Function at 0x10008cd9
Capabilities:
Check for time delay via gettickcount
Create process on windows
Query environment variable
Resume thread
Start service
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007dab8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1020
call fcn.10079b60
push esi
push edi
mov dword [ebp - 0xc64], 0x8eac
mov dword [ebp - 0xc60], 0x8eac
mov dword [ebp - 0xc5c], 0x8eac
mov dword [ebp - 0xc58], 0x8eac
lea ecx, [ebp - 0x2cd]
call fcn.10008a93
push eax
lea eax, [ebp - 0xc54]
push eax
lea eax, [ebp - 0xc64]
push eax
lea ecx, [ebp - 0xff4]
call fcn.100167eb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd48]
call fcn.1001679a
and dword [ebp - 4], 0
mov dword [ebp - 0x13c], 0xcb50bf34
mov dword [ebp - 0xe14], 0x7b051af7
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x10008d8c
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x13c], 3
jmp 0x10008da5
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jl 0x10008f26
mov dword [ebp - 0x9c], 3
mov dword [ebp - 0xf58], 4
mov dword [ebp - 0x9c], 3
jmp 0x10008ddf
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x10008ead
mov dword [ebp - 0x204], 0
jmp 0x10008e05
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
jge 0x10008e21
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x7d4], 0x4caf14c9
jmp 0x10008df8
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x7d4], 3
jmp 0x10008e4f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7d4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x7d4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7d4], 0
jl 0x10008ea8
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x7d4]
lea ecx, [ebp - 0xd48]
call fcn.100167dc
mov esi, eax
push dword [ebp - 0x13c]
lea ecx, [ebp - 0xd48]
call fcn.100167dc
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x10008ea6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x10008e34
jmp 0x10008dd2
mov dword [ebp - 0x9c], 3
jmp 0x10008ec6
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x10008f21
mov dword [ebp - 0x180], 0
jmp 0x10008ee8
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x10008f04
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x428], 0xfffffff7
jmp 0x10008edb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x428]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x428], eax
jmp 0x10008eb9
jmp 0x10008d98
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd48]
call fcn.100167c0
push 1
lea ecx, [ebp - 0x8a8]
call fcn.1001673e
mov dword [ebp - 4], 1
mov dword [ebp - 0xde8], 0x49d585ed
mov dword [ebp - 0x16c], 0
jmp 0x10008f6c
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x10008f8b
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x8a8]
call fcn.100167dc
and dword [eax], 0
jmp 0x10008f5f
push 0
lea ecx, [ebp - 0x8a8]
call fcn.100167dc
and dword [eax], 0
jmp 0x10008fc1
push 0
lea ecx, [ebp - 0x8a8]
call fcn.100167dc
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x830]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x830]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x8a8]
call fcn.100167dc
cmp dword [eax], 2
jge 0x100090a4
mov dword [ebp - 0x228], 0x57102d14
mov dword [ebp - 0xdb4], 0x33843046
mov dword [ebp - 0xe80], 0x9dd952ea
mov dword [ebp - 0x228], 0x15
jmp 0x1000900e
mov eax, dword [ebp - 0x228]
dec eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xfffffff8
je 0x1000909f
push 3
lea ecx, [ebp - 0xd60]
call fcn.1001673e
mov byte [ebp - 4], 2
mov dword [ebp - 0x188], 0
jmp 0x10009045
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x10009067
push dword [ebp - 0x188]
lea ecx, [ebp - 0xd60]
call fcn.100167dc
mov dword [eax], 1
jmp 0x10009038
push 0
lea ecx, [ebp - 0xd60]
call fcn.100167dc
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x838]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x838]
mov dword [ecx], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd60]
call fcn.100167c0
jmp 0x10009001
jmp 0x10008f9d
push 0
lea ecx, [ebp - 0x8a8]
call fcn.100167dc
mov dword [eax], 0x9acf2579
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a8]
call fcn.100167c0
mov dword [ebp - 0xc50], 0x8eac
mov dword [ebp - 0xc4c], 0x8eac
mov dword [ebp - 0xc48], 0x8eac
mov dword [ebp - 0xc44], 0x8eac
lea ecx, [ebp - 0x35d]
call fcn.10008a93
push eax
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0xc50]
push eax
lea ecx, [ebp - 0xfec]
call fcn.100167eb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd78]
call fcn.1001679a
mov dword [ebp - 4], 3
mov dword [ebp - 0x11c], 0xcb50bf34
mov dword [ebp - 0xdbc], 0x7b051af7
mov byte [ebp - 0xea], 0
movzx eax, byte [ebp - 0xea]
test eax, eax
je 0x10009158
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x11c], 3
jmp 0x10009171
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jl 0x100092f2
mov dword [ebp - 0xa8], 3
mov dword [ebp - 0xf20], 4
mov dword [ebp - 0xa8], 3
jmp 0x100091ab
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x10009279
mov dword [ebp - 0x2b8], 0
jmp 0x100091d1
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 2
jge 0x100091ed
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0x7e0], 0x4caf14c9
jmp 0x100091c4
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x7e0], 3
jmp 0x1000921b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7e0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x7e0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7e0], 0
jl 0x10009274
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x7e0]
lea ecx, [ebp - 0xd78]
call fcn.100167dc
mov esi, eax
push dword [ebp - 0x11c]
lea ecx, [ebp - 0xd78]
call fcn.100167dc
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x10009272
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x10009200
jmp 0x1000919e
mov dword [ebp - 0xa8], 3
jmp 0x10009292
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x100092ed
mov dword [ebp - 0x190], 0
jmp 0x100092b4
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jge 0x100092d0
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x840], 0xfffffff7
jmp 0x100092a7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x840]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x840], eax
jmp 0x10009285
jmp 0x10009164
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd78]
call fcn.100167c0
mov dword [ebp - 0x9b8], 0x692beaa3
mov dword [ebp - 0xdc4], 0x2d149fe
mov dword [ebp - 0x2e0], 0xf69f7fd1
mov dword [ebp - 0x938], 0xffffffff
mov dword [ebp - 0xf54], 8
mov dword [ebp - 0xf50], 8
mov dword [ebp - 0xf4c], 8
mov dword [ebp - 0xf48], 8
push 1
lea ecx, [ebp - 0xa08]
call fcn.1001673e
mov dword [ebp - 4], 4
mov dword [ebp - 0x928], 1
mov dword [ebp - 0x930], 2
mov dword [ebp - 0x2c], 0
jmp 0x10009389
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1000939f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x940], 0x464f16ef
jmp 0x10009382
mov dword [ebp - 0x2c], 0
jmp 0x100093af
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x100093c5
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xffc], 3
jmp 0x100093a8
mov dword [ebp - 0x2c], 0
jmp 0x100093d5
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x100093f1
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa08]
call fcn.100167dc
mov dword [eax], 0xa6ff
jmp 0x100093ce
cmp dword [ebp - 0x9b8], 0
je 0x1000949d
mov dword [ebp - 0xe88], 0x579253a3
mov dword [ebp - 0xdcc], 0xfffffffc
push 2
lea ecx, [ebp - 0xec4]
call fcn.1001673e
mov byte [ebp - 4], 5
mov dword [ebp - 0xf28], 0
mov dword [ebp - 0x230], 0
jmp 0x10009446
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jge 0x10009465
push dword [ebp - 0x230]
lea ecx, [ebp - 0xec4]
call fcn.100167dc
or dword [eax], 0xffffffff
jmp 0x10009439
push 0
lea ecx, [ebp - 0xa08]
call fcn.100167dc
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x848]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x848]
mov dword [ecx], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xec4]
call fcn.100167c0
jmp 0x1000968f
push 3
lea ecx, [ebp - 0xb44]
call fcn.1001673e
mov byte [ebp - 4], 6
mov dword [ebp - 0x724], 0x9d0863e8
mov dword [ebp - 0x198], 0
jmp 0x100094d1
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jge 0x100094f3
push dword [ebp - 0x198]
lea ecx, [ebp - 0xb44]
call fcn.100167dc
mov dword [eax], 0x32e0c280
jmp 0x100094c4
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x10009510
push 0x1d00
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea ecx, [ebp - 0xa08]
call fcn.100167dc
cmp dword [eax], 0
jne 0x1000966a
xor eax, eax
inc eax
je 0x10009540
cmp dword [ebp - 0x2e0], 0
je 0x10009540
mov dword [ebp - 0x850], 1
jmp 0x10009547
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x928]
cmp dword [ebp - 0x850], eax
jg 0x10009561
mov dword [ebp - 0x7c8], 1
jmp 0x10009568
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x7c8]
neg eax
cmp eax, 8
jbe 0x10009581
mov dword [ebp - 0x3a4], 1
jmp 0x10009588
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x930]
cmp dword [ebp - 0x3a4], eax
jg 0x100095a2
mov dword [ebp - 0x628], 1
jmp 0x100095a9
and dword [ebp - 0x628], 0
xor esi, esi
inc esi
sub esi, dword [ebp - 0x628]
push 0
lea ecx, [ebp - 0xb44]
call fcn.100167dc
cmp esi, dword [eax]
jg 0x100095cf
mov dword [ebp - 0x3ac], 1
jmp 0x100095d6
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x938]
cmp dword [ebp - 0x3ac], eax
jle 0x100095f0
mov dword [ebp - 0x620], 1
jmp 0x100095f7
and dword [ebp - 0x620], 0
xor esi, esi
sub esi, dword [ebp - 0x620]
push 0
lea ecx, [ebp - 0xa08]
call fcn.100167dc
add esi, dword [eax]
push 1
lea ecx, [ebp - 0xb44]
call fcn.100167dc
cmp esi, dword [eax]
jge 0x1000962b
mov dword [ebp - 0x3b4], 1
jmp 0x10009632
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x724], eax
xor eax, eax
sub eax, dword [ebp - 0x724]
je 0x10009651
cmp dword [ebp - 0x2e0], 0
jne 0x1000966a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x940], 0
jne 0x1000966a
and dword [ebp - 0x3bc], 0
jmp 0x10009674
mov dword [ebp - 0x3bc], 1
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x2e0], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xb44]
call fcn.100167c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa08]
call fcn.100167c0
mov dword [ebp - 0x14], 0xdf37d45d
push 3
lea ecx, [ebp - 0xc10]
call fcn.1001673e
mov dword [ebp - 4], 7
mov dword [ebp - 0x328], 0x5d1cb6a7
mov dword [ebp - 0x948], 0xa0a9
push 4
lea ecx, [ebp - 0xd0c]
call fcn.1001673e
mov byte [ebp - 4], 8
mov dword [ebp - 0x78], 0
jmp 0x100096ee
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x1000970a
push dword [ebp - 0x78]
lea ecx, [ebp - 0xc10]
call fcn.100167dc
mov dword [eax], 0xfffffffb
jmp 0x100096e7
mov dword [ebp - 0x78], 0
jmp 0x1000971a
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x10009736
push dword [ebp - 0x78]
lea ecx, [ebp - 0xd0c]
call fcn.100167dc
mov dword [eax], 1
jmp 0x10009713
mov eax, dword [ebp - 0x14]
sub eax, 0x36126460
cmp eax, 0x4fc2285f
je 0x10009751
mov dword [ebp - 0x3c4], 1
jmp 0x10009758
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x14]
inc eax
cmp eax, dword [ebp - 0x14]
jle 0x1000976d
mov dword [ebp - 0x614], 1
jmp 0x10009774
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0x45fe
je 0x1000978c
mov dword [ebp - 0x808], 1
jmp 0x10009793
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0x808]
jge 0x100097b0
mov dword [ebp - 0x3cc], 1
jmp 0x100097b7
and dword [ebp - 0x3cc], 0
imul eax, dword [ebp - 0x3cc], 0xc2e7
test eax, eax
je 0x100097f7
mov dword [ebp - 0x14], 0
jmp 0x100097d5
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x17
jg 0x100097f5
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x100097f3
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x100097ce
jmp 0x10009841
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x10009814
push 0x133f
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x14], 0
jmp 0x10009824
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x10009841
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc10]
call fcn.100167dc
cmp dword [eax], 0
je 0x1000983f
jmp 0x10009841
jmp 0x1000981d
cmp dword [ebp - 0x14], 0
jne 0x10009856
cmp dword [ebp - 0x14], 0
jne 0x10009856
and dword [ebp - 0x3dc], 0
jmp 0x10009860
mov dword [ebp - 0x3dc], 1
cmp dword [ebp - 0x328], 0
jne 0x100098c4
cmp dword [ebp - 0x948], 0xa12a
jg 0x1000988a
cmp dword [ebp - 0x328], 0
je 0x1000988a
mov dword [ebp - 0x61c], 1
jmp 0x10009891
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x61c], 6
je 0x100098a6
mov dword [ebp - 0x3d4], 1
jmp 0x100098ad
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x328]
add eax, dword [ebp - 0x3d4]
jne 0x100098c4
and dword [ebp - 0x72c], 0
jmp 0x100098ce
mov dword [ebp - 0x72c], 1
push 1
lea ecx, [ebp - 0xc10]
call fcn.100167dc
mov ecx, dword [ebp - 0x72c]
mov edx, dword [ebp - 0x3dc]
lea ecx, [edx + ecx + 4]
cmp dword [eax], ecx
jge 0x100098fb
mov dword [ebp - 0x624], 1
jmp 0x10009902
and dword [ebp - 0x624], 0
push 2
lea ecx, [ebp - 0xd0c]
call fcn.100167dc
mov ecx, dword [ebp - 0x624]
mov dword [eax], ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd0c]
call fcn.100167c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc10]
call fcn.100167c0
mov dword [ebp - 0xc3c], 0x8eac
mov dword [ebp - 0xc38], 0x8eac
mov dword [ebp - 0xc34], 0x8eac
mov dword [ebp - 0xc30], 0x8eac
lea ecx, [ebp - 0x2d5]
call fcn.10008a93
push eax
lea eax, [ebp - 0xc2c]
push eax
lea eax, [ebp - 0xc3c]
push eax
lea ecx, [ebp - 0x100c]
call fcn.100167eb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc94]
call fcn.1001679a
mov dword [ebp - 4], 9
mov dword [ebp - 0x12c], 0xcb50bf34
mov dword [ebp - 0xdd4], 0x7b051af7
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 0x104], 0x6525
push 4
lea ecx, [ebp - 0xd90]
call fcn.1001673e
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x990], 0xffffffff
mov dword [ebp - 0x280], 0
jmp 0x100099f2
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 4
jge 0x10009a14
push dword [ebp - 0x280]
lea ecx, [ebp - 0xd90]
call fcn.100167dc
mov dword [eax], 0xc2f1fcc1
jmp 0x100099e5
mov dword [ebp - 0x40], 0
jmp 0x10009a24
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffff
jg 0x10009cc5
mov dword [ebp - 0x238], 0x5a83d87e
mov dword [ebp - 0x358], 6
push 3
lea ecx, [ebp - 0xb5c]
call fcn.1001673e
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x144], 0xffff
mov dword [ebp - 0x1a0], 0
jmp 0x10009a76
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x10009a98
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0xb5c]
call fcn.100167dc
mov dword [eax], 0xa73a151c
jmp 0x10009a69
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xe90], eax
cmp dword [ebp - 0x104], 0
je 0x10009b6b
cmp dword [ebp - 0x238], 0
je 0x10009acc
cmp dword [ebp - 0x238], 0
je 0x10009acc
mov dword [ebp - 0x3e4], 1
jmp 0x10009ad3
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x3e4], eax
jne 0x10009aed
mov dword [ebp - 0x7b4], 1
jmp 0x10009af4
and dword [ebp - 0x7b4], 0
cmp dword [ebp - 0x7b4], 0x59ea4d59
jne 0x10009b0c
mov dword [ebp - 0x950], 1
jmp 0x10009b13
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xddc], eax
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x238]
jl 0x10009b3a
mov dword [ebp - 0x2e8], 1
jmp 0x10009b41
and dword [ebp - 0x2e8], 0
push 3
lea ecx, [ebp - 0xd90]
call fcn.100167dc
mov ecx, dword [ebp - 0x2e8]
mov dword [eax], ecx
cmp dword [ebp - 0x2e8], 0
je 0x10009b6b
mov dword [ebp - 0x958], 1
jmp 0x10009b72
and dword [ebp - 0x958], 0
cmp dword [ebp - 0x40], 0
je 0x10009b8d
cmp dword [ebp - 0x104], 0
je 0x10009b8d
mov dword [ebp - 0x960], 1
jmp 0x10009b94
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x358], eax
je 0x10009bba
mov dword [ebp - 0x3ec], 1
jmp 0x10009bc1
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x3ec]
cmp eax, dword [ebp - 0x40]
jle 0x10009be4
cmp dword [ebp - 0x104], 0
je 0x10009be4
mov dword [ebp - 0x62c], 1
jmp 0x10009beb
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 1
jne 0x10009c00
mov dword [ebp - 0x3f4], 1
jmp 0x10009c07
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x3f4], eax
je 0x10009c1e
mov dword [ebp - 0x734], 1
jmp 0x10009c25
and dword [ebp - 0x734], 0
push 0
lea ecx, [ebp - 0xb5c]
call fcn.100167dc
mov ecx, dword [ebp - 0x734]
mov dword [eax], ecx
cmp dword [ebp - 0x144], 0
jbe 0x10009c4f
mov dword [ebp - 0x3fc], 1
jmp 0x10009c56
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x990], eax
mov dword [ebp - 0x144], 0
jmp 0x10009c7e
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 6
jne 0x10009cb1
mov dword [ebp - 0x998], 0
mov esi, dword [ebp - 0x358]
push 1
lea ecx, [ebp - 0xb5c]
call fcn.100167dc
mov dword [eax], esi
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x998], eax
jmp 0x10009c71
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xb5c]
call fcn.100167c0
jmp 0x10009a1d
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xd90]
call fcn.100167c0
mov dword [ebp - 0x404], 0x974b666a
push 4
lea ecx, [ebp - 0xda8]
call fcn.1001673e
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x2f0], 5
mov dword [ebp - 0x1a8], 0xffffffff
mov dword [ebp - 0x9b0], 0x5300ce3d
mov dword [ebp - 0x64], 0
jmp 0x10009d1d
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x10009d33
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x858], 1
jmp 0x10009d16
mov dword [ebp - 0x64], 0
jmp 0x10009d43
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x10009d5c
push dword [ebp - 0x64]
lea ecx, [ebp - 0xda8]
call fcn.100167dc
or dword [eax], 0xffffffff
jmp 0x10009d3c
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x10009d7d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
lea ecx, [ebp - 0xda8]
call fcn.100167dc
mov dword [eax], 0xbfb66feb
cmp dword [ebp - 0x1a8], 0xbfb66feb
je 0x10009da8
mov dword [ebp - 0x9a0], 1
jmp 0x10009daf
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0xea0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x858]
mov dword [ebp - 0xdf0], eax
cmp dword [ebp - 0x1a8], 0x4d07ddbf
jge 0x10009de6
mov dword [ebp - 0x634], 1
jmp 0x10009ded
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
neg eax
je 0x10009e1f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x858], 0
je 0x10009e1f
mov dword [ebp - 0x844], 1
jmp 0x10009e26
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x844], eax
jle 0x10009e40
mov dword [ebp - 0x40c], 1
jmp 0x10009e47
and dword [ebp - 0x40c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x858]
cmp dword [ebp - 0x40c], eax
jg 0x10009e68
mov dword [ebp - 0x9a8], 1
jmp 0x10009e6f
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x858]
cmp dword [ebp - 0x2f0], eax
jg 0x10009e9d
mov dword [ebp - 0x63c], 1
jmp 0x10009ea4
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 1
je 0x10009eb9
mov dword [ebp - 0x414], 1
jmp 0x10009ec0
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
inc eax
inc eax
mov dword [ebp - 0x9b0], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xda8]
call fcn.100167c0
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x10009fb1
mov dword [ebp - 0x2a8], 0xcea5d6c0
mov dword [ebp - 0xf2c], 0x891c5534
mov dword [ebp - 0x2a8], 0xffffffed
jmp 0x10009f20
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0x18
jl 0x10009f7a
mov dword [ebp - 0x1b0], 0xeede0b40
mov dword [ebp - 0xdf8], 0
mov dword [ebp - 0x73c], 0xffffffff
mov dword [ebp - 0x1b0], 0
jmp 0x10009f60
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xffffffe6
jl 0x10009f78
mov eax, dword [ebp - 0x73c]
dec eax
mov dword [ebp - 0x73c], eax
jmp 0x10009f53
jmp 0x10009f13
mov byte [ebp - 0xc7], 0
movzx eax, byte [ebp - 0xc7]
test eax, eax
je 0x10009fa9
push 0
push 0
push 0
push 0
push 0x24fb
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 1
lea ecx, [ebp - 0x890]
call fcn.1001673e
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xea8], 0x9ea9831
mov dword [ebp - 0x240], 0
jmp 0x10009fe5
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 1
jge 0x1000a007
push dword [ebp - 0x240]
lea ecx, [ebp - 0x890]
call fcn.100167dc
mov dword [eax], 0xdb3ae355
jmp 0x10009fd8
push 0
lea ecx, [ebp - 0x890]
call fcn.100167dc
and dword [eax], 0
jmp 0x1000a03d
push 0
lea ecx, [ebp - 0x890]
call fcn.100167dc
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x41c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x890]
call fcn.100167dc
cmp dword [eax], 0xa
jle 0x1000a07f
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x1000a069
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
lea ecx, [ebp - 0x890]
call fcn.100167dc
cmp dword [eax], 0
je 0x1000a07d
jmp 0x1000a07f
jmp 0x1000a019
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x890]
call fcn.100167c0
mov dword [ebp - 0x12c], 3
jmp 0x1000a0a7
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jl 0x1000a587
mov dword [ebp - 0x124], 0xd06ce125
mov dword [ebp - 0x1b8], 0
jmp 0x1000a0d7
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jge 0x1000a0f3
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x8e8], 0xfffffff8
jmp 0x1000a0ca
mov dword [ebp - 0x124], 0
jmp 0x1000a10c
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jge 0x1000a128
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x8e8], 0
jmp 0x1000a0ff
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1000a149
push 0
push 0x804
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0xa0], 3
mov dword [ebp - 0xb8], 2
mov dword [ebp - 0x164], 0xfffffffc
mov dword [ebp - 0x288], 0
jmp 0x1000a180
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jge 0x1000a19c
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0x8f0], 1
jmp 0x1000a173
mov dword [ebp - 0xb8], 1
jmp 0x1000a1b5
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x1000a245
mov eax, dword [ebp - 0xb8]
cmp dword [ebp + eax*4 - 0x8f0], 0
je 0x1000a20d
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp + eax*4 - 0x8f0]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x644]
mov dword [ebp + eax*4 - 0x8f0], ecx
cmp dword [ebp - 0x644], 0
je 0x1000a20d
mov dword [ebp - 0x424], 1
jmp 0x1000a214
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
sub eax, dword [ebp - 0xb8]
mov dword [ebp - 0x164], eax
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x1000a240
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x1000a1a8
mov dword [ebp - 0x164], 0xf
jmp 0x1000a25e
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jl 0x1000a28f
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x1000a28d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
jmp 0x1000a251
mov dword [ebp - 0xe00], 4
mov dword [ebp - 0xa0], 3
jmp 0x1000a2b2
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x1000a380
mov dword [ebp - 0x1c0], 0
jmp 0x1000a2d8
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jge 0x1000a2f4
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x7ec], 0x4caf14c9
jmp 0x1000a2cb
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x7ec], 3
jmp 0x1000a322
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7ec]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x7ec], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7ec], 0
jl 0x1000a37b
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x7ec]
lea ecx, [ebp - 0xc94]
call fcn.100167dc
mov esi, eax
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xc94]
call fcn.100167dc
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x1000a379
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1000a307
jmp 0x1000a2a5
push 1
lea ecx, [ebp - 0x878]
call fcn.1001673e
mov byte [ebp - 4], 0xe
mov dword [ebp - 0xf6c], 0x49d585ed
mov dword [ebp - 0x248], 0
jmp 0x1000a3b4
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x1000a3d3
push dword [ebp - 0x248]
lea ecx, [ebp - 0x878]
call fcn.100167dc
and dword [eax], 0
jmp 0x1000a3a7
push 0
lea ecx, [ebp - 0x878]
call fcn.100167dc
and dword [eax], 0
jmp 0x1000a409
push 0
lea ecx, [ebp - 0x878]
call fcn.100167dc
mov dword [ebp - 0x7bc], eax
mov eax, dword [ebp - 0x7bc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7bc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x878]
call fcn.100167dc
cmp dword [eax], 2
jge 0x1000a4ec
mov dword [ebp - 0x1c8], 0x57102d14
mov dword [ebp - 0xe08], 0x33843046
mov dword [ebp - 0xeb0], 0x9dd952ea
mov dword [ebp - 0x1c8], 0x15
jmp 0x1000a456
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0xfffffff8
je 0x1000a4e7
push 3
lea ecx, [ebp - 0xd84]
call fcn.1001673e
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x2c8], 0
jmp 0x1000a48d
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 3
jge 0x1000a4af
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0xd84]
call fcn.100167dc
mov dword [eax], 1
jmp 0x1000a480
push 0
lea ecx, [ebp - 0xd84]
call fcn.100167dc
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x42c]
mov dword [ecx], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xd84]
call fcn.100167c0
jmp 0x1000a449
jmp 0x1000a3e5
push 0
lea ecx, [ebp - 0x878]
call fcn.100167dc
mov dword [eax], 0x9acf2579
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x878]
call fcn.100167c0
mov dword [ebp - 0xa0], 3
jmp 0x1000a527
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x1000a582
mov dword [ebp - 0x1d0], 0
jmp 0x1000a549
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x1000a565
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x64c], 0xfffffff7
jmp 0x1000a53c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x64c], eax
jmp 0x1000a51a
jmp 0x1000a09a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc94]
call fcn.100167c0
mov dword [ebp - 0x9c0], 0x692beaa3
mov dword [ebp - 0xe10], 0x2d149fe
mov dword [ebp - 0x330], 0xf69f7fd1
mov dword [ebp - 0x9d8], 0xffffffff
mov dword [ebp - 0xf68], 8
mov dword [ebp - 0xf64], 8
mov dword [ebp - 0xf60], 8
mov dword [ebp - 0xf5c], 8
push 1
lea ecx, [ebp - 0xa18]
call fcn.1001673e
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x9c8], 1
mov dword [ebp - 0x9d0], 2
mov dword [ebp - 0x24], 0
jmp 0x1000a61e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000a634
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9e0], 0x464f16ef
jmp 0x1000a617
mov dword [ebp - 0x24], 0
jmp 0x1000a644
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1000a65a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x101c], 3
jmp 0x1000a63d
mov dword [ebp - 0x24], 0
jmp 0x1000a66a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000a686
push dword [ebp - 0x24]
lea ecx, [ebp - 0xa18]
call fcn.100167dc
mov dword [eax], 0xa6ff
jmp 0x1000a663
cmp dword [ebp - 0x9c0], 0
je 0x1000a732
mov dword [ebp - 0xf34], 0x579253a3
mov dword [ebp - 0xe18], 0xfffffffc
push 2
lea ecx, [ebp - 0xed4]
call fcn.1001673e
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xeb8], 0
mov dword [ebp - 0x250], 0
jmp 0x1000a6db
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 2
jge 0x1000a6fa
push dword [ebp - 0x250]
lea ecx, [ebp - 0xed4]
call fcn.100167dc
or dword [eax], 0xffffffff
jmp 0x1000a6ce
push 0
lea ecx, [ebp - 0xa18]
call fcn.100167dc
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x434]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x434]
mov dword [ecx], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xed4]
call fcn.100167c0
jmp 0x1000a924
push 3
lea ecx, [ebp - 0xbbc]
call fcn.1001673e
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x454], 0x9d0863e8
mov dword [ebp - 0x1d8], 0
jmp 0x1000a766
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jge 0x1000a788
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0xbbc]
call fcn.100167dc
mov dword [eax], 0x32e0c280
jmp 0x1000a759
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1000a7a5
push 0x1d00
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea ecx, [ebp - 0xa18]
call fcn.100167dc
cmp dword [eax], 0
jne 0x1000a8ff
xor eax, eax
inc eax
je 0x1000a7d5
cmp dword [ebp - 0x330], 0
je 0x1000a7d5
mov dword [ebp - 0x744], 1
jmp 0x1000a7dc
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x9c8]
cmp dword [ebp - 0x744], eax
jg 0x1000a7f6
mov dword [ebp - 0x43c], 1
jmp 0x1000a7fd
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
neg eax
cmp eax, 8
jbe 0x1000a816
mov dword [ebp - 0x654], 1
jmp 0x1000a81d
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x9d0]
cmp dword [ebp - 0x654], eax
jg 0x1000a837
mov dword [ebp - 0x444], 1
jmp 0x1000a83e
and dword [ebp - 0x444], 0
xor esi, esi
inc esi
sub esi, dword [ebp - 0x444]
push 0
lea ecx, [ebp - 0xbbc]
call fcn.100167dc
cmp esi, dword [eax]
jg 0x1000a864
mov dword [ebp - 0x814], 1
jmp 0x1000a86b
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x9d8]
cmp dword [ebp - 0x814], eax
jle 0x1000a885
mov dword [ebp - 0x44c], 1
jmp 0x1000a88c
and dword [ebp - 0x44c], 0
xor esi, esi
sub esi, dword [ebp - 0x44c]
push 0
lea ecx, [ebp - 0xa18]
call fcn.100167dc
add esi, dword [eax]
push 1
lea ecx, [ebp - 0xbbc]
call fcn.100167dc
cmp esi, dword [eax]
jge 0x1000a8c0
mov dword [ebp - 0x65c], 1
jmp 0x1000a8c7
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0x454], eax
xor eax, eax
sub eax, dword [ebp - 0x454]
je 0x1000a8e6
cmp dword [ebp - 0x330], 0
jne 0x1000a8ff
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9e0], 0
jne 0x1000a8ff
and dword [ebp - 0x74c], 0
jmp 0x1000a909
mov dword [ebp - 0x74c], 1
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x330], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xbbc]
call fcn.100167c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa18]
call fcn.100167c0
mov dword [ebp - 0x9e8], 0x692beaa3
mov dword [ebp - 0xe20], 0x2d149fe
mov dword [ebp - 0x2f8], 0xf69f7fd1
mov dword [ebp - 0xaf4], 0xffffffff
mov dword [ebp - 0xf7c], 8
mov dword [ebp - 0xf78], 8
mov dword [ebp - 0xf74], 8
mov dword [ebp - 0xf70], 8
push 1
lea ecx, [ebp - 0xa28]
call fcn.1001673e
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x9f0], 1
mov dword [ebp - 0x9f8], 2
mov dword [ebp - 0x18], 0
jmp 0x1000a9bb
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1000a9d1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa8c], 0x464f16ef
jmp 0x1000a9b4
mov dword [ebp - 0x18], 0
jmp 0x1000a9e1
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1000a9f7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x102c], 3
jmp 0x1000a9da
mov dword [ebp - 0x18], 0
jmp 0x1000aa07
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1000aa23
push dword [ebp - 0x18]
lea ecx, [ebp - 0xa28]
call fcn.100167dc
mov dword [eax], 0xa6ff
jmp 0x1000aa00
cmp dword [ebp - 0x9e8], 0
je 0x1000aacf
mov dword [ebp - 0xfbc], 0x579253a3
mov dword [ebp - 0xe28], 0xfffffffc
push 2
lea ecx, [ebp - 0xee4]
call fcn.1001673e
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xec8], 0
mov dword [ebp - 0x290], 0
jmp 0x1000aa78
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 2
jge 0x1000aa97
push dword [ebp - 0x290]
lea ecx, [ebp - 0xee4]
call fcn.100167dc
or dword [eax], 0xffffffff
jmp 0x1000aa6b
push 0
lea ecx, [ebp - 0xa28]
call fcn.100167dc
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x45c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x45c]
mov dword [ecx], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xee4]
call fcn.100167c0
jmp 0x1000acc1
push 3
lea ecx, [ebp - 0xb74]
call fcn.1001673e
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x47c], 0x9d0863e8
mov dword [ebp - 0x1e0], 0
jmp 0x1000ab03
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jge 0x1000ab25
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0xb74]
call fcn.100167dc
mov dword [eax], 0x32e0c280
jmp 0x1000aaf6
mov byte [ebp - 0xf8], 0
movzx eax, byte [ebp - 0xf8]
test eax, eax
je 0x1000ab42
push 0x1d00
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea ecx, [ebp - 0xa28]
call fcn.100167dc
cmp dword [eax], 0
jne 0x1000ac9c
xor eax, eax
inc eax
je 0x1000ab72
cmp dword [ebp - 0x2f8], 0
je 0x1000ab72
mov dword [ebp - 0x664], 1
jmp 0x1000ab79
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x9f0]
cmp dword [ebp - 0x664], eax
jg 0x1000ab93
mov dword [ebp - 0x464], 1
jmp 0x1000ab9a
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
neg eax
cmp eax, 8
jbe 0x1000abb3
mov dword [ebp - 0x7c4], 1
jmp 0x1000abba
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x9f8]
cmp dword [ebp - 0x7c4], eax
jg 0x1000abd4
mov dword [ebp - 0x46c], 1
jmp 0x1000abdb
and dword [ebp - 0x46c], 0
xor esi, esi
inc esi
sub esi, dword [ebp - 0x46c]
push 0
lea ecx, [ebp - 0xb74]
call fcn.100167dc
cmp esi, dword [eax]
jg 0x1000ac01
mov dword [ebp - 0x66c], 1
jmp 0x1000ac08
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0xaf4]
cmp dword [ebp - 0x66c], eax
jle 0x1000ac22
mov dword [ebp - 0x474], 1
jmp 0x1000ac29
and dword [ebp - 0x474], 0
xor esi, esi
sub esi, dword [ebp - 0x474]
push 0
lea ecx, [ebp - 0xa28]
call fcn.100167dc
add esi, dword [eax]
push 1
lea ecx, [ebp - 0xb74]
call fcn.100167dc
cmp esi, dword [eax]
jge 0x1000ac5d
mov dword [ebp - 0x754], 1
jmp 0x1000ac64
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x47c], eax
xor eax, eax
sub eax, dword [ebp - 0x47c]
je 0x1000ac83
cmp dword [ebp - 0x2f8], 0
jne 0x1000ac9c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa8c], 0
jne 0x1000ac9c
and dword [ebp - 0x674], 0
jmp 0x1000aca6
mov dword [ebp - 0x674], 1
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x2f8], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xb74]
call fcn.100167c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa28]
call fcn.100167c0
mov dword [ebp - 0xb1c], 0x692beaa3
mov dword [ebp - 0xe30], 0x2d149fe
mov dword [ebp - 0x364], 0xf69f7fd1
mov dword [ebp - 0x8fc], 0xffffffff
mov dword [ebp - 0xf90], 8
mov dword [ebp - 0xf8c], 8
mov dword [ebp - 0xf88], 8
mov dword [ebp - 0xf84], 8
push 1
lea ecx, [ebp - 0xa38]
call fcn.1001673e
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x920], 1
mov dword [ebp - 0x968], 2
mov dword [ebp - 0x1c], 0
jmp 0x1000ad58
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000ad6e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa1c], 0x464f16ef
jmp 0x1000ad51
mov dword [ebp - 0x1c], 0
jmp 0x1000ad7e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1000ad94
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1014], 3
jmp 0x1000ad77
mov dword [ebp - 0x1c], 0
jmp 0x1000ada4
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000adc0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa38]
call fcn.100167dc
mov dword [eax], 0xa6ff
jmp 0x1000ad9d
cmp dword [ebp - 0xb1c], 0
je 0x1000ae6c
mov dword [ebp - 0xf3c], 0x579253a3
mov dword [ebp - 0xe38], 0xfffffffc
push 2
lea ecx, [ebp - 0xef4]
call fcn.1001673e
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xed8], 0
mov dword [ebp - 0x258], 0
jmp 0x1000ae15
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 2
jge 0x1000ae34
push dword [ebp - 0x258]
lea ecx, [ebp - 0xef4]
call fcn.100167dc
or dword [eax], 0xffffffff
jmp 0x1000ae08
push 0
lea ecx, [ebp - 0xa38]
call fcn.100167dc
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x484]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x484]
mov dword [ecx], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xef4]
call fcn.100167c0
jmp 0x1000b05e
push 3
lea ecx, [ebp - 0xbec]
call fcn.1001673e
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x4a4], 0x9d0863e8
mov dword [ebp - 0x1e8], 0
jmp 0x1000aea0
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 3
jge 0x1000aec2
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0xbec]
call fcn.100167dc
mov dword [eax], 0x32e0c280
jmp 0x1000ae93
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x1000aedf
push 0x1d00
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea ecx, [ebp - 0xa38]
call fcn.100167dc
cmp dword [eax], 0
jne 0x1000b039
xor eax, eax
inc eax
je 0x1000af0f
cmp dword [ebp - 0x364], 0
je 0x1000af0f
mov dword [ebp - 0x818], 1
jmp 0x1000af16
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x920]
cmp dword [ebp - 0x818], eax
jg 0x1000af30
mov dword [ebp - 0x48c], 1
jmp 0x1000af37
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
neg eax
cmp eax, 8
jbe 0x1000af50
mov dword [ebp - 0x67c], 1
jmp 0x1000af57
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x968]
cmp dword [ebp - 0x67c], eax
jg 0x1000af71
mov dword [ebp - 0x494], 1
jmp 0x1000af78
and dword [ebp - 0x494], 0
xor esi, esi
inc esi
sub esi, dword [ebp - 0x494]
push 0
lea ecx, [ebp - 0xbec]
call fcn.100167dc
cmp esi, dword [eax]
jg 0x1000af9e
mov dword [ebp - 0x75c], 1
jmp 0x1000afa5
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x8fc]
cmp dword [ebp - 0x75c], eax
jle 0x1000afbf
mov dword [ebp - 0x49c], 1
jmp 0x1000afc6
and dword [ebp - 0x49c], 0
xor esi, esi
sub esi, dword [ebp - 0x49c]
push 0
lea ecx, [ebp - 0xa38]
call fcn.100167dc
add esi, dword [eax]
push 1
lea ecx, [ebp - 0xbec]
call fcn.100167dc
cmp esi, dword [eax]
jge 0x1000affa
mov dword [ebp - 0x684], 1
jmp 0x1000b001
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x4a4], eax
xor eax, eax
sub eax, dword [ebp - 0x4a4]
je 0x1000b020
cmp dword [ebp - 0x364], 0
jne 0x1000b039
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa1c], 0
jne 0x1000b039
and dword [ebp - 0x7cc], 0
jmp 0x1000b043
mov dword [ebp - 0x7cc], 1
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0x364], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xbec]
call fcn.100167c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa38]
call fcn.100167c0
push 4
lea ecx, [ebp - 0x388]
call fcn.1001673e
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x20], 0
jmp 0x1000b091
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1000b0a7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa48], 1
jmp 0x1000b08a
mov dword [ebp - 0x20], 0
jmp 0x1000b0b7
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000b0d3
push dword [ebp - 0x20]
lea ecx, [ebp - 0x388]
call fcn.100167dc
mov dword [eax], 0xe83c773
jmp 0x1000b0b0
mov dword [ebp - 0x20], 0
jmp 0x1000b0e3
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1000b0f9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x884], 0xe075257
jmp 0x1000b0dc
push 3
lea ecx, [ebp - 0x388]
call fcn.100167dc
and dword [eax], 0
jmp 0x1000b12f
push 3
lea ecx, [ebp - 0x388]
call fcn.100167dc
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x4ac]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x388]
call fcn.100167dc
cmp dword [eax], 2
jg 0x1000b222
mov dword [ebp - 0x1f0], 0xad86e52d
push 3
lea ecx, [ebp - 0xb8c]
call fcn.1001673e
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x2b0], 0
jmp 0x1000b179
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 3
jge 0x1000b19b
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0xb8c]
call fcn.100167dc
mov dword [eax], 1
jmp 0x1000b16c
push 3
lea ecx, [ebp - 0x388]
call fcn.100167dc
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xa48], 0
je 0x1000b1c5
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xb8c]
call fcn.100167c0
jmp 0x1000b222
mov dword [ebp - 0x1f0], 2
jmp 0x1000b1de
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
jl 0x1000b20e
push 3
lea ecx, [ebp - 0x388]
call fcn.100167dc
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0xa48]
push 2
lea ecx, [ebp - 0xb8c]
call fcn.100167dc
mov dword [eax], esi
jmp 0x1000b1d1
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xb8c]
call fcn.100167c0
jmp 0x1000b10b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa48], 1
jg 0x1000b23e
mov dword [ebp - 0x4bc], 1
jmp 0x1000b245
and dword [ebp - 0x4bc], 0
push 3
lea ecx, [ebp - 0x388]
call fcn.100167dc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa48]
mov dword [ebp - 0xe40], eax
push 0xfffffffffffffffb
pop eax
cmp eax, 0xfffffff9
jne 0x1000b279
mov dword [ebp - 0x68c], 1
jmp 0x1000b280
and dword [ebp - 0x68c], 0
cmp dword [ebp - 0x68c], 1
jl 0x1000b295
mov dword [ebp - 0x4b4], 1
jmp 0x1000b29c
and dword [ebp - 0x4b4], 0
imul eax, dword [ebp - 0x4b4], 0
mov dword [ebp - 0x764], eax
push 1
lea ecx, [ebp - 0x388]
call fcn.100167dc
mov ecx, dword [ebp - 0x764]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa48]
add eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x4bc]
neg ecx
cmp ecx, eax
jne 0x1000b2e9
mov dword [ebp - 0x694], 1
jmp 0x1000b2f0
and dword [ebp - 0x694], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x884]
cmp dword [ebp - 0x694], eax
jge 0x1000b376
mov dword [ebp - 0x260], 5
mov dword [ebp - 0x260], 2
jmp 0x1000b327
mov eax, dword [ebp - 0x260]
dec eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jl 0x1000b371
mov dword [ebp - 0x14c], 0x6728ad64
mov dword [ebp - 0x14c], 0
jmp 0x1000b353
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 3
jge 0x1000b36f
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x884], 0
jmp 0x1000b346
jmp 0x1000b31a
jmp 0x1000b4d1
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0x4cc], 8
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0xf80], eax
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0x884]
push 3
lea ecx, [ebp - 0x388]
call fcn.100167dc
mov dword [eax], esi
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x4cc]
cmp dword [ebp - 0x1f8], eax
jg 0x1000b3d1
mov dword [ebp - 0x4c4], 1
jmp 0x1000b3d8
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x4c4], eax
je 0x1000b3f2
mov dword [ebp - 0x828], 1
jmp 0x1000b3f9
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x828]
add eax, 0x5f87
jne 0x1000b418
cmp dword [ebp - 0x4cc], 0
jne 0x1000b418
and dword [ebp - 0x69c], 0
jmp 0x1000b422
mov dword [ebp - 0x69c], 1
imul eax, dword [ebp - 0x69c], 0xa7fc
test eax, eax
jne 0x1000b448
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x884], 0
jne 0x1000b448
and dword [ebp - 0x4d4], 0
jmp 0x1000b452
mov dword [ebp - 0x4d4], 1
cmp dword [ebp - 0x4d4], 3
jbe 0x1000b470
mov eax, 0xd3d38e20
test eax, eax
je 0x1000b470
mov dword [ebp - 0x76c], 1
jmp 0x1000b477
and dword [ebp - 0x76c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x884]
cmp dword [ebp - 0x76c], eax
jg 0x1000b497
mov dword [ebp - 0x4dc], 1
jmp 0x1000b49e
and dword [ebp - 0x4dc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp + eax - 0x884], ecx
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1000b4d1
push 0
push 0x4c1
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x388]
call fcn.100167c0
mov dword [ebp - 0x904], 0x692beaa3
mov dword [ebp - 0xe48], 0x2d149fe
mov dword [ebp - 0x300], 0xf69f7fd1
mov dword [ebp - 0xa2c], 0xffffffff
mov dword [ebp - 0xfa4], 8
mov dword [ebp - 0xfa0], 8
mov dword [ebp - 0xf9c], 8
mov dword [ebp - 0xf98], 8
push 1
lea ecx, [ebp - 0xa58]
call fcn.1001673e
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0xb04], 1
mov dword [ebp - 0x90c], 2
mov dword [ebp - 0x28], 0
jmp 0x1000b568
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1000b57e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x914], 0x464f16ef
jmp 0x1000b561
mov dword [ebp - 0x28], 0
jmp 0x1000b58e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000b5a4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1004], 3
jmp 0x1000b587
mov dword [ebp - 0x28], 0
jmp 0x1000b5b4
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1000b5d0
push dword [ebp - 0x28]
lea ecx, [ebp - 0xa58]
call fcn.100167dc
mov dword [eax], 0xa6ff
jmp 0x1000b5ad
cmp dword [ebp - 0x904], 0
je 0x1000b67c
mov dword [ebp - 0xee8], 0x579253a3
mov dword [ebp - 0xe50], 0xfffffffc
push 2
lea ecx, [ebp - 0xf04]
call fcn.1001673e
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0xf44], 0
mov dword [ebp - 0x298], 0
jmp 0x1000b625
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 2
jge 0x1000b644
push dword [ebp - 0x298]
lea ecx, [ebp - 0xf04]
call fcn.100167dc
or dword [eax], 0xffffffff
jmp 0x1000b618
push 0
lea ecx, [ebp - 0xa58]
call fcn.100167dc
mov dword [ebp - 0x6a4], eax
mov eax, dword [ebp - 0x6a4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x6a4]
mov dword [ecx], eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xf04]
call fcn.100167c0
jmp 0x1000b86e
push 3
lea ecx, [ebp - 0xbd4]
call fcn.1001673e
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x6b4], 0x9d0863e8
mov dword [ebp - 0x200], 0
jmp 0x1000b6b0
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x1000b6d2
push dword [ebp - 0x200]
lea ecx, [ebp - 0xbd4]
call fcn.100167dc
mov dword [eax], 0x32e0c280
jmp 0x1000b6a3
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x1000b6ef
push 0x1d00
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea ecx, [ebp - 0xa58]
call fcn.100167dc
cmp dword [eax], 0
jne 0x1000b849
xor eax, eax
inc eax
je 0x1000b71f
cmp dword [ebp - 0x300], 0
je 0x1000b71f
mov dword [ebp - 0x4e4], 1
jmp 0x1000b726
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0xb04]
cmp dword [ebp - 0x4e4], eax
jg 0x1000b740
mov dword [ebp - 0x7d8], 1
jmp 0x1000b747
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x7d8]
neg eax
cmp eax, 8
jbe 0x1000b760
mov dword [ebp - 0x4ec], 1
jmp 0x1000b767
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x90c]
cmp dword [ebp - 0x4ec], eax
jg 0x1000b781
mov dword [ebp - 0x6ac], 1
jmp 0x1000b788
and dword [ebp - 0x6ac], 0
xor esi, esi
inc esi
sub esi, dword [ebp - 0x6ac]
push 0
lea ecx, [ebp - 0xbd4]
call fcn.100167dc
cmp esi, dword [eax]
jg 0x1000b7ae
mov dword [ebp - 0x4f4], 1
jmp 0x1000b7b5
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0xa2c]
cmp dword [ebp - 0x4f4], eax
jle 0x1000b7cf
mov dword [ebp - 0x504], 1
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x300], eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xbd4]
call fcn.100167c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa58]
call fcn.100167c0
mov dword [ebp - 0xb2c], 0x692beaa3
mov dword [ebp - 0xe58], 0x2d149fe
mov dword [ebp - 0x338], 0xf69f7fd1
mov dword [ebp - 0x924], 0xffffffff
mov dword [ebp - 0xfb8], 8
mov dword [ebp - 0xfb4], 8
mov dword [ebp - 0xfb0], 8
mov dword [ebp - 0xfac], 8
push 1
lea ecx, [ebp - 0xa68]
call fcn.1001673e
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x91c], 1
mov dword [ebp - 0xa3c], 2
mov dword [ebp - 0x30], 0
jmp 0x1000b905
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1000b91b
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xb0c], 0x464f16ef
jmp 0x1000b8fe
mov dword [ebp - 0x30], 0
jmp 0x1000b92b
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1000b941
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1024], 3
jmp 0x1000b924
mov dword [ebp - 0x30], 0
jmp 0x1000b951
cmp dword [ebp - 0x30], 1
jge 0x1000b96d