Function at 0x100173fd
Capabilities:
Check os version
Connect pipe
Contain obfuscated stackstrings
Delete directory
Extract resource via kernel32 functions
Get disk information
Get graphical window text
Parse pe header
Query environment variable
Resolve function by parsing pe exports
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100724c2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x12e4
call fcn.1006e450
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x16c], 4
mov dword [ebp - 0x450], 0x23e86f8c
mov dword [ebp - 0xb9c], 0x9c279a20
mov dword [ebp - 0x240], 0
jmp 0x1001745d
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 4
jge 0x10017479
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xe80], 0xc85f70ad
jmp 0x10017450
mov dword [ebp - 0x16c], 3
jmp 0x10017492
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jl 0x10017633
push 1
lea ecx, [ebp - 0xce4]
call fcn.10020fd1
and dword [ebp - 4], 0
mov dword [ebp - 0x300], 0
jmp 0x100174c9
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 1
jge 0x100174eb
push dword [ebp - 0x300]
lea ecx, [ebp - 0xce4]
call fcn.1002106f
mov dword [eax], 6
jmp 0x100174bc
mov byte [ebp - 0x168], 0
movzx eax, byte [ebp - 0x168]
test eax, eax
je 0x10017509
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe80]
mov dword [ebp - 0x1074], eax
mov esi, dword [ebp - 0x16c]
push 0
lea ecx, [ebp - 0xce4]
call fcn.1002106f
cmp dword [eax], esi
jl 0x1001753e
mov dword [ebp - 0x7dc], 1
jmp 0x10017545
and dword [ebp - 0x7dc], 0
cmp dword [ebp - 0x7dc], 0xffffffff
jne 0x1001755a
mov dword [ebp - 0xa08], 1
jmp 0x10017561
and dword [ebp - 0xa08], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe80]
cmp eax, dword [ebp - 0xa08]
je 0x1001758f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe80], 0
jne 0x1001758f
and dword [ebp - 0xb3c], 0
jmp 0x10017599
mov dword [ebp - 0xb3c], 1
push 0
lea ecx, [ebp - 0xce4]
call fcn.1002106f
mov dword [ebp - 0x450], 0xe6d0
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0xe80]
push 0
lea ecx, [ebp - 0xce4]
call fcn.1002106f
add esi, dword [eax]
cmp dword [ebp - 0x450], esi
jne 0x100175df
mov dword [ebp - 0xb94], 1
jmp 0x100175e6
and dword [ebp - 0xb94], 0
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0xfb4], eax
cmp dword [ebp - 0x450], 0
jne 0x10017609
xor eax, eax
inc eax
jne 0x10017609
and dword [ebp - 0xa10], 0
jmp 0x10017613
mov dword [ebp - 0xa10], 1
mov eax, dword [ebp - 0xa10]
mov dword [ebp - 0xb9c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xce4]
call fcn.10021053
jmp 0x10017485
cmp dword [ebp + 0x10], 0
jbe 0x10017ebd
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10017ebd
mov dword [ebp - 0xa8], 5
mov dword [ebp - 0x3c], 0x7e294b5
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x10d4], 0x20cf
mov dword [ebp - 0x248], 0
jmp 0x10017687
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 4
jge 0x100176a3
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0xb18], 0
jmp 0x1001767a
mov dword [ebp - 0xa8], 0xffffffe7
jmp 0x100176bc
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xfffffffc
jge 0x10017a78
push 1
lea ecx, [ebp - 0x3c4]
call fcn.10020fd1
mov dword [ebp - 4], 1
mov dword [ebp - 0x84], 7
mov dword [ebp - 0x38c], 0
jmp 0x10017700
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 1
jge 0x10017722
push dword [ebp - 0x38c]
lea ecx, [ebp - 0x3c4]
call fcn.1002106f
mov dword [eax], 1
jmp 0x100176f3
mov dword [ebp - 0x84], 0
jmp 0x1001773b
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jg 0x10017a44
mov dword [ebp - 0xba4], 0xffffffff
mov dword [ebp - 0xa4c], 0xffffffff
mov dword [ebp - 0x250], 0
jmp 0x10017775
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x10017791
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0xe60], 0xffffffff
jmp 0x10017768
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x100177a9
call dword [sym.imp.GDI32.dll_GdiFlush]
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x84]
cmp ecx, dword [ebp + eax - 0xe60]
jge 0x100177c9
mov dword [ebp - 0xa3c], 1
jmp 0x100177d0
and dword [ebp - 0xa3c], 0
push 0
lea ecx, [ebp - 0x3c4]
call fcn.1002106f
mov ecx, dword [ebp - 0xa3c]
cmp ecx, dword [eax]
jge 0x100177f3
mov dword [ebp - 0xa44], 1
jmp 0x100177fa
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0xa44]
mov dword [ebp - 0xba4], eax
cmp dword [ebp - 0xa4c], 0
je 0x1001781f
push 6
pop eax
test eax, eax
je 0x1001781f
mov eax, 0x8abf
test eax, eax
jne 0x10017838
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe60], 0
jne 0x10017838
and dword [ebp - 0xbac], 0
jmp 0x10017842
mov dword [ebp - 0xbac], 1
push dword [ebp - 0x84]
lea ecx, [ebp - 0x3c4]
call fcn.1002106f
push 4
pop eax
shl eax, 0
lea eax, [ebp + eax - 0xb18]
mov dword [ebp - 0xa54], eax
push 0
lea ecx, [ebp - 0x3c4]
call fcn.1002106f
mov ecx, dword [ebp - 0xa54]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xa4c]
mov ecx, dword [ebp - 0xa54]
cmp dword [ecx], eax
jge 0x10017899
mov dword [ebp - 0xa5c], 1
jmp 0x100178a0
and dword [ebp - 0xa5c], 0
cmp dword [ebp - 0xa5c], 0
jge 0x100178b5
mov dword [ebp - 0xa64], 1
jmp 0x100178bc
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xa64], eax
jg 0x100178d3
mov dword [ebp - 0xa6c], 1
jmp 0x100178da
and dword [ebp - 0xa6c], 0
mov esi, dword [ebp - 0xa8]
push 4
pop eax
imul eax, eax, 0
mov edi, dword [ebp + eax - 0xe60]
push dword [ebp - 0x84]
lea ecx, [ebp - 0x3c4]
call fcn.1002106f
mov eax, dword [eax]
sub eax, edi
sub eax, dword [ebp - 0xa6c]
cmp eax, esi
jge 0x10017918
mov dword [ebp - 0xa74], 1
jmp 0x1001791f
and dword [ebp - 0xa74], 0
push 0
lea ecx, [ebp - 0x3c4]
call fcn.1002106f
mov ecx, dword [ebp - 0xa74]
cmp ecx, dword [eax]
jg 0x10017942
mov dword [ebp - 0xc54], 1
jmp 0x10017949
and dword [ebp - 0xc54], 0
push 0
lea ecx, [ebp - 0x3c4]
call fcn.1002106f
mov ecx, 0x6552ded1
sub ecx, dword [eax]
je 0x10017974
cmp dword [ebp - 0x1a0], 0
je 0x10017974
mov dword [ebp - 0xa7c], 1
jmp 0x1001797b
and dword [ebp - 0xa7c], 0
cmp dword [ebp - 0xa7c], 1
ja 0x10017990
mov dword [ebp - 0xa84], 1
jmp 0x10017997
and dword [ebp - 0xa84], 0
push dword [ebp - 0x84]
lea ecx, [ebp - 0x3c4]
call fcn.1002106f
mov ecx, dword [ebp - 0xa84]
cmp ecx, dword [eax]
jl 0x100179be
mov dword [ebp - 0xa8c], 1
jmp 0x100179c5
and dword [ebp - 0xa8c], 0
push 0
lea ecx, [ebp - 0x3c4]
call fcn.1002106f
mov ecx, dword [ebp - 0xa8c]
cmp ecx, dword [eax]
jge 0x100179e8
mov dword [ebp - 0xc5c], 1
jmp 0x100179ef
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xfc4], eax
push dword [ebp - 0x84]
lea ecx, [ebp - 0x3c4]
call fcn.1002106f
cmp dword [eax], 0
jne 0x10017a20
mov eax, 0x55d48264
test eax, eax
jne 0x10017a20
and dword [ebp - 0xa94], 0
jmp 0x10017a2a
mov dword [ebp - 0xa94], 1
push 0
lea ecx, [ebp - 0x3c4]
call fcn.1002106f
mov ecx, dword [ebp - 0xa94]
mov dword [eax], ecx
jmp 0x1001772e
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x10017a64
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c4]
call fcn.10021053
jmp 0x100176af
mov dword [ebp - 0x3c], 0
jmp 0x10017a88
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x2d
jg 0x10017ea9
mov dword [ebp - 0x1e0], 0x7cb2c1d3
mov dword [ebp - 0x498], 0xfd659ca0
mov dword [ebp - 0x4f8], 0
mov dword [ebp - 0xc74], 0x6120e7a9
mov dword [ebp - 0xa8], 0
jmp 0x10017ad3
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 8
je 0x10017e9c
mov dword [ebp - 0x258], 0xfb861a71
mov dword [ebp - 0x1b4], 1
mov dword [ebp - 0x1a0], 0xfffffffa
jmp 0x10017b0d
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x25
jg 0x10017c58
mov dword [ebp - 0xac0], 0x13a4b1f0
mov dword [ebp - 0xd98], 0x7355a2c0
mov dword [ebp - 0xd94], 0x7355a2c0
mov dword [ebp - 0xd90], 0x7355a2c0
mov dword [ebp - 0xd8c], 0x7355a2c0
lea ecx, [ebp - 0x445]
call fcn.1002107e
push eax
lea eax, [ebp - 0xd88]
push eax
lea eax, [ebp - 0xd98]
push eax
lea ecx, [ebp - 0x11bc]
call fcn.10021081
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xfc0]
call fcn.1002102d
mov dword [ebp - 4], 2
cmp dword [ebp - 0xac0], 0xfffffffd
jge 0x10017bf6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb18], 0x8f497c3
jl 0x10017bb0
mov dword [ebp - 0x304], 1
jmp 0x10017bb7
and dword [ebp - 0x304], 0
push 0
lea ecx, [ebp - 0xfc0]
call fcn.1002106f
mov ecx, dword [ebp - 0x304]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x304]
mov dword [ebp + eax - 0xb18], ecx
imul eax, dword [ebp - 0x304], 0x386b
test eax, eax
jne 0x10017bf6
and dword [ebp - 0xc64], 0
jmp 0x10017c00
mov dword [ebp - 0xc64], 1
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x1160], eax
push 4
pop eax
shl eax, 0
imul eax, dword [ebp + eax - 0xb18], 0x82a
cmp eax, dword [ebp - 0xac0]
jle 0x10017c31
mov dword [ebp - 0xab8], 1
jmp 0x10017c38
and dword [ebp - 0xab8], 0
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0x1b4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc0]
call fcn.10021053
jmp 0x10017b00
cmp dword [ebp - 0x1b4], 1
je 0x10017c6d
mov dword [ebp - 0x984], 1
jmp 0x10017c74
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x258]
add eax, dword [ebp - 0x984]
cmp eax, dword [ebp - 0x258]
jne 0x10017c94
mov dword [ebp - 0x960], 1
jmp 0x10017c9b
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x960]
sub eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x1e0]
imul eax, dword [ebp - 0x1e0]
cmp eax, 0x11fe8be9
jne 0x10017cc4
mov dword [ebp - 0x4f0], 1
jmp 0x10017ccb
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x1b4]
add eax, dword [ebp - 0x4f0]
add eax, dword [ebp - 0x1e0]
or ecx, 0xffffffff
sub ecx, eax
cmp ecx, 0xbdd559fe
jne 0x10017cf1
cmp dword [ebp - 0x1b4], 0
imul eax, dword [ebp - 0x1a0], 0xffffffff
mov ecx, dword [ebp - 0x1e0]
add ecx, eax
mov dword [ebp - 0x498], ecx
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0xfd4], eax
mov eax, dword [ebp - 0x498]
cmp eax, dword [ebp - 0x3c]
je 0x10017d29
mov dword [ebp - 0x968], 1
jmp 0x10017d30
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x4f8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4f8]
cmp ecx, dword [ebp + eax - 0xb18]
jg 0x10017d5d
mov dword [ebp - 0x970], 1
jmp 0x10017d64
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x970], eax
jne 0x10017d7e
mov dword [ebp - 0x500], 1
jmp 0x10017d85
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 1
je 0x10017d9a
mov dword [ebp - 0x978], 1
jmp 0x10017da1
and dword [ebp - 0x978], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb18]
add eax, dword [ebp - 0x978]
cmp eax, dword [ebp - 0x3c]
jle 0x10017dc5
mov dword [ebp - 0x508], 1
jmp 0x10017dcc
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x508], eax
jl 0x10017de6
mov dword [ebp - 0x980], 1
jmp 0x10017ded
and dword [ebp - 0x980], 0
cmp dword [ebp - 0x980], 7
jbe 0x10017e02
mov dword [ebp - 0x510], 1
jmp 0x10017e09
and dword [ebp - 0x510], 0
cmp dword [ebp - 0x510], 0xe059
je 0x10017e21
mov dword [ebp - 0x988], 1
jmp 0x10017e28
and dword [ebp - 0x988], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1e0]
add ecx, dword [ebp - 0x988]
cmp ecx, dword [ebp + eax - 0xb18]
jl 0x10017e5c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb18], 0
jne 0x10017e5c
and dword [ebp - 0xc6c], 0
jmp 0x10017e66
mov dword [ebp - 0xc6c], 1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10dc], eax
cmp dword [ebp - 0x3c], 0x9bc9383a
ja 0x10017e84
mov dword [ebp - 0x518], 1
jmp 0x10017e8b
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0xc74], eax
jmp 0x10017ac6
cmp dword [ebp - 0x3c], 0
je 0x10017ea4
jmp 0x10017ea9
jmp 0x10017a81
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10012621
pop ecx
pop ecx
jmp 0x1001fd6f
mov dword [ebp - 0x3dc], 0
mov dword [ebp - 0xdac], 0x3c7730f9
mov dword [ebp - 0xda8], 0x3c7730f9
mov dword [ebp - 0xda4], 0x3c7730f9
mov dword [ebp - 0xda0], 0x3c7730f9
lea ecx, [ebp - 0x479]
call fcn.1002107e
push eax
lea eax, [ebp - 0xd9c]
push eax
lea eax, [ebp - 0xdac]
push eax
lea ecx, [ebp - 0x1214]
call fcn.10021081
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4a4]
call fcn.1002102d
mov dword [ebp - 4], 3
mov dword [ebp - 0xc0], 0xd86e
mov dword [ebp - 0x1a8], 0xfffffffe
mov dword [ebp - 0x48c], 1
mov dword [ebp - 0x530], 0x954f618e
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0xc9c], 1
mov dword [ebp - 0x354], 0
jmp 0x10017f80
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 3
jge 0x10017f9c
mov eax, dword [ebp - 0x354]
mov dword [ebp + eax*4 - 0xfd0], 1
jmp 0x10017f73
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jne 0x10017fc7
cmp dword [ebp - 0xc0], 0
je 0x10017fc7
mov dword [ebp - 0x990], 1
jmp 0x10017fce
and dword [ebp - 0x990], 0
cmp dword [ebp - 0x990], 0xffffffff
jl 0x10017fe3
mov dword [ebp - 0x520], 1
jmp 0x10017fea
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x520], eax
jge 0x10018004
mov dword [ebp - 0xc7c], 1
jmp 0x1001800b
and dword [ebp - 0xc7c], 0
push 3
lea ecx, [ebp - 0x4a4]
call fcn.1002106f
push 3
lea ecx, [ebp - 0x4a4]
call fcn.1002106f
push 3
lea ecx, [ebp - 0x4a4]
call fcn.1002106f
cmp dword [ebp - 0x1a8], 0xb3a00d0e
je 0x10018087
mov dword [ebp - 0xc84], 0
mov dword [ebp - 0x1a8], 0
jmp 0x10018061
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xfffffff8
jle 0x10018082
cmp dword [ebp - 0xc84], 0
je 0x10018075
jmp 0x10018082
cmp dword [ebp - 0x3dc], 0
je 0x10018080
jmp 0x10018082
jmp 0x10018054
jmp 0x100184d0
push 4
lea ecx, [ebp - 0x460]
call fcn.10020fd1
mov byte [ebp - 4], 4
mov dword [ebp - 0x3e4], 0x15e1b46
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x9c8], 0x62afeddd
mov dword [ebp - 0x3ec], 2
mov dword [ebp - 0xca4], 0x77b405a8
mov dword [ebp - 0xcac], 0xfffe
mov dword [ebp - 0x260], 0
jmp 0x100180ed
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 4
jge 0x1001810f
push dword [ebp - 0x260]
lea ecx, [ebp - 0x460]
call fcn.1002106f
mov dword [eax], 0x69dd
jmp 0x100180e0
push 2
lea ecx, [ebp - 0x4a4]
call fcn.1002106f
push 3
lea ecx, [ebp - 0x460]
call fcn.1002106f
cmp dword [eax], 0
jne 0x10018149
push 3
lea ecx, [ebp - 0x460]
call fcn.1002106f
cmp dword [eax], 0
jne 0x10018149
and dword [ebp - 0xc8c], 0
jmp 0x10018153
mov dword [ebp - 0xc8c], 1
push 3
lea ecx, [ebp - 0x460]
call fcn.1002106f
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xfe4], eax
push 3
pop eax
imul eax, eax, 0
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x3dc]
jle 0x10018192
mov dword [ebp - 0x998], 1
jmp 0x10018199
and dword [ebp - 0x998], 0
push 1
lea ecx, [ebp - 0x4a4]
call fcn.1002106f
mov ecx, dword [ebp - 0x998]
cmp ecx, dword [eax]
jl 0x100181bc
mov dword [ebp - 0xc94], 1
jmp 0x100181c3
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x1128], eax
cmp dword [ebp - 0x48c], 0xbd3d38e2
jne 0x100181e7
mov dword [ebp - 0x528], 1
jmp 0x100181ee
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0
je 0x10018218
cmp dword [ebp - 0x48c], 0
je 0x10018218
mov dword [ebp - 0x9a0], 1
jmp 0x1001821f
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x9a8], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x9a8]
mov dword [ebp + eax - 0xfd0], ecx
cmp dword [ebp - 0x9a8], 0xfffffffb
je 0x1001825e
mov dword [ebp - 0x538], 1
jmp 0x10018265
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
cmp eax, dword [ebp - 0x1a8]
jg 0x1001828b
mov dword [ebp - 0x9b0], 1
jmp 0x10018292
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x30c]
imul eax, dword [ebp - 0x9b0]
cmp eax, dword [ebp - 0xc9c]
jg 0x100182b3
mov dword [ebp - 0x540], 1
jmp 0x100182ba
and dword [ebp - 0x540], 0
push 3
lea ecx, [ebp - 0x460]
call fcn.1002106f
mov ecx, dword [ebp - 0x540]
cmp ecx, dword [eax]
jl 0x100182dd
mov dword [ebp - 0x9b8], 1
jmp 0x100182e4
and dword [ebp - 0x9b8], 0
push 1
lea ecx, [ebp - 0x460]
call fcn.1002106f
mov ecx, dword [ebp - 0x9b8]
cmp ecx, dword [eax]
jne 0x10018307
mov dword [ebp - 0x548], 1
jmp 0x1001830e
and dword [ebp - 0x548], 0
push 3
lea ecx, [ebp - 0x460]
call fcn.1002106f
mov ecx, dword [ebp - 0x548]
cmp ecx, dword [eax]
jl 0x10018331
mov dword [ebp - 0x9c0], 1
jmp 0x10018338
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x9c0]
neg eax
mov dword [ebp - 0x550], 1
jmp 0x10018353
push 2
lea ecx, [ebp - 0x4a4]
call fcn.1002106f
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x9c8], eax
mov eax, dword [ebp - 0x9c8]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0xff4], eax
push 0
lea ecx, [ebp - 0x460]
call fcn.1002106f
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xfd0]
imul esi, dword [ebp - 0xc0]
push 3
lea ecx, [ebp - 0x460]
call fcn.1002106f
cmp esi, dword [eax]
jge 0x100183c2
mov dword [ebp - 0x558], 1
jmp 0x100183c9
and dword [ebp - 0x558], 0
push 1
lea ecx, [ebp - 0x4a4]
call fcn.1002106f
mov ecx, dword [ebp - 0x558]
mov dword [eax], ecx
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x9d0], eax
push 3
lea ecx, [ebp - 0x4a4]
call fcn.1002106f
mov ecx, dword [ebp - 0x9d0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x30c]
cmp dword [ebp - 0x9d0], eax
jle 0x10018454
push 1
lea ecx, [ebp - 0x4a4]
call fcn.1002106f
cmp dword [eax], 0xffffffff
jl 0x1001842b
mov dword [ebp - 0x560], 1
jmp 0x10018432
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x3e4]
add eax, dword [ebp - 0x560]
mov ecx, dword [ebp - 0xca4]
sub ecx, eax
cmp ecx, 2
jb 0x10018454
and dword [ebp - 0x9d8], 0
jmp 0x1001845e
mov dword [ebp - 0x9d8], 1
mov eax, dword [ebp - 0x9d8]
sub eax, dword [ebp - 0x30c]
cmp eax, dword [ebp - 0x444]
je 0x1001847e
mov dword [ebp - 0x568], 1
jmp 0x10018485
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0xcac]
cmp dword [ebp - 0x568], eax
jne 0x1001849f
mov dword [ebp - 0x9e0], 1
jmp 0x100184a6
and dword [ebp - 0x9e0], 0
push 3
lea ecx, [ebp - 0x460]
call fcn.1002106f
mov ecx, dword [ebp - 0x9e0]
sub ecx, dword [eax]
mov dword [ebp - 0x3ec], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x460]
call fcn.10021053
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4a4]
call fcn.10021053
mov dword [ebp - 0x83c], 0xe814
push 3
lea ecx, [ebp - 0x3a8]
call fcn.10020fd1
mov dword [ebp - 4], 5
mov dword [ebp - 0x268], 0xffffffff
mov dword [ebp - 0x5ac], 0xfff8
mov dword [ebp - 0x58c], 0x8f9611ca
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x5a4], 0
push 3
lea ecx, [ebp - 0xe54]
call fcn.10020fd1
mov byte [ebp - 4], 6
mov dword [ebp - 0x70], 0
jmp 0x10018550
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1001856c
push dword [ebp - 0x70]
lea ecx, [ebp - 0x3a8]
call fcn.1002106f
mov dword [eax], 1
jmp 0x10018549
mov dword [ebp - 0x70], 0
jmp 0x1001857c
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10018598
push dword [ebp - 0x70]
lea ecx, [ebp - 0xe54]
call fcn.1002106f
mov dword [eax], 0x563ade4
jmp 0x10018575
push 1
lea ecx, [ebp - 0x3a8]
call fcn.1002106f
cmp dword [eax], 0
jne 0x100185b6
mov dword [ebp - 0x570], 1
jmp 0x100185bd
and dword [ebp - 0x570], 0
push 0
lea ecx, [ebp - 0x3a8]
call fcn.1002106f
mov ecx, dword [ebp - 0x570]
cmp ecx, dword [eax]
jle 0x100185e0
mov dword [ebp - 0x9e8], 1
jmp 0x100185e7
and dword [ebp - 0x9e8], 0
push 1
lea ecx, [ebp - 0x3a8]
call fcn.1002106f
mov ecx, dword [ebp - 0x9e8]
cmp ecx, dword [eax]
jne 0x1001860a
mov dword [ebp - 0x578], 1
jmp 0x10018611
and dword [ebp - 0x578], 0
push 1
lea ecx, [ebp - 0x3a8]
call fcn.1002106f
mov ecx, dword [ebp - 0x578]
cmp ecx, dword [eax]
je 0x10018634
mov dword [ebp - 0x9f0], 1
jmp 0x1001863b
and dword [ebp - 0x9f0], 0
mov esi, dword [ebp - 0x268]
push 0
lea ecx, [ebp - 0x3a8]
call fcn.1002106f
mov edi, dword [ebp - 0x9f0]
imul edi, dword [eax]
push 1
lea ecx, [ebp - 0x3a8]
call fcn.1002106f
mov eax, dword [eax]
sub eax, edi
cmp eax, esi
jg 0x10018678
mov dword [ebp - 0xcb4], 1
jmp 0x1001867f
and dword [ebp - 0xcb4], 0
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x10e4], eax
push 0
lea ecx, [ebp - 0x3a8]
call fcn.1002106f
push 0
lea ecx, [ebp - 0x3a8]
call fcn.1002106f
push 1
lea ecx, [ebp - 0x3a8]
call fcn.1002106f
cmp dword [eax], 0
je 0x100186ca
push 4
pop eax
test eax, eax
je 0x100186ca
mov dword [ebp - 0x580], 1
jmp 0x100186d1
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x580], eax
jg 0x100186eb
mov dword [ebp - 0x9f8], 1
jmp 0x100186f2
and dword [ebp - 0x9f8], 0
cmp dword [ebp - 0x9f8], 0xffff
jb 0x1001870a
mov dword [ebp - 0xa00], 1
jmp 0x10018711
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0x268]
add eax, dword [ebp - 0xa00]
mov dword [ebp - 0x58c], eax
mov esi, dword [ebp - 0x58c]
sub esi, dword [ebp - 0x268]
push 1
lea ecx, [ebp - 0x3a8]
call fcn.1002106f
cmp dword [eax], esi
jl 0x1001874c
mov dword [ebp - 0x834], 1
jmp 0x10018753
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 0
jne 0x10018783
push 0
lea ecx, [ebp - 0x3a8]
call fcn.1002106f
cmp dword [eax], 0
jne 0x10018783
and dword [ebp - 0xa30], 0
jmp 0x1001878d
mov dword [ebp - 0xa30], 1
cmp dword [ebp - 0xa30], 0x4644
jne 0x100187b7
push 1
lea ecx, [ebp - 0x3a8]
call fcn.1002106f
cmp dword [eax], 0
je 0x100187b7
mov dword [ebp - 0x59c], 1
jmp 0x100187be
and dword [ebp - 0x59c], 0
mov dword [ebp - 0x83c], 0x748f
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x83c]
cmp eax, dword [ebp - 0x5a4]
jg 0x100187ee
mov dword [ebp - 0x98c], 1
jmp 0x100187f5
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x98c]
dec eax
dec eax
cmp eax, dword [ebp - 0x5ac]
je 0x10018811
mov dword [ebp - 0x844], 1
jmp 0x10018818
and dword [ebp - 0x844], 0
push 0
lea ecx, [ebp - 0xe54]
call fcn.1002106f
mov ecx, dword [ebp - 0x844]
mov dword [eax], ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xe54]
call fcn.10021053
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a8]
call fcn.10021053
cmp dword [ebp + 0x10], 0
jne 0x1001d855
push 2
lea ecx, [ebp - 0x4e0]
call fcn.10020fd1
mov dword [ebp - 4], 7
mov dword [ebp - 0xd0], 6
mov dword [ebp - 0x37c], 0
jmp 0x1001888c
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 2
jge 0x100188ae
push dword [ebp - 0x37c]
lea ecx, [ebp - 0x4e0]
call fcn.1002106f
mov dword [eax], 0xdf75dcec
jmp 0x1001887f
mov dword [ebp - 0xd0], 0
jmp 0x100188c7
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jg 0x10018afc
mov dword [ebp - 0x90], 0
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x4e0]
call fcn.1002106f
mov dword [eax], 0xfffffffd
mov dword [ebp - 0x90], 1
jmp 0x1001890e
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x10018af7
mov dword [ebp - 0x1c0], 0xfffffffd
push dword [ebp - 0x90]
lea ecx, [ebp - 0x4e0]
call fcn.1002106f
cmp dword [eax], 0
je 0x10018940
jmp 0x10018af7
mov dword [ebp - 0x1c0], 1
jmp 0x10018959
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jl 0x10018af2
mov dword [ebp - 0x270], 5
mov dword [ebp - 0xcbc], 0x8e64e6dc
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0xcbc], eax
cmp dword [ebp - 0x270], 0
je 0x10018a8e
push dword [ebp - 0x90]
lea ecx, [ebp - 0x4e0]
call fcn.1002106f
cmp dword [eax], 1
jl 0x100189b5
mov dword [ebp - 0x5b4], 1
jmp 0x100189bc
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x5b4], eax
jle 0x100189d6
mov dword [ebp - 0xa78], 1
jmp 0x100189dd
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x270]
add eax, dword [ebp - 0xa78]
cmp eax, 0x64939e63
jle 0x100189fc
mov dword [ebp - 0x5bc], 1
jmp 0x10018a03
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0xd857289c
je 0x10018a1c
push 0
lea ecx, [ebp - 0x4e0]
call fcn.1002106f
cmp dword [ebp - 0x270], 0xb903
jl 0x10018a34
mov dword [ebp - 0x84c], 1
jmp 0x10018a3b
and dword [ebp - 0x84c], 0
imul eax, dword [ebp - 0x84c], 0xf551
mov ecx, dword [ebp - 0x90]
add ecx, eax
cmp ecx, 0x4bca925f
jge 0x10018a61
mov dword [ebp - 0x5c4], 1
jmp 0x10018a68
and dword [ebp - 0x5c4], 0
imul eax, dword [ebp - 0x5c4], 0
mov ecx, dword [ebp - 0xd0]
sub ecx, eax
je 0x10018a8e
cmp dword [ebp - 0xd0], 0
je 0x10018a8e
mov dword [ebp - 0xcc4], 1
jmp 0x10018a95
and dword [ebp - 0xcc4], 0
push 0
lea ecx, [ebp - 0x4e0]
call fcn.1002106f
cmp dword [ebp - 0x90], 0
je 0x10018acd
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x4e0]
call fcn.1002106f
cmp dword [eax], 0
je 0x10018acd
mov dword [ebp - 0x994], 1
jmp 0x10018ad4
and dword [ebp - 0x994], 0
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x4e0]
call fcn.1002106f
mov ecx, dword [ebp - 0x994]
mov dword [eax], ecx
jmp 0x1001894c
jmp 0x10018901
jmp 0x100188ba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4e0]
call fcn.10021053
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1000a768
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x50], 0xd4e06482
mov dword [ebp - 0x50], 0
jmp 0x10018b33
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xffffffe7
jg 0x10018cc1
mov dword [ebp - 0xa0], 0
jmp 0x10018b56
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x10018b72
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xec], 0x1d925b0e
jmp 0x10018b49
mov dword [ebp - 0xa0], 0
jmp 0x10018b8b
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x10018ba7
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x1018], 0x9f08664a
jmp 0x10018b7e
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x10018bbf
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xec], 5
jmp 0x10018bed
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xec], 0xfffffffd
je 0x10018cbc
mov dword [ebp - 0x5cc], 0x6b8d
mov eax, dword [ebp - 0x5cc]
sub eax, dword [ebp - 0x50]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xec]
imul ecx, eax
test ecx, ecx
je 0x10018c43
cmp dword [ebp - 0x5cc], 0
jne 0x10018c43
cmp dword [ebp - 0x50], 0
je 0x10018c43
mov dword [ebp - 0x854], 1
jmp 0x10018c4a
and dword [ebp - 0x854], 0
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x854], 0
cmp ecx, dword [ebp + eax - 0xec]
jl 0x10018c6c
mov dword [ebp - 0x5d4], 1
jmp 0x10018c73
and dword [ebp - 0x5d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
add eax, dword [ebp - 0x5d4]
jne 0x10018c9d
mov eax, 0x3ccd
test eax, eax
jne 0x10018c9d
mov dword [ebp - 0xa38], 1
jmp 0x10018ca4
and dword [ebp - 0xa38], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa38]
mov dword [ebp + eax - 0x1018], ecx
jmp 0x10018bd2
jmp 0x10018b2c
mov dword [ebp - 0x50], 9
jmp 0x10018cd1
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x14
jne 0x10018cf0
mov dword [ebp - 0x5dc], 2
mov eax, dword [ebp - 0x5dc]
dec eax
mov dword [ebp - 0x5dc], eax
jmp 0x10018cca
mov dword [ebp - 0xde8], 0xf9b3198a
mov dword [ebp - 0xde4], 0xf9b3198a
mov dword [ebp - 0xde0], 0xf9b3198a
mov dword [ebp - 0xddc], 0xf9b3198a
lea ecx, [ebp - 0x435]
call fcn.1002107e
push eax
lea eax, [ebp - 0xdd8]
push eax
lea eax, [ebp - 0xde8]
push eax
lea ecx, [ebp - 0x11ec]
call fcn.10021081
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1184]
call fcn.1002102d
mov dword [ebp - 4], 8
mov dword [ebp - 0x278], 1
push 1
lea ecx, [ebp - 0xfe0]
call fcn.10020fd1
mov byte [ebp - 4], 9
mov dword [ebp - 0x314], 0
jmp 0x10018d88
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 1
jge 0x10018daa
push dword [ebp - 0x314]
lea ecx, [ebp - 0xfe0]
call fcn.1002106f
mov dword [eax], 0x6f6dd8d1
jmp 0x10018d7b
mov dword [ebp - 0x278], 3
jmp 0x10018dc3
mov eax, dword [ebp - 0x278]
dec eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
jl 0x10018de5
mov dword [ebp - 0x85c], 0xa9d69236
mov eax, dword [ebp - 0x85c]
dec eax
mov dword [ebp - 0x85c], eax
jmp 0x10018db6
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xfe0]
call fcn.10021053
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1184]
call fcn.10021053
push 3
lea ecx, [ebp - 0xe48]
call fcn.10020fd1
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xccc], 0
mov dword [ebp - 0x35c], 0
jmp 0x10018e3a
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 3
jge 0x10018e5c
push dword [ebp - 0x35c]
lea ecx, [ebp - 0xe48]
call fcn.1002106f
mov dword [eax], 1
jmp 0x10018e2d
push 0
lea ecx, [ebp - 0xe48]
call fcn.1002106f
mov eax, dword [eax]
mov dword [ebp - 0xccc], eax
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x10018e8e
push 0x24ca
call dword [sym.imp.USER32.dll_GetQueueStatus]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe48]
call fcn.10021053
cmp dword [0x1061b1cc], 0
jne 0x1001d0c1
mov dword [ebp - 0x174], 7
mov dword [ebp - 0x280], 0
jmp 0x10018ecd
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
jge 0x10018ee9
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0xd64], 1
jmp 0x10018ec0
mov dword [ebp - 0x174], 0
jmp 0x10018f02
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jg 0x10019371
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x1004], 9
mov dword [ebp - 0x31c], 4
mov dword [ebp - 0x40], 2
jmp 0x10018f3a
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x10018f81
mov dword [ebp - 0x1d8], 5
mov dword [ebp - 0x1d8], 0
jmp 0x10018f63
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jge 0x10018f7f
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0xd64], 0
jmp 0x10018f56
jmp 0x10018f33
mov dword [ebp - 0x40], 0
jmp 0x10018f91
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x1001936c
mov dword [ebp - 0x1c8], 0x8999d94b
mov dword [ebp - 0x3f4], 4
mov dword [ebp - 0x1c8], 2
jmp 0x10018fc8
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jl 0x10019367
mov dword [ebp - 0xf4], 0x831d26ec
mov dword [ebp - 0xf4], 2
jmp 0x10018ff8
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jl 0x10019362
mov dword [ebp - 0x1e8], 1
mov dword [ebp - 0xcd4], 0xffffffff
mov dword [ebp - 0x1e8], 0
jmp 0x10019032
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jg 0x1001935d
mov dword [ebp - 0x39c], 0xffd81438
mov dword [ebp - 0x288], 0xfffffff9
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x103c], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0xd64], 0xffff
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0xd64], 0x7f39
jl 0x10019099
mov dword [ebp - 0xabc], 1
jmp 0x100190a0
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1048], eax
cmp dword [ebp - 0x1e8], 0
je 0x100190c7
mov eax, 0x4eb0
test eax, eax
je 0x100190c7
mov dword [ebp - 0x5e4], 1
jmp 0x100190ce
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0xcd4]
cmp dword [ebp - 0x5e4], eax
je 0x100190e8
mov dword [ebp - 0x99c], 1
jmp 0x100190ef
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0xd64]
imul eax, dword [ebp - 0x99c]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0x5161
je 0x1001911e
mov dword [ebp - 0x5ec], 1
jmp 0x10019125
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x31c]
cmp dword [ebp - 0x5ec], eax
jl 0x1001913f
mov dword [ebp - 0x864], 1
jmp 0x10019146
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x864], eax
jl 0x10019160
mov dword [ebp - 0x5f4], 1
jmp 0x10019167
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x31c]
cmp dword [ebp - 0x5f4], eax
jg 0x10019181
mov dword [ebp - 0x5fc], 1
jmp 0x10019188
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0xabc]
cmp eax, dword [ebp - 0x5fc]
jle 0x100191a2
mov dword [ebp - 0x86c], 1
jmp 0x100191a9
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
ja 0x100191d3
cmp dword [ebp - 0x288], 0
je 0x100191d3
mov dword [ebp - 0x604], 1
jmp 0x100191da
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 0xffffffff
jg 0x100191ef
mov dword [ebp - 0x9a4], 1
jmp 0x100191f6
and dword [ebp - 0x9a4], 0
cmp dword [ebp - 0x9a4], 0xd4f6
jge 0x10019214
cmp dword [ebp - 0xf4], 0
jne 0x10019214
and dword [ebp - 0x60c], 0
jmp 0x1001921e
mov dword [ebp - 0x60c], 1
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0x12d4
je 0x1001933e
mov dword [ebp - 0x874], 4
mov dword [ebp - 0xe90], 0x747b1d00
mov dword [ebp - 0xe8c], 0x747b1d00
mov dword [ebp - 0xe88], 0x747b1d00
mov dword [ebp - 0xe84], 0x747b1d00
mov dword [ebp - 0x288], 0xffffffff
mov dword [ebp - 0x874], 0xffffffff
cmp dword [ebp - 0x874], 0
jne 0x10019290
cmp dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x10ec], eax
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0xf4]
jne 0x100192b3
mov dword [ebp - 0x614], 1
jmp 0x100192ba
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 1
jge 0x100192cf
mov dword [ebp - 0xa40], 1
jmp 0x100192d6
and dword [ebp - 0xa40], 0
cmp dword [ebp - 0xa40], 0x2d78
jl 0x100192f7
cmp dword [ebp - 0x39c], 0
je 0x100192f7
mov dword [ebp - 0x484], 1
jmp 0x100192fe
and dword [ebp - 0x484], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x484]
mov dword [ebp + eax - 0xe90], ecx
cmp dword [ebp - 0x484], 0x97c2
je 0x10019329
mov dword [ebp - 0x61c], 1
jmp 0x10019330
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x3f4], eax
jmp 0x10019358
mov byte [ebp - 0x162], 0
movzx eax, byte [ebp - 0x162]
test eax, eax
je 0x10019358
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
jmp 0x10019025
jmp 0x10018feb
jmp 0x10018fbb
jmp 0x10018f8a
jmp 0x10018ef5
mov dword [ebp - 0xd24], 0x9e87
lea eax, [ebp - 0xd24]
push eax
call fcn.100125f2
pop ecx
mov dword [ebp - 0x6c0], eax
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0xdc0], 0x3c7730f9
mov dword [ebp - 0xdbc], 0x3c7730f9
mov dword [ebp - 0xdb8], 0x3c7730f9
mov dword [ebp - 0xdb4], 0x3c7730f9
lea ecx, [ebp - 0x3d1]
call fcn.1002107e
push eax
lea eax, [ebp - 0xdb0]
push eax
lea eax, [ebp - 0xdc0]
push eax
lea ecx, [ebp - 0x123c]
call fcn.10021081
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4b0]
call fcn.1002102d
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xc8], 0xd86e
mov dword [ebp - 0x19c], 0xfffffffe
mov dword [ebp - 0x3fc], 1
mov dword [ebp - 0x634], 0x954f618e
mov dword [ebp - 0x298], 0
mov dword [ebp - 0xd48], 1
mov dword [ebp - 0x290], 0
jmp 0x10019451
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 3
jge 0x1001946d
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0xff0], 1
jmp 0x10019444
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jne 0x10019498
cmp dword [ebp - 0xc8], 0
je 0x10019498
mov dword [ebp - 0x87c], 1
jmp 0x1001949f
and dword [ebp - 0x87c], 0
cmp dword [ebp - 0x87c], 0xffffffff
jl 0x100194b4
mov dword [ebp - 0x624], 1
jmp 0x100194bb
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x624], eax
jge 0x100194d5
mov dword [ebp - 0xd2c], 1
jmp 0x100194dc
and dword [ebp - 0xd2c], 0
push 3
lea ecx, [ebp - 0x4b0]
call fcn.1002106f
push 3
lea ecx, [ebp - 0x4b0]
call fcn.1002106f
push 3
lea ecx, [ebp - 0x4b0]
call fcn.1002106f
cmp dword [ebp - 0x19c], 0xb3a00d0e
je 0x10019558
mov dword [ebp - 0xd34], 0
mov dword [ebp - 0x19c], 0
jmp 0x10019532
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xfffffff8
jle 0x10019553
cmp dword [ebp - 0xd34], 0
je 0x10019546
jmp 0x10019553
cmp dword [ebp - 0x44c], 0
je 0x10019551
jmp 0x10019553
jmp 0x10019525
jmp 0x100199a1
push 4
lea ecx, [ebp - 0x470]
call fcn.10020fd1
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x494], 0x15e1b46
mov dword [ebp - 0x404], 1
mov dword [ebp - 0xa48], 0x62afeddd
mov dword [ebp - 0x454], 2
mov dword [ebp - 0xd08], 0x77b405a8
mov dword [ebp - 0xb8c], 0xfffe
mov dword [ebp - 0x324], 0
jmp 0x100195be
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 4
jge 0x100195e0
push dword [ebp - 0x324]
lea ecx, [ebp - 0x470]
call fcn.1002106f
mov dword [eax], 0x69dd
jmp 0x100195b1
push 2
lea ecx, [ebp - 0x4b0]
call fcn.1002106f
push 3
lea ecx, [ebp - 0x470]
call fcn.1002106f
cmp dword [eax], 0
jne 0x1001961a
push 3
lea ecx, [ebp - 0x470]
call fcn.1002106f
cmp dword [eax], 0
jne 0x1001961a
and dword [ebp - 0xd3c], 0
jmp 0x10019624
mov dword [ebp - 0xd3c], 1
push 3
lea ecx, [ebp - 0x470]
call fcn.1002106f
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x1054], eax
push 3
pop eax
imul eax, eax, 0
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x44c]
jle 0x10019663
mov dword [ebp - 0x9ac], 1
jmp 0x1001966a
and dword [ebp - 0x9ac], 0
push 1
lea ecx, [ebp - 0x4b0]
call fcn.1002106f
mov ecx, dword [ebp - 0x9ac]
cmp ecx, dword [eax]
jl 0x1001968d
mov dword [ebp - 0xd44], 1
jmp 0x10019694
and dword [ebp - 0xd44], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x1130], eax
cmp dword [ebp - 0x3fc], 0xbd3d38e2
jne 0x100196b8
mov dword [ebp - 0x62c], 1
jmp 0x100196bf
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0
je 0x100196e9
cmp dword [ebp - 0x3fc], 0
je 0x100196e9
mov dword [ebp - 0x884], 1
jmp 0x100196f0
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0xa80], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa80]
mov dword [ebp + eax - 0xff0], ecx
cmp dword [ebp - 0xa80], 0xfffffffb
je 0x1001972f
mov dword [ebp - 0x63c], 1
jmp 0x10019736
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
cmp eax, dword [ebp - 0x19c]
jg 0x1001975c
mov dword [ebp - 0x88c], 1
jmp 0x10019763
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x298]
imul eax, dword [ebp - 0x88c]
cmp eax, dword [ebp - 0xd48]
jg 0x10019784
mov dword [ebp - 0x644], 1
jmp 0x1001978b
and dword [ebp - 0x644], 0
push 3
lea ecx, [ebp - 0x470]
call fcn.1002106f
mov ecx, dword [ebp - 0x644]
cmp ecx, dword [eax]
jl 0x100197ae
mov dword [ebp - 0x9b4], 1
jmp 0x100197b5
and dword [ebp - 0x9b4], 0
push 1
lea ecx, [ebp - 0x470]
call fcn.1002106f
mov ecx, dword [ebp - 0x9b4]
cmp ecx, dword [eax]
jne 0x100197d8
mov dword [ebp - 0x64c], 1
jmp 0x100197df
and dword [ebp - 0x64c], 0
push 3
lea ecx, [ebp - 0x470]
call fcn.1002106f
mov ecx, dword [ebp - 0x64c]
cmp ecx, dword [eax]
jl 0x10019802
mov dword [ebp - 0x894], 1
jmp 0x10019809
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x894]
neg eax
mov dword [ebp - 0x654], 1
jmp 0x10019824
push 2
lea ecx, [ebp - 0x4b0]
call fcn.1002106f
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x1064], eax
push 0
lea ecx, [ebp - 0x470]
call fcn.1002106f
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xff0]
imul esi, dword [ebp - 0xc8]
push 3
lea ecx, [ebp - 0x470]
call fcn.1002106f
cmp esi, dword [eax]
jge 0x10019893
mov dword [ebp - 0x65c], 1
jmp 0x1001989a
and dword [ebp - 0x65c], 0
push 1
lea ecx, [ebp - 0x4b0]
call fcn.1002106f
mov ecx, dword [ebp - 0x65c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x89c], eax
push 3
lea ecx, [ebp - 0x4b0]
call fcn.1002106f
mov ecx, dword [ebp - 0x89c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x89c], eax
jle 0x10019925
push 1
lea ecx, [ebp - 0x4b0]
call fcn.1002106f
cmp dword [eax], 0xffffffff
jl 0x100198fc
mov dword [ebp - 0x664], 1
jmp 0x10019903
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x494]
add eax, dword [ebp - 0x664]
mov ecx, dword [ebp - 0xd08]
sub ecx, eax
cmp ecx, 2
jb 0x10019925
and dword [ebp - 0x9bc], 0
jmp 0x1001992f
mov dword [ebp - 0x9bc], 1
mov eax, dword [ebp - 0x9bc]
sub eax, dword [ebp - 0x298]
cmp eax, dword [ebp - 0x404]
je 0x1001994f
mov dword [ebp - 0x66c], 1
jmp 0x10019956
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0xb8c]
cmp dword [ebp - 0x66c], eax
jne 0x10019970
mov dword [ebp - 0x8a4], 1
jmp 0x10019977
and dword [ebp - 0x8a4], 0
push 3
lea ecx, [ebp - 0x470]
call fcn.1002106f
mov ecx, dword [ebp - 0x8a4]
sub ecx, dword [eax]
mov dword [ebp - 0x454], ecx
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x470]
call fcn.10021053
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4b0]
call fcn.10021053
mov byte [ebp - 0x228], 1
mov byte [ebp - 0x227], 0x4c
mov byte [ebp - 0x226], 3
mov byte [ebp - 0x225], 0x33
mov byte [ebp - 0x224], 2
mov byte [ebp - 0x223], 2
mov byte [ebp - 0x222], 0x83
mov byte [ebp - 0x221], 9
mov byte [ebp - 0x220], 0x38
mov byte [ebp - 0x21f], 6
mov byte [ebp - 0x21e], 0x1d
mov byte [ebp - 0x21d], 0xb
mov byte [ebp - 0x21c], 0xb
mov byte [ebp - 0x21b], 7
mov byte [ebp - 0x21a], 0x11
mov byte [ebp - 0x219], 5
mov byte [ebp - 0x218], 0x1b
mov byte [ebp - 0x217], 0
mov byte [ebp - 0x216], 0x35
mov byte [ebp - 0x215], 4
mov byte [ebp - 0x214], 0x22
mov byte [ebp - 0x213], 0xa
mov byte [ebp - 0x212], 0x20
mov byte [ebp - 0x211], 8
mov byte [ebp - 0x210], 0x2a
mov byte [ebp - 0x20f], 0xc
mov byte [ebp - 0x20e], 0x38
mov byte [ebp - 0x20d], 2
mov byte [ebp - 0x20c], 0x23
mov dword [ebp - 0x364], 0x82062403
mov byte [ebp - 0xe0], 0
movzx eax, byte [ebp - 0xe0]
test eax, eax
je 0x10019aab
push 0
push 0x208d
push 0
push 0xf14
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
mov dword [ebp - 0x364], 0xfffffffd
jmp 0x10019ac4
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 4
jge 0x10019aed
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x10019aeb
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x10019ab7
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x228]
and eax, 0x29
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x228]
or ecx, 0x29
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x228]
mov byte [ebp + eax - 0xd1c], cl
mov dword [ebp - 0x10f4], 0x7fd5
mov dword [ebp - 0xf10], 1
mov dword [ebp - 0xf18], 0x4182bd7b
push 3
lea ecx, [ebp - 0x1000]
call fcn.10020fd1
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x674], 1
mov dword [ebp - 0x7c], 0
jmp 0x10019b72
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x10019b88
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x129c], 1
jmp 0x10019b6b
mov dword [ebp - 0x7c], 0
jmp 0x10019b98
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x10019bb4
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x1000]
call fcn.1002106f
mov dword [eax], 0x807c
jmp 0x10019b91
mov eax, dword [ebp - 0x674]
inc eax
mov dword [ebp - 0x674], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1000]
call fcn.10021053
mov dword [ebp - 0x34], 2
and dword [ebp - 0x394], 0
jmp 0x10019be8
mov eax, dword [ebp - 0x34]
inc eax
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1d
jae 0x1001a678
push 2
lea ecx, [ebp - 0xd70]
call fcn.10020fd1
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x1114], 0x62d
mov dword [ebp - 0x1110], 0x62d
mov dword [ebp - 0x110c], 0x62d
mov dword [ebp - 0x1108], 0x62d
mov dword [ebp - 0x74], 0
jmp 0x10019c3e
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10019c57
push dword [ebp - 0x74]
lea ecx, [ebp - 0xd70]
call fcn.1002106f
or dword [eax], 0xffffffff
jmp 0x10019c37
mov dword [ebp - 0x74], 0
jmp 0x10019c67
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x10019c7d
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xd58], 0x9bdba76a
jmp 0x10019c60
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xd58], 0
jmp 0x10019cab
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xd58]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xd58], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xd58], 1
jg 0x10019e1b
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0xb48], 0x5b3659ea
mov dword [ebp - 0xcd8], 0x446cd5fe
mov dword [ebp - 0x2a0], 0
jmp 0x10019cf6
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 2
jge 0x10019d12
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0x1044], 0x6128f3b8
jmp 0x10019ce9
mov byte [ebp - 0xe2], 0
movzx eax, byte [ebp - 0xe2]
test eax, eax
je 0x10019d2c
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov eax, dword [ebp - 0x40c]
dec eax
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0xf20], eax
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0xd58]
lea ecx, [ebp - 0xd70]
call fcn.1002106f
cmp dword [eax], 1
jne 0x10019d6e
mov dword [ebp - 0xaa8], 1
jmp 0x10019d75
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0xaa8]
add eax, 0xdb7b
cmp eax, 0x15fb
je 0x10019d93
mov dword [ebp - 0x478], 1
jmp 0x10019d9a
and dword [ebp - 0x478], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x478]
mov dword [ebp + eax - 0x1044], ecx
mov esi, dword [ebp - 0x478]
sub esi, 0x5334db32
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0xd58]
lea ecx, [ebp - 0xd70]
call fcn.1002106f
cmp dword [eax], esi
jle 0x10019de1
mov dword [ebp - 0x67c], 1
jmp 0x10019de8
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
inc eax
cmp eax, dword [ebp - 0xb48]
jge 0x10019e03
mov dword [ebp - 0x8ac], 1
jmp 0x10019e0a
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0xcd8], eax
jmp 0x10019c90
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd70]
call fcn.10021053
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x228]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x34], eax
jne 0x1001a22a
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x228]
inc eax
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x228]
mov ecx, dword [ebp - 0x34]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x34], eax
push 1
lea ecx, [ebp - 0xaa4]
call fcn.10020fd1
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x80], 0
jmp 0x10019e90
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x10019eac
push dword [ebp - 0x80]
lea ecx, [ebp - 0xaa4]
call fcn.1002106f
mov dword [eax], 0xc03342eb
jmp 0x10019e89
mov dword [ebp - 0x80], 0
jmp 0x10019ebc
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x10019ed2
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x102c], 1
jmp 0x10019eb5
push 0
lea ecx, [ebp - 0xaa4]
call fcn.1002106f
and dword [eax], 0
jmp 0x10019f08
push 0
lea ecx, [ebp - 0xaa4]
call fcn.1002106f
mov dword [ebp - 0x684], eax
mov eax, dword [ebp - 0x684]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x684]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xaa4]
call fcn.1002106f
cmp dword [eax], 0xffffffe3
je 0x1001a216
push 3
lea ecx, [ebp - 0xcf4]
call fcn.10020fd1
mov byte [ebp - 4], 0x10
mov dword [ebp - 0xf28], 0x26ff23b1
mov dword [ebp - 0x5c], 0x8cccddd
mov dword [ebp - 0x2a8], 1
mov dword [ebp - 0x2c], 0
jmp 0x10019f5a
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10019f76
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xcf4]
call fcn.1002106f
mov dword [eax], 5
jmp 0x10019f53
mov dword [ebp - 0x2c], 0
jmp 0x10019f86
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10019f9c
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1010], 0xffffffff
jmp 0x10019f7f
mov dword [ebp - 0x2c], 0
jmp 0x10019fac
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x10019fc2
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x12f4], 0
jmp 0x10019fa5
push 2
lea ecx, [ebp - 0xcf4]
call fcn.1002106f
and dword [eax], 0
jmp 0x10019ff8
push 2
lea ecx, [ebp - 0xcf4]
call fcn.1002106f
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp - 0x9c4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9c4]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xcf4]
call fcn.1002106f
cmp dword [eax], 0x1c
jl 0x1001a0f3
mov dword [ebp - 0x68c], 0x6c51
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x5c], 0
jmp 0x1001a035
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jg 0x1001a0ee
mov dword [ebp - 0xb50], 0xb37d0226
mov eax, dword [ebp - 0x5c]
cmp dword [ebp + eax*4 - 0x1010], 0
jne 0x1001a0a1
push 0
lea ecx, [ebp - 0xaa4]
call fcn.1002106f
cmp dword [eax], 0
jl 0x1001a074
mov dword [ebp - 0x8b4], 1
jmp 0x1001a07b
and dword [ebp - 0x8b4], 0
push 0
lea ecx, [ebp - 0xaa4]
call fcn.1002106f
mov ecx, dword [ebp - 0x8b4]
sub ecx, dword [eax]
cmp ecx, 0x5261fc42
je 0x1001a0a1
and dword [ebp - 0x694], 0
jmp 0x1001a0ab
mov dword [ebp - 0x694], 1
mov eax, dword [ebp - 0x694]
inc eax
cmp eax, 6
ja 0x1001a0c3
mov dword [ebp - 0x414], 1
jmp 0x1001a0ca
and dword [ebp - 0x414], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x414]
mov dword [ebp + eax - 0x102c], ecx
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0xb50], eax
jmp 0x1001a02e
jmp 0x10019fd4
mov dword [ebp - 0x5c], 2
jmp 0x1001a103
cmp dword [ebp - 0x5c], 0
jl 0x1001a202
mov dword [ebp - 0xf30], 0x4d258d03
push 2
lea ecx, [ebp - 0x1024]
call fcn.10020fd1
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x32c], 0
jmp 0x1001a141
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 2
jge 0x1001a163
push dword [ebp - 0x32c]
lea ecx, [ebp - 0x1024]
call fcn.1002106f
mov dword [eax], 0x7221ebc5
jmp 0x1001a134
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x1010], 0xf953
push 0
lea ecx, [ebp - 0xaa4]
call fcn.1002106f
cmp dword [eax], 0xf953
jl 0x1001a1b3
mov dword [ebp - 0xf38], 0x7ae2718b
mov dword [ebp - 0xf40], 0x7aebb1bb
mov dword [ebp - 0xa50], 1
mov eax, dword [ebp - 0xa50]
dec eax
mov dword [ebp - 0xa50], eax
jmp 0x1001a1ee
mov dword [ebp - 0x69c], 0xa81f6ed7
mov dword [ebp - 0x2a8], 0xffffffe7
jmp 0x1001a1d6
cmp dword [ebp - 0x2a8], 0xa
je 0x1001a1ee
mov eax, dword [ebp - 0x69c]
dec eax
mov dword [ebp - 0x69c], eax
jmp 0x1001a1c9
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1024]
call fcn.10021053
jmp 0x1001a0fc
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xcf4]
call fcn.10021053
jmp 0x10019ee4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaa4]
call fcn.10021053
jmp 0x10019be0
push 1
lea ecx, [ebp - 0x1060]
call fcn.10020fd1
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x36c], 0xc4d8e5cc
mov dword [ebp - 0xf48], 0xd832937a
mov dword [ebp - 0x8bc], 0x5046
mov dword [ebp - 0xc78], 0x10007b70
cmp dword [ebp - 0x8bc], 0x520f
jle 0x1001a353
and dword [ebp - 0x334], 0
jmp 0x1001a28c
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0x7b00
jge 0x1001a353
and dword [ebp - 0x2b8], 0
jmp 0x1001a2b2
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0x1dfa
jge 0x1001a34e
and dword [ebp - 0x384], 0
jmp 0x1001a2d8
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0x21b
jge 0x1001a349
and dword [ebp - 0x2b0], 0
jmp 0x1001a2fa
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0x9f8
jge 0x1001a347
mov eax, dword [ebp - 0x384]
mov ecx, dword [ebp - 0x2b0]
sar eax, cl
mov ecx, dword [ebp - 0x334]
or ecx, dword [ebp - 0x2b8]
or eax, ecx
cdq
mov dword [ebp - 0xbb8], eax
mov dword [ebp - 0xbb4], edx
push dword [ebp - 0xbb4]
push dword [ebp - 0xbb8]
mov ecx, 0x1061a098
call fcn.10020d91
jmp 0x1001a2ed
jmp 0x1001a2cb
jmp 0x1001a2a5
jmp 0x1001a27f
mov dword [ebp - 0xf50], 0xc660f7e7
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x8bc], 0x4efa
jge 0x1001a37d
mov edx, dword [ebp - 0xc78]
mov ecx, 0x1061a098
call fcn.1002386b
jmp 0x1001a399
mov dword [ebp - 4], 0x12
jmp 0x1001a3a9
mov dword [ebp - 0xf58], 0xff8ee1d1
mov dword [ebp - 0xf60], 5
mov dword [ebp - 0xf68], 0x7c7be021
mov dword [ebp - 0xf70], 0xac7a8cf1
mov dword [ebp - 0xf78], 1
mov dword [ebp - 0xf80], 0xad1532d4
mov dword [ebp - 0x9cc], 0xbaa6f4ed
mov dword [ebp - 0x8c], 0
jmp 0x1001a408
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1001a42a
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x1060]
call fcn.1002106f
mov dword [eax], 0xd3df75dc
jmp 0x1001a3fb
mov dword [ebp - 0x8c], 0
jmp 0x1001a443
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1001a45f
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x1260], 0xbc8b421d
jmp 0x1001a436
mov dword [ebp - 0x36c], 0
jmp 0x1001a478
mov eax, dword [ebp - 0x36c]
dec eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0
jl 0x1001a5fd
mov dword [ebp - 0xf88], 0xfffffffe
mov dword [ebp - 0x6a4], 0x1b8a
mov dword [ebp - 0xb58], 0x10007bc8
cmp dword [ebp - 0x6a4], 0x1cef
jle 0x1001a526
and dword [ebp - 0x2c0], 0
jmp 0x1001a4c5
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x4777
jge 0x1001a526
and dword [ebp - 0x33c], 0
jmp 0x1001a4e7
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x3bfb
jge 0x1001a524
mov eax, dword [ebp - 0x2c0]
and eax, dword [ebp - 0x33c]
cdq
mov dword [ebp - 0xbc4], eax
mov dword [ebp - 0xbc0], edx
push dword [ebp - 0xbc0]
push dword [ebp - 0xbc4]
mov ecx, 0x1061a098
call fcn.10020d91
jmp 0x1001a4da
jmp 0x1001a4b8
mov dword [ebp - 0xf90], 0
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x6a4], 0x1a3f
jge 0x1001a550
mov edx, dword [ebp - 0xb58]
mov ecx, 0x1061a098
call fcn.1002386b
jmp 0x1001a56c
mov dword [ebp - 4], 0x12
jmp 0x1001a57c
mov dword [ebp - 0xf98], 0x1ad67a4b
mov dword [ebp - 0xfa0], 1
push 2
lea ecx, [ebp - 0x1038]
call fcn.10020fd1
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x2c8], 0
jmp 0x1001a5ba
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 2
jge 0x1001a5dc
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0x1038]
call fcn.1002106f
mov dword [eax], 0xfffffffa
jmp 0x1001a5ad
mov eax, dword [ebp - 0x9cc]
inc eax
mov dword [ebp - 0x9cc], eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1038]
call fcn.10021053
jmp 0x1001a46b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1060]
call fcn.10021053
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x394]
movzx eax, byte [ebp + eax - 0x22a]
movsx eax, byte [ebp + eax - 0xd1c]
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ebp + ecx - 0x227]
and ecx, eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x394]
movzx eax, byte [ebp + eax - 0x22a]
movsx eax, byte [ebp + eax - 0xd1c]
mov edx, dword [ebp - 0x34]
movzx edx, byte [ebp + edx - 0x227]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x228]
mov byte [ebp + eax - 0xd1c], dl
and dword [ebp - 0x394], 0
jmp 0x10019be0
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xd1c], 0
mov dword [ebp - 0x2d0], 0xfffffffd
mov dword [ebp - 0x6ac], 9
mov dword [ebp - 0xd28], 0x12265e3e
mov dword [ebp - 0xfa8], 0x2391cb4e
mov byte [ebp - 0x164], 0
movzx eax, byte [ebp - 0x164]
test eax, eax
je 0x1001a6cb
push 0x13f4
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [ebp - 0x6ac], 0x3707
mov eax, dword [ebp - 0x2d0]
dec eax
cmp eax, dword [ebp - 0x6ac]
jl 0x1001a6f0
mov dword [ebp - 0x6b4], 1
jmp 0x1001a6f7
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x2d0], 0x69f3
jne 0x1001a70f
mov dword [ebp - 0x8c4], 1
jmp 0x1001a716
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x2d0]
cmp dword [ebp - 0x8c4], eax
jl 0x1001a730
mov dword [ebp - 0xa88], 1
jmp 0x1001a737
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x6b4]
cmp eax, dword [ebp - 0xa88]
jl 0x1001a751
mov dword [ebp - 0x6bc], 1
jmp 0x1001a758
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x2d0]
cmp dword [ebp - 0x6bc], eax
jge 0x1001a772
mov dword [ebp - 0x8cc], 1
jmp 0x1001a779
and dword [ebp - 0x8cc], 0
cmp dword [ebp - 0x8cc], 0x7cb3
je 0x1001a791
mov dword [ebp - 0x6c4], 1
jmp 0x1001a798
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd1c]
push eax
lea ecx, [ebp - 0x12cc]
call fcn.10020f3a
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0xb60]
mov dword [ebp - 0xc80], eax
mov dword [ebp - 4], 0x18
mov edx, dword [ebp - 0x6c0]
mov ecx, dword [ebp - 0xc80]
call fcn.1000a768
mov dword [0x1061b1cc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12cc]
call fcn.10020f5d
push 3
lea ecx, [ebp - 0xd7c]
call fcn.10020fd1
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x17c], 0xfffffffb
mov dword [ebp - 0x344], 0
jmp 0x1001a82b
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 3
jge 0x1001a84d
push dword [ebp - 0x344]
lea ecx, [ebp - 0xd7c]
call fcn.1002106f
mov dword [eax], 0x8261f9c2
jmp 0x1001a81e
mov byte [ebp - 0xe4], 0
movzx eax, byte [ebp - 0xe4]
test eax, eax
je 0x1001a869
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [ebp - 0x17c], 2
jmp 0x1001a882
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jl 0x1001a92a
mov dword [ebp - 0x2d8], 0
jmp 0x1001a8a8
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 3
jge 0x1001a8c4
mov eax, dword [ebp - 0x2d8]
mov dword [ebp + eax*4 - 0x11b4], 8
jmp 0x1001a89b
push dword [ebp - 0x17c]
lea ecx, [ebp - 0xd7c]
call fcn.1002106f
mov dword [ebp - 0x9d4], eax
push dword [ebp - 0x17c]
lea ecx, [ebp - 0xd7c]
call fcn.1002106f
mov ecx, dword [ebp - 0x9d4]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x9d4]
mov ecx, dword [ecx]
mov dword [ebp + eax - 0x11b4], ecx
mov byte [ebp - 0x166], 0
movzx eax, byte [ebp - 0x166]
test eax, eax
je 0x1001a925
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x1001a875
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd7c]
call fcn.10021053
and dword [ebp - 0x374], 0
jmp 0x1001a94f
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0xe
jae 0x1001aece
mov dword [ebp - 0xdd4], 0xe1b1b552
mov dword [ebp - 0xdd0], 0xe1b1b552
mov dword [ebp - 0xdcc], 0xe1b1b552
mov dword [ebp - 0xdc8], 0xe1b1b552
lea ecx, [ebp - 0x43d]
call fcn.1002107e
push eax
lea eax, [ebp - 0xdc4]
push eax
lea eax, [ebp - 0xdd4]
push eax
lea ecx, [ebp - 0x11e4]
call fcn.10021081
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb08]
call fcn.1002102d
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x41c], 0xffffffff
push 3
lea ecx, [ebp - 0xad0]
call fcn.10020fd1
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0xdfc], 0x9052196d
mov dword [ebp - 0xdf8], 0x9052196d
mov dword [ebp - 0xdf4], 0x9052196d
mov dword [ebp - 0xdf0], 0x9052196d
lea ecx, [ebp - 0x41d]
call fcn.1002107e
push eax
lea eax, [ebp - 0xdec]
push eax
lea eax, [ebp - 0xdfc]
push eax
lea ecx, [ebp - 0x1244]
call fcn.10021081
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1070]
call fcn.1002102d
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x94], 0
jmp 0x1001aa55
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x1001aa71
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xae4], 0xb9102071
jmp 0x1001aa48
mov dword [ebp - 0x94], 0
jmp 0x1001aa8a
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x1001aaac
push dword [ebp - 0x94]
lea ecx, [ebp - 0xad0]
call fcn.1002106f
mov dword [eax], 0xffff
jmp 0x1001aa7d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xae4], 0
je 0x1001ae72
mov dword [ebp - 0x194], 0xd982
push 2
lea ecx, [ebp - 0xb08]
call fcn.1002106f
cmp dword [eax], 0x3c225155
jge 0x1001aaeb
mov dword [ebp - 0x6cc], 1
jmp 0x1001aaf2
and dword [ebp - 0x6cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xae4]
cmp eax, dword [ebp - 0x6cc]
je 0x1001ab13
mov dword [ebp - 0x6dc], 1
jmp 0x1001ab1a
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x194], 0x351a9382
jl 0x1001ab32
mov dword [ebp - 0x8d4], 1
jmp 0x1001ab39
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x8d4], eax
jl 0x1001ab53
mov dword [ebp - 0x6d4], 1
jmp 0x1001ab5a
and dword [ebp - 0x6d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xae4]
cmp dword [ebp - 0x6d4], eax
jne 0x1001ab7b
mov dword [ebp - 0xa58], 1
jmp 0x1001ab82
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0xa58]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0x411a
jne 0x1001aba6
mov dword [ebp - 0x464], 1
jmp 0x1001abad
and dword [ebp - 0x464], 0
push 1
lea ecx, [ebp - 0xad0]
call fcn.1002106f
mov ecx, dword [ebp - 0x464]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6dc]
cmp eax, dword [ebp - 0x464]
jle 0x1001abdc
mov dword [ebp - 0x8dc], 1
jmp 0x1001abe3
and dword [ebp - 0x8dc], 0
push 2
lea ecx, [ebp - 0xb08]
call fcn.1002106f
mov ecx, dword [ebp - 0x8dc]
cmp ecx, dword [eax]
jne 0x1001ac06
mov dword [ebp - 0xb68], 1
jmp 0x1001ac0d
and dword [ebp - 0xb68], 0
push 2
lea ecx, [ebp - 0xb08]
call fcn.1002106f
push 0
lea ecx, [ebp - 0xb08]
call fcn.1002106f
push 1
lea ecx, [ebp - 0xad0]
call fcn.1002106f
cmp dword [eax], 0
jne 0x1001ac54
push 1
lea ecx, [ebp - 0xad0]
call fcn.1002106f
cmp dword [eax], 0
jne 0x1001ac54
mov dword [ebp - 0x6e4], 1
imul eax, dword [ebp - 0x6e4], 0xffff
test eax, eax
je 0x1001ae56
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x1001ae8e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1070]
call fcn.10021053
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xad0]
call fcn.10021053
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb08]
call fcn.10021053
mov eax, dword [ebp - 0x374]
mov byte [ebp + eax - 0xd1c], 0
jmp 0x1001a942
mov dword [ebp - 0x38], 0x3ae35568
mov dword [ebp - 0xe24], 0x2a3062a
mov dword [ebp - 0xe20], 0x2a3062a
mov dword [ebp - 0xe1c], 0x2a3062a
mov dword [ebp - 0xe18], 0x2a3062a
lea ecx, [ebp - 0x425]
call fcn.1002107e
push eax
lea eax, [ebp - 0xe14]
push eax
lea eax, [ebp - 0xe24]
push eax
lea ecx, [ebp - 0x11f4]
call fcn.10021081
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2fc]
call fcn.1002102d
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x70c], 0x5877
mov dword [ebp - 0xc88], 0x10007c20
cmp dword [ebp - 0x70c], 0x5acc
jle 0x1001b00a
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
and dword [ebp - 0x2e0], 0
jmp 0x1001af79
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0x6c72
jge 0x1001b00a
and dword [ebp - 0x34c], 0
jmp 0x1001af9f
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0x6291
jge 0x1001b005
mov eax, dword [ebp - 0x2e0]
cdq
idiv dword [ebp - 0x34c]
mov eax, edx
cdq
mov dword [ebp - 0xbd0], eax
mov dword [ebp - 0xbcc], edx
push dword [ebp - 0xbcc]
push dword [ebp - 0xbd0]
lea ecx, [ebp - 0x1290]
call fcn.1000a6be
pop ecx
pop ecx
mov dword [ebp - 0xb70], eax
mov ecx, dword [ebp - 0xb70]
call fcn.10020d71
push eax
call fcn.1005a6cf
pop ecx
lea ecx, [ebp - 0x1290]
call fcn.10020d67
jmp 0x1001af92
jmp 0x1001af6c
mov dword [ebp - 0xfc], 0xffffffff
mov byte [ebp - 4], 0x1e
cmp dword [ebp - 0x70c], 0x5635
jge 0x1001b030
push dword [ebp - 0xc88]
call fcn.1005a6cf
pop ecx
jmp 0x1001b04c
mov dword [ebp - 4], 0x1d
jmp 0x1001b05c
mov dword [ebp - 0xb88], 0xb9e2bf2d
mov dword [ebp - 0x38], 0
jmp 0x1001b076
cmp dword [ebp - 0x38], 0x1a
jg 0x1001b354
mov dword [ebp - 0x2e8], 0xd66a0756
mov dword [ebp - 0x480], 0xfffffffe
mov dword [ebp - 0x8fc], 0xffffffff
mov dword [ebp - 0x72c], 0xe7504ed0
mov dword [ebp - 0x1d0], 0xffff
mov dword [ebp - 0x90c], 0x9cde30ec
cmp dword [ebp - 0x2e8], 0
je 0x1001b205
cmp dword [ebp - 0x38], 0xfff7
jbe 0x1001b0de
mov dword [ebp - 0x8f4], 1
jmp 0x1001b0e5
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
jne 0x1001b107
push 1
lea ecx, [ebp - 0x2fc]
call fcn.1002106f
mov eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0x38]
jge 0x1001b11e
mov dword [ebp - 0x714], 1
jmp 0x1001b125
and dword [ebp - 0x714], 0
cmp dword [ebp - 0x714], 0x4f77722a
jge 0x1001b13d
mov dword [ebp - 0xa60], 1
jmp 0x1001b144
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0xa60], eax
je 0x1001b15e
mov dword [ebp - 0x71c], 1
jmp 0x1001b165
and dword [ebp - 0x71c], 0
push 3
lea ecx, [ebp - 0x2fc]
call fcn.1002106f
mov ecx, dword [ebp - 0x71c]
sub ecx, dword [eax]
mov dword [ebp - 0xfc], ecx
cmp dword [ebp - 0xfc], 0
mov dword [ebp - 0x8fc], 0x6bd29a2a
cmp dword [ebp - 0x8fc], 0
je 0x1001b1ad
push 8
pop eax
test eax, eax
je 0x1001b1ad
mov dword [ebp - 0x724], 1
jmp 0x1001b1b4
and dword [ebp - 0x724], 0
cmp dword [ebp - 0x724], 0xd711
je 0x1001b1cc
mov dword [ebp - 0x9ec], 1
jmp 0x1001b1d3
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x72c], eax
mov esi, dword [ebp - 0x72c]
push 0
lea ecx, [ebp - 0x2fc]
call fcn.1002106f
imul esi, dword [eax]
test esi, esi
je 0x1001b205
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x904]
jge 0x1001b223
mov dword [ebp - 0x734], 1
jmp 0x1001b22a
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0x1d0]
jl 0x1001b24a
mov dword [ebp - 0xa90], 1
jmp 0x1001b251
and dword [ebp - 0xa90], 0
cmp dword [ebp - 0xa90], 0x36ce
jge 0x1001b269
mov dword [ebp - 0x73c], 1
jmp 0x1001b270
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x90c], eax
or esi, 0xffffffff
sub esi, dword [ebp - 0x90c]
push 3
lea ecx, [ebp - 0x2fc]
call fcn.1002106f
cmp esi, dword [eax]
jle 0x1001b2a2
mov dword [ebp - 0x744], 1
jmp 0x1001b2a9
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x744]
test eax, eax
je 0x1001b328
mov dword [ebp - 0x1d0], 0xfffffffa
jmp 0x1001b2d0
cmp dword [ebp - 0x1d0], 0x37
jne 0x1001b326
mov dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0x10b0], eax
push 0
lea ecx, [ebp - 0x2fc]
call fcn.1002106f
cmp dword [eax], 0
jne 0x1001b30e
jmp 0x1001b344
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1001b344
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp - 0xfc], 0
je 0x1001b34f
jmp 0x1001b354
jmp 0x1001b06f
mov dword [ebp - 0xfc], 0x18
jmp 0x1001b36d
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x17
jl 0x1001b664
mov dword [ebp - 0xc90], 1
mov dword [ebp - 0x38], 6
jmp 0x1001b394
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff2
jl 0x1001b65f
mov dword [ebp - 0x104], 1
mov dword [ebp - 0x104], 0xc
jmp 0x1001b3c1
cmp dword [ebp - 0x104], 0xfffffffd
jle 0x1001b630
mov dword [ebp - 0x24], 0x33db9622
mov dword [ebp - 0x24], 0
jmp 0x1001b3e5
cmp dword [ebp - 0x24], 3
jg 0x1001b62b
mov dword [ebp - 0xa68], 1
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x24]
jl 0x1001b410
jmp 0x1001b3b4
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x1001b65a
push 0
push 0xc58
push 0
push 0x55
push 0
push 0xc42
call dword [sym.imp.USER32.dll_DrawTextExW]
jmp 0x1001b38d
jmp 0x1001b360
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.10021053
push 2
lea ecx, [ebp - 0x4d4]
call fcn.10020fd1
mov dword [ebp - 4], 0x20
mov dword [ebp - 0xd8], 6
mov dword [ebp - 0x2f0], 0
jmp 0x1001b6aa
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 2
jge 0x1001b6cc
push dword [ebp - 0x2f0]
lea ecx, [ebp - 0x4d4]
call fcn.1002106f
mov dword [eax], 0xdf75dcec
jmp 0x1001b69d
mov dword [ebp - 0xd8], 0
jmp 0x1001b6e5
cmp dword [ebp - 0xd8], 1
jg 0x1001b91a
mov dword [ebp - 0x9c], 0
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x4d4]
call fcn.1002106f
mov dword [eax], 0xfffffffd
mov dword [ebp - 0x9c], 1
jmp 0x1001b72c
cmp dword [ebp - 0x9c], 0
jl 0x1001b915
mov dword [ebp - 0x1b0], 0xfffffffd
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x4d4]
call fcn.1002106f
cmp dword [eax], 0
je 0x1001b75e
jmp 0x1001b6d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d4]
call fcn.10021053
mov byte [ebp - 0x208], 4
mov byte [ebp - 0x207], 0x91
mov byte [ebp - 0x206], 0
mov byte [ebp - 0x205], 0x37
mov byte [ebp - 0x204], 6
mov byte [ebp - 0x203], 0x13
mov byte [ebp - 0x202], 0xb
mov byte [ebp - 0x201], 0x23
mov byte [ebp - 0x200], 1
mov byte [ebp - 0x1ff], 1
mov byte [ebp - 0x1fe], 3
mov byte [ebp - 0x1fd], 5
mov byte [ebp - 0x1fc], 0x1b
mov byte [ebp - 0x1fb], 0xc1
mov byte [ebp - 0x1fa], 8
mov byte [ebp - 0x1f9], 0x1d
mov byte [ebp - 0x1f8], 2
mov byte [ebp - 0x1f7], 0xa
mov byte [ebp - 0x1f6], 5
mov byte [ebp - 0x1f5], 0
mov byte [ebp - 0x1f4], 7
mov byte [ebp - 0x1f3], 0x17
mov byte [ebp - 0x1f2], 9
mov byte [ebp - 0x1f1], 0x11
mov byte [ebp - 0x1f0], 0xd
mov byte [ebp - 0x1ef], 0x34
mov byte [ebp - 0x1ee], 3
mov byte [ebp - 0x1ed], 0x36
mov byte [ebp - 0x1ec], 0xc
mov byte [ebp - 0x1eb], 0x12
mov byte [ebp - 0x1ea], 0xa
mov byte [ebp - 0x1e9], 0x16
mov dword [ebp - 0x10c0], 0xffffffff
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1001ba30
push 0x1ab4
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov byte [ebp - 0x15b], 0
movzx eax, byte [ebp - 0x15b]
test eax, eax
je 0x1001ba5c
push 0xf8c
push 0x2cc
push 0x20e4
push 0xfbc
call dword [sym.imp.USER32.dll_CheckRadioButton]
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x208]
and eax, 0xe5
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x208]
or ecx, 0xe5
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x208]
mov byte [ebp + eax - 0xb38], cl
mov dword [ebp - 0x28], 0x4dd03248
push 2
lea ecx, [ebp - 0xadc]
call fcn.10020fd1
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x78], 0x9bca7b5c
mov dword [ebp - 0x7ac], 0x4ab653b1
mov dword [ebp - 0xaf4], 0x4dfd9964
mov dword [ebp - 0xaf0], 0x4dfd9964
mov dword [ebp - 0xaec], 0x4dfd9964
mov dword [ebp - 0xae8], 0x4dfd9964
mov dword [ebp - 0xc98], 1
mov dword [ebp - 0x7c4], 0x7f0a061f
mov dword [ebp - 0xba0], 0x628f0fc5
mov dword [ebp - 0x23c], 0
jmp 0x1001bb25
mov dword [ebp - 0x1d4], 7
mov dword [ebp - 0x1d4], 0xb
jmp 0x1001d0e4
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0xfffffff7
jg 0x1001d13f
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1001d132
push 0x19fa
push 0xb1b
push 0xf4e
push 0x7b2
push 0x13db
push 0xfb8
push 0x2e1
push 0x229
push 0x4e8
call dword [sym.imp.GDI32.dll_Arc]
cmp dword [ebp - 0x1d4], 0
je 0x1001d13d
jmp 0x1001d13f
jmp 0x1001d0d7
mov eax, dword [0x1061b1cc]
cmp eax, dword [ebp - 0x350]
je 0x1001d15d
mov eax, dword [0x1061b310]
cmp eax, dword [ebp - 0x350]
jne 0x1001d855
mov dword [ebp - 0x44], 0x13b91020
push 3
lea ecx, [ebp - 0xab4]
call fcn.10020fd1
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x2cc], 1
mov dword [ebp - 0x43c], 0xffffffff
mov dword [ebp - 0xd04], 0xe1947684
mov dword [ebp - 0x2ac], 0
jmp 0x1001d1af
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 3
jge 0x1001d1d1
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0xab4]
call fcn.1002106f
mov dword [eax], 1
jmp 0x1001d1a2
mov dword [ebp - 0x44], 0
jmp 0x1001d1e1
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffffb
je 0x1001d82e
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0xc30], 0xffffffff
mov dword [ebp - 0x6c8], 0x1167
mov dword [ebp - 0xc10], 0x10007cbc
cmp dword [ebp - 0x6c8], 0x1171
jle 0x1001d2df
push 0x1e19
push 0
push 0x158f
call dword [sym.imp.USER32.dll_GetWindowTextW]
and dword [ebp - 0x2bc], 0
jmp 0x1001d24b
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0x64c1
jge 0x1001d2df
and dword [ebp - 0x22c], 0
jmp 0x1001d271
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0x292
jge 0x1001d2da
and dword [ebp - 0x2b4], 0
jmp 0x1001d293
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x6e53
jge 0x1001d2d8
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x2b4]
shl eax, cl
or eax, dword [ebp - 0x2bc]
cdq
mov dword [ebp - 0xbe8], eax
mov dword [ebp - 0xbe4], edx
push dword [ebp - 0xbe4]
push dword [ebp - 0xbe8]
mov ecx, 0x1061a098
call fcn.10020d91
jmp 0x1001d286
jmp 0x1001d264
jmp 0x1001d23e
mov dword [ebp - 0x1148], 0x504dbf0c
mov byte [ebp - 4], 0x28
cmp dword [ebp - 0x6c8], 0x1098
jge 0x1001d309
mov edx, dword [ebp - 0xc10]
mov ecx, 0x1061a098
call fcn.1002386b
jmp 0x1001d325
mov dword [ebp - 4], 0x27
jmp 0x1001d335
mov dword [ebp - 0xc28], 0xfffffffd
mov dword [ebp - 0x2d4], 0x5da2ca33
mov dword [ebp - 0xf14], 0xe2bf35d
mov dword [ebp - 0xf0c], 0xba8d7d2a
mov dword [ebp - 0xc18], 7
mov dword [ebp - 0xf1c], 0xfffffff6
mov dword [ebp - 0x730], 0xd6937652
mov dword [ebp - 0x1158], 0xfffffff6
mov dword [ebp - 0xf24], 0xb0598737
mov dword [ebp - 0x1084], 0xd5b481d3
mov dword [ebp - 0xf2c], 0xffffffff
mov dword [ebp - 0x1098], 1
mov dword [ebp - 0xf34], 0xfffffffb
mov dword [ebp - 0x30], 0
jmp 0x1001d3c7
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1001d3dd
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x11c4], 0xffffffff
jmp 0x1001d3c0
mov dword [ebp - 0x30], 0
jmp 0x1001d3ed
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1001d403
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xd84], 0x9ff7503a
jmp 0x1001d3e6
mov dword [ebp - 0x30], 0
jmp 0x1001d413
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1001d429
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x11d4], 8
jmp 0x1001d40c
cmp dword [ebp - 0x2c4], 0xfffffffb
jae 0x1001d493
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1094], eax
cmp dword [ebp - 0x44], 0
jle 0x1001d44d
mov dword [ebp - 0xca8], 1
jmp 0x1001d454
and dword [ebp - 0xca8], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0xf3c], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x10a0], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10a8], eax
cmp dword [ebp - 0x2c4], 0
je 0x1001d493
mov dword [ebp - 0x6d0], 1
jmp 0x1001d49a
and dword [ebp - 0x6d0], 0
push 0
lea ecx, [ebp - 0xab4]
call fcn.1002106f
mov ecx, dword [ebp - 0x6d0]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0xab4]
call fcn.1002106f
cmp dword [eax], 0
jne 0x1001d4d0
cmp dword [ebp - 0x44], 0
jne 0x1001d4d0
and dword [ebp - 0x710], 0
jmp 0x1001d4da
mov dword [ebp - 0x710], 1
push 2
lea ecx, [ebp - 0xab4]
call fcn.1002106f
cmp dword [eax], 0
je 0x1001d624
cmp dword [ebp - 0xc18], 0
jne 0x1001d51a
push 0
lea ecx, [ebp - 0xab4]
call fcn.1002106f
cmp dword [eax], 0
jne 0x1001d51a
cmp dword [ebp - 0x44], 0
jne 0x1001d51a
and dword [ebp - 0x6d8], 0
jmp 0x1001d524
mov dword [ebp - 0x6d8], 1
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x43c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x43c]
sub ecx, dword [ebp + eax - 0xd84]
je 0x1001d55a
cmp dword [ebp - 0xd04], 0
je 0x1001d55a
mov dword [ebp - 0x6e0], 1
jmp 0x1001d561
and dword [ebp - 0x6e0], 0
cmp dword [ebp - 0x6e0], 0xb37
jne 0x1001d579
mov dword [ebp - 0x6e8], 1
jmp 0x1001d580
and dword [ebp - 0x6e8], 0
cmp dword [ebp - 0x6e8], 0xffffffff
je 0x1001d595
mov dword [ebp - 0x6f0], 1
jmp 0x1001d59c
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x6f0], eax
jne 0x1001d5b6
cmp dword [ebp - 0x44], 0
jne 0x1001d5b6
and dword [ebp - 0x6f8], 0
jmp 0x1001d5c0
mov dword [ebp - 0x6f8], 1
cmp dword [ebp - 0x6f8], 0xffffffff
jne 0x1001d5d5
mov dword [ebp - 0x700], 1
jmp 0x1001d5dc
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x700]
sub eax, 0x5738
cmp eax, 0xe691
jl 0x1001d5fa
mov dword [ebp - 0x708], 1
jmp 0x1001d601
and dword [ebp - 0x708], 0
push 0
lea ecx, [ebp - 0xab4]
call fcn.1002106f
mov eax, dword [eax]
sub eax, dword [ebp - 0x708]
je 0x1001d624
mov dword [ebp - 0x718], 1
jmp 0x1001d62b
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x710]
sub eax, dword [ebp - 0x718]
jne 0x1001d64b
mov eax, 0x5b627429
test eax, eax
jne 0x1001d64b
and dword [ebp - 0x720], 0
jmp 0x1001d655
mov dword [ebp - 0x720], 1
mov eax, dword [ebp - 0x720]
add eax, 0x30e0
mov ecx, dword [ebp - 0x2cc]
imul ecx, eax
mov dword [ebp - 0xc20], ecx
push 0
lea ecx, [ebp - 0xab4]
call fcn.1002106f
mov eax, dword [eax]
mov dword [ebp - 0xcb0], eax
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0xc20]
cmp eax, dword [ebp - 0xcb0]
jle 0x1001d6ab
mov dword [ebp - 0x728], 1
jmp 0x1001d6b2
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 0
je 0x1001d7e8
mov dword [ebp - 0xc4], 0xfffffff9
xor eax, eax
jne 0x1001d6f2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x11d4], 0
jne 0x1001d6f2
and dword [ebp - 0x738], 0
jmp 0x1001d6fc
mov dword [ebp - 0x738], 1
mov eax, dword [ebp - 0x738]
sub eax, dword [ebp - 0x43c]
jne 0x1001d71c
cmp dword [ebp - 0xc28], 0
jne 0x1001d71c
and dword [ebp - 0xd30], 0
jmp 0x1001d726
mov dword [ebp - 0xd30], 1
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x10fc], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xf54], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x10a4], eax
cmp dword [ebp - 0xc4], 0
jne 0x1001d771
cmp dword [ebp - 0xc4], 0
jne 0x1001d771
and dword [ebp - 0x740], 0
jmp 0x1001d77b
mov dword [ebp - 0x740], 1
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x740]
cmp eax, 0xffffffff
jne 0x1001d798
mov dword [ebp - 0x748], 1
jmp 0x1001d79f
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x645c
jle 0x1001d7c9
cmp dword [ebp - 0xc30], 0
jne 0x1001d7c9
and dword [ebp - 0x750], 0
jmp 0x1001d7d3
mov dword [ebp - 0x750], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x750]
mov dword [ebp + eax - 0xd84], ecx
jmp 0x1001d829
mov dword [ebp - 0x2d4], 1
jmp 0x1001d801
mov eax, dword [ebp - 0x2d4]
dec eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0
jl 0x1001d829
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x1001d827
push 0x22f7
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x1001d7f4
jmp 0x1001d1da
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xab4]
call fcn.10021053
mov ecx, dword [ebp + 0xc]
call fcn.10020d71
push eax
push dword [ebp + 8]
call fcn.10012621
pop ecx
pop ecx
jmp 0x1001fd6f
mov dword [ebp - 0x1a4], 0x8ec0ae97
mov dword [ebp - 0x2dc], 0
jmp 0x1001d878
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 3
jge 0x1001d894
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0x1190], 0xfff9
jmp 0x1001d86b
mov dword [ebp - 0x1a4], 0xffffffe6
jmp 0x1001d8ad
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0x14
jle 0x1001dac5
push 3
lea ecx, [ebp - 0xe3c]
call fcn.10020fd1
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0xcc], 0xd53bc6e5
mov dword [ebp - 0x2e4], 0
jmp 0x1001d8f1
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 3
jge 0x1001d913
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0xe3c]
call fcn.1002106f
mov dword [eax], 0x386c
jmp 0x1001d8e4
mov dword [ebp - 0xcc], 2
jmp 0x1001d92c
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x1001d999
mov dword [ebp - 0x2ec], 7
mov dword [ebp - 0x2ec], 0
jmp 0x1001d958
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 2
jg 0x1001d997
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1001d97b
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1001d995
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1001d94b
jmp 0x1001d91f
push 0
lea ecx, [ebp - 0xe3c]
call fcn.1002106f
cmp dword [eax], 1
jle 0x1001d9b7
mov dword [ebp - 0x758], 1
jmp 0x1001d9be
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x758], eax
jg 0x1001da7a
mov eax, dword [ebp - 0x1a4]
neg eax
add eax, 0x1780
cmp eax, 0xffff
jbe 0x1001d9f0
mov dword [ebp - 0x760], 1
jmp 0x1001d9f7
and dword [ebp - 0x760], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1190]
cmp dword [ebp - 0x760], eax
jl 0x1001da17
mov dword [ebp - 0x768], 1
jmp 0x1001da1e
and dword [ebp - 0x768], 0
cmp dword [ebp - 0x768], 0
jne 0x1001da33
mov dword [ebp - 0x770], 1
jmp 0x1001da3a
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x770], eax
je 0x1001da54
mov dword [ebp - 0x778], 1
jmp 0x1001da5b
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
sub eax, dword [ebp - 0x1a4]
sub eax, 0x247b395d
je 0x1001da7a
mov dword [ebp - 0x780], 1
jmp 0x1001da81
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x780]
sub eax, 0xa
cmp eax, dword [ebp - 0xcc]
jne 0x1001da9e
mov dword [ebp - 0x788], 1
jmp 0x1001daa5
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0xcc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe3c]
call fcn.10021053
jmp 0x1001d8a0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x234], 0xba76
push 4
lea ecx, [ebp - 0x3d0]
call fcn.10020fd1
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x114], 0xd87e
mov dword [ebp - 0x58], 0xe5077045
mov dword [ebp - 0x230], 0
jmp 0x1001db16
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 4
jge 0x1001db38
push dword [ebp - 0x230]
lea ecx, [ebp - 0x3d0]
call fcn.1002106f
mov dword [eax], 0x1d89
jmp 0x1001db09
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0xf5c], eax
push 3
lea ecx, [ebp - 0x3d0]
call fcn.1002106f
push 2
lea ecx, [ebp - 0x3d0]
call fcn.1002106f
cmp dword [ebp - 0x234], 0x415fb57a
jg 0x1001db76
mov dword [ebp - 0x790], 1
jmp 0x1001db7d
and dword [ebp - 0x790], 0
push 2
lea ecx, [ebp - 0x3d0]
call fcn.1002106f
mov ecx, dword [ebp - 0x790]
cmp ecx, dword [eax]
jge 0x1001dba0
mov dword [ebp - 0x798], 1
jmp 0x1001dba7
and dword [ebp - 0x798], 0
push 3
lea ecx, [ebp - 0x3d0]
call fcn.1002106f
mov ecx, dword [ebp - 0x798]
cmp ecx, dword [eax]
jle 0x1001dbca
mov dword [ebp - 0x7a0], 1
jmp 0x1001dbd1
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x7a0], eax
je 0x1001dbeb
mov dword [ebp - 0x7a8], 1
jmp 0x1001dbf2
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x58], eax
mov esi, dword [ebp - 0x58]
push 2
lea ecx, [ebp - 0x3d0]
call fcn.1002106f
cmp esi, dword [eax]
jge 0x1001dc21
mov eax, 0x9ff4
test eax, eax
jne 0x1001dc21
and dword [ebp - 0x7b0], 0
jmp 0x1001dc2b
mov dword [ebp - 0x7b0], 1
push 3
lea ecx, [ebp - 0x3d0]
call fcn.1002106f
mov ecx, dword [ebp - 0x7b0]
cmp ecx, dword [eax]
jl 0x1001dc54
mov eax, 0x2273
test eax, eax
jne 0x1001dc54
and dword [ebp - 0x7b8], 0
jmp 0x1001dc5e
mov dword [ebp - 0x7b8], 1
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0x7b8], eax
jge 0x1001dc78
mov dword [ebp - 0xcb8], 1
jmp 0x1001dc7f
and dword [ebp - 0xcb8], 0
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1002106f
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1002106f
mov esi, eax
push 3
lea ecx, [ebp - 0x3d0]
call fcn.1002106f
mov eax, dword [eax]
sub eax, dword [esi]
je 0x1001dcc3
mov eax, 0x586f
test eax, eax
je 0x1001dcc3
mov dword [ebp - 0x7c0], 1
jmp 0x1001dcca
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x7c0], eax
jne 0x1001dce4
mov dword [ebp - 0x7c8], 1
jmp 0x1001dceb
and dword [ebp - 0x7c8], 0
imul eax, dword [ebp - 0x234], 0x97a8
add eax, dword [ebp - 0x7c8]
je 0x1001ddb2
mov dword [ebp - 0x114], 0
jmp 0x1001dd1a
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jg 0x1001ddb0
mov dword [ebp - 0x58], 0
jmp 0x1001dd37
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jg 0x1001dd77
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x1001dd5d
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
push dword [ebp - 0x114]
lea ecx, [ebp - 0x3d0]
call fcn.1002106f
cmp dword [eax], 0
je 0x1001dd75
jmp 0x1001dd77
jmp 0x1001dd30
mov dword [ebp - 0x58], 0
jmp 0x1001dd87
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jg 0x1001ddab
mov byte [ebp - 0x163], 0
movzx eax, byte [ebp - 0x163]
test eax, eax
je 0x1001dda9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
jmp 0x1001dd80
jmp 0x1001dd0d
jmp 0x1001dde8
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1001ddca
call dword [sym.imp.USER32.dll_DestroyCaret]
mov byte [ebp - 0x15f], 0
movzx eax, byte [ebp - 0x15f]
test eax, eax
je 0x1001dde8
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3d0]
call fcn.10021053
cmp dword [ebp - 0x308], 0
je 0x1001f942
mov eax, dword [ebp - 0x308]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1001f942
mov dword [ebp - 0xd4], 0xea5d6c05
mov dword [ebp - 0xc38], 0xffffffff
mov byte [ebp - 0x156], 0
movzx eax, byte [ebp - 0x156]
test eax, eax
je 0x1001de49
push 0x18c8
call dword [sym.imp.USER32.dll_GetKeyboardType]
mov dword [ebp - 0xd4], 0
jmp 0x1001de62
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xfffffffc
jl 0x1001dfcc
mov dword [ebp - 0x18c], 0xfffffff8
mov dword [ebp - 0x18c], 0
jmp 0x1001de92
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0x14
jge 0x1001dfc7
mov dword [ebp - 0x3d8], 0xffffffff
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x1138], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xf64], eax
mov eax, dword [ebp - 0x3d8]
cmp eax, dword [ebp - 0x3d8]
jg 0x1001dedb
mov dword [ebp - 0x7d0], 1
jmp 0x1001dee2
and dword [ebp - 0x7d0], 0
cmp dword [ebp - 0x7d0], 0
jle 0x1001def7
mov dword [ebp - 0x7d8], 1
jmp 0x1001defe
and dword [ebp - 0x7d8], 0
cmp dword [ebp - 0x7d8], 0xa9b
jl 0x1001df16
mov dword [ebp - 0x7e0], 1
jmp 0x1001df1d
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x18c]
imul eax, dword [ebp - 0x7e0]
mov ecx, dword [ebp - 0x18c]
imul ecx, eax
imul ecx, dword [ebp - 0x3d8]
test ecx, ecx
jne 0x1001df50
cmp dword [ebp - 0xd4], 0
jne 0x1001df50
and dword [ebp - 0x7e8], 0
jmp 0x1001df5a
mov dword [ebp - 0x7e8], 1
cmp dword [ebp - 0x7e8], 0xf1912530
jbe 0x1001df72
mov dword [ebp - 0x7f0], 1
jmp 0x1001df79
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x7f0]
jle 0x1001df93
mov dword [ebp - 0x7f8], 1
jmp 0x1001df9a
and dword [ebp - 0x7f8], 0
cmp dword [ebp - 0x7f8], 6
je 0x1001dfaf
mov dword [ebp - 0x800], 1
jmp 0x1001dfb6
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0xc38], eax
jmp 0x1001de85
jmp 0x1001de55
mov eax, dword [ebp - 0x308]
mov ecx, dword [ebp - 0x308]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1b8], ecx
mov dword [ebp - 0xb28], 0xa5d6c05b
mov dword [ebp - 0xb24], 0xa5d6c05b
mov dword [ebp - 0xb20], 0xa5d6c05b
mov dword [ebp - 0xb1c], 0xa5d6c05b
mov dword [ebp - 0x11c], 0x53d8da8e
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x3e0], 0xfe6966ef
mov dword [ebp - 0xe70], 0xfffffffa
mov dword [ebp - 0xe6c], 0xfffffffa
mov dword [ebp - 0xe68], 0xfffffffa
mov dword [ebp - 0xe64], 0xfffffffa
mov dword [ebp - 0x1dc], 0xffff
mov dword [ebp - 0xcc0], 0x99643747
mov dword [ebp - 0x838], 1
mov dword [ebp - 0x850], 1
mov dword [ebp - 0x858], 0x79038991
mov dword [ebp - 0xd40], 1
mov dword [ebp - 0x11c], 0
jmp 0x1001e0a4
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 4
jge 0x1001e0c0
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0xb28], 0xfffffffc
jmp 0x1001e097
cmp dword [ebp - 0x170], 0
jne 0x1001e0db
cmp dword [ebp - 0x170], 0
jne 0x1001e0db
and dword [ebp - 0x818], 0
jmp 0x1001e0e5
mov dword [ebp - 0x818], 1
xor eax, eax
inc eax
je 0x1001e106
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb28], 0
je 0x1001e106
mov dword [ebp - 0x808], 1
jmp 0x1001e10d
and dword [ebp - 0x808], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb28]
cmp dword [ebp - 0x808], eax
jl 0x1001e12e
mov dword [ebp - 0x810], 1
jmp 0x1001e135
and dword [ebp - 0x810], 0
mov dword [ebp - 0x11c], 0xfffffffd
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x3e0]
je 0x1001e165
mov dword [ebp - 0xd0c], 1
jmp 0x1001e16c
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x10ac], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xc40], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xc40]
mov dword [ebp + eax - 0xe70], ecx
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0xf6c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb28]
mov dword [ebp - 0x1104], eax
cmp dword [ebp - 0xcc0], 0
jne 0x1001e1d0
cmp dword [ebp - 0x3e0], 0
jne 0x1001e1d0
and dword [ebp - 0x820], 0
jmp 0x1001e1da
mov dword [ebp - 0x820], 1
mov eax, dword [ebp - 0x818]
imul eax, dword [ebp - 0x820]
add eax, 0x7d04549c
cmp eax, dword [ebp - 0x1dc]
jg 0x1001e200
mov dword [ebp - 0x828], 1
jmp 0x1001e207
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x828]
sub eax, 0x52601c8d
cmp eax, 0xdd253d97
jbe 0x1001e22b
cmp dword [ebp - 0x1dc], 0
jne 0x1001e22b
and dword [ebp - 0xc48], 0
jmp 0x1001e235
mov dword [ebp - 0xc48], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb28]
mov dword [ebp - 0xf74], eax
cmp dword [ebp - 0x1dc], 0xbadc
jge 0x1001e260
mov dword [ebp - 0x830], 1
jmp 0x1001e267
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x838]
cmp eax, dword [ebp - 0x170]
je 0x1001e28d
mov dword [ebp - 0x840], 1
jmp 0x1001e294
and dword [ebp - 0x840], 0
cmp dword [ebp - 0x840], 0x8ba79672
jne 0x1001e2ac
mov dword [ebp - 0x848], 1
jmp 0x1001e2b3
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x170]
imul eax, dword [ebp - 0x848]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x850]
sub eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xd40], eax
mov eax, dword [ebp - 0x1b8]
cmp dword [eax], 0x4550
jne 0x1001f942
mov eax, dword [ebp - 0x1b8]
cmp dword [eax + 0x74], 0
jbe 0x1001f942
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b8]
cmp dword [ecx + eax + 0x78], 0
je 0x1001f942
mov eax, dword [ebp + 8]
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x310], 0x82062403
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1001e356
push 0
push 0x208d
push 0
push 0xf14
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
mov dword [ebp - 0x310], 0xfffffffd
jmp 0x1001e36f
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 4
jge 0x1001e4ea
mov byte [ebp - 0x158], 0
mov dword [ebp - 0x860], 0x600a
mov dword [ebp - 0xc50], 0x10007d1c
cmp dword [ebp - 0x860], 0x6119
jle 0x1001e485
and dword [ebp - 0x328], 0
jmp 0x1001e3bd
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0x23ee
jge 0x1001e485
and dword [ebp - 0x318], 0
jmp 0x1001e3e3
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x6147
jge 0x1001e480
and dword [ebp - 0x320], 0
jmp 0x1001e409
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0x36a1
jge 0x1001e47b
and dword [ebp - 0x330], 0
jmp 0x1001e42b
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0x710
jge 0x1001e479
mov eax, dword [ebp - 0x318]
cdq
idiv dword [ebp - 0x320]
add edx, dword [ebp - 0x328]
mov ecx, dword [ebp - 0x330]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0xbf4], eax
mov dword [ebp - 0xbf0], edx
push dword [ebp - 0xbf0]
push dword [ebp - 0xbf4]
mov ecx, 0x1061a098
call fcn.10020d91
jmp 0x1001e41e
jmp 0x1001e3fc
jmp 0x1001e3d6
jmp 0x1001e3b0
movzx eax, byte [ebp - 0x158]
test eax, eax
je 0x1001e49c
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [ebp - 4], 0x2c
cmp dword [ebp - 0x860], 0x5fe9
jge 0x1001e4bf
mov edx, dword [ebp - 0xc50]
mov ecx, 0x1061a098
call fcn.1002386b
jmp 0x1001e4db
or dword [ebp - 4], 0xffffffff
jmp 0x1001e4e5
jmp 0x1001e362
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b8]
mov edx, dword [ebp - 0x198]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xdc], edx
mov dword [ebp - 0x60], 2
mov dword [ebp - 0xc58], 0
mov dword [ebp - 0x8a8], 0x7bf748bb
mov dword [ebp - 0x10b4], 0xfff8
mov dword [ebp - 0x60], 0
jmp 0x1001e53b
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jg 0x1001e6d3
mov dword [ebp - 0x124], 0x2e08974b
mov dword [ebp - 0xcc8], 0
mov dword [ebp - 0xc60], 0xbfc75daa
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x60]
jg 0x1001e57a
mov dword [ebp - 0x890], 1
jmp 0x1001e581
and dword [ebp - 0x890], 0
cmp dword [ebp - 0x60], 0
jne 0x1001e68d
cmp dword [ebp - 0x124], 5
je 0x1001e5a0
mov dword [ebp - 0x868], 1
jmp 0x1001e5a7
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x868], eax
jg 0x1001e5c1
mov dword [ebp - 0x870], 1
jmp 0x1001e5c8
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
sub eax, dword [ebp - 0xcc8]
je 0x1001e5eb
cmp dword [ebp - 0x124], 0
je 0x1001e5eb
mov dword [ebp - 0x878], 1
jmp 0x1001e5f2
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x878]
cmp eax, dword [ebp - 0xc58]
je 0x1001e610
mov dword [ebp - 0xd20], 1
jmp 0x1001e617
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xf7c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1150], eax
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0xc60]
jle 0x1001e649
cmp dword [ebp - 0x124], 0
jne 0x1001e649
and dword [ebp - 0x880], 0
jmp 0x1001e653
mov dword [ebp - 0x880], 1
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x880], eax
je 0x1001e66a
mov dword [ebp - 0x888], 1
jmp 0x1001e671
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x888]
neg eax
jne 0x1001e68d
cmp dword [ebp - 0x124], 0
jne 0x1001e68d
and dword [ebp - 0x898], 0
jmp 0x1001e697
mov dword [ebp - 0x898], 1
mov eax, dword [ebp - 0x890]
cmp eax, dword [ebp - 0x898]
jl 0x1001e6b1
mov dword [ebp - 0x8a0], 1
jmp 0x1001e6b8
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x8a8], eax
mov dword [ebp - 0x8a8], 1
jmp 0x1001e534
mov dword [ebp - 0xcd0], 0x14f1
cmp dword [ebp - 0xcd0], 0x1042
jge 0x1001e923
mov dword [ebp - 0xf08], 0x7b
mov dword [ebp - 0xf04], 0x7b
mov dword [ebp - 0xf00], 0x7b
mov dword [ebp - 0xefc], 0x7b
mov dword [ebp - 0xef8], 0x7b
mov dword [ebp - 0xef4], 0x7b
mov dword [ebp - 0xef0], 0x7b
mov dword [ebp - 0xeec], 0x7b
mov dword [ebp - 0xee8], 0x7b
mov dword [ebp - 0xee4], 0x7b
mov dword [ebp - 0xee0], 0x7b
mov dword [ebp - 0xedc], 0x7b
mov dword [ebp - 0xed8], 0x7b
mov dword [ebp - 0xed4], 0x7b
mov dword [ebp - 0xed0], 0x7b
mov dword [ebp - 0xecc], 0x7b
mov dword [ebp - 0xec8], 0x7b
mov dword [ebp - 0xec4], 0x7b
mov dword [ebp - 0xec0], 0x7b
mov dword [ebp - 0xebc], 0x7b
mov dword [ebp - 0xeb8], 0x7b
mov dword [ebp - 0xeb4], 0x7b
mov dword [ebp - 0xeb0], 0x7b
mov dword [ebp - 0xeac], 0x7b
mov dword [ebp - 0xea8], 0x7b
mov dword [ebp - 0xea4], 0x7b
lea ecx, [ebp - 0xafc]
call fcn.100211bf
mov dword [ebp - 4], 0x2e
and dword [ebp - 0x178], 0
jmp 0x1001e819
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x1a
jge 0x1001e86a
mov eax, dword [ebp - 0x178]
lea eax, [ebp + eax*4 - 0xf08]
push eax
lea ecx, [ebp - 0xafc]
call fcn.100211d4
movsx eax, byte [eax]
test eax, eax
je 0x1001e844
jmp 0x1001e80c
mov ebx, dword [ebp - 0x178]
add ebx, 0x61
mov eax, dword [ebp - 0x178]
lea eax, [ebp + eax*4 - 0xf08]
push eax
lea ecx, [ebp - 0xafc]
call fcn.100211d4
mov byte [eax], bl
jmp 0x1001e80c
lea eax, [ebp - 0x3e8]
push eax
push 0x100077c4
call fcn.1005a49b
pop ecx
pop ecx
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0xc68], eax
mov eax, dword [ebp - 0x3e8]
dec eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0xc68], 0
je 0x1001e914
and dword [ebp - 0x3f8], 0
and dword [ebp - 0x3f0], 0
jmp 0x1001e8bc
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 5
jge 0x1001e8ed
lea eax, [ebp - 0xd38]
push eax
push 0x100077c4
call fcn.1005a49b
pop ecx
pop ecx
imul eax, dword [ebp - 0x3f8], 0xa
add eax, dword [ebp - 0xd38]
mov dword [ebp - 0x3f8], eax
jmp 0x1001e8af
lea eax, [ebp - 0x3f8]
push eax
lea ecx, [ebp - 0xafc]
call fcn.100211d4
movsx eax, byte [eax]
push eax
push 0x10007d70
call fcn.1005a6cf
pop ecx
pop ecx
jmp 0x1001e87d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xafc]
call fcn.1002123b
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1001e93f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov eax, 0xffff
mov word [ebp - 0xa4], ax
mov dword [ebp - 0x48], 0x871c7bf0
mov dword [ebp - 0x8e0], 0x703d
mov dword [ebp - 0x400], 1
mov dword [ebp - 0x88], 0
jmp 0x1001e97f
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1001e99b
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x12c], 0x4a6847df
jmp 0x1001e972
mov dword [ebp - 0x88], 0
jmp 0x1001e9b4
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1001e9d0
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xb40], 1
jmp 0x1001e9a7
mov byte [ebp - 0x15a], 0
movzx eax, byte [ebp - 0x15a]
test eax, eax
je 0x1001e9ec
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov dword [ebp - 0x48], 0
jmp 0x1001e9fc
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jg 0x1001ec51
mov dword [ebp - 0x8b8], 2
mov dword [ebp - 0x8c0], 0xd133f29c
mov dword [ebp - 0x8c8], 0xaab39e22
mov dword [ebp - 0x408], 0xffffffff
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x12c]
add eax, dword [ebp - 0x400]
jne 0x1001eb9c
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x12c], 0
jne 0x1001eb9c
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x12c]
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x8b0]
mov dword [ebp + eax*4 - 0x12c], ecx
cmp dword [ebp - 0x8b0], 0
je 0x1001eb80
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x12c]
mov dword [ebp - 0xf84], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x8c0], eax
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x8c8]
cmp ecx, dword [ebp + eax*4 - 0x12c]
jle 0x1001eadd
mov dword [ebp - 0x8d0], 1
jmp 0x1001eae4
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x12c]
cmp dword [ebp - 0x8d0], eax
jle 0x1001eb02
mov dword [ebp - 0x8d8], 1
jmp 0x1001eb09
and dword [ebp - 0x8d8], 0
cmp dword [ebp - 0x8d8], 7
jle 0x1001eb27
cmp dword [ebp - 0x8e0], 0
je 0x1001eb27
mov dword [ebp - 0x8e8], 1
jmp 0x1001eb2e
and dword [ebp - 0x8e8], 0
cmp dword [ebp - 0x8e8], 0xdadf8609
jbe 0x1001eb46
mov dword [ebp - 0x8f0], 1
jmp 0x1001eb4d
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x400]
cmp dword [ebp - 0x8f0], eax
jl 0x1001eb67
mov dword [ebp - 0x8f8], 1
jmp 0x1001eb6e
and dword [ebp - 0x8f8], 0
cmp dword [ebp - 0x8f8], 0
jne 0x1001eb80
and dword [ebp - 0x900], 0
jmp 0x1001eb8a
mov dword [ebp - 0x900], 1
cmp dword [ebp - 0x900], 0
jge 0x1001eb9c
and dword [ebp - 0x908], 0
jmp 0x1001eba6
mov dword [ebp - 0x908], 1
mov eax, dword [ebp - 0x408]
cmp dword [ebp - 0x908], eax
jle 0x1001ebc0
mov dword [ebp - 0xc70], 1
jmp 0x1001ebc7
and dword [ebp - 0xc70], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb40]
mov dword [ebp - 0x10bc], eax
xor eax, eax
inc eax
je 0x1001ebfb
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1001ebf9
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x1001ec40
mov byte [ebp - 0x15c], 0
movzx eax, byte [ebp - 0x15c]
test eax, eax
je 0x1001ec24
push 0x19a0
push 0
push 0x3f1
push 0x26e
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1001ec40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x408], eax
jmp 0x1001e9f5
or dword [ebp - 0x190], 0xffffffff
mov dword [ebp - 0x928], 0x9ddcef98
mov dword [ebp - 0xe10], 0xca968364
mov dword [ebp - 0xe0c], 0xca968364
mov dword [ebp - 0xe08], 0xca968364
mov dword [ebp - 0xe04], 0xca968364
lea ecx, [ebp - 0x42d]
call fcn.1002107e
push eax
lea eax, [ebp - 0xe00]
push eax
lea eax, [ebp - 0xe10]
push eax
lea ecx, [ebp - 0x11dc]
call fcn.10021081
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1080]
call fcn.1002102d
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x98], 0
jmp 0x1001ecdf
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1001ecfb
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x134], 1
jmp 0x1001ecd2
mov dword [ebp - 0x98], 0
jmp 0x1001ed14
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x1001ed30
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1050], 0xfffffff7
jmp 0x1001ed07
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x134], 0
jg 0x1001ed59
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x134], 0
je 0x1001ed59
and dword [ebp - 0x910], 0
jmp 0x1001ed63
mov dword [ebp - 0x910], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x134]
cmp eax, dword [ebp - 0x910]
jl 0x1001ed84
mov dword [ebp - 0x918], 1
jmp 0x1001ed8b
and dword [ebp - 0x918], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x134]
sub eax, dword [ebp - 0x918]
cmp eax, 0x37bb0086
je 0x1001edb1
mov dword [ebp - 0x920], 1
jmp 0x1001edb8
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x928], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x134]
cmp eax, dword [ebp - 0x928]
je 0x1001ede5
mov dword [ebp - 0x930], 1
jmp 0x1001edec
and dword [ebp - 0x930], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x134]
cmp dword [ebp - 0x930], eax
jge 0x1001ee0d
mov dword [ebp - 0x938], 1
jmp 0x1001ee14
and dword [ebp - 0x938], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp - 0x938]
sub esi, dword [ebp + eax - 0x134]
push 2
lea ecx, [ebp - 0x1080]
call fcn.1002106f
cmp esi, dword [eax]
jle 0x1001ee44
mov dword [ebp - 0x940], 1
jmp 0x1001ee4b
and dword [ebp - 0x940], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x940]
mov dword [ebp + eax - 0x1050], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1080]
call fcn.10021053
cmp dword [ebp + 0x10], 0
jbe 0x1001ee91
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1001ee8c
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0xa4], ax
jmp 0x1001f1a4
mov eax, dword [0x1061b318]
and eax, 1
jne 0x1001eec8
mov eax, dword [0x1061b318]
or eax, 1
mov dword [0x1061b318], eax
mov dword [ebp - 4], 0x30
mov ecx, 0x1061b2b8
call fcn.10021095
push 0x1007348b
call fcn.1005a6a5
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x1061b1d0]
test eax, eax
je 0x1001ef34
mov ecx, 0x1061b2b8
call fcn.1002115a
movzx eax, al
test eax, eax
jne 0x1001ef34
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x948]
push eax
mov ecx, 0x1061b2b8
call fcn.10021163
lea eax, [ebp - 0xf8c]
push eax
mov ecx, 0x1061b2b8
call fcn.1002114c
push eax
lea ecx, [ebp - 0x948]
call fcn.10020fbe
movzx eax, al
test eax, eax
je 0x1001ef34
lea ecx, [ebp - 0x948]
call fcn.10021178
mov eax, dword [eax + 4]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xffffffff
jne 0x1001f1a4
mov ecx, 0x1061b2b8
call fcn.100212a2
mov ecx, dword [ebp - 0xdc]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x1061b2b8
call fcn.100212a6
and dword [ebp - 0x180], 0
jmp 0x1001ef75
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x180]
cmp ecx, dword [eax + 0x18]
jae 0x1001f1a4
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x198]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x180]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x950], eax
cmp dword [ebp - 0x950], 0
je 0x1001f19f
mov eax, dword [ebp - 0x950]
mov ecx, dword [ebp - 0x198]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x120c]
call fcn.10020f3a
mov dword [ebp - 4], 0x31
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x120c]
call fcn.1000a768
mov dword [ebp - 0x4e8], eax
movzx eax, byte [0x1061b1d0]
test eax, eax
je 0x1001f00a
mov ecx, 0x1061b2b8
call fcn.1002115a
movzx eax, al
test eax, eax
jne 0x1001f16d
lea eax, [ebp - 0x4e8]
push eax
mov ecx, 0x1061b2b8
call fcn.10021264
mov ecx, dword [ebp - 0x180]
mov dword [eax], ecx
mov dword [ebp - 0x958], 0x50c7
mov dword [ebp - 0xb4c], 0x10007d74
cmp dword [ebp - 0x958], 0x529a
jle 0x1001f11e
and dword [ebp - 0x348], 0
jmp 0x1001f05d
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0xa15
jge 0x1001f11e
and dword [ebp - 0x338], 0
jmp 0x1001f083
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0x3d5f
jge 0x1001f119
and dword [ebp - 0x340], 0
jmp 0x1001f0a9
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0x3bcc
jge 0x1001f114
mov eax, dword [ebp - 0x338]
mov ecx, dword [ebp - 0x340]
sar eax, cl
and eax, dword [ebp - 0x348]
cdq
mov dword [ebp - 0xc00], eax
mov dword [ebp - 0xbfc], edx
push dword [ebp - 0xbfc]
push dword [ebp - 0xc00]
lea ecx, [ebp - 0x1278]
call fcn.1000a6be
pop ecx
pop ecx
mov dword [ebp - 0xb44], eax
mov ecx, dword [ebp - 0xb44]
call fcn.10020d71
push eax
call fcn.1005a6cf
pop ecx
lea ecx, [ebp - 0x1278]
call fcn.10020d67
jmp 0x1001f09c
jmp 0x1001f076
jmp 0x1001f050
mov byte [0x1061b1d0], 1
mov byte [ebp - 4], 0x32
cmp dword [ebp - 0x958], 0x4fc7
jge 0x1001f141
push dword [ebp - 0xb4c]
call fcn.1005a6cf
pop ecx
jmp 0x1001f15d
mov dword [ebp - 4], 0x31
jmp 0x1001f16d
cmp dword [ebp - 0x190], 0xffffffff
jne 0x1001f190
mov eax, dword [ebp - 0x4e8]
cmp eax, dword [ebp - 0x350]
jne 0x1001f190
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x190], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120c]
call fcn.10020f5d
jmp 0x1001ef68
mov dword [ebp - 0x360], 0xfffffffd
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x358], 0
jmp 0x1001f1d1
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 4
jge 0x1001f1ed
mov eax, dword [ebp - 0x358]
mov dword [ebp + eax*4 - 0xea0], 0xc64a6847
jmp 0x1001f1c4
mov dword [ebp - 0x360], 0
jmp 0x1001f206
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 3
jg 0x1001f3de
mov dword [ebp - 0x1e4], 0xdba33992
push 3
lea ecx, [ebp - 0x1090]
call fcn.10020fd1
mov dword [ebp - 4], 0x34
mov dword [ebp - 0x368], 0
jmp 0x1001f24a
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 3
jge 0x1001f26c
push dword [ebp - 0x368]
lea ecx, [ebp - 0x1090]
call fcn.1002106f
mov dword [eax], 1
jmp 0x1001f23d
mov dword [ebp - 0x1e4], 0
jmp 0x1001f285
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 3
jg 0x1001f3ca
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp + eax*4 - 0xea0], 0
je 0x1001f379
mov dword [ebp - 0x1ac], 0xffffffff
mov dword [ebp - 0x1ac], 3
jmp 0x1001f2c9
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jl 0x1001f377
mov dword [ebp - 0x370], 0xe58bfc4f
mov dword [ebp - 0x370], 3
jmp 0x1001f2f9
cmp dword [ebp - 0x370], 0
jl 0x1001f372
mov dword [ebp - 0x378], 0
mov dword [ebp - 0x378], 0
jmp 0x1001f325
cmp dword [ebp - 0x378], 3
jg 0x1001f34c
mov byte [ebp - 0x15e], 0
movzx eax, byte [ebp - 0x15e]
test eax, eax
je 0x1001f34a
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ebp + ecx*4 - 0xea0]
imul ecx, dword [ebp + eax - 0xea0]
mov dword [ebp - 0x188], ecx
jmp 0x1001f2ec
jmp 0x1001f2bc
jmp 0x1001f390
mov dword [ebp - 0x4ec], 0x5ba13b28
mov eax, dword [ebp - 0x4ec]
inc eax
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 0x188], 0
jmp 0x1001f3a9
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 4
jge 0x1001f3c5
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0xea0], 0xd70512a3
jmp 0x1001f39c
jmp 0x1001f278
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1090]
call fcn.10021053
jmp 0x1001f1f9
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x1001f400
push 0x77c
push 0x849
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp dword [ebp + 0x10], 0
jne 0x1001f42f
cmp dword [ebp - 0x190], 0xffffffff
je 0x1001f42f
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x198]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x190]
mov ax, word [ecx + eax*2]
mov word [ebp - 0xa4], ax
push 2
lea ecx, [ebp - 0x4bc]
call fcn.10020fd1
mov dword [ebp - 4], 0x35
mov dword [ebp - 0xb5c], 0xb9725245
mov dword [ebp - 0x380], 0
jmp 0x1001f466
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 2
jge 0x1001f485
push dword [ebp - 0x380]
lea ecx, [ebp - 0x4bc]
call fcn.1002106f
and dword [eax], 0
jmp 0x1001f459
push 1
lea ecx, [ebp - 0x4bc]
call fcn.1002106f
mov esi, eax
push 1
lea ecx, [ebp - 0x4bc]
call fcn.1002106f
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x1001f4b3
mov dword [ebp - 0x4f4], 1
jmp 0x1001f4ba
and dword [ebp - 0x4f4], 0
push 0
lea ecx, [ebp - 0x4bc]
call fcn.1002106f
mov ecx, dword [ebp - 0x4f4]
cmp ecx, dword [eax]
jle 0x1001f4dd
mov dword [ebp - 0xb54], 1
jmp 0x1001f4e4
and dword [ebp - 0xb54], 0
push 0
lea ecx, [ebp - 0x4bc]
call fcn.1002106f
push 0
lea ecx, [ebp - 0x4bc]
call fcn.1002106f
mov esi, eax
push 1
lea ecx, [ebp - 0x4bc]
call fcn.1002106f
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x1001f51f
mov dword [ebp - 0x4fc], 1
jmp 0x1001f526
and dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x4fc], 0xd9637855
jne 0x1001f53e
mov dword [ebp - 0x504], 1
jmp 0x1001f545
and dword [ebp - 0x504], 0
push 1
lea ecx, [ebp - 0x4bc]
call fcn.1002106f
mov eax, dword [eax]
cmp eax, dword [ebp - 0x504]
jg 0x1001f568
mov dword [ebp - 0x50c], 1
jmp 0x1001f56f
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0xb5c], eax
mov byte [ebp - 0x160], 0
movzx eax, byte [ebp - 0x160]
test eax, eax
je 0x1001f599
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4bc]
call fcn.10021053
movzx eax, word [ebp - 0xa4]
cmp eax, 0xffff
je 0x1001f942
movzx eax, word [ebp - 0xa4]
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ebp - 0x198]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp - 0xb64]
mov ecx, dword [ebp - 0x198]
add ecx, dword [eax]
mov dword [ebp - 0xb8], ecx
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xdc]
jbe 0x1001f937
mov dword [ebp - 0x14], 0x2314af12
mov dword [ebp - 0x390], 0
jmp 0x1001f962
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 4
jge 0x1001f97e
mov eax, dword [ebp - 0x390]
mov dword [ebp + eax*4 - 0x3b8], 0xffffffff
jmp 0x1001f955
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3b8], 0
jmp 0x1001f9ac
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3b8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3b8], 0xffffffed
jge 0x1001fb8c
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x154], 0xfffffffc
mov dword [ebp - 0x544], 0xffff
mov dword [ebp - 0x14c], 0xffffffe5
jmp 0x1001f9f7
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffe4
jl 0x1001fb61
mov dword [ebp - 0x53c], 0xd594d035
mov dword [ebp - 0x10c4], 0xf5ebec5e
mov dword [ebp - 0xf9c], 0
mov dword [ebp - 0x398], 0
jmp 0x1001fa3b
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 1
jge 0x1001fa57
mov eax, dword [ebp - 0x398]
mov dword [ebp + eax*4 - 0xb74], 0x45a8
jmp 0x1001fa2e
imul eax, dword [ebp - 0x53c], 0x60cb
cmp eax, dword [ebp - 0x14c]
jge 0x1001fa7b
cmp dword [ebp - 0x14c], 0
jne 0x1001fa7b
and dword [ebp - 0x51c], 0
jmp 0x1001fa85
mov dword [ebp - 0x51c], 1
mov eax, dword [ebp - 0x14c]
sub eax, 0x35e1
cmp eax, dword [ebp - 0x51c]
jge 0x1001faa4
mov dword [ebp - 0x524], 1
jmp 0x1001faab
and dword [ebp - 0x524], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b8]
cmp dword [ebp - 0x524], eax
jg 0x1001facc
mov dword [ebp - 0x52c], 1
jmp 0x1001fad3
and dword [ebp - 0x52c], 0
push 4
pop eax
shl eax, 1
imul ecx, dword [ebp - 0x52c], 0x4f88
cmp ecx, dword [ebp + eax - 0x3b8]
jle 0x1001faf7
mov dword [ebp - 0x534], 1
jmp 0x1001fafe
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0x53c]
jge 0x1001fb27
mov eax, dword [ebp - 0x544]
dec eax
mov dword [ebp - 0x544], eax
jmp 0x1001fb5c
mov dword [ebp - 0x154], 0
jmp 0x1001fb40
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jge 0x1001fb5c
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0xb74], 1
jmp 0x1001fb33
jmp 0x1001f9ea
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x1001fb87
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x1001f991
mov dword [ebp - 0x14], 3
jmp 0x1001fb9c
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1001fd6d
mov dword [ebp - 0x55c], 0x42fa43de
mov dword [ebp - 0xb84], 0xfb38
cmp dword [ebp - 0x14], 0
je 0x1001fbd9
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x3b8], 0
je 0x1001fbd9
mov dword [ebp - 0x564], 1
jmp 0x1001fbe0
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x14], 0
je 0x1001fc41
mov eax, dword [ebp - 0x14]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x3b8]
cmp ecx, dword [ebp + eax*4 - 0x3b8]
jle 0x1001fc03
cmp dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x14], 0x165d
cmp ecx, dword [ebp + eax*4 - 0x3b8]
jg 0x1001fc22
mov dword [ebp - 0x54c], 1
jmp 0x1001fc29
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 0x280d
jne 0x1001fc41
mov dword [ebp - 0x554], 1
jmp 0x1001fc48
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x1140], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b8]
mov dword [ebp - 0xfa4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10cc], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jle 0x1001fc8f
mov dword [ebp - 0xb7c], 1
jmp 0x1001fc96
and dword [ebp - 0xb7c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x3b8]
mov dword [ebp - 0xfac], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x3b8]
mov dword [ebp - 0x1120], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b8]
cmp dword [ebp - 0x564], eax
jne 0x1001fcd7
mov dword [ebp - 0x56c], 1
jmp 0x1001fcde
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x3b8]
cmp eax, dword [ebp - 0x56c]
jg 0x1001fcfc
mov dword [ebp - 0x574], 1
jmp 0x1001fd03
and dword [ebp - 0x574], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3b8]
cmp dword [ebp - 0x574], eax
jne 0x1001fd24
mov dword [ebp - 0x57c], 1
jmp 0x1001fd2b
and dword [ebp - 0x57c], 0
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp - 0x57c], 0xc8bb
add ecx, dword [ebp + eax - 0x3b8]
mov dword [ebp - 0xb84], ecx
mov byte [ebp - 0xde], 0
movzx eax, byte [ebp - 0xde]
test eax, eax
je 0x1001fd68
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
jmp 0x1001fb95
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret