Function at 0x44ac5b
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Delete file
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get file size
Get file system object information
Get graphical window text
Get session user name
Get system information on windows
Hide graphical window
Identify system language via api
Log keystrokes via polling
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x52ac
call fcn.004906e0
push esi
mov dword [ebp - 0xe3c], 1
push 4
lea ecx, [ebp - 0x4224]
call fcn.0040f233
mov dword [ebp - 0x764], 0x6e58d020
mov dword [ebp - 0xb04], 0
jmp 0x44aca3
mov eax, dword [ebp - 0xb04]
inc eax
mov dword [ebp - 0xb04], eax
cmp dword [ebp - 0xb04], 4
jge 0x44acc2
push dword [ebp - 0xb04]
lea ecx, [ebp - 0x4224]
call fcn.0040f321
or dword [eax], 0xffffffff
jmp 0x44ac96
mov dword [ebp - 0xe3c], 0
jmp 0x44acdb
mov eax, dword [ebp - 0xe3c]
inc eax
mov dword [ebp - 0xe3c], eax
cmp dword [ebp - 0xe3c], 0x16
jle 0x44adac
mov dword [ebp - 0x230], 0x5ba77230
mov dword [ebp - 0x230], 0
jmp 0x44ad0b
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jg 0x44ad2d
mov dword [ebp - 0x43fc], 0x72a7
mov eax, dword [ebp - 0x764]
dec eax
mov dword [ebp - 0x764], eax
jmp 0x44acfe
mov dword [ebp - 0x764], 0
jmp 0x44ad46
mov eax, dword [ebp - 0x764]
inc eax
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 3
jg 0x44ada7
mov dword [ebp - 0x230], 0
jmp 0x44ad68
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 4
jge 0x44ad87
push dword [ebp - 0x230]
lea ecx, [ebp - 0x4224]
call fcn.0040f321
or dword [eax], 0xffffffff
jmp 0x44ad5b
mov byte [ebp - 0x6e6], 0
movzx eax, byte [ebp - 0x6e6]
test eax, eax
je 0x44ada5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x44ad39
jmp 0x44acce
lea ecx, [ebp - 0x4224]
call fcn.0040f305
mov dword [ebp - 0x2fc], 1
push 2
lea ecx, [ebp - 0x11b4]
call fcn.0040f233
mov dword [ebp - 0x53c], 6
mov dword [ebp - 0x100c], 0xfffffffa
mov dword [ebp - 0xb0c], 0x2955d482
mov dword [ebp - 0x1478], 0xdef05de0
mov dword [ebp - 0x1480], 0xfffffffc
push 1
lea ecx, [ebp - 0x4134]
call fcn.0040f233
mov dword [ebp - 0x3010], 0xcf2842c5
mov dword [ebp - 0x3080], 0xd1892f88
mov dword [ebp - 0x340c], 0
mov dword [ebp - 0x30e0], 0x826cce71
mov dword [ebp - 0x30c8], 0x37d796e9
mov dword [ebp - 0x341c], 0x4084f7cb
mov dword [ebp - 0x128], 0
jmp 0x44ae62
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jge 0x44ae81
push dword [ebp - 0x128]
lea ecx, [ebp - 0x11b4]
call fcn.0040f321
and dword [eax], 0
jmp 0x44ae55
mov dword [ebp - 0x128], 0
jmp 0x44ae9a
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x44aebc
push dword [ebp - 0x128]
lea ecx, [ebp - 0x4134]
call fcn.0040f321
mov dword [eax], 1
jmp 0x44ae8d
push 1
lea ecx, [ebp - 0x11b4]
call fcn.0040f321
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x100c], eax
jle 0x44aee3
mov dword [ebp - 0x2a6c], 1
jmp 0x44aeea
and dword [ebp - 0x2a6c], 0
mov eax, dword [ebp - 0x100c]
cmp eax, dword [ebp - 0x2a6c]
jne 0x44af04
mov dword [ebp - 0x2fd0], 1
jmp 0x44af0b
and dword [ebp - 0x2fd0], 0
push 1
lea ecx, [ebp - 0x11b4]
call fcn.0040f321
mov ecx, dword [ebp - 0x2fd0]
cmp ecx, dword [eax]
jle 0x44af2e
mov dword [ebp - 0x2fd8], 1
jmp 0x44af35
and dword [ebp - 0x2fd8], 0
cmp dword [ebp - 0x2fd8], 0xffffffff
jle 0x44af4a
mov dword [ebp - 0x2fe0], 1
jmp 0x44af51
and dword [ebp - 0x2fe0], 0
mov esi, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x53c]
sub eax, dword [ebp - 0x2fe0]
imul esi, eax
push 1
lea ecx, [ebp - 0x11b4]
call fcn.0040f321
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x11b4]
call fcn.0040f321
mov dword [eax], esi
mov eax, dword [ebp - 0x53c]
dec eax
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0xb0c], 0xc761
mov eax, dword [ebp - 0xb0c]
neg eax
jne 0x44b049
push 1
lea ecx, [ebp - 0x11b4]
call fcn.0040f321
mov ecx, dword [ebp - 0x53c]
cmp dword [eax], ecx
jne 0x44afcc
mov dword [ebp - 0x2fe8], 1
jmp 0x44afd3
and dword [ebp - 0x2fe8], 0
mov eax, dword [ebp - 0x1478]
cmp dword [ebp - 0x2fe8], eax
je 0x44afed
mov dword [ebp - 0x2ff0], 1
jmp 0x44aff4
and dword [ebp - 0x2ff0], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x2ff0], eax
jg 0x44b00e
mov dword [ebp - 0x2ff8], 1
jmp 0x44b015
and dword [ebp - 0x2ff8], 0
mov eax, dword [ebp - 0x2ff8]
sub eax, dword [ebp - 0xb0c]
cmp eax, 0x31ea
jg 0x44b034
mov dword [ebp - 0x3000], 1
jmp 0x44b03b
and dword [ebp - 0x3000], 0
mov eax, dword [ebp - 0x3000]
neg eax
sub eax, dword [ebp - 0x1480]
mov eax, 0xc63704b
sub eax, dword [ebp - 0x1478]
mov dword [ebp - 0x334c], eax
push 0
lea ecx, [ebp - 0x4134]
call fcn.0040f321
mov ecx, dword [ebp - 0x334c]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x11b4]
call fcn.0040f321
cmp dword [ebp - 0xb0c], 0
jne 0x44b097
cmp dword [ebp - 0x2fc], 0
jne 0x44b097
and dword [ebp - 0x3008], 0
jmp 0x44b0a1
mov dword [ebp - 0x3008], 1
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0x3008]
sub ecx, dword [ebp - 0x1480]
sub eax, ecx
mov dword [ebp - 0x3010], eax
cmp dword [ebp - 0x3010], 0xe11f
jne 0x44b0d9
mov eax, 0x3fd
test eax, eax
jne 0x44b0d9
and dword [ebp - 0x3018], 0
jmp 0x44b0e3
mov dword [ebp - 0x3018], 1
mov eax, dword [ebp - 0x53c]
cmp dword [ebp - 0x3018], eax
je 0x44b0fd
mov dword [ebp - 0x3078], 1
jmp 0x44b104
and dword [ebp - 0x3078], 0
mov eax, dword [ebp - 0x3078]
mov dword [ebp - 0x3080], eax
mov esi, dword [ebp - 0x3080]
push 1
lea ecx, [ebp - 0x11b4]
call fcn.0040f321
cmp dword [eax], esi
jg 0x44b133
mov dword [ebp - 0x3088], 1
jmp 0x44b13a
and dword [ebp - 0x3088], 0
cmp dword [ebp - 0x3088], 0x6a17
jl 0x44b152
mov dword [ebp - 0x3090], 1
jmp 0x44b159
and dword [ebp - 0x3090], 0
push 1
lea ecx, [ebp - 0x11b4]
call fcn.0040f321
mov ecx, dword [ebp - 0x3090]
cmp ecx, dword [eax]
jg 0x44b17c
mov dword [ebp - 0x3098], 1
jmp 0x44b183
and dword [ebp - 0x3098], 0
mov eax, dword [ebp - 0x340c]
cmp dword [ebp - 0x3098], eax
jg 0x44b19d
mov dword [ebp - 0x30a0], 1
jmp 0x44b1a4
and dword [ebp - 0x30a0], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x30a0], eax
jne 0x44b1b9
cmp dword [ebp - 0x30e0], 0
cmp dword [ebp - 0x53c], 0x3c3a871d
jl 0x44b1e0
push 0
lea ecx, [ebp - 0x11b4]
call fcn.0040f321
cmp dword [eax], 0
jne 0x44b1e0
and dword [ebp - 0x30a8], 0
jmp 0x44b1ea
mov dword [ebp - 0x30a8], 1
mov eax, dword [ebp - 0x100c]
cmp dword [ebp - 0x30a8], eax
je 0x44b204
mov dword [ebp - 0x30b0], 1
jmp 0x44b20b
and dword [ebp - 0x30b0], 0
cmp dword [ebp - 0x30b0], 0xd9e6264a
jne 0x44b223
mov dword [ebp - 0x30b8], 1
jmp 0x44b22a
and dword [ebp - 0x30b8], 0
mov eax, dword [ebp - 0x30b8]
imul eax, dword [ebp - 0x1478]
mov dword [ebp - 0x3414], eax
push 0
lea ecx, [ebp - 0x11b4]
call fcn.0040f321
mov ecx, dword [ebp - 0x3414]
mov dword [eax], ecx
cmp dword [ebp - 0x100c], 0
jb 0x44b267
mov dword [ebp - 0x30c0], 1
jmp 0x44b26e
and dword [ebp - 0x30c0], 0
mov eax, dword [ebp - 0x30c0]
mov dword [ebp - 0x30c8], eax
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x30c8], eax
jg 0x44b294
mov dword [ebp - 0x30d0], 1
jmp 0x44b29b
and dword [ebp - 0x30d0], 0
mov eax, dword [ebp - 0x30d0]
sub eax, dword [ebp - 0x2fc]
sub eax, dword [ebp - 0x1480]
cmp dword [ebp - 0x53c], eax
jl 0x44b2c1
mov dword [ebp - 0x30d8], 1
jmp 0x44b2c8
and dword [ebp - 0x30d8], 0
mov eax, dword [ebp - 0x30d8]
sub eax, dword [ebp - 0x30e0]
mov dword [ebp - 0x341c], eax
lea ecx, [ebp - 0x4134]
call fcn.0040f305
lea ecx, [ebp - 0x11b4]
call fcn.0040f305
mov dword [ebp - 0xfe0], 1
push 2
lea ecx, [ebp - 0x48f0]
call fcn.0040f233
push 1
lea ecx, [ebp - 0x38a0]
call fcn.0040f233
mov dword [ebp - 0x238], 0
jmp 0x44b32d
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x44b34c
push dword [ebp - 0x238]
lea ecx, [ebp - 0x48f0]
call fcn.0040f321
and dword [eax], 0
jmp 0x44b320
mov dword [ebp - 0x238], 0
jmp 0x44b365
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jge 0x44b387
push dword [ebp - 0x238]
lea ecx, [ebp - 0x38a0]
call fcn.0040f321
mov dword [eax], 9
jmp 0x44b358
mov byte [ebp - 0x470], 0
movzx eax, byte [ebp - 0x470]
test eax, eax
je 0x44b3af
push 0
push 0
push 0x1df0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea ecx, [ebp - 0x38a0]
call fcn.0040f321
and dword [eax], 0
jmp 0x44b3e5
push 0
lea ecx, [ebp - 0x38a0]
call fcn.0040f321
mov dword [ebp - 0x30e8], eax
mov eax, dword [ebp - 0x30e8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x30e8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x38a0]
call fcn.0040f321
cmp dword [eax], 1
jg 0x44b41a
mov byte [ebp - 0x725], 0
movzx eax, byte [ebp - 0x725]
test eax, eax
je 0x44b418
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x44b3c1
lea ecx, [ebp - 0x38a0]
call fcn.0040f305
lea ecx, [ebp - 0x48f0]
call fcn.0040f305
push 4
lea ecx, [ebp - 0x3f78]
call fcn.0040f233
mov dword [ebp - 0x774], 0x6e58d020
mov dword [ebp - 0x308], 1
mov dword [ebp - 0x30f0], 0x746a1c17
mov dword [ebp - 0x3424], 0x3dc0e3e7
mov dword [ebp - 0x308], 0xffffffe3
jmp 0x44b47e
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0xfffffff0
jle 0x44b574
mov dword [ebp - 0x828], 0x111738ab
mov dword [ebp - 0xb14], 0
jmp 0x44b4ae
mov eax, dword [ebp - 0xb14]
inc eax
mov dword [ebp - 0xb14], eax
cmp dword [ebp - 0xb14], 2
jge 0x44b4ca
mov eax, dword [ebp - 0xb14]
mov dword [ebp + eax*4 - 0x3c70], 0xa473eb90
jmp 0x44b4a1
mov dword [ebp - 0x828], 0
jmp 0x44b4e3
mov eax, dword [ebp - 0x828]
inc eax
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 1
jg 0x44b553
mov dword [ebp - 0xe44], 0xfffffff7
mov dword [ebp - 0xe44], 0
jmp 0x44b50f
mov eax, dword [ebp - 0xe44]
inc eax
mov dword [ebp - 0xe44], eax
cmp dword [ebp - 0xe44], 1
jg 0x44b551
mov byte [ebp - 0x472], 0
movzx eax, byte [ebp - 0x472]
test eax, eax
je 0x44b535
push 0x2309
call dword [sym.imp.USER32.dll_GetKeyState]
mov eax, dword [ebp - 0x828]
mov ecx, dword [ebp - 0x828]
mov eax, dword [ebp + eax*4 - 0x3c70]
mov dword [ebp + ecx*4 - 0x3c70], eax
jmp 0x44b502
jmp 0x44b4d6
mov byte [ebp - 0x512], 0
movzx eax, byte [ebp - 0x512]
test eax, eax
je 0x44b56f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x44b471
mov eax, dword [ebp - 0x308]
imul eax, dword [ebp - 0x308]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x30f0], eax
cmp dword [ebp - 0x30f0], 0x747bb7ab
jne 0x44b5ab
mov dword [ebp - 0x30f8], 1
jmp 0x44b5b2
and dword [ebp - 0x30f8], 0
mov eax, dword [ebp - 0x30f8]
mov dword [ebp - 0x3424], eax
mov dword [ebp - 0x130], 1
push 2
lea ecx, [ebp - 0x42e4]
call fcn.0040f233
mov dword [ebp - 0xb1c], 0
jmp 0x44b5ee
mov eax, dword [ebp - 0xb1c]
inc eax
mov dword [ebp - 0xb1c], eax
cmp dword [ebp - 0xb1c], 2
jge 0x44b610
push dword [ebp - 0xb1c]
lea ecx, [ebp - 0x42e4]
call fcn.0040f321
mov dword [eax], 0xffff
jmp 0x44b5e1
mov dword [ebp - 0x130], 0
jmp 0x44b629
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xfffffffa
jne 0x44b767
mov dword [ebp - 0xfdc], 0xfda0e60f
mov dword [ebp - 0x4330], 0xffffffff
mov dword [ebp - 0x432c], 0xffffffff
mov dword [ebp - 0x4328], 0xffffffff
mov dword [ebp - 0x4324], 0xffffffff
mov dword [ebp - 0xfdc], 0
jmp 0x44b681
mov eax, dword [ebp - 0xfdc]
dec eax
mov dword [ebp - 0xfdc], eax
cmp dword [ebp - 0xfdc], 0xfffffffb
je 0x44b762
mov dword [ebp - 0xa90], 0xfffffff8
mov dword [ebp - 0xa98], 0x71dfd947
mov dword [ebp - 0xa90], 3
jmp 0x44b6bb
mov eax, dword [ebp - 0xa90]
dec eax
mov dword [ebp - 0xa90], eax
cmp dword [ebp - 0xa90], 0
jl 0x44b75d
mov eax, dword [ebp - 0xa90]
mov eax, dword [ebp + eax*4 - 0x4330]
mov dword [ebp - 0xa98], eax
mov dword [ebp - 0xa98], 0
jmp 0x44b6f4
mov eax, dword [ebp - 0xa98]
inc eax
mov dword [ebp - 0xa98], eax
cmp dword [ebp - 0xa98], 3
jg 0x44b758
mov dword [ebp - 0xb24], 0x896e6a37
mov dword [ebp - 0xb24], 0
jmp 0x44b720
mov eax, dword [ebp - 0xb24]
inc eax
mov dword [ebp - 0xb24], eax
cmp dword [ebp - 0xb24], 3
jg 0x44b756
mov byte [ebp - 0x474], 0
movzx eax, byte [ebp - 0x474]
test eax, eax
je 0x44b754
push 0x21d9
push 0x1939
push 0
push 0
push 0x85
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x44b713
jmp 0x44b6e7
jmp 0x44b6ae
jmp 0x44b674
jmp 0x44b61c
mov dword [ebp - 0x130], 0
jmp 0x44b780
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x44b7a2
push dword [ebp - 0x130]
lea ecx, [ebp - 0x42e4]
call fcn.0040f321
mov dword [eax], 0xf3e7
jmp 0x44b773
lea ecx, [ebp - 0x42e4]
call fcn.0040f305
mov dword [ebp - 0xe4c], 0
jmp 0x44b7c6
mov eax, dword [ebp - 0xe4c]
inc eax
mov dword [ebp - 0xe4c], eax
cmp dword [ebp - 0xe4c], 4
jge 0x44b7e5
push dword [ebp - 0xe4c]
lea ecx, [ebp - 0x3f78]
call fcn.0040f321
or dword [eax], 0xffffffff
jmp 0x44b7b9
mov dword [ebp - 0xd4], 2
mov dword [ebp - 0xb2c], 9
mov dword [ebp - 0x3110], 0xffffffff
mov dword [ebp - 0xaa0], 1
cmp dword [ebp - 0xd4], 0
je 0x44b827
or eax, 0xffffffff
je 0x44b827
mov dword [ebp - 0x3128], 1
jmp 0x44b82e
and dword [ebp - 0x3128], 0
mov dword [ebp - 0xb2c], 0xd2f
cmp dword [ebp - 0xb2c], 0
jne 0x44b851
push 9
pop eax
test eax, eax
jne 0x44b851
and dword [ebp - 0x342c], 0
jmp 0x44b85b
mov dword [ebp - 0x342c], 1
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x46ec], eax
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0xb2c], eax
je 0x44b881
mov dword [ebp - 0x3100], 1
jmp 0x44b888
and dword [ebp - 0x3100], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x3100], eax
jne 0x44b8a2
mov dword [ebp - 0x3108], 1
jmp 0x44b8a9
and dword [ebp - 0x3108], 0
mov eax, dword [ebp - 0xd4]
add eax, dword [ebp - 0x3108]
mov dword [ebp - 0x3110], eax
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x3110], eax
jle 0x44b8d5
mov dword [ebp - 0x3118], 1
jmp 0x44b8dc
and dword [ebp - 0x3118], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x3118], eax
jne 0x44b8ff
cmp dword [ebp - 0xb2c], 0
je 0x44b8ff
mov dword [ebp - 0x3120], 1
jmp 0x44b906
and dword [ebp - 0x3120], 0
mov eax, dword [ebp - 0x3120]
add eax, 0x185a
cmp eax, 0x307b5ca9
jl 0x44b924
mov dword [ebp - 0x3130], 1
jmp 0x44b92b
and dword [ebp - 0x3130], 0
mov eax, dword [ebp - 0x3128]
cmp eax, dword [ebp - 0x3130]
jg 0x44b945
mov dword [ebp - 0x3434], 1
jmp 0x44b94c
and dword [ebp - 0x3434], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x4b20], eax
mov dword [ebp - 0xaa0], 0xfffffffd
mov dword [ebp - 0xd4], 0
jmp 0x44b97b
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x16
jl 0x44ba40
mov dword [ebp - 0x3d70], 1
mov dword [ebp - 0x3d6c], 1
mov dword [ebp - 0x3d68], 1
mov dword [ebp - 0x3d64], 1
lea ecx, [ebp - 0x13dd]
call fcn.0040f330
push eax
lea eax, [ebp - 0x3d60]
push eax
lea eax, [ebp - 0x3d70]
push eax
lea ecx, [ebp - 0x50e8]
call fcn.0040f333
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4eb0]
call fcn.0040f2df
mov dword [ebp - 0xaa0], 0
jmp 0x44b9fe
mov eax, dword [ebp - 0xaa0]
inc eax
mov dword [ebp - 0xaa0], eax
cmp dword [ebp - 0xaa0], 3
jg 0x44ba30
mov byte [ebp - 0x5e5], 0
movzx eax, byte [ebp - 0x5e5]
test eax, eax
je 0x44ba2e
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x44b9f1
lea ecx, [ebp - 0x4eb0]
call fcn.0040f305
jmp 0x44b96e
mov dword [ebp - 0xfe0], 0
jmp 0x44ba59
mov eax, dword [ebp - 0xfe0]
inc eax
mov dword [ebp - 0xfe0], eax
cmp dword [ebp - 0xfe0], 0x16
jle 0x44c937
push 1
lea ecx, [ebp - 0x1184]
call fcn.0040f233
mov dword [ebp - 0x76c], 0x19adb821
mov dword [ebp - 0x3148], 0xe3ca3691
mov dword [ebp - 0x3444], 0x2fa5d872
mov dword [ebp - 0x240], 0
jmp 0x44baaa
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 1
jge 0x44bacc
push dword [ebp - 0x240]
lea ecx, [ebp - 0x1184]
call fcn.0040f321
mov dword [eax], 0xfffffffe
jmp 0x44ba9d
mov dword [ebp - 0x240], 0
jmp 0x44bae5
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 1
jge 0x44bb01
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x343c], 0x6595ad33
jmp 0x44bad8
push 0
lea ecx, [ebp - 0x1184]
call fcn.0040f321
cmp dword [eax], 0xfffffff8
jne 0x44bb1a
cmp dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x76c]
cmp dword [ebp - 0x76c], eax
jne 0x44bb34
mov dword [ebp - 0x3138], 1
jmp 0x44bb3b
and dword [ebp - 0x3138], 0
push 0
lea ecx, [ebp - 0x1184]
call fcn.0040f321
mov ecx, dword [ebp - 0x3138]
cmp ecx, dword [eax]
jne 0x44bb5e
mov dword [ebp - 0x3140], 1
jmp 0x44bb65
and dword [ebp - 0x3140], 0
push 0
lea ecx, [ebp - 0x1184]
call fcn.0040f321
push 0
lea ecx, [ebp - 0x1184]
call fcn.0040f321
mov eax, dword [ebp - 0x3140]
sub eax, 0x1a5679b5
mov dword [ebp - 0x3148], eax
mov eax, dword [ebp - 0x3148]
mov dword [ebp - 0x46f4], eax
push 0
lea ecx, [ebp - 0x1184]
call fcn.0040f321
mov esi, eax
push 0
lea ecx, [ebp - 0x1184]
call fcn.0040f321
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x44bbca
mov dword [ebp - 0x3150], 1
jmp 0x44bbd1
and dword [ebp - 0x3150], 0
mov eax, dword [ebp - 0x76c]
cmp dword [ebp - 0x3150], eax
je 0x44bbeb
mov dword [ebp - 0x3158], 1
jmp 0x44bbf2
and dword [ebp - 0x3158], 0
push 0
lea ecx, [ebp - 0x1184]
call fcn.0040f321
mov ecx, dword [ebp - 0x3158]
cmp ecx, dword [eax]
jne 0x44bc15
mov dword [ebp - 0x1488], 1
jmp 0x44bc1c
and dword [ebp - 0x1488], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1488]
mov dword [ebp + eax - 0x343c], ecx
push 0
lea ecx, [ebp - 0x1184]
call fcn.0040f321
mov ecx, dword [ebp - 0x1488]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x76c]
jg 0x44bc58
mov dword [ebp - 0x3160], 1
jmp 0x44bc5f
and dword [ebp - 0x3160], 0
cmp dword [ebp - 0x3160], 0x6e2c
jge 0x44bc77
mov dword [ebp - 0x3168], 1
jmp 0x44bc7e
and dword [ebp - 0x3168], 0
push 0
lea ecx, [ebp - 0x1184]
call fcn.0040f321
mov ecx, dword [ebp - 0x3168]
cmp ecx, dword [eax]
jl 0x44bca1
mov dword [ebp - 0x3170], 1
jmp 0x44bca8
and dword [ebp - 0x3170], 0
push 0
lea ecx, [ebp - 0x1184]
call fcn.0040f321
mov ecx, dword [ebp - 0x3170]
add ecx, dword [eax]
sub ecx, dword [ebp - 0x76c]
mov dword [ebp - 0x3444], ecx
mov byte [ebp - 0x476], 0
movzx eax, byte [ebp - 0x476]
test eax, eax
je 0x44bcf1
push 0xa0b
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
lea ecx, [ebp - 0x1184]
call fcn.0040f305
mov dword [ebp - 0x138], 0x5ba77230
mov dword [ebp - 0x138], 0
jmp 0x44bd1f
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jg 0x44be11
mov dword [ebp - 0x4c9c], 8
mov byte [ebp - 0x514], 0
movzx eax, byte [ebp - 0x514]
test eax, eax
je 0x44bd4e
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov byte [ebp - 0x478], 0
movzx eax, byte [ebp - 0x478]
test eax, eax
je 0x44bd76
push 0
push 0
push 0x1e69
push 0x1ff6
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov dword [ebp - 0x46fc], 0x72a7
mov dword [ebp - 0x4b28], 1
mov dword [ebp - 0x4704], 0xfffffffe
mov dword [ebp - 0x344c], 8
mov dword [ebp - 0x4e44], 0x328129ec
mov dword [ebp - 0xb34], 0
jmp 0x44bdc1
mov eax, dword [ebp - 0xb34]
inc eax
mov dword [ebp - 0xb34], eax
cmp dword [ebp - 0xb34], 3
jge 0x44bddd
mov eax, dword [ebp - 0xb34]
mov dword [ebp + eax*4 - 0x51dc], 0xe8ce6fc2
jmp 0x44bdb4
mov byte [ebp - 0x685], 0
movzx eax, byte [ebp - 0x685]
test eax, eax
je 0x44bdf5
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov dword [ebp - 0x344c], 1
mov eax, dword [ebp - 0x774]
dec eax
mov dword [ebp - 0x774], eax
jmp 0x44bd12
mov dword [ebp - 0x814], 1
mov dword [ebp - 0xaa8], 0xebb6748f
mov dword [ebp - 0x814], 0
jmp 0x44be3e
mov eax, dword [ebp - 0x814]
dec eax
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0xffffffea
jle 0x44c232
mov dword [ebp - 0x390], 0xfffffff8
mov dword [ebp - 0x3190], 0xffffffff
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0xaa8], eax
cmp dword [ebp - 0xaa8], 0
je 0x44bea5
mov dword [ebp - 0x3178], 2
mov dword [ebp - 0x3454], 1
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0x3178], eax
mov eax, dword [ebp - 0x3178]
mov dword [ebp - 0x3454], eax
jmp 0x44c20c
mov dword [ebp - 0x1490], 0xfffffff6
mov dword [ebp - 0x14a0], 0x8b4b72b4
mov dword [ebp - 0xbc], 0x9b96bc71
mov dword [ebp - 0xe54], 0
jmp 0x44bedc
mov eax, dword [ebp - 0xe54]
inc eax
mov dword [ebp - 0xe54], eax
cmp dword [ebp - 0xe54], 3
jge 0x44bef8
mov eax, dword [ebp - 0xe54]
mov dword [ebp + eax*4 - 0x414c], 0xf039d3cd
jmp 0x44becf
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x470c], eax
cmp dword [ebp - 0x390], 0
jne 0x44bf1f
cmp dword [ebp - 0x1490], 0
jne 0x44bf1f
and dword [ebp - 0x3180], 0
jmp 0x44bf29
mov dword [ebp - 0x3180], 1
mov eax, dword [ebp - 0x3180]
mov dword [ebp - 0x1490], eax
cmp dword [ebp - 0x1490], 0
jne 0x44bf50
cmp dword [ebp - 0x814], 0
jne 0x44bf50
and dword [ebp - 0x3188], 0
jmp 0x44bf5a
mov dword [ebp - 0x3188], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x414c]
mov ecx, dword [ebp - 0x3188]
lea eax, [ecx + eax - 1]
test eax, eax
je 0x44bf8a
cmp dword [ebp - 0x390], 0
je 0x44bf8a
mov dword [ebp - 0x1498], 1
jmp 0x44bf91
and dword [ebp - 0x1498], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1498]
mov dword [ebp + eax - 0x414c], ecx
mov eax, dword [ebp - 0x1498]
mov dword [ebp - 0xaa8], eax
cmp dword [ebp - 0xaa8], 0
jne 0x44bfcb
cmp dword [ebp - 0x3190], 0
jne 0x44bfcb
and dword [ebp - 0x3198], 0
jmp 0x44bfd5
mov dword [ebp - 0x3198], 1
mov eax, dword [ebp - 0x3190]
cmp dword [ebp - 0x3198], eax
jl 0x44bfef
mov dword [ebp - 0x31a0], 1
jmp 0x44bff6
and dword [ebp - 0x31a0], 0
mov eax, dword [ebp - 0x31a0]
mov dword [ebp - 0x14a0], eax
cmp dword [ebp - 0x14a0], 0
je 0x44c014
mov eax, 0xd6cd5387
test eax, eax
jne 0x44c026
mov eax, 0xce404d46
test eax, eax
jne 0x44c026
and dword [ebp - 0x31a8], 0
jmp 0x44c030
mov dword [ebp - 0x31a8], 1
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x31a8], eax
jl 0x44c04a
mov dword [ebp - 0x31b0], 1
jmp 0x44c051
and dword [ebp - 0x31b0], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x31b0], eax
jle 0x44c06b
mov dword [ebp - 0x31ec], 1
jmp 0x44c072
and dword [ebp - 0x31ec], 0
mov eax, dword [ebp - 0x390]
cmp dword [ebp - 0x31ec], eax
jge 0x44c08c
mov dword [ebp - 0x31f4], 1
jmp 0x44c093
and dword [ebp - 0x31f4], 0
mov eax, dword [ebp - 0x390]
add eax, dword [ebp - 0x31f4]
cmp eax, 0x2e0c
jge 0x44c0b2
mov dword [ebp - 0x31fc], 1
jmp 0x44c0b9
and dword [ebp - 0x31fc], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x31fc], eax
jl 0x44c0d3
mov dword [ebp - 0x3204], 1
jmp 0x44c0da
and dword [ebp - 0x3204], 0
cmp dword [ebp - 0x3204], 8
jb 0x44c0ef
mov dword [ebp - 0x31e0], 1
jmp 0x44c0f6
and dword [ebp - 0x31e0], 0
cmp dword [ebp - 0x31e0], 0x9172c2e8
je 0x44c10e
mov dword [ebp - 0x3024], 1
jmp 0x44c115
and dword [ebp - 0x3024], 0
mov eax, dword [ebp - 0x390]
cmp eax, dword [ebp - 0x3024]
jne 0x44c12f
mov dword [ebp - 0x2754], 1
jmp 0x44c136
and dword [ebp - 0x2754], 0
cmp dword [ebp - 0x2754], 0x47b6
jle 0x44c14e
mov dword [ebp - 0x345c], 1
jmp 0x44c155
and dword [ebp - 0x345c], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x4b30], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x4714], eax
mov eax, dword [ebp - 0x14a0]
mov dword [ebp - 0x4cb0], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x471c], eax
cmp dword [ebp - 0x390], 1
jg 0x44c19a
mov dword [ebp - 0x15d8], 1
jmp 0x44c1a1
and dword [ebp - 0x15d8], 0
mov eax, dword [ebp - 0x15d8]
sub eax, 7
cmp eax, dword [ebp - 0xbc]
jle 0x44c1be
mov dword [ebp - 0x2978], 1
jmp 0x44c1c5
and dword [ebp - 0x2978], 0
mov eax, dword [ebp - 0xbc]
add eax, dword [ebp - 0x2978]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xbc], 0
jmp 0x44c1f0
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x44c20c
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x414c], 0x16cf0574
jmp 0x44c1e3
mov byte [ebp - 0x47a], 0
movzx eax, byte [ebp - 0x47a]
test eax, eax
je 0x44c22d
push 0x113f
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
jmp 0x44be31
mov dword [ebp - 0x774], 0
jmp 0x44c24b
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 3
jg 0x44c932
mov dword [ebp - 0x68], 0
mov dword [ebp - 0xb3c], 0
jmp 0x44c278
mov eax, dword [ebp - 0xb3c]
inc eax
mov dword [ebp - 0xb3c], eax
cmp dword [ebp - 0xb3c], 3
jge 0x44c294
mov eax, dword [ebp - 0xb3c]
mov dword [ebp + eax*4 - 0x4fd0], 0xeab3cf81
jmp 0x44c26b
mov byte [ebp - 0x516], 0
movzx eax, byte [ebp - 0x516]
test eax, eax
je 0x44c2b7
push 1
push 0xfed
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x68], eax
jge 0x44c2cb
mov dword [ebp - 0x15e0], 1
jmp 0x44c2d2
and dword [ebp - 0x15e0], 0
cmp dword [ebp - 0x68], 0
je 0x44c2f0
cmp dword [ebp - 0x68], 0
jne 0x44c2e4
cmp dword [ebp - 0x68], 0
je 0x44c2f0
mov dword [ebp - 0x3464], 1
jmp 0x44c2f7
and dword [ebp - 0x3464], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x4b38], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x4724], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x4df4], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x472c], eax
cmp dword [ebp - 0x68], 0x3e75
je 0x44c330
mov dword [ebp - 0x2980], 1
jmp 0x44c337
and dword [ebp - 0x2980], 0
mov eax, dword [ebp - 0x15e0]
cmp eax, dword [ebp - 0x2980]
jl 0x44c351
mov dword [ebp - 0x15e8], 1
jmp 0x44c358
and dword [ebp - 0x15e8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x15e8], eax
jne 0x44c36f
mov dword [ebp - 0x2988], 1
jmp 0x44c376
and dword [ebp - 0x2988], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x2988], eax
je 0x44c38d
mov dword [ebp - 0x15f0], 1
jmp 0x44c394
and dword [ebp - 0x15f0], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x15f0], eax
jle 0x44c3b1
cmp dword [ebp - 0x68], 0
je 0x44c3b1
mov dword [ebp - 0x2990], 1
jmp 0x44c3b8
and dword [ebp - 0x2990], 0
cmp dword [ebp - 0x2990], 0xfffffff7
ja 0x44c3cd
mov dword [ebp - 0x15f8], 1
jmp 0x44c3d4
and dword [ebp - 0x15f8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x15f8]
mov dword [ebp + eax - 0x4fd0], ecx
mov dword [ebp - 0x138], 0
jmp 0x44c400
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 4
jge 0x44c41f
push dword [ebp - 0x138]
lea ecx, [ebp - 0x3f78]
call fcn.0040f321
or dword [eax], 0xffffffff
jmp 0x44c3f3
push 1
lea ecx, [ebp - 0x3f54]
call fcn.0040f233
mov dword [ebp - 0xb44], 0xffffffff
mov dword [ebp - 0x10e4], 0
jmp 0x44c44f
mov eax, dword [ebp - 0x10e4]
inc eax
mov dword [ebp - 0x10e4], eax
cmp dword [ebp - 0x10e4], 1
jge 0x44c471
push dword [ebp - 0x10e4]
lea ecx, [ebp - 0x3f54]
call fcn.0040f321
mov dword [eax], 0xaf11
jmp 0x44c442
mov byte [ebp - 0x47c], 0
movzx eax, byte [ebp - 0x47c]
test eax, eax
je 0x44c499
push 0
push 0
push 0x225c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [ebp - 0xb44], 0
jmp 0x44c4b2
mov eax, dword [ebp - 0xb44]
inc eax
mov dword [ebp - 0xb44], eax
cmp dword [ebp - 0xb44], 0
jg 0x44c560
mov dword [ebp - 0xe5c], 0xffffffff
mov byte [ebp - 0x5ed], 0
movzx eax, byte [ebp - 0x5ed]
test eax, eax
je 0x44c4e8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [ebp - 0xe5c], 0
jmp 0x44c501
mov eax, dword [ebp - 0xe5c]
inc eax
mov dword [ebp - 0xe5c], eax
cmp dword [ebp - 0xe5c], 0
jg 0x44c55b
mov dword [ebp - 0x894], 0x72159124
mov dword [ebp - 0x894], 0
jmp 0x44c52d
mov eax, dword [ebp - 0x894]
inc eax
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 1
jge 0x44c54f
push dword [ebp - 0x894]
lea ecx, [ebp - 0x3f54]
call fcn.0040f321
mov dword [eax], 1
jmp 0x44c520
mov dword [ebp - 0x894], 7
jmp 0x44c4f4
jmp 0x44c4a5
lea ecx, [ebp - 0x3f54]
call fcn.0040f305
push 2
lea ecx, [ebp - 0x3f60]
call fcn.0040f233
mov dword [ebp - 0x48], 0
jmp 0x44c588
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x44c59e
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x410], 0xfffffff7
jmp 0x44c581
mov dword [ebp - 0x48], 0
jmp 0x44c5ae
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x44c5c4
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x4c70], 0
jmp 0x44c5a7
mov dword [ebp - 0x48], 0
jmp 0x44c5d4
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x44c5f0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x3f60]
call fcn.0040f321
mov dword [eax], 0x98422518
jmp 0x44c5cd
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x410], 0
jmp 0x44c61e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x410]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x410], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x410], 0xd
jne 0x44c7db
mov dword [ebp - 0x310], 0
mov dword [ebp - 0xb4c], 0xffffffff
mov dword [ebp - 0x346c], 0xfffffffd
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x4b40], eax
cmp dword [ebp - 0x310], 0
jne 0x44c677
cmp dword [ebp - 0x310], 0
jne 0x44c677
and dword [ebp - 0x2998], 0
jmp 0x44c681
mov dword [ebp - 0x2998], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x410]
imul eax, dword [ebp - 0x2998]
test eax, eax
jne 0x44c6a9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4c70], 0
je 0x44c6b7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4c70], 0
mov eax, dword [ebp - 0x310]
sub eax, dword [ebp - 0xb4c]
mov dword [ebp - 0xb4c], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x4734], eax
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0x4cc4], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x473c], eax
cmp dword [ebp - 0x310], 0
jne 0x44c716
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x410], 0
jne 0x44c716
push 6
pop eax
test eax, eax
jne 0x44c716
and dword [ebp - 0x1600], 0
jmp 0x44c720
mov dword [ebp - 0x1600], 1
cmp dword [ebp - 0x1600], 0xffffffff
je 0x44c735
mov dword [ebp - 0x29a0], 1
jmp 0x44c73c
and dword [ebp - 0x29a0], 0
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0x29a0], eax
jne 0x44c766
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4c70], 0
je 0x44c766
mov dword [ebp - 0x1608], 1
jmp 0x44c76d
and dword [ebp - 0x1608], 0
cmp dword [ebp - 0x1608], 3
je 0x44c782
mov dword [ebp - 0x29a8], 1
jmp 0x44c789
and dword [ebp - 0x29a8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x29a8]
sub ecx, dword [ebp + eax - 0x410]
mov dword [ebp - 0x1610], ecx
push 0
lea ecx, [ebp - 0x3f60]
call fcn.0040f321
mov ecx, dword [ebp - 0x1610]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1610]
mov dword [ebp - 0xb4c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x410]
mov dword [ebp - 0x346c], eax
jmp 0x44c603
lea ecx, [ebp - 0x3f60]
call fcn.0040f305
mov byte [ebp - 0x480], 0
mov dword [ebp - 0xfe8], 0
mov dword [ebp - 0xfe8], 0xffffffe2
jmp 0x44c810
mov eax, dword [ebp - 0xfe8]
inc eax
mov dword [ebp - 0xfe8], eax
cmp dword [ebp - 0xfe8], 0x1a
jl 0x44c86a
mov byte [ebp - 0x47e], 0
movzx eax, byte [ebp - 0x47e]
test eax, eax
je 0x44c83d
push 0x4fc
push 0xfee
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
mov byte [ebp - 0x518], 0
movzx eax, byte [ebp - 0x518]
test eax, eax
je 0x44c868
push 0
push 0
push 0
push 0
push 0
push 0
push 0x208
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x44c803
movzx eax, byte [ebp - 0x480]
test eax, eax
je 0x44c92d
mov dword [ebp - 0xe64], 6
mov dword [ebp - 0x4b48], 0xb72b21a3
mov dword [ebp - 0x29b0], 0xfffffff7
mov dword [ebp - 0xb54], 0
jmp 0x44c8b0
mov eax, dword [ebp - 0xb54]
inc eax
mov dword [ebp - 0xb54], eax
cmp dword [ebp - 0xb54], 3
jge 0x44c8cc
mov eax, dword [ebp - 0xb54]
mov dword [ebp + eax*4 - 0x5278], 6
jmp 0x44c8a3
mov dword [ebp - 0xe64], 0
jmp 0x44c8e5
mov eax, dword [ebp - 0xe64]
inc eax
mov dword [ebp - 0xe64], eax
cmp dword [ebp - 0xe64], 2
jg 0x44c914
mov byte [ebp - 0x6d5], 0
movzx eax, byte [ebp - 0x6d5]
test eax, eax
je 0x44c912
push 0x1e2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x44c8d8
mov eax, dword [ebp - 0x29b0]
dec eax
mov dword [ebp - 0x29b0], eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x44c23e
jmp 0x44ba4c
lea ecx, [ebp - 0x3f78]
call fcn.0040f305
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x348c], 0xb21a35ca
mov dword [ebp - 0x248], 0xfffffff0
jmp 0x44c96f
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xe
jne 0x44c990
mov dword [ebp - 0x3474], 0x33992443
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x3474], eax
jmp 0x44c962
mov dword [ebp - 0x248], 0
jmp 0x44c9a9
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xfffffffc
je 0x44c9de
mov dword [ebp - 0x347c], 0xe53e58bf
mov dword [ebp - 0x3484], 0xd2703d9b
mov eax, dword [ebp - 0x347c]
mov dword [ebp - 0x3484], eax
mov dword [ebp - 0x348c], 4
jmp 0x44c99c
mov dword [ebp - 0x15cc], 0x2d5e48d3
mov dword [ebp - 0x15c8], 0x2d5e48d3
mov dword [ebp - 0x15c4], 0x2d5e48d3
mov dword [ebp - 0x15c0], 0x2d5e48d3
mov dword [ebp - 0x2c], 0x52061f6
mov dword [ebp - 0xab0], 1
mov dword [ebp - 0xfc], 0x391cb4e7
mov dword [ebp - 0x14b0], 0x1932e3ca
mov dword [ebp - 0x3e60], 0x23edb395
mov dword [ebp - 0x3e5c], 0x23edb395
mov dword [ebp - 0x3e58], 0x23edb395
mov dword [ebp - 0x3e54], 0x23edb395
lea ecx, [ebp - 0x1445]
call fcn.0040f330
push eax
lea eax, [ebp - 0x3e50]
push eax
lea eax, [ebp - 0x3e60]
push eax
lea ecx, [ebp - 0x4fd8]
call fcn.0040f333
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3f90]
call fcn.0040f2df
mov dword [ebp - 0x3494], 0xffffffff
mov dword [ebp - 0x34ac], 0x1f66
mov dword [ebp - 0x2c], 3
jmp 0x44caac
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x44cc0d
mov dword [ebp - 0x29b8], 0xfffffff9
mov dword [ebp - 0x29c8], 9
cmp dword [ebp - 0xab0], 0
jne 0x44cb2e
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x4744], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x29b8], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp + ecx*4 - 0x15cc]
cmp dword [ebp + eax*4 - 0x15cc], ecx
jl 0x44cb0a
mov dword [ebp - 0x1618], 1
jmp 0x44cb11
and dword [ebp - 0x1618], 0
mov eax, dword [ebp - 0x1618]
sub eax, dword [ebp - 0x29b8]
add eax, dword [ebp - 0x29c8]
jne 0x44cb2e
and dword [ebp - 0x1620], 0
jmp 0x44cb38
mov dword [ebp - 0x1620], 1
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp + ecx*4 - 0x15cc]
imul ecx, dword [ebp - 0x1620]
cmp dword [ebp + eax*4 - 0x15cc], ecx
jle 0x44cb61
mov dword [ebp - 0x14a8], 1
jmp 0x44cb68
and dword [ebp - 0x14a8], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14a8]
mov dword [ebp + eax*4 - 0x15cc], ecx
mov eax, dword [ebp - 0xab0]
cmp dword [ebp - 0x14a8], eax
jl 0x44cb92
mov dword [ebp - 0x29c0], 1
jmp 0x44cb99
and dword [ebp - 0x29c0], 0
mov eax, dword [ebp - 0x29c0]
mov dword [ebp - 0xab0], eax
cmp dword [ebp - 0xab0], 0
je 0x44cbc1
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x44cbc1
mov dword [ebp - 0x1628], 1
jmp 0x44cbc8
and dword [ebp - 0x1628], 0
mov eax, dword [ebp - 0x1628]
mov dword [ebp - 0x14b0], eax
mov eax, dword [ebp - 0x14b0]
imul eax, dword [ebp - 0x29c8]
mov dword [ebp - 0x1630], eax
push 0
lea ecx, [ebp - 0x3f90]
call fcn.0040f321
mov ecx, dword [ebp - 0x1630]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1630]
mov dword [ebp - 0x3494], eax
jmp 0x44caa5
mov dword [ebp - 0xfc], 0
jmp 0x44cc26
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jg 0x44ce55
mov dword [ebp - 0xb5c], 0xfff8
mov dword [ebp - 0x2c], 3
jmp 0x44cc4d
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x44ce25
mov byte [ebp - 0x482], 0
movzx eax, byte [ebp - 0x482]
test eax, eax
je 0x44cc84
push 0x1532
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, 0x10224968
test eax, eax
je 0x44cd96
mov eax, dword [ebp - 0xb5c]
cmp dword [ebp - 0xab0], eax
jle 0x44ccab
mov dword [ebp - 0x349c], 1
jmp 0x44ccb2
and dword [ebp - 0x349c], 0
cmp dword [ebp - 0xb5c], 0xefae07df
jne 0x44ccd3
cmp dword [ebp - 0xb5c], 0
je 0x44ccd3
mov dword [ebp - 0x29d0], 1
jmp 0x44ccda
and dword [ebp - 0x29d0], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x29d0], eax
jg 0x44ccf1
mov dword [ebp - 0x34a4], 1
jmp 0x44ccf8
and dword [ebp - 0x34a4], 0
xor eax, eax
inc eax
cmp eax, 1
je 0x44cd19
mov eax, dword [ebp - 0xfc]
cmp dword [ebp + eax*4 - 0x15cc], 0
jne 0x44cd19
and dword [ebp - 0x1638], 0
jmp 0x44cd23
mov dword [ebp - 0x1638], 1
imul eax, dword [ebp - 0x1638], 0x2987
test eax, eax
jb 0x44cd3d
mov dword [ebp - 0x29d8], 1
jmp 0x44cd44
and dword [ebp - 0x29d8], 0
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0x15cc]
cmp dword [ebp - 0x29d8], eax
je 0x44cd6b
cmp dword [ebp - 0xb5c], 0
jne 0x44cd6b
and dword [ebp - 0x1640], 0
jmp 0x44cd75
mov dword [ebp - 0x1640], 1
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0x15cc]
cmp eax, dword [ebp - 0x1640]
je 0x44cd96
mov dword [ebp - 0x29e0], 1
jmp 0x44cd9d
and dword [ebp - 0x29e0], 0
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp + eax*4 - 0x15cc]
cmp dword [ebp - 0x29e0], eax
jl 0x44cdbe
mov dword [ebp - 0x1648], 1
jmp 0x44cdc5
and dword [ebp - 0x1648], 0
mov eax, dword [ebp - 0x34ac]
cmp dword [ebp - 0x1648], eax
jg 0x44cddf
mov dword [ebp - 0x29e8], 1
jmp 0x44cde6
and dword [ebp - 0x29e8], 0
mov eax, dword [ebp - 0x14b0]
cmp dword [ebp - 0x29e8], eax
je 0x44ce00
mov dword [ebp - 0x1650], 1
jmp 0x44ce07
and dword [ebp - 0x1650], 0
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x3f90]
call fcn.0040f321
mov ecx, dword [ebp - 0x1650]
mov dword [eax], ecx
jmp 0x44cc46
mov byte [ebp - 0x51a], 0
movzx eax, byte [ebp - 0x51a]
test eax, eax
je 0x44ce50
push 0xfc5
push 0
push 0xea3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp 0x44cc19
lea ecx, [ebp - 0x3f90]
call fcn.0040f305
mov dword [ebp - 0x318], 2
mov dword [ebp - 0x14b8], 0xfffffff8
mov dword [ebp - 0x4e70], 3
mov dword [ebp - 0x1094], 9
mov dword [ebp - 0x2a18], 1
mov dword [ebp - 0x36c0], 0xc3d8d589
mov dword [ebp - 0x474c], 0xb108f980
push 4
lea ecx, [ebp - 0x4900]
call fcn.0040f233
mov dword [ebp - 0x140], 0
jmp 0x44cecc
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 4
jge 0x44ceee
push dword [ebp - 0x140]
lea ecx, [ebp - 0x4900]
call fcn.0040f321
mov dword [eax], 0xf5d3cc11
jmp 0x44cebf
mov dword [ebp - 0x140], 0
jmp 0x44cf07
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x44cf23
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x1680], 0x7c2923f8
jmp 0x44cefa
mov dword [ebp - 0x318], 0x11
jmp 0x44cf3c
mov eax, dword [ebp - 0x318]
dec eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 2
jge 0x44d23a
push 1
lea ecx, [ebp - 0x11e4]
call fcn.0040f233
mov dword [ebp - 0x2a10], 0x4856cd83
mov dword [ebp - 0x4b50], 0xdc0ac77a
mov dword [ebp - 0x250], 0
jmp 0x44cf83
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jge 0x44cfa5
push dword [ebp - 0x250]
lea ecx, [ebp - 0x11e4]
call fcn.0040f321
mov dword [eax], 0x999d
jmp 0x44cf76
mov dword [ebp - 0x250], 0
jmp 0x44cfbe
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x44cfda
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x5248], 0xeb9d3763
jmp 0x44cfb1
push 0
lea ecx, [ebp - 0x11e4]
call fcn.0040f321
cmp dword [eax], 0
jne 0x44d1ba
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x2a10], eax
push 0
lea ecx, [ebp - 0x11e4]
call fcn.0040f321
cmp dword [eax], 0x1f0ef2f3
je 0x44d01d
mov dword [ebp - 0x29f0], 1
jmp 0x44d024
and dword [ebp - 0x29f0], 0
cmp dword [ebp - 0x29f0], 0x4752
jne 0x44d03c
mov dword [ebp - 0x1658], 1
jmp 0x44d043
and dword [ebp - 0x1658], 0
mov eax, dword [ebp - 0x1094]
dec eax
mov dword [ebp - 0x1094], eax
mov eax, dword [ebp - 0x1094]
cmp eax, dword [ebp - 0x1658]
jl 0x44d06a
mov dword [ebp - 0x29f8], 1
jmp 0x44d071
and dword [ebp - 0x29f8], 0
mov esi, dword [ebp - 0x29f8]
dec esi
push 0
lea ecx, [ebp - 0x11e4]
call fcn.0040f321
sub esi, dword [eax]
cmp esi, 3
jne 0x44d098
mov dword [ebp - 0x34b4], 1
jmp 0x44d09f
and dword [ebp - 0x34b4], 0
push 0
lea ecx, [ebp - 0x11e4]
call fcn.0040f321
push 0
lea ecx, [ebp - 0x11e4]
call fcn.0040f321
mov eax, dword [ebp - 0x1094]
add eax, dword [ebp - 0x318]
mov dword [ebp - 0x14b8], eax
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x14b8], eax
jle 0x44d0e5
mov dword [ebp - 0x1660], 1
jmp 0x44d0ec
and dword [ebp - 0x1660], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x1660], eax
je 0x44d106
mov dword [ebp - 0x2a00], 1
jmp 0x44d10d
and dword [ebp - 0x2a00], 0
push 0
lea ecx, [ebp - 0x11e4]
call fcn.0040f321
mov ecx, dword [ebp - 0x2a00]
cmp ecx, dword [eax]
jge 0x44d130
mov dword [ebp - 0x1668], 1
jmp 0x44d137
and dword [ebp - 0x1668], 0
push 0
lea ecx, [ebp - 0x11e4]
call fcn.0040f321
mov ecx, dword [ebp - 0x1668]
add ecx, dword [eax]
jne 0x44d160
mov eax, 0x4a10
test eax, eax
jne 0x44d160
and dword [ebp - 0x2a08], 0
jmp 0x44d16a
mov dword [ebp - 0x2a08], 1
mov eax, dword [ebp - 0x2a08]
sub eax, 0xd6ba
imul esi, eax, 7
push 0
lea ecx, [ebp - 0x11e4]
call fcn.0040f321
cmp esi, dword [eax]
jg 0x44d195
mov dword [ebp - 0x1670], 1
jmp 0x44d19c
and dword [ebp - 0x1670], 0
push 0
lea ecx, [ebp - 0x11e4]
call fcn.0040f321
mov ecx, dword [ebp - 0x1670]
cmp ecx, dword [eax]
je 0x44d1ba
cmp dword [ebp - 0x14b8], 0
mov esi, dword [ebp - 0x2a10]
push 0
lea ecx, [ebp - 0x11e4]
call fcn.0040f321
cmp esi, dword [eax]
jge 0x44d1e6
mov eax, 0xb2a93f04
test eax, eax
je 0x44d1e6
mov dword [ebp - 0x1678], 1
jmp 0x44d1ed
and dword [ebp - 0x1678], 0
mov eax, dword [ebp - 0x1678]
mov dword [ebp - 0x2a18], eax
mov eax, dword [ebp - 0x2a18]
mov dword [ebp - 0x4754], eax
mov dword [ebp - 0x36c0], 0x52b3395c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1680]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1680], eax
lea ecx, [ebp - 0x11e4]
call fcn.0040f305
jmp 0x44cf2f
lea ecx, [ebp - 0x4900]
call fcn.0040f305
mov dword [ebp - 0x2a50], 1
mov dword [ebp - 0xb6c], 0xffffffff
mov dword [ebp - 0x14c0], 6
mov dword [ebp - 0x81c], 1
mov dword [ebp - 0x77c], 0xffffffff
push 2
lea ecx, [ebp - 0x38b0]
call fcn.0040f233
mov dword [ebp - 0x398], 0
mov dword [ebp - 0x148], 1
mov dword [ebp - 0xb64], 0
jmp 0x44d2b1
mov eax, dword [ebp - 0xb64]
inc eax
mov dword [ebp - 0xb64], eax
cmp dword [ebp - 0xb64], 2
jge 0x44d2d3
push dword [ebp - 0xb64]
lea ecx, [ebp - 0x38b0]
call fcn.0040f321
mov dword [eax], 0xc930f888
jmp 0x44d2a4
cmp dword [ebp - 0x77c], 0
je 0x44d2e8
mov dword [ebp - 0x2a20], 1
jmp 0x44d2ef
and dword [ebp - 0x2a20], 0
cmp dword [ebp - 0x2a20], 0xb9cf7d16
jne 0x44d307
mov dword [ebp - 0x1688], 1
jmp 0x44d30e
and dword [ebp - 0x1688], 0
mov eax, dword [ebp - 0x81c]
cmp eax, dword [ebp - 0x1688]
jl 0x44d328
mov dword [ebp - 0x2a28], 1
jmp 0x44d32f
and dword [ebp - 0x2a28], 0
cmp dword [ebp - 0x2a28], 0
je 0x44d344
mov dword [ebp - 0x1690], 1
jmp 0x44d34b
and dword [ebp - 0x1690], 0
mov eax, dword [ebp - 0x1690]
sub eax, dword [ebp - 0x81c]
cmp eax, dword [ebp - 0xb6c]
jl 0x44d36b
mov dword [ebp - 0x2a30], 1
jmp 0x44d372
and dword [ebp - 0x2a30], 0
mov eax, dword [ebp - 0x14c0]
cmp dword [ebp - 0x2a30], eax
je 0x44d38c
mov dword [ebp - 0x1698], 1
jmp 0x44d393
and dword [ebp - 0x1698], 0
mov eax, dword [ebp - 0x14c0]
cmp dword [ebp - 0x1698], eax
jle 0x44d3b3
push 0
lea ecx, [ebp - 0x38b0]
call fcn.0040f321
cmp dword [eax], 0
je 0x44d3c8
cmp dword [ebp - 0x398], 0
je 0x44d3c8
mov dword [ebp - 0x2a38], 1
jmp 0x44d3cf
and dword [ebp - 0x2a38], 0
mov eax, dword [ebp - 0x81c]
cmp dword [ebp - 0x2a38], eax
je 0x44d3e9
mov dword [ebp - 0x16a0], 1
jmp 0x44d3f0
and dword [ebp - 0x16a0], 0
cmp dword [ebp - 0x16a0], 0x749e
jne 0x44d408
mov dword [ebp - 0x36c8], 1
jmp 0x44d40f
and dword [ebp - 0x36c8], 0
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0x4cd8], eax
mov eax, dword [ebp - 0x14c0]
mov dword [ebp - 0x475c], eax
push 0
lea ecx, [ebp - 0x38b0]
call fcn.0040f321
cmp dword [ebp - 0x77c], 0x2ab2bc8f
jg 0x44d44c
mov dword [ebp - 0x2a40], 1
jmp 0x44d453
and dword [ebp - 0x2a40], 0
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x2a40], eax
je 0x44d46d
mov dword [ebp - 0x16a8], 1
jmp 0x44d474
and dword [ebp - 0x16a8], 0
mov eax, dword [ebp - 0x16a8]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
sub eax, dword [ebp - 0x81c]
cmp eax, dword [ebp - 0x398]
jge 0x44d4a0
mov dword [ebp - 0x2a48], 1
jmp 0x44d4a7
and dword [ebp - 0x2a48], 0
cmp dword [ebp - 0x2a48], 0
jle 0x44d4bc
mov dword [ebp - 0x16b0], 1
jmp 0x44d4c3
and dword [ebp - 0x16b0], 0
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x16b0], eax
jle 0x44d4dd
mov dword [ebp - 0x16b8], 1
jmp 0x44d4e4
and dword [ebp - 0x16b8], 0
mov dword [ebp - 0x2a50], 0x5710
mov esi, dword [ebp - 0x2a50]
push 0
lea ecx, [ebp - 0x38b0]
call fcn.0040f321
mov ecx, dword [ebp - 0x16b8]
add ecx, dword [eax]
imul esi, ecx
add esi, 3
mov dword [ebp - 0x81c], esi
mov dword [ebp - 0x77c], 0
jmp 0x44d52e
mov eax, dword [ebp - 0x77c]
inc eax
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 0x15
je 0x44d80d
mov dword [ebp - 0x36d8], 0x22a22728
mov dword [ebp - 0x2a90], 0xcc53
mov dword [ebp - 0x16f0], 0xd024bfcc
mov dword [ebp - 0x148], 9
jmp 0x44d572
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 8
je 0x44d808
mov dword [ebp - 0x2a58], 5
mov dword [ebp - 0xe6c], 0x6c9f93b7
cmp dword [ebp - 0x81c], 0
jne 0x44d68f
mov dword [ebp - 0x2a58], 0x230a264f
cmp dword [ebp - 0x2a58], 0
jne 0x44d5c5
cmp dword [ebp - 0x148], 0
jne 0x44d5c5
and dword [ebp - 0x16c0], 0
jmp 0x44d5cf
mov dword [ebp - 0x16c0], 1
cmp dword [ebp - 0x16c0], 0
jne 0x44d5ed
cmp dword [ebp - 0x398], 0
je 0x44d5ed
mov dword [ebp - 0x2a60], 1
jmp 0x44d5f4
and dword [ebp - 0x2a60], 0
mov eax, dword [ebp - 0xe6c]
cmp dword [ebp - 0x2a60], eax
jne 0x44d60e
mov dword [ebp - 0x16c8], 1
jmp 0x44d615
and dword [ebp - 0x16c8], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x16c8], eax
jne 0x44d62f
mov dword [ebp - 0x2a68], 1
jmp 0x44d636
and dword [ebp - 0x2a68], 0
mov eax, dword [ebp - 0x2a90]
cmp dword [ebp - 0x2a68], eax
jle 0x44d650
mov dword [ebp - 0x16d0], 1
jmp 0x44d657
and dword [ebp - 0x16d0], 0
mov eax, dword [ebp - 0xb6c]
cmp dword [ebp - 0x16d0], eax
jne 0x44d671
mov dword [ebp - 0x2a70], 1
jmp 0x44d678
and dword [ebp - 0x2a70], 0
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x2a70], eax
jl 0x44d68f
and dword [ebp - 0x16d8], 0
jmp 0x44d699
mov dword [ebp - 0x16d8], 1
mov eax, dword [ebp - 0xe6c]
cmp dword [ebp - 0x16d8], eax
jl 0x44d6b3
mov dword [ebp - 0x2a78], 1
jmp 0x44d6ba
and dword [ebp - 0x2a78], 0
cmp dword [ebp - 0x2a78], 6
je 0x44d6cf
mov dword [ebp - 0x36d0], 1
jmp 0x44d6d6
and dword [ebp - 0x36d0], 0
cmp dword [ebp - 0x148], 0
je 0x44d6eb
mov dword [ebp - 0x16e0], 1
jmp 0x44d6f2
and dword [ebp - 0x16e0], 0
mov eax, dword [ebp - 0xe6c]
cmp dword [ebp - 0x16e0], eax
jl 0x44d70c
mov dword [ebp - 0x2a80], 1
jmp 0x44d713
and dword [ebp - 0x2a80], 0
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x2a80], eax
jl 0x44d72d
mov dword [ebp - 0x16e8], 1
jmp 0x44d734
and dword [ebp - 0x16e8], 0
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x16e8], eax
jg 0x44d74e
mov dword [ebp - 0x2a88], 1
jmp 0x44d755
and dword [ebp - 0x2a88], 0
imul eax, dword [ebp - 0x2a88], 0xfffd
mov dword [ebp - 0x16f0], eax
mov eax, dword [ebp - 0x16f0]
cmp dword [ebp - 0x36d8], eax
jne 0x44d77f
mov dword [ebp - 0x16f8], 1
jmp 0x44d786
and dword [ebp - 0x16f8], 0
mov eax, dword [ebp - 0x2a90]
cmp dword [ebp - 0x16f8], eax
je 0x44d7e9
mov dword [ebp - 0x36e0], 0xffff
cmp dword [ebp - 0xe6c], 1
jne 0x44d7b3
mov dword [ebp - 0x2a98], 1
jmp 0x44d7ba
and dword [ebp - 0x2a98], 0
mov eax, dword [ebp - 0x36e0]
cmp eax, dword [ebp - 0x2a98]
jne 0x44d7d4
mov dword [ebp - 0x1700], 1
jmp 0x44d7db
and dword [ebp - 0x1700], 0
mov eax, dword [ebp - 0x1700]
mov dword [ebp - 0xb6c], eax
jmp 0x44d803
mov byte [ebp - 0x484], 0
movzx eax, byte [ebp - 0x484]
test eax, eax
je 0x44d803
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
jmp 0x44d565
jmp 0x44d521
lea ecx, [ebp - 0x38b0]
call fcn.0040f305
push 2
lea ecx, [ebp - 0x3fa8]
call fcn.0040f233
mov dword [ebp - 0xab8], 8
mov dword [ebp - 0xff0], 0
jmp 0x44d848
mov eax, dword [ebp - 0xff0]
inc eax
mov dword [ebp - 0xff0], eax
cmp dword [ebp - 0xff0], 2
jge 0x44d86a
push dword [ebp - 0xff0]
lea ecx, [ebp - 0x3fa8]
call fcn.0040f321
mov dword [eax], 0xdd33a4a9
jmp 0x44d83b
mov dword [ebp - 0xab8], 1
jmp 0x44d883
mov eax, dword [ebp - 0xab8]
dec eax
mov dword [ebp - 0xab8], eax
cmp dword [ebp - 0xab8], 0
jl 0x44d8c5
mov byte [ebp - 0x5f5], 0
movzx eax, byte [ebp - 0x5f5]
test eax, eax
je 0x44d8ab
push 0x26c1
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push dword [ebp - 0xab8]
lea ecx, [ebp - 0x3fa8]
call fcn.0040f321
cmp dword [eax], 0
je 0x44d8c3
jmp 0x44d8c5
jmp 0x44d876
lea ecx, [ebp - 0x3fa8]
call fcn.0040f305
mov dword [ebp - 0xe7c], 0xfffffffc
push 1
lea ecx, [ebp - 0xae4]
call fcn.0040f233
mov dword [ebp - 0x36e8], 0x7fb07d0
mov dword [ebp - 0xac0], 0
mov dword [ebp - 0xb74], 0
jmp 0x44d914
mov eax, dword [ebp - 0xb74]
inc eax
mov dword [ebp - 0xb74], eax
cmp dword [ebp - 0xb74], 1
jge 0x44d933
push dword [ebp - 0xb74]
lea ecx, [ebp - 0xae4]
call fcn.0040f321
and dword [eax], 0
jmp 0x44d907
mov eax, 0x7c2c
test eax, eax
je 0x44d987
push 0
lea ecx, [ebp - 0xae4]
call fcn.0040f321
cmp dword [eax], 0xee4c20f8
jg 0x44d95d
mov dword [ebp - 0x2aa0], 1
jmp 0x44d964
and dword [ebp - 0x2aa0], 0
push 0
lea ecx, [ebp - 0xae4]
call fcn.0040f321
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2aa0]
jne 0x44d987
mov dword [ebp - 0x1708], 1
jmp 0x44d98e
and dword [ebp - 0x1708], 0
push 0
lea ecx, [ebp - 0xae4]
call fcn.0040f321
mov ecx, dword [ebp - 0x1708]
imul ecx, dword [eax]
test ecx, ecx
jne 0x44d9ba
push 0
lea ecx, [ebp - 0xae4]
call fcn.0040f321
cmp dword [eax], 0
je 0x44d9d8
push 0
lea ecx, [ebp - 0xae4]
call fcn.0040f321
cmp dword [eax], 0
je 0x44d9d8
mov dword [ebp - 0x2aa8], 1
jmp 0x44d9df
and dword [ebp - 0x2aa8], 0
push 0
lea ecx, [ebp - 0xae4]
call fcn.0040f321
mov ecx, dword [ebp - 0x2aa8]
imul ecx, dword [eax]
cmp ecx, 0x8722
jle 0x44da09
mov dword [ebp - 0x1710], 1
jmp 0x44da10
and dword [ebp - 0x1710], 0
cmp dword [ebp - 0x1710], 0x16aac895
jle 0x44da28
mov dword [ebp - 0x2ab0], 1
jmp 0x44da2f
and dword [ebp - 0x2ab0], 0
push 0
lea ecx, [ebp - 0xae4]
call fcn.0040f321
mov esi, dword [ebp - 0x2ab0]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0xae4]
call fcn.0040f321
cmp esi, dword [eax]
jg 0x44da62
mov dword [ebp - 0x1718], 1
jmp 0x44da69
and dword [ebp - 0x1718], 0
push 0
lea ecx, [ebp - 0xae4]
call fcn.0040f321
mov ecx, dword [ebp - 0x1718]
cmp ecx, dword [eax]
jl 0x44da8c
mov dword [ebp - 0x2ab8], 1
jmp 0x44da93
and dword [ebp - 0x2ab8], 0
mov eax, dword [ebp - 0x36e8]
cmp dword [ebp - 0x2ab8], eax
je 0x44daad
mov dword [ebp - 0x1720], 1
jmp 0x44dab4
and dword [ebp - 0x1720], 0
push 0
lea ecx, [ebp - 0xae4]
call fcn.0040f321
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1720]
je 0x44dad7
mov dword [ebp - 0x2ac0], 1
jmp 0x44dade
and dword [ebp - 0x2ac0], 0
push 0
lea ecx, [ebp - 0xae4]
call fcn.0040f321
mov ecx, dword [ebp - 0x2ac0]
cmp ecx, dword [eax]
je 0x44db01
mov dword [ebp - 0x1728], 1
jmp 0x44db08
and dword [ebp - 0x1728], 0
push 0
lea ecx, [ebp - 0xae4]
call fcn.0040f321
mov eax, dword [eax]
add eax, dword [ebp - 0x1728]
jne 0x44db3a
push 0
lea ecx, [ebp - 0xae4]
call fcn.0040f321
cmp dword [eax], 0
jne 0x44db3a
and dword [ebp - 0x2ac8], 0
jmp 0x44db44
mov dword [ebp - 0x2ac8], 1
mov eax, dword [ebp - 0x2ac8]
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xac0], 7
jmp 0x44db69
mov eax, dword [ebp - 0xac0]
inc eax
mov dword [ebp - 0xac0], eax
cmp dword [ebp - 0xac0], 0x1a
jl 0x44db9a
mov byte [ebp - 0x486], 0
movzx eax, byte [ebp - 0x486]
test eax, eax
je 0x44db98
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
jmp 0x44db5c
lea ecx, [ebp - 0xae4]
call fcn.0040f305
mov dword [ebp - 0x480c], 0
mov dword [ebp - 0xb7c], 0xfffffffc
mov dword [ebp - 0xe74], 0
jmp 0x44dbd2
mov eax, dword [ebp - 0xe74]
inc eax
mov dword [ebp - 0xe74], eax
cmp dword [ebp - 0xe74], 1
jge 0x44dbee
mov eax, dword [ebp - 0xe74]
mov dword [ebp + eax*4 - 0x4e90], 4
jmp 0x44dbc5
mov dword [ebp - 0xb7c], 0
jmp 0x44dc07
mov eax, dword [ebp - 0xb7c]
dec eax
mov dword [ebp - 0xb7c], eax
cmp dword [ebp - 0xb7c], 0
jl 0x44dc63
mov byte [ebp - 0x51c], 0
movzx eax, byte [ebp - 0x51c]
test eax, eax
je 0x44dc3b
push 0x26cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov byte [ebp - 0x488], 0
movzx eax, byte [ebp - 0x488]
test eax, eax
je 0x44dc61
push 0
push 0x1316
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x44dbfa
mov byte [ebp - 0x68d], 0
movzx eax, byte [ebp - 0x68d]
test eax, eax
je 0x44dc82
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov dword [ebp - 0x4814], 0xfffffff6
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x3708], 0xb21a35ca
mov dword [ebp - 0x258], 0xfffffff0
jmp 0x44dcb9
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0xe
jne 0x44dcda
mov dword [ebp - 0x36f0], 0x33992443
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x36f0], eax
jmp 0x44dcac
mov dword [ebp - 0x258], 0
jmp 0x44dcf3
mov eax, dword [ebp - 0x258]
dec eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0xfffffffc
je 0x44dd28
mov dword [ebp - 0x36f8], 0xe53e58bf
mov dword [ebp - 0x3700], 0xd2703d9b
mov eax, dword [ebp - 0x36f8]
mov dword [ebp - 0x3700], eax
mov dword [ebp - 0x3708], 4
jmp 0x44dce6
mov dword [ebp - 0x150], 6
mov dword [ebp - 0x1124], 0
jmp 0x44dd4b
mov eax, dword [ebp - 0x1124]
inc eax
mov dword [ebp - 0x1124], eax
cmp dword [ebp - 0x1124], 4
jge 0x44dd67
mov eax, dword [ebp - 0x1124]
mov dword [ebp + eax*4 - 0x5178], 0xa136951a
jmp 0x44dd3e
mov dword [ebp - 0x150], 0xffffffe2
jmp 0x44dd80
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jge 0x44dda5
mov byte [ebp - 0x48a], 0
movzx eax, byte [ebp - 0x48a]
test eax, eax
je 0x44dda3
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
jmp 0x44dd73
mov dword [ebp - 0x150], 0
jmp 0x44ddbe
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 4
jge 0x44ddda
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x5178], 0xe57bf5cd
jmp 0x44ddb1
mov dword [ebp - 0x158], 0
jmp 0x44ddf3
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x44de0f
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x3c90], 0xbca6
jmp 0x44dde6
push 3
lea ecx, [ebp - 0x3b9c]
call fcn.0040f233
mov dword [ebp - 0xb84], 0x6dd8d130
mov dword [ebp - 0x3c88], 0
mov dword [ebp - 0x3c84], 0
mov dword [ebp - 0x3c80], 0
mov dword [ebp - 0x3c7c], 0
mov dword [ebp - 0x3718], 0xd921b0ae
push 3
lea ecx, [ebp - 0x3fc0]
call fcn.0040f233
mov dword [ebp - 0x3710], 0xc0233fd5
mov dword [ebp - 0x2ae8], 0x6df3e2e1
mov dword [ebp - 0x3720], 0xffffffff
mov dword [ebp - 0x260], 0
jmp 0x44de9c
cmp dword [ebp - 0x260], 3
jge 0x44debe
push dword [ebp - 0x260]
lea ecx, [ebp - 0x3b9c]
call fcn.0040f321
mov dword [eax], 0x8885
jmp 0x44de8f
mov dword [ebp - 0x260], 0
jmp 0x44ded7