Function at 0x100095d2
Capabilities:
Check os version
Connect pipe
Create process on windows
Create thread
Encode data using xor
Set registry value

Disassembly:
mov eax, 0x10066d37
call fcn.10066514
sub esp, 0x9dc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x8c], ecx
push edi
inc ebx
mov byte [ebp - 0x6d], dl
push ebx
lea ecx, [ebp - 0x4a8]
call fcn.100165ef
xor edx, edx
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x18], edx
jmp 0x10009618
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb0], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000960b
mov dword [ebp - 0x18], edx
mov edi, 0x61949f0d
jmp 0x10009637
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4a8]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10009628
mov eax, dword [ebp - 0xac]
xor ecx, ecx
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0xac]
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
push 0xffffffffffffffff
neg eax
cmp eax, 0x2d8cb4c2
mov eax, dword [ebp - 0xac]
setge cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
xor ecx, ecx
cmp eax, 0x9f58
pop eax
setle cl
cmp ecx, dword [ebp - 0xac]
jge 0x100096b0
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x10009770
push 0x6a0
push 0x1b32
push edx
call esi
xor edx, edx
jmp 0x10009770
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x68], 2
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], edx
jmp 0x10009767
mov dword [ebp - 0x34], 0x74db9bec
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xb0], edx
jne 0x10009747
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xb0], ebx
jl 0x10009703
mov eax, dword [ebp - 0x18]
mov ecx, edx
cmp dword [ebp + eax*4 - 0xb0], edx
je 0x10009705
mov ecx, ebx
xor eax, eax
cmp ecx, 0x7fb07d0
setne al
xor ecx, ecx
cmp eax, 0xf392
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, 0xfffffff7
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, 0xffffed51
setg cl
sub eax, ecx
add eax, dword [ebp - 0xb0]
jne 0x10009741
mov eax, dword [ebp - 0xac]
xor edx, edx
mov eax, edx
jmp 0x10009749
mov eax, ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edx
jne 0x1000975f
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xb0], edx
mov eax, edx
je 0x10009761
mov eax, ebx
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100096c9
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], edx
jl 0x1000978b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4a8]
cmp dword [eax + ecx*4], edx
jne 0x1000978b
dec dword [ebp - 0x20]
jns 0x10009778
lea ecx, [ebp - 0x4a8]
call fcn.1001715c
push ebx
lea ecx, [ebp - 0x4c0]
call fcn.100165ef
xor edx, edx
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x18], edx
jmp 0x100097bd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa8], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100097b0
mov dword [ebp - 0x18], edx
jmp 0x100097d7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100097c8
mov eax, dword [ebp - 0xa4]
xor ecx, ecx
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0xa4]
neg eax
cmp eax, 0x2d8cb4c2
mov eax, dword [ebp - 0xa4]
setge cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
xor ecx, ecx
cmp eax, 0x9f58
setle cl
cmp ecx, dword [ebp - 0xa4]
jge 0x10009847
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x1000990a
push 0x6a0
push 0x1b32
push edx
call esi
xor edx, edx
jmp 0x1000990a
mov dword [ebp - 0x18], 0xfffffffb
or eax, 0xffffffff
mov dword [ebp - 0x68], 2
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], edx
jmp 0x10009901
mov dword [ebp - 0x34], 0x74db9bec
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xa8], edx
jne 0x100098e1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xa8]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xa8], ebx
jl 0x1000989d
mov eax, dword [ebp - 0x18]
mov ecx, edx
cmp dword [ebp + eax*4 - 0xa8], edx
je 0x1000989f
mov ecx, ebx
xor eax, eax
cmp ecx, 0x7fb07d0
setne al
xor ecx, ecx
cmp eax, 0xf392
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, 0xfffffff7
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, 0xffffed51
setg cl
sub eax, ecx
add eax, dword [ebp - 0xa8]
jne 0x100098db
mov eax, dword [ebp - 0xa4]
xor edx, edx
mov eax, edx
jmp 0x100098e3
mov eax, ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edx
jne 0x100098f9
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xa8], edx
mov eax, edx
je 0x100098fb
mov eax, ebx
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10009863
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], edx
jl 0x10009925
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c0]
cmp dword [eax + ecx*4], edx
jne 0x10009925
dec dword [ebp - 0x20]
jns 0x10009912
lea ecx, [ebp - 0x4c0]
call fcn.1001715c
push 2
lea ecx, [ebp - 0x4d8]
call fcn.100165ef
xor edx, edx
push 3
mov dword [ebp - 0x18], edx
pop ecx
jmp 0x10009958
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c4], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10009947
mov dword [ebp - 0x18], edx
jmp 0x10009975
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4d8]
mov dword [eax + ecx*4], 0xecb45710
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10009962
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x10009997
push edx
push 0x221a
push 0x19c9
push edx
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor edx, edx
mov esi, dword [ebp - 0x4d8]
mov dword [esi + 4], edx
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x100099b2
push edx
call dword [sym.imp.USER32.dll_RegisterClassA]
xor edx, edx
mov ecx, dword [ebp - 0x5c4]
mov eax, dword [esi + 4]
inc dword [esi + 4]
cmp dword [esi + 4], 2
mov dword [ebp + eax*4 - 0x5c4], ecx
jle 0x100099a0
lea ecx, [ebp - 0x4d8]
call fcn.1001715c
push 4
pop eax
push eax
lea ecx, [ebp - 0x4f0]
call fcn.100165ef
mov dword [ebp - 0x34], 0x6dfc9b99
or esi, 0xffffffff
mov dword [ebp - 0x4c], esi
xor edx, edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x30], 0x9c1477a1
push 4
mov dword [ebp - 0x20], edx
pop eax
cmp dword [ebp - 0x20], eax
jge 0x10009a1f
push eax
pop edi
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4f0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10009a0b
mov ecx, dword [ebp - 0x4f0]
mov dword [ebp - 0x68], 0xb4f5ac3d
mov dword [ecx + 4], 0xf
mov eax, ebx
mov dword [ebp - 0x48], 0xc8f0d071
sub eax, dword [ecx + 4]
cmp dword [ebp - 0x68], eax
sbb eax, eax
inc eax
imul eax, dword [ecx + 4]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x48], edx
jne 0x10009a59
dec dword [ecx + 4]
cmp dword [ecx + 4], esi
jne 0x10009a33
inc dword [ebp - 0x30]
lea ecx, [ebp - 0x4f0]
call fcn.1001715c
push ebx
lea ecx, [ebp - 0x4fc]
call fcn.100165ef
push 3
pop esi
xor eax, eax
lea ecx, [ebp - 0x22c]
push esi
mov dword [ebp - 4], eax
call fcn.100165ef
push 2
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], bl
call fcn.100165ef
or eax, 0xffffffff
xor edx, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x3c], 0x6a7f4ea1
mov dword [ebp - 0x2c], 0xf5e3d1aa
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x44], 0x800f4d4e
mov dword [ebp - 0x18], edx
jmp 0x10009acf
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x22c]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10009ac0
mov dword [ebp - 0x18], edx
jmp 0x10009ae8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x164]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10009ad9
mov eax, dword [ebp - 0x164]
or edi, 0xffffffff
mov dword [eax], 2
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x4c], 0x2466e9f0
mov dword [ebp - 0x34], 0x11600d54
mov dword [ebp - 0x48], 0xc4e2bf5
mov dword [ebp - 0x20], edx
jmp 0x10009bd2
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x4c], 0x1b6fd43d
mov dword [ebp - 0x4c], 0x289fff12
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x14], edx
jmp 0x10009b4f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x768], 0x4709ba87
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10009b3e
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
dec dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
cmovl edx, ebx
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x48]
jne 0x10009b7e
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x764], eax
je 0x10009b80
mov esi, ebx
mov eax, dword [ebp - 0x164]
xor ebx, ebx
mov dword [ebp - 0x30], edi
push 4
mov ecx, dword [eax]
mov eax, dword [ebp - 0x22c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
pop eax
setge bl
xor edx, edx
sub ebx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
imul ebx, ecx
test ebx, ebx
jne 0x10009bc7
cmp dword [ebp - 0x20], edx
jne 0x10009bc7
mov eax, edx
inc ebx
jmp 0x10009bcc
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x10009b21
mov eax, dword [ebp - 0x164]
dec dword [eax]
jns 0x10009afd
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov eax, dword [ebp - 0x22c]
mov edi, 0x61949f0d
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x164]
mov edx, dword [eax]
mov eax, dword [ebp - 0x14]
cmp eax, edx
setle cl
cmp ecx, edx
jle 0x10009c1d
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x10009c1f
mov esi, ebx
mov eax, dword [ebp - 0x44]
xor edx, edx
mov ecx, dword [ebp - 0x22c]
cmp eax, dword [ecx]
mov eax, dword [ebp - 0x164]
setl dl
sub edx, 0x832c1a4
imul edx, dword [ecx + 4]
xor ecx, ecx
imul edx, esi
cmp edx, 0x43c7d757
setge cl
add ecx, dword [eax]
jne 0x10009d2d
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10009d2d
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x30], 0x7dd1a1fb
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], eax
jl 0x10009c9f
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10009c9a
push 0x13e5
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10009c84
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
push 5
pop ecx
sub eax, ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x164]
imul ecx, dword [eax]
xor eax, eax
cmp ecx, ebx
mov ecx, dword [ebp - 0x18]
setg al
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [ebp - 0x18]
jl 0x10009cfd
mov edx, ebx
cmp dword [ebp - 0x30], eax
jne 0x10009cff
mov edx, eax
mov eax, dword [ebp - 0x164]
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x30]
setl cl
add eax, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10009d28
cmp dword [ebp - 0x18], eax
je 0x10009d28
mov eax, ebx
mov dword [ebp - 0x34], eax
jmp 0x10009d36
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x164]
call fcn.1001715c
xor eax, eax
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], al
call fcn.1001715c
mov dword [ebp - 0x38], 0xfffffffe
lea ecx, [ebp - 0x508]
push 2
call fcn.100165ef
push 2
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 2
call fcn.100165ef
xor edx, edx
push 2
mov dword [ebp - 0x18], edx
pop esi
jmp 0x10009d93
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x508]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10009d80
mov dword [ebp - 0x18], edx
jmp 0x10009dac
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x52c]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10009d9d
mov ecx, dword [ebp - 0x52c]
mov dword [ecx], edx
mov edx, dword [ebp - 0x508]
mov eax, dword [ecx]
mov dword [edx + eax*4], 0x4c506d44
inc dword [ecx]
cmp dword [ecx], esi
jl 0x10009dbf
lea ecx, [ebp - 0x52c]
call fcn.1001715c
xor eax, eax
lea ecx, [ebp - 0x508]
mov byte [ebp - 4], al
call fcn.1001715c
mov dword [ebp - 0x38], 0xd15de05d
lea ecx, [ebp - 0x46c]
or eax, 0xffffffff
mov dword [ebp - 0x30], 0x7f37c04c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
push ebx
call fcn.100165ef
xor eax, eax
mov dword [ebp - 0x34], 0x82a6f944
mov dword [ebp - 0x20], eax
jmp 0x10009e2d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x46c]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x10009e1a
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setne dl
sub edx, esi
jne 0x10009e6d
mov eax, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x46c]
mov dword [eax], ecx
xor eax, eax
cmp ecx, 9
lea ecx, [ebp - 0x46c]
setne al
mov dword [ebp - 0x34], eax
call fcn.1001715c
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10009ead
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb8], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10009ea0
mov dword [ebp - 0x30], 0xfffffffc
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x20], 0xdfe012d2
push 2
call fcn.100165ef
xor edx, edx
push 2
mov dword [ebp - 0x18], edx
pop esi
jmp 0x10009eeb
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x394]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10009ed8
mov dword [ebp - 0x18], edx
jmp 0x10009f06
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x77c], 0xed40a165
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10009ef5
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x10009f1a
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
sub eax, edx
neg eax
sbb eax, eax
inc eax
jne 0x10009f3d
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x10009f3f
mov ecx, ebx
mov eax, dword [ebp - 0x394]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x394]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x77c], eax
call fcn.1001715c
xor edx, edx
mov dword [ebp - 0x18], edx
jmp 0x10009f72
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4fc]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10009f63
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x14], edx
jmp 0x10009fa3
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x10009fa0
push edx
push 0xca
push 0x1336
push 0x2be
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor edx, edx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jge 0x10009f7f
mov eax, edx
cmp dword [ebp - 0x14], edx
je 0x10009fb2
mov eax, ebx
add eax, 0xfffffe6c
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0xb4]
neg eax
cmp eax, 0x2d8cb4c2
mov eax, dword [ebp - 0xb4]
setge cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
xor ecx, ecx
cmp eax, 0x9f58
setle cl
cmp ecx, dword [ebp - 0xb4]
jge 0x1000a450
mov dword [ebp - 0x4c], 0x6240
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1000a04c
push edx
push 0x203a
push 0xb9f
push 0x9d
push 0xe35
push 0x125f
push 0x255
push 0x11be
push 0x1d52
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor edx, edx
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1000a061
push edx
push 0xf65
call dword [sym.imp.USER32.dll_ValidateRect]
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x54c], eax
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x540], eax
push 3
call fcn.100165ef
push 3
pop eax
xor edx, edx
mov byte [ebp - 4], al
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
jge 0x1000a0b4
push eax
pop edx
push 5
pop edi
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4e4]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1000a09e
xor edx, edx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x48], ecx
mov dword [ecx + 8], edx
mov dword [ebp - 0x34], 0x2211
cmp dword [ebp - 0x34], 0x10a7
jge 0x1000a227
lea eax, [ebp - 0x108]
push eax
push 0x100077e8
call fcn.1004ed2b
pop ecx
pop ecx
push dword [ebp - 0x108]
lea ecx, [ebp - 0x2cc]
call fcn.100165ef
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x108], eax
jle 0x1000a125
mov esi, dword [ebp - 0x2cc]
push esi
push 0x100077e8
call fcn.1004ed2b
pop ecx
pop ecx
push 4
pop eax
inc edi
add esi, eax
cmp edi, dword [ebp - 0x108]
jl 0x1000a10a
lea eax, [ebp - 0xf8]
push eax
push 0x100077e8
call fcn.1004ed2b
pop ecx
pop ecx
jmp 0x1000a202
dec eax
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0x220]
push eax
push 0x100077e8
call fcn.1004ed2b
pop ecx
pop ecx
cmp dword [ebp - 0x220], ebx
jne 0x1000a1b9
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x100]
push eax
push 0x10007828
call fcn.1004ed2b
mov ecx, dword [ebp - 0x100]
xorps xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
add esp, 0xc
mov esi, dword [ebp - 0x4c]
dec ecx
mov edi, dword [ebp - 0x50]
cmp ecx, dword [ebp - 0xe4]
jge 0x1000a1a8
mov eax, dword [ebp - 0x2cc]
mov eax, dword [eax + ecx*4]
cdq
add edi, eax
adc esi, edx
inc ecx
jmp 0x1000a18f
push esi
push edi
push 0x10007830
call fcn.1004f5a5
add esp, 0xc
jmp 0x1000a202
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x100]
push eax
push 0x10007838
call fcn.1004ed2b
mov ecx, dword [ebp - 0x100]
add esp, 0x10
dec ecx
cmp ecx, dword [ebp - 0xe4]
jge 0x1000a202
mov edx, dword [ebp - 0x2cc]
mov eax, dword [ebp - 0x200]
xor dword [edx + ecx*4], eax
inc ecx
cmp ecx, dword [ebp - 0xe4]
jl 0x1000a1f0
mov eax, dword [ebp - 0xf8]
test eax, eax
jne 0x1000a13d
dec eax
lea ecx, [ebp - 0x2cc]
mov dword [ebp - 0xf8], eax
call fcn.1001715c
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [ecx + 8]
push 3
pop edi
cmp dword [ebp + eax*4 - 0x54c], edx
jne 0x1000a242
inc dword [ecx + 8]
cmp dword [ecx + 8], edi
jle 0x1000a0c0
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1000a254
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor edx, edx
lea ecx, [ebp - 0x4e4]
mov byte [ebp - 4], dl
call fcn.1001715c
xor ecx, ecx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x1000a7af
lea ecx, [ebp - 0x820]
mov dword [ebp - 0x14], 0xfffffff8
push ecx
lea eax, [ebp - 0x810]
xorps xmm0, xmm0
push eax
push ecx
lea ecx, [ebp - 0x2d8]
movdqu xmmword [ebp - 0x820], xmm0
call fcn.1001662b
push 4
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x5dc]
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
push edi
call fcn.100165ef
push 5
pop eax
push 2
pop esi
push esi
lea ecx, [ebp - 0x7c4]
mov byte [ebp - 4], al
call fcn.100165ef
xor edx, edx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x18], edx
jmp 0x1000a2e6
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5dc]
mov dword [eax + ecx*4], 0x2885
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000a2d3
mov dword [ebp - 0x18], edx
jmp 0x1000a303
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x7c4]
mov dword [eax + ecx*4], 0xd0d42ad0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000a2f0
mov dword [ebp - 0x14], 0x10
jmp 0x1000a329
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1000a326
push edx
push edx
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
xor edx, edx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe6
jg 0x1000a311
push 3
mov dword [ebp - 0x14], edx
pop ecx
jmp 0x1000a407
mov dword [ebp - 0x18], 0xfffffff6
or eax, 0xffffffff
mov dword [ebp - 0x4c], 0x24f63abe
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], edx
jl 0x1000a401
mov edi, dword [ebp - 0x2d8]
push 4
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x66c4
setne al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp dword [edi + 4], ebx
jg 0x1000a397
mov esi, edx
cmp dword [ebp - 0x38], edx
je 0x1000a399
mov esi, ebx
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x2d8]
push 3
cmp dword [eax + ecx*4], esi
pop ecx
sete dl
or eax, 0xffffffff
mov dword [ebp - 0x24], edx
xor edx, edx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], ecx
jg 0x1000a3f8
mov dword [ebp - 0x48], 0xd52a2848
cmp dword [ebp - 0x48], edx
jne 0x1000a3f5
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], edx
jl 0x1000a3ed
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x2d8]
mov dword [eax + edx*4], ecx
dec dword [ebp - 0x38]
jns 0x1000a3d4
push 3
xor edx, edx
pop ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x1000a3c0
or eax, 0xffffffff
dec dword [ebp - 0x18]
jns 0x1000a360
mov eax, dword [ebp - 0x60]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x1000a33a
lea ecx, [ebp - 0x7c4]
call fcn.1001715c
lea ecx, [ebp - 0x5dc]
call fcn.1001715c
xor eax, eax
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], al
call fcn.1001715c
push 0x6a0
push 0x1b32
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor ecx, ecx
jmp 0x1000a7af
mov dword [ebp - 0x38], 0xfffffffb
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 0x30], 0xce9d
push ebx
call fcn.100165ef
xor edx, edx
mov dword [ebp - 0x20], edx
jmp 0x1000a484
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3ac]
mov dword [eax + ecx*4], 0xb25b3b9d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a471
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x1000a4a0
push edx
push 0xdd7
push edx
call dword [sym.imp.GDI32.dll_GetObjectW]
xor edx, edx
mov ecx, ebx
cmp dword [ebp - 0x30], edx
jne 0x1000a4a9
mov ecx, edx
mov eax, dword [ebp - 0x3ac]
mov dword [eax], ecx
lea ecx, [ebp - 0x3ac]
call fcn.1001715c
mov dword [ebp - 0x48], esi
xor ecx, ecx
mov dword [ebp - 0x14], 8
or edi, 0xffffffff
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xfffffff8
jle 0x1000a4fc
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x20], ecx
jmp 0x1000a4f1
mov dword [ebp - 0x34], 0xe4b28306
mov eax, dword [ebp - 0x20]
sub eax, 0x7c9334fd
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe7
jge 0x1000a4dc
dec dword [ebp - 0x14]
jmp 0x1000a4ce
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x1000a51a
push 0x196c
push ecx
push ecx
push ecx
push ecx
push 0x1b00
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], ecx
jmp 0x1000a7a6
push esi
lea ecx, [ebp - 0x484]
call fcn.100165ef
mov byte [ebp - 4], 6
xor edx, edx
mov dword [ebp - 0x20], 0x2f4a8b10
mov dword [ebp - 0x20], edx
jmp 0x1000a556
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x484]
mov dword [eax + ecx*4], 0x5c96
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000a543
mov eax, dword [ebp - 0x484]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], edx
jmp 0x1000a684
mov dword [ebp - 0x1c], 0x3eee2fde
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0xfffffff9
jg 0x1000a681
mov dword [ebp - 0x24], 0x99d94b4b
mov dword [ebp - 0x24], 0x11
jmp 0x1000a668
push esi
lea ecx, [ebp - 0x6f0]
call fcn.100165ef
xor edx, edx
mov dword [ebp - 0x18], edx
jmp 0x1000a5ba
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc], 0xc17e5c28
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000a5a9
mov dword [ebp - 0x18], edx
jmp 0x1000a5d7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6f0]
mov dword [eax + ecx*4], 0x81438367
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000a5c4
mov dword [ebp - 0xcc], edx
jmp 0x1000a652
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x18], edx
jmp 0x1000a647
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x14], edx
jmp 0x1000a60c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd0], 0x874b28e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a5fb
mov dword [ebp - 0xd0], edx
jmp 0x1000a63c
mov dword [ebp - 0x30], 0x4957
dec dword [ebp - 0x30]
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1000a636
push edx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
inc dword [ebp - 0xd0]
cmp dword [ebp - 0xd0], ebx
jle 0x1000a619
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1000a5ef
inc dword [ebp - 0xcc]
cmp dword [ebp - 0xcc], ebx
jle 0x1000a5e4
lea ecx, [ebp - 0x6f0]
call fcn.1001715c
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff8
jg 0x1000a596
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff9
jle 0x1000a583
xor edx, edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x13
jl 0x1000a56f
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], dl
call fcn.1001715c
mov dword [ebp - 0x34], 0x74db9bec
lea ecx, [ebp - 0x3c4]
push ebx
call fcn.100165ef
xor edx, edx
mov dword [ebp - 0x20], 0x96960f57
mov dword [ebp - 0x1c], edx
jmp 0x1000a6cc
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1000a6bd
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x1000a6e7
push edx
push 0x20de
call dword [sym.imp.USER32.dll_SetMenu]
xor edx, edx
mov dword [ebp - 0x20], edx
jmp 0x1000a6ff
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c4]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a6ec
lea ecx, [ebp - 0x3c4]
call fcn.1001715c
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0xb8], ecx
jne 0x1000a786
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xb8], ebx
jl 0x1000a742
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xb8], ecx
je 0x1000a744
mov ecx, ebx
xor eax, eax
cmp ecx, 0x7fb07d0
setne al
xor ecx, ecx
cmp eax, 0xf392
mov eax, dword [ebp - 0x38]
setne cl
xor edx, edx
cmp ecx, 0xfffffff7
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, 0xffffed51
setg cl
sub eax, ecx
add eax, dword [ebp - 0xb8]
jne 0x1000a780
mov eax, dword [ebp - 0xb4]
xor ecx, ecx
mov eax, ecx
jmp 0x1000a788
mov eax, ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ecx
jne 0x1000a79e
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xb8], ecx
mov eax, ecx
je 0x1000a7a0
mov eax, ebx
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x1000a525
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], ecx
jl 0x1000aaf9
lea esi, [ebp - 0x55c]
lea edi, [ebp - 0x54c]
or eax, 0xffffffff
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x14], eax
push ebx
call fcn.100165ef
push ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x5f4]
movdqa xmm0, xmmword [0x10007e10]
push edi
mov dword [ebp - 0x1c], 0xfffffffe
push esi
movdqu xmmword [ebp - 0x55c], xmm0
call fcn.1001662b
mov dword [ebp - 0x34], 0xe07e
xor eax, eax
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x1c], eax
jmp 0x1000a82a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x23c]
mov dword [eax + ecx*4], 0x4445559
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1000a817
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
sub eax, 0xfd9e
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x23c]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x23c]
setg cl
cmp ecx, dword [eax]
jge 0x1000a86a
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1000a86c
jmp 0x1000a86e
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0xc9a130df
mov edx, dword [ebp - 0x14]
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x5f4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov eax, dword [ebp - 0x34]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x23c]
setne dl
xor ebx, ebx
cmp dword [eax], edx
mov eax, dword [ebp - 0x48]
setge bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x5f4]
call fcn.1001715c
xor eax, eax
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], al
call fcn.1001715c
xor ebx, ebx
lea ecx, [ebp - 0x24c]
inc ebx
mov dword [ebp - 0x14], ebx
push 2
call fcn.100165ef
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x1000a918
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24c]
mov dword [eax + ecx*4], 0x37a3a11c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000a905
mov dword [ebp - 0x14], edx
jmp 0x1000a9fb
mov dword [ebp - 0x18], 0xc4d8e5cc
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0xffffffeb
jle 0x1000a94e
mov ecx, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x14]
mov dword [ecx + 4], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffeb
jg 0x1000a93f
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0x1c
jl 0x1000a9f8
or eax, 0xffffffff
mov dword [ebp - 0x20], 0x7a4bedcc
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0xfffffff7
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x20], 0xffffffe3
cmp dword [ebp - 0x20], 0xffffffe6
je 0x1000a9e6
mov esi, dword [ebp - 0x24c]
mov dword [ebp - 0x4c], 0x54e3
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], edx
xor edx, edx
mov ecx, dword [ebp - 0x18]
imul ecx, dword [esi + 4]
mov eax, dword [ebp - 0x24c]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x30]
setl dl
dec dword [ebp - 0x30]
cmp eax, edx
jle 0x1000a9c2
mov eax, ebx
jmp 0x1000a9c4
xor eax, eax
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
push 0
setle dl
mov dword [ebp - 0x34], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe6
pop edx
jne 0x1000a993
or eax, 0xffffffff
cmp dword [ebp - 0x48], edx
jne 0x1000a9f8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1c
jge 0x1000a95e
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffd
jge 0x1000a926
lea ecx, [ebp - 0x24c]
call fcn.1001715c
mov dword [ebp - 0x34], 0x26ca
cmp dword [ebp - 0x34], 0x66d
jge 0x1000aada
lea eax, [ebp - 0xec]
push eax
push 0x10007844
call fcn.1004ed2b
pop ecx
xor eax, eax
pop ecx
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x278]
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0xec]
call fcn.10016750
xor eax, eax
mov byte [ebp - 4], 8
mov edi, eax
cmp dword [ebp - 0xec], eax
jle 0x1000aa88
mov esi, dword [ebp - 0x278]
push esi
push 0x1000784c
call fcn.1004ed2b
pop ecx
pop ecx
push 4
pop eax
inc edi
add esi, eax
cmp edi, dword [ebp - 0xec]
jl 0x1000aa6d
push dword [ebp - 0x274]
mov esi, dword [ebp - 0x278]
push esi
call fcn.1001b023
pop ecx
xor eax, eax
pop ecx
mov ecx, ebx
cmp dword [ebp - 0xec], eax
jle 0x1000aab7
cmp ecx, dword [esi + eax*4]
jg 0x1000aaae
inc ecx
inc eax
cmp eax, dword [ebp - 0xec]
jl 0x1000aaa8
push ecx
push 0x10007844
call fcn.1004f5a5
pop ecx
pop ecx
xor eax, eax
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], al
call fcn.1001715c
lea edi, [ebp - 0x54c]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x4fc]
cmp dword [eax + ecx*4], edx
jne 0x1000aaf9
dec dword [ebp - 0x38]
lea esi, [ebp - 0x55c]
jns 0x1000a7c7
or eax, 0xffffffff
lea ecx, [ebp - 0x4fc]
mov dword [ebp - 4], eax
call fcn.1001715c
mov edx, 0x399841b3
mov esi, 0xbb6748f6
mov dword [ebp - 0x20], edx
xor ecx, ecx
push 3
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], ecx
pop edi
jmp 0x1000ab35
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8f0], 0xeb6b9dd9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000ab24
mov dword [ebp - 0x20], ecx
mov edi, 0x4b733c63
jmp 0x1000ab6d
mov dword [ebp - 0x1c], ecx
jmp 0x1000ab56
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1ec], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1000ab49
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x8f0], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffc
jle 0x1000ab44
mov dword [ebp - 0x20], edx
push 3
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], ecx
pop edx
jmp 0x1000ab92
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8d8], 0xeb6b9dd9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1000ab81
push 0xfffffffffffffffc
mov dword [ebp - 0x20], ecx
pop esi
jmp 0x1000abc8
mov dword [ebp - 0x1c], ecx
jmp 0x1000abb1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1f4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1000aba4
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1f4], eax
mov dword [ebp - 0x8d8], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1000ab9f
mov dword [ebp - 0x48], esi
mov edi, 0x2b5725d3
mov dword [ebp - 0x20], 0xfffffff7
or eax, 0xffffffff
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x6c], 0xfffffffa
mov dword [ebp - 0x2c], 0x166c1932
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], ecx
jmp 0x1000ac15
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x98], 7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000ac04
mov dword [ebp - 0x24], ecx
jmp 0x1000ac30