Function at 0x402558
Capabilities:
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file size
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1bc0
call fcn.0046b950
push esi
push edi
push 4
lea ecx, [ebp - 0x16fc]
call fcn.00401e5e
mov dword [ebp - 0x458], 0x22ba3946
mov dword [ebp - 0x1918], 0x3a6c9cd4
mov dword [ebp - 0x1840], 0x71658a6
mov dword [ebp - 0x193c], 0x402ad92
mov dword [ebp - 0x2e4], 0
jmp 0x4025b5
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 4
jge 0x4025d4
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0x16fc]
call fcn.004017e6
and dword [eax], 0
jmp 0x4025a8
mov dword [ebp - 0x458], 0
jmp 0x4025ed
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 3
jg 0x402762
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0xdf8], 0xe77e815f
mov dword [ebp - 0x11bc], 0xfffffff6
mov byte [ebp - 0x176], 0
movzx eax, byte [ebp - 0x176]
test eax, eax
je 0x402637
push 0x293
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x2c4], 0
jmp 0x402650
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 3
jg 0x40275d
mov dword [ebp - 0x111c], 0xffffffff
push 4
lea ecx, [ebp - 0x1750]
call fcn.00401e5e
mov dword [ebp - 0x80], 0
jmp 0x402684
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x40269a
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x11b4], 0xffffffff
jmp 0x40267d
mov dword [ebp - 0x80], 0
jmp 0x4026aa
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x4026c6
push dword [ebp - 0x80]
lea ecx, [ebp - 0x1750]
call fcn.004017e6
mov dword [eax], 0x5189d9e6
jmp 0x4026a3
mov dword [ebp - 0x111c], 0
mov dword [ebp - 0xdf8], 1
mov esi, dword [ebp - 0xdf8]
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0x16fc]
call fcn.004017e6
cmp esi, dword [eax]
jge 0x402701
mov dword [ebp - 0xfbc], 1
jmp 0x402708
and dword [ebp - 0xfbc], 0
push 0
lea ecx, [ebp - 0x1750]
call fcn.004017e6
mov eax, dword [eax]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x11b4]
cmp eax, dword [ebp - 0xfbc]
jne 0x40273a
mov dword [ebp - 0xfc4], 1
jmp 0x402741
and dword [ebp - 0xfc4], 0
mov eax, dword [ebp - 0xfc4]
mov dword [ebp - 0x11bc], eax
lea ecx, [ebp - 0x1750]
call fcn.00401f30
jmp 0x402643
jmp 0x4025e0
lea ecx, [ebp - 0x16fc]
call fcn.00401f30
mov dword [ebp - 0x160c], 0x928c176b
mov dword [ebp - 0x1608], 0x928c176b
mov dword [ebp - 0x1604], 0x928c176b
mov dword [ebp - 0x1600], 0x928c176b
lea ecx, [ebp - 0x541]
call fcn.00401f4c
push eax
lea eax, [ebp - 0x15fc]
push eax
lea eax, [ebp - 0x160c]
push eax
lea ecx, [ebp - 0x1aa0]
call fcn.00401f4f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1448]
call fcn.00401f0a
push 2
lea ecx, [ebp - 0x1448]
call fcn.004017e6
and dword [eax], 0
jmp 0x402800
push 2
lea ecx, [ebp - 0x1448]
call fcn.004017e6
mov dword [ebp - 0xfcc], eax
mov eax, dword [ebp - 0xfcc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xfcc]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x1448]
call fcn.004017e6
cmp dword [eax], 0x1c
jg 0x40283a
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x402838
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x4027dc
lea ecx, [ebp - 0x1448]
call fcn.00401f30
push 4
lea ecx, [ebp - 0x1714]
call fcn.00401e5e
mov dword [ebp - 0x408], 0x22ba3946
mov dword [ebp - 0x1848], 0x3a6c9cd4
mov dword [ebp - 0x19d4], 1
mov dword [ebp - 0x1850], 0xffffffff
mov dword [ebp - 0x2e8], 0x37bc7528
mov dword [ebp - 0x194c], 1
mov dword [ebp - 0x1858], 0xe1ca2961
mov dword [ebp - 0xfd4], 0xfffffff8
mov dword [ebp - 0x24], 0
jmp 0x4028b2
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x4028c8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1a68], 0xb5ca9869
jmp 0x4028ab
mov dword [ebp - 0x24], 0
jmp 0x4028d8
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x4028ee
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1b30], 5
jmp 0x4028d1
mov dword [ebp - 0x24], 0
jmp 0x4028fe
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x402914
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1860], 0xaeb5
jmp 0x4028f7
mov eax, dword [ebp - 0xfd4]
dec eax
mov dword [ebp - 0xfd4], eax
mov dword [ebp - 0x2e8], 0
jmp 0x40293a
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0x18
je 0x40295f
mov byte [ebp - 0x17f], 0
movzx eax, byte [ebp - 0x17f]
test eax, eax
je 0x40295d
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x40292d
mov dword [ebp - 0x195c], 0x71658a6
mov dword [ebp - 0x1868], 0x402ad92
mov dword [ebp - 0x260], 0xffffffff
mov dword [ebp - 0x3a8], 0
jmp 0x402996
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 4
jge 0x4029b2
mov eax, dword [ebp - 0x3a8]
mov dword [ebp + eax*4 - 0x1b10], 0xffffffff
jmp 0x402989
cmp dword [ebp - 0x260], 0x5baf43b7
jl 0x402a23
mov dword [ebp - 0x260], 8
jmp 0x4029d7
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0x1b
jl 0x402a21
mov dword [ebp - 0x258], 0xffffffff
mov dword [ebp - 0x258], 0
jmp 0x402a03
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 4
jge 0x402a1f
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x1b10], 0xbf8f0aa6
jmp 0x4029f6
jmp 0x4029ca
jmp 0x402a46
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x402a46
push 0
push 0x1f4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 0x2f0], 0
jmp 0x402a5f
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 4
jge 0x402a7e
push dword [ebp - 0x2f0]
lea ecx, [ebp - 0x1714]
call fcn.004017e6
and dword [eax], 0
jmp 0x402a52
mov dword [ebp - 0x408], 0
jmp 0x402a97
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 3
jg 0x403cd1
mov dword [ebp - 0x268], 0xffffffff
mov dword [ebp - 0x2f8], 0
jmp 0x402ac7
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 4
jge 0x402ae3
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0x1b40], 0xffffffff
jmp 0x402aba
cmp dword [ebp - 0x268], 0x5baf43b7
jl 0x402b54
mov dword [ebp - 0x268], 8
jmp 0x402b08
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0x1b
jl 0x402b52
mov dword [ebp - 0x2b0], 0xffffffff
mov dword [ebp - 0x2b0], 0
jmp 0x402b34
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 4
jge 0x402b50
mov eax, dword [ebp - 0x2b0]
mov dword [ebp + eax*4 - 0x1b40], 0xbf8f0aa6
jmp 0x402b27
jmp 0x402afb
jmp 0x402b77
mov byte [ebp - 0x183], 0
movzx eax, byte [ebp - 0x183]
test eax, eax
je 0x402b77
push 0
push 0x1f4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 0x270], 0
mov dword [ebp - 0xd94], 0xe77e815f
mov dword [ebp - 0x204], 1
mov dword [ebp - 0x534], 0xfffb
mov dword [ebp - 0x1000], 0xb1d6a56c
mov dword [ebp - 0xce4], 0xffffffff
mov dword [ebp - 0x4ac], 0xc8951bb3
mov dword [ebp - 0x1038], 0x8f08877e
mov dword [ebp - 0x100], 0
jmp 0x402be0
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x402bfc
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x1384], 0xbaeef20f
jmp 0x402bd3
mov dword [ebp - 0x100], 0
jmp 0x402c15
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 4
jge 0x402c31
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x1b28], 0xd6c34f1d
jmp 0x402c08
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1384], 0
je 0x402e25
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1384]
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x534], 0xfffc
jb 0x402c70
mov dword [ebp - 0xfe8], 1
jmp 0x402c77
and dword [ebp - 0xfe8], 0
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0xfe8], eax
jne 0x402c91
mov dword [ebp - 0xff0], 1
jmp 0x402c98
and dword [ebp - 0xff0], 0
mov eax, dword [ebp - 0x204]
cmp eax, dword [ebp - 0xff0]
jne 0x402cb2
mov dword [ebp - 0xff8], 1
jmp 0x402cb9
and dword [ebp - 0xff8], 0
mov eax, dword [ebp - 0xff8]
mov dword [ebp - 0x1000], eax
mov eax, dword [ebp - 0x1000]
sub eax, 0x3fab614
cmp eax, 0x27f0
jle 0x402ce3
mov dword [ebp - 0x1008], 1
jmp 0x402cea
and dword [ebp - 0x1008], 0
mov eax, dword [ebp - 0x204]
cmp eax, dword [ebp - 0x1008]
je 0x402d04
mov dword [ebp - 0x1010], 1
jmp 0x402d0b
and dword [ebp - 0x1010], 0
mov eax, dword [ebp - 0xce4]
cmp dword [ebp - 0x1010], eax
jle 0x402d25
mov dword [ebp - 0x1018], 1
jmp 0x402d2c
and dword [ebp - 0x1018], 0
mov eax, dword [ebp - 0x1018]
mov dword [ebp - 0x204], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1384]
cmp dword [ebp - 0x204], eax
jl 0x402d59
mov dword [ebp - 0x1020], 1
jmp 0x402d60
and dword [ebp - 0x1020], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1384]
cmp dword [ebp - 0x1020], eax
jge 0x402d8a
mov eax, 0x66b7
test eax, eax
je 0x402d8a
mov dword [ebp - 0x1028], 1
jmp 0x402d91
and dword [ebp - 0x1028], 0
mov eax, dword [ebp - 0x1028]
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0
jne 0x402daf
cmp dword [ebp - 0x4ac], 0
je 0x402db6
cmp dword [ebp - 0x204], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x534]
cmp dword [ebp + eax - 0x1384], ecx
jg 0x402dd7
mov dword [ebp - 0x1030], 1
jmp 0x402dde
and dword [ebp - 0x1030], 0
mov eax, dword [ebp - 0x1030]
mov dword [ebp - 0x1038], eax
cmp dword [ebp - 0x1038], 0xfffffffc
jl 0x402dff
mov dword [ebp - 0x5b4], 1
jmp 0x402e06
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
add eax, 0x21b18574
cmp eax, dword [ebp - 0xce4]
jl 0x402e25
mov dword [ebp - 0x5bc], 1
jmp 0x402e2c
and dword [ebp - 0x5bc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5bc]
mov dword [ebp + eax - 0x1b28], ecx
mov dword [ebp - 0x1304], 0xfffffff6
mov dword [ebp - 0x19e8], 0
mov byte [ebp - 0x174], 0
movzx eax, byte [ebp - 0x174]
test eax, eax
je 0x402e84
push 0x25bb
push 0xb36
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov byte [ebp - 0x148], 0
movzx eax, byte [ebp - 0x148]
test eax, eax
je 0x402ea3
push 0x2515
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov byte [ebp - 0x1c9], 0
movzx eax, byte [ebp - 0x1c9]
test eax, eax
je 0x4031f0
mov dword [ebp - 0x88], 0x2667
mov dword [ebp - 0x3b0], 0xffffffff
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x5ec], 0
mov dword [ebp - 0xcfc], 1
mov dword [ebp - 0x4b0], 0x2275dd36
mov dword [ebp - 0xd14], 0xffffffff
mov dword [ebp - 0x11cc], 0x3e1fe01
mov dword [ebp - 0x1870], 0x1994
mov eax, 0xbd94543b
test eax, eax
je 0x402f60
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 1
jle 0x402f3a
mov dword [ebp - 0xcec], 1
jmp 0x402f41
and dword [ebp - 0xcec], 0
mov eax, dword [ebp - 0x88]
add eax, dword [ebp - 0xcec]
cmp eax, 0x13b01d91
jle 0x402f60
mov dword [ebp - 0x5c4], 1
jmp 0x402f67
and dword [ebp - 0x5c4], 0
cmp dword [ebp - 0x5c4], 0xffffffff
jne 0x402f7c
mov dword [ebp - 0xcf4], 1
jmp 0x402f83
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0xcf4], eax
je 0x402f9a
mov dword [ebp - 0x5cc], 1
jmp 0x402fa1
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x5cc]
je 0x402fc9
mov byte [ebp - 0x178], 0
movzx eax, byte [ebp - 0x178]
test eax, eax
je 0x402fc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40300c
mov dword [ebp - 0x5c], 0xffffffe6
jmp 0x402fd9
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x3c
jle 0x40300c
mov byte [ebp - 0x14a], 0
movzx eax, byte [ebp - 0x14a]
test eax, eax
je 0x403000
push 0x124e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x3b0], 0x3e25468d
jmp 0x402fd2
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0xcfc], 0
cmp dword [ebp - 0xcfc], 0
je 0x40303a
cmp dword [ebp - 0x5c], 0
je 0x40303a
mov dword [ebp - 0x5d4], 1
jmp 0x403041
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x5d4]
jg 0x403058
mov dword [ebp - 0xd04], 1
jmp 0x40305f
and dword [ebp - 0xd04], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0xd04], eax
jle 0x403076
mov dword [ebp - 0x5dc], 1
jmp 0x40307d
and dword [ebp - 0x5dc], 0
cmp dword [ebp - 0x5dc], 0xec73f5cf
jae 0x403095
mov dword [ebp - 0xd0c], 1
jmp 0x40309c
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0xd0c]
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x196c], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1878], eax
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x88], eax
jle 0x4030da
mov dword [ebp - 0x5e4], 1
jmp 0x4030e1
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0xd14], eax
mov eax, dword [ebp - 0xd14]
cmp dword [ebp - 0x5ec], eax
jl 0x403113
mov dword [ebp - 0xd1c], 1
jmp 0x40311a
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xd1c], eax
jle 0x403134
mov dword [ebp - 0x5f4], 1
jmp 0x40313b
and dword [ebp - 0x5f4], 0
imul eax, dword [ebp - 0x5f4], 0x5d90
test eax, eax
jne 0x40315b
cmp dword [ebp - 0x4b0], 0
jne 0x40315b
and dword [ebp - 0xd24], 0
jmp 0x403165
mov dword [ebp - 0xd24], 1
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0xd24], eax
jl 0x40317c
mov dword [ebp - 0x11c4], 1
jmp 0x403183
and dword [ebp - 0x11c4], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1984], eax
mov eax, 0x1f1c
test eax, eax
jne 0x40319d
xor eax, eax
inc eax
je 0x4031b0
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x4031b0
mov dword [ebp - 0x5fc], 1
jmp 0x4031b7
and dword [ebp - 0x5fc], 0
cmp dword [ebp - 0x5fc], 1
jae 0x4031d0
xor eax, eax
je 0x4031d0
mov dword [ebp - 0xd2c], 1
jmp 0x4031d7
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0xd2c]
mov dword [ebp - 0x11cc], eax
push 0x293
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 3
lea ecx, [ebp - 0x59c]
call fcn.00401e5e
push 2
lea ecx, [ebp - 0x14d8]
call fcn.00401e5e
mov dword [ebp - 0x20], 0
jmp 0x40321a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x403236
push dword [ebp - 0x20]
lea ecx, [ebp - 0x59c]
call fcn.004017e6
mov dword [eax], 0x7d45db34
jmp 0x403213
mov dword [ebp - 0x20], 0
jmp 0x403246
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x403262
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14d8]
call fcn.004017e6
mov dword [eax], 6
jmp 0x40323f
mov dword [ebp - 0x20], 0
jmp 0x403272
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x403288
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x11d4], 0
jmp 0x40326b
push 0
lea ecx, [ebp - 0x59c]
call fcn.004017e6
push 1
lea ecx, [ebp - 0x59c]
call fcn.004017e6
push 0
lea ecx, [ebp - 0x59c]
call fcn.004017e6
mov esi, eax
push 1
lea ecx, [ebp - 0x59c]
call fcn.004017e6
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x4032d0
mov dword [ebp - 0x604], 1
jmp 0x4032d7
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
add eax, 0xfe46
cmp eax, 0x7ccc
jge 0x4032f5
mov dword [ebp - 0x508], 1
jmp 0x4032fc
and dword [ebp - 0x508], 0
push 0
lea ecx, [ebp - 0x14d8]
call fcn.004017e6
mov ecx, dword [ebp - 0x508]
mov dword [eax], ecx
cmp dword [ebp - 0x508], 0
jne 0x403335
push 0
lea ecx, [ebp - 0x14d8]
call fcn.004017e6
cmp dword [eax], 0
jne 0x403335
and dword [ebp - 0xd34], 0
jmp 0x40333f
mov dword [ebp - 0xd34], 1
cmp dword [ebp - 0xd34], 4
je 0x403354
mov dword [ebp - 0x60c], 1
jmp 0x40335b
and dword [ebp - 0x60c], 0
push 0
lea ecx, [ebp - 0x59c]
call fcn.004017e6
mov ecx, dword [ebp - 0x60c]
cmp ecx, dword [eax]
jg 0x40337e
mov dword [ebp - 0xd3c], 1
jmp 0x403385
and dword [ebp - 0xd3c], 0
push 0
lea ecx, [ebp - 0x59c]
call fcn.004017e6
mov ecx, dword [ebp - 0xd3c]
sub ecx, dword [eax]
neg ecx
je 0x4033ae
xor eax, eax
je 0x4033ae
mov dword [ebp - 0x614], 1
jmp 0x4033b5
and dword [ebp - 0x614], 0
push 0
lea ecx, [ebp - 0x59c]
call fcn.004017e6
mov ecx, dword [ebp - 0x614]
cmp ecx, dword [eax]
jne 0x4033d8
mov dword [ebp - 0xd44], 1
jmp 0x4033df
and dword [ebp - 0xd44], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd44]
mov dword [ebp + eax - 0x11d4], ecx
mov byte [ebp - 0x14c], 0
movzx eax, byte [ebp - 0x14c]
test eax, eax
je 0x40340a
call dword [sym.imp.USER32.dll_DestroyCaret]
lea ecx, [ebp - 0x14d8]
call fcn.00401f30
lea ecx, [ebp - 0x59c]
call fcn.00401f30
mov dword [ebp - 0x270], 0
jmp 0x403439
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 3
jg 0x403ccc
push 2
lea ecx, [ebp - 0x1048]
call fcn.00401e5e
mov dword [ebp - 0x12b4], 0x4e55b65a
mov dword [ebp - 0xe8], 0
jmp 0x403476
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x403498
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x1048]
call fcn.004017e6
mov dword [eax], 0x342eb90d
jmp 0x403469
mov dword [ebp - 0xe8], 0
jmp 0x4034b1
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x4034ca
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x34], 0x13638ecf
jmp 0x4034a4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x34], 1
jmp 0x4034ef
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x34], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
jl 0x40367e
mov dword [ebp - 0x12ac], 0x18c84b7b
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x34]
lea ecx, [ebp - 0x1048]
call fcn.004017e6
mov esi, eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x34]
lea ecx, [ebp - 0x1048]
call fcn.004017e6
mov ecx, dword [esi]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x34]
lea ecx, [ebp - 0x1048]
call fcn.004017e6
cmp dword [eax], 1
je 0x403560
mov dword [ebp - 0x61c], 1
jmp 0x403567
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x61c], 0xffffffff
jne 0x40357c
mov dword [ebp - 0xd4c], 1
jmp 0x403583
and dword [ebp - 0xd4c], 0
imul eax, dword [ebp - 0xd4c], 0xfffc
test eax, eax
jne 0x40359f
xor eax, eax
inc eax
jne 0x40359f
and dword [ebp - 0x624], 0
jmp 0x4035a9
mov dword [ebp - 0x624], 1
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x34]
lea ecx, [ebp - 0x1048]
call fcn.004017e6
mov ecx, dword [ebp - 0x624]
sub ecx, dword [eax]
cmp ecx, 0xff29
je 0x4035da
mov dword [ebp - 0x11dc], 1
jmp 0x4035e1
and dword [ebp - 0x11dc], 0
push 1
lea ecx, [ebp - 0x1048]
call fcn.004017e6
mov eax, dword [ebp - 0x12ac]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x34]
lea eax, [eax + ecx + 4]
test eax, eax
jne 0x40361c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
jne 0x40361c
and dword [ebp - 0xd54], 0
jmp 0x403626
mov dword [ebp - 0xd54], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd54]
sub ecx, dword [ebp + eax - 0x34]
add ecx, 0xffff
je 0x403657
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
je 0x403657
mov dword [ebp - 0x62c], 1
jmp 0x40365e
and dword [ebp - 0x62c], 0
push 0
lea ecx, [ebp - 0x1048]
call fcn.004017e6
mov ecx, dword [ebp - 0x62c]
sub ecx, dword [eax]
mov dword [ebp - 0x12b4], ecx
jmp 0x4034da
lea ecx, [ebp - 0x1048]
call fcn.00401f30
mov dword [ebp - 0x12ec], 0xffffffff
push 4
lea ecx, [ebp - 0x16cc]
call fcn.00401e5e
mov dword [ebp - 0x300], 4
mov dword [ebp - 0xd7c], 0
mov dword [ebp - 0x644], 0xffffffff
mov dword [ebp - 0x65c], 0x40194ddb
mov dword [ebp - 0x1880], 0xfffffff9
mov dword [ebp - 0x68], 0xcc2fdcb
mov dword [ebp - 0x1988], 8
mov dword [ebp - 0x12bc], 0xfffffff8
mov dword [ebp - 0x12dc], 0xeb2391cb
mov dword [ebp - 0x15e4], 0x5a9864ba
mov dword [ebp - 0x15e0], 0x5a9864ba
mov dword [ebp - 0x15dc], 0x5a9864ba
mov dword [ebp - 0x15d8], 0x5a9864ba
lea ecx, [ebp - 0x489]
call fcn.00401f4c
push eax
lea eax, [ebp - 0x15d4]
push eax
lea eax, [ebp - 0x15e4]
push eax
lea ecx, [ebp - 0x1b18]
call fcn.00401f4f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1058]
call fcn.00401f0a
mov dword [ebp - 0xd6c], 0x100
mov dword [ebp - 0x12cc], 0xffff
mov dword [ebp - 0x300], 0
jmp 0x403781
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0xffffffe3
jne 0x40381b
mov dword [ebp - 0x18a4], 0xffffffff
push 4
lea ecx, [ebp - 0x1948]
call fcn.00401e5e
mov dword [ebp - 0x1990], 0x595ad338
mov dword [ebp - 0x18ac], 0x423b19d8
mov dword [ebp - 0xd5c], 8
mov dword [ebp - 0x438], 0
jmp 0x4037dc
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 4
jge 0x4037fe
push dword [ebp - 0x438]
lea ecx, [ebp - 0x1948]
call fcn.004017e6
mov dword [eax], 0xfffffffa
jmp 0x4037cf
mov eax, dword [ebp - 0xd5c]
dec eax
mov dword [ebp - 0xd5c], eax
lea ecx, [ebp - 0x1948]
call fcn.00401f30
jmp 0x403774
mov dword [ebp - 0x68], 0
jmp 0x40382b
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jg 0x4039ee
mov dword [ebp - 0xd84], 0xfffffffe
push dword [ebp - 0x68]
lea ecx, [ebp - 0x1058]
call fcn.004017e6
mov esi, eax
push dword [ebp - 0x68]
lea ecx, [ebp - 0x1058]
call fcn.004017e6
mov ecx, dword [esi]
mov dword [eax], ecx
push dword [ebp - 0x68]
lea ecx, [ebp - 0x1058]
call fcn.004017e6
push 3
lea ecx, [ebp - 0x1058]
call fcn.004017e6
push dword [ebp - 0x68]
lea ecx, [ebp - 0x1058]
call fcn.004017e6
mov eax, dword [ebp - 0x644]
cmp dword [ebp - 0xd7c], eax
jle 0x4038a4
mov dword [ebp - 0x634], 1
jmp 0x4038ab
and dword [ebp - 0x634], 0
cmp dword [ebp - 0x634], 0xffffffff
jg 0x4038c0
mov dword [ebp - 0xd64], 1
jmp 0x4038c7
and dword [ebp - 0xd64], 0
push dword [ebp - 0x68]
lea ecx, [ebp - 0x1058]
call fcn.004017e6
mov ecx, dword [ebp - 0xd64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12bc]
sub eax, dword [ebp - 0x65c]
je 0x4038fd
push 1
lea ecx, [ebp - 0x1058]
call fcn.004017e6
cmp dword [eax], 0
jne 0x40390f
cmp dword [ebp - 0xd6c], 0
jne 0x40390f
and dword [ebp - 0x63c], 0
jmp 0x403919
mov dword [ebp - 0x63c], 1
cmp dword [ebp - 0x63c], 0
jb 0x40392e
mov dword [ebp - 0x12c4], 1
jmp 0x403935
and dword [ebp - 0x12c4], 0
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0x198c], eax
mov eax, dword [ebp - 0xd84]
mov dword [ebp - 0x18b4], eax
cmp dword [ebp - 0x644], 0x937da878
jbe 0x403965
mov dword [ebp - 0xd74], 1
jmp 0x40396c
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0xd74]
jne 0x403983
mov dword [ebp - 0x64c], 1
jmp 0x40398a
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
add eax, 0x3232af72
cmp eax, dword [ebp - 0xd7c]
jle 0x4039a9
mov dword [ebp - 0x654], 1
jmp 0x4039b0
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x12cc]
cmp dword [ebp - 0x654], eax
jg 0x4039ca
mov dword [ebp - 0x12d4], 1
jmp 0x4039d1
and dword [ebp - 0x12d4], 0
mov eax, dword [ebp - 0xd84]
mov dword [ebp - 0x19fc], eax
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0x12dc], eax
jmp 0x403824
lea ecx, [ebp - 0x1058]
call fcn.00401f30
mov dword [ebp - 0x90], 0
jmp 0x403a12
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x403a2e
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x12fc], 0xffffffff
jmp 0x403a05
mov dword [ebp - 0x90], 0
jmp 0x403a47
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x403a69
push dword [ebp - 0x90]
lea ecx, [ebp - 0x16cc]
call fcn.004017e6
mov dword [eax], 0x5189d9e6
jmp 0x403a3a
push 2
lea ecx, [ebp - 0x16b4]
call fcn.00401e5e
mov dword [ebp - 0x12e4], 0xf2f4a8b1
mov dword [ebp - 0x18bc], 0xfffffffc
mov dword [ebp - 0x1994], 1
mov dword [ebp - 0x18c4], 0xfde2bbef
mov dword [ebp - 0x1a60], 0
mov dword [ebp - 0xd8c], 1
mov dword [ebp - 0x108], 0
jmp 0x403acb
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 2
jge 0x403aed
push dword [ebp - 0x108]
lea ecx, [ebp - 0x16b4]
call fcn.004017e6
mov dword [eax], 0x75c9
jmp 0x403abe
mov dword [ebp - 0x108], 0
jmp 0x403b06
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 4
jge 0x403b22
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x1bb0], 0x99d94b4b
jmp 0x403af9
push 0
lea ecx, [ebp - 0x16b4]
call fcn.004017e6
mov eax, dword [eax]
mov dword [ebp - 0x12e4], eax
mov eax, dword [ebp - 0xd8c]
inc eax
mov dword [ebp - 0xd8c], eax
lea ecx, [ebp - 0x16b4]
call fcn.00401f30
mov dword [ebp - 0x12ec], 0
push 2
lea ecx, [ebp - 0x172c]
call fcn.00401e5e
mov dword [ebp - 0x12f4], 0xf2f4a8b1
mov dword [ebp - 0x18cc], 0xfffffffc
mov dword [ebp - 0x1768], 1
mov dword [ebp - 0x176c], 0xfde2bbef
mov dword [ebp - 0x1774], 0
mov dword [ebp - 0x664], 1
mov dword [ebp - 0x98], 0
jmp 0x403bbb
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x403bdd
push dword [ebp - 0x98]
lea ecx, [ebp - 0x172c]
call fcn.004017e6
mov dword [eax], 0x75c9
jmp 0x403bae
mov dword [ebp - 0x98], 0
jmp 0x403bf6
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x403c12
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1bc0], 0x99d94b4b
jmp 0x403be9
push 0
lea ecx, [ebp - 0x172c]
call fcn.004017e6
mov eax, dword [eax]
mov dword [ebp - 0x12f4], eax
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
lea ecx, [ebp - 0x172c]
call fcn.00401f30
mov dword [ebp - 0xd94], 1
mov esi, dword [ebp - 0xd94]
push dword [ebp - 0x270]
lea ecx, [ebp - 0x1714]
call fcn.004017e6
cmp esi, dword [eax]
jge 0x403c70
mov dword [ebp - 0x66c], 1
jmp 0x403c77
and dword [ebp - 0x66c], 0
push 0
lea ecx, [ebp - 0x16cc]
call fcn.004017e6
mov eax, dword [eax]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x12fc]
cmp eax, dword [ebp - 0x66c]
jne 0x403ca9
mov dword [ebp - 0xd9c], 1
jmp 0x403cb0
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0xd9c]
mov dword [ebp - 0x1304], eax
lea ecx, [ebp - 0x16cc]
call fcn.00401f30
jmp 0x40342c
jmp 0x402a8a
lea ecx, [ebp - 0x1714]
call fcn.00401f30
mov dword [ebp - 0x3c], 0x5d6c05ba
mov dword [ebp - 0x308], 0
jmp 0x403cfc
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 2
jge 0x403d18
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0x14f8], 0
jmp 0x403cef
mov dword [ebp - 0x3c], 0
jmp 0x403d28
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jl 0x403ed8
mov dword [ebp - 0x3b8], 0xeede0b40
mov dword [ebp - 0x177c], 0
mov dword [ebp - 0x130c], 0
mov dword [ebp - 0x1784], 0xb43d2717
mov dword [ebp - 0x132c], 0xee491ba6
mov dword [ebp - 0x19e4], 0x197e7c14
mov dword [ebp - 0x19e0], 0x197e7c14
mov dword [ebp - 0x19dc], 0x197e7c14
mov dword [ebp - 0x19d8], 0x197e7c14
mov dword [ebp - 0x4b8], 0xc8210466
mov dword [ebp - 0x3b8], 2
jmp 0x403daf
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 3
jl 0x403ed3
mov dword [ebp - 0x1324], 0x7d7c1188
mov dword [ebp - 0x131c], 1
mov dword [ebp - 0x1314], 0x1c5a3d7f
mov eax, dword [ebp - 0x4b8]
mov ecx, dword [ebp - 0x4b8]
inc ecx
mov dword [ebp - 0x4b8], ecx
test eax, eax
jne 0x403e03
cmp dword [ebp - 0x130c], 0
jne 0x403e03
and dword [ebp - 0x674], 0
jmp 0x403e0d
mov dword [ebp - 0x674], 1
cmp dword [ebp - 0x674], 7
je 0x403e22
mov dword [ebp - 0xda4], 1
jmp 0x403e29
and dword [ebp - 0xda4], 0
imul eax, dword [ebp - 0xda4], 0
cmp eax, 0xa266d210
jb 0x403e43
mov dword [ebp - 0x67c], 1
jmp 0x403e4a
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
neg eax
cmp eax, dword [ebp - 0x1314]
jl 0x403e66
mov dword [ebp - 0xdac], 1
jmp 0x403e6d
and dword [ebp - 0xdac], 0
cmp dword [ebp - 0xdac], 0xef3b0639
ja 0x403e85
mov dword [ebp - 0x684], 1
jmp 0x403e8c
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x131c]
imul eax, dword [ebp - 0x684]
imul eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1324], eax
jle 0x403eab
cmp dword [ebp - 0x3c], 0
jne 0x403eb8
xor eax, eax
jne 0x403eb8
and dword [ebp - 0xdb4], 0
jmp 0x403ec2
mov dword [ebp - 0xdb4], 1
mov eax, dword [ebp - 0xdb4]
mov dword [ebp - 0x132c], eax
jmp 0x403da2
jmp 0x403d21
mov dword [ebp - 0x3c], 0
jmp 0x403ee8
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x403f0e
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x14f8], 0
je 0x403efd
jmp 0x403f0e
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x14f8], 0
je 0x403f0c
jmp 0x403f0e
jmp 0x403ee1
mov dword [ebp - 0x694], 0x1fad
mov dword [ebp - 0x310], 0
jmp 0x403f31
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 1
jge 0x403f4d
mov eax, dword [ebp - 0x310]
mov dword [ebp + eax*4 - 0x188], 0x8ec0ae97
jmp 0x403f24
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x188], 0
jmp 0x403f7b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x188]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x188], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x188], 0x1b
jle 0x404162
mov dword [ebp - 0x410], 0x6cce57bf
mov dword [ebp - 0x410], 0xa
jmp 0x403fb2
mov eax, dword [ebp - 0x410]
dec eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 7
jg 0x40413c
mov dword [ebp - 0x190], 0xfffffffa
mov dword [ebp - 0x190], 0x14
jmp 0x403fe2
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xb
jl 0x404137
mov dword [ebp - 0x1334], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x188], 0
jne 0x40401b
cmp dword [ebp - 0x694], 0
jne 0x40401b
and dword [ebp - 0x68c], 0
jmp 0x404025
mov dword [ebp - 0x68c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp dword [ebp - 0x68c], eax
jne 0x404046
mov dword [ebp - 0xdbc], 1
jmp 0x40404d
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0xdbc]
sub eax, dword [ebp - 0x190]
cmp dword [ebp - 0x694], eax
jle 0x40406d
mov dword [ebp - 0xdc4], 1
jmp 0x404074
and dword [ebp - 0xdc4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xdc4]
sub ecx, dword [ebp + eax - 0x188]
cmp dword [ebp - 0x190], ecx
jl 0x40409b
mov dword [ebp - 0x69c], 1
jmp 0x4040a2
and dword [ebp - 0x69c], 0
cmp dword [ebp - 0x69c], 0xfffffff9
je 0x4040b7
mov dword [ebp - 0xdcc], 1
jmp 0x4040be
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0x1334]
mov ecx, dword [ebp - 0xdcc]
neg ecx
sub eax, ecx
cmp dword [ebp - 0x190], eax
jl 0x4040f5
mov byte [ebp - 0x1a1], 0
movzx eax, byte [ebp - 0x1a1]
test eax, eax
je 0x4040f3
push 0x18d5
call dword [sym.imp.USER32.dll_GetSysColor]
jmp 0x404116
mov byte [ebp - 0x14e], 0
movzx eax, byte [ebp - 0x14e]
test eax, eax
je 0x404116
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x404132
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x403fd5
jmp 0x403fa5
mov byte [ebp - 0x152], 0
movzx eax, byte [ebp - 0x152]
test eax, eax
je 0x40415d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x403f60
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x6cc], 0xdaa237f4
mov dword [ebp - 0x133c], 0xfffffff7
mov dword [ebp - 0x1344], 1
mov dword [ebp - 0x178c], 0x9235
mov dword [ebp - 0x318], 0
jmp 0x4041aa
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 3
jge 0x4041c6
mov eax, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0x1b64], 0x131d
jmp 0x40419d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1794], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x179c], eax
mov eax, 0x5d56
test eax, eax
je 0x4041f3
cmp dword [ebp - 0x10], 0
je 0x4041f3
mov dword [ebp - 0x6a4], 1
jmp 0x4041fa
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x6a4], eax
jg 0x404211
mov dword [ebp - 0xdd4], 1
jmp 0x404218
and dword [ebp - 0xdd4], 0
cmp dword [ebp - 0xdd4], 1
jbe 0x40422d
mov dword [ebp - 0x6ac], 1
jmp 0x404234
and dword [ebp - 0x6ac], 0
cmp dword [ebp - 0x6ac], 0xcee3
je 0x40424c
mov dword [ebp - 0xddc], 1
jmp 0x404253
and dword [ebp - 0xddc], 0
cmp dword [ebp - 0xddc], 0xfffffffc
je 0x40426e
cmp dword [ebp - 0x10], 0
je 0x40426e
mov dword [ebp - 0x6b4], 1
jmp 0x404275
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 0x58efa97f
jg 0x40428d
mov dword [ebp - 0xde4], 1
jmp 0x404294
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xde4], eax
jl 0x4042ab
mov dword [ebp - 0x6bc], 1
jmp 0x4042b2
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x6bc]
cmp eax, dword [ebp - 0x10]
jge 0x4042cc
mov dword [ebp - 0xdec], 1
jmp 0x4042d3
and dword [ebp - 0xdec], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xdec], eax
jle 0x4042ea
mov dword [ebp - 0x6c4], 1
jmp 0x4042f1
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x6c4], eax
jl 0x404308
mov dword [ebp - 0xdf4], 1
jmp 0x40430f
and dword [ebp - 0xdf4], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xdf4]
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 0xd2ae857b
jae 0x404336
mov dword [ebp - 0xdfc], 1
jmp 0x40433d
and dword [ebp - 0xdfc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xdfc], eax
jg 0x404354
mov dword [ebp - 0x6d4], 1
jmp 0x40435b
and dword [ebp - 0x6d4], 0
cmp dword [ebp - 0x6d4], 0xffff
jbe 0x404373
mov dword [ebp - 0xe04], 1
jmp 0x40437a
and dword [ebp - 0xe04], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xe04], eax
jne 0x404391
mov dword [ebp - 0x6dc], 1
jmp 0x404398
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x133c]
cmp dword [ebp - 0x6dc], eax
jg 0x4043b2
mov dword [ebp - 0xe0c], 1
jmp 0x4043b9
and dword [ebp - 0xe0c], 0
imul eax, dword [ebp - 0xe0c], 0x9ab8
cmp eax, 0xffffffff
jne 0x4043d4
mov dword [ebp - 0x6e4], 1
jmp 0x4043db
and dword [ebp - 0x6e4], 0
cmp dword [ebp - 0x6e4], 0x387f
jg 0x4043f3
mov dword [ebp - 0xe14], 1
jmp 0x4043fa
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0xe14]
mov dword [ebp - 0x1344], eax
mov dword [ebp - 0x10], 0
jmp 0x404416
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x40443d
mov byte [ebp - 0x150], 0
movzx eax, byte [ebp - 0x150]
test eax, eax
je 0x40443b
push 0
push 0x22b9
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x40440f
mov dword [ebp - 0x40], 0x5d6c05ba
mov dword [ebp - 0x704], 0xf782
push 1
lea ecx, [ebp - 0x1660]
call fcn.00401e5e
mov dword [ebp - 0x550], 0xb8561371
mov dword [ebp - 0x134c], 0x68939f5f
mov dword [ebp - 0x135c], 0x382e
mov dword [ebp - 0x3c0], 0
jmp 0x404492
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 1
jge 0x4044b4
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x1660]
call fcn.004017e6
mov dword [eax], 1
jmp 0x404485
push 0
lea ecx, [ebp - 0x1660]
call fcn.004017e6
or dword [eax], 0xffffffff
cmp dword [ebp - 0x704], 0xffffffff
je 0x4044d9
mov dword [ebp - 0xe34], 1
jmp 0x4044e0
and dword [ebp - 0xe34], 0
cmp dword [ebp - 0x134c], 1
jb 0x4044f5
mov dword [ebp - 0x6ec], 1
jmp 0x4044fc
and dword [ebp - 0x6ec], 0
cmp dword [ebp - 0x6ec], 1
je 0x404511
mov dword [ebp - 0xe1c], 1
jmp 0x404518
and dword [ebp - 0xe1c], 0
mov eax, dword [ebp - 0xe1c]
neg eax
cmp eax, 1
jbe 0x404531
mov dword [ebp - 0x6f4], 1
jmp 0x404538
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
inc eax
jne 0x404553
mov eax, 0x7001
test eax, eax
jne 0x404553
and dword [ebp - 0xe24], 0
jmp 0x40455d
mov dword [ebp - 0xe24], 1
cmp dword [ebp - 0xe24], 0xd34c
jne 0x404575
mov dword [ebp - 0x6fc], 1
jmp 0x40457c
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x550]
cmp eax, dword [ebp - 0x6fc]
jg 0x404596
mov dword [ebp - 0xe2c], 1
jmp 0x40459d
and dword [ebp - 0xe2c], 0
mov eax, dword [ebp - 0xe2c]
inc eax
je 0x4045bb
cmp dword [ebp - 0x704], 0
je 0x4045bb
mov dword [ebp - 0x70c], 1
jmp 0x4045c2
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0xe34]
sub eax, dword [ebp - 0x70c]
cmp eax, dword [ebp - 0x550]
jl 0x4045e2
mov dword [ebp - 0x1354], 1
jmp 0x4045e9
and dword [ebp - 0x1354], 0
mov eax, dword [ebp - 0x135c]
mov dword [ebp - 0x550], eax
mov byte [ebp - 0x1e1], 0
movzx eax, byte [ebp - 0x1e1]
test eax, eax
je 0x404639
push 0x1c1f
push 0x223c
push 0x156d
push 0x261c
push 0xc83
push 0x12e4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
lea ecx, [ebp - 0x1660]
call fcn.00401f30
push 2
lea ecx, [ebp - 0x1958]
call fcn.00401e5e
mov dword [ebp - 0xf0], 0
jmp 0x40466a
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 4
jge 0x404686
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x1118], 0x2f4a8b10
jmp 0x40465d
mov dword [ebp - 0xf0], 0
jmp 0x40469f
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jge 0x4046c1
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x1958]
call fcn.004017e6
mov dword [eax], 0xffff
jmp 0x404692
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1118], 0xfffffffa
jb 0x4046fa
mov byte [ebp - 0x17a], 0
movzx eax, byte [ebp - 0x17a]
test eax, eax
je 0x4046f5
push 0x5e2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x404931
push 1
lea ecx, [ebp - 0x47c]
call fcn.00401e5e
mov dword [ebp - 0x320], 0
jmp 0x404720
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 1
jge 0x404742
push dword [ebp - 0x320]
lea ecx, [ebp - 0x47c]
call fcn.004017e6
mov dword [eax], 0xd4ea6801
jmp 0x404713
push 0
lea ecx, [ebp - 0x47c]
call fcn.004017e6
and dword [eax], 0
jmp 0x404778
push 0
lea ecx, [ebp - 0x47c]
call fcn.004017e6
mov dword [ebp - 0xe3c], eax
mov eax, dword [ebp - 0xe3c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xe3c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x47c]
call fcn.004017e6
cmp dword [eax], 0xfffffff8
jge 0x4047a1
mov dword [ebp - 0x1364], 3
cmp dword [ebp - 0x1364], 0
je 0x40479f
jmp 0x4047a1
jmp 0x404754
push 0
lea ecx, [ebp - 0x47c]
call fcn.004017e6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1118], 0
je 0x40489d
push 0
lea ecx, [ebp - 0x47c]
call fcn.004017e6
cmp dword [eax], 0xd4856cd8
jne 0x4047e3
mov dword [ebp - 0x136c], 1
jmp 0x4047ea
and dword [ebp - 0x136c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1118]
mov dword [ebp - 0x17a4], eax
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0x1118]
push 0
lea ecx, [ebp - 0x47c]
call fcn.004017e6
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x47c]
call fcn.004017e6
add esi, dword [eax]
push 4
pop eax
imul eax, eax, 3
imul esi, dword [ebp + eax - 0x1118]
push 0
lea ecx, [ebp - 0x47c]
call fcn.004017e6
cmp esi, dword [eax]
jne 0x40485b
mov eax, 0x80335900
test eax, eax
je 0x40485b
mov dword [ebp - 0x714], 1
jmp 0x404862
and dword [ebp - 0x714], 0
cmp dword [ebp - 0x714], 0xffff
jbe 0x40487e
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x40487e
and dword [ebp - 0xe44], 0
jmp 0x404888
mov dword [ebp - 0xe44], 1
cmp dword [ebp - 0xe44], 1
je 0x40489d
mov dword [ebp - 0x1374], 1
jmp 0x4048a4
and dword [ebp - 0x1374], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1118]
mov dword [ebp - 0x17ac], eax
push 0
lea ecx, [ebp - 0x47c]
call fcn.004017e6
mov esi, eax
push 0
lea ecx, [ebp - 0x47c]
call fcn.004017e6
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x4048e5
mov dword [ebp - 0x71c], 1
jmp 0x4048ec
and dword [ebp - 0x71c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1118]
cmp dword [ebp - 0x71c], eax
jge 0x40490d
mov dword [ebp - 0xe4c], 1
jmp 0x404914
and dword [ebp - 0xe4c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xe4c]
mov dword [ebp + eax - 0x1118], ecx
lea ecx, [ebp - 0x47c]
call fcn.00401f30
lea ecx, [ebp - 0x1958]
call fcn.00401f30
mov dword [ebp - 0x143c], 0
mov dword [ebp - 0x1438], 1
mov dword [ebp - 0x450], 0
jmp 0x404969
mov eax, dword [ebp - 0x450]
inc eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 2
jge 0x404985
mov eax, dword [ebp - 0x450]
mov dword [ebp + eax*4 - 0x1b50], 0
jmp 0x40495c
mov eax, dword [ebp - 0x143c]
mov dword [ebp - 0x1438], eax
mov byte [ebp - 0x154], 0
movzx eax, byte [ebp - 0x154]
test eax, eax
je 0x4049b4
push 1
push 0x26df
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov dword [ebp - 0x328], 0
jmp 0x4049cd
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 2
jge 0x4049e9
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0x1550], 0
jmp 0x4049c0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x11ac], 0xdf3d37a5
mov dword [ebp - 0x17b4], 0x5145
mov dword [ebp - 0x110], 0xffffffe6
jmp 0x404a20
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xfffffffc
jle 0x404b67
mov dword [ebp - 0xa0], 9
cmp dword [ebp - 0xa0], 0
je 0x404a94
mov dword [ebp - 0xa0], 0
jmp 0x404a59
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 6
jne 0x404a8f
mov byte [ebp - 0x1a9], 0
movzx eax, byte [ebp - 0x1a9]
test eax, eax
je 0x404a8d
push 0x12ba
push 0
push 0x19cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp 0x404a4c
jmp 0x404b62
push 1
lea ecx, [ebp - 0x14f0]
call fcn.00401e5e
mov dword [ebp - 0x3c8], 0
jmp 0x404aba
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 1
jge 0x404adc
push dword [ebp - 0x3c8]
lea ecx, [ebp - 0x14f0]
call fcn.004017e6
mov dword [eax], 0xfaafe30f
jmp 0x404aad
mov dword [ebp - 0xa0], 0
jmp 0x404af5
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x12
je 0x404b38
push 0
lea ecx, [ebp - 0x14f0]
call fcn.004017e6
mov dword [ebp - 0x724], eax
push 0
lea ecx, [ebp - 0x14f0]
call fcn.004017e6
mov ecx, dword [ebp - 0x724]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x724]
mov eax, dword [eax]
mov dword [ebp - 0x11ac], eax
jmp 0x404ae8
mov byte [ebp - 0x156], 0
movzx eax, byte [ebp - 0x156]
test eax, eax
je 0x404b57
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp - 0x14f0]
call fcn.00401f30
jmp 0x404a13
mov dword [ebp - 0x110], 0
jmp 0x404b80
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jle 0x404ba5
mov dword [ebp - 0x1128], 0x9646
imul eax, dword [ebp - 0x110], 0x10c1
mov dword [ebp - 0x1128], eax
jmp 0x404b73
mov dword [ebp - 0x40], 0
jmp 0x404bb5
cmp dword [ebp - 0x40], 2
jl 0x4067a6
mov dword [ebp - 0x248], 1
mov dword [ebp - 0x330], 0
jmp 0x404be2
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 3
jge 0x404bfe
mov eax, dword [ebp - 0x330]
mov dword [ebp + eax*4 - 0x1b70], 0x6310feca
jmp 0x404bd5
mov byte [ebp - 0x17c], 0
movzx eax, byte [ebp - 0x17c]
test eax, eax
je 0x404c1a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
xor eax, eax
je 0x404d3a
mov dword [ebp - 0x338], 6
push 3
lea ecx, [ebp - 0x166c]
call fcn.00401e5e
mov dword [ebp - 0x418], 0
jmp 0x404c52
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 3
jge 0x404c71
push dword [ebp - 0x418]
lea ecx, [ebp - 0x166c]
call fcn.004017e6
and dword [eax], 0
jmp 0x404c45
mov dword [ebp - 0x338], 0
jmp 0x404c8a
mov eax, dword [ebp - 0x338]
dec eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0xffffffe8
jne 0x404d04
mov dword [ebp - 0x2a0], 0x845d811f
mov dword [ebp - 0x2a0], 2
jmp 0x404cb6
mov eax, dword [ebp - 0x2a0]
dec eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jl 0x404cf3
mov byte [ebp - 0x158], 0
movzx eax, byte [ebp - 0x158]
test eax, eax
je 0x404cd9
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0x166c]
call fcn.004017e6
cmp dword [eax], 0
je 0x404cf1
jmp 0x404cf3
jmp 0x404ca9
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x248], eax
jmp 0x404c7d
mov byte [ebp - 0x1d1], 0
movzx eax, byte [ebp - 0x1d1]
test eax, eax
je 0x404d2d
push 0x2593
push 0x56a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
lea ecx, [ebp - 0x166c]
call fcn.00401f30
jmp 0x404db3
mov dword [ebp - 0x210], 0x67d50f82
mov dword [ebp - 0x248], 0
jmp 0x404d5d
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 2
jg 0x404db3
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x210], 0
jmp 0x404d8c
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jg 0x404db1
mov byte [ebp - 0x15a], 0
movzx eax, byte [ebp - 0x15a]
test eax, eax
je 0x404daf
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x404d7f
jmp 0x404d50
mov dword [ebp - 0x3e0], 0xeede0b40
mov dword [ebp - 0x17bc], 0xfffffffc
mov byte [ebp - 0x17e], 0
movzx eax, byte [ebp - 0x17e]
test eax, eax
je 0x404de1
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov byte [ebp - 0x15c], 0
movzx eax, byte [ebp - 0x15c]
test eax, eax
je 0x404dfb
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 0x17c4], 0
mov dword [ebp - 0x128], 0xffffffff
mov dword [ebp - 0x1130], 0xb586fa66
mov dword [ebp - 0x1310], 0x3758
mov dword [ebp - 0x3d0], 0
jmp 0x404e3c
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 3
jge 0x404e58
mov eax, dword [ebp - 0x3d0]
mov dword [ebp + eax*4 - 0x1394], 0
jmp 0x404e2f
mov dword [ebp - 0x128], 0xffffffff
jmp 0x404e71
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 5
je 0x405116
mov dword [ebp - 0x11c], 0x88adae8c
mov dword [ebp - 0x1138], 0xfffffffd
mov dword [ebp - 0x11c], 0
jmp 0x404eab
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jg 0x4050df
mov dword [ebp - 0x230], 5
push 1
lea ecx, [ebp - 0x16a8]
call fcn.00401e5e
mov dword [ebp - 0x340], 0
jmp 0x404ee8
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 1
jge 0x404f0a
push dword [ebp - 0x340]
lea ecx, [ebp - 0x16a8]
call fcn.004017e6
mov dword [eax], 0xbda73a15
jmp 0x404edb
mov dword [ebp - 0x230], 2
jmp 0x404f23
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jl 0x4050cf
mov dword [ebp - 0xe54], 0x37828451
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ebp + ecx*4 - 0x1394]
cmp dword [ebp + eax*4 - 0x1394], ecx
jge 0x404f62
mov dword [ebp - 0x73c], 1
jmp 0x404f69
and dword [ebp - 0x73c], 0
xor eax, eax
jne 0x405032
cmp dword [ebp - 0x11c], 0xc4aee507
jbe 0x404f8d
xor eax, eax
je 0x404f8d
mov dword [ebp - 0x13c8], 1
jmp 0x404f94
and dword [ebp - 0x13c8], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x17cc], eax
mov dword [ebp - 0xe54], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0xe54], eax
jl 0x404fc4
mov dword [ebp - 0x72c], 1
jmp 0x404fcb
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x72c], eax
jg 0x404fe5
mov dword [ebp - 0xe5c], 1
jmp 0x404fec
and dword [ebp - 0xe5c], 0
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0xe5c]
jg 0x405006
mov dword [ebp - 0x734], 1
jmp 0x40500d
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x1130], eax
mov eax, dword [ebp - 0x230]
cmp dword [ebp + eax*4 - 0x1394], 2
jne 0x405032
and dword [ebp - 0xe64], 0
jmp 0x40503c
mov dword [ebp - 0xe64], 1
cmp dword [ebp - 0xe64], 0xffffffff
je 0x405051
mov dword [ebp - 0xe6c], 1
jmp 0x405058
and dword [ebp - 0xe6c], 0
mov eax, dword [ebp - 0x73c]
cmp eax, dword [ebp - 0xe6c]
je 0x40506d
cmp dword [ebp - 0x128], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1394], 0xf844ba92
je 0x40509b
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1394], 0
je 0x40509b
mov dword [ebp - 0x744], 1
jmp 0x4050a2
and dword [ebp - 0x744], 0
mov esi, dword [ebp - 0x128]
imul esi, dword [ebp - 0x744]
push 0
lea ecx, [ebp - 0x16a8]
call fcn.004017e6
mov dword [eax], esi
mov eax, dword [ebp - 0x1310]
mov dword [ebp - 0x1138], eax
jmp 0x404f16
lea ecx, [ebp - 0x16a8]
call fcn.00401f30
jmp 0x404e9e
mov byte [ebp - 0x1b1], 0
movzx eax, byte [ebp - 0x1b1]
test eax, eax
je 0x405111
push 0
push 0x18ae
push 0x2489
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
jmp 0x404e64
mov dword [ebp - 0x123c], 0
mov dword [ebp - 0xa8], 0x477862fd
mov dword [ebp - 0x3d8], 0xffffffff
mov dword [ebp - 0x440], 0
jmp 0x40514d
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 2
jge 0x405169
mov eax, dword [ebp - 0x440]
mov dword [ebp + eax*4 - 0x1980], 0x8c245e32
jmp 0x405140
mov dword [ebp - 0xa8], 0
jmp 0x405182
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 7
jle 0x405426
mov dword [ebp - 0x75c], 0x955205
mov dword [ebp - 0xe84], 0xbf748bbe
mov dword [ebp - 0xe94], 0xfffffffc
mov dword [ebp - 0x348], 0
jmp 0x4051c6
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 2
jge 0x4051e2
mov eax, dword [ebp - 0x348]
mov dword [ebp + eax*4 - 0xfe0], 0x9ba095a9
jmp 0x4051b9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xfe0], 0
je 0x405203
or eax, 0xffffffff
je 0x405203
mov dword [ebp - 0x76c], 1
jmp 0x40520a
and dword [ebp - 0x76c], 0
mov eax, 0x3086335c
test eax, eax
je 0x405228
cmp dword [ebp - 0xa8], 0
je 0x405228
mov dword [ebp - 0xe74], 1
jmp 0x40522f
and dword [ebp - 0xe74], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xe74], eax
jg 0x405254
cmp dword [ebp - 0x3d8], 0
jne 0x405254
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xfe0], 0
mov eax, dword [ebp - 0x75c]
cmp dword [ebp - 0x3d8], eax
jl 0x40526e
mov dword [ebp - 0x74c], 1
jmp 0x405275
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x74c], eax
jne 0x40528f
mov dword [ebp - 0xe7c], 1
jmp 0x405296
and dword [ebp - 0xe7c], 0
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0xe7c]
jg 0x4052b0
mov dword [ebp - 0x754], 1
jmp 0x4052b7
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0xe84], eax
cmp dword [ebp - 0xe84], 0
je 0x4052e8
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x4052e8
cmp dword [ebp - 0xa8], 0
je 0x4052e8
mov dword [ebp - 0x11f0], 1
jmp 0x4052ef
and dword [ebp - 0x11f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfe0]
mov dword [ebp - 0x17d4], eax
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x17dc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3d8]
cmp dword [ebp + eax - 0xfe0], ecx
jne 0x40532f
mov dword [ebp - 0xe8c], 1
jmp 0x405336
and dword [ebp - 0xe8c], 0
cmp dword [ebp - 0xe8c], 0x6d9e
jl 0x40534e
mov dword [ebp - 0x764], 1
jmp 0x405355
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x764]
sub eax, 0x4548
mov dword [ebp - 0xe94], eax
mov eax, dword [ebp - 0xe94]
cmp dword [ebp - 0x76c], eax
jne 0x405380
mov dword [ebp - 0xe9c], 1
jmp 0x405387
and dword [ebp - 0xe9c], 0
mov eax, dword [ebp - 0x3d8]
imul eax, dword [ebp - 0xe9c]
cmp eax, 4
je 0x4053a5
mov dword [ebp - 0x774], 1
jmp 0x4053ac
and dword [ebp - 0x774], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xfe0]
cmp dword [ebp - 0x774], eax
jle 0x4053cd
mov dword [ebp - 0xea4], 1
jmp 0x4053d4
and dword [ebp - 0xea4], 0
cmp dword [ebp - 0xea4], 9
je 0x4053e9
mov dword [ebp - 0x77c], 1
jmp 0x4053f0
and dword [ebp - 0x77c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x77c]
mov dword [ebp + eax - 0x1980], ecx
mov byte [ebp - 0x15e], 0
movzx eax, byte [ebp - 0x15e]
test eax, eax
je 0x405421
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jmp 0x405175
mov dword [ebp - 0x17e4], 0xb43d2717
mov dword [ebp - 0x124c], 0xee491ba6
mov dword [ebp - 0x1c], 0xdb2bc40e
mov dword [ebp - 0x198], 0xd0d658ed
mov dword [ebp - 0xecc], 0x3cb8e004
mov dword [ebp - 0x7ac], 0xfa3c9e4a
push 3
lea ecx, [ebp - 0x16c0]
call fcn.00401e5e
mov dword [ebp - 0x350], 0
jmp 0x405485
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 3
jge 0x4054a7
push dword [ebp - 0x350]
lea ecx, [ebp - 0x16c0]
call fcn.004017e6
mov dword [eax], 0xce005ab1
jmp 0x405478
mov byte [ebp - 0x180], 0
movzx eax, byte [ebp - 0x180]
test eax, eax
je 0x4054cc
push 0
push 0x1ef7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
je 0x405597
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x17ec], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x17f4], eax
cmp dword [ebp - 0x198], 0x1e707165
je 0x405512
cmp dword [ebp - 0x1c], 0
je 0x405512
mov dword [ebp - 0xeac], 1
jmp 0x405519
and dword [ebp - 0xeac], 0
mov eax, dword [ebp - 0xeac]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
add eax, 0x7f59
cmp eax, 1
jne 0x405541
mov dword [ebp - 0x784], 1
jmp 0x405548
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x784], eax
jge 0x405557
cmp dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 3
jg 0x40556f
mov eax, 0xc2a4
test eax, eax
jne 0x40556f
and dword [ebp - 0xeb4], 0
jmp 0x405579
mov dword [ebp - 0xeb4], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xeb4], eax
je 0x405590
mov dword [ebp - 0x78c], 1
jmp 0x405597
and dword [ebp - 0x78c], 0
cmp dword [ebp - 0x198], 0
jne 0x4055b8
cmp dword [ebp - 0x198], 0
jne 0x4055b8
cmp dword [ebp - 0x1c], 0
jne 0x4055b8
and dword [ebp - 0xebc], 0
jmp 0x4055c2
mov dword [ebp - 0xebc], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xebc], eax
jl 0x4055d9
mov dword [ebp - 0x794], 1
jmp 0x4055e0
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x794], 0xcb8ce3e
jg 0x4055f8
mov dword [ebp - 0xec4], 1
jmp 0x4055ff
and dword [ebp - 0xec4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xec4], eax
jl 0x405616
mov dword [ebp - 0x79c], 1
jmp 0x40561d
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
mov dword [ebp - 0xecc], eax
cmp dword [ebp - 0xecc], 0
je 0x405644
cmp dword [ebp - 0x1c], 0
je 0x405644
mov dword [ebp - 0x7a4], 1
jmp 0x40564b
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x7a4], eax
jl 0x405662
mov dword [ebp - 0xed4], 1
jmp 0x405669
and dword [ebp - 0xed4], 0
mov eax, dword [ebp - 0xed4]
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x7ac], eax
jge 0x40568c
mov dword [ebp - 0xedc], 1
jmp 0x405693
and dword [ebp - 0xedc], 0
mov esi, dword [ebp - 0x1c]
add esi, dword [ebp - 0xedc]
push 0
lea ecx, [ebp - 0x16c0]
call fcn.004017e6
mov dword [eax], esi
lea ecx, [ebp - 0x16c0]
call fcn.00401f30
mov dword [ebp - 0x19f8], 0x197e7c14
mov dword [ebp - 0x19f4], 0x197e7c14
mov dword [ebp - 0x19f0], 0x197e7c14
mov dword [ebp - 0x19ec], 0x197e7c14
mov dword [ebp - 0x420], 0xe0cf
mov dword [ebp - 0x358], 0xd9532bb1
mov dword [ebp - 0x7c4], 9
mov dword [ebp - 0x218], 0x6718e503
mov dword [ebp - 0x7cc], 0x3413f087
mov dword [ebp - 0xefc], 0xfffffff9
mov dword [ebp - 0x1148], 0x366
mov dword [ebp - 0x11fc], 0x4067bc62
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0
je 0x4058e1
cmp dword [ebp - 0x218], 0
jne 0x40576f
cmp dword [ebp - 0x218], 0
jne 0x40576f
and dword [ebp - 0x7b4], 0
jmp 0x405779
mov dword [ebp - 0x7b4], 1
mov eax, dword [ebp - 0x7b4]
sub eax, 0x1405
cmp eax, 0x8722
jne 0x405797
mov dword [ebp - 0xee4], 1
jmp 0x40579e
and dword [ebp - 0xee4], 0
mov eax, dword [ebp - 0x420]
cmp dword [ebp - 0xee4], eax
jle 0x4057b8
mov dword [ebp - 0x7bc], 1
jmp 0x4057bf
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x358]
cmp dword [ebp - 0x7bc], eax
jne 0x4057d9
mov dword [ebp - 0xeec], 1
jmp 0x4057e0
and dword [ebp - 0xeec], 0
mov eax, dword [ebp - 0xeec]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0xefc]
cmp dword [ebp - 0x7c4], eax
jge 0x405812
mov dword [ebp - 0xef4], 1
jmp 0x405819
and dword [ebp - 0xef4], 0
mov eax, dword [ebp - 0x7c4]
cmp dword [ebp - 0xef4], eax
jg 0x405833
mov dword [ebp - 0x1140], 1
jmp 0x40583a
and dword [ebp - 0x1140], 0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x17fc], eax
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x7cc], eax
jl 0x405860
mov dword [ebp - 0x11f4], 1
jmp 0x405867
and dword [ebp - 0x11f4], 0
cmp dword [ebp - 0xefc], 0x2589d389
jge 0x40587f
mov dword [ebp - 0x7d4], 1
jmp 0x405886
and dword [ebp - 0x7d4], 0
imul eax, dword [ebp - 0x7d4], 0x511b
cmp eax, dword [ebp - 0x1148]
jg 0x4058a4
mov dword [ebp - 0xf04], 1
jmp 0x4058ab
and dword [ebp - 0xf04], 0
cmp dword [ebp - 0xf04], 2
jle 0x4058c0
mov dword [ebp - 0x7dc], 1
jmp 0x4058c7
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x358]
cmp eax, dword [ebp - 0x7dc]
je 0x4058e1
mov dword [ebp - 0xf0c], 1
jmp 0x4058e8
and dword [ebp - 0xf0c], 0
mov eax, dword [ebp - 0xf0c]
mov dword [ebp - 0x11fc], eax
mov dword [ebp - 0x4d0], 0xc8210466
mov dword [ebp - 0x1804], 0
mov dword [ebp - 0x7f4], 6
mov dword [ebp - 0x180c], 0x534bf8f0
mov dword [ebp - 0x120c], 5
mov dword [ebp - 0x1214], 3
mov dword [ebp - 0x1814], 0xfffffffb
mov dword [ebp - 0x1160], 0xffffffff
mov dword [ebp - 0x181c], 0x754320e3
mov dword [ebp - 0x1824], 0xffffffff
mov dword [ebp - 0xf1c], 0xed6b6572
mov dword [ebp - 0x1158], 0xffffffff
mov dword [ebp - 0x1150], 0xe23a266d
or dword [ebp - 0x1634], 0xffffffff
or dword [ebp - 0x1630], 0xffffffff
or dword [ebp - 0x162c], 0xffffffff
or dword [ebp - 0x1628], 0xffffffff
lea ecx, [ebp - 0x549]
call fcn.00401f4c
push eax
lea eax, [ebp - 0x1624]
push eax
lea eax, [ebp - 0x1634]
push eax
lea ecx, [ebp - 0x1b48]
call fcn.00401f4f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x16d8]
call fcn.00401f0a
mov dword [ebp - 0x4c0], 0x6b43
mov dword [ebp - 0x1204], 0
mov byte [ebp - 0x160], 0
movzx eax, byte [ebp - 0x160]
test eax, eax
je 0x4059fc
push 0x187b
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [ebp - 0x4c0]
dec eax
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x1150]
cmp dword [ebp - 0x4c0], eax
jge 0x405a23
mov dword [ebp - 0x7fc], 1
jmp 0x405a2a
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x1204]
cmp dword [ebp - 0x1158], eax
jle 0x405a44
mov dword [ebp - 0x7e4], 1
jmp 0x405a4b
and dword [ebp - 0x7e4], 0
cmp dword [ebp - 0xf1c], 1
jge 0x405a60
mov dword [ebp - 0xf14], 1
jmp 0x405a67
and dword [ebp - 0xf14], 0
mov eax, dword [ebp - 0x7e4]
imul eax, dword [ebp - 0xf14]
cmp eax, dword [ebp - 0x120c]
jle 0x405a8e
mov eax, 0x2e91
test eax, eax
jne 0x405a8e
and dword [ebp - 0x7ec], 0
jmp 0x405a98
mov dword [ebp - 0x7ec], 1
mov eax, dword [ebp - 0x1160]
imul eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x7f4], eax
mov eax, dword [ebp - 0xf1c]
cmp dword [ebp - 0x7f4], eax
jge 0x405ac5
mov dword [ebp - 0xf24], 1
jmp 0x405acc
and dword [ebp - 0xf24], 0
push 1
lea ecx, [ebp - 0x16d8]
call fcn.004017e6
mov ecx, dword [ebp - 0xf24]
cmp ecx, dword [eax]
jg 0x405aef
mov dword [ebp - 0xf2c], 1
jmp 0x405af6
and dword [ebp - 0xf2c], 0
mov eax, dword [ebp - 0x7fc]
cmp eax, dword [ebp - 0xf2c]
jg 0x405b10
mov dword [ebp - 0x804], 1
jmp 0x405b17
and dword [ebp - 0x804], 0
cmp dword [ebp - 0x804], 0xa8fad749
ja 0x405b2f
mov dword [ebp - 0xf34], 1
jmp 0x405b36
and dword [ebp - 0xf34], 0
mov eax, dword [ebp - 0x1214]
cmp dword [ebp - 0xf34], eax
jle 0x405b50
mov dword [ebp - 0x80c], 1
jmp 0x405b57
and dword [ebp - 0x80c], 0
push 1
lea ecx, [ebp - 0x16d8]
call fcn.004017e6
mov ecx, dword [ebp - 0x80c]
mov dword [eax], ecx
lea ecx, [ebp - 0x16d8]
call fcn.00401f30
mov dword [ebp - 0x3e0], 2
jmp 0x405b90
cmp dword [ebp - 0x3e0], 3
jl 0x4067a1
push 1
lea ecx, [ebp - 0x14cc]
call fcn.00401e5e
mov dword [ebp - 0x121c], 0xe86524f2
mov dword [ebp - 0x1168], 0
mov dword [ebp - 0xf4c], 0x3ca955a
mov dword [ebp - 0xf8], 0
jmp 0x405be1
jmp 0x404bae
push 2
lea ecx, [ebp - 0x13a4]
call fcn.00401e5e
mov dword [ebp - 0xb8], 0
jmp 0x4067cc
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x4067ee
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x13a4]
call fcn.004017e6
mov dword [eax], 5
jmp 0x4067bf
mov dword [ebp - 0xb8], 0
jmp 0x406807
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 4
jge 0x406823
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x1a0c], 0
jmp 0x4067fa
push 0
lea ecx, [ebp - 0x13a4]
call fcn.004017e6
mov dword [eax], 9
jmp 0x40685c
push 0
lea ecx, [ebp - 0x13a4]
call fcn.004017e6
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x8c8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x8c8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x13a4]
call fcn.004017e6
cmp dword [eax], 0x13
jl 0x406925
mov dword [ebp - 0x11a0], 0xfffffff7
mov dword [ebp - 0x11a8], 0xffffffff
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0xc90], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xc90]
mov dword [ebp + eax - 0x1a0c], ecx
cmp dword [ebp - 0xc90], 0
jne 0x4068cd
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a0c]
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0x1a0c]
test eax, eax
je 0x4068eb
mov eax, 0x7308
test eax, eax
je 0x4068eb
mov eax, 0x727cad7d
test eax, eax
je 0x4068eb
mov dword [ebp - 0x1254], 1
jmp 0x4068f2
and dword [ebp - 0x1254], 0
mov dword [ebp - 0x11a8], 0x7bff44ca
mov byte [ebp - 0x164], 0
movzx eax, byte [ebp - 0x164]
test eax, eax
je 0x406920
push 0x19e0
push 0xddb
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x406838
lea ecx, [ebp - 0x13a4]
call fcn.00401f30
mov dword [ebp - 0x40], 0
jmp 0x406940
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jg 0x406a01
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x1550], 0
je 0x40695c
jmp 0x406a01
mov dword [ebp - 0x125c], 0xffffffff
mov dword [ebp - 0x11b0], 0xfffffff6
mov dword [ebp - 0x187c], 2
mov dword [ebp - 0x1884], 0xcfe04822
mov dword [ebp - 0x1890], 0x9f845d81
mov dword [ebp - 0x18a0], 0xbc662a2b
mov dword [ebp - 0x18a8], 0xffffffff
mov dword [ebp - 0x18b0], 0x938dd44a
mov dword [ebp - 0x18b8], 1
mov dword [ebp - 0x18c0], 0xfe8b0d19
mov dword [ebp - 0x18c8], 8
mov dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x125c]
mov dword [ebp - 0x11b0], eax
mov eax, dword [ebp - 0x8d0]
inc eax
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x1550], 0
je 0x4069fc
jmp 0x406a01
jmp 0x406939
mov dword [ebp - 0x10c], 0xe387fb0b
mov dword [ebp - 0x3e8], 0
jmp 0x406a24
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 2
jge 0x406a40
mov eax, dword [ebp - 0x3e8]
mov dword [ebp + eax*4 - 0x1520], 8
jmp 0x406a17
mov dword [ebp - 0x10c], 0
jmp 0x406a59
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jge 0x406a75
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x1520], 0xffffffff
jmp 0x406a4c
mov dword [ebp - 0x10c], 0
jmp 0x406a8e
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jg 0x406bc9
push 3
lea ecx, [ebp - 0x10e4]
call fcn.00401e5e
mov dword [ebp - 0x1264], 0
mov dword [ebp - 0x370], 0
jmp 0x406acb
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 3
jge 0x406aea
push dword [ebp - 0x370]
lea ecx, [ebp - 0x10e4]
call fcn.004017e6
and dword [eax], 0
jmp 0x406abe
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1520]
mov dword [ebp - 0x18d0], eax
push 2
lea ecx, [ebp - 0x10e4]
call fcn.004017e6
cmp dword [eax], 0x87642760
je 0x406b1e
mov dword [ebp - 0x101c], 1
jmp 0x406b25
and dword [ebp - 0x101c], 0
cmp dword [ebp - 0x101c], 0xffffffff
jle 0x406b3a
mov dword [ebp - 0x8d8], 1
jmp 0x406b41
and dword [ebp - 0x8d8], 0
xor eax, eax
jne 0x406b52
push 0
lea ecx, [ebp - 0x10e4]
call fcn.004017e6
cmp dword [ebp - 0x8d8], 0xcee3
jg 0x406b6a
mov dword [ebp - 0xc98], 1
jmp 0x406b71
and dword [ebp - 0xc98], 0
push 0
lea ecx, [ebp - 0x10e4]
call fcn.004017e6
mov ecx, dword [ebp - 0xc98]
sub ecx, dword [eax]
jne 0x406ba3
push 2
lea ecx, [ebp - 0x10e4]
call fcn.004017e6
cmp dword [eax], 0
jne 0x406ba3
and dword [ebp - 0x8e0], 0
jmp 0x406bad
mov dword [ebp - 0x8e0], 1
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x1264], eax
lea ecx, [ebp - 0x10e4]
call fcn.00401f30
jmp 0x406a81
mov dword [ebp - 0x240], 1
mov dword [ebp - 0x126c], 0x59ff446c
mov dword [ebp - 0x1274], 0xc4433ac2
mov dword [ebp - 0xc0], 0
jmp 0x406c00
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x406c1c
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x1570], 0xffff
jmp 0x406bf3
mov dword [ebp - 0xc0], 0
jmp 0x406c35
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x406c51
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x11c0], 0xffffffff
jmp 0x406c28
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x18d8], eax
mov eax, dword [ebp - 0x240]
dec eax
cmp eax, dword [ebp - 0x240]
je 0x406c78
mov dword [ebp - 0xe78], 1
jmp 0x406c7f
and dword [ebp - 0xe78], 0
cmp dword [ebp - 0xe78], 0xfffffffc
jne 0x406c94
mov dword [ebp - 0x8e8], 1
jmp 0x406c9b
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x8e8], eax
jg 0x406cb5
mov dword [ebp - 0xca0], 1
jmp 0x406cbc
and dword [ebp - 0xca0], 0
xor eax, eax
sub eax, dword [ebp - 0xca0]
cmp eax, 0x7b2415fb
jg 0x406cd7
mov dword [ebp - 0x8f0], 1
jmp 0x406cde
and dword [ebp - 0x8f0], 0
cmp dword [ebp - 0x8f0], 4
jge 0x406cf3
mov dword [ebp - 0x11b8], 1
jmp 0x406cfa
and dword [ebp - 0x11b8], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x18e0], eax
or eax, 0xffffffff
jne 0x406d24
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1570], 0
jne 0x406d24
and dword [ebp - 0xf68], 0
jmp 0x406d2e
mov dword [ebp - 0xf68], 1
cmp dword [ebp - 0xf68], 0x4aee5077
jge 0x406d46
mov dword [ebp - 0x8f8], 1
jmp 0x406d4d
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x126c]
cmp dword [ebp - 0x8f8], eax
jge 0x406d67
mov dword [ebp - 0xca8], 1
jmp 0x406d6e
and dword [ebp - 0xca8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xca8]
sub ecx, dword [ebp + eax - 0x1570]
sub ecx, 0x3637
cmp dword [ebp - 0x240], ecx
je 0x406d9b
mov dword [ebp - 0x900], 1
jmp 0x406da2
and dword [ebp - 0x900], 0
cmp dword [ebp - 0x900], 0x451d77f1
jge 0x406dba
mov dword [ebp - 0x518], 1
jmp 0x406dc1
and dword [ebp - 0x518], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x518]
mov dword [ebp + eax - 0x11c0], ecx
mov eax, dword [ebp - 0x518]
add eax, 0x3c94a791
mov dword [ebp - 0x1274], eax
mov dword [ebp - 0x1a0], 0xffff
mov dword [ebp - 0x220], 0xfffffff6
mov dword [ebp - 0x560], 0
mov dword [ebp - 0x428], 0
jmp 0x406e1c
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 1
jge 0x406e38
mov eax, dword [ebp - 0x428]
mov dword [ebp + eax*4 - 0x11c8], 0x62bb2c59
jmp 0x406e0f
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x18e8], eax
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x1a0], eax
jne 0x406e5e
mov dword [ebp - 0xe80], 1
jmp 0x406e65
and dword [ebp - 0xe80], 0
cmp dword [ebp - 0xe80], 0x161d
je 0x406e81
push 5
pop eax
test eax, eax
jne 0x406e81
and dword [ebp - 0x908], 0
jmp 0x406e8b
mov dword [ebp - 0x908], 1
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x908], eax
je 0x406ea5
mov dword [ebp - 0xcb0], 1
jmp 0x406eac
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0x1a0]
imul eax, dword [ebp - 0xcb0]
test eax, eax
je 0x406ec4
cmp dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x220], eax
jle 0x406ede
mov dword [ebp - 0x910], 1
jmp 0x406ee5
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x910]
sub eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x220]
jg 0x406f05
mov dword [ebp - 0xfe4], 1
jmp 0x406f0c
and dword [ebp - 0xfe4], 0
mov eax, dword [ebp - 0xfe4]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xffffffff
jl 0x406f2d
mov dword [ebp - 0x4d8], 1
jmp 0x406f34
and dword [ebp - 0x4d8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp + eax - 0x11c8], ecx
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 0
je 0x406f6f
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x406f6f
mov dword [ebp - 0x127c], 1
jmp 0x406f76
and dword [ebp - 0x127c], 0
cmp dword [ebp - 0x220], 0
je 0x406fc9
cmp dword [ebp - 0x560], 0
je 0x406fc9
mov dword [ebp - 0x11d0], 0xd4e2b79d
mov dword [ebp - 0x11d0], 0xd20578cc
mov byte [ebp - 0x1b9], 0
movzx eax, byte [ebp - 0x1b9]
test eax, eax
je 0x406fc7
mov dword [ebp - 0x918], 1
mov eax, dword [ebp - 0x918]
dec eax
mov dword [ebp - 0x918], eax
mov dword [ebp - 0xa38], 0x1fad
push 3
lea ecx, [ebp - 0x16f0]
call fcn.00401e5e
mov dword [ebp - 0x78], 0
jmp 0x407007
cmp dword [ebp - 0x78], 3
jge 0x407023