Function at 0x1004a07f
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Query or enumerate registry value
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb14
push esi
push edi
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x2e4], 0x141e4f1f
mov dword [ebp - 0x77c], 0xfffffffa
mov dword [ebp - 0x784], 0
mov dword [ebp - 0x830], 0x17716e31
mov dword [ebp - 0x60], 0
jmp 0x1004a0cc
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1004a0e2
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x9f8], 0xfffffffc
jmp 0x1004a0c5
mov dword [ebp - 0x60], 0
jmp 0x1004a0f2
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1004a108
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x7b0], 0x5c380a38
jmp 0x1004a0eb
mov dword [ebp - 0x104], 0
jmp 0x1004a121
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x17
jl 0x1004a354
mov dword [ebp - 0x84], 0x1813f1a0
mov dword [ebp - 0x4d4], 1
mov dword [ebp - 0x254], 0
jmp 0x1004a15b
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 4
jge 0x1004a177
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0xa6c], 0xd3e018eb
jmp 0x1004a14e
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x4d4], eax
jge 0x1004a1aa
mov dword [ebp - 0x774], 1
jmp 0x1004a1b1
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 0
jne 0x1004a1cd
cmp dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 0
je 0x1004a1e9
cmp dword [ebp - 0x84], 0
cmp dword [ebp - 0x104], 0xfffd
jbe 0x1004a201
mov dword [ebp - 0x760], 1
jmp 0x1004a208
and dword [ebp - 0x760], 0
cmp dword [ebp - 0x760], 0x91ba
jl 0x1004a220
mov dword [ebp - 0x52c], 1
jmp 0x1004a227
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x84]
imul eax, dword [ebp - 0x52c]
cmp eax, 1
je 0x1004a245
mov dword [ebp - 0x534], 1
jmp 0x1004a24c
and dword [ebp - 0x534], 0
mov dword [ebp - 0x2e4], 0xe08a1101
mov eax, dword [ebp - 0x2e4]
add eax, dword [ebp - 0x534]
cmp eax, dword [ebp - 0x84]
jge 0x1004a276
mov dword [ebp - 0x264], 1
jmp 0x1004a27d
and dword [ebp - 0x264], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x264]
mov dword [ebp + eax - 0xa6c], ecx
cmp dword [ebp - 0x264], 0
jne 0x1004a2b2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa6c], 0
jne 0x1004a2b2
and dword [ebp - 0x2c0], 0
jmp 0x1004a2bc
mov dword [ebp - 0x2c0], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2c0]
mov dword [ebp + eax - 0x9f8], ecx
cmp dword [ebp - 0x2c0], 0
jne 0x1004a2e6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9f8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa6c]
mov dword [ebp - 0x934], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7b0], 0xe2c23779
jae 0x1004a318
mov dword [ebp - 0x2ec], 1
jmp 0x1004a31f
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x830], eax
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x1004a34f
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1004a114
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x78], 0
jmp 0x1004a375
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xf
jl 0x1004a6f6
mov dword [ebp - 0x4c], 0x5efa20bd
mov dword [ebp - 0x128], 0x5fec
mov dword [ebp - 0x1e8], 0
jmp 0x1004a3a9
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jge 0x1004a3c5
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x2d4], 0x835357f4
jmp 0x1004a39c
mov eax, 0x1d89
test eax, eax
je 0x1004a3e0
cmp dword [ebp - 0x4c], 0
je 0x1004a3e0
mov dword [ebp - 0x53c], 1
jmp 0x1004a3e7
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x53c], eax
je 0x1004a3fe
mov dword [ebp - 0x544], 1
jmp 0x1004a405
and dword [ebp - 0x544], 0
cmp dword [ebp - 0x4c], 0
je 0x1004a41d
cmp dword [ebp - 0x78], 0
je 0x1004a41d
mov dword [ebp - 0x2f4], 1
jmp 0x1004a424
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x2f4]
jl 0x1004a43b
mov dword [ebp - 0x2fc], 1
jmp 0x1004a442
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x544]
cmp eax, dword [ebp - 0x2fc]
jle 0x1004a45c
mov dword [ebp - 0x54c], 1
jmp 0x1004a463
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x15c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2d4]
cmp dword [ebp - 0x15c], eax
jg 0x1004a5c7
mov dword [ebp - 0x840], 0x415fb57a
mov dword [ebp - 0x2c8], 0xe3bc
mov dword [ebp - 0x55c], 0x1cc0e426
mov dword [ebp - 0x848], 0x7220b739
cmp dword [ebp - 0x2c8], 0
jne 0x1004a522
cmp dword [ebp - 0x2c8], 0
jne 0x1004a4ce
mov dword [ebp - 0x304], 1
jmp 0x1004a4d5
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x304]
jl 0x1004a4ef
mov dword [ebp - 0x554], 1
jmp 0x1004a4f6
and dword [ebp - 0x554], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2d4], 0xffff
ja 0x1004a515
mov dword [ebp - 0x838], 1
jmp 0x1004a51c
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x840]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x2d4]
cmp eax, 0x53bf
jne 0x1004a555
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2d4], 0
jne 0x1004a555
and dword [ebp - 0x30c], 0
jmp 0x1004a55f
mov dword [ebp - 0x30c], 1
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x30c]
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x9c0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2d4]
mov dword [ebp - 0x918], eax
mov eax, 0x5818
add eax, 0x5a27
jne 0x1004a5ac
cmp dword [ebp - 0x15c], 0
jne 0x1004a5ac
and dword [ebp - 0x314], 0
jmp 0x1004a5b6
mov dword [ebp - 0x314], 1
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x848], eax
jmp 0x1004a6e1
mov dword [ebp - 0x56c], 0x1d4d0043
mov dword [ebp - 0x128], 0
jmp 0x1004a5ea
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x39
jne 0x1004a6e1
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x4c], 0xe
jmp 0x1004a611
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffe8
jg 0x1004a633
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x1004a631
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1004a60a
cmp dword [ebp - 0x190], 0
jne 0x1004a699
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jne 0x1004a65d
mov dword [ebp - 0x564], 1
jmp 0x1004a664
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x928], eax
mov eax, 0x4f90bf56
cmp eax, 0xfffffff8
jl 0x1004a692
mov dword [ebp - 0x31c], 1
jmp 0x1004a699
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x56c]
sub eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x190]
jne 0x1004a6c2
mov eax, 0x1ede
test eax, eax
je 0x1004a6c2
mov dword [ebp - 0x324], 1
jmp 0x1004a6c9
and dword [ebp - 0x324], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x324]
mov dword [ebp + eax - 0x2d4], ecx
jmp 0x1004a5dd
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4c]
mov dword [ebp + eax - 0x2d4], ecx
jmp 0x1004a36e
mov dword [ebp - 0x78], 0xffffffea
jmp 0x1004a706
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 8
jl 0x1004a734
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x1004a732
push 0x1a97
push 0
push 0x157
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x1004a6ff
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x1f0], 0
jmp 0x1004a757
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x1004a773
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x8a4], 1
jmp 0x1004a74a
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x8a4], 0xfffffff0
jmp 0x1004a7a1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8a4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x8a4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8a4], 0xffffffe6
jl 0x1004a80f
mov dword [ebp - 0x198], 0
jmp 0x1004a7ca
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jge 0x1004a7e6
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x954], 0xea98
jmp 0x1004a7bd
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8a4], 0
je 0x1004a7f8
jmp 0x1004a80f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x954], 0
je 0x1004a80a
jmp 0x1004a80f
jmp 0x1004a786
mov dword [ebp - 0x744], 0x141e4f1f
mov dword [ebp - 0x734], 0xfffffffa
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0x930], 1
mov dword [ebp - 0x1f8], 0
jmp 0x1004a850
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x1004a86c
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0xaac], 0
jmp 0x1004a843
mov dword [ebp - 0x1a0], 5
jmp 0x1004a885
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xfffffffb
je 0x1004a915
mov dword [ebp - 0x938], 0xd8d13034
mov dword [ebp - 0x940], 1
mov dword [ebp - 0x948], 6
mov dword [ebp - 0x99c], 6
mov dword [ebp - 0x9a4], 0xffffffff
mov dword [ebp - 0x574], 9
mov dword [ebp - 0x200], 0
jmp 0x1004a8e7
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x1004a903
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0xab8], 4
jmp 0x1004a8da
mov eax, dword [ebp - 0x574]
dec eax
mov dword [ebp - 0x574], eax
jmp 0x1004a878
mov dword [ebp - 0x4dc], 0
mov dword [ebp - 0x32c], 6
mov dword [ebp - 0x68], 0
jmp 0x1004a939
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x1004a94f
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xb04], 5
jmp 0x1004a932
mov dword [ebp - 0x68], 0
jmp 0x1004a95f
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1004a975
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xa98], 0x43d837bc
jmp 0x1004a958
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1004a991
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x90], 0x831713b9
mov dword [ebp - 0x110], 0x335c22c9
mov dword [ebp - 0x2a0], 0x598737a
mov dword [ebp - 0x7bc], 0x7ec8a5e7
mov dword [ebp - 0x90], 0
jmp 0x1004a9df
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x1a
jle 0x1004af57
mov dword [ebp - 0x1c], 0xd4e7937
mov dword [ebp - 0x5a4], 3
mov dword [ebp - 0x5bc], 0x6db3
mov dword [ebp - 0x88c], 0x813f8c54
mov dword [ebp - 0x1c], 0
jmp 0x1004aa21
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1a
jge 0x1004af52
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x1a8], 0
jmp 0x1004aa4e
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x1004aa6a
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x7ac], 0
jmp 0x1004aa41
cmp dword [ebp - 0x1c], 0xfffffff7
jbe 0x1004aa7c
mov dword [ebp - 0x584], 1
jmp 0x1004aa83
and dword [ebp - 0x584], 0
xor eax, eax
jne 0x1004aa96
cmp dword [ebp - 0x1c], 0
jne 0x1004aa96
and dword [ebp - 0x57c], 0
jmp 0x1004aaa0
mov dword [ebp - 0x57c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7ac]
imul eax, dword [ebp - 0x57c]
cmp dword [ebp - 0x1c], eax
jle 0x1004aac5
mov dword [ebp - 0x334], 1
jmp 0x1004aacc
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x334], eax
je 0x1004aaf3
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7ac], 0
je 0x1004aaf3
mov dword [ebp - 0x33c], 1
jmp 0x1004aafa
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x584]
cmp eax, dword [ebp - 0x33c]
jge 0x1004ab14
mov dword [ebp - 0x58c], 1
jmp 0x1004ab1b
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x58c], eax
jne 0x1004ab32
mov dword [ebp - 0x850], 1
jmp 0x1004ab39
and dword [ebp - 0x850], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7ac]
mov dword [ebp - 0x9ac], eax
imul eax, dword [ebp - 0x90], 0xb994
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x110], 0x17
jmp 0x1004ab75
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x12
je 0x1004af4d
mov dword [ebp - 0x2c4], 0xfffffff7
mov dword [ebp - 0x858], 0xcb87
mov dword [ebp - 0x208], 0
jmp 0x1004abaf
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jge 0x1004abcb
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x904], 0x5269945c
jmp 0x1004aba2
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x5a4], 0xfffffffb
jg 0x1004ad20
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x9b4], eax
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x130], eax
jge 0x1004ac07
mov dword [ebp - 0x344], 1
jmp 0x1004ac0e
and dword [ebp - 0x344], 0
cmp dword [ebp - 0x344], 0xffff
je 0x1004ac26
mov dword [ebp - 0x594], 1
jmp 0x1004ac2d
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x5bc]
imul eax, dword [ebp - 0x594]
cmp eax, dword [ebp - 0x2c4]
jge 0x1004ac4e
mov dword [ebp - 0x34c], 1
jmp 0x1004ac55
and dword [ebp - 0x34c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7ac]
imul eax, dword [ebp - 0x34c]
cmp eax, 1
jae 0x1004ac7a
mov dword [ebp - 0x59c], 1
jmp 0x1004ac81
and dword [ebp - 0x59c], 0
cmp dword [ebp - 0x59c], 0xb182bc9
je 0x1004ac99
mov dword [ebp - 0x354], 1
jmp 0x1004aca0
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x354]
cmp eax, dword [ebp - 0x2c4]
jne 0x1004acc0
mov dword [ebp - 0x35c], 1
jmp 0x1004acc7
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x5a4]
cmp dword [ebp - 0x35c], eax
jle 0x1004ace1
mov dword [ebp - 0x5ac], 1
jmp 0x1004ace8
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x5ac], eax
jle 0x1004ad02
mov dword [ebp - 0x364], 1
jmp 0x1004ad09
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x2a0]
cmp eax, dword [ebp - 0x364]
jne 0x1004ad20
and dword [ebp - 0x270], 0
jmp 0x1004ad2a
mov dword [ebp - 0x270], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x270]
mov dword [ebp + eax - 0x904], ecx
mov eax, dword [ebp - 0x858]
cmp dword [ebp - 0x270], eax
je 0x1004ad56
mov dword [ebp - 0x5b4], 1
jmp 0x1004ad5d
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x5b4], eax
je 0x1004ad77
mov dword [ebp - 0x36c], 1
jmp 0x1004ad7e
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x36c]
jl 0x1004af19
mov dword [ebp - 0x894], 0
mov dword [ebp - 0x278], 0x8b939845
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x904]
mov dword [ebp - 0x88c], eax
push 4
pop eax
test eax, eax
je 0x1004adcf
push 4
pop eax
shl eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x7ac]
jne 0x1004adde
cmp dword [ebp - 0x1c], 0
jne 0x1004adde
and dword [ebp - 0x374], 0
jmp 0x1004ade8
mov dword [ebp - 0x374], 1
mov eax, dword [ebp - 0x5bc]
cmp dword [ebp - 0x374], eax
je 0x1004ae02
mov dword [ebp - 0x5c4], 1
jmp 0x1004ae09
and dword [ebp - 0x5c4], 0
cmp dword [ebp - 0x5c4], 3
jl 0x1004ae27
cmp dword [ebp - 0x90], 0
je 0x1004ae27
mov dword [ebp - 0x37c], 1
jmp 0x1004ae2e
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x894]
cmp dword [ebp - 0x37c], eax
jge 0x1004ae51
cmp dword [ebp - 0x130], 0
je 0x1004ae51
mov dword [ebp - 0x5cc], 1
jmp 0x1004ae58
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x2a0], eax
jge 0x1004ae87
cmp dword [ebp - 0x278], 0
je 0x1004ae87
mov dword [ebp - 0x384], 1
jmp 0x1004ae8e
and dword [ebp - 0x384], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x904]
cmp dword [ebp - 0x384], eax
jge 0x1004aeaf
mov dword [ebp - 0x5d4], 1
jmp 0x1004aeb6
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x5d4], eax
je 0x1004aedd
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7ac], 0
je 0x1004aedd
mov dword [ebp - 0x828], 1
jmp 0x1004aee4
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x9bc], eax
push 3
pop eax
cmp eax, 0xffffffff
jb 0x1004af04
mov dword [ebp - 0x38c], 1
jmp 0x1004af0b
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7bc], eax
jmp 0x1004af48
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x1004af48
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1004ab68
jmp 0x1004aa1a
jmp 0x1004a9d2
mov dword [ebp - 0x7fc], 0x17716e31
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0xfffffff9
mov dword [ebp - 0xc], 0x44ad3740
mov dword [ebp - 0x210], 0xffff
mov dword [ebp - 0x2bc], 0xffffffff
mov dword [ebp - 0x62c], 0x72be
mov dword [ebp - 0x14], 0
jmp 0x1004afa4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1b
jl 0x1004b12a
mov dword [ebp - 0x13c], 0xb1658084
cmp dword [ebp - 0x13c], 0
je 0x1004afdc
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004afdc
mov dword [ebp - 0x5dc], 1
jmp 0x1004afe3
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x13c], eax
jg 0x1004b003
mov dword [ebp - 0x5ec], 1
jmp 0x1004b00a
and dword [ebp - 0x5ec], 0
mov eax, 0xef6e229e
test eax, eax
je 0x1004b028
cmp dword [ebp - 0x13c], 0
je 0x1004b028
mov dword [ebp - 0x394], 1
jmp 0x1004b02f
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x394], eax
jle 0x1004b046
mov dword [ebp - 0x5e4], 1
jmp 0x1004b04d
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x5e4]
add eax, 0xffff
cmp dword [ebp - 0x13c], eax
je 0x1004b06c
mov dword [ebp - 0x39c], 1
jmp 0x1004b073
and dword [ebp - 0x39c], 0
cmp dword [ebp - 0x39c], 0xfffffff7
jne 0x1004b088
mov dword [ebp - 0x3a4], 1
jmp 0x1004b08f
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x5ec]
cmp eax, dword [ebp - 0x3a4]
jne 0x1004b0d2
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1004b0c8
push 0x1a2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
cmp dword [ebp - 0xc], 0
je 0x1004b0d0
jmp 0x1004b12a
jmp 0x1004b125
mov dword [ebp - 0xc], 0xb6917ab6
mov dword [ebp - 8], 0xfffffff7
jmp 0x1004b0e9
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x1004b125
mov dword [ebp - 0xc], 0
jmp 0x1004b0ff
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jg 0x1004b123
mov byte [ebp - 0xa8], 0
movzx eax, byte [ebp - 0xa8]
test eax, eax
je 0x1004b121
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x1004b0f8
jmp 0x1004b0e2
jmp 0x1004af9d
mov eax, dword [ebp - 8]
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x9cc], eax
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
jl 0x1004b15f
mov dword [ebp - 0x5f4], 1
jmp 0x1004b166
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x5f4], eax
jge 0x1004b17d
mov dword [ebp - 0x3ac], 1
jmp 0x1004b184
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x3ac]
jge 0x1004b19b
mov dword [ebp - 0x5fc], 1
jmp 0x1004b1a2
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x5fc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004b1cc
cmp dword [ebp - 0x14], 0
je 0x1004b1cc
cmp dword [ebp - 0x2bc], 0
je 0x1004b1cc
mov dword [ebp - 0x3b4], 1
jmp 0x1004b1d3
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
shl eax, 1
cmp eax, dword [ebp - 0xc]
jge 0x1004b1ec
mov dword [ebp - 0x83c], 1
jmp 0x1004b1f3
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0xa44], eax
cmp dword [ebp - 0xc], 0xbc35
jge 0x1004b220
mov dword [ebp - 0x604], 1
jmp 0x1004b227
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0x14], eax
je 0x1004b259
mov dword [ebp - 0x3bc], 1
jmp 0x1004b260
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
add eax, 3
cmp eax, 9
jae 0x1004b52f
mov dword [ebp - 0x280], 0x2d1f
mov dword [ebp - 0x614], 0xfffffffd
mov dword [ebp - 0x1b0], 0
jmp 0x1004b29f
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 1
jge 0x1004b2bb
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x17c], 0x624e194e
jmp 0x1004b292
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x17c], 0
je 0x1004b404
mov eax, dword [ebp - 8]
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0xc]
inc eax
cmp eax, dword [ebp - 0x14]
jle 0x1004b2ed
mov dword [ebp - 0x60c], 1
jmp 0x1004b2f4
and dword [ebp - 0x60c], 0
cmp dword [ebp - 0x60c], 1
jne 0x1004b309
mov dword [ebp - 0x3c4], 1
jmp 0x1004b310
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x3c4]
sub eax, 0x2ad4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x614]
sub eax, 0x6f2db44e
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x17c]
cmp eax, 0x3153ed87
jne 0x1004b352
mov dword [ebp - 0x3cc], 1
jmp 0x1004b359
and dword [ebp - 0x3cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x17c]
cmp dword [ebp - 0x3cc], eax
je 0x1004b37a
mov dword [ebp - 0x61c], 1
jmp 0x1004b381
and dword [ebp - 0x61c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x17c]
cmp dword [ebp - 0x61c], eax
jl 0x1004b3a2
mov dword [ebp - 0x3d4], 1
jmp 0x1004b3a9
and dword [ebp - 0x3d4], 0
cmp dword [ebp - 0x3d4], 0x34c8a1b6
jne 0x1004b3c1
mov dword [ebp - 0x624], 1
jmp 0x1004b3c8
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x624], eax
jge 0x1004b3df
mov dword [ebp - 0x3dc], 1
jmp 0x1004b3e6
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0xffffffff
jl 0x1004b3f8
mov eax, 0x2121a659
test eax, eax
je 0x1004b404
mov dword [ebp - 0x3e4], 1
jmp 0x1004b40b
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0x3e4], eax
jl 0x1004b425
mov dword [ebp - 0x634], 1
jmp 0x1004b42c
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0x634], eax
jle 0x1004b446
mov dword [ebp - 0x3ec], 1
jmp 0x1004b44d
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 8
jge 0x1004b462
mov dword [ebp - 0x63c], 1
jmp 0x1004b469
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x63c], eax
jne 0x1004b483
mov dword [ebp - 0x3f4], 1
jmp 0x1004b48a
and dword [ebp - 0x3f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x17c]
cmp dword [ebp - 0x3f4], eax
jl 0x1004b4af
xor eax, eax
je 0x1004b4af
mov dword [ebp - 0x644], 1
jmp 0x1004b4b6
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x280]
cmp eax, dword [ebp - 0x644]
jge 0x1004b4d0
mov dword [ebp - 0x3fc], 1
jmp 0x1004b4d7
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 8
jl 0x1004b4ec
mov dword [ebp - 0x64c], 1
jmp 0x1004b4f3
and dword [ebp - 0x64c], 0
cmp dword [ebp - 0x64c], 0x3bc6c2db
jl 0x1004b50b
mov dword [ebp - 0x404], 1
jmp 0x1004b512
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
add eax, 0x8476
sub eax, dword [ebp - 0x280]
mov dword [ebp - 8], eax
mov dword [ebp - 8], 0x12b152d5
jmp 0x1004b55e
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1004b55e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0xc5a
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
mov dword [ebp - 0x144], 0xf5540d7f
mov dword [ebp - 0x1b8], 0
jmp 0x1004b581
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 2
jge 0x1004b59d
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x8d0], 0
jmp 0x1004b574
mov dword [ebp - 0x144], 0
jmp 0x1004b5b6
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffe4
jg 0x1004b751
mov dword [ebp - 0x218], 2
mov dword [ebp - 0x218], 1
jmp 0x1004b5e6
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x1004b74c
mov dword [ebp - 0x7c4], 0xffffffff
mov dword [ebp - 0x1c0], 0
jmp 0x1004b616
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 3
jge 0x1004b632
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x8bc], 0x82ff40fc
jmp 0x1004b609
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8bc], 0
jmp 0x1004b660
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8bc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8bc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8bc], 1
jg 0x1004b747
mov dword [ebp - 0x120], 0xbd2ab60
mov dword [ebp - 0xa30], 0xfffffffa
mov dword [ebp - 0x120], 0
jmp 0x1004b6a1
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jg 0x1004b742
mov dword [ebp - 0x65c], 0xffffffff
mov eax, dword [ebp - 0x120]
cmp dword [ebp + eax*4 - 0x8d0], 0
je 0x1004b6ca
jmp 0x1004b742
mov eax, dword [ebp - 0x120]
cmp dword [ebp + eax*4 - 0x8d0], 0
je 0x1004b6fa
cmp dword [ebp - 0x144], 0
je 0x1004b6fa
mov dword [ebp - 0x65c], 1
cmp dword [ebp - 0x65c], 0
je 0x1004b6f8
jmp 0x1004b742
jmp 0x1004b73d
mov dword [ebp - 0x164], 8
cmp dword [ebp - 0x164], 0
je 0x1004b70f
jmp 0x1004b742
mov dword [ebp - 0x164], 0
jmp 0x1004b728
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jg 0x1004b73d
mov dword [ebp - 0x7c4], 0x902314af
jmp 0x1004b71b
jmp 0x1004b694
jmp 0x1004b645
jmp 0x1004b5d9
jmp 0x1004b5a9
mov dword [ebp - 0x80], 0
jmp 0x1004b761
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1004b777
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xa08], 0xfffffffc
jmp 0x1004b75a
mov dword [ebp - 0x80], 0
jmp 0x1004b787
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1004b79d
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x860], 0x5c380a38
jmp 0x1004b780
mov dword [ebp - 0x66c], 0x9a7b445a
mov dword [ebp - 0x41c], 0xd6273d59
mov dword [ebp - 0x674], 0xfffffff8
mov dword [ebp - 0x7c], 0
jmp 0x1004b7cb
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1004b7e1
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x260], 0x68ec0ae9
jmp 0x1004b7c4
mov dword [ebp - 0x7c], 0
jmp 0x1004b7f1
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1004b807
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xac4], 0
jmp 0x1004b7ea
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x260], 0x1b
jmp 0x1004b835
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x260], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x260], 0xc
jg 0x1004ba2c
mov dword [ebp - 0x220], 5
mov dword [ebp - 0x7cc], 0x35211521
cmp dword [ebp - 0x220], 0
je 0x1004b941
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x260], 0
je 0x1004b8f5
cmp dword [ebp - 0x66c], 0x3e75
jle 0x1004b892
mov dword [ebp - 0x40c], 1
jmp 0x1004b899
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 0x6178
jge 0x1004b8b1
mov dword [ebp - 0x664], 1
jmp 0x1004b8b8
and dword [ebp - 0x664], 0
cmp dword [ebp - 0x664], 0
jne 0x1004b8cd
mov dword [ebp - 0x414], 1
jmp 0x1004b8d4
and dword [ebp - 0x414], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
cmp dword [ebp - 0x414], eax
je 0x1004b8f5
mov dword [ebp - 0x880], 1
jmp 0x1004b8fc
and dword [ebp - 0x880], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x674]
cmp dword [ebp - 0x220], eax
jl 0x1004b941
mov dword [ebp - 0x424], 1
jmp 0x1004b948
and dword [ebp - 0x424], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
cmp dword [ebp - 0x424], eax
jge 0x1004b969
mov dword [ebp - 0x67c], 1
jmp 0x1004b970
and dword [ebp - 0x67c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
imul eax, dword [ebp - 0x67c]
cmp eax, 0xd6b59229
ja 0x1004b997
mov dword [ebp - 0x42c], 1
jmp 0x1004b99e
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x220]
imul eax, dword [ebp - 0x42c]
cmp eax, dword [ebp - 0x220]
jl 0x1004b9bf
mov dword [ebp - 0x684], 1
jmp 0x1004b9c6
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x684], 0x8217c712
jb 0x1004b9de
mov dword [ebp - 0x434], 1
jmp 0x1004b9e5
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 1
jl 0x1004b9fa
mov dword [ebp - 0x68c], 1
jmp 0x1004ba01
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x7cc], eax
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x1004ba27
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x1004b81a
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1004ba46
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0x108], 0
jmp 0x1004ba5f
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x17
jl 0x1004cdbc
mov dword [ebp - 0x1c8], 0x8bbca631
mov dword [ebp - 0x8f0], 1
mov dword [ebp - 0x8ec], 1
mov dword [ebp - 0x8e8], 1
mov dword [ebp - 0x8e4], 1
mov dword [ebp - 0x1c8], 0xffffffe7
jmp 0x1004bab7
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x10
je 0x1004bb3f
mov dword [ebp - 0x40], 0x4b4e1265
mov dword [ebp - 0x40], 0
jmp 0x1004bad7
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffff5
jl 0x1004bb14
mov dword [ebp - 0x844], 0xe64fd9e2
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x43c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x43c]
mov dword [ebp + eax - 0x8f0], ecx
mov eax, dword [ebp - 0x43c]
shl eax, 3
mov dword [ebp - 0x844], eax
jmp 0x1004bad0
mov dword [ebp - 0x40], 0
jmp 0x1004bb24
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x1004bb3a
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x8f0], 0xfffffffb
jmp 0x1004bb1d
jmp 0x1004baaa
mov dword [ebp - 0x8c], 0x1813f1a0
mov dword [ebp - 0x118], 1
mov dword [ebp - 0xbc], 0xb9c279a2
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x228], 0
jmp 0x1004bb8a
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x1004bba6
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x794], 0x9b54
jmp 0x1004bb7d
mov dword [ebp - 0x118], 0
jmp 0x1004bbbf
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x1a
jne 0x1004c116
mov dword [ebp - 0x494], 0x202d95c7
mov dword [ebp - 0x84c], 0xfffffff9
mov dword [ebp - 0x1d0], 0
jmp 0x1004bbf9
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x1004bc12
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x20], 1
jmp 0x1004bbec
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x20], 0
jmp 0x1004bc37
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x20], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20], 1
jg 0x1004bde4
mov dword [ebp - 0x2a8], 0xffffffff
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x7d4], 0xfffffffb
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2a8]
cmp dword [ebp + eax - 0x794], ecx
je 0x1004bc87
mov dword [ebp - 0x694], 1
jmp 0x1004bc8e
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x118]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x20]
sub ecx, dword [ebp - 0xbc]
lea eax, [ecx + eax - 0x6364d64e]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
je 0x1004bcdb
mov eax, 0xa796
test eax, eax
je 0x1004bcdb
mov dword [ebp - 0x444], 1
jmp 0x1004bce2
and dword [ebp - 0x444], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
cmp dword [ebp - 0x444], eax
jg 0x1004bd00
mov dword [ebp - 0x69c], 1
jmp 0x1004bd07
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x2a8]
add eax, dword [ebp - 0x69c]
je 0x1004bd2a
mov eax, 0x446
test eax, eax
je 0x1004bd2a
mov dword [ebp - 0x44c], 1
jmp 0x1004bd31
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x454]
cmp dword [ebp - 0x44c], eax
jne 0x1004bd4b
mov dword [ebp - 0x6a4], 1
jmp 0x1004bd52
and dword [ebp - 0x6a4], 0
cmp dword [ebp - 0x6a4], 0x442e1191
jne 0x1004bd6a
mov dword [ebp - 0x6ac], 1
jmp 0x1004bd71
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x454]
imul eax, dword [ebp - 0x6ac]
test eax, eax
je 0x1004bd8f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20], 0
jne 0x1004bda1
cmp dword [ebp - 0x2a8], 0
jne 0x1004bda1
and dword [ebp - 0x45c], 0
jmp 0x1004bdab
mov dword [ebp - 0x45c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x45c]
sub ecx, dword [ebp + eax - 0x794]
jne 0x1004bdcc
mov dword [ebp - 0x6b4], 1
jmp 0x1004bdd3
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x7d4], eax
jmp 0x1004bc22
xor eax, eax
inc eax
sub eax, dword [ebp - 0x474]
add eax, dword [ebp - 0x118]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x794]
jg 0x1004be0e
mov dword [ebp - 0x464], 1
jmp 0x1004be15
and dword [ebp - 0x464], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x794]
cmp eax, dword [ebp - 0x464]
jge 0x1004be3d
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x1004be3d
mov dword [ebp - 0x6bc], 1
jmp 0x1004be44
and dword [ebp - 0x6bc], 0
cmp dword [ebp - 0x6bc], 0x4ca72cb5
jne 0x1004be5c
mov dword [ebp - 0x46c], 1
jmp 0x1004be63
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0xa0]
imul eax, dword [ebp - 0x46c]
test eax, eax
je 0x1004be9f
mov dword [ebp - 0x6c4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
mov dword [ebp - 0x6c4], eax
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0x474], eax
jmp 0x1004c111
mov dword [ebp - 0x14c], 0xed40
mov dword [ebp - 0xa0], 0
jmp 0x1004bec2
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jg 0x1004c103
mov dword [ebp - 0x6ec], 1
mov dword [ebp - 0x6d4], 0x8456a9e5
mov dword [ebp - 0xbc], 0
jmp 0x1004befc
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x1004c0fe
mov dword [ebp - 0x890], 1
mov dword [ebp - 0x4ac], 1
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x6ec], 0
jne 0x1004bf5c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
mov dword [ebp - 0x9c8], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x92c], eax
xor eax, eax
jne 0x1004bf5c
and dword [ebp - 0x6cc], 0
jmp 0x1004bf66
mov dword [ebp - 0x6cc], 1
cmp dword [ebp - 0x6cc], 0x406
jl 0x1004bf7e
mov dword [ebp - 0x47c], 1
jmp 0x1004bf85
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x6d4], eax
jge 0x1004bfab
mov dword [ebp - 0x484], 1
jmp 0x1004bfb2
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x20]
cmp dword [ebp - 0x484], eax
je 0x1004bfd7
push 5
pop eax
test eax, eax
je 0x1004bfd7
mov dword [ebp - 0x6dc], 1
jmp 0x1004bfde
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x6dc], 1
je 0x1004bff3
mov dword [ebp - 0x48c], 1
jmp 0x1004bffa
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x890]
cmp dword [ebp - 0x48c], eax
jg 0x1004c014
mov dword [ebp - 0x6e4], 1
jmp 0x1004c01b
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x4ac]
cmp dword [ebp - 0x494], eax
je 0x1004c041
mov dword [ebp - 0x49c], 1
jmp 0x1004c048
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x6ec]
cmp eax, dword [ebp - 0x49c]
jle 0x1004c062
mov dword [ebp - 0x6fc], 1
jmp 0x1004c069
and dword [ebp - 0x6fc], 0
cmp dword [ebp - 0x6fc], 0xe11e5463
jbe 0x1004c081
mov dword [ebp - 0x7dc], 1
jmp 0x1004c088
and dword [ebp - 0x7dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
mov dword [ebp - 0xa2c], eax
cmp dword [ebp - 0xbc], 0x214
jge 0x1004c0b0
mov dword [ebp - 0x4a4], 1
jmp 0x1004c0b7
and dword [ebp - 0x4a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
imul eax, dword [ebp - 0x4a4]
add eax, 0xfffa
cmp eax, 0x7586
jne 0x1004c0e0
mov dword [ebp - 0x704], 1
jmp 0x1004c0e7
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x14c]
add eax, dword [ebp - 0x704]
mov dword [ebp - 0x4ac], eax
jmp 0x1004beef
jmp 0x1004beb5
cmp dword [ebp - 0x84c], 0
je 0x1004c111
jmp 0x1004bbb2
jmp 0x1004bbb2
mov dword [ebp - 0x72c], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0xc4], 0x5116
mov dword [ebp - 0x230], 0
jmp 0x1004c14a
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x1004c166
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0xcc], 0x1713b910
jmp 0x1004c13d
mov dword [ebp - 0x2c], 0
jmp 0x1004c176
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x1004c35d
mov dword [ebp - 0x54], 0xe1b1b55
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0xcc]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 8
jbe 0x1004c1a6
mov dword [ebp - 0x70c], 1
jmp 0x1004c1ad
and dword [ebp - 0x70c], 0
cmp dword [ebp - 0x70c], 1
jbe 0x1004c1c2
mov dword [ebp - 0x7e4], 1
jmp 0x1004c1c9
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp + ecx*4 - 0xcc]
cmp dword [ebp + eax*4 - 0xcc], ecx
jl 0x1004c1eb
mov dword [ebp - 0x864], 1
jmp 0x1004c1f2
and dword [ebp - 0x864], 0
cmp dword [ebp - 0x2c], 0x60a4
jg 0x1004c207
mov dword [ebp - 0x4b4], 1
jmp 0x1004c20e
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 0xec0351a9
jb 0x1004c226
mov dword [ebp - 0x714], 1
jmp 0x1004c22d
and dword [ebp - 0x714], 0
cmp dword [ebp - 0x714], 0x26a0
je 0x1004c245
mov dword [ebp - 0x4bc], 1
jmp 0x1004c24c
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0xcc]
cmp eax, dword [ebp - 0x4bc]
jle 0x1004c26a
mov dword [ebp - 0x71c], 1
jmp 0x1004c271
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0xcc]
cmp dword [ebp - 0x71c], eax
jge 0x1004c2aa
mov dword [ebp - 0x54], 0
jmp 0x1004c293
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffe3
jl 0x1004c2a8
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
jmp 0x1004c28c
jmp 0x1004c2fa
mov byte [ebp - 0xac], 0
movzx eax, byte [ebp - 0xac]
test eax, eax
je 0x1004c2cb
push 0
push 0xf0b
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov dword [ebp - 0xc4], 0
jmp 0x1004c2e4
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x2a
jne 0x1004c2fa
cmp dword [ebp - 0xc4], 0
je 0x1004c2f8
jmp 0x1004c2fa
jmp 0x1004c2d7
mov dword [ebp - 0x54], 0xffffffe9
jmp 0x1004c30a
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffffd
je 0x1004c358
mov dword [ebp - 0x7ec], 0x8d7d2a7e
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0xcc], 0
jne 0x1004c340
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcc], 0
jne 0x1004c340
and dword [ebp - 0x4c4], 0
jmp 0x1004c34a
mov dword [ebp - 0x4c4], 1
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x7ec], eax
jmp 0x1004c303
jmp 0x1004c16f
mov dword [ebp - 0x1d8], 0
jmp 0x1004c376
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 4
jge 0x1004c392
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0xa5c], 0xd3e018eb
jmp 0x1004c369
mov dword [ebp - 0x88], 0xca4f833f
mov dword [ebp - 0x30], 0xf3d4210e
mov dword [ebp - 0x238], 0
jmp 0x1004c3bc
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x1004c3d8
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xa78], 1
jmp 0x1004c3af
mov dword [ebp - 0x88], 0
jmp 0x1004c3f1
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jg 0x1004c42b
mov dword [ebp - 0x854], 6
cmp dword [ebp - 0x854], 0
jne 0x1004c419
mov dword [ebp - 0x724], 1
jmp 0x1004c420
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x30], eax
jmp 0x1004c3e4
mov dword [ebp - 0x88], 0xffffffe3
jmp 0x1004c444
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xfffffff2
jge 0x1004c4fa
mov dword [ebp - 0x30], 0
jmp 0x1004c461
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x1004c4a5
mov dword [ebp - 0x7f4], 0xa7b051af
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xa78], 0x3735b263
jl 0x1004c48d
mov dword [ebp - 0x4cc], 1
jmp 0x1004c494
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x7f4], eax
jmp 0x1004c45a
mov dword [ebp - 0x30], 0
jmp 0x1004c4b5
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x1004c4f5
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1004c4d5
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x1004c4f3
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jmp 0x1004c4ae
jmp 0x1004c437
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x72c], eax
jge 0x1004c52d
mov dword [ebp - 0x2d8], 1
jmp 0x1004c534
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x734], 0
jne 0x1004c550
cmp dword [ebp - 0x8c], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
je 0x1004c56c
cmp dword [ebp - 0x8c], 0
cmp dword [ebp - 0x108], 0xfffd
jbe 0x1004c584
mov dword [ebp - 0x73c], 1
jmp 0x1004c58b
and dword [ebp - 0x73c], 0
cmp dword [ebp - 0x73c], 0x91ba
jl 0x1004c5a3
mov dword [ebp - 0x4e4], 1
jmp 0x1004c5aa
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp - 0x4e4]
cmp eax, 1
je 0x1004c5c8
mov dword [ebp - 0x4ec], 1
jmp 0x1004c5cf
and dword [ebp - 0x4ec], 0
mov dword [ebp - 0x744], 0xe08a1101
mov eax, dword [ebp - 0x744]
add eax, dword [ebp - 0x4ec]
cmp eax, dword [ebp - 0x8c]
jge 0x1004c5f9
mov dword [ebp - 0x288], 1
jmp 0x1004c600
and dword [ebp - 0x288], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x288]
mov dword [ebp + eax - 0xa5c], ecx
cmp dword [ebp - 0x288], 0
jne 0x1004c635
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa5c], 0
jne 0x1004c635
and dword [ebp - 0x2cc], 0
jmp 0x1004c63f
mov dword [ebp - 0x2cc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2cc]
mov dword [ebp + eax - 0xa08], ecx
cmp dword [ebp - 0x2cc], 0
jne 0x1004c669
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa08], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa5c]
mov dword [ebp - 0x914], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x860], 0xe2c23779
jae 0x1004c69b
mov dword [ebp - 0x74c], 1
jmp 0x1004c6a2
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x7fc], eax
mov dword [ebp - 0x1e0], 0x97f6af11
mov dword [ebp - 0x1e0], 0xfffffffe
jmp 0x1004c6d1
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0xfffffffd
jge 0x1004c736
mov dword [ebp - 0x174], 0
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1004c705
push 0x1e48
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x174], 0xffffffec
jmp 0x1004c71e
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0xd
jl 0x1004c734
cmp dword [ebp - 0x174], 0
je 0x1004c732
jmp 0x1004c734
jmp 0x1004c711
jmp 0x1004c6c4
mov byte [ebp - 0xfd], 0
mov dword [ebp - 0x154], 0x1e1e87df
mov dword [ebp - 0x2b0], 0xfffffff7
mov dword [ebp - 0x74], 0
jmp 0x1004c761
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x1004c774
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x34], 0xfffffff8
jmp 0x1004c75a
mov dword [ebp - 0x74], 0
jmp 0x1004c784
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x1004c79a
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xdc], 0x4888999d
jmp 0x1004c77d
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x154]
cmp dword [ebp + eax - 0x34], ecx
jle 0x1004c7b8
mov dword [ebp - 0x4f4], 1
jmp 0x1004c7bf
and dword [ebp - 0x4f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x4f4], eax
jge 0x1004c7dd
mov dword [ebp - 0x754], 1
jmp 0x1004c7e4
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x154]
sub eax, dword [ebp - 0x754]
cmp eax, 0x5689
jne 0x1004c803
mov dword [ebp - 0x75c], 1
jmp 0x1004c80a
and dword [ebp - 0x75c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
mov dword [ebp - 0x4fc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp + eax - 0xdc], ecx
mov eax, dword [ebp - 0x4fc]
cmp eax, dword [ebp - 0x75c]
jge 0x1004c847
mov dword [ebp - 0x504], 1
jmp 0x1004c84e
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x154]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x34]
imul ecx, dword [ebp - 0x504]
add eax, ecx
je 0x1004c999
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0x654], 0x7c57f39c
cmp dword [ebp - 0xd4], 0
je 0x1004c8dc
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x968], eax
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x654], eax
jge 0x1004c8b0
mov dword [ebp - 0x764], 1
jmp 0x1004c8b7
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0xd4]
imul eax, dword [ebp - 0x764]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x34]
jne 0x1004c8dc
mov dword [ebp - 0x76c], 1
jmp 0x1004c8e3
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x76c], eax
jg 0x1004c8fd
mov dword [ebp - 0x510], 1
jmp 0x1004c904
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x510]
jl 0x1004c927
cmp dword [ebp - 0x654], 0
je 0x1004c927
mov dword [ebp - 0x518], 1
jmp 0x1004c92e
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x518], eax
jl 0x1004c948
mov dword [ebp - 0x658], 1
jmp 0x1004c94f
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
sub eax, 0x5900b088
cmp dword [ebp - 0xd4], eax
je 0x1004c96e
mov dword [ebp - 0x290], 1
jmp 0x1004c975
and dword [ebp - 0x290], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x290]
mov dword [ebp + eax - 0xdc], ecx
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x2b0], eax
jmp 0x1004cc6c
mov dword [ebp - 0x6c], 0xc214
mov dword [ebp - 0x244], 0
jmp 0x1004c9b9
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 3
jge 0x1004c9d5
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0xa18], 0x447d0519
jmp 0x1004c9ac
mov eax, dword [ebp - 0x6c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x34]
test eax, eax
jne 0x1004cb64
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdc], 0
je 0x1004caa1
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x93c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdc], 0x395c
jne 0x1004ca2a
mov dword [ebp - 0x520], 1
jmp 0x1004ca31
and dword [ebp - 0x520], 0
cmp dword [ebp - 0x520], 0
jne 0x1004ca46
mov dword [ebp - 0x6f4], 1
jmp 0x1004ca4d
and dword [ebp - 0x6f4], 0
cmp dword [ebp - 0x6f4], 0xfffb
jbe 0x1004ca65
mov dword [ebp - 0x528], 1
jmp 0x1004ca6c
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x528], eax
jne 0x1004ca83
mov dword [ebp - 0x660], 1
jmp 0x1004ca8a
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x660]
sub eax, dword [ebp - 0x6c]
je 0x1004caa1
mov dword [ebp - 0x530], 1
jmp 0x1004caa8
and dword [ebp - 0x530], 0
cmp dword [ebp - 0x530], 0x964e
jle 0x1004cacd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
je 0x1004cacd
mov dword [ebp - 0x6f8], 1
jmp 0x1004cad4
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x6f8], eax
je 0x1004caeb
mov dword [ebp - 0x538], 1
jmp 0x1004caf2
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x538], eax
jne 0x1004cb09
mov dword [ebp - 0x668], 1
jmp 0x1004cb10
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x668]
sub eax, dword [ebp - 0x2b0]
cmp eax, dword [ebp - 0x6c]
jg 0x1004cb2d
mov dword [ebp - 0x540], 1
jmp 0x1004cb34
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x540], eax
jne 0x1004cb4b
mov dword [ebp - 0x298], 1
jmp 0x1004cb52
and dword [ebp - 0x298], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x298]
mov dword [ebp + eax - 0xa18], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, 0xffff
sub ecx, dword [ebp + eax - 0x34]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xdc], ecx
cmp dword [ebp - 0x154], 0
jne 0x1004cb9f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
jne 0x1004cb9f
and dword [ebp - 0x740], 0
jmp 0x1004cba9
mov dword [ebp - 0x740], 1
cmp dword [ebp - 0x740], 6
jae 0x1004cbbe
mov dword [ebp - 0x548], 1
jmp 0x1004cbc5
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x6c], 4
je 0x1004cbd7
mov dword [ebp - 0x85c], 1
jmp 0x1004cbde
and dword [ebp - 0x85c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
mov dword [ebp - 0x96c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdc], 9
jl 0x1004cc0a
mov dword [ebp - 0x804], 1
jmp 0x1004cc11
and dword [ebp - 0x804], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
jl 0x1004cc2a
mov dword [ebp - 0x670], 1
jmp 0x1004cc31
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x548]
add eax, dword [ebp - 0x670]
mov dword [ebp - 0x550], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x550]
mov dword [ebp + eax - 0xa18], ecx
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x550]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xdc], eax
mov byte [ebp - 0xb0], 0
movzx eax, byte [ebp - 0xb0]
test eax, eax
je 0x1004cc8f
push 0
push 0
push 0x3ad
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1004cdb7
mov dword [ebp - 0x1ec], 0xffffffff
mov dword [ebp - 0x24c], 0
jmp 0x1004ccc1
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 1
jge 0x1004ccdd
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x87c], 0xec2e
jmp 0x1004ccb4
mov dword [ebp - 0x1ec], 0
jmp 0x1004ccf6
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
jl 0x1004cd8d
mov dword [ebp - 0x224], 0x32bb11ac
mov dword [ebp - 0x224], 0
jmp 0x1004cd26
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jg 0x1004cd88
mov dword [ebp - 0x16c], 0x3afc3718
mov byte [ebp - 0xff], 0
movzx eax, byte [ebp - 0xff]
test eax, eax
je 0x1004cd51
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x16c], 0
jmp 0x1004cd6a
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x1004cd86
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x87c], 0x425a
jmp 0x1004cd5d
jmp 0x1004cd19
jmp 0x1004cce9
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1004cda5
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1004ba52
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x944], 8
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x1004cdec
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x1004ce0d
push 0
push 0x1398
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x58], 0
jmp 0x1004ce2e
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xf
jl 0x1004d1af
mov dword [ebp - 0x44], 0x5efa20bd
mov dword [ebp - 0x10c], 0x5fec
mov dword [ebp - 0x1f4], 0
jmp 0x1004ce62
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 2
jge 0x1004ce7e
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x2b8], 0x835357f4
jmp 0x1004ce55
mov eax, 0x1d89
test eax, eax
je 0x1004ce99
cmp dword [ebp - 0x44], 0
je 0x1004ce99
mov dword [ebp - 0x700], 1
jmp 0x1004cea0
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x700], eax
je 0x1004ceb7
mov dword [ebp - 0x678], 1
jmp 0x1004cebe
and dword [ebp - 0x678], 0
cmp dword [ebp - 0x44], 0
je 0x1004ced6
cmp dword [ebp - 0x58], 0
je 0x1004ced6
mov dword [ebp - 0x558], 1
jmp 0x1004cedd
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x558]
jl 0x1004cef4
mov dword [ebp - 0x560], 1
jmp 0x1004cefb
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x678]
cmp eax, dword [ebp - 0x560]
jle 0x1004cf15
mov dword [ebp - 0x780], 1
jmp 0x1004cf1c
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x134], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b8]
cmp dword [ebp - 0x134], eax
jg 0x1004d080
mov dword [ebp - 0x884], 0x415fb57a
mov dword [ebp - 0x268], 0xe3bc
mov dword [ebp - 0x708], 0x1cc0e426
mov dword [ebp - 0x814], 0x7220b739
cmp dword [ebp - 0x268], 0
jne 0x1004cfdb
cmp dword [ebp - 0x268], 0
jne 0x1004cf87
mov dword [ebp - 0x568], 1
jmp 0x1004cf8e
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x568]
jl 0x1004cfa8
mov dword [ebp - 0x680], 1
jmp 0x1004cfaf
and dword [ebp - 0x680], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2b8], 0xffff
ja 0x1004cfce
mov dword [ebp - 0x80c], 1
jmp 0x1004cfd5
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x268]
mov eax, dword [ebp - 0x884]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x2b8]
cmp eax, 0x53bf
jne 0x1004d00e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2b8], 0
jne 0x1004d00e
and dword [ebp - 0x570], 0
jmp 0x1004d018
mov dword [ebp - 0x570], 1
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x570]
mov dword [ebp - 0x708], eax
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x974], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b8]
mov dword [ebp - 0x94c], eax
mov eax, 0x5818
add eax, 0x5a27
jne 0x1004d065
cmp dword [ebp - 0x134], 0
jne 0x1004d065
and dword [ebp - 0x578], 0
jmp 0x1004d06f
mov dword [ebp - 0x578], 1
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x814], eax
jmp 0x1004d19a
mov dword [ebp - 0x748], 0x1d4d0043
mov dword [ebp - 0x10c], 0
jmp 0x1004d0a3
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x39
jne 0x1004d19a
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x44], 0xe
jmp 0x1004d0ca
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffe8
jg 0x1004d0ec
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x1004d0ea
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1004d0c3
cmp dword [ebp - 0x250], 0
jne 0x1004d152
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jne 0x1004d116
mov dword [ebp - 0x688], 1
jmp 0x1004d11d
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x97c], eax
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x958], eax
mov eax, 0x4f90bf56
cmp eax, 0xfffffff8
jl 0x1004d14b
mov dword [ebp - 0x580], 1
jmp 0x1004d152
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x748]
sub eax, dword [ebp - 0x250]
cmp eax, dword [ebp - 0x250]
jne 0x1004d17b
mov eax, 0x1ede
test eax, eax
je 0x1004d17b
mov dword [ebp - 0x588], 1
jmp 0x1004d182
and dword [ebp - 0x588], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x588]
mov dword [ebp + eax - 0x2b8], ecx
jmp 0x1004d096
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x44]
mov dword [ebp + eax - 0x2b8], ecx
jmp 0x1004ce27
mov dword [ebp - 0x58], 0xffffffea
jmp 0x1004d1bf
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 8
jl 0x1004d1ed
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x1004d1eb
push 0x1a97
push 0
push 0x157
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x1004d1b8
mov dword [ebp - 0x140], 0x64f14790
mov dword [ebp - 0x598], 0xe468
mov dword [ebp - 0x768], 0xfffffff6
mov dword [ebp - 0x1fc], 0
jmp 0x1004d224
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 1
jge 0x1004d240
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x138], 0xd435
jmp 0x1004d217
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x138], 0x63f9
mov dword [ebp - 0x140], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x138], 0x9120
jle 0x1004d27b
or eax, 0xffffffff
je 0x1004d27b
mov dword [ebp - 0x690], 1
jmp 0x1004d282
and dword [ebp - 0x690], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
add eax, dword [ebp - 0x690]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x138]
jge 0x1004d2b0
mov dword [ebp - 0x590], 1
jmp 0x1004d2b7
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x598]
cmp dword [ebp - 0x590], eax
jl 0x1004d2d1
mov dword [ebp - 0x710], 1
jmp 0x1004d2d8
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 0xc694
jl 0x1004d2f6
mov eax, 0xbf079684
test eax, eax
jne 0x1004d2f6
and dword [ebp - 0x698], 0
jmp 0x1004d300
mov dword [ebp - 0x698], 1
mov eax, dword [ebp - 0x598]
cmp dword [ebp - 0x698], eax
jg 0x1004d31a
mov dword [ebp - 0x5a0], 1
jmp 0x1004d321
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x768], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
cmp dword [ebp - 0x768], eax
jl 0x1004d34e
mov dword [ebp - 0x5a8], 1
jmp 0x1004d355
and dword [ebp - 0x5a8], 0
cmp dword [ebp - 0x5a8], 0xd6a5
je 0x1004d387
mov dword [ebp - 0x984], 0xffffffff
mov dword [ebp - 0x6a0], 1
mov eax, dword [ebp - 0x6a0]
dec eax
mov dword [ebp - 0x6a0], eax
jmp 0x1004d415
mov dword [ebp - 0x184], 0
jmp 0x1004d3a0
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x1004d3bc
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x874], 4
jmp 0x1004d393
mov dword [ebp - 0x140], 0
jmp 0x1004d3d5
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xb
jl 0x1004d3f2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x874], 0
je 0x1004d3f0
jmp 0x1004d3f2
jmp 0x1004d3c8
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp - 0xb8]
test eax, eax
je 0x1004d415
push 0xbbb
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
mov dword [ebp - 0x4e0], 0x141e4f1f
mov dword [ebp - 0x964], 0xbca6
mov byte [ebp - 0xf8], 0
movzx eax, byte [ebp - 0xf8]
test eax, eax
je 0x1004d443
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1004d45f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x22c], 0
jmp 0x1004d478
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x1004d494
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0x870], 1
jmp 0x1004d46b
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x870], 0xfffffff0
jmp 0x1004d4c2
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x870]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x870], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x870], 0xffffffe6
jl 0x1004d530
mov dword [ebp - 0x204], 0
jmp 0x1004d4eb
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
jge 0x1004d507
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x960], 0xea98
jmp 0x1004d4de
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x870], 0
je 0x1004d519
jmp 0x1004d530
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x960], 0
je 0x1004d52b
jmp 0x1004d530
jmp 0x1004d4a7
mov dword [ebp - 0x248], 0x97f6af11
mov dword [ebp - 0x248], 0xfffffffe
jmp 0x1004d553
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xfffffffd
jge 0x1004d5b8
mov dword [ebp - 0x148], 0
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x1004d587
push 0x1e48
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x148], 0xffffffec
jmp 0x1004d5a0
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xd
jl 0x1004d5b6
cmp dword [ebp - 0x148], 0
je 0x1004d5b4
jmp 0x1004d5b6
jmp 0x1004d593
jmp 0x1004d546
mov dword [ebp - 0x4c0], 0xfffffffa
mov dword [ebp - 0x4c8], 0
mov dword [ebp - 0x234], 1
mov dword [ebp - 0x98c], 1
mov dword [ebp - 0x20c], 0
jmp 0x1004d5f9
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 3
jge 0x1004d615
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0xadc], 0
jmp 0x1004d5ec
mov dword [ebp - 0x234], 5
jmp 0x1004d62e
mov eax, dword [ebp - 0x234]
dec eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xfffffffb
je 0x1004d6be
mov dword [ebp - 0x994], 0xd8d13034
mov dword [ebp - 0x970], 1
mov dword [ebp - 0xa34], 6
mov dword [ebp - 0x978], 6
mov dword [ebp - 0x9e4], 0xffffffff
mov dword [ebp - 0x5b0], 9
mov dword [ebp - 0x214], 0
jmp 0x1004d690
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 3
jge 0x1004d6ac
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0xaf4], 4
jmp 0x1004d683
mov eax, dword [ebp - 0x5b0]
dec eax
mov dword [ebp - 0x5b0], eax
jmp 0x1004d621
mov dword [ebp - 0x718], 6
mov dword [ebp - 0x70], 0
jmp 0x1004d6d8
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1004d6ee
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xb14], 5
jmp 0x1004d6d1
mov dword [ebp - 0x70], 0
jmp 0x1004d6fe
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1004d714
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xaa0], 0x43d837bc
jmp 0x1004d6f7
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1004d730
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov eax, dword [ebp - 0x718]
inc eax
mov dword [ebp - 0x718], eax
mov dword [ebp - 0x810], 0x17716e31
mov dword [ebp - 0x94], 0x831713b9
mov dword [ebp - 0x114], 0x335c22c9
mov dword [ebp - 0x27c], 0x598737a
mov dword [ebp - 0x898], 0x7ec8a5e7
mov dword [ebp - 0x94], 0
jmp 0x1004d788
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x1a
jle 0x1004dd00
mov dword [ebp - 0x28], 0xd4e7937
mov dword [ebp - 0x5e0], 3
mov dword [ebp - 0x5f8], 0x6db3
mov dword [ebp - 0x824], 0x813f8c54
mov dword [ebp - 0x28], 0
jmp 0x1004d7ca
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1a
jge 0x1004dcfb
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x258], 0
jmp 0x1004d7f7
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x1004d813
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x7a0], 0
jmp 0x1004d7ea
cmp dword [ebp - 0x28], 0xfffffff7
jbe 0x1004d825
mov dword [ebp - 0x5c0], 1
jmp 0x1004d82c
and dword [ebp - 0x5c0], 0
xor eax, eax
jne 0x1004d83f
cmp dword [ebp - 0x28], 0
jne 0x1004d83f
and dword [ebp - 0x5b8], 0
jmp 0x1004d849
mov dword [ebp - 0x5b8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7a0]
imul eax, dword [ebp - 0x5b8]
cmp dword [ebp - 0x28], eax
jle 0x1004d86e
mov dword [ebp - 0x6a8], 1
jmp 0x1004d875
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x6a8], eax
je 0x1004d89c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7a0], 0
je 0x1004d89c
mov dword [ebp - 0x750], 1
jmp 0x1004d8a3
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x5c0]
cmp eax, dword [ebp - 0x750]
jge 0x1004d8bd
mov dword [ebp - 0x5c8], 1
jmp 0x1004d8c4
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x5c8], eax
jne 0x1004d8db
mov dword [ebp - 0x81c], 1
jmp 0x1004d8e2
and dword [ebp - 0x81c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7a0]
mov dword [ebp - 0x980], eax
imul eax, dword [ebp - 0x94], 0xb994
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x114], 0x17
jmp 0x1004d91e
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x12
je 0x1004dcf6
mov dword [ebp - 0x26c], 0xfffffff7
mov dword [ebp - 0x888], 0xcb87
mov dword [ebp - 0x21c], 0
jmp 0x1004d958
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 3
jge 0x1004d974
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x910], 0x5269945c
jmp 0x1004d94b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x5e0], 0xfffffffb
jg 0x1004dac9
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0xa3c], eax
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x150], eax
jge 0x1004d9b0
mov dword [ebp - 0x6b0], 1
jmp 0x1004d9b7
and dword [ebp - 0x6b0], 0
cmp dword [ebp - 0x6b0], 0xffff
je 0x1004d9cf
mov dword [ebp - 0x5d0], 1
jmp 0x1004d9d6
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x5f8]
imul eax, dword [ebp - 0x5d0]
cmp eax, dword [ebp - 0x26c]
jge 0x1004d9f7
mov dword [ebp - 0x720], 1
jmp 0x1004d9fe
and dword [ebp - 0x720], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7a0]
imul eax, dword [ebp - 0x720]
cmp eax, 1
jae 0x1004da23
mov dword [ebp - 0x5d8], 1
jmp 0x1004da2a
and dword [ebp - 0x5d8], 0
cmp dword [ebp - 0x5d8], 0xb182bc9
je 0x1004da42
mov dword [ebp - 0x6b8], 1
jmp 0x1004da49
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x6b8]
cmp eax, dword [ebp - 0x26c]
jne 0x1004da69
mov dword [ebp - 0x778], 1
jmp 0x1004da70
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x5e0]
cmp dword [ebp - 0x778], eax
jle 0x1004da8a
mov dword [ebp - 0x5e8], 1
jmp 0x1004da91
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x5e8], eax
jle 0x1004daab
mov dword [ebp - 0x6c0], 1
jmp 0x1004dab2
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x27c]
cmp eax, dword [ebp - 0x6c0]
jne 0x1004dac9
and dword [ebp - 0x274], 0
jmp 0x1004dad3
mov dword [ebp - 0x274], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x274]
mov dword [ebp + eax - 0x910], ecx
mov eax, dword [ebp - 0x888]
cmp dword [ebp - 0x274], eax
je 0x1004daff
mov dword [ebp - 0x5f0], 1
jmp 0x1004db06
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x5f0], eax
je 0x1004db20
mov dword [ebp - 0x728], 1
jmp 0x1004db27
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x728]
jl 0x1004dcc2
mov dword [ebp - 0x878], 0
mov dword [ebp - 0x284], 0x8b939845
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x910]
mov dword [ebp - 0x824], eax
push 4
pop eax
test eax, eax
je 0x1004db78
push 4
pop eax
shl eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x7a0]
jne 0x1004db87
cmp dword [ebp - 0x28], 0
jne 0x1004db87
and dword [ebp - 0x6c8], 0
jmp 0x1004db91
mov dword [ebp - 0x6c8], 1
mov eax, dword [ebp - 0x5f8]
cmp dword [ebp - 0x6c8], eax
je 0x1004dbab
mov dword [ebp - 0x600], 1
jmp 0x1004dbb2
and dword [ebp - 0x600], 0
cmp dword [ebp - 0x600], 3
jl 0x1004dbd0
cmp dword [ebp - 0x94], 0
je 0x1004dbd0
mov dword [ebp - 0x758], 1
jmp 0x1004dbd7
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x878]
cmp dword [ebp - 0x758], eax
jge 0x1004dbfa
cmp dword [ebp - 0x150], 0
je 0x1004dbfa
mov dword [ebp - 0x608], 1
jmp 0x1004dc01
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x27c], eax
jge 0x1004dc30
cmp dword [ebp - 0x284], 0
je 0x1004dc30
mov dword [ebp - 0x6d0], 1
jmp 0x1004dc37
and dword [ebp - 0x6d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x910]
cmp dword [ebp - 0x6d0], eax
jge 0x1004dc58
mov dword [ebp - 0x610], 1
jmp 0x1004dc5f
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x610], eax
je 0x1004dc86
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7a0], 0
je 0x1004dc86
mov dword [ebp - 0x82c], 1
jmp 0x1004dc8d
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x988], eax
push 3
pop eax
cmp eax, 0xffffffff
jb 0x1004dcad
mov dword [ebp - 0x730], 1
jmp 0x1004dcb4
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x898], eax
jmp 0x1004dcf1
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x1004dcf1
push 0
push 0
push 0
push 0
push 0x207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1004d911
jmp 0x1004d7c3
jmp 0x1004d77b
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xfffffff9
mov dword [ebp - 0x10], 0x44ad3740
mov dword [ebp - 0x188], 0xffff
mov dword [ebp - 0x28c], 0xffffffff
mov dword [ebp - 0x2e0], 0x72be
mov dword [ebp - 0x18], 0
jmp 0x1004dd43
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1b
jl 0x1004dec9
mov dword [ebp - 0x158], 0xb1658084
cmp dword [ebp - 0x158], 0
je 0x1004dd7b
mov eax, dword [ebp - 0x158]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1004dd7b
mov dword [ebp - 0x618], 1
jmp 0x1004dd82
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x158], eax
jg 0x1004dda2
mov dword [ebp - 0x628], 1
jmp 0x1004dda9
and dword [ebp - 0x628], 0
mov eax, 0xef6e229e
test eax, eax
je 0x1004ddc7
cmp dword [ebp - 0x158], 0
je 0x1004ddc7
mov dword [ebp - 0x6d8], 1
jmp 0x1004ddce
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x6d8], eax
jle 0x1004dde5
mov dword [ebp - 0x620], 1
jmp 0x1004ddec
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x620]
add eax, 0xffff
cmp dword [ebp - 0x158], eax
je 0x1004de0b
mov dword [ebp - 0x770], 1
jmp 0x1004de12
and dword [ebp - 0x770], 0
cmp dword [ebp - 0x770], 0xfffffff7
jne 0x1004de27
mov dword [ebp - 0x6e0], 1
jmp 0x1004de2e
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x628]
cmp eax, dword [ebp - 0x6e0]
jne 0x1004de71
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1004de67
push 0x1a2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
cmp dword [ebp - 0x10], 0
je 0x1004de6f
jmp 0x1004dec9
jmp 0x1004dec4
mov dword [ebp - 0x10], 0xb6917ab6
mov dword [ebp - 4], 0xfffffff7
jmp 0x1004de88
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 7
jge 0x1004dec4
mov dword [ebp - 0x10], 0
jmp 0x1004de9e
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 8
jg 0x1004dec2
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x1004dec0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x1004de97
jmp 0x1004de81
jmp 0x1004dd3c
mov eax, dword [ebp - 4]
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x990], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xa38], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 4], eax
jl 0x1004defe
mov dword [ebp - 0x630], 1
jmp 0x1004df05
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x630], eax
jge 0x1004df1c
mov dword [ebp - 0x738], 1
jmp 0x1004df23
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x738]
jge 0x1004df3a
mov dword [ebp - 0x638], 1
jmp 0x1004df41
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x638]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1004df6b
cmp dword [ebp - 0x18], 0
je 0x1004df6b
cmp dword [ebp - 0x28c], 0
je 0x1004df6b
mov dword [ebp - 0x6e8], 1
jmp 0x1004df72
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
shl eax, 1
cmp eax, dword [ebp - 0x10]
jge 0x1004df8b
mov dword [ebp - 0x834], 1
jmp 0x1004df92
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x998], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x9fc], eax
cmp dword [ebp - 0x10], 0xbc35
jge 0x1004dfbf
mov dword [ebp - 0x640], 1
jmp 0x1004dfc6
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x18], eax
je 0x1004dff8
mov dword [ebp - 0x6f0], 1
jmp 0x1004dfff
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
add eax, 3
cmp eax, 9
jae 0x1004e2ce
mov dword [ebp - 0x294], 0x2d1f
mov dword [ebp - 0x508], 0xfffffffd
mov dword [ebp - 0x1e4], 0
jmp 0x1004e03e
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 1
jge 0x1004e05a
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x160], 0x624e194e
jmp 0x1004e031
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x160], 0
je 0x1004e1a3
mov eax, dword [ebp - 4]
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, dword [ebp - 0x18]
jle 0x1004e08c
mov dword [ebp - 0x648], 1
jmp 0x1004e093
and dword [ebp - 0x648], 0
cmp dword [ebp - 0x648], 1
jne 0x1004e0a8
mov dword [ebp - 0x650], 1
jmp 0x1004e0af
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
sub eax, 0x2ad4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x508]
sub eax, 0x6f2db44e
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x160]
cmp eax, 0x3153ed87
jne 0x1004e0f1
mov dword [ebp - 0x50c], 1
jmp 0x1004e0f8
and dword [ebp - 0x50c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x160]
cmp dword [ebp - 0x50c], eax
je 0x1004e119
mov dword [ebp - 0x514], 1
jmp 0x1004e120
and dword [ebp - 0x514], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x160]
cmp dword [ebp - 0x514], eax
jl 0x1004e141
mov dword [ebp - 0x51c], 1
jmp 0x1004e148
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 0x34c8a1b6
jne 0x1004e160
mov dword [ebp - 0x524], 1
jmp 0x1004e167
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x524], eax
jge 0x1004e17e
mov dword [ebp - 0x2dc], 1
jmp 0x1004e185
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0xffffffff
jl 0x1004e197
mov eax, 0x2121a659
test eax, eax
je 0x1004e1a3
mov dword [ebp - 0x2e8], 1
jmp 0x1004e1aa
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x2e8], eax
jl 0x1004e1c4
mov dword [ebp - 0x2f0], 1
jmp 0x1004e1cb
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x2f0], eax
jle 0x1004e1e5
mov dword [ebp - 0x2f8], 1
jmp 0x1004e1ec
and dword [ebp - 0x2f8], 0
cmp dword [ebp - 0x2f8], 8
jge 0x1004e201
mov dword [ebp - 0x300], 1
jmp 0x1004e208
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x294]
cmp dword [ebp - 0x300], eax
jne 0x1004e222
mov dword [ebp - 0x308], 1
jmp 0x1004e229
and dword [ebp - 0x308], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x160]
cmp dword [ebp - 0x308], eax
jl 0x1004e24e
xor eax, eax
je 0x1004e24e
mov dword [ebp - 0x310], 1
jmp 0x1004e255
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x294]
cmp eax, dword [ebp - 0x310]
jge 0x1004e26f
mov dword [ebp - 0x318], 1
jmp 0x1004e276
and dword [ebp - 0x318], 0
cmp dword [ebp - 0x318], 8
jl 0x1004e28b
mov dword [ebp - 0x320], 1
jmp 0x1004e292
and dword [ebp - 0x320], 0
cmp dword [ebp - 0x320], 0x3bc6c2db
jl 0x1004e2aa
mov dword [ebp - 0x328], 1
jmp 0x1004e2b1
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
add eax, 0x8476
sub eax, dword [ebp - 0x294]
mov dword [ebp - 4], eax
mov dword [ebp - 4], 0x12b152d5
jmp 0x1004e2fd
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1004e2fd
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0xc5a
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
mov dword [ebp - 0x5c], 0
jmp 0x1004e30d
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1004e323
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xa28], 0xfffffffc
jmp 0x1004e306
mov dword [ebp - 0x168], 0xf5540d7f
mov dword [ebp - 0x18c], 0
jmp 0x1004e346
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x1004e362
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x8f8], 0
jmp 0x1004e339
mov dword [ebp - 0x168], 0
jmp 0x1004e37b
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffe4
jg 0x1004e516
mov dword [ebp - 0x194], 2
mov dword [ebp - 0x194], 1
jmp 0x1004e3ab
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jl 0x1004e511
mov dword [ebp - 0x7b4], 0xffffffff
mov dword [ebp - 0x19c], 0
jmp 0x1004e3db
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jge 0x1004e3f7
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x8c8], 0x82ff40fc
jmp 0x1004e3ce
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8c8], 0
jmp 0x1004e425
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8c8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8c8], 1
jg 0x1004e50c
mov dword [ebp - 0x11c], 0xbd2ab60
mov dword [ebp - 0x9a8], 0xfffffffa
mov dword [ebp - 0x11c], 0
jmp 0x1004e466
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jg 0x1004e507
mov dword [ebp - 0x330], 0xffffffff
mov eax, dword [ebp - 0x11c]
cmp dword [ebp + eax*4 - 0x8f8], 0
je 0x1004e48f
jmp 0x1004e507
mov eax, dword [ebp - 0x11c]
cmp dword [ebp + eax*4 - 0x8f8], 0
je 0x1004e4bf
cmp dword [ebp - 0x168], 0
je 0x1004e4bf
mov dword [ebp - 0x330], 1
cmp dword [ebp - 0x330], 0
je 0x1004e4bd
jmp 0x1004e507
jmp 0x1004e502
mov dword [ebp - 0x170], 8
cmp dword [ebp - 0x170], 0
je 0x1004e4d4
jmp 0x1004e507
mov dword [ebp - 0x170], 0
jmp 0x1004e4ed
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jg 0x1004e502
mov dword [ebp - 0x7b4], 0x902314af
jmp 0x1004e4e0
jmp 0x1004e459
jmp 0x1004e40a
jmp 0x1004e39e
jmp 0x1004e36e
mov dword [ebp - 0x5c], 0
jmp 0x1004e526
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1004e53c
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x808], 0x5c380a38
jmp 0x1004e51f
mov dword [ebp - 0x12c], 0
jmp 0x1004e555
cmp dword [ebp - 0x12c], 0x17
jl 0x1004f4ee
mov dword [ebp - 0x350], 0x9a7b445a
mov dword [ebp - 0x358], 0xd6273d59
mov dword [ebp - 0x360], 0xfffffff8
mov dword [ebp - 0x64], 0
jmp 0x1004e590
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1004e5a6
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x240], 0x68ec0ae9
jmp 0x1004e589
mov dword [ebp - 0x64], 0
jmp 0x1004e5b6
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1004e5cc
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xad0], 0
jmp 0x1004e5af
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x240], 0x1b
jmp 0x1004e5fa
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x240]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x240], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x240], 0xc
jg 0x1004e7f1
mov dword [ebp - 0x1a4], 5
mov dword [ebp - 0x7c0], 0x35211521
cmp dword [ebp - 0x1a4], 0
je 0x1004e706
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x240], 0
je 0x1004e6ba
cmp dword [ebp - 0x350], 0x3e75
jle 0x1004e657
mov dword [ebp - 0x338], 1
jmp 0x1004e65e
and dword [ebp - 0x338], 0
cmp dword [ebp - 0x338], 0x6178
jge 0x1004e676
mov dword [ebp - 0x340], 1
jmp 0x1004e67d
and dword [ebp - 0x340], 0
cmp dword [ebp - 0x340], 0
jne 0x1004e692
mov dword [ebp - 0x348], 1
jmp 0x1004e699
and dword [ebp - 0x348], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x240]
cmp dword [ebp - 0x348], eax
je 0x1004e6ba
mov dword [ebp - 0x7b8], 1
jmp 0x1004e6c1
and dword [ebp - 0x7b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x240]
mov dword [ebp - 0xa0c], eax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x1a4], eax
jl 0x1004e706
mov dword [ebp - 0x368], 1
jmp 0x1004e70d
and dword [ebp - 0x368], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x240]
cmp dword [ebp - 0x368], eax
jge 0x1004e72e
mov dword [ebp - 0x370], 1
jmp 0x1004e735
and dword [ebp - 0x370], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x240]
imul eax, dword [ebp - 0x370]
cmp eax, 0xd6b59229
ja 0x1004e75c
mov dword [ebp - 0x378], 1
jmp 0x1004e763
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x1a4]
imul eax, dword [ebp - 0x378]
cmp eax, dword [ebp - 0x1a4]
jl 0x1004e784
mov dword [ebp - 0x380], 1
jmp 0x1004e78b
and dword [ebp - 0x380], 0
cmp dword [ebp - 0x380], 0x8217c712
jb 0x1004e7a3
mov dword [ebp - 0x388], 1
jmp 0x1004e7aa
and dword [ebp - 0x388], 0
cmp dword [ebp - 0x388], 1
jl 0x1004e7bf
mov dword [ebp - 0x390], 1
jmp 0x1004e7c6
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x7c0], eax
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x1004e7ec
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x1004e5df
mov byte [ebp - 0xa6], 0
movzx eax, byte [ebp - 0xa6]
test eax, eax
je 0x1004e80b
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0xa4], 0x1813f1a0
mov dword [ebp - 0x1ac], 0x8bbca631
mov dword [ebp - 0x8e0], 1
mov dword [ebp - 0x8dc], 1
mov dword [ebp - 0x8d8], 1
mov dword [ebp - 0x8d4], 1
mov dword [ebp - 0x1ac], 0xffffffe7
jmp 0x1004e860
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0x10
je 0x1004e8e8
mov dword [ebp - 0x48], 0x4b4e1265
mov dword [ebp - 0x48], 0
jmp 0x1004e880
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xfffffff5
jl 0x1004e8bd
mov dword [ebp - 0x7c8], 0xe64fd9e2
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x398], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x398]
mov dword [ebp + eax - 0x8e0], ecx
mov eax, dword [ebp - 0x398]
shl eax, 3
mov dword [ebp - 0x7c8], eax
jmp 0x1004e879
mov dword [ebp - 0x48], 0
jmp 0x1004e8cd
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x1004e8e3
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x8e0], 0xfffffffb
jmp 0x1004e8c6
jmp 0x1004e853
mov dword [ebp - 0x4b0], 1
mov dword [ebp - 0x124], 1
mov dword [ebp - 0xe4], 0xb9c279a2
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x1b4], 0
jmp 0x1004e933
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x1004e94f
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x78c], 0x9b54
jmp 0x1004e926
mov dword [ebp - 0x124], 0
jmp 0x1004e968
cmp dword [ebp - 0x124], 0x1a
jne 0x1004eebf
mov dword [ebp - 0x448], 0x202d95c7
mov dword [ebp - 0x7e8], 0xfffffff9
mov dword [ebp - 0x1bc], 0
jmp 0x1004e9a2
cmp dword [ebp - 0x1bc], 1
jge 0x1004e9bb
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0x24], 1
jmp 0x1004e995
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x24], 0
jmp 0x1004e9e0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0xec], 0x5116
mov dword [ebp - 0x1c4], 0
jmp 0x1004eee9
cmp dword [ebp - 0x1c4], 1
jge 0x1004ef05
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0xf4], 0x1713b910
jmp 0x1004eedc
mov dword [ebp - 0x3c], 0
jmp 0x1004ef15
push 1
lea eax, [ebp - 0xae8]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.100498e7
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0xa90]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0xa90]
lea edi, [ebp - 0x8b0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x8b0], 0
je 0x1004f53a
push 1
push dword [ebp - 0x8a8]
push dword [ebp - 0x8ac]
call dword [ebp - 0x8b0]
pop edi
pop esi
mov esp, ebp
pop ebp
ret