Function at 0x1004675a
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
mov dword [ebp - 0x140], 0xade
mov dword [ebp - 0x190], 0xebfb2c41
mov dword [ebp - 0x4c], 0
jmp 0x10046787
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x1004679d
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x178], 0xffffffff
jmp 0x10046780
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x178], 0xfffffff3
jmp 0x100467c8
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x178]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x178], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x178], 0xe
je 0x100468f7
mov dword [ebp - 0x184], 0x78f4f823
cmp dword [ebp - 0x140], 0
je 0x100468d0
mov dword [ebp - 0xd4], 0xf5ed9a92
mov dword [ebp - 0x38], 0
jmp 0x1004680c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10046822
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x17c], 0x8dc5336d
jmp 0x10046805
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xd4]
cmp dword [ebp + eax - 0x178], ecx
jg 0x1004683f
mov dword [ebp - 0x60], 1
jmp 0x10046843
and dword [ebp - 0x60], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x60]
je 0x10046857
mov dword [ebp - 0x68], 1
jmp 0x1004685b
and dword [ebp - 0x68], 0
mov eax, 0xba20
test eax, eax
je 0x100468b7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x17c]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x178]
je 0x1004689a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x178], 0
je 0x1004689a
mov dword [ebp - 0xe0], 1
jmp 0x100468a1
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0xe0]
neg eax
je 0x100468b7
mov dword [ebp - 0xf0], 1
jmp 0x100468be
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0xf0]
mov dword [ebp - 0x184], eax
jmp 0x100468de
mov dword [ebp - 0x70], 0xdf9c
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x22], 0
movzx eax, byte [ebp - 0x22]
test eax, eax
je 0x100468f2
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x100467af
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10046e37
mov dword [ebp - 0x28], 0x532fe223
mov dword [ebp - 0x48], 0
jmp 0x1004691a
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x10046930
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x1d8], 0xb9b5
jmp 0x10046913
mov dword [ebp - 0x28], 0
jmp 0x10046940
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x10046ae1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x40], 0
jmp 0x10046961
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x10046977
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x12c], 0x2d67
jmp 0x1004695a
mov dword [ebp - 0x2c], 3
jmp 0x10046987
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x100469b6
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x12c], 0
je 0x1004699e
jmp 0x100469b6
mov byte [ebp - 0x1e], 0
movzx eax, byte [ebp - 0x1e]
test eax, eax
je 0x100469b4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x10046980
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1d8], 0
jne 0x100469d5
cmp dword [ebp - 0x2c], 0
jne 0x100469d5
and dword [ebp - 0x100], 0
jmp 0x100469df
mov dword [ebp - 0x100], 1
cmp dword [ebp - 0x28], 0
jne 0x100469fd
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x12c], 0
jne 0x100469fd
and dword [ebp - 0xf8], 0
jmp 0x10046a07
mov dword [ebp - 0xf8], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x12c]
cmp eax, dword [ebp - 0xf8]
jge 0x10046a24
mov dword [ebp - 0x78], 1
jmp 0x10046a28
and dword [ebp - 0x78], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d8]
cmp dword [ebp - 0x78], eax
jl 0x10046a43
mov dword [ebp - 0x80], 1
jmp 0x10046a47
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x100]
imul eax, dword [ebp - 0x80]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x12c]
jg 0x10046a6c
mov dword [ebp - 0x108], 1
jmp 0x10046a73
and dword [ebp - 0x108], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x12c]
cmp dword [ebp - 0x108], eax
jle 0x10046a93
mov dword [ebp - 0x88], 1
jmp 0x10046a9a
and dword [ebp - 0x88], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x12c]
cmp eax, dword [ebp - 0x88]
je 0x10046acb
mov byte [ebp - 0x20], 0
movzx eax, byte [ebp - 0x20]
test eax, eax
je 0x10046ac9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x10046adc
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x12c], 0
je 0x10046adc
jmp 0x10046ae1
jmp 0x10046939
mov byte [ebp - 0x1d], 0
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x10046e32
mov dword [ebp - 0x10], 0xd1b9849b
mov dword [ebp - 0x14c], 0x93e75cb5
mov dword [ebp - 0xe8], 0xfffffff9
mov dword [ebp - 0x1b0], 0x509ca4f0
mov dword [ebp - 0x180], 0xffffffff
mov dword [ebp - 0x1c4], 0xd132
mov dword [ebp - 0xec], 0xb7f45b6
mov dword [ebp - 0x1c], 0
jmp 0x10046b44
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10046b57
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc], 0x51328f6c
jmp 0x10046b3d
mov dword [ebp - 0x1c], 0
jmp 0x10046b67
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10046b7d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1e4], 0xffffffff
jmp 0x10046b60
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
mov dword [ebp - 0x1c8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
mov dword [ebp - 0x10], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
cmp eax, dword [ebp - 0x10]
jle 0x10046bb5
mov dword [ebp - 0x168], 1
jmp 0x10046bbc
and dword [ebp - 0x168], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
mov dword [ebp - 0x188], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x14c], 0xddd9cd44
jb 0x10046bf4
mov dword [ebp - 0x110], 1
jmp 0x10046bfb
and dword [ebp - 0x110], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
cmp eax, dword [ebp - 0x110]
jle 0x10046c19
mov dword [ebp - 0x90], 1
jmp 0x10046c20
and dword [ebp - 0x90], 0
cmp dword [ebp - 0x90], 0
jg 0x10046c35
mov dword [ebp - 0x118], 1
jmp 0x10046c3c
and dword [ebp - 0x118], 0
imul eax, dword [ebp - 0x118], 0x79a7
test eax, eax
jne 0x10046c56
mov dword [ebp - 0x98], 1
jmp 0x10046c5d
and dword [ebp - 0x98], 0
cmp dword [ebp - 0x98], 0x14a02569
je 0x10046c75
mov dword [ebp - 0x120], 1
jmp 0x10046c7c
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x10], 0
jmp 0x10046c98
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x10046e25
mov dword [ebp - 0x50], 0xfffffff7
mov dword [ebp - 0xac], 0x42628217
mov dword [ebp - 0x18], 0
jmp 0x10046cc3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10046cd9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a8], 0xabf8b243
jmp 0x10046cbc
mov dword [ebp - 0x18], 0
jmp 0x10046ce9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10046cff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x154], 0xffffffff
jmp 0x10046ce2
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xc], 0
je 0x10046d88
cmp dword [ebp - 0xac], 0xed469f41
ja 0x10046d35
mov dword [ebp - 0xa4], 1
jmp 0x10046d3c
and dword [ebp - 0xa4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa4]
sub ecx, dword [ebp + eax - 0xc]
jne 0x10046d67
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e4], 0
jne 0x10046d67
and dword [ebp - 0xe4], 0
jmp 0x10046d71
mov dword [ebp - 0xe4], 1
mov eax, dword [ebp - 0xe4]
sub eax, dword [ebp - 0x10]
je 0x10046d88
mov dword [ebp - 0x164], 1
jmp 0x10046d8f
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x198], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xc], 0
jne 0x10046dd9
mov dword [ebp - 0xb4], 1
jmp 0x10046de0
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xc]
sub eax, dword [ebp - 0xb4]
add eax, 0x7d7c869b
cmp eax, dword [ebp - 0x180]
jge 0x10046e06
mov dword [ebp - 0x114], 1
jmp 0x10046e0d
and dword [ebp - 0x114], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x114]
mov dword [ebp + eax - 0x1a8], ecx
jmp 0x10046c91
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
jmp 0x10047389
mov eax, dword [ebp + 8]
mov dword [ebp - 0x150], eax
mov dword [ebp - 4], 0xc64a6847
mov dword [ebp - 8], 0
mov dword [ebp - 0x30], 0
jmp 0x10046e5e
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x10046e74
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x13c], 0xfff6
jmp 0x10046e57
mov dword [ebp - 4], 0
jmp 0x10046e84
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x15
jle 0x10047045
mov dword [ebp - 0xcc], 0x95031536
mov dword [ebp - 0x104], 0xffffffff
mov dword [ebp - 0x10c], 0x284868fd
mov dword [ebp - 0x54], 0x95610a1
mov dword [ebp - 0x15c], 0xfffffff6
cmp dword [ebp - 0xcc], 0
jne 0x10046fb7
mov eax, 0x9d44c039
test eax, eax
je 0x10046f70
cmp dword [ebp - 0x104], 0
jne 0x10046ee9
mov eax, 0x4ccfd66c
test eax, eax
je 0x10046eed
cmp dword [ebp - 4], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
jg 0x10046f01
mov dword [ebp - 0xbc], 1
jmp 0x10046f08
and dword [ebp - 0xbc], 0
cmp dword [ebp - 0xbc], 0
jne 0x10046f1d
mov dword [ebp - 0xf4], 1
jmp 0x10046f24
and dword [ebp - 0xf4], 0
cmp dword [ebp - 0xf4], 0xdae4f9db
jae 0x10046f3c
mov dword [ebp - 0xc4], 1
jmp 0x10046f43
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x10046f70
mov dword [ebp - 0xfc], 1
jmp 0x10046f77
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xfc], eax
je 0x10046f8e
mov dword [ebp - 0x58], 1
jmp 0x10046f92
and dword [ebp - 0x58], 0
cmp dword [ebp - 0x58], 0xdfe924f6
ja 0x10046fa7
mov dword [ebp - 0x11c], 1
jmp 0x10046fae
and dword [ebp - 0x11c], 0
cmp dword [ebp - 0x11c], 2
jae 0x10046fcc
mov eax, 0x491d
test eax, eax
je 0x10046fcc
mov dword [ebp - 0xdc], 1
jmp 0x10046fd3
and dword [ebp - 0xdc], 0
cmp dword [ebp - 0xdc], 4
jle 0x10046feb
cmp dword [ebp - 0x54], 0
jne 0x10046feb
and dword [ebp - 0x9c], 0
jmp 0x10046ff5
mov dword [ebp - 0x9c], 1
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x9c], eax
je 0x1004700f
mov dword [ebp - 0xa0], 1
jmp 0x10047016
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xa0]
jle 0x1004702d
mov dword [ebp - 0xa8], 1
jmp 0x10047034
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x15c], eax
jmp 0x10046e7d
mov dword [ebp - 4], 1
jmp 0x10047055
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffee
jle 0x100472f2
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x84], 0xdfc7a8f6
mov dword [ebp - 0x148], 0x736453d1
mov dword [ebp - 8], 0
jmp 0x1004708a
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jg 0x100472ed
mov byte [ebp - 0x21], 0
movzx eax, byte [ebp - 0x21]
test eax, eax
je 0x100470b7
push 0x222c
push 0
push 0x15f4
push 0x9e4
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x13c]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x13c], 0
mov eax, dword [ebp - 8]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x13c]
cmp dword [ebp + eax*4 - 0x13c], ecx
je 0x100470f7
mov dword [ebp - 0xb0], 1
jmp 0x100470fe
and dword [ebp - 0xb0], 0
xor eax, eax
sub eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0x14]
imul eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x14]
jge 0x1004711f
mov dword [ebp - 0xb8], 1
jmp 0x10047126
and dword [ebp - 0xb8], 0
cmp dword [ebp - 0xb8], 4
jge 0x1004713b
mov dword [ebp - 0x144], 1
jmp 0x10047142
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x14], 0x55505f45
jge 0x10047160
mov dword [ebp - 0xc0], 1
jmp 0x10047167
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xc0], eax
jle 0x1004717e
mov dword [ebp - 0xc8], 1
jmp 0x10047185
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xc8], eax
jge 0x1004719c
mov dword [ebp - 0xd0], 1
jmp 0x100471a3
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x13c]
cmp dword [ebp - 0xd0], eax
jl 0x100471c1
mov dword [ebp - 0xd8], 1
jmp 0x100471c8
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xd8], eax
jle 0x100471dc
mov dword [ebp - 0x5c], 1
jmp 0x100471e0
and dword [ebp - 0x5c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x5c], eax
je 0x100471f1
mov dword [ebp - 0x64], 1
jmp 0x100471f5
and dword [ebp - 0x64], 0
cmp dword [ebp - 0x64], 4
je 0x10047204
mov dword [ebp - 0x6c], 1
jmp 0x10047208
and dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x6c]
cmp eax, 1
jae 0x1004721d
mov dword [ebp - 0x74], 1
jmp 0x10047221
and dword [ebp - 0x74], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x74], eax
jg 0x10047232
mov dword [ebp - 0x7c], 1
jmp 0x10047236
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x18c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x13c]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x13c], 0
jne 0x10047277
mov dword [ebp - 0x8c], 1
jmp 0x1004727e
and dword [ebp - 0x8c], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x8c], eax
jge 0x10047298
mov dword [ebp - 0x94], 1
jmp 0x1004729f
and dword [ebp - 0x94], 0
cmp dword [ebp - 0x94], 0x14a1
je 0x100472d6
mov byte [ebp - 0x1f], 0
movzx eax, byte [ebp - 0x1f]
test eax, eax
je 0x100472d4
push 0
push 0x2367
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x100472e8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x13c], 0
je 0x100472e8
jmp 0x100472ed
jmp 0x10047083
jmp 0x1004704e
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
movzx eax, byte [eax]
test eax, eax
je 0x10047389
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x34], 0
jmp 0x10047322
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x10047338
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x19c], 0xffffffff
jmp 0x1004731b
mov dword [ebp - 0x3c], 0
jmp 0x10047348
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jg 0x10047383
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x44], 0
jmp 0x10047365
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x10047381
mov dword [ebp - 0x160], 0xfffc
mov dword [ebp - 0x160], 0x7e55059b
jmp 0x1004735e
jmp 0x10047341
call dword [sym.imp.USER32.dll_CreateMenu]
mov esp, ebp
pop ebp
ret