Function at 0x403660
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13884
call fcn.0052fa10
push esi
push edi
mov dword [ebp - 0x3048], 0xe1a
mov eax, dword [ebp - 0x3048]
mov dword [ebp - 0x304c], eax
cmp dword [ebp - 0x304c], 0xe1a
je 0x403696
jmp 0x515d30
mov byte [ebp - 1], 0x51
mov cl, byte [ebp - 1]
mov byte [ebp - 2], cl
mov dword [ebp - 0x3050], 0x4081
mov edx, dword [ebp - 0x3048]
mov dword [ebp - 0x3054], edx
mov byte [ebp - 3], 7
mov eax, dword [ebp - 0x3054]
mov dword [ebp - 0x3058], eax
mov cl, byte [ebp - 2]
mov byte [ebp - 0x305c], cl
cmp byte [ebp - 0x305c], 0x51
je 0x4036da
jmp 0x403730
movzx edx, byte [ebp - 3]
cmp edx, 0x7b
jge 0x403726
mov al, byte [ebp - 3]
mov byte [ebp - 4], al
lea ecx, [ebp - 0x3058]
mov dword [ebp - 0x3060], ecx
mov dword [ebp - 0x3064], 0x5bf8
mov edx, dword [ebp - 0x3060]
mov eax, dword [edx]
xor eax, dword [ebp - 0x3058]
mov dword [ebp - 0x3054], eax
movzx ecx, word [0x56a028]
shl ecx, 0xa
mov word [0x56a028], cx
jmp 0x40372e
mov cl, byte [ebp - 2]
call fcn.00515e10
jmp 0x403765
mov edx, dword [ebp - 0x3048]
add edx, dword [ebp - 0x3058]
mov eax, dword [ebp - 0x3060]
mov dword [eax], edx
lea ecx, [ebp - 0x3068]
push ecx
mov edx, dword [ebp - 0x306c]
push edx
mov eax, dword [ebp - 0x3070]
push eax
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x3068], eax
mov cx, word [0x56a028]
mov word [ebp - 0x3074], cx
mov edx, dword [ebp - 0x3064]
mov dword [ebp - 0x3078], edx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [eax]
mov dword [ebp - 0x307c], ecx
mov edx, 0x39
mov word [ebp - 0x9bc], dx
mov dword [ebp - 0x3080], 0x650a
mov eax, dword [ebp - 0x3080]
add eax, 0x4b
mov dword [ebp - 0x3080], eax
movsx ecx, byte [ebp - 2]
sub ecx, 0x59
mov byte [ebp - 1], cl
movzx edx, word [0x56a028]
and edx, 0x557
mov word [ebp - 0x3074], dx
movzx eax, byte [ebp - 4]
add eax, 0xc7
mov byte [ebp - 3], al
movzx ecx, word [ebp - 0x3074]
sub ecx, 0x8b2
mov word [0x56a028], cx
mov edx, dword [ebp - 0x3060]
mov eax, dword [edx]
add eax, dword [ebp - 0x3054]
mov ecx, dword [ebp - 0x3060]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3060]
mov eax, dword [edx]
sub eax, dword [ebp - 0x307c]
mov dword [ebp - 0x3048], eax
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3058]
sar edx, cl
mov eax, dword [ebp - 0x3060]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3054]
xor ecx, dword [ebp - 0x3058]
mov dword [ebp - 0x3048], ecx
mov edx, dword [ebp - 0x307c]
mov ecx, dword [ebp - 0x3058]
shl edx, cl
mov eax, dword [ebp - 0x3060]
mov dword [eax], edx
movzx ecx, byte [ebp - 3]
or ecx, 0xce
mov byte [ebp - 4], cl
mov edx, dword [ebp - 0x3054]
and edx, dword [ebp - 0x3048]
mov dword [ebp - 0x3058], edx
mov eax, dword [ebp - 0x3064]
add eax, 0xcb67
mov dword [ebp - 0x3078], eax
mov ecx, dword [ebp - 0x3054]
sub ecx, dword [ebp - 0x3048]
mov edx, dword [ebp - 0x3060]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [ebp - 0x3058]
sub ecx, dword [eax]
mov dword [ebp - 0x307c], ecx
movzx edx, word [0x56a028]
add edx, 0x3c7
mov word [ebp - 0x3074], dx
mov eax, dword [ebp - 0x3054]
and eax, dword [ebp - 0x307c]
mov ecx, dword [ebp - 0x3060]
mov dword [ecx], eax
movsx edx, word [ebp - 0x9bc]
sub edx, 0x57b
mov word [ebp - 0x9bc], dx
movsx eax, byte [ebp - 1]
add eax, 0x63
mov byte [ebp - 2], al
mov ecx, dword [ebp - 0x3078]
add ecx, 0xd581
mov dword [ebp - 0x3064], ecx
mov edx, dword [ebp - 0x3060]
mov eax, dword [ebp - 0x3054]
sub eax, dword [edx]
mov dword [ebp - 0x307c], eax
movzx ecx, word [0x56a028]
sar ecx, 5
mov word [ebp - 0x3074], cx
movzx edx, word [ebp - 0x3074]
or edx, 0xd87
mov word [0x56a028], dx
cmp dword [ebp - 0x3080], 0x71a3
jbe 0x4037a3
movzx eax, word [0x56a028]
xor eax, 0xe2b
movzx ecx, word [ebp - 0x3074]
cmp eax, ecx
jne 0x40397e
mov edx, dword [ebp - 0x3078]
and edx, 0xf322
mov dword [ebp - 0x3064], edx
jmp 0x4039b4
mov eax, dword [ebp - 0x3060]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x307c]
mov dword [ebp - 0x3054], ecx
mov edx, dword [ebp - 0x3054]
mov dword [ebp - 0x3084], edx
mov dword [ebp - 0x3088], 0x4a44
mov eax, dword [ebp - 0x3078]
mov dword [ebp - 0x308c], eax
mov cx, word [ebp - 0x3074]
mov word [ebp - 0x3090], cx
mov dl, byte [ebp - 3]
mov byte [ebp - 5], dl
mov eax, dword [ebp - 0x3060]
mov ecx, dword [ebp - 0x307c]
sub ecx, dword [eax]
mov dword [ebp - 0x3058], ecx
lea edx, [ebp - 0x3084]
mov dword [ebp - 0x3094], edx
mov eax, dword [ebp - 0x3084]
mov dword [0x56baf4], eax
lea ecx, [ebp - 0x308c]
mov dword [ebp - 0x3098], ecx
lea edx, [ebp - 0x3058]
mov dword [ebp - 0x309c], edx
mov eax, dword [0x56baf4]
mov dword [ebp - 0x30a0], eax
mov cl, byte [ebp - 2]
mov byte [ebp - 6], cl
mov dword [ebp - 0x30a4], 0x3694
movsx edx, word [ebp - 0x9bc]
cmp edx, 0x70
jne 0x403a44
movzx eax, word [ebp - 0x3074]
push eax
call fcn.005160f0
add esp, 4
jmp 0x403abe
mov cx, word [ebp - 0x9bc]
mov word [ebp - 0x9c0], cx
mov edx, dword [ebp - 0x3060]
mov eax, dword [edx]
mov dword [ebp - 0x30a8], eax
cmp dword [ebp - 0x30a8], 0
je 0x403a6b
jmp 0x403a9e
mov cx, word [ebp - 0x3074]
mov word [ebp - 0x9c4], cx
mov dword [ebp - 0x30ac], 0xe990
movzx edx, byte [ebp - 3]
movzx eax, byte [ebp - 5]
add edx, eax
mov byte [ebp - 4], dl
lea ecx, [ebp - 0x308c]
mov dword [ebp - 0x30b0], ecx
jmp 0x403ab4
mov edx, dword [ebp - 0x309c]
mov eax, dword [ebp - 0x3048]
and eax, dword [edx]
mov ecx, dword [ebp - 0x3094]
mov dword [ecx], eax
mov dword [ebp - 0x30b4], 0x1cf6
movzx edx, word [ebp - 0x3090]
mov dword [ebp - 0x30b8], edx
cmp dword [ebp - 0x30b8], 0xa20
je 0x403adc
jmp 0x403b8f
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
sub eax, ecx
mov byte [ebp - 5], al
lea edx, [ebp - 0x308c]
push edx
mov eax, dword [ebp - 0x30bc]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [ebp - 0x30c0], eax
mov cl, byte [ebp - 4]
mov byte [ebp - 0x30c4], cl
cmp byte [ebp - 0x30c4], 0x97
je 0x403b77
cmp byte [ebp - 0x30c4], 0x9e
je 0x403b20
jmp 0x403b8d
movsx edx, word [ebp - 0x9bc]
sub edx, 0x7f3
movsx eax, word [ebp - 0x9c0]
cmp edx, eax
jg 0x403b4e
mov ecx, dword [ebp - 0x30b0]
mov edx, dword [ebp - 0x308c]
add edx, dword [ecx]
mov eax, dword [ebp - 0x3098]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ebp - 0x3078]
mov ecx, dword [ecx]
shl edx, cl
mov dword [ebp - 0x3064], edx
mov eax, dword [ebp - 0x3078]
push eax
movzx ecx, byte [ebp - 1]
push ecx
call fcn.00516150
jmp 0x403b8d
mov edx, dword [ebp - 0x3094]
mov eax, dword [ebp - 0x309c]
mov ecx, dword [edx]
xor ecx, dword [eax]
mov dword [ebp - 0x3054], ecx
jmp 0x403c0a
movzx edx, word [0x56a028]
movzx ecx, word [ebp - 0x3074]
sar edx, cl
movzx eax, word [ebp - 0x9c4]
movzx ecx, word [ebp - 0x3090]
or eax, ecx
cmp edx, eax
jne 0x403bda
movzx edx, word [ebp - 0x9bc]
push edx
movzx eax, word [ebp - 0x9c0]
push eax
movzx ecx, byte [ebp - 5]
push ecx
movzx edx, word [ebp - 0x9bc]
push edx
call fcn.00516820
add esp, 0x10
jmp 0x403c0a
movzx eax, byte [ebp - 5]
movzx ecx, byte [ebp - 4]
and eax, ecx
movzx edx, byte [ebp - 3]
cmp eax, edx
je 0x403c0a
mov eax, dword [ebp - 0x309c]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x3054]
mov dword [ebp - 0x3084], ecx
mov dword [ebp - 0x30c8], 0xcd2b
mov edx, dword [ebp - 0x30b0]
mov eax, dword [edx]
mov dword [ebp - 0x30cc], eax
movzx ecx, word [ebp - 0x9c4]
movzx edx, word [ebp - 0x3074]
add ecx, edx
mov word [ebp - 0x3090], cx
movzx eax, word [ebp - 0x3090]
mov dword [ebp - 0x30d0], eax
cmp dword [ebp - 0x30d0], 0x1ec
je 0x403c4a
jmp 0x403cba
movsx ecx, byte [ebp - 6]
movsx edx, byte [ebp - 1]
sub ecx, edx
movsx eax, byte [ebp - 2]
cmp ecx, eax
je 0x403ca2
lea ecx, [ebp - 0x30cc]
push ecx
mov edx, dword [ebp - 0x30bc]
push edx
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [ebp - 0x30d4], eax
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [ebp - 0x308c]
add ecx, dword [eax]
mov edx, dword [ebp - 0x3098]
mov dword [edx], ecx
mov eax, dword [ebp - 0x309c]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x3084]
mov dword [0x56baf4], ecx
jmp 0x403cb8
mov edx, dword [ebp - 0x3094]
mov eax, dword [ebp - 0x3058]
add eax, dword [edx]
mov ecx, dword [ebp - 0x309c]
mov dword [ecx], eax
jmp 0x403d24
mov edx, dword [ebp - 0x30b0]
mov eax, dword [edx]
mov dword [ebp - 0x30d8], eax
cmp dword [ebp - 0x30d8], 0x2f5
je 0x403d10
cmp dword [ebp - 0x30d8], 0x472e57
je 0x403ce2
jmp 0x403d24
lea ecx, [ebp - 6]
mov dword [ebp - 0x30dc], ecx
mov dx, word [ebp - 0x9bc]
mov word [ebp - 0x9c8], dx
lea eax, [ebp - 3]
mov dword [ebp - 0x30e0], eax
lea ecx, [ebp - 0x9c4]
mov dword [ebp - 0x30e4], ecx
jmp 0x403d24
mov edx, dword [ebp - 0x3098]
mov eax, dword [edx]
or eax, dword [ebp - 0x3064]
mov dword [ebp - 0x30cc], eax
lea ecx, [ebp - 0x308c]
mov dword [ebp - 0x30e8], ecx
movsx edx, word [ebp - 0x9c8]
mov dword [ebp - 0x30ec], edx
cmp dword [ebp - 0x30ec], 0x295
je 0x403d4b
jmp 0x403db4
push 0xa4
push 0x76
push 0x17
mov eax, dword [ebp - 0x30f0]
push eax
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0x30f4], eax
mov cl, byte [ebp - 6]
mov byte [ebp - 0x30f8], cl
cmp byte [ebp - 0x30f8], 0
je 0x403d83
cmp byte [ebp - 0x30f8], 0x35
je 0x403d97
jmp 0x403daf
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
push eax
call fcn.005160f0
add esp, 4
jmp 0x403daf
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x3054]
mov ecx, dword [ecx]
sar edx, cl
mov eax, dword [ebp - 0x3094]
mov dword [eax], edx
jmp 0x403e40
mov ecx, dword [0x56baf4]
mov dword [ebp - 0x30fc], ecx
cmp dword [ebp - 0x30fc], 0x486a
je 0x403dda
cmp dword [ebp - 0x30fc], 0x5e22
je 0x403e1f
jmp 0x403e36
mov edx, dword [ebp - 0x309c]
mov eax, dword [edx]
xor eax, dword [ebp - 0x30a0]
mov dword [0x56baf4], eax
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x3058]
mov ecx, dword [ecx]
shl edx, cl
mov dword [ebp - 0x3054], edx
lea eax, [ebp - 0x3100]
push eax
mov ecx, dword [ebp - 0x3104]
push ecx
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [ebp - 0x30d4], eax
jmp 0x403e36
mov edx, dword [ebp - 0x30e0]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 3]
sub eax, ecx
mov edx, dword [ebp - 0x30e0]
mov byte [edx], al
mov dword [ebp - 0x3108], 0x52b3
cmp dword [ebp - 0x30c8], 0xc485
jb 0x4041a0
movzx eax, word [ebp - 0x9c4]
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
and eax, edx
mov word [ebp - 0x3074], ax
mov eax, dword [ebp - 0x30e8]
mov ecx, dword [ebp - 0x3098]
mov edx, dword [eax]
add edx, dword [ecx]
mov eax, dword [ebp - 0x30b0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x3054]
mov dword [ebp - 0x3048], edx
mov eax, dword [ebp - 0x3094]
mov ecx, dword [eax]
add ecx, dword [0x56baf4]
mov dword [ebp - 0x30a0], ecx
mov edx, dword [ebp - 0x308c]
sub edx, dword [ebp - 0x3064]
mov dword [ebp - 0x30cc], edx
movzx eax, byte [ebp - 3]
mov ecx, dword [ebp - 0x30e0]
movzx edx, byte [ecx]
add eax, edx
mov byte [ebp - 4], al
movzx eax, word [ebp - 0x9c4]
movzx ecx, word [ebp - 0x3090]
sub eax, ecx
mov edx, dword [ebp - 0x30e4]
mov word [edx], ax
mov eax, dword [ebp - 0x30a0]
add eax, dword [ebp - 0x3084]
mov dword [0x56baf4], eax
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
movsx eax, byte [ebp - 2]
and edx, eax
mov byte [ebp - 1], dl
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x308c]
shr edx, cl
mov dword [ebp - 0x3078], edx
mov eax, dword [ebp - 0x3094]
mov edx, dword [eax]
mov ecx, dword [0x56baf4]
shl edx, cl
mov eax, dword [ebp - 0x3060]
mov dword [eax], edx
mov ecx, dword [ebp - 0x30e0]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
or edx, eax
mov byte [ebp - 3], dl
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x3090]
xor edx, eax
mov word [ebp - 0x9c4], dx
mov ecx, dword [ebp - 0x3048]
sub ecx, dword [ebp - 0x3058]
mov edx, dword [ebp - 0x309c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x30cc]
mov edx, dword [ebp - 0x30e8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x309c]
mov ecx, dword [ebp - 0x3094]
mov edx, dword [eax]
and edx, dword [ecx]
mov dword [ebp - 0x3058], edx
mov eax, dword [ebp - 0x3094]
mov ecx, dword [ebp - 0x3060]
mov edx, dword [eax]
add edx, dword [ecx]
mov eax, dword [ebp - 0x3094]
mov dword [eax], edx
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x3090]
add edx, eax
mov word [ebp - 0x9c4], dx
mov ecx, dword [ebp - 0x30e0]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 4]
sub edx, eax
mov ecx, dword [ebp - 0x30e0]
mov byte [ecx], dl
mov edx, dword [ebp - 0x30cc]
sub edx, dword [ebp - 0x308c]
mov dword [ebp - 0x3078], edx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x3084]
mov dword [ebp - 0x3054], ecx
mov edx, dword [ebp - 0x3054]
sub edx, dword [ebp - 0x3058]
mov dword [ebp - 0x307c], edx
mov eax, dword [ebp - 0x3094]
mov ecx, dword [ebp - 0x30a0]
add ecx, dword [eax]
mov dword [ebp - 0x3058], ecx
mov edx, dword [ebp - 0x3094]
mov eax, dword [ebp - 0x309c]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [ebp - 0x3054], ecx
movsx edx, word [ebp - 0x9c0]
movsx ecx, word [ebp - 0x9bc]
sar edx, cl
mov word [ebp - 0x9c8], dx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [ebp - 0x309c]
mov edx, dword [eax]
or edx, dword [ecx]
mov dword [0x56baf4], edx
movzx eax, word [ebp - 0x3090]
movzx ecx, word [ebp - 0x9c4]
xor eax, ecx
mov edx, dword [ebp - 0x30e4]
mov word [edx], ax
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 5]
shl eax, cl
mov ecx, dword [ebp - 0x30e0]
mov byte [ecx], al
mov edx, dword [ebp - 0x30c8]
sub edx, 0x36
mov dword [ebp - 0x30c8], edx
mov eax, dword [ebp - 0x30e8]
mov ecx, dword [ebp - 0x30b0]
mov edx, dword [eax]
and edx, dword [ecx]
mov eax, dword [ebp - 0x30e8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3064]
sub ecx, dword [ebp - 0x3078]
mov edx, dword [ebp - 0x30e8]
mov dword [edx], ecx
movzx eax, word [ebp - 0x3090]
movzx ecx, word [ebp - 0x9c4]
sub eax, ecx
mov edx, dword [ebp - 0x30e4]
mov word [edx], ax
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
and eax, ecx
mov edx, dword [ebp - 0x30e0]
mov byte [edx], al
mov eax, dword [ebp - 0x3060]
mov ecx, dword [ebp - 0x3058]
add ecx, dword [eax]
mov dword [ebp - 0x3084], ecx
mov edx, dword [ebp - 0x3078]
sub edx, dword [ebp - 0x3064]
mov dword [ebp - 0x308c], edx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x3054]
mov edx, dword [ebp - 0x309c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [ebp - 0x3094]
mov edx, dword [eax]
add edx, dword [ecx]
mov dword [ebp - 0x307c], edx
movzx eax, word [ebp - 0x3090]
movzx ecx, word [ebp - 0x3074]
sub eax, ecx
mov edx, dword [ebp - 0x30e4]
mov word [edx], ax
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
shl eax, cl
mov ecx, dword [ebp - 0x30e0]
mov byte [ecx], al
mov edx, dword [ebp - 0x30b0]
mov eax, dword [ebp - 0x30cc]
or eax, dword [edx]
mov dword [ebp - 0x3064], eax
jmp 0x403e40
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ecx]
mov dword [ebp - 0x310c], edx
movsx eax, word [ebp - 0x9bc]
mov dword [ebp - 0x3110], eax
cmp dword [ebp - 0x3110], 0xd6
je 0x40424c
cmp dword [ebp - 0x3110], 0x1ce
je 0x4041dc
jmp 0x404295
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
movsx eax, byte [ebp - 2]
xor edx, eax
mov byte [ebp - 6], dl
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3084]
sar edx, cl
mov eax, dword [ebp - 0x309c]
mov dword [eax], edx
lea ecx, [ebp - 0x9c4]
push ecx
push fcn.005160f0
mov edx, dword [ebp - 0x3114]
push edx
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [ebp - 0x3118], eax
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
and eax, ecx
mov byte [ebp - 5], al
movzx edx, word [ebp - 0x3090]
movzx eax, word [ebp - 0x9c4]
sub edx, eax
mov ecx, dword [ebp - 0x30e4]
mov word [ecx], dx
jmp 0x404295
mov edx, dword [ebp - 0x3098]
mov eax, dword [ebp - 0x30e8]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [ebp - 0x3064], ecx
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
push eax
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
push edx
mov eax, dword [ebp - 0x3098]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x3078]
push edx
mov eax, dword [ebp - 0x3064]
push eax
call fcn.00516630
add esp, 0x14
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ecx]
add edx, dword [0x56baf4]
mov eax, dword [ebp - 0x3094]
mov dword [eax], edx
movsx ecx, word [ebp - 0x9c8]
mov dword [ebp - 0x311c], ecx
cmp dword [ebp - 0x311c], 0xc3
je 0x4042fe
cmp dword [ebp - 0x311c], 0xc6
je 0x4042d2
jmp 0x404310
mov edx, dword [ebp - 0x30dc]
movzx eax, byte [edx]
push eax
mov ecx, dword [ebp - 0x307c]
push ecx
movzx edx, word [ebp - 0x9c0]
push edx
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [eax]
push ecx
call fcn.00517510
add esp, 0x10
jmp 0x404310
mov edx, dword [ebp - 0x3084]
sub edx, dword [ebp - 0x3058]
mov dword [ebp - 0x3048], edx
mov eax, dword [ebp - 0x30cc]
and eax, dword [ebp - 0x3064]
mov ecx, dword [ebp - 0x30e8]
mov dword [ecx], eax
lea edx, [ebp - 0x310c]
mov dword [ebp - 0x3120], edx
movzx eax, byte [ebp - 5]
movzx ecx, byte [ebp - 4]
sub eax, ecx
mov byte [ebp - 3], al
mov edx, dword [ebp - 0x30b0]
mov eax, dword [edx]
add eax, dword [ebp - 0x3078]
mov ecx, dword [ebp - 0x30e8]
mov edx, dword [ebp - 0x30cc]
add edx, dword [ecx]
cmp eax, edx
jae 0x404472
push 0xaa
mov eax, dword [ebp - 0x3124]
push eax
mov ecx, dword [ebp - 0x30f0]
push ecx
call dword [sym.imp.COMCTL32.dll_DrawInsert]
movzx edx, word [ebp - 0x3074]
mov dword [ebp - 0x3128], edx
cmp dword [ebp - 0x3128], 0x651
je 0x404398
jmp 0x404456
mov eax, dword [ebp - 0x3060]
mov edx, dword [eax]
mov ecx, dword [0x56baf4]
sar edx, cl
mov dword [ebp - 0x3084], edx
mov eax, dword [ebp - 0x3120]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x3048]
mov edx, dword [ebp - 0x3060]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [ebp - 0x309c]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x3094]
mov ecx, dword [ebp - 0x3058]
add ecx, dword [eax]
cmp edx, ecx
jg 0x40441b
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
push eax
movzx ecx, word [ebp - 0x3074]
push ecx
mov edx, dword [ebp - 0x30e8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x30cc]
push ecx
mov edx, dword [ebp - 0x30b0]
mov eax, dword [edx]
push eax
call fcn.00516630
add esp, 0x14
jmp 0x404454
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x3048]
mov eax, dword [ebp - 0x3060]
mov ecx, dword [0x56baf4]
add ecx, dword [eax]
cmp edx, ecx
jge 0x404454
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
movzx ecx, word [0x56a028]
add eax, ecx
mov word [ebp - 0x3074], ax
jmp 0x40446d
lea edx, [ebp - 6]
push edx
mov eax, dword [ebp - 0x312c]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [ebp - 0x3130], eax
jmp 0x515c82
movsx ecx, word [ebp - 0x9c8]
movsx edx, word [ebp - 0x9bc]
sub ecx, edx
movsx eax, word [ebp - 0x9c0]
cmp ecx, eax
jg 0x515c82
lea ecx, [ebp - 5]
mov dword [ebp - 0x3134], ecx
movsx edx, word [ebp - 0x9c0]
movsx eax, word [ebp - 0x9bc]
and edx, eax
mov word [ebp - 0x9c8], dx
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
movsx eax, byte [ebp - 6]
sub edx, eax
mov byte [ebp - 1], dl
mov ecx, dword [ebp - 0x30b0]
mov edx, dword [ebp - 0x3098]
mov eax, dword [ecx]
add eax, dword [edx]
mov dword [ebp - 0x308c], eax
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ebp - 0x3094]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x3048], eax
mov ecx, dword [ebp - 0x3134]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 4]
or edx, eax
mov ecx, dword [ebp - 0x30e0]
mov byte [ecx], dl
movzx edx, word [0x56a028]
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
sar edx, cl
mov word [ebp - 0x3074], dx
mov ecx, dword [ebp - 0x30b0]
mov edx, dword [ebp - 0x3064]
xor edx, dword [ecx]
mov eax, dword [ebp - 0x3098]
mov dword [eax], edx
mov edx, dword [ebp - 0x310c]
mov ecx, dword [ebp - 0x3058]
shl edx, cl
mov dword [ebp - 0x3054], edx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [ebp - 0x3120]
mov edx, dword [eax]
and edx, dword [ecx]
mov eax, dword [ebp - 0x3094]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ecx]
add edx, dword [ebp - 0x30cc]
mov eax, dword [ebp - 0x3098]
mov dword [eax], edx
movzx ecx, byte [ebp - 4]
movzx edx, byte [ebp - 5]
sub ecx, edx
mov byte [ebp - 3], cl
movzx eax, word [ebp - 0x3074]
movzx ecx, word [ebp - 0x9c4]
sub eax, ecx
mov word [ebp - 0x3090], ax
mov edx, dword [ebp - 0x3094]
mov eax, dword [ebp - 0x3120]
mov ecx, dword [edx]
add ecx, dword [eax]
mov edx, dword [ebp - 0x309c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x309c]
mov ecx, dword [ebp - 0x3120]
mov edx, dword [eax]
add edx, dword [ecx]
mov eax, dword [ebp - 0x3094]
mov dword [eax], edx
mov ecx, dword [ebp - 0x308c]
add ecx, dword [ebp - 0x3078]
mov edx, dword [ebp - 0x30e8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3058]
and eax, dword [ebp - 0x310c]
mov dword [ebp - 0x30a0], eax
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ebp - 0x3120]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x3060]
mov dword [ecx], eax
mov edx, dword [ebp - 0x30e0]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 5]
sar eax, cl
mov ecx, dword [ebp - 0x3134]
mov byte [ecx], al
mov edx, dword [ebp - 0x3108]
add edx, 0xd4
mov dword [ebp - 0x3108], edx
movsx eax, byte [ebp - 1]
movsx ecx, byte [ebp - 2]
or eax, ecx
mov byte [ebp - 6], al
mov edx, dword [ebp - 0x30e0]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 4]
shl eax, cl
mov ecx, dword [ebp - 0x30e0]
mov byte [ecx], al
movzx edx, word [ebp - 0x3074]
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
xor edx, ecx
mov word [ebp - 0x9c4], dx
mov edx, dword [ebp - 0x30b0]
mov eax, dword [ebp - 0x3098]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x30e8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3094]
mov ecx, dword [ebp - 0x3058]
and ecx, dword [eax]
mov dword [0x56baf4], ecx
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x3074]
sub eax, ecx
mov edx, dword [ebp - 0x30e4]
mov word [edx], ax
mov eax, dword [ebp - 0x30e0]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 5]
add ecx, edx
mov byte [ebp - 3], cl
mov eax, dword [ebp - 0x3098]
mov ecx, dword [ebp - 0x30cc]
add ecx, dword [eax]
mov dword [ebp - 0x308c], ecx
mov edx, dword [ebp - 0x30a0]
add edx, dword [ebp - 0x310c]
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
mov ecx, dword [ebp - 0x310c]
sub ecx, dword [ebp - 0x307c]
mov dword [ebp - 0x3048], ecx
mov edx, dword [ebp - 0x308c]
add edx, dword [ebp - 0x3078]
mov dword [ebp - 0x30cc], edx
cmp dword [ebp - 0x3108], 0x7f6b
jne 0x40449a
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
movzx edx, word [0x56a028]
sub ecx, edx
mov eax, dword [ebp - 0x30e4]
mov word [eax], cx
movzx ecx, byte [ebp - 5]
movzx edx, byte [ebp - 4]
and ecx, edx
mov eax, dword [ebp - 0x30e0]
mov byte [eax], cl
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x309c]
mov eax, dword [ecx]
mov ecx, dword [edx]
sar eax, cl
mov dword [0x56baf4], eax
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x3084]
mov eax, dword [ebp - 0x3060]
mov dword [eax], edx
movsx ecx, byte [ebp - 1]
movsx edx, byte [ebp - 6]
or ecx, edx
mov eax, dword [ebp - 0x30dc]
mov byte [eax], cl
mov ecx, dword [ebp - 0x30b4]
add ecx, 0x14
mov dword [ebp - 0x30b4], ecx
mov edx, dword [ebp - 0x30e0]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 3]
shl eax, cl
mov ecx, dword [ebp - 0x3134]
mov byte [ecx], al
mov edx, dword [ebp - 0x3134]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x30e0]
movzx edx, byte [ecx]
sub eax, edx
mov byte [ebp - 3], al
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x3090]
add ecx, edx
mov word [ebp - 0x9c4], cx
mov eax, dword [ebp - 0x30cc]
and eax, dword [ebp - 0x308c]
mov ecx, dword [ebp - 0x30e8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3098]
mov eax, dword [edx]
sub eax, dword [ebp - 0x3078]
mov ecx, dword [ebp - 0x30e8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x309c]
mov eax, dword [ebp - 0x3084]
sub eax, dword [edx]
mov dword [ebp - 0x3054], eax
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x3120]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x309c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3120]
mov eax, dword [ebp - 0x309c]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [ebp - 0x3054], ecx
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x3074]
add eax, ecx
mov word [ebp - 0x3090], ax
movzx edx, byte [ebp - 5]
movzx eax, byte [ebp - 4]
sub edx, eax
mov byte [ebp - 3], dl
mov ecx, dword [ebp - 0x3064]
add ecx, dword [ebp - 0x30cc]
mov edx, dword [ebp - 0x30b0]
mov dword [edx], ecx
mov eax, dword [0x56baf4]
add eax, dword [ebp - 0x30a0]
mov ecx, dword [ebp - 0x309c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3060]
mov eax, dword [ebp - 0x3120]
mov ecx, dword [edx]
or ecx, dword [eax]
mov dword [ebp - 0x30a0], ecx
mov edx, dword [ebp - 0x3078]
mov ecx, dword [ebp - 0x30cc]
shl edx, cl
mov eax, dword [ebp - 0x30e8]
mov dword [eax], edx
movzx edx, byte [ebp - 4]
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
sar edx, cl
mov byte [ebp - 5], dl
movzx ecx, word [ebp - 0x3090]
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
xor ecx, eax
mov word [ebp - 0x3074], cx
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ebp - 0x3084]
and edx, dword [ecx]
mov dword [0x56baf4], edx
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 4]
sub ecx, edx
mov eax, dword [ebp - 0x3134]
mov byte [eax], cl
mov ecx, dword [ebp - 0x3078]
add ecx, dword [ebp - 0x308c]
mov dword [ebp - 0x30cc], ecx
mov edx, dword [ebp - 0x3060]
mov eax, dword [edx]
and eax, dword [ebp - 0x310c]
mov ecx, dword [ebp - 0x309c]
mov dword [ecx], eax
movzx edx, word [ebp - 0x9c4]
movzx eax, word [ebp - 0x3074]
sub edx, eax
mov ecx, dword [ebp - 0x30e4]
mov word [ecx], dx
movzx edx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
sub edx, eax
mov byte [ebp - 5], dl
mov ecx, dword [ebp - 0x3048]
sub ecx, dword [0x56baf4]
mov dword [ebp - 0x307c], ecx
mov edx, dword [ebp - 0x3078]
add edx, dword [ebp - 0x3064]
mov eax, dword [ebp - 0x30e8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ecx]
add edx, dword [ebp - 0x307c]
mov eax, dword [ebp - 0x3060]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3120]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x307c]
shl edx, cl
mov dword [0x56baf4], edx
mov eax, dword [ebp - 0x30e0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x3134]
movzx eax, byte [edx]
or ecx, eax
mov edx, dword [ebp - 0x30e0]
mov byte [edx], cl
mov eax, dword [ebp - 0x30e4]
movzx edx, word [eax]
movzx ecx, word [ebp - 0x3090]
sar edx, cl
mov eax, dword [ebp - 0x30e4]
mov word [eax], dx
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ebp - 0x3064]
xor edx, dword [ecx]
mov dword [ebp - 0x30cc], edx
mov eax, dword [ebp - 0x3084]
and eax, dword [ebp - 0x3048]
mov ecx, dword [ebp - 0x3060]
mov dword [ecx], eax
mov edx, dword [ebp - 0x310c]
sub edx, dword [ebp - 0x3054]
mov eax, dword [ebp - 0x3060]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x307c]
add edx, dword [ecx]
mov eax, dword [ebp - 0x309c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ebp - 0x307c]
add edx, dword [ecx]
mov eax, dword [ebp - 0x3094]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ebp - 0x3064]
add edx, dword [ecx]
mov eax, dword [ebp - 0x30e8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3120]
mov edx, dword [ebp - 0x309c]
mov eax, dword [ecx]
and eax, dword [edx]
mov dword [0x56baf4], eax
movzx ecx, byte [ebp - 4]
movzx edx, byte [ebp - 5]
add ecx, edx
mov eax, dword [ebp - 0x3134]
mov byte [eax], cl
movzx ecx, word [ebp - 0x9c4]
movzx edx, word [0x56a028]
sub ecx, edx
mov eax, dword [ebp - 0x30e4]
mov word [eax], cx
mov ecx, dword [ebp - 0x3064]
sub ecx, dword [ebp - 0x30cc]
mov dword [ebp - 0x3078], ecx
mov edx, dword [ebp - 0x30b0]
mov eax, dword [ebp - 0x30e8]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov dword [ebp - 0x3078], ecx
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x3074]
or eax, ecx
mov word [ebp - 0x9c4], ax
mov edx, dword [ebp - 0x3134]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 5]
shl eax, cl
mov ecx, dword [ebp - 0x3134]
mov byte [ecx], al
mov edx, dword [ebp - 0x3060]
mov eax, dword [edx]
xor eax, dword [ebp - 0x30a0]
mov dword [ebp - 0x310c], eax
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ebp - 0x308c]
mov ecx, dword [ecx]
shr edx, cl
mov dword [ebp - 0x3064], edx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [ebp - 0x3084]
and ecx, dword [eax]
mov edx, dword [ebp - 0x3120]
mov dword [edx], ecx
cmp dword [ebp - 0x30b4], 0x24b2
jb 0x404724
lea eax, [ebp - 0x3058]
mov dword [ebp - 0x3138], eax
mov dword [ebp - 0x313c], 0x7d99
mov ecx, dword [ebp - 0x30e8]
mov edx, dword [ecx]
mov dword [ebp - 0x3140], edx
cmp dword [ebp - 0x3140], 0
je 0x404b90
jmp 0x404c15
mov eax, dword [ebp - 0x3094]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x30a0]
mov edx, dword [ebp - 0x3120]
mov eax, dword [0x56baf4]
add eax, dword [edx]
cmp ecx, eax
jne 0x404c01
movzx ecx, word [ebp - 0x3074]
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
sub ecx, eax
mov word [ebp - 0x3090], cx
mov dword [ebp - 0x3144], 0x1c2a
lea ecx, [ebp - 3]
mov dword [ebp - 0x3148], ecx
mov edx, dword [ebp - 0x30b0]
mov eax, dword [ebp - 0x30e8]
mov ecx, dword [edx]
add ecx, dword [eax]
mov edx, dword [ebp - 0x30b0]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3138]
mov ecx, dword [eax]
mov dword [ebp - 0x314c], ecx
mov edx, dword [ebp - 0x30dc]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 2]
sub eax, ecx
mov byte [ebp - 6], al
jmp 0x404c84
movzx edx, byte [ebp - 3]
movzx eax, byte [ebp - 5]
and edx, eax
movzx ecx, byte [ebp - 4]
mov eax, dword [ebp - 0x3148]
movzx eax, byte [eax]
add ecx, eax
cmp edx, ecx
jl 0x404c84
mov ecx, dword [ebp - 0x30e8]
mov edx, dword [ebp - 0x3078]
add edx, dword [ecx]
mov eax, dword [ebp - 0x3098]
mov dword [eax], edx
movzx ecx, word [ebp - 0x9c4]
movzx edx, word [ebp - 0x3090]
sub ecx, edx
mov word [ebp - 0x3074], cx
movzx eax, word [ebp - 0x9bc]
push eax
movzx ecx, word [ebp - 0x9bc]
push ecx
movzx edx, byte [ebp - 4]
push edx
movzx eax, word [ebp - 0x9bc]
push eax
call fcn.00516820
add esp, 0x10
mov cl, byte [ebp - 2]
mov byte [ebp - 0x3150], cl
cmp byte [ebp - 0x3150], 0x55
je 0x404c9b
jmp 0x404d5f
movsx eax, word [ebp - 0x9c8]
movsx ecx, word [ebp - 0x9bc]
cdq
idiv ecx
movsx edx, word [ebp - 0x9c0]
cmp eax, edx
jne 0x404cf1
mov eax, dword [ebp - 0x3148]
movzx edx, byte [eax]
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
sar edx, cl
mov ecx, dword [ebp - 0x30e0]
mov byte [ecx], dl
lea edx, [ebp - 0x3114]
push edx
push fcn.00516150
mov eax, dword [ebp - 0x3124]
push eax
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [ebp - 0x30d4], eax
mov ecx, dword [ebp - 0x30b0]
mov edx, dword [ebp - 0x30e8]
mov eax, dword [ecx]
or eax, dword [edx]
mov dword [ebp - 0x3064], eax
mov ecx, dword [ebp - 0x3138]
mov edx, dword [ebp - 0x3120]
mov eax, dword [ecx]
xor eax, dword [edx]
mov dword [ebp - 0x3058], eax
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ecx]
mov ecx, dword [0x56baf4]
shl edx, cl
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
movzx ecx, word [ebp - 0x9bc]
push ecx
movzx edx, word [ebp - 0x9bc]
push edx
movzx eax, byte [ebp - 5]
push eax
movzx ecx, word [ebp - 0x9c8]
push ecx
call fcn.00516820
add esp, 0x10
jmp 0x404e15
mov edx, dword [ebp - 0x3064]
and edx, dword [ebp - 0x30cc]
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [ebp - 0x3078]
sub ecx, dword [eax]
cmp edx, ecx
ja 0x404df9
lea edx, [ebp - 0x308c]
mov dword [ebp - 0x3154], edx
mov eax, dword [ebp - 0x30cc]
add eax, dword [ebp - 0x308c]
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ebp - 0x30b0]
mov ecx, dword [ecx]
sub ecx, dword [edx]
cmp eax, ecx
jbe 0x404df9
mov edx, dword [ebp - 0x309c]
mov eax, dword [ebp - 0x310c]
add eax, dword [edx]
mov dword [ebp - 0x30a0], eax
lea ecx, [ebp - 0x314c]
push ecx
mov edx, dword [ebp - 0x306c]
push edx
mov eax, dword [ebp - 0x3158]
push eax
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x30c0], eax
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x3090]
and edx, eax
mov ecx, dword [ebp - 0x30e4]
mov word [ecx], dx
mov edx, dword [ebp - 0x3148]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 4]
sub eax, ecx
mov byte [ebp - 3], al
mov dword [ebp - 0x315c], 0x6987
mov edx, dword [ebp - 0x3120]
mov eax, dword [edx]
mov dword [ebp - 0x3160], eax
mov edx, dword [ebp - 0x307c]
mov ecx, dword [ebp - 0x314c]
sar edx, cl
mov dword [0x56baf4], edx
mov eax, dword [ebp - 0x3058]
mov ecx, dword [ebp - 0x3160]
shl eax, cl
mov dword [ebp - 0x3084], eax
mov ecx, dword [ebp - 0x3120]
mov edx, dword [ebp - 0x3160]
xor edx, dword [ecx]
mov eax, dword [ebp - 0x3094]
mov dword [eax], edx
movzx ecx, word [ebp - 0x3074]
movzx edx, word [ebp - 0x9c4]
or ecx, edx
mov eax, dword [ebp - 0x30e4]
mov word [eax], cx
movzx ecx, byte [ebp - 5]
movzx edx, byte [ebp - 4]
add ecx, edx
mov byte [ebp - 3], cl
mov eax, dword [ebp - 0x30ac]
add eax, 0x35
mov dword [ebp - 0x30ac], eax
movsx ecx, byte [ebp - 2]
movsx edx, byte [ebp - 6]
and ecx, edx
mov eax, dword [ebp - 0x30dc]
mov byte [eax], cl
movsx ecx, word [ebp - 0x9c8]
movsx edx, word [ebp - 0x9c0]
sub ecx, edx
mov word [ebp - 0x9bc], cx
mov eax, dword [ebp - 0x3098]
mov ecx, dword [ebp - 0x3154]
mov edx, dword [eax]
add edx, dword [ecx]
mov dword [ebp - 0x3078], edx
mov eax, dword [ebp - 0x309c]
mov ecx, dword [ebp - 0x310c]
add ecx, dword [eax]
mov edx, dword [ebp - 0x3138]
mov dword [edx], ecx
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x30e0]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x3134]
mov byte [ecx], al
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x3090]
sub eax, ecx
mov word [ebp - 0x3074], ax
mov edx, dword [ebp - 0x3064]
add edx, dword [ebp - 0x3078]
mov dword [ebp - 0x30cc], edx
mov eax, dword [ebp - 0x3094]
mov ecx, dword [ebp - 0x307c]
sub ecx, dword [eax]
mov dword [ebp - 0x3084], ecx
mov edx, dword [ebp - 0x3054]
and edx, dword [ebp - 0x3058]
mov dword [ebp - 0x3084], edx
mov eax, dword [ebp - 0x3154]
mov ecx, dword [eax]
or ecx, dword [ebp - 0x30cc]
mov edx, dword [ebp - 0x30e8]
mov dword [edx], ecx
movzx eax, word [ebp - 0x9c4]
mov ecx, dword [ebp - 0x30e4]
movzx ecx, word [ecx]
sar eax, cl
mov word [ebp - 0x3090], ax
mov edx, dword [ebp - 0x30e0]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x3134]
movzx ecx, byte [ecx]
shl eax, cl
mov byte [ebp - 4], al
mov edx, dword [ebp - 0x314c]
xor edx, dword [ebp - 0x3058]
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3058]
add ecx, dword [ebp - 0x3160]
mov dword [0x56baf4], ecx
mov edx, dword [ebp - 0x3098]
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [ebp - 0x3064], ecx
mov edx, dword [ebp - 0x3138]
mov eax, dword [ebp - 0x3120]
mov ecx, dword [edx]
and ecx, dword [eax]
mov dword [ebp - 0x3084], ecx
mov edx, dword [ebp - 0x3138]
mov eax, dword [edx]
sub eax, dword [ebp - 0x3084]
mov dword [ebp - 0x30a0], eax
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
movsx eax, byte [ebp - 1]
sub edx, eax
mov byte [ebp - 6], dl
cmp dword [ebp - 0x30ac], 0xf065
jbe 0x404e23
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
movsx eax, byte [ebp - 1]
add edx, eax
movsx ecx, byte [ebp - 6]
movsx eax, byte [ebp - 2]
sub ecx, eax
cmp edx, ecx
jne 0x4050e7
movzx ecx, word [ebp - 0x3090]
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
sub ecx, eax
movzx edx, word [ebp - 0x3074]
movzx eax, word [0x56a028]
sub edx, eax
cmp ecx, edx
je 0x4050b8
movsx ecx, word [ebp - 0x9c0]
movsx edx, word [ebp - 0x9bc]
xor ecx, edx
mov word [ebp - 0x9c8], cx
movzx eax, word [0x56a028]
movzx ecx, word [ebp - 0x3074]
or eax, ecx
mov edx, dword [ebp - 0x30e4]
mov word [edx], ax
push 0xae
push 0x4e
push 0x8b
mov eax, dword [ebp - 0x3164]
push eax
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0x3168], eax
jmp 0x4050e2
movsx edx, byte [ebp - 6]
movsx ecx, byte [ebp - 2]
sar edx, cl
movsx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x30dc]
movsx ecx, byte [ecx]
shl eax, cl
cmp edx, eax
jne 0x4050e2
movzx edx, byte [ebp - 5]
movzx eax, byte [ebp - 3]
and edx, eax
mov byte [ebp - 4], dl
jmp 0x405194
mov ecx, dword [ebp - 0x3078]
add ecx, dword [ebp - 0x30cc]
mov dword [ebp - 0x308c], ecx
movsx edx, word [ebp - 0x9bc]
movsx eax, word [ebp - 0x9c8]
sub edx, eax
movsx ecx, word [ebp - 0x9c0]
cmp edx, ecx
jne 0x405139
movzx edx, byte [ebp - 6]
push edx
mov eax, dword [ebp - 0x3048]
push eax
movzx ecx, word [ebp - 0x9c0]
push ecx
mov edx, dword [ebp - 0x30cc]
push edx
call fcn.00517510
add esp, 0x10
jmp 0x40518a
movsx eax, byte [ebp - 2]
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
sub eax, edx
mov byte [0x5430d6], al
mov eax, dword [ebp - 0x309c]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x3084]
mov edx, dword [ebp - 0x309c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x30e4]
mov cx, word [eax]
mov word [ebp - 0x316c], cx
mov edx, dword [ebp - 0x3134]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x30e0]
movzx edx, byte [ecx]
add eax, edx
mov byte [ebp - 4], al
mov dword [ebp - 0x3170], 0x87b2
lea eax, [ebp - 0x3078]
mov dword [ebp - 0x3174], eax
mov ecx, dword [ebp - 0x3138]
mov edx, dword [ecx]
add edx, dword [ebp - 0x3160]
mov eax, dword [ebp - 0x309c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3120]
mov edx, dword [ebp - 0x3138]
mov eax, dword [ecx]
or eax, dword [edx]
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ebp - 0x3094]
mov esi, dword [ecx]
mov ecx, dword [edx]
shl esi, cl
cmp eax, esi
jge 0x4052cd
mov eax, dword [ebp - 0x30e8]
mov ecx, dword [ebp - 0x3154]
mov edx, dword [eax]
and edx, dword [ecx]
mov eax, dword [ebp - 0x3174]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x30cc]
cmp edx, ecx
jne 0x40529c
mov edx, dword [ebp - 0x3060]
mov eax, dword [edx]
add eax, dword [ebp - 0x3054]
mov ecx, dword [ebp - 0x3138]
mov dword [ecx], eax
mov edx, dword [ebp - 0x30b0]
mov eax, dword [ebp - 0x3064]
and eax, dword [edx]
mov dword [ebp - 0x308c], eax
mov ecx, dword [ebp - 0x30dc]
mov dl, byte [ecx]
mov byte [ebp - 0x3178], dl
cmp byte [ebp - 0x3178], 0x58
je 0x405252
cmp byte [ebp - 0x3178], 0x64
je 0x405281
jmp 0x40529a
push 0xe
mov eax, dword [ebp - 0x30f0]
push eax
mov ecx, dword [ebp - 0x30f0]
push ecx
call dword [sym.imp.COMCTL32.dll_DrawInsert]
mov edx, dword [ebp - 0x3148]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 4]
sub eax, ecx
mov edx, dword [ebp - 0x3148]
mov byte [edx], al
jmp 0x40529a
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x9c4]
add ecx, edx
mov word [0x56a028], cx
jmp 0x4052cb
movzx eax, word [ebp - 0x3074]
push eax
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
push edx
mov eax, dword [ebp - 0x3064]
push eax
mov ecx, dword [ebp - 0x3064]
push ecx
mov edx, dword [ebp - 0x3078]
push edx
call fcn.00516630
add esp, 0x14
jmp 0x405328
mov eax, dword [ebp - 0x30dc]
movsx edx, byte [eax]
movsx ecx, byte [ebp - 6]
sar edx, cl
movsx eax, byte [ebp - 1]
movsx ecx, byte [ebp - 2]
xor eax, ecx
cmp edx, eax
jle 0x405328
mov edx, dword [ebp - 0x3060]
mov eax, dword [edx]
sub eax, dword [ebp - 0x314c]
mov dword [ebp - 0x307c], eax
mov ecx, dword [ebp - 0x30dc]
movzx edx, byte [ecx]
push edx
mov eax, dword [ebp - 0x3094]
mov ecx, dword [eax]
push ecx
movzx edx, word [ebp - 0x9bc]
push edx
mov eax, dword [ebp - 0x308c]
push eax
call fcn.00517510
add esp, 0x10
cmp dword [ebp - 0x3144], 0x28db
ja 0x4055f2
mov ecx, dword [ebp - 0x3138]
mov edx, dword [ebp - 0x309c]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x30a0], eax
movsx edx, byte [ebp - 6]
movsx ecx, byte [0x5430d6]
sar edx, cl
mov byte [ebp - 2], dl
mov eax, dword [ebp - 0x30dc]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 2]
xor ecx, edx
mov eax, dword [ebp - 0x30dc]
mov byte [eax], cl
movzx edx, byte [ebp - 5]
mov eax, dword [ebp - 0x3148]
movzx ecx, byte [eax]
shl edx, cl
mov byte [ebp - 4], dl
movzx ecx, word [0x56a028]
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
or ecx, eax
mov word [ebp - 0x3074], cx
mov ecx, dword [ebp - 0x3174]
mov edx, dword [ecx]
and edx, dword [ebp - 0x308c]
mov eax, dword [ebp - 0x3174]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3064]
add ecx, dword [ebp - 0x30cc]
mov edx, dword [ebp - 0x3154]
mov dword [edx], ecx
mov eax, dword [ebp - 0x309c]
mov ecx, dword [ebp - 0x3094]
mov edx, dword [eax]
sub edx, dword [ecx]
mov dword [0x56baf4], edx
mov eax, dword [ebp - 0x3120]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x3160]
mov dword [ebp - 0x30a0], ecx
mov edx, dword [ebp - 0x3094]
mov eax, dword [edx]
sub eax, dword [ebp - 0x30a0]
mov dword [ebp - 0x3048], eax
movzx ecx, word [ebp - 0x9c4]
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
add ecx, eax
mov word [ebp - 0x316c], cx
movzx ecx, byte [ebp - 5]
movzx edx, byte [ebp - 4]
and ecx, edx
mov eax, dword [ebp - 0x3134]
mov byte [eax], cl
mov ecx, dword [ebp - 0x30e8]
mov edx, dword [ebp - 0x3154]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x3064], eax
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x307c]
add edx, dword [ecx]
mov eax, dword [ebp - 0x3094]
mov dword [eax], edx
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ebp - 0x3060]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x314c], eax
mov edx, dword [ebp - 0x3078]
mov ecx, dword [ebp - 0x30cc]
shr edx, cl
mov dword [ebp - 0x308c], edx
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
xor eax, ecx
mov byte [ebp - 5], al
movzx edx, word [ebp - 0x3074]
movzx eax, word [ebp - 0x9c4]
or edx, eax
mov word [0x56a028], dx
movsx edx, byte [ebp - 2]
movsx ecx, byte [0x5430d6]
shl edx, cl
mov byte [ebp - 6], dl
movsx eax, word [ebp - 0x9c0]
movsx ecx, word [ebp - 0x9c8]
and eax, ecx
mov word [ebp - 0x9bc], ax
mov edx, dword [ebp - 0x3098]
mov eax, dword [edx]
add eax, dword [ebp - 0x3064]
mov dword [ebp - 0x308c], eax
mov ecx, dword [ebp - 0x3084]
sub ecx, dword [ebp - 0x3054]
mov dword [ebp - 0x3048], ecx
mov edx, dword [ebp - 0x30e0]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 3]
add eax, ecx
mov byte [ebp - 5], al
movzx edx, word [ebp - 0x9c4]
movzx eax, word [ebp - 0x316c]
add edx, eax
mov ecx, dword [ebp - 0x30e4]
mov word [ecx], dx
mov edx, dword [ebp - 0x3138]
mov eax, dword [ebp - 0x314c]
sub eax, dword [edx]
mov dword [ebp - 0x3048], eax
mov ecx, dword [ebp - 0x30e8]
mov edx, dword [ebp - 0x3064]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x3154]
mov dword [eax], edx
mov ecx, dword [ebp - 0x307c]
and ecx, dword [ebp - 0x3084]
mov dword [0x56baf4], ecx
mov edx, dword [ebp - 0x3144]
add edx, 0x39
mov dword [ebp - 0x3144], edx
mov eax, dword [ebp - 0x3138]
mov ecx, dword [ebp - 0x3094]
mov edx, dword [eax]
sub edx, dword [ecx]
mov dword [ebp - 0x3084], edx
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 5]
xor eax, ecx
mov edx, dword [ebp - 0x3134]
mov byte [edx], al
movzx eax, word [0x56a028]
movzx ecx, word [ebp - 0x3090]
sar eax, cl
mov word [ebp - 0x3074], ax
mov ecx, dword [ebp - 0x30e8]
mov edx, dword [ebp - 0x308c]
mov ecx, dword [ecx]
shl edx, cl
mov dword [ebp - 0x30cc], edx
mov eax, dword [ebp - 0x3094]
mov ecx, dword [eax]
or ecx, dword [0x56baf4]
mov dword [ebp - 0x3084], ecx
mov edx, dword [ebp - 0x3120]
mov eax, dword [ebp - 0x314c]
sub eax, dword [edx]
mov dword [ebp - 0x3084], eax
jmp 0x405328
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ecx]
and edx, dword [ebp - 0x3054]
mov eax, dword [ebp - 0x309c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x30b0]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x3064]
mov eax, dword [ebp - 0x30e8]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x30cc]
cmp edx, ecx
jne 0x4056e6
movsx edx, word [ebp - 0x9c8]
mov dword [ebp - 0x317c], edx
cmp dword [ebp - 0x317c], 0x1ef
je 0x40565a
cmp dword [ebp - 0x317c], 0xf15
je 0x4056db
jmp 0x4056e6
mov eax, dword [ebp - 0x3138]
mov ecx, dword [ebp - 0x3160]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x3094]
mov eax, dword [ebp - 0x3120]
mov edx, dword [edx]
add edx, dword [eax]
cmp ecx, edx
je 0x4056c2
push 0xc9
push 0x9a
push 0x14
mov eax, dword [ebp - 0x3180]
push eax
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0x3168], eax
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x310c]
mov eax, dword [ebp - 0x3138]
mov dword [eax], edx
movsx ecx, byte [ebp - 1]
movsx edx, byte [ebp - 6]
and ecx, edx
mov byte [0x5430d6], cl
jmp 0x4056d9
mov eax, dword [ebp - 0x30dc]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 1]
xor ecx, edx
mov eax, dword [ebp - 0x30dc]
mov byte [eax], cl
jmp 0x4056e6
mov ecx, dword [ebp - 0x30e0]
mov dl, byte [ecx]
mov byte [ebp - 7], dl
lea eax, [ebp - 0x3074]
mov dword [ebp - 0x3184], eax
mov ecx, dword [ebp - 0x3154]
mov edx, dword [ebp - 0x3098]
mov eax, dword [ecx]
mov ecx, dword [edx]
shr eax, cl
mov edx, dword [ebp - 0x3064]
mov ecx, dword [ebp - 0x308c]
shl edx, cl
cmp eax, edx
jbe 0x4057bb
mov eax, dword [ebp - 0x30e0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x3148]
movzx eax, byte [edx]
or ecx, eax
movzx edx, byte [ebp - 5]
movzx eax, byte [ebp - 4]
add edx, eax
cmp ecx, edx
jg 0x4057a5
mov ecx, dword [ebp - 0x30e8]
mov edx, dword [ebp - 0x3064]
and edx, dword [ecx]
mov dword [ebp - 0x3078], edx
push 0x44
push 0xe2
push 0xd8
mov eax, dword [ebp - 0x3164]
push eax
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0x30f4], eax
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
push edx
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
push ecx
mov edx, dword [ebp - 0x3154]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x3154]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x3078]
push eax
call fcn.00516630
add esp, 0x14
jmp 0x4057bb
mov ecx, dword [ebp - 0x30b0]
mov edx, dword [ebp - 0x3078]
add edx, dword [ecx]
mov eax, dword [ebp - 0x3154]
mov dword [eax], edx
lea ecx, [ebp - 0x3090]
mov dword [ebp - 0x3188], ecx
mov edx, dword [ebp - 0x3148]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 7]
sub eax, ecx
mov byte [ebp - 3], al
mov edx, dword [ebp - 0x3060]
mov eax, dword [edx]
add eax, dword [ebp - 0x310c]
mov ecx, dword [ebp - 0x3058]
add ecx, dword [ebp - 0x3054]
cmp eax, ecx
je 0x405832
movzx edx, byte [ebp - 7]
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
sub edx, ecx
movzx eax, byte [ebp - 5]
movzx ecx, byte [ebp - 3]
sub eax, ecx
cmp edx, eax
jl 0x405832
mov edx, dword [ebp - 0x3060]
mov eax, dword [ebp - 0x309c]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov dword [ebp - 0x30a0], ecx
mov cl, byte [ebp - 1]
call fcn.00515e10
lea edx, [ebp - 0x316c]
mov dword [0x56bb04], edx
lea eax, [ebp - 0x308c]
mov dword [ebp - 0x318c], eax
movsx ecx, word [ebp - 0x9bc]
mov dword [ebp - 0x3190], ecx
cmp dword [ebp - 0x3190], 0x2b
je 0x4058f1
cmp dword [ebp - 0x3190], 0x44
je 0x405872
jmp 0x405912
mov edx, dword [ebp - 0x3094]
mov eax, dword [edx]
add eax, dword [0x56baf4]
mov dword [ebp - 0x3054], eax
lea ecx, [ebp - 0x312c]
push ecx
mov edx, dword [ebp - 0x3194]
push edx
mov eax, dword [ebp - 0x3070]
push eax
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x3068], eax
mov ecx, dword [ebp - 0x3138]
mov edx, dword [ebp - 0x3160]
xor edx, dword [ecx]
mov eax, dword [ebp - 0x3060]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
shl edx, cl
mov word [ebp - 0x9c4], dx
mov ecx, dword [ebp - 0x30e0]
movzx edx, byte [ecx]
movzx ecx, byte [ebp - 4]
sar edx, cl
mov eax, dword [ebp - 0x30e0]
mov byte [eax], dl
jmp 0x405912
lea ecx, [ebp - 0x3094]
push ecx
mov edx, dword [ebp - 0x312c]
push edx
mov eax, dword [ebp - 0x3158]
push eax
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x3068], eax
mov ecx, dword [ebp - 0x308c]
or ecx, dword [ebp - 0x3078]
mov edx, dword [ebp - 0x30e8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
movzx edx, word [0x56a028]
imul ecx, edx
mov eax, dword [ebp - 0x3184]
movzx edx, word [eax]
movzx eax, word [ebp - 0x316c]
and edx, eax
cmp ecx, edx
jg 0x515bda
mov ecx, dword [ebp - 0x30e0]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
add edx, eax
mov byte [ebp - 3], dl
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x3048]
mov eax, dword [ebp - 0x3120]
mov esi, dword [0x56baf4]
mov ecx, dword [eax]
shl esi, cl
cmp edx, esi
jl 0x405a40
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ebp - 0x3064]
xor edx, dword [ecx]
mov eax, dword [ebp - 0x3174]
mov ecx, dword [ebp - 0x3154]
mov eax, dword [eax]
and eax, dword [ecx]
cmp edx, eax
jb 0x4059fb
mov ecx, dword [ebp - 0x3064]
mov dword [ebp - 0x3198], ecx
mov edx, dword [ebp - 0x3120]
mov eax, dword [edx]
add eax, dword [ebp - 0x30a0]
mov dword [ebp - 0x314c], eax
mov dword [ebp - 0x319c], 0x722e
lea ecx, [ebp - 0x3160]
mov dword [ebp - 0x31a0], ecx
mov edx, dword [ebp - 0x30b0]
mov eax, dword [ebp - 0x318c]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov dword [ebp - 0x3064], ecx
jmp 0x405a3b
mov edx, dword [ebp - 0x3188]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
add eax, edx
movzx ecx, word [ebp - 0x316c]
mov edx, dword [ebp - 0x3184]
movzx edx, word [edx]
add ecx, edx
cmp eax, ecx
jl 0x405a3b
mov eax, dword [ebp - 0x309c]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x307c]
mov edx, dword [ebp - 0x31a0]
mov dword [edx], ecx
jmp 0x405aed
mov eax, dword [ebp - 0x3120]
mov edx, dword [ebp - 0x3084]
mov ecx, dword [eax]
sar edx, cl
mov eax, dword [ebp - 0x3138]
mov ecx, dword [eax]
or ecx, dword [ebp - 0x3048]
cmp edx, ecx
jle 0x405aed
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x316c]
sub eax, ecx
mov word [ebp - 0x3090], ax
mov edx, dword [ebp - 0x3120]
mov eax, dword [ebp - 0x309c]
mov ecx, dword [edx]
add ecx, dword [eax]
mov edx, dword [ebp - 0x3094]
mov eax, dword [edx]
sub eax, dword [ebp - 0x314c]
cmp ecx, eax
jge 0x405ad7
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
xor edx, ecx
mov eax, dword [0x56bb04]
mov word [eax], dx
mov ecx, dword [ebp - 0x3154]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x30dc]
movzx ecx, byte [eax]
push ecx
call fcn.00516150
jmp 0x405aed
push 0x5c
mov edx, dword [ebp - 0x3164]
push edx
mov eax, dword [ebp - 0x30f0]
push eax
call dword [sym.imp.COMCTL32.dll_DrawInsert]
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x309c]
mov eax, dword [ecx]
mov ecx, dword [edx]
shl eax, cl
mov ecx, dword [ebp - 0x3094]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3064]
or edx, dword [ebp - 0x3198]
mov eax, dword [ebp - 0x3098]
mov ecx, dword [ebp - 0x318c]
mov eax, dword [eax]
and eax, dword [ecx]
cmp edx, eax
jae 0x405b98
movsx ecx, word [ebp - 0x9bc]
mov dword [ebp - 0x31a4], ecx
cmp dword [ebp - 0x31a4], 0x59d
je 0x405b42
jmp 0x405b82
mov edx, dword [ebp - 0x3174]
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [ebp - 0x30cc], ecx
mov edx, dword [ebp - 0x3060]
mov eax, dword [ebp - 0x314c]
add eax, dword [edx]
mov ecx, dword [ebp - 0x309c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3188]
movzx eax, word [edx]
push eax
call fcn.005160f0
add esp, 4
jmp 0x405b96
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x3054]
mov dword [ebp - 0x3058], edx
jmp 0x405bd6
mov eax, dword [ebp - 0x3120]
mov ecx, dword [ebp - 0x3160]
add ecx, dword [eax]
mov edx, dword [ebp - 0x3094]
mov eax, dword [ebp - 0x30a0]
sub eax, dword [edx]
cmp ecx, eax
jge 0x405bd6
lea ecx, [ebp - 7]
push ecx
mov edx, dword [ebp - 0x31a8]
push edx
mov eax, dword [ebp - 0x3070]
push eax
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x3118], eax
lea ecx, [ebp - 4]
mov dword [ebp - 0x31ac], ecx
movzx edx, word [ebp - 0x9c4]
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
imul edx, ecx
mov word [ebp - 0x3090], dx
movzx edx, word [ebp - 0x9c4]
mov dword [ebp - 0x31b0], edx
cmp dword [ebp - 0x31b0], 0x710
je 0x405c23
cmp dword [ebp - 0x31b0], 0xd74
je 0x405c5e
jmp 0x405ce3
mov eax, dword [ebp - 0x30e0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x3134]
movzx eax, byte [edx]
and ecx, eax
mov edx, dword [ebp - 0x31ac]
mov byte [edx], cl
movsx eax, byte [ebp - 2]
movsx ecx, byte [ebp - 6]
sub eax, ecx
mov byte [ebp - 1], al
mov edx, dword [ebp - 0x30dc]
mov cl, byte [edx]
call fcn.00515e10
jmp 0x405ce3
mov eax, dword [ebp - 0x3058]
add eax, dword [ebp - 0x307c]
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ebp - 0x310c]
sub edx, dword [ecx]
cmp eax, edx
jge 0x405cd6
movzx eax, word [ebp - 0x3090]
movzx ecx, word [ebp - 0x9c4]
or eax, ecx
mov edx, dword [0x56bb04]
mov word [edx], ax
mov al, byte [ebp - 4]
mov byte [ebp - 0x31b4], al
cmp byte [ebp - 0x31b4], 0x8c
je 0x405ca9
jmp 0x405cbe
lea ecx, [ebp - 0x131a0]
push ecx
call dword [sym.imp.COMCTL32.dll_PropertySheetA]
mov dword [ebp - 0x3048], eax
jmp 0x405cd4
mov edx, dword [ebp - 0x3094]
mov eax, dword [ebp - 0x3160]
mov ecx, dword [edx]
sar eax, cl
mov dword [ebp - 0x3048], eax
jmp 0x405ce3
movzx ecx, byte [ebp - 7]
movzx edx, byte [ebp - 4]
xor ecx, edx
mov byte [ebp - 5], cl
mov eax, dword [ebp - 0x3198]
and eax, dword [ebp - 0x3064]
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ebp - 0x308c]
add edx, dword [ecx]
cmp eax, edx
jb 0x515b21
mov eax, dword [ebp - 0x3154]
mov ecx, dword [ebp - 0x30b0]
mov edx, dword [eax]
sub edx, dword [ecx]
mov dword [ebp - 0x30cc], edx
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 7]
shl eax, cl
mov ecx, dword [ebp - 0x31ac]
mov byte [ecx], al
mov edx, dword [ebp - 0x3188]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
xor eax, edx
mov word [0x56a028], ax
mov eax, dword [ebp - 0x3138]
mov ecx, dword [ebp - 0x309c]
mov edx, dword [eax]
or edx, dword [ecx]
mov dword [ebp - 0x3160], edx
mov eax, dword [ebp - 0x3138]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x310c]
sar edx, cl
mov eax, dword [ebp - 0x309c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x30b0]
mov edx, dword [ebp - 0x30e8]
mov eax, dword [ecx]
add eax, dword [edx]
mov dword [ebp - 0x3078], eax
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ecx]
and edx, dword [ebp - 0x3160]
mov eax, dword [ebp - 0x309c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x314c]
mov eax, dword [ebp - 0x3094]
mov dword [eax], edx
movsx ecx, word [ebp - 0x9c0]
movsx edx, word [ebp - 0x9c8]
sub ecx, edx
mov word [ebp - 0x9bc], cx
mov eax, dword [ebp - 0x30dc]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 1]
sub ecx, edx
mov byte [ebp - 6], cl
movzx eax, word [ebp - 0x316c]
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0x3074], ax
movzx eax, word [ebp - 0x9c4]
movzx ecx, word [ebp - 0x3074]
add eax, ecx
mov edx, dword [0x56bb04]
mov word [edx], ax
mov eax, dword [ebp - 0x3170]
sub eax, 0x4f
mov dword [ebp - 0x3170], eax
mov ecx, dword [ebp - 0x3078]
add ecx, dword [ebp - 0x3198]
mov edx, dword [ebp - 0x30e8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3094]
mov ecx, dword [0x56baf4]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x3120]
mov dword [edx], ecx
movzx eax, word [ebp - 0x3074]
movzx ecx, word [ebp - 0x316c]
and eax, ecx
mov edx, dword [ebp - 0x30e4]
mov word [edx], ax
mov eax, dword [ebp - 0x30e0]
movzx edx, byte [eax]
movzx ecx, byte [ebp - 3]
sar edx, cl
mov eax, dword [ebp - 0x30e0]
mov byte [eax], dl
mov ecx, dword [ebp - 0x308c]
or ecx, dword [ebp - 0x3078]
mov edx, dword [ebp - 0x3098]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3094]
mov ecx, dword [ebp - 0x3054]
xor ecx, dword [eax]
mov edx, dword [ebp - 0x3060]
mov dword [edx], ecx
mov eax, dword [ebp - 0x31a0]
mov ecx, dword [ebp - 0x3138]
mov edx, dword [eax]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0x3060]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3154]
mov edx, dword [ebp - 0x318c]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x3064], eax
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
add edx, ecx
mov eax, dword [0x56bb04]
mov word [eax], dx
movzx ecx, byte [ebp - 7]
mov edx, dword [ebp - 0x31ac]
movzx eax, byte [edx]
and ecx, eax
mov byte [ebp - 5], cl
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ecx]
add edx, dword [0x56baf4]
mov eax, dword [ebp - 0x309c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3138]
mov edx, dword [ebp - 0x3060]
mov eax, dword [ecx]
add eax, dword [edx]
mov dword [ebp - 0x310c], eax
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
movsx eax, byte [0x5430d6]
sub edx, eax
mov ecx, dword [ebp - 0x30dc]
mov byte [ecx], dl
movsx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x30dc]
movsx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 2], dl
movzx edx, byte [ebp - 4]
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x31ac]
mov byte [eax], dl
mov ecx, dword [0x56bb04]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x3090]
sub edx, eax
mov word [ebp - 0x9c4], dx
mov ecx, dword [ebp - 0x308c]
sub ecx, dword [ebp - 0x30cc]
mov dword [ebp - 0x3078], ecx
movsx edx, byte [ebp - 2]
movsx eax, byte [ebp - 6]
add edx, eax
mov byte [0x5430d6], dl
mov ecx, dword [ebp - 0x31a0]
mov edx, dword [ebp - 0x3094]
mov eax, dword [ecx]
or eax, dword [edx]
mov ecx, dword [ebp - 0x3138]
mov dword [ecx], eax
mov edx, dword [ebp - 0x31a0]
mov eax, dword [ebp - 0x3138]
mov ecx, dword [edx]
xor ecx, dword [eax]
mov edx, dword [ebp - 0x3060]
mov dword [edx], ecx
mov eax, dword [ebp - 0x309c]
mov ecx, dword [ebp - 0x3060]
mov edx, dword [eax]
mov ecx, dword [ecx]
sar edx, cl
mov dword [ebp - 0x314c], edx
movzx eax, byte [ebp - 3]
mov ecx, dword [ebp - 0x3134]
movzx ecx, byte [ecx]
shl eax, cl
mov byte [ebp - 5], al
mov edx, dword [0x56bb04]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x316c]
and eax, ecx
mov word [ebp - 0x9c4], ax
mov edx, dword [ebp - 0x3098]
mov eax, dword [edx]
sub eax, dword [ebp - 0x308c]
mov dword [ebp - 0x3198], eax
mov ecx, dword [ebp - 0x3120]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x310c]
mov eax, dword [ebp - 0x3094]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ebp - 0x3060]
mov eax, dword [ecx]
and eax, dword [edx]
mov dword [ebp - 0x307c], eax
mov ecx, dword [ebp - 0x318c]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x308c]
mov dword [ebp - 0x30cc], edx
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
add ecx, eax
mov word [0x56a028], cx
mov ecx, dword [ebp - 0x31ac]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
add edx, eax
mov byte [ebp - 4], dl
movzx ecx, word [0x56a028]
mov edx, dword [ebp - 0x3188]
movzx eax, word [edx]
sub ecx, eax
mov edx, dword [ebp - 0x3184]
mov word [edx], cx
movsx eax, byte [ebp - 6]
movsx ecx, byte [ebp - 1]
add eax, ecx
mov edx, dword [ebp - 0x30dc]
mov byte [edx], al
mov eax, dword [ebp - 0x3154]
mov ecx, dword [eax]
xor ecx, dword [ebp - 0x3064]
mov dword [ebp - 0x308c], ecx
mov edx, dword [ebp - 0x3058]
mov ecx, dword [ebp - 0x314c]
sar edx, cl
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3134]
movzx edx, byte [ecx]
movzx ecx, byte [ebp - 5]
shl edx, cl
mov byte [ebp - 4], dl
movzx eax, word [ebp - 0x316c]
movzx ecx, word [ebp - 0x3090]
or eax, ecx
mov edx, dword [ebp - 0x30e4]
mov word [edx], ax
mov eax, dword [ebp - 0x3120]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x310c]
mov edx, dword [ebp - 0x3138]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x3074]
sub ecx, edx
mov eax, dword [0x56bb04]
mov word [eax], cx
cmp dword [ebp - 0x3170], 0x703e
ja 0x405d05
movzx ecx, word [ebp - 0x3074]
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
sub ecx, eax
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
movzx edx, word [ebp - 0x9c4]
add eax, edx
cmp ecx, eax
jl 0x4061a3
mov eax, dword [ebp - 0x3174]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x30dc]
movzx eax, byte [edx]
push eax
call fcn.00516150
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ecx]
mov dword [ebp - 0x31b8], edx
mov eax, dword [ebp - 0x314c]
sub eax, dword [ebp - 0x3084]
mov dword [ebp - 0x31b8], eax
movzx ecx, word [ebp - 0x3074]
mov dword [ebp - 0x31bc], ecx
cmp dword [ebp - 0x31bc], 0x2aa9
je 0x4061e1
jmp 0x515ab6
mov edx, dword [ebp - 0x30dc]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 6]
add eax, ecx
movsx edx, byte [ebp - 2]
movsx ecx, byte [ebp - 1]
add edx, ecx
cmp eax, edx
jl 0x406312
lea edx, [ebp - 0x3078]
mov dword [ebp - 0x31c0], edx
mov eax, dword [ebp - 0x3094]
mov edx, dword [ebp - 0x310c]
mov ecx, dword [eax]
shl edx, cl
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x3120]
mov eax, dword [ecx]
xor eax, dword [edx]
mov ecx, dword [ebp - 0x3060]
mov dword [ecx], eax
movzx edx, word [ebp - 0x3074]
mov eax, dword [ebp - 0x3188]
movzx ecx, word [eax]
or edx, ecx
movzx eax, word [ebp - 0x9c4]
movzx ecx, word [ebp - 0x316c]
and eax, ecx
cmp edx, eax
jle 0x4062fe
mov edx, dword [ebp - 0x30e8]
mov eax, dword [edx]
sub eax, dword [ebp - 0x3078]
mov ecx, dword [ebp - 0x3174]
mov edx, dword [ebp - 0x3198]
sub edx, dword [ecx]
cmp eax, edx
jbe 0x4062fc
mov eax, dword [ebp - 0x3094]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x3160]
mov edx, dword [ebp - 0x3120]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3098]
mov ecx, dword [ebp - 0x30cc]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x3154]
mov eax, dword [ebp - 0x3064]
add eax, dword [edx]
cmp ecx, eax
je 0x4062fc
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x31b8]
mov dword [0x56baf4], edx
mov eax, dword [ebp - 0x31c4]
push eax
call dword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [ebp - 0x3118], eax
movzx edx, byte [ebp - 4]
mov eax, dword [ebp - 0x30e0]
movzx ecx, byte [eax]
sar edx, cl
mov ecx, dword [ebp - 0x31ac]
mov byte [ecx], dl
jmp 0x406310
mov edx, dword [ebp - 0x30dc]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 1]
or eax, ecx
mov byte [ebp - 2], al
jmp 0x40632b
mov edx, dword [ebp - 0x3188]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x9c4]
shl eax, cl
mov word [ebp - 0x3090], ax
mov cl, byte [ebp - 5]
mov byte [ebp - 8], cl
mov dword [ebp - 0x31c8], 0x1838
mov edx, dword [ebp - 0x3064]
and edx, dword [ebp - 0x3198]
mov dword [ebp - 0x308c], edx
lea eax, [ebp - 0x308c]
mov dword [ebp - 0x31cc], eax
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
sub edx, ecx
mov eax, dword [ebp - 0x30e4]
mov word [eax], dx
mov ecx, dword [ebp - 0x313c]
add ecx, 0x7b
mov dword [ebp - 0x313c], ecx
movzx edx, byte [ebp - 4]
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 8], dl
mov edx, dword [ebp - 0x309c]
mov eax, dword [ebp - 0x307c]
add eax, dword [edx]
mov dword [0x56baf4], eax
mov ecx, dword [ebp - 0x308c]
sub ecx, dword [ebp - 0x3078]
mov edx, dword [ebp - 0x30b0]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3120]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x3160]
mov dword [ebp - 0x3084], ecx
mov edx, dword [ebp - 0x3060]
mov eax, dword [ebp - 0x3138]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [ebp - 0x3058], ecx
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
and eax, edx
mov ecx, dword [ebp - 0x3184]
mov word [ecx], ax
mov edx, dword [ebp - 0x3148]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x3134]
movzx edx, byte [ecx]
sub eax, edx
mov byte [ebp - 8], al
mov eax, dword [ebp - 0x3098]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x3078]
shl edx, cl
mov eax, dword [ebp - 0x3174]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3138]
mov edx, dword [ebp - 0x3094]
mov eax, dword [ecx]
xor eax, dword [edx]
mov ecx, dword [ebp - 0x309c]
mov dword [ecx], eax
movsx edx, byte [ebp - 1]
movsx eax, byte [ebp - 6]
or edx, eax
mov byte [ebp - 2], dl
movzx edx, word [ebp - 0x316c]
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
sar edx, cl
mov ecx, dword [0x56bb04]
mov word [ecx], dx
movzx edx, word [0x56a028]
movzx eax, word [ebp - 0x3090]
add edx, eax
mov word [ebp - 0x3074], dx
mov ecx, dword [ebp - 0x31ac]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x3148]
movzx ecx, byte [eax]
and edx, ecx
mov byte [ebp - 8], dl
mov edx, dword [ebp - 0x30e8]
mov eax, dword [edx]
add eax, dword [ebp - 0x3064]
mov ecx, dword [ebp - 0x318c]
mov dword [ecx], eax
cmp dword [ebp - 0x313c], 0x8def
jb 0x406359
mov edx, dword [ebp - 0x31b8]
sub edx, dword [ebp - 0x3058]
mov eax, dword [ebp - 0x3060]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3120]
mov edx, dword [ecx]
add edx, dword [ebp - 0x314c]
mov dword [ebp - 0x3084], edx
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [ebp - 0x3154]
mov edx, dword [eax]
add edx, dword [ecx]
mov eax, dword [ebp - 0x3098]
mov ecx, dword [ebp - 0x30cc]
sub ecx, dword [eax]
cmp edx, ecx
jb 0x40655c
movsx edx, byte [ebp - 1]
movsx eax, byte [ebp - 6]
sub edx, eax
mov ecx, dword [ebp - 0x30dc]
movsx eax, byte [ecx]
movsx ecx, byte [ebp - 2]
add eax, ecx
cmp edx, eax
jl 0x40653e
mov edx, dword [ebp - 0x30dc]
mov cl, byte [edx]
call fcn.00515e10
jmp 0x40655c
mov eax, dword [ebp - 0x30cc]
mov dword [ebp - 0x31d0], eax
mov ecx, dword [0x56baf4]
xor ecx, dword [ebp - 0x314c]
mov dword [ebp - 0x3054], ecx
mov dl, byte [ebp - 5]
mov byte [ebp - 9], dl
movsx eax, word [ebp - 0x9bc]
movsx ecx, word [ebp - 0x9c0]
or eax, ecx
mov word [0x56a038], ax
mov dword [ebp - 0x31d4], 0xb4a9
movzx eax, word [ebp - 0x3074]
mov edx, dword [ebp - 0x3184]
movzx ecx, word [edx]
cdq
idiv ecx
mov edx, dword [ebp - 0x3188]
mov word [edx], ax
cmp dword [ebp - 0x31d4], 0xc277
jae 0x4068d6
mov eax, dword [ebp - 0x3138]
mov edx, dword [ebp - 0x3160]
mov ecx, dword [eax]
sar edx, cl
mov eax, dword [ebp - 0x31a0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x318c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x30cc]
shl edx, cl
mov eax, dword [ebp - 0x31c0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3120]
mov edx, dword [ebp - 0x3138]
mov eax, dword [ecx]
add eax, dword [edx]
mov dword [ebp - 0x310c], eax
mov ecx, dword [ebp - 0x31a0]
mov edx, dword [0x56baf4]
add edx, dword [ecx]
mov dword [ebp - 0x310c], edx
movzx eax, word [ebp - 0x316c]
movzx ecx, word [ebp - 0x3074]
and eax, ecx
mov word [ebp - 0x9c4], ax
movzx edx, byte [ebp - 9]
mov eax, dword [ebp - 0x31ac]
movzx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x3134]
mov byte [eax], dl
movsx ecx, byte [ebp - 6]
movsx edx, byte [ebp - 1]
sub ecx, edx
mov byte [ebp - 2], cl
movsx eax, word [ebp - 0x9bc]
movsx ecx, word [ebp - 0x9c0]
add eax, ecx
mov word [0x56a038], ax
mov edx, dword [ebp - 0x3064]
sub edx, dword [ebp - 0x3078]
mov dword [ebp - 0x308c], edx
mov eax, dword [ebp - 0x31a0]
mov ecx, dword [ebp - 0x3094]
mov edx, dword [eax]
add edx, dword [ecx]
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
movzx ecx, word [ebp - 0x9c4]
mov edx, dword [ebp - 0x3188]
movzx eax, word [edx]
sub ecx, eax
mov word [ebp - 0x3074], cx
movzx ecx, byte [ebp - 9]
mov edx, dword [ebp - 0x3134]
movzx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0x30e0]
mov byte [edx], cl
mov eax, dword [ebp - 0x3154]
mov ecx, dword [ebp - 0x31cc]
mov edx, dword [eax]
add edx, dword [ecx]
mov eax, dword [ebp - 0x3174]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3120]
mov edx, dword [ebp - 0x3138]
mov eax, dword [ecx]
xor eax, dword [edx]
mov dword [ebp - 0x310c], eax
mov ecx, dword [ebp - 0x3138]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3084]
sar edx, cl
mov dword [ebp - 0x3048], edx
mov eax, dword [ebp - 0x308c]
or eax, dword [ebp - 0x3064]
mov ecx, dword [ebp - 0x30b0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x3074]
shl eax, cl
mov word [0x56a028], ax
movzx ecx, byte [ebp - 8]
mov edx, dword [ebp - 0x31ac]
movzx eax, byte [edx]
and ecx, eax
mov edx, dword [ebp - 0x30e0]
mov byte [edx], cl
mov eax, dword [ebp - 0x3094]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x30a0]
mov edx, dword [ebp - 0x3060]
mov dword [edx], ecx
mov eax, dword [0x56baf4]
add eax, dword [ebp - 0x307c]
mov dword [ebp - 0x310c], eax
mov ecx, dword [ebp - 0x3174]
mov edx, dword [ebp - 0x30e8]
mov eax, dword [ecx]
and eax, dword [edx]
mov dword [ebp - 0x30cc], eax
mov ecx, dword [ebp - 0x3138]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x307c]
mov dword [ebp - 0x3160], edx
mov eax, dword [ebp - 0x309c]
mov ecx, dword [ebp - 0x31a0]
mov edx, dword [eax]
add edx, dword [ecx]
mov eax, dword [ebp - 0x3060]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
movzx eax, word [0x56a028]
sub edx, eax
mov ecx, dword [ebp - 0x30e4]
mov word [ecx], dx
mov edx, dword [ebp - 0x30dc]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 1]
sub eax, ecx
mov byte [ebp - 2], al
movzx edx, word [ebp - 0x9c4]
movzx eax, word [ebp - 0x3090]
sub edx, eax
mov ecx, dword [0x56bb04]
mov word [ecx], dx
movzx edx, byte [ebp - 7]
mov eax, dword [ebp - 0x3148]
movzx ecx, byte [eax]
shl edx, cl
mov byte [ebp - 9], dl
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ebp - 0x30e8]
mov eax, dword [ecx]
or eax, dword [edx]
mov ecx, dword [ebp - 0x30b0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3060]
mov eax, dword [ebp - 0x314c]
mov ecx, dword [edx]
sar eax, cl
mov ecx, dword [ebp - 0x309c]
mov dword [ecx], eax
movzx edx, word [ebp - 0x3090]
movzx eax, word [ebp - 0x9c4]
xor edx, eax
mov ecx, dword [ebp - 0x30e4]
mov word [ecx], dx
mov edx, dword [ebp - 0x31d4]
add edx, 0x26
mov dword [ebp - 0x31d4], edx
movzx eax, byte [ebp - 9]
mov ecx, dword [ebp - 0x3134]
movzx edx, byte [ecx]
and eax, edx
mov ecx, dword [ebp - 0x30e0]
mov byte [ecx], al
mov edx, dword [ebp - 0x30e8]
mov eax, dword [ebp - 0x31c0]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [ebp - 0x30cc], ecx
mov edx, dword [ebp - 0x31a0]
mov eax, dword [ebp - 0x3060]
mov ecx, dword [edx]
add ecx, dword [eax]
mov edx, dword [ebp - 0x3138]
mov dword [edx], ecx
mov eax, dword [0x56baf4]
sub eax, dword [ebp - 0x3084]
mov ecx, dword [ebp - 0x3094]
mov dword [ecx], eax
mov edx, dword [ebp - 0x30dc]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 6]
add eax, ecx
mov byte [0x5430d6], al
mov edx, dword [ebp - 0x3148]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 8]
and eax, ecx
mov byte [ebp - 3], al
jmp 0x40659e
mov edx, dword [ebp - 0x3188]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
imul eax, edx
mov word [ebp - 0x9c4], ax
lea eax, [ebp - 0x307c]
mov dword [ebp - 0x31d8], eax
mov ecx, dword [0x56baf4]
add ecx, dword [ebp - 0x3054]
mov dword [ebp - 0x307c], ecx
movzx edx, word [ebp - 0x3090]
mov dword [ebp - 0x31dc], edx
cmp dword [ebp - 0x31dc], 1
je 0x40692b
jmp 0x4069e1
mov ax, word [ebp - 0x9bc]
mov word [ebp - 0x9cc], ax
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
movsx eax, byte [ebp - 1]
sub edx, eax
mov byte [ebp - 2], dl
movsx ecx, word [ebp - 0x9c8]
mov dword [ebp - 0x31e0], ecx
cmp dword [ebp - 0x31e0], 0x5bb
je 0x4069c9
cmp dword [ebp - 0x31e0], 0xf15
je 0x406972
jmp 0x4069dc
mov edx, dword [ebp - 0x3120]
mov eax, dword [edx]
sub eax, dword [0x56baf4]
mov ecx, dword [ebp - 0x31d8]
mov edx, dword [ebp - 0x310c]
sub edx, dword [ecx]
cmp eax, edx
jl 0x4069c7
lea eax, [ebp - 5]
mov dword [ebp - 0x31e4], eax
mov dword [ebp - 0x31e8], 0xd6dd
movzx edx, word [ebp - 0x3090]
movzx ecx, word [0x56a028]
shl edx, cl
mov word [ebp - 0x316c], dx
lea eax, [ebp - 0x31b8]
mov dword [0x56bb10], eax
jmp 0x4069dc
lea ecx, [ebp - 0x131d4]
push ecx
call dword [sym.imp.COMCTL32.dll_PropertySheetA]
mov dword [ebp - 0x30a0], eax
jmp 0x406a7f
mov edx, dword [ebp - 0x3188]
movzx eax, word [edx]
mov dword [ebp - 0x31ec], eax
cmp dword [ebp - 0x31ec], 0xbfb
je 0x4069fe
jmp 0x406a1a
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ebp - 0x3174]
mov eax, dword [ecx]
mov ecx, dword [edx]
shr eax, cl
mov ecx, dword [ebp - 0x30b0]
mov dword [ecx], eax
jmp 0x406a7f
mov edx, dword [ebp - 0x3098]
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [edx]
xor ecx, dword [eax]
mov dword [ebp - 0x3078], ecx
mov edx, dword [ebp - 0x31d8]
mov eax, dword [ebp - 0x309c]
mov ecx, dword [edx]
or ecx, dword [eax]
mov edx, dword [ebp - 0x3120]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3120]
mov ecx, dword [0x56bb10]
mov edx, dword [eax]
and edx, dword [ecx]
mov dword [ebp - 0x30a0], edx
lea eax, [ebp - 0x31a8]
push eax
mov ecx, dword [ebp - 0x3104]
push ecx
mov edx, dword [ebp - 0x3070]
push edx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x3130], eax
mov eax, dword [ebp - 0x3120]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x307c]
mov edx, dword [ebp - 0x3138]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3188]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x9c4]
add ecx, edx
mov word [ebp - 0x3074], cx
mov eax, dword [ebp - 0x31e4]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x3148]
movzx eax, byte [edx]
sub ecx, eax
mov byte [ebp - 5], cl
mov ecx, dword [ebp - 0x30b0]
mov edx, dword [ebp - 0x318c]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x3098]
mov dword [ecx], eax
mov edx, dword [ebp - 0x31a0]
mov eax, dword [ebp - 0x310c]
sub eax, dword [edx]
mov dword [ebp - 0x3054], eax
mov ecx, dword [ebp - 0x31b8]
and ecx, dword [ebp - 0x307c]
mov dword [0x56baf4], ecx
mov edx, dword [ebp - 0x31c0]
mov eax, dword [edx]
add eax, dword [ebp - 0x3198]
mov ecx, dword [ebp - 0x3098]
mov dword [ecx], eax
movzx edx, byte [ebp - 7]
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 8], dl
movzx edx, word [ebp - 0x3074]
movzx eax, word [ebp - 0x9c4]
add edx, eax
mov ecx, dword [ebp - 0x30e4]
mov word [ecx], dx
movzx edx, byte [ebp - 5]
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
or edx, ecx
mov eax, dword [ebp - 0x3148]
mov byte [eax], dl
mov ecx, dword [ebp - 0x31c8]
add ecx, 0x46
mov dword [ebp - 0x31c8], ecx
movsx edx, byte [ebp - 6]
movsx ecx, byte [ebp - 2]
sar edx, cl
mov byte [ebp - 1], dl
mov eax, dword [ebp - 0x318c]
mov ecx, dword [ebp - 0x3098]
mov edx, dword [eax]
xor edx, dword [ecx]
mov dword [ebp - 0x31d0], edx
mov eax, dword [ebp - 0x3094]
mov edx, dword [ebp - 0x31b8]
mov ecx, dword [eax]
shl edx, cl
mov dword [ebp - 0x3160], edx
movzx eax, byte [ebp - 7]
mov ecx, dword [ebp - 0x3134]
movzx edx, byte [ecx]
and eax, edx
mov ecx, dword [ebp - 0x30e0]
mov byte [ecx], al
movzx edx, word [ebp - 0x3074]
movzx eax, word [ebp - 0x316c]
add edx, eax
mov word [0x56a028], dx
mov ecx, dword [ebp - 0x3138]
mov edx, dword [ebp - 0x31b8]
sub edx, dword [ecx]
mov dword [ebp - 0x314c], edx
mov eax, dword [ebp - 0x31cc]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x3078]
mov dword [ebp - 0x3198], ecx
mov edx, dword [ebp - 0x30a0]
add edx, dword [ebp - 0x3054]
mov eax, dword [ebp - 0x3094]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3048]
sub ecx, dword [0x56baf4]
mov edx, dword [ebp - 0x31d8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
sub ecx, eax
mov edx, dword [ebp - 0x3188]
mov word [edx], cx
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
and eax, ecx
mov byte [ebp - 7], al
mov edx, dword [ebp - 0x3174]
mov eax, dword [ebp - 0x31c0]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [ebp - 0x31d0], ecx
mov edx, dword [ebp - 0x31d8]
mov eax, dword [ebp - 0x3054]
xor eax, dword [edx]
mov ecx, dword [ebp - 0x3138]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3094]
mov eax, dword [ebp - 0x31d8]
mov edx, dword [edx]
mov ecx, dword [eax]
sar edx, cl
mov eax, dword [0x56bb10]
mov dword [eax], edx
mov ecx, dword [ebp - 0x31a0]
mov edx, dword [ecx]
or edx, dword [ebp - 0x3054]
mov dword [ebp - 0x3160], edx
mov eax, dword [ebp - 0x31d8]
mov edx, dword [ebp - 0x3160]
mov ecx, dword [eax]
shl edx, cl
mov dword [ebp - 0x3058], edx
movsx eax, word [ebp - 0x9c8]
movsx ecx, word [ebp - 0x9bc]
sub eax, ecx
mov word [ebp - 0x9cc], ax
mov edx, dword [ebp - 0x30dc]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 6]
and eax, ecx
mov byte [ebp - 2], al
mov edx, dword [ebp - 0x3148]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x31e4]
movzx edx, byte [ecx]
add eax, edx
mov byte [ebp - 7], al
movzx eax, word [0x56a028]
movzx ecx, word [ebp - 0x316c]
add eax, ecx
mov word [ebp - 0x9c4], ax
mov edx, dword [ebp - 0x3078]
add edx, dword [ebp - 0x308c]
mov dword [ebp - 0x3064], edx
mov eax, dword [ebp - 0x31d0]
sub eax, dword [ebp - 0x3198]
mov dword [ebp - 0x30cc], eax
movzx ecx, word [ebp - 0x3074]
mov edx, dword [ebp - 0x3188]
movzx eax, word [edx]
sub ecx, eax
mov word [0x56a028], cx
mov ecx, dword [ebp - 0x30e0]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x31e4]
mov byte [eax], dl
mov ecx, dword [0x56bb10]
mov edx, dword [ebp - 0x3094]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x31d8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3174]
mov eax, dword [edx]
and eax, dword [ebp - 0x3198]
mov dword [ebp - 0x30cc], eax
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ebp - 0x3084]
mov ecx, dword [ecx]
sar edx, cl
mov dword [ebp - 0x3058], edx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [eax]
or ecx, dword [ebp - 0x31b8]
mov edx, dword [ebp - 0x309c]
mov dword [edx], ecx
movzx eax, byte [ebp - 5]
movzx ecx, byte [ebp - 4]
xor eax, ecx
mov byte [ebp - 8], al
cmp dword [ebp - 0x31c8], 0x2c74
jne 0x406a95
mov edx, dword [ebp - 0x30dc]
mov al, byte [edx]
mov byte [ebp - 0x31f0], al
cmp byte [ebp - 0x31f0], 0x4b
je 0x406df8
jmp 0x406e15
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
push edx
mov edx, dword [ebp - 0x316c]
mov cl, byte [ebp - 6]
call fcn.00516f50
jmp 0x406eaf
mov eax, dword [0x56bb04]
movzx edx, word [eax]
mov eax, dword [ebp - 0x3188]
movzx ecx, word [eax]
shl edx, cl
movzx ecx, word [ebp - 0x3090]
mov eax, dword [ebp - 0x3184]
movzx eax, word [eax]
add ecx, eax
cmp edx, ecx
je 0x406eaf
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x3048]
mov eax, dword [ebp - 0x3138]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x307c]
cmp edx, ecx
je 0x406ea3
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
add eax, edx
mov ecx, dword [ebp - 0x30e4]
mov word [ecx], ax
mov edx, dword [ebp - 0x3154]
mov eax, dword [edx]
sub eax, dword [ebp - 0x30cc]
mov dword [ebp - 0x3078], eax
mov ecx, dword [ebp - 0x3138]
mov edx, dword [ebp - 0x3054]
sub edx, dword [ecx]
mov dword [0x56baf4], edx
lea eax, [ebp - 0x9bc]
mov dword [ebp - 0x31f4], eax
mov ecx, dword [ebp - 0x3078]
add ecx, dword [ebp - 0x30cc]
mov edx, dword [ebp - 0x318c]
mov eax, dword [ebp - 0x3198]
sub eax, dword [edx]
cmp ecx, eax
je 0x406ee8
mov edx, dword [ebp - 0x3054]
mov ecx, dword [ebp - 0x3058]
shl edx, cl
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
jmp 0x515a0e
mov ecx, dword [ebp - 0x310c]
mov dword [ebp - 0x31f8], ecx
mov dl, byte [ebp - 9]
mov byte [ebp - 0x31fc], dl
cmp byte [ebp - 0x31fc], 7
je 0x406f08
jmp 0x406f7a
mov eax, dword [ebp - 0x31d8]
mov ecx, dword [0x56baf4]
and ecx, dword [eax]
mov edx, dword [ebp - 0x3120]
mov eax, dword [ebp - 0x307c]
add eax, dword [edx]
cmp ecx, eax
jge 0x406f4b
mov ecx, dword [ebp - 0x31cc]
mov edx, dword [ebp - 0x3078]
sub edx, dword [ecx]
mov dword [ebp - 0x3064], edx
mov eax, dword [ebp - 0x30dc]
mov cl, byte [eax]
call fcn.00515e10
jmp 0x406f75
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x31b8]
sub edx, dword [ecx]
mov dword [0x56baf4], edx
push 0x42
mov eax, dword [ebp - 0x3200]
push eax
mov ecx, dword [ebp - 0x3180]
push ecx
call dword [sym.imp.COMCTL32.dll_DrawInsert]
jmp 0x40701a
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0x316c], ax
mov dword [ebp - 0x3204], 0xa1b4
lea eax, [ebp - 9]
mov dword [ebp - 0x3208], eax
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ebp - 0x3060]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x3054], eax
mov ecx, dword [ebp - 0x3154]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x3064]
mov eax, dword [ebp - 0x3098]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ecx]
mov dword [ebp - 0x320c], edx
mov eax, dword [ebp - 0x3094]
mov ecx, dword [eax]
xor ecx, dword [ebp - 0x307c]
mov edx, dword [ebp - 0x3138]
mov dword [edx], ecx
lea eax, [ebp - 8]
mov dword [ebp - 0x3210], eax
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
movzx ecx, word [ebp - 0x316c]
sar edx, cl
mov word [ebp - 0x3074], dx
lea eax, [ebp - 0x9bc]
mov dword [0x56bb20], eax
lea ecx, [ebp - 0x9c8]
mov dword [ebp - 0x3214], ecx
lea edx, [ebp - 2]
mov dword [ebp - 0x3218], edx
mov eax, dword [ebp - 0x3198]
mov ecx, dword [ebp - 0x30cc]
shl eax, cl
mov ecx, dword [ebp - 0x30e8]
mov edx, dword [ecx]
or edx, dword [ebp - 0x3078]
cmp eax, edx
jne 0x51599b
movzx eax, byte [ebp - 9]
movzx ecx, byte [ebp - 8]
sub eax, ecx
mov edx, dword [ebp - 0x31e4]
mov byte [edx], al
mov eax, dword [ebp - 0x30dc]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 2]
and ecx, edx
mov eax, dword [ebp - 0x3218]
movsx edx, byte [eax]
movsx eax, byte [ebp - 6]
imul edx, eax
cmp ecx, edx
jge 0x51591a
mov ecx, dword [ebp - 0x3174]
mov edx, dword [ecx]
mov dword [ebp - 0x321c], edx
cmp dword [ebp - 0x30a4], 0x395e
ja 0x407436
mov eax, dword [ebp - 0x3188]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
sub ecx, eax
mov word [ebp - 0x9c4], cx
movzx ecx, byte [ebp - 9]
movzx edx, byte [ebp - 3]
xor ecx, edx
mov eax, dword [ebp - 0x3148]
mov byte [eax], cl
mov ecx, dword [ebp - 0x31d8]
mov edx, dword [ebp - 0x309c]
mov eax, dword [ecx]
mov ecx, dword [edx]
sar eax, cl
mov dword [ebp - 0x31b8], eax
mov edx, dword [ebp - 0x3058]
mov ecx, dword [0x56baf4]
shl edx, cl
mov dword [ebp - 0x314c], edx
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [eax]
or ecx, dword [ebp - 0x30cc]
mov edx, dword [ebp - 0x31c0]
mov dword [edx], ecx
mov eax, dword [ebp - 0x30a0]
and eax, dword [ebp - 0x307c]
mov ecx, dword [ebp - 0x3060]
mov dword [ecx], eax
mov edx, dword [0x56bb10]
mov eax, dword [ebp - 0x31a0]
mov ecx, dword [edx]
add ecx, dword [eax]
mov edx, dword [ebp - 0x3094]
mov dword [edx], ecx
movsx eax, word [ebp - 0x9cc]
movsx ecx, word [ebp - 0x9c0]
add eax, ecx
mov edx, dword [0x56bb20]
mov word [edx], ax
movsx eax, word [ebp - 0x9c8]
movsx ecx, word [ebp - 0x9bc]
sub eax, ecx
mov word [ebp - 0x9cc], ax
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x3074]
add eax, ecx
mov word [ebp - 0x9c4], ax
mov edx, dword [ebp - 0x31ac]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 9]
sub eax, ecx
mov byte [ebp - 8], al
mov edx, dword [ebp - 0x3154]
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [edx]
and ecx, dword [eax]
mov edx, dword [ebp - 0x318c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3094]
mov ecx, dword [ebp - 0x3138]
mov edx, dword [eax]
add edx, dword [ecx]
mov dword [ebp - 0x31b8], edx
mov eax, dword [ebp - 0x3210]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 4]
sub ecx, edx
mov eax, dword [ebp - 0x3208]
mov byte [eax], cl
movzx ecx, word [ebp - 0x3074]
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
sub ecx, eax
mov word [ebp - 0x3090], cx
mov ecx, dword [ebp - 0x3174]
mov edx, dword [ebp - 0x30e8]
mov eax, dword [ecx]
or eax, dword [edx]
mov ecx, dword [ebp - 0x30b0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x31a0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x31f8]
sar eax, cl
mov ecx, dword [0x56bb10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3120]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x30a0]
shl eax, cl
mov ecx, dword [ebp - 0x31d8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x30b0]
mov eax, dword [ebp - 0x3154]
mov ecx, dword [edx]
xor ecx, dword [eax]
mov dword [ebp - 0x321c], ecx
mov edx, dword [ebp - 0x31e4]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 5]
and eax, ecx
mov byte [ebp - 8], al
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x3074]
add eax, ecx
mov edx, dword [ebp - 0x3188]
mov word [edx], ax
mov eax, dword [ebp - 0x3060]
mov ecx, dword [ebp - 0x3058]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x3094]
mov dword [edx], ecx
mov eax, dword [0x56bb10]
mov ecx, dword [ebp - 0x3058]
add ecx, dword [eax]
mov dword [ebp - 0x31b8], ecx
movsx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x30dc]
movsx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 6], dl
mov edx, dword [ebp - 0x31f4]
movsx eax, word [edx]
mov ecx, dword [0x56bb20]
movsx edx, word [ecx]
add eax, edx
mov ecx, dword [ebp - 0x3214]
mov word [ecx], ax
mov edx, dword [ebp - 0x30a4]
add edx, 0x11
mov dword [ebp - 0x30a4], edx
movzx eax, word [ebp - 0x3074]
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
add eax, edx
mov word [0x56a028], ax
mov eax, dword [ebp - 0x31e4]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x3208]
movzx eax, byte [edx]
and ecx, eax
mov byte [ebp - 7], cl
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x3078]
mov eax, dword [ebp - 0x3174]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3174]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x308c]
mov dword [ebp - 0x3078], edx
mov eax, dword [ebp - 0x31d8]
mov ecx, dword [0x56bb10]
mov edx, dword [eax]
or edx, dword [ecx]
mov dword [ebp - 0x31b8], edx
mov eax, dword [ebp - 0x3094]
mov edx, dword [ebp - 0x3048]
mov ecx, dword [eax]
shl edx, cl
mov eax, dword [ebp - 0x3060]
mov dword [eax], edx
mov ecx, dword [ebp - 0x31a0]
mov edx, dword [ebp - 0x31f8]
mov ecx, dword [ecx]
sar edx, cl
mov dword [ebp - 0x320c], edx
mov eax, dword [0x56bb04]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x9c4]
sub ecx, edx
mov eax, dword [ebp - 0x30e4]
mov word [eax], cx
movzx ecx, byte [ebp - 3]
mov edx, dword [ebp - 0x31e4]
movzx eax, byte [edx]
and ecx, eax
mov byte [ebp - 7], cl
mov ecx, dword [ebp - 0x30b0]
mov edx, dword [ebp - 0x3064]
sub edx, dword [ecx]
mov dword [ebp - 0x31d0], edx
mov eax, dword [ebp - 0x309c]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x307c]
mov edx, dword [0x56bb10]
mov dword [edx], ecx
mov eax, dword [ebp - 0x31d8]
mov ecx, dword [ebp - 0x314c]
add ecx, dword [eax]
mov dword [ebp - 0x307c], ecx
mov edx, dword [ebp - 0x31cc]
mov eax, dword [edx]
sub eax, dword [ebp - 0x3064]
mov ecx, dword [ebp - 0x3174]
mov dword [ecx], eax
movzx edx, word [ebp - 0x3074]
movzx eax, word [ebp - 0x3090]
add edx, eax
mov ecx, dword [ebp - 0x3184]
mov word [ecx], dx
jmp 0x4070a5
cmp dword [ebp - 0x3050], 0x62f1
jae 0x4075cf
mov edx, dword [ebp - 0x3050]
add edx, 0x98
mov dword [ebp - 0x3050], edx
movzx eax, byte [ebp - 4]
mov ecx, dword [ebp - 0x3148]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x3210]
mov byte [ecx], al
mov edx, dword [ebp - 0x31f4]
movsx eax, word [edx]
movsx ecx, word [ebp - 0x9bc]
add eax, ecx
mov word [ebp - 0x9c8], ax
movsx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x3218]
movsx ecx, byte [eax]
and edx, ecx
mov eax, dword [ebp - 0x30dc]
mov byte [eax], dl
mov ecx, dword [ebp - 0x31c0]
mov edx, dword [ebp - 0x318c]
mov eax, dword [ecx]
or eax, dword [edx]
mov dword [ebp - 0x321c], eax
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x31b8]
mov ecx, dword [ecx]
sar edx, cl
mov dword [ebp - 0x320c], edx
mov eax, dword [0x56bb04]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x3188]
movzx eax, word [edx]
xor ecx, eax
mov word [0x56a028], cx
movzx edx, byte [ebp - 4]
movzx ecx, byte [ebp - 5]
shl edx, cl
mov byte [ebp - 9], dl
mov eax, dword [0x56bb10]
mov ecx, dword [ebp - 0x31f8]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x309c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3154]
mov ecx, dword [ebp - 0x31d0]
add ecx, dword [eax]
mov edx, dword [ebp - 0x3098]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3138]
mov ecx, dword [ebp - 0x3160]
and ecx, dword [eax]
mov edx, dword [ebp - 0x3094]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x31f8]
mov edx, dword [ebp - 0x3120]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3208]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x3134]
movzx eax, byte [edx]
add ecx, eax
mov byte [ebp - 8], cl
mov ecx, dword [0x56bb04]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x3074]
sub edx, eax
mov ecx, dword [ebp - 0x3184]
mov word [ecx], dx
mov edx, dword [ebp - 0x31cc]
mov eax, dword [ebp - 0x321c]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x30b0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3160]
sub edx, dword [ebp - 0x31b8]
mov eax, dword [0x56bb10]
mov dword [eax], edx
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ebp - 0x31b8]
add edx, dword [ecx]
mov dword [ebp - 0x314c], edx
mov eax, dword [ebp - 0x3160]
add eax, dword [ebp - 0x307c]
mov dword [ebp - 0x3058], eax
jmp 0x407436
mov ecx, dword [ebp - 0x31d8]
mov edx, dword [ebp - 0x3048]
add edx, dword [ecx]
mov eax, dword [ebp - 0x31a0]
mov esi, dword [ebp - 0x3058]
mov ecx, dword [eax]
shl esi, cl
cmp edx, esi
jne 0x407658
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x3218]
movsx ecx, byte [eax]
sar edx, cl
movsx ecx, byte [ebp - 1]
movsx eax, byte [ebp - 2]
and ecx, eax
cmp edx, ecx
jle 0x407643
push 0x3d
push 8
push 1
mov ecx, dword [ebp - 0x3220]
push ecx
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0x3168], eax
mov edx, dword [ebp - 0x3138]
mov eax, dword [ebp - 0x3094]
mov ecx, dword [edx]
add ecx, dword [eax]
mov edx, dword [ebp - 0x3060]
mov dword [edx], ecx
mov dword [ebp - 0x3224], 0x56a038
lea eax, [ebp - 6]
mov dword [ebp - 0x3228], eax
jmp 0x4076c6
mov ecx, dword [ebp - 0x31a0]
mov edx, dword [0x56bb10]
mov eax, dword [ecx]
xor eax, dword [edx]
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ebp - 0x3058]
or edx, dword [ecx]
cmp eax, edx
jle 0x4076c6
movzx eax, word [ebp - 0x9c4]
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0x3090], ax
mov eax, dword [ebp - 0x3188]
movzx ecx, word [eax]
push ecx
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
push eax
mov ecx, dword [ebp - 0x30cc]
push ecx
mov edx, dword [ebp - 0x31cc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x3198]
push ecx
call fcn.00516630
add esp, 0x14
cmp dword [ebp - 0x31e8], 0xbbaf
jb 0x40798e
mov edx, dword [ebp - 0x31e8]
sub edx, 0x47
mov dword [ebp - 0x31e8], edx
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 9]
and eax, ecx
mov byte [ebp - 7], al
mov edx, dword [ebp - 0x31c0]
mov eax, dword [ebp - 0x3198]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x30e8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x30dc]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x3218]
movsx edx, byte [ecx]
sub eax, edx
mov byte [0x5430d6], al
mov eax, dword [ebp - 0x3210]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
add ecx, edx
mov byte [ebp - 5], cl
movzx eax, word [ebp - 0x3074]
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x30e4]
mov word [ecx], ax
mov edx, dword [ebp - 0x31d8]
mov eax, dword [edx]
sub eax, dword [ebp - 0x3048]
mov dword [ebp - 0x30a0], eax
mov ecx, dword [ebp - 0x3154]
mov edx, dword [ebp - 0x31d0]
mov ecx, dword [ecx]
shl edx, cl
mov dword [ebp - 0x321c], edx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [ebp - 0x3094]
mov edx, dword [eax]
mov ecx, dword [ecx]
sar edx, cl
mov eax, dword [ebp - 0x31d8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x309c]
mov eax, dword [ecx]
xor eax, dword [edx]
mov ecx, dword [ebp - 0x3120]
mov dword [ecx], eax
movzx edx, byte [ebp - 8]
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
or edx, ecx
mov byte [ebp - 5], dl
mov edx, dword [0x56bb04]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
and eax, edx
mov word [ebp - 0x9c4], ax
movzx eax, word [ebp - 0x3074]
movzx ecx, word [ebp - 0x9c4]
sub eax, ecx
mov edx, dword [0x56bb04]
mov word [edx], ax
mov eax, dword [ebp - 0x3048]
add eax, dword [ebp - 0x3160]
mov dword [ebp - 0x320c], eax
movsx ecx, word [ebp - 0x9cc]
movsx edx, word [ebp - 0x9bc]
sub ecx, edx
mov eax, dword [ebp - 0x3224]
mov word [eax], cx
mov ecx, dword [ebp - 0x3228]
movsx edx, byte [ecx]
movsx eax, byte [ebp - 1]
add edx, eax
mov byte [ebp - 6], dl
movzx ecx, byte [ebp - 8]
mov edx, dword [ebp - 0x3208]
movzx eax, byte [edx]
and ecx, eax
mov edx, dword [ebp - 0x3134]
mov byte [edx], cl
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x3188]
movzx eax, word [edx]
add ecx, eax
mov edx, dword [ebp - 0x30e4]
mov word [edx], cx
mov eax, dword [ebp - 0x3154]
mov ecx, dword [ebp - 0x308c]
add ecx, dword [eax]
mov dword [ebp - 0x321c], ecx
mov edx, dword [ebp - 0x3054]
sub edx, dword [ebp - 0x3058]
mov dword [ebp - 0x31f8], edx
mov eax, dword [ebp - 0x31d8]
mov ecx, dword [ebp - 0x3094]
mov edx, dword [eax]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x31d8]
mov dword [eax], edx
movzx ecx, word [ebp - 0x9c4]
movzx edx, word [ebp - 0x316c]
xor ecx, edx
mov word [0x56a028], cx
mov eax, dword [ebp - 0x3160]
or eax, dword [ebp - 0x307c]
mov ecx, dword [ebp - 0x31a0]
mov dword [ecx], eax
movzx edx, word [ebp - 0x9c4]
mov eax, dword [ebp - 0x3188]
movzx ecx, word [eax]
shl edx, cl
mov ecx, dword [ebp - 0x3184]
mov word [ecx], dx
movzx edx, byte [ebp - 3]
movzx ecx, byte [ebp - 5]
sar edx, cl
mov byte [ebp - 8], dl
mov eax, dword [ebp - 0x3048]
and eax, dword [ebp - 0x310c]
mov dword [ebp - 0x31f8], eax
mov ecx, dword [ebp - 0x318c]
mov edx, dword [ebp - 0x31cc]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x30cc], eax
mov ecx, dword [0x56bb10]
mov edx, dword [ebp - 0x3054]
sub edx, dword [ecx]
mov eax, dword [ebp - 0x31a0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x307c]
mov dword [ebp - 0x30a0], edx
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 5]
add ecx, edx
mov eax, dword [ebp - 0x30e0]
mov byte [eax], cl
movzx ecx, word [ebp - 0x3074]
movzx edx, word [ebp - 0x9c4]
add ecx, edx
mov word [0x56a028], cx
mov eax, dword [ebp - 0x3228]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 1]
and ecx, edx
mov eax, dword [ebp - 0x30dc]
mov byte [eax], cl
jmp 0x4076c6
mov ecx, dword [ebp - 0x3198]
sub ecx, dword [ebp - 0x3078]
mov edx, dword [ebp - 0x31c0]
mov eax, dword [edx]
add eax, dword [ebp - 0x3064]
cmp ecx, eax
jb 0x515844
cmp dword [ebp - 0x319c], 0x9348
je 0x407d03
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x3090]
sub edx, eax
mov ecx, dword [ebp - 0x3188]
mov word [ecx], dx
mov edx, dword [ebp - 0x30e8]
mov eax, dword [edx]
add eax, dword [ebp - 0x308c]
mov dword [ebp - 0x3198], eax
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x3138]
mov eax, dword [ecx]
add eax, dword [edx]
mov dword [ebp - 0x31f8], eax
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ebp - 0x309c]
mov eax, dword [ecx]
add eax, dword [edx]
mov dword [0x56baf4], eax
mov ecx, dword [ebp - 0x318c]
mov edx, dword [ebp - 0x3098]
mov eax, dword [ecx]
and eax, dword [edx]
mov dword [ebp - 0x308c], eax
mov ecx, dword [ebp - 0x30e0]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 8]
sub edx, eax
mov ecx, dword [ebp - 0x3210]
mov byte [ecx], dl
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x3090]
or eax, ecx
mov word [ebp - 0x9c4], ax
mov edx, dword [ebp - 0x3094]
mov eax, dword [ebp - 0x3138]
mov ecx, dword [edx]
xor ecx, dword [eax]
mov edx, dword [ebp - 0x3060]
mov dword [edx], ecx
mov eax, dword [ebp - 0x309c]
mov ecx, dword [ebp - 0x3060]
mov edx, dword [eax]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0x31d8]
mov dword [eax], edx
mov edx, dword [ebp - 0x308c]
mov ecx, dword [ebp - 0x321c]
shr edx, cl
mov dword [ebp - 0x30cc], edx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x3048]
mov dword [ebp - 0x31b8], ecx
mov edx, dword [ebp - 0x3048]
and edx, dword [ebp - 0x314c]
mov dword [ebp - 0x3054], edx
movsx eax, byte [ebp - 1]
movsx ecx, byte [ebp - 2]
sub eax, ecx
mov byte [0x5430d6], al
movsx edx, word [ebp - 0x9cc]
mov eax, dword [ebp - 0x3224]
movsx ecx, word [eax]
sub edx, ecx
mov word [ebp - 0x9c0], dx
mov edx, dword [ebp - 0x319c]
add edx, 0xdf
mov dword [ebp - 0x319c], edx
movzx eax, word [ebp - 0x3074]
movzx ecx, word [ebp - 0x9c4]
sub eax, ecx
mov edx, dword [ebp - 0x3188]
mov word [edx], ax
movzx eax, byte [ebp - 5]
movzx ecx, byte [ebp - 3]
add eax, ecx
mov edx, dword [ebp - 0x3148]
mov byte [edx], al
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [ebp - 0x3064]
add ecx, dword [eax]
mov dword [ebp - 0x30cc], ecx
mov edx, dword [ebp - 0x31a0]
mov eax, dword [edx]
add eax, dword [ebp - 0x307c]
mov ecx, dword [ebp - 0x3120]
mov dword [ecx], eax
movzx edx, byte [ebp - 7]
movzx eax, byte [ebp - 4]
add edx, eax
mov ecx, dword [ebp - 0x3208]
mov byte [ecx], dl
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x316c]
and eax, ecx
mov word [ebp - 0x9c4], ax
mov edx, dword [ebp - 0x3098]
mov eax, dword [ebp - 0x318c]
mov edx, dword [edx]
mov ecx, dword [eax]
shr edx, cl
mov eax, dword [ebp - 0x3174]
mov dword [eax], edx
mov ecx, dword [ebp - 0x31d8]
mov edx, dword [ebp - 0x309c]
mov eax, dword [ecx]
mov ecx, dword [edx]
shl eax, cl
mov dword [0x56baf4], eax
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x3084]
mov dword [ebp - 0x3048], edx
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [ebp - 0x31c0]
mov edx, dword [eax]
or edx, dword [ecx]
mov eax, dword [ebp - 0x31cc]
mov dword [eax], edx
movzx ecx, word [ebp - 0x9c4]
movzx edx, word [ebp - 0x3074]
sub ecx, edx
mov word [ebp - 0x316c], cx
mov eax, dword [ebp - 0x3148]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x31e4]
movzx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0x31ac]
mov byte [edx], cl
mov eax, dword [ebp - 0x3094]
mov ecx, dword [ebp - 0x3138]
mov edx, dword [eax]
and edx, dword [ecx]
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
mov ecx, dword [ebp - 0x31d8]
mov edx, dword [ebp - 0x31b8]
sub edx, dword [ecx]
mov dword [ebp - 0x31f8], edx
movsx eax, byte [ebp - 2]
movsx ecx, byte [ebp - 6]
sub eax, ecx
mov byte [ebp - 1], al
movsx edx, word [ebp - 0x9bc]
movsx eax, word [ebp - 0x9c0]
add edx, eax
mov word [ebp - 0x9cc], dx
movsx ecx, byte [ebp - 2]
movsx edx, byte [ebp - 1]
add ecx, edx
mov byte [0x5430d6], cl
movzx eax, word [ebp - 0x3074]
movzx ecx, word [ebp - 0x3090]
add eax, ecx
mov edx, dword [ebp - 0x3184]
mov word [edx], ax
mov eax, dword [ebp - 0x3174]
mov ecx, dword [ebp - 0x3198]
sub ecx, dword [eax]
mov dword [ebp - 0x3078], ecx
mov edx, dword [ebp - 0x3098]
mov eax, dword [ebp - 0x31cc]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [ebp - 0x30cc], ecx
mov edx, dword [ebp - 0x3060]
mov eax, dword [ebp - 0x3120]
mov ecx, dword [edx]
add ecx, dword [eax]
mov edx, dword [ebp - 0x3138]
mov dword [edx], ecx
mov eax, dword [0x56bb10]
mov ecx, dword [eax]
xor ecx, dword [ebp - 0x3084]
mov edx, dword [ebp - 0x3120]
mov dword [edx], ecx
mov eax, dword [ebp - 0x31a0]
mov edx, dword [ebp - 0x30a0]
mov ecx, dword [eax]
sar edx, cl
mov eax, dword [ebp - 0x3060]
mov dword [eax], edx
jmp 0x4079b0
movzx edx, word [ebp - 0x3074]
mov eax, dword [0x56bb04]
movzx ecx, word [eax]
shl edx, cl
mov ecx, dword [ebp - 0x30e4]
movzx eax, word [ecx]
movzx ecx, word [ebp - 0x316c]
or eax, ecx
cmp edx, eax
je 0x407d64
lea edx, [ebp - 0x131a0]
push edx
mov eax, dword [ebp - 0x31a8]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [ebp - 0x30c0], eax
movzx ecx, word [0x56a028]
mov edx, dword [ebp - 0x3188]
movzx eax, word [edx]
sub ecx, eax
mov edx, dword [ebp - 0x3184]
mov word [edx], cx
jmp 0x515835
movzx eax, byte [ebp - 9]
movzx ecx, byte [ebp - 5]
and eax, ecx
movzx edx, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
add edx, ecx
cmp eax, edx
jge 0x407d92
mov edx, dword [ebp - 0x30e8]
mov eax, dword [ebp - 0x321c]
sub eax, dword [edx]
mov dword [ebp - 0x30cc], eax
jmp 0x407de2
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x3074]
add edx, eax
movzx ecx, word [ebp - 0x3090]
movzx eax, word [ebp - 0x9c4]
add ecx, eax
cmp edx, ecx
jge 0x407de2
movzx ecx, word [ebp - 0x9cc]
push ecx
movzx edx, word [ebp - 0x9c8]
push edx
mov eax, dword [ebp - 0x31ac]
movzx ecx, byte [eax]
push ecx
movzx edx, word [ebp - 0x9c0]
push edx
call fcn.00516820
add esp, 0x10
movzx eax, byte [ebp - 3]
mov ecx, dword [ebp - 0x31ac]
movzx edx, byte [ecx]
sub eax, edx
movzx edx, byte [ebp - 7]
movzx ecx, byte [ebp - 5]
sar edx, cl
cmp eax, edx
jge 0x407ea2
movsx eax, word [ebp - 0x9cc]
mov ecx, dword [ebp - 0x3224]
movsx ecx, word [ecx]
shl eax, cl
mov edx, dword [ebp - 0x3214]
movsx ecx, word [edx]
mov edx, dword [ebp - 0x31f4]
movsx edx, word [edx]
and ecx, edx
cmp eax, ecx
jl 0x407e66
mov eax, dword [0x56bb10]
mov ecx, dword [ebp - 0x3060]
mov edx, dword [eax]
add edx, dword [ecx]
mov eax, dword [0x56bb10]
mov dword [eax], edx
push 0
mov ecx, dword [ebp - 0x1312c]
push ecx
mov edx, dword [ebp - 0x13130]
push edx
mov eax, dword [ebp - 0x322c]
push eax
call dword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [ebp - 0x3230], eax
mov ecx, dword [ebp - 0x3084]
sub ecx, dword [ebp - 0x3230]
mov dword [ebp - 0x31b8], ecx
movzx edx, byte [ebp - 2]
push edx
mov eax, dword [ebp - 0x3048]
push eax
mov ecx, dword [0x56bb20]
movzx edx, word [ecx]
push edx
mov eax, dword [ebp - 0x308c]
push eax
call fcn.00517510
add esp, 0x10
jmp 0x515823
mov ecx, dword [ebp - 0x3198]
sub ecx, dword [ebp - 0x31d0]
mov edx, dword [ebp - 0x30e8]
mov dword [edx], ecx
movzx eax, byte [ebp - 9]
mov ecx, dword [ebp - 0x3210]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x30e0]
mov byte [ecx], al
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x9c4]
and eax, ecx
mov word [ebp - 0x3074], ax
movsx edx, word [0x56a038]
movsx eax, word [ebp - 0x9cc]
add edx, eax
mov word [ebp - 0x9bc], dx
movsx ecx, byte [ebp - 1]
mov edx, dword [ebp - 0x30dc]
movsx eax, byte [edx]
add ecx, eax
mov byte [ebp - 6], cl
mov ecx, dword [ebp - 0x30e8]
mov edx, dword [ebp - 0x3098]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x308c], eax
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x3138]
mov eax, dword [ecx]
add eax, dword [edx]
mov dword [ebp - 0x307c], eax
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
movzx ecx, word [ebp - 0x3090]
sar edx, cl
mov eax, dword [0x56bb04]
mov word [eax], dx
mov ecx, dword [0x56bb04]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
shl edx, cl
mov word [ebp - 0x3090], dx
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x3054]
or edx, dword [ecx]
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3154]
mov edx, dword [ebp - 0x3098]
mov eax, dword [ecx]
xor eax, dword [edx]
mov dword [ebp - 0x3078], eax
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x309c]
mov eax, dword [ecx]
and eax, dword [edx]
mov dword [ebp - 0x3054], eax
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ebp - 0x3138]
mov eax, dword [ecx]
add eax, dword [edx]
mov dword [ebp - 0x31f8], eax
mov ecx, dword [ebp - 0x31ac]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x3148]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 9], dl
movzx edx, word [ebp - 0x9c4]
movzx eax, word [ebp - 0x3074]
sub edx, eax
mov ecx, dword [ebp - 0x3188]
mov word [ecx], dx
mov edx, dword [ebp - 0x3098]
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [edx]
add ecx, dword [eax]
mov edx, dword [ebp - 0x31c0]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3120]
mov ecx, dword [ebp - 0x3084]
add ecx, dword [eax]
mov dword [0x56baf4], ecx
mov edx, dword [ebp - 0x3060]
mov eax, dword [edx]
and eax, dword [ebp - 0x3230]
mov dword [ebp - 0x3160], eax
mov ecx, dword [ebp - 0x3138]
mov edx, dword [ebp - 0x314c]
add edx, dword [ecx]
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3084]
sub ecx, dword [ebp - 0x314c]
mov edx, dword [ebp - 0x31a0]
mov dword [edx], ecx
movsx eax, byte [ebp - 1]
movsx ecx, byte [ebp - 2]
sub eax, ecx
mov byte [ebp - 6], al
mov edx, dword [ebp - 0x3214]
movsx eax, word [edx]
mov ecx, dword [ebp - 0x31f4]
movsx ecx, word [ecx]
shl eax, cl
mov edx, dword [ebp - 0x3224]
mov word [edx], ax
mov eax, dword [ebp - 0x3088]
add eax, 0x22
mov dword [ebp - 0x3088], eax
movzx edx, byte [ebp - 4]
movzx ecx, byte [ebp - 8]
sar edx, cl
mov eax, dword [ebp - 0x30e0]
mov byte [eax], dl
movzx ecx, word [ebp - 0x9c4]
movzx edx, word [ebp - 0x316c]
xor ecx, edx
mov eax, dword [ebp - 0x3184]
mov word [eax], cx
mov ecx, dword [ebp - 0x30e8]
mov edx, dword [ebp - 0x3154]
mov eax, dword [ecx]
or eax, dword [edx]
mov ecx, dword [ebp - 0x31cc]
mov dword [ecx], eax
movzx edx, word [ebp - 0x9c4]
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
and edx, ecx
mov eax, dword [0x56bb04]
mov word [eax], dx
movzx ecx, byte [ebp - 3]
mov edx, dword [ebp - 0x3148]
movzx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0x31ac]
mov byte [edx], cl
mov eax, dword [0x56bb04]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
sub ecx, eax
mov edx, dword [ebp - 0x3184]
mov word [edx], cx
mov eax, dword [ebp - 0x310c]
sub eax, dword [ebp - 0x3084]
mov ecx, dword [ebp - 0x3060]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3154]
mov eax, dword [edx]
add eax, dword [ebp - 0x3078]
mov ecx, dword [ebp - 0x318c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3060]
mov eax, dword [edx]
add eax, dword [ebp - 0x3160]
mov dword [ebp - 0x3084], eax
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ecx]
mov dword [ebp - 0x3230], edx
mov eax, dword [0x56bb04]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
add ecx, eax
mov word [ebp - 0x3090], cx
cmp dword [ebp - 0x3088], 0x512c
jbe 0x407eb6
mov cl, byte [ebp - 8]
mov byte [ebp - 0xa], cl
mov edx, dword [ebp - 0x321c]
mov dword [0x56bb30], edx
mov eax, dword [ebp - 0x321c]
and eax, dword [0x56bb30]
mov ecx, dword [ebp - 0x3154]
mov dword [ecx], eax
mov edx, dword [ebp - 0x31a0]
mov eax, dword [edx]
sub eax, dword [ebp - 0x314c]
mov dword [ebp - 0x307c], eax
cmp dword [ebp - 0x315c], 0x9c39
jae 0x4083ff
movsx ecx, byte [ebp - 6]
mov edx, dword [ebp - 0x3228]
movsx eax, byte [edx]
xor ecx, eax
mov byte [ebp - 2], cl
mov ecx, dword [ebp - 0x315c]
add ecx, 0xce
mov dword [ebp - 0x315c], ecx
mov edx, dword [0x56bb20]
movsx eax, word [edx]
mov ecx, dword [ebp - 0x3214]
movsx ecx, word [ecx]
sar eax, cl
mov edx, dword [ebp - 0x31f4]
mov word [edx], ax
movzx eax, byte [ebp - 8]
mov ecx, dword [ebp - 0x3134]
movzx edx, byte [ecx]
or eax, edx
mov byte [ebp - 9], al
movzx eax, word [ebp - 0x3074]
mov ecx, dword [ebp - 0x3188]
movzx ecx, word [ecx]
shl eax, cl
mov word [ebp - 0x3090], ax
mov edx, dword [ebp - 0x31c0]
mov eax, dword [ebp - 0x3098]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x30b0]
mov dword [edx], ecx
mov eax, dword [ebp - 0x31a0]
mov ecx, dword [ebp - 0x3120]
mov edx, dword [eax]
and edx, dword [ecx]
mov dword [ebp - 0x30a0], edx
mov eax, dword [ebp - 0x31f8]
sub eax, dword [ebp - 0x30a0]
mov ecx, dword [0x56bb10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3078]
sub edx, dword [ebp - 0x30cc]
mov dword [ebp - 0x3198], edx
mov eax, dword [ebp - 0x3094]
mov ecx, dword [0x56baf4]
add ecx, dword [eax]
mov dword [ebp - 0x3054], ecx
movzx edx, byte [ebp - 5]
mov eax, dword [ebp - 0x30e0]
movzx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 0xa], dl
movzx edx, word [ebp - 0x9c4]
movzx eax, word [0x56a028]
add edx, eax
mov ecx, dword [ebp - 0x30e4]
mov word [ecx], dx
mov edx, dword [ebp - 0x3060]
mov eax, dword [edx]
sub eax, dword [ebp - 0x3054]
mov dword [ebp - 0x320c], eax
mov ecx, dword [ebp - 0x3174]
mov edx, dword [ebp - 0x31c0]
mov eax, dword [ecx]
add eax, dword [edx]
mov dword [ebp - 0x3064], eax
mov ecx, dword [ebp - 0x3120]
mov edx, dword [ebp - 0x3094]
mov eax, dword [ecx]
and eax, dword [edx]
mov dword [ebp - 0x320c], eax
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x3094]
mov eax, dword [ecx]
mov ecx, dword [edx]
shl eax, cl
mov dword [ebp - 0x307c], eax
movzx edx, word [ebp - 0x316c]
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
sar edx, cl
mov word [0x56a028], dx
movzx ecx, byte [ebp - 0xa]
movzx edx, byte [ebp - 7]
or ecx, edx
mov byte [ebp - 4], cl
mov eax, dword [ebp - 0x3218]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x30dc]
movsx eax, byte [edx]
xor ecx, eax
mov edx, dword [ebp - 0x3228]
mov byte [edx], cl
mov eax, dword [ebp - 0x3224]
movsx ecx, word [eax]
mov edx, dword [ebp - 0x31f4]
movsx eax, word [edx]
add ecx, eax
mov word [ebp - 0x9c0], cx
mov ecx, dword [ebp - 0x31cc]
mov edx, dword [ebp - 0x321c]
add edx, dword [ecx]
mov eax, dword [ebp - 0x3174]
mov dword [eax], edx
mov ecx, dword [ebp - 0x31d8]
mov edx, dword [ebp - 0x3094]
mov eax, dword [ecx]
and eax, dword [edx]
mov ecx, dword [ebp - 0x309c]
mov dword [ecx], eax
movzx edx, byte [ebp - 4]
mov eax, dword [ebp - 0x3208]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 0xa], dl
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x3074]
sub eax, ecx
mov edx, dword [ebp - 0x3184]
mov word [edx], ax
jmp 0x4081db
lea eax, [ebp - 0x321c]
mov dword [ebp - 0x3234], eax
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x3228]
movsx ecx, byte [eax]
add edx, ecx
mov byte [0x5430da], dl
mov edx, dword [ebp - 0x30a0]
add edx, dword [ebp - 0x320c]
mov dword [ebp - 0x310c], edx
lea eax, [ebp - 0x3054]
mov dword [ebp - 0x3238], eax
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ecx]
mov dword [ebp - 0x323c], edx
cmp dword [ebp - 0x323c], 0
je 0x408501
cmp dword [ebp - 0x323c], 0x6959
je 0x40846f
jmp 0x4085a4
mov eax, dword [ebp - 0x31ac]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x30e0]
movzx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0x3208]
movzx eax, byte [edx]
movzx edx, byte [ebp - 0xa]
add eax, edx
cmp ecx, eax
jl 0x4084e1
mov eax, dword [ebp - 0x31cc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x3078]
shl edx, cl
mov eax, dword [ebp - 0x3234]
mov dword [eax], edx
mov ecx, dword [ebp - 0x31e4]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x3210]
movzx ecx, byte [eax]
or edx, ecx
mov byte [ebp - 4], dl
lea edx, [ebp - 0x31f4]
push edx
mov eax, dword [ebp - 0x31a8]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [ebp - 0x30c0], eax
jmp 0x4084fc
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
movzx ecx, word [ebp - 0x3074]
sar edx, cl
mov eax, dword [ebp - 0x3184]
mov word [eax], dx
jmp 0x4085a4
mov ecx, dword [0x56bb10]
mov edx, dword [ebp - 0x310c]
xor edx, dword [ecx]
mov eax, dword [ebp - 0x3238]
mov dword [eax], edx
movzx ecx, word [ebp - 0x9c4]
mov dword [ebp - 0x3240], ecx
cmp dword [ebp - 0x3240], 0x546
je 0x40857c
cmp dword [ebp - 0x3240], 0xc48
je 0x40853e
jmp 0x4085a4
mov edx, dword [ebp - 0x3060]
mov eax, dword [ebp - 0x31d8]
mov ecx, dword [edx]
and ecx, dword [eax]
mov dword [ebp - 0x314c], ecx
mov edx, dword [ebp - 0x31cc]
mov eax, dword [ebp - 0x3154]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov dword [ebp - 0x30cc], ecx
movzx edx, word [ebp - 0x3074]
push edx
call fcn.005160f0
add esp, 4
jmp 0x4085a4
lea eax, [ebp - 0x13208]
push eax
call dword [sym.imp.COMCTL32.dll_PropertySheetA]
mov dword [ebp - 0x3160], eax
mov ecx, dword [ebp - 0x3138]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x320c]
mov eax, dword [0x56bb10]
mov dword [eax], edx
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ecx]
mov dword [ebp - 0x3244], edx
cmp dword [ebp - 0x3244], 0
je 0x4085c0
jmp 0x4086ab
movsx eax, byte [0x5430d6]
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
and eax, edx
movsx ecx, byte [ebp - 1]
movsx edx, byte [ebp - 6]
sub ecx, edx
cmp eax, ecx
jg 0x408677
mov eax, dword [ebp - 0x307c]
mov dword [ebp - 0x3248], eax
mov ecx, dword [ebp - 0x31f4]
movsx edx, word [ecx]
movsx eax, word [ebp - 0x9c0]
sub edx, eax
mov ecx, dword [ebp - 0x3224]
movsx eax, word [ecx]
movsx ecx, word [ebp - 0x9bc]
add eax, ecx
cmp edx, eax
jg 0x408677
movsx edx, word [ebp - 0x9c8]
mov eax, dword [0x56bb20]
movsx ecx, word [eax]
add edx, ecx
mov eax, dword [ebp - 0x3214]
mov word [eax], dx
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x3228]
movsx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x3218]
mov byte [eax], dl
mov cl, byte [ebp - 7]
mov byte [ebp - 0xb], cl
movzx edx, word [ebp - 0x9c4]
movzx ecx, word [ebp - 0x3074]
sar edx, cl
mov word [ebp - 0x316c], dx
lea eax, [ebp - 0x3078]
mov dword [ebp - 0x324c], eax
mov ecx, dword [ebp - 0x31d8]
mov edx, dword [ebp - 0x3058]
or edx, dword [ecx]
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
movzx ecx, word [ebp - 0x316c]
movzx edx, word [ebp - 0x9c4]
xor ecx, edx
mov eax, dword [ebp - 0x3188]
mov word [eax], cx
jmp 0x408748
movzx edx, word [ebp - 0x3090]
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
shl edx, cl
mov word [0x56a028], dx
movsx ecx, word [ebp - 0x9cc]
movsx edx, word [0x56a038]
and ecx, edx
mov eax, dword [ebp - 0x3224]
movsx edx, word [eax]
movsx eax, word [ebp - 0x9c0]
add edx, eax
cmp ecx, edx
jle 0x40873b
mov ecx, dword [ebp - 0x3174]
mov edx, dword [ebp - 0x31c0]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x318c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3060]
mov eax, dword [ebp - 0x3120]
mov ecx, dword [edx]
and ecx, dword [eax]
mov dword [ebp - 0x3160], ecx
lea edx, [ebp - 0x3168]
push edx
mov eax, dword [ebp - 0x306c]
push eax
mov ecx, dword [ebp - 0x3070]
push ecx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x3250], eax
jmp 0x408748
mov edx, dword [ebp - 0x3218]
mov cl, byte [edx]
call fcn.00515e10
cmp dword [ebp - 0x3204], 0xad44
je 0x4088f6
mov eax, dword [ebp - 0x3138]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x3230]
mov dword [ebp - 0x3160], ecx
mov edx, dword [ebp - 0x30cc]
sub edx, dword [ebp - 0x3198]
mov dword [ebp - 0x3064], edx
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x30e0]
movzx eax, byte [edx]
sub ecx, eax
mov byte [ebp - 9], cl
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x316c]
add edx, eax
mov ecx, dword [ebp - 0x3184]
mov word [ecx], dx
mov edx, dword [ebp - 0x3138]
mov eax, dword [ebp - 0x3048]
or eax, dword [edx]
mov ecx, dword [ebp - 0x31a0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x31a0]
mov eax, dword [ebp - 0x3238]
mov edx, dword [edx]
mov ecx, dword [eax]
sar edx, cl
mov eax, dword [ebp - 0x3138]
mov dword [eax], edx
mov ecx, dword [ebp - 0x31f4]
movsx edx, word [ecx]
mov eax, dword [ebp - 0x3224]
movsx ecx, word [eax]
shl edx, cl
mov word [0x56a038], dx
movsx ecx, byte [ebp - 1]
mov edx, dword [ebp - 0x30dc]
movsx eax, byte [edx]
xor ecx, eax
mov edx, dword [ebp - 0x3218]
mov byte [edx], cl
mov eax, dword [ebp - 0x3148]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 0xb]
and ecx, edx
mov eax, dword [ebp - 0x3134]
mov byte [eax], cl
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x9c4]
sub edx, eax
mov ecx, dword [ebp - 0x3188]
mov word [ecx], dx
mov edx, dword [ebp - 0x31cc]
mov eax, dword [ebp - 0x3154]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov dword [ebp - 0x31d0], ecx
mov edx, dword [ebp - 0x31d0]
sub edx, dword [ebp - 0x3064]
mov eax, dword [ebp - 0x30e8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x31a0]
mov edx, dword [ebp - 0x3138]
mov eax, dword [ecx]
add eax, dword [edx]
mov dword [ebp - 0x3048], eax
mov ecx, dword [0x56baf4]
add ecx, dword [ebp - 0x3248]
mov edx, dword [ebp - 0x3138]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3204]
add eax, 0x50
mov dword [ebp - 0x3204], eax
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ebp - 0x3058]
and edx, dword [ecx]
mov dword [ebp - 0x3084], edx
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
sub ecx, eax
mov word [ebp - 0x9c4], cx
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
add edx, ecx
mov word [0x56a028], dx
jmp 0x408748
mov edx, dword [ebp - 0x3214]
movsx eax, word [edx]
mov ecx, dword [ebp - 0x3224]
movsx edx, word [ecx]
add eax, edx
movsx edx, word [ebp - 0x9bc]
mov ecx, dword [ebp - 0x31f4]
movsx ecx, word [ecx]
sar edx, cl
cmp eax, edx
je 0x51574e
lea edx, [ebp - 7]
mov dword [ebp - 0x3254], edx
movsx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x3218]
movsx edx, byte [ecx]
imul eax, edx
mov byte [ebp - 2], al
mov eax, dword [ebp - 0x3224]
mov cx, word [eax]
mov word [ebp - 0x9d0], cx
lea edx, [ebp - 0x3078]
mov dword [0x56bb40], edx
mov eax, dword [ebp - 0x3138]
mov ecx, dword [ebp - 0x314c]
add ecx, dword [eax]
mov edx, dword [ebp - 0x3238]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3210]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 0xa]
or ecx, edx
mov byte [ebp - 9], cl
movzx eax, word [ebp - 0x3074]
mov dword [ebp - 0x3258], eax
cmp dword [ebp - 0x3258], 0x40b
je 0x40899f
jmp 0x4089d8
movzx edx, word [ebp - 0x3074]
movzx ecx, word [ebp - 0x9c4]
sar edx, cl
mov eax, dword [ebp - 0x30e4]
mov word [eax], dx
push 0x44
push 0x79
push 0xbd
mov ecx, dword [ebp - 0x3124]
push ecx
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0x325c], eax
jmp 0x408b12
mov edx, dword [ebp - 0x3084]
mov dword [ebp - 0x3260], edx
cmp dword [ebp - 0x3260], 0
je 0x408a02
cmp dword [ebp - 0x3260], 0x2c8c
je 0x408af8
jmp 0x408b12
mov eax, dword [ebp - 0x31e4]
movzx edx, byte [eax]
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
xor edx, ecx
mov eax, dword [ebp - 0x3254]
movzx eax, byte [eax]
movzx ecx, byte [ebp - 8]
shl eax, cl
cmp edx, eax
je 0x408abb
mov ecx, dword [ebp - 0x3134]
mov dl, byte [ecx]
mov byte [ebp - 0x3264], dl
cmp byte [ebp - 0x3264], 0x11
je 0x408a46
jmp 0x408a88
mov eax, dword [ebp - 0x3238]
mov ecx, dword [ebp - 0x31a0]
mov edx, dword [eax]
sub edx, dword [ecx]
mov dword [ebp - 0x30a0], edx
mov eax, dword [ebp - 0x31c0]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x3078]
mov edx, dword [ebp - 0x3234]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3094]
mov ecx, dword [ebp - 0x310c]
sub ecx, dword [eax]
mov dword [ebp - 0x30a0], ecx
jmp 0x408abb
movzx edx, word [ebp - 0x3090]
push edx
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
push ecx
mov edx, dword [ebp - 0x3154]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x3174]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x321c]
push eax
call fcn.00516630
add esp, 0x14
mov ecx, dword [ebp - 0x3238]
mov edx, dword [ecx]
mov dword [ebp - 0x3268], edx
mov dword [ebp - 0x326c], 0xf2ff
mov eax, dword [ebp - 0x3188]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x316c]
add ecx, edx
mov word [ebp - 0x3090], cx
mov dword [ebp - 0x3270], 0x51b6
jmp 0x408b12
mov eax, dword [0x56bb04]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
add ecx, eax
mov word [0x56a028], cx
mov ecx, dword [ebp - 0x31d0]
mov dword [ebp - 0x3274], ecx
mov edx, dword [ebp - 0x3248]
add edx, dword [ebp - 0x3058]
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
cmp dword [ebp - 0x3270], 0x4b1a
jb 0x408c45
mov ecx, dword [ebp - 0x3138]
mov edx, dword [ebp - 0x3248]
sub edx, dword [ecx]
mov dword [ebp - 0x3160], edx
mov eax, dword [ebp - 0x3238]
mov ecx, dword [ebp - 0x314c]
sub ecx, dword [eax]
mov dword [ebp - 0x30a0], ecx
mov edx, dword [0x56baf4]
add edx, dword [ebp - 0x307c]
mov dword [ebp - 0x31f8], edx
mov eax, dword [ebp - 0x3228]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x3218]
movsx eax, byte [edx]
and ecx, eax
mov byte [ebp - 2], cl
movsx edx, word [ebp - 0x9c0]
mov eax, dword [0x56bb20]
movsx ecx, word [eax]
sar edx, cl
mov word [ebp - 0x9bc], dx
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x316c]
xor edx, eax
mov word [ebp - 0x3090], dx
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x3074]
or edx, eax
mov word [0x56a028], dx
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x308c]
shl edx, cl
mov eax, dword [ebp - 0x3234]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3270]
sub ecx, 0x2f
mov dword [ebp - 0x3270], ecx
mov edx, dword [ebp - 0x3198]
add edx, dword [ebp - 0x308c]
mov eax, dword [ebp - 0x3154]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x9c4]
add edx, eax
mov ecx, dword [ebp - 0x3188]
mov word [ecx], dx
movzx edx, byte [ebp - 8]
movzx eax, byte [ebp - 4]
and edx, eax
mov byte [ebp - 0xb], dl
jmp 0x408b32
mov ecx, dword [ebp - 0x3120]
mov edx, dword [ecx]
sub edx, dword [0x56baf4]
mov eax, dword [ebp - 0x3238]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3078]
add ecx, dword [ebp - 0x321c]
mov dword [ebp - 0x3274], ecx
mov edx, dword [ebp - 0x3160]
sub edx, dword [ebp - 0x314c]
mov eax, dword [ebp - 0x3238]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3238]
mov edx, dword [ebp - 0x31a0]
mov eax, dword [ecx]
add eax, dword [edx]
mov ecx, dword [ebp - 0x3060]
mov dword [ecx], eax
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x9c4]
sub eax, ecx
mov word [0x56a028], ax
movzx edx, byte [ebp - 5]
movzx eax, byte [ebp - 0xb]
add edx, eax
mov byte [ebp - 4], dl
mov ecx, dword [ebp - 0x31d0]
sub ecx, dword [ebp - 0x3274]
mov edx, dword [ebp - 0x3154]
mov dword [edx], ecx
mov eax, dword [ebp - 0x31b8]
add eax, dword [0x56baf4]
mov dword [ebp - 0x307c], eax
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
movsx eax, byte [ebp - 2]
xor edx, eax
mov ecx, dword [ebp - 0x3228]
mov byte [ecx], dl
mov edx, dword [ebp - 0x3214]
movsx eax, word [edx]
mov ecx, dword [ebp - 0x3224]
movsx ecx, word [ecx]
sar eax, cl
mov word [ebp - 0x9bc], ax
mov edx, dword [ebp - 0x3134]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 5]
or eax, ecx
mov edx, dword [ebp - 0x3134]
mov byte [edx], al
mov eax, dword [ebp - 0x30e4]
movzx edx, word [eax]
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
shl edx, cl
mov ecx, dword [ebp - 0x3188]
mov word [ecx], dx
mov edx, dword [ebp - 0x3198]
and edx, dword [ebp - 0x321c]
mov eax, dword [ebp - 0x30e8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x31d8]
mov edx, dword [ecx]
add edx, dword [ebp - 0x3230]
mov eax, dword [0x56bb10]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x3120]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x3238]
mov dword [ecx], eax
mov edx, dword [ebp - 0x31cc]
mov eax, dword [edx]
and eax, dword [ebp - 0x31d0]
mov ecx, dword [ebp - 0x324c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3268]
sub edx, dword [ebp - 0x3058]
mov eax, dword [ebp - 0x3238]
mov dword [eax], edx
mov ecx, dword [0x56bb04]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x3090]
sub edx, eax
mov word [ebp - 0x9c4], dx
movzx ecx, byte [ebp - 4]
mov edx, dword [ebp - 0x30e0]
movzx eax, byte [edx]
add ecx, eax
mov byte [ebp - 8], cl
mov ecx, dword [ebp - 0x3120]
mov edx, dword [ecx]
sub edx, dword [0x56baf4]
mov eax, dword [ebp - 0x309c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ecx]
add edx, dword [ebp - 0x3274]
mov eax, dword [ebp - 0x3098]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3230]
xor ecx, dword [ebp - 0x314c]
mov dword [ebp - 0x310c], ecx
mov edx, dword [ebp - 0x31a0]
mov eax, dword [0x56baf4]
mov ecx, dword [edx]
shl eax, cl
mov ecx, dword [0x56bb10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3188]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
or eax, edx
mov word [ebp - 0x316c], ax
mov eax, dword [ebp - 0x31ac]
movzx edx, byte [eax]
mov eax, dword [ebp - 0x3210]
movzx ecx, byte [eax]
sar edx, cl
mov ecx, dword [ebp - 0x31e4]
mov byte [ecx], dl
movsx edx, byte [ebp - 2]
movsx eax, byte [ebp - 1]
and edx, eax
mov ecx, dword [ebp - 0x3218]
mov byte [ecx], dl
mov edx, dword [ebp - 0x31f4]
movsx eax, word [edx]
movsx ecx, word [ebp - 0x9c8]
sub eax, ecx
mov edx, dword [ebp - 0x31f4]
mov word [edx], ax
mov eax, dword [ebp - 0x31cc]
mov ecx, dword [ebp - 0x3078]
add ecx, dword [eax]
mov edx, dword [ebp - 0x30e8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3120]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x30a0]
mov dword [ebp - 0x314c], ecx
movzx edx, word [ebp - 0x9c4]
movzx eax, word [ebp - 0x316c]
sub edx, eax
mov word [ebp - 0x3074], dx
movzx ecx, byte [ebp - 4]
movzx edx, byte [ebp - 7]
and ecx, edx
mov byte [ebp - 8], cl
mov eax, dword [ebp - 0x31cc]
mov ecx, dword [eax]
sub ecx, dword [0x56bb30]
mov edx, dword [0x56bb40]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3084]
add eax, dword [ebp - 0x320c]
mov dword [ebp - 0x30a0], eax
mov ecx, dword [ebp - 0x309c]
mov edx, dword [ebp - 0x3238]
mov eax, dword [ecx]
add eax, dword [edx]
mov ecx, dword [ebp - 0x31a0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x326c]
add edx, 3
mov dword [ebp - 0x326c], edx
mov eax, dword [ebp - 0x31cc]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x30cc]
mov edx, dword [ebp - 0x3154]
mov dword [edx], ecx
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x9c4]
or ecx, edx
mov word [ebp - 0x316c], cx
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x3210]
movzx ecx, byte [ecx]
shl eax, cl
mov byte [ebp - 8], al
mov edx, dword [ebp - 0x3238]
mov eax, dword [edx]
xor eax, dword [ebp - 0x3048]
mov ecx, dword [ebp - 0x309c]
mov dword [ecx], eax
mov edx, dword [0x56bb10]
mov eax, dword [ebp - 0x3058]
mov ecx, dword [edx]
sar eax, cl
mov dword [ebp - 0x307c], eax
mov ecx, dword [ebp - 0x31cc]
mov edx, dword [ecx]
and edx, dword [ebp - 0x31d0]
mov eax, dword [ebp - 0x3098]
mov dword [eax], edx
mov ecx, dword [ebp - 0x314c]
add ecx, dword [ebp - 0x3048]
mov dword [0x56baf4], ecx
mov edx, dword [0x56baf4]
sub edx, dword [ebp - 0x3248]
mov dword [ebp - 0x314c], edx
movsx eax, word [ebp - 0x9c0]
movsx ecx, word [ebp - 0x9d0]
add eax, ecx
mov edx, dword [ebp - 0x3224]
mov word [edx], ax
mov eax, dword [ebp - 0x3218]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x3228]
movsx eax, byte [edx]
sub ecx, eax
mov edx, dword [ebp - 0x30dc]
mov byte [edx], cl
movzx eax, byte [ebp - 8]
movzx ecx, byte [ebp - 0xb]
add eax, ecx
mov byte [ebp - 0xa], al
movzx edx, word [ebp - 0x3074]
movzx eax, word [ebp - 0x9c4]
and edx, eax
mov word [ebp - 0x3090], dx
cmp dword [ebp - 0x326c], 0xf37d
jb 0x408c45
mov ecx, dword [ebp - 0x30dc]
mov dl, byte [ecx]
mov byte [ebp - 0x3278], dl
cmp byte [ebp - 0x3278], 0
je 0x40906f
cmp byte [ebp - 0x3278], 0x1a
je 0x4090fe
jmp 0x40911f
movzx eax, word [ebp - 0x316c]
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
add eax, edx
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
movzx ecx, word [0x56a028]
sub edx, ecx
cmp eax, edx
jg 0x4090d6
mov edx, dword [ebp - 0x3154]
mov eax, dword [edx]
sub eax, dword [ebp - 0x3064]
mov ecx, dword [ebp - 0x30b0]
mov dword [ecx], eax
lea edx, [ebp - 0x3048]
mov dword [ebp - 0x327c], edx
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
xor ecx, eax
mov edx, dword [ebp - 0x3188]
mov word [edx], cx
mov eax, dword [ebp - 0x324c]
mov ecx, dword [eax]
mov dword [ebp - 0x3280], ecx
mov edx, dword [ebp - 0x309c]
mov eax, dword [ebp - 0x327c]
mov ecx, dword [edx]
or ecx, dword [eax]
mov edx, dword [ebp - 0x31d8]
mov dword [edx], ecx
jmp 0x40911f
lea eax, [ebp - 0x3078]
push eax
mov ecx, dword [ebp - 0x312c]
push ecx
mov edx, dword [ebp - 0x3284]
push edx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x30d4], eax
lea eax, [ebp - 0x3084]
mov dword [ebp - 0x3288], eax
mov ecx, dword [0x56bb40]
mov edx, dword [ebp - 0x31c0]
mov eax, dword [ecx]
mov ecx, dword [edx]
shl eax, cl
mov ecx, dword [ebp - 0x3098]
mov dword [ecx], eax
movzx edx, byte [ebp - 5]
movzx ecx, byte [ebp - 4]
sar edx, cl
mov eax, dword [ebp - 0x3148]
mov byte [eax], dl
lea ecx, [ebp - 0x3090]
mov dword [ebp - 0x328c], ecx
movsx edx, byte [0x5430da]
movsx eax, byte [ebp - 6]
and edx, eax
mov ecx, dword [ebp - 0x3228]
movsx eax, byte [ecx]
movsx ecx, byte [ebp - 1]
sub eax, ecx
cmp edx, eax
je 0x409255
mov edx, dword [ebp - 0x30a0]
add edx, dword [ebp - 0x3230]
mov eax, dword [ebp - 0x3238]
mov dword [eax], edx
mov ecx, dword [ebp - 0x31d8]
mov edx, dword [ecx]
mov dword [ebp - 0x3290], edx
movsx eax, byte [ebp - 6]
movsx ecx, byte [ebp - 1]
sub eax, ecx
mov byte [0x5430e2], al
mov edx, dword [0x56baf4]
sub edx, dword [ebp - 0x3058]
mov eax, dword [ebp - 0x3060]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x3054]
cmp edx, ecx
jl 0x409255
mov edx, dword [ebp - 0x3098]
mov eax, dword [edx]
mov dword [ebp - 0x3294], eax
cmp dword [ebp - 0x3294], 0
je 0x4091ef
jmp 0x40923f
mov ecx, dword [0x56bb20]
movsx edx, word [ecx]
mov eax, dword [ebp - 0x31f4]
movsx ecx, word [eax]
sub edx, ecx
mov word [ebp - 0x9bc], dx
mov edx, dword [ebp - 0x3254]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 8]
and eax, ecx
mov byte [ebp - 4], al
mov dx, word [ebp - 0x9c4]
mov word [ebp - 0x9d4], dx
mov eax, dword [0x56bb30]
add eax, dword [ebp - 0x3198]
mov ecx, dword [ebp - 0x3154]
mov dword [ecx], eax
jmp 0x409255
mov edx, dword [ebp - 0x30cc]
mov ecx, dword [ebp - 0x3274]
shr edx, cl
mov eax, dword [ebp - 0x30b0]
mov dword [eax], edx
mov dword [ebp - 0x3298], 0xaac6
mov ecx, dword [0x56bb20]
movsx edx, word [ecx]
movsx eax, word [ebp - 0x9bc]
or edx, eax
movsx ecx, word [ebp - 0x9cc]
movsx eax, word [ebp - 0x9d0]
xor ecx, eax
cmp edx, ecx
jg 0x515631
mov ecx, dword [ebp - 0x3154]
mov edx, dword [ecx]
mov dword [ebp - 0x329c], edx
mov eax, dword [ebp - 0x31a0]
mov edx, dword [ebp - 0x3160]
mov ecx, dword [eax]
sar edx, cl
mov dword [ebp - 0x307c], edx
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
movzx edx, word [ebp - 0x3074]
xor ecx, edx
mov eax, dword [ebp - 0x3188]
movzx edx, word [eax]
movzx eax, word [ebp - 0x9d4]
add edx, eax
cmp ecx, edx
jle 0x4093cb
mov cl, byte [ebp - 1]
mov byte [ebp - 0x32a0], cl
cmp byte [ebp - 0x32a0], 0x2e
je 0x4092ed
jmp 0x40931b
lea edx, [ebp - 0x13208]
push edx
call dword [sym.imp.COMCTL32.dll_PropertySheetA]
mov dword [ebp - 0x314c], eax
mov eax, dword [ebp - 0x3120]
mov ecx, dword [ebp - 0x310c]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x3138]
mov dword [edx], ecx
jmp 0x4093c9
movsx eax, word [ebp - 0x9bc]
movsx ecx, word [ebp - 0x9c0]
sub eax, ecx
movsx edx, word [0x56a038]
mov ecx, dword [ebp - 0x3214]
movsx ecx, word [ecx]
sub edx, ecx
cmp eax, edx
jge 0x409388
mov edx, dword [ebp - 0x3198]
add edx, dword [ebp - 0x3078]
mov dword [ebp - 0x3280], edx
movzx eax, word [ebp - 0x3090]
push eax
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
push edx
mov eax, dword [ebp - 0x321c]
push eax
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x3154]
mov ecx, dword [eax]
push ecx
call fcn.00516630
add esp, 0x14
jmp 0x4093c9
movzx edx, word [ebp - 0x316c]
mov eax, dword [ebp - 0x3188]
movzx ecx, word [eax]
add edx, ecx
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
movzx eax, word [ebp - 0x3074]
add ecx, eax
cmp edx, ecx
jge 0x4093c9
movzx ecx, word [ebp - 0x9c4]
movzx edx, word [ebp - 0x9d4]
sub ecx, edx
mov eax, dword [ebp - 0x3184]
mov word [eax], cx
jmp 0x409444
mov ecx, dword [ebp - 0x3254]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x30e0]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 8], dl
mov edx, dword [ebp - 0x3218]
mov al, byte [edx]
mov byte [ebp - 0xc], al
movsx edx, word [ebp - 0x9bc]
movsx ecx, word [0x56a038]
shl edx, cl
mov eax, dword [ebp - 0x3224]
mov word [eax], dx
mov ecx, dword [ebp - 0x329c]
mov dword [0x56bb54], ecx
mov edx, dword [ebp - 0x30a0]
mov dword [ebp - 0x32a4], edx
movzx eax, word [ebp - 0x3090]
mov ecx, dword [ebp - 0x3184]
movzx ecx, word [ecx]
sar eax, cl
mov edx, dword [ebp - 0x30e4]
mov word [edx], ax
mov eax, dword [ebp - 0x3208]
mov cl, byte [eax]
mov byte [ebp - 0xd], cl
mov edx, dword [ebp - 0x31a0]
mov eax, dword [ebp - 0x3094]
mov ecx, dword [edx]
xor ecx, dword [eax]
mov dword [ebp - 0x3160], ecx
mov dl, byte [ebp - 7]
mov byte [ebp - 0x32a8], dl
cmp byte [ebp - 0x32a8], 0
je 0x409471
jmp 0x51547b
movsx eax, byte [0x5430da]
movsx ecx, byte [ebp - 0xc]
shl eax, cl
movsx ecx, byte [ebp - 6]
movsx edx, byte [ebp - 1]
and ecx, edx
cmp eax, ecx
jg 0x515423
mov eax, dword [ebp - 0x31a0]
mov ecx, dword [ebp - 0x3094]
mov edx, dword [eax]
sub edx, dword [ecx]
mov dword [ebp - 0x3160], edx
mov eax, dword [ebp - 0x3218]
mov cl, byte [eax]
mov byte [ebp - 0xe], cl
movzx edx, byte [ebp - 8]
movzx eax, byte [ebp - 7]
add edx, eax
movzx ecx, byte [ebp - 0xa]
movzx eax, byte [ebp - 3]
and ecx, eax
cmp edx, ecx
jl 0x515408
mov ecx, dword [ebp - 0x328c]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x3090]
add edx, eax
mov ecx, dword [ebp - 0x3184]
mov word [ecx], dx
mov edx, dword [ebp - 0x31f4]
movsx eax, word [edx]
movsx ecx, word [ebp - 0x9bc]
add eax, ecx
movsx edx, word [ebp - 0x9d0]
movsx ecx, word [ebp - 0x9cc]
add edx, ecx
cmp eax, edx
jg 0x515356
cmp dword [ebp - 0x3298], 0xc230
je 0x409698
movzx edx, word [ebp - 0x3090]
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
add edx, ecx
mov word [ebp - 0x3074], dx
mov edx, dword [ebp - 0x3138]
mov eax, dword [ebp - 0x3288]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov dword [ebp - 0x320c], ecx
mov edx, dword [0x56bb40]
mov eax, dword [edx]
add eax, dword [ebp - 0x30cc]
mov dword [ebp - 0x329c], eax
mov ecx, dword [ebp - 0x320c]
and ecx, dword [ebp - 0x3048]
mov edx, dword [ebp - 0x3288]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3298]
add eax, 0xde
mov dword [ebp - 0x3298], eax
mov ecx, dword [ebp - 0x3288]
mov edx, dword [ecx]
add edx, dword [ebp - 0x314c]
mov dword [ebp - 0x3160], edx
movzx eax, word [ebp - 0x9c4]
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
sub eax, edx
mov word [0x56a028], ax
movzx eax, byte [ebp - 8]
movzx ecx, byte [ebp - 4]
sub eax, ecx
mov edx, dword [ebp - 0x31ac]
mov byte [edx], al
mov eax, dword [0x56bb40]
mov ecx, dword [ebp - 0x324c]
mov edx, dword [eax]
xor edx, dword [ecx]
mov dword [ebp - 0x3280], edx
mov eax, dword [ebp - 0x3138]
mov ecx, dword [ebp - 0x310c]
or ecx, dword [eax]
mov edx, dword [ebp - 0x327c]
mov dword [edx], ecx
mov eax, dword [ebp - 0x30dc]
movsx edx, byte [eax]
mov eax, dword [ebp - 0x3218]
movsx ecx, byte [eax]
sar edx, cl
mov ecx, dword [ebp - 0x3228]
mov byte [ecx], dl
mov edx, dword [ebp - 0x31f4]
movsx eax, word [edx]
movsx ecx, word [ebp - 0x9c0]
shl eax, cl
mov ecx, dword [ebp - 0x3224]
mov word [ecx], ax
mov edx, dword [ebp - 0x3210]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0xd]
and eax, ecx
mov byte [ebp - 3], al
movzx edx, word [ebp - 0x3074]
movzx eax, word [ebp - 0x316c]
sub edx, eax
mov word [ebp - 0x9c4], dx
mov ecx, dword [ebp - 0x324c]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x3064]
mov eax, dword [ebp - 0x30e8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x32a4]
add edx, dword [ecx]
mov dword [0x56baf4], edx
mov eax, dword [ebp - 0x31d8]
mov ecx, dword [ebp - 0x309c]
mov edx, dword [eax]
add edx, dword [ecx]
mov dword [ebp - 0x3230], edx
jmp 0x409512
mov eax, dword [ebp - 0x31ac]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 0xb]
sub ecx, edx
mov eax, dword [ebp - 0x3134]
movzx edx, byte [eax]
movzx eax, byte [ebp - 4]
sub edx, eax
cmp ecx, edx
je 0x409768
lea ecx, [ebp - 0x3174]
push ecx
mov edx, dword [ebp - 0x31a8]
push edx
mov eax, dword [ebp - 0x3284]
push eax
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x32ac], eax
mov ecx, dword [ebp - 0x3214]
movsx edx, word [ecx]
mov dword [ebp - 0x32b0], edx
cmp dword [ebp - 0x32b0], 0x347
je 0x409720
cmp dword [ebp - 0x32b0], 0x522
je 0x409708
jmp 0x409736
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [ebp - 0x3098]
mov edx, dword [eax]
and edx, dword [ecx]
mov dword [ebp - 0x31d0], edx
jmp 0x409736
mov eax, dword [ebp - 0x31a0]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x32a4]
mov edx, dword [ebp - 0x309c]
mov dword [edx], ecx
movzx eax, word [ebp - 0x3090]
movzx ecx, word [ebp - 0x9d4]
or eax, ecx
mov word [ebp - 0x3074], ax
push 0xdd
push 0x34
push 0x4e
mov edx, dword [ebp - 0x31c4]
push edx
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0x3168], eax
lea eax, [ebp - 0xb]
mov dword [ebp - 0x32b4], eax
mov ecx, dword [ebp - 0x321c]
mov dword [ebp - 0x32b8], ecx
cmp dword [ebp - 0x32b8], 0
je 0x40978b
jmp 0x4098e0
mov edx, dword [ebp - 0x318c]
mov eax, dword [edx]
mov dword [ebp - 0x32bc], eax
cmp dword [ebp - 0x32bc], 0
je 0x4097a7
jmp 0x4098cf
mov ecx, dword [ebp - 0x32b4]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 0xb]
xor edx, eax
movzx eax, byte [ebp - 0xd]
mov ecx, dword [ebp - 0x3134]
movzx ecx, byte [ecx]
sar eax, cl
cmp edx, eax
jl 0x40988d
mov edx, dword [ebp - 0x3274]
and edx, dword [ebp - 0x30cc]
mov eax, dword [ebp - 0x31c0]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x3064]
cmp edx, ecx
jne 0x409852
mov edx, dword [0x56bb10]
mov eax, dword [ebp - 0x31d8]
mov ecx, dword [edx]
add ecx, dword [eax]
mov edx, dword [ebp - 0x3238]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3064]
add eax, dword [ebp - 0x321c]
mov ecx, dword [ebp - 0x30e8]
mov dword [ecx], eax
mov dword [ebp - 0x32c0], 0x6bd3
lea edx, [ebp - 0x3268]
mov dword [ebp - 0x32c4], edx
mov eax, dword [ebp - 0x31a0]
mov ecx, dword [ebp - 0x32c4]
mov edx, dword [eax]
sub edx, dword [ecx]
mov dword [0x56a058], edx
movzx eax, byte [ebp - 0xa]
movzx ecx, byte [ebp - 7]
add eax, ecx
mov byte [ebp - 0xd], al
jmp 0x40988b
mov edx, dword [ebp - 0x3054]
sub edx, dword [ebp - 0x310c]
mov eax, dword [ebp - 0x31a0]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x30a0]
cmp edx, ecx
je 0x40988b
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
movzx ecx, word [ebp - 0x9c4]
and eax, ecx
mov edx, dword [ebp - 0x30e4]
mov word [edx], ax
jmp 0x4098cd
mov eax, dword [ebp - 0x30e0]
movzx edx, byte [eax]
mov eax, dword [ebp - 0x32b4]
movzx ecx, byte [eax]
shl edx, cl
mov ecx, dword [ebp - 0x3254]
movzx eax, byte [ecx]
movzx ecx, byte [ebp - 4]
sub eax, ecx
cmp edx, eax
je 0x4098cd
movsx edx, word [ebp - 0x9cc]
mov eax, dword [ebp - 0x3224]
movsx ecx, word [eax]
or edx, ecx
mov word [ebp - 0x9d0], dx
jmp 0x4098de
mov edx, dword [ebp - 0x31e4]
movzx eax, byte [edx]
push eax
call fcn.005169c0
jmp 0x409920
movsx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x30dc]
movsx ecx, byte [eax]
sar edx, cl
mov byte [ebp - 6], dl
push 0x6a
mov ecx, dword [ebp - 0x3180]
push ecx
mov edx, dword [ebp - 0x32c8]
push edx
call dword [sym.imp.COMCTL32.dll_DrawInsert]
mov eax, dword [ebp - 0x3098]
mov ecx, dword [ebp - 0x30b0]
mov edx, dword [eax]
xor edx, dword [ecx]
mov eax, dword [ebp - 0x3154]
mov dword [eax], edx
mov ecx, dword [ebp - 0x31a0]
mov edx, dword [ecx]
mov dword [ebp - 0x32cc], edx
movzx eax, word [ebp - 0x3090]
mov ecx, dword [ebp - 0x3188]
movzx ecx, word [ecx]
shl eax, cl
mov word [ebp - 0x9d4], ax
movzx edx, byte [ebp - 5]
mov eax, dword [ebp - 0x3208]
movzx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 9], dl
mov edx, dword [0x56bb54]
add edx, dword [ebp - 0x30cc]
mov dword [0x56a05c], edx
mov eax, dword [ebp - 0x31ac]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 9]
and ecx, edx
mov eax, dword [ebp - 0x31e4]
movzx edx, byte [eax]
mov eax, dword [ebp - 0x3148]
movzx eax, byte [eax]
add edx, eax
cmp ecx, edx
jl 0x5151f5
mov ecx, dword [ebp - 0x327c]
mov edx, dword [ecx]
mov dword [ebp - 0x32d0], edx
mov eax, dword [ebp - 0x3268]
mov dword [ebp - 0x32d4], eax
cmp dword [ebp - 0x32d4], 0x4b8c
je 0x4099cd
cmp dword [ebp - 0x32d4], 0x5f52
je 0x409a00
jmp 0x409aa1
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x3054]
add edx, dword [ecx]
mov dword [ebp - 0x3058], edx
lea eax, [ebp - 0x9d0]
push eax
mov ecx, dword [ebp - 0x3194]
push ecx
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [ebp - 0x32d8], eax
jmp 0x409aa1
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
mov dword [ebp - 0x32dc], eax
cmp dword [ebp - 0x32dc], 0x6c0
je 0x409a1d
jmp 0x409a88
movzx ecx, word [ebp - 0x9c4]
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
add ecx, eax
movzx edx, word [ebp - 0x3074]
mov eax, dword [0x56bb04]
movzx eax, word [eax]
sub edx, eax
cmp ecx, edx
jge 0x409a86
mov ecx, dword [ebp - 0x31c0]
mov edx, dword [ebp - 0x324c]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x30b0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x32cc]
sub edx, dword [ebp - 0x3058]
mov dword [0x56a058], edx
mov eax, dword [ebp - 0x32c4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x314c]
shl edx, cl
mov eax, dword [ebp - 0x309c]
mov dword [eax], edx
jmp 0x409aa1
push 0xac
mov ecx, dword [ebp - 0x3164]
push ecx
mov edx, dword [ebp - 0x322c]
push edx
call dword [sym.imp.COMCTL32.dll_DrawInsert]
mov eax, dword [ebp - 0x324c]
mov edx, dword [eax]
or edx, dword [ebp - 0x321c]
mov eax, dword [ebp - 0x30b0]
mov esi, dword [0x56bb54]
mov ecx, dword [eax]
shr esi, cl
cmp edx, esi
jbe 0x409b14
mov cl, byte [ebp - 0xa]
mov byte [ebp - 0x32e0], cl
cmp byte [ebp - 0x32e0], 0x4c
je 0x409ae0
cmp byte [ebp - 0x32e0], 0x84
je 0x409af4
jmp 0x409b0f
movsx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x30dc]
movsx ecx, byte [eax]
sub edx, ecx
mov byte [ebp - 0xe], dl
jmp 0x409b0f
mov edx, dword [ebp - 0x3214]
movsx eax, word [edx]
movsx ecx, word [ebp - 0x9c0]
add eax, ecx
mov edx, dword [ebp - 0x3214]
mov word [edx], ax
jmp 0x409bb2
movzx eax, word [ebp - 0x9c4]
mov ecx, dword [ebp - 0x328c]
movzx edx, word [ecx]
add eax, edx
mov ecx, dword [ebp - 0x3188]
mov word [ecx], ax
mov edx, dword [ebp - 0x30e0]
mov al, byte [edx]
mov byte [ebp - 0xf], al
movsx ecx, word [ebp - 0x9bc]
mov dword [ebp - 0x32e4], ecx
cmp dword [ebp - 0x32e4], 0
je 0x409b52
jmp 0x409b9e
mov edx, dword [0x56bb40]
mov eax, dword [ebp - 0x31cc]
mov ecx, dword [edx]
add ecx, dword [eax]
mov edx, dword [ebp - 0x31c0]
mov dword [edx], ecx
mov eax, dword [ebp - 0x32c4]
mov ecx, dword [ebp - 0x327c]
mov edx, dword [eax]
and edx, dword [ecx]
mov dword [ebp - 0x3058], edx
mov ax, word [ebp - 0x9c4]
mov word [ebp - 0x9d8], ax
mov ecx, dword [ebp - 0x3208]
mov dl, byte [ecx]
mov byte [0x56ba36], dl
jmp 0x409bb2
mov eax, dword [ebp - 0x3154]
mov ecx, dword [ebp - 0x3198]
sub ecx, dword [eax]
mov dword [ebp - 0x3078], ecx
mov edx, dword [ebp - 0x3218]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x3228]
movsx edx, byte [ecx]
add eax, edx
movsx ecx, byte [ebp - 1]
mov edx, dword [ebp - 0x30dc]
movsx edx, byte [edx]
sub ecx, edx
cmp eax, ecx
jge 0x515123
mov eax, dword [ebp - 0x328c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
and ecx, eax
mov word [ebp - 0x9d4], cx
mov ecx, dword [ebp - 0x3210]
mov dl, byte [ecx]
mov byte [ebp - 0x10], dl
mov eax, dword [ebp - 0x307c]
add eax, dword [ebp - 0x32a4]
mov dword [ebp - 0x3084], eax
lea ecx, [ebp - 0x314c]
mov dword [ebp - 0x32e8], ecx
movzx edx, word [ebp - 0x9d8]
mov dword [ebp - 0x32ec], edx
cmp dword [ebp - 0x32ec], 0x501
je 0x409c4f
cmp dword [ebp - 0x32ec], 0xfbe
je 0x409d06
jmp 0x409dde
mov eax, dword [ebp - 0x31f4]
movsx ecx, word [eax]
mov edx, dword [ebp - 0x3214]
movsx eax, word [edx]
add ecx, eax
mov word [0x56a038], cx
movsx ecx, byte [ebp - 6]
mov edx, dword [ebp - 0x3228]
movsx eax, byte [edx]
sub ecx, eax
mov byte [ebp - 1], cl
movzx ecx, byte [ebp - 0xb]
movzx edx, byte [ebp - 7]
add ecx, edx
mov eax, dword [ebp - 0x31ac]
mov byte [eax], cl
mov ecx, dword [ebp - 0x308c]
sub ecx, dword [ebp - 0x3078]
mov edx, dword [ebp - 0x3174]
mov eax, dword [0x56bb54]
and eax, dword [edx]
cmp ecx, eax
jne 0x409d01
movzx ecx, word [ebp - 0x9d8]
mov edx, dword [ebp - 0x328c]
movzx eax, word [edx]
sub ecx, eax
mov word [ebp - 0x9c4], cx
mov ecx, dword [ebp - 0x3124]
push ecx
call dword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [ebp - 0x3118], eax
mov edx, dword [0x56bb40]
mov eax, dword [ebp - 0x31c0]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x3154]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3274]
add eax, dword [ebp - 0x329c]
mov dword [ebp - 0x3198], eax
jmp 0x409dde
mov ecx, dword [ebp - 0x31c0]
mov edx, dword [0x56bb40]
mov eax, dword [ecx]
mov ecx, dword [edx]
shr eax, cl
mov ecx, dword [ebp - 0x3154]
mov edx, dword [ebp - 0x3274]
or edx, dword [ecx]
cmp eax, edx
jae 0x409d65
mov eax, dword [ebp - 0x309c]
mov ecx, dword [ebp - 0x3060]
mov edx, dword [eax]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
lea ecx, [ebp - 0x9d0]
push ecx
mov edx, dword [ebp - 0x31a8]
push edx
mov eax, dword [ebp - 0x3158]
push eax
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x32f0], eax
mov ecx, dword [ebp - 0x3274]
mov dword [ebp - 0x32f4], ecx
cmp dword [ebp - 0x32f4], 0x8dba
je 0x409d7f
jmp 0x409dcc
mov edx, dword [ebp - 0x3120]
mov eax, dword [ebp - 0x3288]
mov ecx, dword [edx]
xor ecx, dword [eax]
mov dword [ebp - 0x32a4], ecx
movzx edx, word [ebp - 0x3074]
push edx
mov eax, dword [ebp - 0x3188]
movzx ecx, word [eax]
push ecx
mov edx, dword [ebp - 0x30e8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x30e8]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x318c]
mov ecx, dword [eax]
push ecx
call fcn.00516630
add esp, 0x14
jmp 0x409dde
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
push eax
call fcn.005160f0
add esp, 4
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ebp - 0x327c]
mov eax, dword [ecx]
and eax, dword [edx]
mov dword [ebp - 0x314c], eax
movzx ecx, word [ebp - 0x3090]
mov dword [ebp - 0x32f8], ecx
cmp dword [ebp - 0x32f8], 0
je 0x409e0f
jmp 0x409e95
mov edx, dword [ebp - 0x3254]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x3134]
movzx edx, byte [ecx]
sub eax, edx
mov ecx, dword [ebp - 0x31ac]
movzx edx, byte [ecx]
movzx ecx, byte [ebp - 3]
add edx, ecx
cmp eax, edx
jg 0x409e78
movzx edx, byte [ebp - 3]
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0x32b4]
mov byte [eax], dl
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x3188]
movzx ecx, word [eax]
sub edx, ecx
mov word [0x56a064], dx
mov edx, dword [ebp - 0x30e8]
mov eax, dword [edx]
mov dword [ebp - 0x32fc], eax
jmp 0x409e90
mov ecx, dword [ebp - 0x3094]
mov edx, dword [ebp - 0x3238]
mov eax, dword [ecx]
and eax, dword [edx]
mov ecx, dword [ebp - 0x309c]
mov dword [ecx], eax
jmp 0x409f46
mov edx, dword [ebp - 0x3254]
movzx eax, byte [edx]
movzx ecx, byte [0x56ba36]
add eax, ecx
movzx edx, byte [ebp - 8]
mov ecx, dword [ebp - 0x31ac]
movzx ecx, byte [ecx]
xor edx, ecx
cmp eax, edx
jg 0x409eec
mov edx, dword [ebp - 0x31a0]
mov eax, dword [ebp - 0x3060]
mov edx, dword [edx]
mov ecx, dword [eax]
sar edx, cl
mov dword [ebp - 0x32cc], edx
lea eax, [ebp - 0x3070]
push eax
mov ecx, dword [ebp - 0x30bc]
push ecx
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [ebp - 0x3250], eax
mov edx, dword [ebp - 0x3234]
mov eax, dword [ebp - 0x30e8]
mov edx, dword [edx]
mov ecx, dword [eax]
shl edx, cl
mov eax, dword [ebp - 0x30b0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3208]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 7]
or edx, eax
mov byte [ebp - 9], dl
mov ecx, dword [ebp - 0x3224]
movzx edx, word [ecx]
push edx
movzx eax, word [ebp - 0x9c8]
push eax
mov ecx, dword [ebp - 0x32b4]
movzx edx, byte [ecx]
push edx
mov eax, dword [ebp - 0x3224]
movzx ecx, word [eax]
push ecx
call fcn.00516820
add esp, 0x10
movsx edx, word [ebp - 0x9cc]
movsx eax, word [ebp - 0x9d0]
add edx, eax
mov ecx, dword [ebp - 0x3214]
movsx eax, word [ecx]
mov ecx, dword [ebp - 0x3224]
movsx ecx, word [ecx]
and eax, ecx
cmp edx, eax
jg 0x409f96
movzx edx, word [ebp - 0x3074]
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
sub edx, ecx
mov word [ebp - 0x9d4], dx
mov edx, dword [ebp - 0x3148]
movzx eax, byte [edx]
push eax
call fcn.005169c0
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x3228]
movsx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 6], dl
mov edx, dword [ebp - 0x3174]
mov eax, dword [edx]
sub eax, dword [ebp - 0x329c]
mov ecx, dword [0x56bb40]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x31d0]
cmp eax, edx
jb 0x40a006
mov eax, dword [ebp - 0x31f4]
mov cx, word [eax]
mov word [ebp - 0x9dc], cx
mov edx, dword [ebp - 0x3098]
mov eax, dword [ebp - 0x3154]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [0x56a074], ecx
mov edx, dword [ebp - 0x3138]
mov eax, dword [0x56baf4]
add eax, dword [edx]
mov dword [ebp - 0x3230], eax
movzx ecx, byte [ebp - 0xb]
movzx edx, byte [ebp - 9]
add ecx, edx
mov byte [ebp - 3], cl
mov eax, dword [ebp - 0x3094]
mov ecx, dword [ebp - 0x31b8]
and ecx, dword [eax]
mov edx, dword [ebp - 0x32e8]
mov eax, dword [ebp - 0x32c4]
mov edx, dword [edx]
xor edx, dword [eax]
cmp ecx, edx
jne 0x40a091
mov ax, word [ebp - 0x3074]
mov word [ebp - 0x9e0], ax
mov edx, dword [ebp - 0x320c]
mov ecx, dword [0x56a058]
sar edx, cl
mov eax, dword [ebp - 0x32c4]
mov dword [eax], edx
mov ecx, dword [ebp - 0x30e8]
mov edx, dword [ecx]
mov dword [ebp - 0x3300], edx
mov eax, dword [ebp - 0x3230]
add eax, dword [ebp - 0x3058]
mov ecx, dword [ebp - 0x327c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x31a0]
mov eax, dword [edx]
sub eax, dword [ebp - 0x3230]
mov dword [ebp - 0x32cc], eax
jmp 0x40a0c0
push 0x79
push 0x20
push 0x7e
mov ecx, dword [ebp - 0x3200]
push ecx
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0x3304], eax
movzx edx, byte [ebp - 0xb]
mov eax, dword [ebp - 0x30e0]
movzx ecx, byte [eax]
and edx, ecx
mov eax, dword [ebp - 0x3148]
mov byte [eax], dl
movzx ecx, word [ebp - 0x316c]
mov edx, dword [ebp - 0x328c]
movzx eax, word [edx]
add ecx, eax
mov edx, dword [0x56bb04]
mov word [edx], cx
mov eax, dword [ebp - 0x3280]
sub eax, dword [ebp - 0x329c]
mov ecx, dword [ebp - 0x3098]
mov dword [ecx], eax
mov edx, dword [ebp - 0x31d8]
mov eax, dword [ebp - 0x32c4]
mov ecx, dword [edx]
sub ecx, dword [eax]
mov edx, dword [ebp - 0x3238]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3120]
mov ecx, dword [0x56bb10]
mov edx, dword [eax]
add edx, dword [ecx]
mov dword [ebp - 0x3160], edx
mov eax, dword [ebp - 0x3060]
mov ecx, dword [ebp - 0x31a0]
mov edx, dword [eax]
add edx, dword [ecx]
mov eax, dword [ebp - 0x327c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x32cc]
sub ecx, dword [ebp - 0x3160]
mov dword [ebp - 0x3048], ecx
movsx edx, word [ebp - 0x9d0]
mov eax, dword [ebp - 0x31f4]
movsx ecx, word [eax]
sub edx, ecx
mov eax, dword [ebp - 0x3224]
mov word [eax], dx
movsx ecx, byte [ebp - 6]
mov edx, dword [ebp - 0x30dc]
movsx eax, byte [edx]
sub ecx, eax
mov byte [ebp - 0xc], cl
movzx ecx, word [ebp - 0x9d4]
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
or ecx, eax
mov word [ebp - 0x3090], cx
movzx ecx, byte [ebp - 7]
movzx edx, byte [ebp - 0xf]
xor ecx, edx
mov byte [0x56ba36], cl
mov eax, dword [ebp - 0x318c]
mov edx, dword [eax]
mov ecx, dword [0x56bb30]
shl edx, cl
mov eax, dword [ebp - 0x30e8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3098]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x32fc]
shr edx, cl
mov dword [ebp - 0x321c], edx
mov eax, dword [ebp - 0x30e0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x32b4]
movzx eax, byte [edx]
and ecx, eax
mov byte [ebp - 3], cl
mov ecx, dword [0x56bb04]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x9c4]
add edx, eax
mov word [ebp - 0x9e0], dx
mov ecx, dword [ebp - 0x310c]
sub ecx, dword [ebp - 0x3048]
mov dword [ebp - 0x30a0], ecx
mov edx, dword [ebp - 0x31d0]
and edx, dword [ebp - 0x3064]
mov eax, dword [ebp - 0x3154]
mov dword [eax], edx
mov ecx, dword [ebp - 0x31d8]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x3048]
mov dword [ebp - 0x307c], edx
mov eax, dword [ebp - 0x3054]
add eax, dword [ebp - 0x3160]
mov dword [ebp - 0x3084], eax
mov ecx, dword [ebp - 0x32c0]
sub ecx, 0x2c
mov dword [ebp - 0x32c0], ecx
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x328c]
movzx edx, word [ecx]
sub eax, edx
mov ecx, dword [0x56bb04]
mov word [ecx], ax
mov edx, dword [ebp - 0x3134]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 8]
add eax, ecx
mov byte [ebp - 0xb], al
mov edx, dword [0x56bb40]
mov eax, dword [edx]
add eax, dword [ebp - 0x3064]
mov ecx, dword [ebp - 0x31c0]
mov dword [ecx], eax
mov edx, dword [ebp - 0x31f8]
xor edx, dword [ebp - 0x32cc]
mov dword [ebp - 0x3058], edx
mov eax, dword [ebp - 0x3214]
movsx edx, word [eax]
mov eax, dword [ebp - 0x31f4]
movsx ecx, word [eax]
shl edx, cl
mov word [ebp - 0x9c8], dx
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x3218]
movsx ecx, byte [eax]
sar edx, cl
mov ecx, dword [ebp - 0x3228]
mov byte [ecx], dl
mov edx, dword [ebp - 0x328c]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
or eax, edx
mov ecx, dword [ebp - 0x30e4]
mov word [ecx], ax
movzx edx, byte [ebp - 9]
mov eax, dword [ebp - 0x3210]
movzx ecx, byte [eax]
and edx, ecx
mov byte [ebp - 7], dl
mov edx, dword [ebp - 0x30b0]
mov eax, dword [ebp - 0x31c0]
mov ecx, dword [edx]
add ecx, dword [eax]
mov edx, dword [ebp - 0x3098]
mov dword [edx], ecx
mov eax, dword [ebp - 0x32c4]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x310c]
mov dword [0x56baf4], ecx
mov edx, dword [ebp - 0x327c]
mov eax, dword [edx]
add eax, dword [ebp - 0x3084]
mov dword [ebp - 0x32a4], eax
mov ecx, dword [ebp - 0x3174]
mov edx, dword [ebp - 0x324c]
mov eax, dword [ecx]
sub eax, dword [edx]
mov dword [ebp - 0x32fc], eax
mov ecx, dword [ebp - 0x3120]
mov edx, dword [ecx]
and edx, dword [ebp - 0x3084]
mov eax, dword [ebp - 0x3288]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3208]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 0xa]
add edx, eax
mov byte [ebp - 0xf], dl
movzx ecx, word [ebp - 0x9c4]
movzx edx, word [ebp - 0x9e0]
sub ecx, edx
mov word [ebp - 0x316c], cx
mov eax, dword [ebp - 0x3290]
sub eax, dword [ebp - 0x3048]
mov ecx, dword [ebp - 0x3138]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3078]
add edx, dword [0x56a074]
mov eax, dword [ebp - 0x324c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3268]
xor ecx, dword [ebp - 0x307c]
mov edx, dword [ebp - 0x32c4]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3120]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x320c]
shl edx, cl
mov dword [0x56baf4], edx
mov eax, dword [ebp - 0x30e0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x3210]
movzx eax, byte [edx]
or ecx, eax
mov edx, dword [ebp - 0x3254]
mov byte [edx], cl
mov eax, dword [ebp - 0x3188]
movzx edx, word [eax]
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
sar edx, cl
mov word [ebp - 0x3090], dx
cmp dword [ebp - 0x32c0], 0x5bd7
jae 0x40a0c0
mov ecx, dword [ebp - 0x3274]
and ecx, dword [ebp - 0x30cc]
mov edx, dword [ebp - 0x3174]
mov eax, dword [ebp - 0x31c0]
mov edx, dword [edx]
add edx, dword [eax]
cmp ecx, edx
jb 0x40a559
lea ecx, [ebp - 0x3184]
push ecx
mov edx, dword [ebp - 0x130ec]
push edx
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [ebp - 0x333c], eax
movsx eax, word [ebp - 0x9c0]
mov dword [ebp - 0x130f8], eax
cmp dword [ebp - 0x130f8], 0x663
je 0x515158
jmp 0x51518e
mov ecx, dword [ebp - 0x3174]
mov edx, dword [ebp - 0x3274]
or edx, dword [ecx]
mov eax, dword [ebp - 0x3098]
mov dword [eax], edx
push 0x6c
lea ecx, [ebp - 0x31c0]
push ecx
push fcn.00516f50
mov edx, dword [ebp - 0x3164]
push edx
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [ebp - 0x130fc], eax
mov eax, dword [ebp - 0x3094]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x3268]
sar edx, cl
mov eax, dword [ebp - 0x309c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3288]
mov edx, dword [0x56bb10]
mov eax, dword [ecx]
xor eax, dword [edx]
mov dword [ebp - 0x320c], eax
movzx ecx, byte [ebp - 0xf]
push ecx
call fcn.005169c0
mov edx, dword [ebp - 0x3218]
movzx eax, byte [edx]
push eax
mov ecx, dword [ebp - 0x307c]
push ecx
movzx edx, word [ebp - 0x9d0]
push edx
mov eax, dword [ebp - 0x30b0]
mov ecx, dword [eax]
push ecx
call fcn.00517510
add esp, 0x10
jmp 0x51528d
mov edx, dword [ebp - 0x3254]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 8]
sub eax, ecx
movzx edx, byte [ebp - 5]
mov ecx, dword [ebp - 0x3148]
movzx ecx, byte [ecx]
add edx, ecx
cmp eax, edx
jle 0x51528d
mov edx, dword [ebp - 0x3228]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
or eax, edx
mov ecx, dword [ebp - 0x3218]
movsx edx, byte [ecx]
movsx ecx, byte [ebp - 6]
and edx, ecx
cmp eax, edx
jne 0x51525f
movzx edx, byte [ebp - 0xb]
mov eax, dword [ebp - 0x31ac]
movzx ecx, byte [eax]
and edx, ecx
mov byte [ebp - 5], dl
mov edx, dword [ebp - 0x3228]
mov cl, byte [edx]
call fcn.00515e10
jmp 0x51528d
mov eax, dword [ebp - 0x3214]
movsx ecx, word [eax]
movsx edx, word [ebp - 0x9c8]
add ecx, edx
movsx eax, word [ebp - 0x9cc]
movsx edx, word [ebp - 0x9c0]
sub eax, edx
cmp ecx, eax
jne 0x51528d
mov cl, byte [ebp - 2]
call fcn.00515e10
mov eax, dword [ebp - 0x3138]
mov ecx, dword [ebp - 0x3230]
add ecx, dword [eax]
mov dword [ebp - 0x31f8], ecx
mov edx, dword [ebp - 0x3218]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x3228]
movsx edx, byte [ecx]
add eax, edx
mov ecx, dword [ebp - 0x30dc]
movsx edx, byte [ecx]
movsx ecx, byte [ebp - 0xc]
sub edx, ecx
cmp eax, edx
jg 0x5152ca
jmp 0x515303
mov edx, dword [ebp - 0x3154]
mov eax, dword [edx]
sub eax, dword [0x56a05c]
mov ecx, dword [ebp - 0x321c]
add ecx, dword [ebp - 0x3064]
cmp eax, ecx
jne 0x515303
movzx edx, word [ebp - 0x316c]
mov eax, dword [ebp - 0x3188]
movzx ecx, word [eax]
xor edx, ecx
mov eax, dword [ebp - 0x3184]
mov word [eax], dx
mov ecx, dword [ebp - 0x31d8]
mov edx, dword [ebp - 0x3084]
mov ecx, dword [ecx]
sar edx, cl
mov eax, dword [ebp - 0x3120]
mov dword [eax], edx
push 0
mov ecx, dword [ebp - 0x1313c]
push ecx
mov edx, dword [ebp - 0x13140]
push edx
mov eax, dword [ebp - 0x32c8]
push eax
call dword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [ebp - 0x32a4], eax
mov ecx, dword [0x56bb40]
mov edx, dword [ebp - 0x31c0]
mov eax, dword [ecx]
mov ecx, dword [edx]
shl eax, cl
mov dword [ebp - 0x321c], eax
mov ecx, dword [ebp - 0x3114]
push ecx
call dword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [ebp - 0x3068], eax
movzx edx, word [ebp - 0x3090]
mov dword [ebp - 0x13100], edx
cmp dword [ebp - 0x13100], 0xff
je 0x515386
jmp 0x515398
movzx eax, byte [ebp - 0xa]
movzx ecx, byte [ebp - 0xb]
sub eax, ecx
mov edx, dword [ebp - 0x3208]
mov byte [edx], al
mov eax, dword [ebp - 0x318c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x31d0]
shr edx, cl
mov eax, dword [0x56bb30]
xor eax, dword [ebp - 0x3280]
cmp edx, eax
jb 0x5153f6
mov ecx, dword [ebp - 0x31c0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x308c]
shl edx, cl
mov eax, dword [0x56bb40]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3064]
and ecx, dword [ebp - 0x321c]
mov dword [ebp - 0x308c], ecx
mov edx, dword [ebp - 0x31c0]
mov eax, dword [ebp - 0x31d0]
add eax, dword [edx]
mov dword [ebp - 0x3198], eax
jmp 0x515408
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
push edx
call fcn.005160f0
add esp, 4
mov eax, dword [ebp - 0x3214]
movsx ecx, word [eax]
mov edx, dword [ebp - 0x31f4]
movsx eax, word [edx]
sub ecx, eax
mov word [ebp - 0x9c8], cx
mov cl, byte [ebp - 0xa]
mov byte [ebp - 0x13104], cl
cmp byte [ebp - 0x13104], 0x64
je 0x515440
cmp byte [ebp - 0x13104], 0xfc
je 0x515456
jmp 0x515460
mov edx, dword [0x56bb10]
mov eax, dword [edx]
sub eax, dword [ebp - 0x320c]
mov dword [ebp - 0x3230], eax
jmp 0x515460
movzx ecx, byte [ebp - 7]
push ecx
call fcn.005169c0
mov edx, dword [ebp - 0x3238]
mov eax, dword [edx]
sub eax, dword [0x56baf4]
mov ecx, dword [ebp - 0x3094]
mov dword [ecx], eax
jmp 0x51557e
movzx edx, byte [ebp - 0xb]
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
add edx, ecx
mov byte [ebp - 5], dl
push 0xa5
lea edx, [ebp - 0x329c]
push edx
push fcn.00515e10
mov eax, dword [ebp - 0x3200]
push eax
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [ebp - 0x30d4], eax
mov ecx, dword [ebp - 0x3218]
mov dl, byte [ecx]
mov byte [ebp - 0x13108], dl
cmp byte [ebp - 0x13108], 0x67
je 0x5154cc
jmp 0x515560
mov eax, dword [ebp - 0x3188]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x328c]
movzx eax, word [edx]
add ecx, eax
mov edx, dword [0x56bb04]
mov word [edx], cx
movsx eax, word [0x56a038]
movsx ecx, word [ebp - 0x9c0]
sub eax, ecx
mov edx, dword [ebp - 0x31f4]
movsx ecx, word [edx]
mov edx, dword [ebp - 0x3214]
movsx edx, word [edx]
sub ecx, edx
cmp eax, ecx
je 0x515546
mov eax, dword [ebp - 0x3154]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30cc]
shr edx, cl
mov dword [ebp - 0x321c], edx
mov eax, dword [ebp - 0x328c]
movzx ecx, word [eax]
push ecx
mov edx, dword [ebp - 0x3074]
mov eax, dword [ebp - 0x3218]
mov cl, byte [eax]
call fcn.00516f50
jmp 0x51555e
mov ecx, dword [ebp - 0x327c]
mov edx, dword [ebp - 0x3288]
mov eax, dword [ecx]
or eax, dword [edx]
mov ecx, dword [ebp - 0x3138]
mov dword [ecx], eax
jmp 0x51557e
lea edx, [ebp - 0xa]
push edx
mov eax, dword [ebp - 0x312c]
push eax
mov ecx, dword [ebp - 0x3158]
push ecx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x130fc], eax
mov edx, dword [ebp - 0x3214]
movsx eax, word [edx]
movsx ecx, word [ebp - 0x9c8]
or eax, ecx
movsx edx, word [ebp - 0x9bc]
mov ecx, dword [ebp - 0x31f4]
movsx ecx, word [ecx]
and edx, ecx
cmp eax, edx
jne 0x5155db
lea edx, [ebp - 0x31f4]
push edx
mov eax, dword [ebp - 0x30bc]
push eax
mov ecx, dword [ebp - 0x3284]
push ecx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x3330], eax
mov edx, dword [ebp - 0x30e8]
mov eax, dword [edx]
add eax, dword [ebp - 0x3198]
mov dword [ebp - 0x3280], eax
mov ecx, dword [ebp - 0x327c]
mov edx, dword [ebp - 0x307c]
add edx, dword [ecx]
mov dword [ebp - 0x3058], edx
mov eax, dword [ebp - 0x3288]
mov ecx, dword [ebp - 0x3094]
mov edx, dword [eax]
and edx, dword [ecx]
mov eax, dword [ebp - 0x31a0]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3218]
movzx edx, byte [ecx]
push edx
mov eax, dword [ebp - 0x320c]
push eax
movzx ecx, word [ebp - 0x9d0]
push ecx
mov edx, dword [0x56bb30]
push edx
call fcn.00517510
add esp, 0x10
jmp 0x51564f
movzx eax, word [ebp - 0x9d4]
push eax
mov ecx, dword [ebp - 0x30e4]
mov dx, word [ecx]
mov eax, dword [ebp - 0x30dc]
mov cl, byte [eax]
call fcn.00516f50
mov ecx, dword [ebp - 0x328c]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x3090]
and edx, eax
movzx ecx, word [0x56a028]
movzx eax, word [ebp - 0x9d4]
add ecx, eax
cmp edx, ecx
je 0x5156a0
movzx ecx, byte [ebp - 2]
push ecx
mov edx, dword [ebp - 0x3288]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x31f4]
movzx edx, word [ecx]
push edx
mov eax, dword [ebp - 0x3154]
mov ecx, dword [eax]
push ecx
call fcn.00517510
add esp, 0x10
jmp 0x5156b2
mov edx, dword [ebp - 0x3280]
or edx, dword [ebp - 0x30cc]
mov dword [0x56bb30], edx
mov eax, dword [ebp - 0x31d8]
mov ecx, dword [ebp - 0x3058]
sub ecx, dword [eax]
mov dword [ebp - 0x314c], ecx
movsx edx, word [ebp - 0x9c8]
movsx eax, word [ebp - 0x9d0]
add edx, eax
movsx ecx, word [0x56a038]
movsx eax, word [ebp - 0x9cc]
add ecx, eax
cmp edx, ecx
jg 0x515749
mov ecx, dword [ebp - 0x3120]
mov edx, dword [ebp - 0x327c]
mov eax, dword [ecx]
sub eax, dword [edx]
mov ecx, dword [ebp - 0x3060]
mov dword [ecx], eax
push 0x5e
mov edx, dword [ebp - 0x3114]
push edx
mov eax, dword [ebp - 0x1310c]
push eax
call dword [sym.imp.COMCTL32.dll_DrawInsert]
mov ecx, dword [0x56bb10]
mov edx, dword [ecx]
and edx, dword [ebp - 0x307c]
mov dword [ebp - 0x320c], edx
mov eax, dword [ebp - 0x328c]
movzx edx, word [eax]
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
shl edx, cl
mov ecx, dword [ebp - 0x3188]
mov word [ecx], dx
jmp 0x51580f
mov edx, dword [ebp - 0x3078]
and edx, dword [0x56bb30]
mov eax, dword [ebp - 0x308c]
sub eax, dword [ebp - 0x321c]
cmp edx, eax
ja 0x5157b5
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ecx]
add edx, dword [ebp - 0x3248]
mov dword [ebp - 0x30a0], edx
mov eax, dword [ebp - 0x3230]
sub eax, dword [ebp - 0x3048]
mov dword [ebp - 0x3160], eax
push 1
mov ecx, dword [ebp - 0x13144]
push ecx
mov edx, dword [ebp - 0x13148]
push edx
mov eax, dword [ebp - 0x31c4]
push eax
call dword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [ebp - 0x3248], eax
jmp 0x51580f
mov ecx, dword [ebp - 0x30e4]
movzx edx, word [ecx]
mov dword [ebp - 0x13110], edx
cmp dword [ebp - 0x13110], 0x331
je 0x5157f4
cmp dword [ebp - 0x13110], 0x9fd
je 0x5157de
jmp 0x51580f
mov eax, dword [ebp - 0x3078]
sub eax, dword [ebp - 0x3198]
mov ecx, dword [ebp - 0x318c]
mov dword [ecx], eax
jmp 0x51580f
mov edx, dword [0x56bb04]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
and eax, edx
mov word [ebp - 0x3074], ax
mov eax, dword [ebp - 0x30cc]
xor eax, dword [ebp - 0x3064]
mov ecx, dword [ebp - 0x3098]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
push eax
call fcn.005160f0
add esp, 4
movzx ecx, byte [ebp - 9]
movzx edx, byte [ebp - 4]
sub ecx, edx
mov byte [ebp - 7], cl
jmp 0x5158a7
movsx eax, word [ebp - 0x9bc]
movsx ecx, word [ebp - 0x9cc]
add eax, ecx
mov edx, dword [ebp - 0x3224]
movsx ecx, word [edx]
mov edx, dword [ebp - 0x3214]
movsx edx, word [edx]
xor ecx, edx
cmp eax, ecx
jne 0x5158a7
mov eax, dword [ebp - 0x3138]
mov ecx, dword [ebp - 0x3160]
sub ecx, dword [eax]
mov dword [ebp - 0x30a0], ecx
movzx edx, byte [ebp - 3]
mov eax, dword [ebp - 0x3134]
movzx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x3148]
mov byte [eax], dl
movzx ecx, word [ebp - 0x3074]
push ecx
call fcn.005160f0
add esp, 4
movsx edx, word [ebp - 0x9c8]
mov eax, dword [ebp - 0x31f4]
movsx ecx, word [eax]
shl edx, cl
mov ecx, dword [ebp - 0x3224]
movsx eax, word [ecx]
movsx ecx, word [ebp - 0x9c0]
or eax, ecx
cmp edx, eax
jg 0x51591a
mov edx, dword [ebp - 0x3214]
movsx eax, word [edx]
mov ecx, dword [ebp - 0x3224]
movsx ecx, word [ecx]
sar eax, cl
mov edx, dword [ebp - 0x3214]
mov word [edx], ax
lea eax, [ebp - 0x3130]
push eax
mov ecx, dword [ebp - 0x312c]
push ecx
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [ebp - 0x3118], eax
mov edx, dword [ebp - 0x31cc]
mov eax, dword [ebp - 0x31d0]
and eax, dword [edx]
mov dword [ebp - 0x3078], eax
mov cl, byte [ebp - 1]
mov byte [ebp - 0x13114], cl
cmp byte [ebp - 0x13114], 0x1a
je 0x515937
cmp byte [ebp - 0x13114], 0x5a
je 0x515986
jmp 0x515999
lea edx, [ebp - 0x31f4]
push edx
mov eax, dword [ebp - 0x306c]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [ebp - 0x3130], eax
mov ecx, dword [ebp - 0x3198]
sub ecx, dword [ebp - 0x308c]
mov dword [ebp - 0x3064], ecx
mov edx, dword [ebp - 0x31f8]
add edx, dword [ebp - 0x314c]
mov eax, dword [ebp - 0x3094]
mov dword [eax], edx
mov ecx, dword [ebp - 0x30dc]
mov cl, byte [ecx]
call fcn.00515e10
jmp 0x515999
mov edx, dword [0x56bb10]
mov eax, dword [ebp - 0x30a0]
sub eax, dword [edx]
mov dword [0x56baf4], eax
jmp 0x5159cd
movzx ecx, word [ebp - 0x316c]
movzx edx, word [ebp - 0x3074]
and ecx, edx
movzx eax, word [ebp - 0x3090]
mov edx, dword [ebp - 0x30e4]
movzx edx, word [edx]
imul eax, edx
cmp ecx, eax
jl 0x5159cd
mov cl, byte [0x5430d6]
call fcn.00515e10
mov eax, dword [ebp - 0x308c]
add eax, dword [ebp - 0x30cc]
mov ecx, dword [ebp - 0x3174]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3120]
mov eax, dword [edx]
add eax, dword [ebp - 0x310c]
mov dword [ebp - 0x3160], eax
movzx ecx, word [ebp - 0x9c4]
movzx edx, word [ebp - 0x316c]
add ecx, edx
mov eax, dword [ebp - 0x3188]
mov word [eax], cx
mov ecx, dword [ebp - 0x3124]
push ecx
call dword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [ebp - 0x333c], eax
movzx edx, word [ebp - 0x3090]
mov dword [ebp - 0x13118], edx
cmp dword [ebp - 0x13118], 0x2c1
je 0x515a3e
jmp 0x515a54
mov eax, dword [ebp - 0x30b0]
mov edx, dword [ebp - 0x31d0]
mov ecx, dword [eax]
shr edx, cl
mov dword [ebp - 0x3064], edx
mov eax, dword [ebp - 0x30dc]
movsx ecx, byte [eax]
movsx edx, byte [ebp - 2]
add ecx, edx
mov eax, dword [ebp - 0x30dc]
mov byte [eax], cl
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x3188]
movzx ecx, word [eax]
or edx, ecx
mov word [ebp - 0x316c], dx
mov edx, dword [ebp - 0x3134]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 7]
xor eax, ecx
mov edx, dword [ebp - 0x3148]
mov byte [edx], al
lea eax, [ebp - 6]
push eax
mov ecx, dword [ebp - 0x31a8]
push ecx
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [ebp - 0x3130], eax
jmp 0x515ad1
movzx edx, word [ebp - 0x316c]
push edx
mov edx, dword [ebp - 0x3090]
mov eax, dword [ebp - 0x30dc]
mov cl, byte [eax]
call fcn.00516f50
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x3184]
movzx ecx, word [eax]
and edx, ecx
mov eax, dword [ebp - 0x3188]
mov word [eax], dx
lea ecx, [ebp - 0x3188]
push ecx
mov edx, dword [ebp - 0x3104]
push edx
mov eax, dword [ebp - 0x3158]
push eax
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x3130], eax
movzx ecx, byte [ebp - 3]
mov edx, dword [ebp - 0x3134]
movzx eax, byte [edx]
sub ecx, eax
mov byte [ebp - 4], cl
mov ecx, dword [ebp - 0x30e8]
mov edx, dword [ebp - 0x318c]
mov eax, dword [ecx]
add eax, dword [edx]
mov ecx, dword [ebp - 0x3154]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x308c]
cmp eax, edx
jne 0x515b5e
movzx eax, word [ebp - 0x9c4]
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
add eax, edx
mov ecx, dword [ebp - 0x3188]
mov word [ecx], ax
mov edx, dword [ebp - 0x3064]
sub edx, dword [ebp - 0x30cc]
mov dword [ebp - 0x308c], edx
lea eax, [ebp - 0x9c4]
push eax
mov ecx, dword [ebp - 0x1311c]
push ecx
mov edx, dword [ebp - 0x3158]
push edx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x3118], eax
mov eax, dword [ebp - 0x3060]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x3058]
mov edx, dword [ebp - 0x3120]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3138]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x3058]
mov dword [ebp - 0x3054], ecx
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
push eax
mov edx, dword [ebp - 0x3074]
mov ecx, dword [ebp - 0x30dc]
mov cl, byte [ecx]
call fcn.00516f50
jmp 0x515bf3
push 0xf9
mov edx, dword [ebp - 0x322c]
push edx
mov eax, dword [ebp - 0x3180]
push eax
call dword [sym.imp.COMCTL32.dll_DrawInsert]
mov ecx, dword [ebp - 0x3084]
mov dword [ebp - 0x13120], ecx
cmp dword [ebp - 0x13120], 0x644a
je 0x515c0f
jmp 0x515c2a
mov edx, dword [ebp - 0x3184]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x3188]
movzx edx, word [ecx]
add eax, edx
mov word [ebp - 0x9c4], ax
mov eax, dword [ebp - 0x3060]
mov ecx, dword [ebp - 0x314c]
and ecx, dword [eax]
mov dword [ebp - 0x3054], ecx
movzx edx, byte [ebp - 7]
mov eax, dword [ebp - 0x3148]
movzx ecx, byte [eax]
sub edx, ecx
mov eax, dword [ebp - 0x3134]
mov byte [eax], dl
movsx ecx, byte [ebp - 2]
mov edx, dword [ebp - 0x30dc]
movsx eax, byte [edx]
sub ecx, eax
mov byte [0x5430d6], cl
mov ecx, dword [ebp - 0x3184]
movzx edx, word [ecx]
push edx
mov edx, dword [ebp - 0x316c]
mov cl, byte [ebp - 1]
call fcn.00516f50
mov eax, dword [ebp - 0x30e4]
movzx ecx, word [eax]
mov dword [ebp - 0x13124], ecx
cmp dword [ebp - 0x13124], 0x928
je 0x515c9f
jmp 0x515cff
lea edx, [ebp - 5]
push edx
mov eax, dword [ebp - 0x30bc]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov dword [ebp - 0x3130], eax
movzx ecx, word [0x56a028]
movzx edx, word [ebp - 0x3074]
or ecx, edx
mov eax, dword [ebp - 0x30e4]
mov word [eax], cx
mov ecx, dword [ebp - 0x3060]
mov edx, dword [ebp - 0x3058]
mov ecx, dword [ecx]
shl edx, cl
mov dword [ebp - 0x307c], edx
mov eax, dword [ebp - 0x3098]
mov ecx, dword [ebp - 0x30b0]
mov edx, dword [eax]
xor edx, dword [ecx]
mov eax, dword [ebp - 0x30e8]
mov dword [eax], edx
jmp 0x515d2e
movzx ecx, word [ebp - 0x3090]
push ecx
mov edx, dword [ebp - 0x30e4]
movzx eax, word [edx]
push eax
mov ecx, dword [ebp - 0x30cc]
push ecx
mov edx, dword [ebp - 0x30cc]
push edx
mov eax, dword [ebp - 0x3064]
push eax
call fcn.00516630
add esp, 0x14
jmp 0x515d75
mov ecx, dword [ebp - 0x3048]
and ecx, 0x5be5
mov dword [ebp - 0x3048], ecx
push 0x67
push 0x4c
push 0xb4
mov edx, dword [ebp - 0x3124]
push edx
call sub.COMCTL32.dll_DefSubclassProc
mov dword [ebp - 0x3100], eax
mov eax, dword [ebp - 0x3048]
sar eax, 0x10
mov dword [ebp - 0x3048], eax
push 0x3a
push 0xffffffffffffffe6
call fcn.00516150
mov ecx, dword [ebp - 0x3048]
mov dword [ebp - 0x13128], ecx
cmp dword [ebp - 0x13128], 0x1d10
je 0x515d9b
cmp dword [ebp - 0x13128], 0x3bef
je 0x515de1
jmp 0x515df9
lea edx, [ebp - 0x3104]
push edx
mov eax, dword [ebp - 0x3104]
push eax
mov ecx, dword [ebp - 0x3284]
push ecx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
mov dword [ebp - 0x3118], eax
mov edx, dword [ebp - 0x3048]
sub edx, 0x655
mov dword [ebp - 0x3048], edx
mov eax, dword [ebp - 0x3048]
add eax, 0xfb8
mov dword [ebp - 0x3048], eax
jmp 0x515df9
push 0xf1
push 0x7a
push 0x66
push 0xe9
push 0x47
call fcn.00516630
add esp, 0x14
mov eax, dword [ebp - 0x3c3c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10