Function at 0x10049ae4
Capabilities:
Get graphical window text
Get memory capacity
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xae8
push esi
push edi
push 1
lea eax, [ebp - 0xadc]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.10049367
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0xa88]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0xa88]
lea edi, [ebp - 0x858]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x244], 0xfffffffb
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x23c], 7
mov dword [ebp - 0x2a8], 0xe101
mov dword [ebp - 0x9c4], 0x5aba8b03
mov dword [ebp - 0x6c], 0
jmp 0x10049b6a
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x10049b80
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x9c], 0x4800fa7
jmp 0x10049b63
mov dword [ebp - 0x6c], 0
jmp 0x10049b90
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10049ba6
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x86c], 0
jmp 0x10049b89
cmp dword [ebp - 0x260], 0
je 0x10049bcb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9c], 0
je 0x10049bcb
mov dword [ebp - 0x5f0], 1
jmp 0x10049bd2
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x23c]
cmp dword [ebp - 0x5f0], eax
jg 0x10049c02
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9c], 0
jne 0x10049c02
mov eax, 0xba4a
test eax, eax
jne 0x10049c02
and dword [ebp - 0x6dc], 0
jmp 0x10049c0c
mov dword [ebp - 0x6dc], 1
cmp dword [ebp - 0x6dc], 0x81f947f9
jbe 0x10049c24
mov dword [ebp - 0x718], 1
jmp 0x10049c2b
and dword [ebp - 0x718], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp - 0x9bc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp - 0x8f0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x13c], 0
jne 0x10049c7f
mov eax, 0x10b4
test eax, eax
jne 0x10049c7f
and dword [ebp - 0x6e4], 0
jmp 0x10049c89
mov dword [ebp - 0x6e4], 1
mov eax, dword [ebp - 0x23c]
cmp dword [ebp - 0x6e4], eax
je 0x10049ca3
mov dword [ebp - 0x6ec], 1
jmp 0x10049caa
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x23c]
imul eax, dword [ebp - 0x6ec]
add eax, dword [ebp - 0x244]
imul eax, dword [ebp - 0x2a8]
add eax, 0xe883
cmp eax, 0x3e8c
jle 0x10049ce5
cmp dword [ebp - 0x244], 0
je 0x10049ce5
mov dword [ebp - 0x6f4], 1
jmp 0x10049cec
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x6f4], eax
jl 0x10049d06
mov dword [ebp - 0x590], 1
jmp 0x10049d0d
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
add eax, 0x190
je 0x10049d2f
cmp dword [ebp - 0x244], 0
je 0x10049d2f
mov dword [ebp - 0x58c], 1
jmp 0x10049d36
and dword [ebp - 0x58c], 0
cmp dword [ebp - 0x58c], 0
jne 0x10049d4b
mov dword [ebp - 0x2dc], 1
jmp 0x10049d52
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x13c]
imul eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x23c]
cmp dword [ebp - 0x13c], eax
jg 0x10049d7f
mov dword [ebp - 0x594], 1
jmp 0x10049d86
and dword [ebp - 0x594], 0
cmp dword [ebp - 0x594], 0
jl 0x10049d9b
mov dword [ebp - 0x2e4], 1
jmp 0x10049da2
and dword [ebp - 0x2e4], 0
cmp dword [ebp - 0x2e4], 0x5a40
je 0x10049dba
mov dword [ebp - 0x790], 1
jmp 0x10049dc1
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x900], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x86c]
dec eax
mov dword [ebp - 0x59c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x59c]
mov dword [ebp + eax - 0x86c], ecx
mov eax, dword [ebp - 0x244]
imul eax, dword [ebp - 0x59c]
test eax, eax
jne 0x10049e17
cmp dword [ebp - 0x2a8], 0
jne 0x10049e17
and dword [ebp - 0x798], 0
jmp 0x10049e21
mov dword [ebp - 0x798], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp - 0x908], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
imul eax, dword [ebp - 0x260]
sub eax, 0xf861
cmp eax, dword [ebp - 0x2a8]
je 0x10049e61
mov dword [ebp - 0x2ec], 1
jmp 0x10049e68
and dword [ebp - 0x2ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2ec]
mov dword [ebp + eax - 0x9c], ecx
mov dword [ebp - 0x7a0], 3
mov dword [ebp - 0x20], 0
jmp 0x10049e95
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10049eab
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x94], 0x1a9565e0
jmp 0x10049e8e
mov dword [ebp - 0x20], 0
jmp 0x10049ebb
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10049ed1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x95c], 0xfffffffc
jmp 0x10049eb4
mov dword [ebp - 0x20], 0
jmp 0x10049ee1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10049ef7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x110], 0x7e80d68f
jmp 0x10049eda
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x10049f1d
push 0x1314
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x110], 0
jne 0x10049f46
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x94], 0
jne 0x10049f46
and dword [ebp - 0x5a4], 0
jmp 0x10049f50
mov dword [ebp - 0x5a4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x94]
cmp dword [ebp - 0x5a4], eax
jl 0x10049f71
mov dword [ebp - 0x2f4], 1
jmp 0x10049f78
and dword [ebp - 0x2f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x94]
cmp eax, dword [ebp - 0x2f4]
jge 0x10049f99
mov dword [ebp - 0x5ac], 1
jmp 0x10049fa0
and dword [ebp - 0x5ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x110]
imul eax, dword [ebp - 0x5ac]
add eax, 0xd777
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x110]
jg 0x10049fd4
mov dword [ebp - 0x2fc], 1
jmp 0x10049fdb
and dword [ebp - 0x2fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x110]
cmp dword [ebp - 0x2fc], eax
jne 0x10049ffc
mov dword [ebp - 0x2b0], 1
jmp 0x1004a003
and dword [ebp - 0x2b0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2b0]
mov dword [ebp + eax - 0x110], ecx
cmp dword [ebp - 0x2b0], 5
jle 0x1004a02b
mov dword [ebp - 0x304], 1
jmp 0x1004a032
and dword [ebp - 0x304], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x94]
add eax, dword [ebp + ecx - 0x94]
mov dword [ebp - 0x5b4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5b4]
mov dword [ebp + eax - 0x95c], ecx
mov eax, dword [ebp - 0x5b4]
sub eax, dword [ebp - 0x304]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x94]
jge 0x1004a08c
mov dword [ebp - 0x5bc], 1
jmp 0x1004a093
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0x209c
jge 0x1004a0ab
mov dword [ebp - 0x30c], 1
jmp 0x1004a0b2
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0x9b37
je 0x1004a0ca
mov dword [ebp - 0x5c4], 1
jmp 0x1004a0d1
and dword [ebp - 0x5c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x94]
cmp dword [ebp - 0x5c4], eax
jne 0x1004a0f2
mov dword [ebp - 0x314], 1
jmp 0x1004a0f9
and dword [ebp - 0x314], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x94]
cmp dword [ebp - 0x314], eax
jle 0x1004a11a
mov dword [ebp - 0x5cc], 1
jmp 0x1004a121
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x7a0], eax
mov dword [ebp - 0x148], 0xba76aabe
mov dword [ebp - 0x78], 0
jmp 0x1004a147
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x1004a15d
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xa58], 0xffffffff
jmp 0x1004a140
mov dword [ebp - 0x78], 0
jmp 0x1004a16d
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x1004a183
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x89c], 0x27557bc7
jmp 0x1004a166
mov dword [ebp - 0x148], 0
jmp 0x1004a19c
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jg 0x1004a3a2
mov dword [ebp - 0x154], 0x67d92612
mov dword [ebp - 0x228], 0
jmp 0x1004a1cc
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jge 0x1004a1e8
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x704], 0
jmp 0x1004a1bf
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x704], 0
jmp 0x1004a216
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x704]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x704], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x704], 3
jg 0x1004a31f
mov dword [ebp - 0x2b8], 0x7e81
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa58]
mov dword [ebp - 0x910], eax
imul eax, dword [ebp - 0x2b8], 0x7f45
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x704]
sub ecx, dword [ebp - 0x2b8]
cmp eax, ecx
jg 0x1004a274
mov dword [ebp - 0x31c], 1
jmp 0x1004a27b
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x31c], eax
jg 0x1004a295
mov dword [ebp - 0x5d4], 1
jmp 0x1004a29c
and dword [ebp - 0x5d4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa58]
imul eax, dword [ebp - 0x5d4]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x704]
jle 0x1004a2da
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x704], 0
je 0x1004a2da
mov dword [ebp - 0x324], 1
jmp 0x1004a2e1
and dword [ebp - 0x324], 0
cmp dword [ebp - 0x324], 0xca70051e
jbe 0x1004a2f9
mov dword [ebp - 0x5dc], 1
jmp 0x1004a300
and dword [ebp - 0x5dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x704]
mov ecx, dword [ebp - 0x5dc]
mov dword [ebp + eax*4 - 0xa58], ecx
jmp 0x1004a1fb
mov dword [ebp - 0x154], 0
jmp 0x1004a338
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jg 0x1004a39d
mov dword [ebp - 0x918], 0x7045b365
mov dword [ebp - 0x208], 0
jmp 0x1004a364
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jge 0x1004a380
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x920], 0
jmp 0x1004a357
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x89c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x89c], eax
jmp 0x1004a32b
jmp 0x1004a18f
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x15c], 0
jmp 0x1004a3cf
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jge 0x1004a3eb
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x7a8], 0xf1124f01
jmp 0x1004a3c2
mov dword [ebp - 0x118], 0
jmp 0x1004a404
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jg 0x1004a547
mov dword [ebp - 0x58], 0
jmp 0x1004a421
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1004a437
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x1c8], 0x654fddd3
jmp 0x1004a41a
mov dword [ebp - 0x58], 0
jmp 0x1004a447
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1004a45d
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x164], 9
jmp 0x1004a440
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1c8], 0
jmp 0x1004a48b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1c8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c8], 0
jg 0x1004a4dc
mov dword [ebp - 0x128], 0x1449c9fb
mov dword [ebp - 0x128], 0
jmp 0x1004a4be
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x1004a4da
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x7a8], 0xb04800fa
jmp 0x1004a4b1
jmp 0x1004a470
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x164], 0
jmp 0x1004a50a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x164]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x164], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x164], 0
jg 0x1004a542
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x1004a540
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
jmp 0x1004a4ef
jmp 0x1004a3f7
mov dword [ebp - 0x118], 3
mov dword [ebp - 0x18c], 0xfffffffb
mov dword [ebp - 0x174], 9
mov dword [ebp - 0x1cc], 0
jmp 0x1004a57e
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 1
jge 0x1004a59a
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0x2c0], 0x24f01c08
jmp 0x1004a571
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c0], 0
je 0x1004a5d0
mov byte [ebp - 0xd0], 0
movzx eax, byte [ebp - 0xd0]
test eax, eax
je 0x1004a5cb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
jmp 0x1004a878
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0x16c], 0
jmp 0x1004a5fd
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x1004a619
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0xaac], 0xffffffff
jmp 0x1004a5f0
mov dword [ebp - 0xd8], 0
jmp 0x1004a632
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jg 0x1004a878
mov dword [ebp - 0x70], 0x3f467215
mov dword [ebp - 0x1dc], 0x3cc25429
mov dword [ebp - 0x70], 0
jmp 0x1004a660
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x1004a873
mov dword [ebp - 0x344], 0xfffffffc
mov dword [ebp - 0x1d4], 0
jmp 0x1004a68d
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 3
jge 0x1004a6a9
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x8b8], 0x6d238e48
jmp 0x1004a680
mov eax, dword [ebp - 0x70]
cmp dword [ebp + eax*4 - 0x2c0], 0xd4e70302
ja 0x1004a6c5
mov dword [ebp - 0x2bc], 1
jmp 0x1004a6cc
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0x2c0], ecx
cmp dword [ebp - 0x2bc], 0
jne 0x1004a6f1
mov dword [ebp - 0x33c], 1
jmp 0x1004a6f8
and dword [ebp - 0x33c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8b8]
cmp dword [ebp - 0x70], eax
jl 0x1004a715
mov dword [ebp - 0x32c], 1
jmp 0x1004a71c
and dword [ebp - 0x32c], 0
cmp dword [ebp - 0x32c], 8
ja 0x1004a72e
mov eax, 0x3f6a0837
test eax, eax
je 0x1004a735
cmp dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0xd8]
sub eax, dword [ebp - 0x70]
cmp dword [ebp - 0x174], eax
je 0x1004a752
mov dword [ebp - 0x5e4], 1
jmp 0x1004a759
and dword [ebp - 0x5e4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8b8]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1dc]
cmp eax, dword [ebp - 0x5e4]
jl 0x1004a785
mov dword [ebp - 0x814], 1
jmp 0x1004a78c
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x928], eax
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x334], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x334]
mov dword [ebp + eax - 0x8b8], ecx
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x334], eax
jl 0x1004a7d1
mov dword [ebp - 0x5ec], 1
jmp 0x1004a7d8
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x5ec]
imul eax, dword [ebp - 0x33c]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
je 0x1004a80c
cmp dword [ebp - 0x1dc], 0
je 0x1004a80c
mov dword [ebp - 0x5f4], 1
jmp 0x1004a813
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x81c]
cmp dword [ebp - 0x344], eax
jl 0x1004a839
mov dword [ebp - 0x5fc], 1
jmp 0x1004a840
and dword [ebp - 0x5fc], 0
cmp dword [ebp - 0x5fc], 0
jbe 0x1004a855
mov dword [ebp - 0x34c], 1
jmp 0x1004a85c
and dword [ebp - 0x34c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x34c]
mov dword [ebp + eax - 0xaac], ecx
jmp 0x1004a659
jmp 0x1004a625
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x1ec], 7
mov dword [ebp - 0xe0], 0x4a18885c
mov dword [ebp - 0x83c], 0x8390a341
mov dword [ebp - 0x930], 0x797b69e0
mov dword [ebp - 0x17c], 0
jmp 0x1004a8c3
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x1004a8df
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x144], 0x9b3198a8
jmp 0x1004a8b6
mov dword [ebp - 0xe0], 1
jmp 0x1004a8f8
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x1004ac9f
mov dword [ebp - 0x18], 0xfe5f36f6
mov dword [ebp - 0x39c], 0
mov dword [ebp - 0x18], 0
jmp 0x1004a926
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x1004ac9a
mov dword [ebp - 0x60], 5
mov dword [ebp - 0x60], 0
jmp 0x1004a947
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jg 0x1004aba2
mov dword [ebp - 0xa4], 0xffffffff
mov dword [ebp - 0x60c], 0xfffffffb
mov dword [ebp - 0xa4], 0
jmp 0x1004a97e
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jg 0x1004ab9d
mov eax, dword [ebp - 0xe0]
sub eax, 8
mov ecx, dword [ebp - 0x18]
sub eax, dword [ebp + ecx*4 - 0x144]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x144]
jne 0x1004a9b9
mov dword [ebp - 0x604], 1
jmp 0x1004a9c0
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x604], eax
jg 0x1004a9d7
mov dword [ebp - 0x354], 1
jmp 0x1004a9de
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x938], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x940], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x144]
mov dword [ebp - 0x948], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x144]
add eax, dword [ebp - 0x18]
cmp eax, 6
jg 0x1004aa3f
mov dword [ebp - 0x35c], 1
jmp 0x1004aa46
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 0x76bd76df
jle 0x1004aa5e
mov dword [ebp - 0x614], 1
jmp 0x1004aa65
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x614], eax
jg 0x1004aa7c
mov dword [ebp - 0x364], 1
jmp 0x1004aa83
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x144]
cmp eax, dword [ebp - 0x364]
jge 0x1004aaa1
mov dword [ebp - 0x61c], 1
jmp 0x1004aaa8
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x144]
add eax, dword [ebp - 0x61c]
jne 0x1004aac9
cmp dword [ebp - 0x18], 0
jne 0x1004aac9
and dword [ebp - 0x36c], 0
jmp 0x1004aad3
mov dword [ebp - 0x36c], 1
mov eax, dword [ebp - 0x36c]
sub eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x18]
je 0x1004aaf0
mov dword [ebp - 0x624], 1
jmp 0x1004aaf7
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 0xfffffff6
jg 0x1004ab0c
mov dword [ebp - 0x374], 1
jmp 0x1004ab13
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x374], eax
jne 0x1004ab2a
mov dword [ebp - 0x62c], 1
jmp 0x1004ab31
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x144]
add eax, 0xf989
cmp eax, dword [ebp - 0x62c]
jne 0x1004ab5d
cmp dword [ebp - 0xa4], 0
je 0x1004ab5d
mov dword [ebp - 0x37c], 1
jmp 0x1004ab64
and dword [ebp - 0x37c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x144]
cmp dword [ebp - 0x37c], eax
je 0x1004ab85
mov dword [ebp - 0x634], 1
jmp 0x1004ab8c
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x39c], eax
jmp 0x1004a971
jmp 0x1004a940
mov dword [ebp - 0x83c], 0xfffffffc
mov eax, dword [ebp - 0xe0]
cmp dword [ebp + eax*4 - 0x144], 0x633b
jne 0x1004abcb
mov dword [ebp - 0x384], 1
jmp 0x1004abd2
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x384]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x18], eax
je 0x1004abf3
mov dword [ebp - 0x63c], 1
jmp 0x1004abfa
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x144]
imul eax, dword [ebp - 0x63c]
test eax, eax
jne 0x1004ac1f
xor eax, eax
jne 0x1004ac1f
and dword [ebp - 0x38c], 0
jmp 0x1004ac29
mov dword [ebp - 0x38c], 1
cmp dword [ebp - 0x38c], 0xffffffff
je 0x1004ac3e
mov dword [ebp - 0x644], 1
jmp 0x1004ac45
and dword [ebp - 0x644], 0
cmp dword [ebp - 0x644], 0x919d6b80
jne 0x1004ac5d
mov dword [ebp - 0x394], 1
jmp 0x1004ac64
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x144]
cmp eax, dword [ebp - 0x394]
jg 0x1004ac82
mov dword [ebp - 0x64c], 1
jmp 0x1004ac89
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x39c], eax
jmp 0x1004a91f
jmp 0x1004a8eb
mov dword [ebp - 0x2b4], 0xe101
mov dword [ebp - 0x38], 0x81c2900
mov dword [ebp - 0x788], 0
mov dword [ebp - 0x80], 0
jmp 0x1004acca
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1004ace0
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xf0], 0x1713b910
jmp 0x1004acc3
mov dword [ebp - 0x80], 0
jmp 0x1004acf0
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1004ad06
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x884], 9
jmp 0x1004ace9
mov dword [ebp - 0x38], 0
jmp 0x1004ad16
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1004aec0
mov dword [ebp - 0x724], 5
mov dword [ebp - 0x1e4], 0
jmp 0x1004ad43
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x1004ad5f
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x968], 0xca335c22
jmp 0x1004ad36
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xf0]
sub eax, 0x6c7d95fb
jne 0x1004ad86
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xf0], 0
jne 0x1004ad86
and dword [ebp - 0x654], 0
jmp 0x1004ad90
mov dword [ebp - 0x654], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xf0]
add eax, dword [ebp - 0x654]
mov ecx, dword [ebp - 0x38]
cmp eax, dword [ebp + ecx*4 - 0xf0]
jne 0x1004adbd
xor eax, eax
inc eax
je 0x1004adbd
mov dword [ebp - 0x3a4], 1
jmp 0x1004adc4
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xf0]
imul eax, dword [ebp - 0x3a4]
sub eax, 0x1e4e4aae
jne 0x1004adee
mov eax, 0x1162f630
test eax, eax
jne 0x1004adee
and dword [ebp - 0x65c], 0
jmp 0x1004adf8
mov dword [ebp - 0x65c], 1
cmp dword [ebp - 0x65c], 1
jb 0x1004ae13
cmp dword [ebp - 0x788], 0
jne 0x1004ae13
and dword [ebp - 0x26c], 0
jmp 0x1004ae1d
mov dword [ebp - 0x26c], 1
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0xf0], ecx
cmp dword [ebp - 0x26c], 0xb593
jge 0x1004ae45
mov dword [ebp - 0x3ac], 1
jmp 0x1004ae4c
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x724]
cmp dword [ebp - 0x3ac], eax
jge 0x1004ae66
mov dword [ebp - 0x29c], 1
jmp 0x1004ae6d
and dword [ebp - 0x29c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x29c]
mov dword [ebp + eax - 0x968], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x884]
cmp dword [ebp - 0x29c], eax
jle 0x1004aea1
mov dword [ebp - 0x664], 1
jmp 0x1004aea8
and dword [ebp - 0x664], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x664]
mov dword [ebp + eax - 0x884], ecx
jmp 0x1004ad0f
mov dword [ebp - 0x9a0], 0x5aba8b03
mov dword [ebp - 0x184], 0
jmp 0x1004aee3
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jge 0x1004aeff
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x84c], 0xe1757117
jmp 0x1004aed6
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x84c], 0
jmp 0x1004af2d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x84c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x84c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x84c], 0xffffffe7
jl 0x1004af6c
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x1004af6a
push 0
push 0x2698
push 0x1ed5
push 0x1eab
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
jmp 0x1004af12
mov dword [ebp - 0x9a8], 0xffffffff
mov byte [ebp - 0xe2], 0
movzx eax, byte [ebp - 0xe2]
test eax, eax
je 0x1004af9c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1004afc3
push 0x210d
push 0xd0e
push 0xbac
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x68], 0
jmp 0x1004afd3
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x1004afe9
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x8c], 0x4800fa7
jmp 0x1004afcc
mov dword [ebp - 0x68], 0
jmp 0x1004aff9
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1004b00f
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x8a4], 0
jmp 0x1004aff2
mov dword [ebp - 0x2c], 0xd1ad
mov dword [ebp - 0x68c], 0xe64e6dc6
mov dword [ebp - 0x3c4], 0x889a278c
mov dword [ebp - 0x734], 1
mov dword [ebp - 0x4c], 0
jmp 0x1004b044
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1004b05a
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x7d4], 0
jmp 0x1004b03d
mov dword [ebp - 0x4c], 0
jmp 0x1004b06a
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1004b080
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x82c], 0xb8f1
jmp 0x1004b063
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3b4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3b4]
mov dword [ebp + eax - 0x7d4], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x3b4], eax
jge 0x1004b0b3
mov dword [ebp - 0x3d4], 1
jmp 0x1004b0ba
and dword [ebp - 0x3d4], 0
cmp dword [ebp - 0x2c], 0x87a912e7
jne 0x1004b0cf
mov dword [ebp - 0x66c], 1
jmp 0x1004b0d6
and dword [ebp - 0x66c], 0
imul eax, dword [ebp - 0x66c], 0x3196
imul eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jle 0x1004b0f5
mov dword [ebp - 0x3bc], 1
jmp 0x1004b0fc
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x3bc], eax
jge 0x1004b113
mov dword [ebp - 0x72c], 1
jmp 0x1004b11a
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x9b0], eax
cmp dword [ebp - 0x2c], 0x5bed8572
jge 0x1004b138
mov dword [ebp - 0x674], 1
jmp 0x1004b13f
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x674], eax
jge 0x1004b156
mov dword [ebp - 0x67c], 1
jmp 0x1004b15d
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x3c4]
add eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x67c]
jl 0x1004b183
mov dword [ebp - 0x3cc], 1
jmp 0x1004b18a
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x3cc], eax
jne 0x1004b1a1
mov dword [ebp - 0x684], 1
jmp 0x1004b1a8
and dword [ebp - 0x684], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x82c]
cmp dword [ebp - 0x684], eax
jne 0x1004b1c9
mov dword [ebp - 0x3dc], 1
jmp 0x1004b1d0
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x68c], eax
mov eax, dword [ebp - 0x68c]
add eax, dword [ebp - 0x3dc]
cmp eax, 1
jge 0x1004b1f9
mov dword [ebp - 0x694], 1
jmp 0x1004b200
and dword [ebp - 0x694], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x82c]
cmp dword [ebp - 0x694], eax
je 0x1004b221
mov dword [ebp - 0x3e4], 1
jmp 0x1004b228
and dword [ebp - 0x3e4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x82c]
cmp dword [ebp - 0x3e4], eax
jne 0x1004b248
mov dword [ebp - 0x838], 1
jmp 0x1004b24f
and dword [ebp - 0x838], 0
cmp dword [ebp - 0x2c], 0
jne 0x1004b26e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x82c], 0
jne 0x1004b26e
and dword [ebp - 0x69c], 0
jmp 0x1004b278
mov dword [ebp - 0x69c], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x82c]
cmp dword [ebp - 0x69c], eax
jne 0x1004b298
mov dword [ebp - 0x3ec], 1
jmp 0x1004b29f
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x274], 0
je 0x1004b2d0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8c], 0
je 0x1004b2d0
mov dword [ebp - 0x6a4], 1
jmp 0x1004b2d7
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x6a4], eax
jg 0x1004b307
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8c], 0
jne 0x1004b307
mov eax, 0xba4a
test eax, eax
jne 0x1004b307
and dword [ebp - 0x3f4], 0
jmp 0x1004b311
mov dword [ebp - 0x3f4], 1
cmp dword [ebp - 0x3f4], 0x81f947f9
jbe 0x1004b329
mov dword [ebp - 0x7dc], 1
jmp 0x1004b330
and dword [ebp - 0x7dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
mov dword [ebp - 0x9b8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
mov dword [ebp - 0x9c0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
mov dword [ebp - 0x9c8], eax
cmp dword [ebp - 0x108], 0
jne 0x1004b384
mov eax, 0x10b4
test eax, eax
jne 0x1004b384
and dword [ebp - 0x6ac], 0
jmp 0x1004b38e
mov dword [ebp - 0x6ac], 1
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x6ac], eax
je 0x1004b3a8
mov dword [ebp - 0x3fc], 1
jmp 0x1004b3af
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x1ec]
imul eax, dword [ebp - 0x3fc]
add eax, dword [ebp - 0x18c]
imul eax, dword [ebp - 0x2b4]
add eax, 0xe883
cmp eax, 0x3e8c
jle 0x1004b3ea
cmp dword [ebp - 0x18c], 0
je 0x1004b3ea
mov dword [ebp - 0x6b4], 1
jmp 0x1004b3f1
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x6b4], eax
jl 0x1004b40b
mov dword [ebp - 0x404], 1
jmp 0x1004b412
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
add eax, 0x190
je 0x1004b434
cmp dword [ebp - 0x18c], 0
je 0x1004b434
mov dword [ebp - 0x6bc], 1
jmp 0x1004b43b
and dword [ebp - 0x6bc], 0
cmp dword [ebp - 0x6bc], 0
jne 0x1004b450
mov dword [ebp - 0x40c], 1
jmp 0x1004b457
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x108]
imul eax, dword [ebp - 0x40c]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x108], eax
jg 0x1004b484
mov dword [ebp - 0x6c4], 1
jmp 0x1004b48b
and dword [ebp - 0x6c4], 0
cmp dword [ebp - 0x6c4], 0
jl 0x1004b4a0
mov dword [ebp - 0x414], 1
jmp 0x1004b4a7
and dword [ebp - 0x414], 0
cmp dword [ebp - 0x414], 0x5a40
je 0x1004b4bf
mov dword [ebp - 0x73c], 1
jmp 0x1004b4c6
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x9d0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8a4]
dec eax
mov dword [ebp - 0x6cc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6cc]
mov dword [ebp + eax - 0x8a4], ecx
mov eax, dword [ebp - 0x18c]
imul eax, dword [ebp - 0x6cc]
test eax, eax
jne 0x1004b51c
cmp dword [ebp - 0x2b4], 0
jne 0x1004b51c
and dword [ebp - 0x818], 0
jmp 0x1004b526
mov dword [ebp - 0x818], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
mov dword [ebp - 0x9d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
imul eax, dword [ebp - 0x274]
sub eax, 0xf861
cmp eax, dword [ebp - 0x2b4]
je 0x1004b566
mov dword [ebp - 0x6d4], 1
jmp 0x1004b56d
and dword [ebp - 0x6d4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6d4]
mov dword [ebp + eax - 0x8c], ecx
mov dword [ebp - 0x1f4], 0xdd9cd443
mov dword [ebp - 0x428], 0xffffffff
mov dword [ebp - 0x744], 0xb6eab3cf
mov dword [ebp - 0x27c], 9
mov dword [ebp - 0x2a4], 0xfffffffb
mov dword [ebp - 0x7e4], 0x6282
mov dword [ebp - 0x7cc], 0x28abf8b2
mov dword [ebp - 0x7c8], 0x28abf8b2
mov dword [ebp - 0x7c4], 0x28abf8b2
mov dword [ebp - 0x7c0], 0x28abf8b2
mov dword [ebp - 0x840], 0xfffffffd
mov dword [ebp - 0x28], 0
jmp 0x1004b5fe
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1004b614
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x2cc], 0
jmp 0x1004b5f7
mov dword [ebp - 0x28], 0
jmp 0x1004b624
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1004b63a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x8d0], 0
jmp 0x1004b61d
mov dword [ebp - 0x28], 0
jmp 0x1004b64a
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1004b660
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x874], 0x6a37d7c8
jmp 0x1004b643
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2cc], 0x1ad386cc
jg 0x1004b67f
mov dword [ebp - 0x440], 1
jmp 0x1004b686
and dword [ebp - 0x440], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2cc], 0
je 0x1004b6fe
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x420], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x420]
mov dword [ebp + eax - 0x8d0], ecx
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 0x1f4]
inc ecx
mov dword [ebp - 0x1f4], ecx
test eax, eax
je 0x1004b6d9
mov eax, dword [ebp - 0x1f4]
sub eax, 0xfa01
jne 0x1004b6f2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8d0], 0
jne 0x1004b6f2
mov eax, 0xb445acee
test eax, eax
je 0x1004b6fe
mov dword [ebp - 0x6a8], 1
jmp 0x1004b705
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x744]
cmp dword [ebp - 0x428], eax
jl 0x1004b72b
mov dword [ebp - 0x598], 1
jmp 0x1004b732
and dword [ebp - 0x598], 0
cmp dword [ebp - 0x598], 0x320f
je 0x1004b74a
mov dword [ebp - 0x430], 1
jmp 0x1004b751
and dword [ebp - 0x430], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2cc]
cmp dword [ebp - 0x430], eax
jne 0x1004b772
mov dword [ebp - 0x650], 1
jmp 0x1004b779
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x27c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2cc]
sub eax, dword [ebp - 0x27c]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x438], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x438]
mov dword [ebp + eax - 0x874], ecx
cmp dword [ebp - 0x438], 0
jne 0x1004b7d2
mov dword [ebp - 0x5a0], 1
jmp 0x1004b7d9
and dword [ebp - 0x5a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2cc]
add eax, dword [ebp - 0x5a0]
mov ecx, dword [ebp - 0x440]
sub ecx, eax
cmp ecx, dword [ebp - 0x7e4]
jg 0x1004b808
mov dword [ebp - 0x6d8], 1
jmp 0x1004b80f
and dword [ebp - 0x6d8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6d8]
mov dword [ebp + eax - 0x7cc], ecx
cmp dword [ebp - 0x27c], 0x6d4f509e
je 0x1004b83a
mov dword [ebp - 0x448], 1
jmp 0x1004b841
and dword [ebp - 0x448], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7cc]
cmp dword [ebp - 0x448], eax
jg 0x1004b862
mov dword [ebp - 0x5a8], 1
jmp 0x1004b869
and dword [ebp - 0x5a8], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x8d0]
add ecx, dword [ebp - 0x5a8]
push 4
pop edx
shl edx, 0
mov edx, dword [ebp + edx - 0x7cc]
lea ecx, [ecx + edx - 0xbf8d6c4]
cmp dword [ebp + eax - 0x2cc], ecx
jle 0x1004b8ab
mov dword [ebp - 0x450], 1
jmp 0x1004b8b2
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
add eax, 0x7b18
je 0x1004b8d2
push 4
pop eax
test eax, eax
je 0x1004b8d2
mov dword [ebp - 0x74c], 1
jmp 0x1004b8d9
and dword [ebp - 0x74c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x874]
mov dword [ebp - 0x9e0], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x7cc], 0xaf2c
mov eax, 0xaf2c
cmp eax, 0xfffffffb
jge 0x1004b913
mov dword [ebp - 0x658], 1
jmp 0x1004b91a
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x840]
cmp dword [ebp - 0x658], eax
jl 0x1004b934
mov dword [ebp - 0x458], 1
jmp 0x1004b93b
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x204], 9
mov dword [ebp - 0x194], 0
jmp 0x1004b96a
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jge 0x1004b986
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x284], 0x24f01c08
jmp 0x1004b95d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x284], 0
je 0x1004b9bc
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1004b9b7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
jmp 0x1004bc64
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0x7ec], 0
mov dword [ebp - 0x1fc], 0
jmp 0x1004b9e9
cmp dword [ebp - 0x1fc], 3
jge 0x1004ba05