Function at 0x4447ed
Capabilities:
Clear file content
Get graphical window text
Parse pe header
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9e8
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x690], 0
mov dword [ebp - 0x780], 0x33e235bd
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x60], 0
jne 0x444840
mov eax, 0x1f2e
test eax, eax
jne 0x444840
and dword [ebp - 0x2f8], 0
jmp 0x44484a
mov dword [ebp - 0x2f8], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2f8], eax
jge 0x444861
mov dword [ebp - 0x578], 1
jmp 0x444868
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x578], eax
jge 0x44487f
mov dword [ebp - 0x574], 1
jmp 0x444886
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x24], eax
je 0x4448a3
mov dword [ebp - 0x558], 1
jmp 0x4448aa
and dword [ebp - 0x558], 0
cmp dword [ebp - 0x558], 0x6e2b
je 0x4448c2
mov dword [ebp - 0x23c], 1
jmp 0x4448c9
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x23c]
add eax, 0x9008
je 0x4448dd
cmp dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x60]
je 0x4448fe
mov dword [ebp - 0x67c], 0x4142
mov dword [ebp - 0x67c], 0xc7c6f1fd
jmp 0x444ba4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1ac], 0xffffffff
mov dword [ebp - 0x1c8], 5
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x60], eax
jne 0x44493d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x7dc], eax
xor eax, eax
sub eax, dword [ebp - 0x114]
jne 0x44493d
and dword [ebp - 0x3d4], 0
jmp 0x444947
mov dword [ebp - 0x3d4], 1
cmp dword [ebp - 0x3d4], 1
jae 0x44495c
mov dword [ebp - 0x674], 1
jmp 0x444963
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x18], 0x4eb300a9
jle 0x444981
mov dword [ebp - 0x244], 1
jmp 0x444988
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x244], eax
je 0x4449a8
cmp dword [ebp - 0x60], 0
jne 0x4449a8
cmp dword [ebp - 0x18], 0
jne 0x4449a8
and dword [ebp - 0x514], 0
jmp 0x4449b2
mov dword [ebp - 0x514], 1
imul eax, dword [ebp - 0x514], 0
cmp dword [ebp - 0x24], eax
jl 0x4449ca
mov dword [ebp - 0x24c], 1
jmp 0x4449d1
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x24c], eax
je 0x4449e8
mov dword [ebp - 0x3ec], 1
jmp 0x4449ef
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x3ec]
add eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jge 0x444a0c
mov dword [ebp - 0x254], 1
jmp 0x444a13
and dword [ebp - 0x254], 0
cmp dword [ebp - 0x254], 0x587697ab
jge 0x444a2b
mov dword [ebp - 0x4b4], 1
jmp 0x444a32
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x4b4], eax
je 0x444a4c
mov dword [ebp - 0x25c], 1
jmp 0x444a53
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x7ec], eax
cmp dword [ebp - 0x18], 0
je 0x444b43
mov dword [ebp - 0x1ac], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1ac], eax
jle 0x444a9c
mov dword [ebp - 0x3f4], 1
jmp 0x444aa3
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x3f4], eax
jne 0x444aba
mov dword [ebp - 0x594], 1
jmp 0x444ac1
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0x85c], eax
cmp dword [ebp - 0x18], 0
je 0x444ae8
cmp dword [ebp - 0x1c8], 0
je 0x444ae8
mov dword [ebp - 0x264], 1
jmp 0x444aef
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x264], 0xffffffff
jl 0x444b04
mov dword [ebp - 0x570], 1
jmp 0x444b0b
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x570], eax
jge 0x444b22
mov dword [ebp - 0x26c], 1
jmp 0x444b29
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x26c], eax
jg 0x444b43
mov dword [ebp - 0x3fc], 1
jmp 0x444b4a
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x3fc]
jl 0x444b6d
cmp dword [ebp - 0x114], 0
je 0x444b6d
mov dword [ebp - 0x274], 1
jmp 0x444b74
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x274]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x24]
jle 0x444b8e
mov dword [ebp - 0x4bc], 1
jmp 0x444b95
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4bc]
sub eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0xab], 0
movzx eax, byte [ebp - 0xab]
test eax, eax
je 0x444bc3
push 0
push 0xa44
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x864], 7
mov dword [ebp - 0x86c], 0x915a1369
mov dword [ebp - 0x880], 0x6cce57bf
mov dword [ebp - 0x888], 0x6e5c7a00
mov dword [ebp - 0xf0], 0xeec54165
mov dword [ebp - 0x890], 0xfffffffb
mov dword [ebp - 0x8a8], 1
mov dword [ebp - 0x27c], 7
mov dword [ebp - 0x150], 0
jmp 0x444c30
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x444c4c
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x930], 0xc74aa0d7
jmp 0x444c23
mov eax, dword [ebp - 0x27c]
dec eax
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0xf0], 0
jmp 0x444c72
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jg 0x444c8f
mov eax, dword [ebp - 0xf0]
cmp dword [ebp + eax*4 - 0x930], 0
je 0x444c8d
jmp 0x444c8f
jmp 0x444c65
mov dword [ebp - 0x120], 0xb60e
mov dword [ebp - 0x698], 0xfffffffe
mov dword [ebp - 0x224], 0xc2184e5a
mov dword [ebp - 0xb8], 0x5ebec5ec
mov dword [ebp - 0x8b0], 1
mov dword [ebp - 0x8b8], 0x8670fc24
mov dword [ebp - 0x8c0], 0x67e784b5
mov dword [ebp - 0x8c8], 0x73e70d2
mov dword [ebp - 0x8d0], 0x92891f43
mov dword [ebp - 0x828], 0x9020024
mov dword [ebp - 0x22c], 0x37280dd
mov dword [ebp - 0xc], 0
jmp 0x444d0d
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x444d23
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x950], 4
jmp 0x444d06
mov dword [ebp - 0xc], 0
jmp 0x444d33
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x444d49
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x9c0], 0xfffffffa
jmp 0x444d2c
mov dword [ebp - 0xc], 0
jmp 0x444d59
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x444d6f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x960], 4
jmp 0x444d52
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x8cc], eax
mov dword [ebp - 0x698], 0xfffffff6
mov eax, dword [ebp - 0x224]
add eax, 0xffff
cmp eax, 0xfffffffc
jbe 0x444dad
mov dword [ebp - 0x404], 1
jmp 0x444db4
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x224]
cmp dword [ebp - 0x404], eax
jne 0x444dce
mov dword [ebp - 0x6cc], 1
jmp 0x444dd5
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x740], eax
cmp dword [ebp - 0xb8], 0x141a9c21
jne 0x444df9
mov dword [ebp - 0x284], 1
jmp 0x444e00
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x120]
sub eax, dword [ebp - 0x284]
imul eax, eax, 0x4b5a
sub eax, dword [ebp - 0xb8]
je 0x444e33
cmp dword [ebp - 0xb8], 0
je 0x444e33
xor eax, eax
je 0x444e33
mov dword [ebp - 0x51c], 1
jmp 0x444e3a
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
add eax, 0x63bb2b1e
cmp eax, dword [ebp - 0x224]
jg 0x444e59
mov dword [ebp - 0x28c], 1
jmp 0x444e60
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x28c], eax
jle 0x444e80
cmp dword [ebp - 0x120], 0
jne 0x444e80
and dword [ebp - 0x40c], 0
jmp 0x444e8a
mov dword [ebp - 0x40c], 1
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x6c0], 0xcf59
jge 0x444ec7
mov dword [ebp - 0x294], 1
jmp 0x444ece
and dword [ebp - 0x294], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x294]
mov dword [ebp + eax - 0x960], ecx
mov dword [ebp - 0x3e4], 0xe91a049f
mov dword [ebp - 0x3e0], 0xe91a049f
mov dword [ebp - 0x3dc], 0xe91a049f
mov dword [ebp - 0x3d8], 0xe91a049f
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x2dc], 0xf1a504a8
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x20], 3
jmp 0x444f34
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x445353
mov dword [ebp - 0x10], 0xaa39ed0
mov dword [ebp - 0x10c], 1
mov byte [ebp - 0x7b], 0
movzx eax, byte [ebp - 0x7b]
test eax, eax
je 0x444f79
push 0x1f60
push 0
push 0x398
push 0
push 0x1937
push 0x78c
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x10], 3
jmp 0x444f89
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x44534e
mov dword [ebp - 0x6c], 0xd56974ed
mov dword [ebp - 0x88], 0x7d228d5f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x6c], 0
jle 0x444fbf
mov dword [ebp - 0x4c4], 1
jmp 0x444fc6
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x10], eax
jge 0x444ff5
mov dword [ebp - 0x29c], 1
jmp 0x444ffc
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x29c]
jge 0x445020
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e4], 0
jne 0x445020
and dword [ebp - 0x414], 0
jmp 0x44502a
mov dword [ebp - 0x414], 1
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp + eax*4 - 0x3e4], 0xffffffff
cmp eax, dword [ebp - 0x414]
jg 0x445049
mov dword [ebp - 0x66c], 1
jmp 0x445050
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x10]
mov ecx, 0x7f51ef99
sub ecx, dword [ebp + eax*4 - 0x3e4]
je 0x445073
cmp dword [ebp - 0x20], 0
je 0x445073
mov dword [ebp - 0x2a4], 1
jmp 0x44507a
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x2a4]
test eax, eax
je 0x44513e
mov dword [ebp - 0x5a0], 0x8e7ea1b1
mov dword [ebp - 0x63c], 0xb9567464
cmp dword [ebp - 0x20], 0
je 0x4450d9
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x5a0]
jne 0x4450be
xor eax, eax
jne 0x4450be
and dword [ebp - 0x54c], 0
jmp 0x4450c8
mov dword [ebp - 0x54c], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x54c]
jl 0x4450eb
cmp dword [ebp - 0x20], 0
jne 0x4450eb
cmp dword [ebp - 0x10c], 0
jne 0x4450eb
and dword [ebp - 0x2ac], 0
jmp 0x4450f5
mov dword [ebp - 0x2ac], 1
mov eax, dword [ebp - 0x6c]
imul eax, dword [ebp - 0x2ac]
test eax, eax
jne 0x44511c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e4], 0
jne 0x44511c
and dword [ebp - 0x41c], 0
jmp 0x445126
mov dword [ebp - 0x41c], 1
mov eax, dword [ebp - 0x10c]
imul eax, dword [ebp - 0x41c]
mov dword [ebp - 0x63c], eax
jmp 0x44531c
mov dword [ebp - 0x188], 0x3a3a1bbd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x748], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x6c], eax
je 0x445165
mov dword [ebp - 0x2b4], 1
jmp 0x44516c
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2b4], eax
jge 0x445183
mov dword [ebp - 0x4cc], 1
jmp 0x44518a
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x3e4]
sub eax, dword [ebp - 0x4cc]
cmp eax, 0xabdc
jge 0x4451ad
mov dword [ebp - 0x2bc], 1
jmp 0x4451b4
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x2bc]
cmp eax, 0xffffffff
je 0x4451d7
cmp dword [ebp - 0x188], 0
je 0x4451d7
mov dword [ebp - 0x424], 1
jmp 0x4451de
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x424]
jle 0x4451f5
mov dword [ebp - 0x2c4], 1
jmp 0x4451fc
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
sub eax, dword [ebp - 0x188]
cmp eax, 0xc6aa04d9
jb 0x44521b
mov dword [ebp - 0x524], 1
jmp 0x445222
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x524], eax
jne 0x445242
cmp dword [ebp - 0x6c], 0
je 0x445242
mov dword [ebp - 0x2cc], 1
jmp 0x445249
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
je 0x445271
push 8
pop eax
test eax, eax
je 0x445271
mov dword [ebp - 0x42c], 1
jmp 0x445278
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x42c], eax
jl 0x44528f
mov dword [ebp - 0x2d4], 1
jmp 0x445296
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
lea eax, [eax*4 - 0x1b020e14]
test eax, eax
je 0x4452b8
or eax, 0xffffffff
je 0x4452b8
mov dword [ebp - 0x4d4], 1
jmp 0x4452bf
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x4d4], eax
jne 0x4452f2
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x4452f0
push 0x203b
push 0
push 0xaea
push 0x1a02
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x4452fa
cmp dword [ebp - 0x10], 0
je 0x4452fa
jmp 0x44534e
mov byte [ebp - 0x7f], 0
movzx eax, byte [ebp - 0x7f]
test eax, eax
je 0x44531c
push 0
push 0
push 0x2644
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [ebp - 0x88], 0
jmp 0x445335
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jg 0x445349
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x10c], eax
jmp 0x445328
jmp 0x444f82
jmp 0x444f2d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x88c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3e4]
cmp dword [ebp - 0x2dc], eax
je 0x44537c
mov dword [ebp - 0x434], 1
jmp 0x445383
and dword [ebp - 0x434], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e4], 0
jne 0x4453a2
cmp dword [ebp - 0x20], 0
jne 0x4453a2
and dword [ebp - 0x2e4], 0
jmp 0x4453ac
mov dword [ebp - 0x2e4], 1
mov eax, dword [ebp - 0x434]
add eax, dword [ebp - 0x2e4]
cmp eax, 0xffffffff
jbe 0x4453c9
mov dword [ebp - 0x568], 1
jmp 0x4453d0
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x568]
sub eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0x1d0]
jl 0x4453f0
mov dword [ebp - 0x5a8], 1
jmp 0x4453f7
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x750], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x128], 0
jmp 0x44542c
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x445448
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x838], 0
jmp 0x44541f
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x44546f
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov byte [ebp - 0x83], 0
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x445490
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0xd0], 0x9c77509c
mov dword [ebp - 0x28], 0xbe856dfc
mov dword [ebp - 0x4c], 0x35c0de45
mov dword [ebp - 0x200], 1
mov dword [ebp - 0x54], 0
jmp 0x4454cb
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x4454e1
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xe4], 0xffffffff
jmp 0x4454c4
mov dword [ebp - 0x54], 0
jmp 0x4454f1
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x445507
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x5b0], 4
jmp 0x4454ea
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0x758], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0x8bc], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xe4]
cmp dword [ebp + eax - 0xe4], ecx
je 0x445553
mov dword [ebp - 0x2ec], 1
jmp 0x44555a
and dword [ebp - 0x2ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
cmp dword [ebp - 0x2ec], eax
jge 0x44558b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe4], 0
je 0x44558b
mov dword [ebp - 0x43c], 1
jmp 0x445592
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
dec eax
mov dword [ebp - 0xd0], eax
je 0x4455ad
mov dword [ebp - 0x2f4], 1
jmp 0x4455b4
and dword [ebp - 0x2f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
cmp dword [ebp - 0x2f4], eax
jge 0x4455d5
mov dword [ebp - 0x4dc], 1
jmp 0x4455dc
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 1
jne 0x4455f1
mov dword [ebp - 0x2fc], 1
jmp 0x4455f8
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x2fc]
add eax, 9
mov dword [ebp - 0x28], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
cmp dword [ebp - 0x28], eax
jne 0x445622
mov dword [ebp - 0x444], 1
jmp 0x445629
and dword [ebp - 0x444], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0x760], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x768], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0x894], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp + ecx - 0xe4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
cmp dword [ebp - 0xd0], eax
jg 0x4456a8
mov dword [ebp - 0x52c], 1
jmp 0x4456af
and dword [ebp - 0x52c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0x770], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe4]
shl eax, 1
mov ecx, dword [ebp - 0x200]
add ecx, 0xb17b
imul eax, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x200]
imul eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x28]
jg 0x445709
mov dword [ebp - 0x304], 1
jmp 0x445710
and dword [ebp - 0x304], 0
cmp dword [ebp - 0x304], 0x997ec53a
jae 0x445728
mov dword [ebp - 0x30c], 1
jmp 0x44572f
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x52c]
cmp eax, dword [ebp - 0x30c]
jl 0x445749
mov dword [ebp - 0x44c], 1
jmp 0x445750
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x44c], eax
jge 0x4457c2
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x445782
push 0x2138
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [ebp - 0x28], 0
jmp 0x445792
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x4457bd
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0xe4], 0
je 0x4457a7
jmp 0x4457bd
mov byte [ebp - 0x7c], 0
movzx eax, byte [ebp - 0x7c]
test eax, eax
je 0x4457bb
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x44578b
jmp 0x445912
mov dword [ebp - 0xc0], 1
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x778], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x4c], eax
jl 0x4457f8
cmp dword [ebp - 0xc0], 0
je 0x4457f8
mov dword [ebp - 0x314], 1
jmp 0x4457ff
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x314], eax
jg 0x445819
mov dword [ebp - 0x4e4], 1
jmp 0x445820
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0xc0]
sub eax, dword [ebp - 0x4e4]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0xe4]
jne 0x44584a
cmp dword [ebp - 0x4c], 0
jne 0x44584a
and dword [ebp - 0x31c], 0
jmp 0x445854
mov dword [ebp - 0x31c], 1
cmp dword [ebp - 0x31c], 1
jl 0x445869
mov dword [ebp - 0x454], 1
jmp 0x445870
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x454], eax
jle 0x445887
mov dword [ebp - 0x640], 1
jmp 0x44588e
and dword [ebp - 0x640], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0x8e8], eax
cmp dword [ebp - 0x4c], 0
jne 0x4458b3
xor eax, eax
jne 0x4458b3
and dword [ebp - 0x324], 0
jmp 0x4458bd
mov dword [ebp - 0x324], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x324]
sub ecx, dword [ebp + eax - 0x5b0]
mov dword [ebp - 0x28], ecx
or eax, 0xffffffff
sub eax, dword [ebp - 0xc0]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xe4]
je 0x4458f9
mov dword [ebp - 0x554], 1
jmp 0x445900
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x1cc]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x445c5b
mov dword [ebp - 0x1d8], 0x6c9
mov dword [ebp - 0x688], 0xf29acd40
mov dword [ebp - 0x5d0], 0xfffffffa
mov dword [ebp - 0x33c], 0xfffffffb
mov dword [ebp - 0x5c8], 1
mov dword [ebp - 0x1e0], 0x7b722ba7
mov dword [ebp - 0x72c], 0xfffffff8
mov dword [ebp - 0x208], 0xffffffff
mov dword [ebp - 0x648], 0x1c587c7a
mov dword [ebp - 0x850], 5
mov dword [ebp - 0x650], 0x28d9ba5f
mov dword [ebp - 0x5b8], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x5c0], 0xfffffffb
mov dword [ebp - 0x190], 0
jmp 0x4459cb
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 4
jge 0x4459e7
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x9e8], 1
jmp 0x4459be
cmp dword [ebp - 0x1d8], 0
jne 0x445a7f
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x788], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
imul eax, dword [ebp - 0x1e0]
cmp eax, dword [ebp - 0x1e0]
je 0x445a2d
mov dword [ebp - 0x32c], 1
jmp 0x445a34
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x5b8]
cmp dword [ebp - 0x32c], eax
jg 0x445a4e
mov dword [ebp - 0x45c], 1
jmp 0x445a55
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x1d8]
add eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x45c]
jne 0x445a7f
and dword [ebp - 0x334], 0
jmp 0x445a89
mov dword [ebp - 0x334], 1
mov eax, dword [ebp - 0x648]
cmp dword [ebp - 0x334], eax
jle 0x445aa3
mov dword [ebp - 0x4ec], 1
jmp 0x445aaa
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x5c0], 0
jne 0x445ad1
cmp dword [ebp - 0x33c], 0
jne 0x445ad1
and dword [ebp - 0x68c], 0
jmp 0x445adb
mov dword [ebp - 0x68c], 1
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x8a4], eax
cmp dword [ebp - 0x1e0], 8
jbe 0x445afc
mov dword [ebp - 0x464], 1
jmp 0x445b03
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
add eax, 0x221ebc5f
imul eax, dword [ebp - 0x650]
cmp eax, dword [ebp - 0x5d0]
jle 0x445b29
mov dword [ebp - 0x344], 1
jmp 0x445b30
and dword [ebp - 0x344], 0
cmp dword [ebp - 0x344], 0xb137
jg 0x445b48
mov dword [ebp - 0x534], 1
jmp 0x445b4f
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 0xffffffff
jge 0x445b70
mov dword [ebp - 0x6bc], 0x183a0997
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x208], eax
jmp 0x445bc2
mov dword [ebp - 0x5d8], 0xfffffff7
mov dword [ebp - 0x130], 0
jmp 0x445b93
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x445baf
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x7f8], 1
jmp 0x445b86
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7f8]
mov dword [ebp - 0x5d8], eax
mov dword [ebp - 0x8e4], 0xffffffff
mov dword [ebp - 0x8e0], 0xffffffff
mov dword [ebp - 0x8dc], 0xffffffff
mov dword [ebp - 0x8d8], 0xffffffff
mov dword [ebp - 0x198], 0x18885c6f
mov dword [ebp - 0x198], 3
jmp 0x445c0d
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jl 0x445c54
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x445c35
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x445c52
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x445c00
xor eax, eax
jmp 0x44898a
mov dword [ebp - 8], 0x642c
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x1a0], 0x478c
mov dword [ebp - 0x694], 0
mov dword [ebp - 0x138], 0
jmp 0x445c99
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x445cb5
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x580], 0x42b9193c
jmp 0x445c8c
cmp dword [ebp - 8], 0
jne 0x445d73
mov eax, dword [ebp - 8]
mov dword [ebp - 0x790], eax
cmp dword [ebp - 8], 0
jne 0x445cdd
cmp dword [ebp - 8], 0
jne 0x445cdd
and dword [ebp - 0x34c], 0
jmp 0x445ce7
mov dword [ebp - 0x34c], 1
cmp dword [ebp - 0x34c], 0xb060
jge 0x445cff
mov dword [ebp - 0x46c], 1
jmp 0x445d06
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 8]
jle 0x445d20
mov dword [ebp - 0x1e8], 1
jmp 0x445d27
and dword [ebp - 0x1e8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1e8]
mov dword [ebp + eax - 0x580], ecx
cmp dword [ebp - 0x1e8], 0x643
jne 0x445d52
mov dword [ebp - 0x354], 1
jmp 0x445d59
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x1a0], eax
jne 0x445d7a
push 4
pop eax
test eax, eax
jne 0x445d87
xor eax, eax
jne 0x445d87
and dword [ebp - 0x4f4], 0
jmp 0x445d91
mov dword [ebp - 0x4f4], 1
cmp dword [ebp - 0x4f4], 0xf5aee0cd
ja 0x445db2
mov eax, 0x5734
test eax, eax
je 0x445db2
mov dword [ebp - 0x35c], 1
jmp 0x445db9
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x35c]
cmp eax, 0x969b42c5
ja 0x445dd6
mov dword [ebp - 0x474], 1
jmp 0x445ddd
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x474], eax
jne 0x445df7
mov dword [ebp - 0x364], 1
jmp 0x445dfe
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x364]
jle 0x445e41
mov dword [ebp - 8], 0
jmp 0x445e19
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jg 0x445e3c
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x445e3a
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
jmp 0x445e12
jmp 0x445f58
mov dword [ebp - 0x228], 0xbf0a
mov dword [ebp - 0x4fc], 0x81fdf20b
mov dword [ebp - 0x5e8], 0xfffffffd
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x90]
mov dword [ebp + eax - 0x580], ecx
cmp dword [ebp - 0x228], 0
je 0x445e97
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x580], 0
je 0x445e97
mov dword [ebp - 0x658], 1
jmp 0x445e9e
and dword [ebp - 0x658], 0
cmp dword [ebp - 8], 0
jne 0x445eb0
mov dword [ebp - 0x5e0], 1
jmp 0x445eb7
and dword [ebp - 0x5e0], 0
cmp dword [ebp - 0x694], 6
jle 0x445ecc
mov dword [ebp - 0x56c], 1
jmp 0x445ed3
and dword [ebp - 0x56c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x580]
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x228], eax
jl 0x445efa
mov dword [ebp - 0x36c], 1
jmp 0x445f01
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x228]
sub eax, dword [ebp - 0x36c]
je 0x445f24
cmp dword [ebp - 0x4fc], 0
je 0x445f24
mov dword [ebp - 0x47c], 1
jmp 0x445f2b
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0x47c], eax
jl 0x445f45
mov dword [ebp - 0x374], 1
jmp 0x445f4c
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x4fc], eax
mov dword [ebp - 8], 0
jmp 0x445f68
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jne 0x44600f
mov dword [ebp - 0x90], 0x13
jmp 0x445f8b
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffffc
jl 0x44600a
mov dword [ebp - 0x660], 0x5c25cceb
cmp dword [ebp - 0x1a0], 0
je 0x445fe3
cmp dword [ebp - 0x660], 0
je 0x445fb2
jmp 0x44600a
mov byte [ebp - 0x84], 0
movzx eax, byte [ebp - 0x84]
test eax, eax
je 0x445fe1
push 0
push 0xe74
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x446005
mov byte [ebp - 0x80], 0
movzx eax, byte [ebp - 0x80]
test eax, eax
je 0x446005
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
jmp 0x445f7e
jmp 0x445f61
mov eax, dword [ebp - 0x1cc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0x1a8], 0xffffffff
mov dword [ebp - 0x140], 0
jmp 0x446044
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 4
jge 0x446060
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x970], 1
jmp 0x446037
mov dword [ebp - 0x1a8], 0xfffffffd
jmp 0x446079
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xfffffff2
jle 0x4460dd
mov dword [ebp - 0x110], 0x8f8256a
mov dword [ebp - 0x110], 0
jmp 0x4460a5
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 4
jge 0x4460c1
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x970], 0xf72d
jmp 0x446098
mov byte [ebp - 0xaf], 0
movzx eax, byte [ebp - 0xaf]
test eax, eax
je 0x4460db
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x44606c
mov eax, dword [ebp - 0xf4]
cmp dword [eax], 0x4550
je 0x4464c8
mov dword [ebp - 0x148], 0xfdf99ff6
mov dword [ebp - 0x8f8], 0xfffffffa
mov dword [ebp - 0x8f4], 0xfffffffa
mov dword [ebp - 0x8f0], 0xfffffffa
mov dword [ebp - 0x8ec], 0xfffffffa
mov dword [ebp - 0x148], 0
jmp 0x44613a
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xfffffff4
jg 0x446245
mov dword [ebp - 0xf8], 8
mov dword [ebp - 0x1b0], 0
jmp 0x44616a
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jge 0x446186
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x93c], 0xa11015aa
jmp 0x44615d
mov dword [ebp - 0xf8], 0xfffffffb
jmp 0x44619f
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xffffffed
jg 0x446240
mov dword [ebp - 0x5f0], 0xfffffffe
mov dword [ebp - 0x6c4], 0x13b01d91
cmp dword [ebp - 0x5f0], 0x1813
jl 0x4461de
cmp dword [ebp - 0xf8], 0
jne 0x4461de
and dword [ebp - 0x37c], 0
jmp 0x4461e8
mov dword [ebp - 0x37c], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x93c], 0x5eb2
jne 0x446207
mov dword [ebp - 0x484], 1
jmp 0x44620e
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x37c]
cmp eax, dword [ebp - 0x484]
jne 0x446228
mov dword [ebp - 0x384], 1
jmp 0x44622f
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x6c4], eax
jmp 0x446192
jmp 0x44612d
mov dword [ebp - 0xc8], 5
mov dword [ebp - 0xe8], 0x442e1191
mov dword [ebp - 0x504], 0xfffa
mov dword [ebp - 0x39c], 0xcc099843
mov dword [ebp - 0x154], 0xfffffffd
mov dword [ebp - 0x3a4], 0x284818a
mov dword [ebp - 0x69c], 0xe21e5250
mov dword [ebp - 0x1b8], 0
jmp 0x4462a4
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 4
jge 0x4462c0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x728], 0x4ea33a4d
jmp 0x446297
mov eax, 0xc3ad3b31
test eax, eax
je 0x446473
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x728]
cmp dword [ebp - 0xc8], eax
je 0x4462ee
mov dword [ebp - 0x5f8], 1
jmp 0x4462f5
and dword [ebp - 0x5f8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x728]
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x8c4], eax
cmp dword [ebp - 0x39c], 4
jge 0x446334
mov dword [ebp - 0x53c], 1
jmp 0x44633b
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0xe8]
imul eax, dword [ebp - 0x53c]
add eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0xe8]
jg 0x44636e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x728], 0
jne 0x44636e
and dword [ebp - 0x38c], 0
jmp 0x446378
mov dword [ebp - 0x38c], 1
imul eax, dword [ebp - 0x38c], 0x10cb
cmp eax, 0xa90ef874
jne 0x446395
mov dword [ebp - 0x48c], 1
jmp 0x44639c
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
neg eax
imul eax, eax, 0xc3da
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
jne 0x4463d7
mov eax, 0x85a06c0f
test eax, eax
jne 0x4463d7
and dword [ebp - 0x394], 0
jmp 0x4463e1
mov dword [ebp - 0x394], 1
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0x394], eax
jle 0x4463f6
cmp dword [ebp - 0x154], 0
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x504], 0
je 0x446420
cmp dword [ebp - 0xc8], 0
je 0x446420
mov dword [ebp - 0x668], 1
jmp 0x446427
and dword [ebp - 0x668], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x728]
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x39c], 0
je 0x446455
push 7
pop eax
test eax, eax
je 0x446455
mov dword [ebp - 0x494], 1
jmp 0x44645c
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x494]
jl 0x446473
cmp dword [ebp - 0x154], 0
jne 0x446485
mov eax, 0x6c7e
test eax, eax
jne 0x446485
and dword [ebp - 0x600], 0
jmp 0x44648f
mov dword [ebp - 0x600], 1
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x69c], eax
mov byte [ebp - 0x82], 0
movzx eax, byte [ebp - 0x82]
test eax, eax
je 0x4464c1
push 0
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
jmp 0x44898a
push 0x413a
push 0x2333
push 1
push dword [ebp - 0xf4]
push 1
push 0x2b59
push 0x3a3b
lea eax, [ebp - 0x13c]
push eax
push 1
push 0x1faf
call fcn.0043d445
add esp, 0x28
mov dword [ebp - 0x98], 0x40d7f825
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0xd8], 0x2a83a0f0
mov dword [ebp - 0x108], 8
mov dword [ebp - 0x8ac], 5
mov dword [ebp - 0x98], 0
jmp 0x446547
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xfffffff1
jge 0x44696f
mov dword [ebp - 0x30], 0xbd2a
mov dword [ebp - 0x100], 3
mov dword [ebp - 0x158], 0
jmp 0x44657e
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x44659a
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x210], 0x6992f1e5
jmp 0x446571
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1f0], eax
mov eax, 0x677b
sub eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x30], eax
jl 0x4465bf
mov dword [ebp - 0x3b4], 1
jmp 0x4465c6
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x30], eax
jg 0x4465dd
mov dword [ebp - 0x55c], 1
jmp 0x4465e4
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 9
jne 0x4465f9
mov dword [ebp - 0x3ac], 1
jmp 0x446600
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x3ac], eax
je 0x446617
mov dword [ebp - 0x49c], 1
jmp 0x44661e
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x49c], eax
je 0x446635
mov dword [ebp - 0x50c], 1
jmp 0x44663c
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x3b4]
imul eax, dword [ebp - 0x50c]
cmp eax, dword [ebp - 0x30]
jle 0x44665a
mov dword [ebp - 0x608], 1
jmp 0x446661
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jne 0x446694
cmp dword [ebp - 0x1f0], 0
jne 0x446694
and dword [ebp - 0x3bc], 0
jmp 0x44669e
mov dword [ebp - 0x3bc], 1
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0xd8], 0
jmp 0x4466c3
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x44696a
mov dword [ebp - 0x670], 0xb39d2057
mov dword [ebp - 0x620], 0xe769035a
mov dword [ebp - 0x678], 0xffffffff
cmp dword [ebp - 0x670], 0
je 0x44693f
mov dword [ebp - 0x868], 0x2a6f9a4d
mov dword [ebp - 0x618], 0xfffffffd
mov dword [ebp - 0x610], 0x656e2e31
mov dword [ebp - 0x30], 0
jmp 0x446729
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jg 0x44693d
mov dword [ebp - 0x4a4], 0xbc25
mov dword [ebp - 0x3c4], 0x9a0165d3
mov dword [ebp - 0x15c], 0
jmp 0x446760
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jge 0x44677c
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x7b8], 0xfffffff7
jmp 0x446753
mov eax, dword [ebp - 0x4a4]
inc eax
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x108], 0
jmp 0x4467a2
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jl 0x446938
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x18c], 0
jmp 0x4467d2
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jge 0x4467ee
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x3cc], 0xfffffffe
jmp 0x4467c5
mov dword [ebp - 0x100], 0
jmp 0x446807
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jg 0x446933
mov dword [ebp - 0x6c8], 0xe67e784b
mov eax, dword [ebp - 0x3c4]
dec eax
mov dword [ebp - 0x3c4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x210], 0
jne 0x4468cf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x210]
sub eax, dword [ebp - 0x610]
cmp eax, 0xfffffff8
ja 0x446873
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3cc], 0
je 0x446873
mov dword [ebp - 0x4ac], 1
jmp 0x44687a
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x544]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3cc]
add ecx, dword [ebp - 0x4ac]
cmp eax, ecx
jg 0x4468b1
mov dword [ebp - 0x234], 1
jmp 0x4468b8
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x618]
cmp dword [ebp - 0x234], eax
jle 0x4468cf
and dword [ebp - 0x238], 0
jmp 0x4468d9
mov dword [ebp - 0x238], 1
mov eax, dword [ebp - 0x678]
cmp dword [ebp - 0x238], eax
je 0x4468f3
mov dword [ebp - 0x240], 1
jmp 0x4468fa
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp + eax*4 - 0x210]
cmp eax, dword [ebp - 0x240]
je 0x44691b
mov dword [ebp - 0x248], 1
jmp 0x446922
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x620], eax
jmp 0x4467fa
jmp 0x446795
jmp 0x446722
jmp 0x446965
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x446965
push 0
push 0x23af
push 0xb0f
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
jmp 0x4466b6
jmp 0x44653a
cmp dword [ebp - 0x13c], 0
jne 0x446f76
mov dword [ebp - 0x8d4], 0xfffffff9
mov dword [ebp - 0x7c0], 0xd6b9c2d6
mov dword [ebp - 0x220], 0xfffffffa
mov dword [ebp - 0x1f8], 0
mov dword [ebp - 0x298], 0x38a83a56
mov dword [ebp - 0x14], 0
jmp 0x4469be
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x4469d4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9a8], 0x7f82
jmp 0x4469b7
mov dword [ebp - 0x14], 0
jmp 0x4469e4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x4469fa
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x564], 0x7d8a8701
jmp 0x4469dd
mov dword [ebp - 0x14], 0
jmp 0x446a0a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x446a20
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x288], 0
jmp 0x446a03
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x564], 2
jmp 0x446a4e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x564]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x564], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x564], 0
jl 0x446c9a
mov dword [ebp - 0x598], 0xe58d020b
mov dword [ebp - 0x810], 0x8d303f02
mov dword [ebp - 0x290], 0xffffffff
mov dword [ebp - 0x7c8], 0xf1e5c8a5
mov dword [ebp - 0x814], 0x9cea445a
mov dword [ebp - 0x7d0], 1
mov dword [ebp - 0x81c], 0xfffffff6
mov dword [ebp - 0x59c], 0xc86695cd
mov dword [ebp - 0x7d8], 0
mov dword [ebp - 0x80c], 0xb4448110
mov dword [ebp - 0x630], 0xfffffffb
mov dword [ebp - 0x7e0], 0
mov dword [ebp - 0x680], 1
mov dword [ebp - 0x164], 0
jmp 0x446afd
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x446b19
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x9b4], 0
jmp 0x446af0
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x684], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x1f8]
dec eax
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x684]
cmp eax, dword [ebp - 0x628]
jle 0x446b58
mov dword [ebp - 0x250], 1
jmp 0x446b5f
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x680]
cmp dword [ebp - 0x250], eax
je 0x446b79
mov dword [ebp - 0x268], 1
jmp 0x446b80
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x630], eax
jg 0x446b9a
mov dword [ebp - 0x258], 1
jmp 0x446ba1
and dword [ebp - 0x258], 0
cmp dword [ebp - 0x258], 0x9f81a770
jne 0x446bb9
mov dword [ebp - 0x260], 1
jmp 0x446bc0
and dword [ebp - 0x260], 0
cmp dword [ebp - 0x260], 1
je 0x446bd5
mov dword [ebp - 0x270], 1
jmp 0x446bdc
and dword [ebp - 0x270], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x268]
imul ecx, dword [ebp - 0x270]
cmp dword [ebp + eax - 0x564], ecx
jne 0x446c04
mov dword [ebp - 0x278], 1
jmp 0x446c0b
and dword [ebp - 0x278], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x278]
sub ecx, dword [ebp + eax - 0x288]
je 0x446c35
mov eax, 0xe9d28bc1
test eax, eax
je 0x446c35
mov dword [ebp - 0x280], 1
jmp 0x446c3c
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x280], eax
jl 0x446c56
mov dword [ebp - 0x638], 1
jmp 0x446c5d
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x82c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x288]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x298]
dec eax
mov dword [ebp - 0x298], eax
jmp 0x446a33
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x2d0], 0xffffffff
mov dword [ebp - 0x5b4], 2
mov dword [ebp - 0x1a4], 0
jmp 0x446cce
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 1
jge 0x446ce7
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x3c], 0x2a1e
jmp 0x446cc1
mov dword [ebp - 0x34], 0
jmp 0x446cf7
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x10
jle 0x446d9c
mov dword [ebp - 0x16c], 0xffffffff
mov dword [ebp - 0x16c], 0xffffffe2
jmp 0x446d24
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xfffffff4
jge 0x446d97
mov dword [ebp - 0x194], 0xb8f3d421
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x446d54
push 0x7b4
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebp - 0x194], 0
jmp 0x446d6d
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jl 0x446d95
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x446d93
push 0xe25
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x446d60
jmp 0x446d17
jmp 0x446cf0
mov dword [ebp - 0x34], 0xefb6
cmp dword [ebp - 0x34], 0
jne 0x446f22
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0xffffffc4
jle 0x446dc6
mov dword [ebp - 0x5a4], 1
jmp 0x446dcd
and dword [ebp - 0x5a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp - 0x7e8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
jne 0x446dfa
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x446dfa
and dword [ebp - 0x5ac], 0
jmp 0x446e04
mov dword [ebp - 0x5ac], 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x34], 0x5878
jl 0x446e22
mov dword [ebp - 0x2a0], 1
jmp 0x446e29
and dword [ebp - 0x2a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp dword [ebp - 0x2a0], eax
jge 0x446e47
mov dword [ebp - 0x2a8], 1
jmp 0x446e4e
and dword [ebp - 0x2a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp eax, dword [ebp - 0x2a8]
jg 0x446e6c
mov dword [ebp - 0x2b0], 1
jmp 0x446e73
and dword [ebp - 0x2b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp eax, dword [ebp - 0x2b0]
jne 0x446e91
mov dword [ebp - 0x2b8], 1
jmp 0x446e98
and dword [ebp - 0x2b8], 0
cmp dword [ebp - 0x2b8], 0xfffffffc
jge 0x446ead
mov dword [ebp - 0x2c0], 1
jmp 0x446eb4
and dword [ebp - 0x2c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp dword [ebp - 0x2c0], eax
jne 0x446ed2
mov dword [ebp - 0x2c8], 1
jmp 0x446ed9
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2d0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp dword [ebp - 0x2d0], eax
jg 0x446f09
mov dword [ebp - 0x2d8], 1
jmp 0x446f10
and dword [ebp - 0x2d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp dword [ebp - 0x2d8], eax
jge 0x446f37
mov eax, 0x459f
test eax, eax
je 0x446f37
mov dword [ebp - 0x2e0], 1
jmp 0x446f3e
and dword [ebp - 0x2e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp dword [ebp - 0x2e0], eax
jle 0x446f5c
mov dword [ebp - 0x2e8], 1
jmp 0x446f63
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x5b4], eax
xor eax, eax
jmp 0x44898a
mov dword [ebp - 0xec], 0xfffffff8
mov dword [ebp - 0x5c4], 0xa290be4
mov dword [ebp - 0xec], 0x10
jmp 0x446fa3
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x12
jge 0x446fe3
mov dword [ebp - 0x5bc], 0x95e17ca0
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x446fd6
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [ebp - 0x5bc], 0
je 0x446fe1
jmp 0x446f96
jmp 0x446f96
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0xec], eax
lea eax, [ebp - 0x13c]
push eax
push 0x4a61
push 0x79e1
push 0x3fb7
push dword [ebp - 0xf4]
push dword [ebp - 0x1cc]
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
call fcn.00448acb
add esp, 0x24
mov dword [ebp - 0x58], 0xe2236432
mov dword [ebp - 0x83c], 0xc74600eb
mov dword [ebp - 0x7fc], 0x855c71da
mov dword [ebp - 0x174], 0
jmp 0x44705a
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x447076
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x6a8], 0xb9b55bb2
jmp 0x44704d
mov dword [ebp - 0x58], 2
jmp 0x447086
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x4473d7
mov dword [ebp - 0xa0], 0xffffffff
mov dword [ebp - 0x1dc], 1
mov dword [ebp - 0x87c], 0xfffffffc
mov dword [ebp - 0x878], 0xfffffffc
mov dword [ebp - 0x874], 0xfffffffc
mov dword [ebp - 0x870], 0xfffffffc
mov dword [ebp - 0x1b4], 0
jmp 0x4470e5
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 4
jge 0x447101
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x918], 0xf36e
jmp 0x4470d8
mov dword [ebp - 0xa0], 0
jmp 0x44711a
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jg 0x4473d2
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x1d4], 0xfffffff9
mov dword [ebp - 0x844], 0
mov dword [ebp - 0x5c], 0
jmp 0x447152
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x447168
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x6d8], 0xac46ddcd
jmp 0x44714b
mov dword [ebp - 0x5c], 0
jmp 0x447178
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x44718e
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x9cc], 0x18246746
jmp 0x447171
mov dword [ebp - 0x38], 2
jmp 0x44719e
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x4471df
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6d8], 1
je 0x4471c0
mov dword [ebp - 0x2f0], 1
jmp 0x4471c7
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x6a8]
add eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x1d4], eax
jmp 0x447197
mov dword [ebp - 0x38], 2
jmp 0x4471ef
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x4473cd
mov dword [ebp - 0x5d4], 1
mov dword [ebp - 0x17c], 0
jmp 0x44721c
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 1
jge 0x447238
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x808], 1
jmp 0x44720f
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x6d8], 0
je 0x447320
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp + ecx*4 - 0x6a8]
cmp dword [ebp + eax*4 - 0x6a8], ecx
je 0x44726b
mov dword [ebp - 0x230], 1
jmp 0x447272
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jne 0x44729a
push 6
pop eax
test eax, eax
je 0x44729a
mov dword [ebp - 0x300], 1
jmp 0x4472a1
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x6a8]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x6d8]
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x300]
sub edx, dword [ebp + ecx*4 - 0x6a8]
cmp eax, edx
je 0x4472d8
mov dword [ebp - 0x308], 1
jmp 0x4472df
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0x308]
cmp eax, dword [ebp - 0xa0]
jl 0x447305
cmp dword [ebp - 0x1d4], 0
jne 0x447305
and dword [ebp - 0x310], 0
jmp 0x44730f
mov dword [ebp - 0x310], 1
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x1d4], eax
jmp 0x4473ad
mov dword [ebp - 0x5dc], 0
mov dword [ebp - 0x19c], 0
jmp 0x447343
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jge 0x44735f
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x948], 2
jmp 0x447336
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x6d8], 0
je 0x447388
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x948], 0
je 0x447388
mov dword [ebp - 0x5cc], 1
jmp 0x44738f
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp - 0x5d4]
add eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x5dc], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x918]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x918], eax
jmp 0x4471e8
jmp 0x44710d
jmp 0x44707f
push 0
push dword [ebp + 8]
push 0
push 0x6b6c
push 0x1fd2
push 0x382
push dword [ebp - 0x2c]
push 0x3b97
push 1
push 0
push dword [ebp - 0xf4]
push 1
call fcn.0043e146
add esp, 0x30
mov dword [ebp - 0xbc], 0x7f60
mov dword [ebp - 0x40], 0
jmp 0x447423
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x447439
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x6b8], 0xffffffff
jmp 0x44741c
mov dword [ebp - 0x40], 0
jmp 0x447449
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x44745f
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x184], 0x9a07b304
jmp 0x447442
mov dword [ebp - 0xbc], 0x282d
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x854], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6b8]
mov dword [ebp - 0x824], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6b8], 0x94e8fe75
ja 0x4474a7
mov dword [ebp - 0x318], 1
jmp 0x4474ae
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x318]
add eax, 0xecc2
neg eax
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x6b8]
jne 0x4474e5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6b8], 0
je 0x4474e5
mov dword [ebp - 0x320], 1
jmp 0x4474ec
and dword [ebp - 0x320], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6b8]
add eax, dword [ebp - 0x320]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x6b8]
je 0x44751a
mov dword [ebp - 0x328], 1
jmp 0x447521
and dword [ebp - 0x328], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x184]
cmp dword [ebp - 0x328], eax
jne 0x447542
mov dword [ebp - 0x330], 1
jmp 0x447549
and dword [ebp - 0x330], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x184]
cmp dword [ebp - 0x330], eax
je 0x44756a
mov dword [ebp - 0x338], 1
jmp 0x447571
and dword [ebp - 0x338], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x338]
sub ecx, dword [ebp + eax - 0x184]
cmp ecx, 0x36432a27
jne 0x447598
mov dword [ebp - 0x1e4], 1
jmp 0x44759f
and dword [ebp - 0x1e4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1e4]
mov dword [ebp + eax - 0x6b8], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x184]
cmp dword [ebp - 0x1e4], eax
jne 0x4475ef
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x4475ed
push 0x410
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x44762d
mov dword [ebp - 0xbc], 0
jmp 0x447608
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x1e
jg 0x44762d
mov byte [ebp - 0xac], 0
movzx eax, byte [ebp - 0xac]
test eax, eax
je 0x44762b
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4475fb
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x13c]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x390], ecx
mov dword [ebp - 0x5f4], 1
mov dword [ebp - 0x818], 0xa43b2b74
mov dword [ebp - 0x5ec], 0xffffffff
mov dword [ebp - 0x8b4], 0x33880e03
mov dword [ebp - 0x360], 0
mov dword [ebp - 0x820], 0xfffffffd
mov dword [ebp - 0x368], 0xde6bc044
mov dword [ebp - 0x5e4], 0x465cd386
mov dword [ebp - 0x5fc], 0xbec0351
mov dword [ebp - 0x350], 0
mov dword [ebp - 0x884], 0
mov dword [ebp - 0x6fc], 0x162f6306
mov dword [ebp - 0x6f8], 0x162f6306
mov dword [ebp - 0x6f4], 0x162f6306
mov dword [ebp - 0x6f0], 0x162f6306
mov dword [ebp - 0x718], 0xffffffff
mov dword [ebp - 0x714], 0xffffffff
mov dword [ebp - 0x710], 0xffffffff
mov dword [ebp - 0x70c], 0xffffffff
mov dword [ebp - 0x14c], 0
jmp 0x447719
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 3
jge 0x447735
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x924], 0x39d9
jmp 0x44770c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x924], 1
jge 0x447750
mov dword [ebp - 0x340], 1
jmp 0x447757
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x5e4]
cmp dword [ebp - 0x340], eax
je 0x447771
mov dword [ebp - 0x348], 1
jmp 0x447778
and dword [ebp - 0x348], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x348]
sub ecx, dword [ebp + eax - 0x6fc]
mov dword [ebp - 0x350], ecx
cmp dword [ebp - 0x350], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5ec]
cmp dword [ebp + eax - 0x718], ecx
jne 0x4477b8
mov dword [ebp - 0x358], 1
jmp 0x4477bf
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x5f4], eax
jl 0x4477e5
mov dword [ebp - 0x1ec], 1
jmp 0x4477ec
and dword [ebp - 0x1ec], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1ec]
mov dword [ebp + eax - 0x6fc], ecx
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x390], 0
je 0x447a60
mov dword [ebp - 0xc4], 0xfffffff9
mov dword [ebp - 0x64], 0xf5af
mov dword [ebp - 0x68], 0xfffffffc
mov dword [ebp - 0x388], 1
mov dword [ebp - 0x50], 0
jmp 0x447855
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x44786b
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x908], 0xffffffff
jmp 0x44784e
mov dword [ebp - 0x50], 0
jmp 0x44787b
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x447891
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x8a0], 0xf495e3b3
jmp 0x447874
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x4478c8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x1d4b
push 0x25e6
push 0x1107
push 0x1626
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x730], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x734], eax
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x64], eax
jge 0x4478f4
mov dword [ebp - 0x370], 1
jmp 0x4478fb
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x370], eax
je 0x447912
mov dword [ebp - 0x378], 1
jmp 0x447919
and dword [ebp - 0x378], 0
cmp dword [ebp - 0x378], 0x37186542
jle 0x447931
mov dword [ebp - 0x1f4], 1
jmp 0x447938
and dword [ebp - 0x1f4], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1f4]
mov dword [ebp + eax - 0x908], ecx
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x744], eax
imul eax, dword [ebp - 0x64], 6
mov dword [ebp - 0x380], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x380]
mov dword [ebp + eax - 0x8a0], ecx
cmp dword [ebp - 0x380], 0
je 0x447a1a
mov dword [ebp - 0xfc], 2
mov dword [ebp - 0x168], 0x56df
mov dword [ebp - 0x78], 0x9e96bb64
mov dword [ebp - 0x61c], 0xa83adab8
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x624], 0x84c7b934
mov dword [ebp - 0x458], 0xf04b7466
mov dword [ebp - 0x1c], 0
jmp 0x447ab3
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x447ac9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1c4], 9
jmp 0x447aac
mov dword [ebp - 0x1c], 0
jmp 0x447ad9
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x447aef
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6e4], 0xfffffff8
jmp 0x447ad2
mov dword [ebp - 0x1c], 0
jmp 0x447aff
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x447b15
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x99c], 0x270adff4
jmp 0x447af8
cmp dword [ebp - 0xfc], 0
je 0x447d8c
mov dword [ebp - 0x70], 0xba20b95a
mov dword [ebp - 0x118], 0
jmp 0x447b42
cmp dword [ebp - 0x118], 1
jge 0x447b5e
mov dword [ebp - 0xa8], 0xfffffffa
mov dword [ebp - 0x160], 0
jmp 0x447daf
cmp dword [ebp - 0x160], 3
jge 0x447dcb
mov esp, ebp
pop ebp
ret