Function at 0x1004cea6
Capabilities:
Enumerate gui resources
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x69c
push esi
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x3c4], 0xd8b3d385
mov dword [ebp - 0x14], 0x19
jmp 0x1004ced2
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x1004d3a7
mov dword [ebp - 0x1c], 0xe713a473
mov dword [ebp - 0x160], 0xaa7054f8
mov dword [ebp - 0x460], 0xfffffffc
mov dword [ebp - 0xe0], 0
jmp 0x1004cf10
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x1004cf2c
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x104], 1
jmp 0x1004cf03
mov dword [ebp - 0x1c], 0
jmp 0x1004cf3c
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffd
jg 0x1004d390
mov dword [ebp - 0x8c], 0xaa9dade6
mov dword [ebp - 0xe8], 1
mov dword [ebp - 0x48c], 0x571be33b
mov dword [ebp - 8], 0
jmp 0x1004cf74
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x1004cf8a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x514], 1
jmp 0x1004cf6d
mov dword [ebp - 8], 0
jmp 0x1004cf9a
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x1004cfb0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x664], 7
jmp 0x1004cf93
mov dword [ebp - 8], 0
jmp 0x1004cfc0
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x1004cfd6
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x608], 0x8e103ca5
jmp 0x1004cfb9
mov dword [ebp - 8], 0
jmp 0x1004cfe6
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x1004cffc
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x468], 0x1355901a
jmp 0x1004cfdf
cmp dword [ebp - 0x8c], 0
jne 0x1004d017
cmp dword [ebp - 0x8c], 0
jne 0x1004d017
and dword [ebp - 0x418], 0
jmp 0x1004d021
mov dword [ebp - 0x418], 1
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x14]
dec eax
jne 0x1004d03f
mov dword [ebp - 0x364], 1
jmp 0x1004d046
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0
jne 0x1004d06d
mov eax, 0x4fe9
test eax, eax
jne 0x1004d06d
and dword [ebp - 0x3e4], 0
jmp 0x1004d077
mov dword [ebp - 0x3e4], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x3e4], eax
jge 0x1004d08e
mov dword [ebp - 0x3b8], 1
jmp 0x1004d095
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x160], eax
je 0x1004d0b8
mov dword [ebp - 0x110], 1
jmp 0x1004d0bf
and dword [ebp - 0x110], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x110]
mov dword [ebp + eax - 0x514], ecx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x110]
jne 0x1004d0ed
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1004d0ed
and dword [ebp - 0x308], 0
jmp 0x1004d0f7
mov dword [ebp - 0x308], 1
imul eax, dword [ebp - 0x308], 0x9b4c
cmp eax, dword [ebp - 0x1c]
je 0x1004d112
mov dword [ebp - 0x168], 1
jmp 0x1004d119
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x168], eax
jg 0x1004d133
mov dword [ebp - 0x310], 1
jmp 0x1004d13a
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x310], eax
jle 0x1004d151
mov dword [ebp - 0x170], 1
jmp 0x1004d158
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x170], eax
jne 0x1004d16f
mov dword [ebp - 0x318], 1
jmp 0x1004d176
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x318]
cmp dword [ebp - 0xe8], eax
jg 0x1004d1ab
cmp dword [ebp - 0xe8], 0
jne 0x1004d1ab
cmp dword [ebp - 0x1c], 0
jne 0x1004d1ab
and dword [ebp - 0x178], 0
jmp 0x1004d1b5
mov dword [ebp - 0x178], 1
cmp dword [ebp - 0x178], 0xfffffff7
jae 0x1004d1ca
mov dword [ebp - 0x320], 1
jmp 0x1004d1d1
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x320]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jl 0x1004d1f0
mov dword [ebp - 0x180], 1
jmp 0x1004d1f7
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x180]
jle 0x1004d211
mov dword [ebp - 0x328], 1
jmp 0x1004d218
and dword [ebp - 0x328], 0
cmp dword [ebp - 0x328], 9
jbe 0x1004d22d
mov dword [ebp - 0x188], 1
jmp 0x1004d234
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x188], eax
jle 0x1004d24b
mov dword [ebp - 0x330], 1
jmp 0x1004d252
and dword [ebp - 0x330], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
cmp dword [ebp - 0x330], eax
je 0x1004d273
mov dword [ebp - 0x458], 1
jmp 0x1004d27a
and dword [ebp - 0x458], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x664]
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x58c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x460]
cmp dword [ebp + eax - 0x608], ecx
jle 0x1004d2b7
mov dword [ebp - 0x190], 1
jmp 0x1004d2be
and dword [ebp - 0x190], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
cmp dword [ebp - 0x190], eax
je 0x1004d2df
mov dword [ebp - 0x338], 1
jmp 0x1004d2e6
and dword [ebp - 0x338], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
cmp dword [ebp - 0x338], eax
je 0x1004d314
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x104], 0
jne 0x1004d314
and dword [ebp - 0x198], 0
jmp 0x1004d31e
mov dword [ebp - 0x198], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x608]
cmp dword [ebp - 0x198], eax
jg 0x1004d33f
mov dword [ebp - 0x340], 1
jmp 0x1004d346
and dword [ebp - 0x340], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x340]
mov dword [ebp + eax - 0x468], ecx
mov eax, dword [ebp - 0x1c]
add eax, 0x9b52
jne 0x1004d375
cmp dword [ebp - 0xe8], 0
jne 0x1004d375
and dword [ebp - 0x1a0], 0
jmp 0x1004d37f
mov dword [ebp - 0x1a0], 1
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x48c], eax
jmp 0x1004cf35
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x1004d3a2
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x1004cecb
mov dword [ebp - 0x494], 0x34e2
mov dword [ebp - 0xb8], 0
jmp 0x1004d3ca
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1004d3e6
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xa4], 0
jmp 0x1004d3bd
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xa4], 0
jmp 0x1004d414
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa4], 0xfffffff2
je 0x1004d655
mov dword [ebp - 0x348], 0xc7153413
mov dword [ebp - 0x144], 7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa4]
mov dword [ebp - 0x5b4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa4]
neg eax
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xa4]
je 0x1004d478
mov dword [ebp - 0x1a8], 1
jmp 0x1004d47f
and dword [ebp - 0x1a8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa4]
mov dword [ebp - 0x4f8], eax
mov eax, 0x3b16aac8
add eax, 0x40552487
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x500], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa4]
cmp dword [ebp - 0x1a8], eax
jg 0x1004d4cf
mov dword [ebp - 0x350], 1
jmp 0x1004d4d6
and dword [ebp - 0x350], 0
cmp dword [ebp - 0x350], 0x9cbc
jg 0x1004d4ee
mov dword [ebp - 0x1b0], 1
jmp 0x1004d4f5
and dword [ebp - 0x1b0], 0
cmp dword [ebp - 0x1b0], 0xb07f
jne 0x1004d50d
mov dword [ebp - 0x358], 1
jmp 0x1004d514
and dword [ebp - 0x358], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa4]
mov ecx, dword [ebp - 0x358]
lea eax, [ecx + eax - 7]
cmp eax, dword [ebp - 0x144]
jne 0x1004d53e
mov dword [ebp - 0x1b8], 1
jmp 0x1004d545
and dword [ebp - 0x1b8], 0
cmp dword [ebp - 0x1b8], 0xe3585ca2
jne 0x1004d55d
mov dword [ebp - 0x360], 1
jmp 0x1004d564
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x360], eax
jle 0x1004d57e
mov dword [ebp - 0x1c0], 1
jmp 0x1004d585
and dword [ebp - 0x1c0], 0
cmp dword [ebp - 0x1c0], 0xd77dfcc8
ja 0x1004d59d
mov dword [ebp - 0x368], 1
jmp 0x1004d5a4
and dword [ebp - 0x368], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa4]
add eax, dword [ebp - 0x368]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xa4]
je 0x1004d5d1
mov dword [ebp - 0x1c8], 1
jmp 0x1004d5d8
and dword [ebp - 0x1c8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa4]
cmp dword [ebp - 0x1c8], eax
jg 0x1004d5f8
mov dword [ebp - 0x370], 1
jmp 0x1004d5ff
and dword [ebp - 0x370], 0
cmp dword [ebp - 0x370], 6
jbe 0x1004d614
mov dword [ebp - 0x1d0], 1
jmp 0x1004d61b
and dword [ebp - 0x1d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa4]
cmp dword [ebp - 0x1d0], eax
jle 0x1004d63e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa4]
mov dword [ebp - 0x144], eax
jmp 0x1004d3f9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa4]
mov dword [ebp - 0x494], eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x98], 0xffffffff
mov dword [ebp - 0x100], 0xffffffff
mov dword [ebp - 0x4b0], 0
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x4a8], 0
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x1f0], 2
mov dword [ebp - 0x38], 0
jmp 0x1004d6c5
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1004d6db
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x68c], 0xfffffffa
jmp 0x1004d6be
mov dword [ebp - 0x38], 0
jmp 0x1004d6eb
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1004d701
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x49c], 0xb566e66b
jmp 0x1004d6e4
mov dword [ebp - 0x98], 0x12
jmp 0x1004d71a
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xa
jl 0x1004db63
mov dword [ebp - 0x140], 0x19c9214a
mov dword [ebp - 0x3bc], 1
mov dword [ebp - 0x5c], 0x402da3c3
mov dword [ebp - 0xf0], 0
jmp 0x1004d75b
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 4
jge 0x1004d777
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x414], 1
jmp 0x1004d74e
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x414], 3
jmp 0x1004d7a5
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x414]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x414], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x414], 0
jl 0x1004d8f7
mov dword [ebp - 0xc0], 0
jmp 0x1004d7d2
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x1004d7ee
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x380], 4
jmp 0x1004d7c5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x414]
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x3bc], 0x58905b8b
jge 0x1004d819
mov dword [ebp - 0x378], 1
jmp 0x1004d820
and dword [ebp - 0x378], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x380]
cmp dword [ebp - 0x378], eax
jle 0x1004d841
mov dword [ebp - 0x1d8], 1
jmp 0x1004d848
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x588], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d8]
sub ecx, dword [ebp + eax - 0x414]
mov dword [ebp - 0x100], ecx
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x140], 0x64d64ea3
jne 0x1004d89e
mov dword [ebp - 0x1e0], 1
jmp 0x1004d8a5
and dword [ebp - 0x1e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x380]
cmp dword [ebp - 0x1e0], eax
jne 0x1004d8c6
mov dword [ebp - 0x388], 1
jmp 0x1004d8cd
and dword [ebp - 0x388], 0
cmp dword [ebp - 0x388], 1
jge 0x1004d8e2
mov dword [ebp - 0x1e8], 1
jmp 0x1004d8e9
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x5c], eax
jmp 0x1004d78a
mov dword [ebp - 0x5c], 0
jmp 0x1004d907
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jg 0x1004db5e
mov dword [ebp - 0x4b8], 0xfffb
mov dword [ebp - 0xf8], 0
jmp 0x1004d934
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x1004d950
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x3d0], 0
jmp 0x1004d927
cmp dword [ebp - 0x1f0], 0
je 0x1004da78
mov dword [ebp - 0x100], 0xe1289ed5
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x4b0]
cmp eax, dword [ebp - 0x100]
jg 0x1004d997
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4b0], 0
je 0x1004d997
mov dword [ebp - 0x390], 1
jmp 0x1004d99e
and dword [ebp - 0x390], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x49c]
cmp dword [ebp - 0x390], eax
jg 0x1004d9c5
cmp dword [ebp - 0x1f0], 0
jne 0x1004d9c5
and dword [ebp - 0x13c], 0
jmp 0x1004d9cf
mov dword [ebp - 0x13c], 1
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x414], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3d0]
cmp dword [ebp - 0x13c], eax
jge 0x1004da00
mov dword [ebp - 0x398], 1
jmp 0x1004da07
and dword [ebp - 0x398], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d0]
cmp eax, dword [ebp - 0x398]
jg 0x1004da28
mov dword [ebp - 0x1f8], 1
jmp 0x1004da2f
and dword [ebp - 0x1f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d0]
cmp dword [ebp - 0x1f8], eax
jl 0x1004da50
mov dword [ebp - 0x3a0], 1
jmp 0x1004da57
and dword [ebp - 0x3a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d0]
cmp dword [ebp - 0x3a0], eax
jl 0x1004da78
mov dword [ebp - 0x200], 1
jmp 0x1004da7f
and dword [ebp - 0x200], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3d0]
cmp dword [ebp - 0x200], eax
jge 0x1004daa0
mov dword [ebp - 0x3a8], 1
jmp 0x1004daa7
and dword [ebp - 0x3a8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x4b0]
sub eax, dword [ebp - 0x3a8]
jne 0x1004dad2
mov eax, dword [ebp - 0x5c]
cmp dword [ebp + eax*4 - 0x414], 0
jne 0x1004dad2
and dword [ebp - 0x208], 0
jmp 0x1004dadc
mov dword [ebp - 0x208], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x4b0]
cmp dword [ebp - 0x208], eax
jge 0x1004dafd
mov dword [ebp - 0x3b0], 1
jmp 0x1004db04
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x3b0], 0x349b
jle 0x1004db1c
mov dword [ebp - 0x214], 1
jmp 0x1004db23
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x3bc]
cmp dword [ebp - 0x214], eax
jl 0x1004db46
mov eax, 0xb1dcede6
test eax, eax
je 0x1004db46
mov dword [ebp - 0x304], 1
jmp 0x1004db4d
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x4b8], eax
jmp 0x1004d900
jmp 0x1004d70d
mov dword [ebp - 0x394], 0x7f37c04c
mov dword [ebp - 0x3e0], 0xf05f4326
mov dword [ebp - 0x11c], 0xae7b
mov dword [ebp - 0x54], 0xfffffffb
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x450], 0xd1d8475
mov dword [ebp - 0x24], 0
jmp 0x1004dbac
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1004dbc2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x520], 0x33a79cc0
jmp 0x1004dba5
mov dword [ebp - 0x24], 0
jmp 0x1004dbd2
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1004dbe8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x644], 0x153413f0
jmp 0x1004dbcb
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1004dc02
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
cmp dword [ebp - 0x11c], 0
jne 0x1004dc17
mov dword [ebp - 0x37c], 1
jmp 0x1004dc1e
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x598], eax
mov eax, 0xf58382bd
test eax, eax
je 0x1004dc45
cmp dword [ebp - 0x54], 0
je 0x1004dc45
mov dword [ebp - 0x21c], 1
jmp 0x1004dc4c
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x21c]
je 0x1004dc69
cmp dword [ebp - 0x54], 0
je 0x1004dc69
mov dword [ebp - 0x224], 1
jmp 0x1004dc70
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x37c]
cmp eax, dword [ebp - 0x224]
jl 0x1004dc8a
mov dword [ebp - 0x30c], 1
jmp 0x1004dc91
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x30c], eax
jl 0x1004dcab
mov dword [ebp - 0x134], 1
jmp 0x1004dcb2
and dword [ebp - 0x134], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x134]
mov dword [ebp + eax - 0x520], ecx
cmp dword [ebp - 0x134], 0
je 0x1004dce0
cmp dword [ebp - 0x54], 0
je 0x1004dce0
mov dword [ebp - 0x22c], 1
jmp 0x1004dce7
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x22c], eax
jg 0x1004dcfe
mov dword [ebp - 0x3b4], 1
jmp 0x1004dd05
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x3b4]
je 0x1004dd22
cmp dword [ebp - 0x54], 0
je 0x1004dd22
mov dword [ebp - 0x124], 1
jmp 0x1004dd29
and dword [ebp - 0x124], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x124]
mov dword [ebp + eax - 0x644], ecx
cmp dword [ebp - 0x124], 0xfffffffd
jge 0x1004dd51
mov dword [ebp - 0x234], 1
jmp 0x1004dd58
and dword [ebp - 0x234], 0
cmp dword [ebp - 0x234], 0xfffffff6
je 0x1004dd6d
mov dword [ebp - 0x314], 1
jmp 0x1004dd74
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x314], eax
jge 0x1004dd8b
mov dword [ebp - 0x23c], 1
jmp 0x1004dd92
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x480]
cmp dword [ebp - 0x23c], eax
jg 0x1004ddac
mov dword [ebp - 0x384], 1
jmp 0x1004ddb3
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x294], 0xb8fa48a2
mov dword [ebp - 0xec], 0xaeef20fe
mov dword [ebp - 0x424], 0x4d63a88e
mov dword [ebp - 0x5a0], 0x9989d221
mov dword [ebp - 0xcc], 0
jmp 0x1004de00
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x1004de1c
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x5c0], 9
jmp 0x1004ddf3
mov dword [ebp - 0xec], 2
jmp 0x1004de35
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x1004dec3
mov dword [ebp - 0x90], 0xd37ad435
mov dword [ebp - 0x90], 2
jmp 0x1004de65
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x1004debe
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp + eax*4 - 0x5c0]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0x5c0], ecx
cmp dword [ebp - 0x244], 4
jae 0x1004dea9
mov dword [ebp - 0x31c], 1
jmp 0x1004deb0
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x424], eax
jmp 0x1004de58
jmp 0x1004de28
mov dword [ebp - 0x29c], 0x11fb8eb5
mov dword [ebp - 0x484], 0xabff5ecc
mov dword [ebp - 0x3e8], 0x336de018
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0x48], 0
jmp 0x1004defb
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1004df11
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x3dc], 0
jmp 0x1004def4
mov dword [ebp - 0x48], 0
jmp 0x1004df21
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1004df37
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x3f8], 1
jmp 0x1004df1a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3dc]
mov dword [ebp - 0x5a8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3dc]
mov dword [ebp - 0x24c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x24c]
mov dword [ebp + eax - 0x3dc], ecx
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x5b0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0x5d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3dc]
sub eax, 0x50a4049a
jne 0x1004dfc8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3dc], 0
jne 0x1004dfc8
and dword [ebp - 0x254], 0
jmp 0x1004dfd2
mov dword [ebp - 0x254], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x254], eax
jne 0x1004dff3
mov dword [ebp - 0x324], 1
jmp 0x1004dffa
and dword [ebp - 0x324], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x324], eax
jle 0x1004e01b
mov dword [ebp - 0x25c], 1
jmp 0x1004e022
and dword [ebp - 0x25c], 0
cmp dword [ebp - 0x25c], 0x3367
jle 0x1004e03a
mov dword [ebp - 0x38c], 1
jmp 0x1004e041
and dword [ebp - 0x38c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x38c], eax
jge 0x1004e062
mov dword [ebp - 0x264], 1
jmp 0x1004e069
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x264], 1
jl 0x1004e07e
mov dword [ebp - 0x32c], 1
jmp 0x1004e085
and dword [ebp - 0x32c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x32c], eax
je 0x1004e0a6
mov dword [ebp - 0x478], 1
jmp 0x1004e0ad
and dword [ebp - 0x478], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0x5e0], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3f8], 0xfffffffe
mov dword [ebp - 0xa8], 0xfffffffe
mov dword [ebp - 0xa8], 1
jmp 0x1004e0f4
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1004e11b
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x1004e119
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
jmp 0x1004e0e7
mov dword [ebp - 0x5e8], 0x3b91
mov dword [ebp - 0x4fc], 0x8d4081c2
mov dword [ebp - 0x26c], 9
mov dword [ebp - 0x40], 0
jmp 0x1004e149
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1004e15f
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x670], 0xe7937d8e
jmp 0x1004e142
mov dword [ebp - 0x40], 0
jmp 0x1004e16f
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x1004e185
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x69c], 1
jmp 0x1004e168
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0xd4], 0
jmp 0x1004e1ab
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 4
jge 0x1004e1c7
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x654], 6
jmp 0x1004e19e
mov dword [ebp - 0x64], 0xf6af1124
mov dword [ebp - 0x42c], 0x89226c31
mov dword [ebp - 0x64], 6
jmp 0x1004e1e8
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xfffffff3
jle 0x1004e26d
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x1004e202
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x64]
imul eax, dword [ebp - 0x64]
cmp dword [ebp - 0x64], eax
jg 0x1004e21a
mov dword [ebp - 0x3c0], 1
jmp 0x1004e221
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 0x91
jle 0x1004e239
mov dword [ebp - 0x274], 1
jmp 0x1004e240
and dword [ebp - 0x274], 0
cmp dword [ebp - 0x274], 0xffffffff
je 0x1004e255
mov dword [ebp - 0x334], 1
jmp 0x1004e25c
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x42c], eax
jmp 0x1004e1e1
mov eax, dword [ebp - 0x30]
sub eax, 0xb5486b6
jne 0x1004e289
mov eax, 0xaed
test eax, eax
jne 0x1004e289
and dword [ebp - 0x47c], 0
jmp 0x1004e293
mov dword [ebp - 0x47c], 1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x594], eax
push 0xfffffffffffffffc
pop eax
cmp eax, 0xfffffffa
jne 0x1004e2b0
mov dword [ebp - 0x434], 1
jmp 0x1004e2b7
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x30], 0
jne 0x1004e2d5
cmp dword [ebp - 0x30], 0
jne 0x1004e2d5
and dword [ebp - 0x27c], 0
jmp 0x1004e2df
mov dword [ebp - 0x27c], 1
cmp dword [ebp - 0x27c], 0x94ab
jg 0x1004e2f7
mov dword [ebp - 0x284], 1
jmp 0x1004e2fe
and dword [ebp - 0x284], 0
mov dword [ebp - 0x394], 1
mov eax, dword [ebp - 0x394]
add eax, dword [ebp - 0x284]
cmp eax, dword [ebp - 0x30]
jg 0x1004e325
mov dword [ebp - 0x33c], 1
jmp 0x1004e32c
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x33c]
jle 0x1004e343
mov dword [ebp - 0x28c], 1
jmp 0x1004e34a
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x294], eax
jne 0x1004e379
mov dword [ebp - 0x344], 1
jmp 0x1004e380
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x29c]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x39c], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x39c]
mov dword [ebp + eax - 0x654], ecx
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x484], eax
push 0
call fcn.1004c5e3
pop ecx
mov dword [ebp - 0x154], 0xf112
mov dword [ebp - 0x150], 0xf112
mov dword [ebp - 0x14c], 0xf112
mov dword [ebp - 0x148], 0xf112
mov dword [ebp - 4], 0x29a3df60
mov dword [ebp - 0x488], 0x302d9caa
mov dword [ebp - 0xfc], 0
jmp 0x1004e414
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x1004e430
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x444], 0x18c6a866
jmp 0x1004e407
mov dword [ebp - 4], 0
jmp 0x1004e440
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jg 0x1004e778
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x2ac], 1
mov dword [ebp - 0x354], 0xaeaba4a2
mov dword [ebp - 0x44c], 0x87c7a501
mov dword [ebp - 0xdc], 0
jmp 0x1004e488
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jge 0x1004e4a4
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x4e8], 0
jmp 0x1004e47b
mov dword [ebp - 0xc], 3
jmp 0x1004e4b4
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x1004e745
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x154], 0
je 0x1004e4d0
jmp 0x1004e745
mov eax, 0xe665
test eax, eax
je 0x1004e4ea
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x154], 0
jne 0x1004e647
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
mov dword [ebp - 0x544], eax
cmp dword [ebp - 4], 0x56e623b2
jle 0x1004e512
mov dword [ebp - 0x43c], 1
jmp 0x1004e519
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x154]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x154]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xc], eax
jg 0x1004e54d
mov dword [ebp - 0x138], 1
jmp 0x1004e554
and dword [ebp - 0x138], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x138]
mov dword [ebp + eax - 0x4e8], ecx
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x138], eax
jle 0x1004e57e
mov dword [ebp - 0x2a4], 1
jmp 0x1004e585
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x154]
cmp dword [ebp - 0x2a4], eax
je 0x1004e5a3
mov dword [ebp - 0x4a0], 1
jmp 0x1004e5aa
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x518], eax
cmp dword [ebp - 4], 0
je 0x1004e5c9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4e8], 0
jne 0x1004e5df
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x154], 0
jne 0x1004e5df
and dword [ebp - 0x34c], 0
jmp 0x1004e5e9
mov dword [ebp - 0x34c], 1
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x2ac], eax
jg 0x1004e60c
mov dword [ebp - 0x3c8], 1
jmp 0x1004e613
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x3c8], eax
jg 0x1004e62a
mov dword [ebp - 0x2b4], 1
jmp 0x1004e631
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
imul eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
jne 0x1004e65b
mov dword [ebp - 0x12c], 1
jmp 0x1004e662
and dword [ebp - 0x12c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x12c]
mov dword [ebp + eax - 0x444], ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x154]
cmp dword [ebp - 0x12c], eax
jle 0x1004e69c
cmp dword [ebp - 0x488], 0
je 0x1004e69c
mov dword [ebp - 0x2bc], 1
jmp 0x1004e6a3
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x2bc]
add eax, 0xcc73
sub eax, dword [ebp - 0xc]
cmp eax, 0x101e
jl 0x1004e6c4
mov dword [ebp - 0x3a4], 1
jmp 0x1004e6cb
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x154]
cmp dword [ebp - 0x3a4], eax
jg 0x1004e6e9
mov dword [ebp - 0x2c4], 1
jmp 0x1004e6f0
and dword [ebp - 0x2c4], 0
cmp dword [ebp - 0x2c4], 0xfff7
jae 0x1004e708
mov dword [ebp - 0x35c], 1
jmp 0x1004e70f
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x154]
cmp dword [ebp - 0x35c], eax
je 0x1004e72d
mov dword [ebp - 0x2cc], 1
jmp 0x1004e734
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x44c], eax
jmp 0x1004e4ad
mov dword [ebp - 0xc], 3
jmp 0x1004e755
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x1004e773
mov byte [ebp - 0x57], 0
movzx eax, byte [ebp - 0x57]
test eax, eax
je 0x1004e771
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1004e74e
jmp 0x1004e439
push 1
lea eax, [ebp - 0x67c]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.1004be66
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x620]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x620]
lea edi, [ebp - 0x4d4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2c], 0x622ba394
mov dword [ebp - 0x28], 0
jmp 0x1004e7be
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1004e7d4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x474], 0xffffffff
jmp 0x1004e7b7
mov dword [ebp - 0x28], 0
jmp 0x1004e7e4
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1004e7fa
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x52c], 0x7525d2d9
jmp 0x1004e7dd
mov dword [ebp - 0x2c], 0
jmp 0x1004e80a
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jg 0x1004e8cf
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x1004e831
push 0x1c7d
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x474]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x474]
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x2c]
mov ecx, 0x2337
sub ecx, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x474], ecx
jg 0x1004e871
mov dword [ebp - 0x3ec], 1
jmp 0x1004e878
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 0x63e31551
je 0x1004e890
mov dword [ebp - 0x2d4], 1
jmp 0x1004e897
and dword [ebp - 0x2d4], 0
cmp dword [ebp - 0x2d4], 0xfffffffc
jl 0x1004e8ac
mov dword [ebp - 0x158], 1
jmp 0x1004e8b3
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x158]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x52c], eax
jmp 0x1004e803
mov dword [ebp - 0x6c], 0xb999fb02
mov dword [ebp - 0x45c], 2
mov dword [ebp - 0x114], 0x2b7b
mov dword [ebp - 0x490], 0x531e
mov dword [ebp - 0x220], 0x9606
mov dword [ebp - 0x4f4], 0x8f497c3
mov dword [ebp - 0x34], 0
jmp 0x1004e918
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1004e92e
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xf4], 0x89a9b8fa
jmp 0x1004e911
mov dword [ebp - 0x34], 0
jmp 0x1004e93e
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1004e954
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x10c], 0x707e294
jmp 0x1004e937
cmp dword [ebp - 0x6c], 0
je 0x1004ea4d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10c], 1
jne 0x1004e97a
mov dword [ebp - 0x2dc], 1
jmp 0x1004e981
and dword [ebp - 0x2dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
cmp dword [ebp - 0x2dc], eax
jne 0x1004e9a2
mov dword [ebp - 0x3ac], 1
jmp 0x1004e9a9
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x3ac], eax
jge 0x1004e9c0
mov dword [ebp - 0x4b4], 1
jmp 0x1004e9c7
and dword [ebp - 0x4b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
cmp dword [ebp - 0x114], eax
jg 0x1004ea08
mov dword [ebp - 0x2e4], 1
jmp 0x1004ea0f
and dword [ebp - 0x2e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
cmp dword [ebp - 0x2e4], eax
jg 0x1004ea30
mov dword [ebp - 0x454], 1
jmp 0x1004ea37
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x570], eax
mov eax, 0x5d482642
test eax, eax
je 0x1004ea4d
xor eax, eax
jne 0x1004ea66
mov eax, 0xffff
test eax, eax
jne 0x1004ea66
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10c], 0
je 0x1004ea82
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10c], 0
je 0x1004ea82
mov dword [ebp - 0x36c], 1
jmp 0x1004ea89
and dword [ebp - 0x36c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
cmp dword [ebp - 0x36c], eax
jne 0x1004eaaa
mov dword [ebp - 0x2ec], 1
jmp 0x1004eab1
and dword [ebp - 0x2ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2ec]
mov dword [ebp + eax - 0xf4], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x6c], 0x643c8f43
jge 0x1004eaf2
mov eax, 0xffff
test eax, eax
jne 0x1004eaf2
and dword [ebp - 0x3d4], 0
jmp 0x1004eafc
mov dword [ebp - 0x3d4], 1
mov eax, dword [ebp - 0x3d4]
sub eax, dword [ebp - 0x490]
je 0x1004eb1f
mov eax, 0x73ecfb86
test eax, eax
je 0x1004eb1f
mov dword [ebp - 0x2f4], 1
jmp 0x1004eb26
and dword [ebp - 0x2f4], 0
cmp dword [ebp - 0x2f4], 0xffff
jb 0x1004eb3e
mov dword [ebp - 0x374], 1
jmp 0x1004eb45
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
neg eax
cmp eax, dword [ebp - 0x6c]
jg 0x1004eb5e
mov dword [ebp - 0x2fc], 1
jmp 0x1004eb65
and dword [ebp - 0x2fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
cmp dword [ebp - 0x2fc], eax
jge 0x1004eb86
mov dword [ebp - 0x20c], 1
jmp 0x1004eb8d
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x6c]
inc eax
inc eax
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x10c]
add ecx, dword [ebp - 0x20c]
cmp eax, ecx
je 0x1004ebb5
mov dword [ebp - 0x210], 1
jmp 0x1004ebbc
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x210]
neg ecx
sub eax, ecx
je 0x1004ebe0
mov eax, 0xfffa
test eax, eax
je 0x1004ebe0
mov dword [ebp - 0x218], 1
jmp 0x1004ebe7
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x1004ec0a
or eax, 0xffffffff
jne 0x1004ec0a
and dword [ebp - 0x228], 0
jmp 0x1004ec14
mov dword [ebp - 0x228], 1
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x44], 0xe81a7ecc
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jne 0x1004ec42
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
je 0x1004ec42
cmp dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0
je 0x1004ec5a
cmp dword [ebp - 0x10], 0
je 0x1004ec5a
mov dword [ebp - 0x230], 1
jmp 0x1004ec61
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x230], eax
jle 0x1004eccc
mov dword [ebp - 0xe4], 0
jmp 0x1004ec85
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jge 0x1004eca1
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x62c], 0x6ddcd166
jmp 0x1004ec78
mov dword [ebp - 0x44], 0
jmp 0x1004ecb1
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x1004ecc7
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x62c], 0xbdbdf7cd
jmp 0x1004ecaa
jmp 0x1004eeeb
mov dword [ebp - 0x118], 0xd8ff8cd3
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x3c], 0
jmp 0x1004ecf0
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1004ed06
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x614], 0x94486cae
jmp 0x1004ece9
mov dword [ebp - 0x3c], 0
jmp 0x1004ed16
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1004ed2c
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x538], 0xfffffffb
jmp 0x1004ed0f
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x1004ed45
push 0xeaf
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x10], 0
jmp 0x1004ed55
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x1004eeeb
mov dword [ebp - 0x74], 0
mov eax, 0xffff
test eax, eax
je 0x1004ed95
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x118], eax
jl 0x1004ed95
mov dword [ebp - 0x250], 1
jmp 0x1004ed9c
and dword [ebp - 0x250], 0
cmp dword [ebp - 0x74], 1
jge 0x1004edae
mov dword [ebp - 0x240], 1
jmp 0x1004edb5
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x240], eax
jne 0x1004edcf
mov dword [ebp - 0x4bc], 1
jmp 0x1004edd6
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x74], 0
jne 0x1004edf1
mov dword [ebp - 0x248], 1
jmp 0x1004edf8
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x248], eax
jge 0x1004ee0f
mov dword [ebp - 0x258], 1
jmp 0x1004ee16
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x250]
cmp eax, dword [ebp - 0x258]
jg 0x1004ee30
mov dword [ebp - 0x260], 1
jmp 0x1004ee37
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x260], eax
jne 0x1004ee4e
mov dword [ebp - 0x268], 1
jmp 0x1004ee55
and dword [ebp - 0x268], 0
cmp dword [ebp - 0x268], 1
jl 0x1004ee6a
mov dword [ebp - 0x270], 1
jmp 0x1004ee71
and dword [ebp - 0x270], 0
cmp dword [ebp - 0x270], 0xf4c6
je 0x1004ee89
mov dword [ebp - 0x120], 1
jmp 0x1004ee90
and dword [ebp - 0x120], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x120]
mov dword [ebp + eax - 0x614], ecx
cmp dword [ebp - 0x120], 0
je 0x1004eebe
cmp dword [ebp - 0x74], 0
je 0x1004eebe
mov dword [ebp - 0x278], 1
jmp 0x1004eec5
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x278]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x538], eax
cmp dword [ebp - 0x74], 0
je 0x1004eee6
jmp 0x1004ed4e
jmp 0x1004ed4e
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x94], 0xffffffff
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x20], 0x1c1ec2db
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x580], 0xc309ab83
mov dword [ebp - 0x560], 0x3ec3e1b8
mov dword [ebp - 0x5e4], 8
mov dword [ebp - 0x55c], 0
mov dword [ebp - 0x554], 0xb14898d0
mov dword [ebp - 0x550], 0xb14898d0
mov dword [ebp - 0x54c], 0xb14898d0
mov dword [ebp - 0x548], 0xb14898d0
mov dword [ebp - 0x2c0], 8
mov dword [ebp - 0xc4], 0
jmp 0x1004ef96
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 4
jge 0x1004efb2
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x5f8], 0xa049fe38
jmp 0x1004ef89
mov dword [ebp - 0x20], 0
jmp 0x1004efc2
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x1004f126
mov dword [ebp - 0x2a8], 1
mov dword [ebp - 0x2b0], 3
cmp dword [ebp - 0x20], 0
je 0x1004f061
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x5f8]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x564], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x20], 0x8d5f
jle 0x1004f01d
mov dword [ebp - 0x280], 1
jmp 0x1004f024
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x128]
imul eax, dword [ebp - 0x280]
cmp eax, dword [ebp - 0x2a8]
jge 0x1004f045
mov dword [ebp - 0x288], 1
jmp 0x1004f04c
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 0xffffffff
jae 0x1004f061
mov dword [ebp - 0x290], 1
jmp 0x1004f068
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x290]
inc eax
cmp eax, dword [ebp - 0x20]
jle 0x1004f080
mov dword [ebp - 0x298], 1
jmp 0x1004f087
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x298], eax
jge 0x1004f0a7
mov eax, 0xeae21516
test eax, eax
jne 0x1004f0a7
and dword [ebp - 0x2a0], 0
jmp 0x1004f0b1
mov dword [ebp - 0x2a0], 1
mov eax, dword [ebp - 0x2a0]
sub eax, dword [ebp - 0x128]
cmp eax, 0x732a
jg 0x1004f0d0
mov dword [ebp - 0x464], 1
jmp 0x1004f0d7
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x56c], eax
mov eax, 0xd2ae857b
neg eax
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x5f8]
cmp eax, dword [ebp - 0x2b0]
jle 0x1004f10e
mov dword [ebp - 0x2b8], 1
jmp 0x1004f115
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x498], eax
jmp 0x1004efbb
mov eax, dword [ebp - 0x2c0]
dec eax
mov dword [ebp - 0x2c0], eax
mov dword [ebp - 0x84], 0xd8169b41
mov dword [ebp - 0x46c], 0xb7f609b2
mov dword [ebp - 0x4c], 0
jmp 0x1004f157
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1004f16d
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x4c8], 0xb9b55bb2
jmp 0x1004f150
mov dword [ebp - 0x4c], 0
jmp 0x1004f17d
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1004f193
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x404], 0xe2236432
jmp 0x1004f176
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x404], 0
jmp 0x1004f1c1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x404]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x404], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x404], 2
jg 0x1004f26b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x404]
mov eax, dword [ebp + eax*4 - 0x4c8]
mov dword [ebp - 0x5a4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x404]
mov eax, dword [ebp + eax*4 - 0x4c8]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x4c8]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x404]
jge 0x1004f22a
mov dword [ebp - 0x2c8], 1
jmp 0x1004f231
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0xfffffffb
jl 0x1004f246
mov dword [ebp - 0x2d0], 1
jmp 0x1004f24d
and dword [ebp - 0x2d0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2d0]
sub ecx, dword [ebp + eax - 0x4c8]
mov dword [ebp - 0x46c], ecx
jmp 0x1004f1a6
mov dword [ebp - 0x130], 0x7b364fe
mov dword [ebp - 0x50], 0
jmp 0x1004f285
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1004f29b
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x634], 0x26bdde0b
jmp 0x1004f27e
mov dword [ebp - 0x50], 0
jmp 0x1004f2ab
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1004f2c1
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x4e0], 0xbe8e56f9
jmp 0x1004f2a4
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x4e0], 1
jmp 0x1004f2ef
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4e0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x4e0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4e0], 0
jl 0x1004f37a
mov dword [ebp - 0xc8], 0x23ed15d
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x1004f325
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0xc8], 0
jmp 0x1004f33e
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jg 0x1004f375
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x1004f373
push 0
push 0x12c3
push 0xbc8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
jmp 0x1004f331
jmp 0x1004f2d4
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x1004f395
push 0
push 0x3df
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov dword [ebp - 0xd0], 0
jmp 0x1004f3ae
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jge 0x1004f3ca
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0xac], 0x48261f9c
jmp 0x1004f3a1
mov dword [ebp - 0x94], 0
jmp 0x1004f3e3
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x1004f985
mov dword [ebp - 0x18], 0x37d45db3
mov dword [ebp - 0x1e4], 0x11e9056f
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x18], 0
jmp 0x1004f41b
cmp dword [ebp - 0x18], 0
jl 0x1004f980
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0xb4], 0x15e4
mov dword [ebp - 0x1c4], 0xe4f9f010
mov dword [ebp - 0xbc], 0x23668f78
cmp dword [ebp - 0x94], 0
jne 0x1004f45f
mov dword [ebp - 0x2e8], 1
jmp 0x1004f466
and dword [ebp - 0x2e8], 0
cmp dword [ebp - 0x7c], 0xfad0d727
jbe 0x1004f47b
mov dword [ebp - 0x2d8], 1
jmp 0x1004f482
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x2d8], eax
jle 0x1004f499
mov dword [ebp - 0x2e0], 1
jmp 0x1004f4a0
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2e0], eax
jne 0x1004f4b7
mov dword [ebp - 0x2f0], 1
jmp 0x1004f4be
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0x2f0]
jl 0x1004f4e1
mov eax, 0xe6a0122d
test eax, eax
je 0x1004f4e1
mov dword [ebp - 0x2f8], 1
jmp 0x1004f4e8
and dword [ebp - 0x2f8], 0
cmp dword [ebp - 0x2f8], 0xf5e3d1aa
jae 0x1004f500
mov dword [ebp - 0x300], 1
jmp 0x1004f507
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x300], eax
je 0x1004f521
mov dword [ebp - 0x15c], 1
jmp 0x1004f528
and dword [ebp - 0x15c], 0
cmp dword [ebp - 0x15c], 0x95e04a27
jbe 0x1004f540
mov dword [ebp - 0x164], 1
jmp 0x1004f547
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x164]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xac]
jg 0x1004f56c
jmp 0x1004f3d6
mov dword [ebp - 0x84], 0
jmp 0x1004f99e
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xffffffeb
jg 0x1004f9bd
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x1004f9bb
push 1
call fcn.1004c5e3
pop ecx
jmp 0x1004f991
cmp dword [ebp - 0x4d4], 0
je 0x1004f9da
push 3
push dword [ebp - 0x4cc]
push dword [ebp - 0x4d0]
call dword [ebp - 0x4d4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret