Function at 0x44b44e
Capabilities:
Check for time delay via queryperformancecounter
Create pipe
Delete registry value
Get common file path
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3188
call fcn.004802a0
push esi
push edi
mov dword [ebp - 0xf4], 0
jmp 0x44b476
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x44b492
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x2490], 0x5464
jmp 0x44b469
mov dword [ebp - 0xf4], 0
jmp 0x44b4ab
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x44b4c7
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x1cc0], 0xfffffffc
jmp 0x44b49e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2490]
mov dword [ebp - 0x154c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x154c]
mov dword [ebp + eax - 0x1cc0], ecx
cmp dword [ebp - 0x154c], 0
je 0x44b529
mov dword [ebp - 0x1cb8], 6
mov eax, dword [ebp - 0x1cb8]
inc eax
mov dword [ebp - 0x1cb8], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x2490]
mov dword [ebp + ecx - 0x1cc0], eax
jmp 0x44b563
mov byte [ebp - 0x432], 0
movzx eax, byte [ebp - 0x432]
test eax, eax
je 0x44b563
push 0x2079
push 0x2505
push 0x1ce3
push 0x5e8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov dword [ebp - 0x908], 0xfffa
mov dword [ebp - 0x200], 0x9e86
mov dword [ebp - 0x1b0], 0
jmp 0x44b590
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jge 0x44b5ac
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x448], 0x915a1369
jmp 0x44b583
mov dword [ebp - 0x1b0], 0
jmp 0x44b5c5
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jge 0x44b5e1
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x1d9c], 0x48320013
jmp 0x44b5b8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x448], 0
jne 0x44b60a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x448], 0
jne 0x44b60a
and dword [ebp - 0x1ef0], 0
jmp 0x44b614
mov dword [ebp - 0x1ef0], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x448], 1
jl 0x44b630
mov dword [ebp - 0x1cc8], 1
jmp 0x44b637
and dword [ebp - 0x1cc8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x448]
imul eax, dword [ebp - 0x1cc8]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x448]
jl 0x44b676
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x448], 0
je 0x44b676
mov dword [ebp - 0x1cd0], 1
jmp 0x44b67d
and dword [ebp - 0x1cd0], 0
cmp dword [ebp - 0x1cd0], 0x6b87d0fa
je 0x44b695
mov dword [ebp - 0x209c], 1
jmp 0x44b69c
and dword [ebp - 0x209c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x448]
mov dword [ebp - 0x27dc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x448]
imul eax, dword [ebp - 0x908]
test eax, eax
je 0x44b71b
mov byte [ebp - 0x292], 0
movzx eax, byte [ebp - 0x292]
test eax, eax
je 0x44b6e9
push 0x1c75
push 0x1ab1
call dword [sym.imp.USER32.dll_SetCaretPos]
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebp - 0x2b0]
test eax, eax
je 0x44b716
push 0
push 0
push 0x461
push 0x220b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jmp 0x44b9ee
mov dword [ebp - 0x9cc], 4
mov dword [ebp - 0x2758], 0xf4442628
mov dword [ebp - 0x20b4], 0
mov dword [ebp - 0x2760], 0xfffffffd
mov dword [ebp - 0x1d10], 1
mov dword [ebp - 0x20a4], 7
mov dword [ebp - 0x2768], 0xb35f1971
mov dword [ebp - 0x20ac], 1
mov dword [ebp - 0x2770], 0x8c2afe24
mov dword [ebp - 0xfc], 0
jmp 0x44b78e
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jge 0x44b7aa
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x2f38], 0
jmp 0x44b781
mov dword [ebp - 0xfc], 0
jmp 0x44b7c3
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 4
jge 0x44b7df
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x2eb0], 0xffff
jmp 0x44b7b6
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2f38]
mov dword [ebp - 0x9cc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x9cc]
mov dword [ebp + eax - 0x448], ecx
cmp dword [ebp - 0x20a4], 1
jle 0x44b819
mov dword [ebp - 0x1ce0], 1
jmp 0x44b820
and dword [ebp - 0x1ce0], 0
mov eax, dword [ebp - 0x908]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x448]
cmp eax, 0x277ed469
je 0x44b847
mov dword [ebp - 0x1cd8], 1
jmp 0x44b84e
and dword [ebp - 0x1cd8], 0
mov eax, dword [ebp - 0x20ac]
imul eax, dword [ebp - 0x1cd8]
cmp dword [ebp - 0x1ce0], eax
je 0x44b86f
mov dword [ebp - 0x1ce8], 1
jmp 0x44b876
and dword [ebp - 0x1ce8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x448]
cmp dword [ebp - 0x1ce8], eax
jg 0x44b897
mov dword [ebp - 0x1cf0], 1
jmp 0x44b89e
and dword [ebp - 0x1cf0], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x1cf0], eax
jne 0x44b8b8
mov dword [ebp - 0x1cf8], 1
jmp 0x44b8bf
and dword [ebp - 0x1cf8], 0
cmp dword [ebp - 0x1cf8], 0xb5d2300b
ja 0x44b8d7
mov dword [ebp - 0x1d00], 1
jmp 0x44b8de
and dword [ebp - 0x1d00], 0
mov eax, dword [ebp - 0x9cc]
add eax, dword [ebp - 0x1d00]
cmp eax, dword [ebp - 0x908]
jle 0x44b8fe
mov dword [ebp - 0x1d08], 1
jmp 0x44b905
and dword [ebp - 0x1d08], 0
mov eax, dword [ebp - 0x1d08]
mov dword [ebp - 0x1d10], eax
cmp dword [ebp - 0x1d10], 0x8150
jl 0x44b929
mov dword [ebp - 0xaa0], 1
jmp 0x44b930
and dword [ebp - 0xaa0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xaa0]
mov dword [ebp + eax - 0x448], ecx
cmp dword [ebp - 0xaa0], 0
jne 0x44b95e
mov eax, 0xab92a1dd
test eax, eax
jne 0x44b95e
and dword [ebp - 0x1d18], 0
jmp 0x44b968
mov dword [ebp - 0x1d18], 1
mov eax, dword [ebp - 0x20b4]
cmp dword [ebp - 0x1d18], eax
jg 0x44b982
mov dword [ebp - 0x1d28], 1
jmp 0x44b989
and dword [ebp - 0x1d28], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2eb0]
dec eax
mov dword [ebp - 0x1d20], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1d20]
mov dword [ebp + eax - 0x2eb0], ecx
mov eax, dword [ebp - 0x1d20]
imul eax, dword [ebp - 0x1d28]
test eax, eax
je 0x44b9d4
push 4
pop eax
test eax, eax
je 0x44b9d4
mov dword [ebp - 0x1d30], 1
jmp 0x44b9db
and dword [ebp - 0x1d30], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d30]
mov dword [ebp + eax - 0x1d9c], ecx
mov dword [ebp - 0x200], 0
jmp 0x44ba07
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jg 0x44bc5c
mov dword [ebp - 0x910], 5
mov dword [ebp - 0x20c4], 1
mov dword [ebp - 0x1d80], 0xffffffff
mov dword [ebp - 0x900], 0
jmp 0x44ba4b
mov eax, dword [ebp - 0x900]
inc eax
mov dword [ebp - 0x900], eax
cmp dword [ebp - 0x900], 3
jge 0x44ba67
mov eax, dword [ebp - 0x900]
mov dword [ebp + eax*4 - 0x2350], 1
jmp 0x44ba3e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x448]
mov dword [ebp - 0x2778], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x448], 0
jne 0x44ba9c
cmp dword [ebp - 0x200], 0
jne 0x44ba9c
and dword [ebp - 0x20bc], 0
jmp 0x44baa6
mov dword [ebp - 0x20bc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2350]
mov dword [ebp - 0x2780], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1d9c], 0xc11d
jl 0x44bad8
mov dword [ebp - 0x1d38], 1
jmp 0x44badf
and dword [ebp - 0x1d38], 0
cmp dword [ebp - 0x1d38], 0xffffffff
jb 0x44baf4
mov dword [ebp - 0x1d40], 1
jmp 0x44bafb
and dword [ebp - 0x1d40], 0
mov eax, dword [ebp - 0x1d40]
sub eax, 0x5669962b
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2350]
jne 0x44bb21
mov dword [ebp - 0x1d48], 1
jmp 0x44bb28
and dword [ebp - 0x1d48], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2350]
sub eax, dword [ebp - 0x1d48]
cmp eax, dword [ebp - 0x910]
je 0x44bb4f
mov dword [ebp - 0x1d50], 1
jmp 0x44bb56
and dword [ebp - 0x1d50], 0
mov eax, dword [ebp - 0x910]
imul eax, dword [ebp - 0x1d50]
test eax, eax
jne 0x44bb7f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2350], 0
jne 0x44bb7f
and dword [ebp - 0x1d58], 0
jmp 0x44bb89
mov dword [ebp - 0x1d58], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d9c]
cmp eax, dword [ebp - 0x1d58]
jne 0x44bbaa
mov dword [ebp - 0x1d70], 1
jmp 0x44bbb1
and dword [ebp - 0x1d70], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2350]
cmp dword [ebp - 0x1d70], eax
jl 0x44bbd1
mov dword [ebp - 0x1d78], 1
jmp 0x44bbd8
and dword [ebp - 0x1d78], 0
mov eax, dword [ebp - 0x1d78]
sub eax, 0xfff6
mov dword [ebp - 0x20c4], eax
push 4
pop eax
shl eax, 0
mov ecx, 0x55fd
sub ecx, dword [ebp + eax - 0x1d9c]
add ecx, dword [ebp - 0x910]
mov dword [ebp - 0x1d80], ecx
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x2788], eax
mov eax, dword [ebp - 0x1d80]
mov dword [ebp - 0x2790], eax
imul eax, dword [ebp - 0x908], 0xc301
cmp eax, dword [ebp - 0x910]
jle 0x44bc3d
mov dword [ebp - 0x1d88], 1
jmp 0x44bc44
and dword [ebp - 0x1d88], 0
mov eax, dword [ebp - 0x200]
mov ecx, dword [ebp - 0x1d88]
mov dword [ebp + eax*4 - 0x1d9c], ecx
jmp 0x44b9fa
mov dword [ebp - 0x270], 0xfffffffc
mov dword [ebp - 0x1b8], 0
jmp 0x44bc7f
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jge 0x44bc9b
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x20cc], 0x4a8c6a53
jmp 0x44bc72
mov dword [ebp - 0x1b8], 0
jmp 0x44bcb4
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 3
jge 0x44bcd0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x2c34], 1
jmp 0x44bca7
mov dword [ebp - 0x270], 0
jmp 0x44bce9
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jl 0x44bdd6
mov dword [ebp - 0x308], 0xb1891f78
mov dword [ebp - 0x20d4], 0xfffffffe
mov dword [ebp - 0x20dc], 8
mov byte [ebp - 0x294], 0
movzx eax, byte [ebp - 0x294]
test eax, eax
je 0x44bd35
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
mov dword [ebp - 0x308], 0
jmp 0x44bd4e
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jg 0x44bdd1
mov dword [ebp - 0x2798], 1
mov dword [ebp - 0x27a0], 0xd34caa8e
mov eax, dword [ebp - 0x308]
mov eax, dword [ebp + eax*4 - 0x20cc]
sub eax, dword [ebp - 0x308]
add eax, 0x57392715
mov dword [ebp - 0x20d4], eax
mov eax, dword [ebp - 0x20dc]
add eax, dword [ebp - 0x308]
jne 0x44bdaf
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2c34], 0
jne 0x44bdaf
and dword [ebp - 0x1d90], 0
jmp 0x44bdb9
mov dword [ebp - 0x1d90], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d90]
mov dword [ebp + eax - 0x2c34], ecx
jmp 0x44bd41
jmp 0x44bcdc
mov dword [ebp - 0x270], 0
jmp 0x44bdef
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jl 0x44bf02
mov dword [ebp - 0x918], 0
jmp 0x44be15
mov eax, dword [ebp - 0x918]
inc eax
mov dword [ebp - 0x918], eax
cmp dword [ebp - 0x918], 1
jge 0x44be31
mov eax, dword [ebp - 0x918]
mov dword [ebp + eax*4 - 0x920], 4
jmp 0x44be08
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x920], 0
jmp 0x44be5f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x920]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x920], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x920], 0
jl 0x44befd
mov dword [ebp - 0x928], 0xffffffff
mov dword [ebp - 0x928], 2
jmp 0x44be96
mov eax, dword [ebp - 0x928]
dec eax
mov dword [ebp - 0x928], eax
cmp dword [ebp - 0x928], 0
jl 0x44bef8
mov dword [ebp - 0x930], 0
mov dword [ebp - 0x930], 0
jmp 0x44bec2
mov eax, dword [ebp - 0x930]
dec eax
mov dword [ebp - 0x930], eax
cmp dword [ebp - 0x930], 0
jl 0x44bef6
mov byte [ebp - 0x2b2], 0
movzx eax, byte [ebp - 0x2b2]
test eax, eax
je 0x44bef4
push 0x1cb0
push 0x2040
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
jmp 0x44beb5
jmp 0x44be89
jmp 0x44be44
jmp 0x44bde2
mov dword [ebp - 0x25c], 0xffffffff
mov dword [ebp - 0x550], 0xac842f88
mov dword [ebp - 0x25c], 0
jmp 0x44bf2f
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xfffffff7
jl 0x44c176
mov dword [ebp - 0x938], 0
jmp 0x44bf55
mov eax, dword [ebp - 0x938]
inc eax
mov dword [ebp - 0x938], eax
cmp dword [ebp - 0x938], 1
jge 0x44bf71
mov eax, dword [ebp - 0x938]
mov dword [ebp + eax*4 - 0x1e0c], 0x7689351f
jmp 0x44bf48
cmp dword [ebp - 0x25c], 0
je 0x44c0c7
mov dword [ebp - 0x1edc], 0xffffffff
mov dword [ebp - 0x1ed8], 0xffffffff
mov dword [ebp - 0x1ed4], 0xffffffff
mov dword [ebp - 0x1ed0], 0xffffffff
mov dword [ebp - 0x20e4], 0x8ea5
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1edc], 0
jmp 0x44bfdb
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1edc]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1edc], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1edc], 0
jg 0x44c081
mov dword [ebp - 0x940], 0xd4dfbd6c
mov dword [ebp - 0x940], 0
jmp 0x44c011
mov eax, dword [ebp - 0x940]
dec eax
mov dword [ebp - 0x940], eax
cmp dword [ebp - 0x940], 0
jl 0x44c07c
mov dword [ebp - 0x548], 0xe81a7ecc
mov dword [ebp - 0x548], 0
jmp 0x44c03d
mov eax, dword [ebp - 0x548]
dec eax
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 0
jl 0x44c07a
mov byte [ebp - 0x296], 0
movzx eax, byte [ebp - 0x296]
test eax, eax
je 0x44c066
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov eax, dword [ebp - 0x548]
cmp dword [ebp + eax*4 - 0x1e0c], 0
je 0x44c078
jmp 0x44c030
jmp 0x44c030
jmp 0x44c004
jmp 0x44bfc2
cmp dword [ebp - 0x25c], 0
je 0x44c09d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1edc], 0xffffffff
jmp 0x44c0c5
cmp dword [ebp - 0x20e4], 0
jge 0x44c0b2
mov dword [ebp - 0x1e04], 1
jmp 0x44c0b9
and dword [ebp - 0x1e04], 0
mov eax, dword [ebp - 0x1e04]
mov dword [ebp - 0x550], eax
jmp 0x44c0e6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1e0c], 0x3ac9d73d
cmp dword [ebp - 0x25c], 0
je 0x44c0e6
jmp 0x44bf22
mov dword [ebp - 0x550], 0xd
jmp 0x44c0ff
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 5
jge 0x44c171
mov dword [ebp - 0x1e1c], 1
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x1e1c], eax
je 0x44c12c
mov dword [ebp - 0x1e14], 1
jmp 0x44c133
and dword [ebp - 0x1e14], 0
mov eax, dword [ebp - 0x1e14]
mov dword [ebp - 0x1e1c], eax
mov byte [ebp - 0x2b4], 0
movzx eax, byte [ebp - 0x2b4]
test eax, eax
je 0x44c16f
push 0x1957
push 0x267f
push 0x20a3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x44c0f2
jmp 0x44bf22
mov dword [ebp - 0x104], 0
jmp 0x44c18f
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 4
jge 0x44c1ab
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x2520], 0xffffffff
jmp 0x44c182
mov dword [ebp - 0x104], 0
jmp 0x44c1c4
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jge 0x44c1e0
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x998], 0xfe7d8a87
jmp 0x44c1b7
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x998], 3
jmp 0x44c20e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x998]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x998], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x998], 0
jl 0x44c448
mov dword [ebp - 0x1e24], 0x8cca6991
mov dword [ebp - 0x948], 0
jmp 0x44c245
mov eax, dword [ebp - 0x948]
inc eax
mov dword [ebp - 0x948], eax
cmp dword [ebp - 0x948], 1
jge 0x44c261
mov eax, dword [ebp - 0x948]
mov dword [ebp + eax*4 - 0xcc], 0x73ff82ff
jmp 0x44c238
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xcc], 3
jmp 0x44c28f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xcc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcc], 0
jl 0x44c40b
mov dword [ebp - 0x20ec], 0xfffffffc
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x2520]
cmp dword [ebp + eax - 0xcc], ecx
je 0x44c2d5
mov dword [ebp - 0xbe8], 1
jmp 0x44c2dc
and dword [ebp - 0xbe8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x998]
cmp dword [ebp + eax*4 - 0x2520], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xcc]
mov ecx, dword [ebp + ecx*4 - 0x2520]
cmp dword [ebp + eax - 0xcc], ecx
jle 0x44c32c
mov dword [ebp - 0x1e30], 1
jmp 0x44c333
and dword [ebp - 0x1e30], 0
cmp dword [ebp - 0x1e30], 0x5a8ccedb
jne 0x44c34b
mov dword [ebp - 0x1e58], 1
jmp 0x44c352
and dword [ebp - 0x1e58], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1e58]
sub ecx, dword [ebp + eax - 0x998]
mov dword [ebp - 0x1e24], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov edx, dword [ebp - 0x1e24]
sub edx, dword [ebp + ecx - 0x998]
sub edx, dword [ebp + eax - 0xcc]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
mov eax, dword [ebp + eax*4 - 0x2520]
sub eax, dword [ebp - 0xbe8]
sub eax, edx
cmp eax, 0xffff
ja 0x44c3ba
mov dword [ebp - 0x1918], 1
jmp 0x44c3c1
and dword [ebp - 0x1918], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2520]
imul eax, dword [ebp - 0x1918]
mov dword [ebp - 0x20ec], eax
mov byte [ebp - 0x298], 0
movzx eax, byte [ebp - 0x298]
test eax, eax
je 0x44c406
push 0x1195
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp 0x44c274
mov byte [ebp - 0x2b6], 0
movzx eax, byte [ebp - 0x2b6]
test eax, eax
je 0x44c443
push 0
push 0
push 0
push 0xb3a
push 0x1b3b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x44c1f3
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x998], 0x10cbbbc2
mov dword [ebp - 0x2de8], 0xfffffff7
mov dword [ebp - 0x2de4], 0xfffffff7
mov dword [ebp - 0x2de0], 0xfffffff7
mov dword [ebp - 0x2ddc], 0xfffffff7
mov dword [ebp - 0x950], 0xffffffff
mov dword [ebp - 0x950], 3
jmp 0x44c4a4
mov eax, dword [ebp - 0x950]
dec eax
mov dword [ebp - 0x950], eax
cmp dword [ebp - 0x950], 0
jl 0x44c4d3
mov byte [ebp - 0x3a1], 0
movzx eax, byte [ebp - 0x3a1]
test eax, eax
je 0x44c4d1
push 0x105d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
jmp 0x44c497
mov dword [ebp - 0x178], 0
jmp 0x44c4ec
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jge 0x44c508
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x2500], 0x5464
jmp 0x44c4df
mov dword [ebp - 0x968], 7
mov dword [ebp - 0x1920], 0
mov dword [ebp - 0x20fc], 0x4f204795
mov dword [ebp - 0x27a8], 0x955a
mov dword [ebp - 0x960], 0
jmp 0x44c549
mov eax, dword [ebp - 0x960]
inc eax
mov dword [ebp - 0x960], eax
cmp dword [ebp - 0x960], 3
jge 0x44c565
mov eax, dword [ebp - 0x960]
mov dword [ebp + eax*4 - 0x25f4], 0x96f377cc
jmp 0x44c53c
xor eax, eax
jne 0x44c57b
cmp dword [ebp - 0x968], 0
jne 0x44c57b
and dword [ebp - 0x20f4], 0
jmp 0x44c585
mov dword [ebp - 0x20f4], 1
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x27b0], eax
mov eax, dword [ebp - 0x1920]
cmp dword [ebp - 0x968], eax
jge 0x44c5ab
mov dword [ebp - 0xbf0], 1
jmp 0x44c5b2
and dword [ebp - 0xbf0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25f4]
cmp dword [ebp - 0xbf0], eax
je 0x44c5dc
cmp dword [ebp - 0x968], 0
je 0x44c5dc
mov dword [ebp - 0xbf8], 1
jmp 0x44c5e3
and dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0x1920]
cmp dword [ebp - 0xbf8], eax
jle 0x44c5fd
mov dword [ebp - 0x1928], 1
jmp 0x44c604
and dword [ebp - 0x1928], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1928]
sub ecx, dword [ebp + eax - 0x25f4]
push 4
pop eax
shl eax, 0
add ecx, dword [ebp + eax - 0x25f4]
je 0x44c632
mov dword [ebp - 0x20fc], 0xfffffff8
jmp 0x44c649
mov dword [ebp - 0xc00], 0xdc6b79df
mov eax, dword [ebp - 0xc00]
inc eax
mov dword [ebp - 0xc00], eax
mov dword [ebp - 0x178], 0
jmp 0x44c662
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x44c67e
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x19e0], 0xfffffffc
jmp 0x44c655
mov dword [ebp - 0xaa8], 0xa6de
mov dword [ebp - 0x27b8], 0x51328f6c
mov dword [ebp - 0x70], 0
jmp 0x44c6a2
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x44c6b8
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xbc0], 0xd72276b8
jmp 0x44c69b
mov dword [ebp - 0x70], 0
jmp 0x44c6c8
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x44c6de
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xc08], 0xfffffff9
jmp 0x44c6c1
mov dword [ebp - 0x70], 0
jmp 0x44c6ee
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x44c704
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x1da8], 0x393e75cb
jmp 0x44c6e7
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1da8]
sub ecx, dword [ebp + eax - 0xbc0]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1da8]
dec eax
push 4
pop edx
imul edx, edx, 0
mov dword [ebp + edx - 0x1da8], eax
test ecx, ecx
je 0x44c74e
xor eax, eax
inc eax
je 0x44c74e
mov dword [ebp - 0x1930], 1
jmp 0x44c755
and dword [ebp - 0x1930], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc08]
cmp dword [ebp - 0x1930], eax
jl 0x44c7fe
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0x27c0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc0]
mov dword [ebp - 0x27c8], eax
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0x27d0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc0], 0xfffffffc
jne 0x44c7c3
mov dword [ebp - 0x2104], 1
jmp 0x44c7ca
and dword [ebp - 0x2104], 0
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0x27d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc08]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xbc0]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x1da8]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1da8], 3
jb 0x44c81a
mov dword [ebp - 0x1938], 1
jmp 0x44c821
and dword [ebp - 0x1938], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1938]
mov dword [ebp + eax - 0xbc0], ecx
mov byte [ebp - 0x2af], 0
movzx eax, byte [ebp - 0x2af]
test eax, eax
je 0x44c861
push 0
push 0
push 0x461
push 0x220b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2500]
mov dword [ebp - 0xc10], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc10]
mov dword [ebp + eax - 0x19e0], ecx
cmp dword [ebp - 0xc10], 0
je 0x44d41e
mov dword [ebp - 0xb74], 0
mov dword [ebp - 0xb70], 0
mov dword [ebp - 0xb6c], 0
mov dword [ebp - 0xb68], 0
mov dword [ebp - 0xab8], 0x83cc
mov dword [ebp - 0x2124], 3
mov dword [ebp - 0x2134], 0x3e87122a
mov dword [ebp - 0x27e0], 0x8c8a
mov dword [ebp - 0x10c], 0
jmp 0x44c8fd
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jge 0x44c919
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x9c0], 2
jmp 0x44c8f0
mov dword [ebp - 0x10c], 0
jmp 0x44c932
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jge 0x44c94e
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x1db4], 0x21fbb9cf
jmp 0x44c925
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb74], 0
jmp 0x44c97c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb74]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb74], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb74], 1
jg 0x44cc98
mov dword [ebp - 0xab0], 1
mov dword [ebp - 0x1960], 0x7b6c411e
mov dword [ebp - 0x5c0], 0
jmp 0x44c9bd
mov eax, dword [ebp - 0x5c0]
inc eax
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 1
jge 0x44c9d9
mov eax, dword [ebp - 0x5c0]
mov dword [ebp + eax*4 - 0x212c], 0x38770ce4
jmp 0x44c9b0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb74]
mov eax, dword [ebp + eax*4 - 0x9c0]
mov dword [ebp - 0x27e8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9c0], 0
je 0x44ca72
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9c0], 0xd814
jge 0x44ca22
mov dword [ebp - 0x1940], 1
jmp 0x44ca29
and dword [ebp - 0x1940], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb74]
cmp dword [ebp - 0x1940], eax
jg 0x44ca4a
mov dword [ebp - 0x210c], 1
jmp 0x44ca51
and dword [ebp - 0x210c], 0
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0x27f0], eax
cmp dword [ebp - 0xab0], 0
je 0x44ca72
mov dword [ebp - 0x2114], 1
jmp 0x44ca79
and dword [ebp - 0x2114], 0
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0x27f8], eax
cmp dword [ebp - 0xab0], 0
jne 0x44caa5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb74]
cmp dword [ebp + eax*4 - 0x9c0], 0
je 0x44cae0
mov dword [ebp - 0x211c], 7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb74]
cmp dword [ebp + eax*4 - 0x9c0], 0
je 0x44cacb
jmp 0x44cc98
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb74]
mov dword [ebp - 0x211c], eax
jmp 0x44cb0b
mov byte [ebp - 0x29a], 0
movzx eax, byte [ebp - 0x29a]
test eax, eax
je 0x44cb0b
push 0x457
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1db4]
mov dword [ebp - 0x2124], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb74]
cmp dword [ebp + eax*4 - 0x9c0], 0
je 0x44cc3f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x212c]
mov dword [ebp - 0x2800], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1db4]
mov dword [ebp - 0x2808], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1db4]
cmp dword [ebp - 0xab0], eax
jle 0x44cb80
mov dword [ebp - 0xc18], 1
jmp 0x44cb87
and dword [ebp - 0xc18], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb74]
mov eax, dword [ebp + eax*4 - 0x9c0]
cmp dword [ebp - 0xc18], eax
jne 0x44cbaf
mov dword [ebp - 0x1948], 1
jmp 0x44cbb6
and dword [ebp - 0x1948], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1db4]
cmp dword [ebp - 0x1948], eax
jge 0x44cbd7
mov dword [ebp - 0xc20], 1
jmp 0x44cbde
and dword [ebp - 0xc20], 0
cmp dword [ebp - 0xc20], 0xb6749efe
jae 0x44cbf6
mov dword [ebp - 0x1950], 1
jmp 0x44cbfd
and dword [ebp - 0x1950], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1db4]
cmp dword [ebp - 0x1950], eax
jne 0x44cc1e
mov dword [ebp - 0xc28], 1
jmp 0x44cc25
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0xab8]
cmp dword [ebp - 0xc28], eax
jne 0x44cc3f
mov dword [ebp - 0x1958], 1
jmp 0x44cc46
and dword [ebp - 0x1958], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb74]
mov eax, dword [ebp + eax*4 - 0x9c0]
imul eax, dword [ebp - 0x1958]
cmp eax, 0x45a9172c
jg 0x44cc74
mov dword [ebp - 0xc30], 1
jmp 0x44cc7b
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0xc30]
mov dword [ebp - 0x1960], eax
mov eax, dword [ebp - 0x1960]
mov dword [ebp - 0x2134], eax
jmp 0x44c961
mov dword [ebp - 0xc78], 6
mov dword [ebp - 0xc50], 5
mov dword [ebp - 0x1968], 0x8fbfc75d
mov dword [ebp - 0xac0], 0
mov dword [ebp - 0x17c], 0
jmp 0x44ccd9
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x44ccf5
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x1fc], 0xf57a7c20
jmp 0x44cccc
mov dword [ebp - 0x17c], 0
jmp 0x44cd0e
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jge 0x44cd2a
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x2c44], 3
jmp 0x44cd01
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
mov dword [ebp - 0x2810], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
mov dword [ebp - 0x2818], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1fc], 0
je 0x44cdea
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1fc], 9
jg 0x44cd80
mov dword [ebp - 0xc38], 1
jmp 0x44cd87
and dword [ebp - 0xc38], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fc]
cmp dword [ebp - 0xc38], eax
jge 0x44cda8
mov dword [ebp - 0x213c], 1
jmp 0x44cdaf
and dword [ebp - 0x213c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fc]
mov dword [ebp - 0x2820], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
mov dword [ebp - 0x1968], eax
cmp dword [ebp - 0x1968], 0
je 0x44cdea
mov dword [ebp - 0xc40], 1
jmp 0x44cdf1
and dword [ebp - 0xc40], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
imul eax, dword [ebp - 0xc40]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1fc]
jne 0x44ce20
mov dword [ebp - 0x1970], 1
jmp 0x44ce27
and dword [ebp - 0x1970], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
cmp dword [ebp - 0x1970], eax
jge 0x44ce58
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1fc], 0
je 0x44ce58
mov dword [ebp - 0xc48], 1
jmp 0x44ce5f
and dword [ebp - 0xc48], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
cmp dword [ebp - 0xc48], eax
jle 0x44ce80
mov dword [ebp - 0x1980], 1
jmp 0x44ce87
and dword [ebp - 0x1980], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fc]
mov dword [ebp - 0x1978], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1978]
mov dword [ebp + eax - 0x2c44], ecx
mov eax, dword [ebp - 0x1978]
mov dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0xc50]
add eax, dword [ebp - 0x1980]
je 0x44cee3
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2c44], 0
je 0x44cee3
mov dword [ebp - 0xc58], 1
jmp 0x44ceea
and dword [ebp - 0xc58], 0
cmp dword [ebp - 0xc58], 0x4c638299
jle 0x44cf02
mov dword [ebp - 0x1988], 1
jmp 0x44cf09
and dword [ebp - 0x1988], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
cmp dword [ebp - 0x1988], eax
jl 0x44cf2a
mov dword [ebp - 0xc60], 1
jmp 0x44cf31
and dword [ebp - 0xc60], 0
cmp dword [ebp - 0xc60], 9
jl 0x44cf46
mov dword [ebp - 0x1990], 1
jmp 0x44cf4d
and dword [ebp - 0x1990], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
cmp dword [ebp - 0x1990], eax
jle 0x44cf6e
mov dword [ebp - 0xc68], 1
jmp 0x44cf75
and dword [ebp - 0xc68], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
cmp dword [ebp - 0xc68], eax
jg 0x44cf96
mov dword [ebp - 0x1998], 1
jmp 0x44cf9d
and dword [ebp - 0x1998], 0
mov eax, dword [ebp - 0x1998]
neg eax
cmp eax, dword [ebp - 0xac0]
jle 0x44cfc6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1fc], 0
jne 0x44cfc6
and dword [ebp - 0xc70], 0
jmp 0x44cfd0
mov dword [ebp - 0xc70], 1
mov eax, dword [ebp - 0xac0]
cmp dword [ebp - 0xc70], eax
jg 0x44cfea
mov dword [ebp - 0x19a0], 1
jmp 0x44cff1
and dword [ebp - 0x19a0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc]
cmp dword [ebp - 0x19a0], eax
jge 0x44d022
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebp - 0x2b8]
test eax, eax
je 0x44d020
push 0
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x44d038
mov dword [ebp - 0x2144], 0x2e255bb5
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0x2144], eax
mov eax, dword [ebp - 0xc78]
inc eax
mov dword [ebp - 0xc78], eax
mov dword [ebp - 0xac8], 0xe05dae5a
mov dword [ebp - 0x494], 0xe5e53494
mov dword [ebp - 0x2828], 1
mov dword [ebp - 0x20c], 0xfffffffc
mov dword [ebp - 0x778], 0
mov dword [ebp - 0x19a8], 0xfffffffb
mov dword [ebp - 0xca0], 0xe86a6760
mov dword [ebp - 0x114], 0
jmp 0x44d0a4
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x44d0c0
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x558], 0x389a9b8f
jmp 0x44d097
mov dword [ebp - 0x114], 0
jmp 0x44d0d9
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 4
jge 0x44d0f5
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x2654], 0
jmp 0x44d0cc
mov eax, dword [ebp - 0xac8]
mov dword [ebp - 0x2830], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2654]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2654], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x558]
mov dword [ebp - 0x2838], eax
mov eax, dword [ebp - 0xac8]
mov dword [ebp - 0x2840], eax
cmp dword [ebp - 0xac8], 0
je 0x44d14e
mov dword [ebp - 0x214c], 1
jmp 0x44d155
and dword [ebp - 0x214c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2654]
mov dword [ebp - 0x20c], eax
mov eax, 0xb2455f9
add eax, 0xfffffff9
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x558]
mov dword [ebp - 0x19a8], eax
cmp dword [ebp - 0x19a8], 0xe5a8
jne 0x44d19b
mov dword [ebp - 0xc80], 1
jmp 0x44d1a2
and dword [ebp - 0xc80], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc80]
sub ecx, dword [ebp + eax - 0x558]
cmp ecx, dword [ebp - 0x778]
je 0x44d1c9
mov dword [ebp - 0x19b0], 1
jmp 0x44d1d0
and dword [ebp - 0x19b0], 0
cmp dword [ebp - 0x19b0], 0
je 0x44d1e5
mov dword [ebp - 0xc88], 1
jmp 0x44d1ec
and dword [ebp - 0xc88], 0
mov eax, dword [ebp - 0x778]
cmp dword [ebp - 0xc88], eax
jg 0x44d206
mov dword [ebp - 0x19b8], 1
jmp 0x44d20d
and dword [ebp - 0x19b8], 0
mov eax, dword [ebp - 0x778]
cmp dword [ebp - 0x19b8], eax
je 0x44d227
mov dword [ebp - 0xc90], 1
jmp 0x44d22e
and dword [ebp - 0xc90], 0
mov eax, dword [ebp - 0xc90]
neg eax
jne 0x44d24a
cmp dword [ebp - 0xca0], 0
jne 0x44d24a
and dword [ebp - 0x19c0], 0
jmp 0x44d254
mov dword [ebp - 0x19c0], 1
cmp dword [ebp - 0x19c0], 0x74db
jg 0x44d26c
mov dword [ebp - 0xc98], 1
jmp 0x44d273
and dword [ebp - 0xc98], 0
mov eax, dword [ebp - 0xc98]
sub eax, dword [ebp - 0x494]
jne 0x44d291
push 4
pop eax
test eax, eax
jne 0x44d291
and dword [ebp - 0x19c8], 0
jmp 0x44d29b
mov dword [ebp - 0x19c8], 1
mov eax, dword [ebp - 0x19c8]
add eax, 0xce22
jne 0x44d2c3
mov eax, 0x4826
test eax, eax
jne 0x44d2c3
cmp dword [ebp - 0xca0], 0
jne 0x44d2c3
and dword [ebp - 0x19d0], 0
jmp 0x44d2cd
mov dword [ebp - 0x19d0], 1
cmp dword [ebp - 0x19d0], 4
ja 0x44d2e2
mov dword [ebp - 0xca8], 1
jmp 0x44d2e9
and dword [ebp - 0xca8], 0
cmp dword [ebp - 0xca8], 0xbcd8
je 0x44d301
mov dword [ebp - 0x19d8], 1
jmp 0x44d308
and dword [ebp - 0x19d8], 0
mov eax, dword [ebp - 0x19d8]
mov dword [ebp - 0x778], eax
mov dword [ebp - 0x20c], 0
jmp 0x44d32d
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jl 0x44d3ff
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0x558], 0xffffffff
or eax, 0xffffffff
neg eax
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x20c]
mov eax, dword [ebp + eax*4 - 0x2654]
mov dword [ebp - 0xcb0], eax
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0xcb0]
mov dword [ebp + eax*4 - 0x558], ecx
cmp dword [ebp - 0xcb0], 0
je 0x44d3b2
mov byte [ebp - 0x29c], 0
movzx eax, byte [ebp - 0x29c]
test eax, eax
je 0x44d3b0
push 0x1f7e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
jmp 0x44d3fa
mov dword [ebp - 0x494], 3
jmp 0x44d3cb
mov eax, dword [ebp - 0x494]
dec eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0
jl 0x44d3fa
mov byte [ebp - 0x2ba], 0
movzx eax, byte [ebp - 0x2ba]
test eax, eax
je 0x44d3f8
push 0x2047
push 0
push 0x497
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x44d3be
jmp 0x44d320
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x2500]
mov dword [ebp + ecx - 0x19e0], eax
jmp 0x44da7a
mov dword [ebp - 0x5c8], 0
jmp 0x44d437
mov eax, dword [ebp - 0x5c8]
inc eax
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 1
jge 0x44d453
mov eax, dword [ebp - 0x5c8]
mov dword [ebp + eax*4 - 0x310], 0xc75b57fd
jmp 0x44d42a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x310], 0
jmp 0x44d481
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x310]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x310], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x310], 0xfffffff7
jl 0x44d754
mov dword [ebp - 0x184], 0xbd7b1c2a
mov dword [ebp - 0xad8], 0x896e60be
mov dword [ebp - 0x184], 0
jmp 0x44d4c2
mov eax, dword [ebp - 0x184]
dec eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0xfffffffa
jg 0x44d744
mov dword [ebp - 0xcd8], 1
mov dword [ebp - 0x2154], 0
mov dword [ebp - 0x780], 0
jmp 0x44d4fc
mov eax, dword [ebp - 0x780]
inc eax
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 2
jge 0x44d518
mov eax, dword [ebp - 0x780]
mov dword [ebp + eax*4 - 0x1dc0], 0x9949dfcf
jmp 0x44d4ef
mov byte [ebp - 0x29e], 0
movzx eax, byte [ebp - 0x29e]
test eax, eax
je 0x44d530
call dword [sym.imp.USER32.dll_EndMenu]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1dc0], 0
jmp 0x44d55e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dc0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1dc0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1dc0], 9
jle 0x44d73f
mov dword [ebp - 0xad0], 0xc6fec1b1
mov dword [ebp - 0x1a00], 0xd574417f
cmp dword [ebp - 0x184], 0x86524f20
jne 0x44d66c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x310]
cmp dword [ebp - 0xad0], eax
je 0x44d5c0
cmp dword [ebp - 0x184], 0
je 0x44d5c0
mov dword [ebp - 0xcb8], 1
jmp 0x44d5c7
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0xad0]
add eax, dword [ebp - 0xcb8]
mov ecx, dword [ebp - 0x184]
lea eax, [eax + ecx + 0x4743]
cmp eax, dword [ebp - 0xad0]
jge 0x44d5f4
mov dword [ebp - 0x19e8], 1
jmp 0x44d5fb
and dword [ebp - 0x19e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dc0]
cmp eax, dword [ebp - 0x19e8]
je 0x44d61c
mov dword [ebp - 0xcc0], 1
jmp 0x44d623
and dword [ebp - 0xcc0], 0
mov eax, dword [ebp - 0xcd8]
cmp dword [ebp - 0xcc0], eax
jne 0x44d63d
mov dword [ebp - 0x19f0], 1
jmp 0x44d644
and dword [ebp - 0x19f0], 0
mov eax, dword [ebp - 0x19f0]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0xad8]
neg eax
cmp eax, 0x1dc6
je 0x44d663
xor eax, eax
jne 0x44d66c
and dword [ebp - 0xcc8], 0
jmp 0x44d676
mov dword [ebp - 0xcc8], 1
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0xcc8], eax
jl 0x44d690
mov dword [ebp - 0x19f8], 1
jmp 0x44d697
and dword [ebp - 0x19f8], 0
mov eax, dword [ebp - 0x19f8]
inc eax
cmp eax, 9
jne 0x44d6af
mov dword [ebp - 0xcd0], 1
jmp 0x44d6b6
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0xcd0]
mov dword [ebp - 0x1a00], eax
mov eax, dword [ebp - 0x1a00]
sub eax, dword [ebp - 0x184]
cmp eax, 0x1723
jg 0x44d6e1
mov dword [ebp - 0x1a08], 1
jmp 0x44d6e8
and dword [ebp - 0x1a08], 0
mov eax, dword [ebp - 0xcd8]
cmp dword [ebp - 0x1a08], eax
jge 0x44d712
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x310], 0
je 0x44d712
mov dword [ebp - 0xce0], 1
jmp 0x44d719
and dword [ebp - 0xce0], 0
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0x2154], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x310], 0
je 0x44d73a
jmp 0x44d543
jmp 0x44d543
jmp 0x44d4b5
cmp dword [ebp - 0xad8], 0
je 0x44d74f
jmp 0x44d754
jmp 0x44d466
mov byte [ebp - 0x2be], 0
mov dword [ebp - 0x318], 0xffffffff
mov dword [ebp - 0xd00], 0
mov dword [ebp - 0x2848], 0xfffffff9
mov dword [ebp - 0x11c], 0
jmp 0x44d792
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jge 0x44d7ae
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x21d0], 1
jmp 0x44d785
mov dword [ebp - 0x11c], 0
jmp 0x44d7c7
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x44d7e3
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x2f74], 0x2ef703c5
jmp 0x44d7ba
mov dword [ebp - 0x318], 0
jmp 0x44d7fc
mov eax, dword [ebp - 0x318]
dec eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0xfffffffa
jne 0x44d99e
mov dword [ebp - 0x5d0], 0x34111d01
mov dword [ebp - 0x1a20], 0xffffffff
cmp dword [ebp - 0x318], 0
je 0x44d92e
mov eax, dword [ebp - 0x5d0]
dec eax
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0x318], eax
jl 0x44d851
mov dword [ebp - 0xce8], 1
jmp 0x44d858
and dword [ebp - 0xce8], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x21d0], 0xc422
jle 0x44d87d
cmp dword [ebp - 0x318], 0
jne 0x44d87d
and dword [ebp - 0x1a10], 0
jmp 0x44d887
mov dword [ebp - 0x1a10], 1
mov eax, dword [ebp - 0x1a20]
cmp eax, dword [ebp - 0x1a10]
jge 0x44d8a1
mov dword [ebp - 0x1a18], 1
jmp 0x44d8a8
and dword [ebp - 0x1a18], 0
mov eax, dword [ebp - 0xce8]
sub eax, dword [ebp - 0x1a18]
mov dword [ebp - 0xcf0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcf0]
mov dword [ebp + eax - 0x2f74], ecx
cmp dword [ebp - 0xcf0], 0
jne 0x44d8e2
mov dword [ebp - 0xcf8], 1
jmp 0x44d8e9
and dword [ebp - 0xcf8], 0
mov eax, dword [ebp - 0x1a20]
cmp dword [ebp - 0xcf8], eax
jne 0x44d903
mov dword [ebp - 0x1a28], 1
jmp 0x44d90a
and dword [ebp - 0x1a28], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1a28]
sub ecx, dword [ebp + eax - 0x21d0]
cmp ecx, 0xffffffff
je 0x44d92e
mov dword [ebp - 0x1a30], 1
jmp 0x44d935
and dword [ebp - 0x1a30], 0
mov dword [ebp - 0xd00], 0x290b
mov eax, dword [ebp - 0xd00]
sub eax, dword [ebp - 0x1a30]
inc eax
jne 0x44d960
cmp dword [ebp - 0x5d0], 0
jne 0x44d960
and dword [ebp - 0xd08], 0
jmp 0x44d96a
mov dword [ebp - 0xd08], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd08]
mov dword [ebp + eax - 0x21d0], ecx
mov byte [ebp - 0x2bc], 0
movzx eax, byte [ebp - 0x2bc]
test eax, eax
je 0x44d999
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x44d7ef
mov byte [ebp - 0x2a0], 0
movzx eax, byte [ebp - 0x2a0]
test eax, eax
je 0x44d9bc
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
movzx eax, byte [ebp - 0x2be]
test eax, eax
je 0x44da7a
mov dword [ebp - 0x215c], 1
mov dword [ebp - 0x2850], 0xde2bbef7
mov dword [ebp - 0x788], 0
jmp 0x44d9f8
mov eax, dword [ebp - 0x788]
inc eax
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x788], 2
jge 0x44da14
mov eax, dword [ebp - 0x788]
mov dword [ebp + eax*4 - 0x2984], 0x72d4ea68
jmp 0x44d9eb
mov byte [ebp - 0x2a2], 0
movzx eax, byte [ebp - 0x2a2]
test eax, eax
je 0x44da3e
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov eax, dword [ebp - 0x215c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2984], eax
push 0x2079
push 0x2505
push 0x1ce3
push 0x5e8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov dword [ebp - 0x320], 0xffffffff
mov dword [ebp - 0xd28], 0
mov dword [ebp - 0x2858], 0xfffffff9
mov dword [ebp - 0x18c], 0
jmp 0x44dab1
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x44dacd
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x21dc], 1
jmp 0x44daa4
mov dword [ebp - 0x18c], 0
jmp 0x44dae6
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x44db02
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x2f8c], 0x2ef703c5
jmp 0x44dad9
mov dword [ebp - 0x320], 0
jmp 0x44db1b
mov eax, dword [ebp - 0x320]
dec eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0xfffffffa
jne 0x44dcbd
mov dword [ebp - 0x5d8], 0x34111d01
mov dword [ebp - 0x1a48], 0xffffffff
cmp dword [ebp - 0x320], 0
je 0x44dc4d
mov eax, dword [ebp - 0x5d8]
dec eax
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x5d8]
cmp dword [ebp - 0x320], eax
jl 0x44db70
mov dword [ebp - 0xd10], 1
jmp 0x44db77
and dword [ebp - 0xd10], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x21dc], 0xc422
jle 0x44db9c
cmp dword [ebp - 0x320], 0
jne 0x44db9c
and dword [ebp - 0x1a38], 0
jmp 0x44dba6
mov dword [ebp - 0x1a38], 1
mov eax, dword [ebp - 0x1a48]
cmp eax, dword [ebp - 0x1a38]
jge 0x44dbc0
mov dword [ebp - 0x1a40], 1
jmp 0x44dbc7
and dword [ebp - 0x1a40], 0
mov eax, dword [ebp - 0xd10]
sub eax, dword [ebp - 0x1a40]
mov dword [ebp - 0xd18], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd18]
mov dword [ebp + eax - 0x2f8c], ecx
cmp dword [ebp - 0xd18], 0
jne 0x44dc01
mov dword [ebp - 0xd20], 1
jmp 0x44dc08
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0x1a48]
cmp dword [ebp - 0xd20], eax
jne 0x44dc22
mov dword [ebp - 0x1a50], 1
jmp 0x44dc29
and dword [ebp - 0x1a50], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1a50]
sub ecx, dword [ebp + eax - 0x21dc]
cmp ecx, 0xffffffff
je 0x44dc4d
mov dword [ebp - 0x1a58], 1
jmp 0x44dc54
and dword [ebp - 0x1a58], 0
mov dword [ebp - 0xd28], 0x290b
mov eax, dword [ebp - 0xd28]
sub eax, dword [ebp - 0x1a58]
inc eax
jne 0x44dc7f
cmp dword [ebp - 0x5d8], 0
jne 0x44dc7f
and dword [ebp - 0xd30], 0
jmp 0x44dc89
mov dword [ebp - 0xd30], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd30]
mov dword [ebp + eax - 0x21dc], ecx
mov byte [ebp - 0x2c0], 0
movzx eax, byte [ebp - 0x2c0]
test eax, eax
je 0x44dcb8
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x44db0e
mov byte [ebp - 0x2a4], 0
movzx eax, byte [ebp - 0x2a4]
test eax, eax
je 0x44dcdb
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
cmp dword [ebp + 8], 2
jl 0x4607f0
mov dword [ebp - 0x2860], 0x648261f
mov byte [ebp - 0x2c2], 0
movzx eax, byte [ebp - 0x2c2]
test eax, eax
je 0x44dd26
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0xb28
push 0x1856
push 0x1c6d
push 0x2510
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov byte [ebp - 0x2a6], 0
movzx eax, byte [ebp - 0x2a6]
test eax, eax
je 0x44dd45
push 0x1cd7
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x790], 0x5b9b55bb
mov dword [ebp - 0x790], 0x16
jmp 0x44dd68
mov eax, dword [ebp - 0x790]
dec eax
mov dword [ebp - 0x790], eax
cmp dword [ebp - 0x790], 8
jl 0x44ddf6
mov dword [ebp - 0x5e0], 0x7689351f
mov dword [ebp - 0x5e0], 0x1a
jmp 0x44dd98
mov eax, dword [ebp - 0x5e0]
dec eax
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 0xfffffffe
jge 0x44ddf1
mov dword [ebp - 0x560], 7
mov dword [ebp - 0x560], 0
jmp 0x44ddc4
mov eax, dword [ebp - 0x560]
inc eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 5
je 0x44dde4
mov dword [ebp - 0x2164], 0xfffffffe
cmp dword [ebp - 0x2164], 0
je 0x44dde2
jmp 0x44dde4
jmp 0x44ddb7
cmp dword [ebp - 0x560], 0
je 0x44ddef
jmp 0x44ddf1
jmp 0x44dd8b
jmp 0x44dd5b
mov dword [ebp - 0x12c], 0x540d7f82
mov dword [ebp - 0x1a60], 0
mov dword [ebp - 0xd38], 0xf3f7e813
mov dword [ebp - 0xd58], 8
mov dword [ebp - 0x124], 0
jmp 0x44de37
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jge 0x44de53
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x798], 0x5357
jmp 0x44de2a
mov dword [ebp - 0x124], 0
jmp 0x44de6c
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jge 0x44de88
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x2990], 0xfffffffa
jmp 0x44de5f
cmp dword [ebp - 0x1a60], 0
je 0x44dee1
cmp dword [ebp - 0x1a60], 0
jne 0x44deb3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x798], 0
jne 0x44deb3
and dword [ebp - 0x1a68], 0
jmp 0x44debd
mov dword [ebp - 0x1a68], 1
mov dword [ebp - 0xd38], 0xfffffff8
mov eax, dword [ebp - 0xd38]
cmp dword [ebp - 0x1a68], eax
jne 0x44dee1
mov dword [ebp - 0xd40], 1
jmp 0x44dee8
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0xd40]
sub eax, 0xbc56
jne 0x44df01
mov dword [ebp - 0x1a70], 1
jmp 0x44df08
and dword [ebp - 0x1a70], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x798]
cmp dword [ebp - 0x1a70], eax
je 0x44df29
mov dword [ebp - 0xd48], 1
jmp 0x44df30
and dword [ebp - 0xd48], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x798]
cmp dword [ebp - 0xd48], eax
jne 0x44df51
mov dword [ebp - 0x1a78], 1
jmp 0x44df58
and dword [ebp - 0x1a78], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x798]
cmp dword [ebp - 0x1a78], eax
jge 0x44df79
mov dword [ebp - 0xd50], 1
jmp 0x44df80
and dword [ebp - 0xd50], 0
cmp dword [ebp - 0xd50], 0xca70051
jne 0x44df9e
cmp dword [ebp - 0xd58], 0
jne 0x44df9e
and dword [ebp - 0x1a80], 0
jmp 0x44dfa8
mov dword [ebp - 0x1a80], 1
cmp dword [ebp - 0x1a80], 6
je 0x44dfbd
mov dword [ebp - 0x1a88], 1
jmp 0x44dfc4
and dword [ebp - 0x1a88], 0
mov eax, dword [ebp - 0xd58]
cmp dword [ebp - 0x1a88], eax
jne 0x44dfde
mov dword [ebp - 0xd60], 1
jmp 0x44dfe5
and dword [ebp - 0xd60], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd60]
mov dword [ebp + eax - 0x2990], ecx
mov dword [ebp - 0x2868], 0xd97a888a
mov dword [ebp - 0x5e8], 0
jmp 0x44e01b
mov eax, dword [ebp - 0x5e8]
inc eax
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x5e8], 4
jge 0x44e037
mov eax, dword [ebp - 0x5e8]
mov dword [ebp + eax*4 - 0x2694], 0
jmp 0x44e00e
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2694], 0
jmp 0x44e062
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2694]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2694], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2694], 0x19
jg 0x44e08d
mov byte [ebp - 0x2c4], 0
movzx eax, byte [ebp - 0x2c4]
test eax, eax
je 0x44e08b
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x44e049
mov dword [ebp - 0x650], 0xfffffffd
mov dword [ebp - 0x244], 0xffffffff
mov dword [ebp - 0xae8], 0x84bc9c3
mov dword [ebp - 0x568], 0xd777
mov dword [ebp - 0xae0], 0xfffffffc
mov dword [ebp - 0xaf0], 1
mov dword [ebp - 0x216c], 0xec1fcc8a
mov dword [ebp - 0x7a0], 0
jmp 0x44e0ec
mov eax, dword [ebp - 0x7a0]
inc eax
mov dword [ebp - 0x7a0], eax
cmp dword [ebp - 0x7a0], 3
jge 0x44e108
mov eax, dword [ebp - 0x7a0]
mov dword [ebp + eax*4 - 0x2fa4], 0x7516a205
jmp 0x44e0df
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x1a90], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1a90]
mov dword [ebp + eax - 0x2fa4], ecx
cmp dword [ebp - 0x1a90], 0
jne 0x44e13d
xor eax, eax
inc eax
jne 0x44e13d
and dword [ebp - 0xd78], 0
jmp 0x44e147
mov dword [ebp - 0xd78], 1
cmp dword [ebp - 0x244], 0
je 0x44e165
cmp dword [ebp - 0x568], 0
je 0x44e165
mov dword [ebp - 0xd68], 1
jmp 0x44e16c
and dword [ebp - 0xd68], 0
mov eax, dword [ebp - 0x568]
cmp dword [ebp - 0xd68], eax
jge 0x44e186
mov dword [ebp - 0x1a98], 1
jmp 0x44e18d
and dword [ebp - 0x1a98], 0
mov eax, dword [ebp - 0x568]
cmp dword [ebp - 0x1a98], eax
jl 0x44e1a7
mov dword [ebp - 0xd70], 1
jmp 0x44e1ae
and dword [ebp - 0xd70], 0
mov eax, dword [ebp - 0xd70]
sub eax, 0x755261fc
je 0x44e1d0
cmp dword [ebp - 0x244], 0
je 0x44e1d0
mov dword [ebp - 0x1aa0], 1
jmp 0x44e1d7
and dword [ebp - 0x1aa0], 0
mov eax, dword [ebp - 0x1aa0]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0xae0], eax
jge 0x44e1fd
mov dword [ebp - 0x1aa8], 1
jmp 0x44e204
and dword [ebp - 0x1aa8], 0
mov eax, dword [ebp - 0xd78]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0x1aa8]
sub eax, dword [ebp - 0x568]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0xaf0]
cmp dword [ebp - 0xae8], eax
jg 0x44e23c
mov dword [ebp - 0xd80], 1
jmp 0x44e243
and dword [ebp - 0xd80], 0
mov eax, dword [ebp - 0x568]
cmp dword [ebp - 0xd80], eax
jl 0x44e25d
mov dword [ebp - 0x1ab0], 1
jmp 0x44e264
and dword [ebp - 0x1ab0], 0
cmp dword [ebp - 0x1ab0], 0x18c84b7b
jl 0x44e27c
mov dword [ebp - 0xd88], 1
jmp 0x44e283
and dword [ebp - 0xd88], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x244]
add eax, dword [ebp - 0xd88]
cmp eax, dword [ebp - 0x244]
jg 0x44e2a6
mov dword [ebp - 0x1ab8], 1
jmp 0x44e2ad
and dword [ebp - 0x1ab8], 0
mov eax, dword [ebp - 0x1ab8]
sub eax, dword [ebp - 0x244]
mov dword [ebp - 0x216c], eax
mov eax, dword [ebp - 0xae0]
imul eax, dword [ebp - 0xae8]
cmp eax, dword [ebp - 0x244]
jl 0x44e2e0
mov dword [ebp - 0xd90], 1
jmp 0x44e2e7
and dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0xd90]
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0x670], 1
mov dword [ebp - 0x2870], 0xd97a888a
mov dword [ebp - 0x5f0], 0
jmp 0x44e320
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
cmp dword [ebp - 0x5f0], 4
jge 0x44e33c
mov eax, dword [ebp - 0x5f0]
mov dword [ebp + eax*4 - 0x2674], 0
jmp 0x44e313
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2674], 0
jmp 0x44e367
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2674], 0x19
jg 0x44e392
cmp dword [ebp + 8], 1
jne 0x460b7c
mov dword [ebp - 0x138], 0
jmp 0x460813
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 4
jge 0x46082f
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x25a8], 0xffffffff
jmp 0x460806
mov dword [ebp - 0x138], 0
jmp 0x460848
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x460864
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x9b8], 0xfe7d8a87
jmp 0x46083b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x9b8], 3
jmp 0x460892
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9b8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x9b8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9b8], 0
jl 0x460acc
mov dword [ebp - 0xc8c], 0x8cca6991
mov dword [ebp - 0x6a4], 0
jmp 0x4608c9
mov eax, dword [ebp - 0x6a4]
inc eax
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 1
jge 0x4608e5
mov eax, dword [ebp - 0x6a4]
mov dword [ebp + eax*4 - 0xdc], 0x73ff82ff
jmp 0x4608bc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xdc], 3
jmp 0x460913
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xdc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdc], 0
jl 0x460a8f
mov dword [ebp - 0x1ffc], 0xfffffffc
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x25a8]
cmp dword [ebp + eax - 0xdc], ecx
je 0x460959
mov dword [ebp - 0xc94], 1
jmp 0x460960
and dword [ebp - 0xc94], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x9b8]
cmp dword [ebp + eax*4 - 0x25a8], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xdc]
mov ecx, dword [ebp + ecx*4 - 0x25a8]
cmp dword [ebp + eax - 0xdc], ecx
jle 0x4609b0
mov dword [ebp - 0xc7c], 1
jmp 0x4609b7
and dword [ebp - 0xc7c], 0
cmp dword [ebp - 0xc7c], 0x5a8ccedb
jne 0x4609cf
mov dword [ebp - 0xc84], 1
jmp 0x4609d6
and dword [ebp - 0xc84], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc84]
sub ecx, dword [ebp + eax - 0x9b8]
mov dword [ebp - 0xc8c], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov edx, dword [ebp - 0xc8c]
sub edx, dword [ebp + ecx - 0x9b8]
sub edx, dword [ebp + eax - 0xdc]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc]
mov eax, dword [ebp + eax*4 - 0x25a8]
sub eax, dword [ebp - 0xc94]
sub eax, edx
cmp eax, 0xffff
ja 0x460a3e
mov dword [ebp - 0xc9c], 1
jmp 0x460a45
and dword [ebp - 0xc9c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x25a8]
imul eax, dword [ebp - 0xc9c]
mov dword [ebp - 0x1ffc], eax
mov byte [ebp - 0x282], 0
movzx eax, byte [ebp - 0x282]
test eax, eax
je 0x460a8a
push 0x1195
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp 0x4608f8
mov byte [ebp - 0x419], 0
movzx eax, byte [ebp - 0x419]
test eax, eax
je 0x460ac7
push 0
push 0
push 0
push 0xb3a
push 0x1b3b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x460877
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x9b8], 0x10cbbbc2
call fcn.0044b449
mov dword [ebp - 0x2a78], 0xfffffff7
mov dword [ebp - 0x2a74], 0xfffffff7
mov dword [ebp - 0x2a70], 0xfffffff7
mov dword [ebp - 0x2a6c], 0xfffffff7
mov dword [ebp - 0x6ac], 0xffffffff
mov dword [ebp - 0x6ac], 3
jmp 0x460b2d
mov eax, dword [ebp - 0x6ac]
dec eax
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 0
jl 0x460b5c
mov byte [ebp - 0x284], 0
movzx eax, byte [ebp - 0x284]
test eax, eax
je 0x460b5a
push 0x105d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
jmp 0x460b20
call fcn.004649f2
cdq
push 3
pop ecx
idiv ecx
add edx, 3
imul eax, edx, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4622f5
mov dword [ebp - 0x6bc], 7
mov dword [ebp - 0xcac], 0
mov dword [ebp - 0x200c], 0x4f204795
mov dword [ebp - 0x2ab0], 0x955a
mov dword [ebp - 0x6b4], 0
jmp 0x460bbd
mov eax, dword [ebp - 0x6b4]
inc eax
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 3
jge 0x460bd9
mov eax, dword [ebp - 0x6b4]
mov dword [ebp + eax*4 - 0x2618], 0x96f377cc
jmp 0x460bb0
xor eax, eax
jne 0x460bef
cmp dword [ebp - 0x6bc], 0
jne 0x460bef
and dword [ebp - 0x2004], 0
jmp 0x460bf9
mov dword [ebp - 0x2004], 1
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x2c58], eax
mov eax, dword [ebp - 0xcac]
cmp dword [ebp - 0x6bc], eax
jge 0x460c1f
mov dword [ebp - 0xca4], 1
jmp 0x460c26
and dword [ebp - 0xca4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2618]
cmp dword [ebp - 0xca4], eax
je 0x460c50
cmp dword [ebp - 0x6bc], 0
je 0x460c50
mov dword [ebp - 0xcb4], 1
jmp 0x460c57
and dword [ebp - 0xcb4], 0
mov eax, dword [ebp - 0xcac]
cmp dword [ebp - 0xcb4], eax
jle 0x460c71
mov dword [ebp - 0xcbc], 1
jmp 0x460c78
and dword [ebp - 0xcbc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcbc]
sub ecx, dword [ebp + eax - 0x2618]
push 4
pop eax
shl eax, 0
add ecx, dword [ebp + eax - 0x2618]
je 0x460ca6
mov dword [ebp - 0x200c], 0xfffffff8
jmp 0x460cbd
mov dword [ebp - 0xcc4], 0xdc6b79df
mov eax, dword [ebp - 0xcc4]
inc eax
mov dword [ebp - 0xcc4], eax
xor ecx, ecx
call fcn.004266bd
push eax
call fcn.00464a13
pop ecx
mov dword [ebp - 0xa3c], 0xa6de
mov dword [ebp - 0x2ab8], 0x51328f6c
mov dword [ebp - 0x28], 0
jmp 0x460cef
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x460d05
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbd0], 0xd72276b8
jmp 0x460ce8
mov dword [ebp - 0x28], 0
jmp 0x460d15
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x460d2b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xcd4], 0xfffffff9
jmp 0x460d0e
mov dword [ebp - 0x28], 0
jmp 0x460d3b
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x460d51
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1de4], 0x393e75cb
jmp 0x460d34
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1de4]
sub ecx, dword [ebp + eax - 0xbd0]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1de4]
dec eax
push 4
pop edx
imul edx, edx, 0
mov dword [ebp + edx - 0x1de4], eax
test ecx, ecx
je 0x460d9b
xor eax, eax
inc eax
je 0x460d9b
mov dword [ebp - 0xccc], 1
jmp 0x460da2
and dword [ebp - 0xccc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcd4]
cmp dword [ebp - 0xccc], eax
jl 0x460e4b
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x2d48], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbd0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbd0]
mov dword [ebp - 0x2ac0], eax
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x2c68], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbd0], 0xfffffffc
jne 0x460e10
mov dword [ebp - 0x2014], 1
jmp 0x460e17
and dword [ebp - 0x2014], 0
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x2ac8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcd4]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xbd0]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x1de4]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1de4], 3
jb 0x460e67
mov dword [ebp - 0xcdc], 1
jmp 0x460e6e
and dword [ebp - 0xcdc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcdc]
mov dword [ebp + eax - 0xbd0], ecx
mov byte [ebp - 0x2fb], 0
movzx eax, byte [ebp - 0x2fb]
test eax, eax
je 0x460eae
push 0
push 0
push 0x461
push 0x220b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov dword [ebp - 0xa98], 0
mov dword [ebp - 0xa94], 0
mov dword [ebp - 0xa90], 0
mov dword [ebp - 0xa8c], 0
mov dword [ebp - 0xa4c], 0x83cc
mov dword [ebp - 0x2034], 3
mov dword [ebp - 0x2044], 0x3e87122a
mov dword [ebp - 0x2e3c], 0x8c8a
mov dword [ebp - 0x140], 0
jmp 0x460f17
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 2
jge 0x460f33
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x9c8], 2
jmp 0x460f0a
mov dword [ebp - 0x140], 0
jmp 0x460f4c
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 2
jge 0x460f68
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x1df0], 0x21fbb9cf
jmp 0x460f3f
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xa98], 0
jmp 0x460f96
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa98]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa98], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa98], 1
jg 0x4612b2
mov dword [ebp - 0xa44], 1
mov dword [ebp - 0xd24], 0x7b6c411e
mov dword [ebp - 0x6c4], 0
jmp 0x460fd7
mov eax, dword [ebp - 0x6c4]
inc eax
mov dword [ebp - 0x6c4], eax
cmp dword [ebp - 0x6c4], 1
jge 0x460ff3
mov eax, dword [ebp - 0x6c4]
mov dword [ebp + eax*4 - 0x203c], 0x38770ce4
jmp 0x460fca
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa98]
mov eax, dword [ebp + eax*4 - 0x9c8]
mov dword [ebp - 0x2ad0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9c8], 0
je 0x46108c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9c8], 0xd814
jge 0x46103c
mov dword [ebp - 0xce4], 1
jmp 0x461043
and dword [ebp - 0xce4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa98]
cmp dword [ebp - 0xce4], eax
jg 0x461064
mov dword [ebp - 0x201c], 1
jmp 0x46106b
and dword [ebp - 0x201c], 0
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0x2c78], eax
cmp dword [ebp - 0xa44], 0
je 0x46108c
mov dword [ebp - 0x2024], 1
jmp 0x461093
and dword [ebp - 0x2024], 0
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0x2ad8], eax
cmp dword [ebp - 0xa44], 0
jne 0x4610bf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa98]
cmp dword [ebp + eax*4 - 0x9c8], 0
je 0x4610fa
mov dword [ebp - 0x202c], 7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa98]
cmp dword [ebp + eax*4 - 0x9c8], 0
je 0x4610e5
jmp 0x4612b2
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa98]
mov dword [ebp - 0x202c], eax
jmp 0x461125
mov byte [ebp - 0x286], 0
movzx eax, byte [ebp - 0x286]
test eax, eax
je 0x461125
push 0x457
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1df0]
mov dword [ebp - 0x2034], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa98]
cmp dword [ebp + eax*4 - 0x9c8], 0
je 0x461259
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x203c]
mov dword [ebp - 0x2d50], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1df0]
mov dword [ebp - 0x2ae0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1df0]
cmp dword [ebp - 0xa44], eax
jle 0x46119a
mov dword [ebp - 0xcec], 1
jmp 0x4611a1
and dword [ebp - 0xcec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa98]
mov eax, dword [ebp + eax*4 - 0x9c8]
cmp dword [ebp - 0xcec], eax
jne 0x4611c9
mov dword [ebp - 0xcf4], 1
jmp 0x4611d0
and dword [ebp - 0xcf4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1df0]
cmp dword [ebp - 0xcf4], eax
jge 0x4611f1
mov dword [ebp - 0xcfc], 1
jmp 0x4611f8
and dword [ebp - 0xcfc], 0
cmp dword [ebp - 0xcfc], 0xb6749efe
jae 0x461210
mov dword [ebp - 0xd04], 1
jmp 0x461217
and dword [ebp - 0xd04], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1df0]
cmp dword [ebp - 0xd04], eax
jne 0x461238
mov dword [ebp - 0xd0c], 1
jmp 0x46123f
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0xa4c]
cmp dword [ebp - 0xd0c], eax
jne 0x461259
and dword [ebp - 0xd14], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa98]
mov eax, dword [ebp + eax*4 - 0x9c8]
imul eax, dword [ebp - 0xd14]
cmp eax, 0x45a9172c
jg 0x46128e
mov dword [ebp - 0xd1c], 1
jmp 0x461295
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0xd1c]
mov dword [ebp - 0xd24], eax
mov eax, dword [ebp - 0xd24]
mov dword [ebp - 0x2044], eax
jmp 0x460f7b
push 0
push 0
push 0
push 0
push 0x19
push 0x64
push 0x1863b
push 0x18695
push 0x90000000
push 0xa7cc6c
push 0xa7cc6c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xd5c], 5
mov dword [ebp - 0xd34], 0x8fbfc75d
mov dword [ebp - 0xa54], 0
mov dword [ebp - 0x148], 0
jmp 0x46131c
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x461338
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x1f4], 0xf57a7c20
jmp 0x46130f
mov dword [ebp - 0x148], 0
jmp 0x461351
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jge 0x46136d
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x2ca4], 3
jmp 0x461344
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f4]
mov dword [ebp - 0x2c88], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f4]
mov dword [ebp - 0x2ae8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f4], 0
je 0x46142d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f4], 9
jg 0x4613c3
mov dword [ebp - 0xd2c], 1
jmp 0x4613ca
and dword [ebp - 0xd2c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f4]
cmp dword [ebp - 0xd2c], eax
jge 0x4613eb
mov dword [ebp - 0x204c], 1
jmp 0x4613f2
and dword [ebp - 0x204c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f4]
mov dword [ebp - 0x2db0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f4]
mov dword [ebp - 0xd34], eax
cmp dword [ebp - 0xd34], 0
je 0x46142d
mov dword [ebp - 0xd3c], 1
jmp 0x461434
and dword [ebp - 0xd3c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f4]
imul eax, dword [ebp - 0xd3c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1f4]
jne 0x461463
mov dword [ebp - 0xd44], 1
jmp 0x46146a
and dword [ebp - 0xd44], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f4]
cmp dword [ebp - 0xd44], eax
jge 0x46149b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f4], 0
je 0x46149b
mov dword [ebp - 0xd4c], 1
jmp 0x4614a2
and dword [ebp - 0xd4c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f4]
cmp dword [ebp - 0xd4c], eax
jle 0x4614c3
mov dword [ebp - 0xd64], 1
jmp 0x4614ca
and dword [ebp - 0xd64], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f4]
mov dword [ebp - 0xd54], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd54]
mov dword [ebp + eax - 0x2ca4], ecx
mov eax, dword [ebp - 0xd54]
mov dword [ebp - 0xd5c], eax
mov eax, dword [ebp - 0xd5c]
add eax, dword [ebp - 0xd64]
je 0x461526
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2ca4], 0
je 0x461526
mov dword [ebp - 0xd6c], 1
jmp 0x46152d
and dword [ebp - 0xd6c], 0
cmp dword [ebp - 0xd6c], 0x4c638299
jle 0x461545
mov dword [ebp - 0xd74], 1
jmp 0x46154c
and dword [ebp - 0xd74], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f4]
cmp dword [ebp - 0xd74], eax
jl 0x46156d
mov dword [ebp - 0xd7c], 1
jmp 0x461574
and dword [ebp - 0xd7c], 0
cmp dword [ebp - 0xd7c], 9
jl 0x461589
mov dword [ebp - 0xd84], 1
jmp 0x461590
and dword [ebp - 0xd84], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f4]
cmp dword [ebp - 0xd84], eax
jle 0x4615b1
mov dword [ebp - 0x168], 0x540d7f82
mov dword [ebp - 0x704], 0xfffffffd
mov dword [ebp - 0x70c], 1
mov dword [ebp - 0x6f4], 0
jmp 0x46232c
mov eax, dword [ebp - 0x6f4]
inc eax
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 2
jge 0x462348
mov eax, dword [ebp - 0x6f4]
mov dword [ebp + eax*4 - 0x2a5c], 0xa772304b
jmp 0x46231f
mov dword [ebp - 0x168], 0xfffffff0
jmp 0x462361
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jge 0x4623b6
mov dword [ebp - 0x538], 0xa4d073ff
cmp dword [ebp - 0x168], 0
je 0x46237f
jmp 0x4623b6
mov dword [ebp - 0x538], 0
jmp 0x462398
mov eax, dword [ebp - 0x538]
inc eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 2
jge 0x4623b4
mov eax, dword [ebp - 0x538]
mov dword [ebp + eax*4 - 0x2a5c], 0xffffffff
jmp 0x46238b
jmp 0x462354
mov dword [ebp - 0x168], 0
jmp 0x4623cf
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jg 0x462577
mov dword [ebp - 0x260], 1
mov dword [ebp - 0x260], 0
jmp 0x4623ff
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 1
jg 0x46245a
mov dword [ebp - 0x6fc], 0
jmp 0x462421
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
cmp dword [ebp - 0x6fc], 1
jge 0x46243d
mov eax, dword [ebp - 0x6fc]
mov dword [ebp + eax*4 - 0xf0c], 0xffffffff
jmp 0x462414
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf0c], eax
jmp 0x4623f2
mov dword [ebp - 0x260], 1
jmp 0x462473
mov eax, dword [ebp - 0x260]
dec eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jl 0x462572
mov dword [ebp - 0x704], 1
jmp 0x462499
mov eax, dword [ebp - 0x704]
dec eax
mov dword [ebp - 0x704], eax
cmp dword [ebp - 0x704], 0
jl 0x46256d
mov byte [ebp - 0x2aa], 0
movzx eax, byte [ebp - 0x2aa]
test eax, eax
je 0x4624c0
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [ebp - 0x70c], 1
jmp 0x4624d9
mov eax, dword [ebp - 0x70c]
dec eax
mov dword [ebp - 0x70c], eax
cmp dword [ebp - 0x70c], 0
jl 0x462568
mov dword [ebp - 0x714], 0x4f88039d
mov dword [ebp - 0x714], 1
jmp 0x462509
mov eax, dword [ebp - 0x714]
dec eax
mov dword [ebp - 0x714], eax
cmp dword [ebp - 0x714], 0
jl 0x462563
mov dword [ebp - 0x71c], 0xa945cb81
mov dword [ebp - 0x71c], 0
jmp 0x462535
mov eax, dword [ebp - 0x71c]
inc eax
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 1
jg 0x462561
mov byte [ebp - 0x28e], 0
movzx eax, byte [ebp - 0x28e]
test eax, eax
je 0x46255f
push 0x140c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x462528
jmp 0x4624fc
jmp 0x4624cc
jmp 0x46248c
jmp 0x462466
jmp 0x4623c2
mov dword [ebp - 0x430], 0xffffffff
mov dword [ebp - 0xf4c], 0
mov dword [ebp - 0x2700], 0xfffffff9
mov dword [ebp - 0x170], 0
jmp 0x4625ae
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x4625ca
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x2248], 1
jmp 0x4625a1
mov dword [ebp - 0x170], 0
jmp 0x4625e3
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jge 0x4625ff
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x2f5c], 0x2ef703c5
jmp 0x4625d6
mov dword [ebp - 0x430], 0
jmp 0x462618
mov eax, dword [ebp - 0x430]
dec eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0xfffffffa
jne 0x4627ba
mov dword [ebp - 0x724], 0x34111d01
mov dword [ebp - 0xf34], 0xffffffff
cmp dword [ebp - 0x430], 0
je 0x46274a
mov eax, dword [ebp - 0x724]
dec eax
mov dword [ebp - 0x724], eax
mov eax, dword [ebp - 0x724]
cmp dword [ebp - 0x430], eax
jl 0x46266d
mov dword [ebp - 0xf1c], 1
jmp 0x462674
and dword [ebp - 0xf1c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2248], 0xc422
jle 0x462699
cmp dword [ebp - 0x430], 0
jne 0x462699
and dword [ebp - 0xf14], 0
jmp 0x4626a3
mov dword [ebp - 0xf14], 1
mov eax, dword [ebp - 0xf34]
cmp eax, dword [ebp - 0xf14]
jge 0x4626bd
mov dword [ebp - 0xf24], 1
jmp 0x4626c4
and dword [ebp - 0xf24], 0
mov eax, dword [ebp - 0xf1c]
sub eax, dword [ebp - 0xf24]
mov dword [ebp - 0xf2c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf2c]
mov dword [ebp + eax - 0x2f5c], ecx
cmp dword [ebp - 0xf2c], 0
jne 0x4626fe
mov dword [ebp - 0xf3c], 1
jmp 0x462705
and dword [ebp - 0xf3c], 0
mov eax, dword [ebp - 0xf34]
cmp dword [ebp - 0xf3c], eax
jne 0x46271f
mov dword [ebp - 0xf44], 1
jmp 0x462726
and dword [ebp - 0xf44], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xf44]
sub ecx, dword [ebp + eax - 0x2248]
cmp ecx, 0xffffffff
je 0x46274a
mov dword [ebp - 0xf54], 1
jmp 0x462751
and dword [ebp - 0xf54], 0
mov dword [ebp - 0xf4c], 0x290b
mov eax, dword [ebp - 0xf4c]
sub eax, dword [ebp - 0xf54]
inc eax
jne 0x46277c
cmp dword [ebp - 0x724], 0
jne 0x46277c
and dword [ebp - 0xf5c], 0
jmp 0x462786
mov dword [ebp - 0xf5c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf5c]
mov dword [ebp + eax - 0x2248], ecx
mov byte [ebp - 0x2ac], 0
movzx eax, byte [ebp - 0x2ac]
test eax, eax
je 0x4627b5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x46260b
mov byte [ebp - 0x290], 0
movzx eax, byte [ebp - 0x290]
test eax, eax
je 0x4627d8
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
mov dword [ebp - 0x268], 0xffffffff
mov dword [ebp - 0x2708], 0xd8cb4c23
mov dword [ebp - 0x2710], 0x865425a8
mov dword [ebp - 0x2718], 0x74c7af5a
mov dword [ebp - 0x2720], 0xffffffff
mov dword [ebp - 0xf64], 0xb16aac89
mov dword [ebp - 0x72c], 0
jmp 0x46282d
mov eax, dword [ebp - 0x72c]
inc eax
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 3
jge 0x462849
mov eax, dword [ebp - 0x72c]
mov dword [ebp + eax*4 - 0x30bc], 9
jmp 0x462820
mov dword [ebp - 0x268], 0x10
jmp 0x462862
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0xe
jle 0x462889
mov byte [ebp - 0x2ae], 0
movzx eax, byte [ebp - 0x2ae]
test eax, eax
je 0x462887
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
jmp 0x462855
mov dword [ebp - 0x268], 0xfffffffe
jmp 0x4628a2
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 9
jg 0x462924
mov dword [ebp - 0x2728], 0xfffffffc
mov dword [ebp - 0x2730], 1
mov dword [ebp - 0x2738], 0xa5223fa3
mov dword [ebp - 0x2740], 0xa29f5838
mov dword [ebp - 0x2748], 0xfffffffb
mov dword [ebp - 0x734], 0
jmp 0x4628f6
mov eax, dword [ebp - 0x734]
inc eax
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x734], 1
jge 0x462912
mov eax, dword [ebp - 0x734]
mov dword [ebp + eax*4 - 0x2750], 1
jmp 0x4628e9
mov eax, dword [ebp - 0xf64]
dec eax
mov dword [ebp - 0xf64], eax
jmp 0x462895
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.0044b44e
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret