Function at 0x1004ead6
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8e4
mov dword [ebp - 0x1bc], 0
jmp 0x1004eaf8
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 4
jge 0x1004eb14
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0x6a8], 6
jmp 0x1004eaeb
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x6a8], 5
jmp 0x1004eb3f
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x6a8]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x6a8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x6a8], 0xf
jle 0x1004ec2b
mov dword [ebp - 0x114], 0xf4a8b108
mov dword [ebp - 0x198], 0
jmp 0x1004eb75
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jge 0x1004eb91
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x764], 0x4b13281d
jmp 0x1004eb68
mov dword [ebp - 0x114], 0
jmp 0x1004ebaa
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffe6
jle 0x1004ec26
mov dword [ebp - 0x1b0], 0xfffffffc
mov dword [ebp - 0x1b0], 0
jmp 0x1004ebd6
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jge 0x1004ec21
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe4], 1
jmp 0x1004ec02
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jl 0x1004ec1f
mov eax, dword [ebp - 0xe4]
cmp dword [ebp + eax*4 - 0x764], 0
je 0x1004ec1d
jmp 0x1004ec1f
jmp 0x1004ebf5
jmp 0x1004ebc9
jmp 0x1004eb9d
jmp 0x1004eb26
mov byte [ebp - 0xa0], 0
movzx eax, byte [ebp - 0xa0]
test eax, eax
je 0x1004ec57
push 0x1205
push 0xbf4
push 0x12c3
push 0x190d
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov dword [ebp - 0xd8], 4
mov dword [ebp - 0xe0], 0xc2285faa
mov dword [ebp - 0x878], 0x72d9ee1c
mov dword [ebp - 0x874], 0x72d9ee1c
mov dword [ebp - 0x870], 0x72d9ee1c
mov dword [ebp - 0x86c], 0x72d9ee1c
mov dword [ebp - 0xa8], 0xcb972524
mov dword [ebp - 0x11c], 0
jmp 0x1004ecb6
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jge 0x1004ecd2
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x12c], 0x648261f
jmp 0x1004eca9
mov dword [ebp - 0xd8], 0
jmp 0x1004eceb
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x1004edac
mov dword [ebp - 0x124], 0xffffffff
mov dword [ebp - 0x190], 0
jmp 0x1004ed1b
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 2
jge 0x1004ed37
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x898], 1
jmp 0x1004ed0e
mov dword [ebp - 0x124], 0
jmp 0x1004ed50
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jg 0x1004eda7
mov dword [ebp - 0x724], 0xffffffff
mov dword [ebp - 0x1a8], 0
jmp 0x1004ed7c
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x1004ed98
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x8d8], 0x9310c13f
jmp 0x1004ed6f
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
jmp 0x1004ed43
jmp 0x1004ecde
mov dword [ebp - 0xa8], 0
jmp 0x1004edc5
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
je 0x1004f022
mov dword [ebp - 0x2c], 0xcb6a
mov dword [ebp - 0x53c], 0x20c256fa
mov eax, 0x42c7
test eax, eax
je 0x1004eea1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x12c], 0
jne 0x1004ee19
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x12c], 0
jne 0x1004ee19
and dword [ebp - 0x4fc], 0
jmp 0x1004ee23
mov dword [ebp - 0x4fc], 1
cmp dword [ebp - 0x4fc], 0x7fefb659
jge 0x1004ee3b
mov dword [ebp - 0x528], 1
jmp 0x1004ee42
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x528], eax
jg 0x1004ee5c
mov dword [ebp - 0x48c], 1
jmp 0x1004ee63
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x48c]
test eax, eax
je 0x1004ee8d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x12c], 0
je 0x1004ee8d
mov dword [ebp - 0x498], 1
jmp 0x1004ee94
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x498]
cmp dword [ebp - 0x2c], eax
mov eax, 0x7cd3e5c7
test eax, eax
je 0x1004eeba
xor eax, eax
je 0x1004eeba
mov dword [ebp - 0x21c], 1
jmp 0x1004eec1
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x21c], eax
jle 0x1004eedb
mov dword [ebp - 0x4a0], 1
jmp 0x1004eee2
and dword [ebp - 0x4a0], 0
cmp dword [ebp - 0x4a0], 0xfffffff9
jbe 0x1004eef4
cmp dword [ebp - 0xd8], 0
je 0x1004ef10
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x12c], 0
je 0x1004ef10
mov dword [ebp - 0x224], 1
jmp 0x1004ef17
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x224]
dec eax
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jge 0x1004ef32
mov dword [ebp - 0x4a8], 1
jmp 0x1004ef39
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x4a8]
cmp dword [ebp - 0x2c], eax
je 0x1004ef53
mov dword [ebp - 0x22c], 1
jmp 0x1004ef5a
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 9
jge 0x1004ef6f
mov dword [ebp - 0x4b0], 1
jmp 0x1004ef76
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0xffffffff
ja 0x1004ef8b
mov dword [ebp - 0x234], 1
jmp 0x1004ef92
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x234]
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0x2c], 0
jmp 0x1004efb1
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x1004f01d
mov dword [ebp - 0xe0], 0
jmp 0x1004efd0
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x1004f01b
mov byte [ebp - 0xa3], 0
movzx eax, byte [ebp - 0xa3]
test eax, eax
je 0x1004f019
push 0
push 0x7a2
push 0
push 0
push 0x1864
push 0x1176
push 0x26f6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
jmp 0x1004efc3
jmp 0x1004efaa
jmp 0x1004edb8
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x1c0], 0x29b3a00d
mov dword [ebp - 0x170], 0
jmp 0x1004f04c
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jge 0x1004f068
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x5d0], 0xec2e0cf5
jmp 0x1004f03f
mov dword [ebp - 0x5c], 0
jmp 0x1004f078
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jg 0x1004f0a1
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x1004f09f
push 0x5d3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x1004f071
cmp dword [ebp - 0x5c], 0
jne 0x1004f12b
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x5c], eax
je 0x1004f0c2
mov dword [ebp - 0x4b8], 1
jmp 0x1004f0c9
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xd9a2b82c
ja 0x1004f0e7
mov dword [ebp - 0x23c], 1
jmp 0x1004f0ee
and dword [ebp - 0x23c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5d0]
cmp dword [ebp - 0x23c], eax
je 0x1004f10f
mov dword [ebp - 0x4c0], 1
jmp 0x1004f116
and dword [ebp - 0x4c0], 0
cmp dword [ebp - 0x4c0], 0xf746
jge 0x1004f12b
and dword [ebp - 0x244], 0
jmp 0x1004f135
mov dword [ebp - 0x244], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5d0]
cmp dword [ebp - 0x244], eax
jl 0x1004f156
mov dword [ebp - 0x4c8], 1
jmp 0x1004f15d
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
sub eax, dword [ebp - 0x1c0]
sub eax, 0x5034859b
je 0x1004f188
cmp dword [ebp - 0x5c], 0
je 0x1004f188
cmp dword [ebp - 0x5c], 0
je 0x1004f188
mov dword [ebp - 0x24c], 1
jmp 0x1004f18f
and dword [ebp - 0x24c], 0
cmp dword [ebp - 0x24c], 0xfffe
jbe 0x1004f1a7
mov dword [ebp - 0x574], 1
jmp 0x1004f1ae
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x720], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5d0]
mov dword [ebp - 0x728], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5d0], 0xe0752570
jb 0x1004f1ec
mov dword [ebp - 0x4d0], 1
jmp 0x1004f1f3
and dword [ebp - 0x4d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp + eax - 0x5d0], ecx
mov dword [ebp - 0x134], 0
jmp 0x1004f21f
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x1004f23b
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x698], 6
jmp 0x1004f212
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x698], 5
jmp 0x1004f266
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x698]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x698], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x698], 0xf
jle 0x1005053b
mov dword [ebp - 0xf4], 0xc68ec0ae
mov dword [ebp - 0x57c], 1
mov dword [ebp - 0xf4], 0x19
jmp 0x1004f2a6
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xfffffff7
jne 0x1004f47b
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x54], 0x6c74aa0d
mov dword [ebp - 0x6b8], 0xd145
mov dword [ebp - 0x6b4], 0xd145
mov dword [ebp - 0x6b0], 0xd145
mov dword [ebp - 0x6ac], 0xd145
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x54], eax
je 0x1004f300
mov dword [ebp - 0x254], 1
jmp 0x1004f307
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x730], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x6b8], 0
jne 0x1004f331
mov eax, 0x44401d1b
test eax, eax
jne 0x1004f331
and dword [ebp - 0x4d8], 0
jmp 0x1004f33b
mov dword [ebp - 0x4d8], 1
mov eax, dword [ebp - 0x254]
cmp eax, dword [ebp - 0x4d8]
jge 0x1004f355
mov dword [ebp - 0x25c], 1
jmp 0x1004f35c
and dword [ebp - 0x25c], 0
mov dword [ebp - 0x4c], 0xffffffff
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x25c]
je 0x1004f436
mov dword [ebp - 0x54], 3
jmp 0x1004f382
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1004f3bc
mov dword [ebp - 0x57c], 0xffffffff
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x1004f3ba
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
jmp 0x1004f37b
mov dword [ebp - 0x54], 0
jmp 0x1004f3cc
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x1004f434
mov dword [ebp - 0x5f8], 0x2d62
mov dword [ebp - 0x4c], 0
jmp 0x1004f3ec
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x1004f410
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x1004f40e
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1004f3e5
mov dword [ebp - 0x4c], 0
jmp 0x1004f420
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x1004f432
mov dword [ebp - 0x5f8], 0xfffffff8
jmp 0x1004f419
jmp 0x1004f3c5
jmp 0x1004f476
mov byte [ebp - 0x98], 0
movzx eax, byte [ebp - 0x98]
test eax, eax
je 0x1004f455
push 0x597
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
mov byte [ebp - 0x9a], 0
movzx eax, byte [ebp - 0x9a]
test eax, eax
je 0x1004f476
push 0
push 0x7dc
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x1004f299
mov byte [ebp - 0x9c], 0
movzx eax, byte [ebp - 0x9c]
test eax, eax
je 0x1004f49b
push 0
push 0
push 7
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [ebp - 0x14c], 0xf4a8b108
mov dword [ebp - 8], 1
mov dword [ebp - 0x2f8], 0x7e6ef1f7
mov dword [ebp - 0x174], 0
jmp 0x1004f4cf
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jge 0x1004f4e8
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0xc], 0x5b57fd54
jmp 0x1004f4c2
mov dword [ebp - 8], 0
jmp 0x1004f4f8
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x1004fceb
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x84], 0x9f8c5172
mov dword [ebp - 0x204], 0xfffffffd
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0xc], 0
je 0x1004f53d
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0xc], 0
jne 0x1004f53d
mov dword [ebp - 0x4e0], 1
jmp 0x1004f544
and dword [ebp - 0x4e0], 0
cmp dword [ebp - 0x4e0], 0xfffffffc
jae 0x1004f559
mov dword [ebp - 0x264], 1
jmp 0x1004f560
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x264], 2
jl 0x1004f575
mov dword [ebp - 0x4e8], 1
jmp 0x1004f57c
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 8]
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x4e8]
sub edx, dword [ebp + ecx - 0xc]
cmp dword [ebp + eax*4 - 0xc], edx
jge 0x1004f5a1
mov dword [ebp - 0x26c], 1
jmp 0x1004f5a8
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0xc]
cmp dword [ebp - 0x26c], eax
jne 0x1004f5c3
mov dword [ebp - 0x4f0], 1
jmp 0x1004f5ca
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0x4f0]
cmp dword [ebp + eax*4 - 0xc], ecx
jle 0x1004f5e9
mov dword [ebp - 0x274], 1
jmp 0x1004f5f0
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0
jmp 0x1004f609
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jg 0x1004fce6
mov dword [ebp - 0x50], 0x8fb8
mov dword [ebp - 0x14], 0xd8d92426
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0xc]
cmp dword [ebp + eax - 0xc], ecx
jne 0x1004f640
mov dword [ebp - 0x56c], 1
jmp 0x1004f647
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
sub eax, dword [ebp + ecx*4 - 0xc]
je 0x1004f67b
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0xc], 0
je 0x1004f67b
mov dword [ebp - 0x548], 1
jmp 0x1004f682
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x748], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0xc], ecx
je 0x1004f6a9
mov dword [ebp - 0x4f8], 1
jmp 0x1004f6b0
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
sub eax, dword [ebp - 0x14]
cmp eax, 0xa81d
jge 0x1004f6cc
mov dword [ebp - 0x27c], 1
jmp 0x1004f6d3
and dword [ebp - 0x27c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc]
cmp dword [ebp - 0x27c], eax
je 0x1004f6f4
cmp dword [ebp - 0x14], 0
jne 0x1004f6f4
and dword [ebp - 0x500], 0
jmp 0x1004f6fe
mov dword [ebp - 0x500], 1
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x50], 1
jbe 0x1004f725
mov dword [ebp - 0x508], 1
jmp 0x1004f72c
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x758], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc], 0xffffffff
jge 0x1004f74e
mov dword [ebp - 0x284], 1
jmp 0x1004f755
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x284]
neg eax
mov ecx, dword [ebp - 8]
add eax, dword [ebp + ecx*4 - 0xc]
cmp dword [ebp - 0x508], eax
jge 0x1004f778
mov dword [ebp - 0x28c], 1
jmp 0x1004f77f
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x28c]
sub eax, dword [ebp - 0x14]
cmp eax, 0x6ba05392
jg 0x1004f7a1
cmp dword [ebp - 0x14], 0
je 0x1004f7a1
mov dword [ebp - 0x510], 1
jmp 0x1004f7a8
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x510], eax
je 0x1004f7bf
mov dword [ebp - 0x294], 1
jmp 0x1004f7c6
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x294]
neg eax
cmp eax, dword [ebp - 8]
jle 0x1004fbaf
mov dword [ebp - 0x78], 0x890aaf75
mov dword [ebp - 0x2d8], 0xad5889e5
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x7d0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp + eax - 0xc]
mov dword [ebp - 0x518], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x518]
mov dword [ebp + eax*4 - 0xc], ecx
cmp dword [ebp - 0x518], 0
je 0x1004f830
cmp dword [ebp - 0x14], 0
je 0x1004f830
mov dword [ebp - 0x520], 1
jmp 0x1004f837
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x78], eax
je 0x1004f854
mov dword [ebp - 0x2a0], 1
jmp 0x1004f85b
and dword [ebp - 0x2a0], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x2a0]
cmp eax, 0xec6b039b
jbe 0x1004f877
mov dword [ebp - 0x3e8], 1
jmp 0x1004f87e
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3e8]
je 0x1004f895
mov dword [ebp - 0x2a8], 1
jmp 0x1004f89c
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x78], 0
jmp 0x1004f8b8
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x33
jg 0x1004fbaa
mov dword [ebp - 0x3f0], 0x2d7faeff
mov dword [ebp - 0x200], 1
mov dword [ebp - 0x2d0], 0xfffffffa
mov dword [ebp - 0x13c], 5
mov eax, dword [ebp - 8]
mov dword [ebp - 0x7d8], eax
cmp dword [ebp - 0x3c], 1
jle 0x1004f905
mov dword [ebp - 0x488], 1
jmp 0x1004f90c
and dword [ebp - 0x488], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x488]
dec ecx
cmp dword [ebp + eax - 0xc], ecx
jne 0x1004f92b
mov dword [ebp - 0x2b0], 1
jmp 0x1004f932
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x2b0], eax
jle 0x1004f94c
mov dword [ebp - 0x2b8], 1
jmp 0x1004f953
and dword [ebp - 0x2b8], 0
mov dword [ebp - 0x3f0], 0xffffffff
mov eax, dword [ebp - 0x3f0]
cmp eax, dword [ebp - 0x2b8]
jg 0x1004f977
mov dword [ebp - 0x5f4], 1
jmp 0x1004f97e
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x7e0], eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0x3c]
je 0x1004f9a1
mov dword [ebp - 0x4dc], 1
jmp 0x1004f9a8
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x4dc], eax
je 0x1004f9bf
mov dword [ebp - 0x2c0], 1
jmp 0x1004f9c6
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x2c0], eax
jge 0x1004f9e0
mov dword [ebp - 0x3f8], 1
jmp 0x1004f9e7
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x2d0]
cmp dword [ebp - 0x3f8], eax
jne 0x1004fa01
mov dword [ebp - 0x2c8], 1
jmp 0x1004fa08
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0
jb 0x1004fa1d
mov dword [ebp - 0x494], 1
jmp 0x1004fa24
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x7e8], eax
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x14], 0xd1e
jne 0x1004fa5d
mov dword [ebp - 0x400], 1
jmp 0x1004fa64
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0x400]
test eax, eax
je 0x1004fb9c
mov dword [ebp - 0x2e8], 0xaf6502fc
mov dword [ebp - 0x84], 0xd
jmp 0x1004fa99
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xfffffffa
je 0x1004fad4
mov dword [ebp - 0x550], 0xfffffffd
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x2d8], eax
mov byte [ebp - 0x9e], 0
movzx eax, byte [ebp - 0x9e]
test eax, eax
je 0x1004fad2
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
jmp 0x1004fa8c
mov dword [ebp - 0x14], 0x7236
cmp dword [ebp - 0x14], 0x8a9b
jl 0x1004faf0
mov dword [ebp - 0x504], 1
jmp 0x1004faf7
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x13c]
imul eax, dword [ebp - 0x504]
test eax, eax
je 0x1004fb3f
cmp dword [ebp - 0x50], 0
jne 0x1004fb1a
mov dword [ebp - 0x2e0], 1
jmp 0x1004fb21
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x2e0]
inc eax
je 0x1004fb3f
cmp dword [ebp - 0x13c], 0
je 0x1004fb3f
mov dword [ebp - 0x408], 1
jmp 0x1004fb46
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x2e8], 0x2da2ea9
cmp dword [ebp - 0x2e8], 0x8c34f7c3
jb 0x1004fb6b
mov dword [ebp - 0x49c], 1
jmp 0x1004fb72
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x49c], 1
jne 0x1004fb87
mov dword [ebp - 0x2f0], 1
jmp 0x1004fb8e
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x84], eax
jmp 0x1004fba5
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x14], eax
jmp 0x1004f8b1
jmp 0x1004fce1
mov dword [ebp - 0x1cc], 1
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0xc], 0xcfc2
jle 0x1004fbd2
mov dword [ebp - 0x418], 1
jmp 0x1004fbd9
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x1cc], 0
jne 0x1004fc19
cmp dword [ebp - 0x50], 0xffffffff
jge 0x1004fbf4
mov dword [ebp - 0x410], 1
jmp 0x1004fbfb
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0
jne 0x1004fc19
and dword [ebp - 0x4e4], 0
jmp 0x1004fc23
mov dword [ebp - 0x4e4], 1
mov eax, dword [ebp - 0x4e4]
add eax, 0x414c507b
jne 0x1004fc3f
cmp dword [ebp - 0x50], 0
jne 0x1004fc3f
and dword [ebp - 0x300], 0
jmp 0x1004fc49
mov dword [ebp - 0x300], 1
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x300], eax
je 0x1004fc63
mov dword [ebp - 0x5bc], 1
jmp 0x1004fc6a
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x824], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x14], eax
jle 0x1004fca2
mov dword [ebp - 0x308], 1
jmp 0x1004fca9
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x418]
neg eax
mov ecx, dword [ebp - 0x1cc]
imul ecx, dword [ebp - 0x308]
cmp eax, ecx
jle 0x1004fcce
mov dword [ebp - 0x4a4], 1
jmp 0x1004fcd5
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x84], eax
jmp 0x1004f602
jmp 0x1004f4f1
mov dword [ebp - 0x17c], 0x9a3df603
mov dword [ebp - 0x83c], 1
mov dword [ebp - 0x844], 0xd714f98c
mov dword [ebp - 0x84c], 0x4e665969
mov dword [ebp - 0x854], 5
mov dword [ebp - 0x85c], 0
mov dword [ebp - 0x864], 8
mov dword [ebp - 0x6c4], 0
mov dword [ebp - 0x7b4], 9
mov dword [ebp - 0x6cc], 0
mov dword [ebp - 0x820], 0xffffffff
mov dword [ebp - 0x6d4], 0xfffffffc
mov dword [ebp - 0x310], 0xffff
mov dword [ebp - 0x7bc], 0xe2caeaba
mov dword [ebp - 0x70], 0
jmp 0x1004fd87
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1004fd9d
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x558], 0x1124f01c
jmp 0x1004fd80
mov dword [ebp - 0x70], 0
jmp 0x1004fdad
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1004fdc3
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x8a0], 0x74d4b4b2
jmp 0x1004fda6
mov dword [ebp - 0x17c], 0
jmp 0x1004fddc
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jg 0x1004ff35
mov dword [ebp - 0x6dc], 0xffffffff
mov dword [ebp - 0x848], 0x91df82
mov dword [ebp - 0x6e4], 1
mov dword [ebp - 0x7c4], 0xbe76d238
mov dword [ebp - 0x6ec], 0
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x6f4], 0x19fa553f
mov dword [ebp - 0x64], 0
jmp 0x1004fe3f
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1004fe55
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xec], 9
jmp 0x1004fe38
mov dword [ebp - 0x64], 0
jmp 0x1004fe65
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1004fe7b
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x8cc], 0xb333ee6
jmp 0x1004fe5e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xec], 0
jmp 0x1004fea9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xec], 0
jl 0x1004ff30
mov dword [ebp - 0x7cc], 0xb048
mov dword [ebp - 0x6fc], 0
mov dword [ebp - 0x144], 0
jmp 0x1004fee6
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x1004ff02
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x8c0], 0x3989226c
jmp 0x1004fed9
mov eax, dword [ebp - 0x310]
dec eax
mov dword [ebp - 0x310], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
cmp dword [ebp + eax*4 - 0x558], 0
je 0x1004ff2b
jmp 0x1004fe8e
jmp 0x1004fe8e
jmp 0x1004fdcf
mov dword [ebp - 0x184], 0
jmp 0x1004ff4e
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x1004ff6a
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x77c], 0x4b13281d
jmp 0x1004ff41
mov dword [ebp - 0x14c], 0
jmp 0x1004ff83
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffe6
jle 0x10050536
mov dword [ebp - 0x24], 0xd8da
mov dword [ebp - 0x868], 0xfffffff6
mov dword [ebp - 0x18c], 0
jmp 0x1004ffba
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x1004ffd6
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x614], 0x20b963ab
jmp 0x1004ffad
mov dword [ebp - 0x24], 0x5d6c05ba
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1004fff1
mov dword [ebp - 0x318], 1
jmp 0x1004fff8
and dword [ebp - 0x318], 0
cmp dword [ebp - 0x24], 0
je 0x1005001b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
je 0x1005001b
mov dword [ebp - 0x420], 1
jmp 0x10050022
and dword [ebp - 0x420], 0
cmp dword [ebp - 0x420], 0
jae 0x10050037
mov dword [ebp - 0x524], 1
jmp 0x1005003e
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x318]
add eax, dword [ebp - 0x524]
cmp eax, dword [ebp - 0x24]
jle 0x1005005b
mov dword [ebp - 0x320], 1
jmp 0x10050062
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x320], eax
jg 0x10050272
mov dword [ebp - 0x584], 0x667120dd
mov dword [ebp - 0x154], 0
jmp 0x10050094
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x100500b0
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x770], 9
jmp 0x10050087
mov dword [ebp - 0x24], 0
jmp 0x100500c0
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jg 0x10050270
mov dword [ebp - 0x194], 0
jmp 0x100500e3
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
jge 0x100500ff
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x20c], 0x3203bd65
jmp 0x100500d6
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x20c], 1
jmp 0x1005012d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x20c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x20c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x20c], 0
jl 0x1005026b
mov dword [ebp - 0x60c], 0xffffffff
mov dword [ebp - 0x608], 0xffffffff
mov dword [ebp - 0x604], 0xffffffff
mov dword [ebp - 0x600], 0xffffffff
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x60c], 0
jmp 0x10050194
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x60c]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x60c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x60c], 1
jg 0x10050266
mov dword [ebp - 0x15c], 0
jmp 0x100501c0
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 4
jge 0x100501dc
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x688], 0
jmp 0x100501b3
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x688], 1
jmp 0x1005020a
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x688]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x688], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x688], 0
jl 0x10050248
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x20c]
mov eax, dword [ebp + eax*4 - 0x614]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x770]
sub ecx, 8
add eax, ecx
mov dword [ebp - 0x584], eax
jmp 0x100501ef
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x20c]
cmp dword [ebp + eax*4 - 0x614], 0
je 0x10050261
jmp 0x10050266
jmp 0x1005017b
jmp 0x10050112
jmp 0x100500b9
jmp 0x100502c2
mov dword [ebp - 0x19c], 0
jmp 0x1005028b
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jge 0x100502a7
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x7f8], 0x6966ef3b
jmp 0x1005027e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7f8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7f8], eax
mov dword [ebp - 0x164], 0xfffffffc
mov dword [ebp - 0x164], 0
jmp 0x100502e5
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jge 0x10050531
mov dword [ebp - 0x7d4], 1
mov dword [ebp - 0x70c], 0x256915a1
mov dword [ebp - 0x830], 0xfffffffa
mov dword [ebp - 0x714], 0x5cd53bc6
mov dword [ebp - 0x428], 1
mov dword [ebp - 0x328], 0xffffffff
mov dword [ebp - 0x1a4], 0
jmp 0x10050347
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jge 0x10050363
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x8e4], 0xffffffff
jmp 0x1005033a
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x328]
dec eax
mov dword [ebp - 0x328], eax
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xdc], 1
jmp 0x100503a0
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jl 0x1005052c
mov dword [ebp - 0x810], 0xfffffffb
mov dword [ebp - 0x80c], 0xfffffffb
mov dword [ebp - 0x808], 0xfffffffb
mov dword [ebp - 0x804], 0xfffffffb
mov dword [ebp - 0x16c], 1
mov dword [ebp - 0x16c], 3
jmp 0x100503f8
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jl 0x1005048c
mov dword [ebp - 0xfc], 0xffffffff
mov dword [ebp - 0xfc], 0xc7c8a6b9
mov dword [ebp - 0xfc], 0
jmp 0x10050432
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jg 0x10050487
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1005045a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x10050485
push 0x16b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp 0x10050425
jmp 0x100503eb
mov dword [ebp - 0x7ac], 0
mov dword [ebp - 0x7a8], 0
mov dword [ebp - 0x7a4], 0
mov dword [ebp - 0x7a0], 0
mov dword [ebp - 0x1ac], 0xe5ccc90a
mov dword [ebp - 0x7dc], 1
mov dword [ebp - 0x1ac], 0
jmp 0x100504e1
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jg 0x10050515
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x10050513
push 0x2029
push 0xa86
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x100504d4
mov eax, dword [ebp - 0xdc]
cmp dword [ebp + eax*4 - 0x77c], 0
je 0x10050527
jmp 0x1005052c
jmp 0x10050393
jmp 0x100502d8
jmp 0x1004ff76
jmp 0x1004f24d
mov dword [ebp - 0xbc], 0xfffffffc
mov dword [ebp - 0xc8], 0xa7d2ae85
mov dword [ebp - 0xd0], 3
mov dword [ebp - 0xe8], 0xfffffffd
mov dword [ebp - 0x20], 0
jmp 0x10050573
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10050589
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x108], 1
jmp 0x1005056c
mov dword [ebp - 0x20], 0
jmp 0x10050599
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x100505af
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x678], 0x28d5
jmp 0x10050592
mov dword [ebp - 0x20], 0
jmp 0x100505bf
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x100505d5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x884], 1
jmp 0x100505b8
mov dword [ebp - 0xbc], 0x713e19f2
mov eax, dword [ebp - 0xbc]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x678]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x108]
jg 0x1005060c
mov dword [ebp - 0x4ac], 1
jmp 0x10050613
and dword [ebp - 0x4ac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x108]
cmp dword [ebp - 0x4ac], eax
jne 0x10050634
mov dword [ebp - 0x330], 1
jmp 0x1005063b
and dword [ebp - 0x330], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108]
cmp dword [ebp - 0x330], eax
jne 0x1005065c
mov dword [ebp - 0x430], 1
jmp 0x10050663
and dword [ebp - 0x430], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x430]
sub ecx, dword [ebp + eax - 0x678]
cmp ecx, 1
jle 0x10050686
mov dword [ebp - 0x338], 1
jmp 0x1005068d
and dword [ebp - 0x338], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108]
imul eax, dword [ebp - 0x338]
mov dword [ebp - 0x4ec], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4ec]
mov dword [ebp + eax - 0x884], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108]
cmp dword [ebp - 0x4ec], eax
jne 0x100506ea
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x108], 0
je 0x100506ea
mov dword [ebp - 0x340], 1
jmp 0x100506f1
and dword [ebp - 0x340], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108]
cmp dword [ebp - 0x340], eax
je 0x10050712
mov dword [ebp - 0x438], 1
jmp 0x10050719
and dword [ebp - 0x438], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x678]
cmp dword [ebp - 0x438], eax
jne 0x10050742
mov eax, 0xadaa
test eax, eax
je 0x10050742
mov dword [ebp - 0x348], 1
jmp 0x10050749
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jne 0x1005076f
xor eax, eax
inc eax
je 0x1005076f
mov dword [ebp - 0x4b4], 1
jmp 0x10050776
and dword [ebp - 0x4b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4b4]
add ecx, 0x50c8
cmp dword [ebp + eax - 0x108], ecx
jge 0x1005079d
mov dword [ebp - 0x350], 1
jmp 0x100507a4
and dword [ebp - 0x350], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108]
cmp dword [ebp - 0x350], eax
jge 0x100507c5
mov dword [ebp - 0x440], 1
jmp 0x100507cc
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x108]
cmp eax, 0x9ab8
jle 0x100507fe
mov dword [ebp - 0x358], 1
jmp 0x10050805
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xbc], 0xc
jmp 0x1005082a
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xb
jl 0x10050948
mov dword [ebp - 0x1b4], 0
jmp 0x10050850
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x1005086c
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x788], 0xfffffffb
jmp 0x10050843
mov dword [ebp - 0xe8], 0xfffffff5
jmp 0x10050885
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
je 0x10050943
mov dword [ebp - 0xd0], 0xffffffef
jmp 0x100508ab
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xfffffffe
jle 0x1005093e
mov dword [ebp - 0x10c], 0
jmp 0x100508d1
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x100508ed
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x71c], 0xf75df156
jmp 0x100508c4
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x788], 0xfffffffb
mov dword [ebp - 0xc8], 0
jmp 0x10050917
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 9
jge 0x10050939
mov dword [ebp - 0x50c], 0x398e
mov eax, dword [ebp - 0x50c]
dec eax
mov dword [ebp - 0x50c], eax
jmp 0x1005090a
jmp 0x1005089e
jmp 0x10050878
jmp 0x1005081d
mov dword [ebp - 0x7c], 0xbcd8c45
mov dword [ebp - 0x378], 0xffffffff
mov dword [ebp - 0x178], 0
jmp 0x10050972
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x1005098e
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x5e0], 0xffffffff
jmp 0x10050965
mov byte [ebp - 0x97], 0
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x100509bb
push 0
push 0x1cfd
push 0
push 0
push 0x8c0
push 0x1f99
call dword [sym.imp.USER32.dll_ToAsciiEx]
cmp dword [ebp - 0x7c], 0
je 0x10050ba0
mov dword [ebp - 0x1b8], 0
jmp 0x100509de
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 4
jge 0x100509fa
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x8b8], 0x20348f4a
jmp 0x100509d1
mov dword [ebp - 0x7c], 2
jmp 0x10050a0a
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jl 0x10050b9e
mov dword [ebp - 0xb0], 0
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x10050a4d
push 0
push 0xf31
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov dword [ebp - 0xb0], 0
jmp 0x10050a66
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jg 0x10050b99
mov eax, dword [ebp - 0xb0]
cmp dword [ebp + eax*4 - 0x5e0], 0
je 0x10050a9c
mov eax, dword [ebp - 0x7c]
cmp dword [ebp + eax*4 - 0x5e0], 0
je 0x10050a9c
mov dword [ebp - 0x360], 1
jmp 0x10050aa3
and dword [ebp - 0x360], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8b8]
mov dword [ebp - 0x850], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x7c]
cmp dword [ebp + eax - 0x5e0], ecx
jl 0x10050ad3
mov dword [ebp - 0x448], 1
jmp 0x10050ada
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x360]
cmp eax, dword [ebp - 0x448]
je 0x10050af4
mov dword [ebp - 0x368], 1
jmp 0x10050afb
and dword [ebp - 0x368], 0
cmp dword [ebp - 0x368], 0x934f
je 0x10050b13
mov dword [ebp - 0x4bc], 1
jmp 0x10050b1a
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp + eax*4 - 0x5e0]
cmp dword [ebp - 0x4bc], eax
jg 0x10050b41
cmp dword [ebp - 0xb0], 0
jne 0x10050b41
and dword [ebp - 0x370], 0
jmp 0x10050b4b
mov dword [ebp - 0x370], 1
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x370], eax
jg 0x10050b62
mov dword [ebp - 0x450], 1
jmp 0x10050b69
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x378], eax
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x10050b94
push 0xd66
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
jmp 0x10050a59
jmp 0x10050a03
jmp 0x10050bb3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5e0]
mov dword [ebp - 0x378], eax
mov byte [ebp - 0x95], 0
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0xc0], 0xe28de637
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x68], 0
jmp 0x10050be8
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x10050bfe
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x560], 0x94a1888
jmp 0x10050be1
mov dword [ebp - 0x68], 0
jmp 0x10050c0e
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x10050c24
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x890], 0xe9323d1b
jmp 0x10050c07
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc4]
cmp dword [ebp + eax - 0x560], ecx
jl 0x10050cb1
mov dword [ebp - 0x4f4], 0xffffffff
mov dword [ebp - 0x7e4], 1
mov dword [ebp - 0x180], 0
jmp 0x10050c66
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x10050c82
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x72c], 0x54a20a2
jmp 0x10050c59
mov dword [ebp - 0x4f4], 0xfffffffb
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4f4]
mov dword [ebp + eax - 0x890], ecx
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
jmp 0x10050dcf
mov dword [ebp - 0x458], 0xc3fc0233
mov dword [ebp - 0x568], 0
mov dword [ebp - 0xc0], 0
jmp 0x10050cde
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x25
jge 0x10050d5b
mov dword [ebp - 0x598], 0xfffffffa
cmp dword [ebp - 0x598], 0
jne 0x10050d0c
cmp dword [ebp - 0xc4], 0
jne 0x10050d0c
and dword [ebp - 0x380], 0
jmp 0x10050d16
mov dword [ebp - 0x380], 1
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x568], eax
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x10050d56
push 0x21a4
push 0
push 0
push 0xb70
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
jmp 0x10050cd1
mov dword [ebp - 0xc4], 0xffffffee
jmp 0x10050d74
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xfffffffb
jne 0x10050dcf
mov dword [ebp - 0x1a0], 0
jmp 0x10050d96
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 2
jge 0x10050db2
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x63c], 0xffff
jmp 0x10050d89
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x63c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x63c], eax
jmp 0x10050d67
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x10050df4
push 0x1205
push 0xbf4
push 0x12c3
push 0x190d
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5a8], eax
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0x1ec], 0xa7ab5bf7
mov dword [ebp - 0x570], 0xfffffffc
mov dword [ebp - 0x44], 0
jmp 0x10050e32
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 6
jge 0x1005113b
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x6c], 0
jmp 0x10050e53
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10050e69
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x634], 0x997736ea
jmp 0x10050e4c
mov dword [ebp - 0x6c], 0
jmp 0x10050e79
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10050e8f
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x624], 0
jmp 0x10050e72
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x44], 1
jne 0x10050eb3
mov dword [ebp - 0x388], 1
jmp 0x10050eba
and dword [ebp - 0x388], 0
cmp dword [ebp - 0x388], 8
jne 0x10050ecf
mov dword [ebp - 0x4c4], 1
jmp 0x10050ed6
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x4c4], eax
jl 0x10050eed
mov dword [ebp - 0x390], 1
jmp 0x10050ef4
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x390], eax
jne 0x10050f0b
mov dword [ebp - 0x460], 1
jmp 0x10050f12
and dword [ebp - 0x460], 0
cmp dword [ebp - 0x460], 0x66c4
jl 0x10050f2a
mov dword [ebp - 0x398], 1
jmp 0x10050f31
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x398], eax
jl 0x10050f48
mov dword [ebp - 0x51c], 1
jmp 0x10050f4f
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 0
je 0x10050f64
mov dword [ebp - 0x3a0], 1
jmp 0x10050f6b
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x3a0], eax
jg 0x10050f82
mov dword [ebp - 0x468], 1
jmp 0x10050f89
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x468], eax
jg 0x10050fa6
mov eax, 0x718b
test eax, eax
jne 0x10050fa6
and dword [ebp - 0x3a8], 0
jmp 0x10050fb0
mov dword [ebp - 0x3a8], 1
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x1d4], eax
mov eax, 0x2f4e
sub eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x1ec]
jg 0x10050fd8
mov dword [ebp - 0x5a0], 1
jmp 0x10050fdf
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x7ec], eax
imul eax, dword [ebp - 0x80], 0xfffb
imul eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x1ec]
jne 0x10051007
mov dword [ebp - 0x4cc], 1
jmp 0x1005100e
and dword [ebp - 0x4cc], 0
imul eax, dword [ebp - 0x4cc], 0xffff
cmp eax, dword [ebp - 0x80]
jge 0x10051029
mov dword [ebp - 0x3b0], 1
jmp 0x10051030
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x3b0], 0x7d3709e8
jg 0x10051048
mov dword [ebp - 0x470], 1
jmp 0x1005104f
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x470], eax
je 0x10051066
mov dword [ebp - 0x3b8], 1
jmp 0x1005106d
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x3b8], eax
je 0x10051087
mov dword [ebp - 0x210], 1
jmp 0x1005108e
and dword [ebp - 0x210], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x210]
mov dword [ebp + eax - 0x634], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x80]
sub ecx, dword [ebp + eax - 0x624]
mov dword [ebp - 0x3c0], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp + eax - 0x634], ecx
mov eax, dword [ebp - 0x570]
add eax, dword [ebp - 0x3c0]
je 0x1005111c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x624], 0x4c3dc4d7
je 0x100510f7
mov dword [ebp - 0x478], 1
jmp 0x100510fe
and dword [ebp - 0x478], 0
cmp dword [ebp - 0x478], 2
jb 0x1005111c
mov eax, 0xffff
test eax, eax
je 0x1005111c
mov dword [ebp - 0x3c8], 1
jmp 0x10051123
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x1d4]
imul eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x1d4], eax
jmp 0x10050e2b
mov eax, dword [ebp - 0x5a8]
movzx eax, byte [eax]
test eax, eax
je 0x10052427
mov dword [ebp - 0x1fc], 0xffffffff
mov dword [ebp - 0x480], 1
mov dword [ebp - 0x73c], 0x3a34c865
mov dword [ebp - 0x5b0], 0x85ed0657
mov dword [ebp - 0x65c], 1
mov dword [ebp - 0x658], 1
mov dword [ebp - 0x654], 1
mov dword [ebp - 0x650], 1
mov dword [ebp - 0xf0], 0xffff
mov dword [ebp - 0x580], 0xb65cab43
mov dword [ebp - 0x188], 0
jmp 0x100511c9
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x100511e5
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x5f0], 0xfffffffb
jmp 0x100511bc
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x5f0]
cmp dword [ebp + eax - 0x5f0], ecx
jle 0x1005120c
mov dword [ebp - 0x578], 1
jmp 0x10051213
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x5b0], 0
je 0x10051245
xor eax, eax
je 0x10051245
mov dword [ebp - 0x4d4], 1
jmp 0x1005124c
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x4d4], eax
jge 0x10051276
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5f0], 0
je 0x10051276
mov dword [ebp - 0x3d0], 1
jmp 0x1005127d
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
sub eax, 0x7d4ca810
mov dword [ebp - 0x480], eax
jne 0x100512a9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5f0], 0
jne 0x100512a9
and dword [ebp - 0x3d8], 0
jmp 0x100512b3
mov dword [ebp - 0x3d8], 1
mov eax, dword [ebp - 0x3d8]
neg eax
cmp eax, dword [ebp - 0x580]
jge 0x100512cf
mov dword [ebp - 0x514], 1
jmp 0x100512d6
and dword [ebp - 0x514], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x65c]
add eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0xf0]
jne 0x100512fd
mov dword [ebp - 0x5b8], 1
jmp 0x10051304
and dword [ebp - 0x5b8], 0
imul eax, dword [ebp - 0xf0], 0
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
sub eax, 0x6c28cbd6
cmp eax, 0x457102d1
jl 0x1005132f
mov dword [ebp - 0x3e0], 1
jmp 0x10051336
and dword [ebp - 0x3e0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5f0]
cmp dword [ebp - 0x3e0], eax
jne 0x10051356
mov dword [ebp - 0x298], 1
jmp 0x1005135d
and dword [ebp - 0x298], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x298]
mov dword [ebp + eax - 0x65c], ecx
mov dword [ebp - 0x1c], 0xb7c7
mov dword [ebp - 0xcc], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x100515cd
mov dword [ebp - 0x1e4], 9
mov dword [ebp - 0x1f4], 0xfffffff8
mov dword [ebp - 0x1c], 0
jmp 0x100513ae
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff5
jg 0x100515c8
mov dword [ebp - 0xf8], 2
mov dword [ebp - 0x5c0], 0x4320e32c
mov dword [ebp - 0xf8], 0xffffffee
jmp 0x100513e5
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xffffffef
jl 0x100515c3
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x590], 0
mov dword [ebp - 0x58c], 0
mov dword [ebp - 0x588], 0
mov dword [ebp - 0x110], 0
jmp 0x10051433
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jge 0x1005144f
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x794], 0
jmp 0x10051426
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x594]
mov dword [ebp - 0x744], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x5c0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x594]
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x1e4], 0x6066
jge 0x10051495
mov dword [ebp - 0x29c], 1
jmp 0x1005149c
and dword [ebp - 0x29c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x594]
cmp dword [ebp - 0x29c], eax
jg 0x100514bc
mov dword [ebp - 0x2a4], 1
jmp 0x100514c3
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x2a4]
sub eax, dword [ebp - 0x1f4]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x594]
sub eax, dword [ebp - 0x1f4]
jne 0x100514f5
cmp dword [ebp - 0xf8], 0
jne 0x100514f5
and dword [ebp - 0x1dc], 0
jmp 0x100514ff
mov dword [ebp - 0x1dc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1dc]
mov dword [ebp + eax - 0x794], ecx
mov eax, dword [ebp - 0x1e4]
cmp eax, dword [ebp - 0x1dc]
je 0x1005152c
mov dword [ebp - 0x2ac], 1
jmp 0x10051533
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x2ac]
sub eax, dword [ebp - 0x1f4]
je 0x10051550
mov dword [ebp - 0x2b4], 1
jmp 0x10051557
and dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2b4], 0xd38c
jle 0x1005156f
mov dword [ebp - 0x2bc], 1
jmp 0x10051576
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x2bc], eax
jle 0x1005158d
mov dword [ebp - 0x2c4], 1
jmp 0x10051594
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x2c4], eax
jg 0x100515ab
mov dword [ebp - 0x2cc], 1
jmp 0x100515b2
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x1e4], eax
jmp 0x100513d8
jmp 0x100513a7
jmp 0x100517a3
mov dword [ebp - 0x538], 1
mov dword [ebp - 0x534], 1
mov dword [ebp - 0x530], 1
mov dword [ebp - 0x52c], 1
mov dword [ebp - 0x59c], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xcc], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x538]
add eax, dword [ebp - 0xcc]
push 4
pop ecx
imul ecx, ecx, 0
cmp dword [ebp + ecx - 0x538], eax
jl 0x10051639
cmp dword [ebp - 0x1c], 0
jne 0x10051639
and dword [ebp - 0x2d4], 0
jmp 0x10051643
mov dword [ebp - 0x2d4], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x2d4], eax
jge 0x1005165a
mov dword [ebp - 0x2dc], 1
jmp 0x10051661
and dword [ebp - 0x2dc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x538]
cmp dword [ebp - 0x2dc], eax
jle 0x1005168e
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x538], 0
jne 0x1005168e
and dword [ebp - 0x2e4], 0
jmp 0x10051698
mov dword [ebp - 0x2e4], 1
cmp dword [ebp - 0x2e4], 0
ja 0x100516b4
push 5
pop eax
test eax, eax
je 0x100516b4
mov dword [ebp - 0x2ec], 1
jmp 0x100516bb
and dword [ebp - 0x2ec], 0
mov eax, 0xa8fa
sub eax, dword [ebp - 0x2ec]
je 0x10051735
mov dword [ebp - 0x1c], 3
jmp 0x100516d8
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10051733
mov dword [ebp - 0xcc], 0
jmp 0x100516f7
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jg 0x10051722
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x10051720
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x100516ea
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x538], 0
je 0x10051731
jmp 0x10051733
jmp 0x100516d1
jmp 0x100517a3
mov dword [ebp - 0x118], 0
jmp 0x1005174e
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jge 0x1005176a
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0x5e4], 0xb9a2f725
jmp 0x10051741
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5e4]
mov dword [ebp - 0x74c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x538]
mov dword [ebp - 0x800], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x538]
mov dword [ebp - 0x59c], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x424], 0x7e6ef1f7
mov dword [ebp - 0x120], 0
jmp 0x100517cd
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x100517e6
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x10], 0x5b57fd54
jmp 0x100517c0
mov dword [ebp - 4], 0
jmp 0x100517f6
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x10052004
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x90], 0x9f8c5172
mov dword [ebp - 0x1c8], 0xfffffffd
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x10], 0
je 0x1005183b
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x10], 0
jne 0x1005183b
mov dword [ebp - 0x2f4], 1
jmp 0x10051842
and dword [ebp - 0x2f4], 0
cmp dword [ebp - 0x2f4], 0xfffffffc
jae 0x10051857
mov dword [ebp - 0x2fc], 1
jmp 0x1005185e
and dword [ebp - 0x2fc], 0
cmp dword [ebp - 0x2fc], 2
jl 0x10051873
mov dword [ebp - 0x304], 1
jmp 0x1005187a
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 4]
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x304]
sub edx, dword [ebp + ecx - 0x10]
cmp dword [ebp + eax*4 - 0x10], edx
jge 0x1005189f
mov dword [ebp - 0x30c], 1
jmp 0x100518a6
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x10]
cmp dword [ebp - 0x30c], eax
jne 0x100518c1
mov dword [ebp - 0x314], 1
jmp 0x100518c8
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 0x314]
cmp dword [ebp + eax*4 - 0x10], ecx
jle 0x100518e7
mov dword [ebp - 0x31c], 1
jmp 0x100518ee
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0
jmp 0x10051907
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jg 0x10051fff
mov dword [ebp - 0x58], 0x8fb8
mov dword [ebp - 0x18], 0xd8d92426
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x10]
cmp dword [ebp + eax - 0x10], ecx
jne 0x1005193e
mov dword [ebp - 0x5c4], 1
jmp 0x10051945
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
sub eax, dword [ebp + ecx*4 - 0x10]
je 0x10051979
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x10], 0
je 0x10051979
mov dword [ebp - 0x5a4], 1
jmp 0x10051980
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x75c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x10], ecx
je 0x100519a7
mov dword [ebp - 0x324], 1
jmp 0x100519ae
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
sub eax, dword [ebp - 0x18]
cmp eax, 0xa81d
jge 0x100519ca
mov dword [ebp - 0x32c], 1
jmp 0x100519d1
and dword [ebp - 0x32c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x32c], eax
je 0x100519f2
cmp dword [ebp - 0x18], 0
jne 0x100519f2
and dword [ebp - 0x334], 0
jmp 0x100519fc
mov dword [ebp - 0x334], 1
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x58], 1
jbe 0x10051a23
mov dword [ebp - 0x344], 1
jmp 0x10051a2a
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x768], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10], 0xffffffff
jge 0x10051a4c
mov dword [ebp - 0x33c], 1
jmp 0x10051a53
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
neg eax
mov ecx, dword [ebp - 4]
add eax, dword [ebp + ecx*4 - 0x10]
cmp dword [ebp - 0x344], eax
jge 0x10051a76
mov dword [ebp - 0x34c], 1
jmp 0x10051a7d
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
sub eax, dword [ebp - 0x18]
cmp eax, 0x6ba05392
jg 0x10051a9f
cmp dword [ebp - 0x18], 0
je 0x10051a9f
mov dword [ebp - 0x354], 1
jmp 0x10051aa6
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x354], eax
je 0x10051abd
mov dword [ebp - 0x35c], 1
jmp 0x10051ac4
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x35c]
neg eax
cmp eax, dword [ebp - 4]
jle 0x10051ec8
mov dword [ebp - 0x88], 0x890aaf75
mov dword [ebp - 0x3e4], 0xad5889e5
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x818], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp + eax - 0x10]
mov dword [ebp - 0x364], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x364]
mov dword [ebp + eax*4 - 0x10], ecx
cmp dword [ebp - 0x364], 0
je 0x10051b34
cmp dword [ebp - 0x18], 0
je 0x10051b34
mov dword [ebp - 0x36c], 1
jmp 0x10051b3b
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x88], eax
je 0x10051b5b
mov dword [ebp - 0x374], 1
jmp 0x10051b62
and dword [ebp - 0x374], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x374]
cmp eax, 0xec6b039b
jbe 0x10051b7e
mov dword [ebp - 0x37c], 1
jmp 0x10051b85
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x37c]
je 0x10051b9c
mov dword [ebp - 0x384], 1
jmp 0x10051ba3
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x88], 0
jmp 0x10051bc8
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x33
jg 0x10051ec3
mov dword [ebp - 0x39c], 0x2d7faeff
mov dword [ebp - 0x1c4], 1
mov dword [ebp - 0x3d4], 0xfffffffa
mov dword [ebp - 0x128], 5
mov eax, dword [ebp - 4]
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x30], 1
jle 0x10051c18
mov dword [ebp - 0x38c], 1
jmp 0x10051c1f
and dword [ebp - 0x38c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x38c]
dec ecx
cmp dword [ebp + eax - 0x10], ecx
jne 0x10051c3e
mov dword [ebp - 0x394], 1
jmp 0x10051c45
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x394], eax
jle 0x10051c5f
mov dword [ebp - 0x3a4], 1
jmp 0x10051c66
and dword [ebp - 0x3a4], 0
mov dword [ebp - 0x39c], 0xffffffff
mov eax, dword [ebp - 0x39c]
cmp eax, dword [ebp - 0x3a4]
jg 0x10051c8a
mov dword [ebp - 0x5fc], 1
jmp 0x10051c91
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x79c], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x30]
je 0x10051cb4
mov dword [ebp - 0x3ac], 1
jmp 0x10051cbb
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x3ac], eax
je 0x10051cd2
mov dword [ebp - 0x3b4], 1
jmp 0x10051cd9
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x3b4], eax
jge 0x10051cf3
mov dword [ebp - 0x3bc], 1
jmp 0x10051cfa
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3d4]
cmp dword [ebp - 0x3bc], eax
jne 0x10051d14
mov dword [ebp - 0x3c4], 1
jmp 0x10051d1b
and dword [ebp - 0x3c4], 0
cmp dword [ebp - 0x3c4], 0
jb 0x10051d30
mov dword [ebp - 0x3cc], 1
jmp 0x10051d37
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x780], eax
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x18], 0xd1e
jne 0x10051d70
mov dword [ebp - 0x3dc], 1
jmp 0x10051d77
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x88]
imul eax, dword [ebp - 0x3dc]
test eax, eax
je 0x10051eb5
mov dword [ebp - 0x404], 0xaf6502fc
mov dword [ebp - 0x90], 0xd
jmp 0x10051daf
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffffa
je 0x10051dea
mov dword [ebp - 0x5ac], 0xfffffffd
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x3e4], eax
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x10051de8
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
jmp 0x10051da2
mov dword [ebp - 0x18], 0x7236
cmp dword [ebp - 0x18], 0x8a9b
jl 0x10051e06
mov dword [ebp - 0x3ec], 1
jmp 0x10051e0d
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x128]
imul eax, dword [ebp - 0x3ec]
test eax, eax
je 0x10051e55
cmp dword [ebp - 0x58], 0
jne 0x10051e30
mov dword [ebp - 0x3f4], 1
jmp 0x10051e37
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
inc eax
je 0x10051e55
cmp dword [ebp - 0x128], 0
je 0x10051e55
mov dword [ebp - 0x3fc], 1
jmp 0x10051e5c
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x404], 0x2da2ea9
cmp dword [ebp - 0x404], 0x8c34f7c3
jb 0x10051e84
mov dword [ebp - 0x40c], 1
jmp 0x10051e8b
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 1
jne 0x10051ea0
mov dword [ebp - 0x414], 1
jmp 0x10051ea7
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x90], eax
jmp 0x10051ebe
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x18], eax
jmp 0x10051bbb
jmp 0x10051ffa
mov dword [ebp - 0x1d0], 1
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x10], 0xcfc2
jle 0x10051eeb
mov dword [ebp - 0x43c], 1
jmp 0x10051ef2
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x1d0], 0
jne 0x10051f32
cmp dword [ebp - 0x58], 0xffffffff
jge 0x10051f0d
mov dword [ebp - 0x41c], 1
jmp 0x10051f14
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jne 0x10051f32
and dword [ebp - 0x42c], 0
jmp 0x10051f3c
mov dword [ebp - 0x42c], 1
mov eax, dword [ebp - 0x42c]
add eax, 0x414c507b
jne 0x10051f58
cmp dword [ebp - 0x58], 0
jne 0x10051f58
and dword [ebp - 0x434], 0
jmp 0x10051f62
mov dword [ebp - 0x434], 1
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0x434], eax
je 0x10051f7c
mov dword [ebp - 0x5d4], 1
jmp 0x10051f83
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x18], eax
jle 0x10051fbb
mov dword [ebp - 0x444], 1
jmp 0x10051fc2
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x43c]
neg eax
mov ecx, dword [ebp - 0x1d0]
imul ecx, dword [ebp - 0x444]
cmp eax, ecx
jle 0x10051fe7
mov dword [ebp - 0x44c], 1
jmp 0x10051fee
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x90], eax
jmp 0x10051900
jmp 0x100517ef
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x66c], 0x66c93ee3
mov dword [ebp - 0x668], 0x66c93ee3
mov dword [ebp - 0x664], 0x66c93ee3
mov dword [ebp - 0x660], 0x66c93ee3
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jl 0x1005205c
mov dword [ebp - 0x454], 1
jmp 0x10052063
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x454]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x66c], eax
mov dword [ebp - 0x34], 0
jmp 0x10052089
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x1005216a
mov dword [ebp - 0x130], 0xb1c03809
mov dword [ebp - 0x130], 3
jmp 0x100520b6
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jl 0x10052156
mov dword [ebp - 0x138], 0xd7540573
mov dword [ebp - 0x138], 0
jmp 0x100520e6
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jg 0x10052151
mov dword [ebp - 0x140], 0xfffffffb
mov dword [ebp - 0x140], 0
jmp 0x10052112
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 3
jg 0x10052135
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x10052133
call dword [sym.imp.KERNEL32.dll_GetVersion]
jmp 0x10052105
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x1005214f
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
jmp 0x100520d9
jmp 0x100520a9
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x66c], 0
je 0x10052165
jmp 0x1005216a
jmp 0x10052082
mov dword [ebp - 0x28], 0x6d44418
mov dword [ebp - 0x45c], 0xeec80f21
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x148], 0
jmp 0x1005219e
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jge 0x100521b7
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x60], 0xd5464b5f
jmp 0x10052191
mov dword [ebp - 0x28], 0
jmp 0x100521c7
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1005240d
mov dword [ebp - 0xd4], 0xffffffff
mov dword [ebp - 0x1d8], 0xfffffffe
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x6c8], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x6d0], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x6e8], eax
mov dword [ebp - 0x45c], 0xa63a74ad
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x1d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x1d8], eax
jne 0x1005227b
mov dword [ebp - 0x464], 1
jmp 0x10052282
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x60]
cmp dword [ebp - 0x464], eax
jge 0x1005229d
mov dword [ebp - 0x46c], 1
jmp 0x100522a4
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 0xe54ee87f
jne 0x100522bc
mov dword [ebp - 0x5b4], 1
jmp 0x100522c3
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp + eax*4 - 0x60], 0xc6fe
test eax, eax
je 0x100522f3
mov eax, 0xb16e
test eax, eax
je 0x100522f3
mov dword [ebp - 0x540], 1
jmp 0x100522fa
and dword [ebp - 0x540], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x1d8], eax
jne 0x10052398
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x60], 0
je 0x10052398
mov dword [ebp - 0x100], 0
jmp 0x10052333
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jg 0x10052379
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x10052356
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x10052377
push 0
push 0
push 0x1bf8
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x10052326
mov byte [ebp - 0x9f], 0
movzx eax, byte [ebp - 0x9f]
test eax, eax
je 0x10052396
push 0x250c
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x10052408
mov dword [ebp - 0x150], 0
jmp 0x100523b1
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jge 0x100523cd
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x8a8], 0xfffffffe
jmp 0x100523a4
mov dword [ebp - 0xd4], 0
jmp 0x100523e6
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x1a
jle 0x10052408
mov dword [ebp - 0x474], 0x417f95e1
mov eax, dword [ebp - 0x474]
dec eax
mov dword [ebp - 0x474], eax
jmp 0x100523d9
jmp 0x100521c0
push 0x1205
push 0xbf4
push 0x12c3
push 0x190d
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x64c], 0x66c93ee3
mov dword [ebp - 0x648], 0x66c93ee3
mov dword [ebp - 0x644], 0x66c93ee3
mov dword [ebp - 0x640], 0x66c93ee3
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x6f8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jl 0x1005247f
mov dword [ebp - 0x47c], 1
jmp 0x10052486
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x47c]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x64c], eax
mov dword [ebp - 0x38], 0
jmp 0x100524ac
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x1005258d
mov dword [ebp - 0x158], 0xb1c03809
mov dword [ebp - 0x158], 3
jmp 0x100524d9
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x10052579
mov dword [ebp - 0x160], 0xd7540573
mov dword [ebp - 0x160], 0
jmp 0x10052509
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jg 0x10052574
mov dword [ebp - 0x168], 0xfffffffb
mov dword [ebp - 0x168], 0
jmp 0x10052535
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jg 0x10052558
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x10052556
call dword [sym.imp.KERNEL32.dll_GetVersion]
jmp 0x10052528
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x10052572
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
jmp 0x100524fc
jmp 0x100524cc
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x64c], 0
je 0x10052588
jmp 0x1005258d
jmp 0x100524a5
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x1e8], 0xffffffff
mov dword [ebp - 0x1e0], 0xa7ab5bf7
mov dword [ebp - 0x54c], 0xfffffffc
mov dword [ebp - 0x40], 0
jmp 0x100525c2
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 6
jge 0x100528e6
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x74], 0
jmp 0x100525e6
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x100525fc
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x62c], 0x997736ea
jmp 0x100525df
mov dword [ebp - 0x74], 0
jmp 0x1005260c
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10052622
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x61c], 0
jmp 0x10052605
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x708], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x710], eax
cmp dword [ebp - 0x40], 1
jne 0x10052649
mov dword [ebp - 0x484], 1
jmp 0x10052650
and dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 8
jne 0x10052665
mov dword [ebp - 0x490], 1
jmp 0x1005266c
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x490], eax
jl 0x10052686
mov dword [ebp - 0x214], 1
jmp 0x1005268d
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x214], eax
jne 0x100526a7
mov dword [ebp - 0x218], 1
jmp 0x100526ae
and dword [ebp - 0x218], 0
cmp dword [ebp - 0x218], 0x66c4
jl 0x100526c6
mov dword [ebp - 0x220], 1
jmp 0x100526cd
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x220], eax
jl 0x100526e4
mov dword [ebp - 0x228], 1
jmp 0x100526eb
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 0
je 0x10052700
mov dword [ebp - 0x230], 1
jmp 0x10052707
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x230], eax
jg 0x1005271e
mov dword [ebp - 0x238], 1
jmp 0x10052725
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x238], eax
jg 0x10052742
mov eax, 0x718b
test eax, eax
jne 0x10052742
and dword [ebp - 0x240], 0
jmp 0x1005274c
mov dword [ebp - 0x240], 1
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x1e8], eax
mov eax, 0x2f4e
sub eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x1e0]
jg 0x10052774
mov dword [ebp - 0x544], 1
jmp 0x1005277b
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x718], eax
imul eax, dword [ebp - 0x8c], 0xfffb
imul eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x1e0]
jne 0x100527ac
mov dword [ebp - 0x248], 1
jmp 0x100527b3
and dword [ebp - 0x248], 0
imul eax, dword [ebp - 0x248], 0xffff
cmp eax, dword [ebp - 0x8c]
jge 0x100527d1
mov dword [ebp - 0x250], 1
jmp 0x100527d8
and dword [ebp - 0x250], 0
cmp dword [ebp - 0x250], 0x7d3709e8
jg 0x100527f0
mov dword [ebp - 0x258], 1
jmp 0x100527f7
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x258], eax
je 0x1005280e
mov dword [ebp - 0x260], 1
jmp 0x10052815
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x260], eax
je 0x1005282f
mov dword [ebp - 0x268], 1
jmp 0x10052836
and dword [ebp - 0x268], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x268]
mov dword [ebp + eax - 0x62c], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8c]
sub ecx, dword [ebp + eax - 0x61c]
mov dword [ebp - 0x270], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x270]
mov dword [ebp + eax - 0x62c], ecx
mov eax, dword [ebp - 0x54c]
add eax, dword [ebp - 0x270]
je 0x100528c7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x61c], 0x4c3dc4d7
je 0x100528a2
mov dword [ebp - 0x278], 1
jmp 0x100528a9
and dword [ebp - 0x278], 0
cmp dword [ebp - 0x278], 2
jb 0x100528c7
mov eax, 0xffff
test eax, eax
je 0x100528c7
mov dword [ebp - 0x280], 1
jmp 0x100528ce
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x1e8]
imul eax, dword [ebp - 0x280]
mov dword [ebp - 0x1e8], eax
jmp 0x100525bb
mov dword [ebp - 0x48], 0x24ec2e0c
mov dword [ebp - 0x48], 0xffffffeb
jmp 0x100528fd
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xfffffff5
jne 0x10052931
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x1005292f
push 0x184b
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x100528f6
mov dword [ebp - 0x48], 0
jmp 0x10052941
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xb
je 0x10052a0a
mov dword [ebp - 0x1f8], 0
mov dword [ebp - 0x1f0], 0x1647
mov dword [ebp - 0x564], 1
cmp dword [ebp - 0x1f8], 0
jne 0x10052987
cmp dword [ebp - 0x48], 0
je 0x1005297e
cmp dword [ebp - 0x48], 0
jne 0x10052987
and dword [ebp - 0x554], 0
jmp 0x10052991
mov dword [ebp - 0x554], 1
cmp dword [ebp - 0x1f0], 0
je 0x100529af
cmp dword [ebp - 0x1f0], 0
je 0x100529af
mov dword [ebp - 0x55c], 1
jmp 0x100529b6
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x1f8]
dec eax
cmp eax, dword [ebp - 0x1f0]
jge 0x100529d1
mov dword [ebp - 0x288], 1
jmp 0x100529d8
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0x288]
jge 0x100529f2
mov dword [ebp - 0x290], 1
jmp 0x100529f9
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x564], eax
jmp 0x1005293a
mov esp, ebp
pop ebp
ret