], 1
jmp 0x1000af82
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x624], eax
jge 0x1000af99
mov dword [ebp - 0xbf8], 1
jmp 0x1000afa0
and dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xbf8]
jge 0x1000afb7
mov dword [ebp - 0x62c], 1
jmp 0x1000afbe
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 0
je 0x1000b1d4
mov dword [ebp - 0x634], 0xffffffff
mov dword [ebp - 0x2d0], 0
jmp 0x1000afee
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 1
jge 0x1000b00a
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0xc18], 1
jmp 0x1000afe1
mov dword [ebp - 0x10], 0
jmp 0x1000b01a
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe2
je 0x1000b1a3
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x238], 0xfffffff6
jmp 0x1000b047
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 7
jle 0x1000b19e
mov dword [ebp - 0xf48], 4
cmp dword [ebp - 0x238], 0
je 0x1000b15b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc18], 0x51b32e26
jne 0x1000b08a
mov dword [ebp - 0xc00], 1
jmp 0x1000b091
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0xc00]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x634], eax
jne 0x1000b0b7
mov dword [ebp - 0xc08], 1
jmp 0x1000b0be
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc08]
jl 0x1000b0d5
mov dword [ebp - 0x63c], 1
jmp 0x1000b0dc
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0xf48]
cmp dword [ebp - 0x63c], eax
jne 0x1000b0f6
mov dword [ebp - 0xc10], 1
jmp 0x1000b0fd
and dword [ebp - 0xc10], 0
cmp dword [ebp - 0xc10], 0xce3c
jne 0x1000b115
mov dword [ebp - 0x644], 1
jmp 0x1000b11c
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x644]
jl 0x1000b133
mov dword [ebp - 0x64c], 1
jmp 0x1000b13a
and dword [ebp - 0x64c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc18]
cmp dword [ebp - 0x64c], eax
jge 0x1000b15b
mov dword [ebp - 0xc20], 1
jmp 0x1000b162
and dword [ebp - 0xc20], 0
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x218], eax
mov byte [ebp - 0x1eb], 0
movzx eax, byte [ebp - 0x1eb]
test eax, eax
je 0x1000b199
push 0
push 0xe3c
push 0
push 0x114
push 0x117d
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x1000b03a
jmp 0x1000b013
mov byte [ebp - 0x17f], 0
movzx eax, byte [ebp - 0x17f]
test eax, eax
je 0x1000b1d2
push 0
push 0x18c7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
jmp 0x1000b1f1
mov byte [ebp - 0x1d9], 0
movzx eax, byte [ebp - 0x1d9]
test eax, eax
je 0x1000b1f1
push 0x1fba
call dword [sym.imp.USER32.dll_MessageBeep]
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x1000b201
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff8
jne 0x1000b273
mov dword [ebp - 0x378], 0
jmp 0x1000b220
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 2
jge 0x1000b23c
mov eax, dword [ebp - 0x378]
mov dword [ebp + eax*4 - 0x1304], 0xa5d87207
jmp 0x1000b213
mov dword [ebp - 0x218], 0
jmp 0x1000b255
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jge 0x1000b271
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0x1304], 0xfffffffd
jmp 0x1000b248
jmp 0x1000b1fa
mov dword [ebp - 0x380], 0x847dfa86
mov dword [ebp - 0x138], 0xb274bf90
mov dword [ebp - 0x2d8], 0
jmp 0x1000b2a0
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 2
jge 0x1000b2bc
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0x1088], 2
jmp 0x1000b293
cmp dword [ebp - 0x380], 0
je 0x1000b2f3
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x1000b2ee
push 0x7a2
push 0x57a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x1000b5fc
mov dword [ebp - 0x1b0], 0xc9e53e58
mov dword [ebp - 0x3f8], 0xdac0faab
mov dword [ebp - 0x1078], 0x80254f8
mov dword [ebp - 0x1074], 0x80254f8
mov dword [ebp - 0x1070], 0x80254f8
mov dword [ebp - 0x106c], 0x80254f8
mov dword [ebp - 0xe48], 0xffffffff
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x1b0], 1
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x13d0], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1160], eax
imul eax, dword [ebp - 0x380], 0xf145
cmp eax, 0xa4ccfd66
jb 0x1000b384
mov dword [ebp - 0x654], 1
jmp 0x1000b38b
and dword [ebp - 0x654], 0
cmp dword [ebp - 0x654], 0
jb 0x1000b3a0
mov dword [ebp - 0xc28], 1
jmp 0x1000b3a7
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0xc28], eax
jl 0x1000b3c1
mov dword [ebp - 0xe40], 1
jmp 0x1000b3c8
and dword [ebp - 0xe40], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x12d8], eax
mov dword [ebp - 0x138], 0x2b21a35c
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x138], eax
jle 0x1000b3f8
mov dword [ebp - 0x65c], 1
jmp 0x1000b3ff
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x65c], eax
jl 0x1000b419
mov dword [ebp - 0xc30], 1
jmp 0x1000b420
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0xc30]
add eax, 0xbc0d
sub eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x664], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x664]
mov dword [ebp + eax - 0x1088], ecx
mov eax, dword [ebp - 0x664]
neg eax
je 0x1000b495
mov dword [ebp - 0x138], 0
jmp 0x1000b46d
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xfffffff3
jg 0x1000b490
mov byte [ebp - 0x1ed], 0
movzx eax, byte [ebp - 0x1ed]
test eax, eax
je 0x1000b48e
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x1000b460
jmp 0x1000b5fc
mov dword [ebp - 0x66c], 0xe69ed994
mov dword [ebp - 0x2e0], 0
jmp 0x1000b4b8
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 3
jge 0x1000b4d4
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0x146c], 0x604491d0
jmp 0x1000b4ab
cmp dword [ebp - 0x1b0], 0
jle 0x1000b4e9
mov dword [ebp - 0xc38], 1
jmp 0x1000b4f0
and dword [ebp - 0xc38], 0
mov dword [ebp - 0x3f8], 7
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0xc40], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc40]
mov dword [ebp + eax - 0x1078], ecx
mov eax, dword [ebp - 0xc38]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x66c]
cmp dword [ebp - 0xc40], eax
jg 0x1000b53f
mov dword [ebp - 0xfcc], 1
jmp 0x1000b546
and dword [ebp - 0xfcc], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1078], 0xd31fc531
je 0x1000b565
mov dword [ebp - 0x674], 1
jmp 0x1000b56c
and dword [ebp - 0x674], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1088]
cmp dword [ebp - 0x674], eax
jl 0x1000b58d
mov dword [ebp - 0xc48], 1
jmp 0x1000b594
and dword [ebp - 0xc48], 0
cmp dword [ebp - 0xc48], 0x35b5b06a
jg 0x1000b5b2
mov eax, 0xd0cd
test eax, eax
jne 0x1000b5b2
and dword [ebp - 0x67c], 0
jmp 0x1000b5bc
mov dword [ebp - 0x67c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x146c]
cmp eax, dword [ebp - 0x67c]
jg 0x1000b5dd
mov dword [ebp - 0xc50], 1
jmp 0x1000b5e4
and dword [ebp - 0xc50], 0
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0xc50]
lea eax, [eax + ecx + 8]
neg eax
mov dword [ebp - 0xe48], eax
mov byte [ebp - 0x183], 0
movzx eax, byte [ebp - 0x183]
test eax, eax
je 0x1000b63b
push 0x12b4
push 0xa2f
push 0x1b51
push 0x945
push 0x4ab
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov dword [ebp - 0x1168], 0xa6847dfa
mov byte [ebp - 0x1ef], 0
movzx eax, byte [ebp - 0x1ef]
test eax, eax
je 0x1000b675
push 0
push 0x121b
push 0x842
push 0x126
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
mov byte [ebp - 0x185], 0
movzx eax, byte [ebp - 0x185]
test eax, eax
je 0x1000b6ac
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xff7
push 0x4ce
push 0xacb
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1f8], 1
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x1000b6d4
mov dword [ebp - 0x684], 1
jmp 0x1000b6db
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x18], 3
je 0x1000b6ed
mov dword [ebp - 0xf50], 1
jmp 0x1000b6f4
and dword [ebp - 0xf50], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x13e8], eax
mov eax, dword [ebp - 0x18]
neg eax
cmp dword [ebp - 0x684], eax
je 0x1000b716
mov dword [ebp - 0xc58], 1
jmp 0x1000b71d
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xc58], eax
jge 0x1000b734
mov dword [ebp - 0x68c], 1
jmp 0x1000b73b
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x68c]
jge 0x1000b752
mov dword [ebp - 0xc60], 1
jmp 0x1000b759
and dword [ebp - 0xc60], 0
cmp dword [ebp - 0xc60], 0
je 0x1000b96f
mov dword [ebp - 0xc68], 0xffffffff
mov dword [ebp - 0x388], 0
jmp 0x1000b789
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 1
jge 0x1000b7a5
mov eax, dword [ebp - 0x388]
mov dword [ebp + eax*4 - 0x6ac], 1
jmp 0x1000b77c
mov dword [ebp - 0x18], 0
jmp 0x1000b7b5
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe2
je 0x1000b93e
mov dword [ebp - 0x230], 0xffffffff
mov dword [ebp - 0x230], 0xfffffff6
jmp 0x1000b7e2
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 7
jle 0x1000b939
mov dword [ebp - 0xe50], 4
cmp dword [ebp - 0x230], 0
je 0x1000b8f6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6ac], 0x51b32e26
jne 0x1000b825
mov dword [ebp - 0x694], 1
jmp 0x1000b82c
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0xc68], eax
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0xc68], eax
jne 0x1000b852
mov dword [ebp - 0x69c], 1
jmp 0x1000b859
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x69c]
jl 0x1000b870
mov dword [ebp - 0xc70], 1
jmp 0x1000b877
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0xe50]
cmp dword [ebp - 0xc70], eax
jne 0x1000b891
mov dword [ebp - 0x6a4], 1
jmp 0x1000b898
and dword [ebp - 0x6a4], 0
cmp dword [ebp - 0x6a4], 0xce3c
jne 0x1000b8b0
mov dword [ebp - 0xc78], 1
jmp 0x1000b8b7
and dword [ebp - 0xc78], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc78]
jl 0x1000b8ce
mov dword [ebp - 0xc80], 1
jmp 0x1000b8d5
and dword [ebp - 0xc80], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6ac]
cmp dword [ebp - 0xc80], eax
jge 0x1000b8f6
mov dword [ebp - 0x6b4], 1
jmp 0x1000b8fd
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x1f8], eax
mov byte [ebp - 0x1dc], 0
movzx eax, byte [ebp - 0x1dc]
test eax, eax
je 0x1000b934
push 0
push 0xe3c
push 0
push 0x114
push 0x117d
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x1000b7d5
jmp 0x1000b7ae
mov byte [ebp - 0x187], 0
movzx eax, byte [ebp - 0x187]
test eax, eax
je 0x1000b96d
push 0
push 0x18c7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
jmp 0x1000b98c
mov byte [ebp - 0x1e6], 0
movzx eax, byte [ebp - 0x1e6]
test eax, eax
je 0x1000b98c
push 0x1fba
call dword [sym.imp.USER32.dll_MessageBeep]
mov dword [ebp - 0x18], 0xfffffffe
jmp 0x1000b99c
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff8
jne 0x1000ba0e
mov dword [ebp - 0x2e8], 0
jmp 0x1000b9bb
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 2
jge 0x1000b9d7
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0x1310], 0xa5d87207
jmp 0x1000b9ae
mov dword [ebp - 0x1f8], 0
jmp 0x1000b9f0
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jge 0x1000ba0c
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0x1310], 0xfffffffd
jmp 0x1000b9e3
jmp 0x1000b995
mov dword [ebp - 0x54], 0xddc85f70
mov dword [ebp - 0x254], 1
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x398], 0x566e66b6
mov dword [ebp - 0x400], 0x2efa
mov dword [ebp - 0x714], 0
mov dword [ebp - 0x6fc], 0xfaf1becd
mov dword [ebp - 0x10a8], 0xffffffff
mov dword [ebp - 0x10a4], 0xffffffff
mov dword [ebp - 0x10a0], 0xffffffff
mov dword [ebp - 0x109c], 0xffffffff
mov dword [ebp - 0xcd8], 0xfffffff9
mov dword [ebp - 0x54], 0
jmp 0x1000ba90
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 7
jge 0x1000bcd8
mov dword [ebp - 0x158], 0x52c5
mov dword [ebp - 0xf58], 0
cmp dword [ebp - 0x54], 0
je 0x1000bb95
mov dword [ebp - 0x390], 0xffffffff
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x390], 0
jne 0x1000bae3
mov dword [ebp - 0xc88], 1
jmp 0x1000baea
and dword [ebp - 0xc88], 0
cmp dword [ebp - 0xc88], 0xffffffff
jl 0x1000bb55
mov eax, dword [ebp - 0x158]
neg eax
cmp eax, dword [ebp - 0x158]
jle 0x1000bb15
cmp dword [ebp - 0x54], 0
je 0x1000bb15
mov dword [ebp - 0x6bc], 1
jmp 0x1000bb1c
and dword [ebp - 0x6bc], 0
cmp dword [ebp - 0x6bc], 0
jl 0x1000bb31
mov dword [ebp - 0xc90], 1
jmp 0x1000bb38
and dword [ebp - 0xc90], 0
mov eax, dword [ebp - 0xc90]
sub eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x390]
jg 0x1000bb55
and dword [ebp - 0x100c], 0
jmp 0x1000bb5f
mov dword [ebp - 0x100c], 1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1170], eax
cmp dword [ebp - 0x158], 0
jne 0x1000bb7d
mov dword [ebp - 0x6c4], 1
jmp 0x1000bb84
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0x390], eax
jmp 0x1000bcd3
mov dword [ebp - 0x488], 0x321210cb
mov dword [ebp - 0x2f0], 0
jmp 0x1000bbb8
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 1
jge 0x1000bbd4
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0xe58], 0xfffffffe
jmp 0x1000bbab
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0xc98], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc98]
mov dword [ebp + eax - 0xe58], ecx
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xc98], eax
jle 0x1000bc0a
mov dword [ebp - 0x6cc], 1
jmp 0x1000bc11
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x6cc]
imul eax, dword [ebp - 0x254]
test eax, eax
je 0x1000bc3a
cmp dword [ebp - 0x488], 0
je 0x1000bc3a
mov dword [ebp - 0xca0], 1
jmp 0x1000bc41
and dword [ebp - 0xca0], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xca0], eax
jg 0x1000bc58
mov dword [ebp - 0x6d4], 1
jmp 0x1000bc5f
and dword [ebp - 0x6d4], 0
cmp dword [ebp - 0x6d4], 0x197c
je 0x1000bc74
mov eax, 0xffff
test eax, eax
jne 0x1000bc86
cmp dword [ebp - 0x488], 0
jne 0x1000bc86
and dword [ebp - 0xca8], 0
jmp 0x1000bc90
mov dword [ebp - 0xca8], 1
imul eax, dword [ebp - 0x158], 0xc3d2
add eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0xca8]
jne 0x1000bcb4
mov dword [ebp - 0x6dc], 1
jmp 0x1000bcbb
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x158]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0xf58], eax
jmp 0x1000ba89
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x10fc], eax
mov eax, dword [ebp - 0x400]
add eax, 0x1d31
sub eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
jge 0x1000bd0c
mov dword [ebp - 0xcb0], 1
jmp 0x1000bd13
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0x398]
imul eax, dword [ebp - 0xcb0]
test eax, eax
jne 0x1000bd30
mov dword [ebp - 0x6e4], 1
jmp 0x1000bd37
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x6e4], eax
je 0x1000bd4e
mov dword [ebp - 0xcb8], 1
jmp 0x1000bd55
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0xcb8], eax
jge 0x1000bd6f
mov dword [ebp - 0xe60], 1
jmp 0x1000bd76
and dword [ebp - 0xe60], 0
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x1178], eax
mov eax, dword [ebp - 0x254]
add eax, 0x1dec7435
cmp eax, 0xad92edcd
jne 0x1000bda9
cmp dword [ebp - 0x254], 0
je 0x1000bda9
mov dword [ebp - 0x6ec], 1
jmp 0x1000bdb0
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x400]
cmp dword [ebp - 0x6ec], eax
jge 0x1000bdca
mov dword [ebp - 0xcc0], 1
jmp 0x1000bdd1
and dword [ebp - 0xcc0], 0
mov eax, dword [ebp - 0x400]
cmp dword [ebp - 0xcc0], eax
jg 0x1000bdeb
mov dword [ebp - 0x6f4], 1
jmp 0x1000bdf2
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x714], eax
cmp dword [ebp - 0x254], 0
jne 0x1000be25
cmp dword [ebp - 0x3c], 0
jne 0x1000be25
and dword [ebp - 0xcc8], 0
jmp 0x1000be2f
mov dword [ebp - 0xcc8], 1
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0x6fc], eax
cmp dword [ebp - 0x6fc], 0
je 0x1000be91
mov dword [ebp - 0x3c], 3
jmp 0x1000be54
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x1000be8c
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x10a8], 0
je 0x1000be69
jmp 0x1000be8c
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x1000be8a
push 0
push 0x19e0
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x1000be4d
jmp 0x1000bfbf
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0x2f8], 0
jmp 0x1000beb4
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 1
jge 0x1000bed0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0xfd4], 1
jmp 0x1000bea7
mov eax, dword [ebp - 0x3a0]
cmp dword [ebp - 0x3a0], eax
jne 0x1000bf28
cmp dword [ebp - 0x3c], 1
jg 0x1000bef0
mov dword [ebp - 0x450], 1
jmp 0x1000bef7
and dword [ebp - 0x450], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x450]
mov dword [ebp + eax - 0xfd4], ecx
cmp dword [ebp - 0x450], 0
je 0x1000bf28
cmp dword [ebp - 0x3a0], 0
je 0x1000bf28
mov dword [ebp - 0xe68], 1
jmp 0x1000bf2f
and dword [ebp - 0xe68], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x3c], eax
jne 0x1000bf43
mov dword [ebp - 0xcd0], 1
jmp 0x1000bf4a
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0xcd0]
sub eax, dword [ebp - 0x3a0]
add eax, 6
cmp eax, dword [ebp - 0x3c]
jge 0x1000bf6a
mov dword [ebp - 0x704], 1
jmp 0x1000bf71
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0xcd8]
cmp eax, dword [ebp - 0x704]
jg 0x1000bf8b
mov dword [ebp - 0x70c], 1
jmp 0x1000bf92
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0xcd8]
cmp dword [ebp - 0x70c], eax
jl 0x1000bfac
mov dword [ebp - 0xce0], 1
jmp 0x1000bfb3
and dword [ebp - 0xce0], 0
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0x714], eax
mov dword [ebp - 0x13e0], 0xffffffff
mov byte [ebp - 0x1de], 0
movzx eax, byte [ebp - 0x1de]
test eax, eax
je 0x1000bfe3
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov byte [ebp - 0x18b], 0
movzx eax, byte [ebp - 0x18b]
test eax, eax
je 0x1000bffd
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
mov dword [ebp - 0x3a8], 0xbac64a68
mov dword [ebp - 0x300], 0
jmp 0x1000c020
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 2
jge 0x1000c03c
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0x131c], 0xba33
jmp 0x1000c013
mov dword [ebp - 0x3a8], 0xfffffff1
jmp 0x1000c055
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0xfffffff3
jg 0x1000c0ef
mov dword [ebp - 0x308], 0
jmp 0x1000c07b
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 4
jge 0x1000c097
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0x1098], 0x50e6da50
jmp 0x1000c06e
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1098], 0
jmp 0x1000c0c2
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1098]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1098], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1098], 2
jge 0x1000c0ea
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1098]
mov dword [ebp + eax*4 - 0x131c], 0x74bf
jmp 0x1000c0a9
jmp 0x1000c048
mov byte [ebp - 0x1ee], 0
movzx eax, byte [ebp - 0x1ee]
test eax, eax
je 0x1000c12f
push 0
push 0xd65
push 0
push 0
push 0x12a7
push 0x1bbe
push 0xdf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov dword [ebp - 0x310], 0x847dfa86
mov dword [ebp - 0x140], 0xb274bf90
mov dword [ebp - 0x3b0], 0
jmp 0x1000c15c
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 2
jge 0x1000c178
mov eax, dword [ebp - 0x3b0]
mov dword [ebp + eax*4 - 0x1040], 2
jmp 0x1000c14f
cmp dword [ebp - 0x310], 0
je 0x1000c1af
mov byte [ebp - 0x18d], 0
movzx eax, byte [ebp - 0x18d]
test eax, eax
je 0x1000c1aa
push 0x7a2
push 0x57a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x1000c4b8
mov dword [ebp - 0x1b8], 0xc9e53e58
mov dword [ebp - 0x408], 0xdac0faab
mov dword [ebp - 0x1028], 0x80254f8
mov dword [ebp - 0x1024], 0x80254f8
mov dword [ebp - 0x1020], 0x80254f8
mov dword [ebp - 0x101c], 0x80254f8
mov dword [ebp - 0xff4], 0xffffffff
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x1b8], 1
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x1180], eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x12e8], eax
imul eax, dword [ebp - 0x310], 0xf145
cmp eax, 0xa4ccfd66
jb 0x1000c240
mov dword [ebp - 0xce8], 1
jmp 0x1000c247
and dword [ebp - 0xce8], 0
cmp dword [ebp - 0xce8], 0
jb 0x1000c25c
mov dword [ebp - 0x71c], 1
jmp 0x1000c263
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x71c], eax
jl 0x1000c27d
mov dword [ebp - 0xf60], 1
jmp 0x1000c284
and dword [ebp - 0xf60], 0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1188], eax
mov dword [ebp - 0x140], 0x2b21a35c
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x140], eax
jle 0x1000c2b4
mov dword [ebp - 0xcf0], 1
jmp 0x1000c2bb
and dword [ebp - 0xcf0], 0
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0xcf0], eax
jl 0x1000c2d5
mov dword [ebp - 0x724], 1
jmp 0x1000c2dc
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x724]
add eax, 0xbc0d
sub eax, dword [ebp - 0x408]
mov dword [ebp - 0xcf8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcf8]
mov dword [ebp + eax - 0x1040], ecx
mov eax, dword [ebp - 0xcf8]
neg eax
je 0x1000c351
mov dword [ebp - 0x140], 0
jmp 0x1000c329
cmp dword [ebp - 0x140], 0xfffffff3
jg 0x1000c34c
mov byte [ebp - 0x1e0], 0
movzx eax, byte [ebp - 0x1e0]
test eax, eax
je 0x1000c34a
jmp 0x1000c4b8
mov dword [ebp - 0xd00], 0xe69ed994
mov dword [ebp - 0x3b8], 0
jmp 0x1000c374
cmp dword [ebp - 0x3b8], 3
jge 0x1000c390
mov eax, dword [ebp - 0x3b8]
mov dword [ebp + eax*4 - 0x1484], 0x604491d0
jmp 0x1000c367
cmp dword [ebp - 0x1b8], 0
jle 0x1000c3a5
mov byte [ebp - 0x18f], 0
movzx eax, byte [ebp - 0x18f]
test eax, eax
je 0x1000c4f7
push 0x12b4
push 0xa2f
push 0x1b51
push 0x945
push 0x4ab
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov dword [ebp - 0xbc], 1
mov dword [ebp - 0xd48], 0x9537
mov dword [ebp - 0x77c], 2
mov dword [ebp - 0xd50], 1
mov dword [ebp - 0x478], 0
mov dword [ebp - 0xd60], 0x871e
mov dword [ebp - 0x794], 0x10aa4aec
mov dword [ebp - 0xe88], 0
mov dword [ebp - 0x318], 0
jmp 0x1000c560
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 1
jge 0x1000c579
mov eax, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0x2c], 0x91a049fe
jmp 0x1000c553
mov dword [ebp - 0xbc], 0
jmp 0x1000c592
cmp dword [ebp - 0xbc], 0
jg 0x1000c82b
mov dword [ebp - 0x1c], 0xb8114768
mov dword [ebp - 0x3c0], 0
jmp 0x1000c5bf
cmp dword [ebp - 0x3c0], 1
jge 0x1000c5db
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
mov dword [ebp - 0x11b0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
dec eax
cmp eax, 0xffff
jne 0x1000c859
mov dword [ebp - 0xd38], 1
jmp 0x1000c860
and dword [ebp - 0xd38], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd38]
sub ecx, dword [ebp + eax - 0x2c]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x2c]
jle 0x1000c888