Function at 0x402012
Capabilities:
Authenticate hmac
Check for time delay via gettickcount
Delete file
Get file size
Hash data with crc32
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x487c
push edi
lea edi, [ebp - 0x487c]
push 1
call dword [ebx + 0x40]
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0xe
je 0x40203b
call dword [ebx + 0x38]
cmp eax, 1
jne 0x4091a2
mov dword [edi], 0
mov ecx, dword [ebx + 0x148]
add ecx, dword [ebx + 0x6c]
lea eax, [ecx + 0x108]
mov ecx, dword [ecx]
cmp ecx, 3
jne 0x4021b8
push eax
push edi
call fcn.00409a24
cmp eax, 1
jne 0x40206f
mov dword [edi], 0x409e25
jmp 0x4020a0
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x5a494c41
push 0x4954494e
push 0x495f4f54
push 0x5f44454c
push 0x49414624
push esp
call dword [ebx + 0x30]
add esp, 0x24
cmp dword [edi], 0
je 0x4021b6
push 0xa
push 0xd732520
push 0x5d24454d
push 0x414e5f52
push 0x45545041
push 0x4441245b
mov ecx, dword [ebx + 0x148]
add ecx, dword [ebx + 0x6c]
lea edx, [ecx + 4]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
add esp, 0x18
lea edx, [edi + 0x38]
push edx
push 0
call dword [edi + 4]
cmp eax, 0
jne 0x4021b6
lea edx, [ebp - 0x461c]
push edx
lea edx, [ebp - 0x466c]
push edx
lea edx, [ebp - 0x46bc]
push edx
push dword [edi + 0x38]
call dword [edi + 0x30]
cmp eax, 0
jne 0x4021b6
push 0xa
push 0xd732520
push 0x5d244552
push 0x41574d52
push 0x49465f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x46bc]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
add esp, 0x1c
push 0
push 0xa0d7325
push 0x205d244c
push 0x4c445f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x466c]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x4021f8
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x48545f59
push 0x425f4445
push 0x54524f50
push 0x5055535f
push 0x544f4e5f
push 0x53495f4c
push 0x4f434f54
push 0x4f525024
push esp
call dword [ebx + 0x30]
add esp, 0x30
cmp dword [edi], 0
je 0x4091a2
mov dword [ebp - 0x43d0], 0
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
lea edx, [ecx + 2]
push edx
push eax
lea edx, [ebp - 0x45cc]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov dword [ebp - 0x42c0], 0
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov byte [esi + 0x6c], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x40225e
cmp eax, 0xb
jne 0x40236c
mov byte [ebp - 0x2814], 0x29
mov byte [ebp - 0x2813], 2
push 0xfa
lea edx, [ebp - 0x44d2]
push edx
push 2
lea edx, [ebp - 0x2814]
push edx
call dword [ebx + 0x3c]
cmp eax, 8
je 0x4022db
push 0xa0d31
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x45242024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x30
mov dword [ebp - 0x42c0], 1
jmp 0x40236c
push 0x6d6f
push 0x632e7572
push 0x2e636d6d
mov dword [ebp - 0x2808], esp
push 0x706870
push 0x2e747365
push 0x745f6e61
push 0x635f3035
push 0x3868725f
push 0x6e617373
push 0x696e2f74
push 0x7365742f
lea edx, [ebp - 0x2810]
push edx
lea edx, [ebp - 0x44d2]
push edx
lea edx, [esp + 8]
push edx
push dword [ebp - 0x2808]
call fcn.0040a973
mov dword [ebp - 0x42c0], eax
add esp, 0x20
add esp, 0xc
test eax, eax
jne 0x40236c
mov byte [ebp - 0x2812], 0x2a
mov byte [ebp - 0x2811], 0xa
push 0xfa
lea edx, [ebp - 0x44d2]
push edx
push 0xa
lea edx, [ebp - 0x2812]
push edx
call dword [ebx + 0x3c]
cmp dword [esi + 0x270], 0x73696e24
jne 0x4023e5
cmp dword [esi + 0x274], 0x386e6173
jne 0x4023e5
cmp dword [esi + 0x278], 0x24315f30
jne 0x4023e5
cmp dword [esi + 0x27c], 0x61746948
jne 0x4023e5
cmp dword [esi + 0x280], 0x20696863
jne 0x4023e5
cmp dword [esi + 0x284], 0x35384852
jne 0x4023e5
cmp dword [esi + 0x288], 0x30345b30
jne 0x4023e5
cmp dword [esi + 0x28c], 0x5d6b3639
jne 0x4023e5
cmp dword [esi + 0x290], 0x4e414320
jne 0x4023e5
cmp byte [esi + 0x294], 0
je 0x4025a3
cmp dword [esi + 0x270], 0x73696e24
jne 0x402479
cmp dword [esi + 0x274], 0x386e6173
jne 0x402479
cmp dword [esi + 0x278], 0x24315f30
jne 0x402479
cmp dword [esi + 0x27c], 0x53455428
jne 0x402479
cmp dword [esi + 0x280], 0x69482954
jne 0x402479
cmp dword [esi + 0x284], 0x68636174
jne 0x402479
cmp dword [esi + 0x288], 0x48522069
jne 0x402479
cmp dword [esi + 0x28c], 0x5b303538
jne 0x402479
cmp dword [esi + 0x290], 0x36393034
jne 0x402479
cmp dword [esi + 0x294], 0x43205d6b
jne 0x402479
cmp word [esi + 0x298], 0x4e41
jne 0x402479
cmp byte [esi + 0x29a], 0
je 0x4025a3
cmp dword [esi + 0x270], 0x73696e24
jne 0x4024f3
cmp dword [esi + 0x274], 0x386e6173
jne 0x4024f3
cmp dword [esi + 0x278], 0x24325f30
jne 0x4024f3
cmp dword [esi + 0x27c], 0x63736f42
jne 0x4024f3
cmp dword [esi + 0x280], 0x44452068
jne 0x4024f3
cmp dword [esi + 0x284], 0x43373143
jne 0x4024f3
cmp dword [esi + 0x288], 0x325b3438
jne 0x4024f3
cmp dword [esi + 0x28c], 0x6b303635
jne 0x4024f3
cmp dword [esi + 0x290], 0x4143205d
jne 0x4024f3
cmp word [esi + 0x294], 0x4e
je 0x4025a3
cmp dword [esi + 0x270], 0x73696e24
jne 0x40919a
cmp dword [esi + 0x274], 0x386e6173
jne 0x40919a
cmp dword [esi + 0x278], 0x24325f30
jne 0x40919a
cmp dword [esi + 0x27c], 0x53455428
jne 0x40919a
cmp dword [esi + 0x280], 0x6f422954
jne 0x40919a
cmp dword [esi + 0x284], 0x20686373
jne 0x40919a
cmp dword [esi + 0x288], 0x31434445
jne 0x40919a
cmp dword [esi + 0x28c], 0x34384337
jne 0x40919a
cmp dword [esi + 0x290], 0x3635325b
jne 0x40919a
cmp dword [esi + 0x294], 0x205d6b30
jne 0x40919a
cmp dword [esi + 0x298], 0x4e4143
jne 0x40919a
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4025cb
cmp eax, 0xa
je 0x4025cb
cmp eax, 0xb
je 0x4025cb
cmp eax, 0x17
je 0x4025cb
cmp eax, 0x18
je 0x4025cb
cmp eax, 0x2f
jne 0x407b53
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x7a120
push 0x800
push 6
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x40260e
mov dword [ebp - 0x42c0], 1
jmp 0x407b53
push 1
push 0x8000
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x40263b
mov dword [ebp - 0x42c0], 1
jmp 0x407b53
push 0xe0070000
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xe8070000
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xffffffffffffffff
push 0
push 4
push 0
push 0x40
push 0
push 6
push 3
push 0
push 0
mov eax, esp
push 0
push eax
push 4
call dword [edi]
add esp, 0x60
cmp eax, 0xffffffff
jne 0x402691
mov dword [ebp - 0x42c0], 1
jmp 0x407b53
mov byte [ebp - 0x26fa], 0
mov byte [ebp - 0x26ba], 0
mov byte [ebp - 0x267a], 0
mov byte [ebp - 0x263a], 0
mov byte [ebp - 0x25fa], 0
mov dword [ebp - 0x25ba], 0
mov dword [ebp - 0x25b6], 0
mov dword [ebp - 0x25b2], 0
mov dword [ebp - 0x25ae], 0
push 0x240
push 0
lea edx, [ebp - 0x1264]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov byte [esi + 0x6c], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x40270b
cmp eax, 0xb
jne 0x402cf4
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x40296d
cmp dword [esi + 0x270], 0x73696e24
jne 0x402793
cmp dword [esi + 0x274], 0x386e6173
jne 0x402793
cmp dword [esi + 0x278], 0x24315f30
jne 0x402793
cmp dword [esi + 0x27c], 0x61746948
jne 0x402793
cmp dword [esi + 0x280], 0x20696863
jne 0x402793
cmp dword [esi + 0x284], 0x35384852
jne 0x402793
cmp dword [esi + 0x288], 0x30345b30
jne 0x402793
cmp dword [esi + 0x28c], 0x5d6b3639
jne 0x402793
cmp dword [esi + 0x290], 0x4e414320
jne 0x402793
cmp byte [esi + 0x294], 0
je 0x40282b
cmp dword [esi + 0x270], 0x73696e24
jne 0x402849
cmp dword [esi + 0x274], 0x386e6173
jne 0x402849
cmp dword [esi + 0x278], 0x24315f30
jne 0x402849
cmp dword [esi + 0x27c], 0x53455428
jne 0x402849
cmp dword [esi + 0x280], 0x69482954
jne 0x402849
cmp dword [esi + 0x284], 0x68636174
jne 0x402849
cmp dword [esi + 0x288], 0x48522069
jne 0x402849
cmp dword [esi + 0x28c], 0x5b303538
jne 0x402849
cmp dword [esi + 0x290], 0x36393034
jne 0x402849
cmp dword [esi + 0x294], 0x43205d6b
jne 0x402849
cmp word [esi + 0x298], 0x4e41
jne 0x402849
cmp byte [esi + 0x29a], 0
jne 0x402849
mov dword [ebp - 0x2804], section..code
mov dword [ebp - 0x2800], 0
mov dword [ebp - 0x27fc], 0x50
cmp dword [esi + 0x270], 0x73696e24
jne 0x4028c3
cmp dword [esi + 0x274], 0x386e6173
jne 0x4028c3
cmp dword [esi + 0x278], 0x24325f30
jne 0x4028c3
cmp dword [esi + 0x27c], 0x63736f42
jne 0x4028c3
cmp dword [esi + 0x280], 0x44452068
jne 0x4028c3
cmp dword [esi + 0x284], 0x43373143
jne 0x4028c3
cmp dword [esi + 0x288], 0x325b3438
jne 0x4028c3
cmp dword [esi + 0x28c], 0x6b303635
jne 0x4028c3
cmp dword [esi + 0x290], 0x4143205d
jne 0x4028c3
cmp word [esi + 0x294], 0x4e
je 0x40294f
cmp dword [esi + 0x270], 0x73696e24
jne 0x40296d
cmp dword [esi + 0x274], 0x386e6173
jne 0x40296d
cmp dword [esi + 0x278], 0x24325f30
jne 0x40296d
cmp dword [esi + 0x27c], 0x53455428
jne 0x40296d
cmp dword [esi + 0x280], 0x6f422954
jne 0x40296d
cmp dword [esi + 0x284], 0x20686373
jne 0x40296d
cmp dword [esi + 0x288], 0x31434445
jne 0x40296d
cmp dword [esi + 0x28c], 0x34384337
jne 0x40296d
cmp dword [esi + 0x290], 0x3635325b
jne 0x40296d
cmp dword [esi + 0x294], 0x205d6b30
jne 0x40296d
cmp dword [esi + 0x298], 0x4e4143
jne 0x40296d
mov dword [ebp - 0x2804], 0x4010a0
mov dword [ebp - 0x2800], 0xa0
mov dword [ebp - 0x27fc], 0x50
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x402bcf
cmp dword [esi + 0x270], 0x73696e24
jne 0x4029f5
cmp dword [esi + 0x274], 0x386e6173
jne 0x4029f5
cmp dword [esi + 0x278], 0x24315f30
jne 0x4029f5
cmp dword [esi + 0x27c], 0x61746948
jne 0x4029f5
cmp dword [esi + 0x280], 0x20696863
jne 0x4029f5
cmp dword [esi + 0x284], 0x35384852
jne 0x4029f5
cmp dword [esi + 0x288], 0x30345b30
jne 0x4029f5
cmp dword [esi + 0x28c], 0x5d6b3639
jne 0x4029f5
cmp dword [esi + 0x290], 0x4e414320
jne 0x4029f5
cmp byte [esi + 0x294], 0
je 0x402a8d
cmp dword [esi + 0x270], 0x73696e24
jne 0x402aab
cmp dword [esi + 0x274], 0x386e6173
jne 0x402aab
cmp dword [esi + 0x278], 0x24315f30
jne 0x402aab
cmp dword [esi + 0x27c], 0x53455428
jne 0x402aab
cmp dword [esi + 0x280], 0x69482954
jne 0x402aab
cmp dword [esi + 0x284], 0x68636174
jne 0x402aab
cmp dword [esi + 0x288], 0x48522069
jne 0x402aab
cmp dword [esi + 0x28c], 0x5b303538
jne 0x402aab
cmp dword [esi + 0x290], 0x36393034
jne 0x402aab
cmp dword [esi + 0x294], 0x43205d6b
jne 0x402aab
cmp word [esi + 0x298], 0x4e41
jne 0x402aab
cmp byte [esi + 0x29a], 0
jne 0x402aab
mov dword [ebp - 0x2804], 0x401050
mov dword [ebp - 0x2800], 0x50
mov dword [ebp - 0x27fc], 0x50
cmp dword [esi + 0x270], 0x73696e24
jne 0x402b25
cmp dword [esi + 0x274], 0x386e6173
jne 0x402b25
cmp dword [esi + 0x278], 0x24325f30
jne 0x402b25
cmp dword [esi + 0x27c], 0x63736f42
jne 0x402b25
cmp dword [esi + 0x280], 0x44452068
jne 0x402b25
cmp dword [esi + 0x284], 0x43373143
jne 0x402b25
cmp dword [esi + 0x288], 0x325b3438
jne 0x402b25
cmp dword [esi + 0x28c], 0x6b303635
jne 0x402b25
cmp dword [esi + 0x290], 0x4143205d
jne 0x402b25
cmp word [esi + 0x294], 0x4e
je 0x402bb1
cmp dword [esi + 0x270], 0x73696e24
jne 0x402bcf
cmp dword [esi + 0x274], 0x386e6173
jne 0x402bcf
cmp dword [esi + 0x278], 0x24325f30
jne 0x402bcf
cmp dword [esi + 0x27c], 0x53455428
jne 0x402bcf
cmp dword [esi + 0x280], 0x6f422954
jne 0x402bcf
cmp dword [esi + 0x284], 0x20686373
jne 0x402bcf
cmp dword [esi + 0x288], 0x31434445
jne 0x402bcf
cmp dword [esi + 0x28c], 0x34384337
jne 0x402bcf
cmp dword [esi + 0x290], 0x3635325b
jne 0x402bcf
cmp dword [esi + 0x294], 0x205d6b30
jne 0x402bcf
cmp dword [esi + 0x298], 0x4e4143
jne 0x402bcf
mov dword [ebp - 0x2804], 0x4010f0
mov dword [ebp - 0x2800], 0xf0
mov dword [ebp - 0x27fc], 0x50
push 0x200
push 0
lea edx, [ebp - 0x25aa]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov byte [ebp - 0x27f0], 0x21
mov dword [ebp - 0x27f8], 0
mov ecx, dword [ebp - 0x27f8]
cmp ecx, dword [ebp - 0x27fc]
jae 0x402cf4
mov eax, dword [ebp - 0x2800]
lea eax, [eax + ecx]
mov dword [ebp - 0x27ee], eax
mov edx, dword [ebp - 0x27fc]
sub edx, ecx
xor ecx, ecx
cmp ecx, edx
jae 0x402c47
cmp ecx, 0xf0
jae 0x402c47
mov eax, dword [ebp - 0x2804]
add eax, dword [ebp - 0x27f8]
mov al, byte [eax + ecx]
mov byte [ebp + ecx - 0x27ea], al
inc ecx
jmp 0x402c22
mov dword [ebp - 0x27f4], ecx
add ecx, 4
mov byte [ebp - 0x27ef], cl
push 0xfa
lea edx, [ebp - 0x44d2]
push edx
push 0xf6
lea edx, [ebp - 0x27f0]
push edx
call dword [ebx + 0x3c]
test eax, eax
jne 0x402cc4
push 0xa0d32
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x45242024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x30
mov dword [ebp - 0x42c0], 1
jmp 0x402cf4
mov eax, dword [ebp - 0x27f4]
mov ecx, dword [ebp - 0x27f8]
add dword [ebp - 0x27f8], eax
push eax
lea edx, [ebp - 0x44d2]
push edx
lea edx, [ebp + ecx - 0x25aa]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
jmp 0x402bf7
mov dword [ebp - 0x1268], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402d12
cmp eax, 0xa
jne 0x40336c
push 0x80f122
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 7
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
push 0x310
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 6
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x402d6d
cmp eax, 0xffffffff
jne 0x402d79
mov dword [ebp - 0x42c0], 1
jmp 0x402df2
cmp byte [ebp - 0x42b8], 0x50
je 0x402df2
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x402dd4
xor eax, eax
jmp 0x402dde
cmp eax, 0x20
jbe 0x402dde
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x402ed5
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x91f122
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 7
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x402e39
cmp eax, 0xffffffff
jne 0x402e48
mov dword [ebp - 0x42c0], 1
jmp 0x402ed5
cmp byte [ebp - 0x42b8], 0x62
jne 0x402ed5
sub eax, 7
xor ecx, ecx
cmp ecx, 0x3f
jae 0x402e83
cmp ecx, eax
jae 0x402e83
mov dl, byte [ebp + ecx - 0x42b5]
cmp dl, 0
je 0x402e83
cmp dl, 0xff
je 0x402e83
cmp dl, 0x2d
je 0x402e83
mov byte [ebp + ecx - 0x26fa], dl
inc ecx
jmp 0x402e5a
mov byte [ebp + ecx - 0x26fa], 0
cmp byte [ebp - 0x26fa], 0
je 0x402ed5
lea eax, [ebp - 0x26fa]
push 0
push 0xa0d7325
push 0x203a244e
push 0x505f5748
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x24
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x42c0], 0
jne 0x402fc7
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x87f122
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 7
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x402f1c
cmp eax, 0xffffffff
jne 0x402f2b
mov dword [ebp - 0x42c0], 1
jmp 0x402fc7
cmp byte [ebp - 0x42b8], 0x62
jne 0x402fc7
sub eax, 7
xor ecx, ecx
cmp ecx, 0x3f
jae 0x402f66
cmp ecx, eax
jae 0x402f66
mov dl, byte [ebp + ecx - 0x42b5]
cmp dl, 0
je 0x402f66
cmp dl, 0xff
je 0x402f66
cmp dl, 0x2d
je 0x402f66
mov byte [ebp + ecx - 0x26ba], dl
inc ecx
jmp 0x402f3d
mov byte [ebp + ecx - 0x26ba], 0
cmp byte [ebp - 0x26ba], 0
je 0x402fc7
lea eax, [ebp - 0x26ba]
push 0xa0d
push 0x7325203a
push 0x24544143
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
lea edx, [ebp - 0x26ba]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
cmp dword [ebp - 0x42c0], 0
jne 0x4030a1
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x96f122
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 7
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x40300e
cmp eax, 0xffffffff
jne 0x40301d
mov dword [ebp - 0x42c0], 1
jmp 0x4030a1
cmp byte [ebp - 0x42b8], 0x62
jne 0x4030a1
sub eax, 7
xor ecx, ecx
cmp ecx, 0x3f
jae 0x403054
cmp ecx, eax
jae 0x403054
mov dl, byte [ebp + ecx - 0x42b5]
cmp dl, 0
je 0x403054
cmp dl, 0xff
je 0x403054
cmp dl, 0x2d
je 0x403054
mov byte [ebp + ecx - 0x267a], dl
inc ecx
jmp 0x40302b
mov byte [ebp + ecx - 0x267a], 0
cmp byte [ebp - 0x267a], 0
je 0x4030a1
lea eax, [ebp - 0x267a]
push 0xa
push 0xd732520
push 0x3a245753
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x42c0], 0
jne 0x4031b0
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x88f122
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 7
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x4030e8
cmp eax, 0xffffffff
jne 0x4030f7
mov dword [ebp - 0x42c0], 1
jmp 0x4031b0
cmp byte [ebp - 0x42b8], 0x62
jne 0x4031b0
sub eax, 7
xor ecx, ecx
cmp ecx, 0x3f
jae 0x403132
cmp ecx, eax
jae 0x403132
mov dl, byte [ebp + ecx - 0x42b5]
cmp dl, 0
je 0x403132
cmp dl, 0xff
je 0x403132
cmp dl, 0x2d
je 0x403132
mov byte [ebp + ecx - 0x263a], dl
inc ecx
jmp 0x403109
mov byte [ebp + ecx - 0x263a], 0
cmp byte [ebp - 0x263a], 0
je 0x4031b0
lea eax, [ebp - 0x263a]
push 0xa
push 0xd732520
push 0x3a244e4f
push 0x49535245
push 0x565f5753
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
cmp byte [esi + 0x6c], 0
je 0x40319f
push 0x5f
push esp
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 4
lea edx, [ebp - 0x263a]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
cmp dword [ebp - 0x42c0], 0
jne 0x40327c
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x90f122
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 7
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x4031f7
cmp eax, 0xffffffff
jne 0x403203
mov dword [ebp - 0x42c0], 1
jmp 0x40327c
cmp byte [ebp - 0x42b8], 0x62
jne 0x40327c
sub eax, 7
xor ecx, ecx
cmp ecx, 0x3f
jae 0x403235
cmp ecx, eax
jae 0x403235
mov dl, byte [ebp + ecx - 0x42b5]
cmp dl, 0
je 0x403235
cmp dl, 0xff
je 0x403235
mov byte [ebp + ecx - 0x25fa], dl
inc ecx
jmp 0x403211
mov byte [ebp + ecx - 0x25fa], 0
lea eax, [ebp - 0x25fa]
push 0xa0d
push 0x7325203a
push 0x244e4956
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x42c0], 0
jne 0x40336c
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x609
push 0xe0070000
push esp
push 6
push 0x12c
push 0x40
push 6
push 0
call fcn.0040935e
cmp eax, 0xffffffff
jne 0x4032c2
mov dword [ebp - 0x42c0], 1
jmp 0x40336c
mov dword [ebp - 0x43c8], 3
lea edx, [ebp - 0x42bc]
push edx
push 0x7d0
push 6
push 0
call fcn.004094ba
cmp eax, 0xffffffff
jne 0x4032f2
mov dword [ebp - 0x42c0], 1
jmp 0x40336c
test eax, eax
jne 0x403300
dec dword [ebp - 0x43c8]
jne 0x4032cc
jmp 0x40336c
cmp byte [ebp - 0x42b8], 0x7f
jne 0x403320
cmp byte [ebp - 0x42b6], 0x78
jne 0x403320
mov dword [ebp - 0x43c8], 3
jmp 0x4032cc
cmp byte [ebp - 0x42b8], 0x49
jne 0x40336c
mov eax, dword [ebp - 0x42b5]
bswap eax
push 0
push 0xa0d5838
push 0x2e25203a
push 0x244e5643
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x24
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
cmp dword [esi + 0x270], 0x73696e24
jne 0x4033e6
cmp dword [esi + 0x274], 0x386e6173
jne 0x4033e6
cmp dword [esi + 0x278], 0x24325f30
jne 0x4033e6
cmp dword [esi + 0x27c], 0x63736f42
jne 0x4033e6
cmp dword [esi + 0x280], 0x44452068
jne 0x4033e6
cmp dword [esi + 0x284], 0x43373143
jne 0x4033e6
cmp dword [esi + 0x288], 0x325b3438
jne 0x4033e6
cmp dword [esi + 0x28c], 0x6b303635
jne 0x4033e6
cmp dword [esi + 0x290], 0x4143205d
jne 0x4033e6
cmp word [esi + 0x294], 0x4e
je 0x403496
cmp dword [esi + 0x270], 0x73696e24
jne 0x403e01
cmp dword [esi + 0x274], 0x386e6173
jne 0x403e01
cmp dword [esi + 0x278], 0x24325f30
jne 0x403e01
cmp dword [esi + 0x27c], 0x53455428
jne 0x403e01
cmp dword [esi + 0x280], 0x6f422954
jne 0x403e01
cmp dword [esi + 0x284], 0x20686373
jne 0x403e01
cmp dword [esi + 0x288], 0x31434445
jne 0x403e01
cmp dword [esi + 0x28c], 0x34384337
jne 0x403e01
cmp dword [esi + 0x290], 0x3635325b
jne 0x403e01
cmp dword [esi + 0x294], 0x205d6b30
jne 0x403e01
cmp dword [esi + 0x298], 0x4e4143
jne 0x403e01
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x2f
jne 0x403e01
mov dword [ebp - 0x1020], 0
push 0
mov dword [ebp - 0xe18], esp
push 0
push 0x6c006d
push 0x78002e
push 0x2a0000
push 0x65006c
push 0x690066
push 0x20006c
push 0x6d0058
mov dword [ebp - 0xe14], esp
push 0
push 0
push 0
push 0
push 0
push 0x1800
push 0
push 0
push 0
push 0
push 0x104
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0x4c
mov eax, dword [ebx + 0x488]
mov dword [esp + 4], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe14]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1020]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0xe18]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push esp
call dword [sym.imp.COMDLG32.DLL_GetOpenFileNameW]
add esp, 0x4c
add esp, 0x20
add esp, 4
test eax, eax
je 0x403e01
lea edx, [ebp - 0x1020]
push edx
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov dword [ebp - 0x1024], eax
push 0
push 0x20
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
push 0
push 0x74006e
push 0x65006d
push 0x750063
push 0x6f0044
push 0x4d004f
push 0x44002e
push 0x32004c
push 0x4d0058
push 0x53004d
mov dword [ebp - 0xe10], esp
lea edx, [ebp - 0x2864]
push edx
push dword [ebp - 0xe10]
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
add esp, 0x28
test eax, eax
je 0x40361d
push 0xa
push 0xd333123
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x403a88
push 0x46000000
push 0xc0
push 0
push 0x20400
mov dword [ebp - 0xe0c], esp
mov dword [ebp - 0x2854], 0
lea edx, [ebp - 0x2854]
push edx
push dword [ebp - 0xe0c]
push 1
push 0
lea edx, [ebp - 0x2864]
push edx
call dword [sym.imp.ole32.dll_CoCreateInstance]
add esp, 0x10
test eax, eax
je 0x4036a8
push 0xa
push 0xd343123
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x403a88
lea edx, [ebp - 0x2834]
push edx
push 0x1a
push dword [ebp - 0x1024]
push 0
push 8
mov eax, dword [ebp - 0x2854]
push eax
mov eax, dword [eax]
call dword [eax + 0xe8]
test eax, eax
je 0x403713
push 0xa
push 0xd353123
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x403a7c
push 0
push 0x650064
push 0x6f0063
push 0x5f0072
push 0x6f0074
push 0x630065
push 0x6a006e
push 0x69002f
push 0x730065
push 0x64006f
push 0x63005f
push 0x72006f
push 0x740063
push 0x65006a
push 0x6e0069
lea edx, [ebp - 0x2838]
push edx
lea edx, [esp + 4]
push edx
mov eax, dword [ebp - 0x2854]
push eax
mov eax, dword [eax]
call dword [eax + 0x90]
add esp, 0x3c
test eax, eax
je 0x4037c2
push 0xa
push 0xd363123
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x403a7c
mov dword [ebp - 0x2824], 0
cmp dword [ebp - 0x42c0], 0
jne 0x403a70
cmp dword [ebp - 0x2824], 0x20
jae 0x403a70
lea edx, [ebp - 0x284c]
push edx
push dword [ebp - 0x2824]
mov eax, dword [ebp - 0x2838]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
test eax, eax
jne 0x403a70
lea edx, [ebp - 0x2844]
push edx
mov eax, dword [ebp - 0x284c]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
test eax, eax
je 0x403863
push 0xa
push 0xd373123
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x403999
push 0
push 0x640069
lea edx, [ebp - 0x2840]
push edx
lea edx, [esp + 4]
push edx
mov eax, dword [ebp - 0x2844]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
add esp, 8
test eax, eax
je 0x4038ce
push 0xa
push 0xd383123
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x40398d
lea edx, [ebp - 0x286c]
push edx
mov eax, dword [ebp - 0x2840]
push eax
mov eax, dword [eax]
call dword [eax + 0x68]
test eax, eax
je 0x403927
push 0xa
push 0xd393123
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x403981
push 0
push 0
push 0
lea edx, [ebp - 0x2c80]
push edx
push 0xffffffffffffffff
push dword [ebp - 0x286c]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push 0
push 0
push eax
lea edx, [ebp - 0x2c80]
push edx
push 0xffffffffffffffff
push dword [ebp - 0x286c]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
imul ecx, dword [ebp - 0x2824], 0x12
push 2
lea edx, [ebp + ecx - 0x1264]
push edx
lea edx, [ebp - 0x2c80]
push edx
call fcn.0040b842
mov eax, dword [ebp - 0x2840]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp - 0x2844]
push eax
mov eax, dword [eax]
call dword [eax + 8]
cmp dword [ebp - 0x42c0], 0
jne 0x403a59
lea edx, [ebp - 0x2868]
push edx
mov eax, dword [ebp - 0x284c]
push eax
mov eax, dword [eax]
call dword [eax + 0x68]
test eax, eax
je 0x4039ff
push 0xa
push 0xd303223
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x403a59
push 0
push 0
push 0
lea edx, [ebp - 0x2a78]
push edx
push 0xffffffffffffffff
push dword [ebp - 0x2868]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push 0
push 0
push eax
lea edx, [ebp - 0x2a78]
push edx
push 0xffffffffffffffff
push dword [ebp - 0x2868]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
imul ecx, dword [ebp - 0x2824], 0x12
push 0x10
lea edx, [ebp + ecx - 0x1262]
push edx
lea edx, [ebp - 0x2a78]
push edx
call fcn.0040b842
mov eax, dword [ebp - 0x284c]
push eax
mov eax, dword [eax]
call dword [eax + 8]
inc dword [ebp - 0x2824]
jmp 0x4037cc
mov eax, dword [ebp - 0x2838]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp - 0x2854]
push eax
mov eax, dword [eax]
call dword [eax + 8]
push dword [ebp - 0x1024]
call dword [sym.imp.oleaut32.dll_SysFreeString]
cmp dword [ebp - 0x42c0], 0
jne 0x403c70
push 0xa0d
push 0x24534544
push 0x4f435f45
push 0x4c5a5a4f
push 0x4e5f524f
push 0x5443454a
push 0x4e495f45
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x329c], 0xa
mov dword [ebp - 0x43c8], 0xa
push 0x310
push 0xe0070000
push esp
push 6
push 0x1f4
push 0x40
push 6
push 0
call fcn.0040935e
cmp eax, 0xffffffff
jne 0x403b1f
mov dword [ebp - 0x42c0], 1
jmp 0x403c70
lea edx, [ebp - 0x42bc]
push edx
push 0x1f4
push 6
push 0
call fcn.004094ba
cmp eax, 0xffffffff
jne 0x403b48
mov dword [ebp - 0x42c0], 1
jmp 0x403c70
test eax, eax
jne 0x403bc7
dec dword [ebp - 0x43c8]
jne 0x403b1f
dec dword [ebp - 0x329c]
jne 0x403ae4
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403ba4
xor eax, eax
jmp 0x403bae
cmp eax, 0x20
jbe 0x403bae
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x403c70
cmp byte [ebp - 0x42b8], 0x7f
jne 0x403bed
cmp byte [ebp - 0x42b6], 0x78
jne 0x403bed
mov dword [ebp - 0x43c8], 0xa
jmp 0x403b1f
cmp byte [ebp - 0x42b8], 0x50
je 0x403c68
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403c48
xor eax, eax
jmp 0x403c52
cmp eax, 0x20
jbe 0x403c52
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x403c70
push 0x37
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x2824], 0
cmp dword [ebp - 0x42c0], 0
jne 0x403dbd
cmp dword [ebp - 0x2824], 0x20
jae 0x403dbd
imul ecx, dword [ebp - 0x2824], 0x12
cmp byte [ebp + ecx - 0x1264], 0
je 0x403dbd
cmp byte [ebp + ecx - 0x1263], 0
je 0x403dbd
mov dword [ebp - 0x2382], 0xe0070000
mov dword [ebp - 0x237e], 0x2e
mov eax, dword [ebp + ecx - 0x1264]
mov dword [ebp - 0x237d], eax
mov eax, dword [ebp + ecx - 0x1260]
mov dword [ebp - 0x2379], eax
mov al, byte [ebp + ecx - 0x125c]
mov byte [ebp - 0x2375], al
lea edx, [ebp - 0x2382]
push edx
push 0xe
lea edx, [ebp - 0x42bc]
push edx
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x403d20
cmp eax, 0xffffffff
jne 0x403d2f
mov dword [ebp - 0x42c0], 1
jmp 0x403dbd
cmp byte [ebp - 0x42b8], 0x6e
je 0x403daa
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403d8a
xor eax, eax
jmp 0x403d94
cmp eax, 0x20
jbe 0x403d94
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x403dbd
push 0x34
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc dword [ebp - 0x2824]
jmp 0x403c7a
cmp dword [ebp - 0x42c0], 0
jne 0x403e01
push 0xa
push 0xd244b4f
push 0x5f534544
push 0x4f435f45
push 0x4c5a5a4f
push 0x4e5f524f
push 0x5443454a
push 0x4e495f45
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x2c
cmp dword [esi + 0x270], 0x73696e24
jne 0x403e7b
cmp dword [esi + 0x274], 0x386e6173
jne 0x403e7b
cmp dword [esi + 0x278], 0x24325f30
jne 0x403e7b
cmp dword [esi + 0x27c], 0x63736f42
jne 0x403e7b
cmp dword [esi + 0x280], 0x44452068
jne 0x403e7b
cmp dword [esi + 0x284], 0x43373143
jne 0x403e7b
cmp dword [esi + 0x288], 0x325b3438
jne 0x403e7b
cmp dword [esi + 0x28c], 0x6b303635
jne 0x403e7b
cmp dword [esi + 0x290], 0x4143205d
jne 0x403e7b
cmp word [esi + 0x294], 0x4e
je 0x403f2b
cmp dword [esi + 0x270], 0x73696e24
jne 0x4042ce
cmp dword [esi + 0x274], 0x386e6173
jne 0x4042ce
cmp dword [esi + 0x278], 0x24325f30
jne 0x4042ce
cmp dword [esi + 0x27c], 0x53455428
jne 0x4042ce
cmp dword [esi + 0x280], 0x6f422954
jne 0x4042ce
cmp dword [esi + 0x284], 0x20686373
jne 0x4042ce
cmp dword [esi + 0x288], 0x31434445
jne 0x4042ce
cmp dword [esi + 0x28c], 0x34384337
jne 0x4042ce
cmp dword [esi + 0x290], 0x3635325b
jne 0x4042ce
cmp dword [esi + 0x294], 0x205d6b30
jne 0x4042ce
cmp dword [esi + 0x298], 0x4e4143
jne 0x4042ce
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x403f3f
cmp eax, 0xa
jne 0x4042ce
cmp dword [ebp - 0x42c0], 0
jne 0x404033
push 0xc4fd22
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 7
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x403f7e
cmp eax, 0xffffffff
jne 0x403f8d
mov dword [ebp - 0x42c0], 1
jmp 0x404033
cmp byte [ebp - 0x42b8], 0x62
jne 0x404033
sub eax, 7
cmp eax, 0x100
jbe 0x403fa9
mov eax, 0x100
push 7
lea edx, [ebp - 0x42b5]
push edx
lea edx, [ebp - 0x1262]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov byte [ebp - 0x125b], 0
push 7
lea edx, [ebp - 0x42ae]
push edx
lea edx, [ebp - 0x1250]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov byte [ebp - 0x1249], 0
push 7
lea edx, [ebp - 0x42a7]
push edx
lea edx, [ebp - 0x123e]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov byte [ebp - 0x1237], 0
push 7
lea edx, [ebp - 0x42a0]
push edx
lea edx, [ebp - 0x122c]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov byte [ebp - 0x1225], 0
mov dword [ebp - 0x1268], 1
cmp dword [ebp - 0x42c0], 0
jne 0x4042ce
push 0x10
push 0xfd0ffd0e
push 0xfdc5fd22
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 0xd
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x404079
cmp eax, 0xffffffff
jne 0x404088
mov dword [ebp - 0x42c0], 1
jmp 0x4042ce
cmp byte [ebp - 0x42b8], 0x62
jne 0x404217
cmp eax, 0x29
jne 0x404217
push 2
lea edx, [ebp - 0x42b7]
push edx
lea edx, [ebp - 0x1264]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
push 7
lea edx, [ebp - 0x42b5]
push edx
lea edx, [ebp - 0x1262]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov byte [ebp - 0x125b], 0
push 2
lea edx, [ebp - 0x42ae]
push edx
lea edx, [ebp - 0x1252]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
push 7
lea edx, [ebp - 0x42ac]
push edx
lea edx, [ebp - 0x1250]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov byte [ebp - 0x1249], 0
push 2
lea edx, [ebp - 0x42a5]
push edx
lea edx, [ebp - 0x1240]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
push 7
lea edx, [ebp - 0x42a3]
push edx
lea edx, [ebp - 0x123e]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov byte [ebp - 0x1237], 0
push 2
lea edx, [ebp - 0x429c]
push edx
lea edx, [ebp - 0x122e]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
push 7
lea edx, [ebp - 0x429a]
push edx
lea edx, [ebp - 0x122c]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov byte [ebp - 0x1225], 0
mov dword [ebp - 0x1268], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x40419c
cmp eax, 0xa
jne 0x404212
pushal
lea eax, [ebp - 0x1262]
lea ecx, [ebp - 0x1250]
lea edx, [ebp - 0x122c]
lea esi, [ebp - 0x121a]
push 0xa
push 0xd732520
push 0x73252073
push 0x25207325
push 0x203a2453
push 0x45444f43
push 0x5f454c5a
push 0x5a4f4e5f
push 0x524f5443
push 0x454a4e49
push 0x24202445
push 0x4d495424
push esi
push edx
push ecx
push eax
lea eax, [esp + 0x10]
push eax
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x48
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
popal
jmp 0x4042ce
cmp dword [ebp - 0x1268], 1
jne 0x4042ce
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x404234
cmp eax, 0xa
jne 0x4042aa
pushal
lea eax, [ebp - 0x1262]
lea ecx, [ebp - 0x1250]
lea edx, [ebp - 0x122c]
lea esi, [ebp - 0x121a]
push 0xa
push 0xd732520
push 0x73252073
push 0x25207325
push 0x203a2453
push 0x45444f43
push 0x5f454c5a
push 0x5a4f4e5f
push 0x524f5443
push 0x454a4e49
push 0x24202445
push 0x4d495424
push esi
push edx
push ecx
push eax
lea eax, [esp + 0x10]
push eax
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x48
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
popal
mov word [ebp - 0x1264], PathRenameExtensionW
mov word [ebp - 0x1252], 0xefd
mov word [ebp - 0x1240], 0xffd
mov word [ebp - 0x122e], 0x10fd
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x4056f5
cmp dword [esi + 0x270], 0x73696e24
jne 0x404356
cmp dword [esi + 0x274], 0x386e6173
jne 0x404356
cmp dword [esi + 0x278], 0x24315f30
jne 0x404356
cmp dword [esi + 0x27c], 0x61746948
jne 0x404356
cmp dword [esi + 0x280], 0x20696863
jne 0x404356
cmp dword [esi + 0x284], 0x35384852
jne 0x404356
cmp dword [esi + 0x288], 0x30345b30
jne 0x404356
cmp dword [esi + 0x28c], 0x5d6b3639
jne 0x404356
cmp dword [esi + 0x290], 0x4e414320
jne 0x404356
cmp byte [esi + 0x294], 0
je 0x404412
cmp dword [esi + 0x270], 0x73696e24
jne 0x4044de
cmp dword [esi + 0x274], 0x386e6173
jne 0x4044de
cmp dword [esi + 0x278], 0x24315f30
jne 0x4044de
cmp dword [esi + 0x27c], 0x53455428
jne 0x4044de
cmp dword [esi + 0x280], 0x69482954
jne 0x4044de
cmp dword [esi + 0x284], 0x68636174
jne 0x4044de
cmp dword [esi + 0x288], 0x48522069
jne 0x4044de
cmp dword [esi + 0x28c], 0x5b303538
jne 0x4044de
cmp dword [esi + 0x290], 0x36393034
jne 0x4044de
cmp dword [esi + 0x294], 0x43205d6b
jne 0x4044de
cmp word [esi + 0x298], 0x4e41
jne 0x4044de
cmp byte [esi + 0x29a], 0
jne 0x4044de
cmp dword [ebp - 0x42c0], 0
jne 0x4044de
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x7b10
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 6
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x404459
cmp eax, 0xffffffff
jne 0x404465
mov dword [ebp - 0x42c0], 1
jmp 0x4044de
cmp byte [ebp - 0x42b8], 0x50
je 0x4044de
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4044c0
xor eax, eax
jmp 0x4044ca
cmp eax, 0x20
jbe 0x4044ca
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x404b05
push 0x2d
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x23aa], 0
mov dword [ebp - 0x23a6], 0
cmp dword [ebp - 0x23aa], 0x20
jae 0x404537
imul ecx, dword [ebp - 0x23aa], 0x10
mov eax, dword [ebp + ecx - 0x25a6]
sub eax, dword [ebp + ecx - 0x25aa]
test eax, eax
je 0x404537
add dword [ebp - 0x23a6], eax
inc dword [ebp - 0x23aa]
jmp 0x404507
mov eax, dword [ebp - 0x23a6]
add eax, 0x7ff
and eax, 0xfffff800
shr eax, 0xb
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [esi + 0x14]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x24], eax
push dword [esi + 0x28]
push 0xff
push eax
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov dword [ebp - 0x23aa], 0
mov dword [ebp - 0x2386], 0
cmp dword [ebp - 0x23aa], 0x20
jae 0x404b05
imul ecx, dword [ebp - 0x23aa], 0x10
mov eax, dword [ebp + ecx - 0x25a6]
sub eax, dword [ebp + ecx - 0x25aa]
test eax, eax
je 0x404b05
mov eax, dword [ebp + ecx - 0x25aa]
mov dword [ebp - 0x23a2], eax
mov eax, dword [ebp + ecx - 0x25a6]
mov dword [ebp - 0x239e], eax
mov eax, dword [ebp + ecx - 0x25a2]
mov dword [ebp - 0x239a], eax
mov eax, dword [ebp + ecx - 0x259e]
mov dword [ebp - 0x2396], eax
mov eax, dword [ebp - 0x23a2]
mov ecx, dword [ebp - 0x239e]
cmp eax, ecx
jae 0x404afa
sub ecx, eax
cmp ecx, dword [ebp - 0x2396]
jbe 0x40466d
mov ecx, dword [ebp - 0x2396]
mov dword [ebp - 0x238e], ecx
add eax, dword [ebp - 0x239a]
cmp dword [esi + 0x270], 0x73696e24
jne 0x4046f2
cmp dword [esi + 0x274], 0x386e6173
jne 0x4046f2
cmp dword [esi + 0x278], 0x24315f30
jne 0x4046f2
cmp dword [esi + 0x27c], 0x61746948
jne 0x4046f2
cmp dword [esi + 0x280], 0x20696863
jne 0x4046f2
cmp dword [esi + 0x284], 0x35384852
jne 0x4046f2
cmp dword [esi + 0x288], 0x30345b30
jne 0x4046f2
cmp dword [esi + 0x28c], 0x5d6b3639
jne 0x4046f2
cmp dword [esi + 0x290], 0x4e414320
jne 0x4046f2
cmp byte [esi + 0x294], 0
je 0x404792
cmp dword [esi + 0x270], 0x73696e24
jne 0x4047ca
cmp dword [esi + 0x274], 0x386e6173
jne 0x4047ca
cmp dword [esi + 0x278], 0x24315f30
jne 0x4047ca
cmp dword [esi + 0x27c], 0x53455428
jne 0x4047ca
cmp dword [esi + 0x280], 0x69482954
jne 0x4047ca
cmp dword [esi + 0x284], 0x68636174
jne 0x4047ca
cmp dword [esi + 0x288], 0x48522069
jne 0x4047ca
cmp dword [esi + 0x28c], 0x5b303538
jne 0x4047ca
cmp dword [esi + 0x290], 0x36393034
jne 0x4047ca
cmp dword [esi + 0x294], 0x43205d6b
jne 0x4047ca
cmp word [esi + 0x298], 0x4e41
jne 0x4047ca
cmp byte [esi + 0x29a], 0
jne 0x4047ca
mov dword [ebp - 0x2382], 0xe0070000
mov byte [ebp - 0x237e], 0x23
mov byte [ebp - 0x237b], ah
mov byte [ebp - 0x237a], al
shr eax, 0x10
mov byte [ebp - 0x237d], ah
mov byte [ebp - 0x237c], al
mov byte [ebp - 0x2379], ch
mov byte [ebp - 0x2378], cl
cmp dword [esi + 0x270], 0x73696e24
jne 0x404844
cmp dword [esi + 0x274], 0x386e6173
jne 0x404844
cmp dword [esi + 0x278], 0x24325f30
jne 0x404844
cmp dword [esi + 0x27c], 0x63736f42
jne 0x404844
cmp dword [esi + 0x280], 0x44452068
jne 0x404844
cmp dword [esi + 0x284], 0x43373143
jne 0x404844
cmp dword [esi + 0x288], 0x325b3438
jne 0x404844
cmp dword [esi + 0x28c], 0x6b303635
jne 0x404844
cmp dword [esi + 0x290], 0x4143205d
jne 0x404844
cmp word [esi + 0x294], 0x4e
je 0x4048d8
cmp dword [esi + 0x270], 0x73696e24
jne 0x40490c
cmp dword [esi + 0x274], 0x386e6173
jne 0x40490c
cmp dword [esi + 0x278], 0x24325f30
jne 0x40490c
cmp dword [esi + 0x27c], 0x53455428
jne 0x40490c
cmp dword [esi + 0x280], 0x6f422954
jne 0x40490c
cmp dword [esi + 0x284], 0x20686373
jne 0x40490c
cmp dword [esi + 0x288], 0x31434445
jne 0x40490c
cmp dword [esi + 0x28c], 0x34384337
jne 0x40490c
cmp dword [esi + 0x290], 0x3635325b
jne 0x40490c
cmp dword [esi + 0x294], 0x205d6b30
jne 0x40490c
cmp dword [esi + 0x298], 0x4e4143
jne 0x40490c
mov dword [ebp - 0x2382], 0xe0070000
mov word [ebp - 0x237e], 0x1423
mov byte [ebp - 0x237a], ah
mov byte [ebp - 0x2379], al
shr eax, 0x10
mov byte [ebp - 0x237c], ah
mov byte [ebp - 0x237b], al
mov byte [ebp - 0x2378], cl
mov dword [ebp - 0x329c], 2
mov dword [ebp - 0x43c8], 0xa
lea edx, [ebp - 0x2382]
push edx
push 0xb
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040935e
cmp eax, 0xffffffff
jne 0x40494d
mov dword [ebp - 0x42c0], 1
jmp 0x404af8
lea edx, [ebp - 0x42bc]
push edx
push 0x1f4
push 6
push 0
call fcn.004094ba
cmp eax, 0xffffffff
jne 0x404976
mov dword [ebp - 0x42c0], 1
jmp 0x404af8
test eax, eax
jne 0x4049f5
dec dword [ebp - 0x43c8]
jne 0x40494d
dec dword [ebp - 0x329c]
jne 0x404916
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4049d2
xor eax, eax
jmp 0x4049dc
cmp eax, 0x20
jbe 0x4049dc
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x404af8
cmp byte [ebp - 0x42b8], 0x7f
jne 0x404a1b
cmp byte [ebp - 0x42b6], 0x78
jne 0x404a1b
mov dword [ebp - 0x43c8], 0xa
jmp 0x40494d
cmp byte [ebp - 0x42b8], 0x7f
jne 0x404a33
cmp byte [ebp - 0x42b6], 0x7f
jne 0x404a33
nop
jmp 0x404af8
cmp byte [ebp - 0x42b8], 0x63
jne 0x404a88
mov eax, dword [ebp - 0x23a2]
and eax, 0xfffff800
cmp eax, dword [ebp - 0x2386]
je 0x404a5a
mov dword [ebp - 0x2386], eax
call fcn.004092db
mov eax, dword [ebp - 0x238e]
mov ecx, dword [esi + 0x24]
add ecx, dword [ebp - 0x23a2]
add dword [ebp - 0x23a2], eax
push eax
lea edx, [ebp - 0x42b7]
push edx
push ecx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
jmp 0x404649
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404ada
xor eax, eax
jmp 0x404ae4
cmp eax, 0x20
jbe 0x404ae4
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x404b05
inc dword [ebp - 0x23aa]
jmp 0x4045eb
cmp dword [ebp - 0x42c0], 0
jne 0x404b55
push 0x82
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x110
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 6
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x404b4b
cmp eax, 0xffffffff
jne 0x404b55
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x4056ec
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
push 0
push 0
push 0xffffffffffffffff
lea edx, [esi + 0x6c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push eax
lea edx, [ebp - 0x3298]
push edx
push 0xffffffffffffffff
lea edx, [esi + 0x6c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push 0
push 0x6e0069
push 0x62002e
mov dword [ebp - 0xe08], esp
push 0
mov dword [ebp - 0xe04], esp
push 0
push 0x6e
push 0x690062
push 0x2e002a
push 0x65
push 0x6c0069
push 0x660020
push 0x790072
push 0x61006e
push 0x690042
mov dword [ebp - 0xe00], esp
push 0
push 0
push 0
push 0
push 0
push 0x800
push 0
push 0
push 0
push 0
push 0x104
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0x4c
mov dword [ebp - 0xdfc], esp
mov eax, dword [ebx + 0x488]
mov dword [esp + 4], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xe00]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x3298]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0xe04]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [ebp - 0xe08]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x34], 2
push esp
call dword [sym.imp.COMDLG32.DLL_GetSaveFileNameW]
add esp, 0x4c
add esp, 0x28
add esp, 4
add esp, 0xc
test eax, eax
je 0x4056ea
cmp dword [esi + 0x270], 0x73696e24
jne 0x404d0f
cmp dword [esi + 0x274], 0x386e6173
jne 0x404d0f
cmp dword [esi + 0x278], 0x24325f30
jne 0x404d0f
cmp dword [esi + 0x27c], 0x63736f42
jne 0x404d0f
cmp dword [esi + 0x280], 0x44452068
jne 0x404d0f
cmp dword [esi + 0x284], 0x43373143
jne 0x404d0f
cmp dword [esi + 0x288], 0x325b3438
jne 0x404d0f
cmp dword [esi + 0x28c], 0x6b303635
jne 0x404d0f
cmp dword [esi + 0x290], 0x4143205d
jne 0x404d0f
cmp word [esi + 0x294], 0x4e
je 0x404dbf
cmp dword [esi + 0x270], 0x73696e24
jne 0x4055cd
cmp dword [esi + 0x274], 0x386e6173
jne 0x4055cd
cmp dword [esi + 0x278], 0x24325f30
jne 0x4055cd
cmp dword [esi + 0x27c], 0x53455428
jne 0x4055cd
cmp dword [esi + 0x280], 0x6f422954
jne 0x4055cd
cmp dword [esi + 0x284], 0x20686373
jne 0x4055cd
cmp dword [esi + 0x288], 0x31434445
jne 0x4055cd
cmp dword [esi + 0x28c], 0x34384337
jne 0x4055cd
cmp dword [esi + 0x290], 0x3635325b
jne 0x4055cd
cmp dword [esi + 0x294], 0x205d6b30
jne 0x4055cd
cmp dword [esi + 0x298], 0x4e4143
jne 0x4055cd
push 0
push 0x6c006d
push 0x78002e
lea edx, [ebp - 0x3298]
push edx
lea edx, [ebp - 0x2f8c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push esp
lea edx, [ebp - 0x2f8c]
push edx
call dword [sym.imp.shlwapi.dll_PathRenameExtensionW]
add esp, 0xc
lea edx, [ebp - 0x2f8c]
push edx
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov dword [ebp - 0x2870], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0x20
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
push 0
push 0x74006e
push 0x65006d
push 0x750063
push 0x6f0044
push 0x4d004f
push 0x44002e
push 0x32004c
push 0x4d0058
push 0x53004d
mov dword [ebp - 0xdf8], esp
lea edx, [ebp - 0x2864]
push edx
push dword [ebp - 0xdf8]
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
add esp, 0x28
test eax, eax
je 0x404eb7
push 0
push 0xa0d3123
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x4055c1
push 0x46000000
push 0xc0
push 0
push 0x20400
mov dword [ebp - 0xdf4], esp
mov dword [ebp - 0x2854], 0
lea edx, [ebp - 0x2854]
push edx
push dword [ebp - 0xdf4]
push 1
push 0
lea edx, [ebp - 0x2864]
push edx
call dword [sym.imp.ole32.dll_CoCreateInstance]
add esp, 0x10
test eax, eax
je 0x404f42
push 0
push 0xa0d3223
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x4055c1
push 0x3e
push 0x730065
push 0x64006f
push 0x63005f
push 0x72006f
push 0x740063
push 0x65006a
push 0x6e0069
push 0x2f003c
push 0x3e0073
push 0x650064
push 0x6f0063
push 0x5f0072
push 0x6f0074
push 0x630065
push 0x6a006e
push 0x69003c
lea edx, [ebp - 0x2834]
push edx
lea edx, [esp + 4]
push edx
mov eax, dword [ebp - 0x2854]
push eax
mov eax, dword [eax]
call dword [eax + 0x104]
add esp, 0x44
test eax, eax
je 0x404ffb
push 0
push 0xa0d3323
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x4055b5
push 0
push 0x730065
push 0x64006f
push 0x63005f
push 0x72006f
push 0x740063
push 0x65006a
push 0x6e0069
lea edx, [ebp - 0x2850]
push edx
lea edx, [esp + 4]
push edx
mov eax, dword [ebp - 0x2854]
push eax
mov eax, dword [eax]
call dword [eax + 0x94]
add esp, 0x20
test eax, eax
je 0x405087
push 0
push 0xa0d3423
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x4055b5
mov dword [ebp - 0x2824], 0
cmp dword [ebp - 0x2824], 0x20
jae 0x4054ce
imul ecx, dword [ebp - 0x2824], 0x12
cmp word [ebp + ecx - 0x1264], 0
je 0x4054ce
movzx eax, byte [ebp + ecx - 0x1263]
movzx ecx, byte [ebp + ecx - 0x1264]
push 0
push 0x580032
push 0x2e0025
push 0x580032
push 0x2e0025
push eax
push ecx
lea edx, [esp + 8]
push edx
lea edx, [ebp - 0x2c80]
push edx
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0x10
add esp, 0x14
push 0x65
push 0x64006f
push 0x63005f
push 0x72006f
push 0x740063
push 0x65006a
push 0x6e0069
mov dword [ebp - 0xdf0], esp
push 0
lea edx, [ebp - 0x284c]
push edx
lea edx, [esp + 4]
push edx
push dword [ebp - 0xdf0]
push 0
push 1
push 0
push 2
mov eax, dword [ebp - 0x2854]
push eax
mov eax, dword [eax]
call dword [eax + 0xe0]
add esp, 4
add esp, 0x1c
test eax, eax
je 0x405194
push 0
push 0xa0d3523
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x4054ba
lea edx, [ebp - 0x2848]
push edx
push dword [ebp - 0x284c]
mov eax, dword [ebp - 0x2850]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
test eax, eax
je 0x4051f6
push 0
push 0xa0d3623
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x4054ae
lea edx, [ebp - 0x2844]
push edx
mov eax, dword [ebp - 0x2848]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
test eax, eax
je 0x405252
push 0
push 0xa0d3723
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x4054a2
push 0
push 0x640069
lea edx, [ebp - 0x2840]
push edx
lea edx, [esp + 4]
push edx
mov eax, dword [ebp - 0x2854]
push eax
mov eax, dword [eax]
call dword [eax + 0xd4]
add esp, 8
test eax, eax
je 0x4052c0
push 0
push 0xa0d3823
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x405496
lea edx, [ebp - 0x2c80]
push edx
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov dword [ebp - 0x286c], eax
push 0
push eax
push 0
push 8
mov eax, dword [ebp - 0x2840]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
test eax, eax
je 0x40532f
push 0
push 0xa0d3923
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x40547e
lea edx, [ebp - 0x283c]
push edx
push dword [ebp - 0x2840]
mov eax, dword [ebp - 0x2844]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
test eax, eax
je 0x405391
push 0xa
push 0xd303123
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x40547e
push 0
push 0x580032
push 0x2e0025
mov dword [ebp - 0x2a78], 0
mov dword [ebp - 0x2820], 0
cmp dword [ebp - 0x2820], 0x10
jae 0x4053ff
imul ecx, dword [ebp - 0x2824], 0x12
add ecx, dword [ebp - 0x2820]
movzx eax, byte [ebp + ecx - 0x1262]
test eax, eax
je 0x4053ff
push eax
lea edx, [ebp - 0x2a78]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edx, [esp + 4]
push edx
lea edx, [ebp + eax*2 - 0x2a78]
push edx
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0xc
inc dword [ebp - 0x2820]
jmp 0x4053b1
add esp, 0xc
lea edx, [ebp - 0x2a78]
push edx
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov dword [ebp - 0x2868], eax
push eax
mov eax, dword [ebp - 0x2848]
push eax
mov eax, dword [eax]
call dword [eax + 0x6c]
test eax, eax
je 0x405466
push 0xa
push 0xd313123
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
push dword [ebp - 0x2868]
call dword [sym.imp.oleaut32.dll_SysFreeString]
mov eax, dword [ebp - 0x283c]
push eax
mov eax, dword [eax]
call dword [eax + 8]
push dword [ebp - 0x286c]
call dword [sym.imp.oleaut32.dll_SysFreeString]
mov eax, dword [ebp - 0x2840]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp - 0x2844]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp - 0x2848]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp - 0x284c]
push eax
mov eax, dword [eax]
call dword [eax + 8]
cmp dword [ebp - 0x42c0], 0
jne 0x4054ce
inc dword [ebp - 0x2824]
jmp 0x405091
cmp dword [ebp - 0x42c0], 0
jne 0x4055b5
push 0
push dword [ebp - 0x2870]
push 0
push 8
mov eax, dword [ebp - 0x2854]
push eax
mov eax, dword [eax]
call dword [eax + 0x108]
test eax, eax
je 0x40553c
push 0xa
push 0xd323123
push 0x20726f72
push 0x72652074
push 0x6e656d75
push 0x636f444d
push 0x4f442e32
push 0x4c4d5853
push 0x4d202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x42c0], 1
jmp 0x4055b5
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x2f8c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push 0
push 0
push eax
lea edx, [ebp - 0x2d84]
push edx
push 0xffffffffffffffff
lea edx, [ebp - 0x2f8c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
lea eax, [ebp - 0x2d84]
push 0xa0d
push 0x7325203a
push 0x24444556
push 0x41535f45
push 0x4c494624
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp - 0x2854]
push eax
mov eax, dword [eax]
call dword [eax + 8]
push dword [ebp - 0x2870]
call dword [sym.imp.oleaut32.dll_SysFreeString]
cmp dword [ebp - 0x42c0], 0
jne 0x4056ea
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x3298]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push 0
push 0
push eax
lea edx, [ebp - 0x3090]
push edx
push 0xffffffffffffffff
lea edx, [ebp - 0x3298]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x3298]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
jne 0x405683
lea eax, [ebp - 0x3090]
push 0xa0d73
push 0x25203a24
push 0x454c4946
push 0x5f474e49
push 0x54414552
push 0x435f524f
push 0x52524524
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
jmp 0x4056ea
mov dword [ebp - 0x281c], eax
push 0
lea edx, [ebp - 0x2818]
push edx
push dword [esi + 0x2c]
push dword [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
lea eax, [ebp - 0x3090]
push 0xa0d
push 0x7325203a
push 0x24444556
push 0x41535f45
push 0x4c494624
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
push dword [ebp - 0x281c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4056f5
lea edx, [esi + 0x24]
push edx
call fcn.0040963c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x407367
cmp dword [ebp - 0x42c0], 0
jne 0x405739
push 0xc010
push 0x4d070000
push esp
push 6
push 0x12c
push 0x40
push 6
push 0
call fcn.0040935e
cmp eax, 0xffffffff
jne 0x405739
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x405776
push 0x36
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x1e31
push 0x4d070000
push esp
push 7
push 0x12c
push 0x40
push 6
push 0
call fcn.0040935e
cmp eax, 0xffffffff
jne 0x405776
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x4057b3
push 0x13e
push 0x4d070000
push 0
push 6
push 0
push 0x40
push 0
push 6
push 0x3e8
push 0
push 0
mov dword [ebp - 0xdec], esp
push 0
push dword [ebp - 0xdec]
push 6
call dword [edi]
add esp, 0x2c
cmp dword [ebp - 0x42c0], 0
jne 0x405973
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x58]
mov dword [ebp - 0x43cc], eax
lea edx, [ebp - 0x42bc]
push edx
push 0xa
push 6
push 0
call fcn.004094ba
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x43cc]
jl 0x4057cf
mov dword [ebp - 0x43c8], 0xa
push 0x210
push 0xe0070000
push esp
push 6
push 0x1f4
push 0x40
push 6
push 0
call fcn.0040935e
cmp eax, 0xffffffff
jne 0x40582a
mov dword [ebp - 0x42c0], 1
jmp 0x405973
lea edx, [ebp - 0x42bc]
push edx
push 0x1f4
push 6
push 0
call fcn.004094ba
cmp eax, 0xffffffff
jne 0x405853
mov dword [ebp - 0x42c0], 1
jmp 0x405973
test eax, eax
jne 0x4058ca
dec dword [ebp - 0x43c8]
jne 0x40582a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4058a7
xor eax, eax
jmp 0x4058b1
cmp eax, 0x20
jbe 0x4058b1
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x405973
cmp byte [ebp - 0x42b8], 0x7f
jne 0x4058f0
cmp byte [ebp - 0x42b6], 0x78
jne 0x4058f0
mov dword [ebp - 0x43c8], 0xa
jmp 0x40582a
cmp byte [ebp - 0x42b8], 0x50
je 0x405973
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405955
xor eax, eax
jmp 0x40595f
cmp eax, 0x20
jbe 0x40595f
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x4059bc
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xa19
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 6
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
cmp eax, 0xffffffff
jne 0x4059bc
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x405a05
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xfd22
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 7
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
cmp eax, 0xffffffff
jne 0x405a05
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x405a4e
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x1fd22
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 7
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
cmp eax, 0xffffffff
jne 0x405a4e
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x405a97
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x2fd22
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 7
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
cmp eax, 0xffffffff
jne 0x405a97
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x405ae0
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x3fd22
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 7
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
cmp eax, 0xffffffff
jne 0x405ae0
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x405b92
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x32]
mov dword [ebp - 0x43cc], eax
lea edx, [ebp - 0x42bc]
push edx
push 0xa
push 6
push 0
call fcn.004094ba
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x43cc]
jl 0x405afc
push 0x11f022
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 7
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x405b4e
cmp eax, 0xffffffff
jne 0x405b5a
mov dword [ebp - 0x42c0], 1
jmp 0x405b92
cmp byte [ebp - 0x42b8], 0x62
jne 0x405b92
sub eax, 7
xor ecx, ecx
cmp ecx, 0x10
jae 0x405b82
cmp ecx, eax
jae 0x405b82
mov dl, byte [ebp + ecx - 0x42b5]
mov byte [ebp + ecx - 0x25ba], dl
inc ecx
jmp 0x405b68
cmp ecx, 0x10
jae 0x405b92
mov byte [ebp + ecx - 0x25ba], 0
inc ecx
jmp 0x405b82
cmp dword [ebp - 0x42c0], 0
jne 0x405d84
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x5c]
mov dword [ebp - 0x43cc], eax
lea edx, [ebp - 0x42bc]
push edx
push 0xa
push 6
push 0
call fcn.004094ba
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x43cc]
jl 0x405bae
mov dword [ebp - 0x43c8], 0x20
push 0x127
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 6
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
jne 0x405c14
mov dword [ebp - 0x42c0], 1
jmp 0x405d84
cmp eax, 0xffffffff
jne 0x405c28
mov dword [ebp - 0x42c0], 1
jmp 0x405d84
cmp byte [ebp - 0x42b8], 0x7f
jne 0x405d09
cmp byte [ebp - 0x42b6], 0x36
jne 0x405c53
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x43c8]
jne 0x405bd8
jmp 0x405c95
cmp byte [ebp - 0x42b6], 0x37
jne 0x405c75
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x43c8]
jne 0x405bd8
jmp 0x405c95
cmp byte [ebp - 0x42b6], 0x22
jne 0x405c95
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x43c8]
jne 0x405bd8
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405ce9
xor eax, eax
jmp 0x405cf3
cmp eax, 0x20
jbe 0x405cf3
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x405d84
cmp byte [ebp - 0x42b8], 0x67
je 0x405d84
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405d66
xor eax, eax
jmp 0x405d70
cmp eax, 0x20
jbe 0x405d70
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x406007
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x32]
mov dword [ebp - 0x43cc], eax
lea edx, [ebp - 0x42bc]
push edx
push 0xa
push 6
push 0
call fcn.004094ba
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x43cc]
jl 0x405da0
cmp dword [ebp - 0x42b6], 0
jne 0x405e0c
cmp dword [ebp - 0x42b2], 0
jne 0x405e0c
cmp dword [ebp - 0x42ae], 0
jne 0x405e0c
cmp dword [ebp - 0x42aa], 0
jne 0x405e0c
cmp dword [ebp - 0x42a6], 0
jne 0x405e0c
cmp dword [ebp - 0x42a2], 0
jne 0x405e0c
cmp dword [ebp - 0x429e], 0
jne 0x405e0c
cmp dword [ebp - 0x429a], 0
je 0x406007
mov byte [ebp - 0x1362], 0x20
mov byte [ebp - 0x1361], 0xf4
mov dword [ebp - 0x1360], 1
mov eax, dword [ebp - 0x42b6]
mov dword [ebp - 0x135c], eax
mov eax, dword [ebp - 0x42b2]
mov dword [ebp - 0x1358], eax
mov eax, dword [ebp - 0x42ae]
mov dword [ebp - 0x1354], eax
mov eax, dword [ebp - 0x42aa]
mov dword [ebp - 0x1350], eax
mov eax, dword [ebp - 0x42a6]
mov dword [ebp - 0x134c], eax
mov eax, dword [ebp - 0x42a2]
mov dword [ebp - 0x1348], eax
mov eax, dword [ebp - 0x429e]
mov dword [ebp - 0x1344], eax
mov eax, dword [ebp - 0x429a]
mov dword [ebp - 0x1340], eax
mov eax, dword [ebp - 0x25ba]
mov dword [ebp - 0x12e4], eax
mov eax, dword [ebp - 0x25b6]
mov dword [ebp - 0x12e0], eax
mov eax, dword [ebp - 0x25b2]
mov dword [ebp - 0x12dc], eax
mov eax, dword [ebp - 0x25ae]
mov dword [ebp - 0x12d8], eax
push 0xfa
lea edx, [ebp - 0x44d2]
push edx
push 0xf6
lea edx, [ebp - 0x1362]
push edx
call dword [ebx + 0x3c]
cmp eax, 0x20
je 0x405f28
push 0
push 0xa0d3120
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x42c0], 1
jmp 0x406007
mov dword [ebp - 0x2382], 0xe0070000
mov word [ebp - 0x237e], 0x227
push 0x20
lea edx, [ebp - 0x44d2]
push edx
lea edx, [ebp - 0x237c]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
lea edx, [ebp - 0x2382]
push edx
push 0x26
lea edx, [ebp - 0x42bc]
push edx
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x405f82
cmp eax, 0xffffffff
jne 0x405f8e
mov dword [ebp - 0x42c0], 1
jmp 0x406007
cmp byte [ebp - 0x42b8], 0x67
je 0x406007
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405fe9
xor eax, eax
jmp 0x405ff3
cmp eax, 0x20
jbe 0x405ff3
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x406112
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x38]
mov dword [ebp - 0x43cc], eax
lea edx, [ebp - 0x42bc]
push edx
push 0xa
push 6
push 0
call fcn.004094ba
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x43cc]
jl 0x406023
mov dword [ebp - 0x23aa], 0
mov dword [ebp - 0x23a6], 0
cmp dword [ebp - 0x23aa], 0x20
jae 0x4060be
imul ecx, dword [ebp - 0x23aa], 0x10
mov eax, dword [ebp + ecx - 0x25a6]
sub eax, dword [ebp + ecx - 0x25aa]
test eax, eax
je 0x4060be
mov eax, dword [ebp + ecx - 0x25a6]
mov edx, dword [esi + 0x20]
cmp eax, dword [ebp + ecx - 0x25aa]
jbe 0x406098
cmp dword [edx + eax - 4], 0xffffffff
jne 0x406098
sub eax, 4
jmp 0x406083
add eax, 0x7ffff
and eax, 0xfff80000
mov dword [ebp + ecx - 0x25a6], eax
sub eax, dword [ebp + ecx - 0x25aa]
add dword [ebp - 0x23a6], eax
inc dword [ebp - 0x23aa]
jmp 0x406057
mov eax, dword [ebp - 0x23a6]
add eax, 0xfff
and eax, 0xfffff000
shr eax, 0xc
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
cmp dword [esi + 0x270], 0x73696e24
jne 0x40618b
cmp dword [esi + 0x274], 0x386e6173
jne 0x40618b
cmp dword [esi + 0x278], 0x24315f30
jne 0x40618b
cmp dword [esi + 0x27c], 0x61746948
jne 0x40618b
cmp dword [esi + 0x280], 0x20696863
jne 0x40618b
cmp dword [esi + 0x284], 0x35384852
jne 0x40618b
cmp dword [esi + 0x288], 0x30345b30
jne 0x40618b
cmp dword [esi + 0x28c], 0x5d6b3639
jne 0x40618b
cmp dword [esi + 0x290], 0x4e414320
jne 0x40618b
cmp byte [esi + 0x294], 0
je 0x406247
cmp dword [esi + 0x270], 0x73696e24
jne 0x406383
cmp dword [esi + 0x274], 0x386e6173
jne 0x406383
cmp dword [esi + 0x278], 0x24315f30
jne 0x406383
cmp dword [esi + 0x27c], 0x53455428
jne 0x406383
cmp dword [esi + 0x280], 0x69482954
jne 0x406383
cmp dword [esi + 0x284], 0x68636174
jne 0x406383
cmp dword [esi + 0x288], 0x48522069
jne 0x406383
cmp dword [esi + 0x28c], 0x5b303538
jne 0x406383
cmp dword [esi + 0x290], 0x36393034
jne 0x406383
cmp dword [esi + 0x294], 0x43205d6b
jne 0x406383
cmp word [esi + 0x298], 0x4e41
jne 0x406383
cmp byte [esi + 0x29a], 0
jne 0x406383
cmp dword [ebp - 0x42c0], 0
jne 0x406383
mov dword [ebp - 0x23aa], 0
cmp dword [ebp - 0x23aa], 0x20
jae 0x406383
imul ecx, dword [ebp - 0x23aa], 0x10
mov eax, dword [ebp + ecx - 0x25a6]
sub eax, dword [ebp + ecx - 0x25aa]
test eax, eax
je 0x406383
mov edx, dword [ebp + ecx - 0x259e]
mov dword [ebp - 0x2382], 0xe0070000
mov word [ebp - 0x237e], 0xfd2e
mov byte [ebp - 0x237c], dl
mov ecx, dword [ebp + ecx - 0x25aa]
add ecx, dword [esi + 0x20]
push eax
push ecx
lea edx, [ebp - 0x237b]
push edx
call fcn.0040972a
lea edx, [ebp - 0x2382]
push edx
push 0x1b
lea edx, [ebp - 0x42bc]
push edx
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x4062ee
cmp eax, 0xffffffff
jne 0x4062fd
mov dword [ebp - 0x42c0], 1
jmp 0x406383
cmp byte [ebp - 0x42b8], 0x6e
je 0x406378
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406358
xor eax, eax
jmp 0x406362
cmp eax, 0x20
jbe 0x406362
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x406383
inc dword [ebp - 0x23aa]
jmp 0x40625e
cmp dword [esi + 0x270], 0x73696e24
jne 0x4063fd
cmp dword [esi + 0x274], 0x386e6173
jne 0x4063fd
cmp dword [esi + 0x278], 0x24325f30
jne 0x4063fd
cmp dword [esi + 0x27c], 0x63736f42
jne 0x4063fd
cmp dword [esi + 0x280], 0x44452068
jne 0x4063fd
cmp dword [esi + 0x284], 0x43373143
jne 0x4063fd
cmp dword [esi + 0x288], 0x325b3438
jne 0x4063fd
cmp dword [esi + 0x28c], 0x6b303635
jne 0x4063fd
cmp dword [esi + 0x290], 0x4143205d
jne 0x4063fd
cmp word [esi + 0x294], 0x4e
je 0x4064ad
cmp dword [esi + 0x270], 0x73696e24
jne 0x40688e
cmp dword [esi + 0x274], 0x386e6173
jne 0x40688e
cmp dword [esi + 0x278], 0x24325f30
jne 0x40688e
cmp dword [esi + 0x27c], 0x53455428
jne 0x40688e
cmp dword [esi + 0x280], 0x6f422954
jne 0x40688e
cmp dword [esi + 0x284], 0x20686373
jne 0x40688e
cmp dword [esi + 0x288], 0x31434445
jne 0x40688e
cmp dword [esi + 0x28c], 0x34384337
jne 0x40688e
cmp dword [esi + 0x290], 0x3635325b
jne 0x40688e
cmp dword [esi + 0x294], 0x205d6b30
jne 0x40688e
cmp dword [esi + 0x298], 0x4e4143
jne 0x40688e
cmp dword [ebp - 0x42c0], 0
jne 0x4065f8
mov ecx, dword [esi + 0x20]
mov edx, dword [ecx + 0x2000c]
and edx, 0x5fffffff
mov dword [ebp - 0x2382], 0xe0070000
mov dword [ebp - 0x237e], 0x2fd2e
mov eax, dword [ecx + 0x20000]
mov dword [ebp - 0xde8], eax
bswap eax
mov dword [ebp - 0x237b], eax
mov eax, dword [ecx + edx - 4]
mov dword [ebp - 0xde4], eax
bswap eax
mov dword [ebp - 0x2377], eax
mov eax, dword [ecx + edx - 0x88]
mov dword [ebp - 0xde0], eax
bswap eax
mov dword [ebp - 0x2373], eax
mov eax, dword [ecx + edx - 0x8c]
mov dword [ebp - 0xddc], eax
bswap eax
mov dword [ebp - 0x236f], eax
push 0
push 0x10
lea edx, [ebp - 0xde8]
push edx
call fcn.00409664
bswap eax
mov dword [ebp - 0x236b], eax
lea edx, [ebp - 0x2382]
push edx
push 0x1b
lea edx, [ebp - 0x42bc]
push edx
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x406573
cmp eax, 0xffffffff
jne 0x40657f
mov dword [ebp - 0x42c0], 1
jmp 0x4065f8
cmp byte [ebp - 0x42b8], 0x6e
je 0x4065f8
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4065da
xor eax, eax
jmp 0x4065e4
cmp eax, 0x20
jbe 0x4065e4
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x406743
mov ecx, dword [esi + 0x20]
mov edx, dword [ecx + 0x4000c]
and edx, 0x5fffffff
mov dword [ebp - 0x2382], 0xe0070000
mov dword [ebp - 0x237e], 0x1fd2e
mov eax, dword [ecx + 0x40000]
mov dword [ebp - 0xde8], eax
bswap eax
mov dword [ebp - 0x237b], eax
mov eax, dword [ecx + edx - 4]
mov dword [ebp - 0xde4], eax
bswap eax
mov dword [ebp - 0x2377], eax
mov eax, dword [ecx + edx - 0x88]
mov dword [ebp - 0xde0], eax
bswap eax
mov dword [ebp - 0x2373], eax
mov eax, dword [ecx + edx - 0x8c]
mov dword [ebp - 0xddc], eax
bswap eax
mov dword [ebp - 0x236f], eax
push 0
push 0x10
lea edx, [ebp - 0xde8]
push edx
call fcn.00409664
bswap eax
mov dword [ebp - 0x236b], eax
lea edx, [ebp - 0x2382]
push edx
push 0x1b
lea edx, [ebp - 0x42bc]
push edx
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x4066be
cmp eax, 0xffffffff
jne 0x4066ca
mov dword [ebp - 0x42c0], 1
jmp 0x406743
cmp byte [ebp - 0x42b8], 0x6e
je 0x406743
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406725
xor eax, eax
jmp 0x40672f
cmp eax, 0x20
jbe 0x40672f
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x40688e
mov ecx, dword [esi + 0x20]
mov edx, dword [ecx + 0x20000c]
and edx, 0x5fffffff
mov dword [ebp - 0x2382], 0xe0070000
mov dword [ebp - 0x237e], 0x3fd2e
mov eax, dword [ecx + 0x200000]
mov dword [ebp - 0xde8], eax
bswap eax
mov dword [ebp - 0x237b], eax
mov eax, dword [ecx + edx - 4]
mov dword [ebp - 0xde4], eax
bswap eax
mov dword [ebp - 0x2377], eax
mov eax, dword [ecx + edx - 0x88]
mov dword [ebp - 0xde0], eax
bswap eax
mov dword [ebp - 0x2373], eax
mov eax, dword [ecx + edx - 0x8c]
mov dword [ebp - 0xddc], eax
bswap eax
mov dword [ebp - 0x236f], eax
push 0
push 0x10
lea edx, [ebp - 0xde8]
push edx
call fcn.00409664
bswap eax
mov dword [ebp - 0x236b], eax
lea edx, [ebp - 0x2382]
push edx
push 0x1b
lea edx, [ebp - 0x42bc]
push edx
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x406809
cmp eax, 0xffffffff
jne 0x406815
mov dword [ebp - 0x42c0], 1
jmp 0x40688e
cmp byte [ebp - 0x42b8], 0x6e
je 0x40688e
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406870
xor eax, eax
jmp 0x40687a
cmp eax, 0x20
jbe 0x40687a
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x406e33
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x80]
mov dword [ebp - 0x43cc], eax
lea edx, [ebp - 0x42bc]
push edx
push 0xa
push 6
push 0
call fcn.004094ba
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x43cc]
jl 0x4068ad
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov dword [ebp - 0x23aa], 0
mov dword [ebp - 0x2386], 0
cmp dword [ebp - 0x23aa], 0x20
jae 0x406e33
imul ecx, dword [ebp - 0x23aa], 0x10
mov eax, dword [ebp + ecx - 0x25a6]
sub eax, dword [ebp + ecx - 0x25aa]
test eax, eax
je 0x406e33
mov eax, dword [ebp + ecx - 0x25aa]
mov dword [ebp - 0x23a2], eax
mov eax, dword [ebp + ecx - 0x25a6]
mov dword [ebp - 0x239e], eax
mov eax, dword [ebp + ecx - 0x25a2]
mov dword [ebp - 0x239a], eax
mov dword [ebp - 0x2382], 0xe0070000
mov dword [ebp - 0x237e], 0x440034
mov eax, dword [ebp - 0x23a2]
add eax, dword [ebp - 0x239a]
mov byte [ebp - 0x2379], ah
mov byte [ebp - 0x2378], al
shr eax, 0x10
mov byte [ebp - 0x237b], ah
mov byte [ebp - 0x237a], al
mov eax, dword [ebp - 0x239e]
sub eax, dword [ebp - 0x23a2]
mov byte [ebp - 0x2375], ah
mov byte [ebp - 0x2374], al
shr eax, 0x10
mov byte [ebp - 0x2377], ah
mov byte [ebp - 0x2376], al
mov dword [ebp - 0x43c8], 0xa
lea edx, [ebp - 0x2382]
push edx
push 0xf
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040935e
cmp eax, 0xffffffff
jne 0x4069f0
mov dword [ebp - 0x42c0], 1
jmp 0x406b62
lea edx, [ebp - 0x42bc]
push edx
push 0x1f4
push 6
push 0
call fcn.004094ba
cmp eax, 0xffffffff
jne 0x406a19
mov dword [ebp - 0x42c0], 1
jmp 0x406b62
test eax, eax
jne 0x406a9c
dec dword [ebp - 0x43c8]
jne 0x4069f0
dec dword [ebp - 0x329c]
jne 0x404916
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406a79
xor eax, eax
jmp 0x406a83
cmp eax, 0x20
jbe 0x406a83
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x406b62
cmp byte [ebp - 0x42b8], 0x7f
jne 0x406ac2
cmp byte [ebp - 0x42b6], 0x78
jne 0x406ac2
mov dword [ebp - 0x43c8], 0xa
jmp 0x4069f0
cmp byte [ebp - 0x42b8], 0x74
je 0x406b3d
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406b1d
xor eax, eax
jmp 0x406b27
cmp eax, 0x20
jbe 0x406b27
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x406b62
mov ecx, 6
xor edx, edx
cmp ecx, 0xa
jae 0x406b5a
cmp ecx, eax
jae 0x406b5a
shl edx, 8
mov dl, byte [ebp + ecx - 0x42bc]
inc ecx
jmp 0x406b44
dec edx
dec edx
mov dword [ebp - 0x2392], edx
cmp dword [ebp - 0x42c0], 0
jne 0x406e33
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x32]
mov dword [ebp - 0x43cc], eax
lea edx, [ebp - 0x42bc]
push edx
push 0xa
push 6
push 0
call fcn.004094ba
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x43cc]
jl 0x406b7e
mov dword [ebp - 0x238a], 1
mov eax, dword [ebp - 0x23a2]
mov ecx, dword [ebp - 0x239e]
cmp eax, ecx
jae 0x406d2d
sub ecx, eax
cmp ecx, dword [ebp - 0x2392]
jbe 0x406bcc
mov ecx, dword [ebp - 0x2392]
mov dword [ebp - 0x238e], ecx
mov dword [ebp - 0x2382], 0xe0070000
mov byte [ebp - 0x237e], 0x36
add eax, dword [esi + 0x20]
push ecx
push eax
lea edx, [ebp - 0x237c]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov eax, dword [ebp - 0x238a]
mov byte [ebp - 0x237d], al
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x14]
mov dword [ebp - 0x43cc], eax
lea edx, [ebp - 0x42bc]
push edx
push 0xa
push 6
push 0
call fcn.004094ba
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x43cc]
jl 0x406c13
mov ecx, dword [ebp - 0x238e]
lea edx, [ebp - 0x2382]
push edx
lea edx, [ecx + 6]
push edx
lea edx, [ebp - 0x42bc]
push edx
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x406c69
cmp eax, 0xffffffff
jne 0x406c78
mov dword [ebp - 0x42c0], 1
jmp 0x406d28
cmp byte [ebp - 0x42b8], 0x76
je 0x406cf3
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406cd3
xor eax, eax
jmp 0x406cdd
cmp eax, 0x20
jbe 0x406cdd
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x406d28
mov eax, dword [ebp - 0x23a2]
and eax, 0xfffff000
cmp eax, dword [ebp - 0x2386]
je 0x406d11
mov dword [ebp - 0x2386], eax
call fcn.004092db
inc dword [ebp - 0x238a]
mov ecx, dword [ebp - 0x238e]
add dword [ebp - 0x23a2], ecx
jmp 0x406ba8
jmp 0x406e33
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x32]
mov dword [ebp - 0x43cc], eax
lea edx, [ebp - 0x42bc]
push edx
push 0xa
push 6
push 0
call fcn.004094ba
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x43cc]
jl 0x406d3c
push 0x37
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 5
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
jne 0x406d95
mov dword [ebp - 0x42c0], 1
jmp 0x406e1f
cmp eax, 0xffffffff
jne 0x406da6
mov dword [ebp - 0x42c0], 1
jmp 0x406e1f
cmp byte [ebp - 0x42b8], 0x77
je 0x406e1f
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406e01
xor eax, eax
jmp 0x406e0b
cmp eax, 0x20
jbe 0x406e0b
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x406e33
inc dword [ebp - 0x23aa]
jmp 0x406906
cmp dword [ebp - 0x42c0], 0
jne 0x406f75
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x32]
mov dword [ebp - 0x43cc], eax
lea edx, [ebp - 0x42bc]
push edx
push 0xa
push 6
push 0
call fcn.004094ba
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x43cc]
jl 0x406e4f
mov dword [ebp - 0xdd8], 0
push 0xa19
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 6
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
jne 0x406eb5
mov dword [ebp - 0x42c0], 1
jmp 0x406f75
cmp eax, 0xffffffff
jne 0x406ec9
mov dword [ebp - 0x42c0], 1
jmp 0x406f75
cmp byte [ebp - 0x42b8], 0x59
je 0x406f44
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406f24
xor eax, eax
jmp 0x406f2e
cmp eax, 0x20
jbe 0x406f2e
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x406f75
sub eax, 7
shr eax, 2
cmp eax, 0x20
jbe 0x406f54
mov eax, 0x20
mov dword [ebp - 0xdd8], eax
shl eax, 2
push eax
lea edx, [ebp - 0x42b5]
push edx
lea edx, [ebp - 0xdd0]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
cmp dword [ebp - 0x42c0], 0
jne 0x407126
mov dword [ebp - 0xdd4], 0
mov ecx, dword [ebp - 0xdd4]
cmp ecx, 0x20
jae 0x406fdd
cmp ecx, dword [ebp - 0xdd8]
jae 0x406fdd
test byte [ebp + ecx*4 - 0xdcd], 0xff
je 0x406fd5
movzx edx, word [ebp + ecx*4 - 0xdd0]
xor ecx, ecx
cmp ecx, 0x20
jae 0x406fd5
cmp ecx, dword [ebp - 0xdd8]
jae 0x406fd5
cmp word [ebp + ecx*4 - 0xdd0], dx
jne 0x406fd2
or byte [ebp + ecx*4 - 0xdcd], 0x10
inc ecx
jmp 0x406fb3
inc dword [ebp - 0xdd4]
jmp 0x406f8c
mov dword [ebp - 0xdd4], 0
mov ecx, dword [ebp - 0xdd4]
cmp ecx, 0x20
jae 0x407126
cmp ecx, dword [ebp - 0xdd8]
jae 0x407126
shl ecx, 2
test byte [ebp + ecx - 0xdcd], 0xff
je 0x40711b
mov dword [ebp - 0x2382], 0xe0070000
mov dword [ebp - 0x237e], 0x6ff0131
mov al, byte [ebp + ecx - 0xdd0]
mov byte [ebp - 0x237a], al
mov al, byte [ebp + ecx - 0xdcf]
mov byte [ebp - 0x2379], al
mov al, byte [ebp + ecx - 0xdce]
mov byte [ebp - 0x2378], al
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea edx, [ebp - 0x2382]
push edx
push 0xb
lea edx, [ebp - 0x42bc]
push edx
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x407084
cmp eax, 0xffffffff
jne 0x407093
mov dword [ebp - 0x42c0], 1
jmp 0x407119
cmp byte [ebp - 0x42b8], 0x71
je 0x40710e
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4070ee
xor eax, eax
jmp 0x4070f8
cmp eax, 0x20
jbe 0x4070f8
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x407119
inc dword [ebp - 0xdd4]
jmp 0x406fe7
jmp 0x407126
inc dword [ebp - 0xdd4]
jmp 0x406fe7
cmp dword [ebp - 0x42c0], 0
jne 0x407337
push 0x24
push 0x474e494e
push 0x52415724
lea edx, [ebp - 0xd4c]
push edx
lea edx, [esp + 4]
push edx
push dword [ebx + 0x170]
call dword [ebx + 0x2c]
add esp, 0xc
push 0x244646
push 0x4f5f4e4f
push 0x4954494e
push 0x47495f4e
push 0x52555424
lea edx, [ebp - 0xb44]
push edx
lea edx, [esp + 4]
push edx
push dword [ebx + 0x170]
call dword [ebx + 0x2c]
add esp, 0x14
push 0x244e
push 0x4f5f4e4f
push 0x4954494e
push 0x47495f4e
push 0x52555424
lea edx, [ebp - 0x93c]
push edx
lea edx, [esp + 4]
push edx
push dword [ebx + 0x170]
call dword [ebx + 0x2c]
add esp, 0x14
push 0
lea edx, [ebp - 0xd4c]
push edx
lea edx, [ebp - 0xb44]
push edx
push dword [ebx + 0x488]
call dword [sym.imp.USER32.DLL_MessageBoxW]
push 0xa0d
push 0x2453444e
push 0x4f434553
push 0x5f30315f
push 0x524f465f
push 0x54494157
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
push 0x270000
push 0
push 0x401
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0xd50], 0x28
push 0xfa
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0
push 0x405
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
dec dword [ebp - 0xd50]
jne 0x407250
push 0
lea edx, [ebp - 0xd4c]
push edx
lea edx, [ebp - 0x93c]
push edx
push dword [ebx + 0x488]
call dword [sym.imp.USER32.DLL_MessageBoxW]
push 0xa0d
push 0x2453444e
push 0x4f434553
push 0x5f30315f
push 0x524f465f
push 0x54494157
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
push 0x270000
push 0
push 0x401
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0xd50], 0x28
push 0xfa
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0
push 0x405
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
dec dword [ebp - 0xd50]
jne 0x40730f
cmp dword [ebp - 0x42c0], 0
jne 0x407367
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x40760e
cmp dword [ebp - 0x42c0], 0
jne 0x40743a
push 0x110
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 6
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x4073b5
cmp eax, 0xffffffff
jne 0x4073c1
mov dword [ebp - 0x42c0], 1
jmp 0x40743a
cmp byte [ebp - 0x42b8], 0x50
je 0x40743a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40741c
xor eax, eax
jmp 0x407426
cmp eax, 0x20
jbe 0x407426
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x40760e
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x8f0219
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 7
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x407481
cmp eax, 0xffffffff
jne 0x407490
mov dword [ebp - 0x42c0], 1
jmp 0x40760e
cmp byte [ebp - 0x42b8], 0x59
je 0x40750e
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4074eb
xor eax, eax
jmp 0x4074f5
cmp eax, 0x20
jbe 0x4074f5
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x40760e
sub eax, 7
shr eax, 2
mov dword [ebp - 0x734], eax
push 0
push 0xa0d6425
push 0x203a2454
push 0x4e554f43
push 0x5f435444
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
mov dword [ebp - 0x730], 0
mov ecx, dword [ebp - 0x730]
cmp ecx, dword [ebp - 0x734]
jae 0x40760e
shl ecx, 2
movzx eax, byte [ebp + ecx - 0x42b5]
mov dword [ebp - 0x72c], eax
movzx eax, byte [ebp + ecx - 0x42b4]
mov dword [ebp - 0x728], eax
movzx eax, byte [ebp + ecx - 0x42b3]
mov dword [ebp - 0x724], eax
movzx eax, byte [ebp + ecx - 0x42b2]
mov dword [ebp - 0x720], eax
push 0xa
push 0xd58322e
push 0x252d5832
push 0x2e252d58
push 0x322e2558
push 0x322e2550
push dword [ebp - 0x720]
push dword [ebp - 0x724]
push dword [ebp - 0x728]
push dword [ebp - 0x72c]
lea eax, [esp + 0x10]
push eax
lea edx, [ebp - 0x47c0]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x47c0]
push edx
call dword [ebx + 0x30]
inc dword [ebp - 0x730]
jmp 0x407564
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x18
jne 0x407b53
cmp dword [ebp - 0x42c0], 0
jne 0x407991
push 0
push 0xa0d2443
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0xffffff14
push 0xe4070000
push 0x8cd00ff
push 0xffff14e4
push 0x7000008
push 0xcc00ffff
push 0xff14e107
push 0x8cd
push 0xffffff
push 0x14d90700
push 0x86800
push 0xffffff14
push 0xd4070000
push 0x86900ff
push 0xffff14b7
push 0x7000008
push 0xd200ffff
push 0xff149707
push 0x8cd
push 0xffffff
push 0x14970700
push 0x86a00
push 0xffffff14
push 0x5d070000
push 0x8cb00ff
push 0xffff1458
push 0x7000008
push 0xce00ffff
push 0xff145507
push 0x868
push 0xffffff
push 0x14520700
push 0x8d200
push 0xffffff14
push 0x4e070000
push 0x86800ff
push 0xffff144e
push 0x7000008
push 0xcc00ffff
push 0xff144d07
push 0x8ce
push 0xffffff
push 0x14480700
push 0x8cc00
push 0xffffff14
push 0x47070000
push 0x86900ff
push 0xffff1446
push 0x7000008
push 0xd100ffff
push 0xff144507
push 0x869
push 0xffffff
push 0x14440700
push 0x8cd00
push 0xffffff14
push 0x43070000
push 0x8cd00ff
push 0xffff1442
push 0x7000008
push 0x6800ffff
push 0xff144007
push 0x8cd
push 0xffffff
push 0x143d0700
push 0x8d100
push 0xffffff14
push 0x23070000
push 0x8cc00ff
push 0xffff1410
push 0x7000008
push 0x7500ffff
push 0xff140c07
push 0x8ce
push 0xffffff
push 0x14070700
push 0x8cd00
push 0xc010e407
push 0x669
push 0x110e4
push 0x7000006
push 0x6800c010
push 0xe1070000
push 0x6d300c0
push 0x10d90700
push 0x6cd00
push 0xc010d407
push 0x668
push 0xc010b7
push 0x7000006
push 0xce00c010
push 0x97070000
push 0x6cd0001
push 0x10970700
push 0x66800
push 0xc0105d07
push 0x6d3
push 0x11058
push 0x7000006
push 0x6700c010
push 0x55070000
push 0x6cd0003
push 0x10520700
push 0x6cd00
push 0xc0104e07
push 0x6cc
push 0x1104e
push 0x7000006
push 0x6800c010
push 0x4d070000
push 0x66d00c0
push 0x10480700
push 0x6cd00
push 0xc0104707
push 0x6cc
push 0xc01046
push 0x7000006
push 0xcd000110
push 0x45070000
push 0x6cd00c0
push 0x10440700
push 0x66800
push 0xc0104307
push 0x66d
push 0xc01042
push 0x7000006
push 0xcd008110
push 0x40070000
push 0x6cc00c0
push 0x103d0700
push 0x66b00
push 0xc0102307
push 0x6cd
push 0x11010
push 0x7000006
push 0x68000310
push 0xc070000
push 0x66e00c0
push 0x10070700
push 0x60000
mov dword [ebp - 0x126c], 0
mov ecx, dword [ebp - 0x126c]
cmp ecx, 0x230
jae 0x40798b
movzx eax, byte [esp + ecx + 1]
mov ah, byte [esp + ecx]
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, dword [ebp - 0x126c]
movzx edx, byte [esp + ecx + 2]
push edx
lea edx, [esp + ecx + 7]
push edx
lea edx, [ebp - 0x2382]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov ecx, dword [ebp - 0x126c]
movzx ecx, byte [esp + ecx + 2]
lea eax, [ecx + 3]
add dword [ebp - 0x126c], eax
lea edx, [ebp - 0x2382]
push edx
push ecx
push 0xc8
push 0x40
push 6
push 0
call fcn.0040935e
cmp eax, 0xffffffff
jne 0x407912
mov dword [ebp - 0x42c0], 1
add esp, 0x230
cmp dword [ebp - 0x42c0], 0
jne 0x407a5d
push 0x75
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x310
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 6
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x4079d8
cmp eax, 0xffffffff
jne 0x4079e4
mov dword [ebp - 0x42c0], 1
jmp 0x407a5d
cmp byte [ebp - 0x42b8], 0x50
je 0x407a5d
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407a3f
xor eax, eax
jmp 0x407a49
cmp eax, 0x20
jbe 0x407a49
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
cmp dword [ebp - 0x42c0], 0
jne 0x407b53
push 3
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xffffff14
push 0xe0070000
lea eax, [ebp - 0x42bc]
push esp
push 8
push eax
push 0x1f4
push 0x12c
push 0x40
push 6
push 0
call fcn.0040932a
test eax, eax
je 0x407aa4
cmp eax, 0xffffffff
jne 0x407ab3
mov dword [ebp - 0x42c0], 1
jmp 0x407b53
cmp byte [ebp - 0x42b8], 0x54
je 0x407b2e
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x42bc]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407b0e
xor eax, eax
jmp 0x407b18
cmp eax, 0x20
jbe 0x407b18
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040950b
mov dword [ebp - 0x42c0], 1
jmp 0x407b53
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
cmp dword [esi + 0x270], 0x73696e24
jne 0x407bcc
cmp dword [esi + 0x274], 0x386e6173
jne 0x407bcc
cmp dword [esi + 0x278], 0x24315f30
jne 0x407bcc
cmp dword [esi + 0x27c], 0x61746948
jne 0x407bcc
cmp dword [esi + 0x280], 0x20696863
jne 0x407bcc
cmp dword [esi + 0x284], 0x35384852
jne 0x407bcc
cmp dword [esi + 0x288], 0x30345b30
jne 0x407bcc
cmp dword [esi + 0x28c], 0x5d6b3639
jne 0x407bcc
cmp dword [esi + 0x290], 0x4e414320
jne 0x407bcc
cmp byte [esi + 0x294], 0
je 0x407c88
cmp dword [esi + 0x270], 0x73696e24
jne 0x4083ad
cmp dword [esi + 0x274], 0x386e6173
jne 0x4083ad
cmp dword [esi + 0x278], 0x24315f30
jne 0x4083ad
cmp dword [esi + 0x27c], 0x53455428
jne 0x4083ad
cmp dword [esi + 0x280], 0x69482954
jne 0x4083ad
cmp dword [esi + 0x284], 0x68636174
jne 0x4083ad
cmp dword [esi + 0x288], 0x48522069
jne 0x4083ad
cmp dword [esi + 0x28c], 0x5b303538
jne 0x4083ad
cmp dword [esi + 0x290], 0x36393034
jne 0x4083ad
cmp dword [esi + 0x294], 0x43205d6b
jne 0x4083ad
cmp word [esi + 0x298], 0x4e41
jne 0x4083ad
cmp byte [esi + 0x29a], 0
jne 0x4083ad
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xd
jne 0x4083ad
xor eax, eax
pushal
mov dword [ebp - 0x714], 0xffffffff
mov dword [ebp - 0x710], 0xffffffff
mov ecx, 0x24
mov edi, dword [esi + 0x20]
cmp ecx, dword [esi + 0x14]
jae 0x407d78
cmp dword [edi + ecx - 0x24], 0xe55553
jne 0x407d70
cmp dword [edi + ecx - 4], 0x4c4b4
jne 0x407d20
lea eax, [ecx - 8]
mov dword [ebp - 0x714], eax
lea eax, [ecx - 0x14]
mov dword [ebp - 0x710], eax
mov dword [ebp - 0x71c], 0x10400
mov dword [ebp - 0x718], 0x100000
mov dword [ebp - 0x6fc], 0x10402
mov dword [ebp - 0x6f8], 0x100000
mov dword [ebp - 0x6f4], 0x10400
jmp 0x407dd7
cmp dword [edi + ecx - 8], 0x4c4b4
jne 0x407d70
lea eax, [ecx - 0xc]
mov dword [ebp - 0x714], eax
lea eax, [ecx - 0x18]
mov dword [ebp - 0x710], eax
mov dword [ebp - 0x71c], 0x10400
mov dword [ebp - 0x718], 0x100000
mov dword [ebp - 0x6fc], 0x10402
mov dword [ebp - 0x6f8], 0x100000
mov dword [ebp - 0x6f4], 0x10400
jmp 0x407dd7
add ecx, 4
jmp 0x407cb6
mov ecx, 0x24
cmp ecx, dword [esi + 0x14]
jae 0x407dd7
cmp dword [edi + ecx - 4], 0x4c4b4
jne 0x407dd2
lea eax, [ecx - 8]
mov dword [ebp - 0x714], eax
lea eax, [ecx - 0x14]
mov dword [ebp - 0x710], eax
mov dword [ebp - 0x71c], 0x10400
mov dword [ebp - 0x718], 0x100000
mov dword [ebp - 0x6fc], 0x10402
mov dword [ebp - 0x6f8], 0x100000
mov dword [ebp - 0x6f4], 0x10400
jmp 0x407dd7
add ecx, 4
jmp 0x407d7d
cmp dword [ebp - 0x714], 0xffffffff
jne 0x407ded
mov dword [esp + 0x1c], 3
jmp 0x408335
push 0x208
push 0
lea edx, [ebp - 0x6dc]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
push 0x24454c
push 0x49465f4d
push 0x4f525f4b
push 0x434f5453
push 0x5f45534f
push 0x4f484324
lea edx, [ebp - 0x4d4]
push edx
lea edx, [esp + 4]
push edx
push dword [ebx + 0x170]
call dword [ebx + 0x2c]
add esp, 0x18
push 0
mov dword [ebp - 0x2cc], esp
push 0
push 0x2a002e
push 0x2a0000
push 0x730065
push 0x6c0069
push 0x660020
push 0x6c006c
push 0x410000
push 0x780065
push 0x68002e
push 0x2a0000
push 0x65006c
push 0x690066
push 0x200078
push 0x650048
push 0x6e
push 0x690062
push 0x2e002a
push 0x65
push 0x6c0069
push 0x660020
push 0x790072
push 0x61006e
push 0x690042
mov dword [ebp - 0x2c8], esp
push 0
push 0
push 0
push 0
push 0
push 0x1800
push 0
push 0
push 0
push 0
push 0x104
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0x4c
mov eax, dword [ebx + 0x488]
mov dword [esp + 4], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c8]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x6dc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x2cc]
mov dword [esp + 0x2c], eax
lea eax, [ebp - 0x4d4]
mov dword [esp + 0x30], eax
push esp
call dword [sym.imp.COMDLG32.DLL_GetOpenFileNameW]
add esp, 0x4c
add esp, 0x60
add esp, 4
test eax, eax
je 0x408335
mov eax, dword [esi + 0x14]
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [ebp - 0x6f0], eax
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
lea edx, [ebp - 0x6dc]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
jne 0x407fa1
push 0xa0d
push 0x24454c49
push 0x465f474e
push 0x494e4550
push 0x4f5f524f
push 0x52524524
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov dword [esp + 0x1c], 3
jmp 0x408329
mov dword [ebp - 0x6ec], eax
push 0
push dword [ebp - 0x6ec]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
je 0x408024
push 0xa
push 0xd245345
push 0x54594224
push 0x20642520
push 0x3a244542
push 0x5f545355
push 0x4d5f455a
push 0x49535f45
push 0x4c494624
push dword [esi + 0x14]
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x4d4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
add esp, 0x24
lea edx, [ebp - 0x4d4]
push edx
call dword [ebx + 0x30]
mov dword [esp + 0x1c], 3
push dword [ebp - 0x6ec]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x408329
push 0
lea edx, [ebp - 0x6e8]
push edx
push dword [esi + 0x14]
push dword [ebp - 0x6f0]
push dword [ebp - 0x6ec]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp - 0x6ec]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pushal
xor eax, eax
mov ebx, dword [esi + 0x20]
xor edi, edi
cmp edi, dword [esi + 0x14]
jae 0x408081
movzx ecx, byte [ebx + edi]
cmp ch, 8
jae 0x40807e
movzx edx, cl
xor edx, eax
shr eax, 1
shr cl, 1
test edx, 1
je 0x40807a
xor eax, 0xedb88320
inc ch
jmp 0x40805f
inc edi
jmp 0x408056
mov dword [ebp - 0x6e4], eax
xor eax, eax
mov ebx, dword [ebp - 0x6f0]
xor edi, edi
cmp edi, dword [esi + 0x14]
jae 0x4080bc
movzx ecx, byte [ebx + edi]
cmp ch, 8
jae 0x4080b9
movzx edx, cl
xor edx, eax
shr eax, 1
shr cl, 1
test edx, 1
je 0x4080b5
xor eax, 0xedb88320
inc ch
jmp 0x40809a
inc edi
jmp 0x408091
mov dword [ebp - 0x6e0], eax
popal
mov eax, dword [ebp - 0x6e4]
cmp eax, dword [ebp - 0x6e0]
jne 0x4081c1
push 0
push 0xa0d2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
push 0x2a2a2a2a
mov dword [ebp - 0x2c4], esp
push 0xa0d
push 0x24454d41
push 0x535f4548
push 0x545f4552
push 0x415f4b43
push 0x4f54535f
push 0x444e415f
push 0x454c4946
push 0x5f4e4553
push 0x4f48435f
push 0x474e494e
push 0x52415724
push dword [ebp - 0x2c4]
call dword [ebx + 0x30]
push esp
call dword [ebx + 0x30]
push dword [ebp - 0x2c4]
call dword [ebx + 0x30]
add esp, 0x30
add esp, 0x74
mov dword [ebp - 0x704], 0
mov dword [ebp - 0x700], 0
mov ecx, dword [ebp - 0x71c]
mov edx, dword [ebp - 0x6f0]
cmp ecx, dword [ebp - 0x718]
jae 0x40821f
cmp ecx, dword [ebp - 0x6f4]
je 0x40821a
cmp ecx, dword [ebp - 0x6f8]
je 0x40821a
cmp ecx, dword [ebp - 0x714]
je 0x40821a
cmp ecx, dword [ebp - 0x710]
je 0x40821a
mov eax, dword [edx + ecx]
bswap eax
add dword [ebp - 0x704], eax
xor dword [ebp - 0x700], eax
add ecx, 4
jmp 0x4081e1
mov eax, dword [ebp - 0x714]
mov eax, dword [edx + eax]
bswap eax
sub eax, dword [ebp - 0x704]
mov dword [ebp - 0x70c], eax
mov eax, dword [ebp - 0x710]
mov eax, dword [edx + eax]
bswap eax
xor eax, dword [ebp - 0x700]
mov dword [ebp - 0x708], eax
mov dword [ebp - 0x704], 0
mov dword [ebp - 0x700], 0
mov ecx, dword [ebp - 0x71c]
cmp ecx, dword [ebp - 0x718]
jae 0x4082a5
cmp ecx, dword [ebp - 0x6f4]
je 0x4082a0
cmp ecx, dword [ebp - 0x6f8]
je 0x4082a0
cmp ecx, dword [ebp - 0x714]
je 0x4082a0
cmp ecx, dword [ebp - 0x710]
je 0x4082a0
mov eax, dword [edi + ecx]
bswap eax
add dword [ebp - 0x704], eax
xor dword [ebp - 0x700], eax
add ecx, 4
jmp 0x408267
mov eax, dword [ebp - 0x704]
add eax, dword [ebp - 0x70c]
bswap eax
mov ecx, dword [ebp - 0x714]
cmp dword [edi + ecx], eax
je 0x4082c9
mov dword [edi + ecx], eax
mov dword [esp + 0x1c], 1
mov eax, dword [ebp - 0x700]
xor eax, dword [ebp - 0x708]
bswap eax
mov ecx, dword [ebp - 0x710]
cmp dword [edi + ecx], eax
je 0x4082ed
mov dword [edi + ecx], eax
mov dword [esp + 0x1c], 1
mov ecx, dword [ebp - 0x6fc]
xor edx, edx
cmp ecx, dword [ebp - 0x6f8]
jae 0x408309
movzx eax, word [edi + ecx]
xchg ah, al
add edx, eax
inc ecx
inc ecx
jmp 0x4082f5
and edx, 0xffff
xchg dh, dl
mov ecx, dword [ebp - 0x6f4]
cmp word [edi + ecx], dx
je 0x408329
mov word [edi + ecx], dx
mov dword [esp + 0x1c], 1
push dword [ebp - 0x6f0]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
popal
test eax, eax
jne 0x40835c
push 0xa0d
push 0x2444494c
push 0x41565f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x14
jmp 0x4083ad
cmp eax, 1
jne 0x408388
push 0xa0d
push 0x24444554
push 0x43455252
push 0x4f435f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x4083ad
push 0xa0d
push 0x24444e55
push 0x4f465f54
push 0x4f4e5f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
cmp dword [esi + 0x270], 0x73696e24
jne 0x408427
cmp dword [esi + 0x274], 0x386e6173
jne 0x408427
cmp dword [esi + 0x278], 0x24325f30
jne 0x408427
cmp dword [esi + 0x27c], 0x63736f42
jne 0x408427
cmp dword [esi + 0x280], 0x44452068
jne 0x408427
cmp dword [esi + 0x284], 0x43373143
jne 0x408427
cmp dword [esi + 0x288], 0x325b3438
jne 0x408427
cmp dword [esi + 0x28c], 0x6b303635
jne 0x408427
cmp dword [esi + 0x290], 0x4143205d
jne 0x408427
cmp word [esi + 0x294], 0x4e
je 0x4084d7
cmp dword [esi + 0x270], 0x73696e24
jne 0x40919a
cmp dword [esi + 0x274], 0x386e6173
jne 0x40919a
cmp dword [esi + 0x278], 0x24325f30
jne 0x40919a
cmp dword [esi + 0x27c], 0x53455428
jne 0x40919a
cmp dword [esi + 0x280], 0x6f422954
jne 0x40919a
cmp dword [esi + 0x284], 0x20686373
jne 0x40919a
cmp dword [esi + 0x288], 0x31434445
jne 0x40919a
cmp dword [esi + 0x28c], 0x34384337
jne 0x40919a
cmp dword [esi + 0x290], 0x3635325b
jne 0x40919a
cmp dword [esi + 0x294], 0x205d6b30
jne 0x40919a
cmp dword [esi + 0x298], 0x4e4143
jne 0x40919a
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xd
jne 0x40919a
mov eax, 3
pushal
mov dword [ebp - 0x42c0], 0
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x20]
cmp ebx, 0x24
jbe 0x4089c0
cmp dword [edi + ebx - 4], 0xcafeaffe
jne 0x4089b8
cmp dword [edi + ebx - 8], 0xfadecafe
jne 0x4089b8
push ebx
xor ecx, ecx
inc ecx
movzx eax, word [edi + ebx - 0x1c]
cmp ebx, 0x3c
jbe 0x40854b
cmp eax, ecx
je 0x40854b
inc ecx
sub ebx, 0x20
cmp dword [edi + ebx - 4], 0xcafeaffe
jne 0x40854b
cmp dword [edi + ebx - 8], 0xfadecafe
je 0x408525
cmp eax, ecx
jne 0x4089b7
movzx eax, word [edi + ebx - 0x1c]
mov dword [ebp - 0x2c0], eax
mov dword [ebp - 0x2bc], 0
mov ecx, dword [ebp - 0x2bc]
cmp ecx, dword [ebp - 0x2c0]
jae 0x4089b4
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
cmp dword [edi + ecx + 8], 0x1000
jne 0x4086ee
mov eax, dword [edi + ecx - 0x10]
mov edx, dword [edi + ecx - 0xc]
cmp eax, 0x80400000
jae 0x4085ab
cmp eax, 0x80000000
jb 0x4085ab
sub eax, 0x80000000
jmp 0x4085e8
cmp eax, 0x80a00000
jae 0x4085c0
cmp eax, 0x80800000
jb 0x4085c0
sub eax, 0x80600000
jmp 0x4085e8
cmp eax, 0x81180000
jae 0x4085d5
cmp eax, 0x81000000
jb 0x4085d5
sub eax, 0x80c00000
jmp 0x4085e8
cmp eax, 0x84380000
jae 0x4085e8
cmp eax, 0x84002000
jb 0x4085e8
sub eax, 0x83c00000
cmp edx, 0x80400000
jae 0x408600
cmp edx, 0x80000000
jb 0x408600
sub edx, 0x80000000
jmp 0x408646
cmp edx, 0x80a00000
jae 0x408618
cmp edx, 0x80800000
jb 0x408618
sub edx, 0x80600000
jmp 0x408646
cmp edx, 0x81180000
jae 0x408630
cmp edx, 0x81000000
jb 0x408630
sub edx, 0x80c00000
jmp 0x408646
cmp edx, 0x84380000
jae 0x408646
cmp edx, 0x84002000
jb 0x408646
sub edx, 0x83c00000
dec edx
and edx, 0xfffffffc
push edx
push eax
push edi
call fcn.004096a7
mov ecx, dword [ebp - 0x2bc]
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
mov ecx, dword [edi + ecx - 0xc]
dec ecx
and ecx, 0xfffffffc
cmp ecx, 0x80400000
jae 0x40867e
cmp ecx, 0x80000000
jb 0x40867e
sub ecx, 0x80000000
jmp 0x4086c4
cmp ecx, 0x80a00000
jae 0x408696
cmp ecx, 0x80800000
jb 0x408696
sub ecx, 0x80600000
jmp 0x4086c4
cmp ecx, 0x81180000
jae 0x4086ae
cmp ecx, 0x81000000
jb 0x4086ae
sub ecx, 0x80c00000
jmp 0x4086c4
cmp ecx, 0x84380000
jae 0x4086c4
cmp ecx, 0x84002000
jb 0x4086c4
sub ecx, 0x83c00000
cmp dword [edi + ecx], eax
jne 0x4086de
cmp dword [esp + 0x20], 3
jne 0x4089a9
mov dword [esp + 0x20], 0
jmp 0x4086e9
mov dword [esp + 0x20], 1
mov dword [edi + ecx], eax
jmp 0x4089a9
cmp dword [edi + ecx + 8], 0x1001
jne 0x40881b
mov eax, dword [edi + ecx - 8]
sub eax, dword [edi + ecx - 4]
mov dword [ebp - 0x2b8], eax
mov edx, dword [edi + ecx - 0xc]
mov ecx, dword [edi + ecx - 0x10]
cmp ecx, 0x80400000
jae 0x40872a
cmp ecx, 0x80000000
jb 0x40872a
sub ecx, 0x80000000
jmp 0x408770
cmp ecx, 0x80a00000
jae 0x408742
cmp ecx, 0x80800000
jb 0x408742
sub ecx, 0x80600000
jmp 0x408770
cmp ecx, 0x81180000
jae 0x40875a
cmp ecx, 0x81000000
jb 0x40875a
sub ecx, 0x80c00000
jmp 0x408770
cmp ecx, 0x84380000
jae 0x408770
cmp ecx, 0x84002000
jb 0x408770
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x408788
cmp edx, 0x80000000
jb 0x408788
sub edx, 0x80000000
jmp 0x4087ce
cmp edx, 0x80a00000
jae 0x4087a0
cmp edx, 0x80800000
jb 0x4087a0
sub edx, 0x80600000
jmp 0x4087ce
cmp edx, 0x81180000
jae 0x4087b8
cmp edx, 0x81000000
jb 0x4087b8
sub edx, 0x80c00000
jmp 0x4087ce
cmp edx, 0x84380000
jae 0x4087ce
cmp edx, 0x84002000
jb 0x4087ce
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
cmp ecx, edx
jae 0x4087e6
mov eax, dword [edi + ecx]
add dword [ebp - 0x2b8], eax
add ecx, 4
jmp 0x4087d4
cmp dword [ebp - 0x2b8], 0
jne 0x408804
cmp dword [esp + 0x20], 3
jne 0x4089a9
mov dword [esp + 0x20], 0
jmp 0x408816
mov dword [esp + 0x20], 1
sub eax, dword [ebp - 0x2b8]
mov dword [edi + edx - 4], eax
jmp 0x4089a9
cmp dword [edi + ecx + 8], 0x1010
jne 0x4089a9
mov eax, dword [edi + ecx - 4]
sub eax, dword [edi + ecx - 8]
mov dword [ebp - 0x2b8], eax
mov edx, dword [edi + ecx - 0xc]
mov ecx, dword [edi + ecx - 0x10]
cmp ecx, 0x80400000
jae 0x408857
cmp ecx, 0x80000000
jb 0x408857
sub ecx, 0x80000000
jmp 0x40889d
cmp ecx, 0x80a00000
jae 0x40886f
cmp ecx, 0x80800000
jb 0x40886f
sub ecx, 0x80600000
jmp 0x40889d
cmp ecx, 0x81180000
jae 0x408887
cmp ecx, 0x81000000
jb 0x408887
sub ecx, 0x80c00000
jmp 0x40889d
cmp ecx, 0x84380000
jae 0x40889d
cmp ecx, 0x84002000
jb 0x40889d
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x4088b5
cmp edx, 0x80000000
jb 0x4088b5
sub edx, 0x80000000
jmp 0x4088fb
cmp edx, 0x80a00000
jae 0x4088cd
cmp edx, 0x80800000
jb 0x4088cd
sub edx, 0x80600000
jmp 0x4088fb
cmp edx, 0x81180000
jae 0x4088e5
cmp edx, 0x81000000
jb 0x4088e5
sub edx, 0x80c00000
jmp 0x4088fb
cmp edx, 0x84380000
jae 0x4088fb
cmp edx, 0x84002000
jb 0x4088fb
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
sub edx, 4
cmp ecx, edx
jae 0x408917
movzx eax, word [edi + ecx]
sub dword [ebp - 0x2b8], eax
add ecx, 2
jmp 0x408904
mov ecx, dword [ebp - 0x2bc]
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
mov ecx, dword [edi + ecx - 0xc]
cmp ecx, 0x80400000
jae 0x40893f
cmp ecx, 0x80000000
jb 0x40893f
sub ecx, 0x80000000
jmp 0x408985
cmp ecx, 0x80a00000
jae 0x408957
cmp ecx, 0x80800000
jb 0x408957
sub ecx, 0x80600000
jmp 0x408985
cmp ecx, 0x81180000
jae 0x40896f
cmp ecx, 0x81000000
jb 0x40896f
sub ecx, 0x80c00000
jmp 0x408985
cmp ecx, 0x84380000
jae 0x408985
cmp ecx, 0x84002000
jb 0x408985
sub ecx, 0x83c00000
add ecx, 3
and ecx, 0xfffffffc
mov eax, dword [edi + ecx - 4]
cmp eax, dword [ebp - 0x2b8]
je 0x4089a9
mov dword [esp + 0x20], 1
mov eax, dword [ebp - 0x2b8]
mov dword [edi + ecx - 4], eax
inc dword [ebp - 0x2bc]
jmp 0x408568
pop eax
jmp 0x4089b8
pop ebx
sub ebx, 4
jmp 0x4084fc
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x218], 0xffffffff
mov dword [ebp - 0x214], 0xffffffff
cmp ebx, 0x24
jbe 0x408c58
mov eax, dword [edi + ebx - 8]
xor eax, 0xffffffff
cmp eax, dword [edi + ebx - 4]
jne 0x408adc
mov eax, dword [edi + ebx - 0x10]
mov ecx, dword [edi + ebx - 0xc]
cmp eax, 0x80400000
jae 0x408a11
cmp eax, 0x80000000
jb 0x408a11
sub eax, 0x80000000
jmp 0x408a4e
cmp eax, 0x80a00000
jae 0x408a26
cmp eax, 0x80800000
jb 0x408a26
sub eax, 0x80600000
jmp 0x408a4e
cmp eax, 0x81180000
jae 0x408a3b
cmp eax, 0x81000000
jb 0x408a3b
sub eax, 0x80c00000
jmp 0x408a4e
cmp eax, 0x84380000
jae 0x408a4e
cmp eax, 0x84002000
jb 0x408a4e
sub eax, 0x83c00000
cmp ecx, 0x80400000
jae 0x408a66
cmp ecx, 0x80000000
jb 0x408a66
sub ecx, 0x80000000
jmp 0x408aac
cmp ecx, 0x80a00000
jae 0x408a7e
cmp ecx, 0x80800000
jb 0x408a7e
sub ecx, 0x80600000
jmp 0x408aac
cmp ecx, 0x81180000
jae 0x408a96
cmp ecx, 0x81000000
jb 0x408a96
sub ecx, 0x80c00000
jmp 0x408aac
cmp ecx, 0x84380000
jae 0x408aac
cmp ecx, 0x84002000
jb 0x408aac
sub ecx, 0x83c00000
add ecx, 3
and ecx, 0xfffffffc
cmp eax, ecx
jae 0x408adc
cmp ecx, dword [esi + 0x14]
jae 0x408adc
mov eax, dword [ebp - 0x214]
sub eax, ebx
cmp eax, 0x10
je 0x408ace
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], ebx
sub ebx, 0x10
jmp 0x4089da
cmp dword [ebp - 0x218], 0xffffffff
je 0x408c50
mov eax, dword [ebp - 0x218]
sub eax, ebx
cmp eax, 0x40
jb 0x408c46
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x218]
ja 0x408c46
mov ecx, dword [edi + eax - 0x10]
mov edx, dword [edi + eax - 0xc]
cmp ecx, 0x80400000
jae 0x408b2c
cmp ecx, 0x80000000
jb 0x408b2c
sub ecx, 0x80000000
jmp 0x408b72
cmp ecx, 0x80a00000
jae 0x408b44
cmp ecx, 0x80800000
jb 0x408b44
sub ecx, 0x80600000
jmp 0x408b72
cmp ecx, 0x81180000
jae 0x408b5c
cmp ecx, 0x81000000
jb 0x408b5c
sub ecx, 0x80c00000
jmp 0x408b72
cmp ecx, 0x84380000
jae 0x408b72
cmp ecx, 0x84002000
jb 0x408b72
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x408b8a
cmp edx, 0x80000000
jb 0x408b8a
sub edx, 0x80000000
jmp 0x408bd0
cmp edx, 0x80a00000
jae 0x408ba2
cmp edx, 0x80800000
jb 0x408ba2
sub edx, 0x80600000
jmp 0x408bd0
cmp edx, 0x81180000
jae 0x408bba
cmp edx, 0x81000000
jb 0x408bba
sub edx, 0x80c00000
jmp 0x408bd0
cmp edx, 0x84380000
jae 0x408bd0
cmp edx, 0x84002000
jb 0x408bd0
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
mov dword [ebp - 0x210], 0
cmp ecx, edx
jae 0x408bf3
movzx eax, word [edi + ecx]
add dword [ebp - 0x210], eax
add ecx, 2
jmp 0x408be0
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x210]
cmp ecx, dword [edi + eax - 8]
je 0x408c1b
cmp dword [edi + eax - 8], 0xcafeaffe
je 0x408c1b
mov dword [esp + 0x20], 1
mov dword [edi + eax - 8], ecx
xor ecx, 0xffffffff
cmp ecx, dword [edi + eax - 4]
je 0x408c3a
cmp dword [edi + eax - 4], 0x35015001
je 0x408c3a
mov dword [esp + 0x20], 1
mov dword [edi + eax - 4], ecx
add dword [ebp - 0x214], 0x10
jmp 0x408afa
mov dword [ebp - 0x218], 0xffffffff
sub ebx, 4
jmp 0x4089da
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x20]
cmp ebx, 0x24
jbe 0x409122
cmp dword [edi + ebx - 4], 0xcafeaffe
jne 0x40911a
cmp dword [edi + ebx - 8], 0xfadecafe
jne 0x40911a
push ebx
xor ecx, ecx
inc ecx
movzx eax, word [edi + ebx - 0x1c]
cmp ebx, 0x3c
jbe 0x408cad
cmp eax, ecx
je 0x408cad
inc ecx
sub ebx, 0x20
cmp dword [edi + ebx - 4], 0xcafeaffe
jne 0x408cad
cmp dword [edi + ebx - 8], 0xfadecafe
je 0x408c87
cmp eax, ecx
jne 0x409119
movzx eax, word [edi + ebx - 0x1c]
mov dword [ebp - 0x2c0], eax
mov dword [ebp - 0x2bc], 0
mov ecx, dword [ebp - 0x2bc]
cmp ecx, dword [ebp - 0x2c0]
jae 0x409116
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
cmp dword [edi + ecx + 8], 0x1000
jne 0x408e50
mov eax, dword [edi + ecx - 0x10]
mov edx, dword [edi + ecx - 0xc]
cmp eax, 0x80400000
jae 0x408d0d
cmp eax, 0x80000000
jb 0x408d0d
sub eax, 0x80000000
jmp 0x408d4a
cmp eax, 0x80a00000
jae 0x408d22
cmp eax, 0x80800000
jb 0x408d22
sub eax, 0x80600000
jmp 0x408d4a
cmp eax, 0x81180000
jae 0x408d37
cmp eax, 0x81000000
jb 0x408d37
sub eax, 0x80c00000
jmp 0x408d4a
cmp eax, 0x84380000
jae 0x408d4a
cmp eax, 0x84002000
jb 0x408d4a
sub eax, 0x83c00000
cmp edx, 0x80400000
jae 0x408d62
cmp edx, 0x80000000
jb 0x408d62
sub edx, 0x80000000
jmp 0x408da8
cmp edx, 0x80a00000
jae 0x408d7a
cmp edx, 0x80800000
jb 0x408d7a
sub edx, 0x80600000
jmp 0x408da8
cmp edx, 0x81180000
jae 0x408d92
cmp edx, 0x81000000
jb 0x408d92
sub edx, 0x80c00000
jmp 0x408da8
cmp edx, 0x84380000
jae 0x408da8
cmp edx, 0x84002000
jb 0x408da8
sub edx, 0x83c00000
dec edx
and edx, 0xfffffffc
push edx
push eax
push edi
call fcn.004096a7
mov ecx, dword [ebp - 0x2bc]
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
mov ecx, dword [edi + ecx - 0xc]
dec ecx
and ecx, 0xfffffffc
cmp ecx, 0x80400000
jae 0x408de0
cmp ecx, 0x80000000
jb 0x408de0
sub ecx, 0x80000000
jmp 0x408e26
cmp ecx, 0x80a00000
jae 0x408df8
cmp ecx, 0x80800000
jb 0x408df8
sub ecx, 0x80600000
jmp 0x408e26
cmp ecx, 0x81180000
jae 0x408e10
cmp ecx, 0x81000000
jb 0x408e10
sub ecx, 0x80c00000
jmp 0x408e26
cmp ecx, 0x84380000
jae 0x408e26
cmp ecx, 0x84002000
jb 0x408e26
sub ecx, 0x83c00000
cmp dword [edi + ecx], eax
jne 0x408e40
cmp dword [esp + 0x20], 3
jne 0x40910b
mov dword [esp + 0x20], 0
jmp 0x408e4b
mov dword [esp + 0x20], 1
mov dword [edi + ecx], eax
jmp 0x40910b
cmp dword [edi + ecx + 8], 0x1001
jne 0x408f7d
mov eax, dword [edi + ecx - 8]
sub eax, dword [edi + ecx - 4]
mov dword [ebp - 0x2b8], eax
mov edx, dword [edi + ecx - 0xc]
mov ecx, dword [edi + ecx - 0x10]
cmp ecx, 0x80400000
jae 0x408e8c
cmp ecx, 0x80000000
jb 0x408e8c
sub ecx, 0x80000000
jmp 0x408ed2
cmp ecx, 0x80a00000
jae 0x408ea4
cmp ecx, 0x80800000
jb 0x408ea4
sub ecx, 0x80600000
jmp 0x408ed2
cmp ecx, 0x81180000
jae 0x408ebc
cmp ecx, 0x81000000
jb 0x408ebc
sub ecx, 0x80c00000
jmp 0x408ed2
cmp ecx, 0x84380000
jae 0x408ed2
cmp ecx, 0x84002000
jb 0x408ed2
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x408eea
cmp edx, 0x80000000
jb 0x408eea
sub edx, 0x80000000
jmp 0x408f30
cmp edx, 0x80a00000
jae 0x408f02
cmp edx, 0x80800000
jb 0x408f02
sub edx, 0x80600000
jmp 0x408f30
cmp edx, 0x81180000
jae 0x408f1a
cmp edx, 0x81000000
jb 0x408f1a
sub edx, 0x80c00000
jmp 0x408f30
cmp edx, 0x84380000
jae 0x408f30
cmp edx, 0x84002000
jb 0x408f30
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
cmp ecx, edx
jae 0x408f48
mov eax, dword [edi + ecx]
add dword [ebp - 0x2b8], eax
add ecx, 4
jmp 0x408f36
cmp dword [ebp - 0x2b8], 0
jne 0x408f66
cmp dword [esp + 0x20], 3
jne 0x40910b
mov dword [esp + 0x20], 0
jmp 0x408f78
mov dword [esp + 0x20], 1
sub eax, dword [ebp - 0x2b8]
mov dword [edi + edx - 4], eax
jmp 0x40910b
cmp dword [edi + ecx + 8], 0x1010
jne 0x40910b
mov eax, dword [edi + ecx - 4]
sub eax, dword [edi + ecx - 8]
mov dword [ebp - 0x2b8], eax
mov edx, dword [edi + ecx - 0xc]
mov ecx, dword [edi + ecx - 0x10]
cmp ecx, 0x80400000
jae 0x408fb9
cmp ecx, 0x80000000
jb 0x408fb9
sub ecx, 0x80000000
jmp 0x408fff
cmp ecx, 0x80a00000
jae 0x408fd1
cmp ecx, 0x80800000
jb 0x408fd1
sub ecx, 0x80600000
jmp 0x408fff
cmp ecx, 0x81180000
jae 0x408fe9
cmp ecx, 0x81000000
jb 0x408fe9
sub ecx, 0x80c00000
jmp 0x408fff
cmp ecx, 0x84380000
jae 0x408fff
cmp ecx, 0x84002000
jb 0x408fff
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x409017
cmp edx, 0x80000000
jb 0x409017
sub edx, 0x80000000
jmp 0x40905d
cmp edx, 0x80a00000
jae 0x40902f
cmp edx, 0x80800000
jb 0x40902f
sub edx, 0x80600000
jmp 0x40905d
cmp edx, 0x81180000
jae 0x409047
cmp edx, 0x81000000
jb 0x409047
sub edx, 0x80c00000
jmp 0x40905d
cmp edx, 0x84380000
jae 0x40905d
cmp edx, 0x84002000
jb 0x40905d
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
sub edx, 4
cmp ecx, edx
jae 0x409079
movzx eax, word [edi + ecx]
sub dword [ebp - 0x2b8], eax
add ecx, 2
jmp 0x409066
mov ecx, dword [ebp - 0x2bc]
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
mov ecx, dword [edi + ecx - 0xc]
cmp ecx, 0x80400000
jae 0x4090a1
cmp ecx, 0x80000000
jb 0x4090a1
sub ecx, 0x80000000
jmp 0x4090e7
cmp ecx, 0x80a00000
jae 0x4090b9
cmp ecx, 0x80800000
jb 0x4090b9
sub ecx, 0x80600000
jmp 0x4090e7
cmp ecx, 0x81180000
jae 0x4090d1
cmp ecx, 0x81000000
jb 0x4090d1
sub ecx, 0x80c00000
jmp 0x4090e7
cmp ecx, 0x84380000
jae 0x4090e7
cmp ecx, 0x84002000
jb 0x4090e7
sub ecx, 0x83c00000
add ecx, 3
and ecx, 0xfffffffc
mov eax, dword [edi + ecx - 4]
cmp eax, dword [ebp - 0x2b8]
je 0x40910b
mov dword [esp + 0x20], 1
mov eax, dword [ebp - 0x2b8]
mov dword [edi + ecx - 4], eax
inc dword [ebp - 0x2bc]
jmp 0x408cca
pop eax
jmp 0x40911a
pop ebx
sub ebx, 4
jmp 0x408c5e
popal
test eax, eax
jne 0x409149
push 0xa0d
push 0x2444494c
push 0x41565f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x14
jmp 0x40919a
cmp eax, 1
jne 0x409175
push 0xa0d
push 0x24444554
push 0x43455252
push 0x4f435f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x40919a
push 0xa0d
push 0x24444e55
push 0x4f465f54
push 0x4f4e5f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0
push 0
push 3
call dword [edi]
cmp dword [ebx + 0x7ac], 0
je 0x4092b5
push 0x3e6c
push 0x6d74682f
push 0x3c3e7964
push 0x6f622f3c
push esp
call dword [ebx + 0x34]
add esp, 0x10
cmp dword [ebx + 0x7ac], 0
je 0x4091e9
push dword [ebx + 0x7ac]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebx + 0x7ac], 0
push 0x7a672e
lea edx, [ebx + 0x6a8]
push edx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push esp
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 4
lea edx, [ebp - 0x20c]
push edx
lea edx, [ebx + 0x6a8]
push edx
call dword [ebx + 0x44]
test eax, eax
je 0x4092b5
lea edx, [ebx + 0x6a8]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea edx, [ebp - 0x20c]
push edx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.shlwapi.dll_PathStripPathA]
push 0x6d6f
push 0x632e7572
push 0x2e636d6d
mov dword [ebp - 4], esp
push 0x706870
push 0x2e747365
push 0x745f6e61
push 0x635f3035
push 0x3868725f
push 0x6e617373
push 0x696e2f74
push 0x7365742f
lea edx, [ebp - 0x108]
push edx
lea edx, [ebp - 0x20c]
push edx
lea edx, [esp + 8]
push edx
push dword [ebp - 4]
call fcn.0040b047
add esp, 0x20
add esp, 0xc
push 0
push esp
push 0x1000001
push 0x40b
push dword [ebx + 0x4c4]
call dword [sym.imp.USER32.DLL_SendMessageW]
add esp, 4
push 0
call dword [ebx + 0x40]
pop edi
leave
ret 8