Function at 0x10044321
Capabilities:
Check os version
Encrypt data using speck
Get common file path
Get disk information
Parse pe header
Query service status
Resolve function by parsing pe exports
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006eadd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1224
call fcn.1006a000
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xc4], 5
mov dword [ebp - 0x7bc], 0x5998ab54
mov dword [ebp - 0x304], 0
jmp 0x10044377
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 4
jge 0x10044393
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0x1170], 0xfffffffa
jmp 0x1004436a
mov dword [ebp - 0xc4], 0
jmp 0x100443ac
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xfffffff3
je 0x1004448a
mov dword [ebp - 0xa08], 0x4f204795
mov dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0x7bc]
cmp eax, 0x7001
jne 0x100443ed
mov dword [ebp - 0x9f0], 1
jmp 0x100443f4
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0xc4]
sub eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x9f0]
jge 0x10044414
mov dword [ebp - 0x9f8], 1
jmp 0x1004441b
and dword [ebp - 0x9f8], 0
cmp dword [ebp - 0x9f8], 0xfffffffd
jne 0x10044430
mov dword [ebp - 0x3c4], 1
jmp 0x10044437
and dword [ebp - 0x3c4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp + eax - 0x1170], ecx
mov eax, dword [ebp - 0x3c4]
sub eax, dword [ebp - 0xa08]
cmp eax, dword [ebp - 0xc4]
jle 0x1004446f
mov eax, 0xd1dc
test eax, eax
jne 0x1004446f
and dword [ebp - 0xa00], 0
jmp 0x10044479
mov dword [ebp - 0xa00], 1
mov eax, dword [ebp - 0xa00]
mov dword [ebp - 0xa08], eax
jmp 0x1004439f
cmp dword [ebp + 0x10], 0
jbe 0x100447f8
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100447f8
mov dword [ebp - 0xac], 0xa439beb0
mov dword [ebp - 0xea8], 0xf8de905f
mov dword [ebp - 0x1004], 0x5951
mov dword [ebp - 0x390], 0
jmp 0x100444d7
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 2
jge 0x100444f3
mov eax, dword [ebp - 0x390]
mov dword [ebp + eax*4 - 0x228], 0x8bbca631
jmp 0x100444ca
mov dword [ebp - 0xac], 0
jmp 0x1004450c
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jg 0x100447d3
mov dword [ebp - 0x154], 1
mov dword [ebp - 0xa38], 0x4ff5452f
mov dword [ebp - 0xaf4], 0
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x1004454f
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x154], 0
jmp 0x10044568
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jg 0x100447ce
mov dword [ebp - 0x398], 0
jmp 0x1004458e
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 3
jge 0x100445aa
mov eax, dword [ebp - 0x398]
mov dword [ebp + eax*4 - 0xaf0], 0xfffffffc
jmp 0x10044581
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xaf0], 0
jmp 0x100445d8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaf0]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xaf0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xaf0], 1
jg 0x100447c9
mov dword [ebp - 0x168], 0xffffffff
mov dword [ebp - 0xb20], 0x7e80a7c6
mov dword [ebp - 0x168], 0
jmp 0x10044619
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jg 0x100447af
xor eax, eax
jne 0x1004470e
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xac]
mov ecx, dword [ebp + ecx*4 - 0x228]
cmp ecx, dword [ebp + eax*4 - 0x228]
jne 0x10044656
mov dword [ebp - 0xa50], 1
jmp 0x1004465d
and dword [ebp - 0xa50], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xaf0]
mov dword [ebp - 0xa38], eax
mov eax, dword [ebp - 0xa38]
mov dword [ebp - 0xf6c], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x109c], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0xf74], eax
cmp dword [ebp - 0xac], 1
jge 0x100446a8
mov dword [ebp - 0xa40], 1
jmp 0x100446af
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp + eax*4 - 0x228]
cmp dword [ebp - 0xa40], eax
jle 0x100446d0
mov dword [ebp - 0xa48], 1
jmp 0x100446d7
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0xa48]
neg eax
mov ecx, dword [ebp - 0xa50]
sub ecx, eax
cmp ecx, dword [ebp - 0xaf4]
jge 0x100446fb
mov dword [ebp - 0xa58], 1
jmp 0x10044702
and dword [ebp - 0xa58], 0
cmp dword [ebp - 0xa58], 0xf15cc7c4
ja 0x1004472a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xaf0], 0
je 0x1004472a
mov dword [ebp - 0xb18], 1
jmp 0x10044731
and dword [ebp - 0xb18], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x228], 0
je 0x10044756
cmp dword [ebp - 0xb20], 0
je 0x10044756
mov dword [ebp - 0xa54], 1
jmp 0x1004475d
and dword [ebp - 0xa54], 0
cmp dword [ebp - 0xa54], 0xfffb
jb 0x10044776
cmp dword [ebp - 0x168], 0
je 0x10044774
jmp 0x100447af
jmp 0x100447aa
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp + eax*4 - 0x228]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x228], eax
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp + eax*4 - 0x228]
mov ecx, dword [ebp - 0xac]
mov dword [ebp + ecx*4 - 0x228], eax
jmp 0x1004460c
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0x228], 0
je 0x100447c4
jmp 0x100445bd
jmp 0x100445bd
jmp 0x1004455b
jmp 0x100444ff
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x228], 1
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1003f08a
pop ecx
pop ecx
jmp 0x1004c8b5
mov dword [ebp - 0x3a0], 0x5d6c05ba
mov byte [ebp - 0x14a], 0
movzx eax, byte [ebp - 0x14a]
test eax, eax
je 0x1004481f
push 0x1ac2
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x3a0], 0xffffffea
jmp 0x10044838
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0x15
je 0x1004485d
mov byte [ebp - 0x16a], 0
movzx eax, byte [ebp - 0x16a]
test eax, eax
je 0x1004485b
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
jmp 0x1004482b
mov dword [ebp - 0xd0], 0x399841b3
push 3
lea ecx, [ebp - 0xd38]
call fcn.10009e9c
and dword [ebp - 4], 0
mov dword [ebp - 0xb38], 0x404d4644
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x78], 0
jmp 0x1004489c
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x100448b2
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xb28], 0xffffffff
jmp 0x10044895
mov dword [ebp - 0x78], 0
jmp 0x100448c2
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x100448de
push dword [ebp - 0x78]
lea ecx, [ebp - 0xd38]
call fcn.10009f14
mov dword [eax], 0xa4b38b4b
jmp 0x100448bb
mov dword [ebp - 0xd0], 0x14
jmp 0x100448f7
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x1b
jle 0x10044b7a
mov dword [ebp - 0x450], 0x6efa
mov dword [ebp - 0x170], 0xfffffff6
push 2
lea ecx, [ebp - 0xdec]
call fcn.10009e9c
mov byte [ebp - 4], 1
mov dword [ebp - 0x32c], 0
jmp 0x10044942
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 2
jge 0x10044964
push dword [ebp - 0x32c]
lea ecx, [ebp - 0xdec]
call fcn.10009f14
mov dword [eax], 4
jmp 0x10044935
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb28], 0x2f20920a
mov eax, dword [ebp - 0x170]
sub eax, dword [ebp - 0xd0]
add eax, 0x2f20920a
cmp eax, dword [ebp - 0x170]
jl 0x1004499a
mov dword [ebp - 0x7fc], 1
jmp 0x100449a1
and dword [ebp - 0x7fc], 0
cmp dword [ebp - 0x7fc], 0x49bc00ea
jne 0x100449b9
mov dword [ebp - 0x8b8], 1
jmp 0x100449c0
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x8b8]
neg ecx
lea eax, [ecx + eax - 6]
cmp eax, dword [ebp - 0x170]
jne 0x100449e6
mov dword [ebp - 0x438], 1
jmp 0x100449ed
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x438]
jge 0x10044a07
mov dword [ebp - 0x8c0], 1
jmp 0x10044a0e
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
dec eax
mov dword [ebp - 0x440], eax
push 1
lea ecx, [ebp - 0xdec]
call fcn.10009f14
mov ecx, dword [ebp - 0x440]
mov dword [eax], ecx
mov eax, dword [ebp - 0x450]
cmp dword [ebp - 0x440], eax
jge 0x10044a4a
mov dword [ebp - 0x8c8], 1
jmp 0x10044a51
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x8c8], eax
jle 0x10044a6b
mov dword [ebp - 0x448], 1
jmp 0x10044a72
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x448], eax
jge 0x10044a8c
mov dword [ebp - 0x8d0], 1
jmp 0x10044a93
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x8d0]
sub eax, 0x379a4b63
je 0x10044ab5
mov eax, 0xd3624b67
test eax, eax
je 0x10044ab5
mov dword [ebp - 0x8d8], 1
jmp 0x10044abc
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x450]
sub eax, dword [ebp - 0x8d8]
jne 0x10044ad6
mov dword [ebp - 0x458], 1
jmp 0x10044add
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x458], eax
jg 0x10044af7
mov dword [ebp - 0xb30], 1
jmp 0x10044afe
and dword [ebp - 0xb30], 0
mov eax, 0x65cab430
sub eax, dword [ebp - 0xd0]
je 0x10044b29
push 2
lea ecx, [ebp - 0xd38]
call fcn.10009f14
cmp dword [eax], 0
je 0x10044b29
mov dword [ebp - 0x8e0], 1
jmp 0x10044b30
and dword [ebp - 0x8e0], 0
push 2
lea ecx, [ebp - 0xd38]
call fcn.10009f14
mov ecx, dword [ebp - 0x8e0]
cmp ecx, dword [eax]
jge 0x10044b53
mov dword [ebp - 0x460], 1
jmp 0x10044b5a
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0xb38], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xdec]
call fcn.10009ef8
jmp 0x100448ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd38]
call fcn.10009ef8
cmp dword [ebp + 0x10], 0
jne 0x10049667
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0xbc], 1
mov dword [ebp - 0x3a8], 0
jmp 0x10044bbd
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 2
jge 0x10044bd9
mov eax, dword [ebp - 0x3a8]
mov dword [ebp + eax*4 - 0x1178], 6
jmp 0x10044bb0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xf7c], eax
cmp dword [ebp - 0x80], 0
je 0x10044e95
mov dword [ebp - 0x334], 0xa13b
mov dword [ebp - 0x254], 0x610a1434
mov dword [ebp - 0x4a0], 0x440e708b
mov dword [ebp - 0x928], 0xac8ef34e
mov dword [ebp - 0xb40], 0xfbc6a687
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x1080], eax
cmp dword [ebp - 0x80], 0xf906d8bc
ja 0x10044c3c
mov dword [ebp - 0x8e8], 1
jmp 0x10044c43
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x8e8], eax
jg 0x10044c5d
mov dword [ebp - 0x468], 1
jmp 0x10044c64
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0x468], eax
jge 0x10044c7e
mov dword [ebp - 0x8f0], 1
jmp 0x10044c85
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x334]
cmp eax, dword [ebp - 0x8f0]
jne 0x10044c9f
mov dword [ebp - 0x470], 1
jmp 0x10044ca6
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x334]
cmp eax, dword [ebp - 0x470]
jle 0x10044cc0
mov dword [ebp - 0x8f8], 1
jmp 0x10044cc7
and dword [ebp - 0x8f8], 0
cmp dword [ebp - 0x8f8], 0xe22401db
jb 0x10044cdf
mov dword [ebp - 0x478], 1
jmp 0x10044ce6
and dword [ebp - 0x478], 0
imul eax, dword [ebp - 0x478], 0xe4f9
cmp eax, 0xf88
jg 0x10044d03
mov dword [ebp - 0x900], 1
jmp 0x10044d0a
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x900], eax
jle 0x10044d21
mov dword [ebp - 0x480], 1
jmp 0x10044d28
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x254]
add eax, dword [ebp - 0x480]
cmp eax, dword [ebp - 0x254]
jne 0x10044d48
mov dword [ebp - 0x908], 1
jmp 0x10044d4f
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x908], eax
jne 0x10044d69
mov dword [ebp - 0x488], 1
jmp 0x10044d70
and dword [ebp - 0x488], 0
cmp dword [ebp - 0x488], 1
jne 0x10044d85
mov dword [ebp - 0x910], 1
jmp 0x10044d8c
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x910], eax
jge 0x10044da6
mov dword [ebp - 0x490], 1
jmp 0x10044dad
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x490], 0xb6b
je 0x10044dc5
mov dword [ebp - 0x918], 1
jmp 0x10044dcc
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x918], eax
jle 0x10044de6
mov dword [ebp - 0x498], 1
jmp 0x10044ded
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x498], eax
jge 0x10044e07
mov dword [ebp - 0x920], 1
jmp 0x10044e0e
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x928], eax
cmp dword [ebp - 0x928], 1
jg 0x10044e3b
mov dword [ebp - 0x4a8], 1
jmp 0x10044e42
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x4a8], eax
jg 0x10044e5c
mov dword [ebp - 0x930], 1
jmp 0x10044e63
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0x930], eax
jne 0x10044e7d
mov dword [ebp - 0x4b0], 1
jmp 0x10044e84
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0xb40], eax
jmp 0x10045015
mov dword [ebp - 0x25c], 0
jmp 0x10044eae
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 2
jge 0x10044eca
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0xe80], 0
jmp 0x10044ea1
mov dword [ebp - 0xbc], 0
jmp 0x10044ee3
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 6
je 0x10045015
mov dword [ebp - 0x948], 1
mov dword [ebp - 0x374], 0
jmp 0x10044f13
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 1
jge 0x10044f2f
mov eax, dword [ebp - 0x374]
mov dword [ebp + eax*4 - 0xbd0], 0xffffffff
jmp 0x10044f06
mov eax, 0xffff4f96
sub eax, dword [ebp - 0x948]
cmp eax, 0x7c52
jl 0x10044f4d
mov dword [ebp - 0x938], 1
jmp 0x10044f54
and dword [ebp - 0x938], 0
cmp dword [ebp - 0x938], 0
jge 0x10044f69
mov dword [ebp - 0x4b8], 1
jmp 0x10044f70
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x4b8], eax
jg 0x10044f8a
mov dword [ebp - 0x940], 1
jmp 0x10044f91
and dword [ebp - 0x940], 0
cmp dword [ebp - 0x940], 0x9aea
jge 0x10044fa9
mov dword [ebp - 0x4c0], 1
jmp 0x10044fb0
and dword [ebp - 0x4c0], 0
cmp dword [ebp - 0x4c0], 0x426ae69e
jg 0x10044fc8
mov dword [ebp - 0x4c8], 1
jmp 0x10044fcf
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x948]
cmp dword [ebp - 0x4c8], eax
jle 0x10044fe9
mov dword [ebp - 0x950], 1
jmp 0x10044ff0
and dword [ebp - 0x950], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe80]
add eax, dword [ebp - 0x950]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbd0], eax
jmp 0x10044ed6
mov dword [ebp - 0x80], 1
jmp 0x10045025
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x1004504c
mov byte [ebp - 0x14c], 0
movzx eax, byte [ebp - 0x14c]
test eax, eax
je 0x1004504a
push 0x17b8
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1004501e
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1003a3dd
mov dword [ebp - 0x310], eax
push 3
lea ecx, [ebp - 0xa68]
call fcn.10009e9c
mov dword [ebp - 4], 2
mov dword [ebp - 0x4d8], 0xffffffff
mov dword [ebp - 0xbd8], 0x9275
mov dword [ebp - 0x264], 0
jmp 0x1004509e
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 3
jge 0x100450c0
push dword [ebp - 0x264]
lea ecx, [ebp - 0xa68]
call fcn.10009f14
mov dword [eax], 0xb110c93b
jmp 0x10045091
push 1
lea ecx, [ebp - 0xa68]
call fcn.10009f14
and dword [eax], 0
jmp 0x100450f6
push 1
lea ecx, [ebp - 0xa68]
call fcn.10009f14
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4d0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xa68]
call fcn.10009f14
cmp dword [eax], 0xfffffff4
jne 0x100451e3
mov dword [ebp - 0x33c], 0xfffffff8
cmp dword [ebp - 0x33c], 0xfffffffd
ja 0x1004512b
mov dword [ebp - 0x960], 1
jmp 0x10045132
and dword [ebp - 0x960], 0
push 1
lea ecx, [ebp - 0xa68]
call fcn.10009f14
mov esi, dword [ebp - 0x33c]
push 1
lea ecx, [ebp - 0xa68]
call fcn.10009f14
mov edi, eax
push 0
lea ecx, [ebp - 0xa68]
call fcn.10009f14
mov eax, dword [eax]
add eax, dword [edi]
add eax, esi
jne 0x10045175
mov dword [ebp - 0x958], 1
jmp 0x1004517c
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x33c]
imul eax, dword [ebp - 0x958]
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 1
jl 0x100451a4
mov dword [ebp - 0x4e0], 1
jmp 0x100451ab
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x960]
cmp eax, dword [ebp - 0x4e0]
jle 0x100451c5
mov dword [ebp - 0x968], 1
jmp 0x100451cc
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x968]
sub eax, dword [ebp - 0x33c]
mov dword [ebp - 0xbd8], eax
jmp 0x100450d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa68]
call fcn.10009ef8
mov dword [ebp - 0xf84], 0xcf5720e8
mov dword [ebp - 0x1024], 1
mov dword [ebp - 0xf8c], 0
mov dword [ebp - 0x10ac], 0x32bb11ac
mov dword [ebp - 0xe6c], 0
push 3
lea ecx, [ebp - 0x1010]
call fcn.10009e9c
mov dword [ebp - 4], 3
mov dword [ebp - 0xe74], 0xd0374c7a
mov dword [ebp - 0x4e8], 0x715cc48b
mov dword [ebp - 0x26c], 0
jmp 0x10045265
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 3
jge 0x10045287
push dword [ebp - 0x26c]
lea ecx, [ebp - 0x1010]
call fcn.10009f14
mov dword [eax], 0x23afc371
jmp 0x10045258
mov byte [ebp - 0x160], 0
movzx eax, byte [ebp - 0x160]
test eax, eax
je 0x100452a1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov eax, dword [ebp - 0x4e8]
dec eax
mov dword [ebp - 0x4e8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1010]
call fcn.10009ef8
cmp dword [0x10616d04], 0
jne 0x100494e0
mov dword [ebp - 0x970], 0x49c6
mov dword [ebp - 0xbe0], 0x10008788
cmp dword [ebp - 0x970], 0x4b5e
jle 0x10045361
and dword [ebp - 0x394], 0
jmp 0x10045300
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x79c
jge 0x10045361
and dword [ebp - 0x274], 0
jmp 0x10045322
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0x508c
jge 0x1004535f
mov eax, dword [ebp - 0x394]
add eax, dword [ebp - 0x274]
cdq
mov dword [ebp - 0xb4c], eax
mov dword [ebp - 0xb48], edx
push dword [ebp - 0xb48]
push dword [ebp - 0xb4c]
mov ecx, 0x10615bb8
call fcn.10015a07
jmp 0x10045315
jmp 0x100452f3
mov dword [ebp - 4], 4
cmp dword [ebp - 0x970], 0x47b2
jge 0x10045384
mov edx, dword [ebp - 0xbe0]
mov ecx, 0x10615bb8
call fcn.10019d5c
jmp 0x100453a0
or dword [ebp - 4], 0xffffffff
jmp 0x100453aa
mov dword [ebp - 0xe0], 8
mov dword [ebp - 0x27c], 0xffffffff
mov dword [ebp - 0xbf0], 0x31c0a9c5
mov dword [ebp - 0x344], 0
jmp 0x100453e1
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 1
jge 0x100453fd
mov eax, dword [ebp - 0x344]
mov dword [ebp + eax*4 - 0xc10], 0xfffffff8
jmp 0x100453d4
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xec0], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xec8], eax
cmp dword [ebp - 0xe0], 0
jne 0x1004542a
mov dword [ebp - 0x4f0], 1
jmp 0x10045431
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0x4f0]
cmp eax, 1
jb 0x1004544f
mov dword [ebp - 0xbe8], 1
jmp 0x10045456
and dword [ebp - 0xbe8], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xed0], eax
cmp dword [ebp - 0xe0], 0
jb 0x10045477
mov dword [ebp - 0x978], 1
jmp 0x1004547e
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x978], eax
je 0x100456a9
cmp dword [ebp - 0x27c], 0
je 0x100456a9
mov dword [ebp - 0xa4], 0x8f9c3281
mov dword [ebp - 0xc08], 0xba5f
cmp dword [ebp - 0x27c], 0
je 0x10045605
mov dword [ebp - 0x510], 0
cmp dword [ebp - 0xe0], 0x279
jge 0x100454e0
mov dword [ebp - 0x4f8], 1
jmp 0x100454e7
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 0x26d5
jle 0x100454ff
mov dword [ebp - 0x980], 1
jmp 0x10045506
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0xbf0]
cmp dword [ebp - 0x980], eax
jle 0x10045526
cmp dword [ebp - 0xa4], 0
jne 0x10045526
and dword [ebp - 0xbf8], 0
jmp 0x10045530
mov dword [ebp - 0xbf8], 1
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0xed8], eax
imul eax, dword [ebp - 0xa4], 0x9961
cmp eax, dword [ebp - 0xa4]
jg 0x1004555a
mov dword [ebp - 0x500], 1
jmp 0x10045561
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x500], eax
je 0x10045584
cmp dword [ebp - 0xa4], 0
je 0x10045584
mov dword [ebp - 0x988], 1
jmp 0x1004558b
and dword [ebp - 0x988], 0
imul eax, dword [ebp - 0x988], 6
cmp eax, 0xaeaba4a2
je 0x100455a5
mov dword [ebp - 0x508], 1
jmp 0x100455ac
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0
jl 0x100455c1
mov dword [ebp - 0xc00], 1
jmp 0x100455c8
and dword [ebp - 0xc00], 0
cmp dword [ebp - 0xe0], 0xdb785b64
jne 0x100455e0
mov dword [ebp - 0x990], 1
jmp 0x100455e7
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x990]
mov dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0x510]
inc eax
mov dword [ebp - 0x510], eax
jmp 0x100456a7
push 4
lea ecx, [ebp - 0x1020]
call fcn.10009e9c
mov dword [ebp - 4], 6
mov dword [ebp - 0x37c], 0
jmp 0x10045632
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 4
jge 0x10045654
push dword [ebp - 0x37c]
lea ecx, [ebp - 0x1020]
call fcn.10009f14
mov dword [eax], 0x42b8
jmp 0x10045625
mov dword [ebp - 0xa4], 3
jmp 0x1004566d
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x10045698
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x10045696
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
jmp 0x10045660
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1020]
call fcn.10009ef8
jmp 0x100456c6
mov dword [ebp - 0xc18], 0xfffffffe
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc10]
mov dword [ebp - 0xc18], eax
mov dword [ebp - 0xc20], 0x99e0
lea eax, [ebp - 0xc20]
push eax
call fcn.1003f054
pop ecx
mov dword [ebp - 0x794], eax
push 3
lea ecx, [ebp - 0x3c0]
call fcn.10009e9c
mov dword [ebp - 4], 7
mov dword [ebp - 0x284], 0
push 2
lea ecx, [ebp - 0x1030]
call fcn.10009e9c
mov byte [ebp - 4], 8
mov dword [ebp - 0x28], 0
jmp 0x10045722
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10045738
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc50], 0xffffffff
jmp 0x1004571b
mov dword [ebp - 0x28], 0
jmp 0x10045748
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10045764
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3c0]
call fcn.10009f14
mov dword [eax], 9
jmp 0x10045741
mov dword [ebp - 0x28], 0
jmp 0x10045774
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10045790
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1030]
call fcn.10009f14
mov dword [eax], 0x2e633725
jmp 0x1004576d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc50]
mov dword [ebp - 0xee0], eax
push 2
lea ecx, [ebp - 0x3c0]
call fcn.10009f14
mov esi, eax
push 2
lea ecx, [ebp - 0x3c0]
call fcn.10009f14
mov edi, dword [eax]
add edi, dword [esi]
push 2
lea ecx, [ebp - 0x3c0]
call fcn.10009f14
cmp edi, dword [eax]
jl 0x100457e0
mov dword [ebp - 0x998], 1
jmp 0x100457e7
and dword [ebp - 0x998], 0
push 2
lea ecx, [ebp - 0x3c0]
call fcn.10009f14
mov ecx, dword [ebp - 0x998]
cmp ecx, dword [eax]
je 0x10045819
push 2
lea ecx, [ebp - 0x3c0]
call fcn.10009f14
cmp dword [eax], 0
jne 0x10045819
and dword [ebp - 0x518], 0
jmp 0x10045823
mov dword [ebp - 0x518], 1
push 2
lea ecx, [ebp - 0x3c0]
call fcn.10009f14
mov ecx, dword [ebp - 0x518]
cmp ecx, dword [eax]
jne 0x10045846
mov dword [ebp - 0xc28], 1
jmp 0x1004584d
and dword [ebp - 0xc28], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc50]
mov dword [ebp - 0xc30], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc30]
mov dword [ebp + eax - 0xc50], ecx
push 0
lea ecx, [ebp - 0x3c0]
call fcn.10009f14
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xc50]
push 1
lea ecx, [ebp - 0x3c0]
call fcn.10009f14
mov dword [eax], esi
mov dword [ebp - 0x284], 0
jmp 0x100458b5
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 2
jg 0x10045a33
mov dword [ebp - 0x34c], 0
jmp 0x100458db
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 2
jge 0x100458f7
mov eax, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0xa14], 0x1780eec2
jmp 0x100458ce
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xa14], 2
jmp 0x10045925
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa14]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa14], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa14], 0
jl 0x10045a2e
push 4
lea ecx, [ebp - 0xe28]
call fcn.10009e9c
mov byte [ebp - 4], 9
mov dword [ebp - 0x3a4], 1
mov dword [ebp - 0x28c], 0
jmp 0x1004596d
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 4
jge 0x1004598f
push dword [ebp - 0x28c]
lea ecx, [ebp - 0xe28]
call fcn.10009f14
mov dword [eax], 0x3222c7e1
jmp 0x10045960
push 1
lea ecx, [ebp - 0xe28]
call fcn.10009f14
cmp dword [eax], 1
jg 0x100459ad
mov dword [ebp - 0x9a0], 1
jmp 0x100459b4
and dword [ebp - 0x9a0], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xa14]
lea ecx, [ebp - 0x3c0]
call fcn.10009f14
mov ecx, dword [ebp - 0x9a0]
mov dword [eax], ecx
mov dword [ebp - 0x3a4], 0x1d
jmp 0x100459ed
mov eax, dword [ebp - 0x3a4]
dec eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0xfffffff3
jne 0x10045a1a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc50], 0
je 0x10045a08
jmp 0x10045a1a
push 0
lea ecx, [ebp - 0x3c0]
call fcn.10009f14
and dword [eax], 0
jmp 0x100459e0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe28]
call fcn.10009ef8
jmp 0x1004590a
jmp 0x100458a8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1030]
call fcn.10009ef8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c0]
call fcn.10009ef8
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x35c], 0x9f93b76f
mov dword [ebp - 0x56c], 0xeb5cfe7
mov dword [ebp - 0x204], 6
mov dword [ebp - 0x294], 0
jmp 0x10045aa3
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 2
jge 0x10045abf
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0x148], 0xd0657689
jmp 0x10045a96
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
dec ecx
mov dword [ebp - 0x48], ecx
xor eax, eax
je 0x10045cc4
mov dword [ebp - 0x29c], 0x519d8147
mov dword [ebp - 0xafc], 0xfff7
mov dword [ebp - 0x354], 0
jmp 0x10045afe
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 1
jge 0x10045b1a
mov eax, dword [ebp - 0x354]
mov dword [ebp + eax*4 - 0x3f8], 0x2e889ec
jmp 0x10045af1
mov byte [ebp - 0x162], 0
movzx eax, byte [ebp - 0x162]
test eax, eax
je 0x10045b36
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, 0x9253a34c
test eax, eax
je 0x10045b90
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
je 0x10045b90
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x148]
mov dword [ebp - 0xee8], eax
cmp dword [ebp - 0x48], 0x5206
je 0x10045b76
mov dword [ebp - 0x3f0], 1
jmp 0x10045b7d
and dword [ebp - 0x3f0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp + eax - 0x148], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp + eax - 0x148]
jl 0x10045bae
mov dword [ebp - 0x520], 1
jmp 0x10045bb5
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x29c]
cmp dword [ebp - 0x520], eax
jg 0x10045bcf
mov dword [ebp - 0xc38], 1
jmp 0x10045bd6
and dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xef0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3f8], 0x9cf7
je 0x10045bfe
mov dword [ebp - 0xc40], 1
jmp 0x10045c05
and dword [ebp - 0xc40], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xef8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
mov dword [ebp - 0xf00], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x148]
cmp ecx, dword [ebp + eax - 0x3f8]
jg 0x10045c49
mov dword [ebp - 0x9a8], 1
jmp 0x10045c50
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x9a8], eax
jl 0x10045c67
mov dword [ebp - 0x528], 1
jmp 0x10045c6e
and dword [ebp - 0x528], 0
cmp dword [ebp - 0x528], 0xfffffff6
jl 0x10045c83
mov dword [ebp - 0xcc4], 1
jmp 0x10045c8a
and dword [ebp - 0xcc4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0xf08], eax
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0xf10], eax
mov dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x530], eax
jmp 0x10046499
push 1
lea ecx, [ebp - 0xf4]
call fcn.10009e9c
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x558], 0
mov dword [ebp - 0x384], 0
jmp 0x10045cfb
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 1
jge 0x10045d1d
push dword [ebp - 0x384]
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov dword [eax], 8
jmp 0x10045cee
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov dword [ebp - 0x9b0], eax
mov eax, dword [ebp - 0x9b0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x9b0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
cmp dword [eax], 0
jne 0x10045fa6
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x148]
xor edi, edi
sub edi, dword [ebp - 0x530]
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
sub edi, dword [eax]
cmp edi, esi
jg 0x10045da1
cmp dword [ebp - 0x35c], 0
je 0x10045da1
mov dword [ebp - 0x9b8], 1
jmp 0x10045da8
and dword [ebp - 0x9b8], 0
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov ecx, dword [ebp - 0x9b8]
cmp ecx, dword [eax]
jle 0x10045dcb
mov dword [ebp - 0x538], 1
jmp 0x10045dd2
and dword [ebp - 0x538], 0
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov esi, dword [ebp - 0x538]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
cmp esi, dword [eax]
jg 0x10045e04
mov dword [ebp - 0x9c0], 1
jmp 0x10045e0b
and dword [ebp - 0x9c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
cmp dword [ebp - 0x9c0], eax
jge 0x10045e2c
mov dword [ebp - 0x540], 1
jmp 0x10045e33
and dword [ebp - 0x540], 0
cmp dword [ebp - 0x540], 0xf13e0ca2
jae 0x10045e4b
mov dword [ebp - 0x9c8], 1
jmp 0x10045e52
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x558]
cmp dword [ebp - 0x9c8], eax
jge 0x10045e6c
mov dword [ebp - 0xb10], 1
jmp 0x10045e73
and dword [ebp - 0xb10], 0
mov esi, dword [ebp - 0x56c]
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov edi, eax
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov eax, dword [eax]
add eax, dword [edi]
cmp eax, esi
jge 0x10045ea9
mov dword [ebp - 0x548], 1
jmp 0x10045eb0
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x548], 0x24bf
je 0x10045ec8
mov dword [ebp - 0x9d0], 1
jmp 0x10045ecf
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x9d0], eax
je 0x10045ee9
mov dword [ebp - 0x550], 1
jmp 0x10045ef0
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0xffffffff
je 0x10045f05
mov dword [ebp - 0x400], 1
jmp 0x10045f0c
and dword [ebp - 0x400], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x400]
mov dword [ebp + eax - 0x148], ecx
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x400], eax
je 0x10045f36
mov dword [ebp - 0x9d8], 1
jmp 0x10045f3d
and dword [ebp - 0x9d8], 0
mov esi, dword [ebp - 0x204]
mov edi, dword [ebp - 0x35c]
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov ecx, dword [ebp - 0x9d8]
add ecx, dword [eax]
sub ecx, edi
sub ecx, 0xffff
sub ecx, esi
jne 0x10045f85
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
cmp dword [eax], 0
jne 0x10045f85
and dword [ebp - 0x9e0], 0
jmp 0x10045f8f
mov dword [ebp - 0x9e0], 1
mov eax, dword [ebp - 0x558]
cmp dword [ebp - 0x9e0], eax
jl 0x10045fa6
and dword [ebp - 0x9e8], 0
jmp 0x10045fb0
mov dword [ebp - 0x9e8], 1
mov eax, dword [ebp - 0x9e8]
inc eax
je 0x1004623c
mov dword [ebp - 0x814], 0x2fe8
push 4
lea ecx, [ebp - 0xc60]
call fcn.10009e9c
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x954], 0x679c
mov dword [ebp - 0x2a4], 0
jmp 0x10045ffb
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 4
jge 0x1004601d
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0xc60]
call fcn.10009f14
mov dword [eax], 0x1d5b
jmp 0x10045fee
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
cmp dword [eax], 0
jne 0x100460b4
push 0
lea ecx, [ebp - 0xc60]
call fcn.10009f14
mov eax, dword [ebp - 0x204]
imul eax, dword [ebp - 0x954]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jne 0x1004606e
cmp dword [ebp - 0x814], 0
jne 0x1004606e
and dword [ebp - 0x564], 0
jmp 0x10046078
mov dword [ebp - 0x564], 1
cmp dword [ebp - 0x564], 0x3fec
jl 0x10046090
mov dword [ebp - 0x94c], 1
jmp 0x10046097
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x94c]
sub eax, dword [ebp - 0x56c]
cmp eax, dword [ebp - 0x204]
jge 0x100460b4
and dword [ebp - 0x804], 0
jmp 0x100460be
mov dword [ebp - 0x804], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
cmp dword [ebp - 0x804], eax
jge 0x100460df
mov dword [ebp - 0x574], 1
jmp 0x100460e6
and dword [ebp - 0x574], 0
mov esi, dword [ebp - 0x204]
push 0
lea ecx, [ebp - 0xc60]
call fcn.10009f14
mov ecx, dword [ebp - 0x574]
imul ecx, dword [eax]
add ecx, 0x4fd7
sub ecx, esi
je 0x1004612a
push 0
lea ecx, [ebp - 0xc60]
call fcn.10009f14
cmp dword [eax], 0
je 0x1004612a
mov dword [ebp - 0x9f4], 1
jmp 0x10046131
and dword [ebp - 0x9f4], 0
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov ecx, dword [ebp - 0x9f4]
cmp ecx, dword [eax]
jle 0x1004615a
cmp dword [ebp - 0x35c], 0
jne 0x1004615a
and dword [ebp - 0x57c], 0
jmp 0x10046164
mov dword [ebp - 0x57c], 1
cmp dword [ebp - 0x57c], 0xfffffff9
jb 0x10046179
mov dword [ebp - 0x80c], 1
jmp 0x10046180
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x80c], eax
jge 0x1004619a
mov dword [ebp - 0x584], 1
jmp 0x100461a1
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x584], eax
je 0x100461b8
mov dword [ebp - 0x58c], 1
jmp 0x100461bf
and dword [ebp - 0x58c], 0
mov esi, dword [ebp - 0x954]
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov ecx, dword [ebp - 0x58c]
sub ecx, dword [eax]
cmp ecx, esi
jle 0x100461ea
mov dword [ebp - 0x594], 1
jmp 0x100461f1
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x814]
add eax, dword [ebp - 0x594]
cmp eax, 0xffffffff
jbe 0x1004620e
mov dword [ebp - 0xa4c], 1
jmp 0x10046215
and dword [ebp - 0xa4c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa4c]
mov dword [ebp + eax - 0x148], ecx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xc60]
call fcn.10009ef8
jmp 0x1004648a
mov dword [ebp - 0x1c8], 0xfffffffc
mov dword [ebp - 0x9fc], 0xa0d8654c
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c8]
cmp ecx, dword [ebp + eax - 0x148]
jg 0x10046271
mov dword [ebp - 0x5bc], 1
jmp 0x10046278
and dword [ebp - 0x5bc], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x148], 0
je 0x100463b3
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov esi, dword [ebp - 0x48]
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
cmp dword [eax], esi
jle 0x100462b9
mov dword [ebp - 0x59c], 1
jmp 0x100462c0
and dword [ebp - 0x59c], 0
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov ecx, dword [ebp - 0x59c]
cmp ecx, dword [eax]
jne 0x100462e3
mov dword [ebp - 0x81c], 1
jmp 0x100462ea
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0x135c
jle 0x10046302
mov dword [ebp - 0x5a4], 1
jmp 0x10046309
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x5a4], eax
jge 0x10046323
mov dword [ebp - 0x95c], 1
jmp 0x1004632a
and dword [ebp - 0x95c], 0
cmp dword [ebp - 0x95c], 0x4e140bd2
jle 0x10046342
mov dword [ebp - 0xccc], 1
jmp 0x10046349
and dword [ebp - 0xccc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
mov dword [ebp - 0xf18], eax
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0xf20], eax
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xf28], eax
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov eax, 0x892f
cmp eax, 0x81bc
jl 0x100463b3
mov dword [ebp - 0x5ac], 1
jmp 0x100463ba
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x1c8]
imul eax, dword [ebp - 0x5ac]
cmp eax, 0x4f58
je 0x100463da
mov dword [ebp - 0x824], 1
jmp 0x100463e1
and dword [ebp - 0x824], 0
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
mov ecx, dword [ebp - 0x824]
cmp ecx, dword [eax]
jl 0x100463ff
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1004641a
mov eax, 0xefdd
test eax, eax
je 0x1004641a
cmp dword [ebp - 0x1c8], 0
jne 0x1004641a
and dword [ebp - 0x5b4], 0
jmp 0x10046424
mov dword [ebp - 0x5b4], 1
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x9fc], eax
mov eax, dword [ebp - 0x9fc]
cmp eax, dword [ebp - 0x35c]
je 0x1004644b
push 0
lea ecx, [ebp - 0xf4]
call fcn.10009f14
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x5bc], 0x75ef
imul ecx, dword [ebp + eax - 0x148]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x148], ecx
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1004648a
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf4]
call fcn.10009ef8
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x1cc], 0x7276463a
mov dword [ebp - 0x2ac], 0
jmp 0x100464c3
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 1
jge 0x100464dc
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x40], 0xfffffff9
jmp 0x100464b6
mov dword [ebp - 0x14], 0
jmp 0x100464ec
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x100466a1
mov dword [ebp - 0x39c], 0xfffffff6
mov dword [ebp - 0x1fc], 0x3126ff23
mov dword [ebp - 0x39c], 0
jmp 0x10046523
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0
jg 0x1004669c
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x40]
mov dword [ebp - 0x1fc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
add eax, dword [ebp - 0x1fc]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp + ecx*4 - 0x40], eax
je 0x10046562
mov dword [ebp - 0x82c], 1
jmp 0x10046569
and dword [ebp - 0x82c], 0
cmp dword [ebp - 0x82c], 1
jb 0x1004657e
mov dword [ebp - 0xb04], 1
jmp 0x10046585
and dword [ebp - 0xb04], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x40]
mov dword [ebp - 0xf30], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0xf38], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp + ecx*4 - 0x40]
add ecx, dword [ebp + eax*4 - 0x40]
imul eax, ecx, 0xffffffff
cmp eax, dword [ebp - 0x1fc]
jg 0x100465c7
mov dword [ebp - 0x5c4], 1
jmp 0x100465ce
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x40]
imul eax, dword [ebp - 0x5c4]
cmp eax, 0xd44f
jge 0x100465ef
mov dword [ebp - 0x964], 1
jmp 0x100465f6
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x964], eax
je 0x10046610
mov dword [ebp - 0x5cc], 1
jmp 0x10046617
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x5cc]
jge 0x1004662e
mov dword [ebp - 0xc1c], 1
jmp 0x10046635
and dword [ebp - 0xc1c], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0xf40], eax
cmp dword [ebp - 0x14], 0
je 0x1004665d
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x40], 0
je 0x1004665d
mov dword [ebp - 0x834], 1
jmp 0x10046664
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x834], eax
je 0x1004667b
mov dword [ebp - 0x5d4], 1
jmp 0x10046682
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x40]
imul eax, dword [ebp - 0x5d4]
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x40], eax
jmp 0x10046516
jmp 0x100464e5
mov dword [ebp - 0x14], 3
jmp 0x100466b1
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff4
je 0x100468ed
push 4
lea ecx, [ebp - 0xa78]
call fcn.10009e9c
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xa7c], 0x890f6dae
mov dword [ebp - 0x5e4], 0x40c8
mov dword [ebp - 0x194], 0xcbd5f5ab
mov dword [ebp - 0xb14], 0xfffffffb
mov dword [ebp - 0x2b4], 0
jmp 0x10046710
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 4
jge 0x1004672f
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0xa78]
call fcn.10009f14
or dword [eax], 0xffffffff
jmp 0x10046703
mov eax, 0xb1bb30b1
test eax, eax
je 0x1004675b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x40], 0xfffb
mov eax, 0xfffb
test eax, eax
je 0x1004675b
mov dword [ebp - 0x5dc], 1
jmp 0x10046762
and dword [ebp - 0x5dc], 0
push 1
lea ecx, [ebp - 0xa78]
call fcn.10009f14
push 1
lea ecx, [ebp - 0xa78]
call fcn.10009f14
mov eax, dword [eax]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0xa7c]
cmp eax, dword [ebp - 0x5e4]
jge 0x1004679e
mov dword [ebp - 0xb0c], 1
jmp 0x100467a5
and dword [ebp - 0xb0c], 0
push 1
lea ecx, [ebp - 0xa78]
call fcn.10009f14
push 1
lea ecx, [ebp - 0xa78]
call fcn.10009f14
mov esi, eax
push 0
lea ecx, [ebp - 0xa78]
call fcn.10009f14
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x100467e0
mov dword [ebp - 0xcb4], 1
jmp 0x100467e7
and dword [ebp - 0xcb4], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf48], eax
imul eax, dword [ebp - 0x1cc], 0x399d
cmp dword [ebp - 0x5dc], eax
jg 0x1004680e
mov dword [ebp - 0x83c], 1
jmp 0x10046815
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x83c]
neg eax
imul eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x194], eax
mov esi, dword [ebp - 0x194]
push 1
lea ecx, [ebp - 0xa78]
call fcn.10009f14
cmp esi, dword [eax]
jne 0x1004684d
mov dword [ebp - 0x96c], 1
jmp 0x10046854
and dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0xb14], eax
mov dword [ebp - 0x1cc], 0
jmp 0x10046879
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jg 0x100468d9
mov dword [ebp - 0x194], 0
jmp 0x1004689b
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jg 0x100468d7
mov byte [ebp - 0x13e], 0
movzx eax, byte [ebp - 0x13e]
test eax, eax
je 0x100468d5
push 0x38f
push 0x13dc
push 0x21c6
push 0x2534
push 0x19fc
call dword [sym.imp.GDI32.dll_Rectangle]
jmp 0x1004688e
jmp 0x1004686c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa78]
call fcn.10009ef8
jmp 0x100466aa
mov byte [ebp - 0x220], 0xb
mov byte [ebp - 0x21f], 0x7f
mov byte [ebp - 0x21e], 8
mov byte [ebp - 0x21d], 0x17
mov byte [ebp - 0x21c], 7
mov byte [ebp - 0x21b], 6
mov byte [ebp - 0x21a], 4
mov byte [ebp - 0x219], 0xc
mov byte [ebp - 0x218], 6
mov byte [ebp - 0x217], 0x16
mov byte [ebp - 0x216], 0xc
mov byte [ebp - 0x215], 0x24
mov byte [ebp - 0x214], 9
mov byte [ebp - 0x213], 0x39
mov byte [ebp - 0x212], 0
mov byte [ebp - 0x211], 0x29
mov byte [ebp - 0x210], 1
mov byte [ebp - 0x20f], 0x22
mov byte [ebp - 0x20e], 2
mov byte [ebp - 0x20d], 0x11
mov byte [ebp - 0x20c], 3
mov byte [ebp - 0x20b], 0x22
mov byte [ebp - 0x20a], 0xa
mov byte [ebp - 0x209], 0x13
mov byte [ebp - 0x208], 1
mov byte [ebp - 0x207], 0x18
mov byte [ebp - 0x206], 5
mov byte [ebp - 0x205], 0x37
push 2
lea ecx, [ebp - 0xc70]
call fcn.10009e9c
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x88], 0
jmp 0x100469de
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x10046a00
push dword [ebp - 0x88]
lea ecx, [ebp - 0xc70]
call fcn.10009f14
mov dword [eax], 0xfffffff7
jmp 0x100469d1
mov dword [ebp - 0x88], 0
jmp 0x10046a19
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x10046a35
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xc24], 0xbacd7953
jmp 0x10046a0c
push 1
lea ecx, [ebp - 0xc70]
call fcn.10009f14
mov dword [eax], 0x15
jmp 0x10046a6e
push 1
lea ecx, [ebp - 0xc70]
call fcn.10009f14
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x5ec]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5ec]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xc70]
call fcn.10009f14
cmp dword [eax], 0x1c
jne 0x10046b11
mov dword [ebp - 0x364], 0x85bf25cb
mov dword [ebp - 0x364], 0
jmp 0x10046aa7
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0
jg 0x10046af7
mov dword [ebp - 0x2bc], 0xfffffff6
mov dword [ebp - 0x2bc], 0
jmp 0x10046ad3
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
jg 0x10046af5
mov dword [ebp - 0x844], 0x7e67
mov eax, dword [ebp - 0x844]
dec eax
mov dword [ebp - 0x844], eax
jmp 0x10046ac6
jmp 0x10046a9a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc24], 0
je 0x10046b0c
jmp 0x10046a4a
jmp 0x10046a4a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc70]
call fcn.10009ef8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x220]
and eax, 7
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x220]
or ecx, 7
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x220]
mov byte [ebp + eax - 0xcf8], cl
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x5f4], 0x74fd5228
mov dword [ebp - 0x38c], 0x636717b3
mov dword [ebp - 0x20], 0
jmp 0x10046b84
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x19
jge 0x10046f71
mov dword [ebp - 0x15c], 0xda8d
mov dword [ebp - 0x408], 0xe33ecdc0
mov dword [ebp - 0xd2c], 0xa36a77d7
mov dword [ebp - 0xd28], 0xa36a77d7
mov dword [ebp - 0xd24], 0xa36a77d7
mov dword [ebp - 0xd20], 0xa36a77d7
push 1
lea ecx, [ebp - 0xe64]
call fcn.10009e9c
mov dword [ebp - 4], 0xe
push 2
lea ecx, [ebp - 0xdf8]
call fcn.10009e9c
mov byte [ebp - 4], 0xf
mov dword [ebp - 0xa8], 0
jmp 0x10046c08
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x10046c2a
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xe64]
call fcn.10009f14
mov dword [eax], 0xc9e520c3
jmp 0x10046bfb
mov dword [ebp - 0xa8], 0
jmp 0x10046c43
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x10046c65
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xdf8]
call fcn.10009f14
mov dword [eax], 0x6a447d05
jmp 0x10046c36
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x10046c7f
push 0
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xf50], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0xf58], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xf60], eax
mov eax, 0x846b51f0
test eax, eax
je 0x10046cc7
cmp dword [ebp - 0x15c], 0
je 0x10046cc7
mov dword [ebp - 0xa04], 1
jmp 0x10046cce
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0xa04]
sub eax, dword [ebp - 0x15c]
je 0x10046cee
cmp dword [ebp - 0x20], 0
je 0x10046cee
mov dword [ebp - 0x5fc], 1
jmp 0x10046cf5
and dword [ebp - 0x5fc], 0
cmp dword [ebp - 0x5fc], 0x7216
jge 0x10046d0d
mov dword [ebp - 0x84c], 1
jmp 0x10046d14
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x84c], eax
jg 0x10046d2e
mov dword [ebp - 0x604], 1
jmp 0x10046d35
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x604], eax
jle 0x10046d4f
mov dword [ebp - 0x974], 1
jmp 0x10046d56
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x408], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x15c]
add ecx, 0xa6f6
cmp ecx, dword [ebp + eax - 0xd2c]
jne 0x10046da5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd2c], 0
je 0x10046da5
mov dword [ebp - 0x60c], 1
jmp 0x10046dac
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x60c], eax
je 0x10046dc6
mov dword [ebp - 0x854], 1
jmp 0x10046dcd
and dword [ebp - 0x854], 0
cmp dword [ebp - 0x854], 0x73c1
jge 0x10046de5
mov dword [ebp - 0x614], 1
jmp 0x10046dec
and dword [ebp - 0x614], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd2c]
cmp dword [ebp - 0x614], eax
jne 0x10046e16
cmp dword [ebp - 0x408], 0
je 0x10046e16
mov dword [ebp - 0xa1c], 1
jmp 0x10046e1d
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xa1c], eax
jle 0x10046e34
mov dword [ebp - 0xb1c], 1
jmp 0x10046e3b
and dword [ebp - 0xb1c], 0
cmp dword [ebp - 0x408], 0
je 0x10046e59
cmp dword [ebp - 0x38c], 0
je 0x10046e59
mov dword [ebp - 0x61c], 1
jmp 0x10046e60
and dword [ebp - 0x61c], 0
push 0
lea ecx, [ebp - 0xe64]
call fcn.10009f14
mov ecx, dword [ebp - 0x61c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xf68], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xf70], eax
cmp dword [ebp - 0x38c], 0xffffffff
jge 0x10046e9c
mov dword [ebp - 0x85c], 1
jmp 0x10046ea3
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x85c]
jl 0x10046eba
mov dword [ebp - 0x624], 1
jmp 0x10046ec1
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x624], eax
jne 0x10046ed8
mov dword [ebp - 0x97c], 1
jmp 0x10046edf
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x97c]
jl 0x10046ef6
mov dword [ebp - 0x62c], 1
jmp 0x10046efd
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x62c], eax
je 0x10046f14
mov dword [ebp - 0x864], 1
jmp 0x10046f1b
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x864], eax
jg 0x10046f32
mov dword [ebp - 0x634], 1
jmp 0x10046f39
and dword [ebp - 0x634], 0
push 0
lea ecx, [ebp - 0xdf8]
call fcn.10009f14
mov ecx, dword [ebp - 0x634]
mov dword [eax], ecx
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xdf8]
call fcn.10009ef8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe64]
call fcn.10009ef8
jmp 0x10046b7d
mov dword [ebp - 0x30], 2
and dword [ebp - 0x36c], 0
jmp 0x10046f89
mov eax, dword [ebp - 0x30]
inc eax
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x1c
jae 0x10047345
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x220]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x30], eax
jne 0x10047069
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x220]
inc eax
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x220]
mov ecx, dword [ebp - 0x30]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1e8], 0x52cb1363
mov dword [ebp - 0x2c4], 0
jmp 0x10046ff8
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 2
jge 0x10047014
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0xe8c], 0x342e
jmp 0x10046feb
mov dword [ebp - 0x1e8], 1
jmp 0x1004702d
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jl 0x10047064
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x10047050
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp + eax*4 - 0xe8c], 0
je 0x10047062
jmp 0x10047064
jmp 0x10047020
jmp 0x10046f81
push 4
lea ecx, [ebp - 0xc80]
call fcn.10009e9c
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x38], 0xdada439b
mov dword [ebp - 0x90], 0
jmp 0x1004709d
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x100470bc
push dword [ebp - 0x90]
lea ecx, [ebp - 0xc80]
call fcn.10009f14
and dword [eax], 0
jmp 0x10047090
mov dword [ebp - 0x90], 0
jmp 0x100470d5
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x100470f1
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x64c], 0xcff15cc7
jmp 0x100470c8
mov dword [ebp - 0x38], 3
jmp 0x10047101
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1004721c
mov dword [ebp - 0x410], 1
mov dword [ebp - 0x86c], 0x8aae07ea
mov eax, 0x17c1
test eax, eax
je 0x1004713f
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x410]
jle 0x1004713f
mov dword [ebp - 0xa0c], 1
jmp 0x10047146
and dword [ebp - 0xa0c], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0xc80]
call fcn.10009f14
mov ecx, dword [ebp - 0xa0c]
cmp ecx, dword [eax]
jg 0x1004716a
mov dword [ebp - 0x63c], 1
jmp 0x10047171
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 0xdfddae97
jbe 0x10047184
cmp dword [ebp - 0x410], 0
mov eax, 0x52fa
add eax, 0x1289
add eax, dword [ebp - 0x410]
mov dword [ebp - 0x86c], eax
mov esi, dword [ebp - 0x86c]
push dword [ebp - 0x38]
lea ecx, [ebp - 0xc80]
call fcn.10009f14
mov eax, dword [eax]
lea eax, [eax + esi - 1]
cmp eax, 0xfffffffd
ja 0x100471c5
mov dword [ebp - 0x644], 1
jmp 0x100471cc
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x644], eax
je 0x100471e3
mov dword [ebp - 0x984], 1
jmp 0x100471ea
and dword [ebp - 0x984], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x984]
mov dword [ebp + eax - 0x64c], ecx
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x10047217
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x100470fa
mov dword [ebp - 0x38], 0x11
jmp 0x1004722c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x1a
jge 0x100472ca
mov dword [ebp - 0x19c], 1
mov dword [ebp - 0x19c], 0
jmp 0x10047259
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jl 0x100472bb
mov dword [ebp - 0x1d0], 0xffffffff
mov dword [ebp - 0x1d0], 0
jmp 0x10047285
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x100472a1
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x64c], 0
jmp 0x10047278
push dword [ebp - 0x19c]
lea ecx, [ebp - 0xc80]
call fcn.10009f14
cmp dword [eax], 0
je 0x100472b9
jmp 0x1004724c
jmp 0x1004724c
mov dword [ebp - 0x19c], 0xed0bd2f2
jmp 0x10047225
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc80]
call fcn.10009ef8
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x36c]
movzx eax, byte [ebp + eax - 0x222]
movsx eax, byte [ebp + eax - 0xcf8]
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x21f]
and ecx, eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x36c]
movzx eax, byte [ebp + eax - 0x222]
movsx eax, byte [ebp + eax - 0xcf8]
mov edx, dword [ebp - 0x30]
movzx edx, byte [ebp + edx - 0x21f]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x220]
mov byte [ebp + eax - 0xcf8], dl
and dword [ebp - 0x36c], 0
jmp 0x10046f81
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xcf8], 0
mov dword [ebp - 0xf78], 0x1f9c28ad
mov dword [ebp - 0xf80], 0xffffffff
mov dword [ebp - 0xf88], 0x446df37d
mov dword [ebp - 0xf90], 0x887cf2e5
mov dword [ebp - 0xcd4], 0xed9ba07e
mov dword [ebp - 0xb0], 0
jmp 0x1004739e
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x100473ba
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0xe98], 0x5faafe30
jmp 0x10047391
mov dword [ebp - 0xb0], 0
jmp 0x100473d3
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 4
jge 0x100473ef
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x10d8], 0x37a5b7d8
jmp 0x100473c6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x10d8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x10d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe98]
mov dword [ebp - 0xcd4], eax
lea eax, [ebp - 0xcf8]
push eax
lea ecx, [ebp - 0x11f4]
call fcn.10020f70
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0xc2c], eax
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x794]
mov ecx, dword [ebp - 0xc2c]
call fcn.1003a3dd
mov dword [0x10616d04], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11f4]
call fcn.10015c8e
mov dword [ebp - 0xd8], 0xfffffff9
push 3
lea ecx, [ebp - 0x428]
call fcn.10009e9c
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x178], 0
push 2
lea ecx, [ebp - 0xa88]
call fcn.10009e9c
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x104], 8
mov dword [ebp - 0x98], 0
jmp 0x100474c9
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x100474eb
push dword [ebp - 0x98]
lea ecx, [ebp - 0x428]
call fcn.10009f14
mov dword [eax], 0x20fe
jmp 0x100474bc
mov dword [ebp - 0x98], 0
jmp 0x10047504
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x10047526
push dword [ebp - 0x98]
lea ecx, [ebp - 0xa88]
call fcn.10009f14
mov dword [eax], 0x36c1d66b
jmp 0x100474f7
mov dword [ebp - 0xd8], 0
jmp 0x1004753f
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xd
je 0x10047bb7
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0xfc], 0xfffffffb
mov dword [ebp - 0x2cc], 0x3a55
mov dword [ebp - 0x328], 0xffffffff
mov dword [ebp - 0x2c], 2
jmp 0x10047581
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x100475ba
mov byte [ebp - 0x14b], 0
movzx eax, byte [ebp - 0x14b]
test eax, eax
je 0x100475a3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x428]
call fcn.10009f14
cmp dword [eax], 0
je 0x100475b8
jmp 0x1004757a
jmp 0x1004757a
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1004762a
imul esi, dword [ebp - 0x178], 0x2a96
push 0
lea ecx, [ebp - 0x428]
call fcn.10009f14
cmp dword [eax], esi
jge 0x100475e3
cmp dword [ebp - 0x178], 0
mov eax, dword [ebp - 0xd8]
neg eax
cmp eax, dword [ebp - 0x2c]
je 0x100475fc
mov dword [ebp - 0xb2c], 1
jmp 0x10047603
and dword [ebp - 0xb2c], 0
push 0
lea ecx, [ebp - 0x428]
call fcn.10009f14
mov eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x1004762a
mov dword [ebp - 0x874], 1
jmp 0x10047631
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xfc]
jg 0x10047651
mov dword [ebp - 0x654], 1
jmp 0x10047658
and dword [ebp - 0x654], 0
push 2
lea ecx, [ebp - 0x428]
call fcn.10009f14
mov eax, dword [eax]
cmp eax, dword [ebp - 0x654]
jl 0x1004798b
mov dword [ebp - 0xb3c], 0xe60d1f28
mov dword [ebp - 0x1f8], 9
mov dword [ebp - 0x674], 0x3807
cmp dword [ebp - 0xfc], 0
jne 0x10047950
cmp dword [ebp - 0x2c], 0
je 0x10047898
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
je 0x100477c9
push 2
lea ecx, [ebp - 0x428]
call fcn.10009f14
cmp dword [eax], 0x1b57
jge 0x100476dc
mov dword [ebp - 0xa20], 1
jmp 0x100476e3
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0xa20]
jge 0x100476fd
mov dword [ebp - 0x65c], 1
jmp 0x10047704
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x65c], eax
jne 0x1004771e
mov dword [ebp - 0x87c], 1
jmp 0x10047725
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
sub eax, 0xffff
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
mov esi, dword [ebp - 0x2cc]
mov edi, dword [ebp - 0xfc]
push 1
lea ecx, [ebp - 0xa88]
call fcn.10009f14
mov eax, dword [eax]
lea eax, [edi + eax - 3]
cmp eax, esi
jne 0x10047766
mov dword [ebp - 0x664], 1
jmp 0x1004776d
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x664], eax
jle 0x10047787
mov dword [ebp - 0x98c], 1
jmp 0x1004778e
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x98c], eax
jge 0x100477a8
mov dword [ebp - 0x66c], 1
jmp 0x100477af
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x66c], eax
jge 0x100477c9
mov dword [ebp - 0x884], 1
jmp 0x100477d0
and dword [ebp - 0x884], 0
mov esi, dword [ebp - 0x674]
push 1
lea ecx, [ebp - 0xa88]
call fcn.10009f14
mov ecx, dword [ebp - 0x884]
imul ecx, dword [eax]
cmp ecx, esi
jne 0x100477fc
mov dword [ebp - 0xb84], 1
jmp 0x10047803
and dword [ebp - 0xb84], 0
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0xf98], eax
mov esi, dword [ebp - 0xfc]
push 0
lea ecx, [ebp - 0xa88]
call fcn.10009f14
cmp dword [eax], esi
jne 0x10047832
mov dword [ebp - 0xa18], 1
jmp 0x10047839
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xa18], eax
jl 0x10047853
mov dword [ebp - 0x67c], 1
jmp 0x1004785a
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x67c], eax
jne 0x10047874
mov dword [ebp - 0xb34], 1
jmp 0x1004787b
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0xfa0], eax
mov eax, dword [ebp - 0x328]
imul eax, dword [ebp - 0x328]
test eax, eax
jne 0x100478a5
xor eax, eax
jne 0x100478a5
and dword [ebp - 0xb88], 0
jmp 0x100478af
mov dword [ebp - 0xb88], 1
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xfa8], eax
mov esi, dword [ebp - 0x2cc]
mov edi, dword [ebp - 0x328]
push 1
lea ecx, [ebp - 0x428]
call fcn.10009f14
imul edi, dword [eax]
cmp edi, esi
jg 0x100478e7
mov dword [ebp - 0x88c], 1
jmp 0x100478ee
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x88c], eax
jge 0x10047908
mov dword [ebp - 0x684], 1
jmp 0x1004790f
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x684], eax
jne 0x10047929
mov dword [ebp - 0x994], 1
jmp 0x10047930
and dword [ebp - 0x994], 0
push 2
lea ecx, [ebp - 0x428]
call fcn.10009f14
mov eax, dword [eax]
add eax, dword [ebp - 0x994]
jne 0x10047950
and dword [ebp - 0x68c], 0
jmp 0x1004795a
mov dword [ebp - 0x68c], 1
mov eax, dword [ebp - 0x68c]
inc eax
jne 0x10047970
xor eax, eax
jne 0x10047970
and dword [ebp - 0x894], 0
jmp 0x1004797a
mov dword [ebp - 0x894], 1
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0xb3c], eax
jmp 0x10047bb2
mov dword [ebp - 0x69c], 0xba2848aa
push 4
lea ecx, [ebp - 0xe10]
call fcn.10009e9c
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x5c], 0
jmp 0x100479b6
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x100479d2
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xe10]
call fcn.10009f14
mov dword [eax], 8
jmp 0x100479af
mov dword [ebp - 0x5c], 0
jmp 0x100479e2
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x100479f8
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xd88], 0x3f7a5371
jmp 0x100479db
mov esi, dword [ebp - 0x104]
push 0
lea ecx, [ebp - 0xa88]
call fcn.10009f14
cmp esi, dword [eax]
jne 0x10047a1b
mov dword [ebp - 0xa28], 1
jmp 0x10047a22
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x328], eax
push 4
pop eax
sub eax, dword [ebp - 0x178]
cmp eax, dword [ebp - 0x2c]
jge 0x10047a48
mov dword [ebp - 0x694], 1
jmp 0x10047a4f
and dword [ebp - 0x694], 0
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp - 0x694], 0xfffffffb
cmp ecx, dword [ebp + eax - 0xd88]
jne 0x10047a71
mov dword [ebp - 0x6a4], 1
jmp 0x10047a78
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0xa28]
mov dword [ebp - 0x69c], eax
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0x89c], eax
push 3
lea ecx, [ebp - 0xe10]
call fcn.10009f14
mov ecx, dword [ebp - 0x89c]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x89c]
add ecx, dword [ebp - 0x6a4]
imul ecx, dword [ebp + eax - 0xd88]
cmp ecx, dword [ebp - 0x178]
jge 0x10047ad3
mov dword [ebp - 0x99c], 1
jmp 0x10047ada
and dword [ebp - 0x99c], 0
push 0
lea ecx, [ebp - 0xa88]
call fcn.10009f14
mov ecx, dword [ebp - 0x99c]
cmp ecx, dword [eax]
jle 0x10047afd
mov dword [ebp - 0x6ac], 1
jmp 0x10047b04
and dword [ebp - 0x6ac], 0
cmp dword [ebp - 0x6ac], 0x9a5d
jne 0x10047b1c
mov dword [ebp - 0x8a4], 1
jmp 0x10047b23
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x178]
cmp eax, dword [ebp - 0x8a4]
jle 0x10047b3d
mov dword [ebp - 0x6b4], 1
jmp 0x10047b44
and dword [ebp - 0x6b4], 0
push 1
lea ecx, [ebp - 0xa88]
call fcn.10009f14
mov ecx, dword [ebp - 0x6b4]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0
jmp 0x10047b72
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jg 0x10047ba3
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x10047ba1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x10047b65
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xe10]
call fcn.10009ef8
jmp 0x10047532
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa88]
call fcn.10009ef8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10009ef8
mov dword [ebp - 0x6ec], 0x7eaa
mov dword [ebp - 0xba0], 0x100087f0
cmp dword [ebp - 0x6ec], 0x80ab
jle 0x10047cd7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 0x2dc], 0
jmp 0x10047c15
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0x2084
jge 0x10047cd7
and dword [ebp - 0x2d4], 0
jmp 0x10047c3b
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x262f
jge 0x10047cd2
and dword [ebp - 0x330], 0
jmp 0x10047c61
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0x290b
jge 0x10047ccd
mov eax, dword [ebp - 0x2d4]
cdq
idiv dword [ebp - 0x330]
xor edx, dword [ebp - 0x2dc]
mov eax, edx
cdq
mov dword [ebp - 0xb58], eax
mov dword [ebp - 0xb54], edx
push dword [ebp - 0xb54]
push dword [ebp - 0xb58]
lea ecx, [ebp - 0x11dc]
call fcn.1000aac8
pop ecx
pop ecx
mov dword [ebp - 0xb90], eax
mov ecx, dword [ebp - 0xb90]
call fcn.10015759
push eax
call fcn.10056b5a
pop ecx
lea ecx, [ebp - 0x11dc]
call fcn.10009e92
jmp 0x10047c54
jmp 0x10047c2e
jmp 0x10047c08
and dword [ebp - 0x348], 0
jmp 0x10047ced
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0xe
jae 0x100480e4
push 3
lea ecx, [ebp - 0xae4]
call fcn.10009e9c
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x10c], 0x596960f5
mov dword [ebp - 0x6dc], 9
mov dword [ebp - 0xb50], 0x955205
mov dword [ebp - 0xfb0], 1
mov dword [ebp - 0xfb8], 0xe3a4c638
mov dword [ebp - 0xfc0], 0xef8169c1
mov dword [ebp - 0x9ac], 0xc79ebef9
mov dword [ebp - 0xa30], 0x4962
mov dword [ebp - 0xb44], 0x10008830
cmp dword [ebp - 0xa30], 0x4b9a
jle 0x10047ded
and dword [ebp - 0x338], 0
jmp 0x10047d8a
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0x40fb
jge 0x10047ded
and dword [ebp - 0x2e4], 0
jmp 0x10047dac
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0x6d5a
jge 0x10047deb
mov eax, dword [ebp - 0x338]
mov ecx, dword [ebp - 0x2e4]
sar eax, cl
cdq
mov dword [ebp - 0xb64], eax
mov dword [ebp - 0xb60], edx
push dword [ebp - 0xb60]
push dword [ebp - 0xb64]
mov ecx, 0x10615bb8
call fcn.10015a07
jmp 0x10047d9f
jmp 0x10047d7d
mov dword [ebp - 0x340], 0
jmp 0x10047e06
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 3
jge 0x10047e28
push dword [ebp - 0x340]
lea ecx, [ebp - 0xae4]
call fcn.10009f14
mov dword [eax], 0x4778
jmp 0x10047df9
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0xa30], 0x457e
jge 0x10047e48
mov edx, dword [ebp - 0xb44]
mov ecx, 0x10615bb8
call fcn.10019d5c
jmp 0x10047e64
mov dword [ebp - 4], 0x15
jmp 0x10047e74
mov dword [ebp - 0x10c], 0
jmp 0x10047e8d
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jg 0x100480b5
mov dword [ebp - 0x6bc], 0xcb0befcd
mov dword [ebp - 0x6c4], 0xe936be85
mov dword [ebp - 0x6cc], 0xfffffff9
mov dword [ebp - 0x2ec], 0
jmp 0x10047ed1
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 3
jge 0x10047eed
mov eax, dword [ebp - 0x2ec]
mov dword [ebp + eax*4 - 0xaac], 0xed9a
jmp 0x10047ec4
push 2
lea ecx, [ebp - 0xae4]
call fcn.10009f14
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaac]
mov dword [ebp - 0xfc8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xaac], 0
je 0x10048055
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaac]
mov dword [ebp - 0x6bc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6bc]
sub ecx, dword [ebp + eax - 0xaac]
cmp ecx, 7
jl 0x10047f58
mov dword [ebp - 0x8ac], 1
jmp 0x10047f5f
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0x6c4], eax
mov eax, dword [ebp - 0x6c4]
cmp eax, dword [ebp - 0x10c]
jge 0x10047f85
mov dword [ebp - 0x9a4], 1
jmp 0x10047f8c
and dword [ebp - 0x9a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaac]
mov dword [ebp - 0x8b4], eax
push dword [ebp - 0x10c]
lea ecx, [ebp - 0xae4]
call fcn.10009f14
mov ecx, dword [ebp - 0x8b4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0x6cc]
cmp dword [ebp - 0x8b4], eax
je 0x10047fde
mov dword [ebp - 0x6d4], 1
jmp 0x10047fe5
and dword [ebp - 0x6d4], 0
cmp dword [ebp - 0x6d4], 2
jae 0x10047ffa
mov dword [ebp - 0xa24], 1
jmp 0x10048001
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0x6dc]
cmp dword [ebp - 0xa24], eax
jge 0x1004801b
mov dword [ebp - 0xb98], 1
jmp 0x10048022
and dword [ebp - 0xb98], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xfd0], eax
cmp dword [ebp - 0x6dc], 0xfffffff9
jae 0x10048055
push 0
lea ecx, [ebp - 0xae4]
call fcn.10009f14
cmp dword [eax], 0
je 0x10048055
mov dword [ebp - 0x8bc], 1
jmp 0x1004805c
and dword [ebp - 0x8bc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xaac]
cmp dword [ebp - 0x8bc], eax
jle 0x1004807c
mov dword [ebp - 0x6e4], 1
jmp 0x10048083
and dword [ebp - 0x6e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaac]
add eax, dword [ebp - 0x6e4]
mov dword [ebp - 0xb50], eax
push 0
lea ecx, [ebp - 0xae4]
call fcn.10009f14
cmp dword [eax], 0
je 0x100480b0
jmp 0x100480b5
jmp 0x10047e80
mov eax, dword [ebp - 0x9ac]
dec eax
mov dword [ebp - 0x9ac], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae4]
call fcn.10009ef8
mov eax, dword [ebp - 0x348]
mov byte [ebp + eax - 0xcf8], 0
jmp 0x10047ce0
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x6ec], 0x7bf2
jge 0x10048103
push dword [ebp - 0xba0]
call fcn.10056b5a
pop ecx
jmp 0x1004811f
or dword [ebp - 4], 0xffffffff
jmp 0x10048129
mov dword [ebp - 0x1d8], 0xc28ade19
mov dword [ebp - 0xfd8], 0xfffffffa
mov dword [ebp - 0xfe0], 0
mov dword [ebp - 0xfe8], 0
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1d8], 0
jmp 0x10048174
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xfffffff3
jl 0x10048432
push 2
lea ecx, [ebp - 0xd44]
call fcn.10009e9c
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x2f4], 0x4f2887cf
mov dword [ebp - 0xff0], 0x46b8d963
mov dword [ebp - 0x8c4], 2
mov dword [ebp - 0xb8], 0
jmp 0x100481cc
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x100481ee
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xd44]
call fcn.10009f14
mov dword [eax], 2
jmp 0x100481bf
mov dword [ebp - 0xb8], 0
jmp 0x10048207
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 4
jge 0x10048223
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x1204], 7
jmp 0x100481fa
mov dword [ebp - 0x2f4], 1
jmp 0x1004823c
mov eax, dword [ebp - 0x2f4]
dec eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0
jl 0x1004841e
mov dword [ebp - 0x4c], 0xc2285faa
mov dword [ebp - 0xff8], 0x5ccb9725
mov dword [ebp - 0x1000], 0xffffffff
mov dword [ebp - 0x4c], 1
jmp 0x10048274
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1004829e
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xd44]
call fcn.10009f14
mov esi, eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xd44]
call fcn.10009f14
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1004826d
mov dword [ebp - 0x4c], 1
jmp 0x100482ae
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10048419
mov dword [ebp - 0x106c], 0
mov dword [ebp - 0x1074], 0
mov dword [ebp - 0x107c], 0xafd77ccc
mov dword [ebp - 0x1084], 0xb6d64bda
mov dword [ebp - 0xa0], 0
jmp 0x100482f9
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x10048315
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x350], 0xe46c2e7c
jmp 0x100482ec
mov dword [ebp - 0xa0], 0
jmp 0x1004832e
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x1004834a
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x11ac], 0xbd791f9e
jmp 0x10048321
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x350], 1
jmp 0x10048378
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x350]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x350], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x350], 0
jl 0x10048414
mov dword [ebp - 0x10a0], 0xfd43
mov dword [ebp - 0x10a8], 0
push 3
lea ecx, [ebp - 0x1040]
call fcn.10009e9c
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x10b0], 0
mov dword [ebp - 0x2fc], 0
jmp 0x100483d4
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 3
jge 0x100483f3
push dword [ebp - 0x2fc]
lea ecx, [ebp - 0x1040]
call fcn.10009f14
and dword [eax], 0
jmp 0x100483c7
mov eax, dword [ebp - 0x8c4]
dec eax
mov dword [ebp - 0x8c4], eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1040]
call fcn.10009ef8
jmp 0x1004835d
jmp 0x100482a7
jmp 0x1004822f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd44]
call fcn.10009ef8
jmp 0x10048167
mov dword [ebp - 0x114], 5
mov dword [ebp - 0x114], 0xfffffff9
jmp 0x10048455
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffe7
je 0x10048649
mov dword [ebp - 0xc8], 0x7a876e6b
mov dword [ebp - 0x1f0], 8
mov dword [ebp - 0x8d4], 0xfffffffc
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1004849d
push 0xe96
call dword [sym.imp.USER32.dll_GetKeyboardType]
mov dword [ebp - 0xc8], 0xa
jmp 0x100484b6
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xb
je 0x10048644
mov dword [ebp - 0x418], 0xffff
mov dword [ebp - 0x6fc], 0xffffffff
mov dword [ebp - 0xb5c], 6
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x1094], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x108c], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
jne 0x100485ea
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0xe70], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xeb8], eax
cmp dword [ebp - 0x8d4], 0
jge 0x1004853f
mov dword [ebp - 0x6f4], 1
jmp 0x10048546
and dword [ebp - 0x6f4], 0
cmp dword [ebp - 0x6f4], 0xfffffffc
jg 0x1004855b
mov dword [ebp - 0xa9c], 1
jmp 0x10048562
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0x6fc], eax
cmp dword [ebp - 0x6fc], 0
jne 0x10048589
cmp dword [ebp - 0x114], 0
jne 0x10048589
and dword [ebp - 0x8cc], 0
jmp 0x10048593
mov dword [ebp - 0x8cc], 1
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x8cc], eax
jg 0x100485ad
mov dword [ebp - 0x704], 1
jmp 0x100485b4
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0x418]
jg 0x100485da
mov dword [ebp - 0x9b4], 1
jmp 0x100485e1
and dword [ebp - 0x9b4], 0
cmp dword [ebp - 0x9b4], 0
jbe 0x100485ff
cmp dword [ebp - 0xc8], 0
je 0x100485ff
mov dword [ebp - 0x70c], 1
jmp 0x10048606
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x418]
add eax, dword [ebp - 0x70c]
sub eax, dword [ebp - 0x8d4]
cmp eax, dword [ebp - 0x114]
jg 0x1004862c
mov dword [ebp - 0x714], 1
jmp 0x10048633
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x714]
mov dword [ebp - 0xb5c], eax
jmp 0x100484a9
jmp 0x10048448
mov dword [ebp - 0xa2c], 0x5ae0
mov dword [ebp - 0xba8], 0x100088f0
cmp dword [ebp - 0xa2c], 0x5daa
jle 0x10048749
and dword [ebp - 0x360], 0
jmp 0x10048683
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0x1f74
jge 0x10048749
and dword [ebp - 0x30c], 0
jmp 0x100486a9
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0x6a47
jge 0x10048744
and dword [ebp - 0x358], 0
jmp 0x100486cf
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x63e9
jge 0x1004873f
and dword [ebp - 0x248], 0
jmp 0x100486f1
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x7561
jge 0x1004873d
mov ecx, dword [ebp - 0x358]
add ecx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x360]
imul eax, dword [ebp - 0x30c]
shl eax, cl
cdq
mov dword [ebp - 0xb70], eax
mov dword [ebp - 0xb6c], edx
push dword [ebp - 0xb6c]
push dword [ebp - 0xb70]
mov ecx, 0x10615bb8
call fcn.10015a07
jmp 0x100486e4
jmp 0x100486c2
jmp 0x1004869c
jmp 0x10048676
mov dword [ebp - 0x1e0], 0x714a0256
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0xa2c], 0x58dc
jge 0x10048776
mov edx, dword [ebp - 0xba8]
mov ecx, 0x10615bb8
call fcn.10019d5c
jmp 0x10048792
or dword [ebp - 4], 0xffffffff
jmp 0x1004879c
mov dword [ebp - 0x368], 0
jmp 0x100487b5
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 3
jge 0x100487d1
mov eax, dword [ebp - 0x368]
mov dword [ebp + eax*4 - 0x10f4], 0xfffffffc
jmp 0x100487a8
mov dword [ebp - 0x1e0], 0
jmp 0x100487ea
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jge 0x10048806
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x10f4], 0x5a136951
jmp 0x100487dd
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x10048822
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov byte [ebp - 0x244], 0xc
mov byte [ebp - 0x243], 0x1d
mov byte [ebp - 0x242], 1
mov byte [ebp - 0x241], 1
mov byte [ebp - 0x240], 6
mov byte [ebp - 0x23f], 0x22
mov byte [ebp - 0x23e], 5
mov byte [ebp - 0x23d], 0x35
mov byte [ebp - 0x23c], 3
mov byte [ebp - 0x23b], 4
mov byte [ebp - 0x23a], 2
mov byte [ebp - 0x239], 4
mov byte [ebp - 0x238], 9
mov byte [ebp - 0x237], 6
mov byte [ebp - 0x236], 7
mov byte [ebp - 0x235], 0x11
mov byte [ebp - 0x234], 4
mov byte [ebp - 0x233], 6
mov byte [ebp - 0x232], 0xa
mov byte [ebp - 0x231], 0x11
mov byte [ebp - 0x230], 0
mov byte [ebp - 0x22f], 0x26
mov byte [ebp - 0x22e], 8
mov byte [ebp - 0x22d], 0x2c
mov byte [ebp - 0x22c], 0xb
mov byte [ebp - 0x22b], 0x1c
mov byte [ebp - 0x22a], 0xd
mov byte [ebp - 0x229], 0x24
push 1
lea ecx, [ebp - 0xc90]
call fcn.10009e9c
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xbb0], 0xffffffff
mov dword [ebp - 0x734], 0xfffffffb
mov dword [ebp - 0xb68], 0x26d8d38
mov dword [ebp - 0xf94], 0x3672d714
mov dword [ebp - 0xbb8], 0xeb81f947
mov dword [ebp - 0x314], 0
jmp 0x10048945
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 1
jge 0x10048967
push dword [ebp - 0x314]
lea ecx, [ebp - 0xc90]
call fcn.10009f14
mov dword [eax], 0x97f6af11
jmp 0x10048938
push 0
lea ecx, [ebp - 0xc90]
call fcn.10009f14
and dword [eax], 0
jmp 0x1004899d
push 0
lea ecx, [ebp - 0xc90]
call fcn.10009f14
mov dword [ebp - 0x71c], eax
mov eax, dword [ebp - 0x71c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x71c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xc90]
call fcn.10009f14
cmp dword [eax], 0xfffffffa
jle 0x10048bd4
mov dword [ebp - 0x1a0], 9
mov dword [ebp - 0x9c4], 0x78398922
mov dword [ebp - 0x1a0], 0xd
jmp 0x100489e0
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 7
jge 0x10048bc1
mov dword [ebp - 0x3cc], 0
mov dword [ebp - 0x200], 1
mov dword [ebp - 0x724], 0xfffffffa
mov dword [ebp - 0x370], 0
jmp 0x10048a24
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 1
jge 0x10048a40
mov eax, dword [ebp - 0x370]
mov dword [ebp + eax*4 - 0x8ec], 0xd19fa553
jmp 0x10048a17
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0xe78], eax
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
je 0x10048b85
cmp dword [ebp - 0xb68], 0
je 0x10048a83
cmp dword [ebp - 0x1a0], 0
jne 0x10048a83
cmp dword [ebp - 0x734], 0
jne 0x10048a83
and dword [ebp - 0x8dc], 0
jmp 0x10048a8d
mov dword [ebp - 0x8dc], 1
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x8dc], eax
jge 0x10048ab0
cmp dword [ebp - 0x3cc], 0
je 0x10048ab0
mov dword [ebp - 0x72c], 1
jmp 0x10048ab7
and dword [ebp - 0x72c], 0
mov dword [ebp - 0x724], 0xfffffff6
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x9bc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9bc]
mov dword [ebp + eax - 0x8ec], ecx
mov eax, dword [ebp - 0x9bc]
cmp eax, dword [ebp - 0x72c]
jge 0x10048afa
mov dword [ebp - 0x8e4], 1
jmp 0x10048b01
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x8e4]
sub eax, 0x6d8f9c32
mov ecx, dword [ebp - 0x734]
add ecx, eax
cmp ecx, dword [ebp - 0xbb0]
jge 0x10048b28
mov dword [ebp - 0xa5c], 1
jmp 0x10048b2f
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0x3cc]
add eax, dword [ebp - 0xa5c]
cmp eax, dword [ebp - 0x200]
jg 0x10048b4f
mov dword [ebp - 0x73c], 1
jmp 0x10048b56
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x73c], eax
jg 0x10048b70
mov dword [ebp - 0xb74], 1
jmp 0x10048b77
and dword [ebp - 0xb74], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8ec], 0
mov eax, 0x2934
cmp eax, 1
jbe 0x10048b9f
xor eax, eax
je 0x10048b9f
mov dword [ebp - 0x744], 1
jmp 0x10048ba6
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0xbb8], eax
mov dword [ebp - 0x9c4], 0xdf890ba5
jmp 0x100489d3
cmp dword [ebp - 0x9c4], 0
je 0x10048bcf
jmp 0x10048979
jmp 0x10048979
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc90]
call fcn.10009ef8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x244]
and eax, 0x6e
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x244]
or ecx, 0x6e
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x244]
mov byte [ebp + eax - 0xd1c], cl
mov dword [ebp - 0xcc], 2
and dword [ebp - 0x76c], 0
jmp 0x10048c3d
cmp dword [ebp - 0xcc], 0x1c
jae 0x10048f27
mov dword [ebp - 0x3d4], 0xda8e97ee
mov dword [ebp - 0x3fc], 0xfffffff9
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x31c], 0xffffffff
mov dword [ebp - 0xbc8], 6
mov dword [ebp - 0x1034], 0xd2717f40
mov dword [ebp - 0x3dc], 0x91ba6b42
mov dword [ebp - 0x40c], 1
mov dword [ebp - 0x8fc], 8
mov dword [ebp - 0xbc0], 0xf135
mov dword [ebp - 0xc0], 0
jmp 0x10048cc7
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x10048ce3
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x1180], 0xfffffffb
jmp 0x10048cba
mov dword [ebp - 0xc0], 0
jmp 0x10048cfc
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x10048d18
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0xea4], 0xffffffff
jmp 0x10048cef
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0xe84], eax
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0xf9c], eax
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0xe90], eax
mov eax, dword [ebp - 0x31c]
cmp eax, dword [ebp - 0x3fc]
jle 0x10048d56
mov dword [ebp - 0x74c], 1
jmp 0x10048d5d
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
cmp eax, dword [ebp - 0x74c]
jl 0x10048d84
mov dword [ebp - 0x8f4], 1
jmp 0x10048d8b
and dword [ebp - 0x8f4], 0
cmp dword [ebp - 0x8f4], 9
jae 0x10048da0
mov dword [ebp - 0x754], 1
jmp 0x10048da7
and dword [ebp - 0x754], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x754]
mov dword [ebp + eax - 0xea4], ecx
mov eax, dword [ebp - 0x31c]
cmp eax, dword [ebp - 0x31c]
jg 0x10048dd4
mov dword [ebp - 0xa34], 1
jmp 0x10048ddb
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0xa34]
sub eax, 0x6195bec9
mov ecx, dword [ebp - 0x3fc]
sub ecx, eax
add ecx, dword [ebp - 0x3dc]
cmp ecx, dword [ebp - 0x31c]
jge 0x10048e08
mov dword [ebp - 0xb80], 1
jmp 0x10048e0f
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x1088], eax
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0xe9c], eax
mov eax, 0x58fc5674
test eax, eax
je 0x10048e45
cmp dword [ebp - 0x8fc], 0
je 0x10048e45
and dword [ebp - 0x75c], 0
cmp dword [ebp - 0x75c], 0
ja 0x10048e61
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x9d4], 0xe94ccb09
mov dword [ebp - 0x78c], 0xfffffffc
mov dword [ebp - 0xb94], 8
cmp dword [ebp - 0x24], 0xf703
jle 0x10048f61
mov dword [ebp - 0x904], 1
jmp 0x10048f68
and dword [ebp - 0x904], 0
cmp dword [ebp - 0x904], 0x61a6b719
jl 0x10048f89
mov eax, 0x263b0a6d
test eax, eax
je 0x10048f89
mov dword [ebp - 0x774], 1
jmp 0x10048f90
and dword [ebp - 0x774], 0
cmp dword [ebp - 0x774], 0xae7b
jne 0x10048fa8
mov dword [ebp - 0xb8c], 1
jmp 0x10048faf
and dword [ebp - 0xb8c], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xfa4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xe68], eax
mov eax, 0x3cf6
imul eax, eax, 0xffffffff
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
jne 0x10048fe2
xor eax, eax
inc eax
jne 0x10048fe2
and dword [ebp - 0xc34], 0
jmp 0x10048fec
mov dword [ebp - 0xc34], 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1044], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
je 0x10049009
mov dword [ebp - 0xa8c], 1
jmp 0x10049010
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xa8c], eax
jg 0x1004902d
cmp dword [ebp - 0x24], 0
je 0x1004902d
mov dword [ebp - 0x77c], 1
jmp 0x10049034
and dword [ebp - 0x77c], 0
imul eax, dword [ebp - 0x77c], 0x985
cmp eax, dword [ebp - 0x24]
jg 0x10049055
cmp dword [ebp - 0x24], 0
je 0x10049055
mov dword [ebp - 0x90c], 1
jmp 0x1004905c
and dword [ebp - 0x90c], 0
cmp dword [ebp - 0x90c], 0xbf5cbf79
jne 0x10049074
mov dword [ebp - 0x784], 1
jmp 0x1004907b
and dword [ebp - 0x784], 0
push 7
pop eax
sub eax, dword [ebp - 0x784]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x9d4], eax
mov eax, dword [ebp - 0x9d4]
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0xb94], eax
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x100490c3
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0xd1c], 0
mov dword [ebp - 0xcdc], 1
push 3
lea ecx, [ebp - 0xe40]
call fcn.10009e9c
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0xeb4], 0xe4fc
mov dword [ebp - 0xfac], 0xf5872d9
mov dword [ebp - 0x914], 1
mov dword [ebp - 0x378], 0
jmp 0x10049126
cmp dword [ebp - 0x378], 3
jge 0x10049148
mov eax, dword [0x10616d04]
cmp eax, dword [ebp - 0x310]
je 0x100494fe
mov eax, dword [0x10616eb4]
cmp eax, dword [ebp - 0x310]
jne 0x10049667
push 2
lea ecx, [ebp - 0xca0]
call fcn.10009e9c
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x6c], 0
jmp 0x10049522
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1004953e
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xca0]
call fcn.10009f14
mov dword [eax], 0xfffffff7
jmp 0x1004951b
mov dword [ebp - 0x6c], 0
jmp 0x1004954e
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x10049564
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xbac], 0xbacd7953
jmp 0x10049547
push 1
lea ecx, [ebp - 0xca0]
call fcn.10009f14
mov dword [eax], 0x15
jmp 0x1004959d
push 1
lea ecx, [ebp - 0xca0]
call fcn.10009f14
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0x924]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x924]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xca0]
call fcn.10009f14
cmp dword [eax], 0x1c
jne 0x10049640
mov dword [ebp - 0x388], 0x85bf25cb
mov dword [ebp - 0x388], 0
jmp 0x100495d6
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0
jg 0x10049626
mov dword [ebp - 0x24c], 0xfffffff6
mov dword [ebp - 0x24c], 0
jmp 0x10049602
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jg 0x10049624
mov dword [ebp - 0x7b4], 0x7e67
mov eax, dword [ebp - 0x7b4]
dec eax
mov dword [ebp - 0x7b4], eax
jmp 0x100495f5
jmp 0x100495c9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbac], 0
je 0x1004963b
jmp 0x10049579
jmp 0x10049579
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca0]
call fcn.10009ef8
mov ecx, dword [ebp + 0xc]
call fcn.10015759
push eax
push dword [ebp + 8]
call fcn.1003f08a
pop ecx
pop ecx
jmp 0x1004c8b5
mov dword [ebp - 0x7c], 0xffffffff
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x250], 0
jmp 0x1004968e
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 2
jge 0x100496aa
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x1120], 6
jmp 0x10049681
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xfbc], eax
cmp dword [ebp - 0x7c], 0
je 0x1004995a
mov dword [ebp - 0x260], 0xa13b
mov dword [ebp - 0x258], 0x610a1434
mov dword [ebp - 0x7f4], 0x440e708b
mov dword [ebp - 0xaa0], 0xac8ef34e
mov dword [ebp - 0xc44], 0xfbc6a687
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xedc], eax
cmp dword [ebp - 0x7c], 0xf906d8bc
ja 0x1004970d
mov dword [ebp - 0xa6c], 1
jmp 0x10049714
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0xa6c], eax
jg 0x1004972b
mov dword [ebp - 0x42c], 1
jmp 0x10049732
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x42c], eax
jge 0x1004974c
mov dword [ebp - 0x92c], 1
jmp 0x10049753
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x260]
cmp eax, dword [ebp - 0x92c]
jne 0x1004976d
mov dword [ebp - 0x7c4], 1
jmp 0x10049774
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x260]
cmp eax, dword [ebp - 0x7c4]
jle 0x1004978e
mov dword [ebp - 0x9e4], 1
jmp 0x10049795
and dword [ebp - 0x9e4], 0
cmp dword [ebp - 0x9e4], 0xe22401db
jb 0x100497ad
mov dword [ebp - 0x7cc], 1
jmp 0x100497b4
and dword [ebp - 0x7cc], 0
imul eax, dword [ebp - 0x7cc], 0xe4f9
cmp eax, 0xf88
jg 0x100497d1
mov dword [ebp - 0x934], 1
jmp 0x100497d8
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x934], eax
jle 0x100497ef
mov dword [ebp - 0x7d4], 1
jmp 0x100497f6
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x258]
add eax, dword [ebp - 0x7d4]
cmp eax, dword [ebp - 0x258]
jne 0x10049816
mov dword [ebp - 0xa44], 1
jmp 0x1004981d
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0xa44], eax
jne 0x10049837
mov dword [ebp - 0x7dc], 1
jmp 0x1004983e
and dword [ebp - 0x7dc], 0
cmp dword [ebp - 0x7dc], 1
jne 0x10049853
mov dword [ebp - 0x93c], 1
jmp 0x1004985a
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x93c], eax
jge 0x10049871
mov dword [ebp - 0x7e4], 1
jmp 0x10049878
and dword [ebp - 0x7e4], 0
cmp dword [ebp - 0x7e4], 0xb6b
je 0x10049890
mov dword [ebp - 0x9ec], 1
jmp 0x10049897
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x9ec], eax
jle 0x100498ae
mov dword [ebp - 0x7ec], 1
jmp 0x100498b5
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x7ec], eax
jge 0x100498cf
mov dword [ebp - 0x944], 1
jmp 0x100498d6
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x944]
mov dword [ebp - 0x7f4], eax
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0xaa0], eax
cmp dword [ebp - 0xaa0], 1
jg 0x10049903
mov dword [ebp - 0x55c], 1
jmp 0x1004990a
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x55c], eax
jg 0x10049921
mov dword [ebp - 0x560], 1
jmp 0x10049928
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x560], eax
jne 0x10049942
mov dword [ebp - 0x568], 1
jmp 0x10049949
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0xc44], eax
jmp 0x10049acb
mov dword [ebp - 0x268], 0
jmp 0x10049973
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 2
jge 0x1004998f
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0xeb0], 0
jmp 0x10049966
mov dword [ebp - 0x74], 0
jmp 0x1004999f
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 6
je 0x10049acb
mov dword [ebp - 0x590], 1
mov dword [ebp - 0x270], 0
jmp 0x100499cc
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x100499e8
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0xbb4], 0xffffffff
jmp 0x100499bf
mov eax, 0xffff4f96
sub eax, dword [ebp - 0x590]
cmp eax, 0x7c52
jl 0x10049a06
mov dword [ebp - 0x570], 1
jmp 0x10049a0d
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 0
jge 0x10049a22
mov dword [ebp - 0x578], 1
jmp 0x10049a29
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x578], eax
jg 0x10049a40
mov dword [ebp - 0x580], 1
jmp 0x10049a47
and dword [ebp - 0x580], 0
cmp dword [ebp - 0x580], 0x9aea
jge 0x10049a5f
mov dword [ebp - 0x588], 1
jmp 0x10049a66
and dword [ebp - 0x588], 0
cmp dword [ebp - 0x588], 0x426ae69e
jg 0x10049a7e
mov dword [ebp - 0x598], 1
jmp 0x10049a85
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x590]
cmp dword [ebp - 0x598], eax
jle 0x10049a9f
mov dword [ebp - 0x5a0], 1
jmp 0x10049aa6
and dword [ebp - 0x5a0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xeb0]
add eax, dword [ebp - 0x5a0]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbb4], eax
jmp 0x10049998
mov dword [ebp - 0x7c], 1
jmp 0x10049adb
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jl 0x10049b02
mov byte [ebp - 0x16b], 0
movzx eax, byte [ebp - 0x16b]
test eax, eax
je 0x10049b00
push 0x17b8
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x10049ad4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x44], 0x64dc9ed9
mov dword [ebp - 0xda4], 0x9725245f
mov dword [ebp - 0xda0], 0x9725245f
mov dword [ebp - 0xd9c], 0x9725245f
mov dword [ebp - 0xd98], 0x9725245f
lea ecx, [ebp - 0x3dd]
call fcn.1000a074
push eax
lea eax, [ebp - 0xd94]
push eax
lea eax, [ebp - 0xda4]
push eax
lea ecx, [ebp - 0x1128]
call fcn.10015d47
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe1c]
call fcn.10015d21
mov dword [ebp - 4], 0x24
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xee4], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x44]
jle 0x10049b9c
mov dword [ebp - 0x5a8], 1
jmp 0x10049ba3
and dword [ebp - 0x5a8], 0
cmp dword [ebp - 0x5a8], 0
jae 0x10049bb8
mov dword [ebp - 0x5b0], 1
jmp 0x10049bbf
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x5b0]
jg 0x10049bd6
mov dword [ebp - 0x5b8], 1
jmp 0x10049bdd
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x5b8], eax
jl 0x10049bf4
mov dword [ebp - 0x5c0], 1
jmp 0x10049bfb
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 0xffffffff
jne 0x10049c10
mov dword [ebp - 0xcd0], 1
jmp 0x10049c17
and dword [ebp - 0xcd0], 0
push 8
pop eax
test eax, eax
jne 0x10049c30
mov eax, 0x96378555
test eax, eax
jne 0x10049c30
and dword [ebp - 0x5c8], 0
jmp 0x10049c3a
mov dword [ebp - 0x5c8], 1
push 0
lea ecx, [ebp - 0xe1c]
call fcn.10009f14
mov ecx, dword [ebp - 0x5c8]
mov dword [eax], ecx
mov dword [ebp - 0x44], 0
jmp 0x10049c5f
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x1e
jne 0x10049d53
mov dword [ebp - 0x5d0], 5
push 3
lea ecx, [ebp - 0xe04]
call fcn.10009e9c
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x278], 0
jmp 0x10049c9d
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
jge 0x10049cbf
push dword [ebp - 0x278]
lea ecx, [ebp - 0xe04]
call fcn.10009f14
mov dword [eax], 0xacb6d64b
jmp 0x10049c90
cmp dword [ebp - 0x5d0], 0
jne 0x10049d01
push 0
lea ecx, [ebp - 0xe1c]
call fcn.10009f14
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0xfc4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xeec], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1064], eax
xor eax, eax
inc eax
jne 0x10049d01
and dword [ebp - 0x5d8], 0
jmp 0x10049d0b
mov dword [ebp - 0x5d8], 1
cmp dword [ebp - 0x5d8], 0xa9f4f9a0
je 0x10049d23
mov dword [ebp - 0x5e0], 1
jmp 0x10049d2a
and dword [ebp - 0x5e0], 0
push 1
lea ecx, [ebp - 0xe04]
call fcn.10009f14
mov ecx, dword [ebp - 0x5e0]
mov dword [eax], ecx
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xe04]
call fcn.10009ef8
jmp 0x10049c58
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe1c]
call fcn.10009ef8
cmp dword [ebp - 0x280], 0
je 0x1004c6bd
mov eax, dword [ebp - 0x280]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1004c6bd
mov dword [ebp - 0xef4], 0x3b4e
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x10049daa
push 0x1383
call dword [sym.imp.USER32.dll_SetCapture]
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x10049dc8
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [ebp - 0x280]
mov ecx, dword [ebp - 0x280]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1f4], ecx
mov dword [ebp - 0xdb8], 0x1a049fe3
mov dword [ebp - 0xdb4], 0x1a049fe3
mov dword [ebp - 0xdb0], 0x1a049fe3
mov dword [ebp - 0xdac], 0x1a049fe3
lea ecx, [ebp - 0x3e5]
call fcn.1000a074
push eax
lea eax, [ebp - 0xda8]
push eax
lea eax, [ebp - 0xdb8]
push eax
lea ecx, [ebp - 0x1130]
call fcn.10015d47
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd80]
call fcn.10015d21
mov dword [ebp - 4], 0x26
push 2
lea ecx, [ebp - 0xd80]
call fcn.10009f14
and dword [eax], 0
jmp 0x10049e77
push 2
lea ecx, [ebp - 0xd80]
call fcn.10009f14
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x5e8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5e8]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xd80]
call fcn.10009f14
cmp dword [eax], 0xffffffe9
jl 0x10049f6f
mov dword [ebp - 0x290], 0xb8114768
push 1
lea ecx, [ebp - 0x1050]
call fcn.10009e9c
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x288], 0
jmp 0x10049ec1
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 1
jge 0x10049ee3
push dword [ebp - 0x288]
lea ecx, [ebp - 0x1050]
call fcn.10009f14
mov dword [eax], 0xffff
jmp 0x10049eb4
mov dword [ebp - 0x290], 0xfffffffa
jmp 0x10049efc
mov eax, dword [ebp - 0x290]
dec eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0xfffffff4
jge 0x10049f5b
mov dword [ebp - 0x1c4], 8
mov dword [ebp - 0x1c4], 0x3c34eea2
mov dword [ebp - 0x1c4], 0
jmp 0x10049f32
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jg 0x10049f59
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x10049f57
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
jmp 0x10049f25
jmp 0x10049eef
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1050]
call fcn.10009ef8
jmp 0x10049e53
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd80]
call fcn.10009ef8
mov eax, dword [ebp - 0x1f4]
cmp dword [eax], 0x4550
jne 0x1004c6bd
mov eax, dword [ebp - 0x1f4]
cmp dword [eax + 0x74], 0
jbe 0x1004c6bd
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f4]
cmp dword [ecx + eax + 0x78], 0
je 0x1004c6bd
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x2a0], 0xe0710dd0
mov dword [ebp - 0x628], 0xfffffffd
mov dword [ebp - 0x650], 0xb2811ff
push 2
lea ecx, [ebp - 0xd74]
call fcn.10009e9c
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x60], 0
jmp 0x1004a000
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1004a016
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xd90], 0xffffffff
jmp 0x10049ff9
mov dword [ebp - 0x60], 0
jmp 0x1004a026
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1004a042
push dword [ebp - 0x60]
lea ecx, [ebp - 0xd74]
call fcn.10009f14
mov dword [eax], 0xf93f8de9
jmp 0x1004a01f
mov dword [ebp - 0x18], 0
jmp 0x1004a052
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffec
jge 0x1004a1c7
mov dword [ebp - 0xbbc], 0
mov dword [ebp - 0x298], 0
jmp 0x1004a07f
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 3
jge 0x1004a09b
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0xcb0], 0xfe64fd9e
jmp 0x1004a072
mov byte [ebp - 0x15e], 0
movzx eax, byte [ebp - 0x15e]
test eax, eax
je 0x1004a0b5
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x18]
add ecx, dword [ebp + eax - 0xcb0]
cmp ecx, dword [ebp - 0x18]
je 0x1004a0e6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcb0], 0
jne 0x1004a0e6
and dword [ebp - 0x5f0], 0
jmp 0x1004a0f0
mov dword [ebp - 0x5f0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcb0]
cmp eax, dword [ebp - 0x5f0]
je 0x1004a111
mov dword [ebp - 0x5f8], 1
jmp 0x1004a118
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
cmp eax, dword [ebp - 0x18]
je 0x1004a13b
mov dword [ebp - 0x600], 1
jmp 0x1004a142
and dword [ebp - 0x600], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x600]
cmp ecx, dword [ebp + eax - 0xcb0]
jle 0x1004a166
mov dword [ebp - 0x608], 1
jmp 0x1004a16d
and dword [ebp - 0x608], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcb0]
cmp dword [ebp - 0x608], eax
jl 0x1004a18e
mov dword [ebp - 0x610], 1
jmp 0x1004a195
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x610]
test eax, eax
jg 0x1004a1af
mov dword [ebp - 0x618], 1
jmp 0x1004a1b6
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0xbbc], eax
jmp 0x1004a04b
cmp dword [ebp - 0x18], 0xd058bbe5
je 0x1004a1e2
cmp dword [ebp - 0x18], 0
je 0x1004a1e2
mov dword [ebp - 0x620], 1
jmp 0x1004a1e9
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x620]
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x630], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x630]
mov dword [ebp + eax - 0xd90], ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x630], eax
jge 0x1004a22e
mov dword [ebp - 0x638], 1
jmp 0x1004a235
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x638]
jge 0x1004a24c
mov dword [ebp - 0x640], 1
jmp 0x1004a253
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2a0], 0xffff
mov eax, 0x5bf8
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2a0]
cmp eax, dword [ebp - 0x18]
je 0x1004a28d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd90], 0
jne 0x1004a28d
and dword [ebp - 0x648], 0
jmp 0x1004a297
mov dword [ebp - 0x648], 1
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x650], eax
mov esi, dword [ebp - 0x650]
push 1
lea ecx, [ebp - 0xd74]
call fcn.10009f14
cmp esi, dword [eax]
jg 0x1004a2c6
mov dword [ebp - 0x658], 1
jmp 0x1004a2cd
and dword [ebp - 0x658], 0
push 1
lea ecx, [ebp - 0xd74]
call fcn.10009f14
mov ecx, dword [ebp - 0x658]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd74]
call fcn.10009ef8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x184], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f4]
mov edx, dword [ebp - 0x184]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0xde0], 7
mov dword [ebp - 0xddc], 7
mov dword [ebp - 0xdd8], 7
mov dword [ebp - 0xdd4], 7
lea ecx, [ebp - 0x3cd]
call fcn.1000a074
push eax
lea eax, [ebp - 0xdd0]
push eax
lea eax, [ebp - 0xde0]
push eax
lea ecx, [ebp - 0x1138]
call fcn.10015d47
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3b4]
call fcn.10015d21
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x6e0], 1
mov dword [ebp - 0x3ec], 0x46cdead9
mov dword [ebp - 0x680], 0x9ae86a67
mov dword [ebp - 0x404], 0x4f34d89b
mov dword [ebp - 0xce8], 0xfffffffe
and dword [ebp - 0xdcc], 0
and dword [ebp - 0xdc8], 0
and dword [ebp - 0xdc4], 0
and dword [ebp - 0xdc0], 0
lea ecx, [ebp - 0x3d5]
call fcn.1000a074
push eax
lea eax, [ebp - 0xdbc]
push eax
lea eax, [ebp - 0xdcc]
push eax
lea ecx, [ebp - 0x1188]
call fcn.10015d47
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe34]
call fcn.10015d21
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0xbcc], 0x698b42d
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10009f14
imul eax, dword [eax], 0x6fd8
cmp eax, 0x1630
jl 0x1004a431
mov dword [ebp - 0x660], 1
jmp 0x1004a438
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x660]
sub eax, 0x7e294b58
cmp eax, 0xe5a8
jg 0x1004a456
mov dword [ebp - 0xc54], 1
jmp 0x1004a45d
and dword [ebp - 0xc54], 0
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10009f14
cmp dword [eax], 0x944d
je 0x1004a47e
mov dword [ebp - 0x668], 1
jmp 0x1004a485
and dword [ebp - 0x668], 0
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10009f14
mov ecx, dword [ebp - 0x668]
cmp ecx, dword [eax]
jg 0x1004a4a8
mov dword [ebp - 0x670], 1
jmp 0x1004a4af
and dword [ebp - 0x670], 0
push 2
lea ecx, [ebp - 0x3b4]
call fcn.10009f14
mov ecx, dword [ebp - 0x670]
cmp ecx, dword [eax]
jge 0x1004a4d2
mov dword [ebp - 0x678], 1
jmp 0x1004a4d9
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x680], eax
mov esi, dword [ebp - 0x680]
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10009f14
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10009f14
cmp esi, dword [eax]
jg 0x1004a518
mov dword [ebp - 0x688], 1
jmp 0x1004a51f
and dword [ebp - 0x688], 0
cmp dword [ebp - 0x688], 0xc7f0
jge 0x1004a537
mov dword [ebp - 0x690], 1
jmp 0x1004a53e
and dword [ebp - 0x690], 0
cmp dword [ebp - 0x690], 0xffffffff
jl 0x1004a553
mov dword [ebp - 0x698], 1
jmp 0x1004a55a
and dword [ebp - 0x698], 0
push 1
lea ecx, [ebp - 0x3b4]
call fcn.10009f14
mov ecx, dword [ebp - 0x698]
cmp ecx, dword [eax]
je 0x1004a57d
mov dword [ebp - 0x6a0], 1
jmp 0x1004a584
and dword [ebp - 0x6a0], 0
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10009f14
mov ecx, dword [ebp - 0x6a0]
cmp ecx, dword [eax]
jle 0x1004a5a7
mov dword [ebp - 0xbc4], 1
jmp 0x1004a5ae
and dword [ebp - 0xbc4], 0
mov eax, 0x95866b38
test eax, eax
jne 0x1004a5c9
mov eax, 0xaa058a13
test eax, eax
jne 0x1004a5c9
and dword [ebp - 0x6a8], 0
jmp 0x1004a5d3
mov dword [ebp - 0x6a8], 1
mov eax, dword [ebp - 0x404]
cmp dword [ebp - 0x6a8], eax
je 0x1004a5ed
mov dword [ebp - 0x6b0], 1
jmp 0x1004a5f4
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0xce8], eax
cmp dword [ebp - 0x404], 0xffffffff
jne 0x1004a61b
cmp dword [ebp - 0x404], 0
jne 0x1004a61b
and dword [ebp - 0x6b8], 0
jmp 0x1004a625
mov dword [ebp - 0x6b8], 1
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10009f14
mov ecx, dword [ebp - 0x6b8]
cmp ecx, dword [eax]
jne 0x1004a648
mov dword [ebp - 0x6c0], 1
jmp 0x1004a64f
and dword [ebp - 0x6c0], 0
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10009f14
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6c0]
jne 0x1004a672
mov dword [ebp - 0x6c8], 1
jmp 0x1004a679
and dword [ebp - 0x6c8], 0
push 2
lea ecx, [ebp - 0xe34]
call fcn.10009f14
mov ecx, dword [ebp - 0x6c8]
cmp ecx, dword [eax]
jle 0x1004a69c
mov dword [ebp - 0x6d0], 1
jmp 0x1004a6a3
and dword [ebp - 0x6d0], 0
cmp dword [ebp - 0x6d0], 1
je 0x1004a6b8
mov dword [ebp - 0x6d8], 1
jmp 0x1004a6bf
and dword [ebp - 0x6d8], 0
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10009f14
mov ecx, dword [ebp - 0x6d8]
imul ecx, dword [eax]
add ecx, 0xc63
jne 0x1004a6ef
mov eax, 0x4bae
test eax, eax
jne 0x1004a6ef
and dword [ebp - 0x6e8], 0
jmp 0x1004a6f9
mov dword [ebp - 0x6e8], 1
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10009f14
imul eax, dword [eax], 0x5da
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3ec]
imul eax, dword [ebp - 0x6e8]
inc eax
jne 0x1004a737
cmp dword [ebp - 0x3ec], 0
je 0x1004a75e
mov eax, 0xc3cc
test eax, eax
je 0x1004a75e
push 0
lea ecx, [ebp - 0xe34]
call fcn.10009f14
cmp dword [eax], 0
je 0x1004a75e
mov dword [ebp - 0x6f0], 1
jmp 0x1004a765
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0xbcc], eax
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xe34]
call fcn.10009ef8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b4]
call fcn.10009ef8
mov eax, 0xffff
mov word [ebp - 0x70], ax
mov dword [ebp - 0x1c], 0x8901f2c
mov dword [ebp - 0x1d4], 0x6121589a
mov dword [ebp - 0x6f8], 0x60fb
mov dword [ebp - 0xc64], 0x10008964
cmp dword [ebp - 0x6f8], 0x6421
jle 0x1004a8a9
and dword [ebp - 0x2b8], 0
jmp 0x1004a7e3
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0x28b9
jge 0x1004a8a9
and dword [ebp - 0x2c0], 0
jmp 0x1004a809
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x76b
jge 0x1004a8a4
and dword [ebp - 0x2a8], 0
jmp 0x1004a82f
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0x3bf7
jge 0x1004a89f
and dword [ebp - 0x2b0], 0
jmp 0x1004a851
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0xfdd
jge 0x1004a89d
mov eax, dword [ebp - 0x2a8]
and eax, dword [ebp - 0x2b0]
mov ecx, dword [ebp - 0x2b8]
imul ecx, dword [ebp - 0x2c0]
xor eax, ecx
cdq
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xb78], edx
push dword [ebp - 0xb78]
push dword [ebp - 0xb7c]
mov ecx, 0x10615bb8
call fcn.10015a07
jmp 0x1004a844
jmp 0x1004a822
jmp 0x1004a7fc
jmp 0x1004a7d6
mov dword [ebp - 0xbdc], 0x7a501900
mov dword [ebp - 4], 0x2b
cmp dword [ebp - 0x6f8], 0x5ea8
jge 0x1004a8d6
mov edx, dword [ebp - 0xc64]
mov ecx, 0x10615bb8
call fcn.10019d5c
jmp 0x1004a8f2
or dword [ebp - 4], 0xffffffff
jmp 0x1004a8fc
mov dword [ebp - 0x760], 0xc747cafd
mov dword [ebp - 0x64], 0
jmp 0x1004a916
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1004a92c
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x1b8], 0xfffffff9
jmp 0x1004a90f
mov dword [ebp - 0x64], 0
jmp 0x1004a93c
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x1004a952
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x10e8], 0
jmp 0x1004a935
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1004a980
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x1c], 0
jmp 0x1004a990
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x1004adae
mov dword [ebp - 0x1c0], 0x79e56e62
mov dword [ebp - 0x718], 0
mov dword [ebp - 0x2c8], 0
jmp 0x1004a9c7
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 2
jge 0x1004a9e3
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0xac0], 0x8880d0e1
jmp 0x1004a9ba
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1b8]
mov dword [ebp - 0xfcc], eax
cmp dword [ebp - 0x1c], 0
jne 0x1004aae3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1b8]
cmp eax, dword [ebp - 0x1c]
jge 0x1004aa1b
cmp dword [ebp - 0x1c], 0
jne 0x1004aa1b
and dword [ebp - 0x700], 0
jmp 0x1004aa25
mov dword [ebp - 0x700], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b8]
cmp dword [ebp - 0x700], eax
jle 0x1004aa46
mov dword [ebp - 0x708], 1
jmp 0x1004aa4d
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x708]
inc eax
cmp eax, dword [ebp - 0x1c0]
jg 0x1004aa68
mov dword [ebp - 0x710], 1
jmp 0x1004aa6f
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 0xf689
je 0x1004aa82
cmp dword [ebp - 0x1c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1b8]
mov dword [ebp - 0xefc], eax
mov dword [ebp - 0x718], 0x4d4b4b26
cmp dword [ebp - 0x718], 0
jbe 0x1004aab4
mov dword [ebp - 0x720], 1
jmp 0x1004aabb
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1b8]
add eax, dword [ebp - 0x720]
jne 0x1004aae3
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1b8], 0
jne 0x1004aae3
and dword [ebp - 0x728], 0
jmp 0x1004aaed
mov dword [ebp - 0x728], 1
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jne 0x1004ab14
cmp dword [ebp - 0x1c0], 0
jne 0x1004ab14
and dword [ebp - 0x730], 0
jmp 0x1004ab1e
mov dword [ebp - 0x730], 1
cmp dword [ebp - 0x730], 0x1e5de2ca
jle 0x1004ab3b
xor eax, eax
inc eax
je 0x1004ab3b
mov dword [ebp - 0x738], 1
jmp 0x1004ab42
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x738]
jle 0x1004ab5b
xor eax, eax
inc eax
jne 0x1004ab5b
and dword [ebp - 0x740], 0
jmp 0x1004ab65
mov dword [ebp - 0x740], 1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x1c0]
jle 0x1004ab89
mov dword [ebp - 0x748], 1
jmp 0x1004ab90
and dword [ebp - 0x748], 0
cmp dword [ebp - 0x748], 0x5fc0
jl 0x1004aba9
xor eax, eax
jne 0x1004aba9
and dword [ebp - 0xbd4], 0
jmp 0x1004abb3
mov dword [ebp - 0xbd4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1b8]
mov dword [ebp - 0x1060], eax
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1b8]
cmp ecx, dword [ebp + eax - 0x10e8]
jl 0x1004abee
mov dword [ebp - 0x750], 1
jmp 0x1004abf5
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x750]
sub eax, 6
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xac0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac0]
cmp eax, dword [ebp - 0x1c0]
jl 0x1004ac2c
mov dword [ebp - 0x758], 1
jmp 0x1004ac33
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x760], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1d4]
imul ecx, dword [ebp - 0x760]
cmp ecx, dword [ebp + eax*4 - 0x1b8]
jne 0x1004ac64
mov dword [ebp - 0x768], 1
jmp 0x1004ac6b
and dword [ebp - 0x768], 0
cmp dword [ebp - 0x768], 3
jne 0x1004ac80
mov dword [ebp - 0x770], 1
jmp 0x1004ac87
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x770]
neg eax
jne 0x1004acaa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xac0], 0
jne 0x1004acaa
and dword [ebp - 0x778], 0
jmp 0x1004acb4
mov dword [ebp - 0x778], 1
cmp dword [ebp - 0x778], 0xfffb
je 0x1004accc
mov dword [ebp - 0x780], 1
jmp 0x1004acd3
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1b8]
cmp dword [ebp - 0x780], eax
je 0x1004acf1
mov dword [ebp - 0xcd8], 1
jmp 0x1004acf8
and dword [ebp - 0xcd8], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1b8]
mov dword [ebp - 0xf04], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xfd4], eax
xor eax, eax
jne 0x1004ad2e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xac0], 0
jne 0x1004ad2e
and dword [ebp - 0x788], 0
jmp 0x1004ad38
mov dword [ebp - 0x788], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x10e8]
cmp dword [ebp - 0x788], eax
jle 0x1004ad59
mov dword [ebp - 0x790], 1
jmp 0x1004ad60
and dword [ebp - 0x790], 0
cmp dword [ebp - 0x790], 1
jge 0x1004ad75
mov dword [ebp - 0x798], 1
jmp 0x1004ad7c
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0xbdc]
cmp eax, dword [ebp - 0x798]
jle 0x1004ad96
mov dword [ebp - 0x7a0], 1
jmp 0x1004ad9d
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x1d4], eax
jmp 0x1004a989
or dword [ebp - 0x17c], 0xffffffff
cmp dword [ebp + 0x10], 0
jbe 0x1004add6
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1004add1
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x70], ax
jmp 0x1004bfbf
mov dword [ebp - 0x34], 0xe1ca2961
push 3
lea ecx, [ebp - 0x1b0]
call fcn.10009e9c
mov dword [ebp - 4], 0x2d
mov dword [ebp - 0x180], 0x41791e6e
mov dword [ebp - 0x198], 4
mov dword [ebp - 0x2d0], 0
jmp 0x1004ae1e
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 3
jge 0x1004ae40
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
mov dword [eax], 0x96673e7e
jmp 0x1004ae11
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
cmp dword [eax], 0
je 0x1004ae84
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
mov esi, dword [eax]
add esi, 0xab5c
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
cmp esi, dword [eax]
jge 0x1004ae84
mov dword [ebp - 0x7a8], 1
jmp 0x1004ae8b
and dword [ebp - 0x7a8], 0
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
mov ecx, dword [ebp - 0x7a8]
cmp ecx, dword [eax]
jle 0x1004aeae
mov dword [ebp - 0xc74], 1
jmp 0x1004aeb5
and dword [ebp - 0xc74], 0
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x180]
jle 0x1004aed9
mov dword [ebp - 0x7b0], 1
jmp 0x1004aee0
and dword [ebp - 0x7b0], 0
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
mov ecx, dword [ebp - 0x7b0]
cmp ecx, dword [eax]
jg 0x1004af03
mov dword [ebp - 0x7b8], 1
jmp 0x1004af0a
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x7b8]
jle 0x1004af21
mov dword [ebp - 0x7c0], 1
jmp 0x1004af28
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x7c0], eax
jne 0x1004af3f
mov dword [ebp - 0x7c8], 1
jmp 0x1004af46
and dword [ebp - 0x7c8], 0
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
mov eax, dword [eax]
cmp eax, dword [ebp - 0x7c8]
jle 0x1004af69
mov dword [ebp - 0x7d0], 1
jmp 0x1004af70
and dword [ebp - 0x7d0], 0
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
mov esi, dword [ebp - 0x7d0]
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
cmp esi, dword [eax]
jne 0x1004afb2
mov dword [ebp - 0x7d8], 1
jmp 0x1004afb9
and dword [ebp - 0x7d8], 0
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
mov ecx, dword [ebp - 0x7d8]
cmp ecx, dword [eax]
je 0x1004afdc
mov dword [ebp - 0xbe4], 1
jmp 0x1004afe3
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xf0c], eax
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
mov esi, eax
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
mov eax, dword [eax]
cmp eax, dword [esi]
jg 0x1004b01a
mov dword [ebp - 0x7e0], 1
jmp 0x1004b021
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x1098], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xf14], eax
push 2
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
mov esi, eax
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x1004b43d
mov dword [ebp - 0x2e0], 0xf4a9
mov dword [ebp - 0x180], 0
jmp 0x1004b08e
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x34
jle 0x1004b43b
push 3
lea ecx, [ebp - 0xd5c]
call fcn.10009e9c
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x84], 0
jmp 0x1004b0c5
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1004b0e1
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x1118], 0xffffffff
jmp 0x1004b0b8
mov dword [ebp - 0x84], 0
jmp 0x1004b0fa
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1004b11c
push dword [ebp - 0x84]
lea ecx, [ebp - 0xd5c]
call fcn.10009f14
mov dword [eax], 0x64f5774d
jmp 0x1004b0ed
mov dword [ebp - 0x34], 0
jmp 0x1004b12c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x20
jle 0x1004b427
mov dword [ebp - 0x7e8], 0xfffffff8
push 4
lea ecx, [ebp - 0xa98]
call fcn.10009e9c
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x2d8], 0
jmp 0x1004b174
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 4
jge 0x1004b196
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0xa98]
call fcn.10009f14
mov dword [eax], 0xfffffff6
jmp 0x1004b167
push 1
lea ecx, [ebp - 0xd5c]
call fcn.10009f14
mov esi, dword [ebp - 0x198]
push 2
lea ecx, [ebp - 0xa98]
call fcn.10009f14
cmp dword [eax], esi
je 0x1004b1c6
mov dword [ebp - 0xcfc], 1
jmp 0x1004b1cd
and dword [ebp - 0xcfc], 0
push 2
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
push 1
lea ecx, [ebp - 0x1b0]
call fcn.10009f14
push 2
lea ecx, [ebp - 0xa98]
call fcn.10009f14
cmp dword [eax], 0x2777
jg 0x1004b208
mov dword [ebp - 0xbec], 1
jmp 0x1004b20f
and dword [ebp - 0xbec], 0
push 0
lea ecx, [ebp - 0xa98]
call fcn.10009f14
mov eax, 0x2f10
cmp eax, 0xba6e
jle 0x1004b23d
cmp dword [ebp - 0x7e8], 0
je 0x1004b23d
mov dword [ebp - 0x7f8], 1
jmp 0x1004b244
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x7f0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x7f0]
mov dword [ebp + eax - 0x1118], ecx
mov eax, dword [ebp - 0x7f0]
add eax, 0x5069097d
cmp eax, dword [ebp - 0x7f8]
je 0x1004b282
mov dword [ebp - 0x800], 1
jmp 0x1004b289
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
je 0x1004b2aa
mov dword [ebp - 0x808], 1
jmp 0x1004b2b1
and dword [ebp - 0x808], 0
cmp dword [ebp - 0x808], 0xfffffff6
jne 0x1004b2c6
mov dword [ebp - 0x810], 1
jmp 0x1004b2cd
and dword [ebp - 0x810], 0
mov esi, dword [ebp - 0x810]
inc esi
push 0
lea ecx, [ebp - 0xa98]
call fcn.10009f14
sub esi, dword [eax]
sub esi, 0x1510
mov dword [ebp - 0x414], esi
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
cmp eax, dword [ebp - 0x2e0]
je 0x1004b38d
cmp dword [ebp - 0x2e0], 0xfffffffc
ja 0x1004b328
mov eax, 0xddaf
test eax, eax
jne 0x1004b328
and dword [ebp - 0x818], 0
jmp 0x1004b332
mov dword [ebp - 0x818], 1
cmp dword [ebp - 0x818], 1
jle 0x1004b347
mov dword [ebp - 0x820], 1
jmp 0x1004b34e
and dword [ebp - 0x820], 0
push 1
lea ecx, [ebp - 0xd5c]
call fcn.10009f14
mov ecx, dword [ebp - 0x820]
cmp ecx, dword [eax]
jl 0x1004b371
mov dword [ebp - 0x828], 1
jmp 0x1004b378
and dword [ebp - 0x828], 0
cmp dword [ebp - 0x828], 0
jbe 0x1004b38d
mov dword [ebp - 0x830], 1
jmp 0x1004b394
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x414]
cmp dword [ebp - 0x830], eax
jg 0x1004b3ae
mov dword [ebp - 0x838], 1
jmp 0x1004b3b5
and dword [ebp - 0x838], 0
cmp dword [ebp - 0x838], 0x911f
jl 0x1004b3cd
mov dword [ebp - 0x840], 1
jmp 0x1004b3d4
and dword [ebp - 0x840], 0
push 3
lea ecx, [ebp - 0xa98]
call fcn.10009f14
mov eax, dword [eax]
cmp eax, dword [ebp - 0x840]
jne 0x1004b3f7
mov dword [ebp - 0x848], 1
jmp 0x1004b3fe
and dword [ebp - 0x848], 0
push 1
lea ecx, [ebp - 0xa98]
call fcn.10009f14
mov ecx, dword [ebp - 0x848]
mov dword [eax], ecx
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xa98]
call fcn.10009ef8
jmp 0x1004b125
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xd5c]
call fcn.10009ef8
jmp 0x1004b081
jmp 0x1004b48f
mov dword [ebp - 0xc84], 0xfd363bf1
mov dword [ebp - 0x2e8], 0
jmp 0x1004b460
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 1
jge 0x1004b47c
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0xbf4], 1
jmp 0x1004b453
mov eax, dword [ebp - 0xc84]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbf4], eax
mov dword [ebp - 0x34], 0xfffffff5
jmp 0x1004b49f
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x2d
jg 0x1004b4c7
mov dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x850]
dec eax
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x198], eax
jmp 0x1004b498
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b0]
call fcn.10009ef8
mov dword [ebp - 0xd0c], 0x7f6af112
mov dword [ebp - 0xd08], 0x7f6af112
mov dword [ebp - 0xd04], 0x7f6af112
mov dword [ebp - 0xd00], 0x7f6af112
mov dword [ebp - 0x858], 1
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xd0c], 0xfffffff7
jmp 0x1004b536
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd0c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xd0c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd0c], 0x1d
jge 0x1004b571
mov byte [ebp - 0x15f], 0
movzx eax, byte [ebp - 0x15f]
test eax, eax
je 0x1004b56f
push 0
push 0xa72
push 0x1470
push 0x245c
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
jmp 0x1004b51b
mov eax, dword [ebp - 0x858]
dec eax
mov dword [ebp - 0x858], eax
mov eax, dword [0x10616eb0]
and eax, 1
jne 0x1004b5b5
mov eax, dword [0x10616eb0]
or eax, 1
mov dword [0x10616eb0], eax
mov dword [ebp - 4], 0x30
mov ecx, 0x10616ed8
call fcn.10015d5b
push 0x1006ee14
call fcn.10056536
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0x1bc], 0x3c15d0d6
push 3
lea ecx, [ebp - 0xcc0]
call fcn.10009e9c
mov dword [ebp - 4], 0x31
mov dword [ebp - 0xce0], 0xa973
mov dword [ebp - 0xfdc], 1
mov dword [ebp - 0x2f0], 0
jmp 0x1004b60a
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 3
jge 0x1004b629
push dword [ebp - 0x2f0]
lea ecx, [ebp - 0xcc0]
call fcn.10009f14
or dword [eax], 0xffffffff
jmp 0x1004b5fd
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jne 0x1004b647
cmp dword [ebp - 0x1bc], 0
je 0x1004b68b
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xf1c], eax
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0xdc]
jne 0x1004b66d
mov dword [ebp - 0x860], 1
jmp 0x1004b674
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x860]
sub eax, dword [ebp - 0xdc]
sub eax, 3
cmp eax, dword [ebp - 0x1bc]
jne 0x1004b69d
mov eax, 0x16501874
test eax, eax
jne 0x1004b69d
and dword [ebp - 0x868], 0
jmp 0x1004b6a7
mov dword [ebp - 0x868], 1
cmp dword [ebp - 0x868], 0
je 0x1004b6bc
mov dword [ebp - 0x870], 1
jmp 0x1004b6c3
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
sub eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xdc]
sub ecx, eax
cmp ecx, dword [ebp - 0xdc]
jle 0x1004b706
cmp dword [ebp - 0xdc], 0
je 0x1004b706
push 2
lea ecx, [ebp - 0xcc0]
call fcn.10009f14
cmp dword [eax], 0
je 0x1004b706
mov dword [ebp - 0x878], 1
jmp 0x1004b70d
and dword [ebp - 0x878], 0
push 0
lea ecx, [ebp - 0xcc0]
call fcn.10009f14
mov esi, dword [ebp - 0x878]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0xcc0]
call fcn.10009f14
cmp esi, dword [eax]
jg 0x1004b73f
mov dword [ebp - 0x880], 1
jmp 0x1004b746
and dword [ebp - 0x880], 0
cmp dword [ebp - 0x880], 0xfffc
jb 0x1004b75e
mov dword [ebp - 0x888], 1
jmp 0x1004b765
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0xce0], eax
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1004b78f
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc0]
call fcn.10009ef8
movzx eax, byte [0x10616d0a]
test eax, eax
je 0x1004ba84
mov ecx, 0x10616ed8
call fcn.10050142
movzx eax, al
test eax, eax
jne 0x1004ba84
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x43c]
push eax
mov ecx, 0x10616ed8
call fcn.10015e20
mov dword [ebp - 0x11c], 7
mov dword [ebp - 0x8a8], 1
push 1
lea ecx, [ebp - 0xe4c]
call fcn.10009e9c
mov dword [ebp - 4], 0x32
mov dword [ebp - 0x2f8], 0
jmp 0x1004b81b
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 1
jge 0x1004b83d
push dword [ebp - 0x2f8]
lea ecx, [ebp - 0xe4c]
call fcn.10009f14
mov dword [eax], 0x6ec6e54e
jmp 0x1004b80e
mov dword [ebp - 0x11c], 0
jmp 0x1004b856
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffeb
jl 0x1004ba3d
mov dword [ebp - 0x1dc], 0x506d4441
mov dword [ebp - 0x300], 0
jmp 0x1004b886
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 4
jge 0x1004b8a2
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0x1160], 7
jmp 0x1004b879
mov dword [ebp - 0x1dc], 0xfffffff4
jmp 0x1004b8bb
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0xd
jl 0x1004ba38
mov dword [ebp - 0x188], 0xfffffffc
mov dword [ebp - 0xc04], 0xe7790660
mov dword [ebp - 0x188], 0xfffffff1
jmp 0x1004b8f5
cmp dword [ebp - 0x188], 0x15
jge 0x1004ba33
mov dword [ebp - 0x8a0], 0xa955
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x8a0]
je 0x1004b926
mov dword [ebp - 0x890], 1
jmp 0x1004b92d
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x890]
add eax, 5
push 7
pop ecx
sub ecx, eax
je 0x1004b952
cmp dword [ebp - 0x188], 0
je 0x1004b952
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x898], eax
je 0x1004b973
jmp 0x1004b8ae
jmp 0x1004b849
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe4c]
call fcn.10009ef8
lea eax, [ebp - 0xfe4]
push eax
mov ecx, 0x10616ed8
call fcn.10015e12
push eax
lea ecx, [ebp - 0x43c]
call fcn.10015eec
movzx eax, al
test eax, eax
je 0x1004ba84
lea ecx, [ebp - 0x43c]
call fcn.1005014b
mov eax, dword [eax + 4]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x3c], 0xe8e56f9b
mov dword [ebp - 0x45c], 0xa6f944dc
push 2
lea ecx, [ebp - 0xab8]
call fcn.10009e9c
mov dword [ebp - 4], 0x33
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x8c], 0
jmp 0x1004bacc
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1004bae8
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x1a4], 0xbdde0bcd
jmp 0x1004babf
mov dword [ebp - 0x8c], 0
jmp 0x1004bb01
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1004bb23
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xab8]
call fcn.10009f14
mov dword [eax], 0x552d
jmp 0x1004baf4
mov dword [ebp - 0x3c], 0
jmp 0x1004bb33
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jg 0x1004bb8a
mov dword [ebp - 0x308], 1
mov dword [ebp - 0x308], 0
jmp 0x1004bb5c
mov eax, dword [ebp - 0x308]
dec eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jl 0x1004bb88
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x1004bb86
push 0
push 0
push 0xddf
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x1004bb4f
jmp 0x1004bb2c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a4], 0
je 0x1004be44
mov dword [ebp - 0x1e4], 0x6b6f
mov dword [ebp - 0xc0c], 0x294b
mov dword [ebp - 0x3c], 1
jmp 0x1004bbc2
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 5
jne 0x1004bbde
mov dword [ebp - 0xcc8], 0xfffffff6
mov dword [ebp - 0xcc8], 0xfffffff9
jmp 0x1004bbbb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a4]
mov dword [ebp - 0xf2c], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x1090], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a4]
mov dword [ebp - 0xf34], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e4]
cmp ecx, dword [ebp + eax - 0x1a4]
jne 0x1004bc31
mov dword [ebp - 0x444], 1
jmp 0x1004bc38
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0xc0c]
cmp dword [ebp - 0x444], eax
jg 0x1004bc52
mov dword [ebp - 0x44c], 1
jmp 0x1004bc59
and dword [ebp - 0x44c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a4]
cmp dword [ebp - 0x44c], eax
jl 0x1004bc7a
mov dword [ebp - 0x454], 1
jmp 0x1004bc81
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x45c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a4]
add eax, dword [ebp - 0x45c]
cmp dword [ebp - 0x3c], eax
jle 0x1004bcb1
mov dword [ebp - 0x464], 1
jmp 0x1004bcb8
and dword [ebp - 0x464], 0
push 1
lea ecx, [ebp - 0xab8]
call fcn.10009f14
mov ecx, dword [ebp - 0x464]
cmp ecx, dword [eax]
jne 0x1004bcdb
mov dword [ebp - 0x190], 0
jmp 0x1004be5d
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jg 0x1004be87
push dword [ebp - 0x190]
lea ecx, [ebp - 0xab8]
call fcn.10009f14
cmp dword [eax], 0
je 0x1004be7e
jmp 0x1004be87
mov dword [ebp - 0x3c], 1
jmp 0x1004be50
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xab8]
call fcn.10009ef8
cmp dword [ebp - 0x17c], 0xffffffff
jne 0x1004bfbf
mov ecx, 0x10616ed8
call fcn.1005018f
mov ecx, dword [ebp - 0xe4]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x10616ed8
call fcn.10050193
and dword [ebp - 0x174], 0
jmp 0x1004bed7
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x174]
cmp ecx, dword [eax + 0x18]
jae 0x1004bfbf
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x184]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x174]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0
je 0x1004bfba
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [ebp - 0x184]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1150]
call fcn.10020f70
mov dword [ebp - 4], 0x34
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1150]
call fcn.1003a3dd
mov dword [ebp - 0x4c4], eax
movzx eax, byte [0x10616d0a]
test eax, eax
je 0x1004bf68
jmp 0x1004beca
mov dword [ebp - 0xfec], 0
mov dword [ebp - 0xf3c], 0
mov dword [ebp - 0x1070], 0xfffffffb
mov dword [ebp - 0xf44], 0
mov dword [ebp - 0xff4], 0x4e6d4f28
mov dword [ebp - 0xf4c], 0
mov dword [ebp - 0x10a4], 9
mov dword [ebp - 0xf54], 0xffffffff
mov dword [ebp - 0xffc], 0xfe30f587
mov dword [ebp - 0xf5c], 0x97412df3
mov dword [ebp - 0x4cc], 0xf4c59cdc
mov byte [ebp - 0x163], 0
movzx eax, byte [ebp - 0x163]
test eax, eax
je 0x1004c054
push 0x77e
push 0x14ce
push 0xde6
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp + 0x10], 0
jne 0x1004c08d
cmp dword [ebp - 0x17c], 0xffffffff
je 0x1004c08d
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x184]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x17c]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x70], ax
mov dword [ebp - 0x1ec], 1
mov dword [ebp - 0xc14], 0xfffffff9
mov dword [ebp - 0x1ec], 0
jmp 0x1004c0ba
cmp dword [ebp - 0x1ec], 3
jl 0x1004c326
mov dword [ebp - 0x9c], 0x633efc07
mov dword [ebp - 0x13c], 0x49cec79e
mov dword [ebp - 0x524], 0xffffffff
mov dword [ebp - 0x52c], 0x40a16501
mov dword [ebp - 0xb08], 0
push 1
lea ecx, [ebp - 0xe58]
call fcn.10009e9c
mov dword [ebp - 4], 0x3c
mov dword [ebp - 0x320], 0
jmp 0x1004c71c
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 1
jge 0x1004c73e
push dword [ebp - 0x320]
lea ecx, [ebp - 0xe58]
call fcn.10009f14
mov dword [eax], 0x6cbcb1a7
jmp 0x1004c70f
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x9c]
je 0x1004c758
mov dword [ebp - 0x554], 1
jmp 0x1004c75f
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x9c], 0
je 0x1004c78b
imul eax, dword [ebp - 0x9c], 0x9cf1
add eax, 0x9fcf
cmp eax, dword [ebp - 0x9c]
jg 0x1004c78b
mov dword [ebp - 0x514], 1
jmp 0x1004c792
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0xffffffff
jne 0x1004c7a7
mov dword [ebp - 0x51c], 1
jmp 0x1004c7ae
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0
jne 0x1004c7db
mov dword [ebp - 0x534], 1
jmp 0x1004c7e2
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x534], eax
jge 0x1004c7fc
mov dword [ebp - 0x53c], 1
jmp 0x1004c803
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x53c]
je 0x1004c829
mov dword [ebp - 0x544], 1
jmp 0x1004c830
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x544], eax
jl 0x1004c84a
mov dword [ebp - 0x54c], 1
jmp 0x1004c851
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
sub eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x554]
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0x13c], 0
jmp 0x1004c882
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jge 0x1004c8a4
push dword [ebp - 0x13c]
lea ecx, [ebp - 0xe58]
call fcn.10009f14
mov dword [eax], 0xe77e815f
jmp 0x1004c875
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe58]
call fcn.10009ef8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret