Function at 0x447f67
Capabilities:
Check os version
Create process on windows
Get common file path
Get system information on windows
Log keystrokes via polling
Query service status

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fa8
call fcn.00484cb0
push esi
push edi
mov dword [ebp - 0x3f0], 1
mov dword [ebp - 0x3f4], 0
jmp 0x447f99
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 4
jge 0x447fb5
mov eax, dword [ebp - 0x3f4]
mov dword [ebp + eax*4 - 0x1f98], 0xc85f70ad
jmp 0x447f8c
mov dword [ebp - 0x3f0], 0
jmp 0x447fce
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 3
jg 0x448021
mov byte [ebp - 0x2b2], 0
movzx eax, byte [ebp - 0x2b2]
test eax, eax
je 0x447ffe
push 0xd76
push 0xaa5
push 0x399
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov byte [ebp - 0x1bf], 0
movzx eax, byte [ebp - 0x1bf]
test eax, eax
je 0x44801f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
jmp 0x447fc1
mov dword [ebp - 0x318], 0xdce9
mov dword [ebp - 0x44], 0x304b25b3
mov dword [ebp - 0x338], 0x84902314
mov dword [ebp - 0x4c0], 0
jmp 0x448055
mov eax, dword [ebp - 0x4c0]
inc eax
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 2
jge 0x448071
mov eax, dword [ebp - 0x4c0]
mov dword [ebp + eax*4 - 0x1bbc], 0x2c593c86
jmp 0x448048
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x1dec], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x448106
cmp dword [ebp - 0x44], 0
je 0x4480a4
cmp dword [ebp - 0x44], 0
je 0x4480a4
mov dword [ebp - 0x13e0], 1
jmp 0x4480ab
and dword [ebp - 0x13e0], 0
cmp dword [ebp - 0x318], 1
jle 0x4480c0
mov dword [ebp - 0x14c8], 1
jmp 0x4480c7
and dword [ebp - 0x14c8], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1b70], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1d18], eax
mov eax, dword [ebp - 0x318]
add eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x318]
jne 0x4480ee
cmp dword [ebp - 0x44], 0
cmp dword [ebp - 0x44], 0
jne 0x448106
cmp dword [ebp - 0x318], 0
jne 0x448106
and dword [ebp - 0x1174], 0
jmp 0x448110
mov dword [ebp - 0x1174], 1
mov eax, dword [ebp - 0x1174]
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x338], 0xfffffffc
jmp 0x448135
mov eax, dword [ebp - 0x338]
dec eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0xfffffff8
jge 0x448166
mov dword [ebp - 0x44], 0
jmp 0x44814e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x448164
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x1bbc], 1
jmp 0x448147
jmp 0x448128
mov dword [ebp - 0x1b78], 0xffffffff
mov dword [ebp - 0x1ce8], 1
mov dword [ebp - 0x1b80], 0
mov dword [ebp - 0x14d0], 3
mov dword [ebp - 0x1d24], 0
mov dword [ebp - 0x1b88], 7
mov dword [ebp - 0x1cf8], 0x44555950
mov dword [ebp - 0x1b90], 0xfffffff7
push 3
lea ecx, [ebp - 0x191c]
call fcn.0040194d
mov dword [ebp - 0x12c], 0
jmp 0x4481dc
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jge 0x4481f8
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x1ee4], 0xffffffff
jmp 0x4481cf
mov dword [ebp - 0x12c], 0
jmp 0x448211
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x448233
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x191c]
call fcn.00401379
mov dword [eax], 0xfd9e2a8d
jmp 0x448204
push 0
lea ecx, [ebp - 0x191c]
call fcn.00401379
mov dword [ebp - 0x1208], eax
mov eax, dword [ebp - 0x1208]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1208]
mov dword [ecx], eax
mov dword [ebp - 0x14d0], 0x3582f80c
lea ecx, [ebp - 0x191c]
call fcn.00401a1f
mov dword [ebp - 0x2c8], 0x24a8c6a5
mov dword [ebp - 0x1264], 0xffff
mov dword [ebp - 0x1274], 0x9f5fa318
push 2
lea ecx, [ebp - 0x1644]
call fcn.0040194d
mov dword [ebp - 0x5d8], 0
mov dword [ebp - 0x1500], 1
mov dword [ebp - 0x52c], 0x5ee56e31
mov dword [ebp - 0x400], 0
mov dword [ebp - 0x14f8], 0x3aa9c1c7
mov dword [ebp - 0x3f8], 0
jmp 0x4482e2
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 2
jge 0x448301
push dword [ebp - 0x3f8]
lea ecx, [ebp - 0x1644]
call fcn.00401379
or dword [eax], 0xffffffff
jmp 0x4482d5
mov dword [ebp - 0x2c8], 0
jmp 0x44831a
mov eax, dword [ebp - 0x2c8]
dec eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0xffffffe7
jge 0x448344
mov byte [ebp - 0x1c1], 0
movzx eax, byte [ebp - 0x1c1]
test eax, eax
je 0x448342
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x44830d
cmp dword [ebp - 0x2c8], 0
jne 0x448443
mov eax, dword [ebp - 0x1264]
mov dword [ebp - 0x14d8], eax
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x14e0], eax
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x14d8]
cmp eax, dword [ebp - 0x14e0]
je 0x448390
mov dword [ebp - 0x14e8], 1
jmp 0x448397
and dword [ebp - 0x14e8], 0
cmp dword [ebp - 0x1274], 0
jne 0x4483e1
mov esi, dword [ebp - 0x52c]
push 1
lea ecx, [ebp - 0x1644]
call fcn.00401379
cmp esi, dword [eax]
jle 0x4483c3
mov dword [ebp - 0x1210], 1
jmp 0x4483ca
and dword [ebp - 0x1210], 0
mov eax, dword [ebp - 0x52c]
cmp dword [ebp - 0x1210], eax
jl 0x4483e1
and dword [ebp - 0x1218], 0
jmp 0x4483eb
mov dword [ebp - 0x1218], 1
cmp dword [ebp - 0x1218], 0xfffffffd
jl 0x448400
mov dword [ebp - 0x1244], 1
jmp 0x448407
and dword [ebp - 0x1244], 0
push 1
lea ecx, [ebp - 0x1644]
call fcn.00401379
mov ecx, dword [ebp - 0x1244]
cmp ecx, dword [eax]
jge 0x44842a
mov dword [ebp - 0x14f0], 1
jmp 0x448431
and dword [ebp - 0x14f0], 0
cmp dword [ebp - 0x5d8], 0
jne 0x448443
and dword [ebp - 0x124c], 0
jmp 0x44844d
mov dword [ebp - 0x124c], 1
mov eax, dword [ebp - 0x124c]
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x1d30], eax
cmp dword [ebp - 0x400], 0xffff
jae 0x44847d
mov dword [ebp - 0x1254], 1
jmp 0x448484
and dword [ebp - 0x1254], 0
mov eax, dword [ebp - 0x5d8]
cmp dword [ebp - 0x1254], eax
jle 0x44849e
mov dword [ebp - 0x125c], 1
jmp 0x4484a5
and dword [ebp - 0x125c], 0
cmp dword [ebp - 0x125c], 0xfffffff9
jl 0x4484ba
mov dword [ebp - 0x126c], 1
jmp 0x4484c1
and dword [ebp - 0x126c], 0
mov eax, dword [ebp - 0x1264]
cmp dword [ebp - 0x126c], eax
jg 0x4484db
mov dword [ebp - 0x127c], 1
jmp 0x4484e2
and dword [ebp - 0x127c], 0
mov eax, dword [ebp - 0x1274]
cmp dword [ebp - 0x127c], eax
jle 0x4484fc
mov dword [ebp - 0x1284], 1
jmp 0x448503
and dword [ebp - 0x1284], 0
mov eax, dword [ebp - 0x14f8]
cmp dword [ebp - 0x1284], eax
jg 0x44851d
mov dword [ebp - 0x128c], 1
jmp 0x448524
and dword [ebp - 0x128c], 0
cmp dword [ebp - 0x128c], 1
jbe 0x448539
mov dword [ebp - 0x1294], 1
jmp 0x448540
and dword [ebp - 0x1294], 0
push 1
lea ecx, [ebp - 0x1644]
call fcn.00401379
mov ecx, dword [ebp - 0x1294]
cmp ecx, dword [eax]
jne 0x448563
mov dword [ebp - 0xed4], 1
jmp 0x44856a
and dword [ebp - 0xed4], 0
mov eax, dword [ebp - 0x1500]
cmp dword [ebp - 0xed4], eax
jge 0x448584
mov dword [ebp - 0x738], 1
jmp 0x44858b
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x5d8]
add eax, dword [ebp - 0x738]
mov dword [ebp - 0x2c8], eax
lea ecx, [ebp - 0x1644]
call fcn.00401a1f
mov dword [ebp - 0x410], 1
mov dword [ebp - 0x1e8], 0x38a1f949
mov dword [ebp - 0x4cc], 0xf6e229ed
mov dword [ebp - 0x1f0], 0x66bc657e
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x300], 0x70e7ad53
cmp dword [ebp - 0x1e8], 0
jne 0x448744
mov eax, dword [ebp - 0x1e8]
sub eax, 5
mov dword [ebp - 0x4cc], eax
jne 0x44861d
cmp dword [ebp - 0x4cc], 0
je 0x448614
cmp dword [ebp - 0x4cc], 0
jne 0x44861d
and dword [ebp - 0xedc], 0
jmp 0x448627
mov dword [ebp - 0xedc], 1
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0xedc], eax
jge 0x448641
mov dword [ebp - 0x740], 1
jmp 0x448648
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x6f9b
jge 0x44866c
mov dword [ebp - 0xee4], 1
jmp 0x448673
and dword [ebp - 0xee4], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0xee4], eax
jg 0x44868d
mov dword [ebp - 0x748], 1
jmp 0x448694
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x84], eax
jne 0x4486ba
mov dword [ebp - 0xeec], 1
jmp 0x4486c1
and dword [ebp - 0xeec], 0
mov eax, dword [ebp - 0x1e8]
cmp eax, dword [ebp - 0xeec]
jne 0x4486db
mov dword [ebp - 0x750], 1
jmp 0x4486e2
and dword [ebp - 0x750], 0
cmp dword [ebp - 0x750], 0xfc65
jle 0x4486fa
mov dword [ebp - 0xef4], 1
jmp 0x448701
and dword [ebp - 0xef4], 0
mov eax, dword [ebp - 0xef4]
sub eax, 4
jne 0x44871e
cmp dword [ebp - 0x1f0], 0
jne 0x44871e
and dword [ebp - 0x758], 0
jmp 0x448728
mov dword [ebp - 0x758], 1
mov eax, dword [ebp - 0x1e8]
imul eax, dword [ebp - 0x758]
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0
je 0x448767
mov dword [ebp - 0x1b98], 0xfffffff7
mov dword [ebp - 0xefc], 0x84edc02
mov eax, dword [ebp - 0xefc]
inc eax
mov dword [ebp - 0xefc], eax
jmp 0x448781
mov byte [ebp - 0x1c3], 0
movzx eax, byte [ebp - 0x1c3]
test eax, eax
je 0x448781
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov dword [ebp - 0x300], 0
jmp 0x44879a
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0x19
jg 0x4488b7
mov dword [ebp - 0x408], 0
jmp 0x4487c0
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 3
jge 0x4487dc
mov eax, dword [ebp - 0x408]
mov dword [ebp + eax*4 - 0x1f6c], 1
jmp 0x4487b3
mov dword [ebp - 0x84], 0
jmp 0x4487f5
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x12
jle 0x44881c
mov byte [ebp - 0x1c5], 0
movzx eax, byte [ebp - 0x1c5]
test eax, eax
je 0x44881a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
jmp 0x4487e8
mov dword [ebp - 0x1f0], 0
jmp 0x448835
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 2
jg 0x4488b2
mov byte [ebp - 0x1c7], 0
movzx eax, byte [ebp - 0x1c7]
test eax, eax
je 0x448868
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
mov dword [ebp - 0x84], 0
jmp 0x448881
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jg 0x4488ad
mov byte [ebp - 0x1c9], 0
movzx eax, byte [ebp - 0x1c9]
test eax, eax
je 0x4488ab
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x448874
jmp 0x448828
jmp 0x44878d
mov dword [ebp - 0x584], 0
jmp 0x4488d0
mov eax, dword [ebp - 0x584]
inc eax
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 4
jge 0x4488ec
mov eax, dword [ebp - 0x584]
mov dword [ebp + eax*4 - 0x1fa8], 0xc85f70ad
jmp 0x4488c3
mov dword [ebp - 0x410], 0
jmp 0x448905
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 3
jg 0x4496c2
mov dword [ebp - 0x1d08], 0x4a6847df
mov byte [ebp - 0x1cb], 0
movzx eax, byte [ebp - 0x1cb]
test eax, eax
je 0x448974
push 0
push 0x2584
push 0xe88
push 0x6bc
push 0x2037
push 0x24ad
push 0x2278
push 0x4f8
push 0x24a1
push 0x151c
push 0x19c7
push 0x19d7
push 0x848
push 0x42
call dword [sym.imp.GDI32.dll_CreateFontA]
mov byte [ebp - 0x1cd], 0
movzx eax, byte [ebp - 0x1cd]
test eax, eax
je 0x44898e
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 0x1d1], 0
mov dword [ebp - 0x418], 0x62e0
mov dword [ebp - 0x354], 0xcdf9c775
mov dword [ebp - 0x1f8], 0xbefcdf11
mov dword [ebp - 0x340], 1
push 2
lea ecx, [ebp - 0x1388]
call fcn.0040194d
mov dword [ebp - 0x1518], 0xfffd
mov dword [ebp - 0x4d4], 0
jmp 0x4489ed
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 2
jge 0x448a0f
push dword [ebp - 0x4d4]
lea ecx, [ebp - 0x1388]
call fcn.00401379
mov dword [eax], 0x1eb64d07
jmp 0x4489e0
cmp dword [ebp - 0x418], 0
jl 0x448a24
mov dword [ebp - 0x760], 1
jmp 0x448a2b
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x418]
add eax, dword [ebp - 0x760]
cmp eax, 0xfb66
je 0x448a4a
mov dword [ebp - 0xf04], 1
jmp 0x448a51
and dword [ebp - 0xf04], 0
mov eax, dword [ebp - 0x418]
add eax, dword [ebp - 0xf04]
sub eax, dword [ebp - 0x354]
mov dword [ebp - 0x1f8], eax
imul eax, dword [ebp - 0x1f8], 0x5ac3
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
mov ecx, dword [ebp - 0x354]
lea eax, [eax + ecx + 3]
neg eax
cmp eax, 0xffffffff
jae 0x448a9c
mov dword [ebp - 0x768], 1
jmp 0x448aa3
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x354]
cmp dword [ebp - 0x768], eax
jl 0x448abd
mov dword [ebp - 0xf0c], 1
jmp 0x448ac4
and dword [ebp - 0xf0c], 0
mov esi, dword [ebp - 0x418]
sub esi, dword [ebp - 0xf0c]
push 0
lea ecx, [ebp - 0x1388]
call fcn.00401379
mov dword [eax], esi
cmp dword [ebp - 0x1f8], 0xd41e5596
jne 0x448b26
mov byte [ebp - 0x1cf], 0
movzx eax, byte [ebp - 0x1cf]
test eax, eax
je 0x448b21
push 0xc1c
push 0
push 0
push 0
push 0
push 0x1679
push 0x9c5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
jmp 0x448e27
mov dword [ebp - 0x3a4], 0x93d7f285
mov dword [ebp - 0x1f8], 0x19
jmp 0x448b49
mov eax, dword [ebp - 0x1f8]
dec eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 9
je 0x448e27
mov dword [ebp - 0x670], 0xfffc
mov dword [ebp - 0x152c], 0
mov dword [ebp - 0xf3c], 0x29ef
mov dword [ebp - 0x534], 0
jmp 0x448b8d
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 3
jge 0x448ba9
mov eax, dword [ebp - 0x534]
mov dword [ebp + eax*4 - 0x1758], 4
jmp 0x448b80
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x1ba0], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x1d38], eax
cmp dword [ebp - 0x670], 0xf9f3
jg 0x448bd9
mov dword [ebp - 0x1508], 1
jmp 0x448be0
and dword [ebp - 0x1508], 0
mov eax, dword [ebp - 0x670]
cmp dword [ebp - 0x3a4], eax
jne 0x448c0c
push 0
lea ecx, [ebp - 0x1388]
call fcn.00401379
cmp dword [eax], 0
je 0x448c0c
mov dword [ebp - 0x1510], 1
jmp 0x448c13
and dword [ebp - 0x1510], 0
mov esi, dword [ebp - 0x340]
push 0
lea ecx, [ebp - 0x1388]
call fcn.00401379
cmp esi, dword [eax]
jge 0x448c36
mov dword [ebp - 0x770], 1
jmp 0x448c3d
and dword [ebp - 0x770], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x770]
mov dword [ebp + eax - 0x1758], ecx
mov eax, dword [ebp - 0x670]
neg eax
je 0x448c99
cmp dword [ebp - 0x340], 0x8a7e8b7d
ja 0x448c72
mov dword [ebp - 0xf14], 1
jmp 0x448c79
and dword [ebp - 0xf14], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1758]
cmp eax, dword [ebp - 0xf14]
jle 0x448c99
mov dword [ebp - 0x778], 1
jmp 0x448ca0
and dword [ebp - 0x778], 0
cmp dword [ebp - 0x778], 0x77e2
jle 0x448cbe
cmp dword [ebp - 0x3a4], 0
jne 0x448cbe
and dword [ebp - 0xf1c], 0
jmp 0x448cc8
mov dword [ebp - 0xf1c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1758]
cmp dword [ebp - 0xf1c], eax
je 0x448ce9
mov dword [ebp - 0x780], 1
jmp 0x448cf0
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x1518]
cmp dword [ebp - 0x780], eax
jl 0x448d0a
mov dword [ebp - 0xf24], 1
jmp 0x448d11
and dword [ebp - 0xf24], 0
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0xf24], eax
je 0x448d2b
mov dword [ebp - 0x788], 1
jmp 0x448d32
and dword [ebp - 0x788], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1758]
cmp dword [ebp - 0x788], eax
jne 0x448d52
mov dword [ebp - 0xf2c], 1
jmp 0x448d59
and dword [ebp - 0xf2c], 0
mov eax, dword [ebp - 0xf2c]
sub eax, dword [ebp - 0x152c]
cmp eax, 0x4a3a207b
jle 0x448d78
mov dword [ebp - 0x790], 1
jmp 0x448d7f
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x790]
add eax, 0x3620
je 0x448d93
cmp dword [ebp - 0xf3c], 0
cmp dword [ebp - 0x3a4], 0x9588dfef
ja 0x448dab
mov dword [ebp - 0xf34], 1
jmp 0x448db2
and dword [ebp - 0xf34], 0
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0xf34], eax
jl 0x448dcc
mov dword [ebp - 0x798], 1
jmp 0x448dd3
and dword [ebp - 0x798], 0
cmp dword [ebp - 0x798], 0xc53a
jg 0x448de6
cmp dword [ebp - 0xf3c], 0
mov eax, 0x38d0
test eax, eax
je 0x448e00
or eax, 0xffffffff
je 0x448e00
mov dword [ebp - 0x7a0], 1
jmp 0x448e07
and dword [ebp - 0x7a0], 0
mov esi, dword [ebp - 0x7a0]
sub esi, dword [ebp - 0x354]
push 0
lea ecx, [ebp - 0x1388]
call fcn.00401379
mov dword [eax], esi
jmp 0x448b3c
lea ecx, [ebp - 0x1388]
call fcn.00401a1f
movzx eax, byte [ebp - 0x1d1]
test eax, eax
je 0x448e90
mov dword [ebp - 0x1ba8], 0x464b
mov byte [ebp - 0x1d3], 0
movzx eax, byte [ebp - 0x1d3]
test eax, eax
je 0x448e63
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
mov byte [ebp - 0x1d5], 0
movzx eax, byte [ebp - 0x1d5]
test eax, eax
je 0x448e7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd76
push 0xaa5
push 0x399
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 2
lea ecx, [ebp - 0x19a0]
call fcn.0040194d
push 3
lea ecx, [ebp - 0x13b8]
call fcn.0040194d
mov dword [ebp - 0xbc], 0
jmp 0x448ec3
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x448ee5
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x19a0]
call fcn.00401379
mov dword [eax], 0x98a8
jmp 0x448eb6
mov dword [ebp - 0xbc], 0
jmp 0x448efe
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x448f20
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x13b8]
call fcn.00401379
mov dword [eax], 0x94a18885
jmp 0x448ef1
push 0
lea ecx, [ebp - 0x13b8]
call fcn.00401379
mov dword [eax], 1
jmp 0x448f59
push 0
lea ecx, [ebp - 0x13b8]
call fcn.00401379
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0xf44]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xf44]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x13b8]
call fcn.00401379
cmp dword [eax], 0
jl 0x448fe9
mov byte [ebp - 0x1d7], 0
movzx eax, byte [ebp - 0x1d7]
test eax, eax
je 0x448fc3
push 0
push 0x2584
push 0xe88
push 0x6bc
push 0x2037
push 0x24ad
push 0x2278
push 0x4f8
push 0x24a1
push 0x151c
push 0x19c7
push 0x19d7
push 0x848
push 0x42
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0
lea ecx, [ebp - 0x13b8]
call fcn.00401379
push dword [eax]
lea ecx, [ebp - 0x19a0]
call fcn.00401379
cmp dword [eax], 0
je 0x448fe4
jmp 0x448fe9
jmp 0x448f35
lea ecx, [ebp - 0x13b8]
call fcn.00401a1f
lea ecx, [ebp - 0x19a0]
call fcn.00401a1f
mov dword [ebp - 0x7a8], 4
mov dword [ebp - 0xf54], 0xdedb
mov dword [ebp - 0xf4c], 1
mov dword [ebp - 0x7b0], 0x310fecaf
mov dword [ebp - 0x1534], 0xc752f67d
cmp dword [ebp - 0x7a8], 2
jae 0x449046
mov dword [ebp - 0xf64], 1
jmp 0x44904d
and dword [ebp - 0xf64], 0
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0xf4c]
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0x7b0]
cmp dword [ebp - 0xf54], eax
jne 0x44907f
mov dword [ebp - 0x7b8], 1
jmp 0x449086
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0xf54]
cmp dword [ebp - 0x7b8], eax
jne 0x4490a0
mov dword [ebp - 0xf5c], 1
jmp 0x4490a7
and dword [ebp - 0xf5c], 0
cmp dword [ebp - 0xf5c], 0xe056
jle 0x4490bf
mov dword [ebp - 0x7c0], 1
jmp 0x4490c6
and dword [ebp - 0x7c0], 0
cmp dword [ebp - 0x7c0], 1
je 0x4490db
mov dword [ebp - 0x7c8], 1
jmp 0x4490e2
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0xf64]
cmp eax, dword [ebp - 0x7c8]
jle 0x4490fc
mov dword [ebp - 0xf6c], 1
jmp 0x449103
and dword [ebp - 0xf6c], 0
mov eax, dword [ebp - 0xf6c]
mov dword [ebp - 0x1534], eax
mov byte [ebp - 0x1d9], 0
movzx eax, byte [ebp - 0x1d9]
test eax, eax
je 0x44912e
push 0x49f
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov byte [ebp - 0x1db], 0
or dword [ebp - 0x1884], 0xffffffff
or dword [ebp - 0x1880], 0xffffffff
or dword [ebp - 0x187c], 0xffffffff
or dword [ebp - 0x1878], 0xffffffff
lea ecx, [ebp - 0x6e5]
call fcn.00401a3b
push eax
lea eax, [ebp - 0x1874]
push eax
lea eax, [ebp - 0x1884]
push eax
lea ecx, [ebp - 0x1ec4]
call fcn.00401a3e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x13a0]
call fcn.004019f9
mov dword [ebp - 0xc4], 0xffffffff
mov dword [ebp - 0xc4], 0
jmp 0x4491a9
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jg 0x4493fc
mov dword [ebp - 0xf7c], 0xe779066
push 3
lea ecx, [ebp - 0x1a18]
call fcn.0040194d
mov dword [ebp - 0x144], 0
jmp 0x4491e6
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x449202
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x420], 0xa955a63a
jmp 0x4491d9
mov dword [ebp - 0x144], 0
jmp 0x44921b
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jge 0x44923d
push dword [ebp - 0x144]
lea ecx, [ebp - 0x1a18]
call fcn.00401379
mov dword [eax], 8
jmp 0x44920e
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x13a0]
call fcn.00401379
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x13a0]
call fcn.00401379
cmp dword [eax], 0
je 0x449280
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x420], 0
je 0x449280
mov dword [ebp - 0x7d0], 1
jmp 0x449287
and dword [ebp - 0x7d0], 0
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x13a0]
call fcn.00401379
mov eax, dword [eax]
cmp eax, dword [ebp - 0x7d0]
jge 0x4492ae
mov dword [ebp - 0xf74], 1
jmp 0x4492b5
and dword [ebp - 0xf74], 0
mov eax, dword [ebp - 0xf74]
neg eax
sub eax, 0x1137f0df
cmp eax, 0x6fdd8fb8
je 0x4492d5
mov dword [ebp - 0x7d8], 1
jmp 0x4492dc
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0xf7c]
cmp dword [ebp - 0x7d8], eax
jne 0x4492ff
cmp dword [ebp - 0xf7c], 0
je 0x4492ff
mov dword [ebp - 0x7e0], 1
jmp 0x449306
and dword [ebp - 0x7e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x420]
cmp dword [ebp - 0x7e0], eax
jl 0x449327
mov dword [ebp - 0x153c], 1
jmp 0x44932e
and dword [ebp - 0x153c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x420]
mov dword [ebp - 0x1d40], eax
push 4
pop eax
imul eax, eax, 0
imul esi, dword [ebp + eax - 0x420], 0xd365
push 1
lea ecx, [ebp - 0x13a0]
call fcn.00401379
cmp esi, dword [eax]
jg 0x44936f
mov dword [ebp - 0xf84], 1
jmp 0x449376
and dword [ebp - 0xf84], 0
cmp dword [ebp - 0xf84], 0xffff
jbe 0x44938e
mov dword [ebp - 0x7e8], 1
jmp 0x449395
and dword [ebp - 0x7e8], 0
cmp dword [ebp - 0x7e8], 0xc36544d1
ja 0x4493c9
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x13a0]
call fcn.00401379
cmp dword [eax], 0
jne 0x4493c9
cmp dword [ebp - 0xc4], 0
jne 0x4493c9
and dword [ebp - 0xf8c], 0
jmp 0x4493d3
mov dword [ebp - 0xf8c], 1
imul esi, dword [ebp - 0xf8c], 0xfff9
push 2
lea ecx, [ebp - 0x1a18]
call fcn.00401379
mov dword [eax], esi
lea ecx, [ebp - 0x1a18]
call fcn.00401a1f
jmp 0x44919c
lea ecx, [ebp - 0x13a0]
call fcn.00401a1f
movzx eax, byte [ebp - 0x1db]
test eax, eax
je 0x4496bd
mov dword [ebp - 0x200], 1
mov dword [ebp - 0x7f0], 4
mov dword [ebp - 0xfb4], 0xfffffffc
mov byte [ebp - 0x1dd], 0
movzx eax, byte [ebp - 0x1dd]
test eax, eax
je 0x449457
push 0
push 0
push 0x16f6
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [ebp - 0x200], 0xfffffff6
jmp 0x449470
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 2
jl 0x4496ae
mov dword [ebp - 0x15c], 1
mov dword [ebp - 0x1544], 1
mov dword [ebp - 0xf9c], 0xf7d26684
mov dword [ebp - 0x154c], 0x6920
mov dword [ebp - 0x15c], 0xfffffffb
jmp 0x4494be
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x11
jle 0x4496a9
push 4
lea ecx, [ebp - 0x17c4]
call fcn.0040194d
mov dword [ebp - 0x4dc], 0
jmp 0x4494f1
mov eax, dword [ebp - 0x4dc]
inc eax
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 4
jge 0x449513
push dword [ebp - 0x4dc]
lea ecx, [ebp - 0x17c4]
call fcn.00401379
mov dword [eax], 0xd2038e85
jmp 0x4494e4
cmp dword [ebp - 0x15c], 0
je 0x44953b
mov dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 0
je 0x44953b
mov dword [ebp - 0x818], 1
jmp 0x449542
and dword [ebp - 0x818], 0
push 1
lea ecx, [ebp - 0x17c4]
call fcn.00401379
cmp dword [eax], 0
je 0x44962e
mov eax, dword [ebp - 0x1544]
cmp dword [ebp - 0x15c], eax
jg 0x449572
mov dword [ebp - 0xf94], 1
jmp 0x449579
and dword [ebp - 0xf94], 0
cmp dword [ebp - 0xf94], 0xffffffff
jl 0x44958e
mov dword [ebp - 0x7f8], 1
jmp 0x449595
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0xf9c], eax
mov eax, dword [ebp - 0xf9c]
mov dword [ebp - 0x1bb0], eax
cmp dword [ebp - 0x15c], 2
jne 0x4495c2
mov dword [ebp - 0x800], 1
jmp 0x4495c9
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x800], eax
jl 0x4495e3
mov dword [ebp - 0xfa4], 1
jmp 0x4495ea
and dword [ebp - 0xfa4], 0
push 1
lea ecx, [ebp - 0x17c4]
call fcn.00401379
mov ecx, dword [ebp - 0xfa4]
cmp ecx, dword [eax]
jg 0x44960d
mov dword [ebp - 0x808], 1
jmp 0x449614
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x808], eax
jne 0x44962e
mov dword [ebp - 0xfac], 1
jmp 0x449635
and dword [ebp - 0xfac], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0xfac], eax
jl 0x449655
cmp dword [ebp - 0x15c], 0
jne 0x449655
and dword [ebp - 0x810], 0
jmp 0x44965f
mov dword [ebp - 0x810], 1
mov eax, dword [ebp - 0x810]
sub eax, dword [ebp - 0xfb4]
cmp eax, dword [ebp - 0xfb4]
jne 0x44967f
mov dword [ebp - 0xfbc], 1
jmp 0x449686
and dword [ebp - 0xfbc], 0
mov eax, dword [ebp - 0x818]
imul eax, dword [ebp - 0xfbc]
mov dword [ebp - 0x154c], eax
lea ecx, [ebp - 0x17c4]
call fcn.00401a1f
jmp 0x4494b1
jmp 0x449463
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
jmp 0x4488f8
or dword [ebp - 0x18d4], 0xffffffff
or dword [ebp - 0x18d0], 0xffffffff
or dword [ebp - 0x18cc], 0xffffffff
or dword [ebp - 0x18c8], 0xffffffff
lea ecx, [ebp - 0x6dd]
call fcn.00401a3b
push eax
lea eax, [ebp - 0x18c4]
push eax
lea eax, [ebp - 0x18d4]
push eax
lea ecx, [ebp - 0x1ef4]
call fcn.00401a3e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x13d0]
call fcn.004019f9
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0xcc], 0
jmp 0x449736
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jg 0x449989
mov dword [ebp - 0xfcc], 0xe779066
push 3
lea ecx, [ebp - 0x1928]
call fcn.0040194d
mov dword [ebp - 0x134], 0
jmp 0x449773
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x44978f
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x428], 0xa955a63a
jmp 0x449766
mov dword [ebp - 0x134], 0
jmp 0x4497a8
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 3
jge 0x4497ca
push dword [ebp - 0x134]
lea ecx, [ebp - 0x1928]
call fcn.00401379
mov dword [eax], 8
jmp 0x44979b
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x13d0]
call fcn.00401379
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x13d0]
call fcn.00401379
cmp dword [eax], 0
je 0x44980d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x428], 0
je 0x44980d
mov dword [ebp - 0x820], 1
jmp 0x449814
and dword [ebp - 0x820], 0
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x13d0]
call fcn.00401379
mov eax, dword [eax]
cmp eax, dword [ebp - 0x820]
jge 0x44983b
mov dword [ebp - 0xfc4], 1
jmp 0x449842
and dword [ebp - 0xfc4], 0
mov eax, dword [ebp - 0xfc4]
neg eax
sub eax, 0x1137f0df
cmp eax, 0x6fdd8fb8
je 0x449862
mov dword [ebp - 0x828], 1
jmp 0x449869
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0xfcc]
cmp dword [ebp - 0x828], eax
jne 0x44988c
cmp dword [ebp - 0xfcc], 0
je 0x44988c
mov dword [ebp - 0x830], 1
jmp 0x449893
and dword [ebp - 0x830], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x428]
cmp dword [ebp - 0x830], eax
jl 0x4498b4
mov dword [ebp - 0x1554], 1
jmp 0x4498bb
and dword [ebp - 0x1554], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x428]
mov dword [ebp - 0x1d14], eax
push 4
pop eax
imul eax, eax, 0
imul esi, dword [ebp + eax - 0x428], 0xd365
push 1
lea ecx, [ebp - 0x13d0]
call fcn.00401379
cmp esi, dword [eax]
jg 0x4498fc
mov dword [ebp - 0xfd4], 1
jmp 0x449903
and dword [ebp - 0xfd4], 0
cmp dword [ebp - 0xfd4], 0xffff
jbe 0x44991b
mov dword [ebp - 0x838], 1
jmp 0x449922
and dword [ebp - 0x838], 0
cmp dword [ebp - 0x838], 0xc36544d1
ja 0x449956
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x13d0]
call fcn.00401379
cmp dword [eax], 0
jne 0x449956
cmp dword [ebp - 0xcc], 0
jne 0x449956
and dword [ebp - 0xfdc], 0
jmp 0x449960
mov dword [ebp - 0xfdc], 1
imul esi, dword [ebp - 0xfdc], 0xfff9
push 2
lea ecx, [ebp - 0x1928]
call fcn.00401379
mov dword [eax], esi
lea ecx, [ebp - 0x1928]
call fcn.00401a1f
jmp 0x449729
lea ecx, [ebp - 0x13d0]
call fcn.00401a1f
mov dword [ebp - 0x38c], 0xfffffffa
push 1
lea ecx, [ebp - 0x1c94]
call fcn.0040194d
mov dword [ebp - 0x564], 0
jmp 0x4499c4
mov eax, dword [ebp - 0x564]
inc eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 1
jge 0x4499e6
push dword [ebp - 0x564]
lea ecx, [ebp - 0x1c94]
call fcn.00401379
mov dword [eax], 0x24cd
jmp 0x4499b7
mov dword [ebp - 0x38c], 0xffffffe4
jmp 0x4499ff
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 1
je 0x449a52
mov dword [ebp - 0x430], 0
jmp 0x449a21
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 3
jge 0x449a3d
mov eax, dword [ebp - 0x430]
mov dword [ebp + eax*4 - 0x1e44], 1
jmp 0x449a14
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x38c]
mov dword [ebp + eax - 0x1e44], ecx
jmp 0x4499f2
lea ecx, [ebp - 0x1c94]
call fcn.00401a1f
push 3
lea ecx, [ebp - 0x137c]
call fcn.0040194d
mov dword [ebp - 0x68], 0xffffffff
push 2
lea ecx, [ebp - 0x1770]
call fcn.0040194d
mov dword [ebp - 0x858], 1
mov dword [ebp - 0x154], 0
jmp 0x449aa1
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x449ac3
push dword [ebp - 0x154]
lea ecx, [ebp - 0x137c]
call fcn.00401379
mov dword [eax], 0x7f82
jmp 0x449a94
mov dword [ebp - 0x154], 0
jmp 0x449adc
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x449afe
push dword [ebp - 0x154]
lea ecx, [ebp - 0x1770]
call fcn.00401379
mov dword [eax], 0xfffffffd
jmp 0x449acf
mov dword [ebp - 0x68], 0
jmp 0x449b0e
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jg 0x449e3e
mov dword [ebp - 0x208], 0x4b25b3b9
mov dword [ebp - 0x2d0], 0xe135e1f6
mov dword [ebp - 0x35c], 0xffffffff
mov dword [ebp - 0x208], 2
jmp 0x449b4f
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jl 0x449e13
mov dword [ebp - 0x1a4], 8
mov dword [ebp - 0x1a4], 0
jmp 0x449b7f
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jg 0x449b94
mov dword [ebp - 0x2d0], 0x4f3d4e6
jmp 0x449b72
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x840], eax
push 0
lea ecx, [ebp - 0x1770]
call fcn.00401379
mov ecx, dword [ebp - 0x840]
mov dword [eax], ecx
mov eax, dword [ebp - 0x840]
add eax, 0x4b5a
cmp eax, dword [ebp - 0x208]
je 0x449bd4
mov dword [ebp - 0xfe4], 1
jmp 0x449bdb
and dword [ebp - 0xfe4], 0
mov eax, dword [ebp - 0x1a4]
imul eax, dword [ebp - 0xfe4]
test eax, eax
je 0x449bfd
or eax, 0xffffffff
je 0x449bfd
mov dword [ebp - 0x848], 1
jmp 0x449c04
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x848], eax
jl 0x449c24
cmp dword [ebp - 0x35c], 0
je 0x449c24
mov dword [ebp - 0xfec], 1
jmp 0x449c2b
and dword [ebp - 0xfec], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0xfec], eax
jne 0x449c42
mov dword [ebp - 0x850], 1
jmp 0x449c49
and dword [ebp - 0x850], 0
xor eax, eax
sub eax, dword [ebp - 0x850]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1a4], eax
jl 0x449c6e
mov dword [ebp - 0xff4], 1
jmp 0x449c75
and dword [ebp - 0xff4], 0
mov eax, dword [ebp - 0xff4]
mov dword [ebp - 0x858], eax
mov esi, dword [ebp - 0x858]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x137c]
call fcn.00401379
add esi, dword [eax]
jne 0x449cab
cmp dword [ebp - 0x1a4], 0
jne 0x449cab
and dword [ebp - 0x155c], 0
jmp 0x449cb5
mov dword [ebp - 0x155c], 1
push dword [ebp - 0x68]
lea ecx, [ebp - 0x137c]
call fcn.00401379
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x1da0], eax
push 0
lea ecx, [ebp - 0x1770]
call fcn.00401379
mov ecx, dword [ebp - 0x208]
cmp dword [eax], ecx
jne 0x449cef
mov dword [ebp - 0xffc], 1
jmp 0x449cf6
and dword [ebp - 0xffc], 0
push dword [ebp - 0x68]
lea ecx, [ebp - 0x137c]
call fcn.00401379
mov ecx, dword [ebp - 0xffc]
cmp ecx, dword [eax]
je 0x449df9
mov dword [ebp - 0x156c], 5
mov dword [ebp - 0x35c], 0
jmp 0x449d35
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 2
jg 0x449da4
mov dword [ebp - 0x1564], 0x8a0c0902
mov dword [ebp - 0x2d0], 2
jmp 0x449d61
mov eax, dword [ebp - 0x2d0]
dec eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0
jl 0x449d97
mov byte [ebp - 0x1df], 0
movzx eax, byte [ebp - 0x1df]
test eax, eax
je 0x449d95
push 0x2390
push 0x245
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x449d54
cmp dword [ebp - 0x1564], 0
je 0x449da2
jmp 0x449d28
jmp 0x449d28
cmp dword [ebp - 0x156c], 6
je 0x449db9
mov dword [ebp - 0x860], 1
jmp 0x449dc0
and dword [ebp - 0x860], 0
push dword [ebp - 0x68]
lea ecx, [ebp - 0x137c]
call fcn.00401379
mov ecx, dword [ebp - 0x860]
cmp ecx, dword [eax]
jle 0x449de4
mov dword [ebp - 0x1004], 1
jmp 0x449deb
and dword [ebp - 0x1004], 0
mov eax, dword [ebp - 0x1004]
mov dword [ebp - 0x2d0], eax
jmp 0x449e0e
mov dword [ebp - 0x1574], 0xfffc
cmp dword [ebp - 0x1574], 0
je 0x449e0e
jmp 0x449e13
jmp 0x449b42
mov byte [ebp - 0x1e1], 0
movzx eax, byte [ebp - 0x1e1]
test eax, eax
je 0x449e39
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
jmp 0x449b07
mov byte [ebp - 0x1e3], 0
movzx eax, byte [ebp - 0x1e3]
test eax, eax
je 0x449e62
push 0x19ac
push 0xee3
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
lea ecx, [ebp - 0x1770]
call fcn.00401a1f
lea ecx, [ebp - 0x137c]
call fcn.00401a1f
or dword [ebp - 0x18ac], 0xffffffff
or dword [ebp - 0x18a8], 0xffffffff
or dword [ebp - 0x18a4], 0xffffffff
or dword [ebp - 0x18a0], 0xffffffff
lea ecx, [ebp - 0x6bd]
call fcn.00401a3b
push eax
lea eax, [ebp - 0x189c]
push eax
lea eax, [ebp - 0x18ac]
push eax
lea ecx, [ebp - 0x1f1c]
call fcn.00401a3e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1394]
call fcn.004019f9
mov dword [ebp - 0xd4], 7
mov dword [ebp - 0x5e0], 0xfffffff7
mov dword [ebp - 0xd4], 0xffffffe7
jmp 0x449ef6
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xffffffe5
jl 0x44a0e7
mov dword [ebp - 0x158c], 0xfffffffd
mov dword [ebp - 0x4e4], 0
jmp 0x449f26
mov eax, dword [ebp - 0x4e4]
inc eax
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 4
jge 0x449f42
mov eax, dword [ebp - 0x4e4]
mov dword [ebp + eax*4 - 0x1a4c], 1
jmp 0x449f19
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x5e0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a4c]
mov dword [ebp - 0x1c00], eax
push 0xfffffffffffffffa
pop eax
cmp eax, 0xa93826a0
jne 0x449f77
mov dword [ebp - 0x157c], 1
jmp 0x449f7e
and dword [ebp - 0x157c], 0
mov eax, 0xd39d
test eax, eax
jne 0x449fa0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a4c], 0
jne 0x449fa0
and dword [ebp - 0x868], 0
jmp 0x449faa
mov dword [ebp - 0x868], 1
cmp dword [ebp - 0x868], 1
jg 0x449fbf
mov dword [ebp - 0x100c], 1
jmp 0x449fc6
and dword [ebp - 0x100c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1a4c]
sub eax, dword [ebp - 0x100c]
jne 0x449fec
cmp dword [ebp - 0xd4], 0
jne 0x449fec
and dword [ebp - 0x870], 0
jmp 0x449ff6
mov dword [ebp - 0x870], 1
cmp dword [ebp - 0x870], 0x69be541
je 0x44a00e
mov dword [ebp - 0x1014], 1
jmp 0x44a015
and dword [ebp - 0x1014], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x1014], eax
jg 0x44a02f
mov dword [ebp - 0x878], 1
jmp 0x44a036
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x878], eax
jne 0x44a050
mov dword [ebp - 0x1584], 1
jmp 0x44a057
and dword [ebp - 0x1584], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x1d3c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a4c], 0x5da2ca33
jle 0x44a082
mov dword [ebp - 0x101c], 1
jmp 0x44a089
and dword [ebp - 0x101c], 0
cmp dword [ebp - 0x101c], 0x859
jle 0x44a0a1
mov dword [ebp - 0x880], 1
jmp 0x44a0a8
and dword [ebp - 0x880], 0
mov dword [ebp - 0x5e0], 3
mov eax, dword [ebp - 0x5e0]
sub eax, dword [ebp - 0x880]
cmp eax, 5
ja 0x44a0cf
mov dword [ebp - 0x1024], 1
jmp 0x44a0d6
and dword [ebp - 0x1024], 0
mov eax, dword [ebp - 0x1024]
mov dword [ebp - 0x158c], eax
jmp 0x449ee9
mov dword [ebp - 0xe4], 0xffffffff
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x8a8], 0x9b8fa48a
mov dword [ebp - 0x185c], 0xb88cdf8a
mov dword [ebp - 0x1858], 0xb88cdf8a
mov dword [ebp - 0x1854], 0xb88cdf8a
mov dword [ebp - 0x1850], 0xb88cdf8a
lea ecx, [ebp - 0x6c5]
call fcn.00401a3b
push eax
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x185c]
push eax
lea ecx, [ebp - 0x1f2c]
call fcn.00401a3e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1934]
call fcn.004019f9
mov dword [ebp - 0x8b8], 1
mov dword [ebp - 0x159c], 9
mov dword [ebp - 0x24], 0
jmp 0x44a183
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x18
jne 0x44a3f7
mov dword [ebp - 0x5e8], 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x8a8], eax
or eax, 0xffffffff
jne 0x44a1b1
mov dword [ebp - 0x888], 1
jmp 0x44a1b8
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0x888], eax
jge 0x44a1d2
mov dword [ebp - 0x102c], 1
jmp 0x44a1d9
and dword [ebp - 0x102c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x102c], eax
je 0x44a1f0
mov dword [ebp - 0x890], 1
jmp 0x44a1f7
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x890], eax
je 0x44a20e
mov dword [ebp - 0x1034], 1
jmp 0x44a215
and dword [ebp - 0x1034], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1034], eax
jg 0x44a22c
mov dword [ebp - 0x898], 1
jmp 0x44a233
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x898], eax
jg 0x44a24a
mov dword [ebp - 0x6bc], 1
jmp 0x44a251
and dword [ebp - 0x6bc], 0
push 2
lea ecx, [ebp - 0x1934]
call fcn.00401379
mov ecx, dword [ebp - 0x6bc]
mov dword [eax], ecx
cmp dword [ebp - 0x6bc], 0
je 0x44a286
push 7
pop eax
test eax, eax
je 0x44a286
xor eax, eax
je 0x44a286
mov dword [ebp - 0x103c], 1
jmp 0x44a28d
and dword [ebp - 0x103c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x103c], eax
jle 0x44a2a4
mov dword [ebp - 0x8a0], 1
jmp 0x44a2ab
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0x455f992d
jne 0x44a2cc
mov eax, 0xc658
test eax, eax
je 0x44a2cc
mov dword [ebp - 0x1044], 1
jmp 0x44a2d3
and dword [ebp - 0x1044], 0
cmp dword [ebp - 0x1044], 0x90707e2
jg 0x44a2eb
mov dword [ebp - 0x1594], 1
jmp 0x44a2f2
and dword [ebp - 0x1594], 0
push 2
lea ecx, [ebp - 0x1934]
call fcn.00401379
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x8a8], eax
je 0x44a316
mov dword [ebp - 0x104c], 1
jmp 0x44a31d
and dword [ebp - 0x104c], 0
cmp dword [ebp - 0x104c], 6
jbe 0x44a332
mov dword [ebp - 0x8b0], 1
jmp 0x44a339
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x8b0]
sub eax, 0x12eba948
cmp eax, 0x5f0e77da
jge 0x44a357
mov dword [ebp - 0x1054], 1
jmp 0x44a35e
and dword [ebp - 0x1054], 0
mov eax, dword [ebp - 0x1054]
mov dword [ebp - 0x8b8], eax
cmp dword [ebp - 0x8b8], 0x3b5b0d6
jge 0x44a382
mov dword [ebp - 0x105c], 1
jmp 0x44a389
and dword [ebp - 0x105c], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x105c]
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x5e8], eax
jl 0x44a3b0
mov dword [ebp - 0x8c0], 1
jmp 0x44a3b7
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
add eax, 0x55d4
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x44a3df
mov eax, 0x70e74bb9
test eax, eax
je 0x44a3df
mov dword [ebp - 0x1064], 1
jmp 0x44a3e6
and dword [ebp - 0x1064], 0
mov eax, dword [ebp - 0x1064]
mov dword [ebp - 0x159c], eax
jmp 0x44a17c
lea ecx, [ebp - 0x1934]
call fcn.00401a1f
mov dword [ebp - 0xe4], 0
jmp 0x44a41b
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jg 0x44af4c
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x3b4], 0x3d4a1cf0
mov dword [ebp - 0x438], 0
jmp 0x44a455
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 4
jge 0x44a471
mov eax, dword [ebp - 0x438]
mov dword [ebp + eax*4 - 0x1f88], 0x6d0c11e0
jmp 0x44a448
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x118], eax
jg 0x44a48b
mov dword [ebp - 0x15a4], 1
jmp 0x44a492
and dword [ebp - 0x15a4], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1c08], eax
cmp dword [ebp - 0x118], 0
je 0x44a4bc
cmp dword [ebp - 0x118], 0
je 0x44a4bc
mov dword [ebp - 0x8c8], 1
jmp 0x44a4c3
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x8c8]
jl 0x44a4ea
push 5
pop eax
test eax, eax
jne 0x44a4ea
cmp dword [ebp - 0x118], 0
jne 0x44a4ea
and dword [ebp - 0x106c], 0
jmp 0x44a4f4
mov dword [ebp - 0x106c], 1
xor eax, eax
sub eax, dword [ebp - 0x106c]
jns 0x44a50a
mov dword [ebp - 0x8d0], 1
jmp 0x44a511
and dword [ebp - 0x8d0], 0
imul eax, dword [ebp - 0x8d0], 0x3191
cmp eax, dword [ebp - 0x118]
jg 0x44a52f
mov dword [ebp - 0x15ac], 1
jmp 0x44a536
and dword [ebp - 0x15ac], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1e00], eax
push 9
pop eax
cmp eax, 0xff63588c
je 0x44a558
mov dword [ebp - 0x1074], 1
jmp 0x44a55f
and dword [ebp - 0x1074], 0
mov eax, dword [ebp - 0x1074]
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3b4], 3
jmp 0x44a584
mov eax, dword [ebp - 0x3b4]
dec eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0
jl 0x44a5ad
mov byte [ebp - 0x1e2], 0
movzx eax, byte [ebp - 0x1e2]
test eax, eax
je 0x44a5ab
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
jmp 0x44a577
mov dword [ebp - 0x958], 0xe779066
mov dword [ebp - 0x53c], 0xea5d6c05
mov dword [ebp - 0x15b4], 1
mov dword [ebp - 0x53c], 0
jmp 0x44a5e4
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 4
je 0x44a880
push 1
lea ecx, [ebp - 0x194c]
call fcn.0040194d
push 1
lea ecx, [ebp - 0x1654]
call fcn.0040194d
mov dword [ebp - 0x900], 1
mov dword [ebp - 0xdc], 0
jmp 0x44a62e
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jge 0x44a650
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x194c]
call fcn.00401379
mov dword [eax], 0xe0b4074d
jmp 0x44a621
mov dword [ebp - 0xdc], 0
jmp 0x44a669
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jge 0x44a68b
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x1654]
call fcn.00401379
mov dword [eax], 0x66f5a9c4
jmp 0x44a65c
push 0
lea ecx, [ebp - 0x1654]
call fcn.00401379
and dword [eax], 0
jmp 0x44a6c1
push 0
lea ecx, [ebp - 0x1654]
call fcn.00401379
mov dword [ebp - 0x8d8], eax
mov eax, dword [ebp - 0x8d8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x8d8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1654]
call fcn.00401379
cmp dword [eax], 0
jg 0x44a865
mov dword [ebp - 0x328], 0x2121f90e
mov dword [ebp - 0x328], 0
jmp 0x44a6fa
mov eax, dword [ebp - 0x328]
dec eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jl 0x44a860
mov dword [ebp - 0x15bc], 0
mov dword [ebp - 0x8f8], 0x46b4
mov dword [ebp - 0x15c4], 0x491ba6b4
mov dword [ebp - 0x1094], 0xfa4c8210
cmp dword [ebp - 0x15b4], 0xffff
jae 0x44a747
mov dword [ebp - 0x107c], 1
jmp 0x44a74e
and dword [ebp - 0x107c], 0
mov eax, dword [ebp - 0x15bc]
cmp dword [ebp - 0x107c], eax
jle 0x44a768
mov dword [ebp - 0x8e0], 1
jmp 0x44a76f
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x900]
cmp dword [ebp - 0x8e0], eax
jle 0x44a789
mov dword [ebp - 0x1084], 1
jmp 0x44a790
and dword [ebp - 0x1084], 0
mov eax, dword [ebp - 0x8f8]
cmp dword [ebp - 0x1084], eax
jl 0x44a7b0
cmp dword [ebp - 0x15c4], 0
jne 0x44a7b0
and dword [ebp - 0x8e8], 0
jmp 0x44a7ba
mov dword [ebp - 0x8e8], 1
cmp dword [ebp - 0x8e8], 0x3c6f
je 0x44a7d2
mov dword [ebp - 0x108c], 1
jmp 0x44a7d9
and dword [ebp - 0x108c], 0
push dword [ebp - 0x328]
lea ecx, [ebp - 0x194c]
call fcn.00401379
mov eax, dword [eax]
sub eax, dword [ebp - 0x108c]
je 0x44a809
mov eax, 0xe7c14ab6
test eax, eax
je 0x44a809
mov dword [ebp - 0x8f0], 1
jmp 0x44a810
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x1094], eax
cmp dword [ebp - 0x1094], 0
jne 0x44a837
cmp dword [ebp - 0x8f8], 0
jne 0x44a837
and dword [ebp - 0x109c], 0
jmp 0x44a841
mov dword [ebp - 0x109c], 1
mov eax, dword [ebp - 0x109c]
mov dword [ebp - 0x900], eax
cmp dword [ebp - 0x328], 0
je 0x44a85b
jmp 0x44a6ed
jmp 0x44a6ed
jmp 0x44a69d
lea ecx, [ebp - 0x1654]
call fcn.00401a1f
lea ecx, [ebp - 0x194c]
call fcn.00401a1f
jmp 0x44a5d7
push 3
lea ecx, [ebp - 0x19e8]
call fcn.0040194d
mov dword [ebp - 0x4ec], 0xb26bdde0
mov dword [ebp - 0x364], 0xfffffffb
mov dword [ebp - 0x440], 0
jmp 0x44a8ba
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 2
jge 0x44a8d6
mov eax, dword [ebp - 0x440]
mov dword [ebp + eax*4 - 0x1e0c], 6
jmp 0x44a8ad
mov dword [ebp - 0x4ec], 0
jmp 0x44a8ef
mov eax, dword [ebp - 0x4ec]
dec eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 0xffffffea
jl 0x44a96a
mov dword [ebp - 0x364], 0xfb6318d5
mov dword [ebp - 0x364], 0xfffffff1
jmp 0x44a91b
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0xfffffffd
jle 0x44a965
mov dword [ebp - 0x394], 0xfffffffd
mov dword [ebp - 0x394], 0
jmp 0x44a947
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 2
jge 0x44a963
mov eax, dword [ebp - 0x394]
mov dword [ebp + eax*4 - 0x1e0c], 0x4ccb63e8
jmp 0x44a93a
jmp 0x44a90e
jmp 0x44a8e2
mov dword [ebp - 0x120], 0
jmp 0x44a983
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x44a99f
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x4f4], 0xa955a63a
jmp 0x44a976
mov dword [ebp - 0x16c], 0xffffffff
push 1
lea ecx, [ebp - 0x17a0]
call fcn.0040194d
mov dword [ebp - 0x678], 0x4df8e3bf
mov dword [ebp - 0x938], 0x435
mov dword [ebp - 0x448], 0
jmp 0x44a9e3
mov eax, dword [ebp - 0x448]
inc eax
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 1
jge 0x44aa05
push dword [ebp - 0x448]
lea ecx, [ebp - 0x17a0]
call fcn.00401379
mov dword [eax], 0x3638
jmp 0x44a9d6
mov dword [ebp - 0x16c], 0x11
jmp 0x44aa1e
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 6
jne 0x44acb3
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x920], 0xaf6082f4
mov dword [ebp - 0x15cc], 7
mov dword [ebp - 0x74], 0
jmp 0x44aa56
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x44aa73
push dword [ebp - 0x74]
lea ecx, [ebp - 0x17a0]
call fcn.00401379
cmp dword [eax], 0
je 0x44aa71
jmp 0x44aa73
jmp 0x44aa4f
push 0
lea ecx, [ebp - 0x17a0]
call fcn.00401379
cmp dword [ebp - 0x74], 0xfffffffa
jae 0x44aa92
mov dword [ebp - 0x10a4], 1
jmp 0x44aa99
and dword [ebp - 0x10a4], 0
mov eax, dword [ebp - 0x678]
cmp dword [ebp - 0x10a4], eax
jne 0x44aab3
mov dword [ebp - 0x908], 1
jmp 0x44aaba
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x908], eax
jl 0x44aad1
mov dword [ebp - 0x10ac], 1
jmp 0x44aad8
and dword [ebp - 0x10ac], 0
mov eax, dword [ebp - 0x678]
cmp dword [ebp - 0x10ac], eax
jl 0x44aaf2
mov dword [ebp - 0x910], 1
jmp 0x44aaf9
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x910], eax
jle 0x44ab13
mov dword [ebp - 0x10e8], 1
jmp 0x44ab1a
and dword [ebp - 0x10e8], 0
cmp dword [ebp - 0x10e8], 7
je 0x44ab32
cmp dword [ebp - 0x74], 0
jne 0x44ab32
and dword [ebp - 0x918], 0
jmp 0x44ab3c
mov dword [ebp - 0x918], 1
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x918]
jg 0x44ab5c
cmp dword [ebp - 0x920], 0
je 0x44ab5c
mov dword [ebp - 0x10f0], 1
jmp 0x44ab63
and dword [ebp - 0x10f0], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x10f0], eax
je 0x44ab7d
mov dword [ebp - 0x10f8], 1
jmp 0x44ab84
and dword [ebp - 0x10f8], 0
mov eax, dword [ebp - 0x920]
cmp dword [ebp - 0x10f8], eax
jge 0x44ab9e
mov dword [ebp - 0x928], 1
jmp 0x44aba5
and dword [ebp - 0x928], 0
cmp dword [ebp - 0x928], 0x65835a7a
je 0x44abbd
mov dword [ebp - 0x1100], 1
jmp 0x44abc4
and dword [ebp - 0x1100], 0
mov eax, dword [ebp - 0x938]
cmp dword [ebp - 0x1100], eax
jne 0x44abde
mov dword [ebp - 0x930], 1
jmp 0x44abe5
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x930]
sub eax, dword [ebp - 0x678]
add eax, dword [ebp - 0x15cc]
cmp dword [ebp - 0x16c], eax
jle 0x44ac0b
mov dword [ebp - 0x1108], 1
jmp 0x44ac12
and dword [ebp - 0x1108], 0
cmp dword [ebp - 0x1108], 0xe7aebb1b
je 0x44ac2a
mov dword [ebp - 0x15d4], 1
jmp 0x44ac31
and dword [ebp - 0x15d4], 0
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0x1c10], eax
mov eax, 0x1e18
test eax, eax
je 0x44ac5b
mov eax, 0x997
test eax, eax
je 0x44ac5b
mov dword [ebp - 0x1110], 1
jmp 0x44ac62
and dword [ebp - 0x1110], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x1110], eax
jge 0x44ac79
mov dword [ebp - 0x940], 1
jmp 0x44ac80
and dword [ebp - 0x940], 0
cmp dword [ebp - 0x940], 2
jg 0x44ac9b
cmp dword [ebp - 0x16c], 0
jne 0x44ac9b
and dword [ebp - 0x1118], 0
jmp 0x44aca5
mov dword [ebp - 0x1118], 1
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x74], eax
jmp 0x44aa11
lea ecx, [ebp - 0x17a0]
call fcn.00401a1f
mov dword [ebp - 0x120], 0
jmp 0x44acd7
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jge 0x44acf9
push dword [ebp - 0x120]
lea ecx, [ebp - 0x19e8]
call fcn.00401379
mov dword [eax], 8
jmp 0x44acca
mov dword [ebp - 0x450], 0x91a049fe
mov dword [ebp - 0x57c], 0
jmp 0x44ad1c
mov eax, dword [ebp - 0x57c]
inc eax
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 3
jge 0x44ad38
mov eax, dword [ebp - 0x57c]
mov dword [ebp + eax*4 - 0x1f60], 0xf84b8114
jmp 0x44ad0f
mov byte [ebp - 0x1b8], 0
movzx eax, byte [ebp - 0x1b8]
test eax, eax
je 0x44ad52
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 0x450], 0
jmp 0x44ad6b
mov eax, dword [ebp - 0x450]
dec eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0xfffffff2
jl 0x44ad8d
mov dword [ebp - 0x948], 7
mov eax, dword [ebp - 0x948]
dec eax
mov dword [ebp - 0x948], eax
jmp 0x44ad5e
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x1394]
call fcn.00401379
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x1394]
call fcn.00401379
cmp dword [eax], 0
je 0x44add0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4f4], 0
je 0x44add0
mov dword [ebp - 0x1120], 1
jmp 0x44add7
and dword [ebp - 0x1120], 0
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x1394]
call fcn.00401379
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1120]
jge 0x44adfe
mov dword [ebp - 0x950], 1
jmp 0x44ae05
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x950]
neg eax
sub eax, 0x1137f0df
cmp eax, 0x6fdd8fb8
je 0x44ae25
mov dword [ebp - 0x1128], 1
jmp 0x44ae2c
and dword [ebp - 0x1128], 0
mov eax, dword [ebp - 0x958]
cmp dword [ebp - 0x1128], eax
jne 0x44ae4f
cmp dword [ebp - 0x958], 0
je 0x44ae4f
mov dword [ebp - 0x1130], 1
jmp 0x44ae56
and dword [ebp - 0x1130], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f4]
cmp dword [ebp - 0x1130], eax
jl 0x44ae77
mov dword [ebp - 0x15dc], 1
jmp 0x44ae7e
and dword [ebp - 0x15dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f4]
mov dword [ebp - 0x1d44], eax
push 4
pop eax
imul eax, eax, 0
imul esi, dword [ebp + eax - 0x4f4], 0xd365
push 1
lea ecx, [ebp - 0x1394]
call fcn.00401379
cmp esi, dword [eax]
jg 0x44aebf
mov dword [ebp - 0x960], 1
jmp 0x44aec6
and dword [ebp - 0x960], 0
cmp dword [ebp - 0x960], 0xffff
jbe 0x44aede
mov dword [ebp - 0x1138], 1
jmp 0x44aee5
and dword [ebp - 0x1138], 0
cmp dword [ebp - 0x1138], 0xc36544d1
ja 0x44af19
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x1394]
call fcn.00401379
cmp dword [eax], 0
jne 0x44af19
cmp dword [ebp - 0xe4], 0
jne 0x44af19
and dword [ebp - 0x968], 0
jmp 0x44af23
mov dword [ebp - 0x968], 1
imul esi, dword [ebp - 0x968], 0xfff9
push 2
lea ecx, [ebp - 0x19e8]
call fcn.00401379
mov dword [eax], esi
lea ecx, [ebp - 0x19e8]
call fcn.00401a1f
jmp 0x44a40e
lea ecx, [ebp - 0x1394]
call fcn.00401a1f
mov dword [ebp - 0x210], 0x69fdf99f
mov dword [ebp - 0x1140], 0x2ea21e1d
mov dword [ebp - 0x544], 0xf4e1c2e9
mov dword [ebp - 0x1168], 0xfffffffb
mov dword [ebp - 0x15f4], 0xffffffff
push 3
lea ecx, [ebp - 0x1994]
call fcn.0040194d
mov dword [ebp - 0x128], 0
jmp 0x44afaf
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jge 0x44afce
push dword [ebp - 0x128]
lea ecx, [ebp - 0x1994]
call fcn.00401379
and dword [eax], 0
jmp 0x44afa2
mov dword [ebp - 0x128], 0
jmp 0x44afe7
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jge 0x44b003
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x1bc8], 0
jmp 0x44afda
mov dword [ebp - 0x210], 0
jmp 0x44b01c
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xfffffff0
jne 0x44b352
mov dword [ebp - 0x18c], 0xfffffff7
mov dword [ebp - 0x2d8], 0
push 2
lea ecx, [ebp - 0x197c]
call fcn.0040194d
mov dword [ebp - 0x458], 0
jmp 0x44b063
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 2
jge 0x44b082
push dword [ebp - 0x458]
lea ecx, [ebp - 0x197c]
call fcn.00401379
or dword [eax], 0xffffffff
jmp 0x44b056
mov byte [ebp - 0x1ac], 0
movzx eax, byte [ebp - 0x1ac]
test eax, eax
je 0x44b0bd
push 0x11fe
push 0
push 0
push 0x193a
push 0x8b3
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1140], eax
mov eax, dword [ebp - 0x1140]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp - 0x210], eax
jge 0x44b0ef
mov dword [ebp - 0x970], 1
jmp 0x44b0f6
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp - 0x544], eax
jge 0x44b125
cmp dword [ebp - 0x18c], 0
je 0x44b125
mov dword [ebp - 0x1148], 1
jmp 0x44b12c
and dword [ebp - 0x1148], 0
cmp dword [ebp - 0x1148], 2
jle 0x44b141
mov dword [ebp - 0x978], 1
jmp 0x44b148
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp - 0x978], eax
jg 0x44b162
mov dword [ebp - 0x1150], 1
jmp 0x44b169
and dword [ebp - 0x1150], 0
cmp dword [ebp - 0x1150], 0x7142b622
jg 0x44b181
mov dword [ebp - 0x980], 1
jmp 0x44b188
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x18c]
add eax, dword [ebp - 0x980]
cmp eax, dword [ebp - 0x544]
je 0x44b1a8
mov dword [ebp - 0x1158], 1
jmp 0x44b1af
and dword [ebp - 0x1158], 0
mov eax, dword [ebp - 0x1158]
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0
jne 0x44b1d6
cmp dword [ebp - 0x18c], 0
jne 0x44b1d6
and dword [ebp - 0x988], 0
jmp 0x44b1e0
mov dword [ebp - 0x988], 1
mov eax, dword [ebp - 0x988]
sub eax, dword [ebp - 0x1168]
inc eax
jne 0x44b201
cmp dword [ebp - 0x18c], 0
jne 0x44b201
and dword [ebp - 0x1160], 0
jmp 0x44b20b
mov dword [ebp - 0x1160], 1
cmp dword [ebp - 0x1160], 0x88ca
jge 0x44b223
mov dword [ebp - 0x990], 1
jmp 0x44b22a
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0x990], eax
jge 0x44b244
mov dword [ebp - 0x15e4], 1
jmp 0x44b24b
and dword [ebp - 0x15e4], 0
mov eax, dword [ebp - 0x1168]
mov dword [ebp - 0x1c18], eax
cmp dword [ebp - 0x210], 0x1d89e177
jge 0x44b26f
mov dword [ebp - 0x15ec], 1
jmp 0x44b276
and dword [ebp - 0x15ec], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1db4], eax
cmp dword [ebp - 0x15f4], 0xffffffff
jl 0x44b2a0
cmp dword [ebp - 0x544], 0
je 0x44b2a0
mov dword [ebp - 0x998], 1
jmp 0x44b2a7
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x998], eax
jge 0x44b2c1
mov dword [ebp - 0x1170], 1
jmp 0x44b2c8
and dword [ebp - 0x1170], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x1170], eax
jg 0x44b2e2
mov dword [ebp - 0x460], 1
jmp 0x44b2e9
and dword [ebp - 0x460], 0
push 1
lea ecx, [ebp - 0x197c]
call fcn.00401379
mov ecx, dword [ebp - 0x460]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x1994]
call fcn.00401379
mov ecx, dword [ebp - 0x460]
mov dword [eax], ecx
cmp dword [ebp - 0x460], 1
jg 0x44b328
mov dword [ebp - 0x9a0], 1
jmp 0x44b32f
and dword [ebp - 0x9a0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9a0]
mov dword [ebp + eax - 0x1bc8], ecx
lea ecx, [ebp - 0x197c]
call fcn.00401a1f
jmp 0x44b00f
lea ecx, [ebp - 0x1994]
call fcn.00401a1f
push 3
lea ecx, [ebp - 0x1664]
call fcn.0040194d
mov dword [ebp - 0x94], 0xe2236432
mov dword [ebp - 0x4fc], 0
jmp 0x44b38d
mov eax, dword [ebp - 0x4fc]
inc eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 3
jge 0x44b3af
push dword [ebp - 0x4fc]
lea ecx, [ebp - 0x1664]
call fcn.00401379
mov dword [eax], 0xb9b55bb2
jmp 0x44b380
mov dword [ebp - 0x94], 0
jmp 0x44b3c8
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jg 0x44b4e5
mov dword [ebp - 0x468], 0
jmp 0x44b3ee
mov eax, dword [ebp - 0x468]
inc eax
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 2
jge 0x44b40a
mov eax, dword [ebp - 0x468]
mov dword [ebp + eax*4 - 0x180c], 0
jmp 0x44b3e1
cmp dword [ebp - 0x94], 1
jge 0x44b41f
mov dword [ebp - 0x1178], 1
jmp 0x44b426
and dword [ebp - 0x1178], 0
push dword [ebp - 0x94]
lea ecx, [ebp - 0x1664]
call fcn.00401379
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1178]
jne 0x44b44d
mov dword [ebp - 0x15fc], 1
jmp 0x44b454
and dword [ebp - 0x15fc], 0
push dword [ebp - 0x94]
lea ecx, [ebp - 0x1664]
call fcn.00401379
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x94], eax
jl 0x44b47f
mov dword [ebp - 0x5f0], 1
jmp 0x44b486
and dword [ebp - 0x5f0], 0
push dword [ebp - 0x94]
lea ecx, [ebp - 0x1664]
call fcn.00401379
mov ecx, dword [ebp - 0x5f0]
mov dword [eax], ecx
cmp dword [ebp - 0x5f0], 0
jae 0x44b4b4
mov dword [ebp - 0x9a8], 1
jmp 0x44b4bb
and dword [ebp - 0x9a8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9a8]
mov dword [ebp + eax - 0x180c], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x180c], 0
je 0x44b4e0
jmp 0x44b4e5
jmp 0x44b3bb
lea ecx, [ebp - 0x1664]
call fcn.00401a1f
movzx eax, byte [0xa79328]
test eax, eax
je 0x44b50e
mov esi, 0x48726c
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x456e00
mov dword [ebp - 0x218], 0xac204e2d
mov dword [ebp - 0x1188], 0x4111d018
mov dword [ebp - 0x160c], 0xffffffff
mov dword [ebp - 0x218], 0xfffffff3
jmp 0x44b545
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 6
jne 0x44b6a9
mov dword [ebp - 0x36c], 1
mov dword [ebp - 0x1604], 0x6e3e
mov dword [ebp - 0x56c], 0
jmp 0x44b57f
mov eax, dword [ebp - 0x56c]
inc eax
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 1
jge 0x44b59b
mov eax, dword [ebp - 0x56c]
mov dword [ebp + eax*4 - 0x1c20], 0
jmp 0x44b572
mov dword [ebp - 0x36c], 0
jmp 0x44b5b4
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0
jg 0x44b5f9
mov byte [ebp - 0x1ae], 0
movzx eax, byte [ebp - 0x1ae]
test eax, eax
je 0x44b5f7
push 0x73f
push 0x2408
push 0x23d1
push 0xf22
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
jmp 0x44b5a7
cmp dword [ebp - 0x218], 0xfdc8
je 0x44b611
mov dword [ebp - 0x1180], 1
jmp 0x44b618
and dword [ebp - 0x1180], 0
cmp dword [ebp - 0x1180], 0x74a5
jge 0x44b630
mov dword [ebp - 0x9b0], 1
jmp 0x44b637
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x218]
add eax, dword [ebp - 0x9b0]
mov dword [ebp - 0x1188], eax
jne 0x44b660
cmp dword [ebp - 0x36c], 0
je 0x44b660
mov dword [ebp - 0x9b8], 1
jmp 0x44b667
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x1604]
imul eax, dword [ebp - 0x9b8]
cmp dword [ebp - 0x218], eax
jge 0x44b68e
mov eax, 0xbdeb
test eax, eax
jne 0x44b68e
and dword [ebp - 0x1190], 0
jmp 0x44b698
mov dword [ebp - 0x1190], 1
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x160c], eax
jmp 0x44b538
mov byte [ebp - 0x1e4], 0
movzx eax, byte [ebp - 0x1e4]
test eax, eax
je 0x44b6c5
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x6e4], 0xffffffff
mov dword [ebp - 0x9c8], 0xfffffff8
push 1
lea ecx, [ebp - 0x19ac]
call fcn.0040194d
mov dword [ebp - 0x174], 0xde574131
mov dword [ebp - 0x470], 0
jmp 0x44b710
mov eax, dword [ebp - 0x470]
inc eax
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 1
jge 0x44b732
push dword [ebp - 0x470]
lea ecx, [ebp - 0x19ac]
call fcn.00401379
mov dword [eax], 0x858f9c25
jmp 0x44b703
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x1d4c], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x78], eax
je 0x44b752
mov dword [ebp - 0x9c0], 1
jmp 0x44b759
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x6e4]
mov ecx, dword [ebp - 0x9c0]
lea eax, [ecx + eax - 0xa]
cmp eax, dword [ebp - 0x9c8]
jne 0x44b77d
mov dword [ebp - 0x1198], 1
jmp 0x44b784
and dword [ebp - 0x1198], 0
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x1198]
jge 0x44b809
mov dword [ebp - 0x504], 0
jmp 0x44b7a8
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 4
jge 0x44b7c4
mov eax, dword [ebp - 0x504]
mov dword [ebp + eax*4 - 0x1db0], 9
jmp 0x44b79b
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1db0], 0
jne 0x44b7e2
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1db0], 0
push 0
lea ecx, [ebp - 0x19ac]
call fcn.00401379
push 4
pop ecx
imul ecx, ecx, 3
xor edx, edx
sub edx, dword [ebp + ecx - 0x1db0]
imul edx, dword [eax]
mov dword [ebp - 0x9c8], edx
jmp 0x44b888
mov dword [ebp - 0x1614], 7
mov byte [ebp - 0x1b0], 0
movzx eax, byte [ebp - 0x1b0]
test eax, eax
je 0x44b82b
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp dword [ebp - 0x6e4], 0
je 0x44b874
mov eax, dword [ebp - 0x174]
dec eax
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x1614]
add eax, dword [ebp - 0x174]
je 0x44b874
mov dword [ebp - 0x78], 0xfffffff5
jmp 0x44b85f
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x22
jne 0x44b872
cmp dword [ebp - 0x174], 0
je 0x44b870
jmp 0x44b872
jmp 0x44b858
jmp 0x44b888
mov dword [ebp - 0x161c], 0xb4af
mov dword [ebp - 0x161c], 0
mov dword [ebp - 0x78], 0
jmp 0x44b898
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jg 0x44b900
mov byte [ebp - 0x281], 0
movzx eax, byte [ebp - 0x281]
test eax, eax
je 0x44b8bd
push 0x19cb
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x174], 0
jmp 0x44b8d6
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jg 0x44b8fe
mov byte [ebp - 0x1b2], 0
movzx eax, byte [ebp - 0x1b2]
test eax, eax
je 0x44b8fc
push 0xea
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x44b8c9
jmp 0x44b891
lea ecx, [ebp - 0x19ac]
call fcn.00401a1f
mov dword [ebp - 0x308], 0x3c69aed2
push 1
lea ecx, [ebp - 0x1674]
call fcn.0040194d
mov dword [ebp - 0x1c28], 0x1c77dcd
mov dword [ebp - 0x1df0], 0x5b65ab4d
mov dword [ebp - 0x1c30], 5
mov dword [ebp - 0x3c], 0
jmp 0x44b950
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x44b96c
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1674]
call fcn.00401379
mov dword [eax], 0x1ff29acd
jmp 0x44b949
mov dword [ebp - 0x3c], 0
jmp 0x44b97c
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x44b992
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1524], 0xfffffff9
jmp 0x44b975
mov dword [ebp - 0x3c], 0
jmp 0x44b9a2
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x44b9b8
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1788], 0xfff6
jmp 0x44b99b
cmp dword [ebp - 0x308], 7
jge 0x44b9cd
mov dword [ebp - 0x9d0], 1
jmp 0x44b9d4
and dword [ebp - 0x9d0], 0
mov eax, 0x23b1a956
sub eax, dword [ebp - 0x308]
jne 0x44ba1d
cmp dword [ebp - 0x308], 0
ja 0x44b9ff
mov eax, 0x906c
test eax, eax
je 0x44b9ff
mov dword [ebp - 0x11a0], 1
jmp 0x44ba06
and dword [ebp - 0x11a0], 0
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x11a0], eax
jl 0x44ba1d
and dword [ebp - 0x11a8], 0
jmp 0x44ba27
mov dword [ebp - 0x11a8], 1
mov eax, dword [ebp - 0x9d0]
cmp eax, dword [ebp - 0x11a8]
jge 0x44ba41
mov dword [ebp - 0x9d8], 1
jmp 0x44ba48
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x9d8], eax
jle 0x44ba62
mov dword [ebp - 0x11b0], 1
jmp 0x44ba69
and dword [ebp - 0x11b0], 0
push 0
lea ecx, [ebp - 0x1674]
call fcn.00401379
mov ecx, dword [ebp - 0x11b0]
mov dword [eax], ecx
cmp dword [ebp - 0x308], 1
jg 0x44ba93
mov dword [ebp - 0x9f0], 1
jmp 0x44ba9a
and dword [ebp - 0x9f0], 0
push 0
lea ecx, [ebp - 0x1674]
call fcn.00401379
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1788]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1788], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1788], 0
je 0x44baee
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1524], 0
je 0x44baee
mov dword [ebp - 0x9e0], 1
jmp 0x44baf5
and dword [ebp - 0x9e0], 0
cmp dword [ebp - 0x9e0], 0xffffffff
je 0x44bb0a
mov dword [ebp - 0x11b8], 1
jmp 0x44bb11
and dword [ebp - 0x11b8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1788]
cmp dword [ebp - 0x11b8], eax
jge 0x44bb31
mov dword [ebp - 0x9e8], 1
jmp 0x44bb38
and dword [ebp - 0x9e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1524]
cmp dword [ebp - 0x9e8], eax
jl 0x44bb59
mov dword [ebp - 0x11c0], 1
jmp 0x44bb60
and dword [ebp - 0x11c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1524]
cmp dword [ebp - 0x11c0], eax
jg 0x44bb81
mov dword [ebp - 0x11c8], 1
jmp 0x44bb88
and dword [ebp - 0x11c8], 0
mov eax, dword [ebp - 0x9f0]
cmp eax, dword [ebp - 0x11c8]
jg 0x44bba2
mov dword [ebp - 0x9f8], 1
jmp 0x44bba9
and dword [ebp - 0x9f8], 0
imul esi, dword [ebp - 0x9f8], 0x17ba
push 0
lea ecx, [ebp - 0x1674]
call fcn.00401379
mov dword [eax], esi
lea ecx, [ebp - 0x1674]
call fcn.00401a1f
mov dword [ebp - 0x228], 0x69fdf99f
mov dword [ebp - 0xc18], 0x2ea21e1d
push 3
lea ecx, [ebp - 0x1ca4]
call fcn.0040194d
mov dword [ebp - 0x478], 0
jmp 0x44bc07
mov eax, dword [ebp - 0x478]
inc eax
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 3
jge 0x44bc29
push dword [ebp - 0x478]
lea ecx, [ebp - 0x1ca4]
call fcn.00401379
mov dword [eax], 2
jmp 0x44bbfa
mov byte [ebp - 0x1e9], 0
movzx eax, byte [ebp - 0x1e9]
test eax, eax
je 0x44bc4a
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov byte [ebp - 0x1b4], 0
movzx eax, byte [ebp - 0x1b4]
test eax, eax
je 0x44bc64
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [ebp - 0x1ca4]
call fcn.00401a1f
mov dword [ebp - 0x4b8], 0xf4e1c2e9
mov dword [ebp - 0xc40], 0xfffffffb
mov dword [ebp - 0x1d54], 0xb319
mov dword [ebp - 0x1c38], 0x5c8094a
mov dword [ebp - 0x1dc8], 0
mov dword [ebp - 0x1c40], 0
mov dword [ebp - 0x1d5c], 1
mov dword [ebp - 0x1a94], 0x36f6dd8d
mov dword [ebp - 0x1a9c], 0x693e93
mov dword [ebp - 0x1aa4], 0xfffffffb
mov dword [ebp - 0x1aac], 0
mov dword [ebp - 0x11d0], 0x1b0ae28d
mov dword [ebp - 0xec], 0
jmp 0x44bd00
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jge 0x44bd1c
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x1f3c], 1
jmp 0x44bcf3
mov dword [ebp - 0xec], 0
jmp 0x44bd35
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jge 0x44bd51
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x1f54], 0xffffffff
jmp 0x44bd28
mov eax, dword [ebp - 0x11d0]
dec eax
mov dword [ebp - 0x11d0], eax
mov dword [ebp - 0x1484], 0xffffffff
push 3
lea ecx, [ebp - 0x19dc]
call fcn.0040194d
mov dword [ebp - 0xc], 0xbeaa32b1
mov dword [ebp - 0x130], 0x7102d149
mov dword [ebp - 0x19c], 0xfffffffa
mov dword [ebp - 0x54c], 0
jmp 0x44bda9
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 2
jge 0x44bdc5
mov eax, dword [ebp - 0x54c]
mov dword [ebp + eax*4 - 0x135c], 0x47d1afd0
jmp 0x44bd9c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1ab4], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1abc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1ac4], eax
mov eax, 0xc865b49d
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0xa00], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa00]
mov dword [ebp + eax - 0x135c], ecx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0xa00]
cmp dword [ebp - 0x130], eax
je 0x44be2a
mov dword [ebp - 0x11d8], 1
jmp 0x44be31
and dword [ebp - 0x11d8], 0
mov eax, dword [ebp - 0x11d8]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1acc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1ad4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x19c]
cmp dword [ebp + eax - 0x135c], ecx
jg 0x44be73
mov dword [ebp - 0xa08], 1
jmp 0x44be7a
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xa08]
cmp eax, dword [ebp - 0xc]
jl 0x44be94
mov dword [ebp - 0x11e0], 1
jmp 0x44be9b
and dword [ebp - 0x11e0], 0
mov eax, dword [ebp - 0x11e0]
sub eax, dword [ebp - 0xc]
je 0x44c122
mov dword [ebp - 0x488], 0x1826fbd1
mov byte [ebp - 0x251], 0
movzx eax, byte [ebp - 0x251]
test eax, eax
je 0x44bece
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov dword [ebp - 0x130], 0
jmp 0x44bee7
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jg 0x44c120
mov dword [ebp - 0x50c], 0xcf7d
mov dword [ebp - 0x1adc], 6
mov eax, dword [ebp - 0x488]
dec eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0xc], 0
jmp 0x44bf25
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jg 0x44c11b
push 3
lea ecx, [ebp - 0x720]
call fcn.0040194d
mov dword [ebp - 0x480], 0
jmp 0x44bf55
mov eax, dword [ebp - 0x480]
inc eax
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 3
jge 0x44bf77
push dword [ebp - 0x480]
lea ecx, [ebp - 0x720]
call fcn.00401379
mov dword [eax], 0xd3cd3624
jmp 0x44bf48
imul esi, dword [ebp - 0xc], 0xfffc
push 2
lea ecx, [ebp - 0x720]
call fcn.00401379
cmp esi, dword [eax]
je 0x44bfb6
push 2
lea ecx, [ebp - 0x720]
call fcn.00401379
cmp dword [eax], 0
je 0x44bfb1
lea ecx, [ebp - 0x720]
call fcn.00401a1f
jmp 0x44c11b
jmp 0x44c10b
mov dword [ebp - 0x1624], 0x72c2e8b5
mov dword [ebp - 0x50c], 2
jmp 0x44bfd9
mov eax, dword [ebp - 0x50c]
dec eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 0
jl 0x44c10b
mov dword [ebp - 0xa18], 0x3c5ebb4e
mov dword [ebp - 0x162c], 0xfffffff6
push dword [ebp - 0xc]
lea ecx, [ebp - 0x720]
call fcn.00401379
mov esi, eax
push dword [ebp - 0xc]
lea ecx, [ebp - 0x720]
call fcn.00401379
mov ecx, dword [esi]
mov dword [eax], ecx
mov esi, dword [ebp - 0x488]
push 2
lea ecx, [ebp - 0x720]
call fcn.00401379
cmp esi, dword [eax]
je 0x44c03f
mov dword [ebp - 0x5f8], 1
jmp 0x44c046
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x5f8]
mov dword [ebp + eax*4 - 0x135c], ecx
cmp dword [ebp - 0x5f8], 0
jne 0x44c071
mov eax, 0xeda1e1cf
test eax, eax
jne 0x44c071
and dword [ebp - 0xa10], 0
jmp 0x44c07b
mov dword [ebp - 0xa10], 1
cmp dword [ebp - 0xa10], 0xfffffffd
jle 0x44c090
mov dword [ebp - 0x11e8], 1
jmp 0x44c097
and dword [ebp - 0x11e8], 0
mov eax, dword [ebp - 0x1624]
imul eax, dword [ebp - 0x11e8]
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0xa18]
sub eax, 5
mov dword [ebp - 0x19c], eax
mov esi, dword [ebp - 0x19c]
push 2
lea ecx, [ebp - 0x720]
call fcn.00401379
add esi, dword [eax]
push 2
lea ecx, [ebp - 0x720]
call fcn.00401379
add esi, dword [eax]
mov eax, dword [ebp - 0x488]
add eax, esi
jne 0x44c0f3
mov dword [ebp - 0x11f0], 1
jmp 0x44c0fa
and dword [ebp - 0x11f0], 0
mov eax, dword [ebp - 0x11f0]
mov dword [ebp - 0x162c], eax
jmp 0x44bfcc
lea ecx, [ebp - 0x720]
call fcn.00401a1f
jmp 0x44bf1e
jmp 0x44beda
jmp 0x44c157
mov dword [ebp - 0x19c], 0
jmp 0x44c13b
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x44c157
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x135c], 0xa90cffae
jmp 0x44c12e
mov dword [ebp - 0xf4], 0xfd4914d2
push 1
lea ecx, [ebp - 0x1694]
call fcn.0040194d
push 1
lea ecx, [ebp - 0x1330]
call fcn.0040194d
push 3
lea ecx, [ebp - 0x1684]
call fcn.0040194d
mov dword [ebp - 0x18], 0
jmp 0x44c198
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x44c1b4
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1694]
call fcn.00401379
mov dword [eax], 1
jmp 0x44c191
mov dword [ebp - 0x18], 0
jmp 0x44c1c4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x44c1dd
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1330]
call fcn.00401379
and dword [eax], 0
jmp 0x44c1bd
mov dword [ebp - 0x18], 0
jmp 0x44c1ed
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x44c209
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1684]
call fcn.00401379
mov dword [eax], 1
jmp 0x44c1e6
cmp dword [ebp - 0xf4], 0x5a59
jne 0x44c221
mov dword [ebp - 0x1200], 1
jmp 0x44c228
and dword [ebp - 0x1200], 0
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0xf4]
je 0x44c248
mov dword [ebp - 0xa20], 1
jmp 0x44c24f
and dword [ebp - 0xa20], 0
cmp dword [ebp - 0xa20], 0xbde283bc
jne 0x44c267
mov dword [ebp - 0x11f8], 1
jmp 0x44c26e
and dword [ebp - 0x11f8], 0
mov eax, dword [ebp - 0x11f8]
add eax, 0x1d30baa
je 0x44c288
push 0
lea ecx, [ebp - 0x1694]
call fcn.00401379
push 0
lea ecx, [ebp - 0x1330]
call fcn.00401379
mov ecx, dword [ebp - 0x1200]
cmp ecx, dword [eax]
jle 0x44c2ab
mov dword [ebp - 0xa4c], 1
jmp 0x44c2b2
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0xa4c], eax
jge 0x44c2de
push 0
lea ecx, [ebp - 0x1330]
call fcn.00401379
cmp dword [eax], 0
je 0x44c2de
mov dword [ebp - 0xa30], 1
jmp 0x44c2e5
and dword [ebp - 0xa30], 0
push 1
lea ecx, [ebp - 0x1684]
call fcn.00401379
mov ecx, dword [ebp - 0xa30]
cmp ecx, dword [eax]
je 0x44c308
mov dword [ebp - 0xe88], 1
jmp 0x44c30f
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0xf4]
imul eax, dword [ebp - 0xe88]
imul eax, eax, 0xb3ae
cmp eax, 0x11b5
jne 0x44c335
mov dword [ebp - 0xa38], 1
jmp 0x44c33c
and dword [ebp - 0xa38], 0
push 0
lea ecx, [ebp - 0x1694]
call fcn.00401379
mov ecx, dword [ebp - 0xa38]
cmp ecx, dword [eax]
jle 0x44c35f
mov dword [ebp - 0x10e0], 1
jmp 0x44c366
and dword [ebp - 0x10e0], 0
push 0
lea ecx, [ebp - 0x1330]
call fcn.00401379
mov ecx, dword [ebp - 0x10e0]
cmp ecx, dword [eax]
jle 0x44c389
mov dword [ebp - 0xa40], 1
jmp 0x44c390
and dword [ebp - 0xa40], 0
push 1
lea ecx, [ebp - 0x1684]
call fcn.00401379
mov ecx, dword [ebp - 0xa40]
add ecx, dword [eax]
jne 0x44c3b0
mov eax, 0x9a164e62
test eax, eax
je 0x44c3ce
push 0
lea ecx, [ebp - 0x1694]
call fcn.00401379
cmp dword [eax], 0
je 0x44c3ce
mov dword [ebp - 0xe90], 1
jmp 0x44c3d5
and dword [ebp - 0xe90], 0
push 0
lea ecx, [ebp - 0x1330]
call fcn.00401379
mov ecx, dword [ebp - 0xe90]
cmp ecx, dword [eax]
jne 0x44c3f8
pop edi
pop esi
mov esp, ebp
pop ebp
ret