Function at 0x1004d79a
Capabilities:
Delete registry value
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10084719
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdd8
push esi
push edi
mov dword [ebp - 0x8a0], 0
push 3
lea ecx, [ebp - 0x860]
call fcn.100171f5
and dword [ebp - 4], 0
mov dword [ebp - 0x808], 9
mov dword [ebp - 0x1a0], 0xafa9b64f
mov dword [ebp - 0x63c], 1
mov dword [ebp - 0x8b0], 0x5243b9c
mov dword [ebp - 0xb60], 0xe1b8
push 4
lea ecx, [ebp - 0xaf8]
call fcn.100171f5
mov byte [ebp - 4], 1
mov dword [ebp - 0x64], 0
jmp 0x1004d828
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1004d844
push dword [ebp - 0x64]
lea ecx, [ebp - 0x860]
call fcn.10017262
mov dword [eax], 0x768c0aa3
jmp 0x1004d821
mov dword [ebp - 0x64], 0
jmp 0x1004d854
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x1004d870
push dword [ebp - 0x64]
lea ecx, [ebp - 0xaf8]
call fcn.10017262
mov dword [eax], 0xd58e7ea
jmp 0x1004d84d
imul eax, dword [ebp - 0x8a0], 0xffffffff
mov dword [ebp - 0x7bc], eax
push 2
lea ecx, [ebp - 0x860]
call fcn.10017262
mov ecx, dword [ebp - 0x7bc]
mov dword [eax], ecx
cmp dword [ebp - 0x7bc], 0
je 0x1004d8ba
mov byte [ebp - 0x9f], 0
movzx eax, byte [ebp - 0x9f]
test eax, eax
je 0x1004d8b5
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
jmp 0x1004da8f
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x818], 0xffffffff
mov dword [ebp - 0x828], 0x7f51ef99
push 1
lea ecx, [ebp - 0x860]
call fcn.10017262
mov dword [ebp - 0x800], eax
push 1
lea ecx, [ebp - 0x860]
call fcn.10017262
mov ecx, dword [ebp - 0x800]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x800]
mov eax, dword [eax]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
je 0x1004da22
push 2
lea ecx, [ebp - 0x860]
call fcn.10017262
cmp dword [eax], 7
je 0x1004d947
mov dword [ebp - 0x810], 1
jmp 0x1004d94e
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
cmp dword [ebp - 0x150], eax
je 0x1004d974
mov dword [ebp - 0x820], 1
jmp 0x1004d97b
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 0
jne 0x1004d9ab
push 1
lea ecx, [ebp - 0x860]
call fcn.10017262
cmp dword [eax], 0
jne 0x1004d9ab
and dword [ebp - 0x830], 0
jmp 0x1004d9b5
mov dword [ebp - 0x830], 1
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x830], eax
jl 0x1004d9cf
mov dword [ebp - 0x838], 1
jmp 0x1004d9d6
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x150]
imul eax, dword [ebp - 0x838]
add eax, 0x4edb
imul eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x150]
jg 0x1004da03
mov dword [ebp - 0x840], 1
jmp 0x1004da0a
and dword [ebp - 0x840], 0
cmp dword [ebp - 0x840], 0xdaa237f4
jne 0x1004da22
mov dword [ebp - 0x848], 1
jmp 0x1004da29
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x848]
dec eax
cmp eax, 0x1a094951
jne 0x1004da4c
cmp dword [ebp - 0x1a0], 0
je 0x1004da4c
mov dword [ebp - 0x2c8], 1
jmp 0x1004da53
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x8b0], eax
push 0
lea ecx, [ebp - 0xaf8]
call fcn.10017262
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2d0]
mov dword [ecx], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xaf8]
call fcn.1001725d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x860]
call fcn.1001725d
mov dword [ebp - 0x918], 0
push 3
lea ecx, [ebp - 0x86c]
call fcn.100171f5
mov dword [ebp - 4], 2
push 4
lea ecx, [ebp - 0x9cc]
call fcn.100171f5
mov byte [ebp - 4], 3
mov dword [ebp - 0x138], 0xdba76aab
mov dword [ebp - 0x8c0], 0x6fda0246
mov dword [ebp - 0x158], 0
jmp 0x1004db09
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 4
jge 0x1004db2b
push dword [ebp - 0x158]
lea ecx, [ebp - 0x9cc]
call fcn.10017262
mov dword [eax], 1
jmp 0x1004dafc
mov dword [ebp - 0x138], 0
jmp 0x1004db44
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jg 0x1004dcd4
mov dword [ebp - 0x8b8], 0x7f2fb5a5
push 3
lea ecx, [ebp - 0xab0]
call fcn.100171f5
mov byte [ebp - 4], 4
mov dword [ebp - 0x1bc], 0
jmp 0x1004db85
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jge 0x1004dba7
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0xab0]
call fcn.10017262
mov dword [eax], 0x13a3dbc5
jmp 0x1004db78
cmp dword [ebp - 0x138], 0xaa0a
jl 0x1004dbbf
mov dword [ebp - 0x644], 1
jmp 0x1004dbc6
and dword [ebp - 0x644], 0
cmp dword [ebp - 0x644], 0xfffffff6
jge 0x1004dbed
push 0
lea ecx, [ebp - 0x9cc]
call fcn.10017262
cmp dword [eax], 0
je 0x1004dbed
mov dword [ebp - 0x2d8], 1
jmp 0x1004dbf4
and dword [ebp - 0x2d8], 0
cmp dword [ebp - 0x2d8], 6
jl 0x1004dc09
mov dword [ebp - 0x64c], 1
jmp 0x1004dc10
and dword [ebp - 0x64c], 0
push 3
lea ecx, [ebp - 0x9cc]
call fcn.10017262
mov eax, dword [eax]
cmp eax, dword [ebp - 0x64c]
jne 0x1004dc33
mov dword [ebp - 0x210], 1
jmp 0x1004dc3a
and dword [ebp - 0x210], 0
push 2
lea ecx, [ebp - 0xab0]
call fcn.10017262
mov ecx, dword [ebp - 0x210]
mov dword [eax], ecx
cmp dword [ebp - 0x210], 0x6525
je 0x1004dc67
mov dword [ebp - 0x2e0], 1
jmp 0x1004dc6e
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x8b8]
cmp eax, dword [ebp - 0x2e0]
jge 0x1004dc88
mov dword [ebp - 0x654], 1
jmp 0x1004dc8f
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x8c0], eax
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x1004dcc0
push 0
push 0
push 0x69a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xab0]
call fcn.1001725d
jmp 0x1004db37
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9cc]
call fcn.1001725d
mov dword [ebp - 0x488], 9
mov dword [ebp - 0x100], 0x5ab3e90a
push 4
lea ecx, [ebp - 0x9f0]
call fcn.100171f5
mov byte [ebp - 4], 5
mov dword [ebp - 0x8d0], 0xfffffff6
mov dword [ebp - 0x8e0], 1
mov dword [ebp - 0xbe8], 0xfffffffb
mov dword [ebp - 0x68], 0
jmp 0x1004dd36
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x1004dd4f
push dword [ebp - 0x68]
lea ecx, [ebp - 0x9f0]
call fcn.10017262
or dword [eax], 0xffffffff
jmp 0x1004dd2f
mov dword [ebp - 0x68], 0
jmp 0x1004dd5f
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1004dd75
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x29c], 0xa32f3f60
jmp 0x1004dd58
cmp dword [ebp - 0x100], 0
jne 0x1004de27
cmp dword [ebp - 0x100], 0
jne 0x1004dd9d
cmp dword [ebp - 0x100], 0
jne 0x1004dd9d
and dword [ebp - 0x2e8], 0
jmp 0x1004dda7
mov dword [ebp - 0x2e8], 1
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xd38], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x65c], eax
push 3
lea ecx, [ebp - 0x9f0]
call fcn.10017262
mov ecx, dword [ebp - 0x65c]
mov dword [eax], ecx
imul eax, dword [ebp - 0x2e8], 0xffff
cmp dword [ebp - 0x65c], eax
jg 0x1004ddf2
mov dword [ebp - 0x2f0], 1
jmp 0x1004ddf9
and dword [ebp - 0x2f0], 0
cmp dword [ebp - 0x2f0], 0
je 0x1004de0e
mov dword [ebp - 0x8c8], 1
jmp 0x1004de15
and dword [ebp - 0x8c8], 0
cmp dword [ebp - 0x100], 0
jne 0x1004de27
and dword [ebp - 0x678], 0
jmp 0x1004de31
mov dword [ebp - 0x678], 1
mov eax, dword [ebp - 0x8d0]
cmp dword [ebp - 0x678], eax
jge 0x1004de4b
mov dword [ebp - 0x2f8], 1
jmp 0x1004de52
and dword [ebp - 0x2f8], 0
imul eax, dword [ebp - 0x2f8], 0
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x29c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x29c], 1
jne 0x1004de82
mov dword [ebp - 0x680], 1
jmp 0x1004de89
and dword [ebp - 0x680], 0
push 3
pop eax
sub eax, dword [ebp - 0x680]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x29c]
je 0x1004dead
mov dword [ebp - 0x300], 1
jmp 0x1004deb4
and dword [ebp - 0x300], 0
push 3
lea ecx, [ebp - 0x9f0]
call fcn.10017262
and dword [eax], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x29c]
add eax, dword [ebp - 0x300]
test eax, eax
jg 0x1004dee7
mov dword [ebp - 0x8d8], 1
jmp 0x1004deee
and dword [ebp - 0x8d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c]
mov dword [ebp - 0xbfc], eax
cmp dword [ebp - 0x8e0], 0x3b83
jg 0x1004df19
mov dword [ebp - 0x688], 1
jmp 0x1004df20
and dword [ebp - 0x688], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x688]
mov dword [ebp + eax - 0x29c], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9f0]
call fcn.1001725d
mov dword [ebp - 0x180], 0xafa9b64f
mov dword [ebp - 0xa78], 0xfffffff7
mov dword [ebp - 0xa74], 0xfffffff7
mov dword [ebp - 0xa70], 0xfffffff7
mov dword [ebp - 0xa6c], 0xfffffff7
lea ecx, [ebp - 0x26d]
call fcn.10008cc3
push eax
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0xa78]
push eax
lea ecx, [ebp - 0xda0]
call fcn.10017271
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc40]
call fcn.10017237
mov byte [ebp - 4], 6
mov dword [ebp - 0x310], 0xffffffff
mov dword [ebp - 0xb18], 0x9b8f
mov dword [ebp - 0xb1c], 0xffffffff
xor eax, eax
inc eax
jne 0x1004dfe2
cmp dword [ebp - 0x310], 0
jne 0x1004dfe2
and dword [ebp - 0x308], 0
jmp 0x1004dfec
mov dword [ebp - 0x308], 1
push 1
lea ecx, [ebp - 0xc40]
call fcn.10017262
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x260]
mov dword [ecx], eax
mov eax, dword [ebp - 0x260]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x308]
jle 0x1004e02c
mov dword [ebp - 0x690], 1
jmp 0x1004e033
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0x310], eax
mov byte [ebp - 0xa0], 0
movzx eax, byte [ebp - 0xa0]
test eax, eax
je 0x1004e083
push 0x2197
push 0x74e
push 0x3c5
push 0x1d8b
push 0x1c62
push 0xfde
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc40]
call fcn.1001725d
mov dword [ebp - 0x4b0], 1
mov dword [ebp - 0x120], 0xffffffff
push 2
lea ecx, [ebp - 0x288]
call fcn.100171f5
mov byte [ebp - 4], 7
mov dword [ebp - 0x6a0], 0xfffffff8
mov dword [ebp - 0x6a8], 0xbfe73744
mov dword [ebp - 0x8e8], 0
mov dword [ebp - 0x338], 0xfffffffb
mov dword [ebp - 0x80], 0
jmp 0x1004e0ef
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x1004e105
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xd5c], 0xe283bc1b
jmp 0x1004e0e8
mov dword [ebp - 0x80], 0
jmp 0x1004e115
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1004e131
push dword [ebp - 0x80]
lea ecx, [ebp - 0x288]
call fcn.10017262
mov dword [eax], 0xa6e8
jmp 0x1004e10e
cmp dword [ebp - 0x120], 0
je 0x1004e37d
xor eax, eax
jne 0x1004e2ea
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd5c], 0x45d
push 1
lea ecx, [ebp - 0x288]
call fcn.10017262
cmp dword [eax], 0x45d
jle 0x1004e178
mov dword [ebp - 0x698], 1
jmp 0x1004e17f
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x698], eax
jl 0x1004e199
mov dword [ebp - 0x318], 1
jmp 0x1004e1a0
and dword [ebp - 0x318], 0
push 1
lea ecx, [ebp - 0x288]
call fcn.10017262
mov ecx, dword [ebp - 0x318]
add ecx, dword [eax]
mov dword [ebp - 0x6a0], ecx
mov esi, dword [ebp - 0x6a0]
push 1
lea ecx, [ebp - 0x288]
call fcn.10017262
cmp esi, dword [eax]
jg 0x1004e1de
mov dword [ebp - 0x320], 1
jmp 0x1004e1e5
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 0
jne 0x1004e215
push 1
lea ecx, [ebp - 0x288]
call fcn.10017262
cmp dword [eax], 0
jne 0x1004e215
and dword [ebp - 0x328], 0
jmp 0x1004e21f
mov dword [ebp - 0x328], 1
cmp dword [ebp - 0x328], 0x1a88
jne 0x1004e237
mov dword [ebp - 0x6b0], 1
jmp 0x1004e23e
and dword [ebp - 0x6b0], 0
cmp dword [ebp - 0x6b0], 0xeab3
jg 0x1004e271
cmp dword [ebp - 0x8e8], 0
je 0x1004e271
push 1
lea ecx, [ebp - 0x288]
call fcn.10017262
cmp dword [eax], 0
je 0x1004e271
mov dword [ebp - 0x330], 1
jmp 0x1004e278
and dword [ebp - 0x330], 0
cmp dword [ebp - 0x330], 0
jne 0x1004e285
xor eax, eax
je 0x1004e296
xor eax, eax
inc eax
je 0x1004e296
mov dword [ebp - 0x6b8], 1
jmp 0x1004e29d
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x338], eax
mov esi, dword [ebp - 0x338]
push 1
lea ecx, [ebp - 0x288]
call fcn.10017262
cmp esi, dword [eax]
jne 0x1004e2cc
mov dword [ebp - 0x6c0], 1
jmp 0x1004e2d3
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x120]
sub eax, dword [ebp - 0x6c0]
jne 0x1004e2ea
and dword [ebp - 0x340], 0
jmp 0x1004e2f4
mov dword [ebp - 0x340], 1
push 0
lea ecx, [ebp - 0x288]
call fcn.10017262
mov ecx, dword [ebp - 0x340]
cmp ecx, dword [eax]
jle 0x1004e317
mov dword [ebp - 0x6c8], 1
jmp 0x1004e31e
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x6c8]
sub ecx, 0xfffe
sub eax, ecx
je 0x1004e350
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd5c], 0
je 0x1004e350
mov dword [ebp - 0x348], 1
jmp 0x1004e357
and dword [ebp - 0x348], 0
push 1
lea ecx, [ebp - 0x288]
call fcn.10017262
mov ecx, dword [ebp - 0x348]
imul ecx, dword [eax]
test ecx, ecx
je 0x1004e37d
mov dword [ebp - 0x6d0], 1
jmp 0x1004e384
and dword [ebp - 0x6d0], 0
cmp dword [ebp - 0x6d0], 0xa339
jg 0x1004e39c
mov dword [ebp - 0x350], 1
jmp 0x1004e3a3
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x120], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x288]
call fcn.1001725d
mov dword [ebp - 0x8ac], 0x5243b9c
mov dword [ebp - 0xb24], 0xe1b8
push 4
lea ecx, [ebp - 0xa98]
call fcn.100171f5
mov byte [ebp - 4], 8
mov dword [ebp - 0x108], 0x6ec17e5c
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x358], 1
mov dword [ebp - 0x130], 0xdf39
mov dword [ebp - 0x258], 0x711f64db
mov dword [ebp - 0x370], 0x5364
mov dword [ebp - 0x8f8], 1
mov dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jg 0x1004e44e
mov dword [ebp - 0x6d8], 1
jmp 0x1004e455
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x358]
imul eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x38]
je 0x1004e47c
mov dword [ebp - 0x6e0], 1
jmp 0x1004e483
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x6e0], eax
jle 0x1004e49d
mov dword [ebp - 0x360], 1
jmp 0x1004e4a4
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x360], eax
jg 0x1004e4be
mov dword [ebp - 0x6e8], 1
jmp 0x1004e4c5
and dword [ebp - 0x6e8], 0
cmp dword [ebp - 0x6e8], 0xf63e
jne 0x1004e4d8
cmp dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xb2c], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x108]
add eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x130]
je 0x1004e516
mov dword [ebp - 0x8f0], 1
jmp 0x1004e51d
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0xb3c], eax
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x38], eax
jle 0x1004e540
mov dword [ebp - 0x368], 1
jmp 0x1004e547
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x370]
cmp dword [ebp - 0x368], eax
jle 0x1004e561
mov dword [ebp - 0x6f0], 1
jmp 0x1004e568
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
sub eax, dword [ebp - 0x38]
jne 0x1004e57f
mov dword [ebp - 0x6f8], 1
jmp 0x1004e586
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x370]
cmp dword [ebp - 0x6f8], eax
jl 0x1004e5a0
mov dword [ebp - 0x378], 1
jmp 0x1004e5a7
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x378], eax
jne 0x1004e5be
mov dword [ebp - 0x700], 1
jmp 0x1004e5c5
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x700]
jge 0x1004e5df
mov dword [ebp - 0x380], 1
jmp 0x1004e5e6
and dword [ebp - 0x380], 0
cmp dword [ebp - 0x380], 0xffffffff
jbe 0x1004e5fb
mov dword [ebp - 0x708], 1
jmp 0x1004e602
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x708]
cmp eax, dword [ebp - 0x8f8]
jne 0x1004e622
mov dword [ebp - 0x900], 1
jmp 0x1004e629
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0xb44], eax
cmp dword [ebp - 0x218], 0xffffffff
ja 0x1004e656
mov dword [ebp - 0x388], 1
jmp 0x1004e65d
and dword [ebp - 0x388], 0
cmp dword [ebp - 0x388], 7
jb 0x1004e67b
cmp dword [ebp - 0x130], 0
je 0x1004e67b
mov dword [ebp - 0x710], 1
jmp 0x1004e682
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 0xef72d4ea
je 0x1004e69a
mov dword [ebp - 0x390], 1
jmp 0x1004e6a1
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x390], eax
jge 0x1004e6bb
mov dword [ebp - 0x718], 1
jmp 0x1004e6c2
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x718]
add eax, 0xc1b1
mov dword [ebp - 0x908], eax
mov dword [ebp - 0x70], 0
jmp 0x1004e6e3
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1004e6ff
push dword [ebp - 0x70]
lea ecx, [ebp - 0x86c]
call fcn.10017262
mov dword [eax], 0x768c0aa3
jmp 0x1004e6dc
push 2
lea ecx, [ebp - 0x890]
call fcn.100171f5
mov byte [ebp - 4], 9
push 1
lea ecx, [ebp - 0xac8]
call fcn.100171f5
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x720], 1
mov dword [ebp - 0x3a8], 0xbb7ab61b
mov dword [ebp - 0x910], 0xe3e7631
push 2
lea ecx, [ebp - 0xc50]
call fcn.100171f5
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x28], 0
jmp 0x1004e760
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1004e779
push dword [ebp - 0x28]
lea ecx, [ebp - 0x890]
call fcn.10017262
or dword [eax], 0xffffffff
jmp 0x1004e759
mov dword [ebp - 0x28], 0
jmp 0x1004e789
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1004e7a5
push dword [ebp - 0x28]
lea ecx, [ebp - 0xac8]
call fcn.10017262
mov dword [eax], 0x13c61c71
jmp 0x1004e782
mov dword [ebp - 0x28], 0
jmp 0x1004e7b5
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1004e7d1
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc50]
call fcn.10017262
mov dword [eax], 0xaa9dade6
jmp 0x1004e7ae
push 0
lea ecx, [ebp - 0xac8]
call fcn.10017262
mov dword [ebp - 0x398], eax
push 0
lea ecx, [ebp - 0x890]
call fcn.10017262
mov ecx, dword [ebp - 0x398]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x398]
mov eax, dword [eax]
mov dword [ebp - 0x720], eax
cmp dword [ebp - 0x720], 4
jg 0x1004e81e
mov dword [ebp - 0x3a0], 1
jmp 0x1004e825
and dword [ebp - 0x3a0], 0
push 0
lea ecx, [ebp - 0x890]
call fcn.10017262
mov esi, dword [ebp - 0x3a0]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x890]
call fcn.10017262
cmp esi, dword [eax]
jg 0x1004e857
mov dword [ebp - 0x728], 1
jmp 0x1004e85e
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x3a8], eax
mov esi, dword [ebp - 0x3a8]
push 0
lea ecx, [ebp - 0x890]
call fcn.10017262
cmp dword [eax], esi
je 0x1004e88d
mov dword [ebp - 0x730], 1
jmp 0x1004e894
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x910], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xc50]
call fcn.1001725d
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xac8]
call fcn.1001725d
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x890]
call fcn.1001725d
mov dword [ebp - 0x70], 0
jmp 0x1004e8dd
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1004e8f9
push dword [ebp - 0x70]
lea ecx, [ebp - 0xa98]
call fcn.10017262
mov dword [eax], 0xd58e7ea
jmp 0x1004e8d6
imul eax, dword [ebp - 0x918], 0xffffffff
mov dword [ebp - 0x3b0], eax
push 2
lea ecx, [ebp - 0x86c]
call fcn.10017262
mov ecx, dword [ebp - 0x3b0]
mov dword [eax], ecx
cmp dword [ebp - 0x3b0], 0
je 0x1004f3b2
mov dword [ebp - 0xa8], 0xb4ffb87
mov dword [ebp - 0x4c], 0x4ab274bf
mov dword [ebp - 0x160], 0
jmp 0x1004e952
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x1004e96e
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x220], 4
jmp 0x1004e945
mov dword [ebp - 0xa8], 0
jmp 0x1004e987
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1004eabc
mov dword [ebp - 0xb4c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x220]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x220]
cmp eax, dword [ebp - 0x4c]
jl 0x1004ea02
mov dword [ebp - 0x738], 0x4f27
mov dword [ebp - 0x4c], 0
jmp 0x1004e9da
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1004e9f0
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x220], 0
jmp 0x1004e9d3
mov eax, dword [ebp - 0x738]
inc eax
mov dword [ebp - 0x738], eax
jmp 0x1004eab7
push 3
lea ecx, [ebp - 0xae0]
call fcn.100171f5
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x1a4], 0
jmp 0x1004ea2c
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jge 0x1004ea4e
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0xae0]
call fcn.10017262
mov dword [eax], 0x62daab72
jmp 0x1004ea1f
push 2
lea ecx, [ebp - 0xae0]
call fcn.10017262
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3b8]
mov dword [ecx], eax
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1004eaa8
push 0x37
push 0
push 0x268d
push 0x22c5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xae0]
call fcn.1001725d
jmp 0x1004e97a
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], eax
jl 0x1004ead6
mov dword [ebp - 0x740], 1
jmp 0x1004eadd
and dword [ebp - 0x740], 0
cmp dword [ebp - 0x4c], 0
je 0x1004eaf5
cmp dword [ebp - 0x4c], 0
je 0x1004eaf5
mov dword [ebp - 0x3c0], 1
jmp 0x1004eafc
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x740]
cmp eax, dword [ebp - 0x3c0]
jge 0x1004eb16
mov dword [ebp - 0x748], 1
jmp 0x1004eb1d
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0xa2], 0
mov dword [ebp - 0xb0], 0x4c506d44
mov dword [ebp - 0x168], 0
jmp 0x1004eb50
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jge 0x1004eb6c
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x884], 0x7fd5
jmp 0x1004eb43
mov dword [ebp - 0xb0], 2
jmp 0x1004eb85
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x1004ed1d
mov dword [ebp - 0x1cc], 0x25f5
mov dword [ebp - 0x3c8], 2
mov dword [ebp - 0x3d8], 0x6b79df94
mov dword [ebp - 0x928], 0x60e77906
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x884]
mov dword [ebp - 0xb54], eax
mov dword [ebp - 0x3c8], 0x4f36
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp + eax*4 - 0x884]
cmp dword [ebp - 0x3c8], eax
jg 0x1004ebf8
mov dword [ebp - 0x750], 1
jmp 0x1004ebff
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x750], eax
jge 0x1004ec19
mov dword [ebp - 0x920], 1
jmp 0x1004ec20
and dword [ebp - 0x920], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x884]
mov dword [ebp - 0xb5c], eax
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x1cc], eax
je 0x1004ec4c
mov dword [ebp - 0x3d0], 1
jmp 0x1004ec53
and dword [ebp - 0x3d0], 0
cmp dword [ebp - 0x3d0], 0xec6e
jg 0x1004ec6b
mov dword [ebp - 0x758], 1
jmp 0x1004ec72
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x3d8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x884]
cmp dword [ebp - 0x3d8], eax
je 0x1004eca4
cmp dword [ebp - 0x1cc], 0
jne 0x1004eca4
and dword [ebp - 0x760], 0
jmp 0x1004ecae
mov dword [ebp - 0x760], 1
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp + eax*4 - 0x884]
cmp eax, dword [ebp - 0x760]
jl 0x1004eccf
mov dword [ebp - 0x3e0], 1
jmp 0x1004ecd6
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x3e0]
sub ecx, dword [ebp + eax*4 - 0x884]
shl ecx, 2
test ecx, ecx
je 0x1004ed05
mov eax, 0xd8fb8cef
test eax, eax
je 0x1004ed05
mov dword [ebp - 0x768], 1
jmp 0x1004ed0c
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x928], eax
jmp 0x1004eb78
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x1004f3ad
mov dword [ebp - 0x1c], 0x90be4438
mov dword [ebp - 0x54], 0xfffffff7
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0xa3c], 0x811fc80a
mov dword [ebp - 0xa38], 0x811fc80a
mov dword [ebp - 0xa34], 0x811fc80a
mov dword [ebp - 0xa30], 0x811fc80a
lea ecx, [ebp - 0x1fd]
call fcn.10008cc3
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0xa3c]
push eax
lea ecx, [ebp - 0xd88]
call fcn.10017271
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x948]
call fcn.10017237
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xb8], 0x87292079
mov dword [ebp - 0x938], 0x7aeb
mov dword [ebp - 0x170], 0
jmp 0x1004edcf
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jge 0x1004edeb
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x1f0], 0xfdc8dfba
jmp 0x1004edc2
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jl 0x1004edff
mov dword [ebp - 0x3e8], 1
jmp 0x1004ee06
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x1c], 0
je 0x1004ee23
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x54]
je 0x1004ee23
mov dword [ebp - 0x770], 1
jmp 0x1004ee2a
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x3e8]
cmp eax, dword [ebp - 0x770]
jg 0x1004ee44
mov dword [ebp - 0x3f0], 1
jmp 0x1004ee4b
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
sub eax, dword [ebp - 0x40]
je 0x1004ee66
xor eax, eax
je 0x1004ee66
mov dword [ebp - 0x778], 1
jmp 0x1004ee6d
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x778], eax
jg 0x1004ee84
mov dword [ebp - 0x3f8], 1
jmp 0x1004ee8b
and dword [ebp - 0x3f8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3f8]
mov dword [ebp + eax - 0x1f0], ecx
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1f0], 1
xor eax, eax
add eax, 0xfffe
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x780], eax
push 2
lea ecx, [ebp - 0x948]
call fcn.10017262
mov ecx, dword [ebp - 0x780]
mov dword [eax], ecx
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x780], eax
jle 0x1004eeeb
mov dword [ebp - 0x400], 1
jmp 0x1004eef2
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x400], eax
jl 0x1004ef09
mov dword [ebp - 0x788], 1
jmp 0x1004ef10
and dword [ebp - 0x788], 0
cmp dword [ebp - 0x788], 0x45bbbdeb
jg 0x1004ef28
mov dword [ebp - 0x408], 1
jmp 0x1004ef2f
and dword [ebp - 0x408], 0
cmp dword [ebp - 0x408], 0x72b9
je 0x1004ef47
mov dword [ebp - 0x790], 1
jmp 0x1004ef4e
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x790]
imul eax, dword [ebp - 0x40]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
je 0x1004f203
mov dword [ebp - 0x264], 0xa6dad3f0
mov dword [ebp - 0xb8], 2
jmp 0x1004ef91
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x1004f1fe
mov dword [ebp - 0x410], 0x239f
mov dword [ebp - 0x228], 0xfffffff6
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1004efda
push 0x36
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
mov dword [ebp - 0x1c], 0
jmp 0x1004efea
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1004f1f9
mov dword [ebp - 0x798], 0xfffd
mov dword [ebp - 0x54], 0
jmp 0x1004f00e
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x1004f153
mov dword [ebp - 0x418], 0x78029323
mov dword [ebp - 0x40], 0
jmp 0x1004f032
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x1004f07c
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1ac], 3
jmp 0x1004f05b
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jl 0x1004f07a
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1f0]
mov dword [ebp + ecx*4 - 0x1f0], eax
jmp 0x1004f04e
jmp 0x1004f02b
cmp dword [ebp - 0x410], 0
jne 0x1004f097
cmp dword [ebp - 0x410], 0
jne 0x1004f097
and dword [ebp - 0x930], 0
jmp 0x1004f0a1
mov dword [ebp - 0x930], 1
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0xb64], eax
cmp dword [ebp - 0x798], 0xf839
jge 0x1004f0c5
mov dword [ebp - 0x7a0], 1
jmp 0x1004f0cc
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x1f0]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x420]
mov dword [ebp + eax*4 - 0x1f0], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
imul eax, dword [ebp - 0x7a0]
cmp dword [ebp - 0x420], eax
je 0x1004f116
mov dword [ebp - 0x7a8], 1
jmp 0x1004f11d
and dword [ebp - 0x7a8], 0
cmp dword [ebp - 0x7a8], 0xffffffff
jne 0x1004f132
mov dword [ebp - 0x428], 1
jmp 0x1004f139
and dword [ebp - 0x428], 0
push 0
lea ecx, [ebp - 0x948]
call fcn.10017262
mov ecx, dword [ebp - 0x428]
mov dword [eax], ecx
jmp 0x1004f007
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x264], eax
jge 0x1004f16d
mov dword [ebp - 0x7b0], 1
jmp 0x1004f174
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x7b0], eax
je 0x1004f18e
mov dword [ebp - 0x430], 1
jmp 0x1004f195
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp + eax*4 - 0x1f0]
cmp eax, dword [ebp - 0x430]
je 0x1004f1b6
mov dword [ebp - 0x7b8], 1
jmp 0x1004f1bd
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x7b8], eax
jne 0x1004f1d7
mov dword [ebp - 0x438], 1
jmp 0x1004f1de
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x228]
imul eax, dword [ebp - 0x438]
imul eax, eax, 0
mov dword [ebp - 0x228], eax
jmp 0x1004efe3
jmp 0x1004ef84
jmp 0x1004f396
mov dword [ebp - 0xc0], 0xb5bc
mov dword [ebp - 0x440], 0x6abe926f
mov dword [ebp - 0x1c], 0
jmp 0x1004f227
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1004f35b
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1f0]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1f0]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1f0]
sub eax, 0x2446
imul eax, eax, 0
cmp eax, dword [ebp - 0x440]
je 0x1004f283
mov dword [ebp - 0x7c0], 1
jmp 0x1004f28a
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x7c0], eax
jle 0x1004f2a1
mov dword [ebp - 0x7c8], 1
jmp 0x1004f2a8
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x440]
cmp dword [ebp - 0x7c8], eax
je 0x1004f2c2
mov dword [ebp - 0x7d0], 1
jmp 0x1004f2c9
and dword [ebp - 0x7d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f0]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x448], eax
push 2
lea ecx, [ebp - 0x948]
call fcn.10017262
mov ecx, dword [ebp - 0x448]
mov dword [eax], ecx
mov eax, dword [ebp - 0x448]
cmp eax, dword [ebp - 0x7d0]
je 0x1004f317
mov dword [ebp - 0x450], 1
jmp 0x1004f31e
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x1f0]
cmp eax, dword [ebp - 0x450]
jle 0x1004f33c
mov dword [ebp - 0x7d8], 1
jmp 0x1004f343
and dword [ebp - 0x7d8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x7d8]
mov dword [ebp + eax - 0x1f0], ecx
jmp 0x1004f220
mov dword [ebp - 0xc0], 0
jmp 0x1004f374
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 4
jge 0x1004f396
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x948]
call fcn.10017262
mov dword [eax], 0xffc8ecea
jmp 0x1004f367
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x948]
call fcn.1001725d
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
jmp 0x1004f90d
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x490], 0xffffffff
mov dword [ebp - 0x498], 0x7f51ef99
mov dword [ebp - 0x9c], 0x8d40
mov dword [ebp - 0xa64], 1
mov dword [ebp - 0xa60], 1
mov dword [ebp - 0xa5c], 1
mov dword [ebp - 0xa58], 1
lea ecx, [ebp - 0x205]
call fcn.10008cc3
push eax
lea eax, [ebp - 0xa54]
push eax
lea eax, [ebp - 0xa64]
push eax
lea ecx, [ebp - 0xd98]
call fcn.10017271
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc60]
call fcn.10017237
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], eax
jne 0x1004f46a
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1004f465
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x1004f747
push 1
lea ecx, [ebp - 0x2bc]
call fcn.100171f5
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x178], 0
jmp 0x1004f494
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x1004f4b3
push dword [ebp - 0x178]
lea ecx, [ebp - 0x2bc]
call fcn.10017262
and dword [eax], 0
jmp 0x1004f487
mov dword [ebp - 0x9c], 0
jmp 0x1004f4cc
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x32
jle 0x1004f738
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x48], 0
jmp 0x1004f4f0
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x1004f733
mov dword [ebp - 0x110], 0xffffffff
mov dword [ebp - 0x110], 0
jmp 0x1004f51d
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jg 0x1004f617
mov dword [ebp - 0x458], 0xfffffffb
mov dword [ebp - 0x7e0], 0x21e0bec0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x7e0], eax
mov esi, dword [ebp - 0x7e0]
push 0
lea ecx, [ebp - 0x2bc]
call fcn.10017262
mov eax, dword [eax]
sub eax, esi
cmp eax, 0x3c225155
jg 0x1004f580
mov dword [ebp - 0x460], 1
jmp 0x1004f587
and dword [ebp - 0x460], 0
cmp dword [ebp - 0x460], 0
jl 0x1004f59c
mov dword [ebp - 0x8a8], 1
jmp 0x1004f5a3
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xb84], eax
mov eax, 0xbf0cf865
test eax, eax
jne 0x1004f5c7
cmp dword [ebp - 0x9c], 0
jne 0x1004f5c7
and dword [ebp - 0x7e8], 0
jmp 0x1004f5d1
mov dword [ebp - 0x7e8], 1
push dword [ebp - 0x48]
lea ecx, [ebp - 0x2bc]
call fcn.10017262
mov eax, dword [eax]
cmp eax, dword [ebp - 0x7e8]
je 0x1004f5f5
mov dword [ebp - 0x468], 1
jmp 0x1004f5fc
and dword [ebp - 0x468], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x2bc]
call fcn.10017262
mov ecx, dword [ebp - 0x468]
mov dword [eax], ecx
jmp 0x1004f510
mov eax, 0xf35dd758
test eax, eax
je 0x1004f633
push dword [ebp - 0x48]
lea ecx, [ebp - 0x2bc]
call fcn.10017262
cmp dword [eax], 0
jne 0x1004f645
mov eax, 0xd7d2
test eax, eax
jne 0x1004f645
and dword [ebp - 0x47c], 0
jmp 0x1004f64f
mov dword [ebp - 0x47c], 1
cmp dword [ebp - 0x110], 0x956a
jle 0x1004f667
mov dword [ebp - 0x7f0], 1
jmp 0x1004f66e
and dword [ebp - 0x7f0], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x2bc]
call fcn.10017262
mov ecx, dword [ebp - 0x7f0]
inc ecx
cmp dword [eax], ecx
jg 0x1004f693
mov dword [ebp - 0x7f8], 1
jmp 0x1004f69a
and dword [ebp - 0x7f8], 0
push 0
lea ecx, [ebp - 0x2bc]
call fcn.10017262
mov ecx, dword [ebp - 0x7f8]
cmp ecx, dword [eax]
je 0x1004f6bd
mov dword [ebp - 0x478], 1
jmp 0x1004f6c4
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x47c]
add eax, dword [ebp - 0x478]
cmp eax, 0x5224
jge 0x1004f6e3
mov dword [ebp - 0x670], 1
jmp 0x1004f6ea
and dword [ebp - 0x670], 0
cmp dword [ebp - 0x670], 4
ja 0x1004f711
push 1
lea ecx, [ebp - 0xc60]
call fcn.10017262
cmp dword [eax], 0
je 0x1004f711
mov dword [ebp - 0x480], 1
jmp 0x1004f718
and dword [ebp - 0x480], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x2bc]
call fcn.10017262
mov ecx, dword [ebp - 0x480]
mov dword [eax], ecx
jmp 0x1004f4e9
jmp 0x1004f4bf
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2bc]
call fcn.1001725d
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xc60]
call fcn.1001725d
push 1
lea ecx, [ebp - 0x86c]
call fcn.10017262
mov dword [ebp - 0x75c], eax
push 1
lea ecx, [ebp - 0x86c]
call fcn.10017262
mov ecx, dword [ebp - 0x75c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x75c]
mov eax, dword [eax]
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
je 0x1004f8a0
push 2
lea ecx, [ebp - 0x86c]
call fcn.10017262
cmp dword [eax], 7
je 0x1004f7c5
mov dword [ebp - 0x674], 1
jmp 0x1004f7cc
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x1c4], eax
je 0x1004f7f2
mov dword [ebp - 0x7d4], 1
jmp 0x1004f7f9
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0
jne 0x1004f829
push 1
lea ecx, [ebp - 0x86c]
call fcn.10017262
cmp dword [eax], 0
jne 0x1004f829
and dword [ebp - 0x67c], 0
jmp 0x1004f833
mov dword [ebp - 0x67c], 1
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x67c], eax
jl 0x1004f84d
mov dword [ebp - 0x4a0], 1
jmp 0x1004f854
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x1c4]
imul eax, dword [ebp - 0x4a0]
add eax, 0x4edb
imul eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x1c4]
jg 0x1004f881
mov dword [ebp - 0x764], 1
jmp 0x1004f888
and dword [ebp - 0x764], 0
cmp dword [ebp - 0x764], 0xdaa237f4
jne 0x1004f8a0
mov dword [ebp - 0x4a8], 1
jmp 0x1004f8a7
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x4a8]
dec eax
cmp eax, 0x1a094951
jne 0x1004f8ca
cmp dword [ebp - 0x180], 0
je 0x1004f8ca
mov dword [ebp - 0x684], 1
jmp 0x1004f8d1
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x8ac], eax
push 0
lea ecx, [ebp - 0xa98]
call fcn.10017262
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp - 0x82c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x82c]
mov dword [ecx], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa98]
call fcn.1001725d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x86c]
call fcn.1001725d
push 1
lea eax, [ebp - 0xdd4]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.1004cff2
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0xd78]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0xd78]
lea edi, [ebp - 0x9e4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1b4], 0x8d4081c2
mov dword [ebp - 0xb8c], 0xe7e55059
mov dword [ebp - 0xb94], 0x34215e1a
push 1
lea ecx, [ebp - 0xc80]
call fcn.100171f5
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xb9c], 0xfffffffa
mov dword [ebp - 0xba4], 0xa2e42846
mov dword [ebp - 0x90], 0
jmp 0x1004f9b9
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1004f9d5
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xda8], 0x713b
jmp 0x1004f9ac
mov dword [ebp - 0x90], 0
jmp 0x1004f9ee
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x1004fa10
push dword [ebp - 0x90]
lea ecx, [ebp - 0xc80]
call fcn.10017262
mov dword [eax], 0x9d4346
jmp 0x1004f9e1
mov dword [ebp - 0x1b4], 0
jmp 0x1004fa29
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 1
jg 0x1004fb5a
mov dword [ebp - 0xbac], 0xffffffff
mov dword [ebp - 0xbb4], 0xfffffffd
mov dword [ebp - 0xbbc], 0xfffffffe
mov dword [ebp - 0xbc4], 0xe1b1b552
mov dword [ebp - 0xbcc], 0xe033c225
mov dword [ebp - 0xbd4], str.zE_tE
mov dword [ebp - 0xbdc], 0xec0351a9
mov dword [ebp - 0xbe4], 0x7359b504
mov dword [ebp - 0xbec], 0x4cbed562
mov dword [ebp - 0xbf8], 0xbb75da2c
mov dword [ebp - 0xc00], 0xfffffffe
mov dword [ebp - 0xc08], 1
mov dword [ebp - 0xc10], 0xffffffff
mov dword [ebp - 0xc18], 0xd021aa29
mov dword [ebp - 0xc20], 0xfc353271
push 1
lea ecx, [ebp - 0xc70]
call fcn.100171f5
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x4b8], 0xfff6
mov dword [ebp - 0x78], 0
jmp 0x1004faf7
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x1004fb0d
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xdc8], 0x7e9f
jmp 0x1004faf0
mov dword [ebp - 0x78], 0
jmp 0x1004fb1d
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1004fb39
push dword [ebp - 0x78]
lea ecx, [ebp - 0xc70]
call fcn.10017262
mov dword [eax], 8
jmp 0x1004fb16
mov eax, dword [ebp - 0x4b8]
inc eax
mov dword [ebp - 0x4b8], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xc70]
call fcn.1001725d
jmp 0x1004fa1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc80]
call fcn.1001725d
mov dword [ebp - 0xc28], 0x7862fd41
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x1004fb94
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1004fbb3
push 0x1b59
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x188], 0
jmp 0x1004fbd6
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 1
jge 0x1004fbf2
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x128], 1
jmp 0x1004fbc9
mov dword [ebp - 0x1d4], 0
jmp 0x1004fc0b
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jl 0x1004fdf5
mov dword [ebp - 0x2c], 0xa0029bf3
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1004fc39
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [ebp - 0x2c], 0
jmp 0x1004fc49
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x1004fdf0
mov dword [ebp - 0x974], 0
mov dword [ebp - 0x190], 0
jmp 0x1004fc76
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jge 0x1004fc92
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0xa14], 0
jmp 0x1004fc69
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xa14], 0
jmp 0x1004fcc0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa14]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa14], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa14], 0
jg 0x1004fdeb
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0xc30], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x128], 0
jne 0x1004fd00
mov dword [ebp - 0x68c], 1
jmp 0x1004fd07
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x68c], eax
jl 0x1004fd1e
mov dword [ebp - 0x4c0], 1
jmp 0x1004fd25
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
dec eax
cmp eax, 0x7643
je 0x1004fd3f
mov dword [ebp - 0x76c], 1
jmp 0x1004fd46
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x76c]
sub ecx, dword [ebp + eax*4 - 0x128]
jne 0x1004fd63
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x128], 0
mov eax, 0x811fc80
test eax, eax
je 0x1004fd7e
cmp dword [ebp - 0x2c], 0
je 0x1004fd7e
mov dword [ebp - 0x4c8], 1
jmp 0x1004fd85
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x128]
sub eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0x2c]
jle 0x1004fda6
mov dword [ebp - 0x694], 1
jmp 0x1004fdad
and dword [ebp - 0x694], 0
cmp dword [ebp - 0x694], 0x1af9
jl 0x1004fdbd
cmp dword [ebp - 0x2c], 0
push 0xfffffffffffffff7
pop eax
cmp eax, 0x9338886a
je 0x1004fdd3
mov dword [ebp - 0x4d0], 1
jmp 0x1004fdda
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x974], eax
jmp 0x1004fca5
jmp 0x1004fc42
jmp 0x1004fbfe
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1004fe13
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x8b4], 0xffffffff
mov dword [ebp - 0x230], 0x5cbf7935
mov dword [ebp - 0x198], 0
jmp 0x1004fe47
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 4
jge 0x1004fe63
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0xd10], 0x94d0e834
jmp 0x1004fe3a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xd3c], eax
cmp dword [ebp - 0x10], 0
je 0x1004ff45
cmp dword [ebp - 0x10], 0
jne 0x1004ff21
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xd44], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xd4c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xd30], eax
cmp dword [ebp - 0x10], 0x6b71
jg 0x1004feb0
mov dword [ebp - 0x7dc], 1
jmp 0x1004feb7
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x7dc]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x8b4], eax
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
jle 0x1004fee2
mov dword [ebp - 0x99c], 1
jmp 0x1004fee9
and dword [ebp - 0x99c], 0
cmp dword [ebp - 0x10], 0x8886
jge 0x1004ff04
cmp dword [ebp - 0x10], 0
je 0x1004ff04
mov dword [ebp - 0x4d8], 1
jmp 0x1004ff0b
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
sub eax, 0x68729207
jne 0x1004ff21
and dword [ebp - 0x8bc], 0
jmp 0x1004ff2b
mov dword [ebp - 0x8bc], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xd40], eax
xor eax, eax
inc eax
je 0x1004ff45
mov dword [ebp - 0x69c], 1
jmp 0x1004ff4c
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x69c]
add eax, ecx
je 0x1004ff77
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xd10], 0
je 0x1004ff77
mov dword [ebp - 0x4e0], 1
jmp 0x1004ff7e
and dword [ebp - 0x4e0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd10]
cmp dword [ebp - 0x4e0], eax
je 0x1004ff9f
mov dword [ebp - 0x25c], 1
jmp 0x1004ffa6
and dword [ebp - 0x25c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x25c]
mov dword [ebp + eax - 0xd10], ecx
mov eax, dword [ebp - 0x25c]
add eax, 5
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x10], 8
jmp 0x1004ffd8
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2f
jge 0x1005009c
mov dword [ebp - 0x148], 0xc8c6dcff
mov dword [ebp - 0x97c], 0xd8a0f839
cmp dword [ebp - 0x148], 0xd6b22149
jae 0x1005000e
mov dword [ebp - 0x4e8], 1
jmp 0x10050015
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x148], 0xfffffffc
jge 0x1005002a
mov dword [ebp - 0x774], 1
jmp 0x10050031
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
add eax, 0xd700
cmp eax, dword [ebp - 0x774]
jle 0x1005005c
mov dword [ebp - 0x6a4], 1
jmp 0x10050063
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x4e8]
imul eax, dword [ebp - 0x6a4]
cmp eax, dword [ebp - 0x148]
jg 0x10050084
mov dword [ebp - 0x4f0], 1
jmp 0x1005008b
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x97c], eax
jmp 0x1004ffd1
mov dword [ebp - 0x92c], 0
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x518], 0xffffffff
mov dword [ebp - 0x9bc], 8
mov dword [ebp - 0x26c], 0x25d36729
mov dword [ebp - 0x14c], 0
jmp 0x100500f1
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jge 0x1005010d
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0xbf4], 1
jmp 0x100500e4
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x10050129
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x114], 0xfffffffa
jmp 0x10050142
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xfffffff2
jg 0x100502c2
mov dword [ebp - 0x8cc], 0
mov dword [ebp - 0x4f8], 0xc12265e3
mov dword [ebp - 0x508], 0
mov dword [ebp - 0xd14], 0xe0980db9
mov dword [ebp - 0x6b4], 0xd1022782
mov dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0xca4], eax
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x814]
add eax, dword [ebp - 0x6b4]
je 0x100501c6
cmp dword [ebp - 0x4f8], 0
je 0x100501c6
mov dword [ebp - 0x6ac], 1
jmp 0x100501cd
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x6ac], eax
jg 0x100501f0
mov eax, 0xe1ee67b3
test eax, eax
je 0x100501f0
mov dword [ebp - 0x500], 1
jmp 0x100501f7
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x9bc]
cmp dword [ebp - 0x500], eax
jne 0x10050211
mov dword [ebp - 0x77c], 1
jmp 0x10050218
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x26c]
dec eax
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x508]
cmp dword [ebp - 0x26c], eax
jne 0x10050248
mov eax, 0xa619
test eax, eax
je 0x10050266
cmp dword [ebp - 0x6b4], 0
je 0x10050266
mov eax, 0x4102
test eax, eax
je 0x10050266
mov dword [ebp - 0x510], 1
jmp 0x1005026d
and dword [ebp - 0x510], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x510]
mov dword [ebp + eax - 0xbf4], ecx
mov eax, 0x725fc1c
sub eax, 0xecbfcf41
cmp eax, dword [ebp - 0x518]
jne 0x1005029e
mov dword [ebp - 0x7e4], 1
jmp 0x100502a5
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x8cc]
add eax, dword [ebp - 0x7e4]
imul eax, eax, 0xfff9
mov dword [ebp - 0x518], eax
jmp 0x10050135
push 3
lea ecx, [ebp - 0x854]
call fcn.100171f5
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x154], 0
jmp 0x10050314
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x10050330
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x294], 0x204e2db5
jmp 0x10050307
mov dword [ebp - 0x20], 0
jmp 0x10050340
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x10050454
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x294], 0
je 0x1005035c
jmp 0x10050454
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp + ecx*4 - 0x294]
cmp dword [ebp + eax*4 - 0x294], ecx
jge 0x1005037e
mov dword [ebp - 0x520], 1
jmp 0x10050385
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x294], 1
jne 0x100503a4
cmp dword [ebp - 0x20], 0
je 0x100503a4
mov dword [ebp - 0x6bc], 1
jmp 0x100503ab
and dword [ebp - 0x6bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x294]
cmp dword [ebp - 0x6bc], eax
jle 0x100503cc
mov dword [ebp - 0x784], 1
jmp 0x100503d3
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
sub eax, dword [ebp - 0x784]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x294]
cmp dword [ebp - 0x20], eax
jne 0x1005040c
mov dword [ebp - 0x528], 1
jmp 0x10050413
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp + ecx*4 - 0x294]
imul ecx, dword [ebp - 0x528]
cmp dword [ebp + eax*4 - 0x294], ecx
jge 0x1005043c
mov dword [ebp - 0x6c4], 1
jmp 0x10050443
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0x238], eax
jmp 0x10050339
mov dword [ebp - 0x11c], 0xf32b5620
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0x11c], eax
jge 0x10050478
mov dword [ebp - 0x530], 1
jmp 0x1005047f
and dword [ebp - 0x530], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x294]
cmp dword [ebp - 0x530], eax
jl 0x100504a0
mov dword [ebp - 0x83c], 1
jmp 0x100504a7
and dword [ebp - 0x83c], 0
cmp dword [ebp - 0x83c], 0xffffffff
jae 0x100504bc
mov dword [ebp - 0x538], 1
jmp 0x100504c3
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x538]
cmp dword [ebp - 0x238], eax
jne 0x100504e0
mov dword [ebp - 0x6cc], 1
jmp 0x100504e7
and dword [ebp - 0x6cc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x294]
cmp dword [ebp - 0x6cc], eax
jge 0x10050508
mov dword [ebp - 0x540], 1
jmp 0x1005050f
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x540]
je 0x10050526
mov dword [ebp - 0x78c], 1
jmp 0x1005052d
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x78c], eax
jne 0x10050559
cmp dword [ebp - 0x11c], 0
je 0x10050559
mov eax, 0x60b25631
test eax, eax
je 0x10050559
mov dword [ebp - 0x548], 1
jmp 0x10050560
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x250]
imul eax, dword [ebp - 0x548]
cmp eax, 0x6b719d87
je 0x10050580
mov dword [ebp - 0x6d4], 1
jmp 0x10050587
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x36c], 9
mov dword [ebp - 0x1c0], 0xafa9b64f
push 4
lea ecx, [ebp - 0xa08]
call fcn.100171f5
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x124], 0xdba76aab
mov dword [ebp - 0x8d4], 0x6fda0246
mov dword [ebp - 0x15c], 0
jmp 0x100505e2
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 4
jge 0x10050604
push dword [ebp - 0x15c]
lea ecx, [ebp - 0xa08]
call fcn.10017262
mov dword [eax], 1
jmp 0x100505d5
mov dword [ebp - 0x124], 0
jmp 0x1005061d
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 3
jg 0x100507ad
mov dword [ebp - 0x984], 0x7f2fb5a5
push 3
lea ecx, [ebp - 0xb10]
call fcn.100171f5
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x164], 0
jmp 0x1005065e
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x10050680
push dword [ebp - 0x164]
lea ecx, [ebp - 0xb10]
call fcn.10017262
mov dword [eax], 0x13a3dbc5
jmp 0x10050651
cmp dword [ebp - 0x124], 0xaa0a
jl 0x10050698
mov dword [ebp - 0x550], 1
jmp 0x1005069f
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0xfffffff6
jge 0x100506c6
push 0
lea ecx, [ebp - 0xa08]
call fcn.10017262
cmp dword [eax], 0
je 0x100506c6
mov dword [ebp - 0x7ec], 1
jmp 0x100506cd
and dword [ebp - 0x7ec], 0
cmp dword [ebp - 0x7ec], 6
jl 0x100506e2
mov dword [ebp - 0x558], 1
jmp 0x100506e9
and dword [ebp - 0x558], 0
push 3
lea ecx, [ebp - 0xa08]
call fcn.10017262
mov eax, dword [eax]
cmp eax, dword [ebp - 0x558]
jne 0x1005070c
mov dword [ebp - 0x240], 1
jmp 0x10050713
and dword [ebp - 0x240], 0
push 2
lea ecx, [ebp - 0xb10]
call fcn.10017262
mov ecx, dword [ebp - 0x240]
mov dword [eax], ecx
cmp dword [ebp - 0x240], 0x6525
je 0x10050740
mov dword [ebp - 0x6dc], 1
jmp 0x10050747
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x984]
cmp eax, dword [ebp - 0x6dc]
jge 0x10050761
mov dword [ebp - 0x560], 1
jmp 0x10050768
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x8d4], eax
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x10050799
push 0
push 0
push 0x69a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xb10]
call fcn.1001725d
jmp 0x10050610
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa08]
call fcn.1001725d
push 2
lea ecx, [ebp - 0xb04]
call fcn.100171f5
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x30], 0x6b6eb6b9
mov dword [ebp - 0x578], 0xadd5d088
mov dword [ebp - 0x570], 1
mov dword [ebp - 0x580], 0
mov dword [ebp - 0x8dc], 1
mov dword [ebp - 0xb20], 0x624b
mov dword [ebp - 0x16c], 0
jmp 0x1005081f
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jge 0x10050841
push dword [ebp - 0x16c]
lea ecx, [ebp - 0xb04]
call fcn.10017262
mov dword [eax], 0x69f7
jmp 0x10050812
cmp dword [ebp - 0x30], 0x3a34c865
je 0x100508fd
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
lea eax, [eax + ecx + 1]
cmp eax, dword [ebp - 0x30]
jle 0x10050869
mov dword [ebp - 0x794], 1
jmp 0x10050870
and dword [ebp - 0x794], 0
imul eax, dword [ebp - 0x794], 0xff60
test eax, eax
jne 0x1005088d
cmp dword [ebp - 0x30], 0
jne 0x1005088d
and dword [ebp - 0x568], 0
jmp 0x10050897
mov dword [ebp - 0x568], 1
cmp dword [ebp - 0x568], 0xfffffff6
je 0x100508ac
mov dword [ebp - 0x6e4], 1
jmp 0x100508b3
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x6e4], eax
je 0x100508ca
mov dword [ebp - 0x9a4], 1
jmp 0x100508d1
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xb28], eax
mov eax, dword [ebp - 0x578]
sub eax, 9
mov dword [ebp - 0x570], eax
jne 0x100508fd
and dword [ebp - 0x81c], 0
jmp 0x10050907
mov dword [ebp - 0x81c], 1
mov eax, dword [ebp - 0x81c]
sub eax, dword [ebp - 0x578]
cmp eax, 0xde81
jg 0x10050926
mov dword [ebp - 0x6ec], 1
jmp 0x1005092d
and dword [ebp - 0x6ec], 0
push 0
lea ecx, [ebp - 0xb04]
call fcn.10017262
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x24c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x24c]
mov eax, dword [eax]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x580]
jle 0x10050980
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10050980
and dword [ebp - 0x79c], 0
jmp 0x1005098a
mov dword [ebp - 0x79c], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x79c], eax
jne 0x100509a1
mov dword [ebp - 0x588], 1
jmp 0x100509a8
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x8dc], eax
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x100509e0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xb04]
call fcn.1001725d
mov dword [ebp - 0x3bc], 1
mov dword [ebp - 0x104], 0x5ab3e90a
push 4
lea ecx, [ebp - 0x9fc]
call fcn.100171f5
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x8e4], 0xfffffff6
mov dword [ebp - 0x8ec], 1
mov dword [ebp - 0xcb4], 0xfffffffb
mov dword [ebp - 0x58], 0
jmp 0x10050a42
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x10050a5b
push dword [ebp - 0x58]
lea ecx, [ebp - 0x9fc]
call fcn.10017262
or dword [eax], 0xffffffff
jmp 0x10050a3b
mov dword [ebp - 0x58], 0
jmp 0x10050a6b
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x10050a81
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x2a4], 0xa32f3f60
jmp 0x10050a64
cmp dword [ebp - 0x104], 0
jne 0x10050b33
cmp dword [ebp - 0x104], 0
jne 0x10050aa9
cmp dword [ebp - 0x104], 0
jne 0x10050aa9
and dword [ebp - 0x6f4], 0
jmp 0x10050ab3
mov dword [ebp - 0x6f4], 1
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x590], eax
push 3
lea ecx, [ebp - 0x9fc]
call fcn.10017262
mov ecx, dword [ebp - 0x590]
mov dword [eax], ecx
imul eax, dword [ebp - 0x6f4], 0xffff
cmp dword [ebp - 0x590], eax
jg 0x10050afe
mov dword [ebp - 0x7f4], 1
jmp 0x10050b05
and dword [ebp - 0x7f4], 0
cmp dword [ebp - 0x7f4], 0
je 0x10050b1a
mov dword [ebp - 0x98c], 1
jmp 0x10050b21
and dword [ebp - 0x98c], 0
cmp dword [ebp - 0x104], 0
jne 0x10050b33
and dword [ebp - 0x598], 0
jmp 0x10050b3d
mov dword [ebp - 0x598], 1
mov eax, dword [ebp - 0x8e4]
cmp dword [ebp - 0x598], eax
jge 0x10050b57
mov dword [ebp - 0x6fc], 1
jmp 0x10050b5e
and dword [ebp - 0x6fc], 0
imul eax, dword [ebp - 0x6fc], 0
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2a4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2a4], 1
jne 0x10050b8e
mov dword [ebp - 0x5a0], 1
jmp 0x10050b95
and dword [ebp - 0x5a0], 0
push 3
pop eax
sub eax, dword [ebp - 0x5a0]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2a4]
je 0x10050bb9
mov dword [ebp - 0x7a4], 1
jmp 0x10050bc0
and dword [ebp - 0x7a4], 0
push 3
lea ecx, [ebp - 0x9fc]
call fcn.10017262
and dword [eax], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a4]
add eax, dword [ebp - 0x7a4]
test eax, eax
jg 0x10050bf3
mov dword [ebp - 0x9b4], 1
jmp 0x10050bfa
and dword [ebp - 0x9b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a4]
mov dword [ebp - 0xc0c], eax
cmp dword [ebp - 0x8ec], 0x3b83
jg 0x10050c25
mov dword [ebp - 0x5a8], 1
jmp 0x10050c2c
and dword [ebp - 0x5a8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5a8]
mov dword [ebp + eax - 0x2a4], ecx
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x9fc]
call fcn.1001725d
mov dword [ebp - 0x94c], 0x5243b9c
mov dword [ebp - 0xc8], 0x1897a4a
mov dword [ebp - 0xb38], 0x312b9482
mov dword [ebp - 0x60], 0
jmp 0x10050c7c
cmp dword [ebp - 0x60], 3
jge 0x10050c92