Function at 0x1000a7ee
Capabilities:
Create directory
Create pipe
Create process on windows
Delete directory
Delete registry value
Get common file path
Get geographical location
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec4
push esi
push edi
mov dword [ebp - 0x324], 0xe0a8eac8
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x1000a81b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x324], 0
jmp 0x1000a834
mov eax, dword [ebp - 0x324]
dec eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0xffffffeb
je 0x1000a856
mov dword [ebp - 0x640], 0xffffffff
mov eax, dword [ebp - 0x640]
inc eax
mov dword [ebp - 0x640], eax
jmp 0x1000a827
mov dword [ebp - 0x280], 0xe0a8eac8
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x1000a878
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x280], 0
jmp 0x1000a891
mov eax, dword [ebp - 0x280]
dec eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xffffffeb
je 0x1000a8b3
mov dword [ebp - 0x7fc], 0xffffffff
mov eax, dword [ebp - 0x7fc]
inc eax
mov dword [ebp - 0x7fc], eax
jmp 0x1000a884
mov dword [ebp - 0x338], 0x3ae35568
mov dword [ebp - 0x338], 0xa
jmp 0x1000a8d6
mov eax, dword [ebp - 0x338]
dec eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 7
jne 0x1000a9b4
mov dword [ebp - 0x3fc], 1
mov dword [ebp - 0x938], 0xffffffff
mov dword [ebp - 0x288], 0
jmp 0x1000a910
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 3
jge 0x1000a92c
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0xd98], 0xffffffff
jmp 0x1000a903
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x804], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x804]
mov dword [ebp + eax - 0xd98], ecx
mov eax, dword [ebp - 0x3fc]
cmp dword [ebp - 0x804], eax
je 0x1000a965
mov dword [ebp - 0x404], 1
jmp 0x1000a96c
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x938], eax
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1000a9af
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x24d7
push 0x1735
push 0x95c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1000a8c9
mov dword [ebp - 0x360], 0
jmp 0x1000a9cd
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 4
jge 0x1000a9e9
mov eax, dword [ebp - 0x360]
mov dword [ebp + eax*4 - 0xa8c], 0x841b3c69
jmp 0x1000a9c0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xa8c], 0
jmp 0x1000aa14
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa8c]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xa8c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa8c], 0xffffffe4
je 0x1000aa71
mov dword [ebp - 0x9d8], 0x43046b6e
mov dword [ebp - 0x9e0], 0x464f16ef
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa8c]
sub eax, dword [ebp - 0x9d8]
cmp eax, 0xb9dd952e
jne 0x1000aa5c
mov dword [ebp - 0x80c], 1
jmp 0x1000aa63
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x9e0], eax
jmp 0x1000a9fb
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa8c], 0
je 0x1000aa93
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1000aa93
mov dword [ebp - 0x40c], 1
jmp 0x1000aa9a
and dword [ebp - 0x40c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x40c]
mov dword [ebp + eax - 0xa8c], ecx
mov dword [ebp - 0x380], 0xe0a8eac8
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x9f8], 0x89afca86
mov dword [ebp - 0xbd0], 4
mov dword [ebp - 0x290], 0
jmp 0x1000aaeb
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 1
jge 0x1000ab07
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0x81c], 0xaf11
jmp 0x1000aade
mov dword [ebp - 0x34], 0
jmp 0x1000ab17
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jg 0x1000adbd
mov dword [ebp - 0x98], 0xe0091df8
mov dword [ebp - 0x1cc], 1
mov dword [ebp - 0x388], 0x2e6c0b33
mov dword [ebp - 0x204], 1
mov dword [ebp - 0x240], 1
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbd4], eax
push 0xfffffffffffffff6
pop eax
add eax, 0x7cdedfc4
je 0x1000ab7b
mov eax, 0xfc2e
test eax, eax
je 0x1000ab7b
and dword [ebp - 0x814], 0
jmp 0x1000ab85
mov dword [ebp - 0x814], 1
mov eax, dword [ebp - 0x388]
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x34], eax
jge 0x1000aba2
mov dword [ebp - 0x9e8], 1
jmp 0x1000aba9
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbec], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0xbf4], eax
mov dword [ebp - 0x1cc], 0xffffffff
mov eax, dword [ebp - 0x1cc]
add eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x34]
jle 0x1000ac00
mov dword [ebp - 0x414], 1
jmp 0x1000ac07
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x414]
je 0x1000ac25
mov dword [ebp - 0x9f0], 1
jmp 0x1000ac2c
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xbfc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x81c]
mov dword [ebp - 0xc04], eax
mov dword [ebp - 0x9f8], 0xf47f28a9
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc0c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x81c], 1
je 0x1000ad5e
mov dword [ebp - 0xa00], 0
mov dword [ebp - 0xa90], 0x10b42b8f
mov dword [ebp - 0x204], 0
jmp 0x1000ac9c
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jg 0x1000acb3
mov eax, dword [ebp - 0xa00]
mov dword [ebp - 0xa90], eax
jmp 0x1000ac8f
mov dword [ebp - 0x98], 0
jmp 0x1000accc
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x1000ad5c
mov dword [ebp - 0x1cc], 0
jmp 0x1000acf2
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jg 0x1000ad57
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1000ad1e
push 0x386
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x1000ad55
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x24d7
push 0x1735
push 0x95c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1000ace5
jmp 0x1000acbf
jmp 0x1000ad7a
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x1000ad7a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x240], 0
jmp 0x1000ad93
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jg 0x1000adb8
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1000adb6
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x1000ad86
jmp 0x1000ab10
mov byte [ebp - 0xcd], 0
mov dword [ebp - 0x934], 0x76820624
mov dword [ebp - 0x930], 0x76820624
mov dword [ebp - 0x92c], 0x76820624
mov dword [ebp - 0x928], 0x76820624
mov dword [ebp - 0x390], 0xffffffff
mov dword [ebp - 0x210], 0xffffffff
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x934], 0
jmp 0x1000ae2e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x934]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x934], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x934], 0x17
jge 0x1000af39
mov dword [ebp - 0x340], 0xa986
mov dword [ebp - 0xaa8], 0x49968cb6
cmp dword [ebp - 0x340], 0
jne 0x1000aede
mov eax, 0x38d9
test eax, eax
je 0x1000ae7f
mov eax, dword [ebp - 0x340]
sub eax, 5
je 0x1000ae7f
mov dword [ebp - 0x41c], 1
jmp 0x1000ae86
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0x41c], eax
je 0x1000aea0
mov dword [ebp - 0xa98], 1
jmp 0x1000aea7
and dword [ebp - 0xa98], 0
mov eax, 0x4142b919
test eax, eax
je 0x1000aec5
mov eax, 0xde6fc608
test eax, eax
je 0x1000aec5
mov dword [ebp - 0xaa0], 1
jmp 0x1000aecc
and dword [ebp - 0xaa0], 0
cmp dword [ebp - 0x340], 0
jne 0x1000aede
and dword [ebp - 0x824], 0
jmp 0x1000aee8
mov dword [ebp - 0x824], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x934]
cmp dword [ebp - 0x824], eax
jg 0x1000af09
mov dword [ebp - 0x424], 1
jmp 0x1000af10
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x210], eax
jmp 0x1000ae13
mov dword [ebp - 0x210], 0
jmp 0x1000af52
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xfffffff7
jg 0x1000afad
mov dword [ebp - 0x298], 0
jmp 0x1000af74
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 1
jge 0x1000af90
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0x82c], 0x512dc6d0
jmp 0x1000af67
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x82c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x82c], eax
jmp 0x1000af45
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1000b1b4
mov dword [ebp - 0x8e4], 1
mov dword [ebp - 0x8e0], 1
mov dword [ebp - 0x8dc], 1
mov dword [ebp - 0x8d8], 1
mov dword [ebp - 0x19c], 0x68108531
mov dword [ebp - 0xb4c], 0x598aaf0a
mov dword [ebp - 0xb48], 0x598aaf0a
mov dword [ebp - 0xb44], 0x598aaf0a
mov dword [ebp - 0xb40], 0x598aaf0a
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x8e4]
cmp dword [ebp + eax - 0x8e4], ecx
jne 0x1000b03d
mov dword [ebp - 0x42c], 1
jmp 0x1000b044
and dword [ebp - 0x42c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8e4], 0x4320e32c
jge 0x1000b063
mov dword [ebp - 0x834], 1
jmp 0x1000b06a
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x42c]
cmp eax, dword [ebp - 0x834]
jl 0x1000b084
mov dword [ebp - 0x434], 1
jmp 0x1000b08b
and dword [ebp - 0x434], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8e4]
cmp eax, dword [ebp - 0x434]
jg 0x1000b0ab
mov dword [ebp - 0x83c], 1
jmp 0x1000b0b2
and dword [ebp - 0x83c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8e4]
cmp dword [ebp - 0x83c], eax
jge 0x1000b0d3
mov dword [ebp - 0x43c], 1
jmp 0x1000b0da
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0xb963
jl 0x1000b0fe
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x8e4], 0
jne 0x1000b0fe
and dword [ebp - 0x844], 0
jmp 0x1000b108
mov dword [ebp - 0x844], 1
cmp dword [ebp - 0x844], 0xec3203b
jle 0x1000b120
mov dword [ebp - 0x444], 1
jmp 0x1000b127
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x19c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x19c]
mov dword [ebp + eax - 0xb4c], ecx
mov dword [ebp - 0x19c], 0xffffffe3
jmp 0x1000b15f
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0x1b
jl 0x1000b1ae
mov dword [ebp - 0x268], 0
mov dword [ebp - 0xab0], 0xf4039ee4
mov dword [ebp - 0x268], 0
jmp 0x1000b195
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0xfffffffc
jg 0x1000b1ac
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0xab0], eax
jmp 0x1000b188
jmp 0x1000b152
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x380], 0
jmp 0x1000b1cd
mov eax, dword [ebp - 0x380]
dec eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffeb
je 0x1000b579
mov dword [ebp - 0x88], 4
mov dword [ebp - 0x454], 0xffffffff
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1000b20a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x88], 0xffffffef
jmp 0x1000b223
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xc
jge 0x1000b393
mov dword [ebp - 0x1a4], 0xffff
mov dword [ebp - 0x1f4], 1
mov dword [ebp - 0x854], 0xee91b76e
mov dword [ebp - 0x2a0], 0
jmp 0x1000b267
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 1
jge 0x1000b283
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0x9d0], 0x2c9bf5e4
jmp 0x1000b25a
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0xc1c], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xc24], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0xc2c], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xc34], eax
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x1f4], eax
jge 0x1000b2f1
mov dword [ebp - 0xaa4], 1
jmp 0x1000b2f8
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xc3c], eax
mov eax, dword [ebp - 0x1f4]
sub eax, 0x3ca3691f
imul eax, dword [ebp - 0x88]
cmp eax, 5
jne 0x1000b327
mov dword [ebp - 0x84c], 1
jmp 0x1000b32e
and dword [ebp - 0x84c], 0
imul eax, dword [ebp - 0x84c], 0xdd97
cmp eax, dword [ebp - 0x88]
jle 0x1000b34c
mov dword [ebp - 0x44c], 1
jmp 0x1000b353
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x1a4]
imul eax, dword [ebp - 0x1a4]
neg eax
imul eax, dword [ebp - 0x44c]
mov dword [ebp - 0x854], eax
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x454], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x454]
mov dword [ebp + eax - 0x9d0], ecx
jmp 0x1000b216
mov dword [ebp - 0x480], 0xffffffff
mov dword [ebp - 0x348], 0xffff
mov dword [ebp - 0x46c], 0xfffffffd
mov dword [ebp - 0x474], 0xfffffffb
mov dword [ebp - 0x944], 0xa2ca335c
mov dword [ebp - 0x24], 0
jmp 0x1000b3d5
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1000b3eb
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xadc], 0xcf8
jmp 0x1000b3ce
mov dword [ebp - 0x24], 0
jmp 0x1000b3fb
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1000b411
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc58], 0x95e0e2bf
jmp 0x1000b3f4
cmp dword [ebp - 0x348], 0
je 0x1000b54d
cmp dword [ebp - 0x348], 0x60a421e0
je 0x1000b436
mov dword [ebp - 0x85c], 1
jmp 0x1000b43d
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x348]
cmp eax, dword [ebp - 0x85c]
jne 0x1000b457
mov dword [ebp - 0x45c], 1
jmp 0x1000b45e
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0x45c], eax
jle 0x1000b478
mov dword [ebp - 0x864], 1
jmp 0x1000b47f
and dword [ebp - 0x864], 0
imul eax, dword [ebp - 0x864], 0x4d39
test eax, eax
jne 0x1000b499
mov dword [ebp - 0x464], 1
jmp 0x1000b4a0
and dword [ebp - 0x464], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xadc]
cmp dword [ebp - 0x464], eax
je 0x1000b4c1
mov dword [ebp - 0x86c], 1
jmp 0x1000b4c8
and dword [ebp - 0x86c], 0
cmp dword [ebp - 0x86c], 0x63069be5
jle 0x1000b4e0
mov dword [ebp - 0x874], 1
jmp 0x1000b4e7
and dword [ebp - 0x874], 0
mov dword [ebp - 0x46c], 0x5059b8bc
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x874]
add eax, 0x4cbed562
cmp dword [ebp - 0x474], eax
jl 0x1000b525
cmp dword [ebp - 0x944], 0
je 0x1000b525
mov dword [ebp - 0x87c], 1
jmp 0x1000b52c
and dword [ebp - 0x87c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x87c]
sub ecx, dword [ebp + eax - 0xadc]
je 0x1000b54d
mov dword [ebp - 0x884], 1
jmp 0x1000b554
and dword [ebp - 0x884], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x884]
mov dword [ebp + eax - 0xc58], ecx
mov eax, dword [ebp - 0x480]
inc eax
mov dword [ebp - 0x480], eax
jmp 0x1000b1c0
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0xa78], 0x89afca86
mov dword [ebp - 0xc44], 4
mov dword [ebp - 0x2a8], 0
jmp 0x1000b5ad
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 1
jge 0x1000b5c9
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0x6b0], 0xaf11
jmp 0x1000b5a0
mov dword [ebp - 0x3c], 0
jmp 0x1000b5d9
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jg 0x1000b87f
mov dword [ebp - 0xa4], 0xe0091df8
mov dword [ebp - 0x1d4], 1
mov dword [ebp - 0x3c0], 0x2e6c0b33
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x248], 1
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xc4c], eax
push 0xfffffffffffffff6
pop eax
add eax, 0x7cdedfc4
je 0x1000b63d
mov eax, 0xfc2e
test eax, eax
je 0x1000b63d
and dword [ebp - 0x6ac], 0
jmp 0x1000b647
mov dword [ebp - 0x6ac], 1
mov eax, dword [ebp - 0x3c0]
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x3c], eax
jge 0x1000b664
mov dword [ebp - 0xa20], 1
jmp 0x1000b66b
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0xd14], eax
mov dword [ebp - 0x1d4], 0xffffffff
mov eax, dword [ebp - 0x1d4]
add eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x3c]
jle 0x1000b6c2
mov dword [ebp - 0x488], 1
jmp 0x1000b6c9
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x488]
je 0x1000b6e7
mov dword [ebp - 0x94c], 1
jmp 0x1000b6ee
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd1c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6b0]
mov dword [ebp - 0xd24], eax
mov dword [ebp - 0xa78], 0xf47f28a9
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd2c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6b0], 1
je 0x1000b820
mov dword [ebp - 0x954], 0
mov dword [ebp - 0xa1c], 0x10b42b8f
mov dword [ebp - 0x218], 0
jmp 0x1000b75e
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jg 0x1000b775
mov eax, dword [ebp - 0x954]
mov dword [ebp - 0xa1c], eax
jmp 0x1000b751
mov dword [ebp - 0xa4], 0
jmp 0x1000b78e
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x1000b81e
mov dword [ebp - 0x1d4], 0
jmp 0x1000b7b4
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jg 0x1000b819
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1000b7e0
push 0x386
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 0x171], 0
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x1000b817
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x24d7
push 0x1735
push 0x95c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1000b7a7
jmp 0x1000b781
jmp 0x1000b83c
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x1000b83c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x248], 0
jmp 0x1000b855
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jg 0x1000b87a
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1000b878
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x1000b848
jmp 0x1000b5d2
mov dword [ebp - 0x44], 0x1c77dcd
mov dword [ebp - 0x4c0], 0xbf118c84
mov dword [ebp - 0xf8], 1
mov dword [ebp - 0x28], 0
jmp 0x1000b8aa
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1000b8c0
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf0], 0xc03342eb
jmp 0x1000b8a3
mov dword [ebp - 0x28], 0
jmp 0x1000b8d0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1000b8e6
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb4], 0xfffffff8
jmp 0x1000b8c9
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xf0], 0
jmp 0x1000b914
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf0], 0xffffffeb
jg 0x1000be49
mov dword [ebp - 0xe8], 0xfffffff8
mov dword [ebp - 0x3d8], 0xfffffff9
mov dword [ebp - 0x368], 0
mov dword [ebp - 0x4d8], 3
mov dword [ebp - 0x80], 0
jmp 0x1000b960
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1000b976
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xabc], 1
jmp 0x1000b959
mov dword [ebp - 0x80], 0
jmp 0x1000b986
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1000b99c
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xa2c], 0x97736eae
jmp 0x1000b97f
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0xe8], eax
je 0x1000b9b6
mov dword [ebp - 0x4b8], 1
jmp 0x1000b9bd
and dword [ebp - 0x4b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x1000b9f7
mov eax, dword [ebp - 0x368]
dec eax
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
add eax, dword [ebp - 0x3d8]
jne 0x1000b9f7
and dword [ebp - 0x490], 0
jmp 0x1000ba01
mov dword [ebp - 0x490], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
cmp dword [ebp - 0x490], eax
jne 0x1000ba22
mov dword [ebp - 0x7c0], 1
jmp 0x1000ba29
and dword [ebp - 0x7c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
cmp dword [ebp - 0x7c0], eax
jne 0x1000ba4a
mov dword [ebp - 0x498], 1
jmp 0x1000ba51
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
sub eax, 0x36d0
neg eax
cmp eax, dword [ebp - 0x3d8]
jg 0x1000ba72
mov dword [ebp - 0x398], 1
jmp 0x1000ba79
and dword [ebp - 0x398], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x398]
mov dword [ebp + eax - 0xabc], ecx
mov eax, dword [ebp - 0x398]
neg eax
cmp eax, dword [ebp - 0xe8]
jg 0x1000baa7
mov dword [ebp - 0x6b8], 1
jmp 0x1000baae
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x3d8]
cmp eax, dword [ebp - 0x6b8]
jge 0x1000bac8
mov dword [ebp - 0x4a0], 1
jmp 0x1000bacf
and dword [ebp - 0x4a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
cmp dword [ebp - 0x4a0], eax
jg 0x1000baf6
cmp dword [ebp - 0x44], 0
je 0x1000baf6
mov dword [ebp - 0x848], 1
jmp 0x1000bafd
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x848]
neg eax
cmp eax, dword [ebp - 0xe8]
jg 0x1000bb19
mov dword [ebp - 0x4a8], 1
jmp 0x1000bb20
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x4a8]
add eax, 5
imul eax, dword [ebp - 0xe8]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xf0]
jle 0x1000bb54
mov eax, 0xbb1bb30b
test eax, eax
je 0x1000bb54
mov dword [ebp - 0x6c0], 1
jmp 0x1000bb5b
and dword [ebp - 0x6c0], 0
imul eax, dword [ebp - 0x6c0], 0
mov dword [ebp - 0x4b0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4b0]
mov dword [ebp + eax - 0xb4], ecx
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x4b0], eax
je 0x1000bb95
mov dword [ebp - 0x7c8], 1
jmp 0x1000bb9c
and dword [ebp - 0x7c8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa2c]
cmp dword [ebp - 0x7c8], eax
jne 0x1000bbbd
mov dword [ebp - 0x6c8], 1
jmp 0x1000bbc4
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x4b8]
add eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0xf8], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xa2c]
cmp dword [ebp + eax - 0xabc], ecx
jg 0x1000bc7c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xabc], 0
je 0x1000bc1e
or eax, 0xffffffff
je 0x1000bc1e
mov dword [ebp - 0x8a4], 1
jmp 0x1000bc25
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x4d8]
cmp dword [ebp - 0x8a4], eax
jge 0x1000bc3f
mov dword [ebp - 0x4c8], 1
jmp 0x1000bc46
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x368]
cmp dword [ebp - 0x4c8], eax
jl 0x1000bc60
mov dword [ebp - 0x6d0], 1
jmp 0x1000bc67
and dword [ebp - 0x6d0], 0
cmp dword [ebp - 0x6d0], 0xfffffffc
jae 0x1000bc7c
mov dword [ebp - 0x4d0], 1
jmp 0x1000bc83
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0xe8]
add eax, dword [ebp - 0x4d0]
je 0x1000bca3
cmp dword [ebp - 0x44], 0
je 0x1000bca3
mov dword [ebp - 0x7d0], 1
jmp 0x1000bcaa
and dword [ebp - 0x7d0], 0
cmp dword [ebp - 0x7d0], 0xe20
jne 0x1000bcc2
mov dword [ebp - 0x6d8], 1
jmp 0x1000bcc9
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x4d8]
cmp dword [ebp - 0x6d8], eax
je 0x1000bce3
mov dword [ebp - 0x4e0], 1
jmp 0x1000bcea
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
sub eax, 0xf2ec
cmp eax, dword [ebp - 0xf8]
jne 0x1000bd0c
cmp dword [ebp - 0x44], 0
jne 0x1000bd0c
and dword [ebp - 0x850], 0
jmp 0x1000bd16
mov dword [ebp - 0x850], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa2c]
cmp dword [ebp - 0x850], eax
je 0x1000bd37
mov dword [ebp - 0x4e8], 1
jmp 0x1000bd3e
and dword [ebp - 0x4e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
cmp dword [ebp - 0x4e8], eax
jl 0x1000bd68
mov eax, 0xd038cf49
test eax, eax
je 0x1000bd68
mov dword [ebp - 0x6e0], 1
jmp 0x1000bd6f
and dword [ebp - 0x6e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
cmp eax, dword [ebp - 0x6e0]
jle 0x1000bd90
mov dword [ebp - 0x4f0], 1
jmp 0x1000bd97
and dword [ebp - 0x4f0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xabc]
sub eax, dword [ebp - 0x4f0]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xb4]
jg 0x1000be0f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb4], 0
je 0x1000be0f
mov dword [ebp - 0x44], 0xfffffff2
jmp 0x1000bdd9
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffff1
jg 0x1000be0d
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x1000be0b
push 0x94e
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1000bdd2
jmp 0x1000be44
mov dword [ebp - 0xf8], 0
jmp 0x1000be28
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jge 0x1000be44
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0xb4], 0
jmp 0x1000be1b
jmp 0x1000b8f9
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1000be6c
push 0
push 0x1bba
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x964], 0x89afca86
mov dword [ebp - 0xd34], 4
mov dword [ebp - 0x2b0], 0
jmp 0x1000bea3
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 1
jge 0x1000bebf
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x6e8], 0xaf11
jmp 0x1000be96
mov dword [ebp - 0x90], 0
jmp 0x1000bed8
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jg 0x1000c190
mov dword [ebp - 0xac], 0xe0091df8
mov dword [ebp - 0x1ac], 1
mov dword [ebp - 0x3a0], 0x2e6c0b33
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x260], 1
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xd3c], eax
push 0xfffffffffffffff6
pop eax
add eax, 0x7cdedfc4
je 0x1000bf3f
mov eax, 0xfc2e
test eax, eax
je 0x1000bf3f
and dword [ebp - 0x7d8], 0
jmp 0x1000bf49
mov dword [ebp - 0x7d8], 1
mov eax, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x90], eax
jge 0x1000bf69
mov dword [ebp - 0x95c], 1
jmp 0x1000bf70
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0xd44], eax
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0xd4c], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xd54], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0xd5c], eax
mov dword [ebp - 0x1ac], 0xffffffff
mov eax, dword [ebp - 0x1ac]
add eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x90]
jle 0x1000bfca
mov dword [ebp - 0x4f8], 1
jmp 0x1000bfd1
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x4f8]
je 0x1000bff2
mov dword [ebp - 0xa9c], 1
jmp 0x1000bff9
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xd64], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6e8]
mov dword [ebp - 0xd6c], eax
mov dword [ebp - 0x964], 0xf47f28a9
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xd60], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6e8], 1
je 0x1000c131
mov dword [ebp - 0xa24], 0
mov dword [ebp - 0x96c], 0x10b42b8f
mov dword [ebp - 0x220], 0
jmp 0x1000c06f
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jg 0x1000c086
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0x96c], eax
jmp 0x1000c062
mov dword [ebp - 0xac], 0
jmp 0x1000c09f
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x1000c12f
mov dword [ebp - 0x1ac], 0
jmp 0x1000c0c5
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jg 0x1000c12a
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1000c0f1
push 0x386
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x1000c128
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x24d7
push 0x1735
push 0x95c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1000c0b8
jmp 0x1000c092
jmp 0x1000c14d
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x1000c14d
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x260], 0
jmp 0x1000c166
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jg 0x1000c18b
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1000c189
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x1000c159
jmp 0x1000becb
mov dword [ebp - 0x2c0], 0x34bf8f0a
mov dword [ebp - 0x3a8], 0x307d7c11
mov dword [ebp - 0x3c8], 0xffffffff
mov dword [ebp - 0x100], 0x320e32cf
mov dword [ebp - 0x378], 0x49aaed6b
mov dword [ebp - 0x8fc], 1
mov dword [ebp - 0x8f8], 1
mov dword [ebp - 0x8f4], 1
mov dword [ebp - 0x8f0], 1
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x1ec], 0xffffffff
mov dword [ebp - 0x278], 0xffffffff
mov dword [ebp - 0x530], 0x47c914a3
mov dword [ebp - 0xa50], 5
mov dword [ebp - 0x350], 0
jmp 0x1000c235
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 1
jge 0x1000c251
mov eax, dword [ebp - 0x350]
mov dword [ebp + eax*4 - 0x984], 1
jmp 0x1000c228
cmp dword [ebp - 0x3c8], 0
jne 0x1000c309
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0xb68], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8fc]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0x378], eax
jg 0x1000c297
mov dword [ebp - 0x500], 1
jmp 0x1000c29e
and dword [ebp - 0x500], 0
imul eax, dword [ebp - 0x500], 0x5bb0
imul eax, dword [ebp - 0x100]
test eax, eax
je 0x1000c2c4
or eax, 0xffffffff
je 0x1000c2c4
mov dword [ebp - 0x8b4], 1
jmp 0x1000c2cb
and dword [ebp - 0x8b4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8fc]
cmp dword [ebp - 0x8b4], eax
jl 0x1000c2eb
mov dword [ebp - 0x508], 1
jmp 0x1000c2f2
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x378]
cmp eax, dword [ebp - 0x508]
jle 0x1000c309
and dword [ebp - 0x6f0], 0
jmp 0x1000c313
mov dword [ebp - 0x6f0], 1
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x6f0], eax
jne 0x1000c32d
mov dword [ebp - 0x510], 1
jmp 0x1000c334
and dword [ebp - 0x510], 0
cmp dword [ebp - 0x510], 0xffffffff
je 0x1000c34f
cmp dword [ebp - 0x278], 0
jne 0x1000c34f
and dword [ebp - 0x7e0], 0
jmp 0x1000c359
mov dword [ebp - 0x7e0], 1
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0x974], eax
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0xa4c]
cmp eax, dword [ebp - 0x974]
jge 0x1000c398
mov dword [ebp - 0xa30], 1
jmp 0x1000c39f
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0xcac], eax
cmp dword [ebp - 0x2c0], 0
jne 0x1000c3d5
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x8fc], 0
jne 0x1000c3d5
cmp dword [ebp - 0x378], 0
jne 0x1000c3d5
and dword [ebp - 0x518], 0
jmp 0x1000c3df
mov dword [ebp - 0x518], 1
mov eax, dword [ebp - 0x530]
cmp dword [ebp - 0x518], eax
jle 0x1000c3f9
mov dword [ebp - 0x6f8], 1
jmp 0x1000c400
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6f8]
sub eax, 6
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0
je 0x1000c445
cmp dword [ebp - 0x1ec], 0
je 0x1000c445
mov dword [ebp - 0x520], 1
jmp 0x1000c44c
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x278]
cmp eax, dword [ebp - 0x520]
jl 0x1000c466
mov dword [ebp - 0x858], 1
jmp 0x1000c46d
and dword [ebp - 0x858], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8fc]
add eax, dword [ebp - 0x858]
sub eax, dword [ebp - 0x1ec]
cmp eax, 0x9afff74b
jae 0x1000c498
mov dword [ebp - 0x528], 1
jmp 0x1000c49f
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x2b8], eax
jl 0x1000c4c5
mov dword [ebp - 0x700], 1
jmp 0x1000c4cc
and dword [ebp - 0x700], 0
imul eax, dword [ebp - 0x700], 6
cmp eax, dword [ebp - 0x100]
jl 0x1000c4e7
mov dword [ebp - 0x97c], 1
jmp 0x1000c4ee
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0xb70], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8fc]
mov dword [ebp - 0xd58], eax
mov eax, dword [ebp - 0xa50]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x984]
xor ecx, ecx
sub ecx, eax
cmp ecx, 8
jge 0x1000c534
mov dword [ebp - 0x7e8], 1
jmp 0x1000c53b
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x7e8]
sub eax, dword [ebp - 0x100]
imul eax, eax, 0x963e
cmp eax, 0xb100
jle 0x1000c560
mov dword [ebp - 0x538], 1
jmp 0x1000c567
and dword [ebp - 0x538], 0
cmp dword [ebp - 0x538], 0xcc425f8e
jae 0x1000c57f
mov dword [ebp - 0x708], 1
jmp 0x1000c586
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x708]
sub eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x540], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x540]
mov dword [ebp + eax - 0x8fc], ecx
mov eax, dword [ebp - 0x540]
sub eax, dword [ebp - 0x378]
cmp eax, dword [ebp - 0x278]
jg 0x1000c5d0
cmp dword [ebp - 0x2c0], 0
jne 0x1000c5d0
and dword [ebp - 0x898], 0
jmp 0x1000c5da
mov dword [ebp - 0x898], 1
mov eax, dword [ebp - 0x898]
sub eax, 0xc660
cmp eax, dword [ebp - 0x278]
jl 0x1000c5f9
mov dword [ebp - 0x548], 1
jmp 0x1000c600
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0xa58], 0x89afca86
mov dword [ebp - 0xb78], 4
mov dword [ebp - 0x2c8], 0
jmp 0x1000c640
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jge 0x1000c65c
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0x7f0], 0xaf11
jmp 0x1000c633
mov dword [ebp - 0x4c], 0
jmp 0x1000c66c
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jg 0x1000c912
mov dword [ebp - 0x9c], 0xe0091df8
mov dword [ebp - 0x1b4], 1
mov dword [ebp - 0x3e8], 0x2e6c0b33
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x250], 1
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xcb4], eax
push 0xfffffffffffffff6
pop eax
add eax, 0x7cdedfc4
je 0x1000c6d0
mov eax, 0xfc2e
test eax, eax
je 0x1000c6d0
and dword [ebp - 0x710], 0
jmp 0x1000c6da
mov dword [ebp - 0x710], 1
mov eax, dword [ebp - 0x3e8]
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x4c], eax
jge 0x1000c6f7
mov dword [ebp - 0xa3c], 1
jmp 0x1000c6fe
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0xd20], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0xcbc], eax
mov dword [ebp - 0x1b4], 0xffffffff
mov eax, dword [ebp - 0x1b4]
add eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x4c]
jle 0x1000c755
mov dword [ebp - 0x550], 1
jmp 0x1000c75c
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x550]
je 0x1000c77a
mov dword [ebp - 0x98c], 1
jmp 0x1000c781
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xb90], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7f0]
mov dword [ebp - 0xd48], eax
mov dword [ebp - 0xa58], 0xf47f28a9
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xb98], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7f0], 1
je 0x1000c8b3
mov dword [ebp - 0x994], 0
mov dword [ebp - 0xa48], 0x10b42b8f
mov dword [ebp - 0x228], 0
jmp 0x1000c7f1
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
jg 0x1000c808
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0xa48], eax
jmp 0x1000c7e4
mov dword [ebp - 0x9c], 0
jmp 0x1000c821
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x1000c8b1
mov dword [ebp - 0x1b4], 0
jmp 0x1000c847
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jg 0x1000c8ac
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x1000c873
push 0x386
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 0xdb], 0
movzx eax, byte [ebp - 0xdb]
test eax, eax
je 0x1000c8aa
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x24d7
push 0x1735
push 0x95c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1000c83a
jmp 0x1000c814
jmp 0x1000c8cf
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x1000c8cf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x250], 0
jmp 0x1000c8e8
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jg 0x1000c90d
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1000c90b
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x1000c8db
jmp 0x1000c665
mov dword [ebp - 0xb2c], 0xfffffffe
mov dword [ebp - 0xb28], 0xfffffffe
mov dword [ebp - 0xb24], 0xfffffffe
mov dword [ebp - 0xb20], 0xfffffffe
mov dword [ebp - 0x78], 0
jmp 0x1000c94a
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x1000c960
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x904], 0x5b57
jmp 0x1000c943
mov dword [ebp - 0x78], 0
jmp 0x1000c970
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1000c986
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x230], 0xc184c506
jmp 0x1000c969
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x230], 1
jmp 0x1000c9b4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x230]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x230], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x230], 0
jl 0x1000ca92
mov dword [ebp - 0x1dc], 1
mov dword [ebp - 0x1dc], 1
jmp 0x1000c9eb
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jl 0x1000ca8d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x230]
mov ecx, dword [ebp - 0x1dc]
mov ecx, dword [ebp + ecx*4 - 0x904]
cmp dword [ebp + eax*4 - 0x904], ecx
jg 0x1000ca51
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1dc]
mov eax, dword [ebp + eax - 0x904]
mov dword [ebp + ecx*4 - 0x904], eax
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1000ca4f
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1000ca74
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x1000ca74
push 0
push 0
push 0x2000
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb2c], 0
je 0x1000ca88
jmp 0x1000c9de
jmp 0x1000c9de
jmp 0x1000c999
mov dword [ebp - 0x5c], 0x1c77dcd
mov dword [ebp - 0x588], 0xbf118c84
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x54], 0
jmp 0x1000cabd
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x1000cad3
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x110], 0xc03342eb
jmp 0x1000cab6
mov dword [ebp - 0x54], 0
jmp 0x1000cae3
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x1000caf9
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xa0], 0xfffffff8
jmp 0x1000cadc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x110], 0
jmp 0x1000cb27
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x110]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x110], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x110], 0xffffffeb
jg 0x1000d05c
mov dword [ebp - 0x108], 0xfffffff8
mov dword [ebp - 0x3d0], 0xfffffff9
mov dword [ebp - 0x32c], 0
mov dword [ebp - 0x5a0], 3
mov dword [ebp - 0x7c], 0
jmp 0x1000cb73
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1000cb89
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xac8], 1
jmp 0x1000cb6c
mov dword [ebp - 0x7c], 0
jmp 0x1000cb99
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1000cbaf
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xa38], 0x97736eae
jmp 0x1000cb92
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x108], eax
je 0x1000cbc9
mov dword [ebp - 0x580], 1
jmp 0x1000cbd0
and dword [ebp - 0x580], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x110]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x1000cc0a
mov eax, dword [ebp - 0x32c]
dec eax
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
add eax, dword [ebp - 0x3d0]
jne 0x1000cc0a
and dword [ebp - 0x558], 0
jmp 0x1000cc14
mov dword [ebp - 0x558], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa0]
cmp dword [ebp - 0x558], eax
jne 0x1000cc35
mov dword [ebp - 0x718], 1
jmp 0x1000cc3c
and dword [ebp - 0x718], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa0]
cmp dword [ebp - 0x718], eax
jne 0x1000cc5d
mov dword [ebp - 0x560], 1
jmp 0x1000cc64
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
sub eax, 0x36d0
neg eax
cmp eax, dword [ebp - 0x3d0]
jg 0x1000cc85
mov dword [ebp - 0x3b0], 1
jmp 0x1000cc8c
and dword [ebp - 0x3b0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3b0]
mov dword [ebp + eax - 0xac8], ecx
mov eax, dword [ebp - 0x3b0]
neg eax
cmp eax, dword [ebp - 0x108]
jg 0x1000ccba
mov dword [ebp - 0x860], 1
jmp 0x1000ccc1
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x3d0]
cmp eax, dword [ebp - 0x860]
jge 0x1000ccdb
mov dword [ebp - 0x568], 1
jmp 0x1000cce2
and dword [ebp - 0x568], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa0]
cmp dword [ebp - 0x568], eax
jg 0x1000cd09
cmp dword [ebp - 0x5c], 0
je 0x1000cd09
mov dword [ebp - 0x720], 1
jmp 0x1000cd10
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
neg eax
cmp eax, dword [ebp - 0x108]
jg 0x1000cd2c
mov dword [ebp - 0x570], 1
jmp 0x1000cd33
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x570]
add eax, 5
imul eax, dword [ebp - 0x108]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x110]
jle 0x1000cd67
mov eax, 0xbb1bb30b
test eax, eax
je 0x1000cd67
mov dword [ebp - 0x7f8], 1
jmp 0x1000cd6e
and dword [ebp - 0x7f8], 0
imul eax, dword [ebp - 0x7f8], 0
mov dword [ebp - 0x578], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x578]
mov dword [ebp + eax - 0xa0], ecx
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x578], eax
je 0x1000cda8
mov dword [ebp - 0x728], 1
jmp 0x1000cdaf
and dword [ebp - 0x728], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa38]
cmp dword [ebp - 0x728], eax
jne 0x1000cdd0
mov dword [ebp - 0x8a8], 1
jmp 0x1000cdd7
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x580]
add eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x118], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xa38]
cmp dword [ebp + eax - 0xac8], ecx
jg 0x1000ce8f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xac8], 0
je 0x1000ce31
or eax, 0xffffffff
je 0x1000ce31
mov dword [ebp - 0x730], 1
jmp 0x1000ce38
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x5a0]
cmp dword [ebp - 0x730], eax
jge 0x1000ce52
mov dword [ebp - 0x590], 1
jmp 0x1000ce59
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x32c]
cmp dword [ebp - 0x590], eax
jl 0x1000ce73
mov dword [ebp - 0x800], 1
jmp 0x1000ce7a
and dword [ebp - 0x800], 0
cmp dword [ebp - 0x800], 0xfffffffc
jae 0x1000ce8f
mov dword [ebp - 0x598], 1
jmp 0x1000ce96
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x108]
add eax, dword [ebp - 0x598]
je 0x1000ceb6
cmp dword [ebp - 0x5c], 0
je 0x1000ceb6
mov dword [ebp - 0x738], 1
jmp 0x1000cebd
and dword [ebp - 0x738], 0
cmp dword [ebp - 0x738], 0xe20
jne 0x1000ced5
mov dword [ebp - 0x868], 1
jmp 0x1000cedc
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x5a0]
cmp dword [ebp - 0x868], eax
je 0x1000cef6
mov dword [ebp - 0x5a8], 1
jmp 0x1000cefd
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
sub eax, 0xf2ec
cmp eax, dword [ebp - 0x118]
jne 0x1000cf1f
cmp dword [ebp - 0x5c], 0
jne 0x1000cf1f
and dword [ebp - 0x740], 0
jmp 0x1000cf29
mov dword [ebp - 0x740], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa38]
cmp dword [ebp - 0x740], eax
je 0x1000cf4a
mov dword [ebp - 0x5b0], 1
jmp 0x1000cf51
and dword [ebp - 0x5b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa0]
cmp dword [ebp - 0x5b0], eax
jl 0x1000cf7b
mov eax, 0xd038cf49
test eax, eax
je 0x1000cf7b
mov dword [ebp - 0x808], 1
jmp 0x1000cf82
and dword [ebp - 0x808], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x110]
cmp eax, dword [ebp - 0x808]
jle 0x1000cfa3
mov dword [ebp - 0x5b8], 1
jmp 0x1000cfaa
and dword [ebp - 0x5b8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xac8]
sub eax, dword [ebp - 0x5b8]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa0]
jg 0x1000d022
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa0], 0
je 0x1000d022
mov dword [ebp - 0x5c], 0xfffffff2
jmp 0x1000cfec
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffff1
jg 0x1000d020
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x1000d01e
push 0x94e
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1000cfe5
jmp 0x1000d057
mov dword [ebp - 0x118], 0
jmp 0x1000d03b
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jge 0x1000d057
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0xa0], 0
jmp 0x1000d02e
jmp 0x1000cb0c
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1000d07f
push 0
push 0x1bba
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 0x270], 0xd29be1d9
mov dword [ebp - 0x2d0], 0
jmp 0x1000d0a2
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 3
jge 0x1000d0be
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0xdb0], 0x648261f9
jmp 0x1000d095
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x1000d0e3
push 0
push 0
push 0x1def
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x270], 2
jmp 0x1000d0fc
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jl 0x1000d119
mov eax, dword [ebp - 0x270]
cmp dword [ebp + eax*4 - 0xdb0], 0
je 0x1000d117
jmp 0x1000d119
jmp 0x1000d0ef
mov dword [ebp - 0x8c], 0x1c77dcd
mov dword [ebp - 0x760], 0xbf118c84
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x84], 0
jmp 0x1000d150
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1000d16c
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x128], 0xc03342eb
jmp 0x1000d143
mov dword [ebp - 0x84], 0
jmp 0x1000d185
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1000d1a1
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xa8], 0xfffffff8
jmp 0x1000d178
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x128], 0
jmp 0x1000d1cf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x128], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x128], 0xffffffeb
jg 0x1000d71f
mov dword [ebp - 0x120], 0xfffffff8
mov dword [ebp - 0x3e0], 0xfffffff9
mov dword [ebp - 0x334], 0
mov dword [ebp - 0x888], 3
mov dword [ebp - 0x64], 0
jmp 0x1000d21b
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1000d231
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xad4], 1
jmp 0x1000d214
mov dword [ebp - 0x64], 0
jmp 0x1000d241
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1000d257
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xa44], 0x97736eae
jmp 0x1000d23a
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x120], eax
je 0x1000d271
mov dword [ebp - 0x870], 1
jmp 0x1000d278
and dword [ebp - 0x870], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jne 0x1000d2b8
mov eax, dword [ebp - 0x334]
dec eax
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
add eax, dword [ebp - 0x3e0]
jne 0x1000d2b8
and dword [ebp - 0x748], 0
jmp 0x1000d2c2
mov dword [ebp - 0x748], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa8]
cmp dword [ebp - 0x748], eax
jne 0x1000d2e3
mov dword [ebp - 0x5c0], 1
jmp 0x1000d2ea
and dword [ebp - 0x5c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa8]
cmp dword [ebp - 0x5c0], eax
jne 0x1000d30b
mov dword [ebp - 0x8a0], 1
jmp 0x1000d312
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x8a0]
sub eax, 0x36d0
neg eax
cmp eax, dword [ebp - 0x3e0]
jg 0x1000d333
mov dword [ebp - 0x3b8], 1
jmp 0x1000d33a
and dword [ebp - 0x3b8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3b8]
mov dword [ebp + eax - 0xad4], ecx
mov eax, dword [ebp - 0x3b8]
neg eax
cmp eax, dword [ebp - 0x120]
jg 0x1000d368
mov dword [ebp - 0x5c8], 1
jmp 0x1000d36f
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x3e0]
cmp eax, dword [ebp - 0x5c8]
jge 0x1000d389
mov dword [ebp - 0x750], 1
jmp 0x1000d390
and dword [ebp - 0x750], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa8]
cmp dword [ebp - 0x750], eax
jg 0x1000d3ba
cmp dword [ebp - 0x8c], 0
je 0x1000d3ba
mov dword [ebp - 0x5d0], 1
jmp 0x1000d3c1
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x5d0]
neg eax
cmp eax, dword [ebp - 0x120]
jg 0x1000d3dd
mov dword [ebp - 0x810], 1
jmp 0x1000d3e4
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
add eax, 5
imul eax, dword [ebp - 0x120]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x128]
jle 0x1000d418
mov eax, 0xbb1bb30b
test eax, eax
je 0x1000d418
mov dword [ebp - 0x5d8], 1
jmp 0x1000d41f
and dword [ebp - 0x5d8], 0
imul eax, dword [ebp - 0x5d8], 0
mov dword [ebp - 0x758], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x758]
mov dword [ebp + eax - 0xa8], ecx
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x758], eax
je 0x1000d459
mov dword [ebp - 0x5e0], 1
jmp 0x1000d460
and dword [ebp - 0x5e0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa44]
cmp dword [ebp - 0x5e0], eax
jne 0x1000d481
mov dword [ebp - 0x5e8], 1
jmp 0x1000d488
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x870]
add eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x760], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x130], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xa44]
cmp dword [ebp + eax - 0xad4], ecx
jg 0x1000d540
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xad4], 0
je 0x1000d4e2
or eax, 0xffffffff
je 0x1000d4e2
mov dword [ebp - 0x5f0], 1
jmp 0x1000d4e9
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x888]
cmp dword [ebp - 0x5f0], eax
jge 0x1000d503
mov dword [ebp - 0x818], 1
jmp 0x1000d50a
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0x818], eax
jl 0x1000d524
mov dword [ebp - 0x5f8], 1
jmp 0x1000d52b
and dword [ebp - 0x5f8], 0
cmp dword [ebp - 0x5f8], 0xfffffffc
jae 0x1000d540
mov dword [ebp - 0x768], 1
jmp 0x1000d547
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x120]
add eax, dword [ebp - 0x768]
je 0x1000d56a
cmp dword [ebp - 0x8c], 0
je 0x1000d56a
mov dword [ebp - 0x600], 1
jmp 0x1000d571
and dword [ebp - 0x600], 0
cmp dword [ebp - 0x600], 0xe20
jne 0x1000d589
mov dword [ebp - 0x608], 1
jmp 0x1000d590
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x888]
cmp dword [ebp - 0x608], eax
je 0x1000d5aa
mov dword [ebp - 0x770], 1
jmp 0x1000d5b1
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x770]
sub eax, 0xf2ec
cmp eax, dword [ebp - 0x130]
jne 0x1000d5d6
cmp dword [ebp - 0x8c], 0
jne 0x1000d5d6
and dword [ebp - 0x610], 0
jmp 0x1000d5e0
mov dword [ebp - 0x610], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa44]
cmp dword [ebp - 0x610], eax
je 0x1000d601
mov dword [ebp - 0x820], 1
jmp 0x1000d608
and dword [ebp - 0x820], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa8]
cmp dword [ebp - 0x820], eax
jl 0x1000d632
mov eax, 0xd038cf49
test eax, eax
je 0x1000d632
mov dword [ebp - 0x618], 1
jmp 0x1000d639
and dword [ebp - 0x618], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
cmp eax, dword [ebp - 0x618]
jle 0x1000d65a
mov dword [ebp - 0x778], 1
jmp 0x1000d661
and dword [ebp - 0x778], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xad4]
sub eax, dword [ebp - 0x778]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa8]
jg 0x1000d6e5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa8], 0
je 0x1000d6e5
mov dword [ebp - 0x8c], 0xfffffff2
jmp 0x1000d6ac
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xfffffff1
jg 0x1000d6e3
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1000d6e1
push 0x94e
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1000d69f
jmp 0x1000d71a
mov dword [ebp - 0x130], 0
jmp 0x1000d6fe
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x1000d71a
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0xa8], 0
jmp 0x1000d6f1
jmp 0x1000d1b4
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x1000d742
push 0
push 0x1bba
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 0xb0], 0xe83c773
mov dword [ebp - 0x2d8], 0
jmp 0x1000d765
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 3
jge 0x1000d781
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0xe88], 0xffffffff
jmp 0x1000d758
mov dword [ebp - 0xb0], 0
jmp 0x1000d79a
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jg 0x1000d7c8
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1000d7c6
push 1
push 0x24d1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
jmp 0x1000d78d
mov dword [ebp - 0xb0], 0
jmp 0x1000d7e1
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jg 0x1000d806
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1000d804
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x1000d7d4
mov dword [ebp - 0xb3c], 0xfffffffe
mov dword [ebp - 0xb38], 0xfffffffe
mov dword [ebp - 0xb34], 0xfffffffe
mov dword [ebp - 0xb30], 0xfffffffe
mov dword [ebp - 0x6c], 0
jmp 0x1000d83e
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1000d854
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x8ec], 0x5b57
jmp 0x1000d837
mov dword [ebp - 0x6c], 0
jmp 0x1000d864
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1000d87a
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x238], 0xc184c506
jmp 0x1000d85d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x238], 1
jmp 0x1000d8a8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x238]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x238], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x238], 0
jl 0x1000d986
mov dword [ebp - 0x1bc], 1
mov dword [ebp - 0x1bc], 1
jmp 0x1000d8df
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jl 0x1000d981
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x238]
mov ecx, dword [ebp - 0x1bc]
mov ecx, dword [ebp + ecx*4 - 0x8ec]
cmp dword [ebp + eax*4 - 0x8ec], ecx
jg 0x1000d945
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1bc]
mov eax, dword [ebp + eax - 0x8ec]
mov dword [ebp + ecx*4 - 0x8ec], eax
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1000d943
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1000d968
mov byte [ebp - 0xc2], 0
movzx eax, byte [ebp - 0xc2]
test eax, eax
je 0x1000d968
push 0
push 0
push 0x2000
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb3c], 0
je 0x1000d97c
jmp 0x1000d8d2
jmp 0x1000d8d2
jmp 0x1000d88d
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x138], 0
jmp 0x1000d9a9
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x16
je 0x1000dbed
mov dword [ebp - 0x258], 0xeede0b40
mov dword [ebp - 0x33c], 0
jmp 0x1000d9d9
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 4
jge 0x1000d9f5
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0xe08], 0xfffffffa
jmp 0x1000d9cc
mov dword [ebp - 0x258], 0
jmp 0x1000da0e
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0x16
je 0x1000dbe8
mov dword [ebp - 0x2e0], 0xffffffff
mov dword [ebp - 0x2e0], 0
jmp 0x1000da3e
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 7
je 0x1000dbe3
mov dword [ebp - 0x20], 0xc1188e17
mov dword [ebp - 0x344], 0
jmp 0x1000da6b
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 1
jge 0x1000da87
mov eax, dword [ebp - 0x344]
mov dword [ebp + eax*4 - 0x1fc], 0x121f
jmp 0x1000da5e
mov dword [ebp - 0x20], 0
jmp 0x1000da97
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1000dbde
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1fc], 0
je 0x1000db24
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1fc]
mov dword [ebp - 0xcc4], eax
push 4
pop eax
imul eax, eax, 0
push 7
pop ecx
sub ecx, dword [ebp + eax - 0x1fc]
je 0x1000dae3
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1000dae3
mov dword [ebp - 0x620], 1
jmp 0x1000daea
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x620], eax
je 0x1000db04
mov dword [ebp - 0x99c], 1
jmp 0x1000db0b
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1fc], 0
je 0x1000db24
mov dword [ebp - 0x878], 1
jmp 0x1000db2b
and dword [ebp - 0x878], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x878]
sub ecx, dword [ebp + eax - 0x1fc]
add ecx, dword [ebp - 0x20]
jne 0x1000db4f
mov dword [ebp - 0x628], 1
jmp 0x1000db56
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x628]
sub eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x138]
jle 0x1000db76
mov dword [ebp - 0x780], 1
jmp 0x1000db7d
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x780]
cmp eax, dword [ebp - 0x138]
jle 0x1000db9a
mov dword [ebp - 0x630], 1
jmp 0x1000dba1
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1fc]
cmp eax, dword [ebp - 0x630]
jle 0x1000dbbf
mov dword [ebp - 0x828], 1
jmp 0x1000dbc6
and dword [ebp - 0x828], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x828]
mov dword [ebp + eax - 0xe08], ecx
jmp 0x1000da90
jmp 0x1000da31
jmp 0x1000da01
jmp 0x1000d99c
mov dword [ebp - 0x208], 0xfffffff6
mov dword [ebp - 0x3f0], 0xcc321a0
mov dword [ebp - 0x10], 0
jmp 0x1000dc11
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000dc27
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xea4], 0xb9b5
jmp 0x1000dc0a
mov dword [ebp - 0x10], 0
jmp 0x1000dc37
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1000dc4d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x140], 0x532fe223
jmp 0x1000dc30
mov dword [ebp - 0x10], 0
jmp 0x1000dc5d
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1000dc73
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xba0], 0xffffffff
jmp 0x1000dc56
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x140], 3
jmp 0x1000dca1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x140], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x140], 0
jl 0x1000df0d
mov dword [ebp - 0x1c4], 0xfffffffe
mov dword [ebp - 0x894], 4
mov dword [ebp - 0x648], 0x6b34c266
mov dword [ebp - 0x394], 0x4ce34aaf
xor eax, eax
jne 0x1000dd10
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0xd28], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
mov dword [ebp - 0xba8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x140], 0
je 0x1000dd25
cmp dword [ebp - 0x1c4], 0
je 0x1000dd25
mov dword [ebp - 0x638], 1
jmp 0x1000dd2c
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 1
jne 0x1000dd47
mov eax, 0x5da2
test eax, eax
jne 0x1000dd47
and dword [ebp - 0x788], 0
jmp 0x1000dd51
mov dword [ebp - 0x788], 1
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x208], 0
jmp 0x1000dd76
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jg 0x1000df08
mov dword [ebp - 0x38c], 0xfe9a5a16
mov dword [ebp - 0x1c4], 0
jmp 0x1000dda6
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 3
jg 0x1000df03
mov dword [ebp - 0x20c], 0xa0cd95ff
mov dword [ebp - 0x9a4], 0xd4a79744
mov dword [ebp - 0xccc], 0xbe3d0e72
mov dword [ebp - 0xa60], 2
mov dword [ebp - 0x2e8], 0
jmp 0x1000ddf4
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 2
jge 0x1000de10
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0xae4], 0xffffffff
jmp 0x1000dde7
mov eax, dword [ebp - 0x38c]
dec eax
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0
je 0x1000de4e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x140], 0
je 0x1000de4e
mov dword [ebp - 0x790], 1
jmp 0x1000de55
and dword [ebp - 0x790], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xae4]
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x648]
cmp eax, dword [ebp - 0x790]
jle 0x1000de93
xor eax, eax
inc eax
je 0x1000de93
mov dword [ebp - 0x650], 1
jmp 0x1000de9a
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0
je 0x1000dec9
mov eax, dword [ebp - 0xa60]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x9a4], eax
jmp 0x1000defe
mov dword [ebp - 0x20c], 0
jmp 0x1000dee2
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x1000defe
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0xae4], 0x2afddf34
jmp 0x1000ded5
jmp 0x1000dd99
jmp 0x1000dd69
jmp 0x1000dc86
mov dword [ebp - 0xb5c], 0xfffffffe
mov dword [ebp - 0xb58], 0xfffffffe
mov dword [ebp - 0xb54], 0xfffffffe
mov dword [ebp - 0xb50], 0xfffffffe
mov dword [ebp - 0x94], 0
jmp 0x1000df4e
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x1000df6a
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x8d4], 0x5b57
jmp 0x1000df41
mov dword [ebp - 0x94], 0
jmp 0x1000df83
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x1000df9f
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x214], 0xc184c506
jmp 0x1000df76
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x214], 1
jmp 0x1000dfcd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x214]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x214], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x214], 0
jl 0x1000e0ab
mov dword [ebp - 0x1e4], 1
mov dword [ebp - 0x1e4], 1
jmp 0x1000e004
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0
jl 0x1000e0a6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x214]
mov ecx, dword [ebp - 0x1e4]
mov ecx, dword [ebp + ecx*4 - 0x8d4]
cmp dword [ebp + eax*4 - 0x8d4], ecx
jg 0x1000e06a
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1e4]
mov eax, dword [ebp + eax - 0x8d4]
mov dword [ebp + ecx*4 - 0x8d4], eax
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x1000e068
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1000e08d
mov byte [ebp - 0xc6], 0
movzx eax, byte [ebp - 0xc6]
test eax, eax
je 0x1000e08d
push 0
push 0
push 0x2000
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb5c], 0
je 0x1000e0a1
jmp 0x1000dff7
jmp 0x1000dff7
jmp 0x1000dfb2
mov dword [ebp - 0x21c], 0xd29be1d9
mov dword [ebp - 0x34c], 0
jmp 0x1000e0ce
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 3
jge 0x1000e0ea
mov eax, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0xdc8], 0x648261f9
jmp 0x1000e0c1
mov byte [ebp - 0xc8], 0
movzx eax, byte [ebp - 0xc8]
test eax, eax
je 0x1000e10f
push 0
push 0
push 0x1def
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x21c], 2
jmp 0x1000e128
mov eax, dword [ebp - 0x21c]
dec eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jl 0x1000e145
mov eax, dword [ebp - 0x21c]
cmp dword [ebp + eax*4 - 0xdc8], 0
je 0x1000e143
jmp 0x1000e145
jmp 0x1000e11b
mov dword [ebp - 0x2f0], 0xfffffffa
mov dword [ebp - 0x74], 0
jmp 0x1000e15f
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1000e175
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xdd0], 0
jmp 0x1000e158
mov dword [ebp - 0x74], 0
jmp 0x1000e185
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1000e19b
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xdf8], 0x8a6b950b
jmp 0x1000e17e
mov dword [ebp - 0x2f0], 1
jmp 0x1000e1b4
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0
jl 0x1000e1f6
mov dword [ebp - 0x830], 1
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x1000e1e7
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov eax, dword [ebp - 0x830]
dec eax
mov dword [ebp - 0x830], eax
jmp 0x1000e1a7
mov dword [ebp - 0xb8], 0xe83c773
mov dword [ebp - 0x354], 0
jmp 0x1000e219
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 3
jge 0x1000e235
mov eax, dword [ebp - 0x354]
mov dword [ebp + eax*4 - 0xe64], 0xffffffff
jmp 0x1000e20c
mov dword [ebp - 0xb8], 0
jmp 0x1000e24e
cmp dword [ebp - 0xb8], 2
jg 0x1000e27c