Function at 0x1000de5f
Capabilities:
Get disk information
Get session user name
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006fa65
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x584
push esi
push edi
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x44], 0
jmp 0x1000de96
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffffe
jne 0x1000df4e
push 2
lea ecx, [ebp - 0x478]
call fcn.10011475
and dword [ebp - 4], 0
mov dword [ebp - 0x94], 1
mov dword [ebp - 0xb0], 0
jmp 0x1000ded4
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1000def6
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x478]
call fcn.100114b6
mov dword [eax], 0xad95
jmp 0x1000dec7
mov dword [ebp - 0x94], 0
jmp 0x1000df0f
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jg 0x1000df30
mov byte [ebp - 0x6f], 0
movzx eax, byte [ebp - 0x6f]
test eax, eax
je 0x1000df2e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x1000df02
mov dword [ebp - 0x94], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.100114b1
jmp 0x1000de8f
mov dword [ebp - 0x44], 0
jmp 0x1000df5e
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffea
jl 0x1000dfde
mov dword [ebp - 0x374], 0x98f01ba0
mov dword [ebp - 0xe4], 0
jmp 0x1000df87
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jge 0x1000dfa3
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x4b4], 0x3617
jmp 0x1000df7a
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x4b4], 0xfffffff7
cmp dword [ebp - 0x44], 0xfffffff7
jg 0x1000dfc6
mov dword [ebp - 0x210], 1
jmp 0x1000dfcd
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x374], eax
jmp 0x1000df57
mov dword [ebp - 0x50], 0xfffffffa
mov dword [ebp - 0x50], 0
jmp 0x1000dff5
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffffe
jne 0x1000e1b2
push 2
lea ecx, [ebp - 0x488]
call fcn.10011475
mov dword [ebp - 4], 1
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0xec], 0
jmp 0x1000e036
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jge 0x1000e058
push dword [ebp - 0xec]
lea ecx, [ebp - 0x488]
call fcn.100114b6
mov dword [eax], 0xad95
jmp 0x1000e029
mov dword [ebp - 0x8c], 0
jmp 0x1000e071
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jg 0x1000e092
mov byte [ebp - 0x6a], 0
movzx eax, byte [ebp - 0x6a]
test eax, eax
je 0x1000e090
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x1000e064
mov dword [ebp - 0x398], 0x20dc
cmp dword [ebp - 0x398], 0x795
jge 0x1000e194
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x3a0]
push eax
mov ecx, 0x10660718
call fcn.10010f2e
mov ecx, eax
call fcn.10010f2e
mov ecx, eax
call fcn.10010f2e
mov ecx, eax
call fcn.10010f2e
mov ecx, eax
call fcn.10010f2e
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x80], 1
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x3a0]
jge 0x1000e17b
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x30c]
add eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x2b8]
sub ecx, dword [ebp - 0xf8]
cmp eax, ecx
jge 0x1000e15a
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x30c]
add eax, dword [ebp - 0xf0]
sub eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0xa0]
mov dword [ebp - 0xa0], eax
jmp 0x1000e172
mov eax, dword [ebp - 0x2b8]
sub eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0xa0]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
jmp 0x1000e108
push fcn.10013ebe
push dword [ebp - 0x80]
mov ecx, 0x106605f8
call fcn.10011129
mov ecx, eax
call fcn.1001111d
mov dword [ebp - 0x8c], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x488]
call fcn.100114b1
jmp 0x1000dfee
mov dword [ebp - 0x50], 0
jmp 0x1000e1c2
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xffffffea
jl 0x1000e242
mov dword [ebp - 0x3a8], 0x98f01ba0
mov dword [ebp - 0xd0], 0
jmp 0x1000e1eb
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x1000e207
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x450], 0x3617
jmp 0x1000e1de
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x450], 0xfffffff7
cmp dword [ebp - 0x50], 0xfffffff7
jg 0x1000e22a
mov dword [ebp - 0x26c], 1
jmp 0x1000e231
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x3a8], eax
jmp 0x1000e1bb
mov dword [ebp - 0x9c], 0xffffffff
mov dword [ebp - 0x9c], 0xfffffffa
jmp 0x1000e265
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xffffffe2
jl 0x1000e28f
cmp dword [ebp - 0x9c], 0
je 0x1000e279
jmp 0x1000e28f
mov byte [ebp - 0x6b], 0
movzx eax, byte [ebp - 0x6b]
test eax, eax
je 0x1000e28d
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x1000e258
mov dword [ebp - 0xb8], 3
mov dword [ebp - 0xb8], 0x13
jmp 0x1000e2b2
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffed
je 0x1000e2e9
mov dword [ebp - 0x3b0], 4
mov byte [ebp - 0x73], 0
movzx eax, byte [ebp - 0x73]
test eax, eax
je 0x1000e2dc
push 0x2542
call dword [sym.imp.USER32.dll_GetQueueStatus]
cmp dword [ebp - 0x3b0], 0
je 0x1000e2e7
jmp 0x1000e2e9
jmp 0x1000e2a5
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x84], 0xfffffffa
jmp 0x1000e30c
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xffffffe2
jl 0x1000e336
cmp dword [ebp - 0x84], 0
je 0x1000e320
jmp 0x1000e336
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x1000e334
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x1000e2ff
movzx eax, byte [0x1066173c]
test eax, eax
je 0x1000e354
mov esi, 0x10075660
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1001049d
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0xe0], 0
jmp 0x1000e374
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jge 0x1000e390
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x490], 0xfffffff6
jmp 0x1000e367
mov dword [ebp - 0x64], 0
jmp 0x1000e3a0
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jg 0x1000e425
mov dword [ebp - 0x88], 0xfffffffd
mov dword [ebp - 0x430], 0x272
mov dword [ebp - 0x42c], 0x272
mov dword [ebp - 0x428], 0x272
mov dword [ebp - 0x424], 0x272
mov dword [ebp - 0x88], 1
jmp 0x1000e3f1
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x1000e40e
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0x490], 0
je 0x1000e40c
jmp 0x1000e40e
jmp 0x1000e3e4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x430], 0
je 0x1000e420
jmp 0x1000e425
jmp 0x1000e399
mov dword [ebp - 0x64], 1
jmp 0x1000e435
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x1000e453
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x1000e451
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x1000e42e
mov dword [ebp - 0xc0], 3
mov dword [ebp - 0xc0], 0x13
jmp 0x1000e476
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffed
je 0x1000e4ad
mov dword [ebp - 0x3b8], 4
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x1000e4a0
push 0x2542
call dword [sym.imp.USER32.dll_GetQueueStatus]
cmp dword [ebp - 0x3b8], 0
je 0x1000e4ab
jmp 0x1000e4ad
jmp 0x1000e469
mov dword [ebp - 0x440], 0x10075660
push 1
lea ecx, [ebp - 0x144]
call fcn.10011475
mov dword [ebp - 4], 2
mov dword [ebp - 0x15c], 0x4f204795
mov dword [ebp - 0x3d0], 0x481f3403
mov dword [ebp - 0x2c], 0
jmp 0x1000e4ef
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1000e50b
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x144]
call fcn.100114b6
mov dword [eax], 0x9dfc
jmp 0x1000e4e8
mov dword [ebp - 0x2c], 0
jmp 0x1000e51b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000e531
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x49c], 0x8abc106e
jmp 0x1000e514
mov dword [ebp - 0x2c], 0
jmp 0x1000e541
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1000e557
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x118], 0xfffffff9
jmp 0x1000e53a
push 0
lea ecx, [ebp - 0x144]
call fcn.100114b6
mov esi, eax
push 0
lea ecx, [ebp - 0x144]
call fcn.100114b6
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1000e597
push 0
lea ecx, [ebp - 0x144]
call fcn.100114b6
cmp dword [eax], 0
je 0x1000e597
mov dword [ebp - 0x3c0], 1
jmp 0x1000e59e
and dword [ebp - 0x3c0], 0
push 4
pop eax
shl eax, 1
lea eax, [ebp + eax - 0x49c]
mov dword [ebp - 0x3c8], eax
push 0
lea ecx, [ebp - 0x144]
call fcn.100114b6
mov ecx, dword [ebp - 0x3c8]
mov eax, dword [eax]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x144]
call fcn.100114b6
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x49c]
push 4
pop edx
imul edx, edx, 0
add ecx, dword [ebp + edx - 0x118]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x118]
je 0x1000e60c
mov dword [ebp - 0x154], 1
jmp 0x1000e613
and dword [ebp - 0x154], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
cmp dword [ebp - 0x154], eax
jle 0x1000e634
mov dword [ebp - 0x274], 1
jmp 0x1000e63b
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x15c], eax
mov esi, dword [ebp - 0x15c]
push 0
lea ecx, [ebp - 0x144]
call fcn.100114b6
imul esi, dword [eax]
sub esi, 0xfff6
je 0x1000e683
push 0
lea ecx, [ebp - 0x144]
call fcn.100114b6
cmp dword [eax], 0
je 0x1000e683
mov dword [ebp - 0x27c], 1
jmp 0x1000e68a
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x3d0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.100114b1
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0xd8], 0
jmp 0x1000e6c5
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x1000e6e1
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x45c], 0xfffffff6
jmp 0x1000e6b8
mov dword [ebp - 0x60], 0
jmp 0x1000e6f1
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jg 0x1000e776
mov dword [ebp - 0x90], 0xfffffffd
mov dword [ebp - 0x420], 0x272
mov dword [ebp - 0x41c], 0x272
mov dword [ebp - 0x418], 0x272
mov dword [ebp - 0x414], 0x272
mov dword [ebp - 0x90], 1
jmp 0x1000e742
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x1000e75f
mov eax, dword [ebp - 0x90]
cmp dword [ebp + eax*4 - 0x45c], 0
je 0x1000e75d
jmp 0x1000e75f
jmp 0x1000e735
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x420], 0
je 0x1000e771
jmp 0x1000e776
jmp 0x1000e6ea
mov dword [ebp - 0x60], 1
jmp 0x1000e786
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x1000e7a4
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1000e7a2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x1000e77f
push 4
lea ecx, [ebp - 0x364]
call fcn.10011475
mov dword [ebp - 4], 3
mov dword [ebp - 0x20], 0
mov dword [ebp - 0xc8], 0
jmp 0x1000e7d8
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 4
jge 0x1000e7fa
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x364]
call fcn.100114b6
mov dword [eax], 0x28c176b0
jmp 0x1000e7cb
mov dword [ebp - 0x20], 0
jmp 0x1000e80a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x1000e832
mov dword [ebp - 0x3d8], 0xffffffff
mov esi, dword [ebp - 0x3d8]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x364]
call fcn.100114b6
mov dword [eax], esi
jmp 0x1000e803
push 1
lea ecx, [ebp - 0x364]
call fcn.100114b6
mov esi, dword [eax]
sub esi, 0x657e
push 1
lea ecx, [ebp - 0x364]
call fcn.100114b6
cmp esi, dword [eax]
je 0x1000e867
cmp dword [ebp - 0x20], 0
jne 0x1000e867
and dword [ebp - 0x164], 0
jmp 0x1000e871
mov dword [ebp - 0x164], 1
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x164]
cmp eax, 0xfffffff7
jb 0x1000e88b
mov dword [ebp - 0x284], 1
jmp 0x1000e892
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x284], eax
jge 0x1000e8a9
mov dword [ebp - 0x16c], 1
jmp 0x1000e8b0
and dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0
jge 0x1000e8c5
mov dword [ebp - 0x28c], 1
jmp 0x1000e8cc
and dword [ebp - 0x28c], 0
push 2
lea ecx, [ebp - 0x364]
call fcn.100114b6
mov eax, dword [eax]
cmp eax, dword [ebp - 0x28c]
jge 0x1000e8ef
mov dword [ebp - 0x174], 1
jmp 0x1000e8f6
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x174], eax
jle 0x1000e90d
mov dword [ebp - 0x294], 1
jmp 0x1000e914
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x294]
cmp eax, 0x70e7ad53
je 0x1000e931
mov dword [ebp - 0x17c], 1
jmp 0x1000e938
and dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x17c]
mov dword [ebp - 0x20], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x364]
call fcn.100114b1
mov dword [ebp - 0x4c0], 0x10075664
push 1
lea ecx, [ebp - 0x138]
call fcn.10011475
mov dword [ebp - 4], 4
mov dword [ebp - 0x2a4], 0x4f204795
mov dword [ebp - 0x3f0], 0x481f3403
mov dword [ebp - 0x24], 0
jmp 0x1000e996
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000e9b2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x138]
call fcn.100114b6
mov dword [eax], 0x9dfc
jmp 0x1000e98f
mov dword [ebp - 0x24], 0
jmp 0x1000e9c2
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000e9d8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4ac], 0x8abc106e
jmp 0x1000e9bb
mov dword [ebp - 0x24], 0
jmp 0x1000e9e8
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000e9fe
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x100], 0xfffffff9
jmp 0x1000e9e1
push 0
lea ecx, [ebp - 0x138]
call fcn.100114b6
mov esi, eax
push 0
lea ecx, [ebp - 0x138]
call fcn.100114b6
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1000ea3e
push 0
lea ecx, [ebp - 0x138]
call fcn.100114b6
cmp dword [eax], 0
je 0x1000ea3e
mov dword [ebp - 0x3e0], 1
jmp 0x1000ea45
and dword [ebp - 0x3e0], 0
push 4
pop eax
shl eax, 1
lea eax, [ebp + eax - 0x4ac]
mov dword [ebp - 0x3e8], eax
push 0
lea ecx, [ebp - 0x138]
call fcn.100114b6
mov ecx, dword [ebp - 0x3e8]
mov eax, dword [eax]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x138]
call fcn.100114b6
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x4ac]
push 4
pop edx
imul edx, edx, 0
add ecx, dword [ebp + edx - 0x100]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x100]
je 0x1000eab3
mov dword [ebp - 0x29c], 1
jmp 0x1000eaba
and dword [ebp - 0x29c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
cmp dword [ebp - 0x29c], eax
jle 0x1000eadb
mov dword [ebp - 0x184], 1
jmp 0x1000eae2
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x2a4], eax
mov esi, dword [ebp - 0x2a4]
push 0
lea ecx, [ebp - 0x138]
call fcn.100114b6
imul esi, dword [eax]
sub esi, 0xfff6
je 0x1000eb2a
push 0
lea ecx, [ebp - 0x138]
call fcn.100114b6
cmp dword [eax], 0
je 0x1000eb2a
mov dword [ebp - 0x18c], 1
jmp 0x1000eb31
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x3f0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.100114b1
mov dword [ebp - 0x34], 0xffffffff
push 2
lea ecx, [ebp - 0x324]
call fcn.10011475
mov dword [ebp - 4], 5
mov dword [ebp - 0x58], 0x2d714f98
mov dword [ebp - 0x2d4], 0x33ee
mov dword [ebp - 0x128], 0xfffffffd
mov dword [ebp - 0x3c], 0
jmp 0x1000eb92
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1000ebae
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x324]
call fcn.100114b6
mov dword [eax], 3
jmp 0x1000eb8b
mov dword [ebp - 0x3c], 0
jmp 0x1000ebbe
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1000ebd4
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x2f8], 0xd4e70302
jmp 0x1000ebb7
mov dword [ebp - 0x34], 0xffffffff
mov esi, dword [ebp - 0x34]
push 0
lea ecx, [ebp - 0x324]
call fcn.100114b6
cmp esi, dword [eax]
je 0x1000ebfb
mov dword [ebp - 0x2bc], 1
jmp 0x1000ec02
and dword [ebp - 0x2bc], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2f8], 0x6c31
jne 0x1000ec21
mov dword [ebp - 0x2ac], 1
jmp 0x1000ec28
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2ac]
sub eax, dword [ebp - 0x58]
cmp eax, 1
ja 0x1000ec42
mov dword [ebp - 0x194], 1
jmp 0x1000ec49
and dword [ebp - 0x194], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f8]
cmp dword [ebp - 0x194], eax
je 0x1000ec73
mov eax, 0x85b6478c
test eax, eax
je 0x1000ec73
mov dword [ebp - 0x2b4], 1
jmp 0x1000ec7a
and dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2b4], 6
jg 0x1000ec8f
mov dword [ebp - 0x19c], 1
jmp 0x1000ec96
and dword [ebp - 0x19c], 0
cmp dword [ebp - 0x19c], 4
ja 0x1000ecab
mov dword [ebp - 0x1a4], 1
jmp 0x1000ecb2
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x2bc]
cmp eax, dword [ebp - 0x1a4]
jle 0x1000eccc
mov dword [ebp - 0x2c4], 1
jmp 0x1000ecd3
and dword [ebp - 0x2c4], 0
push 0
lea ecx, [ebp - 0x324]
call fcn.100114b6
mov ecx, dword [ebp - 0x2c4]
cmp ecx, dword [eax]
jne 0x1000ee91
mov dword [ebp - 0x2e4], 0xe6fc
mov dword [ebp - 0x390], 0xfffb
mov dword [ebp - 0x34], 0
jmp 0x1000ed12
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jg 0x1000ed4f
mov dword [ebp - 0x58], 0
jmp 0x1000ed28
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jg 0x1000ed4d
mov byte [ebp - 0x77], 0
movzx eax, byte [ebp - 0x77]
test eax, eax
je 0x1000ed4b
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
jmp 0x1000ed21
jmp 0x1000ed0b
cmp dword [ebp - 0x2e4], 0
je 0x1000ed64
mov dword [ebp - 0x1ac], 1
jmp 0x1000ed6b
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x1ac], eax
je 0x1000ed85
mov dword [ebp - 0x2cc], 1
jmp 0x1000ed8c
and dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x2cc], 0xfffffffc
je 0x1000edae
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2f8], 0
jne 0x1000edae
and dword [ebp - 0x1b4], 0
jmp 0x1000edb8
mov dword [ebp - 0x1b4], 1
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
add eax, 0xea3d
je 0x1000ede6
cmp dword [ebp - 0x128], 0
je 0x1000ede6
mov dword [ebp - 0x2dc], 1
jmp 0x1000eded
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x1bc], eax
push 0
lea ecx, [ebp - 0x324]
call fcn.100114b6
mov ecx, dword [ebp - 0x1bc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x2dc]
jle 0x1000ee28
mov dword [ebp - 0x1c4], 1
jmp 0x1000ee2f
and dword [ebp - 0x1c4], 0
cmp dword [ebp - 0x1c4], 0x7f28
je 0x1000ee47
mov dword [ebp - 0x3f8], 1
jmp 0x1000ee4e
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x43c], eax
push 0
lea ecx, [ebp - 0x324]
call fcn.100114b6
mov eax, dword [eax]
neg eax
jne 0x1000ee79
mov dword [ebp - 0x2ec], 1
jmp 0x1000ee80
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x390], eax
jmp 0x1000efb1
mov dword [ebp - 0x108], 0xffff
mov dword [ebp - 0x58], 0xffffffec
jmp 0x1000eeab
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jne 0x1000efb1
mov dword [ebp - 0x34], 1
jmp 0x1000eec5
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1000efac
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x2f8], 0
je 0x1000eef1
cmp dword [ebp - 0x108], 0
je 0x1000eef1
mov dword [ebp - 0x1ec], 1
jmp 0x1000eef8
and dword [ebp - 0x1ec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2f8]
mov dword [ebp - 0x47c], eax
xor eax, eax
inc eax
cmp eax, 0x7203fca5
je 0x1000ef21
mov dword [ebp - 0x1e4], 1
jmp 0x1000ef28
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0x1e4]
jne 0x1000ef42
mov dword [ebp - 0x1d8], 1
jmp 0x1000ef49
and dword [ebp - 0x1d8], 0
cmp dword [ebp - 0x1d8], 4
jle 0x1000ef5e
mov dword [ebp - 0x270], 1
jmp 0x1000ef65
and dword [ebp - 0x270], 0
mov eax, 0x461
sub eax, dword [ebp - 0x270]
cmp eax, dword [ebp - 0x108]
je 0x1000ef84
mov dword [ebp - 0x1e0], 1
jmp 0x1000ef8b
and dword [ebp - 0x1e0], 0
mov esi, dword [ebp - 0x108]
imul esi, dword [ebp - 0x1e0]
push 0
lea ecx, [ebp - 0x324]
call fcn.100114b6
mov dword [eax], esi
jmp 0x1000eebe
jmp 0x1000eea4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x324]
call fcn.100114b1
mov byte [0x1066173c], 1
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x10075670
mov dword [ebp - 0x178], eax
push 1
lea ecx, [ebp - 0x33c]
call fcn.10011475
mov dword [ebp - 4], 6
mov dword [ebp - 0x2c0], 8
mov dword [ebp - 0xb4], 0x6c9cd49f
mov dword [ebp - 0x380], 0x157e
cmp dword [ebp - 0x380], 0xb66
jge 0x1000f18e
lea eax, [ebp - 0x120]
push eax
mov ecx, 0x10660718
call fcn.10010f2e
mov dword [ebp - 0x12c], 1
jmp 0x1000f047
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x384], 0
je 0x1000f18e
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x2e0]
push eax
mov ecx, 0x10660718
call fcn.10010f2e
and dword [ebp - 0xe8], 0
jmp 0x1000f0a7
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x2e0]
jge 0x1000f0cf
mov eax, dword [ebp - 0xe8]
lea eax, [ebp + eax*4 - 0x590]
push eax
mov ecx, 0x10660718
call fcn.10010f2e
jmp 0x1000f09a
and dword [ebp - 0x7c], 0
jmp 0x1000f0dc
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x2e0]
dec eax
cmp dword [ebp - 0x7c], eax
jge 0x1000f132
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0x590]
cmp eax, dword [ebp + ecx*4 - 0x58c]
jge 0x1000f10d
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
jmp 0x1000f130
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0x590]
cmp eax, dword [ebp + ecx*4 - 0x58c]
jle 0x1000f130
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
jmp 0x1000f0d5
push fcn.10013ebe
push dword [ebp - 0xac]
push dword [ebp - 0x110]
push dword [ebp - 0x12c]
mov edx, 0x10009d08
mov ecx, 0x106605f8
call fcn.1000d867
mov ecx, eax
call fcn.10011129
mov edx, 0x10009908
mov ecx, eax
call fcn.1000d867
mov ecx, eax
call fcn.10011129
mov dl, 0x20
mov ecx, eax
call fcn.10013ef0
mov ecx, eax
call fcn.10011129
mov ecx, eax
call fcn.1001111d
jmp 0x1000f03a
mov dword [ebp - 0x4c], 0
jmp 0x1000f19e
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1000f1b7
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x33c]
call fcn.100114b6
or dword [eax], 0xffffffff
jmp 0x1000f197
mov dword [ebp - 0x4c], 0
jmp 0x1000f1c7
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x1000f1dd
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x344], 0xffffffff
jmp 0x1000f1c0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x344]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x444], eax
push 0
lea ecx, [ebp - 0x33c]
call fcn.100114b6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x344], 0xfffffffe
je 0x1000f229
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x344], 0
je 0x1000f247
push 0
lea ecx, [ebp - 0x33c]
call fcn.100114b6
cmp dword [eax], 0
je 0x1000f247
mov dword [ebp - 0x1e8], 1
jmp 0x1000f24e
and dword [ebp - 0x1e8], 0
imul eax, dword [ebp - 0x1e8], 0
test eax, eax
jne 0x1000f26b
cmp dword [ebp - 0xb4], 0
jne 0x1000f26b
and dword [ebp - 0x278], 0
jmp 0x1000f275
mov dword [ebp - 0x278], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x344]
cmp dword [ebp - 0x278], eax
jge 0x1000f29c
mov eax, 0x4f6cbcb1
test eax, eax
jne 0x1000f29c
and dword [ebp - 0x1f0], 0
jmp 0x1000f2a6
mov dword [ebp - 0x1f0], 1
push 0
lea ecx, [ebp - 0x33c]
call fcn.100114b6
mov ecx, dword [ebp - 0x2c0]
imul ecx, dword [ebp - 0x1f0]
imul ecx, dword [ebp - 0x2c0]
cmp dword [eax], ecx
jle 0x1000f2e8
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp - 0x72]
test eax, eax
je 0x1000f2e6
push 0
push 0x2517
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x1000f332
xor eax, eax
jne 0x1000f307
push 0
lea ecx, [ebp - 0x33c]
call fcn.100114b6
cmp dword [eax], 0
jne 0x1000f307
and dword [ebp - 0xf4], 0
jmp 0x1000f311
mov dword [ebp - 0xf4], 1
push 0
lea ecx, [ebp - 0x33c]
call fcn.100114b6
mov ecx, dword [ebp - 0xf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xb4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x33c]
call fcn.100114b1
push 4
lea ecx, [ebp - 0x370]
call fcn.10011475
mov dword [ebp - 4], 7
mov dword [ebp - 0x28], 0
mov dword [ebp - 0xbc], 0
jmp 0x1000f375
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 4
jge 0x1000f397
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x370]
call fcn.100114b6
mov dword [eax], 0x28c176b0
jmp 0x1000f368
mov dword [ebp - 0x28], 0
jmp 0x1000f3a7
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x1000f3cf
mov dword [ebp - 0x3c4], 0xffffffff
mov esi, dword [ebp - 0x3c4]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x370]
call fcn.100114b6
mov dword [eax], esi
jmp 0x1000f3a0
push 1
lea ecx, [ebp - 0x370]
call fcn.100114b6
mov esi, dword [eax]
sub esi, 0x657e
push 1
lea ecx, [ebp - 0x370]
call fcn.100114b6
cmp esi, dword [eax]
je 0x1000f404
cmp dword [ebp - 0x28], 0
jne 0x1000f404
and dword [ebp - 0x1f8], 0
jmp 0x1000f40e
mov dword [ebp - 0x1f8], 1
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x1f8]
cmp eax, 0xfffffff7
jb 0x1000f428
mov dword [ebp - 0x280], 1
jmp 0x1000f42f
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x280], eax
jge 0x1000f446
mov dword [ebp - 0x200], 1
jmp 0x1000f44d
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0
jge 0x1000f462
mov dword [ebp - 0x308], 1
jmp 0x1000f469
and dword [ebp - 0x308], 0
push 2
lea ecx, [ebp - 0x370]
call fcn.100114b6
mov eax, dword [eax]
cmp eax, dword [ebp - 0x308]
jge 0x1000f48c
mov dword [ebp - 0x208], 1
jmp 0x1000f493
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x208], eax
jle 0x1000f4aa
mov dword [ebp - 0x288], 1
jmp 0x1000f4b1
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x288]
cmp eax, 0x70e7ad53
je 0x1000f4ce
mov dword [ebp - 0x148], 1
jmp 0x1000f4d5
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x148]
mov dword [ebp - 0x28], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x370]
call fcn.100114b1
mov dword [ebp - 0x14], 0xa3fc4b03
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x298], 1
mov dword [ebp - 0x394], 0xffffffff
xor eax, eax
inc eax
je 0x1000f555
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x14]
dec eax
cmp dword [ebp - 0x14], eax
je 0x1000f536
mov dword [ebp - 0x2c8], 1
jmp 0x1000f53d
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x2c8]
sub eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jge 0x1000f555
cmp dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
je 0x1000f569
mov dword [ebp - 0x218], 1
jmp 0x1000f570
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], eax
je 0x1000f58d
mov dword [ebp - 0x290], 1
jmp 0x1000f594
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x290], eax
jne 0x1000f5ab
mov dword [ebp - 0x220], 1
jmp 0x1000f5b2
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x220]
cmp eax, dword [ebp - 0x1c]
jne 0x1000f5cc
mov dword [ebp - 0x2e8], 1
jmp 0x1000f5d3
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0x1c]
jg 0x1000f602
mov byte [ebp - 0x6c], 0
movzx eax, byte [ebp - 0x6c]
test eax, eax
je 0x1000f5fd
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
jmp 0x1000f792
mov dword [ebp - 0x3e4], 8
mov dword [ebp - 0x1c], 0
jmp 0x1000f61c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1000f659
mov dword [ebp - 0x38c], 0xfffffff6
mov byte [ebp - 0x76], 0
movzx eax, byte [ebp - 0x76]
test eax, eax
je 0x1000f64d
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov dword [ebp - 0x38c], 0x3fd52a42
jmp 0x1000f615
mov dword [ebp - 0x1c], 0
jmp 0x1000f669
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jl 0x1000f792
mov dword [ebp - 0xc4], 0
jmp 0x1000f68c
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x1000f6a8
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x410], 1
jmp 0x1000f67f
mov dword [ebp - 0x14], 0
jmp 0x1000f6b8
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x1000f77b
mov dword [ebp - 0x68], 0x19820b27
mov dword [ebp - 0x68], 0
jmp 0x1000f6d9
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jg 0x1000f776
mov dword [ebp - 0x2d0], 0x7fd8b26d
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0x410], ecx
je 0x1000f71b
mov eax, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0x410], 0
je 0x1000f71b
cmp dword [ebp - 0x1c], 0
jne 0x1000f71b
mov dword [ebp - 0x228], 1
jmp 0x1000f722
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x3e4]
cmp dword [ebp - 0x298], eax
je 0x1000f748
mov dword [ebp - 0x230], 1
jmp 0x1000f74f
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x410]
add eax, dword [ebp - 0x230]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x394], eax
jmp 0x1000f6d2
jmp 0x1000f6b1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x410], 0
je 0x1000f78d
jmp 0x1000f792
jmp 0x1000f662
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x10075670
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x38], 0xffffffff
push 2
lea ecx, [ebp - 0x330]
call fcn.10011475
mov dword [ebp - 4], 8
mov dword [ebp - 0x48], 0x2d714f98
mov dword [ebp - 0x1cc], 0x33ee
mov dword [ebp - 0xfc], 0xfffffffd
mov dword [ebp - 0x40], 0
jmp 0x1000f7e9
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1000f805
push dword [ebp - 0x40]
lea ecx, [ebp - 0x330]
call fcn.100114b6
mov dword [eax], 3
jmp 0x1000f7e2
mov dword [ebp - 0x40], 0
jmp 0x1000f815
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1000f82b
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x304], 0xd4e70302
jmp 0x1000f80e
mov dword [ebp - 0x38], 0xffffffff
mov esi, dword [ebp - 0x38]
push 0
lea ecx, [ebp - 0x330]
call fcn.100114b6
cmp esi, dword [eax]
je 0x1000f852
mov dword [ebp - 0x248], 1
jmp 0x1000f859
and dword [ebp - 0x248], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x304], 0x6c31
jne 0x1000f878
mov dword [ebp - 0x238], 1
jmp 0x1000f87f
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x238]
sub eax, dword [ebp - 0x48]
cmp eax, 1
ja 0x1000f899
mov dword [ebp - 0x2a0], 1
jmp 0x1000f8a0
and dword [ebp - 0x2a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x304]
cmp dword [ebp - 0x2a0], eax
je 0x1000f8ca
mov eax, 0x85b6478c
test eax, eax
je 0x1000f8ca
mov dword [ebp - 0x240], 1
jmp 0x1000f8d1
and dword [ebp - 0x240], 0
cmp dword [ebp - 0x240], 6
jg 0x1000f8e6
mov dword [ebp - 0x2fc], 1
jmp 0x1000f8ed
and dword [ebp - 0x2fc], 0
cmp dword [ebp - 0x2fc], 4
ja 0x1000f902
mov dword [ebp - 0x2a8], 1
jmp 0x1000f909
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x248]
cmp eax, dword [ebp - 0x2a8]
jle 0x1000f923
mov dword [ebp - 0x250], 1
jmp 0x1000f92a
and dword [ebp - 0x250], 0
push 0
lea ecx, [ebp - 0x330]
call fcn.100114b6
mov ecx, dword [ebp - 0x250]
cmp ecx, dword [eax]
jne 0x1000fbed
mov dword [ebp - 0x204], 0xe6fc
mov dword [ebp - 0x3a4], 0xfffb
mov dword [ebp - 0x38], 0
jmp 0x1000f969
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jg 0x1000faab
mov dword [ebp - 0x48], 0
jmp 0x1000f983
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jg 0x1000faa6
mov dword [ebp - 0x3cc], 0x23c1
cmp dword [ebp - 0x3cc], 0xb1d
jge 0x1000fa84
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x39c]
push eax
push 0x10009d10
call fcn.10055d2e
add esp, 0xc
and dword [ebp - 0x2f0], 0
and dword [ebp - 0x268], 0
mov dword [ebp - 0xa4], 1
jmp 0x1000f9e9
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x39c]
jg 0x1000fa72
lea eax, [ebp - 0x2d8]
push eax
push 0x10009d04
call fcn.10055d2e
pop ecx
pop ecx
mov eax, dword [ebp - 0x2d8]
cdq
idiv dword [ebp - 0x258]
test edx, edx
jle 0x1000fa27
mov dword [ebp - 0x2b0], 1
jmp 0x1000fa2e
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x2d8]
cdq
idiv dword [ebp - 0x258]
add eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
cmp eax, dword [ebp - 0x2f0]
jl 0x1000fa6d
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x268], eax
jmp 0x1000f9dc
push dword [ebp - 0x268]
push 0x10009d18
call fcn.100558e6
pop ecx
pop ecx
mov byte [ebp - 0x6e], 0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x1000faa1
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
jmp 0x1000f97c
jmp 0x1000f962
cmp dword [ebp - 0x204], 0
je 0x1000fac0
mov dword [ebp - 0x1d0], 1
jmp 0x1000fac7
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x1d0], eax
je 0x1000fae1
mov dword [ebp - 0x1d4], 1
jmp 0x1000fae8
and dword [ebp - 0x1d4], 0
cmp dword [ebp - 0x1d4], 0xfffffffc
je 0x1000fb0a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x304], 0
jne 0x1000fb0a
and dword [ebp - 0x1dc], 0
jmp 0x1000fb14
mov dword [ebp - 0x1dc], 1
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
add eax, 0xea3d
je 0x1000fb42
cmp dword [ebp - 0xfc], 0
je 0x1000fb42
mov dword [ebp - 0x1f4], 1
jmp 0x1000fb49
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1c8], eax
push 0
lea ecx, [ebp - 0x330]
call fcn.100114b6
mov ecx, dword [ebp - 0x1c8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c8]
cmp eax, dword [ebp - 0x1f4]
jle 0x1000fb84
mov dword [ebp - 0x1fc], 1
jmp 0x1000fb8b
and dword [ebp - 0x1fc], 0
cmp dword [ebp - 0x1fc], 0x7f28
je 0x1000fba3
mov dword [ebp - 0x3f4], 1
jmp 0x1000fbaa
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x464], eax
push 0
lea ecx, [ebp - 0x330]
call fcn.100114b6
mov eax, dword [eax]
neg eax
jne 0x1000fbd5
mov dword [ebp - 0x20c], 1
jmp 0x1000fbdc
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x3a4], eax
jmp 0x1000fd0d
mov dword [ebp - 0x104], 0xffff
mov dword [ebp - 0x48], 0xffffffec
jmp 0x1000fc07
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jne 0x1000fd0d
mov dword [ebp - 0x38], 1
jmp 0x1000fc21
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1000fd08
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x304], 0
je 0x1000fc4d
cmp dword [ebp - 0x104], 0
je 0x1000fc4d
mov dword [ebp - 0x214], 1
jmp 0x1000fc54
and dword [ebp - 0x214], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x304]
mov dword [ebp - 0x4a0], eax
xor eax, eax
inc eax
cmp eax, 0x7203fca5
je 0x1000fc7d
mov dword [ebp - 0x21c], 1
jmp 0x1000fc84
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x21c]
jne 0x1000fc9e
mov dword [ebp - 0x224], 1
jmp 0x1000fca5
and dword [ebp - 0x224], 0
cmp dword [ebp - 0x224], 4
jle 0x1000fcba
mov dword [ebp - 0x22c], 1
jmp 0x1000fcc1
and dword [ebp - 0x22c], 0
mov eax, 0x461
sub eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x104]
je 0x1000fce0
mov dword [ebp - 0x234], 1
jmp 0x1000fce7
and dword [ebp - 0x234], 0
mov esi, dword [ebp - 0x104]
imul esi, dword [ebp - 0x234]
push 0
lea ecx, [ebp - 0x330]
call fcn.100114b6
mov dword [eax], esi
jmp 0x1000fc1a
jmp 0x1000fc00
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x330]
call fcn.100114b1
mov dword [ebp - 0x30], 0x94b4b132
mov dword [ebp - 0xd4], 0x5e49
mov dword [ebp - 0x25c], 0x1311e2db
mov dword [ebp - 0x254], 0xd4856cd8
mov dword [ebp - 0x98], 0xfffffff9
mov dword [ebp - 0x114], 7
mov dword [ebp - 0x10c], 0xffffffff
push 2
lea ecx, [ebp - 0x358]
call fcn.10011475
mov dword [ebp - 4], 9
mov dword [ebp - 0x3dc], 0xffffffff
mov dword [ebp - 0xcc], 0
jmp 0x1000fd96
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jge 0x1000fdb8
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x358]
call fcn.100114b6
mov dword [eax], 0x6b2c4eb0
jmp 0x1000fd89
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
je 0x1000fdcc
mov dword [ebp - 0x23c], 1
jmp 0x1000fdd3
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x23c], eax
jge 0x1000fdea
mov dword [ebp - 0x3d4], 1
jmp 0x1000fdf1
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x30], 0
jl 0x1000fe0c
mov dword [ebp - 0x244], 1
jmp 0x1000fe13
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x244]
imul eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x25c]
je 0x1000fe37
mov dword [ebp - 0x24c], 1
jmp 0x1000fe3e
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x30], eax
jle 0x1000fe61
mov dword [ebp - 0x3ac], 1
jmp 0x1000fe68
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x114], eax
je 0x1000fec1
mov dword [ebp - 0x3ec], 1
jmp 0x1000fec8
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0xd4]
add eax, 7
mov dword [ebp - 0x10c], eax
je 0x1000fef1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret