Function at 0x44845a
Capabilities:
Accept command line arguments
Extract resource via kernel32 functions
Get common file path
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
push ebx
mov dword [ebp - 8], 0xe0648261
xor ebx, ebx
mov byte [ebp - 0x2d], dl
xor edx, edx
mov dword [ebp - 0x14], 0x725245f5
inc ebx
mov dword [ebp - 0xc], 0x520c
push esi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 8], edx
jmp 0x448498
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x4c], 0xc6a3f0bd
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x44848a
mov dword [ebp - 8], edx
jmp 0x4484b3
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xe8], 0xd5ab883e
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x4484a2
mov dword [ebp - 8], 0xffffffef
jmp 0x4484f2
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
dec edx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 1], dl
cmp byte [ebp - 1], dl
je 0x4484ef
push edx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
xor edx, edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffe
jl 0x4484c2
mov dword [ebp - 8], 0xfffffffa
jmp 0x4485de
mov dword [ebp - 0x10], 0x167d
mov dword [ebp - 0x28], 0xffffffff
cmp dword [ebp - 8], edx
jne 0x4485c8
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, 0x40c88307
setne cl
xor eax, eax
cmp ecx, 2
setg al
xor ecx, ecx
cmp eax, 0x5c7d
mov eax, dword [ebp - 0x10]
setle cl
xor edx, edx
cmp ecx, 0xfffffff9
setne dl
xor ecx, ecx
add edx, 0x5e2ed85c
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 8]
jle 0x44855a
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 8]
sub ecx, eax
cmp ecx, 5
jne 0x44857f
cmp dword [ebp - 0xe8], 0
jne 0x44857f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0xe8], ecx
mov eax, dword [ebp - 8]
cmp ecx, eax
setg dl
xor ecx, ecx
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
cmp eax, 0x116104db
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov eax, edx
cmp ecx, 0xfffffffb
jge 0x4485ca
mov eax, ebx
cmp eax, dword [ebp - 0xc]
jg 0x4485d6
mov eax, edx
cmp dword [ebp - 0x14], edx
je 0x4485d8
mov eax, ebx
mov dword [ebp - 0x28], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 8
jge 0x448504
mov eax, 0x61928c17
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
push edi
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
push 3
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], edx
pop edi
jmp 0x448630
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x44862d
push edx
push 0x20f5
push edx
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
xor edx, edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x448615
mov dword [ebp - 0x10], 0xe04822b1
mov dword [ebp - 0x20], 0x989d221e
mov dword [ebp - 0x1c], 0x96ee4e91
mov dword [ebp - 0x10], 0xb2c57e71
mov dword [ebp - 0x20], 0x2a96950a
mov dword [ebp - 0x28], 0x40eb
mov dword [ebp - 0x10], edx
jmp 0x448675
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa8], 0xe1757117
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x448664
mov esi, dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov dword [ebp - 0xa8], edx
jmp 0x44882f
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], 0xba1a
mov dword [ebp - 0x10], edx
jmp 0x4486a8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3c], 0x9b7928f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x44869a
mov dword [ebp - 0x18], edx
jmp 0x44881f
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], edx
jmp 0x4486d9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x178], 0x468a07c6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4486c8
mov dword [ebp - 0x10], 0x1a
jmp 0x4486f4
mov dword [ebp - 0x2c], 0x1d6a56c3
dec dword [ebp - 0x2c]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff7
je 0x4486e7
mov dword [ebp - 0x14], 0x16
cmp dword [ebp - 0x14], 0x15
jl 0x44881c
mov dword [ebp - 0x2c], 0xd4c0
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], edx
jmp 0x44872b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x160], 0x36c1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x44871a
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x44873f
push edx
push edx
call esi
xor edx, edx
mov dword [ebp - 0x10], 0xfffffff2
jmp 0x448802
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
jmp 0x44877c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x174], 0xca3e
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x44876b
cmp dword [ebp - 0x10], edx
je 0x44879c
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x174]
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x16c]
xor edx, edx
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
push 0
setl dl
xor ecx, ecx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp eax, 0x3a55a411
setne cl
add ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
pop edx
setle cl
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff7
jle 0x44874b
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x15
push 0
pop edx
jge 0x44870b
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff5
jl 0x4486b5
dec dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 0xfffffff7
jge 0x44868b
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], 0xa55f07c7
mov dword [ebp - 0x18], edx
jmp 0x44885c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1d0], 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x44884b
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
mov dword [ebp - 0x14], edx
pop ecx
jmp 0x44891f
mov dword [ebp - 8], 0xfffffffb
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], edx
jl 0x44891c
mov dword [ebp - 0x18], edx
jmp 0x44889b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9c], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x44888a
mov dword [ebp - 0x98], edx
jmp 0x44890b
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], edx
jl 0x448905
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], edx
jmp 0x4488f8
mov dword [ebp - 0xc], 5
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], edx
jl 0x4488f5
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x4488ed
push 0x183b
push edx
push edx
call ebx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
dec dword [ebp - 0xc]
jns 0x4488d2
push 2
pop ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x4488c3
mov dword [ebp - 0x10], edx
dec dword [ebp - 0x1c]
jns 0x4488b7
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], ecx
jle 0x4488a8
dec dword [ebp - 8]
jns 0x448885
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x448872
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x448947
push 0x3d
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
xor edx, edx
mov eax, dword [0x4bca0c]
mov dword [ebp - 0x20], 0xeac8b13e
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
mov dword [ebp - 0x2c], eax
je 0x448970
push edx
push edx
push 0x231f
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x448989
push 0x3d
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
xor edx, edx
mov ebx, dword [ebp + 8]
xor ecx, ecx
inc ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x24], 0x32987c83
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
mov dword [ebp - 0x18], edx
jmp 0x4489c1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a0], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x4489b0
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x4489e3
push 0xdcc
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 7
jle 0x448af6
jmp 0x4489f5
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x1c], 0xb0420410
mov dword [ebp - 0x10], 0xdc14c38d
mov dword [ebp - 0xc], 0x8a87ea82
mov dword [ebp - 0x24], 0x1359
mov dword [ebp - 0x18], edx
jmp 0x448a2a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x138], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x448a1d
cmp dword [ebp - 0x14], edx
jne 0x448a3d
cmp dword [ebp - 8], edx
jne 0x448a3d
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
test eax, eax
sets cl
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
sub edx, eax
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x5751
setg al
xor edx, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setl dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
sub eax, 0x3988
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, dword [ebp - 0xc]
jg 0x448acc
cmp dword [ebp - 0x134], edx
je 0x448acc
xor ecx, ecx
inc ecx
jmp 0x448ace
mov ecx, edx
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 8]
imul eax, ecx
sub eax, dword [ebp - 8]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 7
jg 0x4489f2
cmp byte [ebp - 0x2d], 0
je 0x448c85
cmp dword [ebp - 0x2c], 1
jne 0x448c85
mov dword [ebp - 0x20], 0xeac8b13e
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x448b2b
push edx
push edx
push 0x231f
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x448b48
push 0x3d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
xor edx, edx
mov dword [ebp - 0xc], 0x4a18885c
mov dword [ebx + 8], 4
mov dword [ebp - 0x18], edx
jmp 0x448b6c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x90], 0x9b3198a8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x448b5b
xor ecx, ecx
inc ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], edx
jl 0x448c7e
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], edx
jl 0x448c75
mov dword [ebp - 8], 0x3e9323d1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], edx
jl 0x448c18
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x14], edx
jmp 0x448c0e
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x10], edx
jmp 0x448c06
mov dword [ebp - 0x18], 0xbb00868b
mov dword [ebp - 0x18], edx
jmp 0x448be7
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x448bd8
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor ecx, ecx
xor edx, edx
inc ecx
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x90], edx
jne 0x448bec
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x448bc3
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x90], ecx
xor ecx, ecx
inc dword [ebp - 0x10]
inc ecx
cmp dword [ebp - 0x10], ecx
jle 0x448bb7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x448bab
dec dword [ebp - 8]
jns 0x448b9f
mov dword [ebp - 8], edx
jmp 0x448c67
mov dword [ebp - 0x18], edx
jmp 0x448c33
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x448c22
mov dword [ebp - 0xc8], edx
jmp 0x448c5c
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x448c56
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor ecx, ecx
xor edx, edx
inc ecx
inc dword [ebp - 0xc8]
cmp dword [ebp - 0xc8], ecx
jle 0x448c41
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jle 0x448c1d
dec dword [ebp - 0x1c]
jns 0x448b90
dec dword [ebp - 0xc]
jns 0x448b81
mov dword [ebx + 0xc], 0x4bca0c
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x20], 0x3e58bfc4
mov dword [ebp - 0x20], 0x703d9b95
mov dword [ebp - 0x1c], 0x2daab72b
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0x34174aa7
push 3
mov dword [ebp - 0xc], 0xfff7
mov dword [ebp - 8], edx
pop ecx
jmp 0x448cd8
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x100], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x448ccb
mov dword [ebp - 8], edx
jmp 0x448cf3
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xf4], 0x39ecf4a4
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x448ce2
mov dword [ebp - 8], edx
jmp 0x448d0e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xac], 0x491d0b6b
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x448cfd
mov dword [ebp - 0x14], edx
jmp 0x448d2a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x100], 0xb4ffb87
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x448d19
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xec], 0xcd3c
jg 0x448d54
imul eax, dword [ebp - 0xac], 0xfff8
test eax, eax
je 0x448d54
xor ecx, ecx
inc ecx
jmp 0x448d56
mov ecx, edx
mov eax, dword [ebp - 0xf0]
imul eax, ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x448d6d
cmp dword [ebp - 0x1c], edx
je 0x448d6d
mov edx, ecx
xor ecx, ecx
mov dword [ebp - 0xf0], edx
mov eax, dword [ebp - 0x28]
cmp edx, eax
setge cl
cmp ecx, 0xffffffff
jl 0x448d8d
cmp dword [ebp - 0x1c], 0
je 0x448d8d
xor edx, edx
inc edx
jmp 0x448d8f
xor edx, edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0x986219e2
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x24]
test eax, eax
jne 0x448db7
cmp dword [ebp - 0xf8], eax
jne 0x448db7
mov edx, eax
jmp 0x448dba
xor edx, edx
inc edx
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x2c]
jge 0x449896
xor edx, edx
mov dword [ebp - 0x20], 0xfffffff6
mov byte [ebp - 1], dl
cmp byte [ebp - 1], dl
je 0x448e0d
push edx
push 0xdf3
push 0x6b5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
xor edx, edx
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x448e1c
push edx
push edx
call esi
xor edx, edx
mov dword [ebp - 0x1c], 0xcb13638e
xor ecx, ecx
mov dword [ebp - 0x20], 0x576c5165
inc ecx
mov dword [ebp - 0x20], 0xec7516a2
mov ebx, 0x4bca10
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 0xbbd0a708
mov dword [ebp - 0x20], 8
push 3
mov dword [ebp - 0x24], edx
mov dword [ebp - 8], edx
pop esi
jmp 0x448e66
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1c4], 0x3342eb90
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x448e55
mov dword [ebp - 8], edx
jmp 0x448e81
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x14c], 0xf29acd40
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x448e70
mov dword [ebp - 8], edx
jmp 0x448e98
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1dc], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x448e8b
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], edx
jl 0x448ede
mov dword [ebp - 0xc], 0xc4530722
mov dword [ebp - 0xc], 2
cmp dword [ebp - 0xc], edx
jl 0x448ed3
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x448ece
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
dec dword [ebp - 0xc]
jns 0x448ebc
mov eax, dword [ebp - 0x1c4]
dec dword [ebp - 0x1c]
jns 0x448ea9
dec dword [ebp - 0x24]
cmp dword [ebp - 0x34], 0
mov dword [ebp - 0x28], edx
jle 0x449482
mov dword [ebp - 8], 0x69ad
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0xc], edx
jmp 0x448f16
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x64], 0xccb090ae
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x448f08
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x448f2e
push edx
call dword [sym.imp.USER32.dll_DestroyCursor]
xor edx, edx
cmp dword [ebp - 8], edx
jne 0x448ffe
mov dword [ebp - 0xc], 0xfffffffa
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0xc], edx
jmp 0x448f5b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x154], 0x5e17ca00
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x448f4a
xor ecx, ecx
inc ecx
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], edx
jl 0x448fa0
mov dword [ebp - 0xc], edx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], edx
jl 0x448f9b
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x448f93
push 0x283
push 0x5ee
push edx
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
xor edx, edx
dec dword [ebp - 0xc]
jns 0x448f77
xor ecx, ecx
inc ecx
dec dword [ebp - 8]
jns 0x448f6c
mov eax, dword [ebp - 8]
cmp dword [ebp - 8], edx
jne 0x448faf
cmp dword [ebp - 0x1c], edx
jne 0x448faf
mov ecx, edx
mov eax, dword [ebp - 8]
imul eax, ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x154]
neg eax
sbb eax, eax
neg eax
sub eax, 0x8729
neg eax
sbb eax, eax
inc eax
cmp eax, 0xfffffff8
jbe 0x448fdc
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
imul eax, ecx, 0xffff
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x24], eax
jmp 0x4490fa
mov dword [ebp - 0xc], edx
jmp 0x449014
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x88], 0x36042c8c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x449003
mov dword [ebp - 8], 0xfffffff2
cmp dword [ebp - 8], 0x15
jge 0x4490fa
mov dword [ebp - 0x24], 0x55584e2b
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x449069
push 0x14c2
push 0x313
push 0x94f
push 0x175b
push 0x1665
push edx
push edx
push edx
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
xor edx, edx
cmp dword [ebp - 0x24], 0xffffffff
jne 0x449078
cmp dword [ebp - 0x80], edx
jne 0x449078
mov ecx, edx
jmp 0x44907b
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x1c]
add eax, ecx
push 0
pop eax
sets al
add eax, dword [ebp - 0x80]
je 0x449090
cmp dword [ebp - 0x60], edx
jne 0x449099
cmp dword [ebp - 0x60], edx
jne 0x449099
mov ecx, edx
jmp 0x44909c
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x80]
add eax, ecx
cmp dword [ebp - 8], eax
jle 0x4490a9
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x24]
mov ecx, 0xd4b3bebd
neg eax
push 0
sbb eax, eax
neg eax
cmp ecx, eax
mov eax, dword [ebp - 0x80]
sbb ecx, ecx
neg ecx
sub ecx, esi
sub ecx, 0x58af3265
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, eax
mov eax, dword [ebp - 0x88]
cmp ecx, eax
mov eax, dword [ebp - 0x80]
setne dl
xor ecx, ecx
cmp edx, eax
pop edx
sete cl
mov dword [ebp - 0x64], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x15
jl 0x44902a
mov esi, dword [ebx]
push 3
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x20], esi
mov dword [ebp - 8], edx
pop ecx
jmp 0x44911c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x48], 9
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x44910e
mov dword [ebp - 8], edx
jmp 0x449137
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1b8], 0xe22401db
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x449126
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x449153
push 0x12e5
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor edx, edx
cmp dword [ebp - 0x40], edx
je 0x449162
cmp dword [ebp - 0x48], edx
je 0x449162
xor eax, eax
inc eax
jmp 0x449164
mov eax, edx
cmp eax, 0xa17d0b0a
mov eax, dword [ebp - 0x40]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setl dl
imul eax, edx
test eax, eax
je 0x449184
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
xor edx, edx
cmp eax, 2
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x48]
setle cl
add eax, ecx
xor ecx, ecx
cmp eax, 0xf144
mov eax, dword [ebp - 0x48]
setle cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x1b0], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
sub ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
xor ecx, ecx
test eax, eax
setns cl
xor eax, eax
cmp ecx, 0xdfe9
setne al
xor edx, edx
mov dword [ebp - 0x24], eax
add ebx, 4
mov dword [ebp - 0x50], 0xeac8b13e
mov byte [ebp - 1], dl
cmp byte [ebp - 1], dl
je 0x44920e
push edx
push edx
push 0x231f
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x44922b
push 0x3d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
xor edx, edx
mov edi, dword [ebx]
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], 0xf4f4
mov dword [ebp - 0xc], 0x2061f665
mov dword [ebp - 0x14], 0x58bac04e
push 4
mov dword [ebp - 0xc0], 0x5b40194d
pop ecx
mov dword [ebp - 0x1c], 0x2aee5a98
add ebx, ecx
mov dword [ebp - 0x38], 0xa53e
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edx
jmp 0x44927e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xd8], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x449271
dec dword [ebp - 0x1c]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0xfffffff3
jge 0x4493b8
mov dword [ebp - 8], 0xf7c8b166
mov eax, 0xd88c83b9
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0xc], 0x7dc23988
mov dword [ebp - 0x38], 0xf6657eef
mov dword [ebp - 0x38], 9
cmp dword [ebp - 0x1c], edx
je 0x4492df
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 8], edx
je 0x4492df
xor esi, esi
inc esi
jmp 0x4492e1
mov esi, edx
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc0]
cmp ecx, eax
mov eax, dword [ebp - 0xd0]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
sub esi, ecx
mov ecx, dword [ebp - 8]
imul ecx, esi
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xd0]
add ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
xor edi, edi
mov dword [ebp - 0x24], edx
cmp dword [ebp - 8], edi
jne 0x44933a
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, 0x737b78f1
sub ecx, eax
add ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 8]
push 0
setle bl
xor ecx, ecx
cmp ebx, eax
setne cl
xor edx, edx
mov dword [ebp - 0xd8], ecx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 0xa62e26a8
setne al
xor edx, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xc], edi
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setge dl
mov dword [ebp - 0x38], edx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
pop edx
jl 0x449294
mov edi, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x20]
test edi, edi
jne 0x4493c2
add ebx, 8
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], edx
jmp 0x4493d8
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb8], 0xad313dd3
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4493c7
mov dword [ebp - 8], edx
jmp 0x4493f4
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1f4], 0xfffffffb
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4493e3
mov dword [ebp - 0xb0], 0xffffffe7
cmp dword [ebp - 0xb0], 0xfffffff9
jge 0x449467
xor ebx, ebx
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], ebx
jl 0x449453
mov dword [ebp - 0xc], 9
mov dword [ebp - 0xc], 2
cmp dword [ebp - 0xc], ebx
jl 0x44944e
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x449449
push ebx
push 0xcaf
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
dec dword [ebp - 0xc]
jns 0x449435
dec dword [ebp - 0x1c]
jns 0x449422
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], 0xfffffff9
jl 0x44940f
mov ebx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x28]
add ebx, esi
mov edi, dword [sym.imp.USER32.dll_GetDC]
inc eax
push 3
mov dword [ebp - 0x28], eax
pop esi
cmp eax, dword [ebp - 0x34]
jl 0x448eee
mov dword [ebp - 0x14], 0x692b
mov dword [ebp - 0xc], 0x46758e35
cmp dword [ebp - 0x14], edx
je 0x449530
mov dword [ebp - 8], edx
jmp 0x4494af
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x194], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x44949e
xor ecx, ecx
mov dword [ebp - 8], edx
inc ecx
jmp 0x4494ca
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x54], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x4494bc
mov dword [ebp - 0x14], edx
jmp 0x449528
mov dword [ebp - 0x34], 0xfffffff9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18c], 0x3718
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 1], dl
jne 0x449510
cmp byte [ebp - 1], 0
je 0x449525
push edx
push edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x449523
cmp byte [ebp - 1], 0
je 0x449525
push 0x1db2
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor edx, edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1c
jl 0x4494d4
jmp 0x449537
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov edi, dword [ebx]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0xc], edx
jmp 0x44955c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x188], 0x34504cd4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x44954b
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x449574
push edx
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x4495f5
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x10], edx
jmp 0x4495ed
mov dword [ebp - 0xc], edx
jmp 0x449598
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x5c], 0xd2e8588d
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x44958a
mov dword [ebp - 0x58], edx
jmp 0x4495d3
cmp byte [ebp - 1], 0
je 0x4495bc
push 0x12c2
push edx
push 0xb4c
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x188]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x188], ecx
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], esi
mov byte [ebp - 1], dl
jle 0x4495a3
cmp byte [ebp - 1], 0
je 0x4495ea
push edx
call dword [sym.imp.USER32.dll_CharNextW]
xor edx, edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x449585
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x449579
mov dword [ebp - 0x10], 0xc184c506
mov dword [ebp - 0x20], 0xfff7
mov dword [ebp - 0xc], edx
jmp 0x449622
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x168], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x449611
xor ecx, ecx
mov dword [ebp - 0x10], edx
inc ecx
jmp 0x44963f
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x168], edx
jne 0x449644
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x449630
mov esi, dword [ebx + 4]
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x20], 0x5af8b513
mov dword [ebp - 0x20], 0xbea5223f
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xb3a00d0e
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x28], ecx
push 3
mov dword [ebp - 0xc], edx
pop ecx
jmp 0x44968d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1e8], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x44967c
mov dword [ebp - 0x18], edx
jmp 0x44971d
mov dword [ebp - 8], edx
jmp 0x4496ac
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1ac], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x44969f
mov dword [ebp - 8], edx
jmp 0x4496c0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x7c], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x4496b6
mov dword [ebp - 0x74], edx
jmp 0x449714
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], 0x2ca8cda2
mov dword [ebp - 0x1c], edx
jmp 0x44970b
mov dword [ebp - 0xc], edx
jmp 0x4496ef
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe0], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4496e2
dec dword [ebp - 0xe0]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0x1ac]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x4496dd
inc dword [ebp - 0x74]
cmp dword [ebp - 0x74], 2
jle 0x4496ca
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 5
je 0x44969a
inc dword [ebp - 0x28]
add ebx, 8
mov dword [ebp - 8], 0xffffffff
xor edx, edx
mov dword [ebp - 0xc], 0x2466e9f0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 8]
setg dl
mov dword [ebp - 0x10], ebx
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 8]
jge 0x449760
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
jne 0x449773
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
je 0x44978d
cmp dword [ebp - 0xc], ecx
je 0x44978d
xor eax, eax
inc eax
jmp 0x44978f
mov eax, ecx
add eax, 0xa7f4ea14
mov dword [ebp - 8], eax
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x18
jge 0x4497be
xor ebx, ebx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x4497b2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x18
jl 0x4497a2
test esi, esi
jne 0x44988f
cmp byte [ebp - 0x2d], 0
je 0x4497db
mov ebx, dword [ebp + 8]
jmp 0x449896
mov dword [ebp + 8], 0xffffffff
xor edx, edx
mov dword [ebp - 0x10], 0x3c4ab274
push 0xfffffffffffffffd
pop esi
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x20], 0xc039ecf4
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp ecx, eax
pop edi
setg dl
xor ecx, ecx
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x10]
cmp eax, 0xbf0b
setge cl
imul ecx, edx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0x15
cmp dword [ebp - 0x10], esi
jge 0x44992d
xor eax, eax
mov byte [ebp + 0xb], al
cmp byte [ebp + 0xb], 0
je 0x449925
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x449914
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret