Function at 0x100090db
Capabilities:
Create thread
Delete file
Delete registry key
Get common file path
Query service status

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1660
call fcn.10079c00
push esi
push edi
mov dword [ebp - 0x3f0], 0xe1757117
mov dword [ebp - 0x3f0], 0
jmp 0x1000910d
mov eax, dword [ebp - 0x3f0]
dec eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0xfffffff8
jne 0x1000918d
mov dword [ebp - 0x11dc], 0xfffffffa
mov dword [ebp - 0x11d8], 0xfffffffa
mov dword [ebp - 0x11d4], 0xfffffffa
mov dword [ebp - 0x11d0], 0xfffffffa
mov dword [ebp - 0x1b0], 0x37ad4351
mov dword [ebp - 0x1b0], 0
jmp 0x10009161
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 4
jge 0x1000917d
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x11dc], 1
jmp 0x10009154
cmp dword [ebp - 0x1b0], 0
je 0x10009188
jmp 0x1000918d
jmp 0x10009100
mov dword [ebp - 0x3f8], 0xe1757117
mov dword [ebp - 0x3f8], 0
jmp 0x100091b0
mov eax, dword [ebp - 0x3f8]
dec eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0xfffffff8
jne 0x10009230
mov dword [ebp - 0x121c], 0xfffffffa
mov dword [ebp - 0x1218], 0xfffffffa
mov dword [ebp - 0x1214], 0xfffffffa
mov dword [ebp - 0x1210], 0xfffffffa
mov dword [ebp - 0x1d4], 0x37ad4351
mov dword [ebp - 0x1d4], 0
jmp 0x10009204
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 4
jge 0x10009220
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x121c], 1
jmp 0x100091f7
cmp dword [ebp - 0x1d4], 0
je 0x1000922b
jmp 0x10009230
jmp 0x100091a3
mov dword [ebp - 0x130], 0x3ae35568
mov dword [ebp - 0x410], 0x7ab61b58
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x250], 3
mov dword [ebp - 0xf28], 0xd0ae446f
mov dword [ebp - 0x538], 0xa87
mov dword [ebp - 0x80], 0
jmp 0x1000927c
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x10009292
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x10f0], 0xfffffffc
jmp 0x10009275
mov dword [ebp - 0x80], 0
jmp 0x100092a2
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x100092b8
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x132c], 0x25f1a37c
jmp 0x1000929b
mov dword [ebp - 0x130], 0x1a
jmp 0x100092d1
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffef
jle 0x1000993c
mov dword [ebp - 0x48], 0x1738ab65
mov dword [ebp - 0xd8], 0xe7631615
mov dword [ebp - 0xe80], 4
mov dword [ebp - 0x258], 0x2e71cc54
mov dword [ebp - 0x520], 5
mov dword [ebp - 0x400], 0
jmp 0x10009326
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 3
jge 0x10009342
mov eax, dword [ebp - 0x400]
mov dword [ebp + eax*4 - 0xdb0], 0x3eb905d0
jmp 0x10009319
mov dword [ebp - 0x48], 2
jmp 0x10009352
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x10009796
mov dword [ebp - 0xd84], 0xfffffffa
mov dword [ebp - 0x248], 0xfffffff7
mov dword [ebp - 0x494], 0xfffffffe
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0xd84]
mov dword [ebp - 0x9e8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9e8]
mov dword [ebp + eax - 0x10f0], ecx
cmp dword [ebp - 0x9e8], 5
jg 0x100093d9
mov dword [ebp - 0xd1c], 1
jmp 0x100093e0
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0xe80]
cmp dword [ebp - 0xd1c], eax
je 0x100093fa
mov dword [ebp - 0xf18], 1
jmp 0x10009401
and dword [ebp - 0xf18], 0
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x127c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x10f0], 0
jae 0x10009431
mov eax, 0x1a53fde7
test eax, eax
je 0x10009431
mov dword [ebp - 0xd24], 1
jmp 0x10009438
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0xd24]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0x250], eax
jge 0x1000945e
mov dword [ebp - 0xf20], 1
jmp 0x10009465
and dword [ebp - 0xf20], 0
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x1248], eax
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x258]
test eax, eax
jne 0x10009491
cmp dword [ebp - 0x494], 0
jne 0x10009491
and dword [ebp - 0xd2c], 0
jmp 0x1000949b
mov dword [ebp - 0xd2c], 1
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0xd2c]
jg 0x100094c2
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x10f0], 0
je 0x100094c2
mov dword [ebp - 0xd34], 1
jmp 0x100094c9
and dword [ebp - 0xd34], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0xdb0]
cmp eax, dword [ebp - 0xd34]
jne 0x100094e7
mov dword [ebp - 0xd3c], 1
jmp 0x100094ee
and dword [ebp - 0xd3c], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0xd3c], eax
je 0x1000953d
mov dword [ebp - 0xd8], 3
jmp 0x10009515
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x10009538
mov byte [ebp - 0x1aa], 0
movzx eax, byte [ebp - 0x1aa]
test eax, eax
je 0x10009536
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x10009508
jmp 0x10009791
mov dword [ebp - 0x408], 1
mov dword [ebp - 0x518], 0x68b63c96
push 4
pop eax
imul eax, eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x10f0]
sub ecx, dword [ebp - 0x408]
imul ecx, dword [ebp - 0x408]
cmp ecx, 8
jl 0x1000957f
mov dword [ebp - 0xd44], 1
jmp 0x10009586
and dword [ebp - 0xd44], 0
mov eax, dword [ebp - 0xd44]
mov dword [ebp - 0x520], eax
mov dword [ebp - 0xd8], 0x2d9b
cmp dword [ebp - 0xd8], 0
je 0x10009730
mov eax, dword [ebp - 0xf28]
mov dword [ebp - 0x1250], eax
mov eax, dword [ebp - 0x494]
cmp dword [ebp - 0x410], eax
je 0x100095cf
mov dword [ebp - 0xd4c], 1
jmp 0x100095d6
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0xdb0]
cmp dword [ebp - 0xd4c], eax
je 0x100095f4
mov dword [ebp - 0xd54], 1
jmp 0x100095fb
and dword [ebp - 0xd54], 0
cmp dword [ebp - 0xd54], 1
jne 0x10009610
mov dword [ebp - 0xde8], 1
jmp 0x10009617
and dword [ebp - 0xde8], 0
mov eax, dword [ebp - 0xde8]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x250]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x10f0]
cmp eax, dword [ebp - 0x130]
jge 0x10009650
cmp dword [ebp - 0xd84], 0
jne 0x10009650
and dword [ebp - 0x750], 0
jmp 0x1000965a
mov dword [ebp - 0x750], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdb0]
cmp eax, dword [ebp - 0x750]
jge 0x1000967b
mov dword [ebp - 0x500], 1
jmp 0x10009682
and dword [ebp - 0x500], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10f0]
cmp dword [ebp - 0x500], eax
jle 0x100096a3
mov dword [ebp - 0xf30], 1
jmp 0x100096aa
and dword [ebp - 0xf30], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x1258], eax
mov eax, 0xacafb12b
test eax, eax
je 0x100096dc
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0xdb0], 0
je 0x100096dc
xor eax, eax
je 0x100096dc
mov dword [ebp - 0xac4], 1
jmp 0x100096e3
and dword [ebp - 0xac4], 0
mov eax, dword [ebp - 0xac4]
neg eax
cmp eax, dword [ebp - 0x494]
jl 0x100096ff
mov dword [ebp - 0x508], 1
jmp 0x10009706
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
je 0x10009730
cmp dword [ebp - 0x408], 0
je 0x10009730
mov dword [ebp - 0xacc], 1
jmp 0x10009737
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0xacc]
jle 0x10009751
mov dword [ebp - 0x510], 1
jmp 0x10009758
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x408]
cmp dword [ebp - 0x510], eax
jg 0x10009772
mov dword [ebp - 0xad4], 1
jmp 0x10009779
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x258], eax
jmp 0x1000934b
xor eax, eax
inc eax
je 0x100097a9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdb0], 0
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0x48], eax
je 0x100097c0
mov dword [ebp - 0xadc], 1
jmp 0x100097c7
and dword [ebp - 0xadc], 0
cmp dword [ebp - 0xadc], 0x14f04b5a
jle 0x100097df
mov dword [ebp - 0xae4], 1
jmp 0x100097e6
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x520]
cmp dword [ebp - 0xae4], eax
jle 0x10009800
mov dword [ebp - 0x528], 1
jmp 0x10009807
and dword [ebp - 0x528], 0
mov dword [ebp - 0x258], 1
mov eax, dword [ebp - 0x528]
add eax, 0x64400d43
cmp dword [ebp - 0x258], eax
jne 0x10009830
mov dword [ebp - 0xaec], 1
jmp 0x10009837
and dword [ebp - 0xaec], 0
mov eax, dword [ebp - 0x410]
cmp dword [ebp - 0xaec], eax
jle 0x10009861
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdb0], 0
je 0x10009861
mov dword [ebp - 0x530], 1
jmp 0x10009868
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
add eax, 0x9f13
test eax, eax
jg 0x10009883
mov dword [ebp - 0xaf4], 1
jmp 0x1000988a
and dword [ebp - 0xaf4], 0
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 0
ja 0x100098ab
mov dword [ebp - 0xafc], 1
jmp 0x100098b2
and dword [ebp - 0xafc], 0
cmp dword [ebp - 0xafc], 0xfffffff8
jb 0x100098c7
mov dword [ebp - 0x540], 1
jmp 0x100098ce
and dword [ebp - 0x540], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdb0]
cmp dword [ebp - 0x540], eax
je 0x100098ef
mov dword [ebp - 0xb04], 1
jmp 0x100098f6
and dword [ebp - 0xb04], 0
cmp dword [ebp - 0xb04], 0x2beb
jl 0x1000991a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xdb0], 0
jne 0x1000991a
and dword [ebp - 0x548], 0
jmp 0x10009924
mov dword [ebp - 0x548], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x548]
mov dword [ebp + eax - 0x132c], ecx
jmp 0x100092c4
mov dword [ebp - 0x344], 0xe1757117
mov dword [ebp - 0x1f4], 0xc85f70ad
mov dword [ebp - 0xf38], 0x5e314a5e
mov dword [ebp - 0x1260], 0x90c6d21c
mov dword [ebp - 0x1268], 0
mov dword [ebp - 0x1270], 0
mov dword [ebp - 0xf40], 0xfffffff8
mov dword [ebp - 0x49c], 0xfd03b15a
mov dword [ebp - 0xbc], 0
jmp 0x100099a5
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x100099c1
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x1338], 0xe780ca9f
jmp 0x10009998
mov dword [ebp - 0xbc], 0
jmp 0x100099da
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x100099f6
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x158c], 0
jmp 0x100099cd
mov dword [ebp - 0x1f4], 0
jmp 0x10009a0f
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 1
jne 0x10009be5
mov dword [ebp - 0x240], 0x58d32ffa
mov dword [ebp - 0x1278], 0xb28787d
mov dword [ebp - 0x4a4], 0xffffffff
mov dword [ebp - 0x4ac], 0x1462ccd2
mov dword [ebp - 0x240], 0xfffffff6
jmp 0x10009a5d
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
je 0x10009ace
mov dword [ebp - 0x418], 0xfffffffa
mov dword [ebp - 0x418], 0x1d
jmp 0x10009a89
mov eax, dword [ebp - 0x418]
dec eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
jle 0x10009ab0
mov byte [ebp - 0x1a8], 0
movzx eax, byte [ebp - 0x1a8]
test eax, eax
je 0x10009aae
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10009a7c
mov byte [ebp - 0x12a], 0
movzx eax, byte [ebp - 0x12a]
test eax, eax
je 0x10009acc
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x10009a50
cmp dword [ebp - 0x1f4], 7
jne 0x10009ae3
mov dword [ebp - 0x558], 1
jmp 0x10009aea
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x1280], eax
mov eax, dword [ebp - 0x4ac]
cmp dword [ebp - 0x4ac], eax
jl 0x10009b10
mov dword [ebp - 0xb0c], 1
jmp 0x10009b17
and dword [ebp - 0xb0c], 0
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0xf38], 0xffffffff
jge 0x10009b38
mov dword [ebp - 0x550], 1
jmp 0x10009b3f
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
imul eax, dword [ebp - 0x550], 0xfffd
cmp dword [ebp - 0x49c], eax
jle 0x10009b6a
mov dword [ebp - 0xb14], 1
jmp 0x10009b71
and dword [ebp - 0xb14], 0
cmp dword [ebp - 0xb14], 1
jne 0x10009b8f
cmp dword [ebp - 0x4a4], 0
je 0x10009b8f
mov dword [ebp - 0xb1c], 1
jmp 0x10009b96
and dword [ebp - 0xb1c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x558]
add ecx, dword [ebp - 0xb1c]
cmp dword [ebp + eax - 0x1338], ecx
jg 0x10009bb8
cmp dword [ebp - 0xf40], 0
cmp dword [ebp - 0x4a4], 0xfffffff9
jb 0x10009bcd
mov dword [ebp - 0x560], 1
jmp 0x10009bd4
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x4ac], eax
jmp 0x10009a02
mov dword [ebp - 0x344], 0
jmp 0x10009bfe
mov eax, dword [ebp - 0x344]
dec eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0xfffffff8
jne 0x1000a2c4
mov dword [ebp - 0x1f8], 0
mov dword [ebp - 0x11fc], 0xfffffffa
mov dword [ebp - 0x11f8], 0xfffffffa
mov dword [ebp - 0x11f4], 0xfffffffa
mov dword [ebp - 0x11f0], 0xfffffffa
mov dword [ebp - 0x1f8], 0
jmp 0x10009c56
mov eax, dword [ebp - 0x1f8]
dec eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0xfffffff1
je 0x10009cf9
mov dword [ebp - 0x3dc], 0xd3f46721
mov dword [ebp - 0x27c], 0
jmp 0x10009c86
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 4
jge 0x10009ca2
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x153c], 5
jmp 0x10009c79
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x153c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x153c], eax
mov dword [ebp - 0x3dc], 0
jmp 0x10009cd6
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 3
jg 0x10009cf4
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1f8]
mov dword [ebp + eax - 0x11fc], ecx
jmp 0x10009cc9
jmp 0x10009c49
mov dword [ebp - 0x11cc], 0xfffffffa
mov dword [ebp - 0x11c8], 0xfffffffa
mov dword [ebp - 0x11c4], 0xfffffffa
mov dword [ebp - 0x11c0], 0xfffffffa
mov dword [ebp - 0x118], 0x42c70bb7
mov dword [ebp - 0x148], 0xfffffffb
mov dword [ebp - 0x4b4], 0xffffffff
mov dword [ebp - 0x284], 0
jmp 0x10009d58
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 3
jge 0x10009d74
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0xe70], 0xfffffff8
jmp 0x10009d4b
mov dword [ebp - 0x118], 2
jmp 0x10009d8d
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x1000a08c
mov dword [ebp - 0xec], 0xff55e00f
mov dword [ebp - 0x140], 1
mov dword [ebp - 0xec], 0
jmp 0x10009dc7
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jg 0x1000a004
mov dword [ebp - 0x138], 0x478c9dff
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1288], 0xe1a0e1c2
cmp dword [ebp - 0x138], 0
jne 0x10009e0d
mov eax, 0x5849
test eax, eax
jne 0x10009e0d
and dword [ebp - 0xb24], 0
jmp 0x10009e17
mov dword [ebp - 0xb24], 1
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jne 0x10009e3e
cmp dword [ebp - 0xec], 0
jne 0x10009e3e
and dword [ebp - 0x568], 0
jmp 0x10009e48
mov dword [ebp - 0x568], 1
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x568], eax
jne 0x10009e62
mov dword [ebp - 0xb2c], 1
jmp 0x10009e69
and dword [ebp - 0xb2c], 0
cmp dword [ebp - 0xb2c], 0x7857
jne 0x10009e81
mov dword [ebp - 0x570], 1
jmp 0x10009e88
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x140], eax
jl 0x10009eb5
mov dword [ebp - 0xb34], 1
jmp 0x10009ebc
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0xec]
add eax, dword [ebp + ecx*4 - 0xe70]
cmp eax, dword [ebp - 0xb34]
jne 0x10009ee3
mov dword [ebp - 0x578], 1
jmp 0x10009eea
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 0xffff
ja 0x10009f02
mov dword [ebp - 0xf48], 1
jmp 0x10009f09
and dword [ebp - 0xf48], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1290], eax
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp + eax*4 - 0xe70]
neg eax
mov ecx, dword [ebp - 0x118]
push 4
pop edx
imul edx, edx, 0
add ecx, dword [ebp + edx - 0xe70]
cmp eax, ecx
jl 0x10009f47
mov dword [ebp - 0xb3c], 1
jmp 0x10009f4e
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp + eax*4 - 0xe70]
cmp dword [ebp - 0xb3c], eax
jge 0x10009f6f
mov dword [ebp - 0x580], 1
jmp 0x10009f76
and dword [ebp - 0x580], 0
cmp dword [ebp - 0x580], 0xc90e69cd
jne 0x10009f94
mov eax, 0xcd95
test eax, eax
jne 0x10009f94
and dword [ebp - 0xb44], 0
jmp 0x10009f9e
mov dword [ebp - 0xb44], 1
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x138], 0
jmp 0x10009fc3
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jg 0x10009fff
mov dword [ebp - 0x1dc], 2
jmp 0x10009fe5
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jl 0x10009ffd
mov eax, dword [ebp - 0x4b4]
dec eax
mov dword [ebp - 0x4b4], eax
jmp 0x10009fd8
jmp 0x10009fb6
jmp 0x10009dba
mov dword [ebp - 0x148], 2
jmp 0x1000a01d
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jl 0x1000a087
mov dword [ebp - 0x140], 0
jmp 0x1000a03f
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 2
jg 0x1000a064
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x148]
mov eax, dword [ebp + eax*4 - 0xe70]
mov dword [ebp + ecx*4 - 0xe70], eax
jmp 0x1000a032
mov byte [ebp - 0x1ac], 0
movzx eax, byte [ebp - 0x1ac]
test eax, eax
je 0x1000a085
push 0
push 0xb54
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
jmp 0x1000a010
jmp 0x10009d80
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x1b8], 0x37ad4351
mov dword [ebp - 0x1e4], 0xf7bf
mov dword [ebp - 0x484], 0xffffffff
mov dword [ebp - 0x424], 0xfffe
mov dword [ebp - 0x498], 0xd3e99730
mov dword [ebp - 0xf60], 0xfffffffd
mov dword [ebp - 0xf68], 0xffffffff
mov byte [ebp - 0x19b], 0
movzx eax, byte [ebp - 0x19b]
test eax, eax
je 0x1000a102
push 0xae3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x1298], eax
cmp dword [ebp - 0x1e4], 0
jne 0x1000a123
mov dword [ebp - 0x588], 1
jmp 0x1000a12a
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x588], eax
jge 0x1000a144
mov dword [ebp - 0xb4c], 1
jmp 0x1000a14b
and dword [ebp - 0xb4c], 0
cmp dword [ebp - 0xb4c], 1
jle 0x1000a160
mov dword [ebp - 0x590], 1
jmp 0x1000a167
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0x1b583dc0
je 0x1000a18b
mov dword [ebp - 0xf50], 1
jmp 0x1000a192
and dword [ebp - 0xf50], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x12a0], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x1e4]
sub eax, 0xc71b
imul eax, dword [ebp - 0x498]
test eax, eax
jne 0x1000a1d2
cmp dword [ebp - 0x498], 0
jne 0x1000a1d2
and dword [ebp - 0xb54], 0
jmp 0x1000a1dc
mov dword [ebp - 0xb54], 1
imul eax, dword [ebp - 0xb54], 0xac89
cmp eax, dword [ebp - 0x424]
jl 0x1000a1fa
mov dword [ebp - 0x598], 1
jmp 0x1000a201
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x598], eax
je 0x1000a21b
mov dword [ebp - 0xf58], 1
jmp 0x1000a222
and dword [ebp - 0xf58], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x12a8], eax
cmp dword [ebp - 0xf60], 0x91a8
je 0x1000a246
mov dword [ebp - 0xb5c], 1
jmp 0x1000a24d
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0xb5c]
dec eax
dec eax
je 0x1000a26c
cmp dword [ebp - 0x484], 0
je 0x1000a26c
mov dword [ebp - 0x5a0], 1
jmp 0x1000a273
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0xf68], eax
mov dword [ebp - 0x1b8], 0
jmp 0x1000a298
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 4
jge 0x1000a2b4
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x11cc], 1
jmp 0x1000a28b
cmp dword [ebp - 0x1b8], 0
je 0x1000a2bf
jmp 0x1000a2c4
jmp 0x10009bf1
mov dword [ebp - 0x150], 0x3ae35568
mov dword [ebp - 0x3fc], 0x7ab61b58
mov dword [ebp - 0x42c], 1
mov dword [ebp - 0x1fc], 3
mov dword [ebp - 0x1020], 0xd0ae446f
mov dword [ebp - 0xbcc], 0xa87
mov dword [ebp - 0x88], 0
jmp 0x1000a319
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x1000a335
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x1100], 0xfffffffc
jmp 0x1000a30c
mov dword [ebp - 0x88], 0
jmp 0x1000a34e
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1000a36a
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x1344], 0x25f1a37c
jmp 0x1000a341
mov dword [ebp - 0x150], 0x1a
jmp 0x1000a383
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xffffffef
jle 0x1000a9ee
mov dword [ebp - 0x54], 0x1738ab65
mov dword [ebp - 0xf4], 0xe7631615
mov dword [ebp - 0xf70], 4
mov dword [ebp - 0x22c], 0x2e71cc54
mov dword [ebp - 0xbb4], 5
mov dword [ebp - 0x3a4], 0
jmp 0x1000a3d8
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 3
jge 0x1000a3f4
mov eax, dword [ebp - 0x3a4]
mov dword [ebp + eax*4 - 0xdc0], 0x3eb905d0
jmp 0x1000a3cb
mov dword [ebp - 0x54], 2
jmp 0x1000a404
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1000a848
mov dword [ebp - 0xb8c], 0xfffffffa
mov dword [ebp - 0x24c], 0xfffffff7
mov dword [ebp - 0x48c], 0xfffffffe
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x3fc]
sub eax, dword [ebp - 0xb8c]
mov dword [ebp - 0xb64], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb64]
mov dword [ebp + eax - 0x1100], ecx
cmp dword [ebp - 0xb64], 5
jg 0x1000a48b
mov dword [ebp - 0x5a8], 1
jmp 0x1000a492
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0xf70]
cmp dword [ebp - 0x5a8], eax
je 0x1000a4ac
mov dword [ebp - 0xf78], 1
jmp 0x1000a4b3
and dword [ebp - 0xf78], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x12b0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1100], 0
jae 0x1000a4e3
mov eax, 0x1a53fde7
test eax, eax
je 0x1000a4e3
mov dword [ebp - 0xb6c], 1
jmp 0x1000a4ea
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x1fc], eax
jge 0x1000a510
mov dword [ebp - 0xf80], 1
jmp 0x1000a517
and dword [ebp - 0xf80], 0
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x12b8], eax
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x22c]
test eax, eax
jne 0x1000a543
cmp dword [ebp - 0x48c], 0
jne 0x1000a543
and dword [ebp - 0x5b0], 0
jmp 0x1000a54d
mov dword [ebp - 0x5b0], 1
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x5b0]
jg 0x1000a574
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1100], 0
je 0x1000a574
mov dword [ebp - 0xb74], 1
jmp 0x1000a57b
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0xdc0]
cmp eax, dword [ebp - 0xb74]
jne 0x1000a599
mov dword [ebp - 0x5b8], 1
jmp 0x1000a5a0
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x5b8], eax
je 0x1000a5ef
mov dword [ebp - 0xf4], 3
jmp 0x1000a5c7
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jl 0x1000a5ea
mov byte [ebp - 0x12b], 0
movzx eax, byte [ebp - 0x12b]
test eax, eax
je 0x1000a5e8
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x1000a5ba
jmp 0x1000a843
mov dword [ebp - 0x28c], 1
mov dword [ebp - 0xbac], 0x68b63c96
push 4
pop eax
imul eax, eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x1100]
sub ecx, dword [ebp - 0x28c]
imul ecx, dword [ebp - 0x28c]
cmp ecx, 8
jl 0x1000a631
mov dword [ebp - 0xb7c], 1
jmp 0x1000a638
and dword [ebp - 0xb7c], 0
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xbb4], eax
mov dword [ebp - 0xf4], 0x2d9b
cmp dword [ebp - 0xf4], 0
je 0x1000a7e2
mov eax, dword [ebp - 0x1020]
mov dword [ebp - 0x12c0], eax
mov eax, dword [ebp - 0x48c]
cmp dword [ebp - 0x3fc], eax
je 0x1000a681
mov dword [ebp - 0x5c0], 1
jmp 0x1000a688
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0xdc0]
cmp dword [ebp - 0x5c0], eax
je 0x1000a6a6
mov dword [ebp - 0xb84], 1
jmp 0x1000a6ad
and dword [ebp - 0xb84], 0
cmp dword [ebp - 0xb84], 1
jne 0x1000a6c2
mov dword [ebp - 0x5c8], 1
jmp 0x1000a6c9
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x1100]
cmp eax, dword [ebp - 0x150]
jge 0x1000a702
cmp dword [ebp - 0xb8c], 0
jne 0x1000a702
and dword [ebp - 0x5d0], 0
jmp 0x1000a70c
mov dword [ebp - 0x5d0], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdc0]
cmp eax, dword [ebp - 0x5d0]
jge 0x1000a72d
mov dword [ebp - 0xb94], 1
jmp 0x1000a734
and dword [ebp - 0xb94], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1100]
cmp dword [ebp - 0xb94], eax
jle 0x1000a755
mov dword [ebp - 0x1028], 1
jmp 0x1000a75c
and dword [ebp - 0x1028], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x12c8], eax
mov eax, 0xacafb12b
test eax, eax
je 0x1000a78e
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0xdc0], 0
je 0x1000a78e
xor eax, eax
je 0x1000a78e
mov dword [ebp - 0x5d8], 1
jmp 0x1000a795
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d8]
neg eax
cmp eax, dword [ebp - 0x48c]
jl 0x1000a7b1
mov dword [ebp - 0xb9c], 1
jmp 0x1000a7b8
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
je 0x1000a7e2
cmp dword [ebp - 0x28c], 0
je 0x1000a7e2
mov dword [ebp - 0x5e0], 1
jmp 0x1000a7e9
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x5e0]
jle 0x1000a803
mov dword [ebp - 0xba4], 1
jmp 0x1000a80a
and dword [ebp - 0xba4], 0
mov eax, dword [ebp - 0x28c]
cmp dword [ebp - 0xba4], eax
jg 0x1000a824
mov dword [ebp - 0x5e8], 1
jmp 0x1000a82b
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0x22c], eax
jmp 0x1000a3fd
xor eax, eax
inc eax
je 0x1000a85b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdc0], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x54], eax
je 0x1000a872
mov dword [ebp - 0x5f0], 1
jmp 0x1000a879
and dword [ebp - 0x5f0], 0
cmp dword [ebp - 0x5f0], 0x14f04b5a
jle 0x1000a891
mov dword [ebp - 0x5f8], 1
jmp 0x1000a898
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0xbb4]
cmp dword [ebp - 0x5f8], eax
jle 0x1000a8b2
mov dword [ebp - 0xbbc], 1
jmp 0x1000a8b9
and dword [ebp - 0xbbc], 0
mov dword [ebp - 0x22c], 1
mov eax, dword [ebp - 0xbbc]
add eax, 0x64400d43
cmp dword [ebp - 0x22c], eax
jne 0x1000a8e2
mov dword [ebp - 0x600], 1
jmp 0x1000a8e9
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x3fc]
cmp dword [ebp - 0x600], eax
jle 0x1000a913
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdc0], 0
je 0x1000a913
mov dword [ebp - 0xbc4], 1
jmp 0x1000a91a
and dword [ebp - 0xbc4], 0
mov eax, dword [ebp - 0xbc4]
add eax, 0x9f13
test eax, eax
jg 0x1000a935
mov dword [ebp - 0x608], 1
jmp 0x1000a93c
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0xbcc], eax
cmp dword [ebp - 0xbcc], 0
ja 0x1000a95d
mov dword [ebp - 0x610], 1
jmp 0x1000a964
and dword [ebp - 0x610], 0
cmp dword [ebp - 0x610], 0xfffffff8
jb 0x1000a979
mov dword [ebp - 0xbd4], 1
jmp 0x1000a980
and dword [ebp - 0xbd4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc0]
cmp dword [ebp - 0xbd4], eax
je 0x1000a9a1
mov dword [ebp - 0x618], 1
jmp 0x1000a9a8
and dword [ebp - 0x618], 0
cmp dword [ebp - 0x618], 0x2beb
jl 0x1000a9cc
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xdc0], 0
jne 0x1000a9cc
and dword [ebp - 0xbdc], 0
jmp 0x1000a9d6
mov dword [ebp - 0xbdc], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbdc]
mov dword [ebp + eax - 0x1344], ecx
jmp 0x1000a376
mov dword [ebp - 0x158], 8
mov dword [ebp - 0x348], 0xfffffffc
mov dword [ebp - 0x2a4], 0xfffffff7
mov dword [ebp - 0x4dc], 0xc6f0d4a7
mov dword [ebp - 0x4d8], 0xc6f0d4a7
mov dword [ebp - 0x4d4], 0xc6f0d4a7
mov dword [ebp - 0x4d0], 0xc6f0d4a7
mov dword [ebp - 0x294], 0
jmp 0x1000aa4d
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 1
jge 0x1000aa66
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0x24], 0x1928c176
jmp 0x1000aa40
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x24], 0
jmp 0x1000aa8b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x24], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0x16
je 0x1000b175
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x1030], 0xfffffffa
mov dword [ebp - 0x690], 0xfffffff9
mov dword [ebp - 0xc3c], 0
mov dword [ebp - 0x3ac], 0
jmp 0x1000aada
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 1
jge 0x1000aaf6
mov eax, dword [ebp - 0x3ac]
mov dword [ebp + eax*4 - 0xbfc], 0xffffffff
jmp 0x1000aacd
mov dword [ebp - 0x158], 2
mov dword [ebp - 0x158], 0xfffffff0
jmp 0x1000ab19
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 9
jl 0x1000b170
mov dword [ebp - 0x29c], 0
jmp 0x1000ab3f
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 2
jge 0x1000ab5b
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0x268], 0xffff
jmp 0x1000ab32
mov byte [ebp - 0x1ab], 0
movzx eax, byte [ebp - 0x1ab]
test eax, eax
je 0x1000ab7a
push 0xf57
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [ebp - 0x158], 0
jne 0x1000add7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbfc], 1
jne 0x1000aba3
mov dword [ebp - 0x620], 1
jmp 0x1000abaa
and dword [ebp - 0x620], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x620]
sub ecx, dword [ebp + eax - 0x268]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x24]
jl 0x1000abd5
mov dword [ebp - 0xbe4], 1
jmp 0x1000abdc
and dword [ebp - 0xbe4], 0
cmp dword [ebp - 0xbe4], 0x68dacb31
jge 0x1000abf4
mov dword [ebp - 0x628], 1
jmp 0x1000abfb
and dword [ebp - 0x628], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
cmp dword [ebp - 0x628], eax
jle 0x1000ac1c
mov dword [ebp - 0xbec], 1
jmp 0x1000ac23
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0xbec]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x348], eax
je 0x1000ac49
mov dword [ebp - 0x630], 1
jmp 0x1000ac50
and dword [ebp - 0x630], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x630]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x39c0
jne 0x1000ac84
mov dword [ebp - 0xbf4], 1
jmp 0x1000ac8b
and dword [ebp - 0xbf4], 0
cmp dword [ebp - 0xbf4], 0xdf11
je 0x1000aca3
mov dword [ebp - 0x638], 1
jmp 0x1000acaa
and dword [ebp - 0x638], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp dword [ebp - 0x638], eax
je 0x1000acc8
mov dword [ebp - 0x640], 1
jmp 0x1000accf
and dword [ebp - 0x640], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbfc]
imul eax, dword [ebp - 0x640]
cmp eax, dword [ebp - 0x1030]
jle 0x1000acf7
mov dword [ebp - 0xc04], 1
jmp 0x1000acfe
and dword [ebp - 0xc04], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
add eax, dword [ebp - 0xc04]
mov dword [ebp - 0x648], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x648]
mov dword [ebp + eax - 0x4dc], ecx
cmp dword [ebp - 0x648], 0xd579deb4
jne 0x1000ad3f
mov dword [ebp - 0xc0c], 1
jmp 0x1000ad46
and dword [ebp - 0xc0c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp dword [ebp - 0xc0c], eax
jl 0x1000ad64
mov dword [ebp - 0x650], 1
jmp 0x1000ad6b
and dword [ebp - 0x650], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x650]
sub ecx, dword [ebp + eax - 0x24]
cmp ecx, 2
jle 0x1000ad8c
mov dword [ebp - 0xc14], 1
jmp 0x1000ad93
and dword [ebp - 0xc14], 0
cmp dword [ebp - 0xc14], 0xeb7bfbc3
je 0x1000adbb
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x4dc], 0
je 0x1000adbb
mov dword [ebp - 0x658], 1
jmp 0x1000adc2
and dword [ebp - 0x658], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
cmp dword [ebp - 0x658], eax
je 0x1000adea
push 9
pop eax
test eax, eax
je 0x1000adea
mov dword [ebp - 0xc1c], 1
jmp 0x1000adf1
and dword [ebp - 0xc1c], 0
mov eax, dword [ebp - 0xc1c]
sub eax, 3
je 0x1000b04c
mov eax, 0xc7b249e3
test eax, eax
je 0x1000b04c
mov dword [ebp - 0x340], 0
jmp 0x1000ae26
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 1
jge 0x1000ae42
mov eax, dword [ebp - 0x340]
mov dword [ebp + eax*4 - 0x668], 0
jmp 0x1000ae19
mov dword [ebp - 0x64], 3
jmp 0x1000ae52
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x1000b047
mov dword [ebp - 0x1048], 0x22c2
mov eax, 0x5e2e4bcb
test eax, eax
je 0x1000ae8b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x268], 0
je 0x1000ae8b
mov dword [ebp - 0x660], 1
jmp 0x1000ae92
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x4dc]
cmp dword [ebp - 0x660], eax
jg 0x1000aeb0
mov dword [ebp - 0xc24], 1
jmp 0x1000aeb7
and dword [ebp - 0xc24], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc24]
sub ecx, dword [ebp + eax - 0x4dc]
cmp ecx, 0xb0debf6
jg 0x1000aee0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4dc], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x268]
cmp dword [ebp + eax - 0x668], ecx
jl 0x1000af08
mov dword [ebp - 0x1038], 1
jmp 0x1000af0f
and dword [ebp - 0x1038], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x668]
mov dword [ebp - 0x12d0], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x4dc]
mov dword [ebp - 0x12d8], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x4dc]
mov dword [ebp - 0x2a4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4dc]
cmp dword [ebp - 0x2a4], eax
je 0x1000af63
mov dword [ebp - 0xc2c], 1
jmp 0x1000af6a
and dword [ebp - 0xc2c], 0
cmp dword [ebp - 0xc2c], 0xcf63
jg 0x1000af82
mov dword [ebp - 0x670], 1
jmp 0x1000af89
and dword [ebp - 0x670], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x268]
cmp dword [ebp - 0x670], eax
jne 0x1000afaa
mov dword [ebp - 0x1040], 1
jmp 0x1000afb1
and dword [ebp - 0x1040], 0
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x4dc]
mov dword [ebp - 0x12e0], eax
cmp dword [ebp - 0x1048], 0
je 0x1000afe6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x268], 0
je 0x1000afe6
mov dword [ebp - 0xc34], 1
jmp 0x1000afed
and dword [ebp - 0xc34], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x268]
cmp dword [ebp - 0xc34], eax
jg 0x1000b00e
mov dword [ebp - 0x678], 1
jmp 0x1000b015
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1000b042
push 1
push 0x136f
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x1000ae4b
jmp 0x1000b16b
mov dword [ebp - 0x1050], 0
mov eax, dword [ebp - 0xc3c]
mov dword [ebp - 0x12e8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 8
jae 0x1000b0f5
cmp dword [ebp - 0xc3c], 0xac5da298
je 0x1000b096
mov dword [ebp - 0x680], 1
jmp 0x1000b09d
and dword [ebp - 0x680], 0
cmp dword [ebp - 0x680], 0xf019d465
je 0x1000b0b5
mov dword [ebp - 0xc44], 1
jmp 0x1000b0bc
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0x1050]
cmp dword [ebp - 0xc44], eax
je 0x1000b0d6
mov dword [ebp - 0x688], 1
jmp 0x1000b0dd
and dword [ebp - 0x688], 0
cmp dword [ebp - 0x688], 0x7411
je 0x1000b0f5
mov dword [ebp - 0xc4c], 1
jmp 0x1000b0fc
and dword [ebp - 0xc4c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
imul eax, dword [ebp - 0xc4c]
xor ecx, ecx
inc ecx
sub ecx, eax
je 0x1000b130
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x268], 0
je 0x1000b130
mov dword [ebp - 0xc54], 1
jmp 0x1000b137
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0x690]
cmp dword [ebp - 0xc54], eax
jl 0x1000b151
mov dword [ebp - 0x698], 1
jmp 0x1000b158
and dword [ebp - 0x698], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x698]
mov dword [ebp + eax - 0x4dc], ecx
jmp 0x1000ab0c
jmp 0x1000aa76
mov byte [ebp - 0x19d], 0
movzx eax, byte [ebp - 0x19d]
test eax, eax
je 0x1000b18f
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0xfc], 0x17ca4e86
mov dword [ebp - 0x244], 0xffffffff
mov dword [ebp - 0x110], 0xcb7be74f
mov dword [ebp - 0x6b8], 1
mov dword [ebp - 0x10], 0
jmp 0x1000b1c7
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1000b1dd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x128], 0x5b57
jmp 0x1000b1c0
mov dword [ebp - 0x10], 0
jmp 0x1000b1ed
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1000b200
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc], 7
jmp 0x1000b1e6
mov dword [ebp - 0x10], 0
jmp 0x1000b210
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1000b226
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1560], 0
jmp 0x1000b209
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc], 0
jmp 0x1000b24b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc], 1
jg 0x1000b867
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x434], 0xfffffff8
mov dword [ebp - 0x3c], 0
jmp 0x1000b27d
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x1000b2c4
mov dword [ebp - 0x204], 0x2b29949d
mov dword [ebp - 0x204], 0
jmp 0x1000b2a6
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
jge 0x1000b2c2
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x128], 0xffffffff
jmp 0x1000b299
jmp 0x1000b276
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0x12f0], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x128]
cmp dword [ebp + eax - 0xc], ecx
jl 0x1000b300
mov dword [ebp - 0xc5c], 1
jmp 0x1000b307
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0xc5c]
mov dword [ebp - 0x244], eax
imul eax, dword [ebp - 0x244], 0x6d54
cmp eax, 0xb474
je 0x1000b330
mov dword [ebp - 0x6a0], 1
jmp 0x1000b337
and dword [ebp - 0x6a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
mov eax, dword [ebp + eax*4 - 0x128]
imul eax, dword [ebp - 0x6a0]
imul eax, eax, 0x6fdd
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc]
jle 0x1000b36d
mov dword [ebp - 0xc64], 1
jmp 0x1000b374
and dword [ebp - 0xc64], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
cmp dword [ebp - 0xc64], eax
jg 0x1000b395
mov dword [ebp - 0x6a8], 1
jmp 0x1000b39c
and dword [ebp - 0x6a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
cmp dword [ebp - 0x6a8], eax
jg 0x1000b3ba
mov dword [ebp - 0xc6c], 1
jmp 0x1000b3c1
and dword [ebp - 0xc6c], 0
mov eax, dword [ebp - 0xc6c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
inc eax
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xc]
cmp eax, dword [ebp + ecx*4 - 0x128]
jle 0x1000b3fa
mov dword [ebp - 0x6b0], 1
jmp 0x1000b401
and dword [ebp - 0x6b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
mov eax, dword [ebp + eax*4 - 0x128]
cmp eax, dword [ebp - 0x6b0]
jne 0x1000b430
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc], 0
jne 0x1000b430
and dword [ebp - 0xc74], 0
jmp 0x1000b43a
mov dword [ebp - 0xc74], 1
mov dword [ebp - 0xfc], 0x8f4f
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x6b8]
cmp dword [ebp - 0xfc], eax
jne 0x1000b46a
mov dword [ebp - 0xc7c], 1
jmp 0x1000b471
and dword [ebp - 0xc7c], 0
mov eax, dword [ebp - 0xc7c]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc]
jg 0x1000b491
mov dword [ebp - 0x6c0], 1
jmp 0x1000b498
and dword [ebp - 0x6c0], 0
cmp dword [ebp - 0x6c0], 0x4c259dba
jl 0x1000b4b0
mov dword [ebp - 0x1058], 1
jmp 0x1000b4b7
and dword [ebp - 0x1058], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
mov dword [ebp - 0x12f8], eax
push 9
pop eax
cmp eax, 0x7e29ac92
jge 0x1000b4dd
mov dword [ebp - 0x1060], 1
jmp 0x1000b4e4
and dword [ebp - 0x1060], 0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x1300], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x128]
cmp dword [ebp + eax - 0x1560], ecx
jl 0x1000b518
mov dword [ebp - 0xc84], 1
jmp 0x1000b51f
and dword [ebp - 0xc84], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
mov eax, dword [ebp + eax*4 - 0x128]
cmp dword [ebp - 0xc84], eax
je 0x1000b544
mov dword [ebp - 0x6c8], 1
jmp 0x1000b54b
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x1000b6f7
mov eax, 0x8d88
test eax, eax
je 0x1000b6f7
mov dword [ebp - 0x1068], 0xffffffff
mov dword [ebp - 0x2ac], 0
jmp 0x1000b594
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 2
jge 0x1000b5b0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0xe30], 2
jmp 0x1000b587
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x128]
cmp eax, 0x3212
je 0x1000b5da
mov dword [ebp - 0xc8c], 1
jmp 0x1000b5e1
and dword [ebp - 0xc8c], 0
cmp dword [ebp - 0xc8c], 0x251f81f1
jle 0x1000b5f9
mov dword [ebp - 0x6d0], 1
jmp 0x1000b600
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x6d0], eax
jge 0x1000b617
mov dword [ebp - 0xc94], 1
jmp 0x1000b61e
and dword [ebp - 0xc94], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
mov eax, dword [ebp + eax*4 - 0x128]
cmp eax, dword [ebp - 0xc94]
jle 0x1000b653
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe30], 0
je 0x1000b653
mov dword [ebp - 0x6d8], 1
jmp 0x1000b65a
and dword [ebp - 0x6d8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6d8]
sub ecx, dword [ebp + eax - 0xe30]
cmp dword [ebp - 0x434], ecx
jg 0x1000b681
mov dword [ebp - 0xc9c], 1
jmp 0x1000b688
and dword [ebp - 0xc9c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe30]
cmp dword [ebp - 0xc9c], eax
jg 0x1000b6a9
mov dword [ebp - 0x6e0], 1
jmp 0x1000b6b0
and dword [ebp - 0x6e0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe30]
cmp dword [ebp - 0x6e0], eax
jl 0x1000b6d1
mov dword [ebp - 0xca4], 1
jmp 0x1000b6d8
and dword [ebp - 0xca4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
imul eax, dword [ebp - 0xca4]
mov dword [ebp - 0x1068], eax
jmp 0x1000b862
mov dword [ebp - 0x1308], 0x42427020
mov dword [ebp - 0x350], 0
jmp 0x1000b71a
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 4
jge 0x1000b736
mov eax, dword [ebp - 0x350]
mov dword [ebp + eax*4 - 0x1640], 0
jmp 0x1000b70d
mov dword [ebp - 0xfc], 0
jmp 0x1000b74f
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jg 0x1000b862
mov dword [ebp - 0x6e8], 0xd3184ba
mov dword [ebp - 0x1078], 0x1fe44aad
mov dword [ebp - 0x3c], 0
jmp 0x1000b780
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x1000b795
mov eax, dword [ebp - 0x6e8]
inc eax
mov dword [ebp - 0x6e8], eax
jmp 0x1000b779
mov dword [ebp - 0x110], 0
jmp 0x1000b7ae
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 1
jg 0x1000b85d
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0x1310], eax
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0x128]
mov ecx, dword [ebp - 0x110]
sub eax, dword [ebp + ecx*4 - 0x128]
jne 0x1000b836
mov eax, dword [ebp - 0xfc]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xc]
cmp dword [ebp + eax*4 - 0x128], ecx
jge 0x1000b80f
mov dword [ebp - 0x1070], 1
jmp 0x1000b816
and dword [ebp - 0x1070], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
cmp dword [ebp + eax*4 - 0x128], 0xfff7
je 0x1000b836
and dword [ebp - 0xcac], 0
jmp 0x1000b840
mov dword [ebp - 0xcac], 1
mov eax, dword [ebp - 0xcac]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x1078], eax
jmp 0x1000b7a1
jmp 0x1000b742
jmp 0x1000b236
mov dword [ebp - 0x160], 0x3ae35568
mov dword [ebp - 0x2bc], 0x7ab61b58
mov dword [ebp - 0x480], 1
mov dword [ebp - 0x234], 3
mov dword [ebp - 0xfb4], 0xd0ae446f
mov dword [ebp - 0x758], 0xa87
mov dword [ebp - 0xc4], 0
jmp 0x1000b8bc
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 4
jge 0x1000b8d8
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x10e0], 0xfffffffc
jmp 0x1000b8af
mov dword [ebp - 0xc4], 0
jmp 0x1000b8f1
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x1000b90d
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x1350], 0x25f1a37c
jmp 0x1000b8e4
mov dword [ebp - 0x160], 0x1a
jmp 0x1000b926
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffef
jle 0x1000bf91
mov dword [ebp - 0x4c], 0x1738ab65
mov dword [ebp - 0x120], 0xe7631615
mov dword [ebp - 0x1080], 4
mov dword [ebp - 0x214], 0x2e71cc54
mov dword [ebp - 0x740], 5
mov dword [ebp - 0x2b4], 0
jmp 0x1000b97b
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 3
jge 0x1000b997
mov eax, dword [ebp - 0x2b4]
mov dword [ebp + eax*4 - 0xdd0], 0x3eb905d0
jmp 0x1000b96e
mov dword [ebp - 0x4c], 2
jmp 0x1000b9a7
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1000bdeb
mov dword [ebp - 0x718], 0xfffffffa
mov dword [ebp - 0x20c], 0xfffffff7
mov dword [ebp - 0x43c], 0xfffffffe
mov eax, dword [ebp - 0x480]
inc eax
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
sub eax, dword [ebp - 0x718]
mov dword [ebp - 0x6f0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6f0]
mov dword [ebp + eax - 0x10e0], ecx
cmp dword [ebp - 0x6f0], 5
jg 0x1000ba2e
mov dword [ebp - 0xcb4], 1
jmp 0x1000ba35
and dword [ebp - 0xcb4], 0
mov eax, dword [ebp - 0x1080]
cmp dword [ebp - 0xcb4], eax
je 0x1000ba4f
mov dword [ebp - 0x10c8], 1
jmp 0x1000ba56
and dword [ebp - 0x10c8], 0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x1318], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x10e0], 0
jae 0x1000ba86
mov eax, 0x1a53fde7
test eax, eax
je 0x1000ba86
mov dword [ebp - 0x6f8], 1
jmp 0x1000ba8d
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x234], eax
jge 0x1000bab3
mov dword [ebp - 0x10d0], 1
jmp 0x1000baba
and dword [ebp - 0x10d0], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x1320], eax
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x214]
test eax, eax
jne 0x1000bae6
cmp dword [ebp - 0x43c], 0
jne 0x1000bae6
and dword [ebp - 0xcbc], 0
jmp 0x1000baf0
mov dword [ebp - 0xcbc], 1
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0xcbc]
jg 0x1000bb17
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x10e0], 0
je 0x1000bb17
mov dword [ebp - 0x700], 1
jmp 0x1000bb1e
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0xdd0]
cmp eax, dword [ebp - 0x700]
jne 0x1000bb3c
mov dword [ebp - 0xcc4], 1
jmp 0x1000bb43
and dword [ebp - 0xcc4], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0xcc4], eax
je 0x1000bb92
mov dword [ebp - 0x120], 3
jmp 0x1000bb6a
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x1000bb8d
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x1000bb8b
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x1000bb5d
jmp 0x1000bde6
mov dword [ebp - 0x358], 1
mov dword [ebp - 0x738], 0x68b63c96
push 4
pop eax
imul eax, eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x10e0]
sub ecx, dword [ebp - 0x358]
imul ecx, dword [ebp - 0x358]
cmp ecx, 8
jl 0x1000bbd4
mov dword [ebp - 0x708], 1
jmp 0x1000bbdb
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x740], eax
mov dword [ebp - 0x120], 0x2d9b
cmp dword [ebp - 0x120], 0
je 0x1000bd85
mov eax, dword [ebp - 0xfb4]
mov dword [ebp - 0x13d4], eax
mov eax, dword [ebp - 0x43c]
cmp dword [ebp - 0x2bc], eax
je 0x1000bc24
mov dword [ebp - 0xccc], 1
jmp 0x1000bc2b
and dword [ebp - 0xccc], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0xdd0]
cmp dword [ebp - 0xccc], eax
je 0x1000bc49
mov dword [ebp - 0x710], 1
jmp 0x1000bc50
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 1
jne 0x1000bc65
mov dword [ebp - 0xcd4], 1
jmp 0x1000bc6c
and dword [ebp - 0xcd4], 0
mov eax, dword [ebp - 0xcd4]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x10e0]
cmp eax, dword [ebp - 0x160]
jge 0x1000bca5
cmp dword [ebp - 0x718], 0
jne 0x1000bca5
and dword [ebp - 0xcdc], 0
jmp 0x1000bcaf
mov dword [ebp - 0xcdc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdd0]
cmp eax, dword [ebp - 0xcdc]
jge 0x1000bcd0
mov dword [ebp - 0x720], 1
jmp 0x1000bcd7
and dword [ebp - 0x720], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10e0]
cmp dword [ebp - 0x720], eax
jle 0x1000bcf8
mov dword [ebp - 0xf10], 1
jmp 0x1000bcff
and dword [ebp - 0xf10], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x13dc], eax
mov eax, 0xacafb12b
test eax, eax
je 0x1000bd31
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0xdd0], 0
je 0x1000bd31
xor eax, eax
je 0x1000bd31
mov dword [ebp - 0xce4], 1
jmp 0x1000bd38
and dword [ebp - 0xce4], 0
mov eax, dword [ebp - 0xce4]
neg eax
cmp eax, dword [ebp - 0x43c]
jl 0x1000bd54
mov dword [ebp - 0x728], 1
jmp 0x1000bd5b
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x1000bd85
cmp dword [ebp - 0x358], 0
je 0x1000bd85
mov dword [ebp - 0xcec], 1
jmp 0x1000bd8c
and dword [ebp - 0xcec], 0
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0xcec]
jle 0x1000bda6
mov dword [ebp - 0x730], 1
jmp 0x1000bdad
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x358]
cmp dword [ebp - 0x730], eax
jg 0x1000bdc7
mov dword [ebp - 0xcf4], 1
jmp 0x1000bdce
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xcf4]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x214], eax
jmp 0x1000b9a0
xor eax, eax
inc eax
je 0x1000bdfe
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdd0], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0x4c], eax
je 0x1000be15
mov dword [ebp - 0xcfc], 1
jmp 0x1000be1c
and dword [ebp - 0xcfc], 0
cmp dword [ebp - 0xcfc], 0x14f04b5a
jle 0x1000be34
mov dword [ebp - 0xd04], 1
jmp 0x1000be3b
and dword [ebp - 0xd04], 0
mov eax, dword [ebp - 0x740]
cmp dword [ebp - 0xd04], eax
jle 0x1000be55
mov dword [ebp - 0x748], 1
jmp 0x1000be5c
and dword [ebp - 0x748], 0
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x748]
add eax, 0x64400d43
cmp dword [ebp - 0x214], eax
jne 0x1000be85
mov dword [ebp - 0xd0c], 1
jmp 0x1000be8c
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0x2bc]
cmp dword [ebp - 0xd0c], eax
jle 0x1000beb6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdd0], 0
je 0x1000beb6
mov dword [ebp - 0xd14], 1
jmp 0x1000bebd
and dword [ebp - 0xd14], 0
mov eax, dword [ebp - 0xd14]
add eax, 0x9f13
test eax, eax
jg 0x1000bed8
mov dword [ebp - 0xaa8], 1
jmp 0x1000bedf
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x758], 0
ja 0x1000bf00
mov dword [ebp - 0xd28], 1
jmp 0x1000bf07
and dword [ebp - 0xd28], 0
cmp dword [ebp - 0xd28], 0xfffffff8
jb 0x1000bf1c
mov dword [ebp - 0x760], 1
jmp 0x1000bf23
and dword [ebp - 0x760], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdd0]
cmp dword [ebp - 0x760], eax
je 0x1000bf44
mov dword [ebp - 0xab0], 1
jmp 0x1000bf4b
and dword [ebp - 0xab0], 0
cmp dword [ebp - 0xab0], 0x2beb
jl 0x1000bf6f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xdd0], 0
jne 0x1000bf6f
and dword [ebp - 0x768], 0
jmp 0x1000bf79
mov dword [ebp - 0x768], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x768]
mov dword [ebp + eax - 0x1350], ecx
jmp 0x1000b919
mov dword [ebp - 0x50], 0xe387fb0b
mov dword [ebp - 0x770], 0x228d5fea
mov dword [ebp - 0xac0], 1
mov dword [ebp - 0x107c], 0xd08f4923
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x50], 0
jmp 0x1000bfcc
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x12
je 0x1000c1b1
mov dword [ebp - 0x11ec], 0x2ae8
mov dword [ebp - 0x11e8], 0x2ae8
mov dword [ebp - 0x11e4], 0x2ae8
mov dword [ebp - 0x11e0], 0x2ae8
mov dword [ebp - 0x360], 0
jmp 0x1000c017
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 3
jge 0x1000c033
mov eax, dword [ebp - 0x360]
mov dword [ebp + eax*4 - 0xdf8], 0
jmp 0x1000c00a
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xdf8]
cmp dword [ebp + eax - 0xdf8], ecx
jl 0x1000c05b
mov dword [ebp - 0xe8c], 1
jmp 0x1000c062
and dword [ebp - 0xe8c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdf8], 0x6974
jge 0x1000c081
mov dword [ebp - 0xfdc], 1
jmp 0x1000c088
and dword [ebp - 0xfdc], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x13e4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdf8]
mov dword [ebp - 0x13ec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdf8]
cmp dword [ebp - 0x50], eax
jge 0x1000c0c2
mov dword [ebp - 0xc58], 1
jmp 0x1000c0c9
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0xc58]
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 1
jne 0x1000c0ea
mov dword [ebp - 0xab8], 1
jmp 0x1000c0f1
and dword [ebp - 0xab8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdf8]
imul eax, dword [ebp - 0xab8]
cmp eax, 0xb56411d7
jne 0x1000c118
mov dword [ebp - 0x778], 1
jmp 0x1000c11f
and dword [ebp - 0x778], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x11ec], 0xfffffffb
jl 0x1000c13b
mov dword [ebp - 0xe94], 1
jmp 0x1000c142
and dword [ebp - 0xe94], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdf8]
mov dword [ebp - 0x13f4], eax
cmp dword [ebp - 0x50], 0xee05243b
jne 0x1000c16a
mov dword [ebp - 0xdec], 1
jmp 0x1000c171
and dword [ebp - 0xdec], 0
cmp dword [ebp - 0xdec], 0x83eb
jne 0x1000c189
mov dword [ebp - 0x780], 1
jmp 0x1000c190
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0xac0]
imul eax, dword [ebp - 0x50]
mov dword [ebp - 0x107c], eax
jmp 0x1000bfc5
mov dword [ebp - 0x168], 8
mov dword [ebp - 0x378], 0xfffffffc
mov dword [ebp - 0x2d4], 0xfffffff7
mov dword [ebp - 0x4f4], 0xc6f0d4a7
mov dword [ebp - 0x4f0], 0xc6f0d4a7
mov dword [ebp - 0x4ec], 0xc6f0d4a7
mov dword [ebp - 0x4e8], 0xc6f0d4a7
mov dword [ebp - 0x2c4], 0
jmp 0x1000c210
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x1000c229
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0x2c], 0x1928c176
jmp 0x1000c203
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2c], 0
jmp 0x1000c24e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0x16
je 0x1000c938
mov dword [ebp - 0x58], 0
mov dword [ebp - 0xe9c], 0xfffffffa
mov dword [ebp - 0x7f8], 0xfffffff9
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0x368], 0
jmp 0x1000c29d
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 1
jge 0x1000c2b9
mov eax, dword [ebp - 0x368]
mov dword [ebp + eax*4 - 0xad0], 0xffffffff
jmp 0x1000c290
mov dword [ebp - 0x168], 2
mov dword [ebp - 0x168], 0xfffffff0
jmp 0x1000c2dc
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 9
jl 0x1000c933
mov dword [ebp - 0x2cc], 0
jmp 0x1000c302
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 2
jge 0x1000c31e
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0x270], 0xffff
jmp 0x1000c2f5
mov byte [ebp - 0x1a5], 0
movzx eax, byte [ebp - 0x1a5]
test eax, eax
je 0x1000c33d
push 0xf57
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [ebp - 0x168], 0
jne 0x1000c59a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xad0], 1
jne 0x1000c366
mov dword [ebp - 0x788], 1
jmp 0x1000c36d
and dword [ebp - 0x788], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x788]
sub ecx, dword [ebp + eax - 0x270]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x2c]
jl 0x1000c398
mov dword [ebp - 0xc60], 1
jmp 0x1000c39f
and dword [ebp - 0xc60], 0
cmp dword [ebp - 0xc60], 0x68dacb31
jge 0x1000c3b7
mov dword [ebp - 0x790], 1
jmp 0x1000c3be
and dword [ebp - 0x790], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x270]
cmp dword [ebp - 0x790], eax
jle 0x1000c3df
mov dword [ebp - 0xac8], 1
jmp 0x1000c3e6
and dword [ebp - 0xac8], 0
mov eax, dword [ebp - 0xac8]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x378], eax
je 0x1000c40c
mov dword [ebp - 0x798], 1
jmp 0x1000c413
and dword [ebp - 0x798], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x798]
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x39c0
jne 0x1000c447
mov dword [ebp - 0xd30], 1
jmp 0x1000c44e
and dword [ebp - 0xd30], 0
cmp dword [ebp - 0xd30], 0xdf11
je 0x1000c466
mov dword [ebp - 0x7a0], 1
jmp 0x1000c46d
and dword [ebp - 0x7a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x7a0], eax
je 0x1000c48b
mov dword [ebp - 0x7a8], 1
jmp 0x1000c492
and dword [ebp - 0x7a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xad0]
imul eax, dword [ebp - 0x7a8]
cmp eax, dword [ebp - 0xe9c]
jle 0x1000c4ba
mov dword [ebp - 0xc68], 1
jmp 0x1000c4c1
and dword [ebp - 0xc68], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
add eax, dword [ebp - 0xc68]
mov dword [ebp - 0x7b0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7b0]
mov dword [ebp + eax - 0x4f4], ecx
cmp dword [ebp - 0x7b0], 0xd579deb4
jne 0x1000c502
mov dword [ebp - 0xad8], 1
jmp 0x1000c509
and dword [ebp - 0xad8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0xad8], eax
jl 0x1000c527
mov dword [ebp - 0x7b8], 1
jmp 0x1000c52e
and dword [ebp - 0x7b8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7b8]
sub ecx, dword [ebp + eax - 0x2c]
cmp ecx, 2
jle 0x1000c54f
mov dword [ebp - 0xda4], 1
jmp 0x1000c556
and dword [ebp - 0xda4], 0
cmp dword [ebp - 0xda4], 0xeb7bfbc3
je 0x1000c57e
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x4f4], 0
je 0x1000c57e
mov dword [ebp - 0x7c0], 1
jmp 0x1000c585
and dword [ebp - 0x7c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x270]
cmp dword [ebp - 0x7c0], eax
je 0x1000c5ad
push 9
pop eax
test eax, eax
je 0x1000c5ad
mov dword [ebp - 0xae0], 1
jmp 0x1000c5b4
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0xae0]
sub eax, 3
je 0x1000c80f
mov eax, 0xc7b249e3
test eax, eax
je 0x1000c80f
mov dword [ebp - 0x370], 0
jmp 0x1000c5e9
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 1
jge 0x1000c605
mov eax, dword [ebp - 0x370]
mov dword [ebp + eax*4 - 0x7d0], 0
jmp 0x1000c5dc
mov dword [ebp - 0x58], 3
jmp 0x1000c615
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x1000c80a
mov dword [ebp - 0x104c], 0x22c2
mov eax, 0x5e2e4bcb
test eax, eax
je 0x1000c64e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x270], 0
je 0x1000c64e
mov dword [ebp - 0x7c8], 1
jmp 0x1000c655
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x4f4]
cmp dword [ebp - 0x7c8], eax
jg 0x1000c673
mov dword [ebp - 0xc70], 1
jmp 0x1000c67a
and dword [ebp - 0xc70], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc70]
sub ecx, dword [ebp + eax - 0x4f4]
cmp ecx, 0xb0debf6
jg 0x1000c6a3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4f4], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x270]
cmp dword [ebp + eax - 0x7d0], ecx
jl 0x1000c6cb
mov dword [ebp - 0xfe4], 1
jmp 0x1000c6d2
and dword [ebp - 0xfe4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7d0]
mov dword [ebp - 0x13fc], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x4f4]
mov dword [ebp - 0x1404], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x4f4]
mov dword [ebp - 0x2d4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f4]
cmp dword [ebp - 0x2d4], eax
je 0x1000c726
mov dword [ebp - 0xae8], 1
jmp 0x1000c72d
and dword [ebp - 0xae8], 0
cmp dword [ebp - 0xae8], 0xcf63
jg 0x1000c745
mov dword [ebp - 0x7d8], 1
jmp 0x1000c74c
and dword [ebp - 0x7d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x270]
cmp dword [ebp - 0x7d8], eax
jne 0x1000c76d
mov dword [ebp - 0xea4], 1
jmp 0x1000c774
and dword [ebp - 0xea4], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x4f4]
mov dword [ebp - 0x140c], eax
cmp dword [ebp - 0x104c], 0
je 0x1000c7a9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x270], 0
je 0x1000c7a9
mov dword [ebp - 0xd38], 1
jmp 0x1000c7b0
and dword [ebp - 0xd38], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x270]
cmp dword [ebp - 0xd38], eax
jg 0x1000c7d1
mov dword [ebp - 0x7e0], 1
jmp 0x1000c7d8
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0x7f8], eax
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1000c805
push 1
push 0x136f
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x1000c60e
jmp 0x1000c92e
mov dword [ebp - 0xeac], 0
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0x1414], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x270]
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 8
jae 0x1000c8b8
cmp dword [ebp - 0xaf0], 0xac5da298
je 0x1000c859
mov dword [ebp - 0x7e8], 1
jmp 0x1000c860
and dword [ebp - 0x7e8], 0
cmp dword [ebp - 0x7e8], 0xf019d465
je 0x1000c878
mov dword [ebp - 0xc78], 1
jmp 0x1000c87f
and dword [ebp - 0xc78], 0
mov eax, dword [ebp - 0xeac]
cmp dword [ebp - 0xc78], eax
je 0x1000c899
mov dword [ebp - 0x7f0], 1
jmp 0x1000c8a0
and dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 0x7411
je 0x1000c8b8
mov dword [ebp - 0xaf8], 1
jmp 0x1000c8bf
and dword [ebp - 0xaf8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
imul eax, dword [ebp - 0xaf8]
xor ecx, ecx
inc ecx
sub ecx, eax
je 0x1000c8f3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x270], 0
je 0x1000c8f3
mov dword [ebp - 0xde0], 1
jmp 0x1000c8fa
and dword [ebp - 0xde0], 0
mov eax, dword [ebp - 0x7f8]
cmp dword [ebp - 0xde0], eax
jl 0x1000c914
mov dword [ebp - 0x800], 1
jmp 0x1000c91b
and dword [ebp - 0x800], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x800]
mov dword [ebp + eax - 0x4f4], ecx
jmp 0x1000c2cf
jmp 0x1000c239
mov byte [ebp - 0x19f], 0
movzx eax, byte [ebp - 0x19f]
test eax, eax
je 0x1000c952
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x1d0], 0x5020f89b
mov dword [ebp - 0x2e4], 0x4309642e
mov dword [ebp - 0x818], 7
mov dword [ebp - 0x10c4], 0xcc5c6a3f
mov dword [ebp - 0x2dc], 0
jmp 0x1000c993
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 3
jge 0x1000c9af
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0x117c], 0xdc85f70a
jmp 0x1000c986
mov dword [ebp - 0x1d0], 0
jmp 0x1000c9c8
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 2
jg 0x1000cb4d
mov dword [ebp - 0xc80], 4
mov dword [ebp - 0xeb4], 0xdfadf628
mov dword [ebp - 0xb08], 0xb8b78acc
mov dword [ebp - 0x141c], 0xffffffff
mov dword [ebp - 0x1424], 0xffffffff
mov dword [ebp - 0x380], 0
jmp 0x1000ca20
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 3
jge 0x1000ca3c
mov eax, dword [ebp - 0x380]
mov dword [ebp + eax*4 - 0x1624], 1
jmp 0x1000ca13
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp + eax*4 - 0x117c], 0
jae 0x1000ca58
mov dword [ebp - 0xb00], 1
jmp 0x1000ca5f
and dword [ebp - 0xb00], 0
cmp dword [ebp - 0xb00], 0xfa2fafd1
jb 0x1000ca77
mov dword [ebp - 0x808], 1
jmp 0x1000ca7e
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0xc80], eax
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
js 0x1000caa5
mov dword [ebp - 0xfec], 1
jmp 0x1000caac
and dword [ebp - 0xfec], 0
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x142c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x117c]
mov dword [ebp - 0x1434], eax
mov eax, dword [ebp - 0xeb4]
mov dword [ebp - 0x1448], eax
mov eax, dword [ebp - 0x10c4]
mov dword [ebp - 0x1450], eax
mov eax, dword [ebp - 0xc80]
add eax, 7
cmp eax, 0xe60d
jne 0x1000caff
mov dword [ebp - 0x810], 1
jmp 0x1000cb06
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0x1458], eax
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x1460], eax
mov eax, dword [ebp - 0x2e4]
sub eax, 0x47d17017
imul eax, eax, 0xfab8
mov ecx, dword [ebp - 0x1d0]
mov dword [ebp + ecx*4 - 0x117c], eax
jmp 0x1000c9bb
mov dword [ebp - 0xe8], 0x17ca4e86
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0xdc], 0xcb7be74f
mov dword [ebp - 0x838], 1
mov dword [ebp - 0x18], 0
jmp 0x1000cb85
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1000cb9b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x108], 0x5b57
jmp 0x1000cb7e
mov dword [ebp - 0x18], 0
jmp 0x1000cbab
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1000cbbe
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 4], 7
jmp 0x1000cba4
mov dword [ebp - 0x18], 0
jmp 0x1000cbce
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1000cbe4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1548], 0
jmp 0x1000cbc7
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 4], 0
jmp 0x1000cc09
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 4], 1
jg 0x1000d225
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x4a8], 0xfffffff8
mov dword [ebp - 0x44], 0
jmp 0x1000cc3b
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x1000cc82
mov dword [ebp - 0x254], 0x2b29949d
mov dword [ebp - 0x254], 0
jmp 0x1000cc64
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 2
jge 0x1000cc80
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0x108], 0xffffffff
jmp 0x1000cc57
jmp 0x1000cc34
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp - 0x1468], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x108]
cmp dword [ebp + eax - 4], ecx
jl 0x1000ccbe
mov dword [ebp - 0xd40], 1
jmp 0x1000ccc5
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0xd40]
mov dword [ebp - 0x21c], eax
imul eax, dword [ebp - 0x21c], 0x6d54
cmp eax, 0xb474
je 0x1000ccee
mov dword [ebp - 0x820], 1
jmp 0x1000ccf5
and dword [ebp - 0x820], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
mov eax, dword [ebp + eax*4 - 0x108]
imul eax, dword [ebp - 0x820]
imul eax, eax, 0x6fdd
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 4]
jle 0x1000cd2b
mov dword [ebp - 0xb10], 1
jmp 0x1000cd32
and dword [ebp - 0xb10], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108]
cmp dword [ebp - 0xb10], eax
jg 0x1000cd53
mov dword [ebp - 0x828], 1
jmp 0x1000cd5a
and dword [ebp - 0x828], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
cmp dword [ebp - 0x828], eax
jg 0x1000cd78
mov dword [ebp - 0xc88], 1
jmp 0x1000cd7f
and dword [ebp - 0xc88], 0
mov eax, dword [ebp - 0xc88]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
inc eax
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 4]
cmp eax, dword [ebp + ecx*4 - 0x108]
jle 0x1000cdb8
mov dword [ebp - 0x830], 1
jmp 0x1000cdbf
and dword [ebp - 0x830], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
mov eax, dword [ebp + eax*4 - 0x108]
cmp eax, dword [ebp - 0x830]
jne 0x1000cdee
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 4], 0
jne 0x1000cdee
and dword [ebp - 0xb18], 0
jmp 0x1000cdf8
mov dword [ebp - 0xb18], 1
mov dword [ebp - 0xe8], 0x8f4f
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x838]
cmp dword [ebp - 0xe8], eax
jne 0x1000ce28
mov dword [ebp - 0xdb4], 1
jmp 0x1000ce2f
and dword [ebp - 0xdb4], 0
mov eax, dword [ebp - 0xdb4]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 4]
jg 0x1000ce4f
mov dword [ebp - 0x840], 1
jmp 0x1000ce56
and dword [ebp - 0x840], 0
cmp dword [ebp - 0x840], 0x4c259dba
jl 0x1000ce6e
mov dword [ebp - 0xebc], 1
jmp 0x1000ce75
and dword [ebp - 0xebc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
mov dword [ebp - 0x1470], eax
push 9
pop eax
cmp eax, 0x7e29ac92
jge 0x1000ce9b
mov dword [ebp - 0xff4], 1
jmp 0x1000cea2
and dword [ebp - 0xff4], 0
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x1478], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x108]
cmp dword [ebp + eax - 0x1548], ecx
jl 0x1000ced6
mov dword [ebp - 0xb20], 1
jmp 0x1000cedd
and dword [ebp - 0xb20], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
mov eax, dword [ebp + eax*4 - 0x108]
cmp dword [ebp - 0xb20], eax
je 0x1000cf02
mov dword [ebp - 0x848], 1
jmp 0x1000cf09
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0
je 0x1000d0b5
mov eax, 0x8d88
test eax, eax
je 0x1000d0b5
mov dword [ebp - 0xec4], 0xffffffff
mov dword [ebp - 0x388], 0
jmp 0x1000cf52
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 2
jge 0x1000cf6e
mov eax, dword [ebp - 0x388]
mov dword [ebp + eax*4 - 0xe40], 2
jmp 0x1000cf45
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x108]
cmp eax, 0x3212
je 0x1000cf98
mov dword [ebp - 0xc90], 1
jmp 0x1000cf9f
and dword [ebp - 0xc90], 0
cmp dword [ebp - 0xc90], 0x251f81f1
jle 0x1000cfb7
mov dword [ebp - 0x850], 1
jmp 0x1000cfbe
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x850], eax
jge 0x1000cfd5
mov dword [ebp - 0xb28], 1
jmp 0x1000cfdc
and dword [ebp - 0xb28], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
mov eax, dword [ebp + eax*4 - 0x108]
cmp eax, dword [ebp - 0xb28]
jle 0x1000d011
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe40], 0
je 0x1000d011
mov dword [ebp - 0x858], 1
jmp 0x1000d018
and dword [ebp - 0x858], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x858]
sub ecx, dword [ebp + eax - 0xe40]
cmp dword [ebp - 0x4a8], ecx
jg 0x1000d03f
mov dword [ebp - 0xd48], 1
jmp 0x1000d046
and dword [ebp - 0xd48], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe40]
cmp dword [ebp - 0xd48], eax
jg 0x1000d067
mov dword [ebp - 0x860], 1
jmp 0x1000d06e
and dword [ebp - 0x860], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe40]
cmp dword [ebp - 0x860], eax
jl 0x1000d08f
mov dword [ebp - 0xb30], 1
jmp 0x1000d096
and dword [ebp - 0xb30], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108]
imul eax, dword [ebp - 0xb30]
mov dword [ebp - 0xec4], eax
jmp 0x1000d220
mov dword [ebp - 0x1480], 0x42427020
mov dword [ebp - 0x2ec], 0
jmp 0x1000d0d8
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 4
jge 0x1000d0f4
mov eax, dword [ebp - 0x2ec]
mov dword [ebp + eax*4 - 0x1650], 0
jmp 0x1000d0cb
mov dword [ebp - 0xe8], 0
jmp 0x1000d10d
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jg 0x1000d220
mov dword [ebp - 0x868], 0xd3184ba
mov dword [ebp - 0xecc], 0x1fe44aad
mov dword [ebp - 0x44], 0
jmp 0x1000d13e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x1000d153
mov eax, dword [ebp - 0x868]
inc eax
mov dword [ebp - 0x868], eax
jmp 0x1000d137
mov dword [ebp - 0xdc], 0
jmp 0x1000d16c
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jg 0x1000d21b
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp - 0x1488], eax
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp + eax*4 - 0x108]
mov ecx, dword [ebp - 0xdc]
sub eax, dword [ebp + ecx*4 - 0x108]
jne 0x1000d1f4
mov eax, dword [ebp - 0xe8]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 4]
cmp dword [ebp + eax*4 - 0x108], ecx
jge 0x1000d1cd
mov dword [ebp - 0x1054], 1
jmp 0x1000d1d4
and dword [ebp - 0x1054], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
cmp dword [ebp + eax*4 - 0x108], 0xfff7
je 0x1000d1f4
and dword [ebp - 0xc98], 0
jmp 0x1000d1fe
mov dword [ebp - 0xc98], 1
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0xecc], eax
jmp 0x1000d15f
jmp 0x1000d100
jmp 0x1000cbf4
mov dword [ebp - 0xffc], 4
mov dword [ebp - 0x1490], 0xb7d8cf4c
mov dword [ebp - 0x1498], 0x959310c1
mov dword [ebp - 0xed4], 4
mov dword [ebp - 0x14a0], 6
mov dword [ebp - 0x390], 0
jmp 0x1000d270
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 2
jge 0x1000d28c
mov eax, dword [ebp - 0x390]
mov dword [ebp + eax*4 - 0x1108], 0xfffc
jmp 0x1000d263
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1108], 0
je 0x1000d3c8
mov dword [ebp - 0x2f4], 0x9d29be1d
mov dword [ebp - 0x14a8], 0xfffffff6
mov dword [ebp - 0x14b0], 0x45fe46c2
mov dword [ebp - 0x90], 0
jmp 0x1000d2d7
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x1000d2f3
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x14b8], 0x5ccb9725
jmp 0x1000d2ca
mov dword [ebp - 0x90], 0
jmp 0x1000d30c
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1000d328
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x1118], 0x64a11600
jmp 0x1000d2ff
mov dword [ebp - 0x2f4], 0x14
jmp 0x1000d341
mov eax, dword [ebp - 0x2f4]
dec eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0xfffffff7
jl 0x1000d3c6
mov dword [ebp - 0x14c0], 0xafe30f58
mov dword [ebp - 0x14c8], 0x1c97412d
mov dword [ebp - 0x398], 0
jmp 0x1000d377
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 2
jge 0x1000d393
mov eax, dword [ebp - 0x398]
mov dword [ebp + eax*4 - 0x15ac], 0x8e9646b8
jmp 0x1000d36a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1108]
mov dword [ebp - 0xffc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1118]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1118], eax
jmp 0x1000d334
jmp 0x1000d3fa
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x1000d3fa
push 0
push 0x1287
push 0xbd3
push 0
push 0x124e
push 0x141c
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xed4], 0
mov dword [ebp - 0x60], 0xe387fb0b
mov dword [ebp - 0xb38], 0x228d5fea
mov dword [ebp - 0x888], 1
mov dword [ebp - 0xee4], 0xd08f4923
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x60], 0
jmp 0x1000d43f
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x12
je 0x1000d624
mov dword [ebp - 0x120c], 0x2ae8
mov dword [ebp - 0x1208], 0x2ae8
mov dword [ebp - 0x1204], 0x2ae8
mov dword [ebp - 0x1200], 0x2ae8
mov dword [ebp - 0x2fc], 0
jmp 0x1000d48a
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 3
jge 0x1000d4a6
mov eax, dword [ebp - 0x2fc]
mov dword [ebp + eax*4 - 0xe28], 0
jmp 0x1000d47d
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xe28]
cmp dword [ebp + eax - 0xe28], ecx
jl 0x1000d4ce
mov dword [ebp - 0x1084], 1
jmp 0x1000d4d5
and dword [ebp - 0x1084], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe28], 0x6974
jge 0x1000d4f4
mov dword [ebp - 0xedc], 1
jmp 0x1000d4fb
and dword [ebp - 0xedc], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x14d0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe28]
mov dword [ebp - 0x14d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe28]
cmp dword [ebp - 0x60], eax
jge 0x1000d535
mov dword [ebp - 0x870], 1
jmp 0x1000d53c
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0xb38], eax
cmp dword [ebp - 0xb38], 1
jne 0x1000d55d
mov dword [ebp - 0x878], 1
jmp 0x1000d564
and dword [ebp - 0x878], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe28]
imul eax, dword [ebp - 0x878]
cmp eax, 0xb56411d7
jne 0x1000d58b
mov dword [ebp - 0xdd8], 1
jmp 0x1000d592
and dword [ebp - 0xdd8], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x120c], 0xfffffffb
jl 0x1000d5ae
mov dword [ebp - 0x1004], 1
jmp 0x1000d5b5
and dword [ebp - 0x1004], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe28]
mov dword [ebp - 0x14e0], eax
cmp dword [ebp - 0x60], 0xee05243b
jne 0x1000d5dd
mov dword [ebp - 0x880], 1
jmp 0x1000d5e4
and dword [ebp - 0x880], 0
cmp dword [ebp - 0x880], 0x83eb
jne 0x1000d5fc
mov dword [ebp - 0xb40], 1
jmp 0x1000d603
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0xb40]
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x888]
imul eax, dword [ebp - 0x60]
mov dword [ebp - 0xee4], eax
jmp 0x1000d438
mov dword [ebp - 0x170], 8
mov dword [ebp - 0x314], 0xfffffffc
mov dword [ebp - 0x3b0], 0xfffffff7
mov dword [ebp - 0x4c4], 0xc6f0d4a7
mov dword [ebp - 0x4c0], 0xc6f0d4a7
mov dword [ebp - 0x4bc], 0xc6f0d4a7
mov dword [ebp - 0x4b8], 0xc6f0d4a7
mov dword [ebp - 0x3a0], 0
jmp 0x1000d683
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 1
jge 0x1000d69c
mov eax, dword [ebp - 0x3a0]
mov dword [ebp + eax*4 - 0x40], 0x1928c176
jmp 0x1000d676
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x40], 0
jmp 0x1000d6c1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x40], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0x16
je 0x1000ddab
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x105c], 0xfffffffa
mov dword [ebp - 0xd80], 0xfffffff9
mov dword [ebp - 0x8e8], 0
mov dword [ebp - 0x304], 0
jmp 0x1000d710
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 1
jge 0x1000d72c
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0x8a8], 0xffffffff
jmp 0x1000d703
mov dword [ebp - 0x170], 2
mov dword [ebp - 0x170], 0xfffffff0
jmp 0x1000d74f
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 9
jl 0x1000dda6
mov dword [ebp - 0x3a8], 0
jmp 0x1000d775
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 2
jge 0x1000d791
mov eax, dword [ebp - 0x3a8]
mov dword [ebp + eax*4 - 0x260], 0xffff
jmp 0x1000d768
mov byte [ebp - 0x1a1], 0
movzx eax, byte [ebp - 0x1a1]
test eax, eax
je 0x1000d7b0
push 0xf57
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [ebp - 0x170], 0
jne 0x1000da0d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8a8], 1
jne 0x1000d7d9
mov dword [ebp - 0xca0], 1
jmp 0x1000d7e0
and dword [ebp - 0xca0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xca0]
sub ecx, dword [ebp + eax - 0x260]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x40]
jl 0x1000d80b
mov dword [ebp - 0x890], 1
jmp 0x1000d812
and dword [ebp - 0x890], 0
cmp dword [ebp - 0x890], 0x68dacb31
jge 0x1000d82a
mov dword [ebp - 0xb48], 1
jmp 0x1000d831
and dword [ebp - 0xb48], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
cmp dword [ebp - 0xb48], eax
jle 0x1000d852
mov dword [ebp - 0x898], 1
jmp 0x1000d859
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x314], eax
je 0x1000d87f
mov dword [ebp - 0xd50], 1
jmp 0x1000d886
and dword [ebp - 0xd50], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0xd50]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0x39c0
jne 0x1000d8ba
mov dword [ebp - 0x8a0], 1
jmp 0x1000d8c1
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0xdf11
je 0x1000d8d9
mov dword [ebp - 0xb50], 1
jmp 0x1000d8e0
and dword [ebp - 0xb50], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
cmp dword [ebp - 0xb50], eax
je 0x1000d8fe
mov dword [ebp - 0xca8], 1
jmp 0x1000d905
and dword [ebp - 0xca8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8a8]
imul eax, dword [ebp - 0xca8]
cmp eax, dword [ebp - 0x105c]
jle 0x1000d92d
mov dword [ebp - 0x8b0], 1
jmp 0x1000d934
and dword [ebp - 0x8b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
add eax, dword [ebp - 0x8b0]
mov dword [ebp - 0xb58], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb58]
mov dword [ebp + eax - 0x4c4], ecx
cmp dword [ebp - 0xb58], 0xd579deb4
jne 0x1000d975
mov dword [ebp - 0x8b8], 1
jmp 0x1000d97c
and dword [ebp - 0x8b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
cmp dword [ebp - 0x8b8], eax
jl 0x1000d99a
mov dword [ebp - 0xdc4], 1
jmp 0x1000d9a1
and dword [ebp - 0xdc4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xdc4]
sub ecx, dword [ebp + eax - 0x40]
cmp ecx, 2
jle 0x1000d9c2
mov dword [ebp - 0x8c0], 1
jmp 0x1000d9c9
and dword [ebp - 0x8c0], 0
cmp dword [ebp - 0x8c0], 0xeb7bfbc3
je 0x1000d9f1
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x4c4], 0
je 0x1000d9f1
mov dword [ebp - 0xb60], 1
jmp 0x1000d9f8
and dword [ebp - 0xb60], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
cmp dword [ebp - 0xb60], eax
je 0x1000da20
push 9
pop eax
test eax, eax
je 0x1000da20
mov dword [ebp - 0x8c8], 1
jmp 0x1000da27
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x8c8]
sub eax, 3
je 0x1000dc82
mov eax, 0xc7b249e3
test eax, eax
je 0x1000dc82
mov dword [ebp - 0x30c], 0
jmp 0x1000da5c
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 1
jge 0x1000da78
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0xb68], 0
jmp 0x1000da4f
mov dword [ebp - 0x68], 3
jmp 0x1000da88
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x1000dc7d
mov dword [ebp - 0xef4], 0x22c2
mov eax, 0x5e2e4bcb
test eax, eax
je 0x1000dac1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x260], 0
je 0x1000dac1
mov dword [ebp - 0xcb0], 1
jmp 0x1000dac8
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x4c4]
cmp dword [ebp - 0xcb0], eax
jg 0x1000dae6
mov dword [ebp - 0x8d0], 1
jmp 0x1000daed
and dword [ebp - 0x8d0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8d0]
sub ecx, dword [ebp + eax - 0x4c4]
cmp ecx, 0xb0debf6
jg 0x1000db16
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c4], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x260]
cmp dword [ebp + eax - 0xb68], ecx
jl 0x1000db3e
mov dword [ebp - 0xeec], 1
jmp 0x1000db45
and dword [ebp - 0xeec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb68]
mov dword [ebp - 0x14e8], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x4c4]
mov dword [ebp - 0x14f0], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x4c4]
mov dword [ebp - 0x3b0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c4]
cmp dword [ebp - 0x3b0], eax
je 0x1000db99
mov dword [ebp - 0x8d8], 1
jmp 0x1000dba0
and dword [ebp - 0x8d8], 0
cmp dword [ebp - 0x8d8], 0xcf63
jg 0x1000dbb8
mov dword [ebp - 0xd58], 1
jmp 0x1000dbbf
and dword [ebp - 0xd58], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x260]
cmp dword [ebp - 0xd58], eax
jne 0x1000dbe0
mov dword [ebp - 0x100c], 1
jmp 0x1000dbe7
and dword [ebp - 0x100c], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x4c4]
mov dword [ebp - 0x14f8], eax
cmp dword [ebp - 0xef4], 0
je 0x1000dc1c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x260], 0
je 0x1000dc1c
mov dword [ebp - 0x8e0], 1
jmp 0x1000dc23
and dword [ebp - 0x8e0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x260]
cmp dword [ebp - 0x8e0], eax
jg 0x1000dc44
mov dword [ebp - 0xb70], 1
jmp 0x1000dc4b
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0xb70]
mov dword [ebp - 0xd80], eax
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x1000dc78
push 1
push 0x136f
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x1000da81
jmp 0x1000dda1
mov dword [ebp - 0x10b4], 0
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0x1500], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 8
jae 0x1000dd2b
cmp dword [ebp - 0x8e8], 0xac5da298
je 0x1000dccc
mov dword [ebp - 0xcb8], 1
jmp 0x1000dcd3
and dword [ebp - 0xcb8], 0
cmp dword [ebp - 0xcb8], 0xf019d465
je 0x1000dceb
mov dword [ebp - 0x8f0], 1
jmp 0x1000dcf2
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x10b4]
cmp dword [ebp - 0x8f0], eax
je 0x1000dd0c
mov dword [ebp - 0xb78], 1
jmp 0x1000dd13
and dword [ebp - 0xb78], 0
cmp dword [ebp - 0xb78], 0x7411
je 0x1000dd2b
mov dword [ebp - 0x8f8], 1
jmp 0x1000dd32
and dword [ebp - 0x8f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
imul eax, dword [ebp - 0x8f8]
xor ecx, ecx
inc ecx
sub ecx, eax
je 0x1000dd66
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x260], 0
je 0x1000dd66
mov dword [ebp - 0x900], 1
jmp 0x1000dd6d
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0xd80]
cmp dword [ebp - 0x900], eax
jl 0x1000dd87
mov dword [ebp - 0xb80], 1
jmp 0x1000dd8e
and dword [ebp - 0xb80], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb80]
mov dword [ebp + eax - 0x4c4], ecx
jmp 0x1000d742
jmp 0x1000d6ac
mov byte [ebp - 0x1a7], 0
movzx eax, byte [ebp - 0x1a7]
test eax, eax
je 0x1000ddc5
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x31c], 8
mov dword [ebp - 0xefc], 0x981ff29a
mov dword [ebp - 0x3b8], 0
jmp 0x1000ddf2
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 3
jge 0x1000de0e
mov eax, dword [ebp - 0x3b8]
mov dword [ebp + eax*4 - 0x1554], 0xfffffffe
jmp 0x1000dde5
mov dword [ebp - 0x31c], 0
jmp 0x1000de27
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 2
jg 0x1000df6c
mov dword [ebp - 0x3c0], 0x3c69aed2
mov dword [ebp - 0x3c0], 2
jmp 0x1000de57
mov eax, dword [ebp - 0x3c0]
dec eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0
jl 0x1000df67
mov dword [ebp - 0x6c], 0
jmp 0x1000de74
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1000de8a
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xd60], 0xffffffff
jmp 0x1000de6d
mov dword [ebp - 0x6c], 0
jmp 0x1000de9a
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1000deb0
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x1148], 0xfffffffd
jmp 0x1000de93
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xd60], 2
jmp 0x1000dede
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd60]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xd60], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd60], 0
jl 0x1000df4f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd60]
cmp dword [ebp + eax*4 - 0x1554], 0xc751
jl 0x1000df14
mov dword [ebp - 0x908], 1
jmp 0x1000df1b
and dword [ebp - 0x908], 0
cmp dword [ebp - 0x908], 0
jl 0x1000df30
mov dword [ebp - 0xcc0], 1
jmp 0x1000df37
and dword [ebp - 0xcc0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcc0]
mov dword [ebp + eax - 0x1148], ecx
jmp 0x1000dec3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1148]
mov dword [ebp - 0xefc], eax
jmp 0x1000de4a
jmp 0x1000de1a
mov dword [ebp - 0x1c0], 0x5020f89b
mov dword [ebp - 0x32c], 0x4309642e
mov dword [ebp - 0xb90], 7
mov dword [ebp - 0x1064], 0xcc5c6a3f
mov dword [ebp - 0x324], 0
jmp 0x1000dfad
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 3
jge 0x1000dfc9
mov eax, dword [ebp - 0x324]
mov dword [ebp + eax*4 - 0x1164], 0xdc85f70a
jmp 0x1000dfa0
mov dword [ebp - 0x1c0], 0
jmp 0x1000dfe2
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jg 0x1000e167
mov dword [ebp - 0x918], 4
mov dword [ebp - 0xf04], 0xdfadf628
mov dword [ebp - 0x920], 0xb8b78acc
mov dword [ebp - 0x1508], 0xffffffff
mov dword [ebp - 0x147c], 0xffffffff
mov dword [ebp - 0x3c8], 0
jmp 0x1000e03a
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 3
jge 0x1000e056
mov eax, dword [ebp - 0x3c8]
mov dword [ebp + eax*4 - 0x1630], 1
jmp 0x1000e02d
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp + eax*4 - 0x1164], 0
jae 0x1000e072
mov dword [ebp - 0x910], 1
jmp 0x1000e079
and dword [ebp - 0x910], 0
cmp dword [ebp - 0x910], 0xfa2fafd1
jb 0x1000e091
mov dword [ebp - 0xb88], 1
jmp 0x1000e098
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0xb88]
mov dword [ebp - 0x918], eax
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
js 0x1000e0bf
mov dword [ebp - 0x1014], 1
jmp 0x1000e0c6
and dword [ebp - 0x1014], 0
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0x123c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1164]
mov dword [ebp - 0x13e0], eax
mov eax, dword [ebp - 0xf04]
mov dword [ebp - 0x1244], eax
mov eax, dword [ebp - 0x1064]
mov dword [ebp - 0x14ec], eax
mov eax, dword [ebp - 0x918]
add eax, 7
cmp eax, 0xe60d
jne 0x1000e119
mov dword [ebp - 0xd64], 1
jmp 0x1000e120
and dword [ebp - 0xd64], 0
mov eax, dword [ebp - 0xd64]
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x124c], eax
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0x13e8], eax
mov eax, dword [ebp - 0x32c]
sub eax, 0x47d17017
imul eax, eax, 0xfab8
mov ecx, dword [ebp - 0x1c0]
mov dword [ebp + ecx*4 - 0x1164], eax
jmp 0x1000dfd5
mov dword [ebp - 0x23c], 9
mov dword [ebp - 0x3d0], 0
jmp 0x1000e18a
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 4
jge 0x1000e1a6
mov eax, dword [ebp - 0x3d0]
mov dword [ebp + eax*4 - 0x15c4], 0xb9b5
jmp 0x1000e17d
mov dword [ebp - 0x23c], 0
jmp 0x1000e1bf
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 3
jg 0x1000e1dc
mov eax, dword [ebp - 0x23c]
cmp dword [ebp + eax*4 - 0x15c4], 0
je 0x1000e1da
jmp 0x1000e1dc
jmp 0x1000e1b2
mov dword [ebp - 0xf8], 0x17ca4e86
mov dword [ebp - 0x1f0], 0xffffffff
mov dword [ebp - 0xf0], 0xcb7be74f
mov dword [ebp - 0xba0], 1
mov dword [ebp - 0x14], 0
jmp 0x1000e214
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000e22a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe4], 0x5b57
jmp 0x1000e20d
mov dword [ebp - 0x14], 0
jmp 0x1000e23a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1000e24d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 8], 7
jmp 0x1000e233
mov dword [ebp - 0x14], 0
jmp 0x1000e25d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1000e273
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x156c], 0
jmp 0x1000e256
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 8], 0
jmp 0x1000e298
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 8], 1
jg 0x1000e8b4
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x444], 0xfffffff8
mov dword [ebp - 0x1c], 0
jmp 0x1000e2ca
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x1000e311
mov dword [ebp - 0x224], 0x2b29949d
mov dword [ebp - 0x224], 0
jmp 0x1000e2f3
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 2
jge 0x1000e30f
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0xe4], 0xffffffff
jmp 0x1000e2e6
jmp 0x1000e2c3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
mov eax, dword [ebp + eax*4 - 0xe4]
mov dword [ebp - 0x1254], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xe4]
cmp dword [ebp + eax - 8], ecx
jl 0x1000e34d
mov dword [ebp - 0x928], 1
jmp 0x1000e354
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x1f0], eax
imul eax, dword [ebp - 0x1f0], 0x6d54
cmp eax, 0xb474
je 0x1000e37d
mov dword [ebp - 0xcc8], 1
jmp 0x1000e384
and dword [ebp - 0xcc8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
mov eax, dword [ebp + eax*4 - 0xe4]
imul eax, dword [ebp - 0xcc8]
imul eax, eax, 0x6fdd
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 8]
jle 0x1000e3ba
mov dword [ebp - 0x930], 1
jmp 0x1000e3c1
and dword [ebp - 0x930], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
cmp dword [ebp - 0x930], eax
jg 0x1000e3e2
mov dword [ebp - 0xb98], 1
jmp 0x1000e3e9
and dword [ebp - 0xb98], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
cmp dword [ebp - 0xb98], eax
jg 0x1000e407
mov dword [ebp - 0x938], 1
jmp 0x1000e40e
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
inc eax
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 8]
cmp eax, dword [ebp + ecx*4 - 0xe4]
jle 0x1000e447
mov dword [ebp - 0xd88], 1
jmp 0x1000e44e
and dword [ebp - 0xd88], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp eax, dword [ebp - 0xd88]
jne 0x1000e47d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 8], 0
jne 0x1000e47d
and dword [ebp - 0x940], 0
jmp 0x1000e487
mov dword [ebp - 0x940], 1
mov dword [ebp - 0xf8], 0x8f4f
mov eax, dword [ebp - 0x940]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xba0]
cmp dword [ebp - 0xf8], eax
jne 0x1000e4b7
mov dword [ebp - 0x948], 1
jmp 0x1000e4be
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x948]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 8]
jg 0x1000e4de
mov dword [ebp - 0xcd0], 1
jmp 0x1000e4e5
and dword [ebp - 0xcd0], 0
cmp dword [ebp - 0xcd0], 0x4c259dba
jl 0x1000e4fd
mov dword [ebp - 0xf0c], 1
jmp 0x1000e504
and dword [ebp - 0xf0c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
mov dword [ebp - 0x1484], eax
push 9
pop eax
cmp eax, 0x7e29ac92
jge 0x1000e52a
mov dword [ebp - 0x101c], 1
jmp 0x1000e531
and dword [ebp - 0x101c], 0
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x125c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xe4]
cmp dword [ebp + eax - 0x156c], ecx
jl 0x1000e565
mov dword [ebp - 0x950], 1
jmp 0x1000e56c
and dword [ebp - 0x950], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp dword [ebp - 0x950], eax
je 0x1000e591
mov dword [ebp - 0xba8], 1
jmp 0x1000e598
and dword [ebp - 0xba8], 0
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0
je 0x1000e744
mov eax, 0x8d88
test eax, eax
je 0x1000e744
mov dword [ebp - 0xf14], 0xffffffff
mov dword [ebp - 0x334], 0
jmp 0x1000e5e1
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 2
jge 0x1000e5fd
mov eax, dword [ebp - 0x334]
mov dword [ebp + eax*4 - 0xe38], 2
jmp 0x1000e5d4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0xe4]
cmp eax, 0x3212
je 0x1000e627
mov dword [ebp - 0x958], 1
jmp 0x1000e62e
and dword [ebp - 0x958], 0
cmp dword [ebp - 0x958], 0x251f81f1
jle 0x1000e646
mov dword [ebp - 0xd70], 1
jmp 0x1000e64d
and dword [ebp - 0xd70], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xd70], eax
jge 0x1000e664
mov dword [ebp - 0x960], 1
jmp 0x1000e66b
and dword [ebp - 0x960], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp eax, dword [ebp - 0x960]
jle 0x1000e6a0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe38], 0
je 0x1000e6a0
mov dword [ebp - 0xbb0], 1
jmp 0x1000e6a7
and dword [ebp - 0xbb0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbb0]
sub ecx, dword [ebp + eax - 0xe38]
cmp dword [ebp - 0x444], ecx
jg 0x1000e6ce
mov dword [ebp - 0x968], 1
jmp 0x1000e6d5
and dword [ebp - 0x968], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe38]
cmp dword [ebp - 0x968], eax
jg 0x1000e6f6
mov dword [ebp - 0xcd8], 1
jmp 0x1000e6fd
and dword [ebp - 0xcd8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe38]
cmp dword [ebp - 0xcd8], eax
jl 0x1000e71e
mov dword [ebp - 0x970], 1
jmp 0x1000e725
and dword [ebp - 0x970], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
imul eax, dword [ebp - 0x970]
mov dword [ebp - 0xf14], eax
jmp 0x1000e8af
mov dword [ebp - 0x13f0], 0x42427020
mov dword [ebp - 0x3d8], 0
jmp 0x1000e767
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 4
jge 0x1000e783
mov eax, dword [ebp - 0x3d8]
mov dword [ebp + eax*4 - 0x1660], 0
jmp 0x1000e75a
mov dword [ebp - 0xf8], 0
jmp 0x1000e79c
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jg 0x1000e8af
mov dword [ebp - 0xbb8], 0xd3184ba
mov dword [ebp - 0xf1c], 0x1fe44aad
mov dword [ebp - 0x1c], 0
jmp 0x1000e7cd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x1000e7e2
mov eax, dword [ebp - 0xbb8]
inc eax
mov dword [ebp - 0xbb8], eax
jmp 0x1000e7c6
mov dword [ebp - 0xf0], 0
jmp 0x1000e7fb
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jg 0x1000e8aa
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp + eax*4 - 0xe4]
mov dword [ebp - 0x1264], eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp + eax*4 - 0xe4]
mov ecx, dword [ebp - 0xf0]
sub eax, dword [ebp + ecx*4 - 0xe4]
jne 0x1000e883
mov eax, dword [ebp - 0xf8]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 8]
cmp dword [ebp + eax*4 - 0xe4], ecx
jge 0x1000e85c
mov dword [ebp - 0x1094], 1
jmp 0x1000e863
and dword [ebp - 0x1094], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
cmp dword [ebp + eax*4 - 0xe4], 0xfff7
je 0x1000e883
and dword [ebp - 0x978], 0
jmp 0x1000e88d
mov dword [ebp - 0x978], 1
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0xf1c], eax
jmp 0x1000e7ee
jmp 0x1000e78f
jmp 0x1000e283
mov dword [ebp - 0x98], 0x8901f2c
mov dword [ebp - 0x33c], 0
jmp 0x1000e8d7
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 2
jge 0x1000e8f3
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0xf8c], 1
jmp 0x1000e8ca
mov dword [ebp - 0x98], 1
jmp 0x1000e90c
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x1000eb2a
mov dword [ebp - 0x1ec], 0xfffffffc
mov dword [ebp - 0x3e0], 0
jmp 0x1000e93c
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 3
jge 0x1000e958
mov eax, dword [ebp - 0x3e0]
mov dword [ebp + eax*4 - 0xe64], 0xffffffff
jmp 0x1000e92f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe64]
mov dword [ebp - 0x14cc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf8c]
mov dword [ebp - 0x126c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe64]
mov dword [ebp - 0x13f8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8c]
cmp dword [ebp - 0x98], eax
jg 0x1000e9b2
mov dword [ebp - 0xd90], 1
jmp 0x1000e9b9
and dword [ebp - 0xd90], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe64]
cmp dword [ebp - 0xd90], eax
jg 0x1000e9da
mov dword [ebp - 0x980], 1
jmp 0x1000e9e1
and dword [ebp - 0x980], 0
cmp dword [ebp - 0x980], 0xc254
jge 0x1000e9f9
mov dword [ebp - 0x1024], 1
jmp 0x1000ea00
and dword [ebp - 0x1024], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x1274], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe64], 0
je 0x1000ea38
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe64], 0
je 0x1000ea38
mov dword [ebp - 0xbc0], 1
jmp 0x1000ea3f
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0xbc0]
jge 0x1000ea59
mov dword [ebp - 0x988], 1
jmp 0x1000ea60
and dword [ebp - 0x988], 0
cmp dword [ebp - 0x988], 0xb3493876
jbe 0x1000ea78
mov dword [ebp - 0xf24], 1
jmp 0x1000ea7f
and dword [ebp - 0xf24], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x148c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8c]
cmp dword [ebp - 0x98], eax
jge 0x1000eaac
mov dword [ebp - 0xce0], 1
jmp 0x1000eab3
and dword [ebp - 0xce0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe64]
cmp dword [ebp - 0xce0], eax
jle 0x1000ead4
mov dword [ebp - 0x990], 1
jmp 0x1000eadb
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x990]
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1ec], 1
jmp 0x1000eb00
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
jl 0x1000eb25
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x1000eb23
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000eaf3
jmp 0x1000e8ff
mov dword [ebp - 0x106c], 4
mov dword [ebp - 0x1230], 0xb7d8cf4c
mov dword [ebp - 0x1400], 0x959310c1
mov dword [ebp - 0xf2c], 4
mov dword [ebp - 0x1284], 6
mov dword [ebp - 0x3e8], 0
jmp 0x1000eb75
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 2
jge 0x1000eb91
mov eax, dword [ebp - 0x3e8]
mov dword [ebp + eax*4 - 0x1128], 0xfffc
jmp 0x1000eb68
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1128], 0
je 0x1000eccd
mov dword [ebp - 0x3e4], 0x9d29be1d
mov dword [ebp - 0x150c], 0xfffffff6
mov dword [ebp - 0x128c], 0x45fe46c2
mov dword [ebp - 0xcc], 0
jmp 0x1000ebdc
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x1000ebf8
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x1408], 0x5ccb9725
jmp 0x1000ebcf
mov dword [ebp - 0xcc], 0
jmp 0x1000ec11
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jge 0x1000ec2d
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x1158], 0x64a11600
jmp 0x1000ec04
mov dword [ebp - 0x3e4], 0x14
jmp 0x1000ec46
mov eax, dword [ebp - 0x3e4]
dec eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0xfffffff7
jl 0x1000eccb
mov dword [ebp - 0x1294], 0xafe30f58
mov dword [ebp - 0x1494], 0x1c97412d
mov dword [ebp - 0x34c], 0
jmp 0x1000ec7c
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 2
jge 0x1000ec98
mov eax, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0x15fc], 0x8e9646b8
jmp 0x1000ec6f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1128]
mov dword [ebp - 0x106c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1158]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1158], eax
jmp 0x1000ec39
jmp 0x1000ecff
mov byte [ebp - 0x1a3], 0
movzx eax, byte [ebp - 0x1a3]
test eax, eax
je 0x1000ecff
push 0
push 0x1287
push 0xbd3
push 0
push 0x124e
push 0x141c
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xf2c], 0
mov dword [ebp - 0x38], 2
mov dword [ebp - 0xbe8], 0xffff
mov dword [ebp - 0x9d8], 7
mov dword [ebp - 0xf3c], 8
mov dword [ebp - 0xfb0], 0
mov dword [ebp - 0x129c], 0xa67d
mov dword [ebp - 0x3b4], 0
jmp 0x1000ed5b
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 1
jge 0x1000ed77
mov eax, dword [ebp - 0x3b4]
mov dword [ebp + eax*4 - 0xa0], 0xa8e
jmp 0x1000ed4e
mov dword [ebp - 0x38], 0
jmp 0x1000ed87
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1000f06a
mov dword [ebp - 0x9c8], 0xd947597a
mov dword [ebp - 0x488], 0xc9d94031
mov dword [ebp - 0x40c], 0x4186
mov dword [ebp - 0x9a8], 0x9b8842b4
mov dword [ebp - 0x354], 0
jmp 0x1000edd2
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 1
jge 0x1000edee
mov eax, dword [ebp - 0x354]
mov dword [ebp + eax*4 - 0x102c], 0xa4d9a54e
jmp 0x1000edc5
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xa0], 0
jne 0x1000ee07
mov dword [ebp - 0xbe0], 1
jmp 0x1000ee0e
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xa0]
sub eax, 0xcac3
mov dword [ebp - 0xbc8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbc8]
mov dword [ebp + eax - 0x102c], ecx
mov eax, dword [ebp - 0x488]
cmp dword [ebp - 0xbc8], eax
jg 0x1000ee50
mov dword [ebp - 0x998], 1
jmp 0x1000ee57
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xa0]
cmp dword [ebp - 0x998], eax
jg 0x1000ee75
mov dword [ebp - 0xd7c], 1
jmp 0x1000ee7c
and dword [ebp - 0xd7c], 0
mov eax, dword [ebp - 0xd7c]
neg eax
imul eax, eax, 0x4692
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa0]
jle 0x1000eea5
mov dword [ebp - 0x9a0], 1
jmp 0x1000eeac
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x40c]
add eax, dword [ebp - 0x9a0]
jne 0x1000eed1
or eax, 0xffffffff
jne 0x1000eed1
cmp dword [ebp - 0x488], 0
jne 0x1000eed1
and dword [ebp - 0xbd0], 0
jmp 0x1000eedb
mov dword [ebp - 0xbd0], 1
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0x9a8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa0]
cmp dword [ebp - 0x9a8], eax
jle 0x1000ef08
mov dword [ebp - 0xce8], 1
jmp 0x1000ef0f
and dword [ebp - 0xce8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa0]
cmp dword [ebp - 0xce8], eax
je 0x1000ef30
mov dword [ebp - 0x9b0], 1
jmp 0x1000ef37
and dword [ebp - 0x9b0], 0
cmp dword [ebp - 0x9b0], 0xffff
jb 0x1000ef4f
mov dword [ebp - 0xbd8], 1
jmp 0x1000ef56
and dword [ebp - 0xbd8], 0
mov eax, dword [ebp - 0xbd8]
add eax, 9
cmp eax, dword [ebp - 0x38]
jle 0x1000ef79
mov eax, 0x6983
test eax, eax
je 0x1000ef79
mov dword [ebp - 0x9b8], 1
jmp 0x1000ef80
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xa0]
cmp eax, dword [ebp - 0x9b8]
je 0x1000efa7
cmp dword [ebp - 0x40c], 0
je 0x1000efa7
mov dword [ebp - 0xd98], 1
jmp 0x1000efae
and dword [ebp - 0xd98], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa0]
cmp dword [ebp - 0xd98], eax
jge 0x1000efcf
mov dword [ebp - 0x9c0], 1
jmp 0x1000efd6
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x40c]
add eax, dword [ebp - 0x9c0]
cmp eax, dword [ebp - 0x488]
je 0x1000eff6
mov dword [ebp - 0xcf0], 1
jmp 0x1000effd
and dword [ebp - 0xcf0], 0
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0x9c8], eax
mov eax, dword [ebp - 0x9c8]
sub eax, dword [ebp - 0xcf0]
cmp eax, 0x30b5
jge 0x1000f028
mov dword [ebp - 0xf34], 1
jmp 0x1000f02f
and dword [ebp - 0xf34], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp - 0x40c]
cmp dword [ebp - 0xbe8], eax
jne 0x1000f052
mov dword [ebp - 0x9d0], 1
jmp 0x1000f059
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x9d0]
mov dword [ebp - 0x9d8], eax
jmp 0x1000ed80
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0x12a4], eax
mov eax, 0x463028ec
sub eax, dword [ebp - 0x9d8]
js 0x1000f08f
mov dword [ebp - 0xda0], 1
jmp 0x1000f096
and dword [ebp - 0xda0], 0
cmp dword [ebp - 0xda0], 1
ja 0x1000f0ab
mov dword [ebp - 0x10cc], 1
jmp 0x1000f0b2
and dword [ebp - 0x10cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa0]
mov dword [ebp - 0x14d4], eax
mov eax, dword [ebp - 0xf3c]
mov dword [ebp - 0x12ac], eax
imul eax, dword [ebp - 0xfb0], 0xf2b6
cmp eax, 0xbccb
jne 0x1000f0ee
mov dword [ebp - 0x9e0], 1
jmp 0x1000f0f5
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0x38], eax
movzx eax, byte [0x11a96ca0]
test eax, eax
je 0x1000f11c
mov esi, 0x100825a0
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10013231
mov dword [ebp - 0x5c], 0xe387fb0b
mov dword [ebp - 0x4f8], 0x228d5fea
mov dword [ebp - 0xddc], 1
mov dword [ebp - 0xfc0], 0xd08f4923
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x5c], 0
jmp 0x1000f157
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x12
je 0x1000f33c
mov dword [ebp - 0x122c], 0x2ae8
mov dword [ebp - 0x1228], 0x2ae8
mov dword [ebp - 0x1224], 0x2ae8
mov dword [ebp - 0x1220], 0x2ae8
mov dword [ebp - 0x35c], 0
jmp 0x1000f1a2
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 3
jge 0x1000f1be
mov eax, dword [ebp - 0x35c]
mov dword [ebp + eax*4 - 0xe1c], 0
jmp 0x1000f195
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xe1c]
cmp dword [ebp + eax - 0xe1c], ecx
jl 0x1000f1e6
mov dword [ebp - 0xf44], 1
jmp 0x1000f1ed
and dword [ebp - 0xf44], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe1c], 0x6974
jge 0x1000f20c
mov dword [ebp - 0xfac], 1
jmp 0x1000f213
and dword [ebp - 0xfac], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1418], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe1c]
mov dword [ebp - 0x12b4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe1c]
cmp dword [ebp - 0x5c], eax
jge 0x1000f24d
mov dword [ebp - 0xbf0], 1
jmp 0x1000f254
and dword [ebp - 0xbf0], 0
mov eax, dword [ebp - 0xbf0]
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 1
jne 0x1000f275
mov dword [ebp - 0xcf8], 1
jmp 0x1000f27c
and dword [ebp - 0xcf8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe1c]
imul eax, dword [ebp - 0xcf8]
cmp eax, 0xb56411d7
jne 0x1000f2a3
mov dword [ebp - 0x9f0], 1
jmp 0x1000f2aa
and dword [ebp - 0x9f0], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x122c], 0xfffffffb
jl 0x1000f2c6
mov dword [ebp - 0xf4c], 1
jmp 0x1000f2cd
and dword [ebp - 0xf4c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe1c]
mov dword [ebp - 0x149c], eax
cmp dword [ebp - 0x5c], 0xee05243b
jne 0x1000f2f5
mov dword [ebp - 0xbf8], 1
jmp 0x1000f2fc
and dword [ebp - 0xbf8], 0
cmp dword [ebp - 0xbf8], 0x83eb
jne 0x1000f314
mov dword [ebp - 0x9f8], 1
jmp 0x1000f31b
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0xddc], eax
mov eax, dword [ebp - 0xddc]
imul eax, dword [ebp - 0x5c]
mov dword [ebp - 0xfc0], eax
jmp 0x1000f150
mov dword [ebp - 0x30], 0xe76f5020
mov dword [ebp - 0xd4], 0xd4309642
mov dword [ebp - 0x200], 0xfffffffa
mov dword [ebp - 0xa48], 0xffffffff
mov dword [ebp - 0xfd8], 8
mov dword [ebp - 0x3bc], 0
jmp 0x1000f384
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 4
jge 0x1000f3a0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp + eax*4 - 0x151c], 0xdc85
jmp 0x1000f377
mov dword [ebp - 0x30], 0
jmp 0x1000f3b0
cmp dword [ebp - 0x30], 3
jg 0x1000f86e
mov dword [ebp - 0x1e0], 1
mov dword [ebp - 0x178], 0xffffffff
mov dword [ebp - 0xf54], 0x79a20b28
mov dword [ebp - 0xfd0], 1
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x12bc], eax
cmp dword [ebp - 0x1e0], 0
je 0x1000f40c
cmp dword [ebp - 0x1e0], 0
je 0x1000f40c
mov dword [ebp - 0xa00], 1
jmp 0x1000f413
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xa00], eax
jl 0x1000f42a
mov dword [ebp - 0xc00], 1
jmp 0x1000f431
and dword [ebp - 0xc00], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x151c]
cmp dword [ebp - 0xc00], eax
je 0x1000f452
mov dword [ebp - 0xa08], 1
jmp 0x1000f459
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0xa08], eax
jl 0x1000f473
mov dword [ebp - 0xd00], 1
jmp 0x1000f47a
and dword [ebp - 0xd00], 0
cmp dword [ebp - 0xd00], 0
je 0x1000f48f
mov dword [ebp - 0xa10], 1
jmp 0x1000f496
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0xa10]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x178], eax
jne 0x1000f4bc
mov dword [ebp - 0xc08], 1
jmp 0x1000f4c3
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0xc08], eax
jne 0x1000f4dd
mov dword [ebp - 0xa18], 1
jmp 0x1000f4e4
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0xa18]
mov dword [ebp - 0xf54], eax
cmp dword [ebp - 0xd4], 0
jne 0x1000f516
mov dword [ebp - 0x178], 5
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x151c], 0x1540
mov eax, 0x1540
test eax, eax
jne 0x1000f56e
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1e0], eax
jl 0x1000f544
mov dword [ebp - 0xd8c], 1
jmp 0x1000f54b
and dword [ebp - 0xd8c], 0
mov eax, dword [ebp - 0xd8c]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
add eax, dword [ebp - 0x178]
jne 0x1000f56e
and dword [ebp - 0xa20], 0
jmp 0x1000f578
mov dword [ebp - 0xa20], 1
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0xa20]
sub eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x200]
test eax, eax
je 0x1000f6dd
mov dword [ebp - 0xfc8], 1
mov dword [ebp - 0xc10], 0xd06de21e
mov dword [ebp - 0xdd4], 4
mov eax, dword [ebp - 0xfc8]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp - 0xc10]
cmp dword [ebp - 0xd4], eax
jle 0x1000f5da
mov dword [ebp - 0xa28], 1
jmp 0x1000f5e1
and dword [ebp - 0xa28], 0
cmp dword [ebp - 0xa28], 0
jl 0x1000f5f6
mov dword [ebp - 0xd08], 1
jmp 0x1000f5fd
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 0x178]
sub eax, dword [ebp - 0xd08]
imul eax, dword [ebp - 0x30]
test eax, eax
jb 0x1000f61d
mov dword [ebp - 0xa30], 1
jmp 0x1000f624
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0xa30]
sub eax, 6
cmp eax, 7
jge 0x1000f63e
mov dword [ebp - 0x274], 0
jmp 0x1000f6f6
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 2
jge 0x1000f712
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0x1138], 0xfffffffb
jmp 0x1000f6e9
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x1000f73c
push 0
push 0x2144
push 0
push 0
push 0x129
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1138], 0
jne 0x1000f7e4
mov dword [ebp - 0x12c4], 0x100825a0
mov dword [ebp - 0x1c8], 0x5020f89b
mov dword [ebp - 0x36c], 0x4309642e
mov dword [ebp - 0xa78], 7
mov dword [ebp - 0xf74], 0xcc5c6a3f
mov dword [ebp - 0x364], 0
jmp 0x1000f8b9
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 3
jge 0x1000f8d5
mov eax, dword [ebp - 0x364]
mov dword [ebp + eax*4 - 0x1194], 0xdc85f70a
jmp 0x1000f8ac
mov dword [ebp - 0x1c8], 0
jmp 0x1000f8ee
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 2
jg 0x1000fa73
mov dword [ebp - 0xd18], 4
mov dword [ebp - 0xfe0], 0xdfadf628
mov dword [ebp - 0xc38], 0xb8b78acc
mov dword [ebp - 0x14f4], 0xffffffff
mov dword [ebp - 0x12cc], 0xffffffff
mov dword [ebp - 0x3ec], 0
jmp 0x1000f946
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 3
jge 0x1000f962
mov eax, dword [ebp - 0x3ec]
mov dword [ebp + eax*4 - 0x1618], 1
jmp 0x1000f939
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp + eax*4 - 0x1194], 0
jae 0x1000f97e
mov dword [ebp - 0xc30], 1
jmp 0x1000f985
and dword [ebp - 0xc30], 0
cmp dword [ebp - 0xc30], 0xfa2fafd1
jb 0x1000f99d
mov dword [ebp - 0xa68], 1
jmp 0x1000f9a4
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0xd18], eax
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
js 0x1000f9cb
mov dword [ebp - 0xf6c], 1
jmp 0x1000f9d2
and dword [ebp - 0xf6c], 0
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0x1428], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1194]
mov dword [ebp - 0x12d4], eax
mov eax, dword [ebp - 0xfe0]
mov dword [ebp - 0x14a4], eax
mov eax, dword [ebp - 0xf74]
mov dword [ebp - 0x12dc], eax
mov eax, dword [ebp - 0xd18]
add eax, 7
cmp eax, 0xe60d
jne 0x1000fa25
mov dword [ebp - 0xa70], 1
jmp 0x1000fa2c
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0xa70]
mov dword [ebp - 0xc38], eax
mov eax, dword [ebp - 0xc38]
mov dword [ebp - 0x1430], eax
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0x12e4], eax
mov eax, dword [ebp - 0x36c]
sub eax, 0x47d17017
imul eax, eax, 0xfab8
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp + ecx*4 - 0x1194], eax
jmp 0x1000f8e1
mov dword [ebp - 0x374], 8
mov dword [ebp - 0xfe8], 0x981ff29a
mov dword [ebp - 0x3c4], 0
jmp 0x1000faa0
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 3
jge 0x1000fabc
mov eax, dword [ebp - 0x3c4]
mov dword [ebp + eax*4 - 0x1578], 0xfffffffe
jmp 0x1000fa93
mov dword [ebp - 0x374], 0
jmp 0x1000fad5
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 2
jg 0x1000fc38
mov dword [ebp - 0x404], 0x3c69aed2
mov dword [ebp - 0x404], 2
jmp 0x1000fb05
cmp dword [ebp - 0x404], 0
jl 0x1000fc33
mov dword [ebp - 0xa8], 0
jmp 0x1000fb2b
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1000fb47
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xd6c], 0xffffffff
jmp 0x1000fb1e
mov dword [ebp - 0xa8], 0
jmp 0x1000fb60
cmp dword [ebp - 0xa8], 2
jge 0x1000fb7c
jmp 0x1000fac8
mov dword [ebp - 0x100], 0x92758e92
mov dword [ebp - 0x4a0], 0xfffffff6
mov dword [ebp - 0x79c], 0x88a9
mov dword [ebp - 0x454], 8
mov dword [ebp - 0x7b4], 0xffffffff
mov dword [ebp - 0x7cc], 0
mov dword [ebp - 0x14dc], 1
mov dword [ebp - 0x12ec], 0xb4ff
mov dword [ebp - 0x7ac], 0xfffffffe
mov dword [ebp - 0xc0], 0
jmp 0x1000fcab
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x1000fcc7
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0xe04], 0x4e1a
jmp 0x1000fc9e
mov dword [ebp - 0xc0], 0
jmp 0x1000fce0
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x1000fcfc
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x1090], 0
jmp 0x1000fcd3
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe04], 0
je 0x1000fee3
mov dword [ebp - 0xd9c], 1
mov dword [ebp - 0x37c], 0
jmp 0x1000fd33
mov dword [ebp - 0x44c], 9
mov dword [ebp - 0x764], 0x941993e3
mov dword [ebp - 0x3f4], 0x120b879b
mov dword [ebp - 0x384], 0xffffffff
mov dword [ebp - 0x490], 1
mov dword [ebp - 0x7a4], 6
mov dword [ebp - 0x7c4], 1
mov dword [ebp - 0x100], 2
jmp 0x1000ff42
pop edi
pop esi
mov esp, ebp
pop ebp
ret