Function at 0x10008eac
Capabilities:
Get file attributes
Get session user name
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100844f4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x183c
call fcn.10080620
push esi
push edi
push 3
lea ecx, [ebp - 0x480]
call fcn.1001add3
and dword [ebp - 4], 0
push 2
lea ecx, [ebp - 0xf44]
call fcn.1001add3
mov byte [ebp - 4], 1
mov dword [ebp - 0x10c8], 0xffffffff
mov dword [ebp - 0x16d8], 0xe617092f
mov dword [ebp - 0xb60], 0x9d0615a0
mov dword [ebp - 0x16b8], 0x33e270b
mov dword [ebp - 0x10d0], 0
mov dword [ebp - 0x1588], 0xdcedb1a7
mov dword [ebp - 0x16c0], 0xfffffff8
mov dword [ebp - 0x494], 0xfffffffa
mov dword [ebp - 0x60], 0
jmp 0x10008f52
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x10008f6e
push dword [ebp - 0x60]
lea ecx, [ebp - 0x480]
call fcn.1001ae71
mov dword [eax], 0x85f7
jmp 0x10008f4b
mov dword [ebp - 0x60], 0
jmp 0x10008f7e
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x10008f91
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x20], 0
jmp 0x10008f77
mov dword [ebp - 0x60], 0
jmp 0x10008fa1
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x10008fbd
push dword [ebp - 0x60]
lea ecx, [ebp - 0xf44]
call fcn.1001ae71
mov dword [eax], 0xdc6f
jmp 0x10008f9a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x20], 0
jmp 0x10008fe2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x20], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20], 2
jg 0x1000957a
mov dword [ebp - 0xa8], 0xb56fe18
mov dword [ebp - 0x3e8], 0
mov dword [ebp - 0x540], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x480]
call fcn.1001ae71
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x480]
call fcn.1001ae71
cmp dword [eax], 0
jne 0x1000904b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20], 0
mov eax, 0x964
cmp eax, 0x4ea3
jg 0x10009063
mov dword [ebp - 0xc84], 1
jmp 0x1000906a
and dword [ebp - 0xc84], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x20]
imul esi, dword [ebp - 0xc84]
push 0
lea ecx, [ebp - 0x480]
call fcn.1001ae71
sub esi, dword [eax]
add esi, 0xffff
jne 0x100090a8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20], 0
jne 0x100090a8
and dword [ebp - 0xf84], 0
jmp 0x100090b2
mov dword [ebp - 0xf84], 1
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x480]
call fcn.1001ae71
mov esi, eax
push 1
lea ecx, [ebp - 0x480]
call fcn.1001ae71
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x100090e8
mov dword [ebp - 0xe28], 1
jmp 0x100090ef
and dword [ebp - 0xe28], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x480]
call fcn.1001ae71
mov ecx, dword [ebp - 0xe28]
cmp ecx, dword [eax]
jl 0x1000911a
mov dword [ebp - 0xe30], 1
jmp 0x10009121
and dword [ebp - 0xe30], 0
cmp dword [ebp - 0xe30], 0xf1540ee1
ja 0x10009139
mov dword [ebp - 0xe38], 1
jmp 0x10009140
and dword [ebp - 0xe38], 0
cmp dword [ebp - 0xe38], 0x214a
jle 0x10009158
mov dword [ebp - 0x10a0], 1
jmp 0x1000915f
and dword [ebp - 0x10a0], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x480]
call fcn.1001ae71
mov esi, dword [eax]
sub esi, 0x78e6
push 0
lea ecx, [ebp - 0xf44]
call fcn.1001ae71
cmp esi, dword [eax]
je 0x10009199
mov dword [ebp - 0xe40], 1
jmp 0x100091a0
and dword [ebp - 0xe40], 0
cmp dword [ebp - 0xe40], 4
jne 0x100091bb
mov eax, 0x17017a68
test eax, eax
jne 0x100091bb
and dword [ebp - 0x10a8], 0
jmp 0x100091c5
mov dword [ebp - 0x10a8], 1
push 0
lea ecx, [ebp - 0xf44]
call fcn.1001ae71
push 0
lea ecx, [ebp - 0xf44]
call fcn.1001ae71
cmp dword [eax], 0xcc0136ef
jb 0x10009270
mov eax, 0x3da550e8
test eax, eax
je 0x10009270
push 0
lea ecx, [ebp - 0xf44]
call fcn.1001ae71
cmp dword [eax], 0
je 0x10009270
mov dword [ebp - 0x394], 0xfffffffa
mov dword [ebp - 0x394], 0
jmp 0x10009229
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 2
jg 0x1000925c
mov byte [ebp - 0x18d], 0
movzx eax, byte [ebp - 0x18d]
test eax, eax
je 0x1000925a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x1000921c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20], 0
je 0x1000926e
jmp 0x1000957a
jmp 0x10009288
mov dword [ebp - 0x10b0], 0xffffffff
cmp dword [ebp - 0x10b0], 0
je 0x10009288
jmp 0x1000957a
mov dword [ebp - 0xa8], 2
jmp 0x100092a1
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x10009575
mov dword [ebp - 0xb88], 0x555d5df5
mov dword [ebp - 0xb78], 8
mov dword [ebp - 0x454], 0xad92edcd
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x480]
call fcn.1001ae71
mov dword [ebp - 0xe48], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x20]
lea ecx, [ebp - 0x480]
call fcn.1001ae71
mov ecx, dword [ebp - 0xe48]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xe48]
mov eax, dword [eax]
mov dword [ebp - 0x10b8], eax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x10c0], eax
mov eax, dword [ebp - 0x494]
inc eax
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x10b8]
cmp eax, dword [ebp - 0x10c0]
jge 0x10009347
mov dword [ebp - 0xb68], 1
jmp 0x1000934e
and dword [ebp - 0xb68], 0
cmp dword [ebp - 0xa8], 0
jne 0x100093b8
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x15c4], eax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x16ac], eax
mov eax, dword [ebp - 0x454]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x20]
jge 0x1000938e
mov dword [ebp - 0xe50], 1
jmp 0x10009395
and dword [ebp - 0xe50], 0
mov eax, dword [ebp - 0xe50]
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0xb60]
cmp dword [ebp - 0x3e8], eax
jl 0x100093b8
and dword [ebp - 0xe58], 0
jmp 0x100093c2
mov dword [ebp - 0xe58], 1
mov eax, dword [ebp - 0xb88]
cmp dword [ebp - 0xe58], eax
jle 0x100093dc
mov dword [ebp - 0xe60], 1
jmp 0x100093e3
and dword [ebp - 0xe60], 0
mov eax, dword [ebp - 0xe60]
sub eax, dword [ebp - 0x10c8]
jne 0x10009403
mov eax, 0xffff
test eax, eax
jne 0x10009403
and dword [ebp - 0xe68], 0
jmp 0x1000940d
mov dword [ebp - 0xe68], 1
mov eax, dword [ebp - 0xe68]
sub eax, 0x96aa
jne 0x1000942c
cmp dword [ebp - 0x454], 0
jne 0x1000942c
and dword [ebp - 0xe70], 0
jmp 0x10009436
mov dword [ebp - 0xe70], 1
cmp dword [ebp - 0xe70], 0xffff
ja 0x1000944e
mov dword [ebp - 0xe78], 1
jmp 0x10009455
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0xe78]
cmp eax, dword [ebp - 0xa8]
je 0x10009476
mov dword [ebp - 0xe80], 1
jmp 0x1000947d
and dword [ebp - 0xe80], 0
imul eax, dword [ebp - 0xe80], 0x5801
imul eax, dword [ebp - 0x10d0]
cmp eax, dword [ebp - 0xb60]
jne 0x100094a2
mov dword [ebp - 0x530], 1
jmp 0x100094a9
and dword [ebp - 0x530], 0
cmp dword [ebp - 0x530], 0xc67586e0
jae 0x100094c1
mov dword [ebp - 0x538], 1
jmp 0x100094c8
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0xb68]
cmp eax, dword [ebp - 0x538]
jle 0x100094e2
mov dword [ebp - 0xb70], 1
jmp 0x100094e9
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0xb70]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xb78], eax
jl 0x1000951b
mov dword [ebp - 0x548], 1
jmp 0x10009522
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x548], eax
je 0x1000953c
mov dword [ebp - 0xb80], 1
jmp 0x10009543
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xb80], eax
jg 0x1000955d
mov dword [ebp - 0x550], 1
jmp 0x10009564
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0xb88], eax
jmp 0x10009294
jmp 0x10008fcd
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf44]
call fcn.1001ae55
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x480]
call fcn.1001ae55
mov dword [ebp - 0xc0], 0xc29a3df6
mov dword [ebp - 0x4c], 0xa654fddd
push 3
lea ecx, [ebp - 0xe90]
call fcn.1001add3
mov dword [ebp - 4], 2
mov dword [ebp - 0x104], 0x56e6
mov dword [ebp - 0x1108], 9
mov dword [ebp - 0x5c0], 8
mov dword [ebp - 0x15cc], 0xffffffff
mov dword [ebp - 0x4c8], 0xfffffffe
mov dword [ebp - 0x264], 0
jmp 0x10009608
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 3
jge 0x1000962a
push dword [ebp - 0x264]
lea ecx, [ebp - 0xe90]
call fcn.1001ae71
mov dword [eax], 1
jmp 0x100095fb
cmp dword [ebp - 0xc0], 0
je 0x10009648
mov eax, 0xfa75
test eax, eax
je 0x10009648
mov dword [ebp - 0x558], 1
jmp 0x1000964f
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x4c], eax
mov eax, 0xf068
sub eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4c]
je 0x10009674
mov dword [ebp - 0x10d8], 1
jmp 0x1000967b
and dword [ebp - 0x10d8], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x171c], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x15d4], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x16b4], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xc0], eax
jl 0x100096b6
mov dword [ebp - 0xb90], 1
jmp 0x100096bd
and dword [ebp - 0xb90], 0
push 1
lea ecx, [ebp - 0xe90]
call fcn.1001ae71
mov dword [eax], 0x703026d8
cmp dword [ebp - 0xb90], 0x703026d8
jg 0x100096e8
mov dword [ebp - 0x10e0], 1
jmp 0x100096ef
and dword [ebp - 0x10e0], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x15dc], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x16fc], eax
mov esi, dword [ebp - 0x4c]
push 1
lea ecx, [ebp - 0xe90]
call fcn.1001ae71
cmp esi, dword [eax]
jge 0x10009727
mov dword [ebp - 0x10e8], 1
jmp 0x1000972e
and dword [ebp - 0x10e8], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x15e4], eax
cmp dword [ebp - 0x104], 0xa9c5a74d
jae 0x10009752
mov dword [ebp - 0x560], 1
jmp 0x10009759
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
neg eax
cmp eax, 0x129ec6ea
je 0x10009774
mov dword [ebp - 0xb98], 1
jmp 0x1000977b
and dword [ebp - 0xb98], 0
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x4c], eax
jge 0x10009bdc
mov dword [ebp - 0x54], 0xa5fc
mov dword [ebp - 0x590], 1
mov dword [ebp - 0x1118], 0
mov dword [ebp - 0x314], 0
jmp 0x100097c7
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 4
jge 0x100097e3
mov eax, dword [ebp - 0x314]
mov dword [ebp + eax*4 - 0x17c0], 0
jmp 0x100097ba
mov dword [ebp - 0x4c], 0
jmp 0x100097f3
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffff1
jl 0x10009bd7
mov dword [ebp - 0x10f0], 0x1cdf
mov dword [ebp - 0xbc8], 5
mov dword [ebp - 0x274], 0x92e414e4
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x16bc], eax
imul eax, dword [ebp - 0x54], 0x8ffd
mov ecx, dword [ebp - 0x10f0]
neg ecx
imul ecx, dword [ebp - 0x54]
sub eax, ecx
cmp eax, 0xa501
jge 0x1000984c
mov dword [ebp - 0x3f0], 1
jmp 0x10009853
and dword [ebp - 0x3f0], 0
push 2
lea ecx, [ebp - 0xe90]
call fcn.1001ae71
mov ecx, dword [ebp - 0x3f0]
mov dword [eax], ecx
cmp dword [ebp - 0x3f0], 0
jne 0x10009880
cmp dword [ebp - 0x54], 0
jne 0x10009880
and dword [ebp - 0x568], 0
jmp 0x1000988a
mov dword [ebp - 0x568], 1
cmp dword [ebp - 0x568], 0x1e5de2ca
je 0x100098a2
mov dword [ebp - 0xba0], 1
jmp 0x100098a9
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0x54], 0x19
jmp 0x100098c5
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xd
jl 0x10009bd2
mov dword [ebp - 0x1100], 0x133a5b7d
mov dword [ebp - 0x26c], 0
jmp 0x100098f2
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x1000990e
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x1110], 0x697289f1
jmp 0x100098e5
mov dword [ebp - 0x104], 0xfffffff4
jmp 0x10009927
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x2a
jge 0x10009bcd
mov dword [ebp - 0x36c], 0
jmp 0x1000994d
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 4
jge 0x10009969
mov eax, dword [ebp - 0x36c]
mov dword [ebp + eax*4 - 0x17f8], 1
jmp 0x10009940
cmp dword [ebp - 0x54], 0
je 0x10009bac
push 2
lea ecx, [ebp - 0xe90]
call fcn.1001ae71
cmp dword [ebp - 0x54], 0
je 0x100099d3
mov eax, 0xe49ed226
test eax, eax
je 0x100099a1
cmp dword [ebp - 0x54], 0
je 0x100099a1
mov dword [ebp - 0x10f8], 1
jmp 0x100099a8
and dword [ebp - 0x10f8], 0
mov eax, dword [ebp - 0x1100]
mov dword [ebp - 0x15ec], eax
mov eax, dword [ebp - 0x274]
add eax, 0x37b1
je 0x100099d3
cmp dword [ebp - 0x54], 0
je 0x100099d3
mov dword [ebp - 0x570], 1
jmp 0x100099da
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 0xfffffff7
jne 0x100099ef
mov dword [ebp - 0xba8], 1
jmp 0x100099f6
and dword [ebp - 0xba8], 0
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0xba8], eax
jne 0x10009a10
mov dword [ebp - 0x578], 1
jmp 0x10009a17
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x1108]
cmp dword [ebp - 0x578], eax
je 0x10009a31
mov dword [ebp - 0xbb0], 1
jmp 0x10009a38
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xbb0], eax
je 0x10009a4f
mov dword [ebp - 0x580], 1
jmp 0x10009a56
and dword [ebp - 0x580], 0
cmp dword [ebp - 0x580], 0xa80aa4b6
ja 0x10009a6e
mov dword [ebp - 0xbb8], 1
jmp 0x10009a75
and dword [ebp - 0xbb8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x17f8]
cmp eax, dword [ebp - 0xbb8]
jge 0x10009a96
mov dword [ebp - 0x588], 1
jmp 0x10009a9d
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x588], eax
jge 0x10009ab4
mov dword [ebp - 0xbc0], 1
jmp 0x10009abb
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0xbc0]
sub eax, dword [ebp - 0x274]
mov dword [ebp - 0x590], eax
mov eax, dword [ebp - 0x590]
mov dword [ebp - 0x173c], eax
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x15f4], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x17c0]
cmp dword [ebp - 0xbc8], eax
jl 0x10009b06
mov dword [ebp - 0x598], 1
jmp 0x10009b0d
and dword [ebp - 0x598], 0
cmp dword [ebp - 0x598], 0x9bbc
jg 0x10009b25
mov dword [ebp - 0xbd0], 1
jmp 0x10009b2c
and dword [ebp - 0xbd0], 0
cmp dword [ebp - 0xbd0], 0xf528
jne 0x10009b44
mov dword [ebp - 0x5a0], 1
jmp 0x10009b4b
and dword [ebp - 0x5a0], 0
cmp dword [ebp - 0x5a0], 0xffff
jbe 0x10009b63
mov dword [ebp - 0xbd8], 1
jmp 0x10009b6a
and dword [ebp - 0xbd8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1110]
cmp dword [ebp - 0xbd8], eax
jg 0x10009b8b
mov dword [ebp - 0x5a8], 1
jmp 0x10009b92
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x1118]
cmp dword [ebp - 0x5a8], eax
jle 0x10009bac
mov dword [ebp - 0xbe0], 1
jmp 0x10009bb3
and dword [ebp - 0xbe0], 0
push 2
lea ecx, [ebp - 0xe90]
call fcn.1001ae71
mov ecx, dword [ebp - 0xbe0]
mov dword [eax], ecx
jmp 0x1000991a
jmp 0x100098be
jmp 0x100097ec
jmp 0x10009e39
mov dword [ebp - 0x27c], 0x93197c82
mov dword [ebp - 0x16c4], 4
mov dword [ebp - 0x145c], 0xffffffff
mov dword [ebp - 0x1458], 0xffffffff
mov dword [ebp - 0x1454], 0xffffffff
mov dword [ebp - 0x1450], 0xffffffff
push 4
lea ecx, [ebp - 0x1180]
call fcn.1001add3
mov byte [ebp - 4], 3
mov dword [ebp - 0x31c], 0
jmp 0x10009c42
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 4
jge 0x10009c64
push dword [ebp - 0x31c]
lea ecx, [ebp - 0x1180]
call fcn.1001ae71
mov dword [eax], 0xfffffffd
jmp 0x10009c35
mov byte [ebp - 0x1a9], 0
movzx eax, byte [ebp - 0x1a9]
test eax, eax
je 0x10009c7e
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 0x5c0], 0
je 0x10009df9
mov eax, dword [ebp - 0x27c]
neg eax
je 0x10009ca1
mov dword [ebp - 0x5b0], 1
jmp 0x10009ca8
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x15fc], eax
push 1
lea ecx, [ebp - 0xe90]
call fcn.1001ae71
mov ecx, dword [ebp - 0x5b0]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x145c]
mov dword [ebp - 0x1704], eax
mov eax, dword [ebp - 0x4c8]
dec eax
mov dword [ebp - 0x4c8], eax
mov esi, dword [ebp - 0x27c]
push 0
lea ecx, [ebp - 0x1180]
call fcn.1001ae71
cmp esi, dword [eax]
jge 0x10009d0c
mov dword [ebp - 0xbe8], 1
jmp 0x10009d13
and dword [ebp - 0xbe8], 0
mov esi, dword [ebp - 0xbe8]
dec esi
push 3
lea ecx, [ebp - 0x1180]
call fcn.1001ae71
cmp esi, dword [eax]
jl 0x10009d37
mov dword [ebp - 0x5b8], 1
jmp 0x10009d3e
and dword [ebp - 0x5b8], 0
cmp dword [ebp - 0x5b8], 0
jg 0x10009d53
mov dword [ebp - 0xbf0], 1
jmp 0x10009d5a
and dword [ebp - 0xbf0], 0
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0xbf0]
je 0x10009d74
mov dword [ebp - 0xbf8], 1
jmp 0x10009d7b
and dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0x5c0]
cmp dword [ebp - 0xbf8], eax
jne 0x10009d9e
cmp dword [ebp - 0x27c], 0
je 0x10009d9e
mov dword [ebp - 0x1120], 1
jmp 0x10009da5
and dword [ebp - 0x1120], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x14a4], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x14ac], eax
cmp dword [ebp - 0x27c], 0xffffffff
je 0x10009dcf
mov dword [ebp - 0x5c8], 1
jmp 0x10009dd6
and dword [ebp - 0x5c8], 0
push 0
lea ecx, [ebp - 0x1180]
call fcn.1001ae71
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [eax]
jge 0x10009df9
mov dword [ebp - 0xc00], 1
jmp 0x10009e00
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xc00], eax
jge 0x10009e1a
mov dword [ebp - 0x5d0], 1
jmp 0x10009e21
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1180]
call fcn.1001ae55
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe90]
call fcn.1001ae55
push 3
lea ecx, [ebp - 0x4a0]
call fcn.1001add3
mov dword [ebp - 4], 4
push 2
lea ecx, [ebp - 0x490]
call fcn.1001add3
mov byte [ebp - 4], 5
mov dword [ebp - 0x200], 0xa9ac70c3
mov dword [ebp - 0x3ac], 0
jmp 0x10009e90
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 2
jge 0x10009eaf
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x490]
call fcn.1001ae71
and dword [eax], 0
jmp 0x10009e83
push 0
lea ecx, [ebp - 0x490]
call fcn.1001ae71
mov dword [eax], 0x13
jmp 0x10009ee8
push 0
lea ecx, [ebp - 0x490]
call fcn.1001ae71
mov dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0xc08]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc08]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x490]
call fcn.1001ae71
cmp dword [eax], 0xfffffff1
jge 0x10009f18
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x10009f16
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x10009ec4
mov dword [ebp - 0x200], 0
jmp 0x10009f31
mov eax, dword [ebp - 0x200]
dec eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xffffffe3
je 0x1000a406
mov dword [ebp - 0x1b8], 1
mov dword [ebp - 0x324], 0x5d840dfe
mov dword [ebp - 0xc28], 9
mov dword [ebp - 0xc50], 0xe6b87c26
mov dword [ebp - 0x630], 0x194e4064
push 2
lea ecx, [ebp - 0x1350]
call fcn.1001add3
mov byte [ebp - 4], 6
mov dword [ebp - 0x284], 0
jmp 0x10009f9a
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 2
jge 0x10009fbc
push dword [ebp - 0x284]
lea ecx, [ebp - 0x1350]
call fcn.1001ae71
mov dword [eax], 1
jmp 0x10009f8d
mov dword [ebp - 0x1b8], 0xfffffff7
jmp 0x10009fd5
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 7
jge 0x1000a3f2
mov dword [ebp - 0xa0], 0xfffffffc
push 0
lea ecx, [ebp - 0x490]
call fcn.1001ae71
cmp dword [ebp - 0x324], 0
jge 0x1000a00e
mov dword [ebp - 0x5d8], 1
jmp 0x1000a015
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x5d8], eax
jne 0x1000a02f
mov dword [ebp - 0xc10], 1
jmp 0x1000a036
and dword [ebp - 0xc10], 0
cmp dword [ebp - 0xc10], 0x4668dacb
jl 0x1000a04e
mov dword [ebp - 0x5e0], 1
jmp 0x1000a055
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x324]
cmp dword [ebp - 0x5e0], eax
jle 0x1000a06f
mov dword [ebp - 0xc18], 1
jmp 0x1000a076
and dword [ebp - 0xc18], 0
mov eax, dword [ebp - 0xc28]
cmp dword [ebp - 0xc18], eax
jg 0x1000a090
mov dword [ebp - 0x5e8], 1
jmp 0x1000a097
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
sub eax, dword [ebp - 0xa0]
cmp eax, 0x5d06
jl 0x1000a0b6
mov dword [ebp - 0xc20], 1
jmp 0x1000a0bd
and dword [ebp - 0xc20], 0
mov esi, dword [ebp - 0xc20]
sub esi, dword [ebp - 0xa0]
push 0
lea ecx, [ebp - 0x490]
call fcn.1001ae71
cmp esi, dword [eax]
jne 0x1000a0e6
mov dword [ebp - 0x5f0], 1
jmp 0x1000a0ed
and dword [ebp - 0x5f0], 0
mov esi, dword [ebp - 0x5f0]
neg esi
add esi, dword [ebp - 0xc28]
push 1
lea ecx, [ebp - 0x490]
call fcn.1001ae71
cmp esi, dword [eax]
jge 0x1000a118
mov dword [ebp - 0x5f8], 1
jmp 0x1000a11f
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x5f8]
jge 0x1000a139
mov dword [ebp - 0xc30], 1
jmp 0x1000a140
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0xc30]
add eax, 0x2cd8491f
cmp eax, 0x9e1f9531
jne 0x1000a15e
mov dword [ebp - 0x1128], 1
jmp 0x1000a165
and dword [ebp - 0x1128], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x14b4], eax
cmp dword [ebp - 0xa0], 0xc6f0
jl 0x1000a18f
cmp dword [ebp - 0xa0], 0
jne 0x1000a18f
and dword [ebp - 0x600], 0
jmp 0x1000a199
mov dword [ebp - 0x600], 1
cmp dword [ebp - 0x600], 1
je 0x1000a1ae
mov dword [ebp - 0xc38], 1
jmp 0x1000a1b5
and dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0xc38]
jne 0x1000a1cf
mov dword [ebp - 0x608], 1
jmp 0x1000a1d6
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x608], eax
jne 0x1000a1f0
mov dword [ebp - 0xc40], 1
jmp 0x1000a1f7
and dword [ebp - 0xc40], 0
cmp dword [ebp - 0xc40], 0xb13b1067
jae 0x1000a210
xor eax, eax
jne 0x1000a210
and dword [ebp - 0x610], 0
jmp 0x1000a21a
mov dword [ebp - 0x610], 1
push 0
lea ecx, [ebp - 0x490]
call fcn.1001ae71
mov ecx, dword [ebp - 0x610]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0xc50]
je 0x1000a243
mov dword [ebp - 0xc48], 1
jmp 0x1000a24a
and dword [ebp - 0xc48], 0
push 0
lea ecx, [ebp - 0x490]
call fcn.1001ae71
mov ecx, dword [ebp - 0xc48]
mov dword [eax], ecx
cmp dword [ebp - 0xa0], 0
jne 0x1000a276
or eax, 0xffffffff
jne 0x1000a276
and dword [ebp - 0x618], 0
jmp 0x1000a280
mov dword [ebp - 0x618], 1
push 0
lea ecx, [ebp - 0x490]
call fcn.1001ae71
mov ecx, dword [ebp - 0x618]
cmp ecx, dword [eax]
jne 0x1000a2a3
mov dword [ebp - 0x620], 1
jmp 0x1000a2aa
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0xc50]
cmp dword [ebp - 0x620], eax
jne 0x1000a2c4
mov dword [ebp - 0xc58], 1
jmp 0x1000a2cb
and dword [ebp - 0xc58], 0
cmp dword [ebp - 0xc58], 0
jle 0x1000a2e0
mov dword [ebp - 0x628], 1
jmp 0x1000a2e7
and dword [ebp - 0x628], 0
cmp dword [ebp - 0x628], 0x51f7
jne 0x1000a2ff
mov dword [ebp - 0x1130], 1
jmp 0x1000a306
and dword [ebp - 0x1130], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x14bc], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xa0], eax
jl 0x1000a32c
mov dword [ebp - 0xc60], 1
jmp 0x1000a333
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0xc60]
add eax, 4
mov dword [ebp - 0x630], eax
je 0x1000a357
push 8
pop eax
test eax, eax
je 0x1000a357
mov dword [ebp - 0xc68], 1
jmp 0x1000a35e
and dword [ebp - 0xc68], 0
cmp dword [ebp - 0xc68], 0
je 0x1000a373
mov dword [ebp - 0x638], 1
jmp 0x1000a37a
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x638], eax
je 0x1000a394
mov dword [ebp - 0xc70], 1
jmp 0x1000a39b
and dword [ebp - 0xc70], 0
cmp dword [ebp - 0xc70], 3
jae 0x1000a3b0
mov dword [ebp - 0x640], 1
jmp 0x1000a3b7
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x324]
cmp dword [ebp - 0x640], eax
jne 0x1000a3d1
mov dword [ebp - 0xc78], 1
jmp 0x1000a3d8
and dword [ebp - 0xc78], 0
push 1
lea ecx, [ebp - 0x1350]
call fcn.1001ae71
mov ecx, dword [ebp - 0xc78]
mov dword [eax], ecx
jmp 0x10009fc8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1350]
call fcn.1001ae55
jmp 0x10009f24
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x490]
call fcn.1001ae55
push 2
lea ecx, [ebp - 0xf38]
call fcn.1001add3
mov byte [ebp - 4], 7
push 1
lea ecx, [ebp - 0x1270]
call fcn.1001add3
mov byte [ebp - 4], 8
mov dword [ebp - 0x45c], 0xffffffff
mov dword [ebp - 0x3f8], 0
mov dword [ebp - 0xc88], 0xfffffffb
mov dword [ebp - 0x650], 1
mov dword [ebp - 0xe4], 0
jmp 0x1000a478
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jge 0x1000a494
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0xf5c], 8
jmp 0x1000a46b
mov dword [ebp - 0xe4], 0
jmp 0x1000a4ad
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x1000a4cf
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x1270]
call fcn.1001ae71
mov dword [eax], 0xfffffffe
jmp 0x1000a4a0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf5c], 0
jne 0x1000a534
push 0
lea ecx, [ebp - 0x1270]
call fcn.1001ae71
mov dword [eax], 1
mov dword [ebp - 0x45c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf5c]
mov dword [ebp - 0x14c4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xf5c]
cmp dword [ebp + eax - 0xf5c], ecx
jl 0x1000a534
and dword [ebp - 0x648], 0
jmp 0x1000a53e
mov dword [ebp - 0x648], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf5c]
cmp eax, dword [ebp - 0x648]
jne 0x1000a55f
mov dword [ebp - 0xc80], 1
jmp 0x1000a566
and dword [ebp - 0xc80], 0
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0x3f8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf5c]
mov dword [ebp - 0x14cc], eax
mov eax, dword [ebp - 0xc88]
mov dword [ebp - 0x1138], eax
push 0
lea ecx, [ebp - 0x1270]
call fcn.1001ae71
mov ecx, dword [ebp - 0x1138]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 0
jne 0x1000a5c7
mov dword [ebp - 0x1140], 1
jmp 0x1000a5ce
and dword [ebp - 0x1140], 0
mov eax, dword [ebp - 0xc88]
mov dword [ebp - 0x14d4], eax
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x14dc], eax
cmp dword [ebp - 0x45c], 1
jne 0x1000a5fb
mov dword [ebp - 0x658], 1
jmp 0x1000a602
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x45c], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1270]
call fcn.1001ae55
mov dword [ebp - 0x124c], 0xffffffff
mov dword [ebp - 0x14e4], 0xe617092f
mov dword [ebp - 0x228], 0x7cb3f4f4
mov dword [ebp - 0x28c], 0
jmp 0x1000a654
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 3
jge 0x1000a670
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0x174c], 0xfffffff7
jmp 0x1000a647
mov byte [ebp - 0x185], 0
movzx eax, byte [ebp - 0x185]
test eax, eax
je 0x1000a69b
push 0x451
push 0xb0f
push 1
push 0
push 0x22bd
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x228], 0
jmp 0x1000a6b4
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jge 0x1000a6d0
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x174c], 0xfffffff7
jmp 0x1000a6a7
mov dword [ebp - 0x690], 0x9d0615a0
mov dword [ebp - 0x14ec], 0x33e270b
mov dword [ebp - 0x1254], 0
mov dword [ebp - 0x14f4], 0xdcedb1a7
mov dword [ebp - 0x14fc], 0xfffffff8
mov dword [ebp - 0x400], 0xfffffffa
mov dword [ebp - 0x3c], 0
jmp 0x1000a71c
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1000a738
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x4a0]
call fcn.1001ae71
mov dword [eax], 0x85f7
jmp 0x1000a715
mov dword [ebp - 0x3c], 0
jmp 0x1000a748
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1000a75b
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1c], 0
jmp 0x1000a741
mov dword [ebp - 0x3c], 0
jmp 0x1000a76b
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1000a787
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xf38]
call fcn.1001ae71
mov dword [eax], 0xdc6f
jmp 0x1000a764
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1c], 0
jmp 0x1000a7ac
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 2
jg 0x1000ad44
mov dword [ebp - 0x90], 0xb56fe18
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0xcd8], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0x4a0]
call fcn.1001ae71
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0x4a0]
call fcn.1001ae71
cmp dword [eax], 0
jne 0x1000a815
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
mov eax, 0x964
cmp eax, 0x4ea3
jg 0x1000a82d
mov dword [ebp - 0xc90], 1
jmp 0x1000a834
and dword [ebp - 0xc90], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x1c]
imul esi, dword [ebp - 0xc90]
push 0
lea ecx, [ebp - 0x4a0]
call fcn.1001ae71
sub esi, dword [eax]
add esi, 0xffff
jne 0x1000a872
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
jne 0x1000a872
and dword [ebp - 0x1148], 0
jmp 0x1000a87c
mov dword [ebp - 0x1148], 1
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0x4a0]
call fcn.1001ae71
mov esi, eax
push 1
lea ecx, [ebp - 0x4a0]
call fcn.1001ae71
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1000a8b2
mov dword [ebp - 0x660], 1
jmp 0x1000a8b9
and dword [ebp - 0x660], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0x4a0]
call fcn.1001ae71
mov ecx, dword [ebp - 0x660]
cmp ecx, dword [eax]
jl 0x1000a8e4
mov dword [ebp - 0xc98], 1
jmp 0x1000a8eb
and dword [ebp - 0xc98], 0
cmp dword [ebp - 0xc98], 0xf1540ee1
ja 0x1000a903
mov dword [ebp - 0x668], 1
jmp 0x1000a90a
and dword [ebp - 0x668], 0
cmp dword [ebp - 0x668], 0x214a
jle 0x1000a922
mov dword [ebp - 0x1150], 1
jmp 0x1000a929
and dword [ebp - 0x1150], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0x4a0]
call fcn.1001ae71
mov esi, dword [eax]
sub esi, 0x78e6
push 0
lea ecx, [ebp - 0xf38]
call fcn.1001ae71
cmp esi, dword [eax]
je 0x1000a963
mov dword [ebp - 0xca0], 1
jmp 0x1000a96a
and dword [ebp - 0xca0], 0
cmp dword [ebp - 0xca0], 4
jne 0x1000a985
mov eax, 0x17017a68
test eax, eax
jne 0x1000a985
and dword [ebp - 0x1158], 0
jmp 0x1000a98f
mov dword [ebp - 0x1158], 1
push 0
lea ecx, [ebp - 0xf38]
call fcn.1001ae71
push 0
lea ecx, [ebp - 0xf38]
call fcn.1001ae71
cmp dword [eax], 0xcc0136ef
jb 0x1000aa3a
mov eax, 0x3da550e8
test eax, eax
je 0x1000aa3a
push 0
lea ecx, [ebp - 0xf38]
call fcn.1001ae71
cmp dword [eax], 0
je 0x1000aa3a
mov dword [ebp - 0x374], 0xfffffffa
mov dword [ebp - 0x374], 0
jmp 0x1000a9f3
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 2
jg 0x1000aa26
mov byte [ebp - 0x1ab], 0
movzx eax, byte [ebp - 0x1ab]
test eax, eax
je 0x1000aa24
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x1000a9e6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
je 0x1000aa38
jmp 0x1000ad44
jmp 0x1000aa52
mov dword [ebp - 0x1160], 0xffffffff
cmp dword [ebp - 0x1160], 0
je 0x1000aa52
jmp 0x1000ad44
mov dword [ebp - 0x90], 2
jmp 0x1000aa6b
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x1000ad3f
mov dword [ebp - 0x6b8], 0x555d5df5
mov dword [ebp - 0x6a8], 8
mov dword [ebp - 0x408], 0xad92edcd
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0x4a0]
call fcn.1001ae71
mov dword [ebp - 0x670], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0x4a0]
call fcn.1001ae71
mov ecx, dword [ebp - 0x670]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x670]
mov eax, dword [eax]
mov dword [ebp - 0x1168], eax
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x1170], eax
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x1168]
cmp eax, dword [ebp - 0x1170]
jge 0x1000ab11
mov dword [ebp - 0x698], 1
jmp 0x1000ab18
and dword [ebp - 0x698], 0
cmp dword [ebp - 0x90], 0
jne 0x1000ab82
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x1504], eax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x150c], eax
mov eax, dword [ebp - 0x408]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1c]
jge 0x1000ab58
mov dword [ebp - 0xca8], 1
jmp 0x1000ab5f
and dword [ebp - 0xca8], 0
mov eax, dword [ebp - 0xca8]
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x690]
cmp dword [ebp - 0x4a4], eax
jl 0x1000ab82
and dword [ebp - 0x678], 0
jmp 0x1000ab8c
mov dword [ebp - 0x678], 1
mov eax, dword [ebp - 0x6b8]
cmp dword [ebp - 0x678], eax
jle 0x1000aba6
mov dword [ebp - 0xcb0], 1
jmp 0x1000abad
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0xcb0]
sub eax, dword [ebp - 0x124c]
jne 0x1000abcd
mov eax, 0xffff
test eax, eax
jne 0x1000abcd
and dword [ebp - 0x680], 0
jmp 0x1000abd7
mov dword [ebp - 0x680], 1
mov eax, dword [ebp - 0x680]
sub eax, 0x96aa
jne 0x1000abf6
cmp dword [ebp - 0x408], 0
jne 0x1000abf6
and dword [ebp - 0xcb8], 0
jmp 0x1000ac00
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0xffff
ja 0x1000ac18
mov dword [ebp - 0x688], 1
jmp 0x1000ac1f
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x688]
cmp eax, dword [ebp - 0x90]
je 0x1000ac40
mov dword [ebp - 0xcc0], 1
jmp 0x1000ac47
and dword [ebp - 0xcc0], 0
imul eax, dword [ebp - 0xcc0], 0x5801
imul eax, dword [ebp - 0x1254]
cmp eax, dword [ebp - 0x690]
jne 0x1000ac6c
mov dword [ebp - 0xcc8], 1
jmp 0x1000ac73
and dword [ebp - 0xcc8], 0
cmp dword [ebp - 0xcc8], 0xc67586e0
jae 0x1000ac8b
mov dword [ebp - 0xcd0], 1
jmp 0x1000ac92
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0x698]
cmp eax, dword [ebp - 0xcd0]
jle 0x1000acac
mov dword [ebp - 0x6a0], 1
jmp 0x1000acb3
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0xcd8], eax
mov eax, dword [ebp - 0xcd8]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x6a8], eax
jl 0x1000ace5
mov dword [ebp - 0xce0], 1
jmp 0x1000acec
and dword [ebp - 0xce0], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0xce0], eax
je 0x1000ad06
mov dword [ebp - 0x6b0], 1
jmp 0x1000ad0d
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x6b0], eax
jg 0x1000ad27
mov dword [ebp - 0xce8], 1
jmp 0x1000ad2e
and dword [ebp - 0xce8], 0
mov eax, dword [ebp - 0xce8]
mov dword [ebp - 0x6b8], eax
jmp 0x1000aa5e
jmp 0x1000a797
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf38]
call fcn.1001ae55
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4a0]
call fcn.1001ae55
push 3
lea ecx, [ebp - 0x4c0]
call fcn.1001add3
mov dword [ebp - 4], 9
mov dword [ebp - 0x208], 0xac204e2
mov dword [ebp - 0x6c0], 0
mov dword [ebp - 0x125c], 1
mov dword [ebp - 0xd08], 0x952f3411
mov dword [ebp - 0x294], 0
jmp 0x1000adb7
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 1
jge 0x1000add3
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0xcf8], 0xffffffff
jmp 0x1000adaa
mov dword [ebp - 0x208], 5
jmp 0x1000adec
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xf
jne 0x1000af0a
mov dword [ebp - 0x32c], 7
mov dword [ebp - 0x32c], 0xffffffef
jmp 0x1000ae1c
mov eax, dword [ebp - 0x32c]
dec eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0xffffffed
jle 0x1000af05
push 3
lea ecx, [ebp - 0xf50]
call fcn.1001add3
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x29c], 0
jmp 0x1000ae53
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 3
jge 0x1000ae75
push dword [ebp - 0x29c]
lea ecx, [ebp - 0xf50]
call fcn.1001ae71
mov dword [eax], 0xea122098
jmp 0x1000ae46
mov byte [ebp - 0x1ad], 0
movzx eax, byte [ebp - 0x1ad]
test eax, eax
je 0x1000ae8d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 2
lea ecx, [ebp - 0xf50]
call fcn.1001ae71
and dword [eax], 0
jmp 0x1000aec3
push 2
lea ecx, [ebp - 0xf50]
call fcn.1001ae71
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0xcf0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xcf0]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xf50]
call fcn.1001ae71
cmp dword [eax], 1
jge 0x1000aef1
push 2
lea ecx, [ebp - 0xf50]
call fcn.1001ae71
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0xcf8], 4
jmp 0x1000ae9f
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xf50]
call fcn.1001ae55
jmp 0x1000ae0f
jmp 0x1000addf
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x1514], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x151c], eax
mov eax, dword [ebp - 0x125c]
cmp dword [ebp - 0x6c0], eax
jge 0x1000af3c
mov dword [ebp - 0x6c8], 1
jmp 0x1000af43
and dword [ebp - 0x6c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcf8]
cmp eax, dword [ebp - 0x6c8]
jne 0x1000af64
mov dword [ebp - 0xd00], 1
jmp 0x1000af6b
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0xd08]
cmp dword [ebp - 0xd00], eax
jle 0x1000af85
mov dword [ebp - 0x6d0], 1
jmp 0x1000af8c
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0xd08], eax
push 2
lea ecx, [ebp - 0xf80]
call fcn.1001add3
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x78], 0xfffffffc
push 3
lea ecx, [ebp - 0x11a0]
call fcn.1001add3
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xd20], 0xc6b79df9
push 2
lea ecx, [ebp - 0x1190]
call fcn.1001add3
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xd28], 1
mov dword [ebp - 0x1248], 6
mov dword [ebp - 0xc8], 0
jmp 0x1000b009
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x1000b02b
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x11a0]
call fcn.1001ae71
mov dword [eax], 0xfffffffe
jmp 0x1000affc
mov dword [ebp - 0xc8], 0
jmp 0x1000b044
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x1000b066
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x1190]
call fcn.1001ae71
mov dword [eax], 1
jmp 0x1000b037
imul eax, dword [ebp - 0x78], 0
test eax, eax
je 0x1000b080
cmp dword [ebp - 0x78], 0
je 0x1000b080
mov dword [ebp - 0x6e0], 1
jmp 0x1000b087
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x78], eax
jl 0x1000b09b
mov dword [ebp - 0x6d8], 1
jmp 0x1000b0a2
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x6d8], eax
je 0x1000b0b9
mov dword [ebp - 0xd10], 1
jmp 0x1000b0c0
and dword [ebp - 0xd10], 0
cmp dword [ebp - 0xd10], 0x36544d18
jne 0x1000b0d8
mov dword [ebp - 0xd18], 1
jmp 0x1000b0df
and dword [ebp - 0xd18], 0
mov eax, dword [ebp - 0x6e0]
cmp eax, dword [ebp - 0xd18]
jg 0x1000b1a0
mov dword [ebp - 0x1e4], 0xfffffff8
mov dword [ebp - 0x78], 0
jmp 0x1000b10b
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jg 0x1000b160
mov dword [ebp - 0x39c], 0xfffffff8
mov dword [ebp - 0x39c], 2
jmp 0x1000b134
mov eax, dword [ebp - 0x39c]
dec eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0
jl 0x1000b14a
cmp dword [ebp - 0x1e4], 0
je 0x1000b148
jmp 0x1000b14a
jmp 0x1000b127
push 1
lea ecx, [ebp - 0x11a0]
call fcn.1001ae71
cmp dword [eax], 0
je 0x1000b15e
jmp 0x1000b160
jmp 0x1000b104
mov dword [ebp - 0x1e4], 0
jmp 0x1000b179
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 3
jge 0x1000b19b
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x11a0]
call fcn.1001ae71
mov dword [eax], 6
jmp 0x1000b16c
jmp 0x1000b434
push 3
lea ecx, [ebp - 0x1294]
call fcn.1001add3
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x410], 0x72327932
mov dword [ebp - 0xe8], 0
jmp 0x1000b1d4
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 3
jge 0x1000b1f6
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x1294]
call fcn.1001ae71
mov dword [eax], 0xec80f219
jmp 0x1000b1c7
mov dword [ebp - 0xe8], 0
jmp 0x1000b20f
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 3
jge 0x1000b22b
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x13e0], 0xe7790660
jmp 0x1000b202
push 0
lea ecx, [ebp - 0x1294]
call fcn.1001ae71
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x464]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x464]
mov dword [ecx], eax
mov eax, dword [ebp - 0xd20]
mov ecx, dword [ebp - 0x464]
cmp eax, dword [ecx]
jge 0x1000b26b
mov dword [ebp - 0x6e8], 1
jmp 0x1000b272
and dword [ebp - 0x6e8], 0
mov esi, dword [ebp - 0x6e8]
neg esi
push 4
pop eax
imul eax, eax, 0
add esi, dword [ebp + eax - 0x13e0]
neg esi
push 0
lea ecx, [ebp - 0x1190]
call fcn.1001ae71
mov dword [eax], esi
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0x1524], eax
cmp dword [ebp - 0x410], 0
jne 0x1000b31f
push 0
lea ecx, [ebp - 0x1294]
call fcn.1001ae71
cmp dword [eax], 0xfffffffc
jbe 0x1000b2cb
mov dword [ebp - 0x6f0], 1
jmp 0x1000b2d2
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0xd28], eax
cmp dword [ebp - 0xd28], 0xfffffffa
ja 0x1000b2f3
mov dword [ebp - 0x6f8], 1
jmp 0x1000b2fa
and dword [ebp - 0x6f8], 0
cmp dword [ebp - 0x6f8], 0x69e7721c
jg 0x1000b31f
push 6
pop eax
test eax, eax
jne 0x1000b31f
cmp dword [ebp - 0x410], 0
jne 0x1000b31f
and dword [ebp - 0xd30], 0
jmp 0x1000b329
mov dword [ebp - 0xd30], 1
push 0
lea ecx, [ebp - 0x11a0]
call fcn.1001ae71
mov ecx, dword [ebp - 0xd30]
sub ecx, dword [eax]
je 0x1000b355
cmp dword [ebp - 0x410], 0
je 0x1000b355
mov dword [ebp - 0x1264], 1
jmp 0x1000b35c
and dword [ebp - 0x1264], 0
push 0
lea ecx, [ebp - 0x1190]
call fcn.1001ae71
mov dword [eax], 1
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x152c], eax
cmp dword [ebp - 0x78], 0
je 0x1000b39c
push 0
lea ecx, [ebp - 0x1190]
call fcn.1001ae71
cmp dword [eax], 0
je 0x1000b39c
mov dword [ebp - 0x700], 1
jmp 0x1000b3a3
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x1248]
cmp dword [ebp - 0x700], eax
jge 0x1000b3c4
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x1000b3c4
mov dword [ebp - 0xd38], 1
jmp 0x1000b3cb
and dword [ebp - 0xd38], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13e0]
cmp dword [ebp - 0xd38], eax
jg 0x1000b3ec
mov dword [ebp - 0x708], 1
jmp 0x1000b3f3
and dword [ebp - 0x708], 0
cmp dword [ebp - 0x708], 0xf45a
je 0x1000b40b
mov dword [ebp - 0xd40], 1
jmp 0x1000b412
and dword [ebp - 0xd40], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd40]
mov dword [ebp + eax - 0x13e0], ecx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1294]
call fcn.1001ae55
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1190]
call fcn.1001ae55
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x11a0]
call fcn.1001ae55
mov dword [ebp - 0x11c4], 0xffffffff
push 2
lea ecx, [ebp - 0x520]
call fcn.1001add3
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x1308], 0x69f4288a
mov dword [ebp - 0x1304], 0x69f4288a
mov dword [ebp - 0x1300], 0x69f4288a
mov dword [ebp - 0x12fc], 0x69f4288a
lea ecx, [ebp - 0x3c1]
call fcn.10008c6b
push eax
lea eax, [ebp - 0x12f8]
push eax
lea eax, [ebp - 0x1308]
push eax
lea ecx, [ebp - 0x17b0]
call fcn.1001ae80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4fc]
call fcn.1001ae2f
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x248], 0x35637001
mov dword [ebp - 0x134], 0xfffffff9
mov dword [ebp - 0x1098], 0x5f885928
mov dword [ebp - 0x2a4], 0
jmp 0x1000b505
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 2
jge 0x1000b524
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0x520]
call fcn.1001ae71
and dword [eax], 0
jmp 0x1000b4f8
push 1
lea ecx, [ebp - 0x520]
call fcn.1001ae71
mov dword [eax], 3
push 1
lea ecx, [ebp - 0x4fc]
call fcn.1001ae71
mov dword [eax], 3
push 1
lea ecx, [ebp - 0x520]
call fcn.1001ae71
cmp dword [eax], 0
je 0x1000b789
push 2
lea ecx, [ebp - 0x4fc]
call fcn.1001ae71
cmp dword [eax], 0
je 0x1000b587
cmp dword [ebp - 0x248], 0
je 0x1000b587
mov dword [ebp - 0x10dc], 1
jmp 0x1000b58e
and dword [ebp - 0x10dc], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x1534], eax
push 1
lea ecx, [ebp - 0x4fc]
call fcn.1001ae71
cmp dword [eax], 0
jae 0x1000b5b8
mov dword [ebp - 0x710], 1
jmp 0x1000b5bf
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 0x60bc
jle 0x1000b5d7
mov dword [ebp - 0xd48], 1
jmp 0x1000b5de
and dword [ebp - 0xd48], 0
push 1
lea ecx, [ebp - 0x4fc]
call fcn.1001ae71
mov ecx, dword [ebp - 0xd48]
cmp ecx, dword [eax]
jle 0x1000b601
mov dword [ebp - 0x4c4], 1
jmp 0x1000b608
and dword [ebp - 0x4c4], 0
push 1
lea ecx, [ebp - 0x520]
call fcn.1001ae71
mov ecx, dword [ebp - 0x4c4]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x4fc]
call fcn.1001ae71
mov eax, dword [eax]
add eax, dword [ebp - 0x4c4]
je 0x1000b644
xor eax, eax
je 0x1000b644
mov dword [ebp - 0x718], 1
jmp 0x1000b64b
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x248]
imul eax, dword [ebp - 0x718]
test eax, eax
je 0x1000b67a
push 1
lea ecx, [ebp - 0x520]
call fcn.1001ae71
cmp dword [eax], 0
je 0x1000b67a
mov dword [ebp - 0xd50], 1
jmp 0x1000b681
and dword [ebp - 0xd50], 0
cmp dword [ebp - 0xd50], 0x7f1b
jle 0x1000b699
mov dword [ebp - 0x720], 1
jmp 0x1000b6a0
and dword [ebp - 0x720], 0
push 1
lea ecx, [ebp - 0x4fc]
call fcn.1001ae71
mov ecx, dword [ebp - 0x720]
cmp ecx, dword [eax]
jne 0x1000b6c3
mov dword [ebp - 0xd58], 1
jmp 0x1000b6ca
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0x248]
cmp eax, dword [ebp - 0xd58]
jl 0x1000b6e4
mov dword [ebp - 0x728], 1
jmp 0x1000b6eb
and dword [ebp - 0x728], 0
push 1
lea ecx, [ebp - 0x4fc]
call fcn.1001ae71
mov ecx, dword [ebp - 0x728]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x520]
call fcn.1001ae71
mov ecx, dword [ebp - 0x248]
cmp dword [eax], ecx
je 0x1000b723
mov dword [ebp - 0xd60], 1
jmp 0x1000b72a
and dword [ebp - 0xd60], 0
mov eax, dword [ebp - 0xd60]
sub eax, 0x3d252981
mov dword [ebp - 0x248], eax
push 1
lea ecx, [ebp - 0x520]
call fcn.1001ae71
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x153c], eax
push 3
lea ecx, [ebp - 0x4fc]
call fcn.1001ae71
mov ecx, dword [ebp - 0x134]
cmp dword [eax], ecx
je 0x1000b789
push 0
lea ecx, [ebp - 0x520]
call fcn.1001ae71
cmp dword [eax], 0
je 0x1000b789
mov dword [ebp - 0x730], 1
jmp 0x1000b790
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x134]
imul eax, dword [ebp - 0x730]
add eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x134]
jg 0x1000b7b7
mov dword [ebp - 0xd68], 1
jmp 0x1000b7be
and dword [ebp - 0xd68], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0xd68], eax
jne 0x1000b7ea
push 1
lea ecx, [ebp - 0x4fc]
call fcn.1001ae71
cmp dword [eax], 0
je 0x1000b7ea
mov dword [ebp - 0x738], 1
jmp 0x1000b7f1
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x1098], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x4fc]
call fcn.1001ae55
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x520]
call fcn.1001ae55
mov dword [ebp - 0x1544], 0xe617092f
push 2
lea ecx, [ebp - 0x11b0]
call fcn.1001add3
mov byte [ebp - 4], 0x11
push 2
lea ecx, [ebp - 0x1440]
call fcn.1001add3
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xd0], 0
jmp 0x1000b860
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x1000b882
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x11b0]
call fcn.1001ae71
mov dword [eax], 5
jmp 0x1000b853
mov dword [ebp - 0xd0], 0
jmp 0x1000b89b
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x1000b8bd
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x1440]
call fcn.1001ae71
mov dword [eax], 0x8e1b61ba
jmp 0x1000b88e
push 0
lea ecx, [ebp - 0x11b0]
call fcn.1001ae71
and dword [eax], 0
jmp 0x1000b8f3
push 0
lea ecx, [ebp - 0x11b0]
call fcn.1001ae71
mov dword [ebp - 0xd70], eax
mov eax, dword [ebp - 0xd70]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xd70]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x11b0]
call fcn.1001ae71
cmp dword [eax], 0x1d
jg 0x1000b9ec
mov dword [ebp - 0xf0], 0xffffffff
mov dword [ebp - 0xf0], 0
jmp 0x1000b92c
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x11
je 0x1000b97e
mov dword [ebp - 0x1010], 0x5059
mov byte [ebp - 0x195], 0
movzx eax, byte [ebp - 0x195]
test eax, eax
je 0x1000b971
push 0
push 0x12d
push 0x2ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
cmp dword [ebp - 0x1010], 0
je 0x1000b97c
jmp 0x1000b97e
jmp 0x1000b91f
mov dword [ebp - 0xf0], 1
jmp 0x1000b997
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jl 0x1000b9e7
mov byte [ebp - 0x1af], 0
movzx eax, byte [ebp - 0x1af]
test eax, eax
je 0x1000b9cd
push 0
push 0
push 0x667
push 0xdbf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x1440]
call fcn.1001ae71
cmp dword [eax], 0
je 0x1000b9e5
jmp 0x1000b98a
jmp 0x1000b98a
jmp 0x1000b8cf
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1440]
call fcn.1001ae55
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x11b0]
call fcn.1001ae55
mov dword [ebp - 0xbb4], 0x9d0615a0
mov dword [ebp - 0x154c], 0x33e270b
mov dword [ebp - 0xffc], 0
mov dword [ebp - 0x1554], 0xdcedb1a7
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x144], 0xfffffff6
mov dword [ebp - 0x334], 0
jmp 0x1000ba5c
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 1
jge 0x1000ba78
mov eax, dword [ebp - 0x334]
mov dword [ebp + eax*4 - 0x33c], 0xd77c
jmp 0x1000ba4f
mov dword [ebp - 0x28], 0xffffffee
jmp 0x1000ba88
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x18
jle 0x1000bb6f
mov dword [ebp - 0x2ac], 0xffffffff
mov dword [ebp - 0x740], 0x555145cc
mov dword [ebp - 0xd80], 0x1cb6a7f4
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x155c], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x1564], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x156c], eax
cmp dword [ebp - 0x28], 0x12f3ccd2
jg 0x1000baf5
mov dword [ebp - 0xf94], 1
jmp 0x1000bafc
and dword [ebp - 0xf94], 0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x1574], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
neg eax
cmp eax, dword [ebp - 0x28]
jge 0x1000bb2a
mov dword [ebp - 0xd78], 1
jmp 0x1000bb31
and dword [ebp - 0xd78], 0
mov eax, dword [ebp - 0xd78]
sub eax, dword [ebp - 0xd80]
cmp dword [ebp - 0x2ac], eax
jg 0x1000bb57
cmp dword [ebp - 0x28], 0
je 0x1000bb57
mov dword [ebp - 0x748], 1
jmp 0x1000bb5e
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0xd80], eax
jmp 0x1000ba81
mov dword [ebp - 0x28], 0
jmp 0x1000bb7f
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 9
jl 0x1000bf82
mov dword [ebp - 0x13c], 0xfffffff9
mov dword [ebp - 0xdc8], 2
mov dword [ebp - 0x418], 0
push 1
lea ecx, [ebp - 0x135c]
call fcn.1001add3
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x37c], 0
jmp 0x1000bbd1
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 1
jge 0x1000bbf3
push dword [ebp - 0x37c]
lea ecx, [ebp - 0x135c]
call fcn.1001ae71
mov dword [eax], 0x5108d7eb
jmp 0x1000bbc4
mov dword [ebp - 0x144], 0
jmp 0x1000bc0c
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jl 0x1000bcc5
mov dword [ebp - 0x750], 0x276cc72b
mov dword [ebp - 0xd88], 2
mov dword [ebp - 0x1194], 0xf9e6a012
mov dword [ebp - 0x2b4], 0
jmp 0x1000bc50
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 2
jge 0x1000bc6c
mov eax, dword [ebp - 0x2b4]
mov dword [ebp + eax*4 - 0x1594], 0xbda9
jmp 0x1000bc43
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1594], 0
je 0x1000bc7e
jmp 0x1000bcc5
mov dword [ebp - 0x750], 9
mov eax, dword [ebp - 0x750]
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0xd88]
neg eax
cmp eax, 1
jg 0x1000bcad
mov dword [ebp - 0x758], 1
jmp 0x1000bcb4
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x1194], eax
jmp 0x1000bbff
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x28]
cmp dword [ebp + eax - 0x33c], ecx
jle 0x1000bce3
mov dword [ebp - 0xd90], 1
jmp 0x1000bcea
and dword [ebp - 0xd90], 0
cmp dword [ebp - 0xd90], 0x95e04a27
ja 0x1000beed
mov dword [ebp - 0xf9c], 1
mov dword [ebp - 0xdb8], 0xf673
mov dword [ebp - 0x10e4], 0xffffffff
cmp dword [ebp - 0x13c], 0
jne 0x1000bd33
cmp dword [ebp - 0xf9c], 0
jne 0x1000bd33
and dword [ebp - 0x760], 0
jmp 0x1000bd3d
mov dword [ebp - 0x760], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x33c]
cmp dword [ebp - 0x760], eax
je 0x1000bd5e
mov dword [ebp - 0xd98], 1
jmp 0x1000bd65
and dword [ebp - 0xd98], 0
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0xd98]
jg 0x1000bd7f
mov dword [ebp - 0x768], 1
jmp 0x1000bd86
and dword [ebp - 0x768], 0
cmp dword [ebp - 0x768], 5
jae 0x1000bd9b
mov dword [ebp - 0xda0], 1
jmp 0x1000bda2
and dword [ebp - 0xda0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x33c]
cmp dword [ebp - 0xda0], eax
jge 0x1000bdc3
mov dword [ebp - 0x770], 1
jmp 0x1000bdca
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x770]
inc eax
inc eax
jne 0x1000bde0
mov dword [ebp - 0xda8], 1
jmp 0x1000bde7
and dword [ebp - 0xda8], 0
mov eax, 0xf21ddbc7
sub eax, dword [ebp - 0xda8]
sub eax, 0xc323
cmp eax, dword [ebp - 0x13c]
jne 0x1000be0f
push 6
pop eax
test eax, eax
jne 0x1000be0f
and dword [ebp - 0x778], 0
jmp 0x1000be19
mov dword [ebp - 0x778], 1
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x778], eax
jge 0x1000be33
mov dword [ebp - 0xdb0], 1
jmp 0x1000be3a
and dword [ebp - 0xdb0], 0
mov eax, dword [ebp - 0xdb8]
add eax, dword [ebp - 0xdb0]
je 0x1000be58
xor eax, eax
je 0x1000be58
mov dword [ebp - 0x780], 1
jmp 0x1000be5f
and dword [ebp - 0x780], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x33c]
cmp dword [ebp - 0x780], eax
jne 0x1000be80
mov dword [ebp - 0x788], 1
jmp 0x1000be87
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0xdb8]
add eax, dword [ebp - 0x788]
cmp eax, dword [ebp - 0x13c]
jne 0x1000bea7
mov dword [ebp - 0xdc0], 1
jmp 0x1000beae
and dword [ebp - 0xdc0], 0
cmp dword [ebp - 0xdc0], 0xffffffff
jl 0x1000bec3
mov dword [ebp - 0x790], 1
jmp 0x1000beca
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0x10e4], eax
mov eax, dword [ebp - 0xdc8]
add eax, dword [ebp - 0xdc8]
mov dword [ebp - 0x418], eax
jmp 0x1000bf6e
mov dword [ebp - 0xfa4], 0xffff
mov eax, 0x3b57
inc eax
sub eax, dword [ebp - 0x13c]
cmp eax, 0x3b28
jg 0x1000bf16
mov dword [ebp - 0x798], 1
jmp 0x1000bf1d
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x418], eax
imul eax, dword [ebp - 0x418], 0xffffffff
test eax, eax
je 0x1000bf41
push 0
lea ecx, [ebp - 0x135c]
call fcn.1001ae71
mov eax, dword [ebp - 0xfa4]
cmp dword [ebp - 0x13c], eax
jne 0x1000bf5b
mov dword [ebp - 0xdd0], 1
jmp 0x1000bf62
and dword [ebp - 0xdd0], 0
mov eax, dword [ebp - 0xdd0]
mov dword [ebp - 0x144], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x135c]
call fcn.1001ae55
jmp 0x1000bb78
mov dword [ebp - 0x157c], 0xfffffff8
mov dword [ebp - 0xd8], 0xc29a3df6
mov dword [ebp - 0x44], 0xa654fddd
push 3
lea ecx, [ebp - 0x7f4]
call fcn.1001add3
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x110], 0x56e6
mov dword [ebp - 0x10f4], 9
mov dword [ebp - 0xb4c], 8
mov dword [ebp - 0x1584], 0xffffffff
mov dword [ebp - 0x420], 0xfffffffe
mov dword [ebp - 0x2bc], 0
jmp 0x1000bff9
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 3
jge 0x1000c01b
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0x7f4]
call fcn.1001ae71
mov dword [eax], 1
jmp 0x1000bfec
cmp dword [ebp - 0xd8], 0
je 0x1000c039
mov eax, 0xfa75
test eax, eax
je 0x1000c039
mov dword [ebp - 0x7a0], 1
jmp 0x1000c040
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x44], eax
mov eax, 0xf068
sub eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x44]
je 0x1000c065
mov dword [ebp - 0x1230], 1
jmp 0x1000c06c
and dword [ebp - 0x1230], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x158c], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x1598], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x15a4], eax
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0xd8], eax
jl 0x1000c0a7
mov dword [ebp - 0xdd8], 1
jmp 0x1000c0ae
and dword [ebp - 0xdd8], 0
push 1
lea ecx, [ebp - 0x7f4]
call fcn.1001ae71
mov dword [eax], 0x703026d8
cmp dword [ebp - 0xdd8], 0x703026d8
jg 0x1000c0d9
mov dword [ebp - 0xfac], 1
jmp 0x1000c0e0
and dword [ebp - 0xfac], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x15b0], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x15c8], eax
mov esi, dword [ebp - 0x44]
push 1
lea ecx, [ebp - 0x7f4]
call fcn.1001ae71
cmp esi, dword [eax]
jge 0x1000c118
mov dword [ebp - 0x10ec], 1
jmp 0x1000c11f
and dword [ebp - 0x10ec], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x15d0], eax
cmp dword [ebp - 0x110], 0xa9c5a74d
jae 0x1000c143
mov dword [ebp - 0x7a8], 1
jmp 0x1000c14a
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x7a8]
neg eax
cmp eax, 0x129ec6ea
je 0x1000c165
mov dword [ebp - 0xde0], 1
jmp 0x1000c16c
and dword [ebp - 0xde0], 0
mov eax, dword [ebp - 0xde0]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x44], eax
jge 0x1000c5cd
mov dword [ebp - 0x5c], 0xa5fc
mov dword [ebp - 0x7d8], 1
mov dword [ebp - 0x1258], 0
mov dword [ebp - 0x3bc], 0
jmp 0x1000c1b8
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 4
jge 0x1000c1d4
mov eax, dword [ebp - 0x3bc]
mov dword [ebp + eax*4 - 0x17d8], 0
jmp 0x1000c1ab
mov dword [ebp - 0x44], 0
jmp 0x1000c1e4
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffff1
jl 0x1000c5c8
mov dword [ebp - 0xfb4], 0x1cdf
mov dword [ebp - 0xe10], 5
mov dword [ebp - 0x2cc], 0x92e414e4
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x15d8], eax
imul eax, dword [ebp - 0x5c], 0x8ffd
mov ecx, dword [ebp - 0xfb4]
neg ecx
imul ecx, dword [ebp - 0x5c]
sub eax, ecx
cmp eax, 0xa501
jge 0x1000c23d
mov dword [ebp - 0x46c], 1
jmp 0x1000c244
and dword [ebp - 0x46c], 0
push 2
lea ecx, [ebp - 0x7f4]
call fcn.1001ae71
mov ecx, dword [ebp - 0x46c]
mov dword [eax], ecx
cmp dword [ebp - 0x46c], 0
jne 0x1000c271
cmp dword [ebp - 0x5c], 0
jne 0x1000c271
and dword [ebp - 0x7b0], 0
jmp 0x1000c27b
mov dword [ebp - 0x7b0], 1
cmp dword [ebp - 0x7b0], 0x1e5de2ca
je 0x1000c293
mov dword [ebp - 0xde8], 1
jmp 0x1000c29a
and dword [ebp - 0xde8], 0
mov eax, dword [ebp - 0xde8]
mov dword [ebp - 0xe10], eax
mov dword [ebp - 0x5c], 0x19
jmp 0x1000c2b6
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xd
jl 0x1000c5c3
mov dword [ebp - 0xfbc], 0x133a5b7d
mov dword [ebp - 0x2c4], 0
jmp 0x1000c2e3
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x1000c2ff
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0xfc4], 0x697289f1
jmp 0x1000c2d6
mov dword [ebp - 0x110], 0xfffffff4
jmp 0x1000c318
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x2a
jge 0x1000c5be
mov dword [ebp - 0x344], 0
jmp 0x1000c33e
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 4
jge 0x1000c35a
mov eax, dword [ebp - 0x344]
mov dword [ebp + eax*4 - 0x1810], 1
jmp 0x1000c331
cmp dword [ebp - 0x5c], 0
je 0x1000c59d
push 2
lea ecx, [ebp - 0x7f4]
call fcn.1001ae71
cmp dword [ebp - 0x5c], 0
je 0x1000c3c4
mov eax, 0xe49ed226
test eax, eax
je 0x1000c392
cmp dword [ebp - 0x5c], 0
je 0x1000c392
mov dword [ebp - 0x11a4], 1
jmp 0x1000c399
and dword [ebp - 0x11a4], 0
mov eax, dword [ebp - 0xfbc]
mov dword [ebp - 0x15e0], eax
mov eax, dword [ebp - 0x2cc]
add eax, 0x37b1
je 0x1000c3c4
cmp dword [ebp - 0x5c], 0
je 0x1000c3c4
mov dword [ebp - 0x7b8], 1
jmp 0x1000c3cb
and dword [ebp - 0x7b8], 0
cmp dword [ebp - 0x7b8], 0xfffffff7
jne 0x1000c3e0
mov dword [ebp - 0xdf0], 1
jmp 0x1000c3e7
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0xdf0], eax
jne 0x1000c401
mov dword [ebp - 0x7c0], 1
jmp 0x1000c408
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x10f4]
cmp dword [ebp - 0x7c0], eax
je 0x1000c422
mov dword [ebp - 0xdf8], 1
jmp 0x1000c429
and dword [ebp - 0xdf8], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0xdf8], eax
je 0x1000c440
mov dword [ebp - 0x7c8], 1
jmp 0x1000c447
and dword [ebp - 0x7c8], 0
cmp dword [ebp - 0x7c8], 0xa80aa4b6
ja 0x1000c45f
mov dword [ebp - 0xe00], 1
jmp 0x1000c466
and dword [ebp - 0xe00], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1810]
cmp eax, dword [ebp - 0xe00]
jge 0x1000c487
mov dword [ebp - 0x7d0], 1
jmp 0x1000c48e
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x7d0], eax
jge 0x1000c4a5
mov dword [ebp - 0xe08], 1
jmp 0x1000c4ac
and dword [ebp - 0xe08], 0
mov eax, dword [ebp - 0xe08]
sub eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x15e8], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x15f0], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x17d8]
cmp dword [ebp - 0xe10], eax
jl 0x1000c4f7
and dword [ebp - 0x7fc], 0
push 2
lea ecx, [ebp - 0x7f4]
call fcn.1001ae71
mov ecx, dword [ebp - 0x7fc]
mov dword [eax], ecx
jmp 0x1000c30b
jmp 0x1000c2af
jmp 0x1000c1dd
jmp 0x1000c82a
mov dword [ebp - 0x2d4], 0x93197c82
mov dword [ebp - 0x15f8], 4
mov dword [ebp - 0x147c], 0xffffffff
mov dword [ebp - 0x1478], 0xffffffff
mov dword [ebp - 0x1474], 0xffffffff
mov dword [ebp - 0x1470], 0xffffffff
push 4
lea ecx, [ebp - 0x11c0]
call fcn.1001add3
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x384], 0
jmp 0x1000c633
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 4
jge 0x1000c655
push dword [ebp - 0x384]
lea ecx, [ebp - 0x11c0]
call fcn.1001ae71
mov dword [eax], 0xfffffffd
jmp 0x1000c626
mov byte [ebp - 0x19d], 0
movzx eax, byte [ebp - 0x19d]
test eax, eax
je 0x1000c66f
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 0xb4c], 0
je 0x1000c7ea
mov eax, dword [ebp - 0x2d4]
neg eax
je 0x1000c692
mov dword [ebp - 0xb44], 1
jmp 0x1000c699
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x1600], eax
push 1
lea ecx, [ebp - 0x7f4]
call fcn.1001ae71
mov ecx, dword [ebp - 0xb44]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x147c]
mov dword [ebp - 0x1608], eax
mov eax, dword [ebp - 0x420]
dec eax
mov dword [ebp - 0x420], eax
mov esi, dword [ebp - 0x2d4]
push 0
lea ecx, [ebp - 0x11c0]
call fcn.1001ae71
cmp esi, dword [eax]
jge 0x1000c6fd
mov dword [ebp - 0x804], 1
jmp 0x1000c704
and dword [ebp - 0x804], 0
mov esi, dword [ebp - 0x804]
dec esi
push 3
lea ecx, [ebp - 0x11c0]
call fcn.1001ae71
cmp esi, dword [eax]
jl 0x1000c728
mov dword [ebp - 0xe54], 1
jmp 0x1000c72f
and dword [ebp - 0xe54], 0
cmp dword [ebp - 0xe54], 0
jg 0x1000c744
mov dword [ebp - 0x80c], 1
jmp 0x1000c74b
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x80c]
je 0x1000c765
mov dword [ebp - 0x814], 1
jmp 0x1000c76c
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0xb4c]
cmp dword [ebp - 0x814], eax
jne 0x1000c78f
cmp dword [ebp - 0x2d4], 0
je 0x1000c78f
mov dword [ebp - 0xfcc], 1
jmp 0x1000c796
and dword [ebp - 0xfcc], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x1610], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1618], eax
cmp dword [ebp - 0x2d4], 0xffffffff
je 0x1000c7c0
mov dword [ebp - 0xcec], 1
jmp 0x1000c7c7
and dword [ebp - 0xcec], 0
push 0
lea ecx, [ebp - 0x11c0]
call fcn.1001ae71
mov ecx, dword [ebp - 0xcec]
cmp ecx, dword [eax]
jge 0x1000c7ea
mov dword [ebp - 0x81c], 1
jmp 0x1000c7f1
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x81c], eax
jge 0x1000c80b
mov dword [ebp - 0xb54], 1
jmp 0x1000c812
and dword [ebp - 0xb54], 0
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x11c0]
call fcn.1001ae55
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x7f4]
call fcn.1001ae55
mov dword [ebp - 0x474], 0xfffffffa
push 2
lea ecx, [ebp - 0x4b0]
call fcn.1001add3
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x210], 0xa9ac70c3
mov dword [ebp - 0x34c], 0
jmp 0x1000c877
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 2
jge 0x1000c896
push dword [ebp - 0x34c]
lea ecx, [ebp - 0x4b0]
call fcn.1001ae71
and dword [eax], 0
jmp 0x1000c86a
push 0
lea ecx, [ebp - 0x4b0]
call fcn.1001ae71
mov dword [eax], 0x13
jmp 0x1000c8cf
push 0
lea ecx, [ebp - 0x4b0]
call fcn.1001ae71
mov dword [ebp - 0x824], eax
mov eax, dword [ebp - 0x824]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x824]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x4b0]
call fcn.1001ae71
cmp dword [eax], 0xfffffff1
jge 0x1000c8ff
mov byte [ebp - 0x1b1], 0
movzx eax, byte [ebp - 0x1b1]
test eax, eax
je 0x1000c8fd
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x1000c8ab
mov dword [ebp - 0x210], 0
jmp 0x1000c918
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffe3
je 0x1000cded
mov dword [ebp - 0x1c4], 1
mov dword [ebp - 0x3a4], 0x5d840dfe
mov dword [ebp - 0x844], 9
mov dword [ebp - 0x86c], 0xe6b87c26
mov dword [ebp - 0xb84], 0x194e4064
push 2
lea ecx, [ebp - 0x1368]
call fcn.1001add3
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x2dc], 0
jmp 0x1000c981
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 2
jge 0x1000c9a3
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0x1368]
call fcn.1001ae71
mov dword [eax], 1
jmp 0x1000c974
mov dword [ebp - 0x1c4], 0xfffffff7
jmp 0x1000c9bc
cmp dword [ebp - 0x1c4], 7
jge 0x1000cdd9
mov dword [ebp - 0x94], 0xfffffffc
push 0
lea ecx, [ebp - 0x4b0]
call fcn.1001ae71
cmp dword [ebp - 0x3a4], 0
jge 0x1000c9f5
mov dword [ebp - 0xdbc], 1
jmp 0x1000c9fc
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0xdbc], eax
jne 0x1000ca16
mov dword [ebp - 0x82c], 1
jmp 0x1000ca1d
and dword [ebp - 0x82c], 0
cmp dword [ebp - 0x82c], 0x4668dacb
jl 0x1000ca35
mov dword [ebp - 0xb5c], 1
jmp 0x1000ca3c
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0xb5c], eax
jle 0x1000ca56
mov dword [ebp - 0x834], 1
jmp 0x1000ca5d
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x844]
cmp dword [ebp - 0x834], eax
jg 0x1000ca77
mov dword [ebp - 0xcf4], 1
jmp 0x1000ca7e
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xcf4]
sub eax, dword [ebp - 0x94]
cmp eax, 0x5d06
jl 0x1000ca9d
mov dword [ebp - 0x83c], 1
jmp 0x1000caa4
and dword [ebp - 0x83c], 0
mov esi, dword [ebp - 0x83c]
sub esi, dword [ebp - 0x94]
push 0
lea ecx, [ebp - 0x4b0]
call fcn.1001ae71
cmp esi, dword [eax]
jne 0x1000cacd
mov dword [ebp - 0xb64], 1
jmp 0x1000cad4
and dword [ebp - 0xb64], 0
mov esi, dword [ebp - 0xb64]
neg esi
add esi, dword [ebp - 0x844]
push 1
lea ecx, [ebp - 0x4b0]
call fcn.1001ae71
cmp esi, dword [eax]
jge 0x1000caff
mov dword [ebp - 0xe24], 1
jmp 0x1000cb06
and dword [ebp - 0xe24], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0xe24]
jge 0x1000cb20
mov dword [ebp - 0x84c], 1
jmp 0x1000cb27
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x84c]
add eax, 0x2cd8491f
cmp eax, 0x9e1f9531
jne 0x1000cb45
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1368]
call fcn.1001ae55
jmp 0x1000c90b
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x4b0]
call fcn.1001ae55
mov dword [ebp - 0x48], 0
jmp 0x1000ce0c
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1000ce28
push dword [ebp - 0x48]
lea ecx, [ebp - 0x4c0]
call fcn.1001ae71
mov dword [eax], 0x85f7
jmp 0x1000ce05
mov dword [ebp - 0x48], 0
jmp 0x1000ce38
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1000ce4b
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x24], 0
jmp 0x1000ce31
push 1
lea ecx, [ebp - 0x127c]
call fcn.1001add3
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x428], 0xffffffff
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x8a4], 0xfffffffb
mov dword [ebp - 0xb94], 1
mov dword [ebp - 0xf8], 0
jmp 0x1000ce9d
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jge 0x1000ceb9
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0xf68], 8
jmp 0x1000ce90
mov dword [ebp - 0xf8], 0
jmp 0x1000ced2
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jge 0x1000cef4
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x127c]
call fcn.1001ae71
mov dword [eax], 0xfffffffe
jmp 0x1000cec5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf68], 0
jne 0x1000cf59
push 0
lea ecx, [ebp - 0x127c]
call fcn.1001ae71
mov dword [eax], 1
mov dword [ebp - 0x428], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf68]
mov dword [ebp - 0x1630], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xf68]
cmp dword [ebp + eax - 0xf68], ecx
jl 0x1000cf59
and dword [ebp - 0xd0c], 0
jmp 0x1000cf63
mov dword [ebp - 0xd0c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf68]
cmp eax, dword [ebp - 0xd0c]
jne 0x1000cf84
mov dword [ebp - 0x89c], 1
jmp 0x1000cf8b
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x4b4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf68]
mov dword [ebp - 0x1638], eax
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x11b4], eax
push 0
lea ecx, [ebp - 0x127c]
call fcn.1001ae71
mov ecx, dword [ebp - 0x11b4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0xb94], eax
cmp dword [ebp - 0xb94], 0
jne 0x1000cfec
mov dword [ebp - 0xfdc], 1
jmp 0x1000cff3
and dword [ebp - 0xfdc], 0
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x16c8], eax
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x16d0], eax
cmp dword [ebp - 0x428], 1
jne 0x1000d020
mov dword [ebp - 0xdcc], 1
jmp 0x1000d027
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0xdcc]
mov dword [ebp - 0x428], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x127c]
call fcn.1001ae55
mov dword [ebp - 0x48], 0
jmp 0x1000d052
cmp dword [ebp - 0x48], 2
jge 0x1000d06e