Function at 0x40129e
Capabilities:
Allocate thread local storage
Check os version
Contain obfuscated stackstrings
Create pipe
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x25e8
call fcn.004a87d0
push esi
push edi
mov dword [ebp - 0x70], 0xc03342eb
mov byte [ebp - 0x2c0], 0
movzx eax, byte [ebp - 0x2c0]
test eax, eax
je 0x4012ce
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [ebp - 0x70], 0
jmp 0x4012de
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x12
je 0x4015d0
mov dword [ebp - 0x9c], 0xfffffffa
mov dword [ebp - 0x1a80], 0x22263126
mov dword [ebp - 0x1a7c], 0x22263126
mov dword [ebp - 0x1a78], 0x22263126
mov dword [ebp - 0x1a74], 0x22263126
mov dword [ebp - 0x3c8], 0
jmp 0x401333
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 3
jge 0x40134f
mov eax, dword [ebp - 0x3c8]
mov dword [ebp + eax*4 - 0x247c], 0
jmp 0x401326
mov dword [ebp - 0x9c], 9
jmp 0x401368
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xffffffe2
jne 0x401399
mov byte [ebp - 0x2b2], 0
movzx eax, byte [ebp - 0x2b2]
test eax, eax
je 0x401397
push 0
push 0x1965
push 0
push 0x11d1
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
jmp 0x40135b
mov dword [ebp - 0x9c], 3
jmp 0x4013b2
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x4015cb
push 2
lea ecx, [ebp - 0x1968]
call fcn.004133eb
mov dword [ebp - 0x1610], 0xd1d9d65f
mov dword [ebp - 0x3cc], 0
jmp 0x4013ef
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 2
jge 0x401411
push dword [ebp - 0x3cc]
lea ecx, [ebp - 0x1968]
call fcn.004134d9
mov dword [eax], 0xa5f27a41
jmp 0x4013e2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1a80], 0
je 0x4014d9
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x2450], eax
push 0xfffffffffffffff7
pop eax
cmp eax, 0x4d25
je 0x401444
mov dword [ebp - 0x9fc], 1
jmp 0x40144b
and dword [ebp - 0x9fc], 0
imul eax, dword [ebp - 0x9fc], 0x6d06
cmp eax, dword [ebp - 0x9c]
jne 0x401469
mov dword [ebp - 0x13fc], 1
jmp 0x401470
and dword [ebp - 0x13fc], 0
imul eax, dword [ebp - 0x13fc], 0x5bf7
dec eax
je 0x401492
mov eax, 0x4353ea3a
test eax, eax
je 0x401492
mov dword [ebp - 0x1404], 1
jmp 0x401499
and dword [ebp - 0x1404], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x1404], eax
jge 0x4014b0
mov dword [ebp - 0x140c], 1
jmp 0x4014b7
and dword [ebp - 0x140c], 0
push 1
lea ecx, [ebp - 0x1968]
call fcn.004134d9
mov eax, dword [eax]
sub eax, dword [ebp - 0x140c]
push 4
pop ecx
imul ecx, ecx, 3
sub eax, dword [ebp + ecx - 0x1a80]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1a80]
mov dword [ebp - 0x23d0], eax
push 1
lea ecx, [ebp - 0x1968]
call fcn.004134d9
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x20dc], eax
mov eax, 0x1177
test eax, eax
jne 0x401519
cmp dword [ebp - 0x70], 0
jne 0x401519
and dword [ebp - 0x1414], 0
jmp 0x401523
mov dword [ebp - 0x1414], 1
push 0
lea ecx, [ebp - 0x1968]
call fcn.004134d9
mov ecx, dword [ebp - 0x1414]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x22a8], eax
mov eax, dword [ebp - 0x1610]
cmp dword [ebp - 0x70], eax
jle 0x401558
mov dword [ebp - 0x141c], 1
jmp 0x40155f
and dword [ebp - 0x141c], 0
cmp dword [ebp - 0x141c], 0x7d900d29
jge 0x401577
mov dword [ebp - 0x1738], 1
jmp 0x40157e
and dword [ebp - 0x1738], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x20e4], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x247c], 1
mov byte [ebp - 0x25d], 0
movzx eax, byte [ebp - 0x25d]
test eax, eax
je 0x4015bb
push 0
push 0
push 0x1250
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea ecx, [ebp - 0x1968]
call fcn.004134bd
jmp 0x4013a5
jmp 0x4012d7
mov dword [ebp - 0x158], 0xc45c
mov dword [ebp - 0x1b0], 0xffffffff
push 1
lea ecx, [ebp - 0x2234]
call fcn.004133eb
push 1
lea ecx, [ebp - 0x2224]
call fcn.004133eb
mov dword [ebp - 0x128c], 0xbb5f37d7
mov dword [ebp - 0xb0], 0
jmp 0x401621
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x401643
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x2234]
call fcn.004134d9
mov dword [eax], 0xfffffffd
jmp 0x401614
mov dword [ebp - 0xb0], 0
jmp 0x40165c
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x40167e
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x2224]
call fcn.004134d9
mov dword [eax], 5
jmp 0x40164f
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x158], eax
jne 0x40169b
mov dword [ebp - 0x1b0], 0xb6318d58
jmp 0x401a08
mov dword [ebp - 0x37c], 0xe4de
mov dword [ebp - 0x860], 0x9b93b3bb
mov dword [ebp - 0x2420], 1
mov dword [ebp - 0x20ec], 0xfffffffe
mov dword [ebp - 0x22b8], 1
mov dword [ebp - 0x20f4], 0
mov dword [ebp - 0x23d8], 0x2dcbded6
mov dword [ebp - 0x20fc], 0xffffffff
mov dword [ebp - 0x2428], 0x8e11f317
mov dword [ebp - 0x2128], 0xc03fdda7
push 1
lea ecx, [ebp - 0x2214]
call fcn.004133eb
mov dword [ebp - 0x4e4], 0
jmp 0x401725
mov eax, dword [ebp - 0x4e4]
inc eax
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 1
jge 0x401747
push dword [ebp - 0x4e4]
lea ecx, [ebp - 0x2214]
call fcn.004134d9
mov dword [eax], 0x386b9bdd
jmp 0x401718
mov dword [ebp - 0x158], 0
jmp 0x401760
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x1f
je 0x4019f0
mov dword [ebp - 0x1444], 0
mov dword [ebp - 0x142c], 0
mov dword [ebp - 0x720], 0
mov dword [ebp - 0x1740], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x158], eax
je 0x4017af
mov dword [ebp - 0x1424], 1
jmp 0x4017b6
and dword [ebp - 0x1424], 0
imul eax, dword [ebp - 0x1424], 0x907
cmp eax, dword [ebp - 0x37c]
jle 0x4017d4
mov dword [ebp - 0x1434], 1
jmp 0x4017db
and dword [ebp - 0x1434], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x142c], eax
mov eax, dword [ebp - 0x142c]
cmp eax, dword [ebp - 0x1434]
je 0x401801
mov dword [ebp - 0x143c], 1
jmp 0x401808
and dword [ebp - 0x143c], 0
cmp dword [ebp - 0x143c], 0
jne 0x40181d
mov dword [ebp - 0x144c], 1
jmp 0x401824
and dword [ebp - 0x144c], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1444], eax
mov eax, dword [ebp - 0x1444]
inc eax
inc eax
cmp eax, dword [ebp - 0x144c]
jle 0x401849
cmp dword [ebp - 0x1b0], 0
je 0x40184d
xor eax, eax
jne 0x40185f
cmp dword [ebp - 0x158], 0
jne 0x40185f
and dword [ebp - 0x1454], 0
jmp 0x401869
mov dword [ebp - 0x1454], 1
mov eax, dword [ebp - 0x720]
cmp dword [ebp - 0x1454], eax
jle 0x401883
mov dword [ebp - 0x145c], 1
jmp 0x40188a
and dword [ebp - 0x145c], 0
cmp dword [ebp - 0x145c], 0xffffffff
jg 0x40189f
mov dword [ebp - 0x1464], 1
jmp 0x4018a6
and dword [ebp - 0x1464], 0
mov eax, dword [ebp - 0x37c]
cmp dword [ebp - 0x1464], eax
jg 0x4018c0
mov dword [ebp - 0x1564], 1
jmp 0x4018c7
and dword [ebp - 0x1564], 0
cmp dword [ebp - 0x1564], 0xd69b45c7
je 0x4018df
mov dword [ebp - 0x9b0], 1
jmp 0x4018e6
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x720]
imul eax, dword [ebp - 0x9b0]
imul eax, eax, 0x56ee
mov dword [ebp - 0x720], eax
mov eax, dword [ebp - 0x37c]
sub eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x158]
jle 0x40191f
mov dword [ebp - 0x848], 1
jmp 0x401926
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x37c]
imul eax, dword [ebp - 0x848]
cmp eax, 0x3c444c9c
je 0x401946
mov dword [ebp - 0x1274], 1
jmp 0x40194d
and dword [ebp - 0x1274], 0
mov eax, dword [ebp - 0x1274]
mov dword [ebp - 0x1740], eax
mov eax, dword [ebp - 0x37c]
cmp dword [ebp - 0x1b0], eax
jl 0x401973
mov dword [ebp - 0x850], 1
jmp 0x40197a
and dword [ebp - 0x850], 0
cmp dword [ebp - 0x850], 0x3836
jle 0x401998
cmp dword [ebp - 0x1b0], 0
jne 0x401998
and dword [ebp - 0x127c], 0
jmp 0x4019a2
mov dword [ebp - 0x127c], 1
mov eax, dword [ebp - 0x860]
cmp dword [ebp - 0x127c], eax
jg 0x4019bc
mov dword [ebp - 0x858], 1
jmp 0x4019c3
and dword [ebp - 0x858], 0
cmp dword [ebp - 0x858], 0xfffffff9
jne 0x4019d8
mov dword [ebp - 0x1284], 1
jmp 0x4019df
and dword [ebp - 0x1284], 0
mov eax, dword [ebp - 0x1284]
mov dword [ebp - 0x860], eax
jmp 0x401753
mov eax, dword [ebp - 0x128c]
dec eax
mov dword [ebp - 0x128c], eax
lea ecx, [ebp - 0x2214]
call fcn.004134bd
lea ecx, [ebp - 0x2224]
call fcn.004134bd
lea ecx, [ebp - 0x2234]
call fcn.004134bd
mov dword [ebp - 0x660], 0xe57b
mov dword [ebp - 0x780], 0xd76ce4a6
mov dword [ebp - 0x1778], 1
mov dword [ebp - 0x3d4], 0
jmp 0x401a55
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 2
jge 0x401a71
mov eax, dword [ebp - 0x3d4]
mov dword [ebp + eax*4 - 0x13e8], 0xffffffff
jmp 0x401a48
mov eax, dword [ebp - 0x660]
mov dword [ebp - 0x22fc], eax
or eax, 0xffffffff
je 0x401aee
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x13e8]
mov dword [ebp - 0x2130], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x13e8]
cmp dword [ebp + eax - 0x13e8], ecx
je 0x401abd
mov dword [ebp - 0x868], 1
jmp 0x401ac4
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 0
je 0x401aee
cmp dword [ebp - 0x660], 0
je 0x401aee
mov dword [ebp - 0x1294], 1
jmp 0x401af5
and dword [ebp - 0x1294], 0
mov eax, dword [ebp - 0x660]
cmp eax, dword [ebp - 0x1294]
jl 0x401b0f
mov dword [ebp - 0x870], 1
jmp 0x401b16
and dword [ebp - 0x870], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13e8]
cmp dword [ebp - 0x870], eax
jg 0x401b3b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x13e8], 0
je 0x401b5c
mov byte [ebp - 0x2b4], 0
movzx eax, byte [ebp - 0x2b4]
test eax, eax
je 0x401b5a
push 0xae5
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
jmp 0x401bcf
mov dword [ebp - 0x12a4], 0xfffffffb
mov dword [ebp - 0x878], 0xf81320f2
mov eax, dword [ebp - 0x1778]
cmp dword [ebp - 0x12a4], eax
je 0x401b8a
mov dword [ebp - 0x129c], 1
jmp 0x401b91
and dword [ebp - 0x129c], 0
mov eax, dword [ebp - 0x129c]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp - 0x878]
cmp dword [ebp - 0x12a4], eax
jge 0x401bb7
mov dword [ebp - 0x880], 1
jmp 0x401bbe
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x880]
add eax, 0xcd44
mov dword [ebp - 0x780], eax
mov byte [ebp - 0x265], 0
movzx eax, byte [ebp - 0x265]
test eax, eax
je 0x401bee
push 0x1eaf
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [ebp - 0x6c], 0xc03342eb
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x2cc], 0xc5416513
mov dword [ebp - 0x1790], 0x8dc509ca
mov dword [ebp - 0x1798], 0xb187b35f
mov dword [ebp - 0x23e8], 0xffffffff
mov dword [ebp - 0x174], 0xffffffea
jmp 0x401c40
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0xffffffee
jne 0x401eef
push 3
lea ecx, [ebp - 0x1bf4]
call fcn.004133eb
mov dword [ebp - 0x1dc], 0xf2d3f504
mov dword [ebp - 0x12bc], 7
mov dword [ebp - 0xb8], 0
jmp 0x401c87
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x401ca3
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x1474], 0x36951ad3
jmp 0x401c7a
mov dword [ebp - 0xb8], 0
jmp 0x401cbc
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x401cde
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x1bf4]
call fcn.004134d9
mov dword [eax], 0x4aa0d722
jmp 0x401caf
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1474], 0
jmp 0x401d0c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1474]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1474], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1474], 0xffffffe9
jl 0x401d35
mov dword [ebp - 0x2138], 9
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
jmp 0x401cf1
cmp dword [ebp - 0x174], 0x43e2
jle 0x401d4d
mov dword [ebp - 0x12ac], 1
jmp 0x401d54
and dword [ebp - 0x12ac], 0
mov eax, dword [ebp - 0x12bc]
cmp dword [ebp - 0x1dc], eax
jle 0x401d77
cmp dword [ebp - 0x174], 0
je 0x401d77
mov dword [ebp - 0x888], 1
jmp 0x401d7e
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x12ac]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
cmp eax, dword [ebp - 0x888]
jge 0x401da4
mov dword [ebp - 0x12b4], 1
jmp 0x401dab
and dword [ebp - 0x12b4], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x12b4], eax
jle 0x401dc5
mov dword [ebp - 0x890], 1
jmp 0x401dcc
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x890], eax
je 0x401df6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1474], 0
je 0x401df6
mov dword [ebp - 0x1780], 1
jmp 0x401dfd
and dword [ebp - 0x1780], 0
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1788], eax
push 2
lea ecx, [ebp - 0x1bf4]
call fcn.004134d9
mov ecx, dword [ebp - 0x1788]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0x1bf4]
call fcn.004134d9
mov ecx, dword [ebp - 0x12bc]
cmp dword [eax], ecx
jg 0x401e41
mov dword [ebp - 0x898], 1
jmp 0x401e48
and dword [ebp - 0x898], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1474]
imul eax, dword [ebp - 0x898]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x1474]
jg 0x401e77
mov dword [ebp - 0x12c4], 1
jmp 0x401e7e
and dword [ebp - 0x12c4], 0
mov eax, dword [ebp - 0x12c4]
mov dword [ebp - 0x1790], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1dc]
cmp dword [ebp + eax - 0x1474], ecx
jge 0x401eab
mov dword [ebp - 0x8a0], 1
jmp 0x401eb2
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x8a0], eax
jg 0x401ecc
mov dword [ebp - 0x12cc], 1
jmp 0x401ed3
and dword [ebp - 0x12cc], 0
mov eax, dword [ebp - 0x12cc]
mov dword [ebp - 0x1798], eax
lea ecx, [ebp - 0x1bf4]
call fcn.004134bd
jmp 0x401c33
mov dword [ebp - 0x2cc], 0xffffffff
jmp 0x401f08
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0
jge 0x401f1f
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x174], eax
jmp 0x401efb
mov byte [ebp - 0x2b6], 0
mov dword [ebp - 0x2d4], 0xfffffff7
mov dword [ebp - 0x5bc], 0
jmp 0x401f49
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 3
jge 0x401f65
mov eax, dword [ebp - 0x5bc]
mov dword [ebp + eax*4 - 0x2244], 0xfffffffd
jmp 0x401f3c
mov dword [ebp - 0x2d4], 2
jmp 0x401f7e
mov eax, dword [ebp - 0x2d4]
dec eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0
jl 0x401fa3
mov eax, dword [ebp - 0x2d4]
mov ecx, dword [ebp - 0x2d4]
mov eax, dword [ebp + eax*4 - 0x2244]
mov dword [ebp + ecx*4 - 0x2244], eax
jmp 0x401f71
movzx eax, byte [ebp - 0x2b6]
test eax, eax
je 0x401fb6
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [ebp - 0x6c], 0
jmp 0x401fc6
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x12
je 0x40378e
mov dword [ebp - 0x1e4], 0xb9f9b31
mov dword [ebp - 0x34c], 0xd686a37b
mov dword [ebp - 0x1e4], 0xffffffe6
jmp 0x401ffd
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xfffffff4
jle 0x402467
mov dword [ebp - 0x1ec], 0xc6f1bf50
mov dword [ebp - 0x728], 0xffffffff
mov dword [ebp - 0x1ec], 0
jmp 0x402037
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0xfffffffc
jne 0x402437
mov dword [ebp - 0x1f4], 0xffffffff
mov dword [ebp - 0x668], 0xfffe
push 4
lea ecx, [ebp - 0x1978]
call fcn.004133eb
mov dword [ebp - 0x3dc], 0
jmp 0x40207e
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 4
jge 0x4020a0
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0x1978]
call fcn.004134d9
mov dword [eax], 0xe497d6a5
jmp 0x402071
mov eax, 0xa98815cb
sub eax, dword [ebp - 0x1e4]
neg eax
je 0x402180
cmp dword [ebp - 0x1ec], 0
jne 0x402149
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x230c], eax
cmp dword [ebp - 0x1e4], 0
cmp dword [ebp - 0x1f4], 0xfffc
jne 0x4020eb
mov dword [ebp - 0x8a8], 1
jmp 0x4020f2
and dword [ebp - 0x8a8], 0
cmp dword [ebp - 0x8a8], 0xe136dc99
ja 0x40210a
mov dword [ebp - 0x12d4], 1
jmp 0x402111
and dword [ebp - 0x12d4], 0
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x12d4], eax
jne 0x40212b
mov dword [ebp - 0x8b0], 1
jmp 0x402132
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x8b0]
sub eax, dword [ebp - 0x1f4]
jne 0x402149
and dword [ebp - 0x12dc], 0
jmp 0x402153
mov dword [ebp - 0x12dc], 1
mov eax, dword [ebp - 0x1f4]
imul eax, dword [ebp - 0x12dc]
test eax, eax
jne 0x40216b
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x402180
cmp dword [ebp - 0x668], 0
je 0x402180
mov dword [ebp - 0x8b8], 1
jmp 0x402187
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x2140], eax
or eax, 0xffffffff
je 0x402407
mov dword [ebp - 0x4ec], 0xffffffff
mov dword [ebp - 0x1314], 0
mov byte [ebp - 0x26d], 0
movzx eax, byte [ebp - 0x26d]
test eax, eax
je 0x4021da
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
cmp dword [ebp - 0x1f4], 0
jne 0x4021ef
mov dword [ebp - 0x12e4], 1
jmp 0x4021f6
and dword [ebp - 0x12e4], 0
mov eax, dword [ebp - 0x34c]
cmp dword [ebp - 0x12e4], eax
jne 0x402210
mov dword [ebp - 0x8c0], 1
jmp 0x402217
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0x728], 0
je 0x402241
cmp dword [ebp - 0x1e4], 0
je 0x402241
mov dword [ebp - 0x12ec], 1
jmp 0x402248
and dword [ebp - 0x12ec], 0
cmp dword [ebp - 0x12ec], 0x643d
je 0x402260
mov dword [ebp - 0x8c8], 1
jmp 0x402267
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x8c8]
shl eax, 2
cmp eax, dword [ebp - 0x34c]
jg 0x40228d
cmp dword [ebp - 0x4ec], 0
je 0x40228d
mov dword [ebp - 0x12f4], 1
jmp 0x402294
and dword [ebp - 0x12f4], 0
push 2
lea ecx, [ebp - 0x1978]
call fcn.004134d9
mov ecx, dword [ebp - 0x12f4]
cmp ecx, dword [eax]
jne 0x4022b7
mov dword [ebp - 0x8d0], 1
jmp 0x4022be
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x4ec]
imul eax, dword [ebp - 0x8d0]
test eax, eax
je 0x4022e4
cmp dword [ebp - 0x4ec], 0
je 0x4022e4
mov dword [ebp - 0x12fc], 1
jmp 0x4022eb
and dword [ebp - 0x12fc], 0
mov eax, dword [ebp - 0x668]
cmp eax, dword [ebp - 0x12fc]
jl 0x402305
mov dword [ebp - 0x8d8], 1
jmp 0x40230c
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x668]
imul eax, dword [ebp - 0x8d8]
cmp dword [ebp - 0x4ec], eax
jg 0x402333
cmp dword [ebp - 0x728], 0
jne 0x402333
and dword [ebp - 0x1304], 0
jmp 0x40233d
mov dword [ebp - 0x1304], 1
cmp dword [ebp - 0x1304], 0xcda2
jg 0x402355
mov dword [ebp - 0x8e0], 1
jmp 0x40235c
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x8e0], eax
jge 0x402376
mov dword [ebp - 0x130c], 1
jmp 0x40237d
and dword [ebp - 0x130c], 0
push 2
lea ecx, [ebp - 0x1978]
call fcn.004134d9
mov ecx, dword [ebp - 0x130c]
cmp ecx, dword [eax]
jne 0x4023a0
mov dword [ebp - 0x8e8], 1
jmp 0x4023a7
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x1f4]
add eax, dword [ebp - 0x8e8]
mov dword [ebp - 0x1314], eax
mov eax, dword [ebp - 0x34c]
cmp dword [ebp - 0x1314], eax
jge 0x4023d3
mov dword [ebp - 0x8f0], 1
jmp 0x4023da
and dword [ebp - 0x8f0], 0
cmp dword [ebp - 0x8f0], 0xe3b9
je 0x4023f2
mov dword [ebp - 0x131c], 1
jmp 0x4023f9
and dword [ebp - 0x131c], 0
mov eax, dword [ebp - 0x131c]
mov dword [ebp - 0x34c], eax
jmp 0x402427
mov dword [ebp - 0x17a0], 0xc867
cmp dword [ebp - 0x17a0], 0
je 0x402427
lea ecx, [ebp - 0x1978]
call fcn.004134bd
jmp 0x402437
lea ecx, [ebp - 0x1978]
call fcn.004134bd
jmp 0x40202a
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebp - 0x2b8]
test eax, eax
je 0x402462
push 0x2471
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
jmp 0x401ff0
mov dword [ebp - 0xc8], 0xfffffffa
mov dword [ebp - 0x1a90], 0x22263126
mov dword [ebp - 0x1a8c], 0x22263126
mov dword [ebp - 0x1a88], 0x22263126
mov dword [ebp - 0x1a84], 0x22263126
mov dword [ebp - 0x3e4], 0
jmp 0x4024b2
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 3
jge 0x4024ce
mov eax, dword [ebp - 0x3e4]
mov dword [ebp + eax*4 - 0x24c4], 0
jmp 0x4024a5
mov dword [ebp - 0x670], 0xfffffffa
mov dword [ebp - 0x8f8], 0xe76d238e
mov dword [ebp - 0x908], 0x8ef068cd
mov dword [ebp - 0x48], 0xdedfc3e8
mov dword [ebp - 0x57c], 0
jmp 0x40250c
mov eax, dword [ebp - 0x57c]
inc eax
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 3
jge 0x402528
mov eax, dword [ebp - 0x57c]
mov dword [ebp + eax*4 - 0x830], 0
jmp 0x4024ff
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x830], 0
je 0x4025ff
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x830], 0
je 0x402556
mov dword [ebp - 0x1324], 1
jmp 0x40255d
and dword [ebp - 0x1324], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x830]
mov dword [ebp - 0x8f8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x830]
cmp dword [ebp - 0x8f8], eax
jle 0x40258f
mov dword [ebp - 0x900], 1
jmp 0x402596
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x1324]
cmp eax, dword [ebp - 0x900]
jle 0x4025b0
mov dword [ebp - 0x132c], 1
jmp 0x4025b7
and dword [ebp - 0x132c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x132c]
mov dword [ebp + eax - 0x830], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x830]
mov dword [ebp - 0x908], eax
mov eax, dword [ebp - 0x908]
mov ecx, dword [ebp - 0x48]
lea eax, [eax + ecx - 0x56a0b349]
cmp eax, 0xfc2e607d
jbe 0x4025ff
mov dword [ebp - 0x1334], 1
jmp 0x402606
and dword [ebp - 0x1334], 0
cmp dword [ebp - 0x1334], 0xfffb
je 0x40261e
mov dword [ebp - 0x910], 1
jmp 0x402625
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x910], eax
je 0x40263c
mov dword [ebp - 0x133c], 1
jmp 0x402643
and dword [ebp - 0x133c], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
cmp eax, dword [ebp - 0x133c]
jle 0x402669
mov dword [ebp - 0x918], 1
jmp 0x402670
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x918], eax
jle 0x402687
mov dword [ebp - 0x1344], 1
jmp 0x40268e
and dword [ebp - 0x1344], 0
mov eax, dword [ebp - 0x1344]
neg eax
cmp eax, dword [ebp - 0x48]
jg 0x4026b3
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x830], 0
jne 0x4026b3
and dword [ebp - 0x920], 0
jmp 0x4026bd
mov dword [ebp - 0x920], 1
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x920], eax
jle 0x4026d4
mov dword [ebp - 0x134c], 1
jmp 0x4026db
and dword [ebp - 0x134c], 0
mov eax, dword [ebp - 0x134c]
sub eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 2
jmp 0x4026f7
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x402713
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x830]
mov dword [ebp + ecx*4 - 0x830], eax
jmp 0x4026f0
mov dword [ebp - 0xc8], 9
jmp 0x40272c
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xffffffe2
jne 0x402cdf
push 3
lea ecx, [ebp - 0x1c0c]
call fcn.004133eb
push 3
lea ecx, [ebp - 0x80c]
call fcn.004133eb
mov dword [ebp - 0x32c], 1
mov dword [ebp - 0xc0], 0
jmp 0x402776
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x402798
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x1c0c]
call fcn.004134d9
mov dword [eax], 0xcff0
jmp 0x402769
mov dword [ebp - 0xc0], 0
jmp 0x4027b1
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x4027d3
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x80c]
call fcn.004134d9
mov dword [eax], 0xd1e1e87d
jmp 0x4027a4
push 0
lea ecx, [ebp - 0x80c]
call fcn.004134d9
and dword [eax], 0
jmp 0x402809
push 0
lea ecx, [ebp - 0x80c]
call fcn.004134d9
mov dword [ebp - 0x928], eax
mov eax, dword [ebp - 0x928]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x928]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x80c]
call fcn.004134d9
cmp dword [eax], 2
jg 0x4029e5
mov dword [ebp - 0x930], 7
mov dword [ebp - 0x1364], 0xc70ab227
mov dword [ebp - 0x136c], 0xfffffffd
push 2
lea ecx, [ebp - 0x1edc]
call fcn.004133eb
mov dword [ebp - 0x3ec], 0
jmp 0x402863
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 2
jge 0x402885
push dword [ebp - 0x3ec]
lea ecx, [ebp - 0x1edc]
call fcn.004134d9
mov dword [eax], 1
jmp 0x402856
push 0
lea ecx, [ebp - 0x80c]
call fcn.004134d9
push dword [eax]
lea ecx, [ebp - 0x1c0c]
call fcn.004134d9
cmp dword [ebp - 0x930], 0
jne 0x4028d0
push 0
lea ecx, [ebp - 0x80c]
call fcn.004134d9
push dword [eax]
lea ecx, [ebp - 0x1c0c]
call fcn.004134d9
cmp dword [eax], 0
jne 0x4028d0
and dword [ebp - 0x1354], 0
jmp 0x4028da
mov dword [ebp - 0x1354], 1
mov eax, dword [ebp - 0x1354]
dec eax
cmp eax, dword [ebp - 0x930]
jl 0x4028f5
mov dword [ebp - 0x135c], 1
jmp 0x4028fc
and dword [ebp - 0x135c], 0
cmp dword [ebp - 0x135c], 1
jbe 0x402911
mov dword [ebp - 0x938], 1
jmp 0x402918
and dword [ebp - 0x938], 0
push 0
lea ecx, [ebp - 0x80c]
call fcn.004134d9
mov ecx, dword [ebp - 0x938]
sub ecx, dword [eax]
mov dword [ebp - 0x32c], ecx
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x1364], eax
mov esi, dword [ebp - 0x1364]
push 0
lea ecx, [ebp - 0x80c]
call fcn.004134d9
cmp dword [eax], esi
jl 0x402962
mov dword [ebp - 0x940], 1
jmp 0x402969
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x940]
mov dword [ebp - 0x136c], eax
mov esi, dword [ebp - 0x136c]
push 0
lea ecx, [ebp - 0x80c]
call fcn.004134d9
cmp esi, dword [eax]
jg 0x402998
mov dword [ebp - 0x948], 1
jmp 0x40299f
and dword [ebp - 0x948], 0
push 0
lea ecx, [ebp - 0x1edc]
call fcn.004134d9
mov ecx, dword [ebp - 0x948]
mov dword [eax], ecx
mov byte [ebp - 0x1b6], 0
movzx eax, byte [ebp - 0x1b6]
test eax, eax
je 0x4029d5
push 0
push 0x1e40
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea ecx, [ebp - 0x1edc]
call fcn.004134bd
jmp 0x4027e5
mov dword [ebp - 0x32c], 0
jmp 0x4029fe
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 1
je 0x402a43
mov dword [ebp - 0x17a8], 0x1be360de
mov dword [ebp - 0x17b0], 0xffffffff
mov eax, dword [ebp - 0x17a8]
mov dword [ebp - 0x17b0], eax
mov byte [ebp - 0x1b8], 0
movzx eax, byte [ebp - 0x1b8]
test eax, eax
je 0x402a41
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x4029f1
lea ecx, [ebp - 0x80c]
call fcn.004134bd
lea ecx, [ebp - 0x1c0c]
call fcn.004134bd
mov byte [ebp - 0x1ba], 0
movzx eax, byte [ebp - 0x1ba]
test eax, eax
je 0x402cda
mov dword [ebp - 0x5c], 0xfc07e17f
push 2
lea ecx, [ebp - 0x1484]
call fcn.004133eb
mov dword [ebp - 0x7a4], 1
mov dword [ebp - 0x1384], 2
mov dword [ebp - 0x968], 0xfffffff6
mov dword [ebp - 0x17c0], 0x46c8c5ce
mov dword [ebp - 0x246c], 0xab136113
mov dword [ebp - 0x4f4], 0
jmp 0x402ace
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 2
jge 0x402af0
push dword [ebp - 0x4f4]
lea ecx, [ebp - 0x1484]
call fcn.004134d9
mov dword [eax], 0x23371247
jmp 0x402ac1
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x2148], eax
push 0
lea ecx, [ebp - 0x1484]
call fcn.004134d9
mov dword [eax], 0xfffffffe
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x402b4b
push 0
lea ecx, [ebp - 0x1484]
call fcn.004134d9
cmp dword [eax], 0
je 0x402b37
cmp dword [ebp - 0x5c], 0
je 0x402b37
mov dword [ebp - 0x1374], 1
jmp 0x402b3e
and dword [ebp - 0x1374], 0
push 0
lea ecx, [ebp - 0x1484]
call fcn.004134d9
cmp dword [ebp - 0x5c], 0xe008fb0b
jbe 0x402b60
mov dword [ebp - 0x950], 1
jmp 0x402b67
and dword [ebp - 0x950], 0
imul eax, dword [ebp - 0x950], 0xffffffff
cmp eax, dword [ebp - 0x5c]
je 0x402b7f
mov dword [ebp - 0x17b8], 1
jmp 0x402b86
and dword [ebp - 0x17b8], 0
push 0
lea ecx, [ebp - 0x1484]
call fcn.004134d9
cmp dword [eax], 0
je 0x402bad
mov eax, 0x6bde64f6
test eax, eax
je 0x402bad
mov dword [ebp - 0x137c], 1
jmp 0x402bb4
and dword [ebp - 0x137c], 0
mov eax, dword [ebp - 0x137c]
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x231c], eax
cmp dword [ebp - 0x5c], 1
jne 0x402bde
cmp dword [ebp - 0x5c], 0
jne 0x402bde
and dword [ebp - 0x958], 0
jmp 0x402be8
mov dword [ebp - 0x958], 1
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x1384], eax
mov eax, dword [ebp - 0x1384]
mov dword [ebp - 0x2150], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x23f0], eax
push 1
lea ecx, [ebp - 0x1484]
call fcn.004134d9
mov dword [ebp - 0x960], eax
push 0
lea ecx, [ebp - 0x1484]
call fcn.004134d9
mov ecx, dword [ebp - 0x960]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x960]
mov ecx, dword [ebp - 0x5c]
imul ecx, dword [eax]
mov dword [ebp - 0x7a4], ecx
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x7a4], eax
jne 0x402c5c
mov dword [ebp - 0x138c], 1
jmp 0x402c63
and dword [ebp - 0x138c], 0
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x138c]
imul eax, eax, 0x7a23
cmp eax, dword [ebp - 0x968]
jne 0x402c87
mov dword [ebp - 0x1394], 1
jmp 0x402c8e
and dword [ebp - 0x1394], 0
mov eax, dword [ebp - 0x968]
cmp dword [ebp - 0x1394], eax
je 0x402ca8
mov dword [ebp - 0x970], 1
jmp 0x402caf
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0x17c0], eax
lea ecx, [ebp - 0x1484]
call fcn.004134bd
push 0
push 0x1965
push 0
push 0x11d1
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
jmp 0x40271f
mov dword [ebp - 0xc8], 3
jmp 0x402cf8
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x403789
push 2
lea ecx, [ebp - 0x1988]
call fcn.004133eb
mov dword [ebp - 0x17d0], 0xd1d9d65f
mov dword [ebp - 0x17c8], 0x1c08901f
mov dword [ebp - 0x2dc], 0xffffffff
push 2
lea ecx, [ebp - 0x1e1c]
call fcn.004133eb
mov dword [ebp - 0x3f4], 0
jmp 0x402d56
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 2
jge 0x402d75
push dword [ebp - 0x3f4]
lea ecx, [ebp - 0x1e1c]
call fcn.004134d9
and dword [eax], 0
jmp 0x402d49
mov eax, dword [ebp - 0x17c8]
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x2dc], 0
jmp 0x402d9a
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 2
jge 0x402db9
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0x1e1c]
call fcn.004134d9
and dword [eax], 0
jmp 0x402d8d
lea ecx, [ebp - 0x1e1c]
call fcn.004134bd
mov dword [ebp - 0x2158], 0
mov dword [ebp - 0x232c], 0x6db50520
mov dword [ebp - 0x2160], 0x83c8fc55
mov dword [ebp - 0x2430], 0xfffffffd
mov dword [ebp - 0x2168], 0
mov dword [ebp - 0x233c], 0xbc370782
mov dword [ebp - 0x2170], 0xffffffff
mov dword [ebp - 0x2380], 0xfffffffd
mov dword [ebp - 0x2178], 0xfffffff7
mov dword [ebp - 0x139c], 0xfffffffa
mov byte [ebp - 0x1bc], 0
movzx eax, byte [ebp - 0x1bc]
test eax, eax
je 0x402e4b
push 0x1381
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
mov eax, dword [ebp - 0x139c]
dec eax
mov dword [ebp - 0x139c], eax
mov dword [ebp - 0x604], 0
jmp 0x402e71
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 2
jge 0x402e93
push dword [ebp - 0x604]
lea ecx, [ebp - 0x1988]
call fcn.004134d9
mov dword [eax], 0xa5f27a41
jmp 0x402e64
mov dword [ebp - 0x198], 1
mov dword [ebp - 0x13c], 0x609c3fbb
push 3
lea ecx, [ebp - 0x2254]
call fcn.004133eb
mov dword [ebp - 0x3fc], 0
jmp 0x402ecd
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 3
jge 0x402eef
push dword [ebp - 0x3fc]
lea ecx, [ebp - 0x2254]
call fcn.004134d9
mov dword [eax], 1
jmp 0x402ec0
cmp dword [ebp - 0x198], 0
je 0x402f0d
cmp dword [ebp - 0x198], 0
je 0x402f0d
mov dword [ebp - 0x978], 1
jmp 0x402f14
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x978], eax
jg 0x402f2e
mov dword [ebp - 0x13a4], 1
jmp 0x402f35
and dword [ebp - 0x13a4], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x13c], eax
imul eax, dword [ebp - 0x13c], 0xbb0c
imul eax, eax, 0xfffd
cmp eax, dword [ebp - 0x13a4]
jl 0x40301e
mov dword [ebp - 0x13ac], 0x13e13a6c
mov dword [ebp - 0x980], 0x628405ce
mov dword [ebp - 0x4fc], 0
jmp 0x402f8a
mov eax, dword [ebp - 0x4fc]
inc eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 4
jge 0x402fa6
mov eax, dword [ebp - 0x4fc]
mov dword [ebp + eax*4 - 0x2534], 0xfffffff6
jmp 0x402f7d
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x234c], eax
mov eax, dword [ebp - 0x13ac]
imul eax, dword [ebp - 0x13c]
mov dword [ebp - 0x980], eax
cmp dword [ebp - 0x980], 0
je 0x402fe3
mov eax, 0xffff
test eax, eax
je 0x402fe3
mov dword [ebp - 0x13b4], 1
jmp 0x402fea
and dword [ebp - 0x13b4], 0
mov eax, dword [ebp - 0x13ac]
mov dword [ebp - 0x988], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x988]
mov dword [ebp + eax - 0x2534], ecx
mov eax, dword [ebp - 0x988]
imul eax, dword [ebp - 0x13b4]
mov dword [ebp - 0x13c], eax
jmp 0x403084
mov dword [ebp - 0x13c], 0xfffffff2
jmp 0x403037
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffed
jne 0x403084
mov dword [ebp - 0x198], 0
jmp 0x403059
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0x14
jle 0x403082
mov byte [ebp - 0x1be], 0
movzx eax, byte [ebp - 0x1be]
test eax, eax
je 0x403080
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x40304c
jmp 0x40302a
lea ecx, [ebp - 0x2254]
call fcn.004134bd
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1a90], 0
je 0x403157
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x2180], eax
push 0xfffffffffffffff7
pop eax
cmp eax, 0x4d25
je 0x4030c2
mov dword [ebp - 0x990], 1
jmp 0x4030c9
and dword [ebp - 0x990], 0
imul eax, dword [ebp - 0x990], 0x6d06
cmp eax, dword [ebp - 0xc8]
jne 0x4030e7
mov dword [ebp - 0x13bc], 1
jmp 0x4030ee
and dword [ebp - 0x13bc], 0
imul eax, dword [ebp - 0x13bc], 0x5bf7
dec eax
je 0x403110
mov eax, 0x4353ea3a
test eax, eax
je 0x403110
mov dword [ebp - 0x998], 1
jmp 0x403117
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x998], eax
jge 0x40312e
mov dword [ebp - 0x13c4], 1
jmp 0x403135
and dword [ebp - 0x13c4], 0
push 1
lea ecx, [ebp - 0x1988]
call fcn.004134d9
mov eax, dword [eax]
sub eax, dword [ebp - 0x13c4]
push 4
pop ecx
imul ecx, ecx, 3
sub eax, dword [ebp + ecx - 0x1a90]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1a90]
mov dword [ebp - 0x2384], eax
push 1
lea ecx, [ebp - 0x1988]
call fcn.004134d9
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x2188], eax
mov eax, 0x1177
test eax, eax
jne 0x403197
cmp dword [ebp - 0x6c], 0
jne 0x403197
and dword [ebp - 0x9a0], 0
jmp 0x4031a1
mov dword [ebp - 0x9a0], 1
push 0
lea ecx, [ebp - 0x1988]
call fcn.004134d9
mov ecx, dword [ebp - 0x9a0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1f40], eax
mov eax, dword [ebp - 0x17d0]
cmp dword [ebp - 0x6c], eax
jle 0x4031d6
mov dword [ebp - 0x13cc], 1
jmp 0x4031dd
and dword [ebp - 0x13cc], 0
cmp dword [ebp - 0x13cc], 0x7d900d29
jge 0x4031f5
mov dword [ebp - 0x17d8], 1
jmp 0x4031fc
and dword [ebp - 0x17d8], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1f48], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x24c4], 1
mov dword [ebp - 0x33c], 0xb26bdde0
mov dword [ebp - 0x33c], 0xfffffffa
jmp 0x403239
mov eax, dword [ebp - 0x33c]
dec eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0xfffffff3
jne 0x403269
cmp dword [ebp - 0x33c], 0
je 0x40324d
jmp 0x403269
mov byte [ebp - 0x1c0], 0
movzx eax, byte [ebp - 0x1c0]
test eax, eax
je 0x403267
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x40322c
mov byte [ebp - 0x1c4], 0
mov dword [ebp - 0x74], 0xa61928c1
mov dword [ebp - 0x13d4], 8
mov dword [ebp - 0x1258], 0
mov byte [ebp - 0x1c2], 0
movzx eax, byte [ebp - 0x1c2]
test eax, eax
je 0x4032ac
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov dword [ebp - 0x74], 8
jmp 0x4032bc
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffe9
jne 0x4034d9
push 3
lea ecx, [ebp - 0x15d0]
call fcn.004133eb
mov dword [ebp - 0x13dc], 2
mov dword [ebp - 0x164], 0
jmp 0x4032f6
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x403318
push dword [ebp - 0x164]
lea ecx, [ebp - 0x15d0]
call fcn.004134d9
mov dword [eax], 3
jmp 0x4032e9
mov dword [ebp - 0x164], 0
jmp 0x403331
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x40334d
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x24dc], 0x9281c1d9
jmp 0x403324
cmp dword [ebp - 0x74], 0
je 0x403368
cmp dword [ebp - 0x13d4], 0
je 0x403368
mov dword [ebp - 0x17e0], 1
jmp 0x40336f
and dword [ebp - 0x17e0], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x1f50], eax
mov eax, 0xd5de1fc6
test eax, eax
jne 0x40339c
push 0
lea ecx, [ebp - 0x15d0]
call fcn.004134d9
cmp dword [eax], 0
jne 0x40339c
and dword [ebp - 0x9a8], 0
jmp 0x4033a6
mov dword [ebp - 0x9a8], 1
push 0
lea ecx, [ebp - 0x15d0]
call fcn.004134d9
mov ecx, dword [ebp - 0x9a8]
cmp ecx, dword [eax]
jg 0x4033c9
mov dword [ebp - 0x17e8], 1
jmp 0x4033d0
and dword [ebp - 0x17e8], 0
mov esi, dword [ebp - 0x13d4]
push 0
lea ecx, [ebp - 0x15d0]
call fcn.004134d9
sub esi, dword [eax]
mov dword [ebp - 0x13dc], esi
jne 0x4033fc
cmp dword [ebp - 0x74], 0
jne 0x4033fc
and dword [ebp - 0x155c], 0
jmp 0x403406
mov dword [ebp - 0x155c], 1
cmp dword [ebp - 0x155c], 0xfffffffb
jl 0x40341b
mov dword [ebp - 0x9b8], 1
jmp 0x403422
and dword [ebp - 0x9b8], 0
cmp dword [ebp - 0x9b8], 0xdb5cabfc
jae 0x40343a
mov dword [ebp - 0xf78], 1
jmp 0x403441
and dword [ebp - 0xf78], 0
push 0
lea ecx, [ebp - 0x15d0]
call fcn.004134d9
mov ecx, dword [ebp - 0xf78]
cmp ecx, dword [eax]
jne 0x403464
mov dword [ebp - 0x9c0], 1
jmp 0x40346b
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0x1258], eax
mov eax, dword [ebp - 0x1258]
add eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x74]
jg 0x403491
mov dword [ebp - 0x9c8], 1
jmp 0x403498
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x9c8], eax
je 0x4034af
mov dword [ebp - 0xf80], 1
jmp 0x4034b6
and dword [ebp - 0xf80], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xf80]
mov dword [ebp + eax - 0x24dc], ecx
lea ecx, [ebp - 0x15d0]
call fcn.004134bd
jmp 0x4032b5
movzx eax, byte [ebp - 0x1c4]
test eax, eax
je 0x403779
mov dword [ebp - 0x678], 9
push 2
lea ecx, [ebp - 0x1eac]
call fcn.004133eb
push 3
lea ecx, [ebp - 0x1b88]
call fcn.004133eb
mov dword [ebp - 0x9e8], 0
mov dword [ebp - 0xd0], 0
jmp 0x40352f
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x403551
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x1eac]
call fcn.004134d9
mov dword [eax], 0x14c405b4
jmp 0x403522
mov dword [ebp - 0xd0], 0
jmp 0x40356a
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jge 0x40358c
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x1b88]
call fcn.004134d9
mov dword [eax], 0xdcba
jmp 0x40355d
cmp dword [ebp - 0x678], 0
je 0x4035b4
mov byte [ebp - 0x1c6], 0
movzx eax, byte [ebp - 0x1c6]
test eax, eax
je 0x4035af
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x403745
mov dword [ebp - 0xf88], 0x61f66568
mov dword [ebp - 0x788], 1
mov dword [ebp - 0x9d8], 0xfffffffb
mov dword [ebp - 0x404], 0
jmp 0x4035eb
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 1
jge 0x403607
mov eax, dword [ebp - 0x404]
mov dword [ebp + eax*4 - 0x730], 1
jmp 0x4035de
push 0
lea ecx, [ebp - 0x1b88]
call fcn.004134d9
mov dword [ebp - 0x9d0], eax
mov eax, dword [ebp - 0x9d0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9d0]
mov dword [ecx], eax
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x1f58], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x730], 0
je 0x403688
cmp dword [ebp - 0xf88], 0
je 0x40366b
push 1
lea ecx, [ebp - 0x1eac]
call fcn.004134d9
cmp dword [eax], 0
jne 0x40366b
and dword [ebp - 0x13c8], 0
jmp 0x403675
mov dword [ebp - 0x13c8], 1
mov eax, dword [ebp - 0x13c8]
mov dword [ebp - 0x9d8], eax
cmp dword [ebp - 0x9d8], 0
mov esi, dword [ebp - 0xf88]
push 0
lea ecx, [ebp - 0x1b88]
call fcn.004134d9
cmp esi, dword [eax]
jge 0x4036ab
mov dword [ebp - 0x9e0], 1
jmp 0x4036b2
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x788]
cmp eax, dword [ebp - 0x9e0]
jge 0x4036cc
mov dword [ebp - 0x17f0], 1
jmp 0x4036d3
and dword [ebp - 0x17f0], 0
cmp dword [ebp - 0x678], 0
je 0x4036f1
mov eax, 0xa5b04204
test eax, eax
je 0x4036f1
mov dword [ebp - 0x1260], 1
jmp 0x4036f8
and dword [ebp - 0x1260], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x730]
cmp dword [ebp - 0x1260], eax
jge 0x403719
mov dword [ebp - 0x680], 1
jmp 0x403720
and dword [ebp - 0x680], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x680]
mov dword [ebp + eax - 0x730], ecx
mov eax, dword [ebp - 0x680]
sub eax, dword [ebp - 0x788]
mov dword [ebp - 0x788], eax
mov eax, dword [ebp - 0x9e8]
inc eax
mov dword [ebp - 0x9e8], eax
lea ecx, [ebp - 0x1b88]
call fcn.004134bd
lea ecx, [ebp - 0x1eac]
call fcn.004134bd
push 0
push 0
push 0x1250
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea ecx, [ebp - 0x1988]
call fcn.004134bd
jmp 0x402ceb
jmp 0x401fbf
mov dword [ebp - 0x58], 0xc03342eb
mov dword [ebp - 0x1a8], 0xffffffff
mov dword [ebp - 0x1db0], 0xc700
mov dword [ebp - 0x1dac], 0xc700
mov dword [ebp - 0x1da8], 0xc700
mov dword [ebp - 0x1da4], 0xc700
lea ecx, [ebp - 0x70d]
call fcn.004134e8
push eax
lea eax, [ebp - 0x1da0]
push eax
lea eax, [ebp - 0x1db0]
push eax
lea ecx, [ebp - 0x256c]
call fcn.004134eb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1c24]
call fcn.00413497
mov dword [ebp - 0x17f8], 0xffffffff
mov dword [ebp - 0x30c], 1
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x1a8], eax
jne 0x40382a
mov dword [ebp - 0xa08], 1
jmp 0x403831
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1f60], eax
cmp dword [ebp - 0x1a8], 0xe19e95d1
jbe 0x40385e
cmp dword [ebp - 0x1a8], 0
je 0x40385e
mov dword [ebp - 0xf90], 1
jmp 0x403865
and dword [ebp - 0xf90], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0xf90], eax
jg 0x40387f
mov dword [ebp - 0x9f0], 1
jmp 0x403886
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x9f0], eax
jl 0x4038a0
mov dword [ebp - 0x14a8], 1
jmp 0x4038a7
and dword [ebp - 0x14a8], 0
push 1
lea ecx, [ebp - 0x1c24]
call fcn.004134d9
mov ecx, dword [ebp - 0x14a8]
cmp ecx, dword [eax]
jle 0x4038ca
mov dword [ebp - 0x9f8], 1
jmp 0x4038d1
and dword [ebp - 0x9f8], 0
cmp dword [ebp - 0x9f8], 0x6d21
jge 0x4038fb
push 1
lea ecx, [ebp - 0x1c24]
call fcn.004134d9
cmp dword [eax], 0
je 0x4038fb
mov dword [ebp - 0xf98], 1
jmp 0x403902
and dword [ebp - 0xf98], 0
cmp dword [ebp - 0xf98], 8
je 0x403917
mov dword [ebp - 0xa00], 1
jmp 0x40391e
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0x17f8]
cmp dword [ebp - 0xa00], eax
jg 0x403938
mov dword [ebp - 0x1268], 1
jmp 0x40393f
and dword [ebp - 0x1268], 0
mov eax, dword [ebp - 0x1268]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x1a8]
imul eax, dword [ebp - 0xa08]
cmp eax, dword [ebp - 0x30c]
je 0x40396c
mov dword [ebp - 0xfa0], 1
jmp 0x403973
and dword [ebp - 0xfa0], 0
push 1
lea ecx, [ebp - 0x1c24]
call fcn.004134d9
mov ecx, dword [ebp - 0xfa0]
sub ecx, dword [eax]
je 0x4039d1
mov dword [ebp - 0x30c], 0
jmp 0x4039a3
mov eax, dword [ebp - 0x30c]
dec eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0xfffffff6
jne 0x4039cf
mov byte [ebp - 0x1c8], 0
movzx eax, byte [ebp - 0x1c8]
test eax, eax
je 0x4039cd
push 0x23ad
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
jmp 0x403996
jmp 0x403a0b
mov byte [ebp - 0x1ca], 0
movzx eax, byte [ebp - 0x1ca]
test eax, eax
je 0x403a0b
push 0
push 0x8cf
push 0x2496
push 0x742
push 0x150e
push 0x6ed
push 0x53c
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 0x1c24]
call fcn.004134bd
mov dword [ebp - 0x2e4], 0x862f
mov dword [ebp - 0x738], 0x5300ce3
mov dword [ebp - 0x1810], 0xe26b5cfd
mov dword [ebp - 0x1830], 0x5c7e4ddb
mov dword [ebp - 0x1828], 0x255bb5fb
mov dword [ebp - 0x1f68], 0x1b09c821
mov dword [ebp - 0x1f70], 0x2da3bb1d
mov dword [ebp - 0x1f78], 1
mov dword [ebp - 0x1820], 0xfffffffb
push 3
lea ecx, [ebp - 0x1e34]
call fcn.004133eb
mov dword [ebp - 0x1818], 0xfffffffa
mov dword [ebp - 0x584], 0
jmp 0x403aa0
mov eax, dword [ebp - 0x584]
inc eax
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 3
jge 0x403ac2
push dword [ebp - 0x584]
lea ecx, [ebp - 0x1e34]
call fcn.004134d9
mov dword [eax], 0xfffffff9
jmp 0x403a93
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2e4], 0
jmp 0x403ae8
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0x3a
jg 0x403eab
mov dword [ebp - 0x3a4], 0x70ade21
push 3
lea ecx, [ebp - 0x1494]
call fcn.004133eb
push 1
lea ecx, [ebp - 0x1c3c]
call fcn.004133eb
mov dword [ebp - 0x688], 0xe219
mov dword [ebp - 0xfb0], 0xc710
mov dword [ebp - 0x144], 0
jmp 0x403b46
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jge 0x403b68
push dword [ebp - 0x144]
lea ecx, [ebp - 0x1494]
call fcn.004134d9
mov dword [eax], 0x367f
jmp 0x403b39
mov dword [ebp - 0x144], 0
jmp 0x403b81
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x403ba3
push dword [ebp - 0x144]
lea ecx, [ebp - 0x1c3c]
call fcn.004134d9
mov dword [eax], 0x21b78cd9
jmp 0x403b74
mov dword [ebp - 0x3a4], 0xfffffff9
jmp 0x403bbc
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 5
jne 0x403d41
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd8], 2
jmp 0x403bec
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x403d3c
mov byte [ebp - 0x1cc], 0
movzx eax, byte [ebp - 0x1cc]
test eax, eax
je 0x403c26
push 0x167e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x1f80], eax
mov eax, 0x50bb
test eax, eax
jl 0x403c47
mov dword [ebp - 0x1800], 1
jmp 0x403c4e
and dword [ebp - 0x1800], 0
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x1494]
call fcn.004134d9
push 2
lea ecx, [ebp - 0x1494]
call fcn.004134d9
mov esi, dword [eax]
neg esi
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x1494]
call fcn.004134d9
sub esi, dword [eax]
jne 0x403ca0
push 1
lea ecx, [ebp - 0x1494]
call fcn.004134d9
cmp dword [eax], 0
jne 0x403ca0
and dword [ebp - 0xa10], 0
jmp 0x403caa
mov dword [ebp - 0xa10], 1
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x1494]
call fcn.004134d9
mov eax, dword [eax]
add eax, dword [ebp - 0xa10]
cmp eax, 0xc75d
jge 0x403cd6
mov dword [ebp - 0x1808], 1
jmp 0x403cdd
and dword [ebp - 0x1808], 0
cmp dword [ebp - 0x738], 0
je 0x403d05
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x1494]
call fcn.004134d9
cmp dword [eax], 0
jne 0x403d05
and dword [ebp - 0x13d0], 0
jmp 0x403d0f
mov dword [ebp - 0x13d0], 1
cmp dword [ebp - 0x13d0], 0xfffffffd
jge 0x403d24
mov dword [ebp - 0xa18], 1
jmp 0x403d2b
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0xa18]
mov dword [ebp - 0x1810], eax
jmp 0x403bdf
jmp 0x403baf
mov eax, dword [ebp - 0x688]
dec eax
mov dword [ebp - 0x688], eax
je 0x403d86
cmp dword [ebp - 0x1818], 3
jg 0x403d65
mov dword [ebp - 0xfa8], 1
jmp 0x403d6c
and dword [ebp - 0xfa8], 0
mov eax, dword [ebp - 0x1820]
cmp dword [ebp - 0xfa8], eax
jl 0x403d86
mov dword [ebp - 0xa20], 1
jmp 0x403d8d
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0x1828]
add eax, dword [ebp - 0xa20]
cmp eax, dword [ebp - 0x3a4]
jg 0x403dad
mov dword [ebp - 0x1270], 1
jmp 0x403db4
and dword [ebp - 0x1270], 0
mov eax, dword [ebp - 0x738]
cmp eax, dword [ebp - 0x1270]
jl 0x403dce
mov dword [ebp - 0xa28], 1
jmp 0x403dd5
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0xa28]
mov dword [ebp - 0xfb0], eax
cmp dword [ebp - 0xfb0], 1
jne 0x403df6
mov dword [ebp - 0xa30], 1
jmp 0x403dfd
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x738]
cmp eax, dword [ebp - 0xa30]
jne 0x403e17
mov dword [ebp - 0x154c], 1
jmp 0x403e1e
and dword [ebp - 0x154c], 0
mov eax, dword [ebp - 0x1830]
cmp dword [ebp - 0x154c], eax
jl 0x403e38
mov dword [ebp - 0xa38], 1
jmp 0x403e3f
and dword [ebp - 0xa38], 0
push 0
lea ecx, [ebp - 0x1c3c]
call fcn.004134d9
mov ecx, dword [ebp - 0xa38]
sub ecx, dword [eax]
cmp ecx, 1
jge 0x403e65
mov dword [ebp - 0xfb8], 1
jmp 0x403e6c
and dword [ebp - 0xfb8], 0
push 0
lea ecx, [ebp - 0x1c3c]
call fcn.004134d9
mov esi, dword [ebp - 0xfb8]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x1e34]
call fcn.004134d9
mov dword [eax], esi
lea ecx, [ebp - 0x1c3c]
call fcn.004134bd
lea ecx, [ebp - 0x1494]
call fcn.004134bd
jmp 0x403adb
lea ecx, [ebp - 0x1e34]
call fcn.004134bd
mov dword [ebp - 0x35c], 0xec2db221
mov dword [ebp - 0x40], 0x90ac204e
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x1910], 0x584e
mov dword [ebp - 0x1918], 0x3f04e266
mov dword [ebp - 0x40], 0x13
jmp 0x403ef5
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffe9
jg 0x4040e6
mov dword [ebp - 0x354], 0xf390197f
mov dword [ebp - 0x40c], 0
jmp 0x403f22
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 1
jge 0x403f3e
mov eax, dword [ebp - 0x40c]
mov dword [ebp + eax*4 - 0x690], 0xffffffff
jmp 0x403f15
mov dword [ebp - 0x354], 0
jmp 0x403f57
mov eax, dword [ebp - 0x354]
dec eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0
jl 0x4040e1
mov dword [ebp - 0x184], 0xffffffff
mov dword [ebp - 0x1840], 1
mov dword [ebp - 0x184], 0
jmp 0x403f91
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0
jg 0x4040dc
mov dword [ebp - 0x1838], 0x2b90f998
mov byte [ebp - 0x1ce], 0
movzx eax, byte [ebp - 0x1ce]
test eax, eax
je 0x403fd6
push 0x1be
push 0x1d1f
push 0x521
push 0xa39
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x184], eax
jne 0x403ff0
mov dword [ebp - 0xa40], 1
jmp 0x403ff7
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp + eax*4 - 0x690], 0x1e01
jle 0x404016
mov dword [ebp - 0x1278], 1
jmp 0x40401d
and dword [ebp - 0x1278], 0
mov eax, dword [ebp - 0xa40]
cmp eax, dword [ebp - 0x1278]
jl 0x404037
mov dword [ebp - 0xa48], 1
jmp 0x40403e
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0x1838], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x1f88], eax
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x690], ecx
jg 0x404074
mov dword [ebp - 0xfc0], 1
jmp 0x40407b
and dword [ebp - 0xfc0], 0
mov eax, dword [ebp - 0xfc0]
add eax, 0x8f01
cmp eax, 0xfffffff7
jl 0x404097
mov dword [ebp - 0xa50], 1
jmp 0x40409e
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp + eax*4 - 0x690]
add eax, dword [ebp - 0xa50]
cmp eax, 0xdd2cc910
jne 0x4040c4
mov dword [ebp - 0x13d8], 1
jmp 0x4040cb
and dword [ebp - 0x13d8], 0
mov eax, dword [ebp - 0x13d8]
mov dword [ebp - 0x1840], eax
jmp 0x403f84
jmp 0x403f4a
jmp 0x403eee
cmp dword [ebp - 0x40], 0
jne 0x404108
cmp dword [ebp - 0x40], 0
jne 0x404108
mov eax, 0x1ac8
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
jne 0x404108
and dword [ebp - 0x1848], 0
jmp 0x404112
mov dword [ebp - 0x1848], 1
cmp dword [ebp - 0x40], 0
jne 0x404124
mov dword [ebp - 0xa58], 1
jmp 0x40412b
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xa58], eax
jne 0x404145
mov dword [ebp - 0x1850], 1
jmp 0x40414c
and dword [ebp - 0x1850], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1f90], eax
mov eax, 0xc37f20ba
test eax, eax
jne 0x404173
cmp dword [ebp - 0x8c], 0
jne 0x404173
and dword [ebp - 0xfc8], 0
jmp 0x40417d
mov dword [ebp - 0xfc8], 1
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xfc8], eax
jle 0x40419e
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x40419e
mov dword [ebp - 0xa60], 1
jmp 0x4041a5
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xa60], eax
jg 0x4041bf
mov dword [ebp - 0x1858], 1
jmp 0x4041c6
and dword [ebp - 0x1858], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1f98], eax
xor eax, eax
inc eax
je 0x4041e9
cmp dword [ebp - 0x40], 0
je 0x4041e9
mov dword [ebp - 0x1280], 1
jmp 0x4041f0
and dword [ebp - 0x1280], 0
cmp dword [ebp - 0x1280], 0xb218
jl 0x404208
mov dword [ebp - 0xa68], 1
jmp 0x40420f
and dword [ebp - 0xa68], 0
cmp dword [ebp - 0xa68], 0xfffffffa
jle 0x404224
mov dword [ebp - 0xfd0], 1
jmp 0x40422b
and dword [ebp - 0xfd0], 0
cmp dword [ebp - 0xfd0], 0xfffffffe
jge 0x404240
mov dword [ebp - 0xa70], 1
jmp 0x404247
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xa70], eax
jl 0x404261
mov dword [ebp - 0x1908], 1
jmp 0x404268
and dword [ebp - 0x1908], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x40], eax
je 0x40427f
mov dword [ebp - 0x14b8], 1
jmp 0x404286
and dword [ebp - 0x14b8], 0
mov eax, dword [ebp - 0x1910]
cmp dword [ebp - 0x14b8], eax
jg 0x4042a0
mov dword [ebp - 0xa78], 1
jmp 0x4042a7
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1918], eax
mov dword [ebp - 0xaa0], 0x27603859
mov dword [ebp - 0xaa8], 0x70a3267e
mov dword [ebp - 0x1298], 0x19f23e52
mov dword [ebp - 0x1d10], 9
mov dword [ebp - 0x1d0c], 9
mov dword [ebp - 0x1d08], 9
mov dword [ebp - 0x1d04], 9
lea ecx, [ebp - 0x63d]
call fcn.004134e8
push eax
lea eax, [ebp - 0x1d00]
push eax
lea eax, [ebp - 0x1d10]
push eax
lea ecx, [ebp - 0x24e4]
call fcn.004134eb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2264]
call fcn.00413497
mov dword [ebp - 0x384], 0xffffffff
mov dword [ebp - 0x1920], 1
push 3
lea ecx, [ebp - 0x1df8]
call fcn.004133eb
mov dword [ebp - 0x504], 0
jmp 0x404374
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 3
jge 0x404396
push dword [ebp - 0x504]
lea ecx, [ebp - 0x1df8]
call fcn.004134d9
mov dword [eax], 0xfffffff6
jmp 0x404367
mov dword [ebp - 0x384], 3
jmp 0x4043af
mov eax, dword [ebp - 0x384]
dec eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0
jl 0x4043e0
push dword [ebp - 0x384]
lea ecx, [ebp - 0x2264]
call fcn.004134d9
mov esi, dword [ebp - 0x1920]
push 0
lea ecx, [ebp - 0x1df8]
call fcn.004134d9
mov dword [eax], esi
jmp 0x4043a2
lea ecx, [ebp - 0x1df8]
call fcn.004134bd
lea ecx, [ebp - 0x2264]
call fcn.004134bd
mov dword [ebp - 0x84], 0x5bf2d3f5
mov dword [ebp - 0x414], 0
jmp 0x404419
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 2
jge 0x404435
mov eax, dword [ebp - 0x414]
mov dword [ebp + eax*4 - 0x1c8c], 0x76eea530
jmp 0x40440c
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x84], eax
jne 0x40444f
mov dword [ebp - 0xfd8], 1
jmp 0x404456
and dword [ebp - 0xfd8], 0
mov eax, dword [ebp - 0xfd8]
inc eax
mov dword [ebp - 0xa80], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa80]
mov dword [ebp + eax - 0x1c8c], ecx
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0xa80], eax
jg 0x404490
mov dword [ebp - 0x1288], 1
jmp 0x404497
and dword [ebp - 0x1288], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x1288], eax
jge 0x4044b1
mov dword [ebp - 0xa88], 1
jmp 0x4044b8
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0xa88]
sub eax, 0x1fad
cmp eax, dword [ebp - 0x84]
jne 0x4044d7
mov dword [ebp - 0xfe0], 1
jmp 0x4044de
and dword [ebp - 0xfe0], 0
mov eax, dword [ebp - 0xfe0]
sub eax, 0xcb55
je 0x404507
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c8c], 0
je 0x404507
mov dword [ebp - 0xa90], 1
jmp 0x40450e
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0xa90], eax
jge 0x40467d
mov dword [ebp - 0x1d88], 0xfffffff8
mov dword [ebp - 0x1d84], 0xfffffff8
mov dword [ebp - 0x1d80], 0xfffffff8
mov dword [ebp - 0x1d7c], 0xfffffff8
lea ecx, [ebp - 0x796]
call fcn.004134e8
push eax
lea eax, [ebp - 0x1d78]
push eax
lea eax, [ebp - 0x1d88]
push eax
lea ecx, [ebp - 0x257c]
call fcn.004134eb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2274]
call fcn.00413497
mov dword [ebp - 0x84], 0
jmp 0x404596
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jne 0x404670
mov dword [ebp - 0x5c4], 0x6eab3cf8
mov dword [ebp - 0x5c4], 1
jmp 0x4045c6
mov eax, dword [ebp - 0x5c4]
dec eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 0
jl 0x40466b
mov dword [ebp - 0xfe8], 0x243e5ec3
mov dword [ebp - 0x41c], 0
jmp 0x4045f6
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 1
jge 0x404612
mov eax, dword [ebp - 0x41c]
mov dword [ebp + eax*4 - 0xa98], 0xfffffff8
jmp 0x4045e9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa98], 0x7128
jle 0x404631
mov dword [ebp - 0x13e0], 1
jmp 0x404638
and dword [ebp - 0x13e0], 0
push 1
lea ecx, [ebp - 0x2274]
call fcn.004134d9
mov eax, dword [eax]
add eax, dword [ebp - 0x13e0]
mov dword [ebp - 0xfe8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa98]
mov dword [ebp - 0xfe8], eax
jmp 0x4045b9
jmp 0x404589
lea ecx, [ebp - 0x2274]
call fcn.004134bd
jmp 0x404699
mov byte [ebp - 0x1d0], 0
movzx eax, byte [ebp - 0x1d0]
test eax, eax
je 0x404699
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov byte [ebp - 0x1d2], 0
movzx eax, byte [ebp - 0x1d2]
test eax, eax
je 0x4046b9
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 0x50c], 0
jmp 0x4046d2
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 1
jge 0x4046ee
mov eax, dword [ebp - 0x50c]
mov dword [ebp + eax*4 - 0xab8], 0xf1a969ac
jmp 0x4046c5
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x1fa0], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0xaa0], eax
imul eax, dword [ebp - 0x35c], 0x4fda
cmp dword [ebp - 0xaa0], eax
jge 0x404724
mov dword [ebp - 0x1290], 1
jmp 0x40472b
and dword [ebp - 0x1290], 0
mov eax, dword [ebp - 0x1290]
mov dword [ebp - 0xaa8], eax
cmp dword [ebp - 0xaa8], 0
jne 0x40474c
mov dword [ebp - 0xff0], 1
jmp 0x404753
and dword [ebp - 0xff0], 0
mov eax, dword [ebp - 0x35c]
cmp eax, dword [ebp - 0xff0]
jle 0x40476d
mov dword [ebp - 0xab0], 1
jmp 0x404774
and dword [ebp - 0xab0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xab8]
cmp dword [ebp - 0xab0], eax
jge 0x404795
mov dword [ebp - 0x156c], 1
jmp 0x40479c
and dword [ebp - 0x156c], 0
mov eax, dword [ebp - 0x35c]
cmp eax, dword [ebp - 0x156c]
jg 0x4047b6
mov dword [ebp - 0xff8], 1
jmp 0x4047bd
and dword [ebp - 0xff8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xab8]
cmp dword [ebp - 0xff8], eax
jge 0x4047de
mov dword [ebp - 0xac0], 1
jmp 0x4047e5
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0xac0]
sub eax, dword [ebp - 0x1298]
mov dword [ebp - 0x1298], eax
mov dword [ebp - 0x58c], 0xfffffff9
mov dword [ebp - 0xac8], 0x1b5f7a0d
mov dword [ebp - 0x424], 0
jmp 0x404824
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 3
jge 0x404840
mov eax, dword [ebp - 0x424]
mov dword [ebp + eax*4 - 0x2598], 0x5c96dd1e
jmp 0x404817
mov dword [ebp - 0x58c], 0
jmp 0x404859
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 2
jg 0x4048b0
mov dword [ebp - 0x1fa8], 1
mov dword [ebp - 0x42c], 0
jmp 0x404885
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 2
jge 0x4048a1
mov eax, dword [ebp - 0x42c]
mov dword [ebp + eax*4 - 0x251c], 7
jmp 0x404878
mov eax, dword [ebp - 0xac8]
inc eax
mov dword [ebp - 0xac8], eax
jmp 0x40484c
mov byte [ebp - 0x1d4], 0
mov dword [ebp - 0x5e4], 0xa860
mov dword [ebp - 0x43c], 5
push 4
lea ecx, [ebp - 0x157c]
call fcn.004133eb
mov dword [ebp - 0x1928], 0xfaab39e
mov dword [ebp - 0x13ec], 1
mov dword [ebp - 0x434], 0x34a938f7
mov dword [ebp - 0x1940], 0x8bee6da
mov dword [ebp - 0x514], 0
jmp 0x404919
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 4
jge 0x40493b
push dword [ebp - 0x514]
lea ecx, [ebp - 0x157c]
call fcn.004134d9
mov dword [eax], 0xaab72b21
jmp 0x40490c
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x43c], 0x85c9e53
push 2
lea ecx, [ebp - 0x157c]
call fcn.004134d9
mov ecx, dword [ebp - 0x43c]
cmp dword [eax], ecx
jl 0x404974
mov dword [ebp - 0xad8], 1
jmp 0x40497b
and dword [ebp - 0xad8], 0
push 2
lea ecx, [ebp - 0x157c]
call fcn.004134d9
cmp dword [eax], 0xd8bc
jg 0x4049b7
cmp dword [ebp - 0x1928], 0
je 0x4049b7
push 2
lea ecx, [ebp - 0x157c]
call fcn.004134d9
cmp dword [eax], 0
je 0x4049b7
mov dword [ebp - 0x1000], 1
jmp 0x4049be
and dword [ebp - 0x1000], 0
push 3
lea ecx, [ebp - 0x157c]
call fcn.004134d9
mov ecx, dword [ebp - 0x1000]
cmp ecx, dword [eax]
jle 0x4049e1
mov dword [ebp - 0xad0], 1
jmp 0x4049e8
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0x13ec], eax
mov eax, dword [ebp - 0x13ec]
mov dword [ebp - 0x1fb0], eax
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x1fb8], eax
mov dword [ebp - 0x434], 0xdf860956
cmp dword [ebp - 0x434], 0
je 0x404a34
cmp dword [ebp - 0x434], 0
je 0x404a34
mov dword [ebp - 0x1930], 1
jmp 0x404a3b
and dword [ebp - 0x1930], 0
push 2
lea ecx, [ebp - 0x157c]
call fcn.004134d9
cmp dword [ebp - 0x434], 0xfffffffa
je 0x404a61
push 7
pop eax
test eax, eax
jne 0x404a61
and dword [ebp - 0x1008], 0
jmp 0x404a6b
mov dword [ebp - 0x1008], 1
mov eax, dword [ebp - 0xad8]
imul eax, dword [ebp - 0x1008]
cmp eax, dword [ebp - 0x5e4]
je 0x404a8c
mov dword [ebp - 0x1938], 1
jmp 0x404a93
and dword [ebp - 0x1938], 0
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x1fc0], eax
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x1940], eax
lea ecx, [ebp - 0x157c]
call fcn.004134bd
movzx eax, byte [ebp - 0x1d4]
test eax, eax
je 0x404ead
mov dword [ebp - 0x10], 0x9ae77ab3
mov dword [ebp - 0x64], 0x11f3813b
mov dword [ebp - 0xe0], 0xea4c5706
mov dword [ebp - 0x51c], 0
jmp 0x404af6
mov eax, dword [ebp - 0x51c]
inc eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 1
jge 0x404b12
mov eax, dword [ebp - 0x51c]
mov dword [ebp + eax*4 - 0x14c], 0x80c3414b
jmp 0x404ae9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
mov dword [ebp - 0xae0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xae0]
mov dword [ebp + eax - 0x14c], ecx
cmp dword [ebp - 0xae0], 0
je 0x404b5c
mov eax, 0xa124
test eax, eax
je 0x404b5c
mov dword [ebp - 0x12a0], 1
jmp 0x404b63
and dword [ebp - 0x12a0], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x12a0]
jl 0x404bec
cmp dword [ebp - 0x10], 0
je 0x404b89
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
sub eax, 0x39e0
cmp eax, 1
jne 0x404bac
mov dword [ebp - 0xae8], 1
jmp 0x404bb3
and dword [ebp - 0xae8], 0
cmp dword [ebp - 0xae8], 4
jle 0x404bc8
mov dword [ebp - 0x1010], 1
jmp 0x404bcf
and dword [ebp - 0x1010], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x1010]
cmp eax, 0xae974ca7
jb 0x404bec
mov dword [ebp - 0xaf0], 1
jmp 0x404bf3
and dword [ebp - 0xaf0], 0
cmp dword [ebp - 0xaf0], 6
jb 0x404c0b
cmp dword [ebp - 0x10], 0
jne 0x404c0b
and dword [ebp - 0x14c8], 0
jmp 0x404c15
mov dword [ebp - 0x14c8], 1
mov eax, dword [ebp - 0x14c8]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0xe0]
jg 0x404c3b
mov dword [ebp - 0xaf8], 1
jmp 0x404c42
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0xaf8], eax
jg 0x404c5c
mov dword [ebp - 0x1018], 1
jmp 0x404c63
and dword [ebp - 0x1018], 0
cmp dword [ebp - 0x1018], 7
jae 0x404c78
mov dword [ebp - 0xb00], 1
jmp 0x404c7f
and dword [ebp - 0xb00], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0xb00], eax
je 0x404c99
mov dword [ebp - 0x12a8], 1
jmp 0x404ca0
and dword [ebp - 0x12a8], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x12a8], eax
jge 0x404ddb
mov dword [ebp - 0xb08], 0xbf5b
mov dword [ebp - 0x698], 1
mov dword [ebp - 0x10], 3
jmp 0x404cd6
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 7
je 0x404dd6
mov dword [ebp - 0x79c], 0xffffffff
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x1fc8], eax
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0x1fd0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
cmp dword [ebp - 0x698], eax
jg 0x404d29
cmp dword [ebp - 0x79c], 0
je 0x404d29
mov dword [ebp - 0x1020], 1
jmp 0x404d30
and dword [ebp - 0x1020], 0
mov eax, dword [ebp - 0xb08]
add eax, dword [ebp - 0x1020]
cmp eax, dword [ebp - 0x698]
jl 0x404d50
mov dword [ebp - 0x1948], 1
jmp 0x404d57
and dword [ebp - 0x1948], 0
mov eax, dword [ebp - 0x79c]
mov dword [ebp - 0x1fd8], eax
mov eax, dword [ebp - 0x79c]
cmp dword [ebp - 0x698], eax
jne 0x404d7d
mov dword [ebp - 0xb10], 1
jmp 0x404d84
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0xb10]
jge 0x404d9b
mov dword [ebp - 0x13f8], 1
jmp 0x404da2
and dword [ebp - 0x13f8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x13f8]
mov dword [ebp + eax - 0x14c], ecx
mov byte [ebp - 0x1b7], 0
movzx eax, byte [ebp - 0x1b7]
test eax, eax
je 0x404dd1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
jmp 0x404ccf
jmp 0x404e9f
mov dword [ebp - 0xe0], 0
jmp 0x404df4
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jg 0x404e9f
mov byte [ebp - 0x275], 0
movzx eax, byte [ebp - 0x275]
test eax, eax
je 0x404e19
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x64], 0
jmp 0x404e29
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jg 0x404e9a
mov dword [ebp - 0x10], 0
jmp 0x404e3f
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x404e98
mov dword [ebp - 0x444], 0xffffffff
mov dword [ebp - 0x444], 0
jmp 0x404e68
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0
jg 0x404e87
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x14c]
mov dword [ebp + ecx*4 - 0x14c], eax
jmp 0x404e5b
mov eax, dword [ebp - 0x64]
cmp dword [ebp + eax*4 - 0x14c], 0
je 0x404e96
jmp 0x404e38
jmp 0x404e38
jmp 0x404e22
jmp 0x404de7
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 4], 0xf82d83d7
mov dword [ebp - 0x1fc], 0xd5467356
mov dword [ebp - 0x204], 0xffffffff
mov dword [ebp - 0x14], 0
jmp 0x404ed8
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x404eee
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7d0], 0xffffffff
jmp 0x404ed1
mov dword [ebp - 0x14], 0
jmp 0x404efe
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x404f14
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1cac], 0xffffffff
jmp 0x404ef7
mov dword [ebp - 0x14], 0
jmp 0x404f24
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x404f3a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1f28], 0x76fbfcc0
jmp 0x404f1d
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x7d0], 0
je 0x405132
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7d0], 0
jne 0x404fcd
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x7d0], 0
jne 0x404f7d
cmp dword [ebp - 4], 0
jne 0x404f7d
and dword [ebp - 0xb18], 0
jmp 0x404f87
mov dword [ebp - 0xb18], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7d0]
cmp dword [ebp - 0xb18], eax
jle 0x404fa8
mov dword [ebp - 0x1028], 1
jmp 0x404faf
and dword [ebp - 0x1028], 0
mov eax, dword [ebp - 0x1028]
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jne 0x404fcd
and dword [ebp - 0x740], 0
jmp 0x404fd7
mov dword [ebp - 0x740], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x740]
mov dword [ebp + eax - 0x1cac], ecx
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x7d0]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x7d0]
je 0x405024
mov dword [ebp - 0xb20], 1
jmp 0x40502b
and dword [ebp - 0xb20], 0
cmp dword [ebp - 0xb20], 0x6c0b
je 0x405043
mov dword [ebp - 0x12b0], 1
jmp 0x40504a
and dword [ebp - 0x12b0], 0
cmp dword [ebp - 0x12b0], 0x3ee6
jne 0x405062
mov dword [ebp - 0xb28], 1
jmp 0x405069
and dword [ebp - 0xb28], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xb28]
sub ecx, dword [ebp + eax - 0x7d0]
mov dword [ebp - 0x1030], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1030]
mov dword [ebp + eax - 0x1f28], ecx
mov eax, dword [ebp - 0x1030]
add eax, 0x279e56
push 4
pop ecx
imul ecx, ecx, 3
cmp dword [ebp + ecx - 0x7d0], eax
jle 0x4050bb
mov dword [ebp - 0xb30], 1
jmp 0x4050c2
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xb30], eax
jge 0x4050d9
mov dword [ebp - 0x1554], 1
jmp 0x4050e0
and dword [ebp - 0x1554], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1554]
je 0x4050f7
mov dword [ebp - 0x1950], 1
jmp 0x4050fe
and dword [ebp - 0x1950], 0
mov eax, 0x6899
cmp eax, 1
jl 0x405114
mov dword [ebp - 0xb38], 1
jmp 0x40511b
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0xb38]
sub eax, 7
je 0x405132
mov dword [ebp - 0x1038], 1
jmp 0x405139
and dword [ebp - 0x1038], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7d0]
imul eax, dword [ebp - 0x1038]
cmp eax, dword [ebp - 4]
jle 0x40515d
mov dword [ebp - 0xb40], 1
jmp 0x405164
and dword [ebp - 0xb40], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xb40]
mov dword [ebp + eax - 0x7d0], ecx
mov dword [ebp - 4], 0
jmp 0x405187
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jg 0x4053e9
mov dword [ebp - 0x594], 0x57e8f534
mov dword [ebp - 0x204], 3
jmp 0x4051b4
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jl 0x4053e4
mov dword [ebp - 0x20c], 0x5375bb79
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x7d0], 0
je 0x4053a4
mov dword [ebp - 0x1400], 0xa8b036c8
mov dword [ebp - 0x1fc], 0
jmp 0x4051ff
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jg 0x4053a2
mov eax, dword [ebp - 0x594]
neg eax
mov ecx, dword [ebp - 4]
cmp eax, dword [ebp + ecx*4 - 0x1cac]
je 0x40522c
mov dword [ebp - 0x6a0], 1
jmp 0x405233
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x6a0]
mov dword [ebp + eax*4 - 0x7d0], ecx
cmp dword [ebp - 0x6a0], 0xfffffffb
jae 0x405258
mov dword [ebp - 0x12b8], 1
jmp 0x40525f
and dword [ebp - 0x12b8], 0
mov eax, dword [ebp - 0x594]
cmp dword [ebp - 0x12b8], eax
jl 0x405279
mov dword [ebp - 0xb48], 1
jmp 0x405280
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1cac]
sub eax, dword [ebp - 0xb48]
cmp eax, 0x6604
jge 0x4052a3
mov dword [ebp - 0x1958], 1
jmp 0x4052aa
and dword [ebp - 0x1958], 0
mov eax, dword [ebp - 0x1400]
mov dword [ebp - 0x1fe0], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x1fe8], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ff0], eax
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x1ff8], eax
mov eax, dword [ebp - 0x204]
cmp dword [ebp + eax*4 - 0x1f28], 0x14c7c747
jne 0x4052f9
mov dword [ebp - 0x1040], 1
jmp 0x405300
and dword [ebp - 0x1040], 0
cmp dword [ebp - 0x1040], 0xffffffff
jae 0x405315
mov dword [ebp - 0x790], 1
jmp 0x40531c
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x790]
mov dword [ebp + eax*4 - 0x1f28], ecx
cmp dword [ebp - 0x790], 0
jne 0x40534b
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x7d0], 0
jne 0x40534b
and dword [ebp - 0xb50], 0
jmp 0x405355
mov dword [ebp - 0xb50], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xb50]
sub ecx, dword [ebp + eax*4 - 0x1cac]
sub ecx, dword [ebp - 0x594]
imul ecx, dword [ebp - 0x20c]
cmp ecx, dword [ebp - 0x1400]
jle 0x405386
mov dword [ebp - 0xb58], 1
jmp 0x40538d
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xb58]
mov dword [ebp + eax*4 - 0x1cac], ecx
jmp 0x4051f2
jmp 0x4053df
mov dword [ebp - 0x20c], 3
jmp 0x4053bd
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jl 0x4053df
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x20c]
mov eax, dword [ebp + eax*4 - 0x1f28]
mov dword [ebp + ecx*4 - 0x7d0], eax
jmp 0x4053b0
jmp 0x4051a7
jmp 0x405180
push 2
lea ecx, [ebp - 0x1998]
call fcn.004133eb
mov dword [ebp - 0x39c], 1
mov dword [ebp - 0xe8], 0
jmp 0x405419
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x40543b
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x1998]
call fcn.004134d9
mov dword [eax], 0xfffffffc
jmp 0x40540c
mov dword [ebp - 0xe8], 0
jmp 0x405454
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 3
jge 0x405470
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x2284], 0xfffffff8
jmp 0x405447
mov byte [ebp - 0x1b9], 0
movzx eax, byte [ebp - 0x1b9]
test eax, eax
je 0x40548a
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea ecx, [ebp - 0x1998]
call fcn.004134d9
mov dword [eax], 0xffffffe6
jmp 0x4054c3
push 0
lea ecx, [ebp - 0x1998]
call fcn.004134d9
mov dword [ebp - 0x1048], eax
mov eax, dword [ebp - 0x1048]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1048]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1998]
call fcn.004134d9
cmp dword [eax], 0xb
jge 0x4055d2
mov dword [ebp - 0x1a0], 0x6210
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x2000], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x1a0], 0
jmp 0x405514
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 2
jg 0x4055cd
mov dword [ebp - 0x39c], 2
jmp 0x40553a
mov eax, dword [ebp - 0x39c]
dec eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0
jl 0x4055b6
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x44c], 0
jmp 0x405566
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 2
jg 0x4055b1
mov dword [ebp - 0x524], 1
mov dword [ebp - 0x524], 2
jmp 0x405592
mov eax, dword [ebp - 0x524]
dec eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 0
jl 0x4055af
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp + eax*4 - 0x2284], 0
je 0x4055ad
jmp 0x4055af
jmp 0x405585
jmp 0x405559
jmp 0x40552d
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp + eax*4 - 0x2284], 0
je 0x4055c8
jmp 0x4055cd
jmp 0x405507
jmp 0x40549f
lea ecx, [ebp - 0x1998]
call fcn.004134bd
mov dword [ebp - 0x2008], 0x77862fd4
mov byte [ebp - 0x2ba], 0
movzx eax, byte [ebp - 0x2ba]
test eax, eax
je 0x405612
push 0x2471
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
mov byte [ebp - 0x1bb], 0
movzx eax, byte [ebp - 0x1bb]
test eax, eax
je 0x40562a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
lea ecx, [ebp - 0x19a8]
call fcn.004133eb
mov dword [ebp - 0x5cc], 0xffffffff
mov dword [ebp - 0x1a60], 0x2a28
mov dword [ebp - 0x1a4c], 7
mov dword [ebp - 0x454], 0
jmp 0x40566e
mov eax, dword [ebp - 0x454]
inc eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 1
jge 0x405690
push dword [ebp - 0x454]
lea ecx, [ebp - 0x19a8]
call fcn.004134d9
mov dword [eax], 0x64a6
jmp 0x405661
mov dword [ebp - 0x5cc], 0
jmp 0x4056a9
mov eax, dword [ebp - 0x5cc]
dec eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 0
jl 0x405893
mov dword [ebp - 0x14d8], 0x362daab7
mov dword [ebp - 0x748], 0
mov dword [ebp - 0xb60], 0xffffffff
mov dword [ebp - 0x6a8], 0x88586fd5
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0xb60]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x14d8]
add eax, dword [ebp - 0x6a8]
je 0x405798
push 0
lea ecx, [ebp - 0x19a8]
call fcn.004134d9
mov ecx, dword [ebp - 0x6a8]
cmp dword [eax], ecx
je 0x40572b
mov dword [ebp - 0x12c0], 1
jmp 0x405732
and dword [ebp - 0x12c0], 0
push 0
lea ecx, [ebp - 0x19a8]
call fcn.004134d9
mov eax, dword [eax]
cmp eax, dword [ebp - 0x12c0]
je 0x405755
mov dword [ebp - 0xb68], 1
jmp 0x40575c
and dword [ebp - 0xb68], 0
cmp dword [ebp - 0xb68], 0xfffffff6
jb 0x405771
mov dword [ebp - 0x1050], 1
jmp 0x405778
and dword [ebp - 0x1050], 0
push 0
lea ecx, [ebp - 0x19a8]
call fcn.004134d9
mov ecx, dword [ebp - 0x1050]
cmp ecx, dword [eax]
je 0x405798
and dword [ebp - 0xb70], 0
jmp 0x4057a2
mov dword [ebp - 0xb70], 1
mov eax, dword [ebp - 0x748]
cmp dword [ebp - 0xb70], eax
jge 0x4057c0
xor eax, eax
je 0x4057c0
mov dword [ebp - 0xb78], 1
jmp 0x4057c7
and dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0x14d8]
cmp eax, dword [ebp - 0xb78]
jl 0x4057e1
mov dword [ebp - 0x1058], 1
jmp 0x4057e8
and dword [ebp - 0x1058], 0
cmp dword [ebp - 0x1058], 0xfffffffc
jge 0x4057fe
xor eax, eax
jne 0x4057fe
and dword [ebp - 0xb80], 0
jmp 0x405808
mov dword [ebp - 0xb80], 1
mov eax, dword [ebp - 0x1a60]
cmp dword [ebp - 0xb80], eax
jge 0x405822
mov dword [ebp - 0x12c8], 1
jmp 0x405829
and dword [ebp - 0x12c8], 0
cmp dword [ebp - 0x12c8], 0
jne 0x40583e
mov dword [ebp - 0xb88], 1
jmp 0x405845
and dword [ebp - 0xb88], 0
cmp dword [ebp - 0xb88], 1
je 0x40585a
mov dword [ebp - 0x1060], 1
jmp 0x405861
and dword [ebp - 0x1060], 0
mov eax, dword [ebp - 0x748]
cmp dword [ebp - 0x1060], eax
jne 0x40587b
mov dword [ebp - 0xb90], 1
jmp 0x405882
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0x1a4c], eax
jmp 0x40569c
mov byte [ebp - 0x27d], 0
movzx eax, byte [ebp - 0x27d]
test eax, eax
je 0x4058ad
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ecx, [ebp - 0x19a8]
call fcn.004134bd
mov dword [ebp - 0x154], 1
mov dword [ebp - 0x6b0], 9
push 2
lea ecx, [ebp - 0x1e4c]
call fcn.004133eb
push 3
lea ecx, [ebp - 0x1c54]
call fcn.004133eb
mov dword [ebp - 0x1070], 0
mov dword [ebp - 0x16c], 0
jmp 0x405909
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jge 0x40592b
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x1e4c]
call fcn.004134d9
mov dword [eax], 0x14c405b4
jmp 0x4058fc
mov dword [ebp - 0x16c], 0
jmp 0x405944
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x405966
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x1c54]
call fcn.004134d9
mov dword [eax], 0xdcba
jmp 0x405937
cmp dword [ebp - 0x6b0], 0
je 0x40598e
mov byte [ebp - 0x1bd], 0
movzx eax, byte [ebp - 0x1bd]
test eax, eax
je 0x405989
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x405b1f
mov dword [ebp - 0xba0], 0x61f66568
mov dword [ebp - 0x750], 1
mov dword [ebp - 0x1068], 0xfffffffb
mov dword [ebp - 0x45c], 0
jmp 0x4059c5
mov eax, dword [ebp - 0x45c]
inc eax
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 1
jge 0x4059e1
mov eax, dword [ebp - 0x45c]
mov dword [ebp + eax*4 - 0x7ac], 1
jmp 0x4059b8
push 0
lea ecx, [ebp - 0x1c54]
call fcn.004134d9
mov dword [ebp - 0x1408], eax
mov eax, dword [ebp - 0x1408]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1408]
mov dword [ecx], eax
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x2010], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7ac], 0
je 0x405a62
cmp dword [ebp - 0xba0], 0
je 0x405a45
mov esi, dword [ebp - 0xba0]
push 0
lea ecx, [ebp - 0x1c54]
call fcn.004134d9
cmp esi, dword [eax]
jge 0x405a85
mov eax, dword [ebp - 0x1070]
inc eax
mov dword [ebp - 0x1070], eax
lea ecx, [ebp - 0x1c54]
call fcn.004134bd
lea ecx, [ebp - 0x1e4c]
call fcn.004134bd
mov dword [ebp - 0xbc0], 1
mov dword [ebp - 0x1410], 0xfffffff6
mov dword [ebp - 0xf0], 0
jmp 0x405b6f
cmp dword [ebp - 0xf0], 4
jge 0x405b8b