Function at 0x401fdf
Capabilities:
Check for time delay via gettickcount
Delete file
Encrypt data using speck
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x346c
push edi
lea edi, [ebp - 0x346c]
push 1
call dword [ebx + 0x44]
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0xe
je 0x402008
call dword [ebx + 0x3c]
cmp eax, 1
jne 0x405693
mov dword [edi], 0
mov ecx, dword [ebx + 0x15c]
add ecx, dword [ebx + 0x74]
lea eax, [ecx + 0x108]
mov ecx, dword [ecx]
cmp ecx, 3
jne 0x402185
push eax
push edi
call fcn.00405c02
cmp eax, 1
jne 0x40203c
mov dword [edi], 0x406003
jmp 0x40206d
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x5a494c41
push 0x4954494e
push 0x495f4f54
push 0x5f44454c
push 0x49414624
push esp
call dword [ebx + 0x30]
add esp, 0x24
cmp dword [edi], 0
je 0x402183
push 0xa
push 0xd732520
push 0x5d24454d
push 0x414e5f52
push 0x45545041
push 0x4441245b
mov ecx, dword [ebx + 0x15c]
add ecx, dword [ebx + 0x74]
lea edx, [ecx + 4]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x33b0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x33b0]
push edx
call dword [ebx + 0x30]
add esp, 0x18
lea edx, [edi + 0x38]
push edx
push 0
call dword [edi + 4]
cmp eax, 0
jne 0x402183
lea edx, [ebp - 0x320c]
push edx
lea edx, [ebp - 0x325c]
push edx
lea edx, [ebp - 0x32ac]
push edx
push dword [edi + 0x38]
call dword [edi + 0x30]
cmp eax, 0
jne 0x402183
push 0xa
push 0xd732520
push 0x5d244552
push 0x41574d52
push 0x49465f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x32ac]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x33b0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x33b0]
push edx
call dword [ebx + 0x30]
add esp, 0x1c
push 0
push 0xa0d7325
push 0x205d244c
push 0x4c445f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x325c]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x33b0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x33b0]
push edx
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x4021c5
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x48545f59
push 0x425f4445
push 0x54524f50
push 0x5055535f
push 0x544f4e5f
push 0x53495f4c
push 0x4f434f54
push 0x4f525024
push esp
call dword [ebx + 0x30]
add esp, 0x30
cmp dword [edi], 0
je 0x405693
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
lea edx, [ecx + 2]
push edx
push eax
lea edx, [ebp - 0x31bc]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov dword [ebp - 0x2fc0], 0
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov byte [esi + 0x6c], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x402221
cmp eax, 0xb
jne 0x402331
mov byte [ebp - 0x702], 0x29
mov byte [ebp - 0x701], 2
push 0xfa
lea edx, [ebp - 0x30c2]
push edx
push 2
lea edx, [ebp - 0x702]
push edx
call dword [ebx + 0x40]
cmp eax, 8
je 0x40229e
push 0xa0d31
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x45242024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x30
mov dword [ebp - 0x2fc0], 1
jmp 0x402331
push 0x6d6f
push 0x632e7572
push 0x2e636d6d
mov dword [ebp - 0x6f6], esp
push 0
push 0x7068702e
push 0x74736574
push 0x5f6e6163
push 0x5f353063
push 0x37316364
push 0x655f6472
push 0x6f662f74
push 0x7365742f
lea edx, [ebp - 0x6fe]
push edx
lea edx, [ebp - 0x30c2]
push edx
lea edx, [esp + 8]
push edx
push dword [ebp - 0x6f6]
call fcn.00406b52
mov dword [ebp - 0x2fc0], eax
add esp, 0x24
add esp, 0xc
test eax, eax
jne 0x402331
mov byte [ebp - 0x700], 0x2a
mov byte [ebp - 0x6ff], 0xa
push 0xfa
lea edx, [ebp - 0x30c2]
push edx
push 0xa
lea edx, [ebp - 0x700]
push edx
call dword [ebx + 0x40]
mov dword [ebp - 0x2fc0], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
jne 0x402358
push 0x7e8
push 0x7e0
call dword [ebx + 0x54]
jmp 0x40568b
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x1a
jne 0x40237c
push 0x7e8
push 0x7e0
call dword [ebx + 0x64]
push esi
push ebx
call fcn.004015b0
jmp 0x40568b
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x4023ab
mov dword [ebx + 0xe94], 0xffffffff
push 0x7e8
push 0x7e0
call dword [ebx + 0x54]
cmp dword [ebx + 0xe94], 0xffffffff
jne 0x40568b
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x4023d4
mov dword [ebp - 0xf7a], 0x401050
mov dword [ebp - 0xf76], 0x50
mov dword [ebp - 0xf72], 0x50
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x4023fd
mov dword [ebp - 0xf7a], 0x4010a0
mov dword [ebp - 0xf76], 0xa0
mov dword [ebp - 0xf72], 0x50
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x40240d
cmp eax, 0xb
jne 0x40243f
mov dword [ebp - 0x71e], 1
mov dword [ebp - 0x706], 0xc0002000
mov dword [ebp - 0xf86], 0x401000
mov dword [ebp - 0xf82], 0
mov dword [ebp - 0xf7e], 0x50
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x402453
cmp eax, 0xb
jne 0x402699
cmp dword [ebp - 0x2fc0], 0
jne 0x402699
push 0x320
push 0
lea edx, [ebp - 0xc2a]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov byte [ebp - 0x90a], 0x21
mov dword [ebp - 0xf8e], 0
mov ecx, dword [ebp - 0xf8e]
cmp ecx, dword [ebp - 0xf7e]
jae 0x402576
mov eax, dword [ebp - 0xf82]
lea eax, [eax + ecx]
mov dword [ebp - 0x908], eax
mov edx, dword [ebp - 0xf7e]
sub edx, ecx
xor ecx, ecx
cmp ecx, edx
jae 0x4024d8
cmp ecx, 0xf0
jae 0x4024d8
mov eax, dword [ebp - 0xf86]
add eax, dword [ebp - 0xf8e]
mov al, byte [eax + ecx]
mov byte [ebp + ecx - 0x904], al
inc ecx
jmp 0x4024b3
mov dword [ebp - 0xf8a], ecx
add ecx, 4
mov byte [ebp - 0x909], cl
push 0xfa
lea edx, [ebp - 0x30c2]
push edx
push 0xf6
lea edx, [ebp - 0x90a]
push edx
call dword [ebx + 0x40]
test eax, eax
jne 0x402546
push 0xa0d
push 0x31232024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x24
mov dword [ebp - 0x2fc0], 1
jmp 0x402576
mov eax, dword [ebp - 0xf8a]
mov ecx, dword [ebp - 0xf8e]
add dword [ebp - 0xf8e], eax
push eax
lea edx, [ebp - 0x30c2]
push edx
lea edx, [ebp + ecx - 0xc2a]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
jmp 0x402488
cmp dword [ebp - 0x2fc0], 0
jne 0x402699
push 0x320
push 0
lea edx, [ebp - 0xf4a]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov byte [ebp - 0x90a], 0x21
mov dword [ebp - 0xf8e], 0
mov ecx, dword [ebp - 0xf8e]
cmp ecx, dword [ebp - 0xf72]
jae 0x402699
mov eax, dword [ebp - 0xf76]
lea eax, [eax + ecx]
mov dword [ebp - 0x908], eax
mov edx, dword [ebp - 0xf72]
sub edx, ecx
xor ecx, ecx
cmp ecx, edx
jae 0x4025fb
cmp ecx, 0xf0
jae 0x4025fb
mov eax, dword [ebp - 0xf7a]
add eax, dword [ebp - 0xf8e]
mov al, byte [eax + ecx]
mov byte [ebp + ecx - 0x904], al
inc ecx
jmp 0x4025d6
mov dword [ebp - 0xf8a], ecx
add ecx, 4
mov byte [ebp - 0x909], cl
push 0xfa
lea edx, [ebp - 0x30c2]
push edx
push 0xf6
lea edx, [ebp - 0x90a]
push edx
call dword [ebx + 0x40]
test eax, eax
jne 0x402669
push 0xa0d
push 0x32232024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x24
mov dword [ebp - 0x2fc0], 1
jmp 0x402699
mov eax, dword [ebp - 0xf8a]
mov ecx, dword [ebp - 0xf8e]
add dword [ebp - 0xf8e], eax
push eax
lea edx, [ebp - 0x30c2]
push edx
lea edx, [ebp + ecx - 0xf4a]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
jmp 0x4025ab
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x4026b7
cmp eax, 0xb
je 0x4026b7
cmp eax, 0x17
je 0x4026b7
cmp eax, 0x18
jne 0x4049c8
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x7a120
push 0x800
push 6
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4026fa
mov dword [ebp - 0x2fc0], 1
jmp 0x4049c8
push 1
push 0x8000
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x402727
mov dword [ebp - 0x2fc0], 1
jmp 0x4049b2
mov dword [ebp - 0xf96], 0xe0070000
mov dword [ebp - 0xf92], 0xe8070000
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xffffffffffffffff
push 0
push 4
push 0
push 0x40
push 0
push 6
push 3
push 0
push 0
mov dword [ebp - 0x6f2], esp
mov eax, dword [ebp - 0xf92]
mov dword [esp + 0x40], eax
mov eax, dword [ebp - 0xf96]
mov dword [esp + 0x5c], eax
push 0
push dword [ebp - 0x6f2]
push 4
call dword [edi]
add esp, 0x60
cmp eax, 0xffffffff
jne 0x4027a8
mov dword [ebp - 0x2fc0], 1
jmp 0x4049b2
mov eax, dword [ebp - 0xf96]
mov dword [ebp - 0x2fbc], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x4027c8
cmp eax, 0xb
jne 0x404649
cmp dword [ebp - 0x2fc0], 0
jne 0x402805
push 0x803e
push 0xdf070000
push 0
push 6
push 0
push 0x40
push 0
push 6
push 0x3e8
push 0
push 0
mov dword [ebp - 0x6ee], esp
push 0
push dword [ebp - 0x6ee]
push 6
call dword [edi]
add esp, 0x2c
cmp dword [ebp - 0x2fc0], 0
jne 0x402a75
mov dword [ebp - 0x2fc4], 0x180
push 0x8210
push 0xdf070000
push esp
push 6
push 0x1f4
push 0x40
push 6
push 0
call fcn.004058fc
cmp eax, 0xffffffff
jne 0x40284d
mov dword [ebp - 0x2fc0], 1
jmp 0x402a75
lea edx, [ebp - 0x1fb6]
push edx
push 0xa
push 6
push 0
call fcn.00405a58
cmp eax, 0xffffffff
jne 0x402873
mov dword [ebp - 0x2fc0], 1
jmp 0x402a75
test eax, eax
je 0x402889
cmp byte [ebp - 0x1fb2], 0x7f
jne 0x402889
cmp byte [ebp - 0x1fb0], 0x78
je 0x40284d
dec dword [ebp - 0x2fc4]
jne 0x402910
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4028ed
xor eax, eax
jmp 0x4028f7
cmp eax, 0x20
jbe 0x4028f7
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x402a75
test dword [ebp - 0x2fc4], 0x3f
jne 0x402957
push 0
push 0xa0d244e
push 0x4f5f4e45
push 0x48545f44
push 0x4e415f46
push 0x464f5f4e
push 0x4f495449
push 0x4e47495f
push 0x4e525554
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x2c
test dword [ebp - 0x2fc4], 0xf
jne 0x40281c
mov dword [ebp - 0x2fb8], 0x210
lea edx, [ebp - 0x2fbc]
push edx
push 6
push 0x1f4
push 0x40
push 6
push 0
call fcn.004058fc
cmp eax, 0xffffffff
jne 0x40299e
mov dword [ebp - 0x2fc0], 1
jmp 0x402a75
lea edx, [ebp - 0x1fb6]
push edx
push 0x1f4
push 6
push 0
call fcn.00405a58
cmp eax, 0xffffffff
jne 0x4029c7
mov dword [ebp - 0x2fc0], 1
jmp 0x402a75
test eax, eax
je 0x40281c
cmp byte [ebp - 0x1fb2], 0x7f
jne 0x402a75
cmp byte [ebp - 0x1fb0], 0x78
je 0x40299e
cmp byte [ebp - 0x1fb0], 0x11
je 0x40299e
cmp byte [ebp - 0x1fb0], 0x22
je 0x40281c
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x402a57
xor eax, eax
jmp 0x402a61
cmp eax, 0x20
jbe 0x402a61
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
cmp dword [ebp - 0x2fc0], 0
jne 0x402da6
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x38]
mov dword [ebp - 0x2fc8], eax
lea edx, [ebp - 0x1fb6]
push edx
push 0xa
push 6
push 0
call fcn.00405a58
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2fc8]
jl 0x402a91
mov dword [ebp - 0x2fb8], 0x127
lea edx, [ebp - 0x2fbc]
push edx
push 6
push 0x1f4
push 0x40
push 6
push 0
call fcn.004058fc
cmp eax, 0xffffffff
jne 0x402ae8
mov dword [ebp - 0x2fc0], 1
jmp 0x402da6
lea edx, [ebp - 0x1fb6]
push edx
push 0xbb8
push 6
push 0
call fcn.00405a58
cmp eax, 0xffffffff
jne 0x402b11
mov dword [ebp - 0x2fc0], 1
jmp 0x402da6
test eax, eax
jne 0x402b82
dec dword [ebp - 0x2fc4]
jne 0x402967
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x402b69
xor eax, eax
jmp 0x402b73
cmp eax, 0x20
jbe 0x402b73
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
jmp 0x402da6
cmp byte [ebp - 0x1fb2], 0x7f
jne 0x402d2b
cmp byte [ebp - 0x1fb0], 0x36
jne 0x402bdb
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x1f4]
mov dword [ebp - 0x2fc8], eax
lea edx, [ebp - 0x1fb6]
push edx
push 0xa
push 6
push 0
call fcn.00405a58
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2fc8]
jl 0x402baa
dec dword [ebp - 0x2fc4]
jne 0x402ab1
jmp 0x402cb7
cmp byte [ebp - 0x1fb0], 0x37
jne 0x402c27
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x1f4]
mov dword [ebp - 0x2fc8], eax
lea edx, [ebp - 0x1fb6]
push edx
push 0xa
push 6
push 0
call fcn.00405a58
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2fc8]
jl 0x402bf6
dec dword [ebp - 0x2fc4]
jne 0x402ab1
jmp 0x402cb7
cmp byte [ebp - 0x1fb0], 0x22
jne 0x402c70
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x1f4]
mov dword [ebp - 0x2fc8], eax
lea edx, [ebp - 0x1fb6]
push edx
push 0xa
push 6
push 0
call fcn.00405a58
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2fc8]
jl 0x402c42
dec dword [ebp - 0x2fc4]
jne 0x402ab1
jmp 0x402cb7
cmp byte [ebp - 0x1fb0], 0x7f
jne 0x402cb7
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x1f4]
mov dword [ebp - 0x2fc8], eax
lea edx, [ebp - 0x1fb6]
push edx
push 0xa
push 6
push 0
call fcn.00405a58
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2fc8]
jl 0x402c8b
dec dword [ebp - 0x2fc4]
jne 0x402967
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x402d0b
xor eax, eax
jmp 0x402d15
cmp eax, 0x20
jbe 0x402d15
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x402da6
cmp byte [ebp - 0x1fb2], 0x67
je 0x402da6
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x402d88
xor eax, eax
jmp 0x402d92
cmp eax, 0x20
jbe 0x402d92
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
cmp dword [ebp - 0x2fc0], 0
jne 0x402f55
cmp word [ebp - 0x1fb0], 0
jne 0x402dca
cmp byte [ebp - 0x1fae], 0
je 0x402f55
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x7d]
mov dword [ebp - 0x2fc8], eax
lea edx, [ebp - 0x1fb6]
push edx
push 0xa
push 6
push 0
call fcn.00405a58
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2fc8]
jl 0x402dd9
mov byte [ebp - 0x814], 0x20
mov byte [ebp - 0x813], 0xf4
mov dword [ebp - 0x812], 1
mov eax, dword [ebp - 0x1fb0]
mov dword [ebp - 0x80e], eax
push 0xfa
lea edx, [ebp - 0x30c2]
push edx
push 0xf6
lea edx, [ebp - 0x814]
push edx
call dword [ebx + 0x40]
cmp eax, 3
je 0x402e80
push 0xa0d
push 0x33232024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x24
mov dword [ebp - 0x2fc0], 1
jmp 0x402f55
mov word [ebp - 0x2fb8], 0x227
push 3
lea edx, [ebp - 0x30c2]
push edx
lea edx, [ebp - 0x2fb6]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
lea edx, [ebp - 0x2fbc]
push edx
push 9
lea edx, [ebp - 0x1fb6]
push edx
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.004058c8
test eax, eax
je 0x402ed0
cmp eax, 0xffffffff
jne 0x402edc
mov dword [ebp - 0x2fc0], 1
jmp 0x402f55
cmp byte [ebp - 0x1fb2], 0x67
je 0x402f55
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x402f37
xor eax, eax
jmp 0x402f41
cmp eax, 0x20
jbe 0x402f41
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
cmp dword [ebp - 0x2fc0], 0
jne 0x403799
push 0xa0d24
push 0x544f4f42
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x10
mov dword [ebp - 0x70a], 0
push 0xa
push dword [ebp - 0x71e]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
jne 0x402fdf
push 0xa0d
push 0x36232024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x24
mov dword [ebp - 0x2fc0], 1
jmp 0x40311a
mov dword [ebp - 0x71a], eax
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 0x716], eax
push dword [ebp - 0x71a]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x40304b
push 0xa0d
push 0x37232024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x24
mov dword [ebp - 0x2fc0], 1
jmp 0x40311a
mov dword [ebp - 0x712], eax
cmp byte [eax + 3], 8
je 0x403097
push 0xa0d
push 0x38232024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x24
mov dword [ebp - 0x2fc0], 1
jmp 0x40310e
mov ecx, dword [ebp - 0x716]
mov eax, dword [ecx + eax - 4]
mov dword [ebp - 0x70e], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [ebp - 0x70a], eax
push dword [ebp - 0x70e]
push eax
push dword [ebp - 0x716]
push dword [ebp - 0x712]
call dword [ebx + 0x4c]
test eax, eax
jne 0x40310e
push 0xa0d
push 0x39232024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x24
mov dword [ebp - 0x2fc0], 1
push dword [ebp - 0x712]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
cmp dword [ebp - 0x2fc0], 0
jne 0x4035ca
mov dword [ebp - 0xf6e], 0
mov dword [ebp - 0xf6a], 0
cmp dword [ebp - 0xf6a], 0x32
jae 0x40316b
imul ecx, dword [ebp - 0xf6a], 0x10
mov eax, dword [ebp + ecx - 0xc26]
sub eax, dword [ebp + ecx - 0xc2a]
test eax, eax
je 0x40316b
add dword [ebp - 0xf6e], eax
inc dword [ebp - 0xf6a]
jmp 0x40313b
mov dword [ebp - 0xf6a], 0
cmp dword [ebp - 0xf6a], 0x32
jae 0x4035ca
imul ecx, dword [ebp - 0xf6a], 0x10
mov eax, dword [ebp + ecx - 0xc26]
sub eax, dword [ebp + ecx - 0xc2a]
test eax, eax
je 0x4035ca
mov eax, dword [ebp + ecx - 0xc2a]
mov dword [ebp - 0xf66], eax
mov eax, dword [ebp + ecx - 0xc26]
mov dword [ebp - 0xf62], eax
mov eax, dword [ebp + ecx - 0xc22]
mov dword [ebp - 0xf5e], eax
mov dword [ebp - 0x2fb8], 0x440034
mov eax, dword [ebp - 0xf66]
add eax, dword [ebp - 0xf5e]
mov byte [ebp - 0x2fb3], ah
mov byte [ebp - 0x2fb2], al
shr eax, 0x10
mov byte [ebp - 0x2fb5], ah
mov byte [ebp - 0x2fb4], al
mov eax, dword [ebp - 0xf62]
sub eax, dword [ebp - 0xf66]
mov byte [ebp - 0x2faf], ah
mov byte [ebp - 0x2fae], al
shr eax, 0x10
mov byte [ebp - 0x2fb1], ah
mov byte [ebp - 0x2fb0], al
lea edx, [ebp - 0x2fbc]
push edx
push 0xf
lea edx, [ebp - 0x1fb6]
push edx
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.004058c8
test eax, eax
je 0x40324c
cmp eax, 0xffffffff
jne 0x40325b
mov dword [ebp - 0x2fc0], 1
jmp 0x403352
cmp byte [ebp - 0x1fb2], 0x74
je 0x4032d6
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4032b6
xor eax, eax
jmp 0x4032c0
cmp eax, 0x20
jbe 0x4032c0
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x403352
mov ecx, 6
xor edx, edx
cmp ecx, 0xa
jae 0x4032f3
cmp ecx, eax
jae 0x4032f3
shl edx, 8
mov dl, byte [ebp + ecx - 0x1fb6]
inc ecx
jmp 0x4032dd
mov eax, dword [ebp - 0xf62]
sub eax, dword [ebp - 0xf66]
lea ecx, [edx - 2]
mov dword [ebp - 0xf5a], ecx
xor edx, edx
div ecx
test edx, edx
je 0x403311
inc eax
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
cmp dword [ebp - 0x2fc0], 0
jne 0x4035ca
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0xfd]
mov dword [ebp - 0x2fc8], eax
lea edx, [ebp - 0x1fb6]
push edx
push 0xa
push 6
push 0
call fcn.00405a58
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2fc8]
jl 0x403371
mov dword [ebp - 0xf52], 1
mov ecx, dword [ebp - 0xf66]
mov edx, dword [ebp - 0xf62]
cmp ecx, edx
jae 0x4034d1
sub edx, ecx
cmp edx, dword [ebp - 0xf5a]
jbe 0x4033bf
mov edx, dword [ebp - 0xf5a]
mov dword [ebp - 0xf56], edx
mov byte [ebp - 0x2fb8], 0x36
add ecx, dword [ebp - 0x70a]
mov eax, dword [ebp - 0xf52]
mov byte [ebp - 0x2fb7], al
push edx
push ecx
lea edx, [ebp - 0x2fb6]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov ecx, dword [ebp - 0xf56]
lea edx, [ebp - 0x2fbc]
push edx
lea edx, [ecx + 6]
push edx
lea edx, [ebp - 0x1fb6]
push edx
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.004058c8
test eax, eax
je 0x403426
cmp eax, 0xffffffff
jne 0x403435
mov dword [ebp - 0x2fc0], 1
jmp 0x4034cc
cmp byte [ebp - 0x1fb2], 0x76
je 0x4034b0
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403490
xor eax, eax
jmp 0x40349a
cmp eax, 0x20
jbe 0x40349a
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x4034cc
inc dword [ebp - 0xf52]
mov ecx, dword [ebp - 0xf56]
add dword [ebp - 0xf66], ecx
call fcn.004057f6
jmp 0x40339b
jmp 0x4035ca
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x39]
mov dword [ebp - 0x2fc8], eax
lea edx, [ebp - 0x1fb6]
push edx
push 0xa
push 6
push 0
call fcn.00405a58
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2fc8]
jl 0x4034e0
mov byte [ebp - 0x2fb8], 0x37
lea edx, [ebp - 0x2fbc]
push edx
push 5
lea edx, [ebp - 0x1fb6]
push edx
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.004058c8
test eax, eax
je 0x403535
cmp eax, 0xffffffff
jne 0x403544
mov dword [ebp - 0x2fc0], 1
jmp 0x4035ca
cmp byte [ebp - 0x1fb2], 0x77
je 0x4035bf
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40359f
xor eax, eax
jmp 0x4035a9
cmp eax, 0x20
jbe 0x4035a9
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x4035ca
inc dword [ebp - 0xf6a]
jmp 0x403175
cmp dword [ebp - 0x2fc0], 0
jne 0x40377a
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x82]
mov dword [ebp - 0x2fc8], eax
lea edx, [ebp - 0x1fb6]
push edx
push 0xa
push 6
push 0
call fcn.00405a58
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2fc8]
jl 0x4035e9
mov dword [ebp - 0x2fb8], 0x1030131
mov dword [ebp - 0x2fb4], 0x3100d0
mov eax, dword [ebp - 0x706]
mov byte [ebp - 0x2fb2], ah
mov byte [ebp - 0x2fb1], al
shr eax, 0x10
mov byte [ebp - 0x2fb4], ah
mov byte [ebp - 0x2fb3], al
lea edx, [ebp - 0x2fbc]
push edx
push 0xc
push 0x12c
push 0x40
push 6
push 0
call fcn.004058fc
cmp eax, 0xffffffff
jne 0x40366b
mov dword [ebp - 0x2fc0], 1
jmp 0x40377a
mov dword [ebp - 0x2fc4], 2
lea edx, [ebp - 0x1fb6]
push edx
push 0x7d0
push 6
push 0
call fcn.00405a58
cmp eax, 0xffffffff
jne 0x40369e
mov dword [ebp - 0x2fc0], 1
jmp 0x403728
test eax, eax
jne 0x403712
dec dword [ebp - 0x2fc4]
jne 0x403675
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4036f2
xor eax, eax
jmp 0x4036fc
cmp eax, 0x20
jbe 0x4036fc
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x403728
cmp byte [ebp - 0x1fb2], 0x7f
jne 0x403728
cmp byte [ebp - 0x1fb0], 0x78
je 0x403675
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x1f4]
mov dword [ebp - 0x2fc8], eax
lea edx, [ebp - 0x1fb6]
push edx
push 0xa
push 6
push 0
call fcn.00405a58
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2fc8]
jl 0x40373a
push 0xa0d
push 0x244b4f5f
push 0x544f4f42
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x14
cmp dword [ebp - 0x70a], 0
je 0x403799
push dword [ebp - 0x70a]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [ebp - 0x70a], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x403f06
cmp dword [ebp - 0x2fc0], 0
jne 0x403aeb
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov dword [ebp - 0xf6e], 0
mov dword [ebp - 0xf6a], 0
cmp dword [ebp - 0xf6a], 0x32
jae 0x40381e
imul ecx, dword [ebp - 0xf6a], 0x10
mov eax, dword [ebp + ecx - 0xf46]
sub eax, dword [ebp + ecx - 0xf4a]
test eax, eax
je 0x40381e
add dword [ebp - 0xf6e], eax
inc dword [ebp - 0xf6a]
jmp 0x4037ee
mov eax, dword [ebp - 0xf6e]
add eax, 0x7ff
and eax, 0xfffff800
shr eax, 0xb
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0xf6a], 0
cmp dword [ebp - 0xf6a], 0x32
jae 0x403aeb
imul ecx, dword [ebp - 0xf6a], 0x10
mov eax, dword [ebp + ecx - 0xf46]
sub eax, dword [ebp + ecx - 0xf4a]
test eax, eax
je 0x403aeb
mov dword [ebp - 0x2fb8], 0xff0131
mov byte [ebp - 0x2fae], ah
mov byte [ebp - 0x2fad], al
shr eax, 0x10
mov byte [ebp - 0x2fb0], ah
mov byte [ebp - 0x2faf], al
mov eax, dword [ebp + ecx - 0xf4a]
add eax, dword [ebp + ecx - 0xf42]
mov byte [ebp - 0x2fb2], ah
mov byte [ebp - 0x2fb1], al
shr eax, 0x10
mov byte [ebp - 0x2fb4], ah
mov byte [ebp - 0x2fb3], al
lea edx, [ebp - 0x2fbc]
push edx
push 0x10
push 0x12c
push 0x40
push 6
push 0
call fcn.004058fc
cmp eax, 0xffffffff
jne 0x403921
mov dword [ebp - 0x2fc0], 1
jmp 0x403aeb
mov dword [ebp - 0x2fc4], 0x40
lea edx, [ebp - 0x1fb6]
push edx
push 0x12c
push 6
push 0
call fcn.00405a58
cmp eax, 0xffffffff
jne 0x403954
mov dword [ebp - 0x2fc0], 1
jmp 0x403aeb
test eax, eax
jne 0x4039cb
dec dword [ebp - 0x2fc4]
jne 0x40392b
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4039a8
xor eax, eax
jmp 0x4039b2
cmp eax, 0x20
jbe 0x4039b2
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x403aeb
cmp byte [ebp - 0x1fb2], 0x7f
jne 0x403a65
cmp byte [ebp - 0x1fb0], 0x78
jne 0x4039f0
mov dword [ebp - 0x2fc4], 0x40
jmp 0x40392b
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403a42
xor eax, eax
jmp 0x403a4c
cmp eax, 0x20
jbe 0x403a4c
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x403aeb
cmp byte [ebp - 0x1fb2], 0x71
je 0x403ae0
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403ac0
xor eax, eax
jmp 0x403aca
cmp eax, 0x20
jbe 0x403aca
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x403aeb
inc dword [ebp - 0xf6a]
jmp 0x40387c
cmp dword [ebp - 0x2fc0], 0
jne 0x403ed6
mov dword [ebp - 0xf6a], 0
mov dword [ebp - 0xf4e], 0
cmp dword [ebp - 0xf6a], 0x32
jae 0x403ed6
imul ecx, dword [ebp - 0xf6a], 0x10
mov eax, dword [ebp + ecx - 0xf46]
sub eax, dword [ebp + ecx - 0xf4a]
test eax, eax
je 0x403ed6
mov eax, dword [ebp + ecx - 0xf4a]
mov dword [ebp - 0xf66], eax
mov eax, dword [ebp + ecx - 0xf46]
mov dword [ebp - 0xf62], eax
mov eax, dword [ebp + ecx - 0xf42]
mov dword [ebp - 0xf5e], eax
mov dword [ebp - 0x2fb8], 0x440034
mov eax, dword [ebp - 0xf66]
add eax, dword [ebp - 0xf5e]
mov byte [ebp - 0x2fb3], ah
mov byte [ebp - 0x2fb2], al
shr eax, 0x10
mov byte [ebp - 0x2fb5], ah
mov byte [ebp - 0x2fb4], al
mov eax, dword [ebp - 0xf62]
sub eax, dword [ebp - 0xf66]
mov byte [ebp - 0x2faf], ah
mov byte [ebp - 0x2fae], al
shr eax, 0x10
mov byte [ebp - 0x2fb1], ah
mov byte [ebp - 0x2fb0], al
lea edx, [ebp - 0x2fbc]
push edx
push 0xf
lea edx, [ebp - 0x1fb6]
push edx
push 0x1388
push 0xc8
push 0x40
push 6
push 0
call fcn.004058c8
test eax, eax
je 0x403be3
cmp eax, 0xffffffff
jne 0x403bf2
mov dword [ebp - 0x2fc0], 1
jmp 0x403c93
cmp byte [ebp - 0x1fb2], 0x74
je 0x403c6d
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403c4d
xor eax, eax
jmp 0x403c57
cmp eax, 0x20
jbe 0x403c57
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x403c93
mov ecx, 6
xor edx, edx
cmp ecx, 0xa
jae 0x403c8a
cmp ecx, eax
jae 0x403c8a
shl edx, 8
mov dl, byte [ebp + ecx - 0x1fb6]
inc ecx
jmp 0x403c74
lea ecx, [edx - 2]
mov dword [ebp - 0xf5a], ecx
cmp dword [ebp - 0x2fc0], 0
jne 0x403ed6
mov dword [ebp - 0xf52], 1
mov ecx, dword [ebp - 0xf66]
mov edx, dword [ebp - 0xf62]
cmp ecx, edx
jae 0x403df6
sub edx, ecx
cmp edx, dword [ebp - 0xf5a]
jbe 0x403cce
mov edx, dword [ebp - 0xf5a]
mov dword [ebp - 0xf56], edx
mov byte [ebp - 0x2fb8], 0x36
add ecx, dword [esi + 0x20]
mov eax, dword [ebp - 0xf52]
mov byte [ebp - 0x2fb7], al
push edx
push ecx
lea edx, [ebp - 0x2fb6]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov ecx, dword [ebp - 0xf56]
lea edx, [ebp - 0x2fbc]
push edx
lea edx, [ecx + 6]
push edx
lea edx, [ebp - 0x1fb6]
push edx
push 0x1388
push 0xc8
push 0x40
push 6
push 0
call fcn.004058c8
test eax, eax
je 0x403d32
cmp eax, 0xffffffff
jne 0x403d41
mov dword [ebp - 0x2fc0], 1
jmp 0x403df1
cmp byte [ebp - 0x1fb2], 0x76
je 0x403dbc
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403d9c
xor eax, eax
jmp 0x403da6
cmp eax, 0x20
jbe 0x403da6
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x403df1
mov eax, dword [ebp - 0xf66]
and eax, 0xfffff800
cmp eax, dword [ebp - 0xf4e]
je 0x403dda
mov dword [ebp - 0xf4e], eax
call fcn.004057f6
inc dword [ebp - 0xf52]
mov ecx, dword [ebp - 0xf56]
add dword [ebp - 0xf66], ecx
jmp 0x403caa
jmp 0x403ed6
mov byte [ebp - 0x2fb8], 0x37
lea edx, [ebp - 0x2fbc]
push edx
push 5
lea edx, [ebp - 0x1fb6]
push edx
push 0x1388
push 0x12c
push 0x40
push 6
push 0
call fcn.004058c8
test eax, eax
je 0x403e2b
cmp eax, 0xffffffff
jne 0x403e3a
mov dword [ebp - 0x2fc0], 1
jmp 0x403ed6
cmp byte [ebp - 0x1fb2], 0x77
je 0x403ecb
cmp byte [ebp - 0x1fb2], 0x7f
jne 0x403e59
cmp byte [ebp - 0x1fb0], 1
je 0x403ecb
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403eab
xor eax, eax
jmp 0x403eb5
cmp eax, 0x20
jbe 0x403eb5
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x403ed6
inc dword [ebp - 0xf6a]
jmp 0x403b0c
cmp dword [ebp - 0x2fc0], 0
jne 0x403f06
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x404513
cmp dword [ebp - 0x2fc0], 0
jne 0x4044c3
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [esi + 0x14]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x24], eax
push dword [esi + 0x28]
push 0xff
push eax
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov dword [ebp - 0xf6e], 0
mov dword [ebp - 0xf6a], 0
cmp dword [ebp - 0xf6a], 0x32
jae 0x403fb2
imul ecx, dword [ebp - 0xf6a], 0x10
mov eax, dword [ebp + ecx - 0xf46]
sub eax, dword [ebp + ecx - 0xf4a]
test eax, eax
je 0x403fb2
add dword [ebp - 0xf6e], eax
inc dword [ebp - 0xf6a]
jmp 0x403f82
mov eax, dword [ebp - 0xf6e]
add eax, 0x7ff
and eax, 0xfffff800
shr eax, 0xb
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0xf6a], 0
mov dword [ebp - 0xf4e], 0
cmp dword [ebp - 0xf6a], 0x32
jae 0x4044c3
imul ecx, dword [ebp - 0xf6a], 0x10
mov eax, dword [ebp + ecx - 0xf46]
sub eax, dword [ebp + ecx - 0xf4a]
test eax, eax
je 0x4044c3
mov eax, dword [ebp + ecx - 0xf4a]
mov dword [ebp - 0xf66], eax
mov eax, dword [ebp + ecx - 0xf46]
mov dword [ebp - 0xf62], eax
mov eax, dword [ebp + ecx - 0xf42]
mov dword [ebp - 0xf5e], eax
mov dword [ebp - 0x2fb8], 0x440035
mov eax, dword [ebp - 0xf66]
add eax, dword [ebp - 0xf5e]
mov byte [ebp - 0x2fb3], ah
mov byte [ebp - 0x2fb2], al
shr eax, 0x10
mov byte [ebp - 0x2fb5], ah
mov byte [ebp - 0x2fb4], al
mov eax, dword [ebp - 0xf62]
sub eax, dword [ebp - 0xf66]
mov byte [ebp - 0x2faf], ah
mov byte [ebp - 0x2fae], al
shr eax, 0x10
mov byte [ebp - 0x2fb1], ah
mov byte [ebp - 0x2fb0], al
lea edx, [ebp - 0x2fbc]
push edx
push 0xf
push 0x12c
push 0x40
push 6
push 0
call fcn.004058fc
cmp eax, 0xffffffff
jne 0x4040f0
mov dword [ebp - 0x2fc0], 1
jmp 0x4044c3
mov dword [ebp - 0x2fc4], 0x40
lea edx, [ebp - 0x1fb6]
push edx
push 0x12c
push 6
push 0
call fcn.00405a58
cmp eax, 0xffffffff
jne 0x404123
mov dword [ebp - 0x2fc0], 1
jmp 0x4044c3
test eax, eax
jne 0x40419a
dec dword [ebp - 0x2fc4]
jne 0x4040fa
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404177
xor eax, eax
jmp 0x404181
cmp eax, 0x20
jbe 0x404181
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x4044c3
cmp byte [ebp - 0x1fb2], 0x7f
jne 0x404234
cmp byte [ebp - 0x1fb0], 0x78
jne 0x4041bf
mov dword [ebp - 0x2fc4], 0x40
jmp 0x4040fa
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404211
xor eax, eax
jmp 0x40421b
cmp eax, 0x20
jbe 0x40421b
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x4044c3
cmp byte [ebp - 0x1fb2], 0x75
je 0x4042b2
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40428f
xor eax, eax
jmp 0x404299
cmp eax, 0x20
jbe 0x404299
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x4044c3
mov dword [ebp - 0xf52], 1
mov ecx, dword [ebp - 0xf66]
mov edx, dword [ebp - 0xf62]
cmp ecx, edx
jae 0x4043f9
mov byte [ebp - 0x2fb8], 0x36
mov eax, dword [ebp - 0xf52]
mov byte [ebp - 0x2fb7], al
lea edx, [ebp - 0x2fbc]
push edx
push 6
lea edx, [ebp - 0x1fb6]
push edx
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.004058c8
test eax, eax
je 0x404311
cmp eax, 0xffffffff
jne 0x404320
mov dword [ebp - 0x2fc0], 1
jmp 0x4043f4
cmp byte [ebp - 0x1fb2], 0x76
je 0x40439b
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40437b
xor eax, eax
jmp 0x404385
cmp eax, 0x20
jbe 0x404385
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x4043f4
sub eax, 6
mov dword [ebp - 0xf56], eax
mov eax, dword [ebp - 0xf66]
and eax, 0xfffff800
cmp eax, dword [ebp - 0xf4e]
je 0x4043c2
mov dword [ebp - 0xf4e], eax
call fcn.004057f6
inc dword [ebp - 0xf52]
mov eax, dword [ebp - 0xf56]
mov ecx, dword [esi + 0x24]
add ecx, dword [ebp - 0xf66]
add dword [ebp - 0xf66], eax
push eax
lea edx, [ebp - 0x1fb0]
push edx
push ecx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
jmp 0x4042bc
jmp 0x4044c3
mov byte [ebp - 0x2fb8], 0x37
lea edx, [ebp - 0x2fbc]
push edx
push 5
lea edx, [ebp - 0x1fb6]
push edx
push 0x1388
push 0x12c
push 0x40
push 6
push 0
call fcn.004058c8
test eax, eax
je 0x40442e
cmp eax, 0xffffffff
jne 0x40443d
mov dword [ebp - 0x2fc0], 1
jmp 0x4044c3
cmp byte [ebp - 0x1fb2], 0x77
je 0x4044b8
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404498
xor eax, eax
jmp 0x4044a2
cmp eax, 0x20
jbe 0x4044a2
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x4044c3
inc dword [ebp - 0xf6a]
jmp 0x40401a
cmp dword [ebp - 0x2fc0], 0
je 0x4044ec
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
jmp 0x404513
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
je 0x404527
cmp eax, 0x18
jne 0x4045fd
cmp dword [ebp - 0x2fc0], 0
jne 0x4045fd
mov eax, dword [ebp - 0xf96]
mov dword [ebp - 0x2fbc], eax
mov dword [ebp - 0x2fb8], 0x110
lea edx, [ebp - 0x2fbc]
push edx
push 6
lea edx, [ebp - 0x1fb6]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.004058c8
test eax, eax
je 0x404578
cmp eax, 0xffffffff
jne 0x404584
mov dword [ebp - 0x2fc0], 1
jmp 0x4045fd
cmp byte [ebp - 0x1fb2], 0x50
je 0x4045fd
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4045df
xor eax, eax
jmp 0x4045e9
cmp eax, 0x20
jbe 0x4045e9
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x40460d
cmp eax, 0xb
jne 0x404649
mov dword [ebp - 0x2fbc], 0xdf070000
mov dword [ebp - 0x2fb8], 0x8111
lea edx, [ebp - 0x2fbc]
push edx
push 6
push 0x12c
push 0x40
push 6
push 0
call fcn.004058fc
cmp eax, 0xffffffff
jne 0x404649
mov dword [ebp - 0x2fc0], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x404835
cmp dword [ebp - 0x2fc0], 0
jne 0x404835
push 0x1fd
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x2fb8], 0x8f0219
lea edx, [ebp - 0x2fbc]
push edx
push 7
lea edx, [ebp - 0x1fb6]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.004058c8
test eax, eax
je 0x4046a8
cmp eax, 0xffffffff
jne 0x4046b7
mov dword [ebp - 0x2fc0], 1
jmp 0x404835
cmp byte [ebp - 0x1fb2], 0x59
je 0x404735
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404712
xor eax, eax
jmp 0x40471c
cmp eax, 0x20
jbe 0x40471c
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x404835
sub eax, 7
shr eax, 2
mov dword [ebp - 0x6ea], eax
push 0
push 0xa0d6425
push 0x203a2454
push 0x4e554f43
push 0x5f435444
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x33b0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x33b0]
push edx
call dword [ebx + 0x30]
mov dword [ebp - 0x6e6], 0
mov ecx, dword [ebp - 0x6e6]
cmp ecx, dword [ebp - 0x6ea]
jae 0x404835
shl ecx, 2
movzx eax, byte [ebp + ecx - 0x1faf]
mov dword [ebp - 0x6e2], eax
movzx eax, byte [ebp + ecx - 0x1fae]
mov dword [ebp - 0x6de], eax
movzx eax, byte [ebp + ecx - 0x1fad]
mov dword [ebp - 0x6da], eax
movzx eax, byte [ebp + ecx - 0x1fac]
mov dword [ebp - 0x6d6], eax
push 0xa
push 0xd58322e
push 0x252d5832
push 0x2e252d58
push 0x322e2558
push 0x322e2550
push dword [ebp - 0x6d6]
push dword [ebp - 0x6da]
push dword [ebp - 0x6de]
push dword [ebp - 0x6e2]
lea eax, [esp + 0x10]
push eax
lea edx, [ebp - 0x33b0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x33b0]
push edx
call dword [ebx + 0x30]
inc dword [ebp - 0x6e6]
jmp 0x40478b
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x18
jne 0x4049a2
cmp dword [ebp - 0x2fc0], 0
jne 0x4048a3
push 0
push 0xa0d2443
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0x248
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xffffff14
push 0xdf070000
push esp
push 8
push 0
push 0x40
push 6
push 0
call fcn.004058fc
cmp eax, 0xffffffff
jne 0x4048a3
mov dword [ebp - 0x2fc0], 1
cmp dword [ebp - 0x2fc0], 0
jne 0x4049a2
push 0x21b
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x2fb8], 0xffffff14
lea edx, [ebp - 0x2fbc]
push edx
push 8
lea edx, [ebp - 0x1fb6]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.004058c8
test eax, eax
je 0x4048f3
cmp eax, 0xffffffff
jne 0x404902
mov dword [ebp - 0x2fc0], 1
jmp 0x4049a2
cmp byte [ebp - 0x1fb2], 0x54
je 0x40497d
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x1fb6]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40495d
xor eax, eax
jmp 0x404967
cmp eax, 0x20
jbe 0x404967
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00405aa9
mov dword [ebp - 0x2fc0], 1
jmp 0x4049a2
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0
mov eax, esp
push 0
push eax
push 2
call dword [edi]
add esp, 4
push 0
push 0
push 3
call dword [edi]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xd
jne 0x40568b
mov eax, 3
pushal
mov dword [ebp - 0x2fc0], 0
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x20]
cmp ebx, 0x24
jbe 0x404eb1
cmp dword [edi + ebx - 4], 0xcafeaffe
jne 0x404ea9
cmp dword [edi + ebx - 8], 0xfadecafe
jne 0x404ea9
push ebx
xor ecx, ecx
inc ecx
movzx eax, word [edi + ebx - 0x1c]
cmp ebx, 0x3c
jbe 0x404a3c
cmp eax, ecx
je 0x404a3c
inc ecx
sub ebx, 0x20
cmp dword [edi + ebx - 4], 0xcafeaffe
jne 0x404a3c
cmp dword [edi + ebx - 8], 0xfadecafe
je 0x404a16
cmp eax, ecx
jne 0x404ea8
movzx eax, word [edi + ebx - 0x1c]
mov dword [ebp - 0x6d2], eax
mov dword [ebp - 0x6ce], 0
mov ecx, dword [ebp - 0x6ce]
cmp ecx, dword [ebp - 0x6d2]
jae 0x404ea5
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
cmp dword [edi + ecx + 8], 0x1000
jne 0x404bdf
mov eax, dword [edi + ecx - 0x10]
mov edx, dword [edi + ecx - 0xc]
cmp eax, 0x80400000
jae 0x404a9c
cmp eax, 0x80000000
jb 0x404a9c
sub eax, 0x80000000
jmp 0x404ad9
cmp eax, 0x80a00000
jae 0x404ab1
cmp eax, 0x80800000
jb 0x404ab1
sub eax, 0x80600000
jmp 0x404ad9
cmp eax, 0x81180000
jae 0x404ac6
cmp eax, 0x81000000
jb 0x404ac6
sub eax, 0x80c00000
jmp 0x404ad9
cmp eax, 0x84380000
jae 0x404ad9
cmp eax, 0x84002000
jb 0x404ad9
sub eax, 0x83c00000
cmp edx, 0x80400000
jae 0x404af1
cmp edx, 0x80000000
jb 0x404af1
sub edx, 0x80000000
jmp 0x404b37
cmp edx, 0x80a00000
jae 0x404b09
cmp edx, 0x80800000
jb 0x404b09
sub edx, 0x80600000
jmp 0x404b37
cmp edx, 0x81180000
jae 0x404b21
cmp edx, 0x81000000
jb 0x404b21
sub edx, 0x80c00000
jmp 0x404b37
cmp edx, 0x84380000
jae 0x404b37
cmp edx, 0x84002000
jb 0x404b37
sub edx, 0x83c00000
dec edx
and edx, 0xfffffffc
push edx
push eax
push edi
call fcn.00405845
mov ecx, dword [ebp - 0x6ce]
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
mov ecx, dword [edi + ecx - 0xc]
dec ecx
and ecx, 0xfffffffc
cmp ecx, 0x80400000
jae 0x404b6f
cmp ecx, 0x80000000
jb 0x404b6f
sub ecx, 0x80000000
jmp 0x404bb5
cmp ecx, 0x80a00000
jae 0x404b87
cmp ecx, 0x80800000
jb 0x404b87
sub ecx, 0x80600000
jmp 0x404bb5
cmp ecx, 0x81180000
jae 0x404b9f
cmp ecx, 0x81000000
jb 0x404b9f
sub ecx, 0x80c00000
jmp 0x404bb5
cmp ecx, 0x84380000
jae 0x404bb5
cmp ecx, 0x84002000
jb 0x404bb5
sub ecx, 0x83c00000
cmp dword [edi + ecx], eax
jne 0x404bcf
cmp dword [esp + 0x20], 3
jne 0x404e9a
mov dword [esp + 0x20], 0
jmp 0x404bda
mov dword [esp + 0x20], 1
mov dword [edi + ecx], eax
jmp 0x404e9a
cmp dword [edi + ecx + 8], 0x1001
jne 0x404d0c
mov eax, dword [edi + ecx - 8]
sub eax, dword [edi + ecx - 4]
mov dword [ebp - 0x6ca], eax
mov edx, dword [edi + ecx - 0xc]
mov ecx, dword [edi + ecx - 0x10]
cmp ecx, 0x80400000
jae 0x404c1b
cmp ecx, 0x80000000
jb 0x404c1b
sub ecx, 0x80000000
jmp 0x404c61
cmp ecx, 0x80a00000
jae 0x404c33
cmp ecx, 0x80800000
jb 0x404c33
sub ecx, 0x80600000
jmp 0x404c61
cmp ecx, 0x81180000
jae 0x404c4b
cmp ecx, 0x81000000
jb 0x404c4b
sub ecx, 0x80c00000
jmp 0x404c61
cmp ecx, 0x84380000
jae 0x404c61
cmp ecx, 0x84002000
jb 0x404c61
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x404c79
cmp edx, 0x80000000
jb 0x404c79
sub edx, 0x80000000
jmp 0x404cbf
cmp edx, 0x80a00000
jae 0x404c91
cmp edx, 0x80800000
jb 0x404c91
sub edx, 0x80600000
jmp 0x404cbf
cmp edx, 0x81180000
jae 0x404ca9
cmp edx, 0x81000000
jb 0x404ca9
sub edx, 0x80c00000
jmp 0x404cbf
cmp edx, 0x84380000
jae 0x404cbf
cmp edx, 0x84002000
jb 0x404cbf
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
cmp ecx, edx
jae 0x404cd7
mov eax, dword [edi + ecx]
add dword [ebp - 0x6ca], eax
add ecx, 4
jmp 0x404cc5
cmp dword [ebp - 0x6ca], 0
jne 0x404cf5
cmp dword [esp + 0x20], 3
jne 0x404e9a
mov dword [esp + 0x20], 0
jmp 0x404d07
mov dword [esp + 0x20], 1
sub eax, dword [ebp - 0x6ca]
mov dword [edi + edx - 4], eax
jmp 0x404e9a
cmp dword [edi + ecx + 8], 0x1010
jne 0x404e9a
mov eax, dword [edi + ecx - 4]
sub eax, dword [edi + ecx - 8]
mov dword [ebp - 0x6ca], eax
mov edx, dword [edi + ecx - 0xc]
mov ecx, dword [edi + ecx - 0x10]
cmp ecx, 0x80400000
jae 0x404d48
cmp ecx, 0x80000000
jb 0x404d48
sub ecx, 0x80000000
jmp 0x404d8e
cmp ecx, 0x80a00000
jae 0x404d60
cmp ecx, 0x80800000
jb 0x404d60
sub ecx, 0x80600000
jmp 0x404d8e
cmp ecx, 0x81180000
jae 0x404d78
cmp ecx, 0x81000000
jb 0x404d78
sub ecx, 0x80c00000
jmp 0x404d8e
cmp ecx, 0x84380000
jae 0x404d8e
cmp ecx, 0x84002000
jb 0x404d8e
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x404da6
cmp edx, 0x80000000
jb 0x404da6
sub edx, 0x80000000
jmp 0x404dec
cmp edx, 0x80a00000
jae 0x404dbe
cmp edx, 0x80800000
jb 0x404dbe
sub edx, 0x80600000
jmp 0x404dec
cmp edx, 0x81180000
jae 0x404dd6
cmp edx, 0x81000000
jb 0x404dd6
sub edx, 0x80c00000
jmp 0x404dec
cmp edx, 0x84380000
jae 0x404dec
cmp edx, 0x84002000
jb 0x404dec
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
sub edx, 4
cmp ecx, edx
jae 0x404e08
movzx eax, word [edi + ecx]
sub dword [ebp - 0x6ca], eax
add ecx, 2
jmp 0x404df5
mov ecx, dword [ebp - 0x6ce]
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
mov ecx, dword [edi + ecx - 0xc]
cmp ecx, 0x80400000
jae 0x404e30
cmp ecx, 0x80000000
jb 0x404e30
sub ecx, 0x80000000
jmp 0x404e76
cmp ecx, 0x80a00000
jae 0x404e48
cmp ecx, 0x80800000
jb 0x404e48
sub ecx, 0x80600000
jmp 0x404e76
cmp ecx, 0x81180000
jae 0x404e60
cmp ecx, 0x81000000
jb 0x404e60
sub ecx, 0x80c00000
jmp 0x404e76
cmp ecx, 0x84380000
jae 0x404e76
cmp ecx, 0x84002000
jb 0x404e76
sub ecx, 0x83c00000
add ecx, 3
and ecx, 0xfffffffc
mov eax, dword [edi + ecx - 4]
cmp eax, dword [ebp - 0x6ca]
je 0x404e9a
mov dword [esp + 0x20], 1
mov eax, dword [ebp - 0x6ca]
mov dword [edi + ecx - 4], eax
inc dword [ebp - 0x6ce]
jmp 0x404a59
pop eax
jmp 0x404ea9
pop ebx
sub ebx, 4
jmp 0x4049ed
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x62a], 0xffffffff
mov dword [ebp - 0x626], 0xffffffff
cmp ebx, 0x24
jbe 0x405149
mov eax, dword [edi + ebx - 8]
xor eax, 0xffffffff
cmp eax, dword [edi + ebx - 4]
jne 0x404fcd
mov eax, dword [edi + ebx - 0x10]
mov ecx, dword [edi + ebx - 0xc]
cmp eax, 0x80400000
jae 0x404f02
cmp eax, 0x80000000
jb 0x404f02
sub eax, 0x80000000
jmp 0x404f3f
cmp eax, 0x80a00000
jae 0x404f17
cmp eax, 0x80800000
jb 0x404f17
sub eax, 0x80600000
jmp 0x404f3f
cmp eax, 0x81180000
jae 0x404f2c
cmp eax, 0x81000000
jb 0x404f2c
sub eax, 0x80c00000
jmp 0x404f3f
cmp eax, 0x84380000
jae 0x404f3f
cmp eax, 0x84002000
jb 0x404f3f
sub eax, 0x83c00000
cmp ecx, 0x80400000
jae 0x404f57
cmp ecx, 0x80000000
jb 0x404f57
sub ecx, 0x80000000
jmp 0x404f9d
cmp ecx, 0x80a00000
jae 0x404f6f
cmp ecx, 0x80800000
jb 0x404f6f
sub ecx, 0x80600000
jmp 0x404f9d
cmp ecx, 0x81180000
jae 0x404f87
cmp ecx, 0x81000000
jb 0x404f87
sub ecx, 0x80c00000
jmp 0x404f9d
cmp ecx, 0x84380000
jae 0x404f9d
cmp ecx, 0x84002000
jb 0x404f9d
sub ecx, 0x83c00000
add ecx, 3
and ecx, 0xfffffffc
cmp eax, ecx
jae 0x404fcd
cmp ecx, dword [esi + 0x14]
jae 0x404fcd
mov eax, dword [ebp - 0x626]
sub eax, ebx
cmp eax, 0x10
je 0x404fbf
mov dword [ebp - 0x62a], ebx
mov dword [ebp - 0x626], ebx
sub ebx, 0x10
jmp 0x404ecb
cmp dword [ebp - 0x62a], 0xffffffff
je 0x405141
mov eax, dword [ebp - 0x62a]
sub eax, ebx
cmp eax, 0x40
jb 0x405137
mov eax, dword [ebp - 0x626]
cmp eax, dword [ebp - 0x62a]
ja 0x405137
mov ecx, dword [edi + eax - 0x10]
mov edx, dword [edi + eax - 0xc]
cmp ecx, 0x80400000
jae 0x40501d
cmp ecx, 0x80000000
jb 0x40501d
sub ecx, 0x80000000
jmp 0x405063
cmp ecx, 0x80a00000
jae 0x405035
cmp ecx, 0x80800000
jb 0x405035
sub ecx, 0x80600000
jmp 0x405063
cmp ecx, 0x81180000
jae 0x40504d
cmp ecx, 0x81000000
jb 0x40504d
sub ecx, 0x80c00000
jmp 0x405063
cmp ecx, 0x84380000
jae 0x405063
cmp ecx, 0x84002000
jb 0x405063
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x40507b
cmp edx, 0x80000000
jb 0x40507b
sub edx, 0x80000000
jmp 0x4050c1
cmp edx, 0x80a00000
jae 0x405093
cmp edx, 0x80800000
jb 0x405093
sub edx, 0x80600000
jmp 0x4050c1
cmp edx, 0x81180000
jae 0x4050ab
cmp edx, 0x81000000
jb 0x4050ab
sub edx, 0x80c00000
jmp 0x4050c1
cmp edx, 0x84380000
jae 0x4050c1
cmp edx, 0x84002000
jb 0x4050c1
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
mov dword [ebp - 0x622], 0
cmp ecx, edx
jae 0x4050e4
movzx eax, word [edi + ecx]
add dword [ebp - 0x622], eax
add ecx, 2
jmp 0x4050d1
mov eax, dword [ebp - 0x626]
mov ecx, dword [ebp - 0x622]
cmp ecx, dword [edi + eax - 8]
je 0x40510c
cmp dword [edi + eax - 8], 0xcafeaffe
je 0x40510c
mov dword [esp + 0x20], 1
mov dword [edi + eax - 8], ecx
xor ecx, 0xffffffff
cmp ecx, dword [edi + eax - 4]
je 0x40512b
cmp dword [edi + eax - 4], 0x35015001
je 0x40512b
mov dword [esp + 0x20], 1
mov dword [edi + eax - 4], ecx
add dword [ebp - 0x626], 0x10
jmp 0x404feb
mov dword [ebp - 0x62a], 0xffffffff
sub ebx, 4
jmp 0x404ecb
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x20]
cmp ebx, 0x24
jbe 0x405613
cmp dword [edi + ebx - 4], 0xcafeaffe
jne 0x40560b
cmp dword [edi + ebx - 8], 0xfadecafe
jne 0x40560b
push ebx
xor ecx, ecx
inc ecx
movzx eax, word [edi + ebx - 0x1c]
cmp ebx, 0x3c
jbe 0x40519e
cmp eax, ecx
je 0x40519e
inc ecx
sub ebx, 0x20
cmp dword [edi + ebx - 4], 0xcafeaffe
jne 0x40519e
cmp dword [edi + ebx - 8], 0xfadecafe
je 0x405178
cmp eax, ecx
jne 0x40560a
movzx eax, word [edi + ebx - 0x1c]
mov dword [ebp - 0x6d2], eax
mov dword [ebp - 0x6ce], 0
mov ecx, dword [ebp - 0x6ce]
cmp ecx, dword [ebp - 0x6d2]
jae 0x405607
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
cmp dword [edi + ecx + 8], 0x1000
jne 0x405341
mov eax, dword [edi + ecx - 0x10]
mov edx, dword [edi + ecx - 0xc]
cmp eax, 0x80400000
jae 0x4051fe
cmp eax, 0x80000000
jb 0x4051fe
sub eax, 0x80000000
jmp 0x40523b
cmp eax, 0x80a00000
jae 0x405213
cmp eax, 0x80800000
jb 0x405213
sub eax, 0x80600000
jmp 0x40523b
cmp eax, 0x81180000
jae 0x405228
cmp eax, 0x81000000
jb 0x405228
sub eax, 0x80c00000
jmp 0x40523b
cmp eax, 0x84380000
jae 0x40523b
cmp eax, 0x84002000
jb 0x40523b
sub eax, 0x83c00000
cmp edx, 0x80400000
jae 0x405253
cmp edx, 0x80000000
jb 0x405253
sub edx, 0x80000000
jmp 0x405299
cmp edx, 0x80a00000
jae 0x40526b
cmp edx, 0x80800000
jb 0x40526b
sub edx, 0x80600000
jmp 0x405299
cmp edx, 0x81180000
jae 0x405283
cmp edx, 0x81000000
jb 0x405283
sub edx, 0x80c00000
jmp 0x405299
cmp edx, 0x84380000
jae 0x405299
cmp edx, 0x84002000
jb 0x405299
sub edx, 0x83c00000
dec edx
and edx, 0xfffffffc
push edx
push eax
push edi
call fcn.00405845
mov ecx, dword [ebp - 0x6ce]
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
mov ecx, dword [edi + ecx - 0xc]
dec ecx
and ecx, 0xfffffffc
cmp ecx, 0x80400000
jae 0x4052d1
cmp ecx, 0x80000000
jb 0x4052d1
sub ecx, 0x80000000
jmp 0x405317
cmp ecx, 0x80a00000
jae 0x4052e9
cmp ecx, 0x80800000
jb 0x4052e9
sub ecx, 0x80600000
jmp 0x405317
cmp ecx, 0x81180000
jae 0x405301
cmp ecx, 0x81000000
jb 0x405301
sub ecx, 0x80c00000
jmp 0x405317
cmp ecx, 0x84380000
jae 0x405317
cmp ecx, 0x84002000
jb 0x405317
sub ecx, 0x83c00000
cmp dword [edi + ecx], eax
jne 0x405331
cmp dword [esp + 0x20], 3
jne 0x4055fc
mov dword [esp + 0x20], 0
jmp 0x40533c
mov dword [esp + 0x20], 1
mov dword [edi + ecx], eax
jmp 0x4055fc
cmp dword [edi + ecx + 8], 0x1001
jne 0x40546e
mov eax, dword [edi + ecx - 8]
sub eax, dword [edi + ecx - 4]
mov dword [ebp - 0x6ca], eax
mov edx, dword [edi + ecx - 0xc]
mov ecx, dword [edi + ecx - 0x10]
cmp ecx, 0x80400000
jae 0x40537d
cmp ecx, 0x80000000
jb 0x40537d
sub ecx, 0x80000000
jmp 0x4053c3
cmp ecx, 0x80a00000
jae 0x405395
cmp ecx, 0x80800000
jb 0x405395
sub ecx, 0x80600000
jmp 0x4053c3
cmp ecx, 0x81180000
jae 0x4053ad
cmp ecx, 0x81000000
jb 0x4053ad
sub ecx, 0x80c00000
jmp 0x4053c3
cmp ecx, 0x84380000
jae 0x4053c3
cmp ecx, 0x84002000
jb 0x4053c3
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x4053db
cmp edx, 0x80000000
jb 0x4053db
sub edx, 0x80000000
jmp 0x405421
cmp edx, 0x80a00000
jae 0x4053f3
cmp edx, 0x80800000
jb 0x4053f3
sub edx, 0x80600000
jmp 0x405421
cmp edx, 0x81180000
jae 0x40540b
cmp edx, 0x81000000
jb 0x40540b
sub edx, 0x80c00000
jmp 0x405421
cmp edx, 0x84380000
jae 0x405421
cmp edx, 0x84002000
jb 0x405421
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
cmp ecx, edx
jae 0x405439
mov eax, dword [edi + ecx]
add dword [ebp - 0x6ca], eax
add ecx, 4
jmp 0x405427
cmp dword [ebp - 0x6ca], 0
jne 0x405457
cmp dword [esp + 0x20], 3
jne 0x4055fc
mov dword [esp + 0x20], 0
jmp 0x405469
mov dword [esp + 0x20], 1
sub eax, dword [ebp - 0x6ca]
mov dword [edi + edx - 4], eax
jmp 0x4055fc
cmp dword [edi + ecx + 8], 0x1010
jne 0x4055fc
mov eax, dword [edi + ecx - 4]
sub eax, dword [edi + ecx - 8]
mov dword [ebp - 0x6ca], eax
mov edx, dword [edi + ecx - 0xc]
mov ecx, dword [edi + ecx - 0x10]
cmp ecx, 0x80400000
jae 0x4054aa
cmp ecx, 0x80000000
jb 0x4054aa
sub ecx, 0x80000000
jmp 0x4054f0
cmp ecx, 0x80a00000
jae 0x4054c2
cmp ecx, 0x80800000
jb 0x4054c2
sub ecx, 0x80600000
jmp 0x4054f0
cmp ecx, 0x81180000
jae 0x4054da
cmp ecx, 0x81000000
jb 0x4054da
sub ecx, 0x80c00000
jmp 0x4054f0
cmp ecx, 0x84380000
jae 0x4054f0
cmp ecx, 0x84002000
jb 0x4054f0
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x405508
cmp edx, 0x80000000
jb 0x405508
sub edx, 0x80000000
jmp 0x40554e
cmp edx, 0x80a00000
jae 0x405520
cmp edx, 0x80800000
jb 0x405520
sub edx, 0x80600000
jmp 0x40554e
cmp edx, 0x81180000
jae 0x405538
cmp edx, 0x81000000
jb 0x405538
sub edx, 0x80c00000
jmp 0x40554e
cmp edx, 0x84380000
jae 0x40554e
cmp edx, 0x84002000
jb 0x40554e
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
sub edx, 4
cmp ecx, edx
jae 0x40556a
movzx eax, word [edi + ecx]
sub dword [ebp - 0x6ca], eax
add ecx, 2
jmp 0x405557
mov ecx, dword [ebp - 0x6ce]
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
mov ecx, dword [edi + ecx - 0xc]
cmp ecx, 0x80400000
jae 0x405592
cmp ecx, 0x80000000
jb 0x405592
sub ecx, 0x80000000
jmp 0x4055d8
cmp ecx, 0x80a00000
jae 0x4055aa
cmp ecx, 0x80800000
jb 0x4055aa
sub ecx, 0x80600000
jmp 0x4055d8
cmp ecx, 0x81180000
jae 0x4055c2
cmp ecx, 0x81000000
jb 0x4055c2
sub ecx, 0x80c00000
jmp 0x4055d8
cmp ecx, 0x84380000
jae 0x4055d8
cmp ecx, 0x84002000
jb 0x4055d8
sub ecx, 0x83c00000
add ecx, 3
and ecx, 0xfffffffc
mov eax, dword [edi + ecx - 4]
cmp eax, dword [ebp - 0x6ca]
je 0x4055fc
mov dword [esp + 0x20], 1
mov eax, dword [ebp - 0x6ca]
mov dword [edi + ecx - 4], eax
inc dword [ebp - 0x6ce]
jmp 0x4051bb
pop eax
jmp 0x40560b
pop ebx
sub ebx, 4
jmp 0x40514f
popal
test eax, eax
jne 0x40563a
push 0xa0d
push 0x2444494c
push 0x41565f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x14
jmp 0x40568b
cmp eax, 1
jne 0x405666
push 0xa0d
push 0x24444554
push 0x43455252
push 0x4f435f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x40568b
push 0xa0d
push 0x24444e55
push 0x4f465f54
push 0x4f4e5f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0
push 0
push 3
call dword [edi]
cmp dword [ebx + 0xcec], 0
je 0x4057d0
push 0x3e6c
push 0x6d74682f
push 0x3c3e7964
push 0x6f622f3c
push esp
call dword [ebx + 0x38]
add esp, 0x10
cmp dword [ebx + 0xcec], 0
je 0x4056da
push dword [ebx + 0xcec]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebx + 0xcec], 0
push 0x7a
push 0x67002e
lea edx, [ebx + 0xae4]
push edx
lea edx, [ebp - 0x61e]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push esp
lea edx, [ebp - 0x61e]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
add esp, 8
lea edx, [ebp - 0x61e]
push edx
lea edx, [ebx + 0xae4]
push edx
call dword [ebx + 0x48]
test eax, eax
je 0x4057d0
lea edx, [ebx + 0xae4]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x61e]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push 0
push 0
push eax
lea edx, [ebp - 0x20e]
push edx
push 0xffffffffffffffff
lea edx, [ebp - 0x61e]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
lea edx, [ebp - 0x20e]
push edx
call dword [sym.imp.shlwapi.dll_PathStripPathA]
push 0x6d6f
push 0x632e7572
push 0x2e636d6d
mov dword [ebp - 6], esp
push 0
push 0x7068702e
push 0x74736574
push 0x5f6e6163
push 0x5f353063
push 0x37316364
push 0x655f6472
push 0x6f662f74
push 0x7365742f
lea edx, [ebp - 0x20e]
push edx
lea edx, [ebp - 0x61e]
push edx
lea edx, [esp + 8]
push edx
push dword [ebp - 6]
call fcn.00407226
add esp, 0x24
add esp, 0xc
push 0
push esp
push 0x1000001
push 0x40b
push dword [ebx + 0x8e8]
call dword [sym.imp.USER32.DLL_SendMessageW]
add esp, 4
push 0
call dword [ebx + 0x44]
pop edi
leave
ret 8