Function at 0x10008b94
Capabilities:
Create pipe
Get session user name
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12b0
call fcn.100729e0
push esi
push edi
mov dword [ebp - 0xed8], 0x722a
mov dword [ebp - 0xb0], 0
jmp 0x10008bc6
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x10008be2
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0xa4c], 9
jmp 0x10008bb9
mov dword [ebp - 0xb0], 0
jmp 0x10008bfb
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x10008c17
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x198], 0x4cd45360
jmp 0x10008bee
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x198], 1
jmp 0x10008c45
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x198], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x198], 0
jl 0x10008d9a
mov dword [ebp - 0xe58], 0xc234ac01
mov dword [ebp - 0xe60], 0xfffffffc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp dword [ebp + eax*4 - 0xa4c], 1
jg 0x10008c90
mov dword [ebp - 0x58c], 1
jmp 0x10008c97
and dword [ebp - 0x58c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp dword [ebp - 0x58c], eax
jle 0x10008cb8
mov dword [ebp - 0xa08], 1
jmp 0x10008cbf
and dword [ebp - 0xa08], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp dword [ebp - 0xa08], eax
jne 0x10008ce0
mov dword [ebp - 0xa10], 1
jmp 0x10008ce7
and dword [ebp - 0xa10], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
mov eax, dword [ebp + eax*4 - 0xa4c]
imul eax, dword [ebp - 0xa10]
mov ecx, 0x244d
sub ecx, eax
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x198]
jg 0x10008d24
mov dword [ebp - 0xa18], 1
jmp 0x10008d2b
and dword [ebp - 0xa18], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
mov eax, dword [ebp + eax*4 - 0xa4c]
cmp dword [ebp - 0xa18], eax
jl 0x10008d53
mov dword [ebp - 0xa20], 1
jmp 0x10008d5a
and dword [ebp - 0xa20], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
mov eax, dword [ebp + eax*4 - 0xa4c]
mov ecx, dword [ebp - 0xa20]
lea eax, [eax + ecx + 0x83ac]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x198]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa4c], eax
jmp 0x10008c2a
mov dword [ebp - 0x14c], 0x87013dce
mov dword [ebp - 0xaf0], 0xe2b7
mov dword [ebp - 0xa30], 1
mov dword [ebp - 0x54], 0
jmp 0x10008dc8
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x10008dde
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xcec], 0x7f825e7a
jmp 0x10008dc1
mov dword [ebp - 0x54], 0
jmp 0x10008dee
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x10008e04
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x340], 0x2a83
jmp 0x10008de7
mov dword [ebp - 0x54], 0
jmp 0x10008e14
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x10008e2a
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xc78], 1
jmp 0x10008e0d
mov dword [ebp - 0x14c], 0
jmp 0x10008e43
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jg 0x10008f3d
mov dword [ebp - 0x1dc], 0xffffffff
mov dword [ebp - 0xe68], 1
mov dword [ebp - 0xe70], 0xfffffff6
mov dword [ebp - 0xe78], 0xfffffffa
mov dword [ebp - 0x338], 0
jmp 0x10008e91
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 4
jge 0x10008ead
mov eax, dword [ebp - 0x338]
mov dword [ebp + eax*4 - 0x1250], 0xffffffff
jmp 0x10008e84
mov dword [ebp - 0x1dc], 2
jmp 0x10008ec6
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jl 0x10008f1d
mov byte [ebp - 0x146], 0
movzx eax, byte [ebp - 0x146]
test eax, eax
je 0x10008f09
push 0
push 0xfdb
push 0x440
push 0x197a
push 0x20ee
push 0x1096
push 0x1478
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp + eax*4 - 0xcec], 0
je 0x10008f1b
jmp 0x10008eb9
jmp 0x10008eb9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x340]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x340], eax
jmp 0x10008e36
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x340]
mov dword [ebp - 0xa28], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa28]
mov dword [ebp + eax - 0xc78], ecx
mov eax, dword [ebp - 0xaf0]
cmp eax, dword [ebp - 0xa28]
je 0x10008f7d
mov dword [ebp - 0xa38], 1
jmp 0x10008f84
and dword [ebp - 0xa38], 0
mov dword [ebp - 0xa30], 0xffff
mov eax, dword [ebp - 0xa30]
imul eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0xa38]
sub ecx, eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xcec], ecx
jg 0x10008fbd
mov dword [ebp - 0xb2c], 1
jmp 0x10008fc4
and dword [ebp - 0xb2c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x340]
mov dword [ebp - 0xe80], eax
mov eax, dword [ebp - 0x14c]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0xc78]
jne 0x10008ffe
mov eax, 0x84365721
test eax, eax
jne 0x10008ffe
and dword [ebp - 0xa40], 0
jmp 0x10009008
mov dword [ebp - 0xa40], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa40]
mov dword [ebp + eax - 0xcec], ecx
mov dword [ebp - 0x348], 0
jmp 0x10009033
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 1
jge 0x1000904f
mov eax, dword [ebp - 0x348]
mov dword [ebp + eax*4 - 0x1e4], 0x8c6a53d0
jmp 0x10009026
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1e4], 0
jmp 0x1000907d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e4], 0xfffffff7
jg 0x10009166
mov dword [ebp - 0xa6c], 0
mov dword [ebp - 0x388], 0xe9fb1c03
mov dword [ebp - 0xa94], 0xd9d75405
mov eax, dword [ebp - 0x388]
neg eax
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0xa94]
sub eax, 0x61fc2da8
cmp dword [ebp - 0x388], eax
jg 0x100090dc
mov dword [ebp - 0xa74], 1
jmp 0x100090e3
and dword [ebp - 0xa74], 0
mov dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0xa6c]
cmp eax, dword [ebp - 0xa74]
jge 0x10009107
mov dword [ebp - 0xa7c], 1
jmp 0x1000910e
and dword [ebp - 0xa7c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e4]
cmp eax, dword [ebp - 0xa7c]
jg 0x1000912f
mov dword [ebp - 0xa84], 1
jmp 0x10009136
and dword [ebp - 0xa84], 0
cmp dword [ebp - 0xa84], 0x1f78
jge 0x1000914e
mov dword [ebp - 0xa8c], 1
jmp 0x10009155
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0xa94], eax
jmp 0x10009062
mov dword [ebp - 0xe88], 0x722a
mov dword [ebp - 0xa4], 0
jmp 0x10009189
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x100091a5
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xa58], 9
jmp 0x1000917c
mov dword [ebp - 0xa4], 0
jmp 0x100091be
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x100091da
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x1a0], 0x4cd45360
jmp 0x100091b1
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1a0], 1
jmp 0x10009208
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1a0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1a0], 0
jl 0x1000935d
mov dword [ebp - 0xe90], 0xc234ac01
mov dword [ebp - 0xe98], 0xfffffffc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp dword [ebp + eax*4 - 0xa58], 1
jg 0x10009253
mov dword [ebp - 0xa9c], 1
jmp 0x1000925a
and dword [ebp - 0xa9c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp dword [ebp - 0xa9c], eax
jle 0x1000927b
mov dword [ebp - 0xaa4], 1
jmp 0x10009282
and dword [ebp - 0xaa4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp dword [ebp - 0xaa4], eax
jne 0x100092a3
mov dword [ebp - 0x468], 1
jmp 0x100092aa
and dword [ebp - 0x468], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a0]
mov eax, dword [ebp + eax*4 - 0xa58]
imul eax, dword [ebp - 0x468]
mov ecx, 0x244d
sub ecx, eax
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x1a0]
jg 0x100092e7
mov dword [ebp - 0x9e8], 1
jmp 0x100092ee
and dword [ebp - 0x9e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a0]
mov eax, dword [ebp + eax*4 - 0xa58]
cmp dword [ebp - 0x9e8], eax
jl 0x10009316
mov dword [ebp - 0x470], 1
jmp 0x1000931d
and dword [ebp - 0x470], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a0]
mov eax, dword [ebp + eax*4 - 0xa58]
mov ecx, dword [ebp - 0x470]
lea eax, [eax + ecx + 0x83ac]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x1a0]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa58], eax
jmp 0x100091ed
mov dword [ebp - 0x924], 0xb72fd491
mov dword [ebp - 0x2a8], 0xffffffff
mov dword [ebp - 0x36c], 0xc5b641b4
mov dword [ebp - 0x368], 0xbc1b0fe2
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x3cc], 0xffffffff
mov dword [ebp - 0xb44], 0xd9f6c850
mov dword [ebp - 0xea0], 1
mov dword [ebp - 0x350], 0
jmp 0x100093c6
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 1
jge 0x100093df
mov eax, dword [ebp - 0x350]
mov dword [ebp + eax*4 - 0x74], 0xffffffff
jmp 0x100093b9
xor eax, eax
inc eax
je 0x100093fd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x74], 0
je 0x100093fd
mov dword [ebp - 0x9f0], 1
jmp 0x10009404
and dword [ebp - 0x9f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
add eax, dword [ebp - 0x9f0]
cmp eax, 6
jg 0x10009425
mov dword [ebp - 0x478], 1
jmp 0x1000942c
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0xea8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
mov dword [ebp - 0xeb0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
mov dword [ebp - 0x368], eax
mov eax, 0x6046e74a
test eax, eax
je 0x10009482
cmp dword [ebp - 0x368], 0
je 0x10009482
mov dword [ebp - 0x9f8], 1
jmp 0x10009489
and dword [ebp - 0x9f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
add eax, dword [ebp - 0x9f8]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x74]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x74]
jge 0x100094bc
mov dword [ebp - 0xa00], 1
jmp 0x100094c3
and dword [ebp - 0xa00], 0
cmp dword [ebp - 0xa00], 0x7e280bfe
jl 0x100094db
mov dword [ebp - 0x484], 1
jmp 0x100094e2
and dword [ebp - 0x484], 0
mov dword [ebp - 0x2a8], 0x196a
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x484]
jge 0x10009506
mov dword [ebp - 0x488], 1
jmp 0x1000950d
and dword [ebp - 0x488], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
cmp dword [ebp - 0x488], eax
jg 0x1000952b
mov dword [ebp - 0x490], 1
jmp 0x10009532
and dword [ebp - 0x490], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0x924]
cmp eax, dword [ebp - 0x490]
jl 0x1000955c
mov dword [ebp - 0x7a4], 1
jmp 0x10009563
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x84], 0
jmp 0x10009588
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jl 0x10009860
mov dword [ebp - 0xdc], 0x9a164e6
mov dword [ebp - 0x30c], 0x892657cf
mov dword [ebp - 0x3d4], 0x7420
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp + eax*4 - 0x74]
mov dword [ebp - 0xeb8], eax
mov eax, dword [ebp - 0x368]
sub eax, dword [ebp - 0xdc]
cmp eax, 0xc09c4f4
je 0x100095dd
cmp dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xec0], eax
cmp dword [ebp - 0x30c], 0xffffffff
je 0x100095fe
mov dword [ebp - 0x498], 1
jmp 0x10009605
and dword [ebp - 0x498], 0
imul eax, dword [ebp - 0x498], 0xfa23
cmp eax, 1
jbe 0x10009624
push 4
pop eax
test eax, eax
jne 0x10009624
and dword [ebp - 0xaa8], 0
jmp 0x1000962e
mov dword [ebp - 0xaa8], 1
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp + eax*4 - 0x74]
cmp dword [ebp - 0xaa8], eax
je 0x1000964c
mov dword [ebp - 0x4a0], 1
jmp 0x10009653
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
neg eax
cmp eax, 1
jl 0x1000966c
mov dword [ebp - 0x7ac], 1
jmp 0x10009673
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x7ac]
jg 0x10009693
cmp dword [ebp - 0x36c], 0
jne 0x10009693
and dword [ebp - 0x4a8], 0
jmp 0x1000969d
mov dword [ebp - 0x4a8], 1
mov eax, dword [ebp - 0x30c]
cmp dword [ebp - 0x4a8], eax
jl 0x100096b7
mov dword [ebp - 0x92c], 1
jmp 0x100096be
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0xc07e7f6f
ja 0x100096e2
mov dword [ebp - 0x4b0], 1
jmp 0x100096e9
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0xfffffff6
jg 0x100096fe
mov dword [ebp - 0x7b4], 1
jmp 0x10009705
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x7b4]
jle 0x1000971f
mov dword [ebp - 0xb34], 1
jmp 0x10009726
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xec8], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0xed0], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x3cc], eax
jge 0x10009764
mov dword [ebp - 0x4b8], 1
jmp 0x1000976b
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x4b8], eax
je 0x10009785
mov dword [ebp - 0xb3c], 1
jmp 0x1000978c
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0xf54], eax
cmp dword [ebp - 0x368], 0
jne 0x100097ac
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x74], 0
cmp dword [ebp - 0x30c], 0xf376
jg 0x100097c4
mov dword [ebp - 0x9ec], 1
jmp 0x100097cb
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp + eax*4 - 0x74]
imul eax, dword [ebp - 0x9ec]
test eax, eax
jne 0x100097f2
cmp dword [ebp - 0xdc], 0
jne 0x100097f2
and dword [ebp - 0x4c0], 0
jmp 0x100097fc
mov dword [ebp - 0x4c0], 1
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0xb44]
add eax, dword [ebp - 0x4c0]
cmp dword [ebp - 0x3d4], eax
je 0x10009829
mov dword [ebp - 0x7bc], 1
jmp 0x10009830
and dword [ebp - 0x7bc], 0
cmp dword [ebp - 0x7bc], 0x20822c3
jle 0x10009848
mov dword [ebp - 0x4c8], 1
jmp 0x1000984f
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x2a8], eax
jmp 0x1000957b
mov dword [ebp - 0x2b0], 0x5020f89b
mov dword [ebp - 0x7c4], 0xb40e11a7
mov dword [ebp - 0xb4], 1
mov dword [ebp - 0x10c0], 0xcbedfa90
mov dword [ebp - 0x10bc], 0xcbedfa90
mov dword [ebp - 0x10b8], 0xcbedfa90
mov dword [ebp - 0x10b4], 0xcbedfa90
mov dword [ebp - 0x220], 0
jmp 0x100098bf
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jge 0x100098db
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0x41c], 0x5f70
jmp 0x100098b2
mov dword [ebp - 0x2b0], 1
jmp 0x100098f4
mov eax, dword [ebp - 0x2b0]
dec eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0
jl 0x10009c44
mov dword [ebp - 0x158], 0x52c58fb7
mov dword [ebp - 0xf5c], 8
mov dword [ebp - 0xb4c], 0x88acc167
mov dword [ebp - 0x93c], 7
mov dword [ebp - 0x228], 0
jmp 0x10009942
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x1000995e
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x1164], 0xdaf0b56f
jmp 0x10009935
mov dword [ebp - 0x158], 1
jmp 0x10009977
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x10009c32
mov dword [ebp - 0x188], 0x62ee6d05
mov dword [ebp - 0xb54], 7
mov dword [ebp - 0x188], 1
jmp 0x100099b1
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x10009bff
mov dword [ebp - 0xf64], 0xa2e712c5
mov dword [ebp - 0xf6c], 0xffffffff
mov dword [ebp - 0xf74], 9
mov dword [ebp - 0xf7c], 0x550e8f7c
mov dword [ebp - 0xf84], 0x97cbb402
mov dword [ebp - 0x4e8], 0xb6062cf9
mov dword [ebp - 0x2b8], 0
jmp 0x10009a13
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x10009a2f
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0x450], 6
jmp 0x10009a06
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x450], 0
jmp 0x10009a5d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x450]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x450], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x450], 1
jg 0x10009bec
mov dword [ebp - 0xf8c], 1
mov dword [ebp - 0x1014], 0x334adc6f
mov eax, dword [ebp - 0x188]
mov eax, dword [ebp + eax*4 - 0x41c]
mov dword [ebp - 0x101c], eax
mov eax, dword [ebp - 0x188]
mov eax, dword [ebp + eax*4 - 0x41c]
mov dword [ebp - 0x1024], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x450], 0
jne 0x10009af8
cmp dword [ebp - 0x158], 0
jne 0x10009ad0
mov dword [ebp - 0x934], 1
jmp 0x10009ad7
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x934]
add eax, 8
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x450]
jle 0x10009af8
and dword [ebp - 0x4d0], 0
jmp 0x10009b02
mov dword [ebp - 0x4d0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x450]
mov eax, dword [ebp + eax*4 - 0x41c]
imul eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x7c4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x450]
mov eax, dword [ebp + eax*4 - 0x41c]
cmp eax, dword [ebp - 0x7c4]
jne 0x10009b4b
mov dword [ebp - 0x4d8], 1
jmp 0x10009b52
and dword [ebp - 0x4d8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4d8]
sub ecx, dword [ebp + eax - 0x41c]
jne 0x10009b79
cmp dword [ebp - 0x158], 0
jne 0x10009b79
and dword [ebp - 0xa50], 0
jmp 0x10009b83
mov dword [ebp - 0xa50], 1
cmp dword [ebp - 0xa50], 0xfffffff7
jl 0x10009b98
mov dword [ebp - 0x4e0], 1
jmp 0x10009b9f
and dword [ebp - 0x4e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x450]
mov eax, dword [ebp + eax*4 - 0x41c]
cmp dword [ebp - 0x4e0], eax
jl 0x10009bc7
mov dword [ebp - 0x7cc], 1
jmp 0x10009bce
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x4e8]
dec eax
mov dword [ebp - 0x4e8], eax
jmp 0x10009a42
cmp dword [ebp - 0xb4c], 0
je 0x10009bfa
jmp 0x100099a4
jmp 0x100099a4
mov dword [ebp - 0xb4], 0
jmp 0x10009c18
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jg 0x10009c2d
mov dword [ebp - 0xb54], 0xc7e7c0ce
jmp 0x10009c0b
jmp 0x1000996a
mov eax, dword [ebp - 0x93c]
inc eax
mov dword [ebp - 0x93c], eax
jmp 0x100098e7
mov dword [ebp - 0xb4], 0xffffffef
jmp 0x10009c5d
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xc
jg 0x10009c7c
mov dword [ebp - 0xb5c], 0
mov dword [ebp - 0xb5c], 0xae0512ed
jmp 0x10009c50
mov dword [ebp - 0x102c], 0x722a
mov dword [ebp - 0x4c], 0x971c1ec2
mov dword [ebp - 0x3dc], 6
mov dword [ebp - 0x230], 0
jmp 0x10009cb0
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x10009ccc
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x178], 0x91a049fe
jmp 0x10009ca3
mov dword [ebp - 0x4c], 0
jmp 0x10009cdc
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10009f22
mov dword [ebp - 0x2c0], 0xffff
cmp dword [ebp - 0x4c], 0
jg 0x10009d02
mov dword [ebp - 0x4f0], 1
jmp 0x10009d09
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x4f0]
imul eax, dword [ebp - 0x4c]
cmp eax, 0x237f4a7d
jl 0x10009d29
mov dword [ebp - 0x7d4], 1
jmp 0x10009d30
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x7d4], eax
jge 0x10009d4a
mov dword [ebp - 0x4f8], 1
jmp 0x10009d51
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4f8]
jg 0x10009d68
mov dword [ebp - 0x9f4], 1
jmp 0x10009d6f
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x9f4]
add eax, 0x8576
cmp eax, 0xec0dcee
jne 0x10009d96
cmp dword [ebp - 0x3dc], 0
je 0x10009d96
mov dword [ebp - 0x500], 1
jmp 0x10009d9d
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0
ja 0x10009dbb
cmp dword [ebp - 0x2c0], 0
je 0x10009dbb
mov dword [ebp - 0xb64], 1
jmp 0x10009dc2
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x178]
mov dword [ebp - 0x1034], eax
xor eax, eax
inc eax
jne 0x10009de0
cmp dword [ebp - 0x3dc], 0
je 0x10009de9
cmp dword [ebp - 0x2c0], 0
jne 0x10009e02
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x178], 0
jne 0x10009e02
and dword [ebp - 0x7dc], 0
jmp 0x10009e0c
mov dword [ebp - 0x7dc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
cmp eax, dword [ebp - 0x7dc]
jne 0x10009e2d
mov dword [ebp - 0x508], 1
jmp 0x10009e34
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 1
jbe 0x10009e49
mov dword [ebp - 0x944], 1
jmp 0x10009e50
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x178]
cmp eax, dword [ebp - 0x944]
jge 0x10009e6e
mov dword [ebp - 0x510], 1
jmp 0x10009e75
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x2c0]
imul eax, dword [ebp - 0x510]
cmp eax, 0xfffffff9
jge 0x10009e99
cmp dword [ebp - 0x3dc], 0
jne 0x10009e99
and dword [ebp - 0x7e4], 0
jmp 0x10009ea3
mov dword [ebp - 0x7e4], 1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x7e4], eax
jl 0x10009eba
mov dword [ebp - 0x518], 1
jmp 0x10009ec1
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x518], eax
jle 0x10009ed8
mov dword [ebp - 0xa88], 1
jmp 0x10009edf
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x178]
sub eax, dword [ebp - 0xa88]
je 0x10009f06
mov eax, 0xe10e
test eax, eax
je 0x10009f06
mov dword [ebp - 0x520], 1
jmp 0x10009f0d
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x520]
mov dword [ebp + eax*4 - 0x178], ecx
jmp 0x10009cd5
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x10009f4f
push 0xe96
push 0x42
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0xa8], 0
jmp 0x10009f68
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x10009f84
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xa64], 9
jmp 0x10009f5b
mov dword [ebp - 0x160], 0xb7c7ce53
mov dword [ebp - 0xe4], 1
mov dword [ebp - 0x103c], 0xfffffffd
mov dword [ebp - 0x1044], 3
mov dword [ebp - 0x104c], 0xffffffff
mov dword [ebp - 0x1054], 0xfffffffe
mov dword [ebp - 0xb7c], 0x40b319b
mov dword [ebp - 0x105c], 1
mov dword [ebp - 0x238], 0
jmp 0x10009fed
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x1000a009
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xc70], 0xffff
jmp 0x10009fe0
mov dword [ebp - 0x160], 0
jmp 0x1000a022
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 2
jg 0x1000a3ab
mov dword [ebp - 0x9c], 0xffffffff
mov dword [ebp - 0x528], 0xee491ba6
mov dword [ebp - 0xb6c], 0x32d38ca8
mov dword [ebp - 0x1064], 1
mov dword [ebp - 0x10d4], 4
mov dword [ebp - 0x10d0], 4
mov dword [ebp - 0x10cc], 4
mov dword [ebp - 0x10c8], 4
mov dword [ebp - 0x106c], 0xd1b4
mov dword [ebp - 0x1074], 0xfffffffd
mov dword [ebp - 0x2c8], 0
jmp 0x1000a0ac
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jge 0x1000a0c8
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0xb74], 0
jmp 0x1000a09f
mov dword [ebp - 0x9c], 2
jmp 0x1000a0e1
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x1000a371
mov dword [ebp - 0x107c], 0xffffffff
mov dword [ebp - 0x1084], 0x50fa8fad
mov dword [ebp - 0x108c], 0xfffffff7
mov dword [ebp - 0x1094], 0x5ef13550
mov dword [ebp - 0xb8], 0
jmp 0x1000a12f
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 4
jge 0x1000a14b
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x12a0], 0x253d9751
jmp 0x1000a122
mov dword [ebp - 0xb8], 0
jmp 0x1000a164
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1000a180
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xf9c], 0xbf68
jmp 0x1000a157
mov eax, dword [ebp - 0x9c]
cmp dword [ebp + eax*4 - 0xc70], 0
je 0x1000a294
mov eax, dword [ebp - 0x160]
cmp dword [ebp + eax*4 - 0xc70], 0xd271
je 0x1000a1b3
mov dword [ebp - 0x7ec], 1
jmp 0x1000a1ba
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0x528]
mov ecx, dword [ebp - 0x9c]
imul eax, dword [ebp + ecx*4 - 0xc70]
cmp eax, 0x1c5a3d7f
jg 0x1000a1ed
mov dword [ebp - 0x94c], 1
jmp 0x1000a1f4
and dword [ebp - 0x94c], 0
cmp dword [ebp - 0x94c], 0xffffffff
jle 0x1000a209
mov dword [ebp - 0x530], 1
jmp 0x1000a210
and dword [ebp - 0x530], 0
imul eax, dword [ebp - 0x530], 0
cmp eax, 0xc821
jg 0x1000a22a
mov dword [ebp - 0x7f4], 1
jmp 0x1000a231
and dword [ebp - 0x7f4], 0
cmp dword [ebp - 0x7f4], 0
jge 0x1000a246
mov dword [ebp - 0x538], 1
jmp 0x1000a24d
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x538], eax
jge 0x1000a26c
or eax, 0xffffffff
je 0x1000a26c
mov dword [ebp - 0x9fc], 1
jmp 0x1000a273
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
je 0x1000a294
mov dword [ebp - 0x540], 1
jmp 0x1000a29b
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x540], eax
jle 0x1000a2b5
mov dword [ebp - 0x7fc], 1
jmp 0x1000a2bc
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x7fc], eax
je 0x1000a2d6
mov dword [ebp - 0x548], 1
jmp 0x1000a2dd
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp + eax*4 - 0xc70]
cmp dword [ebp - 0x548], eax
jle 0x1000a2fe
mov dword [ebp - 0x954], 1
jmp 0x1000a305
and dword [ebp - 0x954], 0
cmp dword [ebp - 0x954], 0
jne 0x1000a31a
mov dword [ebp - 0x550], 1
jmp 0x1000a321
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
shl eax, 2
cmp eax, dword [ebp - 0x9c]
je 0x1000a33e
mov dword [ebp - 0x804], 1
jmp 0x1000a345
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0xb6c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf9c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf9c], eax
jmp 0x1000a0d4
mov dword [ebp - 0xe4], 0
jmp 0x1000a38a
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x1000a3a6
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0xb74], 8
jmp 0x1000a37d
jmp 0x1000a015
mov dword [ebp - 0xb7c], 0xffffffff
mov dword [ebp - 0xa8], 0
jmp 0x1000a3ce
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1000a3ea
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x190], 0x4cd45360
jmp 0x1000a3c1
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x190], 1
jmp 0x1000a418
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x190], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x190], 0
jl 0x1000a83d
mov dword [ebp - 0x109c], 0xc234ac01
mov dword [ebp - 0x10a4], 0xfffffffc
mov dword [ebp - 0xc58], 0x6f2e
mov dword [ebp - 0xc54], 0x6f2e
mov dword [ebp - 0xc50], 0x6f2e
mov dword [ebp - 0xc4c], 0x6f2e
mov dword [ebp - 0x90], 0x46158d32
mov dword [ebp - 0x570], 0xc6a3f154
mov dword [ebp - 0xd28], 0
mov dword [ebp - 0xd24], 0
mov dword [ebp - 0xd20], 0
mov dword [ebp - 0xd1c], 0
mov dword [ebp - 0xac], 0
jmp 0x1000a4bd
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 4
jge 0x1000a4d9
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x10e8], 0x9a20b287
jmp 0x1000a4b0
mov dword [ebp - 0xac], 0
jmp 0x1000a4f2
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x1000a50e
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x1108], 0xb40e11a7
jmp 0x1000a4e5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc58]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xcd43
jl 0x1000a539
mov dword [ebp - 0x558], 1
jmp 0x1000a540
and dword [ebp - 0x558], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc58]
cmp eax, dword [ebp - 0x558]
jne 0x1000a561
mov dword [ebp - 0xbe0], 1
jmp 0x1000a568
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x10ac], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x10e8], 0x58905b8b
jg 0x1000a593
mov dword [ebp - 0xa5c], 1
jmp 0x1000a59a
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0xa5c], eax
jl 0x1000a5b4
mov dword [ebp - 0x560], 1
jmp 0x1000a5bb
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x560]
jle 0x1000a5d5
mov dword [ebp - 0x3e4], 1
jmp 0x1000a5dc
and dword [ebp - 0x3e4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp + eax - 0x1108], ecx
cmp dword [ebp - 0x3e4], 0
jne 0x1000a608
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1000a608
and dword [ebp - 0x80c], 0
jmp 0x1000a612
mov dword [ebp - 0x80c], 1
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x80c]
cmp eax, dword [ebp - 0x90]
je 0x1000a633
mov dword [ebp - 0x568], 1
jmp 0x1000a63a
and dword [ebp - 0x568], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xc58]
cmp dword [ebp - 0x568], eax
jne 0x1000a65b
mov dword [ebp - 0x95c], 1
jmp 0x1000a662
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x95c]
add eax, 0xffff
imul eax, dword [ebp - 0x570]
cmp eax, dword [ebp - 0x570]
je 0x1000a688
mov dword [ebp - 0x814], 1
jmp 0x1000a68f
and dword [ebp - 0x814], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x10e8]
cmp dword [ebp - 0x814], eax
jg 0x1000a6b0
mov dword [ebp - 0x578], 1
jmp 0x1000a6b7
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x578], eax
jle 0x1000a6ea
mov eax, 0x34adc6f7
test eax, eax
je 0x1000a6ea
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x10e8], 0
je 0x1000a6ea
mov dword [ebp - 0xa04], 1
jmp 0x1000a6f1
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0x90], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x90]
mov dword [ebp + eax - 0xd28], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp + eax*4 - 0xa64], 1
jg 0x1000a733
mov dword [ebp - 0x580], 1
jmp 0x1000a73a
and dword [ebp - 0x580], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp - 0x580], eax
jle 0x1000a75b
mov dword [ebp - 0x81c], 1
jmp 0x1000a762
and dword [ebp - 0x81c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp - 0x81c], eax
jne 0x1000a783
mov dword [ebp - 0x588], 1
jmp 0x1000a78a
and dword [ebp - 0x588], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
mov eax, dword [ebp + eax*4 - 0xa64]
imul eax, dword [ebp - 0x588]
mov ecx, 0x244d
sub ecx, eax
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x190]
jg 0x1000a7c7
mov dword [ebp - 0x964], 1
jmp 0x1000a7ce
and dword [ebp - 0x964], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
mov eax, dword [ebp + eax*4 - 0xa64]
cmp dword [ebp - 0x964], eax
jl 0x1000a7f6
mov dword [ebp - 0x590], 1
jmp 0x1000a7fd
and dword [ebp - 0x590], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
mov eax, dword [ebp + eax*4 - 0xa64]
mov ecx, dword [ebp - 0x590]
lea eax, [eax + ecx + 0x83ac]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x190]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa64], eax
jmp 0x1000a3fd
mov dword [ebp - 0x2d0], 5
mov dword [ebp - 0x240], 0
jmp 0x1000a860
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 4
jge 0x1000a87c
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x119c], 0x9841
jmp 0x1000a853
mov dword [ebp - 0x2d0], 3
jmp 0x1000a895
mov eax, dword [ebp - 0x2d0]
dec eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0
jl 0x1000a914
mov dword [ebp - 0x1ec], 0xbb6748f6
mov dword [ebp - 0x1ec], 0
jmp 0x1000a8c1
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 4
jge 0x1000a8dd
mov eax, dword [ebp - 0x1ec]
mov dword [ebp + eax*4 - 0x119c], 0x7fd1
jmp 0x1000a8b4
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1000a90f
push 0
push 0x2518
push 0xd78
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
jmp 0x1000a888
mov dword [ebp - 0x2d8], 5
mov dword [ebp - 0x248], 0
jmp 0x1000a937
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 4
jge 0x1000a953
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x11bc], 0x9841
jmp 0x1000a92a
mov dword [ebp - 0x2d8], 3
jmp 0x1000a96c
mov eax, dword [ebp - 0x2d8]
dec eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0
jl 0x1000a9eb
mov dword [ebp - 0x1b0], 0xbb6748f6
mov dword [ebp - 0x1b0], 0
jmp 0x1000a998
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 4
jge 0x1000a9b4
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x11bc], 0x7fd1
jmp 0x1000a98b
mov byte [ebp - 0x143], 0
movzx eax, byte [ebp - 0x143]
test eax, eax
je 0x1000a9e6
push 0
push 0x2518
push 0xd78
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
jmp 0x1000a95f
mov dword [ebp - 0xd44], 3
mov dword [ebp - 0x24], 0
jmp 0x1000aa05
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000aa1b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x10c4], 0x8eac8b13
jmp 0x1000a9fe
mov dword [ebp - 0x24], 0
jmp 0x1000aa2b
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000aa41
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x250], 0x3fcb50bf
jmp 0x1000aa24
mov dword [ebp - 0x24], 0
jmp 0x1000aa51
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000aa67
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd4c], 0x29729cf3
jmp 0x1000aa4a
mov dword [ebp - 0x24], 0
jmp 0x1000aa77
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000aa8d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1204], 0xf63588c5
jmp 0x1000aa70
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1000aab0
push 0x651
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x250], 0
jmp 0x1000aade
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x250]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x250], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x250], 0
jl 0x1000ac0b
mov dword [ebp - 0x1d4], 0x2a1e
mov dword [ebp - 0xf38], 5
mov dword [ebp - 0xd54], 0x1dfd9475
mov dword [ebp - 0x1030], 1
mov dword [ebp - 0xd5c], 0xa3735b26
mov dword [ebp - 0xf40], 0
mov dword [ebp - 0xd64], 1
mov dword [ebp - 0x1080], 0x956e74e8
mov dword [ebp - 0xd6c], 0xe043eef7
mov dword [ebp - 0x2e0], 0
jmp 0x1000ab65
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 2
jge 0x1000ab81
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0x117c], 0xfffffffb
jmp 0x1000ab58
cmp dword [ebp - 0x1d4], 0
je 0x1000ab8c
jmp 0x1000ac0b
mov dword [ebp - 0x1d4], 0
jmp 0x1000aba5
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jg 0x1000ac06
mov dword [ebp - 0xf48], 0
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x258], 0
jmp 0x1000abdb
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 4
jge 0x1000abf7
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x1280], 7
jmp 0x1000abce
mov eax, dword [ebp - 0x824]
inc eax
mov dword [ebp - 0x824], eax
jmp 0x1000ab98
jmp 0x1000aac3
mov dword [ebp - 0x184], 0x87013dce
mov dword [ebp - 0xbe8], 0xe2b7
mov dword [ebp - 0xaa0], 1
mov dword [ebp - 0x5c], 0
jmp 0x1000ac39
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1000ac4f
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xcf8], 0x7f825e7a
jmp 0x1000ac32
mov dword [ebp - 0x5c], 0
jmp 0x1000ac5f
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1000ac75
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x260], 0x2a83
jmp 0x1000ac58
mov dword [ebp - 0x5c], 0
jmp 0x1000ac85
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x1000ac9b
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xcb0], 1
jmp 0x1000ac7e
mov dword [ebp - 0x184], 0
jmp 0x1000acb4
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jg 0x1000adae
mov dword [ebp - 0x1b4], 0xffffffff
mov dword [ebp - 0xd74], 1
mov dword [ebp - 0x1038], 0xfffffff6
mov dword [ebp - 0xd7c], 0xfffffffa
mov dword [ebp - 0x2e8], 0
jmp 0x1000ad02
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 4
jge 0x1000ad1e
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0x1260], 0xffffffff
jmp 0x1000acf5
mov dword [ebp - 0x1b4], 2
jmp 0x1000ad37
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jl 0x1000ad8e
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x1000ad7a
push 0
push 0xfdb
push 0x440
push 0x197a
push 0x20ee
push 0x1096
push 0x1478
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp + eax*4 - 0xcf8], 0
je 0x1000ad8c
jmp 0x1000ad2a
jmp 0x1000ad2a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x260], eax
jmp 0x1000aca7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
mov dword [ebp - 0x598], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x598]
mov dword [ebp + eax - 0xcb0], ecx
mov eax, dword [ebp - 0xbe8]
cmp eax, dword [ebp - 0x598]
je 0x1000adee
mov dword [ebp - 0x5a0], 1
jmp 0x1000adf5
and dword [ebp - 0x5a0], 0
mov dword [ebp - 0xaa0], 0xffff
mov eax, dword [ebp - 0xaa0]
imul eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x5a0]
sub ecx, eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xcf8], ecx
jg 0x1000ae2e
mov dword [ebp - 0xbf0], 1
jmp 0x1000ae35
and dword [ebp - 0xbf0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
mov dword [ebp - 0xf50], eax
mov eax, dword [ebp - 0x184]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0xcb0]
jne 0x1000ae6f
mov eax, 0x84365721
test eax, eax
jne 0x1000ae6f
and dword [ebp - 0x82c], 0
jmp 0x1000ae79
mov dword [ebp - 0x82c], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x82c]
mov dword [ebp + eax - 0xcf8], ecx
mov dword [ebp - 0x2f0], 0
jmp 0x1000aea4
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 1
jge 0x1000aec0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x1d0], 0x8c6a53d0
jmp 0x1000ae97
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1d0], 0
jmp 0x1000aeee
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1d0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d0], 0xfffffff7
jg 0x1000afd7
mov dword [ebp - 0x5a8], 0
mov dword [ebp - 0x3ec], 0xe9fb1c03
mov dword [ebp - 0xa0c], 0xd9d75405
mov eax, dword [ebp - 0x3ec]
neg eax
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0xa0c]
sub eax, 0x61fc2da8
cmp dword [ebp - 0x3ec], eax
jg 0x1000af4d
mov dword [ebp - 0x96c], 1
jmp 0x1000af54
and dword [ebp - 0x96c], 0
mov dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
cmp eax, dword [ebp - 0x96c]
jge 0x1000af78
mov dword [ebp - 0x5b0], 1
jmp 0x1000af7f
and dword [ebp - 0x5b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d0]
cmp eax, dword [ebp - 0x5b0]
jg 0x1000afa0
mov dword [ebp - 0x834], 1
jmp 0x1000afa7
and dword [ebp - 0x834], 0
cmp dword [ebp - 0x834], 0x1f78
jge 0x1000afbf
mov dword [ebp - 0x5b8], 1
jmp 0x1000afc6
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0xa0c], eax
jmp 0x1000aed3
mov dword [ebp - 0x2f8], 5
mov dword [ebp - 0x268], 0
jmp 0x1000affa
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 4
jge 0x1000b016
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0x11d4], 0x9841
jmp 0x1000afed
mov dword [ebp - 0x2f8], 3
jmp 0x1000b02f
mov eax, dword [ebp - 0x2f8]
dec eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0
jl 0x1000b0ae
mov dword [ebp - 0x1b8], 0xbb6748f6
mov dword [ebp - 0x1b8], 0
jmp 0x1000b05b
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 4
jge 0x1000b077
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x11d4], 0x7fd1
jmp 0x1000b04e
mov byte [ebp - 0x147], 0
movzx eax, byte [ebp - 0x147]
test eax, eax
je 0x1000b0a9
push 0
push 0x2518
push 0xd78
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
jmp 0x1000b022
mov dword [ebp - 0xec], 0x4cd4536
mov dword [ebp - 0xc00], 5
mov dword [ebp - 0x270], 0
jmp 0x1000b0db
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 2
jge 0x1000b0f7
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x374], 8
jmp 0x1000b0ce
mov dword [ebp - 0xec], 1
jmp 0x1000b110
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x1000b497
mov dword [ebp - 0x278], 0x3314648a
mov dword [ebp - 0x300], 0
jmp 0x1000b140
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 3
jge 0x1000b15c
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0x204], 0x98311173
jmp 0x1000b133
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x1000b18e
push 0
push 0x91b
push 0x22f7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x204], 0
jmp 0x1000b1bc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x204]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x204], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x204], 1
jg 0x1000b492
mov dword [ebp - 0xa68], 0xfffffff6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x204]
mov eax, dword [ebp + eax*4 - 0x374]
mov dword [ebp - 0xd84], eax
mov dword [ebp - 0xa68], 0xfffffffd
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x374]
mov dword [ebp - 0x10a8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x204]
mov dword [ebp - 0xd8c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x204]
cmp dword [ebp + eax - 0x204], ecx
jge 0x1000b24c
mov dword [ebp - 0x5c0], 1
jmp 0x1000b253
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x5c0]
inc eax
cmp eax, 0x62a04f77
jne 0x1000b26d
mov dword [ebp - 0x83c], 1
jmp 0x1000b274
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x83c]
inc eax
cmp eax, 0xb818f8f6
je 0x1000b28e
mov dword [ebp - 0x5c8], 1
jmp 0x1000b295
and dword [ebp - 0x5c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x204]
mov eax, dword [ebp + eax*4 - 0x374]
add eax, dword [ebp - 0x5c8]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x204]
jg 0x1000b2ca
mov dword [ebp - 0x974], 1
jmp 0x1000b2d1
and dword [ebp - 0x974], 0
cmp dword [ebp - 0x974], 0xfff9
jbe 0x1000b2e9
mov dword [ebp - 0x5d0], 1
jmp 0x1000b2f0
and dword [ebp - 0x5d0], 0
cmp dword [ebp - 0x5d0], 1
jae 0x1000b305
mov dword [ebp - 0x844], 1
jmp 0x1000b30c
and dword [ebp - 0x844], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x204]
imul eax, dword [ebp - 0x844]
cmp eax, 1
je 0x1000b331
mov dword [ebp - 0x5d8], 1
jmp 0x1000b338
and dword [ebp - 0x5d8], 0
imul eax, dword [ebp - 0x5d8], 5
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x204]
imul eax, dword [ebp + ecx*4 - 0x374]
test eax, eax
jne 0x1000b36a
cmp dword [ebp - 0xa68], 0
jne 0x1000b36a
and dword [ebp - 0x5e0], 0
jmp 0x1000b374
mov dword [ebp - 0x5e0], 1
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x5e0], eax
jl 0x1000b38e
mov dword [ebp - 0x84c], 1
jmp 0x1000b395
and dword [ebp - 0x84c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x204]
cmp dword [ebp - 0x84c], eax
jl 0x1000b3b6
mov dword [ebp - 0xbf8], 1
jmp 0x1000b3bd
and dword [ebp - 0xbf8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x374]
mov dword [ebp - 0xf58], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x204]
cmp dword [ebp + eax - 0x374], ecx
jl 0x1000b3f7
mov dword [ebp - 0x5e8], 1
jmp 0x1000b3fe
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
je 0x1000b41a
cmp dword [ebp - 0x278], 0
mov eax, 0x4254
test eax, eax
jne 0x1000b431
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x374], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x204]
mov eax, dword [ebp + eax*4 - 0x374]
mov dword [ebp - 0xd94], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1040], eax
cmp dword [ebp - 0xec], 0xffffffff
je 0x1000b46c
mov dword [ebp - 0x97c], 1
jmp 0x1000b473
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0xc00], eax
cmp dword [ebp - 0x278], 0
je 0x1000b48d
jmp 0x1000b1a1
jmp 0x1000b1a1
jmp 0x1000b103
mov dword [ebp - 0xd9c], 3
mov dword [ebp - 0x1c], 0
jmp 0x1000b4b1
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000b4c7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf60], 0x8eac8b13
jmp 0x1000b4aa
mov dword [ebp - 0x1c], 0
jmp 0x1000b4d7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000b4ed
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x308], 0x3fcb50bf
jmp 0x1000b4d0
mov dword [ebp - 0x1c], 0
jmp 0x1000b4fd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1000b513
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xda4], 0x29729cf3
jmp 0x1000b4f6
mov dword [ebp - 0x1c], 0
jmp 0x1000b523
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1000b539
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1210], 0xf63588c5
jmp 0x1000b51c
mov byte [ebp - 0xd0], 0
movzx eax, byte [ebp - 0xd0]
test eax, eax
je 0x1000b55c
push 0x651
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x308], 0
jmp 0x1000b58a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x308]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x308], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x308], 0
jl 0x1000b6b7
mov dword [ebp - 0x1e0], 0x2a1e
mov dword [ebp - 0x1088], 5
mov dword [ebp - 0xdac], 0x1dfd9475
mov dword [ebp - 0xf68], 1
mov dword [ebp - 0xdb4], 0xa3735b26
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0xdbc], 1
mov dword [ebp - 0xf70], 0x956e74e8
mov dword [ebp - 0xdc4], 0xe043eef7
mov dword [ebp - 0x280], 0
jmp 0x1000b611
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 2
jge 0x1000b62d
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0x11dc], 0xfffffffb
jmp 0x1000b604
cmp dword [ebp - 0x1e0], 0
je 0x1000b638
jmp 0x1000b6b7
mov dword [ebp - 0x1e0], 0
jmp 0x1000b651
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jg 0x1000b6b2
mov dword [ebp - 0x10ec], 0
mov dword [ebp - 0x5f0], 0
mov dword [ebp - 0x310], 0
jmp 0x1000b687
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 4
jge 0x1000b6a3
mov eax, dword [ebp - 0x310]
mov dword [ebp + eax*4 - 0x1270], 7
jmp 0x1000b67a
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
jmp 0x1000b644
jmp 0x1000b56f
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x5f8], 0x7e71f09a
mov dword [ebp - 0xc10], 7
mov dword [ebp - 0x168], 0x13
jmp 0x1000b6ee
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffe7
je 0x1000b880
mov dword [ebp - 0xf4], 0xfffffffc
mov dword [ebp - 0xa14], 1
mov dword [ebp - 0x288], 0
jmp 0x1000b728
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jge 0x1000b744
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0xb88], 0xe6e3245f
jmp 0x1000b71b
mov dword [ebp - 0xf4], 0
jmp 0x1000b75d
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jg 0x1000b7c7
mov dword [ebp - 0xc08], 1
mov eax, dword [ebp - 0xf4]
cmp dword [ebp + eax*4 - 0xb88], 0
je 0x1000b795
mov eax, 0xf147909b
test eax, eax
je 0x1000b795
mov dword [ebp - 0x854], 1
jmp 0x1000b79c
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0xc08], eax
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x1000b7c5
push 0x211d
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x1000b750
mov dword [ebp - 0x5f8], 0xffffffff
mov eax, dword [ebp - 0xc10]
cmp dword [ebp - 0x5f8], eax
jge 0x1000b7eb
mov dword [ebp - 0xc18], 1
jmp 0x1000b7f2
and dword [ebp - 0xc18], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xdcc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb88]
mov dword [ebp - 0xf78], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xdd4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa14]
cmp dword [ebp + eax - 0xb88], ecx
jge 0x1000b844
cmp dword [ebp - 0xa14], 0
jne 0x1000b844
and dword [ebp - 0x600], 0
jmp 0x1000b84e
mov dword [ebp - 0x600], 1
mov eax, dword [ebp - 0x600]
sub eax, dword [ebp - 0x168]
jne 0x1000b868
mov dword [ebp - 0x85c], 1
jmp 0x1000b86f
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0xf4], eax
jmp 0x1000b6e1
mov dword [ebp - 0x6c], 0xfffffffe
mov dword [ebp - 0x86c], 0x1af6658d
mov dword [ebp - 0xc28], 0xfffffffe
mov dword [ebp - 0x630], 0x4415e40c
mov dword [ebp - 0x6c], 0
jmp 0x1000b8b5
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xfffffff2
jge 0x1000b8f8
mov dword [ebp - 0xc20], 0xffffffff
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x1000b8eb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
cmp dword [ebp - 0xc20], 0
je 0x1000b8f6
jmp 0x1000b8ae
jmp 0x1000b8ae
mov dword [ebp - 0x6c], 0xffffffe8
jmp 0x1000b908
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xffffffea
jge 0x1000bb67
mov dword [ebp - 0x318], 0x887cf2e5
mov dword [ebp - 0x3f4], 0x5e04a276
mov dword [ebp - 0x318], 0
jmp 0x1000b93f
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0xc
jne 0x1000bb62
mov dword [ebp - 0xc88], 0x2df3d37a
mov dword [ebp - 0xc84], 0x2df3d37a
mov dword [ebp - 0xc80], 0x2df3d37a
mov dword [ebp - 0xc7c], 0x2df3d37a
mov dword [ebp - 0x608], 0x7276cc72
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0xc88], 0x5fe4
test eax, eax
je 0x1000bb52
mov dword [ebp - 0x1c0], 0xccc89593
mov dword [ebp - 0x1c0], 0xa
jmp 0x1000b9ba
cmp dword [ebp - 0x1c0], 6
jl 0x1000bb50
mov dword [ebp - 0x1d8], 0x7855
cmp dword [ebp - 0x1d8], 0
je 0x1000b9df
jmp 0x1000bb50
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc88]
cmp dword [ebp - 0x1d8], eax
jl 0x1000ba00
mov dword [ebp - 0x864], 1
jmp 0x1000ba07
and dword [ebp - 0x864], 0
mov dword [ebp - 0x608], 1
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x1050], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xddc], eax
push 3
pop eax
cmp eax, 0xfffd
jb 0x1000ba45
cmp dword [ebp - 0x1d8], 0
je 0x1000ba45
mov dword [ebp - 0x984], 1
jmp 0x1000ba4c
and dword [ebp - 0x984], 0
cmp dword [ebp - 0x984], 0xa012
jge 0x1000ba64
mov dword [ebp - 0x610], 1
jmp 0x1000ba6b
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x610], eax
jl 0x1000ba82
jmp 0x1000bb5d
cmp dword [ebp - 0x630], 0
je 0x1000bb5d
jmp 0x1000bb62
jmp 0x1000b932
jmp 0x1000b901
movzx eax, byte [0x10667854]
test eax, eax
je 0x1000bb85
mov esi, 0x1007b834
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10011106
mov dword [ebp - 0x320], 1
mov dword [ebp - 0x290], 0
jmp 0x1000bba8
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 2
jge 0x1000bbc4
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0x118c], 0x1713
jmp 0x1000bb9b
mov dword [ebp - 0x320], 0
jmp 0x1000bbdd
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 1
jg 0x1000bc12
mov dword [ebp - 0x874], 0x7e55
mov dword [ebp - 0xc30], 6
mov dword [ebp - 0x874], 0x83846275
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0xc30], eax
jmp 0x1000bbd0
mov dword [ebp - 0xfc], 0x4cd4536
mov dword [ebp - 0xbf4], 5
mov dword [ebp - 0x298], 0
jmp 0x1000bc3f
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 2
jge 0x1000bc5b
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0x37c], 8
jmp 0x1000bc32
mov dword [ebp - 0xfc], 1
jmp 0x1000bc74
cmp dword [ebp - 0xfc], 0
jl 0x1000bffb
mov dword [ebp - 0x330], 0x3314648a
mov dword [ebp - 0x328], 0
jmp 0x1000bca4
mov dword [ebp - 0x1058], 3
mov dword [ebp - 0x10], 0
jmp 0x1000c015
pop edi
pop esi
mov esp, ebp
pop ebp
ret