Function at 0x407830
Capabilities:
Create thread
Extract resource via kernel32 functions
Get common file path
Resume thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57d700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x260
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x44], 0
push edi
mov dword [ebp - 0x18], ebx
call fcn.0042b826
test ebx, ebx
jne 0x40786a
xor ecx, ecx
jmp 0x40786d
mov ecx, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebx + 0x20]
test ebx, ebx
mov dword [0x5f8498], ecx
mov edi, 0x20
cmovne edi, eax
mov eax, dword [ebx + 0x1c8]
mov dword [ebp - 0x40], edi
test eax, eax
je 0x4078b0
push eax
push 1
push 0x80
push dword [edi]
call esi
push dword [ebx + 0x1c8]
push 0
push 0x80
push dword [edi]
call esi
lea ecx, [ebp - 0x3c]
call fcn.004108f0
push str.PATCH.bin
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
call fcn.0040b6d0
add esp, 0xc
mov byte [ebp - 4], 1
or ebx, 0xffffffff
mov ecx, dword [eax]
mov esi, dword [0x5f84cc]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x407937
mov eax, dword [esi + 0xc]
lea edi, [esi + 0xc]
shr eax, 0x1f
test al, al
jne 0x407929
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x407929
push edx
call fcn.0040c780
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x40791f
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [0x5f84cc], eax
jmp 0x407937
push dword [ecx - 0xc]
push ecx
mov ecx, 0x5f84cc
call fcn.0040c8c0
mov edx, dword [ebp - 0x14]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407951
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov edx, dword [ebp - 0x3c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407972
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [0x5f84cc]
call fcn.0040fde0
cmp eax, 0xffffffff
je 0x4090a1
mov dword [ebp - 4], 3
call fcn.00438044
mov ecx, eax
mov byte [ebp - 4], 2
test ecx, ecx
je 0x4090a8
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x64], esi
mov dword [ebp - 4], 4
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x105
or eax, ecx
jge 0x4079d6
push 0x105
lea ecx, [ebp - 0x64]
call fcn.0040c850
mov esi, dword [ebp - 0x64]
cmp dword [esi - 8], 0x105
lea edi, [esi - 0x10]
mov dword [ebp - 0x38], edi
jl 0x409097
push 0x104
xor eax, eax
mov dword [edi + 4], 0x105
push esi
push eax
mov word [esi + 0x20a], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [edi + 8]
push esi
call fcn.0055e0d8
add esp, 8
test eax, eax
js 0x409097
cmp eax, dword [edi + 8]
jg 0x409097
xor ecx, ecx
mov dword [edi + 4], eax
push ecx
push ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov word [esi + eax*2], cx
mov esi, esp
push edi
mov dword [ebp - 0x60], esi
call fcn.0040c780
add esp, 4
add eax, 0x10
mov ecx, 0x5f85d8
mov dword [esi], eax
call fcn.00411240
mov byte [ebp - 4], 6
call fcn.00438044
mov ecx, eax
mov byte [ebp - 4], 5
test ecx, ecx
je 0x4090b2
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x58], esi
mov byte [ebp - 4], 7
lea edi, [esi - 0x10]
mov eax, dword [0x5f85f8]
mov ecx, dword [eax + 0x84]
lea edx, [ecx - 0x10]
cmp edx, edi
je 0x407ad7
mov eax, dword [edi + 0xc]
lea esi, [edi + 0xc]
shr eax, 0x1f
test al, al
jne 0x407ac8
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x407ac8
push edx
call fcn.0040c780
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, ebx
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x407ac0
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
lea esi, [eax + 0x10]
mov dword [ebp - 0x58], esi
jmp 0x407ad7
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x58]
call fcn.0040c8c0
mov esi, dword [ebp - 0x58]
cmp dword [esi - 0xc], 0
lea edi, [esi - 0x10]
mov dword [ebp - 0x34], edi
jl 0x407bbd
push 0x5c3350
push esi
call fcn.0055a5ce
add esp, 8
test eax, eax
je 0x407bbd
sub eax, esi
sar eax, 1
js 0x407bbd
cmp dword [edi + 4], 0
jge 0x407b12
or eax, 0xffffffff
jmp 0x407b2d
push 0x5c3350
push esi
call fcn.0055a5ce
add esp, 8
test eax, eax
jne 0x407b29
or eax, 0xffffffff
jmp 0x407b2d
sub eax, esi
sar eax, 1
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040b9a0
mov byte [ebp - 4], 8
mov ecx, dword [eax]
mov esi, dword [0x5f85b4]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x407b9d
mov eax, dword [esi + 0xc]
lea edi, [esi + 0xc]
shr eax, 0x1f
test al, al
jne 0x407b8f
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x407b8f
push edx
call fcn.0040c780
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x407b85
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [0x5f85b4], eax
jmp 0x407b9d
push dword [ecx - 0xc]
push ecx
mov ecx, 0x5f85b4
call fcn.0040c8c0
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407c1e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x407c1e
mov ecx, dword [0x5f85b4]
add ecx, 0xfffffff0
mov dword [ebp - 0x14], ecx
cmp edi, ecx
je 0x407c1e
lea eax, [ecx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
shr eax, 0x1f
test al, al
jne 0x407c10
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x407c10
push edi
call fcn.0040c780
mov edx, dword [ebp - 0x10]
add esp, 4
mov edi, eax
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407c06
mov esi, dword [ebp - 0x14]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [edi + 0x10]
mov dword [0x5f85b4], eax
jmp 0x407c1e
push dword [edi + 4]
mov ecx, 0x5f85b4
push esi
call fcn.0040c8c0
mov eax, dword [0x5f85f8]
push 1
push dword [eax + 8]
call fcn.00563978
add esp, 8
mov esi, eax
mov ecx, 0x5f85d8
mov dword [ebp - 0x20], esi
push esi
push 0
push 0
call fcn.004118d0
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 8]
mov dword [ebp - 0x10], eax
mov dword [0x5f84a0], edi
mov dword [0x5f84a4], eax
mov byte [ebp - 4], 0xb
call fcn.00438044
mov ecx, eax
mov byte [ebp - 4], 0xa
test ecx, ecx
je 0x4090bc
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [ebp - 4], 9
mov ecx, edi
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x44], 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
call fcn.0057d0a0
movsd xmm1, qword [0x5cb7e8]
movsd xmm2, qword [0x5cb818]
mulsd xmm0, xmm1
comisd xmm0, xmm2
jb 0x407cdb
mulsd xmm0, xmm1
comisd xmm0, xmm2
jb 0x407ccc
mulsd xmm0, xmm1
comisd xmm0, xmm2
jae 0x407cf7
sub esp, 8
movsd qword [esp], xmm0
push str._.2f_GB
jmp 0x407ce8
sub esp, 8
movsd qword [esp], xmm0
push str._.2f_MB
jmp 0x407ce8
sub esp, 8
movsd qword [esp], xmm0
push str._.2f_KB
lea eax, [ebp - 0x1c]
push eax
call fcn.0040cc30
mov esi, dword [ebp - 0x1c]
add esp, 0x10
mov ecx, dword [0x5f85b8]
lea edi, [esi - 0x10]
add ecx, 0xfffffff0
mov dword [ebp - 0x14], ecx
cmp edi, ecx
je 0x407d5f
lea eax, [ecx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
shr eax, 0x1f
test al, al
jne 0x407d51
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x407d51
push edi
call fcn.0040c780
mov edx, dword [ebp - 0x10]
add esp, 4
mov dword [ebp - 0x3c], eax
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407d47
mov esi, dword [ebp - 0x14]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x3c]
add eax, 0x10
mov dword [0x5f85b8], eax
jmp 0x407d5f
push dword [esi - 0xc]
mov ecx, 0x5f85b8
push esi
call fcn.0040c8c0
mov dword [ebp - 0x44], 0
mov eax, ebx
mov byte [ebp - 4], 7
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x407d7e
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x20]
lea edx, [esi + 0x10]
test edx, edx
jne 0x407d8c
xor ecx, ecx
jmp 0x407da0
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407d91
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, 0x5f85c0
call fcn.0040c8c0
mov eax, dword [0x5f85c0]
mov eax, dword [eax - 0xc]
lea edi, [eax*2 + 0x12]
lea edx, [edi + esi]
test edx, edx
jne 0x407dc6
xor ecx, ecx
jmp 0x407de0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407dd0
sub ecx, dword [ebp - 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, 0x5f85b0
call fcn.0040c8c0
mov eax, dword [0x5f85b0]
mov eax, dword [eax - 0xc]
lea edi, [edi + eax*2]
lea edi, [edi + 2]
lea edx, [edi + esi]
test edx, edx
jne 0x407e05
xor ecx, ecx
jmp 0x407e20
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407e10
sub ecx, dword [ebp - 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, 0x5f85c8
call fcn.0040c8c0
mov eax, dword [0x5f85c8]
mov edx, dword [eax - 0xc]
inc edx
lea edx, [edi + edx*2]
add edx, esi
jne 0x407e40
xor ecx, ecx
jmp 0x407e54
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407e45
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, 0x5f864c
call fcn.0040c8c0
push esi
call fcn.0055de73
add esp, 4
mov eax, dword [0x5f85c8]
mov edx, 0x5c4a54
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x407e9b
test si, si
je 0x407e97
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x407e9b
add ecx, 4
add edx, 4
test si, si
jne 0x407e75
xor ecx, ecx
jmp 0x407ea0
sbb ecx, ecx
or ecx, 1
mov byte [ebp - 4], 7
test ecx, ecx
jne 0x407f0a
mov ecx, dword [0x5f85b4]
lea esi, [eax - 0x10]
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x407f0a
mov eax, dword [esi + 0xc]
lea edi, [esi + 0xc]
shr eax, 0x1f
test al, al
jne 0x407ef7
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x407ef7
push edx
call fcn.0040c780
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x407eed
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [0x5f85c8], eax
jmp 0x407f0a
push dword [edx + 4]
push ecx
mov ecx, 0x5f85c8
call fcn.0040c8c0
mov eax, dword [0x5f85c8]
mov edi, dword [eax - 0xc]
test edi, edi
js 0x409097
mov edx, dword [eax - 8]
mov esi, 1
sub esi, dword [eax - 4]
sub edx, edi
or edx, esi
jge 0x407f36
push edi
mov ecx, 0x5f85c8
call fcn.0040c850
mov eax, dword [0x5f85c8]
lea ecx, [edi + 1]
push ecx
push eax
call fcn.00562f18
mov eax, dword [0x5f85c8]
add esp, 8
cmp edi, dword [eax - 8]
jg 0x409097
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [0x5f85c8]
mov word [eax + edi*2], cx
lea ecx, [ebp - 0x14]
call fcn.004108f0
mov byte [ebp - 4], 0xd
mov ecx, dword [eax]
mov esi, dword [0x5f85bc]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x407fca
mov eax, dword [esi + 0xc]
lea edi, [esi + 0xc]
shr eax, 0x1f
test al, al
jne 0x407fbc
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x407fbc
push edx
call fcn.0040c780
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x407fb2
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [0x5f85bc], eax
jmp 0x407fca
push dword [ecx - 0xc]
push ecx
mov ecx, 0x5f85bc
call fcn.0040c8c0
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407fe8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5f85bc]
mov ecx, 0x5f85bc
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040b9a0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x14]
mov edx, dword [eax]
call fcn.004110a0
mov byte [ebp - 4], 0xf
mov ecx, dword [eax]
mov esi, dword [0x5f85bc]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x408071
mov eax, dword [esi + 0xc]
lea edi, [esi + 0xc]
shr eax, 0x1f
test al, al
jne 0x408063
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x408063
push edx
call fcn.0040c780
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x408059
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [0x5f85bc], eax
jmp 0x408071
push dword [ecx - 0xc]
push ecx
mov ecx, 0x5f85bc
call fcn.0040c8c0
mov edx, dword [ebp - 0x14]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40808b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x3c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4080a9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 5
push str.Crack
mov ecx, 0x5f85bc
call fcn.0040c9e0
mov ecx, dword [0x5f85bc]
call fcn.0040fde0
cmp eax, 0xffffffff
jne 0x4080d4
mov ecx, 0x5f85bc
call fcn.0040c1c0
mov eax, dword [0x5f85c8]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x4080eb
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x4080fd
mov byte [ebp - 4], 0x11
call fcn.00438044
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 0x12
test ecx, ecx
je 0x4090c6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [0x5f85c8]
mov dword [ebp - 0x44], 8
push dword [eax - 0xc]
push eax
push 8
lea eax, [ebp - 0x20]
push 0x5c4b98
push eax
call fcn.0040c5c0
push 0x5c4b94
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040b6d0
push 0x5f864c
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x13
push eax
call fcn.0040b7a0
add esp, 0x2c
mov byte [ebp - 4], 0x14
mov ecx, dword [eax]
mov esi, dword [0x5f8644]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x4081c3
mov eax, dword [esi + 0xc]
lea edi, [esi + 0xc]
shr eax, 0x1f
test al, al
jne 0x4081b5
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x4081b5
push edx
call fcn.0040c780
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x4081ab
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [0x5f8644], eax
jmp 0x4081c3
push dword [ecx - 0xc]
push ecx
mov ecx, 0x5f8644
call fcn.0040c8c0
mov edx, dword [ebp - 0x14]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4081dd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x3c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4081f7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x44], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40821c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5f8644]
mov edi, dword [eax - 0xc]
test edi, edi
js 0x409097
mov edx, dword [eax - 8]
mov esi, 1
sub esi, dword [eax - 4]
sub edx, edi
or edx, esi
jge 0x40824d
push edi
mov ecx, 0x5f8644
call fcn.0040c850
mov eax, dword [0x5f8644]
lea ecx, [edi + 1]
push ecx
push eax
call fcn.00562f18
mov eax, dword [0x5f8644]
add esp, 8
cmp edi, dword [eax - 8]
jg 0x409097
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [0x5f8644]
mov word [eax + edi*2], cx
call fcn.0041c773
test eax, eax
je 0x408288
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40828a
xor eax, eax
push dword [0x5f8644]
mov ecx, eax
call fcn.00436720
lea eax, [ebp - 0x26c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x26c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4082b2
sub ecx, edx
lea eax, [ebp - 0x26c]
sar ecx, 1
push ecx
push eax
mov ecx, 0x5f8648
call fcn.0040c8c0
push 0xa
push str.tenoke.mid
mov ecx, 0x5f8648
call fcn.0040c9e0
mov ecx, dword [0x5f8648]
call fcn.0040fde0
cmp eax, 0xffffffff
jne 0x408376
mov eax, dword [0x5f8648]
push 0
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x5c4bc4
mov esi, eax
push 0x89
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x408376
push edi
push esi
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 2
push 2
push 0
push 7
push 0x40000000
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or ebx, 0xffffffff
mov eax, dword [0x5f8648]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x40838d
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x40839f
mov byte [ebp - 4], 0x16
call fcn.00438044
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 0x17
test ecx, ecx
je 0x4090d0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x20], eax
mov eax, dword [0x5f8648]
mov dword [ebp - 0x44], 1
push dword [eax - 0xc]
push eax
push 5
lea eax, [ebp - 0x20]
push str.Open
push eax
call fcn.0040c5c0
add esp, 0x14
mov esi, dword [ebp - 0x20]
mov ecx, dword [esi - 0x10]
lea edi, [esi - 0x10]
test ecx, ecx
je 0x4083f5
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x408407
mov byte [ebp - 4], 0x19
call fcn.00438044
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 0x1a
test ecx, ecx
je 0x4090da
mov eax, dword [ecx]
call dword [eax + 0xc]
push 0x1c
push 0x5c53d8
mov byte [ebp - 4], 0x18
add eax, 0x10
push dword [esi - 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push esi
push eax
mov dword [ebp - 0x44], 3
call fcn.0040c5c0
add esp, 0x14
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x408454
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x1c]
mov edi, dword [sym.imp.WINMM.dll_mciSendStringW]
push 0
push 0
push 0
push esi
call edi
push 0
push 0
push 0
push str.play_Music1_repeat
call edi
mov dword [ebp - 0x44], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 7
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x408495
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
sub eax, 0x320
cdq
sub eax, edx
mov edi, eax
push 1
sar edi, 1
call esi
mov esi, dword [ebp - 0x18]
sub eax, 0x1c2
push 1
cdq
mov ecx, esi
push 0x1c2
sub eax, edx
push 0x320
sar eax, 1
push eax
push edi
call fcn.00436570
mov edi, dword [ebp - 0x40]
push 0
push 0
push 0x31
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.0043744c
mov dword [ebp - 0x60], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x54]
push eax
push dword [edi]
movups xmmword [ebp - 0x54], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x50]
lea eax, [esi + 0xd0]
mov dword [ebp - 0x20], eax
mov eax, dword [eax]
push 0x44c
push dword [ebp - 0x18]
lea esi, [edx + 0xc8]
mov dword [ebp - 0x2c], edx
mov edi, dword [eax + 0x164]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], esi
lea ecx, [eax + 0x320]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x20]
push eax
push 0x50000000
push 0x5c3354
call edi
test eax, eax
je 0x408f1a
call fcn.0043a184
push 0x5c4bc4
push 0x86
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4086dd
call fcn.0043a184
push esi
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x4086dd
call fcn.0043a184
push esi
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4086dd
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 0x40]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4086d6
test ebx, ebx
je 0x4086d6
push esi
push eax
push ebx
call fcn.0055acc0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, dword [ebp - 0x20]
mov ecx, ebx
push esi
push edi
call fcn.0040d090
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x4086dd
cmp dword [ebx + 0xb8], 0
je 0x4086dd
cmp dword [ebx + 0xac], 0
je 0x40866d
mov ecx, dword [ebx + 0xf0]
mov eax, 0x92492493
sub ecx, dword [ebx + 0xec]
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jbe 0x40866d
lea eax, [ebp - 0x5c]
push eax
push 4
push ebx
push 0x40dc50
push 0
push 0
call fcn.005632b3
add esp, 0x18
mov dword [ebx + 0xd4], eax
test eax, eax
je 0x4086dd
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x4086dd
mov ecx, dword [ebx + 0xdc]
test ecx, ecx
je 0x4086dd
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
push ecx
call dword [eax + 0x18]
mov ecx, dword [ebx + 0xdc]
lea edx, [ebp - 0x40]
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov esi, dword [ebx + 0xdc]
mov ecx, dword [ebp - 0x40]
push 0
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
mov eax, ecx
neg eax
push eax
push dword [ebp - 0x10]
push ecx
push 0
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push 0
push 0
push dword [ebx + 0xbc]
push esi
call edx
test eax, eax
jne 0x4086dd
push eax
push eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4086dd
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x50]
add ecx, 0x1d0
push 0x44d
push dword [ebp - 0x18]
mov eax, dword [ecx]
lea edi, [edx + 0x186]
add edx, 0xdc
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edx
mov ebx, dword [eax + 0x164]
mov eax, dword [ebp - 0x54]
lea esi, [eax + 0xc8]
add eax, 0xa
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000007
push str.OPTIONS
mov dword [ebp - 0x28], esi
call ebx
test eax, eax
jne 0x40875b
mov edx, dword [ebp - 0x34]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40874b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x38]
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jmp 0x408f3c
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x50]
push 0x44e
push ebx
mov eax, dword [ebx + 0x450]
lea esi, [ecx + 0x112]
add ecx, 0xfa
mov dword [ebp - 0x2c], ecx
lea ecx, [ebx + 0x450]
mov dword [ebp - 0x24], esi
mov edi, dword [eax + 0x164]
mov eax, dword [ebp - 0x54]
lea edx, [eax + 0x36]
add eax, 0x1e
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000000
push str.music
mov dword [ebp - 0x28], edx
call edi
test eax, eax
jne 0x4087d8
mov edx, dword [ebp - 0x34]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40874b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x38]
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jmp 0x408f3c
sub esp, 0x18
lea ecx, [ebx + 0x450]
call fcn.0040f0c0
mov eax, dword [ebx + 0x3d0]
lea ecx, [ebx + 0x3d0]
mov edx, dword [ebp - 0x50]
push 0x452
push dword [ebp - 0x18]
mov ebx, dword [eax + 0x164]
mov eax, dword [ebp - 0x54]
lea edi, [edx + 0x120]
add edx, 0x100
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edx
lea esi, [eax + 0xa0]
add eax, 0x3c
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000000
push str.MUSIC
mov dword [ebp - 0x28], esi
call ebx
test eax, eax
jne 0x408869
mov edx, dword [ebp - 0x34]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40874b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x38]
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jmp 0x408f3c
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x50]
push 0x453
push ebx
mov eax, dword [ebx + 0x548]
lea esi, [ecx + 0x13b]
add ecx, 0x11d
mov dword [ebp - 0x2c], ecx
lea ecx, [ebx + 0x548]
mov dword [ebp - 0x24], esi
mov edi, dword [eax + 0x164]
mov eax, dword [ebp - 0x54]
lea edx, [eax + 0xbf]
add eax, 0x1f
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000003
push str.COPY_CRACK
mov dword [ebp - 0x28], edx
call edi
test eax, eax
jne 0x4088ed
mov edx, dword [ebp - 0x34]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40874b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x38]
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jmp 0x408f3c
push 0
push dword [0x5effd0]
push 0xf1
push dword [ebx + 0x568]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x5f85bc]
cmp dword [eax - 0xc], 0
jne 0x40891e
push 0
lea ecx, [ebx + 0x548]
call fcn.00436294
mov eax, dword [0x5f85c0]
mov ecx, 0x5c4a54
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40894e
test dx, dx
je 0x40894a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40894e
add eax, 4
add ecx, 4
test dx, dx
jne 0x408928
xor eax, eax
jmp 0x408953
sbb eax, eax
or eax, 1
mov byte [ebp - 4], 7
test eax, eax
jne 0x408967
lea ecx, [ebx + 0x5c8]
push eax
call fcn.00436294
mov eax, dword [ebx + 0x250]
lea ecx, [ebx + 0x250]
mov edx, dword [ebp - 0x50]
push 0x45b
push dword [ebp - 0x18]
mov ebx, dword [eax + 0x164]
mov eax, dword [ebp - 0x54]
lea edi, [edx + 0x186]
add edx, 0xdc
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edx
lea esi, [eax + 0x30c]
add eax, 0xd2
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000007
push str.INSTALL_DIRECTORY
mov dword [ebp - 0x28], esi
call ebx
test eax, eax
jne 0x4089ec
mov edx, dword [ebp - 0x34]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40874b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x38]
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jmp 0x408f3c
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x18]
push 0x456
lea esi, [eax + 0x29e]
add eax, 0xf0
mov dword [ebp - 0x30], eax
lea edi, [edx + 0x10e]
push ebx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], esi
push eax
add edx, 0xfb
mov dword [ebp - 0x24], edi
lea ecx, [ebx + 0x6c8]
mov dword [ebp - 0x2c], edx
push 0x50800080
call fcn.00438cc7
test eax, eax
jne 0x408a64
mov edx, dword [ebp - 0x34]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40874b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x38]
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jmp 0x408f3c
mov eax, dword [ebx + 0x748]
lea ecx, [ebx + 0x748]
mov edx, dword [ebp - 0x50]
push 0x451
mov ebx, dword [eax + 0x164]
mov eax, dword [ebp - 0x54]
lea edi, [edx + 0x110]
mov dword [ebp - 0x24], edi
add edx, 0xf8
mov edi, dword [ebp - 0x18]
push edi
lea esi, [eax + 0x2fd]
mov dword [ebp - 0x2c], edx
add eax, 0x2ad
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000000
push str.BROWSER...
call ebx
test eax, eax
jne 0x408aea
mov edx, dword [ebp - 0x34]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40874b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x38]
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jmp 0x408f3c
mov eax, dword [edi + 0x7c8]
mov ecx, dword [ebp - 0x50]
push 0xc
mov eax, dword [eax + 0x164]
mov dword [ebp - 0x5c], eax
lea esi, [ecx + 0x135]
mov eax, dword [ebp - 0x54]
add ecx, 0x11d
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], esi
lea edx, [eax + 0x302]
add eax, 0xf0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edx
call fcn.0042ad45
mov ebx, eax
mov dword [ebp - 0x10], eax
add esp, 4
mov dword [ebp - 0x40], ebx
mov byte [ebp - 4], 0x1d
test ebx, ebx
je 0x408b58
push str._FREE_DISKSPACE
mov dword [ebx + 4], 0
mov dword [ebx + 8], 1
call fcn.00559c00
mov dword [ebx], eax
jmp 0x408b5d
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 7
mov dword [ebp - 0x40], ebx
test ebx, ebx
je 0x4090e4
mov eax, dword [0x5f85b8]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x408b83
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x408b95
mov byte [ebp - 4], 0x20
call fcn.00438044
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 0x21
test ecx, ecx
je 0x4090ee
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x3c], eax
mov eax, dword [0x5f85b8]
mov dword [ebp - 0x44], 0x10
push dword [eax - 0xc]
push eax
push 9
lea eax, [ebp - 0x3c]
push str.REQUIRED
push eax
call fcn.0040c5c0
push 0xc
mov byte [ebp - 4], 0x22
call fcn.0042ad45
mov ebx, eax
add esp, 0x18
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 0x23
mov esi, dword [ebp - 0x3c]
test ebx, ebx
je 0x408c16
push esi
mov dword [ebx + 4], 0
mov dword [ebx + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebx], eax
test eax, eax
jne 0x408c1b
test esi, esi
jne 0x4090f8
jmp 0x408c1b
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x4090e4
push 0xc
mov dword [ebp - 0x44], 0x30
call fcn.0042ad45
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0x24
test eax, eax
je 0x408c5c
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.004032d0
mov edx, eax
mov dword [ebp - 0x1c], eax
jmp 0x408c61
xor edx, edx
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 0x22
test edx, edx
je 0x4090e4
mov ecx, dword [ebp - 0x20]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [ecx + 8], eax
dec eax
jne 0x408cbb
mov eax, dword [ecx]
test eax, eax
je 0x408c93
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], 0
mov eax, dword [ecx + 4]
test eax, eax
je 0x408cad
push eax
call fcn.0042ee69
mov ecx, dword [ebp - 0x20]
add esp, 4
mov dword [ecx + 4], 0
push 0xc
push ecx
call fcn.00558c7b
mov edx, dword [ebp - 0x1c]
add esp, 8
push 0x457
push edi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x14], edx
push eax
push 0x50000000
push dword [edx]
lea ecx, [edi + 0x7c8]
call dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
lock xadd dword [eax + 8], ecx
dec ecx
jne 0x408d23
mov ecx, dword [eax]
test ecx, ecx
je 0x408cfe
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x408d18
push ecx
call fcn.0042ee69
mov eax, dword [ebp - 0x1c]
add esp, 4
mov dword [eax + 4], 0
push 0xc
push eax
call fcn.00558c7b
add esp, 8
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x408d3a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, ebx
mov esi, dword [ebp - 0x10]
lock xadd dword [esi + 8], eax
dec eax
jne 0x408d80
mov eax, dword [esi]
test eax, eax
je 0x408d5e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x408d75
push eax
call fcn.0042ee69
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00558c7b
add esp, 8
cmp dword [ebp - 0x5c], 0
je 0x408f1a
mov eax, dword [edi + 0x948]
lea ecx, [edi + 0x948]
mov esi, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
push 0x45a
mov edi, dword [eax + 0x164]
lea eax, [esi + 0xf0]
mov dword [ebp - 0x30], eax
lea eax, [edx + 0x136]
mov dword [ebp - 0x2c], eax
lea eax, [esi + 0x29e]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
lea eax, [edx + 0x14e]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push esi
push eax
push 0x50000000
call edi
test eax, eax
je 0x408f1a
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x3e80000
push 0
push 0x401
push dword [esi + 0x968]
call edi
push 0
push 0
push 0x402
push dword [esi + 0x968]
call edi
mov eax, dword [esi + 0x8c8]
lea edi, [esi + 0x8c8]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
push 0x459
mov esi, dword [eax + 0x164]
push dword [ebp - 0x18]
lea eax, [ecx + 0x2c1]
mov dword [ebp - 0x30], eax
lea eax, [edx + 0x13b]
mov dword [ebp - 0x2c], eax
lea eax, [ecx + 0x2fd]
mov dword [ebp - 0x28], eax
mov ecx, edi
lea eax, [edx + 0x14f]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000000
push 0x5c4b94
call esi
test eax, eax
je 0x408f1a
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
push 0x44f
mov eax, dword [edi + 0x2d0]
push edi
mov esi, dword [eax + 0x164]
lea eax, [ecx + 0x12c]
mov dword [ebp - 0x30], eax
lea eax, [edx + 0x159]
mov dword [ebp - 0x2c], eax
lea eax, [ecx + 0x190]
mov dword [ebp - 0x28], eax
lea ecx, [edi + 0x2d0]
lea eax, [edx + 0x177]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000001
push str.PATCH
call esi
test eax, eax
je 0x408f1a
mov eax, dword [edi + 0x350]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
push 0x450
mov esi, dword [eax + 0x164]
lea eax, [ecx + 0x1f4]
mov dword [ebp - 0x30], eax
lea eax, [edx + 0x159]
mov dword [ebp - 0x2c], eax
lea eax, [ecx + 0x258]
mov dword [ebp - 0x28], eax
lea ecx, [edi + 0x350]
lea eax, [edx + 0x177]
push edi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 0x50000000
push str.EXIT
call esi
test eax, eax
jne 0x408f59
mov edx, dword [ebp - 0x34]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408f31
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x38]
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x408f46
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x60]
test edi, edi
je 0x40904b
mov esi, dword [ebp - 0x18]
push 1
push dword [edi + 4]
push 0x30
push dword [esi + 0x1f0]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [esi + 0x270]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [esi + 0x568]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [esi + 0x5e8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [esi + 0x668]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [esi + 0x3f0]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [esi + 0x7e8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [esi + 0x6e8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [esi + 0x8e8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [esi + 0x768]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [esi + 0x2f0]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi + 4]
push 0x30
push dword [esi + 0x370]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00406b90
call fcn.00406e30
mov edx, dword [ebp - 0x34]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40906c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x38]
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x409081
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
mov eax, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004027b0
push 0
call fcn.0055e5f7
push 0x80004005
call fcn.004027b0
push 0x80004005
call fcn.004027b0
push 0x80004005
call fcn.004027b0
push 0x80004005
call fcn.004027b0
push 0x80004005
call fcn.004027b0
push 0x80004005
call fcn.004027b0
push 0x8007000e
call fcn.00559be0
push 0x80004005
call fcn.004027b0
push 0x8007000e
call fcn.00559be0
int3