Function at 0x4099c2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x110
mov eax, 0x4820ab
call fcn.00466adb
mov eax, dword [ebp + 8]
mov dword [ebp - 0xec], eax
lea eax, [ebp - 0x114]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x48abc0
push 0x80000002
mov byte [ebp - 0xd5], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x409a5e
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xf0]
push eax
push ebx
push 0x48a658
push dword [ebp - 0x114]
mov dword [ebp - 0xdc], 0x40
mov dword [ebp - 0xf0], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x409a52
lea eax, [ebp - 0x54]
push eax
call fcn.00461704
test eax, eax
pop ecx
setne byte [ebp - 0xd5]
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4a9c4c]
add eax, 0x1b0
push 0x48abf8
push eax
lea eax, [ebp - 0xd0]
push eax
mov byte [ebp - 0xd7], bl
mov byte [ebp - 0xd6], bl
mov dword [ebp - 0x100], ebx
call fcn.00404f99
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp - 0xb8], 8
mov eax, dword [ebp - 0xcc]
jae 0x409aa7
lea eax, [ebp - 0xcc]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x409b1b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0x6400000
jae 0x409b14
lea eax, [esi + 1]
push eax
call fcn.0045d808
pop ecx
push ebx
lea ecx, [ebp - 0x118]
push ecx
push esi
push eax
mov byte [esi + eax], bl
push edi
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x118], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x118]
cmp eax, esi
ja 0x409b14
mov ecx, dword [ebp - 0x100]
mov byte [eax + ecx], bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x48
call fcn.0045fd75
pop ecx
mov dword [ebp - 0xe8], eax
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x409b41
push eax
call fcn.00448087
mov esi, eax
mov dword [ebp - 0x110], esi
jmp 0x409b49
mov dword [ebp - 0x110], ebx
mov esi, ebx
cmp esi, ebx
mov byte [ebp - 4], bl
je 0x40a720
mov eax, dword [esi]
push ebx
push ebx
push dword [ebp - 0x100]
mov ecx, esi
call dword [eax + 8]
mov eax, esi
call fcn.00405d08
cmp eax, ebx
mov dword [ebp - 0xfc], eax
je 0x40a714
push 0x48ac10
mov byte [ebp - 0xd7], 1
call fcn.00405d2c
mov edi, eax
cmp edi, ebx
je 0x409d0d
cmp byte [ebp - 0xd5], bl
je 0x409ba2
push 0x48ac18
jmp 0x409ba7
push 0x48ac20
call fcn.00405d2c
push str.9d5
mov esi, eax
call fcn.00405d2c
mov dword [ebp - 0xe4], eax
push 0x48ac30
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0xe0], eax
push 0x48ac38
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0xf8], eax
push str.__wM
mov eax, edi
call fcn.00405d2c
mov edi, eax
push 0x48ac44
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0xdc], eax
push 0x48ac4c
mov eax, esi
call fcn.00405d2c
cmp dword [ebp - 0xe4], ebx
mov dword [ebp - 0xf0], eax
je 0x409d0d
cmp dword [ebp - 0xe0], ebx
je 0x409d0d
cmp dword [ebp - 0xf8], ebx
je 0x409d0d
cmp edi, ebx
je 0x409d0d
mov eax, dword [ebp - 0xe4]
push 0x4a9df8
call int.0044806d
push eax
call fcn.0044d34c
mov eax, dword [ebp - 0xe0]
pop ecx
pop ecx
push 0x4a9e14
call int.0044806d
push eax
call fcn.0044d34c
mov eax, dword [ebp - 0xf8]
pop ecx
pop ecx
push 0x4a9e30
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
mov esi, 0x4a9e4c
push esi
mov eax, edi
call int.0044806d
push eax
call fcn.0044d34c
mov eax, dword [ebp - 0xdc]
cmp eax, ebx
pop ecx
pop ecx
je 0x409cb9
push 0x4a9e68
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
mov eax, dword [ebp - 0xf0]
cmp eax, ebx
je 0x409cd5
push 0x4a9e84
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
mov edi, 0x48ac58
push edi
call fcn.0045ef28
pop ecx
mov ecx, dword [0x4a9e60]
push edi
mov edi, eax
mov eax, esi
call fcn.0040d75a
test eax, eax
jne 0x409d06
mov byte [0x4a9f11], 1
mov dword [0x4a9f60], 0x1f40
mov byte [ebp - 0xd6], 1
mov eax, dword [ebp - 0xfc]
push 0x48ac64
call fcn.00405d2c
cmp eax, ebx
je 0x40a39d
push 0x48ac6c
call fcn.00405d2c
cmp eax, ebx
mov dword [ebp - 0xd4], eax
je 0x40a39d
mov esi, dword [ebp - 0xd4]
push 0x48ab9c
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0xf8], eax
push 0x48ab84
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0xe0], eax
push str._a3_w
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0xe4], eax
push 0x48ab88
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0x10c], eax
push 0x48ab90
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0xf0], eax
push 0x48ab94
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0xdc], eax
push 0x48ac84
mov eax, esi
call fcn.00405d2c
mov esi, eax
cmp esi, ebx
je 0x409f21
push 0x48ac90
call fcn.00405d2c
mov edi, eax
push 0x48ac98
mov eax, esi
call fcn.00405d2c
cmp edi, ebx
mov esi, eax
je 0x409f21
cmp esi, ebx
je 0x409f21
push 7
pop eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], ebx
mov word [ebp - 0xb0], bx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x84], ebx
mov word [ebp - 0x94], bx
lea eax, [ebp - 0xb4]
push eax
mov eax, edi
mov byte [ebp - 4], 3
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
lea eax, [ebp - 0x98]
push eax
mov eax, esi
call int.0044806d
push eax
call fcn.0044d34c
mov edi, dword [ebp - 0xec]
pop ecx
pop ecx
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x108]
add edi, 4
push eax
call fcn.0040d1fe
cmp dword [ebp - 0x108], ebx
mov esi, dword [edi + 4]
je 0x409e74
cmp dword [ebp - 0x108], edi
je 0x409e79
call fcn.0045fa67
mov edi, dword [ebp - 0x104]
cmp edi, esi
je 0x409f02
cmp dword [ebp - 0x80], 8
mov esi, dword [ebp - 0x94]
jae 0x409e95
lea esi, [ebp - 0x94]
cmp dword [ebp - 0x108], ebx
jne 0x409ea2
call fcn.0045fa67
mov eax, dword [ebp - 0x108]
cmp edi, dword [eax + 4]
jne 0x409eb2
call fcn.0045fa67
lea eax, [ebp - 0x11c]
push eax
push 0x20019
push ebx
push esi
push dword [edi + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x409f02
mov eax, dword [ebp - 0xd4]
call fcn.00405cda
push ebx
push 1
lea esi, [ebp - 0x98]
mov dword [ebp - 0xd4], eax
call fcn.00404aac
push ebx
push 1
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], bl
call fcn.00404aac
jmp 0x40a391
push ebx
push 1
lea esi, [ebp - 0x98]
call fcn.00404aac
push ebx
push 1
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], bl
call fcn.00404aac
cmp dword [ebp - 0xf8], ebx
je 0x40a380
cmp dword [ebp - 0xe0], ebx
je 0x40a380
cmp dword [ebp - 0xe4], ebx
je 0x40a380
mov eax, dword [ebp - 0xec]
cmp dword [eax + 0x77c], ebx
jne 0x40a167
push 0xb8
call fcn.0045fd75
pop ecx
mov dword [ebp - 0xe8], eax
cmp eax, ebx
mov byte [ebp - 4], 4
je 0x409f80
push eax
call fcn.00405f5d
mov edi, eax
mov dword [ebp - 0xf4], edi
jmp 0x409f88
mov dword [ebp - 0xf4], ebx
mov edi, ebx
mov ecx, dword [ebp - 0xd4]
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], bl
call fcn.004094df
push 0xffffffffffffffff
lea ecx, [edi + 0x94]
push ecx
xor ebx, ebx
mov byte [ebp - 4], 5
call fcn.00404ce2
push ebx
push 1
lea esi, [ebp - 0x70]
mov byte [ebp - 4], bl
call fcn.00404aac
lea eax, [edi + 0x5c]
mov dword [ebp - 0xe8], eax
push eax
mov eax, dword [ebp - 0xf8]
mov dword [edi], ebx
mov dword [edi + 4], ebx
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
lea eax, [edi + 8]
push eax
mov eax, dword [ebp - 0xe0]
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
lea eax, [edi + 0x78]
pop ecx
mov dword [ebp - 0xe0], eax
push eax
mov eax, dword [ebp - 0xe4]
call int.0044806d
push eax
call fcn.0044d34c
mov eax, dword [ebp - 0x10c]
cmp eax, ebx
pop ecx
pop ecx
je 0x40a02d
lea ecx, [edi + 0x40]
push ecx
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
mov eax, dword [ebp - 0xf0]
cmp eax, ebx
je 0x40a048
lea ecx, [edi + 0x24]
push ecx
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
mov eax, dword [ebp - 0xdc]
cmp eax, ebx
je 0x40a09b
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x5c], ebx
mov word [ebp - 0x6c], bx
lea ecx, [ebp - 0x70]
push ecx
mov byte [ebp - 4], 6
call int.0044806d
push eax
call fcn.0044d34c
cmp dword [ebp - 0x58], 8
mov eax, dword [ebp - 0x6c]
pop ecx
pop ecx
jae 0x40a081
lea eax, [ebp - 0x6c]
push eax
call fcn.00461504
pop ecx
push ebx
push 1
lea esi, [ebp - 0x70]
mov dword [edi], eax
mov dword [edi + 4], edx
mov byte [ebp - 4], bl
call fcn.00404aac
push 0x70
call fcn.0045fd75
pop ecx
mov dword [ebp - 0xdc], eax
cmp eax, ebx
mov byte [ebp - 4], 7
je 0x40a0b9
push eax
call fcn.0045b25e
jmp 0x40a0bb
xor eax, eax
mov ecx, dword [ebp - 0xec]
mov byte [ebp - 4], bl
mov dword [edi + 0xb0], eax
push dword [ecx + 0x58]
mov edi, eax
call int.0045b413
mov edi, dword [ebp - 0xf4]
mov eax, dword [edi + 0xb0]
mov ecx, dword [eax + 0x68]
push dword [ebp - 0xe8]
mov edx, 0x141
mov dword [eax + 0x60], 0x1e1
mov dword [eax + 0x64], edx
add ecx, 0x1eb
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], edx
mov eax, dword [edi + 0xb0]
call int.0045b465
mov eax, dword [edi + 0xb0]
call fcn.0045b475
mov eax, dword [edi + 0xb0]
mov esi, dword [ebp - 0xe0]
push 0x48aca0
mov dword [eax + 0x24], 0x464646
call fcn.0040d138
test eax, eax
mov eax, dword [edi + 0xb0]
jne 0x40a147
mov byte [eax + 0x5d], 1
jmp 0x40a14a
mov byte [eax + 0x5d], bl
mov eax, dword [edi + 0xb0]
mov byte [eax + 0x3c], bl
mov byte [eax + 0x5c], bl
mov eax, dword [ebp - 0xec]
mov dword [eax + 0x77c], edi
jmp 0x40a37e
cmp dword [eax + 0x780], ebx
jne 0x40a380
push 0xb8
call fcn.0045fd75
pop ecx
mov dword [ebp - 0xe8], eax
cmp eax, ebx
mov byte [ebp - 4], 8
je 0x40a19c
push eax
call fcn.00405f5d
mov edi, eax
mov dword [ebp - 0xf4], edi
jmp 0x40a1a4
mov dword [ebp - 0xf4], ebx
mov edi, ebx
mov ecx, dword [ebp - 0xd4]
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], bl
call fcn.004094df
push 0xffffffffffffffff
lea ecx, [edi + 0x94]
push ecx
xor ebx, ebx
mov byte [ebp - 4], 9
call fcn.00404ce2
push ebx
push 1
lea esi, [ebp - 0x70]
mov byte [ebp - 4], bl
call fcn.00404aac
lea eax, [edi + 0x5c]
mov dword [ebp - 0xe8], eax
push eax
mov eax, dword [ebp - 0xf8]
mov dword [edi], ebx
mov dword [edi + 4], ebx
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
lea eax, [edi + 8]
push eax
mov eax, dword [ebp - 0xe0]
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
lea eax, [edi + 0x78]
pop ecx
mov dword [ebp - 0xe0], eax
push eax
mov eax, dword [ebp - 0xe4]
call int.0044806d
push eax
call fcn.0044d34c
mov eax, dword [ebp - 0x10c]
cmp eax, ebx
pop ecx
pop ecx
je 0x40a249
lea ecx, [edi + 0x40]
push ecx
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
mov eax, dword [ebp - 0xf0]
cmp eax, ebx
je 0x40a264
lea ecx, [edi + 0x24]
push ecx
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
mov eax, dword [ebp - 0xdc]
cmp eax, ebx
je 0x40a2b7
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x5c], ebx
mov word [ebp - 0x6c], bx
lea ecx, [ebp - 0x70]
push ecx
mov byte [ebp - 4], 0xa
call int.0044806d
push eax
call fcn.0044d34c
cmp dword [ebp - 0x58], 8
mov eax, dword [ebp - 0x6c]
pop ecx
pop ecx
jae 0x40a29d
lea eax, [ebp - 0x6c]
push eax
call fcn.00461504
pop ecx
push ebx
push 1
lea esi, [ebp - 0x70]
mov dword [edi], eax
mov dword [edi + 4], edx
mov byte [ebp - 4], bl
call fcn.00404aac
push 0x70
call fcn.0045fd75
pop ecx
mov dword [ebp - 0xdc], eax
cmp eax, ebx
mov byte [ebp - 4], 0xb
je 0x40a2d5
push eax
call fcn.0045b25e
jmp 0x40a2d7
xor eax, eax
mov ecx, dword [ebp - 0xec]
mov byte [ebp - 4], bl
mov dword [edi + 0xb0], eax
push dword [ecx + 0x58]
mov edi, eax
call int.0045b413
mov edi, dword [ebp - 0xf4]
mov eax, dword [edi + 0xb0]
mov ecx, dword [eax + 0x68]
push dword [ebp - 0xe8]
mov edx, 0x141
mov dword [eax + 0x60], 0x149
mov dword [eax + 0x64], edx
add ecx, 0x153
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], edx
mov eax, dword [edi + 0xb0]
call int.0045b465
mov eax, dword [edi + 0xb0]
call fcn.0045b475
mov eax, dword [edi + 0xb0]
mov esi, dword [ebp - 0xe0]
push 0x48aca0
mov dword [eax + 0x24], 0x464646
call fcn.0040d138
test eax, eax
mov eax, dword [edi + 0xb0]
jne 0x40a363
mov byte [eax + 0x5d], 1
jmp 0x40a366
mov byte [eax + 0x5d], bl
mov eax, dword [edi + 0xb0]
mov byte [eax + 0x3c], bl
mov byte [eax + 0x5c], bl
mov eax, dword [ebp - 0xec]
mov dword [eax + 0x780], edi
xor ebx, ebx
mov eax, dword [ebp - 0xd4]
call fcn.00405cda
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], ebx
jne 0x409d3d
mov eax, dword [ebp - 0xfc]
push 0x48acac
call fcn.00405d2c
cmp eax, ebx
je 0x40a714
push 0x48ac6c
call fcn.00405d2c
cmp eax, ebx
mov dword [ebp - 0xd4], eax
je 0x40a714
mov esi, dword [ebp - 0xd4]
push 0x48ab9c
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0xdc], eax
push 0x48ab84
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0xe8], eax
push 0x48ab88
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0xf0], eax
push 0x48ab90
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0x10c], eax
push 0x48ab94
mov eax, esi
call fcn.00405d2c
mov dword [ebp - 0xfc], eax
push 0x48ac84
mov eax, esi
call fcn.00405d2c
mov esi, eax
cmp esi, ebx
je 0x40a59f
push 0x48ac90
call fcn.00405d2c
mov edi, eax
push 0x48ac98
mov eax, esi
call fcn.00405d2c
cmp edi, ebx
mov esi, eax
je 0x40a59f
cmp esi, ebx
je 0x40a59f
push 7
pop eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], ebx
mov word [ebp - 0xb0], bx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x84], ebx
mov word [ebp - 0x94], bx
lea eax, [ebp - 0xb4]
push eax
mov eax, edi
mov byte [ebp - 4], 0xd
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
lea eax, [ebp - 0x98]
push eax
mov eax, esi
call int.0044806d
push eax
call fcn.0044d34c
mov edi, dword [ebp - 0xec]
pop ecx
pop ecx
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x108]
add edi, 4
push eax
call fcn.0040d1fe
cmp dword [ebp - 0x108], ebx
mov esi, dword [edi + 4]
je 0x40a4f2
cmp dword [ebp - 0x108], edi
je 0x40a4f7
call fcn.0045fa67
mov edi, dword [ebp - 0x104]
cmp edi, esi
je 0x40a580
cmp dword [ebp - 0x80], 8
mov esi, dword [ebp - 0x94]
jae 0x40a513
lea esi, [ebp - 0x94]
cmp dword [ebp - 0x108], ebx
jne 0x40a520
call fcn.0045fa67
mov eax, dword [ebp - 0x108]
cmp edi, dword [eax + 4]
jne 0x40a530
call fcn.0045fa67
lea eax, [ebp - 0x11c]
push eax
push 0x20019
push ebx
push esi
push dword [edi + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40a580
mov eax, dword [ebp - 0xd4]
call fcn.00405cda
push ebx
push 1
lea esi, [ebp - 0x98]
mov dword [ebp - 0xd4], eax
call fcn.00404aac
push ebx
push 1
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], bl
call fcn.00404aac
jmp 0x40a708
push ebx
push 1
lea esi, [ebp - 0x98]
call fcn.00404aac
push ebx
push 1
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], bl
call fcn.00404aac
push 0xb8
call fcn.0045fd75
pop ecx
mov dword [ebp - 0xe4], eax
cmp eax, ebx
mov byte [ebp - 4], 0xe
je 0x40a5c2
push eax
call fcn.00405f5d
mov edi, eax
jmp 0x40a5c4
xor edi, edi
mov ecx, dword [ebp - 0xd4]
lea eax, [ebp - 0x70]
mov byte [ebp - 4], bl
push eax
mov dword [ebp - 0xe4], edi
call fcn.004094df
lea ecx, [edi + 0x94]
push 0xffffffffffffffff
push ecx
xor ebx, ebx
mov byte [ebp - 4], 0xf
call fcn.00404ce2
push ebx
push 1
lea esi, [ebp - 0x70]
mov byte [ebp - 4], bl
call fcn.00404aac
lea eax, [edi + 8]
push eax
mov eax, dword [ebp - 0xe8]
mov dword [edi], ebx
mov dword [edi + 4], ebx
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
lea eax, [edi + 0x5c]
push eax
mov eax, dword [ebp - 0xdc]
call int.0044806d
push eax
call fcn.0044d34c
mov eax, dword [ebp - 0xf0]
cmp eax, ebx
pop ecx
pop ecx
je 0x40a64c
lea ecx, [edi + 0x40]
push ecx
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
mov eax, dword [ebp - 0x10c]
cmp eax, ebx
je 0x40a667
lea ecx, [edi + 0x24]
push ecx
call int.0044806d
push eax
call fcn.0044d34c
pop ecx
pop ecx
mov eax, dword [ebp - 0xfc]
cmp eax, ebx
je 0x40a6ba
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x5c], ebx
mov word [ebp - 0x6c], bx
lea ecx, [ebp - 0x70]
push ecx
mov byte [ebp - 4], 0x10
call int.0044806d
push eax
call fcn.0044d34c
cmp dword [ebp - 0x58], 8
mov eax, dword [ebp - 0x6c]
pop ecx
pop ecx
jae 0x40a6a0
lea eax, [ebp - 0x6c]
push eax
call fcn.00461504
pop ecx
push ebx
mov dword [edi], eax
push 1
lea esi, [ebp - 0x70]
mov dword [edi + 4], edx
mov byte [ebp - 4], bl
call fcn.00404aac
mov edi, dword [ebp - 0xec]
mov esi, dword [edi + 0x788]
lea eax, [ebp - 0xe4]
push eax
push dword [esi + 4]
push esi
call fcn.0040dc90
lea ecx, [edi + 0x78c]
mov edx, dword [ecx]
mov edi, 0x3fffffff
sub edi, edx
cmp edi, 1
jb 0x40a74d
inc edx
mov dword [ecx], edx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [ebp - 0xd4]
call fcn.00405cda
mov dword [ebp - 0xd4], eax
xor ebx, ebx
cmp dword [ebp - 0xd4], ebx
jne 0x40a3cd
mov ecx, dword [ebp - 0x110]
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [ebp - 0x100], ebx
je 0x40a734
push dword [ebp - 0x100]
call fcn.0045f0fa
pop ecx
cmp byte [ebp - 0xd7], bl
push ebx
push ebx
je 0x40a78c
cmp byte [ebp - 0xd6], bl
je 0x40a785
push 0x4c9
jmp 0x40a79b
push 0x48afbc
lea ecx, [ebp - 0xb4]
call fcn.00404560
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x11
call fcn.00401ddf
push 0x494404
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x7c], 0x484954
call fcn.00466661
push 0x4ce
jmp 0x40a79b
mov dword [0x4a9dac], 1
push 0x4c8
push dword [0x4a9784]
call dword [sym.imp.USER32.dll_PostMessageW]
push ebx
push 1
lea esi, [ebp - 0xd0]
call fcn.00404aac
call fcn.00466b5e
ret 4