Function at 0x1004d640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083a7a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x96c
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004ff00
mov dword [ebp - 0x24], 0x7ca0029b
mov dword [ebp - 0x9c], 0xe974a520
mov dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x78c], eax
cmp dword [ebp - 0x24], 0xa3888451
ja 0x1004d6a4
mov dword [ebp - 0x27c], 1
jmp 0x1004d6ab
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jne 0x1004d6d2
cmp dword [ebp - 0x9c], 0
jne 0x1004d6d2
and dword [ebp - 0x4dc], 0
jmp 0x1004d6dc
mov dword [ebp - 0x4dc], 1
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x4dc]
jl 0x1004d6f3
mov dword [ebp - 0x4e4], 1
jmp 0x1004d6fa
and dword [ebp - 0x4e4], 0
mov eax, 0xd853
sub eax, dword [ebp - 0x4e4]
cmp eax, dword [ebp - 0x24]
je 0x1004d716
mov dword [ebp - 0x4ec], 1
jmp 0x1004d71d
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x4ec], eax
jl 0x1004d734
mov dword [ebp - 0x4f4], 1
jmp 0x1004d73b
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0x1b17
je 0x1004d753
mov dword [ebp - 0x4b8], 1
jmp 0x1004d75a
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x4b8], eax
jne 0x1004d771
mov dword [ebp - 0x494], 1
jmp 0x1004d778
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x494], eax
jne 0x1004d78f
mov dword [ebp - 0x1fc], 1
jmp 0x1004d796
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1fc]
je 0x1004d7ae
xor eax, eax
jne 0x1004d7ae
and dword [ebp - 0x49c], 0
jmp 0x1004d7b8
mov dword [ebp - 0x49c], 1
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xfc], 0
jmp 0x1004d7dd
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xffffffe8
jg 0x1004d838
mov dword [ebp - 0x24], 0
jmp 0x1004d7f6
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1004d836
mov dword [ebp - 0x538], 6
mov dword [ebp - 0x9c], 0xb
jmp 0x1004d81f
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x18
jne 0x1004d834
mov dword [ebp - 0x538], 0xffffffff
jmp 0x1004d812
jmp 0x1004d7ef
jmp 0x1004d7d0
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0x21c], 1
push 2
lea ecx, [ebp - 0x6b4]
call fcn.10016f4f
and dword [ebp - 4], 0
mov dword [ebp - 0x74], 0
jmp 0x1004d86a
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1004d880
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x810], 0x4be76d23
jmp 0x1004d863
mov dword [ebp - 0x74], 0
jmp 0x1004d890
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1004d8ac
push dword [ebp - 0x74]
lea ecx, [ebp - 0x6b4]
call fcn.10016fbc
mov dword [eax], 0xfffffff6
jmp 0x1004d889
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x10], 0
jne 0x1004d968
cmp dword [ebp - 0x10], 0
je 0x1004d92d
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jl 0x1004d8d9
mov dword [ebp - 0x204], 1
jmp 0x1004d8e0
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x204], eax
je 0x1004d8fa
cmp dword [ebp - 0x10], 0
jne 0x1004d8fa
and dword [ebp - 0x4a4], 0
jmp 0x1004d904
mov dword [ebp - 0x4a4], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x4a4], eax
jl 0x1004d91b
mov dword [ebp - 0x20c], 1
jmp 0x1004d922
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x20c], eax
jle 0x1004d93c
cmp dword [ebp - 0x10], 0
jne 0x1004d93c
and dword [ebp - 0x4ac], 0
jmp 0x1004d946
mov dword [ebp - 0x4ac], 1
cmp dword [ebp - 0x4ac], 0x32fd2d1a
jge 0x1004d95e
mov dword [ebp - 0x214], 1
jmp 0x1004d965
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0
je 0x1004d97d
cmp dword [ebp - 0x10], 0
je 0x1004d97d
and dword [ebp - 0x4b4], 0
jmp 0x1004d987
mov dword [ebp - 0x4b4], 1
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x4b4]
test eax, eax
je 0x1004d9bf
mov byte [ebp - 0x7f], 0
movzx eax, byte [ebp - 0x7f]
test eax, eax
je 0x1004d9ba
push 0x975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
jmp 0x1004dba3
mov dword [ebp - 0xd4], 1
mov dword [ebp - 0x10], 2
jmp 0x1004d9d9
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1004dba3
mov dword [ebp - 0x100], 0xfffffff9
mov dword [ebp - 0x4d4], 0xd88101ae
mov dword [ebp - 0x100], 0
jmp 0x1004da10
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 2
jg 0x1004db7e
mov dword [ebp - 0xdc], 0xffffffff
mov dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x810], 0x279e56e
jg 0x1004da4d
mov dword [ebp - 0x4bc], 1
jmp 0x1004da54
and dword [ebp - 0x4bc], 0
mov dword [ebp - 0x21c], 0xffffffff
mov eax, dword [ebp - 0x21c]
add eax, dword [ebp - 0x4bc]
cmp eax, dword [ebp - 0xdc]
je 0x1004da7e
mov dword [ebp - 0x224], 1
jmp 0x1004da85
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x224], eax
jle 0x1004da9f
mov dword [ebp - 0x4c4], 1
jmp 0x1004daa6
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x810]
sub eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x100]
jg 0x1004dad6
mov dword [ebp - 0x4cc], 1
jmp 0x1004dadd
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x4d4], eax
mov esi, dword [ebp - 0x4d4]
push 1
lea ecx, [ebp - 0x6b4]
call fcn.10016fbc
mov dword [eax], esi
mov dword [ebp - 0xdc], 0
jmp 0x1004db17
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jg 0x1004db79
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1004db39
push 0x23c3
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov dword [ebp - 0xd4], 0
jmp 0x1004db52
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 2
jg 0x1004db77
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1004db75
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x1004db45
jmp 0x1004db0a
jmp 0x1004da03
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x1004db9e
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
jmp 0x1004d9d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6b4]
call fcn.10016fb7
mov dword [ebp - 0x1c], 0x7ca0029b
mov dword [ebp - 0x72c], 0xf825e7a6
mov dword [ebp - 0x728], 0xf825e7a6
mov dword [ebp - 0x724], 0xf825e7a6
mov dword [ebp - 0x720], 0xf825e7a6
mov dword [ebp - 0x588], 5
mov dword [ebp - 0x3a8], 0xffffffff
mov dword [ebp - 0x460], 0x4d073ff8
mov dword [ebp - 0x1a0], 0xfffc
mov dword [ebp - 0x53c], 0
mov dword [ebp - 0x5a0], 0x4b5a
mov dword [ebp - 0x91c], 1
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x72c], 4
jbe 0x1004dc50
mov dword [ebp - 0x238], 1
jmp 0x1004dc57
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x7fc], eax
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x8b4], eax
cmp dword [ebp - 0x53c], 0xfffffff7
jae 0x1004dc95
or eax, 0xffffffff
je 0x1004dc95
mov dword [ebp - 0x540], 1
jmp 0x1004dc9c
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x804], eax
mov eax, dword [ebp - 0x5a0]
cmp dword [ebp - 0x460], eax
jge 0x1004dcc2
mov dword [ebp - 0x240], 1
jmp 0x1004dcc9
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x460], eax
mov dword [ebp - 0xa4], 0xe974a520
mov dword [ebp - 0x750], 0xbca6
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1004dd08
push 0x10e5
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [ebp - 0x83], 0
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x1004dd36
push 0x2301
push 0xcff
push 0x1cd7
push 0x1114
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x1c], 0xa3888451
ja 0x1004dd5e
mov dword [ebp - 0x248], 1
jmp 0x1004dd65
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x1004dd8c
cmp dword [ebp - 0xa4], 0
jne 0x1004dd8c
and dword [ebp - 0x3b0], 0
jmp 0x1004dd96
mov dword [ebp - 0x3b0], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x3b0]
jl 0x1004ddad
mov dword [ebp - 0x250], 1
jmp 0x1004ddb4
and dword [ebp - 0x250], 0
mov eax, 0xd853
sub eax, dword [ebp - 0x250]
cmp eax, dword [ebp - 0x1c]
je 0x1004ddd0
mov dword [ebp - 0x4e8], 1
jmp 0x1004ddd7
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4e8], eax
jl 0x1004ddee
mov dword [ebp - 0x258], 1
jmp 0x1004ddf5
and dword [ebp - 0x258], 0
cmp dword [ebp - 0x258], 0x1b17
je 0x1004de0d
mov dword [ebp - 0x3b8], 1
jmp 0x1004de14
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x3b8], eax
jne 0x1004de2b
mov dword [ebp - 0x260], 1
jmp 0x1004de32
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x260], eax
jne 0x1004de49
mov dword [ebp - 0x468], 1
jmp 0x1004de50
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x468]
je 0x1004de68
xor eax, eax
jne 0x1004de68
and dword [ebp - 0x268], 0
jmp 0x1004de72
mov dword [ebp - 0x268], 1
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe4], 0
jmp 0x1004de97
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xffffffe8
jg 0x1004e2ca
mov dword [ebp - 0x1c], 0
jmp 0x1004deb4
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1004e2c5
push 3
lea ecx, [ebp - 0x6d8]
call fcn.10016f4f
mov dword [ebp - 4], 1
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0x760], 0xfffffff6
push 4
lea ecx, [ebp - 0x830]
call fcn.10016f4f
mov byte [ebp - 4], 2
mov dword [ebp - 0x40], 0
jmp 0x1004df07
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1004df20
push dword [ebp - 0x40]
lea ecx, [ebp - 0x6d8]
call fcn.10016fbc
or dword [eax], 0xffffffff
jmp 0x1004df00
mov dword [ebp - 0x40], 0
jmp 0x1004df30
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x1004df49
push dword [ebp - 0x40]
lea ecx, [ebp - 0x830]
call fcn.10016fbc
or dword [eax], 0xffffffff
jmp 0x1004df29
mov dword [ebp - 0xf4], 0
jmp 0x1004df62
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jg 0x1004e26a
mov dword [ebp - 0xbc], 3
mov dword [ebp - 0x778], 1
push 1
lea ecx, [ebp - 0x820]
call fcn.10016f4f
mov byte [ebp - 4], 3
mov dword [ebp - 0x154], 0
jmp 0x1004dfad
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jge 0x1004dfcf
push dword [ebp - 0x154]
lea ecx, [ebp - 0x820]
call fcn.10016fbc
mov dword [eax], 0x974ca779
jmp 0x1004dfa0
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x1004dfec
push 0xb4d
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0xbc], 0
jmp 0x1004e005
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jg 0x1004e256
mov dword [ebp - 0x150], 0xfaaaeb9a
mov dword [ebp - 0x114], 0
jmp 0x1004e035
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x1004e051
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x780], 3
jmp 0x1004e028
mov dword [ebp - 0x150], 2
jmp 0x1004e06a
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jl 0x1004e251
mov dword [ebp - 0x660], 0xdbda7fe6
mov dword [ebp - 0x65c], 0xdbda7fe6
mov dword [ebp - 0x658], 0xdbda7fe6
mov dword [ebp - 0x654], 0xdbda7fe6
lea ecx, [ebp - 0x1bd]
call fcn.10008f43
push eax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x660]
push eax
lea ecx, [ebp - 0x930]
call fcn.10016fcb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5ec]
call fcn.10016f91
mov byte [ebp - 4], 4
mov dword [ebp - 0x5b0], 0x710dd013
mov dword [ebp - 0x120], 0
jmp 0x1004e0fb
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x1004e117
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x618], 0xd3ed23c5
jmp 0x1004e0ee
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x6d8]
call fcn.10016fbc
cmp dword [eax], 0
je 0x1004e1a8
mov dword [ebp - 0x270], 0x7e4a9061
mov esi, dword [ebp - 0xbc]
push 2
lea ecx, [ebp - 0x5ec]
call fcn.10016fbc
mov dword [eax], esi
mov esi, dword [ebp - 0x270]
push 2
lea ecx, [ebp - 0x5ec]
call fcn.10016fbc
cmp esi, dword [eax]
jl 0x1004e16f
mov dword [ebp - 0x3c0], 1
jmp 0x1004e176
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x3c0], eax
jge 0x1004e190
mov dword [ebp - 0x5a8], 1
jmp 0x1004e197
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x5b0], eax
jmp 0x1004e23d
mov dword [ebp - 0x73c], 1
mov dword [ebp - 0x738], 1
mov dword [ebp - 0x734], 1
mov dword [ebp - 0x730], 1
mov dword [ebp - 0x788], 0xfffffffd
mov dword [ebp - 0x790], 0xffffffff
mov dword [ebp - 0x798], 0xfffffff8
mov dword [ebp - 0x7a0], 0xfffffff8
mov dword [ebp - 0x7a8], 0xfffffffc
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x73c], 0
je 0x1004e222
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5ec]
call fcn.10016fb7
jmp 0x1004e251
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x618]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x618], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5ec]
call fcn.10016fb7
jmp 0x1004e05d
jmp 0x1004dff8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x820]
call fcn.10016fb7
jmp 0x1004df55
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x830]
call fcn.10016fb7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6d8]
call fcn.10016fb7
mov dword [ebp - 0x5b8], 6
mov dword [ebp - 0xa4], 0xb
jmp 0x1004e2ab
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x18
jne 0x1004e2c0
mov dword [ebp - 0x5b8], 0xffffffff
jmp 0x1004e29e
jmp 0x1004dead
jmp 0x1004de8a
mov dword [ebp - 0x1d0], 0xfffffffc
mov dword [ebp - 0x178], 0
jmp 0x1004e2ed
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jge 0x1004e309
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0xc8], 1
jmp 0x1004e2e0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc8], 0
jne 0x1004e4a3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc8]
mov dword [ebp - 0x7b0], eax
mov dword [ebp - 0x1d0], 0x83cc47d1
cmp dword [ebp - 0x1d0], 0
je 0x1004e358
mov eax, 0xc829ed89
test eax, eax
je 0x1004e358
mov dword [ebp - 0x4c0], 1
jmp 0x1004e35f
and dword [ebp - 0x4c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc8]
cmp dword [ebp - 0x4c0], eax
jge 0x1004e380
mov dword [ebp - 0x278], 1
jmp 0x1004e387
and dword [ebp - 0x278], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc8]
cmp dword [ebp - 0x278], eax
je 0x1004e3a8
mov dword [ebp - 0x3c8], 1
jmp 0x1004e3af
and dword [ebp - 0x3c8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc8]
cmp dword [ebp - 0x3c8], eax
jle 0x1004e3d0
mov dword [ebp - 0x5c0], 1
jmp 0x1004e3d7
and dword [ebp - 0x5c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc8]
mov dword [ebp - 0x7b8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc8], 0
je 0x1004e40f
cmp dword [ebp - 0x1d0], 0
je 0x1004e40f
mov dword [ebp - 0x280], 1
jmp 0x1004e416
and dword [ebp - 0x280], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc8]
cmp dword [ebp - 0x280], eax
je 0x1004e437
mov dword [ebp - 0x470], 1
jmp 0x1004e43e
and dword [ebp - 0x470], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc8]
cmp eax, dword [ebp - 0x470]
jne 0x1004e45f
mov dword [ebp - 0x288], 1
jmp 0x1004e466
and dword [ebp - 0x288], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc8]
cmp dword [ebp - 0x288], eax
jl 0x1004e487
mov dword [ebp - 0x3d0], 1
jmp 0x1004e48e
and dword [ebp - 0x3d0], 0
cmp dword [ebp - 0x3d0], 0xfffd
je 0x1004e4a3
and dword [ebp - 0x290], 0
jmp 0x1004e4ad
mov dword [ebp - 0x290], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc8]
cmp eax, dword [ebp - 0x290]
je 0x1004e4ce
mov dword [ebp - 0x508], 1
jmp 0x1004e4d5
and dword [ebp - 0x508], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc8]
cmp dword [ebp - 0x508], eax
jle 0x1004e524
mov dword [ebp - 0x298], 0x26fb
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x1004e515
push 0x1551
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
jmp 0x1004e545
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1004e545
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [ebp - 0x28], 0xac204e2d
mov dword [ebp - 0x28], 0
jmp 0x1004e55c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1b
jle 0x1004e72c
mov dword [ebp - 0xb0], 0xfffffffd
mov dword [ebp - 0x544], 0xffffffff
mov dword [ebp - 0x60], 0
jmp 0x1004e58a
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1004e5a0
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x620], 0x8753
jmp 0x1004e583
mov dword [ebp - 0x60], 0
jmp 0x1004e5b0
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1004e5c6
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x580], 0x6c65b0b5
jmp 0x1004e5a9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x7d0], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], eax
je 0x1004e5fe
mov dword [ebp - 0x3d8], 1
jmp 0x1004e605
and dword [ebp - 0x3d8], 0
cmp dword [ebp - 0x3d8], 0xfffe
jbe 0x1004e61d
mov dword [ebp - 0x2a0], 1
jmp 0x1004e624
and dword [ebp - 0x2a0], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x620], 0x4952f341
cmp dword [ebp - 0x2a0], 0x4952f341
jl 0x1004e656
mov eax, 0xa5bc
test eax, eax
je 0x1004e656
mov dword [ebp - 0x478], 1
jmp 0x1004e65d
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x478], eax
jne 0x1004e67b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x620], 0
je 0x1004e690
mov eax, 0xa2ef
test eax, eax
je 0x1004e690
mov dword [ebp - 0x2a8], 1
jmp 0x1004e697
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x2a8], eax
jge 0x1004e6b5
push 4
pop eax
test eax, eax
je 0x1004e6b5
mov dword [ebp - 0x3e0], 1
jmp 0x1004e6bc
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
sub eax, dword [ebp - 0x28]
jne 0x1004e6cd
cmp dword [ebp - 0x28], 0
je 0x1004e6e2
cmp dword [ebp - 0xb0], 0
je 0x1004e6e2
mov dword [ebp - 0x2b0], 1
jmp 0x1004e6e9
and dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x2b0], 0xaf9d
jg 0x1004e701
mov dword [ebp - 0x54c], 1
jmp 0x1004e708
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x7d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x580]
mov dword [ebp - 0x544], eax
jmp 0x1004e555
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1a8], 0xfffffffc
push 2
lea ecx, [ebp - 0x860]
call fcn.10016f4f
mov dword [ebp - 4], 5
mov dword [ebp - 0x128], 0x19d29be1
mov dword [ebp - 0x7e0], 0xfffffff9
mov dword [ebp - 0x7e8], 0xaafe30f5
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 0x7f0], 0xe7ccc895
mov dword [ebp - 0x7f8], 0xfe662db8
push 2
lea ecx, [ebp - 0x850]
call fcn.10016f4f
mov byte [ebp - 4], 6
mov dword [ebp - 0x48], 0
jmp 0x1004e7ad
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1004e7c9
push dword [ebp - 0x48]
lea ecx, [ebp - 0x860]
call fcn.10016fbc
mov dword [eax], 0x6482
jmp 0x1004e7a6
mov dword [ebp - 0x48], 0
jmp 0x1004e7d9
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1004e7f5
push dword [ebp - 0x48]
lea ecx, [ebp - 0x850]
call fcn.10016fbc
mov dword [eax], 0x8d963785
jmp 0x1004e7d2
mov dword [ebp - 0x128], 1
jmp 0x1004e80e
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jl 0x1004e969
mov dword [ebp - 0x7c], 0x45db34e6
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x8e8], 0xb7d8cf4c
mov dword [ebp - 0x590], 0
mov dword [ebp - 0x8f0], 0
push 1
lea ecx, [ebp - 0x840]
call fcn.10016f4f
mov byte [ebp - 4], 7
push 3
lea ecx, [ebp - 0x6cc]
call fcn.10016f4f
mov byte [ebp - 4], 8
mov dword [ebp - 0x34], 0
jmp 0x1004e87c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1004e898
push dword [ebp - 0x34]
lea ecx, [ebp - 0x840]
call fcn.10016fbc
mov dword [eax], 0xfffffff9
jmp 0x1004e875
mov dword [ebp - 0x34], 0
jmp 0x1004e8a8
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1004e8c4
push dword [ebp - 0x34]
lea ecx, [ebp - 0x6cc]
call fcn.10016fbc
mov dword [eax], 8
jmp 0x1004e8a1
mov dword [ebp - 0x7c], 0
jmp 0x1004e8d4
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jg 0x1004e900
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x1004e8fe
push 0x6c0
push 0x46b
push 0
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x1004e8cd
push 2
lea ecx, [ebp - 0x6cc]
call fcn.10016fbc
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x4c8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4c8]
mov dword [ecx], eax
mov dword [ebp - 0x7c], 0
jmp 0x1004e934
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jg 0x1004e946
mov dword [ebp - 0x590], 1
jmp 0x1004e92d
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x6cc]
call fcn.10016fb7
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x840]
call fcn.10016fb7
jmp 0x1004e801
mov dword [ebp - 0xec], 0xe
jmp 0x1004e982
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 1
jne 0x1004e998
cmp dword [ebp - 0xec], 0
je 0x1004e996
jmp 0x1004e998
jmp 0x1004e975
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x850]
call fcn.10016fb7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x860]
call fcn.10016fb7
mov dword [ebp - 0x158], 0
jmp 0x1004e9cf
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x1004e9eb
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0xd0], 1
jmp 0x1004e9c2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd0], 0
jne 0x1004eb85
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd0]
mov dword [ebp - 0x8f8], eax
mov dword [ebp - 0x1a8], 0x83cc47d1
cmp dword [ebp - 0x1a8], 0
je 0x1004ea3a
mov eax, 0xc829ed89
test eax, eax
je 0x1004ea3a
mov dword [ebp - 0x2b8], 1
jmp 0x1004ea41
and dword [ebp - 0x2b8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp dword [ebp - 0x2b8], eax
jge 0x1004ea62
mov dword [ebp - 0x3e8], 1
jmp 0x1004ea69
and dword [ebp - 0x3e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp dword [ebp - 0x3e8], eax
je 0x1004ea8a
mov dword [ebp - 0x2c0], 1
jmp 0x1004ea91
and dword [ebp - 0x2c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp dword [ebp - 0x2c0], eax
jle 0x1004eab2
mov dword [ebp - 0x598], 1
jmp 0x1004eab9
and dword [ebp - 0x598], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
mov dword [ebp - 0x900], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd0], 0
je 0x1004eaf1
cmp dword [ebp - 0x1a8], 0
je 0x1004eaf1
mov dword [ebp - 0x480], 1
jmp 0x1004eaf8
and dword [ebp - 0x480], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp dword [ebp - 0x480], eax
je 0x1004eb19
mov dword [ebp - 0x2c8], 1
jmp 0x1004eb20
and dword [ebp - 0x2c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp eax, dword [ebp - 0x2c8]
jne 0x1004eb41
mov dword [ebp - 0x3f0], 1
jmp 0x1004eb48
and dword [ebp - 0x3f0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp dword [ebp - 0x3f0], eax
jl 0x1004eb69
mov dword [ebp - 0x2d0], 1
jmp 0x1004eb70
and dword [ebp - 0x2d0], 0
cmp dword [ebp - 0x2d0], 0xfffd
je 0x1004eb85
and dword [ebp - 0x4f0], 0
jmp 0x1004eb8f
mov dword [ebp - 0x4f0], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp eax, dword [ebp - 0x4f0]
je 0x1004ebb0
mov dword [ebp - 0x2d8], 1
jmp 0x1004ebb7
and dword [ebp - 0x2d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd0]
cmp dword [ebp - 0x2d8], eax
jle 0x1004f295
mov dword [ebp - 0x908], 0xa8c6
mov byte [ebp - 0x97], 0
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x1004ec00
push 0
push 0x4fa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1004ec2f
push 0
push 0x663
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov dword [ebp - 0x340], 0x26fb
mov dword [ebp - 0x1b0], 0xffffffff
mov dword [ebp - 0x2f0], 1
mov dword [ebp - 0x310], 0xb416c28c
mov dword [ebp - 0x300], 0x99b96bc7
mov dword [ebp - 0x490], 0x9ea4087b
mov dword [ebp - 0x59c], 0xfffffff8
mov dword [ebp - 0x1c8], 0xfffffff8
mov dword [ebp - 0x130], 0x7c08a59c
mov dword [ebp - 0x498], 0xf93b76f0
mov dword [ebp - 0x50], 0
jmp 0x1004eca3
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x1004ecb9
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x1ec], 0
jmp 0x1004ec9c
mov dword [ebp - 0x50], 0
jmp 0x1004ecc9
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1004ecdf
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x630], 0xb6c411e6
jmp 0x1004ecc2
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1ec]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x1ec], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1ec], 0
jne 0x1004ef52
mov dword [ebp - 0x1b0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ec]
cmp dword [ebp - 0x1b0], eax
jg 0x1004ed38
mov dword [ebp - 0x3f8], 1
jmp 0x1004ed3f
and dword [ebp - 0x3f8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1ec]
cmp dword [ebp - 0x3f8], eax
jg 0x1004ed60
mov dword [ebp - 0x2e0], 1
jmp 0x1004ed67
and dword [ebp - 0x2e0], 0
cmp dword [ebp - 0x2e0], 0x24b6749e
jl 0x1004ed7f
mov dword [ebp - 0x488], 1
jmp 0x1004ed86
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
dec eax
jne 0x1004ed9d
xor eax, eax
inc eax
jne 0x1004ed9d
and dword [ebp - 0x2e8], 0
jmp 0x1004eda7
mov dword [ebp - 0x2e8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ec]
cmp dword [ebp - 0x2e8], eax
jle 0x1004edd5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ec], 0
jne 0x1004edd5
and dword [ebp - 0x400], 0
jmp 0x1004eddf
mov dword [ebp - 0x400], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ec]
add eax, dword [ebp - 0x400]
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0xd890fc52
jb 0x1004ee10
mov dword [ebp - 0x4d0], 1
jmp 0x1004ee17
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x310], eax
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1ec]
cmp dword [ebp + eax - 0x1ec], ecx
jl 0x1004ee4a
mov dword [ebp - 0x2f8], 1
jmp 0x1004ee51
and dword [ebp - 0x2f8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ec]
cmp dword [ebp - 0x2f8], eax
jne 0x1004ee71
mov dword [ebp - 0x408], 1
jmp 0x1004ee78
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x490], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ec]
cmp eax, dword [ebp - 0x490]
jne 0x1004eeb1
mov dword [ebp - 0x308], 1
jmp 0x1004eeb8
and dword [ebp - 0x308], 0
cmp dword [ebp - 0x308], 0xe0c28056
jae 0x1004eed0
mov dword [ebp - 0x410], 1
jmp 0x1004eed7
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 0x9172c2e8
jbe 0x1004eeef
mov dword [ebp - 0x1c4], 1
jmp 0x1004eef6
and dword [ebp - 0x1c4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c4]
mov dword [ebp + eax - 0x630], ecx
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x59c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1ec]
mov dword [ebp - 0x910], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x918], eax
push 4
pop eax
shl eax, 0
imul eax, dword [ebp + eax - 0x1ec], 0xffff
test eax, eax
jne 0x1004ef52
and dword [ebp - 0x51c], 0
jmp 0x1004ef5c
mov dword [ebp - 0x51c], 1
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jne 0x1004ef7f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x630], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x1b0], eax
xor eax, eax
inc eax
jne 0x1004efa2
cmp dword [ebp - 0x1c8], 0
jne 0x1004efa2
and dword [ebp - 0x318], 0
jmp 0x1004efac
mov dword [ebp - 0x318], 1
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x318], eax
je 0x1004efc6
mov dword [ebp - 0x418], 1
jmp 0x1004efcd
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x418], eax
jl 0x1004efe7
mov dword [ebp - 0x320], 1
jmp 0x1004efee
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x498]
inc eax
mov dword [ebp - 0x498], eax
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x1004f283
mov dword [ebp - 0x30], 0x642c70bb
push 2
lea ecx, [ebp - 0x6e4]
call fcn.10016f4f
mov dword [ebp - 4], 9
mov dword [ebp - 0x68], 0
jmp 0x1004f048
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1004f05e
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x504], 0xfffffff6
jmp 0x1004f041
mov dword [ebp - 0x68], 0
jmp 0x1004f06e
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1004f08a
push dword [ebp - 0x68]
lea ecx, [ebp - 0x6e4]
call fcn.10016fbc
mov dword [eax], 0xb14151c8
jmp 0x1004f067
mov dword [ebp - 0x30], 0
jmp 0x1004f09a
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1004f0b0
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x504], 0xffffffff
jmp 0x1004f093
mov dword [ebp - 0x30], 2
jmp 0x1004f0c0
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1004f265
mov dword [ebp - 0x58], 0xffffffff
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x1004f0ed
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x58], 2
jmp 0x1004f0fd
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x1004f260
mov dword [ebp - 0x554], 0xfffffff9
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x504], 0
je 0x1004f21c
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x504]
mov dword [ebp - 0x554], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x504], 1
jg 0x1004f14d
mov dword [ebp - 0x5c4], 1
jmp 0x1004f154
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x504], 0
je 0x1004f17c
cmp dword [ebp - 0x30], 0
je 0x1004f17c
mov dword [ebp - 0x328], 1
jmp 0x1004f183
and dword [ebp - 0x328], 0
cmp dword [ebp - 0x328], 0xa0b59785
jbe 0x1004f19f
push 8
pop eax
test eax, eax
jne 0x1004f19f
and dword [ebp - 0x420], 0
jmp 0x1004f1a9
mov dword [ebp - 0x420], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x504]
cmp dword [ebp - 0x420], eax
jl 0x1004f1ca
mov dword [ebp - 0x330], 1
jmp 0x1004f1d1
and dword [ebp - 0x330], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x58]
imul ecx, dword [ebp - 0x330]
cmp dword [ebp + eax - 0x504], ecx
jge 0x1004f1f5
mov dword [ebp - 0x4d8], 1
jmp 0x1004f1fc
and dword [ebp - 0x4d8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x504]
cmp eax, dword [ebp - 0x4d8]
jle 0x1004f21c
mov dword [ebp - 0x338], 1
jmp 0x1004f223
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x338]
add eax, 6
cmp eax, 0xd0f0
je 0x1004f23f
mov dword [ebp - 0x428], 1
jmp 0x1004f246
and dword [ebp - 0x428], 0
push 1
lea ecx, [ebp - 0x6e4]
call fcn.10016fbc
mov ecx, dword [ebp - 0x428]
mov dword [eax], ecx
jmp 0x1004f0f6
jmp 0x1004f0b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6e4]
call fcn.10016fb7
push 0x1551
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
jmp 0x1004fc53
mov dword [ebp - 0x928], 0xffffffff
mov dword [ebp - 0x754], 0x7730f94f
mov dword [ebp - 0x74c], 0x9532bb11
mov dword [ebp - 0x768], 0xffffffff
mov dword [ebp - 0x770], 0xc23afc37
mov dword [ebp - 0x8fc], 0xe3580d41
mov dword [ebp - 0x75c], 0xfffffff6
push 2
lea ecx, [ebp - 0x870]
call fcn.10016f4f
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x4a0], 0xfffffff9
mov dword [ebp - 0x170], 0
jmp 0x1004f312
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x1004f334
push dword [ebp - 0x170]
lea ecx, [ebp - 0x870]
call fcn.10016fbc
mov dword [eax], 0x8b5131d8
jmp 0x1004f305
mov eax, dword [ebp - 0x4a0]
dec eax
mov dword [ebp - 0x4a0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x870]
call fcn.10016fb7
mov dword [ebp - 0x160], 0x8ade19d2
mov dword [ebp - 0x138], 0
jmp 0x1004f373
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jge 0x1004f38f
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x95c], 0xfffffffe
jmp 0x1004f366
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1004f3ad
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [ebp - 0x160], 0
jmp 0x1004f3c6
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 2
jg 0x1004f3e8
mov dword [ebp - 0x348], 0x34e6
mov eax, dword [ebp - 0x348]
dec eax
mov dword [ebp - 0x348], eax
jmp 0x1004f3b9
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1004fc53
mov dword [ebp - 0xb4], 0xffffffff
mov dword [ebp - 0x2c], 0x1d11
mov dword [ebp - 0x20], 0x89a278c0
mov dword [ebp - 0x3c], 0x9f42c60e
push 2
lea ecx, [ebp - 0x190]
call fcn.10016f4f
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x55c], 0xbc8b421d
mov dword [ebp - 0x198], 0x5297f1ff
mov dword [ebp - 0x140], 0
jmp 0x1004f45e
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 2
jge 0x1004f480
push dword [ebp - 0x140]
lea ecx, [ebp - 0x190]
call fcn.10016fbc
mov dword [eax], 1
jmp 0x1004f451
cmp dword [ebp - 0xb4], 0
je 0x1004f495
mov dword [ebp - 0x358], 1
jmp 0x1004f49c
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xb4], eax
jge 0x1004f4b6
mov dword [ebp - 0x430], 1
jmp 0x1004f4bd
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x430]
jge 0x1004f4d7
mov dword [ebp - 0x350], 1
jmp 0x1004f4de
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x350]
test eax, eax
jne 0x1004f4fb
cmp dword [ebp - 0x2c], 0
jne 0x1004f4fb
and dword [ebp - 0x4f8], 0
jmp 0x1004f505
mov dword [ebp - 0x4f8], 1
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x2c]
neg eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x438], eax
push 1
lea ecx, [ebp - 0x190]
call fcn.10016fbc
mov ecx, dword [ebp - 0x438]
mov dword [eax], ecx
mov eax, dword [ebp - 0x358]
cmp eax, dword [ebp - 0x438]
jle 0x1004f551
mov dword [ebp - 0x360], 1
jmp 0x1004f558
and dword [ebp - 0x360], 0
imul eax, dword [ebp - 0x360], 0xc12a
cmp eax, dword [ebp - 0x2c]
jle 0x1004f573
mov dword [ebp - 0x4a8], 1
jmp 0x1004f57a
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x4a8], eax
jg 0x1004f591
mov dword [ebp - 0x368], 1
jmp 0x1004f598
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0x20], 1
jmp 0x1004f5b4
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1004fc35
mov dword [ebp - 0x1cc], 0xffffffff
mov dword [ebp - 0x5a4], 0x1ae9c7d4
push 4
lea ecx, [ebp - 0x5f8]
call fcn.10016f4f
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x814], 0xffffffff
mov dword [ebp - 0x234], 0xfffd
push 1
lea ecx, [ebp - 0x604]
call fcn.10016f4f
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x38], 0
jmp 0x1004f618
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1004f634
push dword [ebp - 0x38]
lea ecx, [ebp - 0x5f8]
call fcn.10016fbc
mov dword [eax], 0xb1cc
jmp 0x1004f611
mov dword [ebp - 0x38], 0
jmp 0x1004f644
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1004f660
push dword [ebp - 0x38]
lea ecx, [ebp - 0x604]
call fcn.10016fbc
mov dword [eax], 8
jmp 0x1004f63d
push dword [ebp - 0x20]
lea ecx, [ebp - 0x190]
call fcn.10016fbc
cmp dword [eax], 0
je 0x1004f6c3
push dword [ebp - 0x20]
lea ecx, [ebp - 0x190]
call fcn.10016fbc
cmp dword [eax], 0
jne 0x1004f6a2
push dword [ebp - 0x20]
lea ecx, [ebp - 0x190]
call fcn.10016fbc
cmp dword [eax], 0
jne 0x1004f6a2
and dword [ebp - 0x440], 0
jmp 0x1004f6ac
mov dword [ebp - 0x440], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x440], eax
jle 0x1004f6c3
mov dword [ebp - 0x1b8], 1
jmp 0x1004f6ca
and dword [ebp - 0x1b8], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x190]
call fcn.10016fbc
mov ecx, dword [ebp - 0x1b8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1b8]
add eax, 0xd857
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x1004facb
mov dword [ebp - 0x674], 0xd49acb08
mov dword [ebp - 0x670], 0xd49acb08
mov dword [ebp - 0x66c], 0xd49acb08
mov dword [ebp - 0x668], 0xd49acb08
lea ecx, [ebp - 0x1be]
call fcn.10008f43
push eax
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x674]
push eax
lea ecx, [ebp - 0x938]
call fcn.10016fcb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5d0]
call fcn.10016f91
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x168], 6
mov dword [ebp - 0x764], 0xf3ae864e
mov dword [ebp - 0x8c4], 0x7713999e
mov dword [ebp - 0x76c], 0x42fb88b
mov dword [ebp - 0x3c], 9
jmp 0x1004f790
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffec
jl 0x1004faaa
mov dword [ebp - 0x148], 0xffffffff
mov dword [ebp - 0x104], 8
push 1
lea ecx, [ebp - 0x190]
call fcn.10016fbc
mov ecx, dword [ebp - 0x148]
cmp dword [eax], ecx
jle 0x1004f7d1
mov dword [ebp - 0x180], 1
jmp 0x1004f7d8
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x1cc], eax
je 0x1004f7f2
mov dword [ebp - 0x370], 1
jmp 0x1004f7f9
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0x370]
jne 0x1004f813
mov dword [ebp - 0x4e0], 1
jmp 0x1004f81a
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x4e0], eax
jge 0x1004f834
mov dword [ebp - 0x378], 1
jmp 0x1004f83b
and dword [ebp - 0x378], 0
cmp dword [ebp - 0x378], 0x8160a871
jae 0x1004f853
mov dword [ebp - 0x448], 1
jmp 0x1004f85a
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x448], eax
jg 0x1004f874
mov dword [ebp - 0x380], 1
jmp 0x1004f87b
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x380], eax
jge 0x1004f895
mov dword [ebp - 0x4b0], 1
jmp 0x1004f89c
and dword [ebp - 0x4b0], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x190]
call fcn.10016fbc
mov ecx, dword [ebp - 0x180]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0x5d0]
call fcn.10016fbc
mov ecx, dword [ebp - 0x180]
mov dword [eax], ecx
mov eax, dword [ebp - 0x180]
sub eax, dword [ebp - 0x4b0]
je 0x1004f8e6
xor eax, eax
inc eax
je 0x1004f8e6
mov dword [ebp - 0x388], 1
jmp 0x1004f8ed
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x388]
jg 0x1004f907
mov dword [ebp - 0x450], 1
jmp 0x1004f90e
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
sub eax, dword [ebp - 0x148]
je 0x1004f938
cmp dword [ebp - 0x5a4], 0
je 0x1004f936
jmp 0x1004faaa
jmp 0x1004f955
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x1004f955
push 0
push 0
push 0x1b99
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
cmp dword [ebp - 0x1cc], 0
je 0x1004f9b9
cmp dword [ebp - 0x2c], 0
jne 0x1004f9ad
push 2
lea ecx, [ebp - 0x5f8]
call fcn.10016fbc
mov eax, 0x1ca0
test eax, eax
je 0x1004f998
push 1
lea ecx, [ebp - 0x5d0]
call fcn.10016fbc
cmp dword [eax], 0
je 0x1004f998
mov dword [ebp - 0x390], 1
jmp 0x1004f99f
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x390], eax
jg 0x1004f9b9
mov dword [ebp - 0x518], 1
jmp 0x1004f9c0
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x518]
sub eax, 0xee151ae
cmp eax, dword [ebp - 0x104]
jg 0x1004f9df
mov dword [ebp - 0x398], 1
jmp 0x1004f9e6
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x398], eax
je 0x1004fa00
mov dword [ebp - 0x458], 1
jmp 0x1004fa07
and dword [ebp - 0x458], 0
push 3
lea ecx, [ebp - 0x5d0]
call fcn.10016fbc
mov ecx, dword [ebp - 0x458]
imul ecx, dword [eax]
mov dword [ebp - 0x168], ecx
mov esi, dword [ebp - 0x168]
push 2
lea ecx, [ebp - 0x5f8]
call fcn.10016fbc
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x5d0]
call fcn.10016fbc
cmp esi, dword [eax]
jne 0x1004fa55
mov dword [ebp - 0x3a0], 1
jmp 0x1004fa5c
and dword [ebp - 0x3a0], 0
mov esi, dword [ebp - 0x104]
imul esi, dword [ebp - 0x2c]
sub esi, dword [ebp - 0x3a0]
push 1
lea ecx, [ebp - 0x190]
call fcn.10016fbc
cmp esi, dword [eax]
jge 0x1004fa89
mov dword [ebp - 0x230], 1
jmp 0x1004fa90
and dword [ebp - 0x230], 0
push 1
lea ecx, [ebp - 0x190]
call fcn.10016fbc
mov ecx, dword [ebp - 0x230]
mov dword [eax], ecx
jmp 0x1004f789
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x5d0]
call fcn.10016fb7
jmp 0x1004fc12
mov dword [ebp - 0x264], 0x1c0e03a8
mov dword [ebp - 0x26c], 0x4566f38f
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x264], eax
jg 0x1004faf6
mov dword [ebp - 0x244], 1
jmp 0x1004fafd
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x198]
jne 0x1004fb14
mov dword [ebp - 0x23c], 1
jmp 0x1004fb1b
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xb4]
add ecx, dword [ebp - 0x23c]
add eax, ecx
cmp eax, 0x9f2e
jle 0x1004fb3f
mov dword [ebp - 0x24c], 1
jmp 0x1004fb46
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0x24c]
jne 0x1004fb60
mov dword [ebp - 0x254], 1
jmp 0x1004fb67
and dword [ebp - 0x254], 0
push 0
lea ecx, [ebp - 0x604]
call fcn.10016fbc
mov ecx, dword [ebp - 0x254]
cmp ecx, dword [eax]
je 0x1004fb8a
mov dword [ebp - 0x25c], 1
jmp 0x1004fb91
and dword [ebp - 0x25c], 0
cmp dword [ebp - 0x25c], 0
jle 0x1004fba6
mov dword [ebp - 0x564], 1
jmp 0x1004fbad
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x824], eax
mov eax, 0x63326eed
test eax, eax
je 0x1004fbd4
cmp dword [ebp - 0x264], 0
je 0x1004fbd4
mov dword [ebp - 0x19c], 1
jmp 0x1004fbdb
and dword [ebp - 0x19c], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x190]
call fcn.10016fbc
mov ecx, dword [ebp - 0x19c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x26c], eax
mov esi, dword [ebp - 0x26c]
push 0
lea ecx, [ebp - 0x604]
call fcn.10016fbc
mov dword [eax], esi
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x604]
call fcn.10016fb7
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x5f8]
call fcn.10016fb7
jmp 0x1004f5ad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x190]
call fcn.10016fb7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [ebp - 0x11c], 0x6aabecba
mov dword [ebp - 0x28c], 0xffffffff
mov dword [ebp - 0x5d8], 0xd77f1724
cmp dword [ebp - 0x11c], 0xfffffff8
jl 0x1004fe93
mov dword [ebp - 0x124], 0x5efa
push 2
lea ecx, [ebp - 0x6fc]
call fcn.10016f4f
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x110], 0
jmp 0x1004fcb5
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jge 0x1004fcd7
push dword [ebp - 0x110]
lea ecx, [ebp - 0x6fc]
call fcn.10016fbc
mov dword [eax], 1
jmp 0x1004fca8
cmp dword [ebp - 0x124], 0xfffb
jae 0x1004fcef
mov dword [ebp - 0x274], 1
jmp 0x1004fcf6
and dword [ebp - 0x274], 0
cmp dword [ebp - 0x274], 0
jg 0x1004fd0b
mov dword [ebp - 0x1f0], 1
jmp 0x1004fd12
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x1f0], eax
jg 0x1004fd2c
mov dword [ebp - 0x284], 1
jmp 0x1004fd33
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x28c], eax
jl 0x1004fd59
mov dword [ebp - 0x294], 1
jmp 0x1004fd60
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x11c]
imul eax, dword [ebp - 0x294]
cmp eax, 0x3d87e3bc
jne 0x1004fd80
mov dword [ebp - 0x29c], 1
jmp 0x1004fd87
and dword [ebp - 0x29c], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x29c]
cmp eax, 4
jg 0x1004fd9c
cmp dword [ebp - 0x124], 0
or eax, 0xffffffff
cmp eax, 0xd59ff446
jae 0x1004fdb2
mov dword [ebp - 0x2a4], 1
jmp 0x1004fdb9
and dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 0xffff
jb 0x1004fdd1
mov dword [ebp - 0x2ac], 1
jmp 0x1004fdd8
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x2ac], eax
jg 0x1004fdf2
mov dword [ebp - 0x2b4], 1
jmp 0x1004fdf9
and dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2b4], 1
jl 0x1004fe0e
mov dword [ebp - 0x2c4], 1
jmp 0x1004fe15
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x2bc], eax
push 1
lea ecx, [ebp - 0x6fc]
call fcn.10016fbc
mov ecx, dword [ebp - 0x2bc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2bc]
cmp eax, dword [ebp - 0x2c4]
jg 0x1004fe50
mov dword [ebp - 0x2cc], 1
jmp 0x1004fe57
and dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x2cc], 0x8c9f
jl 0x1004fe6f
mov dword [ebp - 0x2d4], 1
jmp 0x1004fe76
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x5d8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6fc]
call fcn.10016fb7
jmp 0x1004feec
mov byte [ebp - 0x80], 0
movzx eax, byte [ebp - 0x80]
test eax, eax
je 0x1004febf
push 0
push 0x1bd4
push 0x1086
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov byte [ebp - 0x82], 0
movzx eax, byte [ebp - 0x82]
test eax, eax
je 0x1004feec
push 0xb23
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 0x1551
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x100516b8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x558], eax
mov dword [ebp - 0x12c], 0xb3ae3556
mov dword [ebp - 0x13c], 0xb818f8f6
mov dword [ebp - 0x324], 0xfffffff8
mov dword [ebp - 0x56c], 0xa2fc53d
mov dword [ebp - 0x69c], 0x7054f86f
mov dword [ebp - 0x698], 0x7054f86f
mov dword [ebp - 0x694], 0x7054f86f
mov dword [ebp - 0x690], 0x7054f86f
lea ecx, [ebp - 0x1d2]
call fcn.10008f43
push eax
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x69c]
push eax
lea ecx, [ebp - 0x940]
call fcn.10016fcb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x880]
call fcn.10016f91
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x12c], 0xfffffff1
jmp 0x1004ffae
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xe
je 0x10050380
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x314], 0x1c17c774
mov dword [ebp - 0x134], 0
jmp 0x1004ffe5
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jge 0x10050001
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x1dc], 0x73eb905d
jmp 0x1004ffd8
mov dword [ebp - 0x4c], 0
jmp 0x10050011
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jg 0x1005029b
push 1
lea ecx, [ebp - 0x528]
call fcn.10016f4f
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x2f4], 3
push 4
lea ecx, [ebp - 0x6c0]
call fcn.10016f4f
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x44], 0
jmp 0x10050057
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x10050073
push dword [ebp - 0x44]
lea ecx, [ebp - 0x528]
call fcn.10016fbc
mov dword [eax], 0x6d2e8588
jmp 0x10050050
mov dword [ebp - 0x44], 0
jmp 0x10050083
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1005009f
push dword [ebp - 0x44]
lea ecx, [ebp - 0x6c0]
call fcn.10016fbc
mov dword [eax], 0x3ae4c7ba
jmp 0x1005007c
mov byte [ebp - 0x84], 0
movzx eax, byte [ebp - 0x84]
test eax, eax
je 0x100500c3
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
lea ecx, [ebp - 0x528]
call fcn.10016fbc
and dword [eax], 0
jmp 0x100500f9
push 0
lea ecx, [ebp - 0x528]
call fcn.10016fbc
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x2dc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2dc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x528]
call fcn.10016fbc
cmp dword [eax], 1
jg 0x10050278
mov dword [ebp - 0xac], 0xe4562513
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x10050135
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xac], 0
jmp 0x1005014e
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jg 0x10050273
mov dword [ebp - 0xd8], 0xffffffff
mov dword [ebp - 0xd8], 0
jmp 0x1005017e
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jg 0x100501b6
mov dword [ebp - 0x314], 1
mov esi, dword [ebp - 0xd8]
push 0
lea ecx, [ebp - 0x528]
call fcn.10016fbc
mov eax, dword [eax]
mov ecx, dword [ebp + esi*4 - 0x1dc]
mov dword [ebp + eax*4 - 0x1dc], ecx
jmp 0x10050171
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x1dc]
mov dword [ebp - 0x774], eax
push 0
lea ecx, [ebp - 0x528]
call fcn.10016fbc
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1dc]
mov dword [ebp - 0x914], eax
mov eax, dword [ebp - 0xac]
dec eax
cmp eax, dword [ebp - 0xac]
jg 0x10050200
mov dword [ebp - 0x2e4], 1
jmp 0x10050207
and dword [ebp - 0x2e4], 0
cmp dword [ebp - 0x2e4], 6
jge 0x1005021c
mov dword [ebp - 0x2ec], 1
jmp 0x10050223
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
add eax, 0x27a2
mov ecx, dword [ebp - 0x4c]
cmp dword [ebp + ecx*4 - 0x1dc], eax
jl 0x10050252
mov dword [ebp - 0x2fc], 1
jmp 0x10050259
and dword [ebp - 0x2fc], 0
push 0
lea ecx, [ebp - 0x6c0]
call fcn.10016fbc
mov ecx, dword [ebp - 0x2fc]
mov dword [eax], ecx
jmp 0x10050141
jmp 0x100500d5
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x6c0]
call fcn.10016fb7
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x528]
call fcn.10016fb7
jmp 0x1005000a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dc]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x77c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1dc]
cmp dword [ebp - 0x324], eax
jl 0x100502d8
mov dword [ebp - 0x304], 1
jmp 0x100502df
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x56c]
cmp dword [ebp - 0x304], eax
jge 0x100502f9
mov dword [ebp - 0x30c], 1
jmp 0x10050300
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x13c], 0
jne 0x10050324
cmp dword [ebp - 0x4c], 0
jne 0x10050324
and dword [ebp - 0x31c], 0
jmp 0x1005032e
mov dword [ebp - 0x31c], 1
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
sub eax, 0x6e57c533
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x324]
cmp dword [ebp - 0x4c], eax
jl 0x1005035f
mov dword [ebp - 0x32c], 1
jmp 0x10050366
and dword [ebp - 0x32c], 0
push 1
lea ecx, [ebp - 0x880]
call fcn.10016fbc
mov ecx, dword [ebp - 0x32c]
mov dword [eax], ecx
jmp 0x1004ffa1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x880]
call fcn.10016fb7
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x78], 0x3ae35568
mov dword [ebp - 0x354], 0x43eb6069
mov dword [ebp - 0x1a4], 0xffffffff
mov dword [ebp - 0x5d4], 0xd62a04f7
mov dword [ebp - 0x834], 0xffffffff
mov dword [ebp - 0x78], 0xe
jmp 0x100503d5
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xfffffffb
jne 0x10050532
mov dword [ebp - 0x144], 0xd3f7
mov dword [ebp - 0x34c], 0xffffffff
mov dword [ebp - 0x574], 0xffffffff
cmp dword [ebp - 0x78], 0
je 0x1005043d
cmp dword [ebp - 0x78], 1
je 0x10050415
mov dword [ebp - 0x334], 1
jmp 0x1005041c
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
je 0x1005043d
mov dword [ebp - 0x33c], 1
jmp 0x10050444
and dword [ebp - 0x33c], 0
cmp dword [ebp - 0x33c], 4
jb 0x10050459
mov dword [ebp - 0x5ac], 1
jmp 0x10050460
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x784], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x8d4], eax
cmp dword [ebp - 0x144], 0x8b01
jg 0x1005048d
mov dword [ebp - 0x344], 1
jmp 0x10050494
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x574]
cmp dword [ebp - 0x34c], eax
jge 0x100504ba
mov dword [ebp - 0x35c], 1
jmp 0x100504c1
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
mov ecx, dword [ebp - 0x144]
sub ecx, dword [ebp - 0x78]
add eax, ecx
cmp eax, dword [ebp - 0x35c]
jle 0x100504f2
mov dword [ebp - 0x364], 1
jmp 0x100504f9
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
neg eax
jne 0x1005050f
mov dword [ebp - 0x36c], 1
jmp 0x10050516
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x1a4], 0
je 0x1005052d
jmp 0x10050532
jmp 0x100503ce
push 1
lea ecx, [ebp - 0x890]
call fcn.10016f4f
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x740], 0x12b57e8b
mov dword [ebp - 0x844], 0x4b5c
mov dword [ebp - 0x794], 0x12aa53f0
mov dword [ebp - 0x904], 0x678e
mov dword [ebp - 0x79c], 0x574b
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x7a4], 3
mov dword [ebp - 0x18], 0
jmp 0x1005059c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x100505b8
push dword [ebp - 0x18]
lea ecx, [ebp - 0x890]
call fcn.10016fbc
mov dword [eax], 0x99ac
jmp 0x10050595
mov dword [ebp - 0x18], 0
jmp 0x100505c8
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100505de
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x978], 0x2edc7555
jmp 0x100505c1
mov dword [ebp - 0x18], 0
jmp 0x100505ee
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10050604
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x968], 2
jmp 0x100505e7
mov dword [ebp - 0x18], 0
jmp 0x10050614
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1005062a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x628], 0xeeb
jmp 0x1005060d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x628]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x628], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x890]
call fcn.10016fb7
mov dword [ebp - 0x3a4], 1
push 2
lea ecx, [ebp - 0x6a8]
call fcn.10016f4f
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x54], 0
jmp 0x10050682
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x10050698
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x8a0], 0x4be76d23
jmp 0x1005067b
mov dword [ebp - 0x54], 0
jmp 0x100506a8
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x100506c4
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6a8]
call fcn.10016fbc
mov dword [eax], 0xfffffff6
jmp 0x100506a1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x8e4], eax
cmp dword [ebp - 0x14], 0
jne 0x10050780
cmp dword [ebp - 0x14], 0
je 0x10050745
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x100506f1
mov dword [ebp - 0x374], 1
jmp 0x100506f8
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x374], eax
je 0x10050712
cmp dword [ebp - 0x14], 0
jne 0x10050712
and dword [ebp - 0x37c], 0
jmp 0x1005071c
mov dword [ebp - 0x37c], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x37c], eax
jl 0x10050733
mov dword [ebp - 0x384], 1
jmp 0x1005073a
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x384], eax
jle 0x10050754
cmp dword [ebp - 0x14], 0
jne 0x10050754
and dword [ebp - 0x38c], 0
jmp 0x1005075e
mov dword [ebp - 0x38c], 1
cmp dword [ebp - 0x38c], 0x32fd2d1a
jge 0x10050776
mov dword [ebp - 0x394], 1
jmp 0x1005077d
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
je 0x10050795
cmp dword [ebp - 0x14], 0
je 0x10050795
and dword [ebp - 0x39c], 0
jmp 0x1005079f
mov dword [ebp - 0x39c], 1
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x39c]
test eax, eax
je 0x100507dd
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x100507d8
push 0x975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
jmp 0x100509c7
mov dword [ebp - 0xf0], 1
mov dword [ebp - 0x14], 2
jmp 0x100507f7
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x100509c7
mov dword [ebp - 0xe0], 0xfffffff9
mov dword [ebp - 0x3d4], 0xd88101ae
mov dword [ebp - 0xe0], 0
jmp 0x1005082e
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jg 0x100509a2
mov dword [ebp - 0xe8], 0xffffffff
mov dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x8a0], 0x279e56e
jg 0x1005086b
mov dword [ebp - 0x3ac], 1
jmp 0x10050872
and dword [ebp - 0x3ac], 0
mov dword [ebp - 0x3a4], 0xffffffff
mov eax, dword [ebp - 0x3a4]
add eax, dword [ebp - 0x3ac]
cmp eax, dword [ebp - 0xe8]
je 0x1005089c
mov dword [ebp - 0x3b4], 1
jmp 0x100508a3
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x3b4], eax
jle 0x100508bd
mov dword [ebp - 0x3bc], 1
jmp 0x100508c4
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x8a0]
sub eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0xe0]
jg 0x100508f4
mov dword [ebp - 0x3cc], 1
jmp 0x100508fb
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x3d4], eax
mov esi, dword [ebp - 0x3d4]
push 1
lea ecx, [ebp - 0x6a8]
call fcn.10016fbc
mov dword [eax], esi
mov dword [ebp - 0xe8], 0
jmp 0x10050935
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jg 0x1005099d
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x1005095d
push 0x23c3
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov dword [ebp - 0xf0], 0
jmp 0x10050976
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jg 0x1005099b
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x10050999
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x10050969
jmp 0x10050928
jmp 0x10050821
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x100509c2
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
jmp 0x100507f0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6a8]
call fcn.10016fb7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x560], eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x64], 0x6d64bda9
mov dword [ebp - 0x10c], 0x40c88307
mov dword [ebp - 0x58c], 0xffff
mov dword [ebp - 0x5bc], 0xf73ecb6a
mov dword [ebp - 0x7ac], 0xfffffff9
mov dword [ebp - 0x864], 0xfffffffe
push 4
lea ecx, [ebp - 0x8c0]
call fcn.10016f4f
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x1f4], 0
mov dword [ebp - 0x14c], 0
jmp 0x10050a56
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 4
jge 0x10050a78
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x8c0]
call fcn.10016fbc
mov dword [eax], 0x330c202e
jmp 0x10050a49
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], eax
jge 0x10050c3b
mov dword [ebp - 0xb8], 0x664d
mov dword [ebp - 0x3ec], 1
mov dword [ebp - 0x57c], 0xc78ef8a6
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x10050acb
push 0x1367
push 0
push 0x1d62
push 0x1512
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp dword [ebp - 0x5c], 0
jne 0x10050b44
cmp dword [ebp - 0x5c], 0
jne 0x10050add
cmp dword [ebp - 0x5c], 0
je 0x10050af2
mov eax, 0x493e
test eax, eax
je 0x10050af2
mov dword [ebp - 0x3dc], 1
jmp 0x10050af9
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x3dc], eax
jle 0x10050b13
mov dword [ebp - 0x3e4], 1
jmp 0x10050b1a
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
neg eax
neg eax
sub eax, dword [ebp - 0xb8]
sub eax, 0xffff
mov dword [ebp - 0x3ec], eax
jne 0x10050b44
xor eax, eax
jne 0x10050b44
and dword [ebp - 0x3f4], 0
jmp 0x10050b4e
mov dword [ebp - 0x3f4], 1
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x3f4]
lea eax, [ecx + eax + 0x30c4e2bf]
cmp eax, 0xf5e3
je 0x10050b71
mov dword [ebp - 0x3fc], 1
jmp 0x10050b78
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x3fc], eax
jl 0x10050b8f
mov dword [ebp - 0x404], 1
jmp 0x10050b96
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x404], eax
jne 0x10050bb0
mov dword [ebp - 0x40c], 1
jmp 0x10050bb7
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 0xee1c9741
jne 0x10050bcf
mov dword [ebp - 0x414], 1
jmp 0x10050bd6
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x5c]
cmp eax, 0xffffffff
jne 0x10050bf6
mov dword [ebp - 0x41c], 1
jmp 0x10050bfd
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0x41c]
sub eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xb8]
je 0x10050c23
mov dword [ebp - 0x424], 1
jmp 0x10050c2a
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x57c], eax
jmp 0x10050fc9
push 2
lea ecx, [ebp - 0x514]
call fcn.10016f4f
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x108], 0
jmp 0x10050c65
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 2
jge 0x10050c87
push dword [ebp - 0x108]
lea ecx, [ebp - 0x514]
call fcn.10016fbc
mov dword [eax], 0xe8aff65c
jmp 0x10050c58
mov dword [ebp - 0x64], 0xffffffec
jmp 0x10050c97
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x17
jge 0x10050fba
mov dword [ebp - 0x1ac], 0x16e0
mov dword [ebp - 0x1b4], 0xfffffff8
mov dword [ebp - 0x584], 1
mov dword [ebp - 0x64c], 0xfdcb
mov dword [ebp - 0x648], 0xfdcb
mov dword [ebp - 0x644], 0xfdcb
mov dword [ebp - 0x640], 0xfdcb
lea ecx, [ebp - 0x191]
call fcn.10008f43
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x950]
call fcn.10016fcb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x8b0]
call fcn.10016f91
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x10050e14
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x1b4], eax
jl 0x10050d50
mov dword [ebp - 0x42c], 1
jmp 0x10050d57
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
inc eax
imul eax, eax, 0x31a2
test eax, eax
jne 0x10050d76
xor eax, eax
inc eax
jne 0x10050d76
and dword [ebp - 0x434], 0
jmp 0x10050d80
mov dword [ebp - 0x434], 1
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x434], eax
je 0x10050d9a
mov dword [ebp - 0x5b4], 1
jmp 0x10050da1
and dword [ebp - 0x5b4], 0
push 1
lea ecx, [ebp - 0x514]
call fcn.10016fbc
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x10c], eax
jne 0x10050dda
cmp dword [ebp - 0x584], 0
je 0x10050dda
mov dword [ebp - 0x5e0], 1
jmp 0x10050de1
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x7bc], eax
push 1
lea ecx, [ebp - 0x514]
call fcn.10016fbc
cmp dword [eax], 0
je 0x10050e14
mov dword [ebp - 0x43c], 1
jmp 0x10050e1b
and dword [ebp - 0x43c], 0
push 1
lea ecx, [ebp - 0x514]
call fcn.10016fbc
mov ecx, dword [ebp - 0x43c]
cmp ecx, dword [eax]
jl 0x10050e3e
mov dword [ebp - 0x444], 1
jmp 0x10050e45
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x58c]
cmp dword [ebp - 0x444], eax
jne 0x10050e5f
mov dword [ebp - 0x44c], 1
jmp 0x10050e66
and dword [ebp - 0x44c], 0
push 0
lea ecx, [ebp - 0x514]
call fcn.10016fbc
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44c]
lea eax, [ecx + eax - 0xffff]
test eax, eax
jne 0x10050ea1
push 0
lea ecx, [ebp - 0x514]
call fcn.10016fbc
cmp dword [eax], 0
jne 0x10050ea1
and dword [ebp - 0x454], 0
jmp 0x10050eab
mov dword [ebp - 0x454], 1
cmp dword [ebp - 0x454], 0x2102
jge 0x10050ec3
mov dword [ebp - 0x45c], 1
jmp 0x10050eca
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x45c], eax
jle 0x10050ee1
mov dword [ebp - 0x464], 1
jmp 0x10050ee8
and dword [ebp - 0x464], 0
cmp dword [ebp - 0x464], 5
je 0x10050efd
mov dword [ebp - 0x46c], 1
jmp 0x10050f04
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x1ac]
cmp eax, dword [ebp - 0x46c]
je 0x10050f1e
mov dword [ebp - 0x474], 1
jmp 0x10050f25
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x474], eax
je 0x10050f3f
mov dword [ebp - 0x47c], 1
jmp 0x10050f46
and dword [ebp - 0x47c], 0
push 1
lea ecx, [ebp - 0x514]
call fcn.10016fbc
mov ecx, dword [ebp - 0x47c]
cmp ecx, dword [eax]
je 0x10050f69
mov dword [ebp - 0x484], 1
jmp 0x10050f70
and dword [ebp - 0x484], 0
push 0
lea ecx, [ebp - 0x8b0]
call fcn.10016fbc
mov ecx, dword [ebp - 0x484]
cmp ecx, dword [eax]
jle 0x10050f93
mov dword [ebp - 0x48c], 1
jmp 0x10050f9a
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x5bc], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x8b0]
call fcn.10016fb7
jmp 0x10050c90
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x514]
call fcn.10016fb7
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c0]
call fcn.10016fb7
mov dword [ebp - 0x70c], 0xf825e7a6
mov dword [ebp - 0x708], 0xf825e7a6
mov dword [ebp - 0x704], 0xf825e7a6
mov dword [ebp - 0x700], 0xf825e7a6
mov dword [ebp - 0x594], 5
mov dword [ebp - 0x200], 0xffffffff
mov dword [ebp - 0x210], 0x4d073ff8
mov dword [ebp - 0x1bc], 0xfffc
mov dword [ebp - 0x5dc], 0
mov dword [ebp - 0x550], 0x4b5a
mov dword [ebp - 0x874], 1
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x70c], 4
jbe 0x1005107c
mov dword [ebp - 0x1f8], 1
jmp 0x10051083
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x8ec], eax
cmp dword [ebp - 0x5dc], 0xfffffff7
jae 0x100510c1
or eax, 0xffffffff
je 0x100510c1
mov dword [ebp - 0x548], 1
jmp 0x100510c8
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0x550]
cmp dword [ebp - 0x210], eax
jge 0x100510ee
mov dword [ebp - 0x208], 1
jmp 0x100510f5
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x15c], 8
mov dword [ebp - 0x15c], 0
jmp 0x10051124
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffe2
je 0x1005120c
push 4
lea ecx, [ebp - 0x534]
call fcn.10016f4f
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x6c], 0
jmp 0x10051155
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1005116b
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x748], 0xde0b4074
jmp 0x1005114e
mov dword [ebp - 0x6c], 0
jmp 0x1005117b
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10051194
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x534]
call fcn.10016fbc
and dword [eax], 0
jmp 0x10051174
push 1
lea ecx, [ebp - 0x534]
call fcn.10016fbc
and dword [eax], 0
jmp 0x100511ca
push 1
lea ecx, [ebp - 0x534]
call fcn.10016fbc
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x218]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x534]
call fcn.10016fbc
cmp dword [eax], 2
jge 0x100511f8
push 1
lea ecx, [ebp - 0x534]
call fcn.10016fbc
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x748], 0
jmp 0x100511a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x534]
call fcn.10016fb7
jmp 0x10051117
mov dword [ebp - 0x884], 0xbca6
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x10051235
push 0x10e5
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x10051263
push 0x2301
push 0xcff
push 0x1cd7
push 0x1114
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x164]
mov dword [eax], 0
jmp 0x1005129a
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x164]
mov dword [ecx], eax
mov eax, dword [ebp - 0x164]
cmp dword [eax], 2
jge 0x100516b8
push 3
lea ecx, [ebp - 0x6f0]
call fcn.10016f4f
mov dword [ebp - 4], 0x19
mov dword [ebp - 0xf8], 1
mov dword [ebp - 0x7d4], 0xfffffff6
push 4
lea ecx, [ebp - 0x8e0]
call fcn.10016f4f
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x70], 0
jmp 0x100512f2
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1005130b
push dword [ebp - 0x70]
lea ecx, [ebp - 0x6f0]
call fcn.10016fbc
or dword [eax], 0xffffffff
jmp 0x100512eb
mov dword [ebp - 0x70], 0
jmp 0x1005131b
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x10051334
push dword [ebp - 0x70]
lea ecx, [ebp - 0x8e0]
call fcn.10016fbc
or dword [eax], 0xffffffff
jmp 0x10051314
mov dword [ebp - 0xf8], 0
jmp 0x1005134d
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jg 0x10051655
mov dword [ebp - 0xc0], 3
mov dword [ebp - 0x90c], 1
push 1
lea ecx, [ebp - 0x8d0]
call fcn.10016f4f
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x16c], 0
jmp 0x10051398
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x100513ba
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x8d0]
call fcn.10016fbc
mov dword [eax], 0x974ca779
jmp 0x1005138b
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x100513d7
push 0xb4d
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0xc0], 0
jmp 0x100513f0
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jg 0x10051641
mov dword [ebp - 0x17c], 0xfaaaeb9a
mov dword [ebp - 0x174], 0
jmp 0x10051420
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jge 0x1005143c
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x7dc], 3
jmp 0x10051413
mov dword [ebp - 0x17c], 2
jmp 0x10051455
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jl 0x1005163c
mov dword [ebp - 0x688], 0xdbda7fe6
mov dword [ebp - 0x684], 0xdbda7fe6
mov dword [ebp - 0x680], 0xdbda7fe6
mov dword [ebp - 0x67c], 0xdbda7fe6
lea ecx, [ebp - 0x1d1]
call fcn.10008f43
push eax
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x688]
push eax
lea ecx, [ebp - 0x948]
call fcn.10016fcb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x610]
call fcn.10016f91
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x570], 0x710dd013
mov dword [ebp - 0x184], 0
jmp 0x100514e6
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x10051502
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x638], 0xd3ed23c5
jmp 0x100514d9
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x6f0]
call fcn.10016fbc
cmp dword [eax], 0
je 0x10051593
mov dword [ebp - 0x228], 0x7e4a9061
mov esi, dword [ebp - 0xc0]
push 2
lea ecx, [ebp - 0x610]
call fcn.10016fbc
mov dword [eax], esi
mov esi, dword [ebp - 0x228]
push 2
lea ecx, [ebp - 0x610]
call fcn.10016fbc
cmp esi, dword [eax]
jl 0x1005155a
mov dword [ebp - 0x220], 1
jmp 0x10051561
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x220], eax
jge 0x1005157b
mov dword [ebp - 0x568], 1
jmp 0x10051582
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x570], eax
jmp 0x10051628
mov dword [ebp - 0x71c], 1
mov dword [ebp - 0x718], 1
mov dword [ebp - 0x714], 1
mov dword [ebp - 0x710], 1
mov dword [ebp - 0x894], 0xfffffffd
mov dword [ebp - 0x7e4], 0xffffffff
mov dword [ebp - 0x8f4], 0xfffffff8
mov dword [ebp - 0x7ec], 0xfffffff8
mov dword [ebp - 0x8a4], 0xfffffffc
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x71c], 0
je 0x1005160d
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x610]
call fcn.10016fb7
jmp 0x1005163c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x638]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x638], eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x610]
call fcn.10016fb7
jmp 0x10051448
jmp 0x100513e3
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x8d0]
call fcn.10016fb7
jmp 0x10051340
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x8e0]
call fcn.10016fb7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f0]
call fcn.10016fb7
mov dword [ebp - 0x578], 6
mov eax, dword [ebp - 0x118]
mov dword [eax], 0xb
jmp 0x1005169c
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x118]
mov dword [ecx], eax
mov eax, dword [ebp - 0x118]
cmp dword [eax], 0x18
jne 0x100516b3
mov dword [ebp - 0x578], 0xffffffff
jmp 0x1005168b
jmp 0x10051289
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret