Function at 0x1000a2a0
Capabilities:
Accept command line arguments
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006adc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c8
push esi
push edi
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x28], 0
jmp 0x1000a2d7
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffffe
jne 0x1000a3d2
mov dword [ebp - 0x148], 0x31e42a43
mov dword [ebp - 0x37c], 3
mov dword [ebp - 0x148], 0xffffffff
jmp 0x1000a30e
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x1b
je 0x1000a3cd
mov dword [ebp - 0x15c], 0xf495e3b3
mov eax, dword [ebp - 0x28]
sub eax, 7
cmp eax, 2
jb 0x1000a33c
mov dword [ebp - 0x2b0], 1
jmp 0x1000a343
and dword [ebp - 0x2b0], 0
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1000a394
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x28], eax
jl 0x1000a36a
cmp dword [ebp - 0x15c], 0
je 0x1000a36a
mov dword [ebp - 0x280], 1
jmp 0x1000a371
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x37c], eax
jg 0x1000a394
mov dword [ebp - 0x198], 1
jmp 0x1000a39b
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x2b0]
cmp eax, dword [ebp - 0x198]
je 0x1000a3b5
mov dword [ebp - 0x32c], 1
jmp 0x1000a3bc
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x15c], eax
jmp 0x1000a301
jmp 0x1000a2d0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x3c], 0
jmp 0x1000a3ef
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffffe
jne 0x1000a4ea
mov dword [ebp - 0xc0], 0x31e42a43
mov dword [ebp - 0x334], 3
mov dword [ebp - 0xc0], 0xffffffff
jmp 0x1000a426
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x1b
je 0x1000a4e5
mov dword [ebp - 0x184], 0xf495e3b3
mov eax, dword [ebp - 0x3c]
sub eax, 7
cmp eax, 2
jb 0x1000a454
mov dword [ebp - 0x1a8], 1
jmp 0x1000a45b
and dword [ebp - 0x1a8], 0
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1000a4ac
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x3c], eax
jl 0x1000a482
cmp dword [ebp - 0x184], 0
je 0x1000a482
mov dword [ebp - 0x1a0], 1
jmp 0x1000a489
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x334], eax
jg 0x1000a4ac
mov dword [ebp - 0x33c], 1
jmp 0x1000a4b3
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x33c]
je 0x1000a4cd
mov dword [ebp - 0x1b0], 1
jmp 0x1000a4d4
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x184], eax
jmp 0x1000a419
jmp 0x1000a3e8
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
push 3
lea ecx, [ebp - 0x394]
call fcn.1000dfce
and dword [ebp - 4], 0
mov dword [ebp - 0xa8], 0x96960f57
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x124], 0
jmp 0x1000a52b
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 3
jge 0x1000a54d
push dword [ebp - 0x124]
lea ecx, [ebp - 0x394]
call fcn.1000e00f
mov dword [eax], 0xfffa
jmp 0x1000a51e
mov dword [ebp - 0x398], 0x22bb
cmp dword [ebp - 0x398], 0x79b
jge 0x1000a8d3
mov dword [ebp - 0x12c], 0x4d
lea eax, [ebp - 0x18]
push eax
push 0x100089dc
call fcn.10050e4b
pop ecx
pop ecx
and dword [ebp - 0x3d4], 0
lea eax, [ebp - 0x3d4]
push eax
mov eax, dword [ebp - 0x18]
dec eax
push eax
lea ecx, [ebp - 0x484]
call fcn.1000e01e
mov byte [ebp - 4], 1
and dword [ebp - 0xc8], 0
jmp 0x1000a5b9
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x18]
dec eax
cmp dword [ebp - 0xc8], eax
jge 0x1000a5e5
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x484]
call fcn.1000e00f
push eax
push 0x100089d8
call fcn.10050e4b
pop ecx
pop ecx
jmp 0x1000a5ac
and dword [ebp - 0x3dc], 0
lea eax, [ebp - 0x3dc]
push eax
mov eax, dword [ebp - 0x18]
dec eax
push eax
lea ecx, [ebp - 0x4a8]
call fcn.1000e01e
mov byte [ebp - 4], 2
and dword [ebp - 0x140], 0
jmp 0x1000a61d
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x18]
dec eax
cmp dword [ebp - 0x140], eax
jge 0x1000a649
push dword [ebp - 0x140]
lea ecx, [ebp - 0x4a8]
call fcn.1000e00f
push eax
push 0x100089d8
call fcn.10050e4b
pop ecx
pop ecx
jmp 0x1000a610
and dword [ebp - 0x3e4], 0
lea eax, [ebp - 0x3e4]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x490]
call fcn.1000e01e
mov byte [ebp - 4], 3
and dword [ebp - 0xd0], 0
jmp 0x1000a67f
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x18]
jge 0x1000a6aa
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x490]
call fcn.1000e00f
push eax
push 0x100089d8
call fcn.10050e4b
pop ecx
pop ecx
jmp 0x1000a672
and dword [ebp - 0x3ec], 0
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x454]
call fcn.1000e01e
mov byte [ebp - 4], 4
and dword [ebp - 0x3cc], 0
lea eax, [ebp - 0x3cc]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x460]
call fcn.1000e01e
mov byte [ebp - 4], 5
mov dword [ebp - 0x7c], 1
jmp 0x1000a6fa
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x18]
jge 0x1000a73a
mov eax, dword [ebp - 0x7c]
dec eax
push eax
lea ecx, [ebp - 0x454]
call fcn.1000e00f
mov esi, eax
mov eax, dword [ebp - 0x7c]
dec eax
push eax
lea ecx, [ebp - 0x484]
call fcn.1000e00f
mov esi, dword [esi]
add esi, dword [eax]
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x454]
call fcn.1000e00f
mov dword [eax], esi
jmp 0x1000a6f3
mov eax, dword [ebp - 0x18]
dec eax
dec eax
mov dword [ebp - 0x98], eax
jmp 0x1000a754
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x1000a79c
mov eax, dword [ebp - 0x98]
inc eax
push eax
lea ecx, [ebp - 0x460]
call fcn.1000e00f
mov esi, eax
push dword [ebp - 0x98]
lea ecx, [ebp - 0x4a8]
call fcn.1000e00f
mov esi, dword [esi]
add esi, dword [eax]
push dword [ebp - 0x98]
lea ecx, [ebp - 0x460]
call fcn.1000e00f
mov dword [eax], esi
jmp 0x1000a747
mov eax, dword [ebp - 0x12c]
imul eax, dword [ebp - 0x12c]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x12c]
imul eax, dword [ebp - 0x12c]
mov dword [ebp - 0xe0], eax
and dword [ebp - 0x88], 0
jmp 0x1000a7d8
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x18]
jge 0x1000a86f
push dword [ebp - 0x88]
lea ecx, [ebp - 0x454]
call fcn.1000e00f
mov esi, eax
push dword [ebp - 0x88]
lea ecx, [ebp - 0x490]
call fcn.1000e00f
mov esi, dword [esi]
add esi, dword [eax]
push dword [ebp - 0x88]
lea ecx, [ebp - 0x460]
call fcn.1000e00f
add esi, dword [eax]
mov dword [ebp - 0xd8], esi
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x150]
jg 0x1000a850
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x150], eax
jmp 0x1000a86a
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0xe0]
jge 0x1000a86a
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xe0], eax
jmp 0x1000a7cb
mov eax, dword [ebp - 0x150]
add eax, dword [ebp - 0xe0]
push eax
push 0x100089dc
call fcn.10051040
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x460]
call fcn.1000e040
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x454]
call fcn.1000e040
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x490]
call fcn.1000e040
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4a8]
call fcn.1000e040
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x484]
call fcn.1000e040
mov dword [ebp - 0xa8], 0
jmp 0x1000a8ec
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jg 0x1000aa8c
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x90], 0x56df
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x394]
call fcn.1000e00f
mov esi, eax
push 0
lea ecx, [ebp - 0x394]
call fcn.1000e00f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1000a93c
mov dword [ebp - 0x344], 1
jmp 0x1000a943
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
neg eax
imul eax, eax, 0xb666
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0
jmp 0x1000a96a
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x1000aa87
mov dword [ebp - 0x18c], 0x4c8f0d07
mov dword [ebp - 0x3a4], 0xfffffff8
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x40], 0
je 0x1000a9b5
cmp dword [ebp - 0x18c], 0
je 0x1000a9b5
cmp dword [ebp - 0x40], 0
je 0x1000a9b5
mov dword [ebp - 0x1b8], 1
jmp 0x1000a9bc
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x1b8], eax
jne 0x1000a9dc
cmp dword [ebp - 0x90], 0
jne 0x1000a9dc
and dword [ebp - 0x34c], 0
jmp 0x1000a9e6
mov dword [ebp - 0x34c], 1
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [ebp - 0x34c]
add ecx, dword [ebp - 0x40]
imul eax, ecx
cmp eax, 0xb64d
jge 0x1000aa6e
mov dword [ebp - 0x54], 2
jmp 0x1000aa1b
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1000aa6c
mov dword [ebp - 0x90], 2
jmp 0x1000aa3a
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x1000aa6a
push dword [ebp - 0x90]
lea ecx, [ebp - 0x394]
call fcn.1000e00f
mov esi, eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x394]
call fcn.1000e00f
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000aa2d
jmp 0x1000aa14
jmp 0x1000aa82
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x1000aa82
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
jmp 0x1000a963
jmp 0x1000a8df
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x394]
call fcn.1000e00a
mov dword [ebp - 0xe8], 0x2c03342e
mov dword [ebp - 0x548], 0xffffffff
mov dword [ebp - 0x4dc], 0x3b6182ea
mov dword [ebp - 0x3a8], 0xfffffff9
mov dword [ebp - 0x50c], 0x6a205b29
mov dword [ebp - 0x114], 0
jmp 0x1000aae6
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x1000ab02
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x414], 0
jmp 0x1000aad9
mov dword [ebp - 0xe8], 0xffffffeb
jmp 0x1000ab1b
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xffffffea
je 0x1000abd9
mov dword [ebp - 0x514], 0x26ff23b1
push 3
lea ecx, [ebp - 0x58c]
call fcn.1000dfce
mov dword [ebp - 4], 6
mov dword [ebp - 0x1c0], 2
mov dword [ebp - 0x2c], 0
jmp 0x1000ab60
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1000ab76
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x51c], 0xfffffffa
jmp 0x1000ab59
mov dword [ebp - 0x2c], 0
jmp 0x1000ab86
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1000aba2
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x58c]
call fcn.1000e00f
mov dword [eax], 0x84bc9c3d
jmp 0x1000ab7f
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
mov byte [ebp - 0x58], 0
movzx eax, byte [ebp - 0x58]
test eax, eax
je 0x1000abc5
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58c]
call fcn.1000e00a
jmp 0x1000ab0e
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3a8]
mov dword [ebp + eax - 0x414], ecx
push 3
lea ecx, [ebp - 0x388]
call fcn.1000dfce
mov dword [ebp - 4], 7
mov dword [ebp - 0xa0], 0x96960f57
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x118], 0
jmp 0x1000ac2a
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 3
jge 0x1000ac4c
push dword [ebp - 0x118]
lea ecx, [ebp - 0x388]
call fcn.1000e00f
mov dword [eax], 0xfffa
jmp 0x1000ac1d
mov dword [ebp - 0xa0], 0
jmp 0x1000ac65
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jg 0x1000adf0
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x80], 0x56df
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x388]
call fcn.1000e00f
mov esi, eax
push 0
lea ecx, [ebp - 0x388]
call fcn.1000e00f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1000acb2
mov dword [ebp - 0x354], 1
jmp 0x1000acb9
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
neg eax
imul eax, eax, 0xb666
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0
jmp 0x1000ace0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x1000adeb
mov dword [ebp - 0x178], 0x4c8f0d07
mov dword [ebp - 0x3b0], 0xfffffff8
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x30], 0
je 0x1000ad2b
cmp dword [ebp - 0x178], 0
je 0x1000ad2b
cmp dword [ebp - 0x30], 0
je 0x1000ad2b
mov dword [ebp - 0x1c8], 1
jmp 0x1000ad32
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x1c8], eax
jne 0x1000ad4f
cmp dword [ebp - 0x80], 0
jne 0x1000ad4f
and dword [ebp - 0x35c], 0
jmp 0x1000ad59
mov dword [ebp - 0x35c], 1
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x3b0]
add ecx, dword [ebp - 0x35c]
add ecx, dword [ebp - 0x30]
imul eax, ecx
cmp eax, 0xb64d
jge 0x1000add2
mov dword [ebp - 0x50], 2
jmp 0x1000ad8e
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x1000add0
mov dword [ebp - 0x80], 2
jmp 0x1000ada4
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x1000adce
push dword [ebp - 0x80]
lea ecx, [ebp - 0x388]
call fcn.1000e00f
mov esi, eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x388]
call fcn.1000e00f
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1000ad9d
jmp 0x1000ad87
jmp 0x1000ade6
mov byte [ebp - 0x6f], 0
movzx eax, byte [ebp - 0x6f]
test eax, eax
je 0x1000ade6
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
jmp 0x1000acd9
jmp 0x1000ac58
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x388]
call fcn.1000e00a
mov dword [ebp - 0x120], 0x2c03342e
mov dword [ebp - 0x52c], 0xffffffff
mov dword [ebp - 0x534], 0x3b6182ea
mov dword [ebp - 0x408], 0xfffffff9
mov dword [ebp - 0x53c], 0x6a205b29
mov dword [ebp - 0xf0], 0
jmp 0x1000ae4a
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x1000ae66
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x3b8], 0
jmp 0x1000ae3d
mov dword [ebp - 0x120], 0xffffffeb
jmp 0x1000ae7f
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffea
je 0x1000af3d
mov dword [ebp - 0x544], 0x26ff23b1
push 3
lea ecx, [ebp - 0x59c]
call fcn.1000dfce
mov dword [ebp - 4], 8
mov dword [ebp - 0x1d0], 2
mov dword [ebp - 0x38], 0
jmp 0x1000aec4
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1000aeda
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x54c], 0xfffffffa
jmp 0x1000aebd
mov dword [ebp - 0x38], 0
jmp 0x1000aeea
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1000af06
push dword [ebp - 0x38]
lea ecx, [ebp - 0x59c]
call fcn.1000e00f
mov dword [eax], 0x84bc9c3d
jmp 0x1000aee3
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
mov byte [ebp - 0x5a], 0
movzx eax, byte [ebp - 0x5a]
test eax, eax
je 0x1000af29
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x59c]
call fcn.1000e00a
jmp 0x1000ae72
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x408]
mov dword [ebp + eax - 0x3b8], ecx
mov dword [ebp - 0x84], 0x9e57ad95
push 3
lea ecx, [ebp - 0x49c]
call fcn.1000dfce
mov dword [ebp - 4], 9
mov dword [ebp - 0x554], 0xfff9
mov dword [ebp - 0x34], 0
jmp 0x1000af88
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1000af9e
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x128], 0xc204e2db
jmp 0x1000af81
mov dword [ebp - 0x34], 0
jmp 0x1000afae
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1000afc7
push dword [ebp - 0x34]
lea ecx, [ebp - 0x49c]
call fcn.1000e00f
or dword [eax], 0xffffffff
jmp 0x1000afa7
mov dword [ebp - 0x84], 0
jmp 0x1000afe0
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jl 0x1000b20a
mov dword [ebp - 0x1d8], 0x6b719d87
mov dword [ebp - 0x43c], 1
mov dword [ebp - 0xf8], 0
jmp 0x1000b01a
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x1000b036
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x138], 0
jmp 0x1000b00d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x138], 0
jmp 0x1000b064
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x138], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x138], 0
jl 0x1000b205
mov dword [ebp - 0x168], 7
mov dword [ebp - 0x374], 0xaf9d66de
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
cmp dword [ebp + eax*4 - 0x128], 0
jne 0x1000b1e1
or eax, 0xffffffff
je 0x1000b0cf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
cmp dword [ebp + eax*4 - 0x128], 0
je 0x1000b0cf
mov dword [ebp - 0x364], 1
jmp 0x1000b0d6
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x168], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
mov eax, dword [ebp + eax*4 - 0x128]
cmp dword [ebp - 0x168], eax
jl 0x1000b11c
cmp dword [ebp - 0x84], 0
jne 0x1000b11c
and dword [ebp - 0x36c], 0
jmp 0x1000b126
mov dword [ebp - 0x36c], 1
mov eax, dword [ebp - 0x36c]
neg eax
mov dword [ebp - 0x374], eax
jne 0x1000b148
cmp dword [ebp - 0x43c], 0
jne 0x1000b148
and dword [ebp - 0x1e4], 0
jmp 0x1000b152
mov dword [ebp - 0x1e4], 1
cmp dword [ebp - 0x1e4], 0xffffffff
jle 0x1000b167
mov dword [ebp - 0x1e8], 1
jmp 0x1000b16e
and dword [ebp - 0x1e8], 0
imul eax, dword [ebp - 0x1e8], 6
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x138]
jne 0x1000b196
cmp dword [ebp - 0x168], 0
jne 0x1000b196
and dword [ebp - 0x318], 0
jmp 0x1000b1a0
mov dword [ebp - 0x318], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
mov eax, dword [ebp + eax*4 - 0x128]
cmp dword [ebp - 0x318], eax
jle 0x1000b1c8
mov dword [ebp - 0x3c0], 1
jmp 0x1000b1cf
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x84], 0
jne 0x1000b1e1
and dword [ebp - 0x1f0], 0
jmp 0x1000b1eb
mov dword [ebp - 0x1f0], 1
push 0
lea ecx, [ebp - 0x49c]
call fcn.1000e00f
mov ecx, dword [ebp - 0x1f0]
mov dword [eax], ecx
jmp 0x1000b049
jmp 0x1000afd3
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1000b221
push 0xafb
call dword [sym.imp.USER32.dll_GetDC]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x49c]
call fcn.1000e00a
movzx eax, byte [0x1065ee40]
test eax, eax
je 0x1000b24e
mov esi, 0x10072600
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1000cd61
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x188], 0x3bed
mov dword [ebp - 0x170], 0xacd4a797
mov dword [ebp - 0x210], 0xfffffff6
mov dword [ebp - 0x2d0], 0xffffffff
mov dword [ebp - 0x100], 0
jmp 0x1000b296
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x1000b2b2
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x5b8], 0xfddf34ff
jmp 0x1000b289
cmp dword [ebp - 0x60], 0xef51
je 0x1000b2c7
mov dword [ebp - 0x2b8], 1
jmp 0x1000b2ce
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x2b8], eax
jle 0x1000b2e8
mov dword [ebp - 0x1f8], 1
jmp 0x1000b2ef
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x1f8], eax
jle 0x1000b309
mov dword [ebp - 0x410], 1
jmp 0x1000b310
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x60]
add eax, 0x4ce34aaf
sub eax, dword [ebp - 0x170]
jne 0x1000b33e
cmp dword [ebp - 0x170], 0
jne 0x1000b33e
and dword [ebp - 0x370], 0
jmp 0x1000b348
mov dword [ebp - 0x370], 1
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x370]
jge 0x1000b35f
mov dword [ebp - 0x200], 1
jmp 0x1000b366
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x200]
lea eax, [ecx + eax + 3]
cmp dword [ebp - 0x60], eax
jge 0x1000b387
mov dword [ebp - 0x2c0], 1
jmp 0x1000b38e
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x2c0], eax
jg 0x1000b3a8
mov dword [ebp - 0x208], 1
jmp 0x1000b3af
and dword [ebp - 0x208], 0
imul eax, dword [ebp - 0x208], 0
cmp eax, 0xa165f5c9
jne 0x1000b3c9
mov dword [ebp - 0x320], 1
jmp 0x1000b3d0
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x320]
cmp eax, dword [ebp - 0x210]
je 0x1000b3ed
mov dword [ebp - 0x2c8], 1
jmp 0x1000b3f4
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0xffff
jae 0x1000b40c
mov dword [ebp - 0x218], 1
jmp 0x1000b413
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x218], eax
jl 0x1000b42a
mov dword [ebp - 0x350], 1
jmp 0x1000b431
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x350]
cmp eax, 0xfffffff6
jne 0x1000b44c
mov dword [ebp - 0x220], 1
jmp 0x1000b453
and dword [ebp - 0x220], 0
imul eax, dword [ebp - 0x220], 0xae8e
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 1
jne 0x1000b478
mov dword [ebp - 0x228], 1
jmp 0x1000b47f
and dword [ebp - 0x228], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x228]
mov dword [ebp + eax - 0x5b8], ecx
mov dword [ebp - 0x564], 0x10072600
mov dword [ebp - 0x56c], 0xea75c96
mov dword [ebp - 0x3c8], 0x7df2f4a8
mov dword [ebp - 0x574], 3
mov dword [ebp - 0x328], 0xffff
mov dword [ebp - 0x130], 0
jmp 0x1000b4dc
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x1000b4f8
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x5cc], 0x256a9ef7
jmp 0x1000b4cf
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
mov dword [ebp - 0x3c8], 0x2a831d26
mov dword [ebp - 0x57c], 0x10072604
mov dword [ebp - 0x94], 0x9e57ad95
push 3
lea ecx, [ebp - 0x4b4]
call fcn.1000dfce
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x5a8], 0xfff9
mov dword [ebp - 0x44], 0
jmp 0x1000b551
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1000b567
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x13c], 0xc204e2db
jmp 0x1000b54a
mov dword [ebp - 0x44], 0
jmp 0x1000b577
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x1000b590
push dword [ebp - 0x44]
lea ecx, [ebp - 0x4b4]
call fcn.1000e00f
or dword [eax], 0xffffffff
jmp 0x1000b570
mov dword [ebp - 0x94], 0
jmp 0x1000b5a9
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x1000b905
mov dword [ebp - 0x2d8], 0x6b719d87
mov dword [ebp - 0x3d0], 1
mov dword [ebp - 0x428], 0x21bb
cmp dword [ebp - 0x428], 0x7a1
jge 0x1000b6fc
and dword [ebp - 0xb0], 0
and dword [ebp - 0xb4], 0
and dword [ebp - 0x8c], 0
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0x100089e4
call fcn.10050e4b
add esp, 0x10
movsd xmm0, qword [0x100091d0]
movsd qword [ebp - 0x4e8], xmm0
cmp dword [ebp - 0xb0], 1
jne 0x1000b646
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0xb4]
jle 0x1000b6e4
cmp dword [ebp - 0xb0], 2
jne 0x1000b663
mov eax, dword [ebp - 0x8c]
shl eax, 1
cmp eax, dword [ebp - 0xb4]
jle 0x1000b6e4
cmp dword [ebp - 0xb0], 3
jl 0x1000b6f1
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0xb4]
jge 0x1000b6f1
cvtsi2sd xmm0, dword [ebp - 0xb0]
movsd xmm1, qword [ebp - 0x4e8]
divsd xmm1, xmm0
push ecx
push ecx
movsd qword [esp], xmm1
call fcn.10051350
pop ecx
pop ecx
fstp qword [ebp - 0x4f4]
movsd xmm0, qword [ebp - 0x4f4]
cvtsi2sd xmm1, dword [ebp - 0x8c]
mulsd xmm1, qword [0x100091c0]
cvtsi2sd xmm2, dword [ebp - 0xb4]
mulsd xmm2, qword [0x100091c0]
cvtsi2sd xmm3, dword [ebp - 0x8c]
subsd xmm2, xmm3
divsd xmm1, xmm2
comisd xmm0, xmm1
jb 0x1000b6f1
push 0x100089f0
call fcn.100511a7
pop ecx
jmp 0x1000b6fc
push 0x100089f4
call fcn.100511a7
pop ecx
mov dword [ebp - 0x108], 0
jmp 0x1000b715
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 2
jge 0x1000b731
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x158], 0
jmp 0x1000b708
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x158], 0
jmp 0x1000b75f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x158]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x158], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x158], 0
jl 0x1000b900
mov dword [ebp - 0x180], 7
mov dword [ebp - 0x368], 0xaf9d66de
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x158]
cmp dword [ebp + eax*4 - 0x13c], 0
jne 0x1000b8dc
or eax, 0xffffffff
je 0x1000b7ca
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x158]
cmp dword [ebp + eax*4 - 0x13c], 0
je 0x1000b7ca
mov dword [ebp - 0x230], 1
jmp 0x1000b7d1
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x180], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x158]
mov eax, dword [ebp + eax*4 - 0x13c]
cmp dword [ebp - 0x180], eax
jl 0x1000b817
cmp dword [ebp - 0x94], 0
jne 0x1000b817
and dword [ebp - 0x238], 0
jmp 0x1000b821
mov dword [ebp - 0x238], 1
mov eax, dword [ebp - 0x238]
neg eax
mov dword [ebp - 0x368], eax
jne 0x1000b843
cmp dword [ebp - 0x3d0], 0
jne 0x1000b843
and dword [ebp - 0x240], 0
jmp 0x1000b84d
mov dword [ebp - 0x240], 1
cmp dword [ebp - 0x240], 0xffffffff
jle 0x1000b862
mov dword [ebp - 0x2e0], 1
jmp 0x1000b869
and dword [ebp - 0x2e0], 0
imul eax, dword [ebp - 0x2e0], 6
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x158]
jne 0x1000b891
cmp dword [ebp - 0x180], 0
jne 0x1000b891
and dword [ebp - 0x248], 0
jmp 0x1000b89b
mov dword [ebp - 0x248], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x158]
mov eax, dword [ebp + eax*4 - 0x13c]
cmp dword [ebp - 0x248], eax
jle 0x1000b8c3
mov dword [ebp - 0x418], 1
jmp 0x1000b8ca
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x94], 0
jne 0x1000b8dc
and dword [ebp - 0x330], 0
jmp 0x1000b8e6
mov dword [ebp - 0x330], 1
push 0
lea ecx, [ebp - 0x4b4]
call fcn.1000e00f
mov ecx, dword [ebp - 0x330]
mov dword [eax], ecx
jmp 0x1000b744
jmp 0x1000b59c
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x1000b91c
push 0xafb
call dword [sym.imp.USER32.dll_GetDC]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4b4]
call fcn.1000e00a
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x4d4], 0xb319bd1
mov dword [ebp - 0x4d0], 0xb319bd1
mov dword [ebp - 0x4cc], 0xb319bd1
mov dword [ebp - 0x4c8], 0xb319bd1
mov byte [ebp - 0x73], 0
movzx eax, byte [ebp - 0x73]
test eax, eax
je 0x1000b970
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x1c], 0
jmp 0x1000b980
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffe
jge 0x1000bccf
mov dword [ebp - 0x9c], 0xffffffff
mov dword [ebp - 0x144], 0x21046671
mov dword [ebp - 0x268], 1
mov dword [ebp - 0x300], 0xfffffff7
mov dword [ebp - 0x340], 0xffffffff
mov dword [ebp - 0x3e0], 0xffffffff
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x500], eax
mov eax, 0x27fa
cmp eax, 0xad5b
jg 0x1000b9ea
mov dword [ebp - 0x250], 1
jmp 0x1000b9f1
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x250]
add eax, dword [ebp - 0x1c]
jne 0x1000ba11
cmp dword [ebp - 0x9c], 0
jne 0x1000ba11
and dword [ebp - 0x2e8], 0
jmp 0x1000ba1b
mov dword [ebp - 0x2e8], 1
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x2e8], eax
jle 0x1000ba35
mov dword [ebp - 0x258], 1
jmp 0x1000ba3c
and dword [ebp - 0x258], 0
cmp dword [ebp - 0x258], 0x30a9
je 0x1000ba54
mov dword [ebp - 0x358], 1
jmp 0x1000ba5b
and dword [ebp - 0x358], 0
cmp dword [ebp - 0x358], 1
jle 0x1000ba70
mov dword [ebp - 0x260], 1
jmp 0x1000ba77
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
neg eax
je 0x1000ba8a
cmp dword [ebp - 0x9c], 0
jne 0x1000ba99
cmp dword [ebp - 0x1c], 0
jne 0x1000ba99
and dword [ebp - 0x3d8], 0
jmp 0x1000baa3
mov dword [ebp - 0x3d8], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4e0], eax
imul eax, dword [ebp - 0x9c], 0
cmp eax, dword [ebp - 0x144]
jle 0x1000bad2
mov byte [ebp - 0x6c], 0
movzx eax, byte [ebp - 0x6c]
test eax, eax
je 0x1000bacd
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x1000bcca
mov dword [ebp - 0x278], 0x6a4137d6
mov dword [ebp - 0x190], 7
mov dword [ebp - 0x2f8], 0xfffffff8
push 2
lea ecx, [ebp - 0x46c]
call fcn.1000dfce
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x110], 0
jmp 0x1000bb1d
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jge 0x1000bb3c
push dword [ebp - 0x110]
lea ecx, [ebp - 0x46c]
call fcn.1000e00f
or dword [eax], 0xffffffff
jmp 0x1000bb10
cmp dword [ebp - 0x278], 0
jne 0x1000bc4b
cmp dword [ebp - 0x144], 0xffff
jb 0x1000bb61
mov dword [ebp - 0x2f0], 1
jmp 0x1000bb68
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
neg eax
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x338], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x338]
mov dword [ebp + eax - 0x4d4], ecx
cmp dword [ebp - 0x338], 0x549c
jle 0x1000bbad
mov dword [ebp - 0x270], 1
jmp 0x1000bbb4
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x270]
add eax, 8
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x144], 5
jle 0x1000bbfc
mov dword [ebp - 0x378], 1
jmp 0x1000bc03
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x378], eax
jg 0x1000bc1d
mov dword [ebp - 0x42c], 1
jmp 0x1000bc24
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0
jne 0x1000bc4b
and dword [ebp - 0x288], 0
jmp 0x1000bc55
mov dword [ebp - 0x288], 1
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x340], eax
jne 0x1000bc78
mov dword [ebp - 0x290], 1
jmp 0x1000bc7f
and dword [ebp - 0x290], 0
push 0
lea ecx, [ebp - 0x46c]
call fcn.1000e00f
mov ecx, dword [ebp - 0x290]
mov dword [eax], ecx
mov dword [ebp - 0x3e0], 4
cmp dword [ebp - 0x144], 0
je 0x1000bcbb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x46c]
call fcn.1000e00a
jmp 0x1000b979
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x46c]
call fcn.1000e00a
jmp 0x1000b979
mov byte [0x1065ee40], 1
push 4
lea ecx, [ebp - 0x3fc]
call fcn.1000dfce
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x400], 0x2ca8cda2
mov dword [ebp - 0x4c], 0
jmp 0x1000bd0e
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1000bd24
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x4fc], 1
jmp 0x1000bd07
mov dword [ebp - 0x4c], 0
jmp 0x1000bd34
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x1000bd50
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x3fc]
call fcn.1000e00f
mov dword [eax], 0x30f94f37
jmp 0x1000bd2d
push 0
lea ecx, [ebp - 0x3fc]
call fcn.1000e00f
and dword [eax], 0
jmp 0x1000bd86
push 0
lea ecx, [ebp - 0x3fc]
call fcn.1000e00f
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x308]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3fc]
call fcn.1000e00f
cmp dword [eax], 0
jg 0x1000be57
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x14c], 0
jmp 0x1000bdbf
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jl 0x1000be3e
mov dword [ebp - 0x11c], 0xffffffff
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x1000bdf0
push 0x1b59
push 0x1de7
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 0x11c], 0
jmp 0x1000be09
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jg 0x1000be39
mov byte [ebp - 0x74], 0
movzx eax, byte [ebp - 0x74]
test eax, eax
je 0x1000be37
push 0
push 0
push 0x77f
push 0x21a4
push 0xbdc
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jmp 0x1000bdfc
jmp 0x1000bdb2
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x1000be52
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1000bd62
mov dword [ebp - 0xb8], 0
jmp 0x1000be70
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xfffffffd
je 0x1000be9c
mov dword [ebp - 0x400], 9
mov byte [ebp - 0x70], 0
movzx eax, byte [ebp - 0x70]
test eax, eax
je 0x1000be9a
push 0x2303
call dword [sym.imp.GDI32.dll_EndPage]
jmp 0x1000be63
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3fc]
call fcn.1000e00a
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x160], 0x3bed
mov dword [ebp - 0x164], 0xacd4a797
mov dword [ebp - 0x1dc], 0xfffffff6
mov dword [ebp - 0x20c], 0xffffffff
mov dword [ebp - 0xbc], 0
jmp 0x1000bef3
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x1000bf0f
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x5c4], 0xfddf34ff
jmp 0x1000bee6
cmp dword [ebp - 0x68], 0xef51
je 0x1000bf24
mov dword [ebp - 0x298], 1
jmp 0x1000bf2b
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x298], eax
jle 0x1000bf45
mov dword [ebp - 0x360], 1
jmp 0x1000bf4c
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x360], eax
jle 0x1000bf66
mov dword [ebp - 0x3e8], 1
jmp 0x1000bf6d
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x504], eax
mov eax, dword [ebp - 0x68]
add eax, 0x4ce34aaf
sub eax, dword [ebp - 0x164]
jne 0x1000bf9b
cmp dword [ebp - 0x164], 0
jne 0x1000bf9b
and dword [ebp - 0x2a0], 0
jmp 0x1000bfa5
mov dword [ebp - 0x2a0], 1
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x2a0]
jge 0x1000bfbc
mov dword [ebp - 0x310], 1
jmp 0x1000bfc3
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x1dc]
mov ecx, dword [ebp - 0x310]
lea eax, [ecx + eax + 3]
cmp dword [ebp - 0x68], eax
jge 0x1000bfe4
mov dword [ebp - 0x2a8], 1
jmp 0x1000bfeb
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x2a8], eax
jg 0x1000c005
mov dword [ebp - 0x348], 1
jmp 0x1000c00c
and dword [ebp - 0x348], 0
imul eax, dword [ebp - 0x348], 0
cmp eax, 0xa165f5c9
jne 0x1000c026
mov dword [ebp - 0x1e0], 1
jmp 0x1000c02d
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x1e0]
cmp eax, dword [ebp - 0x1dc]
je 0x1000c04a
mov dword [ebp - 0x1ec], 1
jmp 0x1000c051
and dword [ebp - 0x1ec], 0
cmp dword [ebp - 0x1ec], 0xffff
jae 0x1000c069
mov dword [ebp - 0x1f4], 1
jmp 0x1000c070
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1f4], eax
jl 0x1000c087
mov dword [ebp - 0x1fc], 1
jmp 0x1000c08e
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0x1fc]
cmp eax, 0xfffffff6
jne 0x1000c0a9
mov dword [ebp - 0x204], 1
jmp 0x1000c0b0
and dword [ebp - 0x204], 0
imul eax, dword [ebp - 0x204], 0xae8e
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jne 0x1000c0d5
mov dword [ebp - 0x214], 1
jmp 0x1000c0dc
and dword [ebp - 0x214], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x214]
mov dword [ebp + eax - 0x5c4], ecx
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x100726b0
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x5a0], 0xea75c96
mov dword [ebp - 0x404], 0x7df2f4a8
mov dword [ebp - 0x508], 3
mov dword [ebp - 0x21c], 0xffff
mov dword [ebp - 0xc4], 0
jmp 0x1000c143
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x1000c15f
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x5d4], 0x256a9ef7
jmp 0x1000c136
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x404], 0x2a831d26
mov dword [ebp - 0x24], 0x85f70ad6
mov dword [ebp - 0x14], 1
push 3
lea ecx, [ebp - 0x424]
call fcn.1000dfce
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x294], 0xfffffffd
mov dword [ebp - 0x3f0], 0xb53c
mov dword [ebp - 0xcc], 0
jmp 0x1000c1c5
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x1000c1e7
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x424]
call fcn.1000e00f
mov dword [eax], 2
jmp 0x1000c1b8
mov dword [ebp - 0x24], 0
jmp 0x1000c1f7
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffffc
jle 0x1000c3f8
mov dword [ebp - 0x16c], 0xfffd
mov dword [ebp - 0xd4], 0x7d6364d6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x16c], eax
mov eax, 0xcde9
test eax, eax
je 0x1000c2ac
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x14], 0x9646
jge 0x1000c249
mov dword [ebp - 0x224], 1
jmp 0x1000c250
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x224], eax
jle 0x1000c26a
mov dword [ebp - 0x22c], 1
jmp 0x1000c271
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x22c]
je 0x1000c28b
mov dword [ebp - 0x234], 1
jmp 0x1000c292
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x234], eax
jne 0x1000c2ac
mov dword [ebp - 0x23c], 1
jmp 0x1000c2b3
and dword [ebp - 0x23c], 0
cmp dword [ebp - 0x23c], 0x1b40
jg 0x1000c2cb
mov dword [ebp - 0x244], 1
jmp 0x1000c2d2
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x244]
jl 0x1000c2ec
mov dword [ebp - 0x24c], 1
jmp 0x1000c2f3
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24c], eax
jle 0x1000c30a
mov dword [ebp - 0x254], 1
jmp 0x1000c311
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x254]
jne 0x1000c32e
cmp dword [ebp - 0xd4], 0
jne 0x1000c32e
and dword [ebp - 0x25c], 0
jmp 0x1000c338
mov dword [ebp - 0x25c], 1
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x25c], eax
jge 0x1000c352
mov dword [ebp - 0x264], 1
jmp 0x1000c359
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x264]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jne 0x1000c397
mov dword [ebp - 0x14], 2
jmp 0x1000c377
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1000c395
mov byte [ebp - 0x6e], 0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x1000c393
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
jmp 0x1000c370
jmp 0x1000c3f3
mov dword [ebp - 0xdc], 0
jmp 0x1000c3b0
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jge 0x1000c3cc
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x26c], 0x9843334a
jmp 0x1000c3a3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x26c], 0
je 0x1000c3de
jmp 0x1000c3f8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x26c], 0
je 0x1000c3f3
jmp 0x1000c1f0
jmp 0x1000c1f0
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x14], 0
je 0x1000c419
cmp dword [ebp - 0x24], 0
jne 0x1000c434
push 2
lea ecx, [ebp - 0x424]
call fcn.1000e00f
cmp dword [eax], 0
jne 0x1000c434
and dword [ebp - 0x274], 0
jmp 0x1000c43e
mov dword [ebp - 0x274], 1
mov eax, dword [ebp - 0x14]
neg eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x274]
imul ecx, ecx, 0x9b8a
add ecx, 0x12ed4033
cmp eax, ecx
jl 0x1000c468
mov dword [ebp - 0x27c], 1
jmp 0x1000c46f
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1000c490
mov eax, 0x1dce
test eax, eax
jne 0x1000c490
and dword [ebp - 0x284], 0
jmp 0x1000c49a
mov dword [ebp - 0x284], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x284], eax
je 0x1000c4b1
mov dword [ebp - 0x28c], 1
jmp 0x1000c4b8
and dword [ebp - 0x28c], 0
push 0
lea ecx, [ebp - 0x424]
call fcn.1000e00f
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x28c]
mov eax, dword [eax]
sub eax, ecx
test eax, eax
jle 0x1000c4e9
cmp dword [ebp - 0x294], 0
jne 0x1000c4e9
and dword [ebp - 0x29c], 0
jmp 0x1000c4f3
mov dword [ebp - 0x29c], 1
push 0
lea ecx, [ebp - 0x424]
call fcn.1000e00f
mov ecx, dword [ebp - 0x29c]
cmp ecx, dword [eax]
jge 0x1000c516
mov dword [ebp - 0x2a4], 1
jmp 0x1000c51d
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x3f0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call fcn.1000e00a
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x100726b0
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x1d4]
mov dword [0x10072600], eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x4c4], 0xb319bd1
mov dword [ebp - 0x4c0], 0xb319bd1
mov dword [ebp - 0x4bc], 0xb319bd1
mov dword [ebp - 0x4b8], 0xb319bd1
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp - 0x72]
test eax, eax
je 0x1000c599
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x20], 0
jmp 0x1000c5a9
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffffe
jge 0x1000c8f8
mov dword [ebp - 0xa4], 0xffffffff
mov dword [ebp - 0xec], 0x21046671
mov dword [ebp - 0x2dc], 1
mov dword [ebp - 0x314], 0xfffffff7
mov dword [ebp - 0x324], 0xffffffff
mov dword [ebp - 0x39c], 0xffffffff
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x518], eax
mov eax, 0x27fa
cmp eax, 0xad5b
jg 0x1000c613
mov dword [ebp - 0x2ac], 1
jmp 0x1000c61a
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x2ac]
add eax, dword [ebp - 0x20]
jne 0x1000c63a
cmp dword [ebp - 0xa4], 0
jne 0x1000c63a
and dword [ebp - 0x2b4], 0
jmp 0x1000c644
mov dword [ebp - 0x2b4], 1
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x2b4], eax
jle 0x1000c65e
mov dword [ebp - 0x2bc], 1
jmp 0x1000c665
and dword [ebp - 0x2bc], 0
cmp dword [ebp - 0x2bc], 0x30a9
je 0x1000c67d
mov dword [ebp - 0x2c4], 1
jmp 0x1000c684
and dword [ebp - 0x2c4], 0
cmp dword [ebp - 0x2c4], 1
jle 0x1000c699
mov dword [ebp - 0x2cc], 1
jmp 0x1000c6a0
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
neg eax
je 0x1000c6b3
cmp dword [ebp - 0xa4], 0
jne 0x1000c6c2
cmp dword [ebp - 0x20], 0
jne 0x1000c6c2
and dword [ebp - 0x40c], 0
jmp 0x1000c6cc
mov dword [ebp - 0x40c], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x560], eax
imul eax, dword [ebp - 0xa4], 0
cmp eax, dword [ebp - 0xec]
jle 0x1000c6fb
mov byte [ebp - 0x6a], 0
movzx eax, byte [ebp - 0x6a]
test eax, eax
je 0x1000c6f6
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x1000c8f3
mov dword [ebp - 0x2fc], 0x6a4137d6
mov dword [ebp - 0x30c], 7
mov dword [ebp - 0x2f4], 0xfffffff8
push 2
lea ecx, [ebp - 0x448]
call fcn.1000dfce
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xe4], 0
jmp 0x1000c746
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jge 0x1000c765
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x448]
call fcn.1000e00f
or dword [eax], 0xffffffff
jmp 0x1000c739
cmp dword [ebp - 0x2fc], 0
jne 0x1000c874
cmp dword [ebp - 0xec], 0xffff
jb 0x1000c78a
mov dword [ebp - 0x2d4], 1
jmp 0x1000c791
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
neg eax
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x2e4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp + eax - 0x4c4], ecx
cmp dword [ebp - 0x2e4], 0x549c
jle 0x1000c7d6
mov dword [ebp - 0x2ec], 1
jmp 0x1000c7dd
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x2ec]
add eax, 8
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0xec], 5
jle 0x1000c825
mov dword [ebp - 0x304], 1
jmp 0x1000c82c
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x304], eax
jg 0x1000c846
mov dword [ebp - 0x3a0], 1
jmp 0x1000c84d
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
jne 0x1000c874
and dword [ebp - 0x31c], 0
jmp 0x1000c87e
mov dword [ebp - 0x31c], 1
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x324], eax
jne 0x1000c8a1
mov dword [ebp - 0x194], 1
jmp 0x1000c8a8
and dword [ebp - 0x194], 0
push 0
lea ecx, [ebp - 0x448]
call fcn.1000e00f
mov ecx, dword [ebp - 0x194]
mov dword [eax], ecx
mov dword [ebp - 0x39c], 4
cmp dword [ebp - 0xec], 0
je 0x1000c8e4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x448]
call fcn.1000e00a
jmp 0x1000c5a2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x448]
call fcn.1000e00a
jmp 0x1000c5a2
mov eax, dword [ebp - 0x17c]
mov dword [0x10072604], eax
push 4
lea ecx, [ebp - 0x438]
call fcn.1000dfce
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x3ac], 0x2ca8cda2
mov dword [ebp - 0x48], 0
jmp 0x1000c93b
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1000c951
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x530], 1
jmp 0x1000c934
mov dword [ebp - 0x48], 0
jmp 0x1000c961
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x1000c97d
push dword [ebp - 0x48]
lea ecx, [ebp - 0x438]
call fcn.1000e00f
mov dword [eax], 0x30f94f37
jmp 0x1000c95a
push 0
lea ecx, [ebp - 0x438]
call fcn.1000e00f
and dword [eax], 0
jmp 0x1000c9b3
push 0
lea ecx, [ebp - 0x438]
call fcn.1000e00f
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x19c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x438]
call fcn.1000e00f
cmp dword [eax], 0
jg 0x1000ca84
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf4], 0
jmp 0x1000c9ec
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jl 0x1000ca6b
mov dword [ebp - 0xfc], 0xffffffff
mov byte [ebp - 0x6b], 0
movzx eax, byte [ebp - 0x6b]
test eax, eax
je 0x1000ca1d
push 0x1b59
push 0x1de7
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 0xfc], 0
jmp 0x1000ca36
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jg 0x1000ca66
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x1000ca64
push 0
push 0
push 0x77f
push 0x21a4
push 0xbdc
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jmp 0x1000ca29
jmp 0x1000c9df
mov byte [ebp - 0x57], 0
movzx eax, byte [ebp - 0x57]
test eax, eax
je 0x1000ca7f
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1000c98f
mov dword [ebp - 0x104], 0
jmp 0x1000ca9d
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xfffffffd
je 0x1000cac9
mov dword [ebp - 0x3ac], 9
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x1000cac7
push 0x2303
call dword [sym.imp.GDI32.dll_EndPage]
jmp 0x1000ca90
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x438]
call fcn.1000e00a
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xac], 0x9a54e587
push 3
lea ecx, [ebp - 0x478]
call fcn.1000dfce
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x10c], 0
jmp 0x1000cb16
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jge 0x1000cb38
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x478]
call fcn.1000e00f
mov dword [eax], 0xfff8
jmp 0x1000cb09
mov dword [ebp - 0x10], 0xa
jmp 0x1000cb48
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff0
jne 0x1000cc80
mov dword [ebp - 0x174], 0x47d2038e
mov dword [ebp - 0x1a4], 0xfffffffb
mov dword [ebp - 0x1c4], 0xdfbc43cc
cmp dword [ebp - 0x1a4], 2
jl 0x1000cb8e
cmp dword [ebp - 0x1a4], 0
je 0x1000cb8e
mov dword [ebp - 0x3b4], 1
jmp 0x1000cb95
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x590], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x10]
neg eax
je 0x1000cbc1
xor eax, eax
je 0x1000cbc1
mov dword [ebp - 0x3bc], 1
jmp 0x1000cbc8
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x10], 0x736d
jne 0x1000cbfe
mov dword [ebp - 0x1ac], 1
jmp 0x1000cc05
and dword [ebp - 0x1ac], 0
cmp dword [ebp - 0x1ac], 0xef7d2668
ja 0x1000cc1d
mov dword [ebp - 0x1b4], 1
jmp 0x1000cc24
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1b4], eax
jg 0x1000cc3b
mov dword [ebp - 0x1bc], 1
jmp 0x1000cc42
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x10], eax
jne 0x1000cc65
mov dword [ebp - 0x1cc], 1
jmp 0x1000cc6c
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
sub eax, 0xb
mov dword [ebp - 0xac], eax
jmp 0x1000cb41
mov dword [ebp - 0x10], 0
jmp 0x1000cc90
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 9
jge 0x1000cd04
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x1000ccc7
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x8b8
push 0x228b
push 0x25fc
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0xac], 0
jmp 0x1000cce0
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x1000cd02
push dword [ebp - 0xac]
lea ecx, [ebp - 0x478]
call fcn.1000e00f
mov dword [eax], 0x9209
jmp 0x1000ccd3
jmp 0x1000cc89
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.1000e00a
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x17c]
mov edx, dword [edx + eax]
mov eax, dword [ebp - 0x1d4]
mov ecx, dword [eax + ecx]
call fcn.1000a25f
mov dword [ebp - 0x3c4], eax
push dword [ebp - 0x17c]
mov edx, 0x1007265c
mov ecx, dword [ebp - 0x3c4]
call fcn.1000a26b
pop ecx
mov esi, 0x10072600
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret