Function at 0x40129e
Capabilities:
Check os version
Get graphical window text
Get keyboard layout
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2034
call fcn.0049c580
push esi
push edi
mov dword [ebp - 0x2f4], 1
mov dword [ebp - 0x190c], 0xfffffffe
mov dword [ebp - 0x1874], 0xe87f6fb8
mov dword [ebp - 0x187c], 0xed7c6ae4
mov dword [ebp - 0x1884], 0x403ca955
mov dword [ebp - 0x188c], 7
mov dword [ebp - 0x2f4], 0xfffffff9
jmp 0x401302
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0xb
je 0x401512
push 2
lea ecx, [ebp - 0x14ac]
call fcn.0040fd61
mov dword [ebp - 0x1894], 0xfffffffc
mov dword [ebp - 0x189c], 0xdc6b79df
mov dword [ebp - 0x18a4], 0
mov dword [ebp - 0x18ac], 0xdd8fb8ce
mov dword [ebp - 0x418], 0
jmp 0x40135d
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 2
jge 0x40137f
push dword [ebp - 0x418]
lea ecx, [ebp - 0x14ac]
call fcn.0040fe4f
mov dword [eax], 0x6d444182
jmp 0x401350
push 1
lea ecx, [ebp - 0x14ac]
call fcn.0040fe4f
mov dword [eax], 0xc
jmp 0x4013b8
push 1
lea ecx, [ebp - 0x14ac]
call fcn.0040fe4f
mov dword [ebp - 0x978], eax
mov eax, dword [ebp - 0x978]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x978]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x14ac]
call fcn.0040fe4f
cmp dword [eax], 0xfffffff8
jne 0x401502
mov dword [ebp - 0x270], 9
mov dword [ebp - 0x18b4], 0xfffffff7
push 4
lea ecx, [ebp - 0x1740]
call fcn.0040fd61
mov dword [ebp - 0x2fc], 0
jmp 0x401408
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 4
jge 0x40142a
push dword [ebp - 0x2fc]
lea ecx, [ebp - 0x1740]
call fcn.0040fe4f
mov dword [eax], 0xfffffffe
jmp 0x4013fb
cmp dword [ebp - 0x270], 0
je 0x401443
lea ecx, [ebp - 0x1740]
call fcn.0040fe33
jmp 0x401502
mov dword [ebp - 0x270], 0xffffffee
jmp 0x40145c
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0x31
jne 0x4014f2
push 4
lea ecx, [ebp - 0x1bd4]
call fcn.0040fd61
mov dword [ebp - 0x1068], 0xe7790660
mov dword [ebp - 0x41c], 0
jmp 0x401499
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 4
jge 0x4014bb
push dword [ebp - 0x41c]
lea ecx, [ebp - 0x1bd4]
call fcn.0040fe4f
mov dword [eax], 0x5f5f996f
jmp 0x40148c
mov eax, dword [ebp - 0x1068]
inc eax
mov dword [ebp - 0x1068], eax
mov byte [ebp - 0x20b], 0
movzx eax, byte [ebp - 0x20b]
test eax, eax
je 0x4014e2
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ecx, [ebp - 0x1bd4]
call fcn.0040fe33
jmp 0x40144f
lea ecx, [ebp - 0x1740]
call fcn.0040fe33
jmp 0x401394
lea ecx, [ebp - 0x14ac]
call fcn.0040fe33
jmp 0x4012f5
mov dword [ebp - 0x1090], 4
mov dword [ebp - 0x1370], 0xe0d1
mov dword [ebp - 0x1378], 0x748dc164
mov dword [ebp - 0x1368], 0x2f34e401
mov dword [ebp - 0x668], 6
mov dword [ebp - 0x1098], 0xfff9
mov dword [ebp - 0x1380], 0xfffffff8
mov dword [ebp - 0x304], 0
jmp 0x401571
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 4
jge 0x40158d
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0x1f6c], 0x5eb20068
jmp 0x401564
cmp dword [ebp - 0x1090], 0
je 0x401602
cmp dword [ebp - 0x1378], 0xfffffff6
jge 0x4015ab
mov dword [ebp - 0x1070], 1
jmp 0x4015b2
and dword [ebp - 0x1070], 0
mov eax, dword [ebp - 0x1368]
add eax, dword [ebp - 0x1070]
cmp eax, 0x380a
jg 0x4015d1
mov dword [ebp - 0x1078], 1
jmp 0x4015d8
and dword [ebp - 0x1078], 0
imul eax, dword [ebp - 0x668], 0
mov ecx, dword [ebp - 0x1078]
mov edx, dword [ebp - 0x668]
dec edx
mov dword [ebp - 0x668], edx
cmp eax, ecx
jle 0x401602
mov dword [ebp - 0x1080], 1
jmp 0x401609
and dword [ebp - 0x1080], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f6c]
add eax, dword [ebp - 0x1080]
jne 0x40162b
xor eax, eax
jne 0x40162b
and dword [ebp - 0x1088], 0
jmp 0x401635
mov dword [ebp - 0x1088], 1
mov eax, dword [ebp - 0x1088]
mov dword [ebp - 0x1098], eax
mov eax, dword [ebp - 0x1090]
cmp dword [ebp - 0x1098], eax
jge 0x40165b
mov dword [ebp - 0x10a0], 1
jmp 0x401662
and dword [ebp - 0x10a0], 0
mov eax, dword [ebp - 0x1370]
cmp dword [ebp - 0x10a0], eax
jge 0x40167c
mov dword [ebp - 0x120c], 1
jmp 0x401683
and dword [ebp - 0x120c], 0
mov dword [ebp - 0x1380], 0xdd3610cb
mov dword [ebp - 0x42c], 1
mov dword [ebp - 0x18bc], 0xfffffffe
mov dword [ebp - 0x138], 0xb9f9b31
mov dword [ebp - 0x18c4], 0x85ffff32
mov dword [ebp - 0x13a0], 0xffffffff
mov dword [ebp - 0x18cc], 0x975a1448
mov dword [ebp - 0x18d4], 0x2cac2457
mov dword [ebp - 0x1398], 0xbdbb389e
mov dword [ebp - 0x138], 0
jmp 0x4016f6
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 6
jle 0x401c17
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x18dc], 0xffffffff
mov dword [ebp - 0x18e4], 0xd2c643d4
mov dword [ebp - 0x19c4], 0xffffffff
mov dword [ebp - 0xa8], 0
jmp 0x401744
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x401760
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x15d4], 1
jmp 0x401737
mov dword [ebp - 0xa8], 0
jmp 0x401779
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x401795
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x1e40], 0xc86797b6
jmp 0x40176c
mov dword [ebp - 0x178], 0xffffffe3
jmp 0x4017ae
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xfffffff5
jg 0x401c12
push 2
lea ecx, [ebp - 0x11e4]
call fcn.0040fd61
mov dword [ebp - 0xb0], 8
mov dword [ebp - 0x4b0], 0xea311c3f
mov dword [ebp - 0x10e0], 1
mov dword [ebp - 0x56c], 0xfff9
mov dword [ebp - 0xf4], 0
jmp 0x401809
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x40182b
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x11e4]
call fcn.0040fe4f
mov dword [eax], 0xf6dd
jmp 0x4017fc
mov dword [ebp - 0xf4], 0
jmp 0x401844
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 3
jge 0x401860
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x1be4], 1
jmp 0x401837
mov dword [ebp - 0xb0], 1
jmp 0x401879
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x401a36
mov dword [ebp - 0x10d8], 0xffff
mov dword [ebp - 0x1388], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x19cc], eax
mov dword [ebp - 0x4b0], 1
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x4b0], eax
jne 0x4018ca
mov dword [ebp - 0x10a8], 1
jmp 0x4018d1
and dword [ebp - 0x10a8], 0
cmp dword [ebp - 0x10a8], 0x52a42bbd
jge 0x4018e9
mov dword [ebp - 0x10b0], 1
jmp 0x4018f0
and dword [ebp - 0x10b0], 0
cmp dword [ebp - 0x10b0], 0xfffffffa
jae 0x401905
mov dword [ebp - 0x10b8], 1
jmp 0x40190c
and dword [ebp - 0x10b8], 0
mov eax, dword [ebp - 0x10b8]
sub eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x10d8]
jne 0x40192c
mov dword [ebp - 0x10c0], 1
jmp 0x401933
and dword [ebp - 0x10c0], 0
mov eax, dword [ebp - 0x138]
sub eax, dword [ebp - 0x10c0]
cmp eax, dword [ebp - 0x178]
jg 0x401953
mov dword [ebp - 0x10c8], 1
jmp 0x40195a
and dword [ebp - 0x10c8], 0
cmp dword [ebp - 0x10c8], 0xa3205f5
je 0x401972
mov dword [ebp - 0x10d0], 1
jmp 0x401979
and dword [ebp - 0x10d0], 0
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x11e4]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x10d0]
add ecx, dword [eax]
mov dword [ebp - 0x10e0], ecx
mov esi, dword [ebp - 0x10d8]
add esi, dword [ebp - 0x10e0]
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x11e4]
call fcn.0040fe4f
cmp dword [eax], esi
jne 0x4019d2
mov eax, 0xa198
test eax, eax
jne 0x4019d2
push 8
pop eax
test eax, eax
jne 0x4019d2
and dword [ebp - 0x117c], 0
jmp 0x4019dc
mov dword [ebp - 0x117c], 1
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x117c], eax
jle 0x4019f6
mov dword [ebp - 0xffc], 1
jmp 0x4019fd
and dword [ebp - 0xffc], 0
mov eax, dword [ebp - 0xffc]
mov dword [ebp - 0x1388], eax
mov byte [ebp - 0x215], 0
movzx eax, byte [ebp - 0x215]
test eax, eax
je 0x401a31
push 0
push 0
push 0x22fe
push 0x1731
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
jmp 0x40186c
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x19d4], eax
mov eax, dword [ebp - 0x56c]
dec eax
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x4b0]
imul eax, dword [ebp - 0x56c]
mov dword [ebp - 0xb0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x15d4]
cmp dword [ebp - 0xb0], eax
jle 0x401a83
mov dword [ebp - 0x1060], 1
jmp 0x401a8a
and dword [ebp - 0x1060], 0
cmp dword [ebp - 0x1060], 0x1cd4
jl 0x401aa2
mov dword [ebp - 0x6c0], 1
jmp 0x401aa9
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x6c0]
je 0x401ac3
mov dword [ebp - 0x6b4], 1
jmp 0x401aca
and dword [ebp - 0x6b4], 0
push 0
lea ecx, [ebp - 0x11e4]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x6b4]
cmp ecx, dword [eax]
jle 0x401aed
mov dword [ebp - 0x5ec], 1
jmp 0x401af4
and dword [ebp - 0x5ec], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5ec]
mov dword [ebp + eax - 0x1e40], ecx
push 0
lea ecx, [ebp - 0x11e4]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x5ec]
cmp ecx, dword [eax]
je 0x401b29
mov dword [ebp - 0x1390], 1
jmp 0x401b30
and dword [ebp - 0x1390], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1be4]
mov dword [ebp - 0x19dc], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1be4]
cmp dword [ebp + eax - 0x15d4], ecx
je 0x401b6a
mov dword [ebp - 0xc04], 1
jmp 0x401b71
and dword [ebp - 0xc04], 0
mov eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0xc04], eax
jl 0x401b8b
mov dword [ebp - 0x6bc], 1
jmp 0x401b92
and dword [ebp - 0x6bc], 0
cmp dword [ebp - 0x6bc], 0xdf100f83
jae 0x401baa
mov dword [ebp - 0xeac], 1
jmp 0x401bb1
and dword [ebp - 0xeac], 0
mov eax, dword [ebp - 0xeac]
add eax, 0x6cdf50b9
jne 0x401bd0
cmp dword [ebp - 0x1398], 0
jne 0x401bd0
and dword [ebp - 0x6c4], 0
jmp 0x401bda
mov dword [ebp - 0x6c4], 1
cmp dword [ebp - 0x6c4], 9
jge 0x401bef
mov dword [ebp - 0xc0c], 1
jmp 0x401bf6
and dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0x13a0], eax
lea ecx, [ebp - 0x11e4]
call fcn.0040fe33
jmp 0x4017a1
jmp 0x4016e9
mov dword [ebp - 0x19e4], 0xe87f6fb8
mov dword [ebp - 0x6cc], 5
mov dword [ebp - 0x30c], 0
jmp 0x401c44
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 1
jge 0x401c60
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0x19ec], 0xfffffff6
jmp 0x401c37
mov byte [ebp - 0x148], 0
movzx eax, byte [ebp - 0x148]
test eax, eax
je 0x401c89
push 0xdeb
push 0x344
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
mov eax, dword [ebp - 0x6cc]
dec eax
mov dword [ebp - 0x6cc], eax
mov dword [ebp - 0x19f4], 0xed7c6ae4
mov dword [ebp - 0x19fc], 0x403ca955
mov dword [ebp - 0x314], 0xb8ee41b
mov dword [ebp - 0x13dc], 0xe022
mov dword [ebp - 0x13e4], 0
mov dword [ebp - 0x1a04], 0xadfb
mov dword [ebp - 0x424], 0
jmp 0x401ceb
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 2
jge 0x401d07
mov eax, dword [ebp - 0x424]
mov dword [ebp + eax*4 - 0x670], 0xffff
jmp 0x401cde
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x670], 0
je 0x401d2c
mov eax, 0xfff60009
test eax, eax
je 0x401d2c
mov dword [ebp - 0x1114], 1
jmp 0x401d33
and dword [ebp - 0x1114], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x670]
add eax, dword [ebp - 0x1114]
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x314], 0xa22e974a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x670]
mov dword [ebp - 0x1a0c], eax
mov eax, dword [ebp - 0x13dc]
mov dword [ebp - 0x1a14], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x670]
mov dword [ebp - 0x1a1c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x670]
mov dword [ebp - 0x1a24], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x670]
mov dword [ebp - 0x1a2c], eax
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x1a34], eax
cmp dword [ebp - 0x314], 1
jle 0x401dcf
mov dword [ebp - 0x6d4], 1
jmp 0x401dd6
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
add eax, 0xad85
mov dword [ebp - 0x13e4], eax
mov dword [ebp - 0x1a3c], 7
mov dword [ebp - 0x2a0], 1
mov dword [ebp - 0x574], 0
mov dword [ebp - 0x638], 0x7ab61b58
mov dword [ebp - 0x1a44], 0
mov dword [ebp - 0x140c], 0xcae2fe81
mov dword [ebp - 0xc24], 0xfffffffe
mov dword [ebp - 0x31c], 0xbc1c234a
mov dword [ebp - 0x2a0], 0xffffffe4
jmp 0x401e50
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0xffffffe9
je 0x401ee7
mov dword [ebp - 0x13ec], 0xeb905d09
push 2
lea ecx, [ebp - 0x1590]
call fcn.0040fd61
mov dword [ebp - 0x4ac], 0
jmp 0x401e8d
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 2
jge 0x401eaf
push dword [ebp - 0x4ac]
lea ecx, [ebp - 0x1590]
call fcn.0040fe4f
mov dword [eax], 0x111738ab
jmp 0x401e80
mov esi, dword [ebp - 0x13ec]
push 1
lea ecx, [ebp - 0x1590]
call fcn.0040fe4f
mov dword [eax], esi
push 1
lea ecx, [ebp - 0x1590]
call fcn.0040fe4f
mov dword [eax], 0xd2e8588d
lea ecx, [ebp - 0x1590]
call fcn.0040fe33
jmp 0x401e43
cmp dword [ebp - 0x574], 0x71bc7dcd
jne 0x401eff
mov dword [ebp - 0xc14], 1
jmp 0x401f06
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x2a0]
cmp dword [ebp - 0xc14], eax
jne 0x401f20
mov dword [ebp - 0x1004], 1
jmp 0x401f27
and dword [ebp - 0x1004], 0
cmp dword [ebp - 0x574], 4
je 0x401f3c
mov dword [ebp - 0x6dc], 1
jmp 0x401f43
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0xc24]
cmp dword [ebp - 0x6dc], eax
je 0x401f5d
mov dword [ebp - 0xeb4], 1
jmp 0x401f64
and dword [ebp - 0xeb4], 0
cmp dword [ebp - 0xeb4], 1
ja 0x401f79
mov dword [ebp - 0x6e4], 1
jmp 0x401f80
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x31c]
cmp eax, dword [ebp - 0x6e4]
jl 0x401fa7
mov dword [ebp - 0x13f4], 1
jmp 0x401fae
and dword [ebp - 0x13f4], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x1a4c], eax
cmp dword [ebp - 0x31c], 0xfffffffd
jne 0x401fcf
mov dword [ebp - 0xc1c], 1
jmp 0x401fd6
and dword [ebp - 0xc1c], 0
cmp dword [ebp - 0xc1c], 0x6446bd29
jne 0x401fee
mov dword [ebp - 0x6ec], 1
jmp 0x401ff5
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x13fc], eax
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x1404], eax
mov eax, dword [ebp - 0x638]
dec eax
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x13fc]
cmp eax, dword [ebp - 0x1404]
jge 0x402034
mov dword [ebp - 0x6f4], 1
jmp 0x40203b
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x1004]
sub eax, dword [ebp - 0x6f4]
add eax, dword [ebp - 0x140c]
mov dword [ebp - 0xc24], eax
mov dword [ebp - 0x42c], 0xfffffff9
jmp 0x40206c
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0xb
je 0x4040cf
push 4
lea ecx, [ebp - 0x1c04]
call fcn.0040fd61
mov dword [ebp - 0x324], 0xffffffff
mov dword [ebp - 0x1a54], 0x4f2887cf
mov dword [ebp - 0x1a5c], 0xfffffffc
mov dword [ebp - 0x1a64], 0xe1c97412
mov dword [ebp - 0x1a6c], 0xffffffff
mov dword [ebp - 0x1a74], 4
mov dword [ebp - 0x1a7c], 0xccc89593
mov dword [ebp - 0x1a84], 0xffffffff
mov dword [ebp - 0x1a8c], 0x289fff12
mov dword [ebp - 0x1a94], 0x466e9f08
mov dword [ebp - 0x6fc], 1
mov dword [ebp - 0xd8], 0
jmp 0x40210d
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 4
jge 0x40212f
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x1c04]
call fcn.0040fe4f
mov dword [eax], 0x4826
jmp 0x402100
mov dword [ebp - 0xd8], 0
jmp 0x402148
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x402164
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x1e9c], 1
jmp 0x40213b
mov byte [ebp - 0x1a9], 0
movzx eax, byte [ebp - 0x1a9]
test eax, eax
je 0x402183
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
mov dword [ebp - 0x324], 3
jmp 0x40219c
mov eax, dword [ebp - 0x324]
dec eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
jl 0x402243
mov dword [ebp - 0x1a9c], 0xfffffffb
push 3
lea ecx, [ebp - 0x1bf4]
call fcn.0040fd61
mov dword [ebp - 0x504], 0
jmp 0x4021d9
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 3
jge 0x4021fb
push dword [ebp - 0x504]
lea ecx, [ebp - 0x1bf4]
call fcn.0040fe4f
mov dword [eax], 0xfffffffa
jmp 0x4021cc
mov byte [ebp - 0x14a], 0
movzx eax, byte [ebp - 0x14a]
test eax, eax
je 0x402226
push 0x9f4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
mov eax, dword [ebp - 0x6fc]
dec eax
mov dword [ebp - 0x6fc], eax
lea ecx, [ebp - 0x1bf4]
call fcn.0040fe33
jmp 0x40218f
lea ecx, [ebp - 0x1c04]
call fcn.0040fe33
push 2
lea ecx, [ebp - 0x14dc]
call fcn.0040fd61
mov dword [ebp - 0x1aa4], 0xfffffffc
mov dword [ebp - 0x11d8], 0xa5d6c05b
mov dword [ebp - 0x11d4], 0xa5d6c05b
mov dword [ebp - 0x11d0], 0xa5d6c05b
mov dword [ebp - 0x11cc], 0xa5d6c05b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x11d8], 0
jmp 0x4022bb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x11d8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x11d8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x11d8], 0xfffffff0
jle 0x402376
mov dword [ebp - 0x180], 0x6f5a9c4c
mov dword [ebp - 0x704], 0
mov dword [ebp - 0x180], 0
jmp 0x4022fc
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xffffffe3
jl 0x40235e
mov dword [ebp - 0xebc], 0x65720b96
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x1aac], eax
mov eax, dword [ebp - 0xebc]
mov dword [ebp - 0x1ab4], eax
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0x1abc], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x1ac4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x11d8]
sub eax, 0x3bd6525
sub eax, dword [ebp - 0x180]
mov dword [ebp - 0xebc], eax
jmp 0x4022ef
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x11d8]
mov dword [ebp - 0x704], eax
jmp 0x4022a0
mov dword [ebp - 0x1acc], 0xdc6b79df
mov dword [ebp - 0x120], 0xfffffff9
mov dword [ebp - 0x724], 0xd9964974
mov dword [ebp - 0x32c], 0
jmp 0x4023ad
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 2
jge 0x4023c9
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0x18f0], 0xa7c6dd3
jmp 0x4023a0
mov byte [ebp - 0x20d], 0
movzx eax, byte [ebp - 0x20d]
test eax, eax
je 0x4023f2
push 0x421
push 0x452
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [ebp - 0x120], 0x383c
jl 0x40240a
mov dword [ebp - 0x70c], 1
jmp 0x402411
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x120], eax
je 0x40242b
mov dword [ebp - 0xc2c], 1
jmp 0x402432
and dword [ebp - 0xc2c], 0
cmp dword [ebp - 0xc2c], 0xe071
je 0x402450
mov eax, 0xd7af2c9a
test eax, eax
jne 0x402450
and dword [ebp - 0x10ac], 0
jmp 0x40245a
mov dword [ebp - 0x10ac], 1
mov eax, dword [ebp - 0x70c]
add eax, dword [ebp - 0x10ac]
cmp eax, dword [ebp - 0x120]
je 0x40247a
mov dword [ebp - 0x714], 1
jmp 0x402481
and dword [ebp - 0x714], 0
cmp dword [ebp - 0x120], 0
je 0x40249b
or eax, 0xffffffff
je 0x40249b
mov dword [ebp - 0xc34], 1
jmp 0x4024a2
and dword [ebp - 0xc34], 0
cmp dword [ebp - 0xc34], 0xb91e
jl 0x4024ba
mov dword [ebp - 0x71c], 1
jmp 0x4024c1
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x71c], eax
jle 0x4024db
mov dword [ebp - 0xec4], 1
jmp 0x4024e2
and dword [ebp - 0xec4], 0
mov eax, dword [ebp - 0xec4]
mov dword [ebp - 0x724], eax
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x1ad4], eax
cmp dword [ebp - 0x120], 1
je 0x40250f
mov dword [ebp - 0xc3c], 1
jmp 0x402516
and dword [ebp - 0xc3c], 0
mov eax, dword [ebp - 0xc3c]
shl eax, 1
jne 0x402532
cmp dword [ebp - 0x120], 0
jne 0x402532
and dword [ebp - 0x72c], 0
jmp 0x40253c
mov dword [ebp - 0x72c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x72c]
mov dword [ebp + eax - 0x18f0], ecx
mov dword [ebp - 0x1adc], 0
mov dword [ebp - 0x21c], 0xfffffffc
mov dword [ebp - 0xc44], 0xf2e5664d
mov dword [ebp - 0x21c], 0xfffffffc
jmp 0x402586
mov eax, dword [ebp - 0x21c]
dec eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xfffffffa
jne 0x402604
mov dword [ebp - 0x100c], 0x45db
mov byte [ebp - 0x14c], 0
movzx eax, byte [ebp - 0x14c]
test eax, eax
je 0x4025c2
push 0x421
push 0x452
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
je 0x4025ec
cmp dword [ebp - 0x21c], 0
je 0x4025ec
mov dword [ebp - 0x734], 1
jmp 0x4025f3
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0xc44], eax
jmp 0x402579
mov dword [ebp - 0xc44], 0x7e4fc22
mov dword [ebp - 0x1ae4], 0xdd8fb8ce
mov dword [ebp - 0x80], 0x2db58e46
mov dword [ebp - 0xc], 0x7ad95e17
mov dword [ebp - 0x142c], 0xff5f6f59
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x80], 0
jmp 0x402646
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xfffffff3
je 0x402ad2
mov dword [ebp - 0xb8], 0xd72b
mov dword [ebp - 0x1178], 0x44fa7555
mov dword [ebp - 0x434], 0
jmp 0x40267d
mov eax, dword [ebp - 0x434]
inc eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 2
jge 0x402699
mov eax, dword [ebp - 0x434]
mov dword [ebp + eax*4 - 0x260], 0xb143e95a
jmp 0x402670
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x260]
cmp dword [ebp + eax - 0x260], ecx
je 0x4026c1
mov dword [ebp - 0x1414], 1
jmp 0x4026c8
and dword [ebp - 0x1414], 0
mov eax, 0xa22e
test eax, eax
je 0x4026e3
cmp dword [ebp - 0x80], 0
je 0x4026e3
mov dword [ebp - 0x73c], 1
jmp 0x4026ea
and dword [ebp - 0x73c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x260]
cmp dword [ebp - 0x73c], eax
jge 0x40270b
mov dword [ebp - 0xecc], 1
jmp 0x402712
and dword [ebp - 0xecc], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0xecc]
jl 0x40272f
mov dword [ebp - 0x141c], 1
jmp 0x402736
and dword [ebp - 0x141c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x260]
add eax, dword [ebp - 0x80]
je 0x40275b
cmp dword [ebp - 0xb8], 0
je 0x402756
jmp 0x402ad2
jmp 0x402acd
mov dword [ebp - 0x57c], 0x8317d239
cmp dword [ebp - 0xc], 0
je 0x402770
jmp 0x402ad2
mov dword [ebp - 0xb8], 0
jmp 0x402789
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jg 0x402acd
push 2
lea ecx, [ebp - 0x14bc]
call fcn.0040fd61
mov dword [ebp - 0xc5c], 0xfffffffb
mov dword [ebp - 0x334], 0
jmp 0x4027c6
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 2
jge 0x4027e8
push dword [ebp - 0x334]
lea ecx, [ebp - 0x14bc]
call fcn.0040fe4f
mov dword [eax], 0x208dd2dc
jmp 0x4027b9
mov dword [ebp - 0xc], 0
jmp 0x4027f8
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jg 0x402abd
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x1aec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x260], 0
je 0x402830
cmp dword [ebp - 0x80], 0
je 0x402830
mov dword [ebp - 0x744], 1
jmp 0x402837
and dword [ebp - 0x744], 0
cmp dword [ebp - 0x744], 0x36042c8c
je 0x40284f
mov dword [ebp - 0xc4c], 1
jmp 0x402856
and dword [ebp - 0xc4c], 0
imul eax, dword [ebp - 0xc4c], 0xfffffff6
cmp dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x80], eax
jne 0x40287f
or eax, 0xffffffff
je 0x40287f
mov dword [ebp - 0x74c], 1
jmp 0x402886
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x1178], eax
cmp dword [ebp - 0x1178], 0x2bba6dad
jle 0x4028aa
mov dword [ebp - 0x754], 1
jmp 0x4028b1
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x754], eax
jl 0x4028cb
mov dword [ebp - 0xc54], 1
jmp 0x4028d2
and dword [ebp - 0xc54], 0
cmp dword [ebp - 0xc54], 0x8d81c919
jne 0x4028ea
mov dword [ebp - 0x75c], 1
jmp 0x4028f1
and dword [ebp - 0x75c], 0
push 0
lea ecx, [ebp - 0x14bc]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x75c]
add ecx, dword [eax]
jne 0x402918
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x402918
and dword [ebp - 0xed4], 0
jmp 0x402922
mov dword [ebp - 0xed4], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x260]
cmp eax, dword [ebp - 0xed4]
je 0x402940
mov dword [ebp - 0x1424], 1
jmp 0x402947
and dword [ebp - 0x1424], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x260]
mov dword [ebp - 0x1af4], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x260]
mov dword [ebp - 0x1afc], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x1b04], eax
mov eax, 0x9b20
cmp eax, 0x5c0
jg 0x40299a
or eax, 0xffffffff
je 0x40299a
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x260], 0
je 0x40299a
mov dword [ebp - 0x764], 1
jmp 0x4029a1
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x764]
mov dword [ebp - 0xc5c], eax
mov eax, dword [ebp - 0xc5c]
mov dword [ebp - 0x1b0c], eax
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp + eax*4 - 0x260]
push 0
lea ecx, [ebp - 0x14bc]
call fcn.0040fe4f
sub esi, dword [eax]
cmp esi, dword [ebp - 0x57c]
jne 0x4029e9
mov dword [ebp - 0x76c], 1
jmp 0x4029f0
and dword [ebp - 0x76c], 0
cmp dword [ebp - 0x76c], 0xc65b0b56
jbe 0x402a08
mov dword [ebp - 0x1014], 1
jmp 0x402a0f
and dword [ebp - 0x1014], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1014]
mov dword [ebp + eax*4 - 0x260], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x260]
imul eax, dword [ebp - 0xb8]
test eax, eax
je 0x402a55
push 0
lea ecx, [ebp - 0x14bc]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x402a55
mov dword [ebp - 0x774], 1
jmp 0x402a5c
and dword [ebp - 0x774], 0
cmp dword [ebp - 0x774], 0x7a312446
je 0x402a74
mov dword [ebp - 0xc64], 1
jmp 0x402a7b
and dword [ebp - 0xc64], 0
mov eax, dword [ebp - 0xc64]
sub eax, 0xcc39
mov dword [ebp - 0x142c], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x260], 0
jne 0x402aa5
mov dword [ebp - 0x77c], 1
jmp 0x402aac
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x57c], eax
jmp 0x4027f1
lea ecx, [ebp - 0x14bc]
call fcn.0040fe33
jmp 0x40277c
jmp 0x40263f
mov dword [ebp - 0x4b4], 0
jmp 0x402aeb
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 2
jge 0x402b0d
push dword [ebp - 0x4b4]
lea ecx, [ebp - 0x14dc]
call fcn.0040fe4f
mov dword [eax], 0x6d444182
jmp 0x402ade
mov dword [ebp - 0x33c], 0xfd3df75d
mov dword [ebp - 0x1680], 5
mov dword [ebp - 0x167c], 5
mov dword [ebp - 0x1678], 5
mov dword [ebp - 0x1674], 5
lea ecx, [ebp - 0x65d]
call fcn.0040fe5e
push eax
lea eax, [ebp - 0x1670]
push eax
lea eax, [ebp - 0x1680]
push eax
lea ecx, [ebp - 0x1f74]
call fcn.0040fe61
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1c14]
call fcn.0040fe0d
mov dword [ebp - 0x33c], 0
jmp 0x402b8d
mov eax, dword [ebp - 0x33c]
dec eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0xffffffe8
jle 0x402bf9
mov dword [ebp - 0x278], 0xffffffff
mov dword [ebp - 0x278], 0
jmp 0x402bb9
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 4
jge 0x402bdb
push dword [ebp - 0x278]
lea ecx, [ebp - 0x1c14]
call fcn.0040fe4f
mov dword [eax], 0x937a3a11
jmp 0x402bac
mov byte [ebp - 0x20f], 0
movzx eax, byte [ebp - 0x20f]
test eax, eax
je 0x402bf7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x402b80
lea ecx, [ebp - 0x1c14]
call fcn.0040fe33
push 1
lea ecx, [ebp - 0x14dc]
call fcn.0040fe4f
mov dword [eax], 0xc
jmp 0x402c3d
push 1
lea ecx, [ebp - 0x14dc]
call fcn.0040fe4f
mov dword [ebp - 0xedc], eax
mov eax, dword [ebp - 0xedc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xedc]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x14dc]
call fcn.0040fe4f
cmp dword [eax], 0xfffffff8
jne 0x4040bf
push 2
lea ecx, [ebp - 0x1c24]
call fcn.0040fd61
mov dword [ebp - 0x43c], 0xeef20fe6
mov dword [ebp - 0x1b14], 0xad4351cd
mov dword [ebp - 0xe0], 0
jmp 0x402c8d
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jge 0x402caf
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x1c24]
call fcn.0040fe4f
mov dword [eax], 0x571177e8
jmp 0x402c80
mov dword [ebp - 0xe0], 0
jmp 0x402cc8
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 4
jge 0x402ce4
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x1ff4], 3
jmp 0x402cbb
mov dword [ebp - 0x43c], 0
jmp 0x402cfd
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 1
jg 0x402d1f
mov dword [ebp - 0x784], 0xffffffff
mov eax, dword [ebp - 0x784]
inc eax
mov dword [ebp - 0x784], eax
jmp 0x402cf0
lea ecx, [ebp - 0x1c24]
call fcn.0040fe33
mov dword [ebp - 0x2b8], 9
mov dword [ebp - 0x1b1c], 0xfffffff7
mov dword [ebp - 0xc6c], 1
mov dword [ebp - 0x344], 0
jmp 0x402d61
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 2
jge 0x402d7d
mov eax, dword [ebp - 0x344]
mov dword [ebp + eax*4 - 0x1ee4], 0x58e469ad
jmp 0x402d54
mov byte [ebp - 0x1b1], 0
movzx eax, byte [ebp - 0x1b1]
test eax, eax
je 0x402da5
push 0
push 0x15c9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp - 0xc6c]
inc eax
mov dword [ebp - 0xc6c], eax
push 4
lea ecx, [ebp - 0x1758]
call fcn.0040fd61
mov dword [ebp - 0x1b24], 0x2135
mov dword [ebp - 0x1b2c], 0xffffffff
mov dword [ebp - 0x1b34], 2
mov dword [ebp - 0x78c], 0xfffffffc
mov eax, dword [ebp - 0x78c]
dec eax
mov dword [ebp - 0x78c], eax
mov byte [ebp - 0x14e], 0
movzx eax, byte [ebp - 0x14e]
test eax, eax
je 0x402e18
push 0x25bb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0x4ec], 0
jmp 0x402e31
mov eax, dword [ebp - 0x4ec]
inc eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 4
jge 0x402e53
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x1758]
call fcn.0040fe4f
mov dword [eax], 0xfffffffe
jmp 0x402e24
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34c], 0xfffffff7
push 3
lea ecx, [ebp - 0x10f0]
call fcn.0040fd61
mov dword [ebp - 0x5f4], 4
push 4
lea ecx, [ebp - 0x1194]
call fcn.0040fd61
mov dword [ebp - 0x44], 0xda972737
mov dword [ebp - 0x144c], 0x320ba2c1
mov dword [ebp - 0x34], 0
jmp 0x402ea9
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x402ec5
push dword [ebp - 0x34]
lea ecx, [ebp - 0x10f0]
call fcn.0040fe4f
mov dword [eax], 0x9ba8
jmp 0x402ea2
mov dword [ebp - 0x34], 0
jmp 0x402ed5
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x402ef1
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1194]
call fcn.0040fe4f
mov dword [eax], 0xa9f4f9a0
jmp 0x402ece
mov dword [ebp - 0x34], 0
jmp 0x402f01
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x402f17
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1f0c], 0xffffffff
jmp 0x402efa
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1b3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1b44], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1b4c], eax
xor eax, eax
inc eax
imul eax, eax, 0x9637
test eax, eax
je 0x402f51
cmp dword [ebp - 0x2c], 0
je 0x402f51
mov dword [ebp - 0x10b4], 1
jmp 0x402f58
and dword [ebp - 0x10b4], 0
mov eax, dword [ebp - 0x10b4]
sub eax, 0x2728
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x1b54], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1b5c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1b64], eax
cmp dword [ebp - 0x2c], 0x9ba0
je 0x402f9c
mov dword [ebp - 0x794], 1
jmp 0x402fa3
and dword [ebp - 0x794], 0
push 1
lea ecx, [ebp - 0x10f0]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x794]
cmp ecx, dword [eax]
jg 0x402fc6
mov dword [ebp - 0x1434], 1
jmp 0x402fcd
and dword [ebp - 0x1434], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x402fe1
mov dword [ebp - 0xc74], 1
jmp 0x402fe8
and dword [ebp - 0xc74], 0
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x1b6c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1b74], eax
push 3
lea ecx, [ebp - 0x1194]
call fcn.0040fe4f
mov esi, eax
push 3
lea ecx, [ebp - 0x1194]
call fcn.0040fe4f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x403037
mov dword [ebp - 0x79c], 1
jmp 0x40303e
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x2c], 0
jmp 0x403057
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x40321a
mov dword [ebp - 0xc84], 0xffffffff
mov dword [ebp - 0x143c], 0
mov dword [ebp - 0x1444], 5
mov dword [ebp - 0x44], 2
jmp 0x40308f
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x403215
push dword [ebp - 0x44]
lea ecx, [ebp - 0x10f0]
call fcn.0040fe4f
push dword [ebp - 0x44]
lea ecx, [ebp - 0x10f0]
call fcn.0040fe4f
cmp dword [ebp - 0x34c], 0xffffffff
je 0x4030ca
mov dword [ebp - 0xee4], 1
jmp 0x4030d1
and dword [ebp - 0xee4], 0
cmp dword [ebp - 0xee4], 0
jne 0x4030e6
mov dword [ebp - 0x7a4], 1
jmp 0x4030ed
and dword [ebp - 0x7a4], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1194]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x7a4]
add ecx, dword [eax]
cmp ecx, 0xffffffff
jle 0x403114
mov dword [ebp - 0xc7c], 1
jmp 0x40311b
and dword [ebp - 0xc7c], 0
mov esi, dword [ebp - 0x44]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x10f0]
call fcn.0040fe4f
mov ecx, dword [ebp - 0xc7c]
add ecx, dword [eax]
imul esi, ecx
cmp esi, 0xffff
je 0x40314b
mov dword [ebp - 0x7ac], 1
jmp 0x403152
and dword [ebp - 0x7ac], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x10f0]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x7ac]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0xc84]
jne 0x40317c
mov dword [ebp - 0x101c], 1
jmp 0x403183
and dword [ebp - 0x101c], 0
cmp dword [ebp - 0x101c], 0
jne 0x403193
cmp dword [ebp - 0x143c], 0
mov eax, dword [ebp - 0x1444]
mov dword [ebp - 0x5f4], eax
mov esi, dword [ebp - 0x5f4]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1194]
call fcn.0040fe4f
cmp dword [eax], esi
jl 0x4031c3
mov dword [ebp - 0x7b4], 1
jmp 0x4031ca
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x144c], eax
mov esi, dword [ebp - 0xc84]
push 1
lea ecx, [ebp - 0x10f0]
call fcn.0040fe4f
add esi, dword [eax]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1f0c], esi
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1194]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x403210
jmp 0x403088
jmp 0x403088
jmp 0x403050
lea ecx, [ebp - 0x1194]
call fcn.0040fe33
lea ecx, [ebp - 0x10f0]
call fcn.0040fe33
cmp dword [ebp - 0x2b8], 0
je 0x403249
lea ecx, [ebp - 0x1758]
call fcn.0040fe33
jmp 0x4040bf
push 1
lea ecx, [ebp - 0x694]
call fcn.0040fd61
mov dword [ebp - 0x224], 0xfffffffa
mov dword [ebp - 0x444], 0
jmp 0x403279
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 1
jge 0x40329b
push dword [ebp - 0x444]
lea ecx, [ebp - 0x694]
call fcn.0040fe4f
mov dword [eax], 0x1c7b
jmp 0x40326c
push 0
lea ecx, [ebp - 0x694]
call fcn.0040fe4f
push 0
lea ecx, [ebp - 0x694]
call fcn.0040fe4f
mov esi, eax
push 0
lea ecx, [ebp - 0x694]
call fcn.0040fe4f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x4032d6
mov dword [ebp - 0x7bc], 1
jmp 0x4032dd
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x7bc]
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x224], 0
jmp 0x403302
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x13
jle 0x4033f8
mov dword [ebp - 0x90], 0xd2086bd0
mov dword [ebp - 0x90], 0
jmp 0x403332
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jg 0x403365
push dword [ebp - 0x90]
lea ecx, [ebp - 0x694]
call fcn.0040fe4f
mov esi, eax
push dword [ebp - 0x90]
lea ecx, [ebp - 0x694]
call fcn.0040fe4f
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x403325
mov eax, dword [ebp - 0x224]
cmp dword [ebp - 0x90], eax
je 0x40337f
mov dword [ebp - 0x1454], 1
jmp 0x403386
and dword [ebp - 0x1454], 0
push 0
lea ecx, [ebp - 0x694]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x4033b6
push 0
lea ecx, [ebp - 0x694]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x4033b6
mov dword [ebp - 0x145c], 1
jmp 0x4033bd
and dword [ebp - 0x145c], 0
cmp dword [ebp - 0x90], 0
je 0x4033db
cmp dword [ebp - 0x90], 0
je 0x4033db
mov dword [ebp - 0xeec], 1
jmp 0x4033e2
and dword [ebp - 0xeec], 0
mov eax, dword [ebp - 0xeec]
sub eax, 0xb0a
mov dword [ebp - 0x90], eax
jmp 0x4032f5
lea ecx, [ebp - 0x694]
call fcn.0040fe33
mov dword [ebp - 0x2b8], 0xffffffee
jmp 0x40341c
cmp dword [ebp - 0x2b8], 0x31
jne 0x4040af
push 4
lea ecx, [ebp - 0x1c74]
call fcn.0040fd61
mov dword [ebp - 0x7ec], 0xe7790660
mov dword [ebp - 0x280], 0
push 4
lea ecx, [ebp - 0x1788]
call fcn.0040fd61
mov dword [ebp - 0x354], 0
jmp 0x403470
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 4
jge 0x403492
push dword [ebp - 0x354]
lea ecx, [ebp - 0x1788]
call fcn.0040fe4f
mov dword [eax], 0xfffffffc
jmp 0x403463
mov esi, dword [ebp - 0x280]
push 1
lea ecx, [ebp - 0x1788]
call fcn.0040fe4f
mov dword [eax], esi
mov dword [ebp - 0x280], 0
jmp 0x4034c0
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
jg 0x4034ec
mov byte [ebp - 0x213], 0
movzx eax, byte [ebp - 0x213]
test eax, eax
je 0x4034ea
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x4034b3
lea ecx, [ebp - 0x1788]
call fcn.0040fe33
mov dword [ebp - 0x2a8], 0xfffffffc
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x608], 0xfffffff9
mov dword [ebp - 0x1464], 0xfba2522a
mov dword [ebp - 0x1b7c], 0xf5a260df
mov dword [ebp - 0x4bc], 0
jmp 0x403542
mov eax, dword [ebp - 0x4bc]
inc eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 2
jge 0x40355e
mov eax, dword [ebp - 0x4bc]
mov dword [ebp + eax*4 - 0x18fc], 9
jmp 0x403535
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x1b84], eax
push 0xfffffffffffffff7
pop eax
sub eax, dword [ebp - 0x188]
cmp eax, dword [ebp - 0x608]
jl 0x403587
mov dword [ebp - 0x584], 1
jmp 0x40358e
and dword [ebp - 0x584], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x584]
mov dword [ebp + eax - 0x18fc], ecx
mov eax, dword [ebp - 0x608]
imul eax, dword [ebp - 0x584]
cmp dword [ebp - 0x2a8], eax
jle 0x4035c2
mov dword [ebp - 0x7c4], 1
jmp 0x4035c9
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x608]
cmp dword [ebp - 0x7c4], eax
jle 0x4035e3
mov dword [ebp - 0xc8c], 1
jmp 0x4035ea
and dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0xc8c], eax
jle 0x40360d
cmp dword [ebp - 0x188], 0
je 0x40360d
mov dword [ebp - 0x7cc], 1
jmp 0x403614
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x7cc], eax
je 0x40362e
mov dword [ebp - 0x1124], 1
jmp 0x403635
and dword [ebp - 0x1124], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x1124], eax
jg 0x40364f
mov dword [ebp - 0x7d4], 1
jmp 0x403656
and dword [ebp - 0x7d4], 0
cmp dword [ebp - 0x7d4], 0x8bff9cf0
jg 0x40366e
mov dword [ebp - 0xc94], 1
jmp 0x403675
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0x188]
imul eax, dword [ebp - 0xc94]
sub eax, 0xdec9
cmp eax, dword [ebp - 0x188]
jge 0x40369b
mov dword [ebp - 0x7dc], 1
jmp 0x4036a2
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x188]
imul eax, dword [ebp - 0x7dc]
cmp eax, dword [ebp - 0x188]
je 0x4036c3
mov dword [ebp - 0xef4], 1
jmp 0x4036ca
and dword [ebp - 0xef4], 0
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0xef4]
jge 0x4036e4
mov dword [ebp - 0x7e4], 1
jmp 0x4036eb
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x1464], eax
mov dword [ebp - 0x35c], 0
jmp 0x403710
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 4
jge 0x403732
push dword [ebp - 0x35c]
lea ecx, [ebp - 0x1c74]
call fcn.0040fe4f
mov dword [eax], 0x5f5f996f
jmp 0x403703
mov dword [ebp - 0x364], 0x1a049fe3
mov dword [ebp - 0x44c], 0
jmp 0x403755
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 1
jge 0x403771
mov eax, dword [ebp - 0x44c]
mov dword [ebp + eax*4 - 0xc9c], 0xffffffff
jmp 0x403748
mov dword [ebp - 0x364], 0
jmp 0x40378a
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0xd
jg 0x40380d
mov dword [ebp - 0x24c], 1
mov dword [ebp - 0x24c], 0
jmp 0x4037b6
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jg 0x403808
mov byte [ebp - 0x150], 0
movzx eax, byte [ebp - 0x150]
test eax, eax
je 0x4037ec
push 0x11ee
push 0
push 0x26ab
push 0x1572
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0x24c]
mov eax, dword [ebp + eax*4 - 0xc9c]
mov dword [ebp + ecx*4 - 0xc9c], eax
jmp 0x4037a9
jmp 0x40377d
mov eax, dword [ebp - 0x7ec]
inc eax
mov dword [ebp - 0x7ec], eax
mov dword [ebp - 0x130], 0x3644
mov dword [ebp - 0x36c], 0x1b713623
mov dword [ebp - 0xefc], 0x806aa1c3
mov dword [ebp - 0x80c], 0x18ebdb8
mov dword [ebp - 0x1b8c], 0
mov dword [ebp - 0x1b94], 0xffffffff
mov dword [ebp - 0x514], 0
jmp 0x40386f
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 4
jge 0x40388b
mov eax, dword [ebp - 0x514]
mov dword [ebp + eax*4 - 0x1fc4], 1
jmp 0x403862
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1b9c], eax
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x130]
lea eax, [eax + ecx + 1]
cmp eax, 1
je 0x4038b8
mov dword [ebp - 0x1024], 1
jmp 0x4038bf
and dword [ebp - 0x1024], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x1024], eax
jle 0x4038d9
mov dword [ebp - 0x7f4], 1
jmp 0x4038e0
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x130]
imul eax, dword [ebp - 0x7f4]
cmp eax, 6
je 0x403904
cmp dword [ebp - 0x36c], 0
jne 0x403904
and dword [ebp - 0xca4], 0
jmp 0x40390e
mov dword [ebp - 0xca4], 1
imul eax, dword [ebp - 0xca4], 0xe4bf
cmp eax, dword [ebp - 0x36c]
jg 0x40392c
mov dword [ebp - 0x7fc], 1
jmp 0x403933
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0xefc], eax
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0xefc], eax
jne 0x403959
mov dword [ebp - 0x804], 1
jmp 0x403960
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x804]
je 0x40397a
mov dword [ebp - 0xcac], 1
jmp 0x403981
and dword [ebp - 0xcac], 0
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0xcac], eax
jl 0x40399b
mov dword [ebp - 0x146c], 1
jmp 0x4039a2
and dword [ebp - 0x146c], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1ba4], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1bac], eax
mov dword [ebp - 0x80c], 0x34e401d9
cmp dword [ebp - 0x80c], 0
je 0x403a79
mov dword [ebp - 0x1bb4], 0xffffffff
mov dword [ebp - 0x1bbc], 0xfffffffe
mov dword [ebp - 0x1bc4], 0x3f6d1d89
mov dword [ebp - 0x1da4], 0x31137833
mov dword [ebp - 0x1dac], 0xffffffff
mov dword [ebp - 0x1db4], 0xeb4e5227
push 3
lea ecx, [ebp - 0x1c34]
call fcn.0040fd61
mov dword [ebp - 0x10bc], 0
mov dword [ebp - 0x454], 0
jmp 0x403a3d
cmp dword [ebp - 0x454], 3
jge 0x403a5f
push dword [ebp - 0x454]
lea ecx, [ebp - 0x1c34]
call fcn.0040fe4f
mov dword [eax], 0xfffffffd
jmp 0x403a30
mov eax, dword [ebp - 0x10bc]
dec eax
mov dword [ebp - 0x10bc], eax
lea ecx, [ebp - 0x1c34]
call fcn.0040fe33
jmp 0x403aa5
mov dword [ebp - 0x1474], 0xfffffff6
mov byte [ebp - 0x1b9], 0
movzx eax, byte [ebp - 0x1b9]
test eax, eax
je 0x403a9b
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [ebp - 0x1474], 0
mov byte [ebp - 0x154], 0
push 2
lea ecx, [ebp - 0x2dc]
call fcn.0040fd61
mov dword [ebp - 0x1484], 1
mov dword [ebp - 0x3c], 0
jmp 0x403ad3
cmp dword [ebp - 0x3c], 3
jge 0x403ae9
lea ecx, [ebp - 0x1758]
call fcn.0040fe33
jmp 0x402c19
lea ecx, [ebp - 0x14dc]
call fcn.0040fe33
jmp 0x40205f
mov dword [ebp - 0x37c], 0
mov dword [ebp - 0x148c], 0xffffffff
mov dword [ebp - 0x37c], 0xfffffff2
jmp 0x4040fc
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0x10
jge 0x404137
mov dword [ebp - 0x148c], 0x951ad386
mov byte [ebp - 0x1c1], 0
movzx eax, byte [ebp - 0x1c1]
test eax, eax
je 0x404135
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x4040ef
push 2
lea ecx, [ebp - 0x14ec]
call fcn.0040fd61
mov dword [ebp - 0x190], 0x622ba394
mov dword [ebp - 0x1494], 5
mov dword [ebp - 0x149c], 0x3fa3c9e4
mov dword [ebp - 0x45c], 0
jmp 0x40417b
mov eax, dword [ebp - 0x45c]
inc eax
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 2
jge 0x40419d
push dword [ebp - 0x45c]
lea ecx, [ebp - 0x14ec]
call fcn.0040fe4f
mov dword [eax], 6
jmp 0x40416e
mov dword [ebp - 0x190], 0
jmp 0x4041b6
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jg 0x404444
mov dword [ebp - 0x128], 0x7e17f75
mov dword [ebp - 0x1174], 0xffffffff
mov dword [ebp - 0x128], 0
jmp 0x4041f0
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jg 0x404425
mov dword [ebp - 0x288], 0x1da622a1
push dword [ebp - 0x128]
lea ecx, [ebp - 0x14ec]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x404222
jmp 0x404425
mov dword [ebp - 0x288], 1
jmp 0x40423b
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0
jl 0x404420
mov dword [ebp - 0xf14], 0x8b15b45b
mov dword [ebp - 0x384], 0
jmp 0x40426b
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 1
jge 0x404287
mov eax, dword [ebp - 0x384]
mov dword [ebp + eax*4 - 0x864], 7
jmp 0x40425e
mov esi, dword [ebp - 0x288]
mov edi, dword [ebp - 0x190]
push 0
lea ecx, [ebp - 0x14ec]
call fcn.0040fe4f
imul edi, dword [eax]
add esi, edi
jne 0x4042b3
mov dword [ebp - 0xf0c], 1
jmp 0x4042ba
and dword [ebp - 0xf0c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x864]
cmp dword [ebp - 0xf0c], eax
jl 0x4042db
mov dword [ebp - 0x844], 1
jmp 0x4042e2
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x128]
imul eax, dword [ebp - 0x844]
cmp eax, 1
je 0x404300
mov dword [ebp - 0xccc], 1
jmp 0x404307
and dword [ebp - 0xccc], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0xccc], eax
jne 0x404321
mov dword [ebp - 0x84c], 1
jmp 0x404328
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0x1174], eax
cmp dword [ebp - 0x1174], 0xffffffff
jge 0x404349
mov dword [ebp - 0x854], 1
jmp 0x404350
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x854]
jne 0x40436a
mov dword [ebp - 0xcd4], 1
jmp 0x404371
and dword [ebp - 0xcd4], 0
cmp dword [ebp - 0xcd4], 0xa41b
jle 0x404389
mov dword [ebp - 0x85c], 1
jmp 0x404390
and dword [ebp - 0x85c], 0
push 0
lea ecx, [ebp - 0x14ec]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x85c]
imul ecx, dword [eax]
test ecx, ecx
je 0x4043b1
cmp dword [ebp - 0xf14], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf14]
cmp dword [ebp + eax - 0x864], ecx
jl 0x4043d2
mov dword [ebp - 0xcdc], 1
jmp 0x4043d9
and dword [ebp - 0xcdc], 0
mov eax, dword [ebp - 0x1494]
cmp eax, dword [ebp - 0xcdc]
jle 0x4043ee
cmp dword [ebp - 0x128], 0
imul eax, dword [ebp - 0x190], 0
cmp eax, 0xe994
jge 0x404408
mov dword [ebp - 0x86c], 1
jmp 0x40440f
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x149c], eax
jmp 0x40422e
jmp 0x4041e3
mov byte [ebp - 0x156], 0
movzx eax, byte [ebp - 0x156]
test eax, eax
je 0x40443f
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
jmp 0x4041a9
lea ecx, [ebp - 0x14ec]
call fcn.0040fe33
mov dword [ebp - 0x16a8], 0xd6c05baf
mov dword [ebp - 0x16a4], 0xd6c05baf
mov dword [ebp - 0x16a0], 0xd6c05baf
mov dword [ebp - 0x169c], 0xd6c05baf
lea ecx, [ebp - 0x5dd]
call fcn.0040fe5e
push eax
lea eax, [ebp - 0x1698]
push eax
lea eax, [ebp - 0x16a8]
push eax
lea ecx, [ebp - 0x1ef4]
call fcn.0040fe61
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1e7c]
call fcn.0040fe0d
mov dword [ebp - 0x38c], 0xa8e97eed
mov dword [ebp - 0x1e14], 0x891c5534
push 3
lea ecx, [ebp - 0x1c84]
call fcn.0040fd61
mov dword [ebp - 0x1dd8], 0x88e1
mov dword [ebp - 0x1034], 0xffffffff
mov dword [ebp - 0x4f4], 0
jmp 0x4044fa
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 3
jge 0x40451c
push dword [ebp - 0x4f4]
lea ecx, [ebp - 0x1c84]
call fcn.0040fe4f
mov dword [eax], 0xe6f7fbf2
jmp 0x4044ed
mov dword [ebp - 0x38c], 3
jmp 0x404535
mov eax, dword [ebp - 0x38c]
dec eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0
jl 0x404565
mov byte [ebp - 0x15c], 0
movzx eax, byte [ebp - 0x15c]
test eax, eax
je 0x404563
push 0
push 0x827
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x404528
mov eax, dword [ebp - 0x1034]
inc eax
mov dword [ebp - 0x1034], eax
lea ecx, [ebp - 0x1c84]
call fcn.0040fe33
lea ecx, [ebp - 0x1e7c]
call fcn.0040fe33
mov dword [ebp - 0x464], 6
mov dword [ebp - 0xce4], 0xffffffff
mov dword [ebp - 0x58c], 0xe008
mov dword [ebp - 0x1584], 0x28405cef
mov byte [ebp - 0x158], 0
movzx eax, byte [ebp - 0x158]
test eax, eax
je 0x4045d4
push 0x20
push 0x234a
push 0x2525
call dword [sym.imp.KERNEL32.dll_HeapCreate]
cmp dword [ebp - 0x464], 0
jne 0x40461f
cmp dword [ebp - 0x464], 0
jne 0x4045fb
cmp dword [ebp - 0x464], 1
jne 0x4045fb
mov dword [ebp - 0x874], 1
jmp 0x404602
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x464]
add eax, dword [ebp - 0x874]
mov dword [ebp - 0xce4], eax
jne 0x40461f
and dword [ebp - 0x87c], 0
jmp 0x404629
mov dword [ebp - 0x87c], 1
cmp dword [ebp - 0x87c], 0xfffffff7
jg 0x40463e
mov dword [ebp - 0xf1c], 1
jmp 0x404645
and dword [ebp - 0xf1c], 0
cmp dword [ebp - 0xf1c], 1
jg 0x40465a
mov dword [ebp - 0x884], 1
jmp 0x404661
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x58c]
cmp dword [ebp - 0x884], eax
jle 0x40467b
mov dword [ebp - 0xcec], 1
jmp 0x404682
and dword [ebp - 0xcec], 0
cmp dword [ebp - 0xcec], 0xb44cf59
jle 0x40469a
mov dword [ebp - 0x88c], 1
jmp 0x4046a1
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x58c]
cmp dword [ebp - 0x88c], eax
jg 0x4046bb
mov dword [ebp - 0x10c4], 1
jmp 0x4046c2
and dword [ebp - 0x10c4], 0
mov eax, dword [ebp - 0x58c]
cmp dword [ebp - 0x10c4], eax
jl 0x4046dc
mov dword [ebp - 0x894], 1
jmp 0x4046e3
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x1584], eax
mov dword [ebp - 0x394], 0
mov dword [ebp - 0x121c], 0xffffffff
mov dword [ebp - 8], 0x643cdf98
mov dword [ebp - 0x8d4], 0xcc9df78a
mov dword [ebp - 0x8ec], 0x73394210
mov dword [ebp - 0x1360], 3
mov dword [ebp - 0xe8], 0
jmp 0x404741
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 4
jge 0x40475d
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x618], 0xc93b4e1
jmp 0x404734
mov dword [ebp - 0xe8], 0
jmp 0x404776
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x404792
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x548], 0xffffffff
jmp 0x404769
mov dword [ebp - 8], 0
jmp 0x4047a2
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jg 0x404a71
mov dword [ebp - 0x198], 0x2b56095d
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x618]
mov dword [ebp - 0x1d80], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x618]
mov dword [ebp - 0x1938], eax
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x618], 0xfffe
jbe 0x4047f2
mov dword [ebp - 0x1568], 1
jmp 0x4047f9
and dword [ebp - 0x1568], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x618]
mov dword [ebp - 0x17f0], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x618]
mov dword [ebp - 0x1c98], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x17f8], eax
mov eax, dword [ebp - 8]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x618]
cmp dword [ebp + eax*4 - 0x618], ecx
je 0x404851
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x618], 0
jne 0x404851
and dword [ebp - 0x1480], 0
jmp 0x40485b
mov dword [ebp - 0x1480], 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1b00], eax
push 4
pop eax
imul eax, eax, 3
imul eax, dword [ebp + eax - 0x618], 0xc0bf
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x618]
mov ecx, dword [ebp - 8]
cmp eax, dword [ebp + ecx*4 - 0x618]
jl 0x40489a
mov dword [ebp - 0xcf4], 1
jmp 0x4048a1
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xcf4]
dec eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x198], 0
jmp 0x4048c7
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jg 0x404a6c
mov dword [ebp - 0x89c], 0x325cf162
mov dword [ebp - 0x17d4], 5
mov dword [ebp - 0x17d0], 5
mov dword [ebp - 0x17cc], 5
mov dword [ebp - 0x17c8], 5
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x1800], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
sub ecx, dword [ebp + eax*4 - 0x618]
cmp ecx, 0x236f914a
jne 0x404932
mov dword [ebp - 0x13c4], 1
jmp 0x404939
and dword [ebp - 0x13c4], 0
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x198]
js 0x404950
mov dword [ebp - 0xf24], 1
jmp 0x404957
and dword [ebp - 0xf24], 0
mov eax, dword [ebp - 0x89c]
cmp dword [ebp - 0xf24], eax
jne 0x404971
mov dword [ebp - 0x8a4], 1
jmp 0x404978
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x8a4]
test eax, eax
je 0x404998
cmp dword [ebp - 8], 0
je 0x404998
mov dword [ebp - 0xcfc], 1
jmp 0x40499f
and dword [ebp - 0xcfc], 0
cmp dword [ebp - 0xcfc], 0x8477
jle 0x4049b7
mov dword [ebp - 0x8ac], 1
jmp 0x4049be
and dword [ebp - 0x8ac], 0
cmp dword [ebp - 0x8ac], 0x457a23a3
jl 0x4049d6
mov dword [ebp - 0x103c], 1
jmp 0x4049dd
and dword [ebp - 0x103c], 0
cmp dword [ebp - 0x103c], 0xb4ff
jge 0x4049f5
mov dword [ebp - 0x8b4], 1
jmp 0x4049fc
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x8b4], eax
jge 0x404a13
mov dword [ebp - 0xd04], 1
jmp 0x404a1a
and dword [ebp - 0xd04], 0
cmp dword [ebp - 0xd04], 1
ja 0x404a2f
mov dword [ebp - 0x8bc], 1
jmp 0x404a36
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x8bc]
add eax, 0x128b
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x17d4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x198]
mov eax, dword [ebp + eax - 0x548]
mov dword [ebp + ecx*4 - 0x618], eax
jmp 0x4048ba
jmp 0x40479b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x548], 0
je 0x404b99
mov eax, dword [ebp - 8]
neg eax
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x618]
je 0x404aa5
mov dword [ebp - 0xf2c], 1
jmp 0x404aac
and dword [ebp - 0xf2c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xf2c], eax
jne 0x404ac3
mov dword [ebp - 0x8c4], 1
jmp 0x404aca
and dword [ebp - 0x8c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x548]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x548]
cmp eax, dword [ebp - 0x8c4]
jl 0x404af8
mov dword [ebp - 0xd0c], 1
jmp 0x404aff
and dword [ebp - 0xd0c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x548]
cmp dword [ebp - 0xd0c], eax
je 0x404b20
mov dword [ebp - 0x8cc], 1
jmp 0x404b27
and dword [ebp - 0x8cc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x548]
add eax, dword [ebp - 0x8cc]
sub eax, dword [ebp - 0x8d4]
cmp eax, 0x86e0daee
jne 0x404b53
mov dword [ebp - 0x1134], 1
jmp 0x404b5a
and dword [ebp - 0x1134], 0
cmp dword [ebp - 0x1134], 0
ja 0x404b6f
mov dword [ebp - 0xd14], 1
jmp 0x404b76
and dword [ebp - 0xd14], 0
mov eax, dword [ebp - 0x8d4]
cmp dword [ebp - 0xd14], eax
jg 0x404b99
mov eax, 0x5a4a
test eax, eax
je 0x404b99
mov dword [ebp - 0x8dc], 1
jmp 0x404ba0
and dword [ebp - 0x8dc], 0
cmp dword [ebp - 0x8dc], 0xa760f2f4
jbe 0x404bb8
mov dword [ebp - 0xf34], 1
jmp 0x404bbf
and dword [ebp - 0xf34], 0
mov eax, dword [ebp - 0xf34]
mov dword [ebp - 8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x548]
cmp dword [ebp - 8], eax
jle 0x404be6
mov dword [ebp - 0x8e4], 1
jmp 0x404bed
and dword [ebp - 0x8e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x548]
cmp dword [ebp - 0x8e4], eax
jge 0x404c0e
mov dword [ebp - 0xd1c], 1
jmp 0x404c15
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0xd1c]
mov dword [ebp - 0x8ec], eax
mov eax, dword [ebp - 0x8ec]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x618]
mov dword [ebp - 0x1360], eax
mov dword [ebp - 0x394], 0xfffffff2
jmp 0x404c52
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x10
jge 0x40511c
push 2
lea ecx, [ebp - 0x16d4]
call fcn.0040fd61
mov dword [ebp - 0x1298], 0xce57bf5c
mov dword [ebp - 0x4cc], 0
jmp 0x404c8f
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 2
jge 0x404cb1
push dword [ebp - 0x4cc]
lea ecx, [ebp - 0x16d4]
call fcn.0040fe4f
mov dword [eax], 1
jmp 0x404c82
push 0
lea ecx, [ebp - 0x16d4]
call fcn.0040fe4f
mov dword [eax], 0xc0ae9714
mov dword [ebp - 0x1298], 0xc0ae9714
mov byte [ebp - 0x1c9], 0
movzx eax, byte [ebp - 0x1c9]
test eax, eax
je 0x404d00
push 0
push 0x23a7
push 0
push 0x9d9
push 0x1ca
push 0
push 0x1ea9
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea ecx, [ebp - 0x16d4]
call fcn.0040fe33
mov dword [ebp - 0x121c], 0x951ad386
mov dword [ebp - 0x39c], 0xffffffff
mov dword [ebp - 0x39c], 0xfffffffa
jmp 0x404d38
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0x1c
jge 0x404d62
mov byte [ebp - 0x15a], 0
movzx eax, byte [ebp - 0x15a]
test eax, eax
je 0x404d60
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x404d2b
mov byte [ebp - 0x217], 0
movzx eax, byte [ebp - 0x217]
test eax, eax
je 0x404d82
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov byte [ebp - 0x15e], 0
mov dword [ebp - 0x3a4], 0
push 1
lea ecx, [ebp - 0x538]
call fcn.0040fd61
mov dword [ebp - 0x2c4], 0xf196e6c8
mov dword [ebp - 0x1224], 0xffffffff
mov dword [ebp - 0x914], 0x6a9c
mov dword [ebp - 0x10cc], 0x8e181f51
mov dword [ebp - 0x13cc], 6
mov dword [ebp - 0x46c], 0
jmp 0x404deb
mov eax, dword [ebp - 0x46c]
inc eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 1
jge 0x404e0d
push dword [ebp - 0x46c]
lea ecx, [ebp - 0x538]
call fcn.0040fe4f
mov dword [eax], 0x47d2038
jmp 0x404dde
push 0
lea ecx, [ebp - 0x538]
call fcn.0040fe4f
mov esi, eax
push 0
lea ecx, [ebp - 0x538]
call fcn.0040fe4f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x404e3b
mov dword [ebp - 0x1044], 1
jmp 0x404e42
and dword [ebp - 0x1044], 0
push 0
lea ecx, [ebp - 0x538]
call fcn.0040fe4f
cmp dword [eax], 0xfffffff6
jg 0x404e60
mov dword [ebp - 0x13bc], 1
jmp 0x404e67
and dword [ebp - 0x13bc], 0
push 0
lea ecx, [ebp - 0x538]
call fcn.0040fe4f
push 0
lea ecx, [ebp - 0x538]
call fcn.0040fe4f
imul esi, dword [ebp - 0x1044], 0
push 0
lea ecx, [ebp - 0x538]
call fcn.0040fe4f
cmp esi, dword [eax]
je 0x404ea5
mov dword [ebp - 0x8f4], 1
jmp 0x404eac
and dword [ebp - 0x8f4], 0
push 0
lea ecx, [ebp - 0x538]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x8f4]
cmp ecx, dword [eax]
jge 0x404ecf
mov dword [ebp - 0xd24], 1
jmp 0x404ed6
and dword [ebp - 0xd24], 0
push 0
lea ecx, [ebp - 0x538]
call fcn.0040fe4f
mov ecx, dword [ebp - 0xd24]
cmp ecx, dword [eax]
jne 0x404ef9
mov dword [ebp - 0x8fc], 1
jmp 0x404f00
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x3a4], eax
mov esi, dword [ebp - 0x3a4]
push 0
lea ecx, [ebp - 0x538]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x8fc]
sub ecx, dword [eax]
neg ecx
imul esi, ecx
mov dword [ebp - 0xf3c], esi
push 0
lea ecx, [ebp - 0x538]
call fcn.0040fe4f
mov ecx, dword [ebp - 0xf3c]
mov dword [eax], ecx
cmp dword [ebp - 0xf3c], 0x7d266845
jge 0x404f5f
mov dword [ebp - 0x904], 1
jmp 0x404f66
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x2c4]
mov ecx, dword [ebp - 0x904]
lea eax, [ecx + eax + 0x1e28]
test eax, eax
je 0x404f9b
push 0
lea ecx, [ebp - 0x538]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x404f9b
mov dword [ebp - 0xd2c], 1
jmp 0x404fa2
and dword [ebp - 0xd2c], 0
imul eax, dword [ebp - 0xd2c], 0xffffffff
cmp eax, dword [ebp - 0x1224]
jge 0x404fbd
mov dword [ebp - 0x90c], 1
jmp 0x404fc4
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x2c4], eax
mov eax, 0x4186e145
test eax, eax
je 0x405011
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x1de0], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c4]
sub eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x10cc], eax
je 0x405011
mov dword [ebp - 0xd34], 1
jmp 0x405018
and dword [ebp - 0xd34], 0
mov eax, dword [ebp - 0x914]
add eax, dword [ebp - 0xd34]
mov dword [ebp - 0x91c], 1
jmp 0x405037
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x13cc], eax
lea ecx, [ebp - 0x538]
call fcn.0040fe33
movzx eax, byte [ebp - 0x15e]
test eax, eax
je 0x405117
mov dword [ebp - 0x290], 0xfcb50bf3
mov dword [ebp - 0x50c], 0
jmp 0x405080
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 3
jge 0x40509c
mov eax, dword [ebp - 0x50c]
mov dword [ebp + eax*4 - 0x1e94], 0xeac8b13e
jmp 0x405073
mov byte [ebp - 0x1d1], 0
movzx eax, byte [ebp - 0x1d1]
test eax, eax
je 0x4050ce
push 0
push 0x1986
push 0x7b4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
mov dword [ebp - 0x290], 0
jmp 0x4050e7
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 3
jge 0x405103
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0x1e94], 0xda0e60f9
jmp 0x4050da
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x404c45
mov dword [ebp - 0x161c], 5
mov dword [ebp - 0x1618], 5
mov dword [ebp - 0x1614], 5
mov dword [ebp - 0x1610], 5
lea ecx, [ebp - 0x5e5]
call fcn.0040fe5e
push eax
lea eax, [ebp - 0x160c]
push eax
lea eax, [ebp - 0x161c]
push eax
lea ecx, [ebp - 0x1efc]
call fcn.0040fe61
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x15b4]
call fcn.0040fe0d
push 0
lea ecx, [ebp - 0x15b4]
call fcn.0040fe4f
mov dword [eax], 0xf
jmp 0x4051b2
push 0
lea ecx, [ebp - 0x15b4]
call fcn.0040fe4f
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0xf44]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xf44]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x15b4]
call fcn.0040fe4f
cmp dword [eax], 9
je 0x4051e3
mov byte [ebp - 0x211], 0
movzx eax, byte [ebp - 0x211]
test eax, eax
je 0x4051e1
push 0x132a
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x40518e
lea ecx, [ebp - 0x15b4]
call fcn.0040fe33
mov dword [ebp - 0x4d4], 1
mov dword [ebp - 0x1808], 0xfffffffe
mov dword [ebp - 0x3ac], 0
jmp 0x40521b
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 1
jge 0x405237
mov eax, dword [ebp - 0x3ac]
mov dword [ebp + eax*4 - 0x1b08], 1
jmp 0x40520e
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x405251
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov byte [ebp - 0x160], 0
movzx eax, byte [ebp - 0x160]
test eax, eax
je 0x40527c
push 0xe38
push 0x583
push 0
push 0x1348
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov dword [ebp - 0x1810], 0xe87f6fb8
mov dword [ebp - 0x1ca8], 0xed7c6ae4
mov dword [ebp - 0x1818], 0x403ca955
mov dword [ebp - 0x934], 4
mov dword [ebp - 0x1234], 0xe0d1
mov dword [ebp - 0x122c], 0x748dc164
mov dword [ebp - 0x13d4], 0x2f34e401
mov dword [ebp - 0x5fc], 6
mov dword [ebp - 0xd44], 0xfff9
mov dword [ebp - 0x123c], 0xfffffff8
mov dword [ebp - 0x474], 0
jmp 0x4052f9
mov eax, dword [ebp - 0x474]
inc eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 4
jge 0x405315
mov eax, dword [ebp - 0x474]
mov dword [ebp + eax*4 - 0x1f5c], 0x5eb20068
jmp 0x4052ec
cmp dword [ebp - 0x934], 0
je 0x40538a
cmp dword [ebp - 0x122c], 0xfffffff6
jge 0x405333
mov dword [ebp - 0x924], 1
jmp 0x40533a
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x13d4]
add eax, dword [ebp - 0x924]
cmp eax, 0x380a
jg 0x405359
mov dword [ebp - 0xd3c], 1
jmp 0x405360
and dword [ebp - 0xd3c], 0
imul eax, dword [ebp - 0x5fc], 0
mov ecx, dword [ebp - 0xd3c]
mov edx, dword [ebp - 0x5fc]
dec edx
mov dword [ebp - 0x5fc], edx
cmp eax, ecx
jle 0x40538a
mov dword [ebp - 0x92c], 1
jmp 0x405391
and dword [ebp - 0x92c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f5c]
add eax, dword [ebp - 0x92c]
jne 0x4053b3
xor eax, eax
jne 0x4053b3
and dword [ebp - 0x104c], 0
jmp 0x4053bd
mov dword [ebp - 0x104c], 1
mov eax, dword [ebp - 0x104c]
mov dword [ebp - 0xd44], eax
mov eax, dword [ebp - 0x934]
cmp dword [ebp - 0xd44], eax
jge 0x4053e3
mov dword [ebp - 0x93c], 1
jmp 0x4053ea
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x1234]
cmp dword [ebp - 0x93c], eax
jge 0x405404
mov dword [ebp - 0x13c8], 1
jmp 0x40540b
and dword [ebp - 0x13c8], 0
mov dword [ebp - 0x123c], 0xdd3610cb
mov dword [ebp - 0x1b10], 7
mov dword [ebp - 0x58], 0xdfa860b4
mov dword [ebp - 0x1820], 0xffffffff
mov dword [ebp - 0x1da8], 0x9dbc9b78
mov dword [ebp - 0x1828], 0xa938f738
mov dword [ebp - 0x1b18], 0xcfdfe92
mov byte [ebp - 0x1d9], 0
movzx eax, byte [ebp - 0x1d9]
test eax, eax
je 0x40546d
push 0x5e9
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cmp dword [ebp - 0x58], 0
je 0x405664
mov dword [ebp - 0x594], 0xffffffff
mov dword [ebp - 0x1244], 1
push 2
lea ecx, [ebp - 0x1c94]
call fcn.0040fd61
mov dword [ebp - 0x61c], 0x9935ff57
mov dword [ebp - 0x3b4], 0
jmp 0x4054bb
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 2
jge 0x4054dd
push dword [ebp - 0x3b4]
lea ecx, [ebp - 0x1c94]
call fcn.0040fe4f
mov dword [eax], 0x284868fd
jmp 0x4054ae
mov dword [ebp - 0x58], 0
jmp 0x4054ed
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffffffe
jl 0x405634
mov dword [ebp - 0xf4c], 0x145b
mov dword [ebp - 0x13d0], 0xef906d8b
mov dword [ebp - 0x1830], 0xb39e2240
mov dword [ebp - 0x1cb8], 0x25ec5604
mov dword [ebp - 0x1838], 0xfffffffc
cmp dword [ebp - 0x58], 0xffffffff
je 0x40553b
mov dword [ebp - 0x1520], 1
jmp 0x405542
and dword [ebp - 0x1520], 0
mov eax, dword [ebp - 0xf4c]
mov dword [ebp - 0x1b20], eax
mov eax, dword [ebp - 0xf4c]
mov dword [ebp - 0x1840], eax
mov eax, dword [ebp - 0x594]
cmp dword [ebp - 0x58], eax
jge 0x405571
mov dword [ebp - 0x944], 1
jmp 0x405578
and dword [ebp - 0x944], 0
cmp dword [ebp - 0x944], 0xfffffff8
jbe 0x40558d
mov dword [ebp - 0xd4c], 1
jmp 0x405594
and dword [ebp - 0xd4c], 0
cmp dword [ebp - 0xd4c], 0xfffffffb
jle 0x4055a9
mov dword [ebp - 0x94c], 1
jmp 0x4055b0
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x94c]
jne 0x4055c7
mov dword [ebp - 0x1180], 1
jmp 0x4055ce
and dword [ebp - 0x1180], 0
mov eax, dword [ebp - 0x1244]
add eax, dword [ebp - 0x594]
cmp eax, dword [ebp - 0x1180]
jl 0x4055ee
mov dword [ebp - 0x954], 1
jmp 0x4055f5
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x594]
cmp eax, dword [ebp - 0x954]
jge 0x40560f
mov dword [ebp - 0xd54], 1
jmp 0x405616
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0xd54]
mov dword [ebp - 0x13d0], eax
mov eax, dword [ebp - 0x61c]
inc eax
mov dword [ebp - 0x61c], eax
jmp 0x4054e6
mov dword [ebp - 0x58], 0xfffffff4
jmp 0x405644
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 8
jl 0x405657
cmp dword [ebp - 0x61c], 0
je 0x405655
jmp 0x405657
jmp 0x40563d
lea ecx, [ebp - 0x1c94]
call fcn.0040fe33
jmp 0x40567b
mov dword [ebp - 0x95c], 0x6ed5
mov eax, dword [ebp - 0x95c]
inc eax
mov dword [ebp - 0x95c], eax
mov dword [ebp - 0x4d4], 0xfffffff9
jmp 0x405694
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0xb
je 0x407e52
mov dword [ebp - 0x60], 0xe52d
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x10], 0xe9829cbc
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x3bc], 0
jmp 0x4056dc
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 3
jge 0x4056f8
mov eax, dword [ebp - 0x3bc]
mov dword [ebp + eax*4 - 0x11b8], 0xfffffffb
jmp 0x4056cf
cmp dword [ebp - 0x60], 0x3d9532bb
jg 0x40570d
mov dword [ebp - 0x124c], 1
jmp 0x405714
and dword [ebp - 0x124c], 0
cmp dword [ebp - 0x60], 0
jne 0x405736
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1e08], eax
mov eax, dword [ebp - 0x60]
sub eax, 0x462415ae
jne 0x405736
and dword [ebp - 0xf54], 0
jmp 0x405740
mov dword [ebp - 0xf54], 1
cmp dword [ebp - 0xf54], 0x37186542
jle 0x405758
mov dword [ebp - 0x1488], 1
jmp 0x40575f
and dword [ebp - 0x1488], 0
cmp dword [ebp - 0x60], 0xfa3a
jl 0x405774
mov dword [ebp - 0x964], 1
jmp 0x40577b
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x964]
sub eax, dword [ebp - 0x60]
je 0x40595e
push 4
lea ecx, [ebp - 0x15cc]
call fcn.0040fd61
mov dword [ebp - 0x59c], 1
mov dword [ebp - 0x47c], 0
jmp 0x4057ba
mov eax, dword [ebp - 0x47c]
inc eax
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 4
jge 0x4057dc
push dword [ebp - 0x47c]
lea ecx, [ebp - 0x15cc]
call fcn.0040fe4f
mov dword [eax], 0xffff
jmp 0x4057ad
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x10], eax
push 1
lea ecx, [ebp - 0x15cc]
call fcn.0040fe4f
cmp dword [eax], 1
jne 0x405803
mov dword [ebp - 0xd5c], 1
jmp 0x40580a
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0xd5c]
sub eax, dword [ebp - 0x1a0]
cmp eax, 0x8951fe51
jbe 0x405829
mov dword [ebp - 0x1254], 1
jmp 0x405830
and dword [ebp - 0x1254], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1848], eax
push 1
lea ecx, [ebp - 0x15cc]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x60]
cmp dword [eax], ecx
jle 0x405859
mov dword [ebp - 0x96c], 1
jmp 0x405860
and dword [ebp - 0x96c], 0
cmp dword [ebp - 0x96c], 0xcc099a56
jb 0x405878
mov dword [ebp - 0x1054], 1
jmp 0x40587f
and dword [ebp - 0x1054], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x1054]
jl 0x405896
mov dword [ebp - 0x974], 1
jmp 0x40589d
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x974]
add eax, 8
cmp eax, dword [ebp - 0x60]
je 0x4058b7
mov dword [ebp - 0xd64], 1
jmp 0x4058be
and dword [ebp - 0xd64], 0
mov eax, dword [ebp - 0xd64]
add eax, 0x7fcc65ad
imul eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x1a0]
jl 0x4058e4
mov dword [ebp - 0x97c], 1
jmp 0x4058eb
and dword [ebp - 0x97c], 0
cmp dword [ebp - 0x97c], 2
je 0x405900
mov dword [ebp - 0xf5c], 1
jmp 0x405907
and dword [ebp - 0xf5c], 0
mov eax, dword [ebp - 0xf5c]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x59c]
add eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x10], 0
jne 0x405937
mov dword [ebp - 0x984], 1
jmp 0x40593e
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x59c]
imul eax, dword [ebp - 0x984]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x15cc]
call fcn.0040fe33
jmp 0x405a84
mov dword [ebp - 0x2b0], 4
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x2b0], eax
jle 0x405982
mov dword [ebp - 0x98c], 1
jmp 0x405989
and dword [ebp - 0x98c], 0
cmp dword [ebp - 0x22c], 0xfffffff9
jle 0x40599e
mov dword [ebp - 0x13d8], 1
jmp 0x4059a5
and dword [ebp - 0x13d8], 0
cmp dword [ebp - 0x60], 0
jne 0x4059bd
mov eax, 0xc9fc22f7
test eax, eax
jne 0x4059bd
and dword [ebp - 0xd6c], 0
jmp 0x4059c7
mov dword [ebp - 0xd6c], 1
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0xd6c]
cmp eax, dword [ebp - 0x1a0]
je 0x4059e5
mov dword [ebp - 0x10d4], 1
jmp 0x4059ec
and dword [ebp - 0x10d4], 0
mov eax, dword [ebp - 0x98c]
neg eax
cmp eax, dword [ebp - 0x10d4]
je 0x405a08
mov dword [ebp - 0x994], 1
jmp 0x405a0f
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x994]
add eax, 0xbb54
je 0x405a31
cmp dword [ebp - 0x2b0], 0
je 0x405a31
mov dword [ebp - 0xd74], 1
jmp 0x405a38
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0x1a0]
add eax, dword [ebp - 0xd74]
mov ecx, 0xdb9b
sub ecx, eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x10], eax
jle 0x405a65
mov dword [ebp - 0x125c], 1
jmp 0x405a6c
and dword [ebp - 0x125c], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x1b28], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x10], 0
jmp 0x405a94
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x405cf4
mov dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x11b8], 1
jle 0x405acb
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x11b8], 0
jne 0x405acb
and dword [ebp - 0x1570], 0
jmp 0x405ad5
mov dword [ebp - 0x1570], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11b8]
mov dword [ebp - 0x1850], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11b8]
mov dword [ebp - 0x1cc8], eax
cmp dword [ebp - 0x244], 0xebdc
je 0x405b16
mov eax, 0x3d189eeb
test eax, eax
je 0x405b16
mov dword [ebp - 0x99c], 1
jmp 0x405b1d
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0x99c], eax
jle 0x405b37
mov dword [ebp - 0xf64], 1
jmp 0x405b3e
and dword [ebp - 0xf64], 0
cmp dword [ebp - 0xf64], 0xac07
je 0x405b56
mov dword [ebp - 0x9a4], 1
jmp 0x405b5d
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0x9a4], eax
jle 0x405b77
mov dword [ebp - 0xd7c], 1
jmp 0x405b7e
and dword [ebp - 0xd7c], 0
mov eax, dword [ebp - 0xd7c]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11b8]
cmp dword [ebp - 0x22c], eax
jge 0x405ba8
mov dword [ebp - 0x9ac], 1
jmp 0x405baf
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x244]
imul eax, dword [ebp - 0x9ac]
test eax, eax
jne 0x405bd2
cmp dword [ebp - 0x244], 0
jne 0x405bd2
and dword [ebp - 0x105c], 0
jmp 0x405bdc
mov dword [ebp - 0x105c], 1
cmp dword [ebp - 0x105c], 0
je 0x405cb5
push 1
lea ecx, [ebp - 0x1728]
call fcn.0040fd61
mov dword [ebp - 0x1264], 0xfff6
mov dword [ebp - 0x3c4], 0
jmp 0x405c19
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 1
jge 0x405c3b
push dword [ebp - 0x3c4]
lea ecx, [ebp - 0x1728]
call fcn.0040fe4f
mov dword [eax], 0x77dc9657
jmp 0x405c0c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11b8]
add eax, 0x7801
cmp dword [ebp - 0x244], eax
jg 0x405c5e
mov dword [ebp - 0x9b4], 1
jmp 0x405c65
and dword [ebp - 0x9b4], 0
push 0
lea ecx, [ebp - 0x1728]
call fcn.0040fe4f
mov dword [eax], 0x12900
imul eax, dword [ebp - 0x9b4], 0x841a
cmp eax, 0x12900
je 0x405c95
mov dword [ebp - 0xd84], 1
jmp 0x405c9c
and dword [ebp - 0xd84], 0
mov eax, dword [ebp - 0xd84]
mov dword [ebp - 0x1264], eax
lea ecx, [ebp - 0x1728]
call fcn.0040fe33
jmp 0x405ce0
mov byte [ebp - 0x162], 0
movzx eax, byte [ebp - 0x162]
test eax, eax
je 0x405ce0
push 0xe38
push 0x583
push 0
push 0x1348
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x11b8], 0
je 0x405cef
jmp 0x405cf4
jmp 0x405a8d
push 2
lea ecx, [ebp - 0x150c]
call fcn.0040fd61
mov dword [ebp - 0x1858], 0xfffffffc
mov dword [ebp - 0x1b30], 0xdc6b79df
mov dword [ebp - 0x9dc], 0
mov dword [ebp - 0x13e0], 0xfffffffc
mov dword [ebp - 0x1860], 7
mov dword [ebp - 0x1db0], 1
mov dword [ebp - 0x4fc], 0x57ea0d01
mov dword [ebp - 0x1490], 0x44c3f4f8
mov dword [ebp - 0x9d4], 0x6b9c2d62
mov dword [ebp - 0x126c], 0xe5a945cb
mov dword [ebp - 0x13e8], 0x6c849023
mov dword [ebp - 0x1868], 0x5a9c
mov dword [ebp - 0x1b38], 0xfffffff7
mov dword [ebp - 0x1274], 0x8e4c12f6
mov dword [ebp - 0x1870], 0x4f6f4846
mov dword [ebp - 0x604], 7
mov dword [ebp - 0xc8], 0
jmp 0x405dba
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 4
jge 0x405dd6
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x1e24], 8
jmp 0x405dad
mov dword [ebp - 0xc8], 0
jmp 0x405def
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x405e0b
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x1908], 0x93c86992
jmp 0x405de2
cmp dword [ebp - 0x4fc], 0
jne 0x405e5a
mov eax, dword [ebp - 0x13e0]
sub eax, dword [ebp - 0x4fc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1e24]
jl 0x405e3b
mov dword [ebp - 0x9bc], 1
jmp 0x405e42
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x9bc]
add eax, 0x391df4c7
neg eax
jne 0x405e5a
and dword [ebp - 0xf6c], 0
jmp 0x405e64
mov dword [ebp - 0xf6c], 1
mov eax, dword [ebp - 0x9d4]
cmp dword [ebp - 0xf6c], eax
jl 0x405e7e
mov dword [ebp - 0x9c4], 1
jmp 0x405e85
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x126c]
cmp dword [ebp - 0x9c4], eax
jge 0x405e9f
mov dword [ebp - 0xd8c], 1
jmp 0x405ea6
and dword [ebp - 0xd8c], 0
cmp dword [ebp - 0xd8c], 0xc130268d
je 0x405ebe
mov dword [ebp - 0x9cc], 1
jmp 0x405ec5
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x604]
sub eax, dword [ebp - 0x9cc]
cmp eax, 0xffffffff
jae 0x405eef
mov dword [ebp - 0x1144], 1
jmp 0x405ef6
and dword [ebp - 0x1144], 0
imul eax, dword [ebp - 0x1144], 0x5285
cmp eax, dword [ebp - 0x9dc]
jg 0x405f14
mov dword [ebp - 0x5a4], 1
jmp 0x405f1b
and dword [ebp - 0x5a4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5a4]
mov dword [ebp + eax - 0x1908], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5a4]
mov dword [ebp + eax - 0x1e24], ecx
mov eax, dword [ebp - 0x1490]
mov dword [ebp - 0x1cd8], eax
cmp dword [ebp - 0x9d4], 0xfffffffa
jne 0x405f62
mov dword [ebp - 0xd94], 1
jmp 0x405f69
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0xd94]
sub eax, 9
mov dword [ebp - 0x1274], eax
mov eax, dword [ebp - 0x9dc]
imul eax, dword [ebp - 0x4fc]
cmp eax, dword [ebp - 0x4fc]
jg 0x405f99
mov dword [ebp - 0xf74], 1
jmp 0x405fa0
and dword [ebp - 0xf74], 0
mov eax, dword [ebp - 0xf74]
mov dword [ebp - 0x13e8], eax
mov dword [ebp - 0x1878], 0
mov dword [ebp - 0x234], 1
mov dword [ebp - 0x298], 0x188753e1
mov dword [ebp - 0xf7c], 7
mov dword [ebp - 0x624], 0x9986e3e4
mov dword [ebp - 0x62c], 0xbf889e02
mov dword [ebp - 0x484], 0x2206dd2c
mov dword [ebp - 0x64], 0xa2ef703c
and dword [ebp - 0x1644], 0
and dword [ebp - 0x1640], 0
and dword [ebp - 0x163c], 0
and dword [ebp - 0x1638], 0
lea ecx, [ebp - 0x5ed]
call fcn.0040fe5e
push eax
lea eax, [ebp - 0x1634]
push eax
lea eax, [ebp - 0x1644]
push eax
lea ecx, [ebp - 0x1f14]
call fcn.0040fe61
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x560]
call fcn.0040fe0d
mov dword [ebp - 0x3d4], 0xbf5cbf79
mov dword [ebp - 0x3cc], 1
mov dword [ebp - 0xa2c], 0x88fefd6e
cmp dword [ebp - 0x234], 0
je 0x406235
cmp dword [ebp - 0x624], 0
jne 0x406172
mov eax, dword [ebp - 0x3cc]
cmp dword [ebp - 0x64], eax
jl 0x406099
mov dword [ebp - 0x9e4], 1
jmp 0x4060a0
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0x9e4], eax
jle 0x4060ba
mov dword [ebp - 0xd9c], 1
jmp 0x4060c1
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0x484]
cmp dword [ebp - 0xd9c], eax
jl 0x4060db
mov dword [ebp - 0x9ec], 1
jmp 0x4060e2
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x3cc], eax
jge 0x406108
mov dword [ebp - 0x1064], 1
jmp 0x40610f
and dword [ebp - 0x1064], 0
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0x1064], eax
je 0x406129
mov dword [ebp - 0x127c], 1
jmp 0x406130
and dword [ebp - 0x127c], 0
mov eax, dword [ebp - 0xf7c]
mov dword [ebp - 0x1b40], eax
cmp dword [ebp - 0x484], 2
je 0x406151
mov dword [ebp - 0x9f4], 1
jmp 0x406158
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x234]
imul eax, dword [ebp - 0x9f4]
test eax, eax
jne 0x406172
and dword [ebp - 0xda4], 0
jmp 0x40617c
mov dword [ebp - 0xda4], 1
mov eax, dword [ebp - 0x3d4]
add eax, dword [ebp - 0xda4]
mov ecx, dword [ebp - 0x234]
mov edx, dword [ebp - 0x3d4]
dec edx
mov dword [ebp - 0x3d4], edx
cmp ecx, eax
jge 0x4061bd
cmp dword [ebp - 0x484], 0
je 0x4061bd
mov eax, 0xc79a46bb
test eax, eax
je 0x4061bd
mov dword [ebp - 0x1530], 1
jmp 0x4061c4
and dword [ebp - 0x1530], 0
mov esi, dword [ebp - 0x298]
push 3
lea ecx, [ebp - 0x560]
call fcn.0040fe4f
cmp esi, dword [eax]
je 0x4061e7
mov dword [ebp - 0x9fc], 1
jmp 0x4061ee
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x624]
cmp dword [ebp - 0x9fc], eax
jge 0x406208
mov dword [ebp - 0x1284], 1
jmp 0x40620f
and dword [ebp - 0x1284], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x1880], eax
mov eax, dword [ebp - 0xf7c]
add eax, dword [ebp - 0x3cc]
je 0x406235
mov dword [ebp - 0xa04], 1
jmp 0x40623c
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0x484]
cmp dword [ebp - 0xa04], eax
jge 0x406256
mov dword [ebp - 0x13f0], 1
jmp 0x40625d
and dword [ebp - 0x13f0], 0
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x1de8], eax
mov esi, dword [ebp - 0x234]
sub esi, dword [ebp - 0xa2c]
neg esi
neg esi
push 2
lea ecx, [ebp - 0x560]
call fcn.0040fe4f
add esi, dword [eax]
push 2
lea ecx, [ebp - 0x560]
call fcn.0040fe4f
mov dword [eax], esi
mov dword [ebp - 0x64], 3
jmp 0x4062a7
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x406578
mov dword [ebp - 0xf0], 0xffffffff
mov dword [ebp - 0x5ac], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0x560]
call fcn.0040fe4f
mov eax, dword [ebp - 0xf0]
add eax, dword [ebp - 0x298]
cmp dword [ebp - 0xf0], 0
jg 0x4062f4
mov dword [ebp - 0xdac], 1
jmp 0x4062fb
and dword [ebp - 0xdac], 0
cmp dword [ebp - 0xdac], 0xffffffff
jae 0x406310
mov dword [ebp - 0xa0c], 1
jmp 0x406317
and dword [ebp - 0xa0c], 0
cmp dword [ebp - 0xa0c], 0xffffffff
jne 0x40632c
mov dword [ebp - 0x10dc], 1
jmp 0x406333
and dword [ebp - 0x10dc], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x10dc], eax
jne 0x40634d
mov dword [ebp - 0xa14], 1
jmp 0x406354
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0xa14], eax
je 0x40636e
mov dword [ebp - 0xdb4], 1
jmp 0x406375
and dword [ebp - 0xdb4], 0
mov eax, dword [ebp - 0xf0]
add eax, dword [ebp - 0xdb4]
mov dword [ebp - 0xf0], eax
push dword [ebp - 0x64]
lea ecx, [ebp - 0x560]
call fcn.0040fe4f
mov dword [ebp - 0xa1c], eax
push dword [ebp - 0x64]
lea ecx, [ebp - 0x560]
call fcn.0040fe4f
mov ecx, dword [ebp - 0xa1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xa1c]
imul eax, dword [ecx]
cmp eax, dword [ebp - 0xf0]
je 0x4063d6
mov dword [ebp - 0xf84], 1
jmp 0x4063dd
and dword [ebp - 0xf84], 0
mov eax, dword [ebp - 0x5ac]
cmp dword [ebp - 0xf84], eax
jge 0x4063f7
mov dword [ebp - 0xa24], 1
jmp 0x4063fe
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0x5ac]
cmp dword [ebp - 0xa24], eax
jne 0x406418
mov dword [ebp - 0xdbc], 1
jmp 0x40641f
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0xdbc]
mov dword [ebp - 0x5ac], eax
push 2
lea ecx, [ebp - 0x560]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x406477
push dword [ebp - 0x64]
lea ecx, [ebp - 0x560]
call fcn.0040fe4f
cmp dword [eax], 0
jne 0x40645d
push 0
lea ecx, [ebp - 0x560]
call fcn.0040fe4f
mov eax, dword [ebp - 0xa2c]
add eax, 7
cmp eax, 1
jb 0x406477
mov dword [ebp - 0x106c], 1
jmp 0x40647e
and dword [ebp - 0x106c], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0x560]
call fcn.0040fe4f
mov eax, dword [eax]
imul eax, dword [ebp - 0x106c]
cmp eax, 0xffffffff
jge 0x4064a6
mov dword [ebp - 0x128c], 1
jmp 0x4064ad
and dword [ebp - 0x128c], 0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x1888], eax
mov eax, dword [ebp - 0xf0]
add eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x3d4], eax
jge 0x4064d9
mov dword [ebp - 0xa34], 1
jmp 0x4064e0
and dword [ebp - 0xa34], 0
cmp dword [ebp - 0xa34], 0x57094d04
je 0x4064f8
mov dword [ebp - 0xdc4], 1
jmp 0x4064ff
and dword [ebp - 0xdc4], 0
cmp dword [ebp - 0xdc4], 0xffffffff
jg 0x406514
mov dword [ebp - 0xa3c], 1
jmp 0x40651b
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0xa3c], eax
je 0x406535
mov dword [ebp - 0xf8c], 1
jmp 0x40653c
and dword [ebp - 0xf8c], 0
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0xf8c], eax
je 0x406556
mov dword [ebp - 0xa44], 1
jmp 0x40655d
and dword [ebp - 0xa44], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0x560]
call fcn.0040fe4f
mov ecx, dword [ebp - 0xa44]
mov dword [eax], ecx
jmp 0x4062a0
lea ecx, [ebp - 0x560]
call fcn.0040fe33
mov dword [ebp - 0x1b48], 0xdd8fb8ce
mov dword [ebp - 0x4dc], 0
jmp 0x4065a6
mov eax, dword [ebp - 0x4dc]
inc eax
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 2
jge 0x4065c8
push dword [ebp - 0x4dc]
lea ecx, [ebp - 0x150c]
call fcn.0040fe4f
mov dword [eax], 0x6d444182
jmp 0x406599
mov dword [ebp - 0xdd4], 4
mov dword [ebp - 0x13f8], 0xe0d1
mov dword [ebp - 0x1498], 0x748dc164
mov dword [ebp - 0x1294], 0x2f34e401
mov dword [ebp - 0x5b4], 6
mov dword [ebp - 0xa5c], 0xfff9
mov dword [ebp - 0x1580], 0xfffffff8
mov dword [ebp - 0x3dc], 0
jmp 0x406627
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 4
jge 0x406643
mov eax, dword [ebp - 0x3dc]
mov dword [ebp + eax*4 - 0x1f24], 0x5eb20068
jmp 0x40661a
cmp dword [ebp - 0xdd4], 0
je 0x4066b8
cmp dword [ebp - 0x1498], 0xfffffff6
jge 0x406661
mov dword [ebp - 0xdcc], 1
jmp 0x406668
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0x1294]
add eax, dword [ebp - 0xdcc]
cmp eax, 0x380a
jg 0x406687
mov dword [ebp - 0xa4c], 1
jmp 0x40668e
and dword [ebp - 0xa4c], 0
imul eax, dword [ebp - 0x5b4], 0
mov ecx, dword [ebp - 0xa4c]
mov edx, dword [ebp - 0x5b4]
dec edx
mov dword [ebp - 0x5b4], edx
cmp eax, ecx
jle 0x4066b8
mov dword [ebp - 0x1188], 1
jmp 0x4066bf
and dword [ebp - 0x1188], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f24]
add eax, dword [ebp - 0x1188]
jne 0x4066e1
xor eax, eax
jne 0x4066e1
and dword [ebp - 0xa54], 0
jmp 0x4066eb
mov dword [ebp - 0xa54], 1
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0xa5c], eax
mov eax, dword [ebp - 0xdd4]
cmp dword [ebp - 0xa5c], eax
jge 0x406711
mov dword [ebp - 0xf94], 1
jmp 0x406718
and dword [ebp - 0xf94], 0
mov eax, dword [ebp - 0x13f8]
cmp dword [ebp - 0xf94], eax
jge 0x406732
mov dword [ebp - 0x129c], 1
jmp 0x406739
and dword [ebp - 0x129c], 0
mov dword [ebp - 0x1580], 0xdd3610cb
push 1
lea ecx, [ebp - 0x150c]
call fcn.0040fe4f
mov dword [eax], 0xc
jmp 0x40677c
push 1
lea ecx, [ebp - 0x150c]
call fcn.0040fe4f
cmp dword [eax], 0xfffffff8
jne 0x407e42
mov dword [ebp - 0x264], 9
mov dword [ebp - 0x118], 0xb9f9b31
mov dword [ebp - 0x1890], 0x85ffff32
mov dword [ebp - 0x14a0], 0xffffffff
mov dword [ebp - 0x1ce8], 0x975a1448
mov dword [ebp - 0x1898], 0x2cac2457
mov dword [ebp - 0x12ac], 0xbdbb389e
mov dword [ebp - 0x118], 0
jmp 0x4067f1
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 6
jle 0x406d12
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x1934], 0xffffffff
mov dword [ebp - 0x18a0], 0xd2c643d4
mov dword [ebp - 0x193c], 0xffffffff
mov dword [ebp - 0xd0], 0
jmp 0x40683f
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x40685b
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x15e4], 1
jmp 0x406832
mov dword [ebp - 0xd0], 0
jmp 0x406874
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jge 0x406890
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x1e58], 0xc86797b6
jmp 0x406867
mov dword [ebp - 0x1a8], 0xffffffe3
jmp 0x4068a9
cmp dword [ebp - 0x1a8], 0xfffffff5
jg 0x406d0d
push 2
lea ecx, [ebp - 0x11f0]
call fcn.0040fd61
mov dword [ebp - 0xa0], 8
mov dword [ebp - 0x48c], 0xea311c3f
mov dword [ebp - 0xa84], 1
mov dword [ebp - 0x664], 0xfff9
mov dword [ebp - 0xf8], 0
jmp 0x406904
cmp dword [ebp - 0xf8], 2
jge 0x406926
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x11f0]
call fcn.0040fe4f
mov dword [eax], 0xf6dd
jmp 0x4068f7
mov dword [ebp - 0xf8], 0
jmp 0x40693f
jmp 0x4067e4
mov dword [ebp - 0x194c], 0xfffffff7
mov dword [ebp - 0x107c], 5
mov dword [ebp - 0x3e4], 0
jmp 0x406d3f
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 1
jge 0x406d5b
mov eax, dword [ebp - 0x3e4]
mov dword [ebp + eax*4 - 0x18b8], 0xfffffff6
jmp 0x406d32
mov byte [ebp - 0x164], 0
movzx eax, byte [ebp - 0x164]
test eax, eax
je 0x406d84
push 0xdeb
push 0x344
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
mov eax, dword [ebp - 0x107c]
dec eax
mov dword [ebp - 0x107c], eax
push 4
lea ecx, [ebp - 0x171c]
call fcn.0040fd61
mov dword [ebp - 0x3ec], 0xb8ee41b
mov dword [ebp - 0x12b4], 0xe022
mov dword [ebp - 0x1408], 0
mov dword [ebp - 0x1954], 0xadfb
mov dword [ebp - 0x51c], 0
jmp 0x406ddf
mov eax, dword [ebp - 0x51c]
inc eax
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 2
jge 0x406dfb
mov eax, dword [ebp - 0x51c]
mov dword [ebp + eax*4 - 0x680], 0xffff
jmp 0x406dd2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x680], 0
je 0x406e20
mov eax, 0xfff60009
test eax, eax
je 0x406e20
mov dword [ebp - 0xab4], 1
jmp 0x406e27
and dword [ebp - 0xab4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x680]
add eax, dword [ebp - 0xab4]
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x3ec], 0xa22e974a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x680]
mov dword [ebp - 0x18c0], eax
mov eax, dword [ebp - 0x12b4]
mov dword [ebp - 0x195c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x680]
mov dword [ebp - 0x18c8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x680]
mov dword [ebp - 0x1964], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x680]
mov dword [ebp - 0x18d0], eax
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x196c], eax
cmp dword [ebp - 0x3ec], 1
jle 0x406ec3
mov dword [ebp - 0xe04], 1
jmp 0x406eca
and dword [ebp - 0xe04], 0
mov eax, dword [ebp - 0xe04]
add eax, 0xad85
mov dword [ebp - 0x1408], eax
mov dword [ebp - 0x494], 0
jmp 0x406ef4
cmp dword [ebp - 0x494], 4
jge 0x406f16
lea ecx, [ebp - 0x150c]
call fcn.0040fe33
jmp 0x405687
mov dword [ebp - 0x300], 0
mov dword [ebp - 0xb6c], 4
mov dword [ebp - 0x1564], 0x9a971867
mov dword [ebp - 0x2f8], 0
jmp 0x407e89
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 3
jge 0x407ea5
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0x1734], 0xdb50
jmp 0x407e7c
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1734]
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0
je 0x407ef3
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1734]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0
je 0x407ef3
mov dword [ebp - 0x1094], 1
jmp 0x407efa
and dword [ebp - 0x1094], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1734]
sub eax, dword [ebp - 0x1094]
mov dword [ebp - 0x1564], eax
mov byte [ebp - 0x20e], 0
movzx eax, byte [ebp - 0x20e]
test eax, eax
je 0x407f30
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
push 2
lea ecx, [ebp - 0x151c]
call fcn.0040fd61
mov dword [ebp - 0x1b8], 0x622ba394
mov dword [ebp - 0x12e4], 5
mov dword [ebp - 0x1420], 0x3fa3c9e4
mov dword [ebp - 0x308], 0
jmp 0x407f74
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 2
jge 0x407f96
push dword [ebp - 0x308]
lea ecx, [ebp - 0x151c]
call fcn.0040fe4f
mov dword [eax], 6
jmp 0x407f67
mov dword [ebp - 0x1b8], 0
jmp 0x407faf
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jg 0x40823d
mov dword [ebp - 0x124], 0x7e17f75
mov dword [ebp - 0xb84], 0xffffffff
mov dword [ebp - 0x124], 0
jmp 0x407fe9
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jg 0x40821e
mov dword [ebp - 0x274], 0x1da622a1
push dword [ebp - 0x124]
lea ecx, [ebp - 0x151c]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x40801b
jmp 0x40821e
mov dword [ebp - 0x274], 1
jmp 0x408034
mov eax, dword [ebp - 0x274]
dec eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0
jl 0x408219
mov dword [ebp - 0xb94], 0x8b15b45b
mov dword [ebp - 0x310], 0
jmp 0x408064
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 1
jge 0x408080
mov eax, dword [ebp - 0x310]
mov dword [ebp + eax*4 - 0xe74], 7
jmp 0x408057
mov esi, dword [ebp - 0x274]
mov edi, dword [ebp - 0x1b8]
push 0
lea ecx, [ebp - 0x151c]
call fcn.0040fe4f
imul edi, dword [eax]
add esi, edi
jne 0x4080ac
mov dword [ebp - 0xb74], 1
jmp 0x4080b3
and dword [ebp - 0xb74], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe74]
cmp dword [ebp - 0xb74], eax
jl 0x4080d4
mov dword [ebp - 0xe64], 1
jmp 0x4080db
and dword [ebp - 0xe64], 0
mov eax, dword [ebp - 0x124]
imul eax, dword [ebp - 0xe64]
cmp eax, 1
je 0x4080f9
mov dword [ebp - 0xb7c], 1
jmp 0x408100
and dword [ebp - 0xb7c], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0xb7c], eax
jne 0x40811a
mov dword [ebp - 0xfdc], 1
jmp 0x408121
and dword [ebp - 0xfdc], 0
mov eax, dword [ebp - 0xfdc]
mov dword [ebp - 0xb84], eax
cmp dword [ebp - 0xb84], 0xffffffff
jge 0x408142
mov dword [ebp - 0xe6c], 1
jmp 0x408149
and dword [ebp - 0xe6c], 0
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0xe6c]
jne 0x408163
mov dword [ebp - 0xb8c], 1
jmp 0x40816a
and dword [ebp - 0xb8c], 0
cmp dword [ebp - 0xb8c], 0xa41b
jle 0x408182
mov dword [ebp - 0x1104], 1
jmp 0x408189
and dword [ebp - 0x1104], 0
push 0
lea ecx, [ebp - 0x151c]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x1104]
imul ecx, dword [eax]
test ecx, ecx
je 0x4081aa
cmp dword [ebp - 0xb94], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb94]
cmp dword [ebp + eax - 0xe74], ecx
jl 0x4081cb
mov dword [ebp - 0xb9c], 1
jmp 0x4081d2
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0x12e4]
cmp eax, dword [ebp - 0xb9c]
jle 0x4081e7
cmp dword [ebp - 0x124], 0
imul eax, dword [ebp - 0x1b8], 0
cmp eax, 0xe994
jge 0x408201
mov dword [ebp - 0xfe4], 1
jmp 0x408208
and dword [ebp - 0xfe4], 0
mov eax, dword [ebp - 0xfe4]
mov dword [ebp - 0x1420], eax
jmp 0x408027
jmp 0x407fdc
mov byte [ebp - 0x16c], 0
movzx eax, byte [ebp - 0x16c]
test eax, eax
je 0x408238
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
jmp 0x407fa2
lea ecx, [ebp - 0x151c]
call fcn.0040fe33
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0xbdc], 0xfffffffc
mov dword [ebp - 0x1c0], 0xfffe
mov dword [ebp - 0x318], 0
jmp 0x408286
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 3
jge 0x4082a2
mov eax, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0x1110], 0x9a4d91f0
jmp 0x408279
mov eax, 0xbf03fd8e
test eax, eax
je 0x4082d9
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x48]
jne 0x4082c5
mov dword [ebp - 0xba4], 1
jmp 0x4082cc
and dword [ebp - 0xba4], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0xba4]
cmp dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1b58], eax
mov eax, 0x8d30
shl eax, 3
cmp eax, dword [ebp - 0x48]
jg 0x4082fb
mov dword [ebp - 0xe7c], 1
jmp 0x408302
and dword [ebp - 0xe7c], 0
cmp dword [ebp - 0xe7c], 0xf4f88039
je 0x40831a
mov dword [ebp - 0xbac], 1
jmp 0x408321
and dword [ebp - 0xbac], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xbac], eax
jne 0x408563
push 1
lea ecx, [ebp - 0x174c]
call fcn.0040fd61
mov dword [ebp - 0xbc4], 0xc86695cd
mov dword [ebp - 0x14c0], 0xbcf59f89
mov dword [ebp - 0xfc], 0
jmp 0x40836a
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x40838c
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x174c]
call fcn.0040fe4f
mov dword [eax], 0xfffffff9
jmp 0x40835d
mov dword [ebp - 0xfc], 0
jmp 0x4083a5
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x4083c1
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x15f4], 1
jmp 0x408398
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1950], eax
cmp dword [ebp - 0xbc4], 1
jne 0x4083ec
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x15f4], 0
jne 0x4083ec
and dword [ebp - 0x109c], 0
jmp 0x4083f6
mov dword [ebp - 0x109c], 1
cmp dword [ebp - 0x109c], 0
ja 0x40840b
mov dword [ebp - 0xbb4], 1
jmp 0x408412
and dword [ebp - 0xbb4], 0
cmp dword [ebp - 0xbb4], 3
je 0x408427
mov dword [ebp - 0x12ec], 1
jmp 0x40842e
and dword [ebp - 0x12ec], 0
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1cf8], eax
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1958], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1110]
cmp dword [ebp + eax - 0x1110], ecx
jge 0x408476
mov dword [ebp - 0xe84], 1
jmp 0x40847d
and dword [ebp - 0xe84], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xe84], eax
jl 0x408494
mov dword [ebp - 0xbbc], 1
jmp 0x40849b
and dword [ebp - 0xbbc], 0
cmp dword [ebp - 0xbbc], 0xffffffff
je 0x4084b0
mov dword [ebp - 0xfec], 1
jmp 0x4084b7
and dword [ebp - 0xfec], 0
push 0
lea ecx, [ebp - 0x174c]
call fcn.0040fe4f
mov eax, dword [eax]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
add eax, dword [ebp - 0xfec]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x1110]
cmp eax, dword [ebp - 0xbc4]
jge 0x4084f9
mov dword [ebp - 0xe8c], 1
jmp 0x408500
and dword [ebp - 0xe8c], 0
mov eax, dword [ebp - 0xe8c]
mov dword [ebp - 0x14c0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x15f4]
cmp dword [ebp - 0x1c0], eax
jge 0x40852d
mov dword [ebp - 0x5cc], 1
jmp 0x408534
and dword [ebp - 0x5cc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5cc]
mov dword [ebp + eax - 0x1110], ecx
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0xbdc], eax
lea ecx, [ebp - 0x174c]
call fcn.0040fe33
jmp 0x4085f4
mov dword [ebp - 0x12f4], 2
mov dword [ebp - 0xbcc], 0xbb6af833
mov dword [ebp - 0xbcc], 0xffff
cmp dword [ebp - 0xbcc], 0x31b54653
jle 0x408599
mov dword [ebp - 0x1164], 1
jmp 0x4085a0
and dword [ebp - 0x1164], 0
mov eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x1164]
jl 0x4085ba
mov dword [ebp - 0xbd4], 1
jmp 0x4085c1
and dword [ebp - 0xbd4], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0xbd4], eax
jle 0x4085db
mov dword [ebp - 0xe94], 1
jmp 0x4085e2
and dword [ebp - 0xe94], 0
mov eax, dword [ebp - 0x12f4]
add eax, dword [ebp - 0xe94]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c0]
dec eax
je 0x4086dc
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1110]
cmp dword [ebp - 0x1c8], eax
jne 0x408621
mov dword [ebp - 0xff4], 1
jmp 0x408628
and dword [ebp - 0xff4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1110]
mov dword [ebp - 0x1b60], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1960], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1110]
cmp dword [ebp - 0xbdc], eax
jge 0x408664
mov dword [ebp - 0xbe4], 1
jmp 0x40866b
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0xff4]
add eax, dword [ebp - 0xbe4]
cmp eax, dword [ebp - 0x1c0]
jle 0x40868b
mov dword [ebp - 0xe9c], 1
jmp 0x408692
and dword [ebp - 0xe9c], 0
cmp dword [ebp - 0xe9c], 0xffffffff
jle 0x4086a7
mov dword [ebp - 0x1428], 1
jmp 0x4086ae
and dword [ebp - 0x1428], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1e00], eax
push 8
pop eax
test eax, eax
jne 0x4086d0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1110], 0
je 0x4086dc
mov dword [ebp - 0xbec], 1
jmp 0x4086e3
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0xbec]
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x10a4], 1
mov dword [ebp - 0x320], 0
jmp 0x408712
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 2
jge 0x40872e
mov eax, dword [ebp - 0x320]
mov dword [ebp + eax*4 - 0x1f4c], 0x58e469ad
jmp 0x408705
mov byte [ebp - 0x1f1], 0
movzx eax, byte [ebp - 0x1f1]
test eax, eax
je 0x408756
push 0
push 0x15c9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp - 0x10a4]
inc eax
mov dword [ebp - 0x10a4], eax
mov dword [ebp - 0x1968], 0x2135
mov dword [ebp - 0x1b68], 0xffffffff
mov dword [ebp - 0x1970], 2
mov dword [ebp - 0xbf4], 0xfffffffc
mov eax, dword [ebp - 0xbf4]
dec eax
mov dword [ebp - 0xbf4], eax
mov byte [ebp - 0x16e], 0
movzx eax, byte [ebp - 0x16e]
test eax, eax
je 0x4087bc
push 0x25bb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0x330], 0
mov dword [ebp - 0x1314], 0xffffffff
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x328], 0xfffffff7
push 3
lea ecx, [ebp - 0x1120]
call fcn.0040fd61
mov dword [ebp - 0x628], 4
push 4
lea ecx, [ebp - 0x11ac]
call fcn.0040fd61
mov dword [ebp - 0x4c], 0xda972737
mov dword [ebp - 0x1430], 0x320ba2c1
mov dword [ebp - 0x28], 0
jmp 0x408826
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x408842
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1120]
call fcn.0040fe4f
mov dword [eax], 0x9ba8
jmp 0x40881f
mov dword [ebp - 0x28], 0
jmp 0x408852
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x40886e
push dword [ebp - 0x28]
lea ecx, [ebp - 0x11ac]
call fcn.0040fe4f
mov dword [eax], 0xa9f4f9a0
jmp 0x40884b
mov dword [ebp - 0x28], 0
jmp 0x40887e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x408894
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1f84], 0xffffffff
jmp 0x408877
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1d08], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1978], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1b70], eax
xor eax, eax
inc eax
imul eax, eax, 0x9637
test eax, eax
je 0x4088ce
cmp dword [ebp - 0x30], 0
je 0x4088ce
mov dword [ebp - 0xea4], 1
jmp 0x4088d5
and dword [ebp - 0xea4], 0
mov eax, dword [ebp - 0xea4]
sub eax, 0x2728
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x1980], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1dc0], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1988], eax
cmp dword [ebp - 0x30], 0x9ba0
je 0x408919
mov dword [ebp - 0xbfc], 1
jmp 0x408920
and dword [ebp - 0xbfc], 0
push 1
lea ecx, [ebp - 0x1120]
call fcn.0040fe4f
mov ecx, dword [ebp - 0xbfc]
cmp ecx, dword [eax]
jg 0x408943
mov dword [ebp - 0x12fc], 1
jmp 0x40894a
and dword [ebp - 0x12fc], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x40895e
mov dword [ebp - 0x6ac], 1
jmp 0x408965
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x6ac]
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x1b78], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1990], eax
push 3
lea ecx, [ebp - 0x11ac]
call fcn.0040fe4f
mov esi, eax
push 3
lea ecx, [ebp - 0x11ac]
call fcn.0040fe4f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x4089b4
mov dword [ebp - 0x6b0], 1
jmp 0x4089bb
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], 0
jmp 0x4089d4
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x408b97
mov dword [ebp - 0x6e8], 0xffffffff
mov dword [ebp - 0x1550], 0
mov dword [ebp - 0x1304], 5
mov dword [ebp - 0x4c], 2
jmp 0x408a0c
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x408b92
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1120]
call fcn.0040fe4f
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1120]
call fcn.0040fe4f
cmp dword [ebp - 0x328], 0xffffffff
je 0x408a47
mov dword [ebp - 0x6b8], 1
jmp 0x408a4e
and dword [ebp - 0x6b8], 0
cmp dword [ebp - 0x6b8], 0
jne 0x408a63
mov dword [ebp - 0x6a8], 1
jmp 0x408a6a
and dword [ebp - 0x6a8], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x11ac]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x6a8]
add ecx, dword [eax]
cmp ecx, 0xffffffff
jle 0x408a91
mov dword [ebp - 0x6c8], 1
jmp 0x408a98
and dword [ebp - 0x6c8], 0
mov esi, dword [ebp - 0x4c]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1120]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x6c8]
add ecx, dword [eax]
imul esi, ecx
cmp esi, 0xffff
je 0x408ac8
mov dword [ebp - 0x6d0], 1
jmp 0x408acf
and dword [ebp - 0x6d0], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1120]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x6d0]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x6e8]
jne 0x408af9
mov dword [ebp - 0x6d8], 1
jmp 0x408b00
and dword [ebp - 0x6d8], 0
cmp dword [ebp - 0x6d8], 0
jne 0x408b10
cmp dword [ebp - 0x1550], 0
mov eax, dword [ebp - 0x1304]
mov dword [ebp - 0x628], eax
mov esi, dword [ebp - 0x628]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x11ac]
call fcn.0040fe4f
cmp dword [eax], esi
jl 0x408b40
mov dword [ebp - 0x6e0], 1
jmp 0x408b47
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x1430], eax
mov esi, dword [ebp - 0x6e8]
push 1
lea ecx, [ebp - 0x1120]
call fcn.0040fe4f
add esi, dword [eax]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1f84], esi
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x11ac]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x408b8d
jmp 0x408a05
jmp 0x408a05
jmp 0x4089cd
lea ecx, [ebp - 0x11ac]
call fcn.0040fe33
lea ecx, [ebp - 0x1120]
call fcn.0040fe33
mov dword [ebp - 0x330], 0xfffffff2
jmp 0x408bc6
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0x10
jge 0x40907d
push 1
lea ecx, [ebp - 0x6a0]
call fcn.0040fd61
mov dword [ebp - 0x23c], 0xfffffffa
mov dword [ebp - 0x338], 0
jmp 0x408c03
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 1
jge 0x408c25
push dword [ebp - 0x338]
lea ecx, [ebp - 0x6a0]
call fcn.0040fe4f
mov dword [eax], 0x1c7b
jmp 0x408bf6
push 0
lea ecx, [ebp - 0x6a0]
call fcn.0040fe4f
push 0
lea ecx, [ebp - 0x6a0]
call fcn.0040fe4f
mov esi, eax
push 0
lea ecx, [ebp - 0x6a0]
call fcn.0040fe4f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x408c60
mov dword [ebp - 0x6f0], 1
jmp 0x408c67
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x23c], 0
jmp 0x408c8c
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x13
jle 0x408d82
mov dword [ebp - 0x98], 0xd2086bd0
mov dword [ebp - 0x98], 0
jmp 0x408cbc
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jg 0x408cef
push dword [ebp - 0x98]
lea ecx, [ebp - 0x6a0]
call fcn.0040fe4f
mov esi, eax
push dword [ebp - 0x98]
lea ecx, [ebp - 0x6a0]
call fcn.0040fe4f
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x408caf
mov eax, dword [ebp - 0x23c]
cmp dword [ebp - 0x98], eax
je 0x408d09
mov dword [ebp - 0x130c], 1
jmp 0x408d10
and dword [ebp - 0x130c], 0
push 0
lea ecx, [ebp - 0x6a0]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x408d40
push 0
lea ecx, [ebp - 0x6a0]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x408d40
mov dword [ebp - 0x14d0], 1
jmp 0x408d47
and dword [ebp - 0x14d0], 0
cmp dword [ebp - 0x98], 0
je 0x408d65
cmp dword [ebp - 0x98], 0
je 0x408d65
mov dword [ebp - 0x6f8], 1
jmp 0x408d6c
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6f8]
sub eax, 0xb0a
mov dword [ebp - 0x98], eax
jmp 0x408c7f
lea ecx, [ebp - 0x6a0]
call fcn.0040fe33
mov dword [ebp - 0x1314], 0x951ad386
mov byte [ebp - 0x170], 0
mov dword [ebp - 0x27c], 0
push 4
lea ecx, [ebp - 0x1764]
call fcn.0040fd61
mov dword [ebp - 0x340], 0
jmp 0x408dce
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 4
jge 0x408df0
push dword [ebp - 0x340]
lea ecx, [ebp - 0x1764]
call fcn.0040fe4f
mov dword [eax], 0xfffffffc
jmp 0x408dc1
mov esi, dword [ebp - 0x27c]
push 1
lea ecx, [ebp - 0x1764]
call fcn.0040fe4f
mov dword [eax], esi
mov dword [ebp - 0x27c], 0
jmp 0x408e1e
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 3
jg 0x408e4a
mov byte [ebp - 0x210], 0
movzx eax, byte [ebp - 0x210]
test eax, eax
je 0x408e48
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x408e11
lea ecx, [ebp - 0x1764]
call fcn.0040fe33
movzx eax, byte [ebp - 0x170]
test eax, eax
je 0x409078
mov dword [ebp - 0x284], 0xfffffffc
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x65c], 0xfffffff9
mov dword [ebp - 0x1438], 0xfba2522a
mov dword [ebp - 0x1d18], 0xf5a260df
mov dword [ebp - 0x348], 0
jmp 0x408eaf
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 2
jge 0x408ecb
mov eax, dword [ebp - 0x348]
mov dword [ebp + eax*4 - 0x1920], 9
jmp 0x408ea2
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x1998], eax
push 0xfffffffffffffff7
pop eax
sub eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0x65c]
jl 0x408ef4
mov dword [ebp - 0x5d4], 1
jmp 0x408efb
and dword [ebp - 0x5d4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5d4]
mov dword [ebp + eax - 0x1920], ecx
mov eax, dword [ebp - 0x65c]
imul eax, dword [ebp - 0x5d4]
cmp dword [ebp - 0x284], eax
jle 0x408f2f
mov dword [ebp - 0x700], 1
jmp 0x408f36
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x65c]
cmp dword [ebp - 0x700], eax
jle 0x408f50
mov dword [ebp - 0x708], 1
jmp 0x408f57
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x708], eax
jle 0x408f7a
jmp 0x408bb9
mov dword [ebp - 0x28c], 0xb3c6
push 4
lea ecx, [ebp - 0x177c]
call fcn.0040fd61
mov dword [ebp - 0x1b80], 0x9dd9
mov dword [ebp - 0x350], 0
jmp 0x4090b7
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 4
jge 0x4090d9
push dword [ebp - 0x350]
lea ecx, [ebp - 0x177c]
call fcn.0040fe4f
mov dword [eax], 9
jmp 0x4090aa
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x748], eax
push 2
lea ecx, [ebp - 0x177c]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x748]
mov dword [eax], ecx
cmp dword [ebp - 0x748], 0
je 0x40916f
mov dword [ebp - 0x131c], 0xe814
mov dword [ebp - 0x28c], 0x13
jmp 0x409126
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0x3c
jg 0x40916d
mov dword [ebp - 0x156c], 0x3843
mov eax, dword [ebp - 0x131c]
mov dword [ebp - 0x156c], eax
mov byte [ebp - 0x1f9], 0
movzx eax, byte [ebp - 0x1f9]
test eax, eax
je 0x40916b
push 0x129d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x409119
jmp 0x4091a5
mov byte [ebp - 0x172], 0
movzx eax, byte [ebp - 0x172]
test eax, eax
je 0x4091a5
push 0x98a
push 0
push 0
push 0x158a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
lea ecx, [ebp - 0x177c]
call fcn.0040fe33
mov dword [ebp - 0x360], 0
mov dword [ebp - 0x750], 4
mov dword [ebp - 0x1324], 0x9a971867
mov dword [ebp - 0x358], 0
jmp 0x4091e7
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 3
jge 0x409203
mov eax, dword [ebp - 0x358]
mov dword [ebp + eax*4 - 0x1794], 0xdb50
jmp 0x4091da
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1794]
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0
je 0x409251
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1794]
mov dword [ebp - 0x750], eax
mov eax, dword [ebp - 0x750]
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0
je 0x409251
mov dword [ebp - 0x758], 1
jmp 0x409258
and dword [ebp - 0x758], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1794]
sub eax, dword [ebp - 0x758]
mov dword [ebp - 0x1324], eax
mov byte [ebp - 0x212], 0
movzx eax, byte [ebp - 0x212]
test eax, eax
je 0x40928e
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov dword [ebp - 0x19a0], 0xc6a5
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x4092c5
push 0
push 0
push 0xf79
push 0x4be
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
mov byte [ebp - 0x201], 0
movzx eax, byte [ebp - 0x201]
test eax, eax
je 0x4092ed
push 0
push 0
push 0x392
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x7d0], 0xfffffffc
mov dword [ebp - 0x1d8], 0xfffe
mov dword [ebp - 0x368], 0
jmp 0x40932b
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 3
jge 0x409347
mov eax, dword [ebp - 0x368]
mov dword [ebp + eax*4 - 0x1130], 0x9a4d91f0
jmp 0x40931e
mov eax, 0xbf03fd8e
test eax, eax
je 0x40937e
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x54]
jne 0x40936a
mov dword [ebp - 0x760], 1
jmp 0x409371
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x760]
cmp dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1df0], eax
mov eax, 0x8d30
shl eax, 3
cmp eax, dword [ebp - 0x54]
jg 0x4093a0
mov dword [ebp - 0x768], 1
jmp 0x4093a7
and dword [ebp - 0x768], 0
cmp dword [ebp - 0x768], 0xf4f88039
je 0x4093bf
mov dword [ebp - 0x770], 1
jmp 0x4093c6
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x770], eax
jne 0x409608