Function at 0x40129e
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2614
call fcn.004aa9c0
push esi
push edi
mov dword [ebp - 0x290], 0x77c8748a
mov dword [ebp - 0x24], 0x9bd697e7
mov dword [ebp - 0xa4], 0xf8d19c92
push 4
lea ecx, [ebp - 0x458]
call fcn.004147f5
mov dword [ebp - 0x1b0], 0xffffffff
mov dword [ebp - 0x1af8], 1
mov dword [ebp - 0x6b8], 0
jmp 0x401302
mov eax, dword [ebp - 0x6b8]
inc eax
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 4
jge 0x401324
push dword [ebp - 0x6b8]
lea ecx, [ebp - 0x458]
call fcn.004148e3
mov dword [eax], 0xcde9e843
jmp 0x4012f5
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
je 0x401344
xor eax, eax
inc eax
je 0x401344
mov dword [ebp - 0x1074], 1
jmp 0x40134b
and dword [ebp - 0x1074], 0
cmp dword [ebp - 0x1074], 0x3e86f8c7
jne 0x401363
mov dword [ebp - 0x1780], 1
jmp 0x40136a
and dword [ebp - 0x1780], 0
mov eax, dword [ebp - 0x1780]
inc eax
je 0x401388
cmp dword [ebp - 0x290], 0
je 0x401388
mov dword [ebp - 0x1788], 1
jmp 0x40138f
and dword [ebp - 0x1788], 0
mov eax, dword [ebp - 0x1788]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x24], 0
jmp 0x4013b1
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x401964
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x1b18], 0x503ecef3
push dword [ebp - 0x24]
lea ecx, [ebp - 0x458]
call fcn.004148e3
cmp dword [eax], 0
je 0x4013fe
push dword [ebp - 0x24]
lea ecx, [ebp - 0x458]
call fcn.004148e3
cmp dword [eax], 0
je 0x4013fe
mov dword [ebp - 0x1790], 1
jmp 0x401405
and dword [ebp - 0x1790], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x458]
call fcn.004148e3
mov ecx, dword [ebp - 0x1790]
cmp ecx, dword [eax]
jge 0x401429
mov dword [ebp - 0x1798], 1
jmp 0x401430
and dword [ebp - 0x1798], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x458]
call fcn.004148e3
mov ecx, dword [ebp - 0x1798]
add ecx, dword [eax]
jne 0x401454
mov dword [ebp - 0x17a0], 1
jmp 0x40145b
and dword [ebp - 0x17a0], 0
mov eax, dword [ebp - 0x17a0]
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 0x3c]
push 3
lea ecx, [ebp - 0x458]
call fcn.004148e3
cmp esi, dword [eax]
jle 0x401484
mov dword [ebp - 0x1884], 1
jmp 0x40148b
and dword [ebp - 0x1884], 0
mov dword [ebp - 0xa4], 8
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x22e0], eax
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x21d0], eax
push 0
lea ecx, [ebp - 0x458]
call fcn.004148e3
push 2
pop eax
test eax, eax
je 0x4014d6
cmp dword [ebp - 0xa4], 0
je 0x4014d6
mov dword [ebp - 0x17a8], 1
jmp 0x4014dd
and dword [ebp - 0x17a8], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x458]
call fcn.004148e3
mov ecx, dword [ebp - 0x17a8]
cmp ecx, dword [eax]
jge 0x401501
mov dword [ebp - 0x17b0], 1
jmp 0x401508
and dword [ebp - 0x17b0], 0
cmp dword [ebp - 0x17b0], 0
jl 0x40151d
mov dword [ebp - 0x17b8], 1
jmp 0x401524
and dword [ebp - 0x17b8], 0
push 3
lea ecx, [ebp - 0x458]
call fcn.004148e3
mov ecx, dword [ebp - 0x17b8]
cmp ecx, dword [eax]
jg 0x401547
mov dword [ebp - 0x1ae8], 1
jmp 0x40154e
and dword [ebp - 0x1ae8], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x458]
call fcn.004148e3
mov eax, dword [eax]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x197cbb40
jne 0x40157c
mov dword [ebp - 0x17c0], 1
jmp 0x401583
and dword [ebp - 0x17c0], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x458]
call fcn.004148e3
mov eax, dword [eax]
cmp eax, dword [ebp - 0x17c0]
jne 0x4015a7
mov dword [ebp - 0x17c8], 1
jmp 0x4015ae
and dword [ebp - 0x17c8], 0
mov eax, dword [ebp - 0x17c8]
sub eax, 0xa
je 0x401805
push 2
lea ecx, [ebp - 0x1d1c]
call fcn.004147f5
mov dword [ebp - 0x644], 0
jmp 0x4015e3
mov eax, dword [ebp - 0x644]
inc eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 2
jge 0x401605
push dword [ebp - 0x644]
lea ecx, [ebp - 0x1d1c]
call fcn.004148e3
mov dword [eax], 0x8b9db5df
jmp 0x4015d6
mov dword [ebp - 0x3c], 0
jmp 0x401615
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jne 0x401640
mov byte [ebp - 0x1f0], 0
movzx eax, byte [ebp - 0x1f0]
test eax, eax
je 0x40163e
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
jmp 0x40160e
mov dword [ebp - 0x1b0], 0xffffffe4
jmp 0x401659
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x15
jne 0x4017f5
mov dword [ebp - 0x1b00], 0x53cf54ce
mov dword [ebp - 0x1808], 0
mov dword [ebp - 0xa4], 0x19
jmp 0x401693
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x1c
jg 0x4017f0
mov dword [ebp - 0x1b08], 0x456a9e5f
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x290], eax
jne 0x4016c4
mov dword [ebp - 0x1af0], 1
jmp 0x4016cb
and dword [ebp - 0x1af0], 0
mov eax, dword [ebp - 0x1af8]
mov dword [ebp - 0x2334], eax
mov eax, dword [ebp - 0x1b00]
sub eax, 0x2ce7bce5
cmp eax, dword [ebp - 0x24]
jge 0x4016f3
mov dword [ebp - 0x17d0], 1
jmp 0x4016fa
and dword [ebp - 0x17d0], 0
cmp dword [ebp - 0x17d0], 0xa6b9
jg 0x401712
mov dword [ebp - 0x17d8], 1
jmp 0x401719
and dword [ebp - 0x17d8], 0
mov eax, dword [ebp - 0x17d8]
add eax, 0x10f71350
jne 0x401732
mov dword [ebp - 0x17e0], 1
jmp 0x401739
and dword [ebp - 0x17e0], 0
cmp dword [ebp - 0x17e0], 1
jl 0x40174e
mov dword [ebp - 0x17f0], 1
jmp 0x401755
and dword [ebp - 0x17f0], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x458]
call fcn.004148e3
mov eax, 0x2edcddcd
cmp eax, 1
jb 0x401779
mov dword [ebp - 0x17f8], 1
jmp 0x401780
and dword [ebp - 0x17f8], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x17f8]
lea esi, [ecx + eax + 0x9032]
imul esi, dword [ebp - 0x1b08]
push 1
lea ecx, [ebp - 0x1d1c]
call fcn.004148e3
cmp esi, dword [eax]
je 0x4017b4
mov dword [ebp - 0x1800], 1
jmp 0x4017bb
and dword [ebp - 0x1800], 0
mov eax, dword [ebp - 0x1800]
mov dword [ebp - 0x1808], eax
mov esi, dword [ebp - 0x1808]
push 0
lea ecx, [ebp - 0x1d1c]
call fcn.004148e3
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0x458]
call fcn.004148e3
mov dword [eax], esi
jmp 0x401686
jmp 0x40164c
lea ecx, [ebp - 0x1d1c]
call fcn.004148c7
jmp 0x401932
mov dword [ebp - 0x1208], 0x66802143
mov dword [ebp - 0x1b28], 1
mov byte [ebp - 0x263], 0
movzx eax, byte [ebp - 0x263]
test eax, eax
je 0x401835
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x21d8], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x243c], eax
cmp dword [ebp - 0xa4], 0xfffffff9
jae 0x40185f
mov dword [ebp - 0x1b10], 1
jmp 0x401866
and dword [ebp - 0x1b10], 0
cmp dword [ebp - 0x3c], 0xe516
jl 0x40187b
mov dword [ebp - 0x8e8], 1
jmp 0x401882
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x8e8]
je 0x40189f
cmp dword [ebp - 0x3c], 0
je 0x40189f
mov dword [ebp - 0x1200], 1
jmp 0x4018a6
and dword [ebp - 0x1200], 0
mov eax, dword [ebp - 0x1b18]
cmp dword [ebp - 0x1200], eax
jg 0x4018c0
mov dword [ebp - 0x1b20], 1
jmp 0x4018c7
and dword [ebp - 0x1b20], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x21e0], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x8f0], eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x458]
call fcn.004148e3
mov ecx, dword [ebp - 0x8f0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x1208], eax
mov eax, dword [ebp - 0x1208]
imul eax, dword [ebp - 0x1b28]
cmp eax, dword [ebp - 0x1b0]
jl 0x40191f
mov dword [ebp - 0x8f8], 1
jmp 0x401926
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x8f8]
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x3c], 3
jmp 0x401942
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x40195f
push dword [ebp - 0x24]
lea ecx, [ebp - 0x458]
call fcn.004148e3
cmp dword [eax], 0
je 0x40195d
jmp 0x40195f
jmp 0x40193b
jmp 0x4013aa
lea ecx, [ebp - 0x458]
call fcn.004148c7
mov dword [ebp - 0x2d8], 0x77c8748a
mov dword [ebp - 0x30], 0x9bd697e7
mov dword [ebp - 0x88], 0xf8d19c92
mov dword [ebp - 0x2a8], 1
push 2
lea ecx, [ebp - 0x1da0]
call fcn.004147f5
mov dword [ebp - 0x1b30], 0xacb314b8
mov dword [ebp - 0x488], 0
jmp 0x4019c4
mov eax, dword [ebp - 0x488]
inc eax
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 2
jge 0x4019e6
push dword [ebp - 0x488]
lea ecx, [ebp - 0x1da0]
call fcn.004148e3
mov dword [eax], 0x49f845d8
jmp 0x4019b7
mov dword [ebp - 0x2a8], 0xffffffec
jmp 0x4019ff
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0x1a
jne 0x401e03
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x1b38], 0x7c1abdf
mov dword [ebp - 0x358], 0x1e2cd849
mov dword [ebp - 0x374], 0
jmp 0x401a43
mov eax, dword [ebp - 0x374]
dec eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0xffffffec
jle 0x401dfe
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x298], 1
jmp 0x401a73
mov eax, dword [ebp - 0x298]
dec eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jl 0x401df9
mov dword [ebp - 0x2a0], 0xfc3938dd
mov dword [ebp - 0x1b48], 5
mov dword [ebp - 0x2a0], 0
jmp 0x401aad
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 1
jg 0x401da6
mov dword [ebp - 0x300], 7
mov dword [ebp - 0x300], 0
jmp 0x401add
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 1
jg 0x401da1
mov dword [ebp - 0x650], 0x67d50f82
mov dword [ebp - 0x1b40], 0x3523e24b
mov byte [ebp - 0x277], 0
movzx eax, byte [ebp - 0x277]
test eax, eax
je 0x401b27
push 0x17e9
push 0x257c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [ebp - 0x650], 1
jmp 0x401b40
mov eax, dword [ebp - 0x650]
dec eax
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 0
jl 0x401d9c
push 4
lea ecx, [ebp - 0x1f3c]
call fcn.004147f5
mov dword [ebp - 0x114], 0
jmp 0x401b73
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 4
jge 0x401b95
push dword [ebp - 0x114]
lea ecx, [ebp - 0x1f3c]
call fcn.004148e3
mov dword [eax], 1
jmp 0x401b66
mov dword [ebp - 0x114], 0
jmp 0x401bae
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 4
jge 0x401bca
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x25c4], 0x531defce
jmp 0x401ba1
push 2
lea ecx, [ebp - 0x1f3c]
call fcn.004148e3
mov ecx, dword [ebp - 0x298]
cmp dword [eax], ecx
je 0x401bf7
mov eax, dword [ebp - 0x298]
sub eax, 0x40df
jne 0x401bf7
and dword [ebp - 0x1210], 0
jmp 0x401c01
mov dword [ebp - 0x1210], 1
imul eax, dword [ebp - 0x1210], 0x995f
test eax, eax
jge 0x401c1b
mov dword [ebp - 0x900], 1
jmp 0x401c22
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x1b30]
cmp dword [ebp - 0x900], eax
jle 0x401c3c
mov dword [ebp - 0x1218], 1
jmp 0x401c43
and dword [ebp - 0x1218], 0
cmp dword [ebp - 0x1218], 0xfffffffd
je 0x401c5d
xor eax, eax
inc eax
je 0x401c5d
mov dword [ebp - 0x908], 1
jmp 0x401c64
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x908], eax
jle 0x401c87
mov eax, 0x9552
test eax, eax
je 0x401c87
mov dword [ebp - 0x1220], 1
jmp 0x401c8e
and dword [ebp - 0x1220], 0
cmp dword [ebp - 0x1220], 0xd06f
je 0x401cac
cmp dword [ebp - 0x1b38], 0
jne 0x401cac
and dword [ebp - 0x910], 0
jmp 0x401cb6
mov dword [ebp - 0x910], 1
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0
jne 0x401ce4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x25c4], 0
jne 0x401ce4
and dword [ebp - 0x1228], 0
jmp 0x401cee
mov dword [ebp - 0x1228], 1
mov eax, dword [ebp - 0x1228]
add eax, 0x2b583897
cmp eax, dword [ebp - 0x300]
jl 0x401d0d
mov dword [ebp - 0x1230], 1
jmp 0x401d14
and dword [ebp - 0x1230], 0
push dword [ebp - 0x300]
lea ecx, [ebp - 0x1da0]
call fcn.004148e3
mov dword [ebp - 0x918], eax
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0x1da0]
call fcn.004148e3
mov ecx, dword [ebp - 0x918]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x918]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1230]
jl 0x401d62
mov dword [ebp - 0x920], 1
jmp 0x401d69
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x2a8]
imul eax, dword [ebp - 0x920]
sub eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x1b40], eax
mov dword [ebp - 0x1b48], 0x7dcc3592
lea ecx, [ebp - 0x1f3c]
call fcn.004148c7
jmp 0x401b33
jmp 0x401ad0
jmp 0x401aa0
mov dword [ebp - 0x358], 0
jmp 0x401dbf
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 1
jg 0x401df4
mov byte [ebp - 0x265], 0
movzx eax, byte [ebp - 0x265]
test eax, eax
je 0x401de7
push 0x1901
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
cmp dword [ebp - 0x2a8], 0
je 0x401df2
jmp 0x401df4
jmp 0x401db2
jmp 0x401a66
jmp 0x401a36
jmp 0x4019f2
lea ecx, [ebp - 0x1da0]
call fcn.004148c7
push 4
lea ecx, [ebp - 0x44c]
call fcn.004147f5
mov dword [ebp - 0x1c0], 0xffffffff
mov dword [ebp - 0x2344], 0xba6b42be
mov dword [ebp - 0x1238], 1
mov dword [ebp - 0x124], 0
jmp 0x401e52
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jge 0x401e6e
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x308], 0xffffffff
jmp 0x401e45
mov dword [ebp - 0x124], 0
jmp 0x401e87
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 4
jge 0x401ea3
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x2594], 0x67120dd9
jmp 0x401e7a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x308], 0xfffffff0
jmp 0x401ed1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x308]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x308], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x308], 0xd
jne 0x402303
mov dword [ebp - 0x658], 0xeede0b40
mov dword [ebp - 0x6bc], 0x551fa4c8
mov dword [ebp - 0x950], 0x5bb08661
mov dword [ebp - 0x1258], 0
mov dword [ebp - 0x490], 0
jmp 0x401f26
mov eax, dword [ebp - 0x490]
inc eax
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 3
jge 0x401f42
mov eax, dword [ebp - 0x490]
mov dword [ebp + eax*4 - 0x2300], 0x84132d38
jmp 0x401f19
mov dword [ebp - 0x658], 0
jmp 0x401f5b
mov eax, dword [ebp - 0x658]
dec eax
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 0xffffffee
jl 0x4022fe
mov dword [ebp - 0x378], 0x3c891c55
mov dword [ebp - 0x21e8], 0x1c5a3d7f
mov dword [ebp - 0x498], 0
jmp 0x401f95
mov eax, dword [ebp - 0x498]
inc eax
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 4
jge 0x401fb1
mov eax, dword [ebp - 0x498]
mov dword [ebp + eax*4 - 0x249c], 0xffffffff
jmp 0x401f88
mov dword [ebp - 0x378], 0
jmp 0x401fca
mov eax, dword [ebp - 0x378]
dec eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0xffffffee
jg 0x4022f9
push 3
lea ecx, [ebp - 0x1db8]
call fcn.004147f5
mov dword [ebp - 0x24b4], 0x9b27fa3d
mov dword [ebp - 0x660], 0xffffffff
mov dword [ebp - 0x21f0], 0x717f4039
mov dword [ebp - 0x1b50], 0xc14ab653
mov dword [ebp - 0x1b58], 0x966ef3b0
push 2
lea ecx, [ebp - 0x1f54]
call fcn.004147f5
mov dword [ebp - 0x164], 0
jmp 0x40203c
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x40205e
push dword [ebp - 0x164]
lea ecx, [ebp - 0x1db8]
call fcn.004148e3
mov dword [eax], 0xfe23a266
jmp 0x40202f
mov dword [ebp - 0x164], 0
jmp 0x402077
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jge 0x402096
push dword [ebp - 0x164]
lea ecx, [ebp - 0x1f54]
call fcn.004148e3
or dword [eax], 0xffffffff
jmp 0x40206a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x308]
mov dword [ebp - 0x2354], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x249c]
mov dword [ebp - 0x21f8], eax
mov eax, dword [ebp - 0x1258]
mov dword [ebp - 0x2444], eax
mov eax, dword [ebp - 0x1b50]
mov dword [ebp - 0x1b58], eax
imul eax, dword [ebp - 0x950], 0xffff
mov dword [ebp - 0x1238], eax
mov eax, dword [ebp - 0x1238]
mov dword [ebp - 0x928], eax
push 1
lea ecx, [ebp - 0x1f54]
call fcn.004148e3
mov ecx, dword [ebp - 0x928]
mov dword [eax], ecx
cmp dword [ebp - 0x928], 5
jg 0x40211a
mov dword [ebp - 0x1240], 1
jmp 0x402121
and dword [ebp - 0x1240], 0
push 0
lea ecx, [ebp - 0x1db8]
call fcn.004148e3
mov ecx, dword [ebp - 0x1240]
cmp ecx, dword [eax]
jl 0x402144
mov dword [ebp - 0x930], 1
jmp 0x40214b
and dword [ebp - 0x930], 0
cmp dword [ebp - 0x930], 1
jl 0x402160
mov dword [ebp - 0x1248], 1
jmp 0x402167
and dword [ebp - 0x1248], 0
cmp dword [ebp - 0x1248], 0x70c1
jl 0x40217f
mov dword [ebp - 0x938], 1
jmp 0x402186
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x378]
cmp dword [ebp - 0x6bc], eax
jge 0x4021bb
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x249c], 0
je 0x4021bb
mov dword [ebp - 0x1250], 1
jmp 0x4021c2
and dword [ebp - 0x1250], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2300]
inc eax
mov dword [ebp - 0x940], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x940]
mov dword [ebp + eax - 0x2300], ecx
mov eax, dword [ebp - 0x1250]
add eax, 0x4559
cmp dword [ebp - 0x940], eax
je 0x402208
mov dword [ebp - 0x948], 1
jmp 0x40220f
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x1258]
cmp dword [ebp - 0x948], eax
jne 0x402229
mov dword [ebp - 0x1260], 1
jmp 0x402230
and dword [ebp - 0x1260], 0
push 2
lea ecx, [ebp - 0x1db8]
call fcn.004148e3
mov eax, dword [eax]
imul eax, dword [ebp - 0x1260]
add eax, dword [ebp - 0x950]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x308]
cmp eax, 0x6377f0a0
jne 0x40226d
mov dword [ebp - 0x1268], 1
jmp 0x402274
and dword [ebp - 0x1268], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x249c]
cmp dword [ebp - 0x1268], eax
jne 0x402295
mov dword [ebp - 0x958], 1
jmp 0x40229c
and dword [ebp - 0x958], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x958]
mov dword [ebp + eax - 0x2594], ecx
mov dword [ebp - 0x660], 0
jmp 0x4022c8
mov eax, dword [ebp - 0x660]
dec eax
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x660], 0xfffffff5
jl 0x4022de
cmp dword [ebp - 0x6bc], 0
je 0x4022dc
jmp 0x4022de
jmp 0x4022bb
lea ecx, [ebp - 0x1f54]
call fcn.004148c7
lea ecx, [ebp - 0x1db8]
call fcn.004148c7
jmp 0x401fbd
jmp 0x401f4e
jmp 0x401eb6
mov dword [ebp - 0x1c5c], 1
mov dword [ebp - 0x2200], 0
mov byte [ebp - 0x281], 0
movzx eax, byte [ebp - 0x281]
test eax, eax
je 0x402351
push 0x19a6
push 0x23b4
push 0x1141
push 0x1069
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
mov byte [ebp - 0x267], 0
movzx eax, byte [ebp - 0x267]
test eax, eax
je 0x40236b
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov dword [ebp - 0x668], 0xfffffffc
mov dword [ebp - 0x1b60], 0xfa72c25
mov dword [ebp - 0x2364], 0x2e1dfe00
mov dword [ebp - 0x1270], 1
mov dword [ebp - 0x4a0], 0
jmp 0x4023ac
mov eax, dword [ebp - 0x4a0]
inc eax
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 2
jge 0x4023c8
mov eax, dword [ebp - 0x4a0]
mov dword [ebp + eax*4 - 0x253c], 0x6af1124f
jmp 0x40239f
mov dword [ebp - 0x668], 1
jmp 0x4023e1
mov eax, dword [ebp - 0x668]
dec eax
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 0
jl 0x402436
mov dword [ebp - 0x203c], 8
mov dword [ebp - 0x2044], 0x91e29ea4
mov dword [ebp - 0x204c], 1
mov dword [ebp - 0x2054], 0xffffffff
mov dword [ebp - 0x205c], 0x26c312fb
mov eax, dword [ebp - 0x1270]
dec eax
mov dword [ebp - 0x1270], eax
cmp dword [ebp - 0x1b60], 0
je 0x402434
jmp 0x4023d4
jmp 0x4023d4
mov dword [ebp - 0x4a8], 0
jmp 0x40244f
mov eax, dword [ebp - 0x4a8]
inc eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 4
jge 0x402471
push dword [ebp - 0x4a8]
lea ecx, [ebp - 0x44c]
call fcn.004148e3
mov dword [eax], 0xcde9e843
jmp 0x402442
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
je 0x402491
xor eax, eax
inc eax
je 0x402491
mov dword [ebp - 0x960], 1
jmp 0x402498
and dword [ebp - 0x960], 0
cmp dword [ebp - 0x960], 0x3e86f8c7
jne 0x4024b0
mov dword [ebp - 0x1278], 1
jmp 0x4024b7
and dword [ebp - 0x1278], 0
mov eax, dword [ebp - 0x1278]
inc eax
je 0x4024d5
cmp dword [ebp - 0x2d8], 0
je 0x4024d5
mov dword [ebp - 0x968], 1
jmp 0x4024dc
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0xdc], 0xffffffff
mov dword [ebp - 0x670], 0
jmp 0x402511
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 3
jge 0x40252d
mov eax, dword [ebp - 0x670]
mov dword [ebp + eax*4 - 0x1bb8], 0
jmp 0x402504
mov dword [ebp - 0xdc], 2
jmp 0x402546
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jl 0x40276a
mov dword [ebp - 0x3e8], 0xed23b618
mov dword [ebp - 0x4b0], 0
jmp 0x402576
mov eax, dword [ebp - 0x4b0]
inc eax
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 1
jge 0x402592
mov eax, dword [ebp - 0x4b0]
mov dword [ebp + eax*4 - 0x1b70], 0xfffffffb
jmp 0x402569
mov dword [ebp - 0x3e8], 2
jmp 0x4025ab
mov eax, dword [ebp - 0x3e8]
dec eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 0
jl 0x402765
push 2
lea ecx, [ebp - 0x2008]
call fcn.004147f5
mov dword [ebp - 0x678], 0
jmp 0x4025de
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], 2
jge 0x402600
push dword [ebp - 0x678]
lea ecx, [ebp - 0x2008]
call fcn.004148e3
mov dword [eax], 0x79d44f4c
jmp 0x4025d1
mov byte [ebp - 0x279], 0
movzx eax, byte [ebp - 0x279]
test eax, eax
je 0x402628
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
cmp dword [ebp - 0xdc], 0xacd4
jg 0x402640
mov dword [ebp - 0x1280], 1
jmp 0x402647
and dword [ebp - 0x1280], 0
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp + eax*4 - 0x1bb8]
mov dword [ebp - 0x2064], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1bb8], 0x5261fc42
je 0x402678
mov dword [ebp - 0x970], 1
jmp 0x40267f
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x1280]
cmp eax, dword [ebp - 0x970]
je 0x402699
mov dword [ebp - 0x1288], 1
jmp 0x4026a0
and dword [ebp - 0x1288], 0
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x1288]
sub ecx, dword [ebp + eax*4 - 0x1bb8]
cmp ecx, 0x1c77dcda
jg 0x4026c7
mov dword [ebp - 0x1b68], 1
jmp 0x4026ce
and dword [ebp - 0x1b68], 0
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp + eax*4 - 0x1bb8]
mov dword [ebp - 0x206c], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1b70], 0xffff
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp + eax*4 - 0x1bb8]
sub eax, dword [ebp - 0xdc]
cmp eax, 0xffff
jge 0x402718
mov dword [ebp - 0x978], 1
jmp 0x40271f
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x3e8]
cmp dword [ebp - 0x978], eax
jg 0x402739
mov dword [ebp - 0x1290], 1
jmp 0x402740
and dword [ebp - 0x1290], 0
push 0
lea ecx, [ebp - 0x2008]
call fcn.004148e3
mov ecx, dword [ebp - 0x1290]
mov dword [eax], ecx
lea ecx, [ebp - 0x2008]
call fcn.004148c7
jmp 0x40259e
jmp 0x402539
mov dword [ebp - 0x30], 0
jmp 0x40277a
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x4071d3
mov dword [ebp - 0x12c], 0x56a3367f
push 1
lea ecx, [ebp - 0x888]
call fcn.004147f5
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x1b80], 0x3a60813c
mov dword [ebp - 0x4b8], 0
jmp 0x4027c8
mov eax, dword [ebp - 0x4b8]
inc eax
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 1
jge 0x4027e7
push dword [ebp - 0x4b8]
lea ecx, [ebp - 0x888]
call fcn.004148e3
and dword [eax], 0
jmp 0x4027bb
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x2074], eax
cmp dword [ebp - 0x12c], 0
jne 0x40280a
xor eax, eax
inc eax
jne 0x40280a
and dword [ebp - 0x980], 0
jmp 0x402814
mov dword [ebp - 0x980], 1
cmp dword [ebp - 0x980], 1
ja 0x402829
mov dword [ebp - 0x1298], 1
jmp 0x402830
and dword [ebp - 0x1298], 0
mov esi, dword [ebp - 0x12c]
imul eax, dword [ebp - 0x1298], 5
xor ecx, ecx
sub ecx, eax
add esi, ecx
push 0
lea ecx, [ebp - 0x888]
call fcn.004148e3
cmp esi, dword [eax]
jl 0x402860
mov dword [ebp - 0x1b78], 1
jmp 0x402867
and dword [ebp - 0x1b78], 0
push 0
lea ecx, [ebp - 0x888]
call fcn.004148e3
push 0
lea ecx, [ebp - 0x888]
call fcn.004148e3
push 0
lea ecx, [ebp - 0x888]
call fcn.004148e3
mov esi, eax
push 0
lea ecx, [ebp - 0x888]
call fcn.004148e3
mov ecx, dword [esi]
imul ecx, dword [eax]
mov dword [ebp - 0x988], ecx
push 0
lea ecx, [ebp - 0x888]
call fcn.004148e3
mov ecx, dword [ebp - 0x988]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x988], eax
jne 0x4028d7
mov dword [ebp - 0x12a0], 1
jmp 0x4028de
and dword [ebp - 0x12a0], 0
mov eax, dword [ebp - 0x12c]
imul eax, dword [ebp - 0x12a0]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x8c], eax
jge 0x40290b
mov dword [ebp - 0x990], 1
jmp 0x402912
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x990], eax
jge 0x40292c
mov dword [ebp - 0x12a8], 1
jmp 0x402933
and dword [ebp - 0x12a8], 0
mov eax, dword [ebp - 0x12a8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x1b80], eax
push 0
lea ecx, [ebp - 0x888]
call fcn.004148e3
mov dword [eax], 1
cmp dword [ebp - 0x8c], 1
jle 0x4029df
mov dword [ebp - 0x8c], 0
jmp 0x402980
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x4029ab
mov byte [ebp - 0x269], 0
movzx eax, byte [ebp - 0x269]
test eax, eax
je 0x4029a9
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x402973
mov byte [ebp - 0x289], 0
movzx eax, byte [ebp - 0x289]
test eax, eax
je 0x4029dd
push 0
push 0xbce
push 0xf7a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x402a1b
mov dword [ebp - 0x8c], 0
jmp 0x4029f8
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jg 0x402a1b
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x888]
call fcn.004148e3
cmp dword [eax], 0
je 0x402a19
jmp 0x402a1b
jmp 0x4029eb
lea ecx, [ebp - 0x888]
call fcn.004148c7
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x1930], 0x503ecef3
mov dword [ebp - 0x850], 0x5425a80e
mov dword [ebp - 0x380], 0xfffffffd
mov dword [ebp - 0x12b0], 0xfffffffa
mov dword [ebp - 0x12c0], 0xf746e33a
mov dword [ebp - 0x1b88], 1
mov dword [ebp - 0x207c], 0x413f
mov dword [ebp - 0x2084], 0xc0e07525
mov dword [ebp - 0x208c], 0xe9829cbc
mov dword [ebp - 0x2094], 0xfffffff9
mov dword [ebp - 0x209c], 0x5761ac7e
mov dword [ebp - 0x20a4], 4
mov dword [ebp - 0x20ac], 0x3e3585ca
mov dword [ebp - 0x20b4], 0x8951fe51
mov dword [ebp - 0x20bc], 0xcc86f803
mov dword [ebp - 0x20c4], 0xfffffffa
mov dword [ebp - 0x20cc], 0xffffffff
mov dword [ebp - 0x20d4], 3
mov dword [ebp - 0x20dc], 0xe65dd4d1
mov dword [ebp - 0x20e4], 0x8adc705b
mov dword [ebp - 0x20ec], 0xb4584502
mov dword [ebp - 0x12d8], 0xfffffff8
mov dword [ebp - 0x680], 0
jmp 0x402b22
mov eax, dword [ebp - 0x680]
inc eax
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 2
jge 0x402b3e
mov eax, dword [ebp - 0x680]
mov dword [ebp + eax*4 - 0x257c], 0xf61949f
jmp 0x402b15
push 3
pop eax
test eax, eax
je 0x402c5a
mov eax, dword [ebp - 0x850]
dec eax
dec eax
jne 0x402c36
cmp dword [ebp - 0x850], 0xfffffffb
ja 0x402b6c
mov dword [ebp - 0x998], 1
jmp 0x402b73
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0x12b0], eax
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x12b0], eax
jge 0x402b99
mov dword [ebp - 0x9a0], 1
jmp 0x402ba0
and dword [ebp - 0x9a0], 0
cmp dword [ebp - 0x9a0], 0xa00d
jne 0x402bb8
mov dword [ebp - 0x12b8], 1
jmp 0x402bbf
and dword [ebp - 0x12b8], 0
imul eax, dword [ebp - 0x12b8], 0xd5f8
test eax, eax
jne 0x402bdf
mov eax, 0x82c4475e
test eax, eax
jne 0x402bdf
and dword [ebp - 0x9a8], 0
jmp 0x402be9
mov dword [ebp - 0x9a8], 1
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x12c0], eax
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x12c0], eax
je 0x402c0f
mov dword [ebp - 0x9b0], 1
jmp 0x402c16
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x380]
cmp eax, dword [ebp - 0x9b0]
jle 0x402c36
cmp dword [ebp - 0x380], 0
jne 0x402c36
and dword [ebp - 0x12c8], 0
jmp 0x402c40
mov dword [ebp - 0x12c8], 1
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x12c8], eax
je 0x402c5a
mov dword [ebp - 0x9b8], 1
jmp 0x402c61
and dword [ebp - 0x9b8], 0
cmp dword [ebp - 0x9b8], 0x7a14
jg 0x402c79
mov dword [ebp - 0x12d0], 1
jmp 0x402c80
and dword [ebp - 0x12d0], 0
mov eax, dword [ebp - 0x850]
cmp dword [ebp - 0x12d0], eax
je 0x402c9a
mov dword [ebp - 0x9c0], 1
jmp 0x402ca1
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0x1b88], eax
mov eax, dword [ebp - 0x12d8]
inc eax
mov dword [ebp - 0x12d8], eax
mov dword [ebp - 0x7a8], 0x67f5ed9a
mov dword [ebp - 0x338], 0x3aaf
mov dword [ebp - 0x2b0], 0xdfc9b996
push 1
lea ecx, [ebp - 0x1dd0]
call fcn.004147f5
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x6c8], 0x67a7
mov dword [ebp - 0x404], 0xeb6652f0
mov dword [ebp - 0xa00], 0xc2c6f73
mov dword [ebp - 0x1ea4], 1
mov dword [ebp - 0x1ea0], 1
mov dword [ebp - 0x1e9c], 1
mov dword [ebp - 0x1e98], 1
lea ecx, [ebp - 0x861]
call fcn.004148f2
push eax
lea eax, [ebp - 0x1e94]
push eax
lea eax, [ebp - 0x1ea4]
push eax
lea ecx, [ebp - 0x25dc]
call fcn.004148f5
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2310]
call fcn.004148a1
mov dword [ebp - 0x1cd0], 3
mov dword [ebp - 0x50], 0
jmp 0x402d81
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x402d94
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x4c], 0x80fc3a06
jmp 0x402d7a
mov dword [ebp - 0x50], 0
jmp 0x402da4
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x402dc0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x1dd0]
call fcn.004148e3
mov dword [eax], 0xfff9
jmp 0x402d9d
mov dword [ebp - 0x50], 0
jmp 0x402dd0
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x402de6
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x1ca4], 9
jmp 0x402dc9
push 0
lea ecx, [ebp - 0x1dd0]
call fcn.004148e3
mov dword [ebp - 0x9c8], eax
mov eax, dword [ebp - 0x9c8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9c8]
mov dword [ecx], eax
cmp dword [ebp - 0x68], 0
jne 0x402e1c
mov dword [ebp - 0x12e0], 1
jmp 0x402e23
and dword [ebp - 0x12e0], 0
mov eax, dword [ebp - 0x7a8]
imul eax, dword [ebp - 0x12e0]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x4c]
je 0x402e51
cmp dword [ebp - 0x6c8], 0
je 0x402e51
mov dword [ebp - 0x9d0], 1
jmp 0x402e58
and dword [ebp - 0x9d0], 0
mov eax, 0x14ad
sub eax, dword [ebp - 0x9d0]
cmp eax, 0x26b5cfda
jl 0x402e7c
cmp dword [ebp - 0x338], 0
jne 0x402e7c
and dword [ebp - 0x1b90], 0
jmp 0x402e86
mov dword [ebp - 0x1b90], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c]
mov dword [ebp - 0x12e8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x12e8]
mov dword [ebp + eax - 0x4c], ecx
mov eax, dword [ebp - 0x7a8]
cmp eax, dword [ebp - 0x12e8]
jl 0x402ec0
mov dword [ebp - 0x9d8], 1
jmp 0x402ec7
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x9d8], eax
je 0x402ee1
mov dword [ebp - 0x12f0], 1
jmp 0x402ee8
and dword [ebp - 0x12f0], 0
mov eax, dword [ebp - 0x7a8]
add eax, dword [ebp - 0x12f0]
cmp eax, 0x2167fa5c
jle 0x402f07
mov dword [ebp - 0x9e0], 1
jmp 0x402f0e
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x9e0]
neg eax
cmp eax, dword [ebp - 0x6c8]
jl 0x402f2a
mov dword [ebp - 0x12f8], 1
jmp 0x402f31
and dword [ebp - 0x12f8], 0
mov eax, dword [ebp - 0x12f8]
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x404], 0xffffffe5
jmp 0x402f56
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0xfffffff9
jle 0x40364d
mov dword [ebp - 0x2b8], 0xb8a5
mov dword [ebp - 0x83c], 0x609e5b73
mov dword [ebp - 0x2b0], 0
jmp 0x402f90
mov eax, dword [ebp - 0x2b0]
dec eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0xffffffe5
jl 0x40362b
mov dword [ebp - 0x4c0], 0xd1456014
mov dword [ebp - 0x6d0], 0x6696b495
mov dword [ebp - 0x68], 0
jmp 0x402fc1
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jg 0x403612
mov dword [ebp - 0x104], 0x9132e882
mov dword [ebp - 0x310], 0x79b1000b
mov dword [ebp - 0x338], 0
jmp 0x402ff8
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0
jg 0x40355a
mov dword [ebp - 0xa50], 7
mov eax, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0x4c], 0
jne 0x403107
mov dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x4c0], eax
jle 0x40303a
or eax, 0xffffffff
jne 0x403050
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c], 0
jne 0x403050
and dword [ebp - 0x9e8], 0
jmp 0x40305a
mov dword [ebp - 0x9e8], 1
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x9e8], eax
jne 0x403074
mov dword [ebp - 0x1300], 1
jmp 0x40307b
and dword [ebp - 0x1300], 0
mov eax, dword [ebp - 0x6d0]
cmp dword [ebp - 0x1300], eax
jg 0x403095
mov dword [ebp - 0x1b98], 1
jmp 0x40309c
and dword [ebp - 0x1b98], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x4c]
mov dword [ebp - 0x20f4], eax
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x4030c6
mov eax, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0x4c], 0
je 0x4030c6
mov dword [ebp - 0x9f0], 1
jmp 0x4030cd
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0xa00]
cmp eax, dword [ebp - 0x9f0]
jne 0x4030e7
mov dword [ebp - 0x1ba0], 1
jmp 0x4030ee
and dword [ebp - 0x1ba0], 0
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x20fc], eax
xor eax, eax
jne 0x403107
and dword [ebp - 0x1308], 0
jmp 0x403111
mov dword [ebp - 0x1308], 1
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x1308], eax
jl 0x40312b
mov dword [ebp - 0x9f8], 1
jmp 0x403132
and dword [ebp - 0x9f8], 0
cmp dword [ebp - 0x9f8], 0x1a93
jl 0x40314a
mov dword [ebp - 0x1ba8], 1
jmp 0x403151
and dword [ebp - 0x1ba8], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x2104], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x104]
cmp dword [ebp + eax*4 - 0x4c], ecx
je 0x403178
mov dword [ebp - 0x1310], 1
jmp 0x40317f
and dword [ebp - 0x1310], 0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x1310]
mov dword [ebp + eax*4 - 0x4c], ecx
cmp dword [ebp - 0x2b8], 0
je 0x4031a8
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4c], 0
jmp 0x403555
mov dword [ebp - 0x388], 4
mov eax, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0x4c], 0
jne 0x4031ce
cmp dword [ebp - 0x2b8], 0
jne 0x4031ce
and dword [ebp - 0x1318], 0
jmp 0x4031d8
mov dword [ebp - 0x1318], 1
mov eax, 0xf61094
sub eax, dword [ebp - 0xa00]
cmp dword [ebp - 0x1318], eax
jg 0x4031f9
xor eax, eax
inc eax
jne 0x4031f9
and dword [ebp - 0xa08], 0
jmp 0x403203
mov dword [ebp - 0xa08], 1
cmp dword [ebp - 0xa08], 0xfbd2
jge 0x40321b
mov dword [ebp - 0x1320], 1
jmp 0x403222
and dword [ebp - 0x1320], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x4c]
cmp eax, dword [ebp - 0x1320]
jge 0x40323d
mov dword [ebp - 0xa10], 1
jmp 0x403244
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0xa10], eax
jl 0x40326c
xor eax, eax
inc eax
je 0x40326c
cmp dword [ebp - 0x388], 0
je 0x40326c
mov dword [ebp - 0x1328], 1
jmp 0x403273
and dword [ebp - 0x1328], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x1328], eax
je 0x403294
push 7
pop eax
test eax, eax
je 0x403294
mov dword [ebp - 0xa18], 1
jmp 0x40329b
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0xa18], eax
jl 0x4032b5
mov dword [ebp - 0x1330], 1
jmp 0x4032bc
and dword [ebp - 0x1330], 0
mov eax, dword [ebp - 0x4c0]
cmp dword [ebp - 0x1330], eax
jg 0x4032d6
mov dword [ebp - 0xa20], 1
jmp 0x4032dd
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
cmp eax, dword [ebp - 0xa20]
jl 0x403303
mov dword [ebp - 0x1340], 1
jmp 0x40330a
and dword [ebp - 0x1340], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x1340], eax
jg 0x403324
mov dword [ebp - 0xa28], 1
jmp 0x40332b
and dword [ebp - 0xa28], 0
cmp dword [ebp - 0xa28], 0
jae 0x403340
mov dword [ebp - 0x1348], 1
jmp 0x403347
and dword [ebp - 0x1348], 0
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x1348], eax
jg 0x403361
mov dword [ebp - 0xa30], 1
jmp 0x403368
and dword [ebp - 0xa30], 0
imul eax, dword [ebp - 0xa30], 0xffffffff
test eax, eax
je 0x403388
cmp dword [ebp - 0x2b8], 0
je 0x403388
mov dword [ebp - 0x1350], 1
jmp 0x40338f
and dword [ebp - 0x1350], 0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x1350]
mov dword [ebp + eax*4 - 0x4c], ecx
cmp dword [ebp - 0x2b8], 0
jne 0x4033d3
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0xa38], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa38]
mov dword [ebp + eax - 0x4c], ecx
cmp dword [ebp - 0xa38], 0
jne 0x4033d3
and dword [ebp - 0xa58], 0
jmp 0x4033dd
mov dword [ebp - 0xa58], 1
mov eax, dword [ebp - 0x338]
add eax, 0x2f6e
cmp eax, dword [ebp - 0x6d0]
jl 0x4033fc
mov dword [ebp - 0x1358], 1
jmp 0x403403
and dword [ebp - 0x1358], 0
imul eax, dword [ebp - 0x1358], 0xac9e
test eax, eax
jne 0x403423
cmp dword [ebp - 0x4c0], 0
jne 0x403423
and dword [ebp - 0xa40], 0
jmp 0x40342d
mov dword [ebp - 0xa40], 1
mov eax, dword [ebp - 0xa40]
sub eax, dword [ebp - 0x104]
inc eax
inc eax
je 0x403452
cmp dword [ebp - 0xa50], 0
je 0x403452
mov dword [ebp - 0x1360], 1
jmp 0x403459
and dword [ebp - 0x1360], 0
push 1
lea ecx, [ebp - 0x2310]
call fcn.004148e3
mov ecx, dword [ebp - 0x1360]
cmp ecx, dword [eax]
je 0x40347c
mov dword [ebp - 0xa48], 1
jmp 0x403483
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0xa48], eax
jle 0x40349d
mov dword [ebp - 0x1368], 1
jmp 0x4034a4
and dword [ebp - 0x1368], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1368], eax
je 0x4034bb
mov dword [ebp - 0x1370], 1
jmp 0x4034c2
and dword [ebp - 0x1370], 0
mov eax, dword [ebp - 0xa50]
imul eax, dword [ebp - 0x1370]
test eax, eax
jne 0x4034e5
cmp dword [ebp - 0x2b8], 0
jne 0x4034e5
and dword [ebp - 0x1378], 0
jmp 0x4034ef
mov dword [ebp - 0x1378], 1
mov eax, dword [ebp - 0xa58]
cmp eax, dword [ebp - 0x1378]
jge 0x403509
mov dword [ebp - 0xa60], 1
jmp 0x403510
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x388]
sub eax, dword [ebp - 0xa60]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x83c]
imul eax, dword [ebp - 0x388]
cmp eax, 0x717e41ab
jl 0x403542
mov dword [ebp - 0x1380], 1
jmp 0x403549
and dword [ebp - 0x1380], 0
mov eax, dword [ebp - 0x1380]
mov dword [ebp - 0x310], eax
jmp 0x402feb
mov eax, 0x82ffb082
test eax, eax
je 0x4035f3
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xa68], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa68]
mov dword [ebp + eax - 0x4c], ecx
cmp dword [ebp - 0xa68], 0
je 0x4035c6
mov eax, dword [ebp - 0x6c8]
cmp dword [ebp - 0x83c], eax
jle 0x4035a6
mov dword [ebp - 0x1388], 1
jmp 0x4035ad
and dword [ebp - 0x1388], 0
mov eax, dword [ebp - 0x1388]
add eax, 0xc533
je 0x4035c6
mov dword [ebp - 0xa70], 1
jmp 0x4035cd
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0xa70]
mov dword [ebp - 0x6d0], eax
mov eax, dword [ebp - 0x1cd0]
add eax, dword [ebp - 0x310]
je 0x4035f3
mov dword [ebp - 0x1390], 1
jmp 0x4035fa
and dword [ebp - 0x1390], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1390]
mov dword [ebp + eax - 0x1ca4], ecx
jmp 0x402fba
push 0
lea ecx, [ebp - 0x1dd0]
call fcn.004148e3
cmp dword [eax], 0
je 0x403626
jmp 0x40362b
jmp 0x402f83
mov byte [ebp - 0x26b], 0
movzx eax, byte [ebp - 0x26b]
test eax, eax
je 0x403648
push 0x250c
call dword [sym.imp.USER32.dll_GetQueueStatus]
jmp 0x402f49
lea ecx, [ebp - 0x2310]
call fcn.004148c7
lea ecx, [ebp - 0x1dd0]
call fcn.004148c7
push dword [ebp - 0x30]
lea ecx, [ebp - 0x44c]
call fcn.004148e3
cmp dword [eax], 0
je 0x403695
push dword [ebp - 0x30]
lea ecx, [ebp - 0x44c]
call fcn.004148e3
cmp dword [eax], 0
je 0x403695
mov dword [ebp - 0xa78], 1
jmp 0x40369c
and dword [ebp - 0xa78], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x44c]
call fcn.004148e3
mov ecx, dword [ebp - 0xa78]
cmp ecx, dword [eax]
jge 0x4036c0
mov dword [ebp - 0x1398], 1
jmp 0x4036c7
and dword [ebp - 0x1398], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x44c]
call fcn.004148e3
mov ecx, dword [ebp - 0x1398]
add ecx, dword [eax]
jne 0x4036eb
mov dword [ebp - 0xa80], 1
jmp 0x4036f2
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0x40], eax
mov esi, dword [ebp - 0x40]
push 3
lea ecx, [ebp - 0x44c]
call fcn.004148e3
cmp esi, dword [eax]
jle 0x40371b
mov dword [ebp - 0x19bc], 1
jmp 0x403722
and dword [ebp - 0x19bc], 0
mov dword [ebp - 0x88], 8
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x210c], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x2114], eax
push 0
lea ecx, [ebp - 0x44c]
call fcn.004148e3
push 2
pop eax
test eax, eax
je 0x40376d
cmp dword [ebp - 0x88], 0
je 0x40376d
mov dword [ebp - 0x13a0], 1
jmp 0x403774
and dword [ebp - 0x13a0], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x44c]
call fcn.004148e3
mov ecx, dword [ebp - 0x13a0]
cmp ecx, dword [eax]
jge 0x403798
mov dword [ebp - 0xa88], 1
jmp 0x40379f
and dword [ebp - 0xa88], 0
cmp dword [ebp - 0xa88], 0
jl 0x4037b4
mov dword [ebp - 0x13a8], 1
jmp 0x4037bb
and dword [ebp - 0x13a8], 0
push 3
lea ecx, [ebp - 0x44c]
call fcn.004148e3
mov ecx, dword [ebp - 0x13a8]
cmp ecx, dword [eax]
jg 0x4037de
mov dword [ebp - 0x1890], 1
jmp 0x4037e5
and dword [ebp - 0x1890], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x44c]
call fcn.004148e3
mov eax, dword [eax]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x197cbb40
jne 0x403813
mov dword [ebp - 0xa90], 1
jmp 0x40381a
and dword [ebp - 0xa90], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x44c]
call fcn.004148e3
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa90]
jne 0x40383e
mov dword [ebp - 0x13b0], 1
jmp 0x403845
and dword [ebp - 0x13b0], 0
mov eax, dword [ebp - 0x13b0]
sub eax, 0xa
je 0x405314
push 2
lea ecx, [ebp - 0x1e00]
call fcn.004147f5
mov dword [ebp - 0x688], 0
jmp 0x40387a
mov eax, dword [ebp - 0x688]
inc eax
mov dword [ebp - 0x688], eax
cmp dword [ebp - 0x688], 3
jge 0x403896
mov eax, dword [ebp - 0x688]
mov dword [ebp + eax*4 - 0x183c], 1
jmp 0x40386d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x183c], 0xfffffff4
jmp 0x4038c4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x183c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x183c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x183c], 0x1a
je 0x403bcf
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0x4c8], 0
jmp 0x4038fb
mov eax, dword [ebp - 0x4c8]
inc eax
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 3
jge 0x403917
mov eax, dword [ebp - 0x4c8]
mov dword [ebp + eax*4 - 0x1bc8], 0x3eb905d0
jmp 0x4038ee
mov dword [ebp - 0xd4], 2
jmp 0x403930
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jl 0x403ba9
mov dword [ebp - 0x188], 0xd0d3f7bf
mov dword [ebp - 0x1b1c], 0xaa9dade6
mov byte [ebp - 0x27b], 0
movzx eax, byte [ebp - 0x27b]
test eax, eax
je 0x403979
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x188], 0
jmp 0x403992
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 2
jg 0x403ba4
mov dword [ebp - 0x7b0], 0xa8bc
mov dword [ebp - 0xaa0], 9
mov eax, dword [ebp - 0xd4]
cmp dword [ebp + eax*4 - 0x1bc8], 0
je 0x4039c8
jmp 0x403ba4
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0x1c3c], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x1898], eax
mov eax, dword [ebp - 0x7b0]
inc eax
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0x1c3c]
cmp eax, dword [ebp - 0x1898]
jne 0x403a07
mov dword [ebp - 0xaa8], 1
jmp 0x403a0e
and dword [ebp - 0xaa8], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x183c], 2
jl 0x403a2a
mov dword [ebp - 0xa98], 1
jmp 0x403a31
and dword [ebp - 0xa98], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x183c]
cmp dword [ebp - 0xa98], eax
je 0x403a52
mov dword [ebp - 0x13b8], 1
jmp 0x403a59
and dword [ebp - 0x13b8], 0
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp + eax*4 - 0x1bc8]
add eax, dword [ebp - 0x13b8]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0xaa0], eax
jg 0x403a92
cmp dword [ebp - 0x188], 0
jne 0x403a92
and dword [ebp - 0x13c0], 0
jmp 0x403a9c
mov dword [ebp - 0x13c0], 1
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp + eax*4 - 0x1bc8]
add eax, dword [ebp - 0x13c0]
cmp eax, 0xc89d73ae
jbe 0x403ac2
mov dword [ebp - 0x13c8], 1
jmp 0x403ac9
and dword [ebp - 0x13c8], 0
mov eax, dword [ebp - 0xaa8]
cmp eax, dword [ebp - 0x13c8]
je 0x403ae3
mov dword [ebp - 0xab0], 1
jmp 0x403aea
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x188]
mov eax, dword [ebp + eax*4 - 0x1bc8]
imul eax, dword [ebp - 0xab0]
test eax, eax
jne 0x403b1a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x183c], 0
jne 0x403b1a
and dword [ebp - 0x13d0], 0
jmp 0x403b24
mov dword [ebp - 0x13d0], 1
mov eax, dword [ebp - 0x1b1c]
cmp dword [ebp - 0x13d0], eax
jl 0x403b40
xor eax, eax
inc eax
jne 0x403b40
and dword [ebp - 0xab8], 0
jmp 0x403b4a
mov dword [ebp - 0xab8], 1
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0xab8], eax
jle 0x403b64
mov dword [ebp - 0x13d8], 1
jmp 0x403b6b
and dword [ebp - 0x13d8], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x13d8]
jl 0x403b85
mov dword [ebp - 0xac0], 1
jmp 0x403b8c
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xac0]
mov dword [ebp + eax*4 - 0x1bc8], ecx
jmp 0x403985
jmp 0x403923
mov byte [ebp - 0x26d], 0
movzx eax, byte [ebp - 0x26d]
test eax, eax
je 0x403bca
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x4038a9
mov dword [ebp - 0x690], 0
jmp 0x403be8
mov eax, dword [ebp - 0x690]
inc eax
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 2
jge 0x403c0a
push dword [ebp - 0x690]
lea ecx, [ebp - 0x1e00]
call fcn.004148e3
mov dword [eax], 0x8b9db5df
jmp 0x403bdb
mov dword [ebp - 0x40], 0
jmp 0x403c1a
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jne 0x40426d
mov dword [ebp - 0x1e18], 0x2d14
mov dword [ebp - 0x1e14], 0x2d14
mov dword [ebp - 0x1e10], 0x2d14
mov dword [ebp - 0x1e0c], 0x2d14
mov dword [ebp - 0x13f0], 0xd1e814b7
mov dword [ebp - 0x2c0], 2
mov dword [ebp - 0x6d8], 0xfdad
mov dword [ebp - 0x13e0], 0xd5d08818
mov dword [ebp - 0xad0], 0
mov dword [ebp - 0x4d0], 0
jmp 0x403c97
mov eax, dword [ebp - 0x4d0]
inc eax
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 2
jge 0x403cb3
mov eax, dword [ebp - 0x4d0]
mov dword [ebp + eax*4 - 0x1e08], 0x6eb6b9dd
jmp 0x403c8a
mov eax, dword [ebp - 0x6d8]
inc eax
mov dword [ebp - 0x6d8], eax
jne 0x403cd4
cmp dword [ebp - 0x2c0], 0
jne 0x403cd4
and dword [ebp - 0xad8], 0
jmp 0x403cde
mov dword [ebp - 0xad8], 1
cmp dword [ebp - 0x2c0], 0x21
jl 0x403cf3
mov dword [ebp - 0x820], 1
jmp 0x403cfa
and dword [ebp - 0x820], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x820]
mov dword [ebp + eax - 0x1e08], ecx
mov eax, dword [ebp - 0x13e0]
cmp dword [ebp - 0x820], eax
je 0x403d27
mov dword [ebp - 0x18a0], 1
jmp 0x403d2e
and dword [ebp - 0x18a0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1e18]
mov dword [ebp - 0x211c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e08]
cmp dword [ebp - 0x2c0], eax
jge 0x403d62
mov dword [ebp - 0xac8], 1
jmp 0x403d69
and dword [ebp - 0xac8], 0
mov eax, dword [ebp - 0x13e0]
cmp dword [ebp - 0xac8], eax
jg 0x403d83
mov dword [ebp - 0x13e8], 1
jmp 0x403d8a
and dword [ebp - 0x13e8], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x2124], eax
mov eax, dword [ebp - 0x13f0]
mov dword [ebp - 0x212c], eax
mov eax, dword [ebp - 0x13e8]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0x2134], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x213c], eax
cmp dword [ebp - 0x13f0], 0
je 0x403deb
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1e18], 0
je 0x403deb
mov dword [ebp - 0x13f8], 1
jmp 0x403df2
and dword [ebp - 0x13f8], 0
mov eax, dword [ebp - 0xad8]
add eax, dword [ebp - 0x13f8]
mov dword [ebp - 0x2c0], eax
mov byte [ebp - 0x283], 0
mov dword [ebp - 0x1c8], 0x60477862
mov dword [ebp - 0x3e4], 0x70ade216
push 1
lea ecx, [ebp - 0x1ef4]
call fcn.004147f5
mov dword [ebp - 0x698], 9
mov dword [ebp - 0xb00], 0xb7a2e255
push 4
lea ecx, [ebp - 0x1edc]
call fcn.004147f5
mov dword [ebp - 0xc], 0
jmp 0x403e5d
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x403e73
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2320], 0xfffffffe
jmp 0x403e56
mov dword [ebp - 0xc], 0
jmp 0x403e83
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x403e9f
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1ef4]
call fcn.004148e3
mov dword [eax], 0xe0184dcc
jmp 0x403e7c
mov dword [ebp - 0xc], 0
jmp 0x403eaf
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x403ec5
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x19c8], 0x299fa9ef
jmp 0x403ea8
mov dword [ebp - 0xc], 0
jmp 0x403ed5
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x403eeb
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x220c], 0xffffffff
jmp 0x403ece
mov dword [ebp - 0xc], 0
jmp 0x403efb
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x403f14
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1edc]
call fcn.004148e3
and dword [eax], 0
jmp 0x403ef4
mov dword [ebp - 0x1c8], 0xffffffe3
jmp 0x403f2d
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x1a
jg 0x403f57
mov eax, dword [ebp - 0x3e4]
dec eax
mov dword [ebp - 0x3e4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2320], 0
je 0x403f55
jmp 0x403f57
jmp 0x403f20
push 0
lea ecx, [ebp - 0x1ef4]
call fcn.004148e3
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x6e0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6e0]
mov dword [ecx], eax
mov eax, dword [ebp - 0x698]
imul ecx, dword [ebp - 0x3e4], 0xfffffff6
sub eax, ecx
mov ecx, dword [ebp - 0x6e0]
cmp dword [ecx], eax
je 0x403fa0
mov dword [ebp - 0x7b8], 1
jmp 0x403fa7
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x2144], eax
cmp dword [ebp - 0x698], 0x97867a7b
je 0x403fcb
mov dword [ebp - 0xae0], 1
jmp 0x403fd2
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0xae0]
sub eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1400], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1400]
mov dword [ebp + eax - 0x19c8], ecx
mov eax, dword [ebp - 0x1400]
inc eax
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x3e4]
cmp dword [ebp - 0x1c8], eax
jl 0x40401e
mov dword [ebp - 0xae8], 1
jmp 0x404025
and dword [ebp - 0xae8], 0
cmp dword [ebp - 0xae8], 0xe96bb645
je 0x40403d
mov dword [ebp - 0x1408], 1
jmp 0x404044
and dword [ebp - 0x1408], 0
mov eax, dword [ebp - 0x698]
cmp dword [ebp - 0x1408], eax
jle 0x40405e
mov dword [ebp - 0xaf0], 1
jmp 0x404065
and dword [ebp - 0xaf0], 0
cmp dword [ebp - 0xaf0], 9
jle 0x404083
cmp dword [ebp - 0x1c8], 0
je 0x404083
mov dword [ebp - 0x1410], 1
jmp 0x40408a
and dword [ebp - 0x1410], 0
mov eax, dword [ebp - 0x1410]
neg eax
jne 0x4040a2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x19c8], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x214c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x19c8], 0x245e3205
je 0x4040cd
mov dword [ebp - 0xaf8], 1
jmp 0x4040d4
and dword [ebp - 0xaf8], 0
cmp dword [ebp - 0xaf8], 0xffffffff
je 0x4040e9
mov dword [ebp - 0x1418], 1
jmp 0x4040f0
and dword [ebp - 0x1418], 0
mov eax, dword [ebp - 0x1418]
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0x1420], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1420]
mov dword [ebp + eax - 0x220c], ecx
cmp dword [ebp - 0x1420], 0
jne 0x404136
mov eax, 0x1f99
test eax, eax
jne 0x404136
and dword [ebp - 0xb08], 0
jmp 0x404140
mov dword [ebp - 0xb08], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7b8]
mov dword [ebp + eax - 0x2320], ecx
mov eax, dword [ebp - 0x7b8]
cmp eax, dword [ebp - 0xb08]
jl 0x40416d
mov dword [ebp - 0x1428], 1
jmp 0x404174
and dword [ebp - 0x1428], 0
push 0
lea ecx, [ebp - 0x1edc]
call fcn.004148e3
mov ecx, dword [ebp - 0x1428]
mov dword [eax], ecx
lea ecx, [ebp - 0x1edc]
call fcn.004148c7
lea ecx, [ebp - 0x1ef4]
call fcn.004148c7
movzx eax, byte [ebp - 0x283]
test eax, eax
je 0x404268
push 4
lea ecx, [ebp - 0x1de8]
call fcn.004147f5
mov dword [ebp - 0x350], 0xa18885c6
mov dword [ebp - 0x4d8], 0
jmp 0x4041de
mov eax, dword [ebp - 0x4d8]
inc eax
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 4
jge 0x404200
push dword [ebp - 0x4d8]
lea ecx, [ebp - 0x1de8]
call fcn.004148e3
mov dword [eax], 0xb3198a8f
jmp 0x4041d1
mov dword [ebp - 0x350], 0
jmp 0x404219
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 3
jg 0x40424c
push dword [ebp - 0x350]
lea ecx, [ebp - 0x1de8]
call fcn.004148e3
mov esi, eax
push dword [ebp - 0x350]
lea ecx, [ebp - 0x1de8]
call fcn.004148e3
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x40420c
lea ecx, [ebp - 0x1de8]
call fcn.004148c7
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
jmp 0x403c13
mov dword [ebp - 0x1c0], 0xffffffe4
jmp 0x404286
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x15
jne 0x405304
mov dword [ebp - 0x9c], 0xfffffff6
mov dword [ebp - 0x844], 4
mov dword [ebp - 0x4e0], 0xbc00eadd
mov dword [ebp - 0x6f0], 0xea90
mov dword [ebp - 0x1c4c], 0
mov dword [ebp - 0x9c], 0xffffffeb
jmp 0x4042de
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xffffffed
je 0x4044a3
mov dword [ebp - 0x390], 1
mov dword [ebp - 0x6e8], 8
mov dword [ebp - 0x1b24], 0xfffffffb
mov dword [ebp - 0x6a0], 0
jmp 0x404322
mov eax, dword [ebp - 0x6a0]
inc eax
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x6a0], 1
jge 0x40433e
mov eax, dword [ebp - 0x6a0]
mov dword [ebp + eax*4 - 0x1438], 0xffffffff
jmp 0x404315
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x390]
mov dword [ebp + eax - 0x1438], ecx
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x390], eax
jle 0x40436b
mov dword [ebp - 0x1ca8], 1
jmp 0x404372
and dword [ebp - 0x1ca8], 0
mov eax, 0x392f2092
sub eax, 0x6ff609d7
neg eax
cmp eax, dword [ebp - 0x390]
jl 0x404392
mov dword [ebp - 0xb10], 1
jmp 0x404399
and dword [ebp - 0xb10], 0
cmp dword [ebp - 0xb10], 0xe96f8f9e
je 0x4043b1
mov dword [ebp - 0x1430], 1
jmp 0x4043b8
and dword [ebp - 0x1430], 0
mov eax, dword [ebp - 0x6e8]
cmp dword [ebp - 0x1430], eax
jne 0x4043d8
mov eax, 0xffff
test eax, eax
jne 0x4043d8
and dword [ebp - 0xb18], 0
jmp 0x4043e2
mov dword [ebp - 0xb18], 1
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x2154], eax
cmp dword [ebp - 0x6e8], 6
ja 0x40440f
mov dword [ebp - 0x18a8], 1
jmp 0x404416
and dword [ebp - 0x18a8], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x215c], eax
mov eax, dword [ebp - 0x390]
cmp dword [ebp - 0x844], eax
jge 0x404442
cmp dword [ebp - 0x9c], 0
jne 0x404442
and dword [ebp - 0xb20], 0
jmp 0x40444c
mov dword [ebp - 0xb20], 1
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x1440], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1440]
mov dword [ebp + eax - 0x1438], ecx
mov eax, dword [ebp - 0x6e8]
add eax, dword [ebp - 0xb20]
cmp dword [ebp - 0x1440], eax
jge 0x40448b
mov dword [ebp - 0xb28], 1
jmp 0x404492
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0x1b24], eax
jmp 0x4042d1
mov dword [ebp - 0x9c], 0
jmp 0x4044bc
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xfffffffb
jg 0x404713
mov dword [ebp - 0x2c8], 0xd6cd5387
mov dword [ebp - 0x318], 0xe45a9172
mov dword [ebp - 0x424], 0xfffffff6
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x2164], eax
mov eax, dword [ebp - 0x6f0]
dec eax
mov dword [ebp - 0x6f0], eax
je 0x404544
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x424], eax
je 0x40451c
mov dword [ebp - 0x1448], 1
jmp 0x404523
and dword [ebp - 0x1448], 0
cmp dword [ebp - 0x1448], 0x71f8
jg 0x404544
cmp dword [ebp - 0x9c], 0
je 0x404544
mov dword [ebp - 0x18b0], 1
jmp 0x40454b
and dword [ebp - 0x18b0], 0
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [ebp - 0x9c]
imul ecx, dword [ebp - 0x424]
sub eax, ecx
cmp eax, dword [ebp - 0x424]
je 0x404574
mov dword [ebp - 0xb30], 1
jmp 0x40457b
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0xb30]
sub eax, dword [ebp - 0x2c8]
cmp eax, dword [ebp - 0x2c8]
jl 0x40459b
mov dword [ebp - 0x1450], 1
jmp 0x4045a2
and dword [ebp - 0x1450], 0
mov eax, dword [ebp - 0x424]
cmp dword [ebp - 0x1450], eax
jle 0x4045bc
mov dword [ebp - 0xb38], 1
jmp 0x4045c3
and dword [ebp - 0xb38], 0
mov dword [ebp - 0x4e0], 0x87b332e
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0xb38]
shl eax, 2
cmp dword [ebp - 0x318], eax
jne 0x4045f6
mov dword [ebp - 0x1458], 1
jmp 0x4045fd
and dword [ebp - 0x1458], 0
cmp dword [ebp - 0x1458], 0x99fd
je 0x404615
mov dword [ebp - 0xb40], 1
jmp 0x40461c
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0xb40], eax
jg 0x404636
mov dword [ebp - 0x1460], 1
jmp 0x40463d
and dword [ebp - 0x1460], 0
mov eax, dword [ebp - 0x2c8]
cmp eax, dword [ebp - 0x1460]
je 0x404657
mov dword [ebp - 0xb48], 1
jmp 0x40465e
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0xb48]
dec eax
cmp eax, dword [ebp - 0x424]
jle 0x404679
mov dword [ebp - 0x1468], 1
jmp 0x404680
and dword [ebp - 0x1468], 0
cmp dword [ebp - 0x1468], 0xc911b6be
jb 0x404698
mov dword [ebp - 0xb50], 1
jmp 0x40469f
and dword [ebp - 0xb50], 0
mov eax, dword [ebp - 0xb50]
neg eax
mov dword [ebp - 0x1c4c], eax
mov dword [ebp - 0x318], 0x11
jmp 0x4046c6
mov eax, dword [ebp - 0x318]
dec eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 4
jge 0x40470e
mov byte [ebp - 0x26f], 0
movzx eax, byte [ebp - 0x26f]
test eax, eax
je 0x4046eb
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov byte [ebp - 0x27d], 0
movzx eax, byte [ebp - 0x27d]
test eax, eax
je 0x40470c
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
jmp 0x4046b9
jmp 0x4044af
mov dword [ebp - 0x18d8], 0x53cf54ce
mov dword [ebp - 0x1520], 0
mov dword [ebp - 0x80], 0xfffffff9
mov dword [ebp - 0x1fc], 0xfffffff7
mov dword [ebp - 0x6a8], 0xffffffff
mov dword [ebp - 0x14c0], 1
mov dword [ebp - 0x80], 0xfffffff5
jmp 0x40475c
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jg 0x404af3
mov dword [ebp - 0x190], 0xfffffffe
mov dword [ebp - 0x398], 0x95196ee4
mov dword [ebp - 0x3ec], 0xfffffff7
cmp dword [ebp - 0x190], 0
jne 0x40479c
cmp dword [ebp - 0x80], 0
jne 0x40479c
and dword [ebp - 0xb58], 0
jmp 0x4047a6
mov dword [ebp - 0xb58], 1
cmp dword [ebp - 0x190], 0x4d63a88e
jg 0x4047be
mov dword [ebp - 0x1470], 1
jmp 0x4047c5
and dword [ebp - 0x1470], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x1470], eax
jl 0x4047df
mov dword [ebp - 0x1478], 1
jmp 0x4047e6
and dword [ebp - 0x1478], 0
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0x1478]
jl 0x40480c
mov dword [ebp - 0xb60], 1
jmp 0x404813
and dword [ebp - 0xb60], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0xb60], eax
jg 0x40482a
mov dword [ebp - 0x1480], 1
jmp 0x404831
and dword [ebp - 0x1480], 0
mov eax, dword [ebp - 0x1480]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
add eax, dword [ebp - 0x80]
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x216c], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x2174], eax
cmp dword [ebp - 0x398], 0xffffffff
je 0x404882
mov dword [ebp - 0xb68], 1
jmp 0x404889
and dword [ebp - 0xb68], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0xb68], eax
jg 0x4048a3
mov dword [ebp - 0x1488], 1
jmp 0x4048aa
and dword [ebp - 0x1488], 0
mov eax, dword [ebp - 0x3ec]
cmp eax, dword [ebp - 0x1488]
jle 0x4048c4
mov dword [ebp - 0xb70], 1
jmp 0x4048cb
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0x6a8]
cmp dword [ebp - 0xb70], eax
jl 0x4048ee
cmp dword [ebp - 0x3ec], 0
je 0x4048ee
mov dword [ebp - 0x1490], 1
jmp 0x4048f5
and dword [ebp - 0x1490], 0
cmp dword [ebp - 0x1490], 0x3e8f
jg 0x40490d
mov dword [ebp - 0xb78], 1
jmp 0x404914
and dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0x398]
cmp eax, dword [ebp - 0xb78]
jle 0x40492e
mov dword [ebp - 0x1498], 1
jmp 0x404935
and dword [ebp - 0x1498], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x1498], eax
jle 0x404953
xor eax, eax
je 0x404953
mov dword [ebp - 0xb80], 1
jmp 0x40495a
and dword [ebp - 0xb80], 0
cmp dword [ebp - 0xb80], 4
jl 0x40496f
mov dword [ebp - 0x14a0], 1
jmp 0x404976
and dword [ebp - 0x14a0], 0
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0x14a0], eax
jne 0x404990
mov dword [ebp - 0xb88], 1
jmp 0x404997
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0xb88]
jne 0x4049b1
mov dword [ebp - 0x14a8], 1
jmp 0x4049b8
and dword [ebp - 0x14a8], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x14a8], eax
jge 0x404ae2
mov dword [ebp - 0x18b8], 1
mov dword [ebp - 0x1fc], 0xffff
cmp dword [ebp - 0x1fc], 0
jne 0x4049f0
mov dword [ebp - 0xb90], 1
jmp 0x4049f7
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0xb90]
jle 0x404a0e
mov dword [ebp - 0x14b0], 1
jmp 0x404a15
and dword [ebp - 0x14b0], 0
cmp dword [ebp - 0x14b0], 1
jg 0x404a2a
mov dword [ebp - 0xb98], 1
jmp 0x404a31
and dword [ebp - 0xb98], 0
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x6a8], eax
jge 0x404a57
mov dword [ebp - 0xba8], 1
jmp 0x404a5e
and dword [ebp - 0xba8], 0
cmp dword [ebp - 0x190], 2
je 0x404a79
cmp dword [ebp - 0x80], 0
je 0x404a79
mov dword [ebp - 0x14b8], 1
jmp 0x404a80
and dword [ebp - 0x14b8], 0
mov eax, dword [ebp - 0x14b8]
sub eax, dword [ebp - 0x80]
cmp eax, 0xa7a2
jg 0x404a9c
mov dword [ebp - 0xba0], 1
jmp 0x404aa3
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 0xba0]
inc eax
mov dword [ebp - 0x14c0], eax
jne 0x404ac4
cmp dword [ebp - 0x18b8], 0
jne 0x404ac4
and dword [ebp - 0x14c8], 0
jmp 0x404ace
mov dword [ebp - 0x14c8], 1
mov eax, dword [ebp - 0xba8]
sub eax, dword [ebp - 0x14c8]
mov dword [ebp - 0x190], eax
jmp 0x404aee
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x3ec], eax
jmp 0x404755
mov dword [ebp - 0x88], 0x19
jmp 0x404b0c
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x1c
jg 0x4052ff
mov dword [ebp - 0x84], 0xfffffffb
mov dword [ebp - 0x78], 0x41b66baf
push 2
lea ecx, [ebp - 0x440]
call fcn.004147f5
mov dword [ebp - 0x4f4], 1
mov dword [ebp - 0x217c], 0x1d584d75
mov dword [ebp - 0x6b0], 0
jmp 0x404b64
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 2
jge 0x404b86
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x440]
call fcn.004148e3
mov dword [eax], 0x3b0a6d08
jmp 0x404b57
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x2184], eax
cmp dword [ebp - 0x78], 0
je 0x404c7e
cmp dword [ebp - 0x78], 0
jne 0x404bb4
cmp dword [ebp - 0x84], 0
jne 0x404bb4
and dword [ebp - 0xbb8], 0
jmp 0x404bbe
mov dword [ebp - 0xbb8], 1
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x84], eax
je 0x404bd5
mov dword [ebp - 0xbb0], 1
jmp 0x404bdc
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0xbb0]
sub eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x78]
jl 0x404bf9
mov dword [ebp - 0x14d0], 1
jmp 0x404c00
and dword [ebp - 0x14d0], 0
mov eax, dword [ebp - 0x14d0]
sub eax, 4
jne 0x404c1a
cmp dword [ebp - 0x78], 0
jne 0x404c1a
and dword [ebp - 0x14d8], 0
jmp 0x404c24
mov dword [ebp - 0x14d8], 1
mov eax, dword [ebp - 0xbb8]
cmp eax, dword [ebp - 0x14d8]
jne 0x404c3e
mov dword [ebp - 0xbc0], 1
jmp 0x404c45
and dword [ebp - 0xbc0], 0
cmp dword [ebp - 0xbc0], 0x889e
jl 0x404c5d
mov dword [ebp - 0x14e0], 1
jmp 0x404c64
and dword [ebp - 0x14e0], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x14e0], eax
jg 0x404c7e
mov dword [ebp - 0xbc8], 1
jmp 0x404c85
and dword [ebp - 0xbc8], 0
imul eax, dword [ebp - 0xbc8], 0xfffffff9
sub eax, 0x703c5764
cmp eax, dword [ebp - 0x78]
jg 0x404ca2
mov dword [ebp - 0x7c0], 1
jmp 0x404ca9
and dword [ebp - 0x7c0], 0
push 0
lea ecx, [ebp - 0x440]
call fcn.004148e3
mov ecx, dword [ebp - 0x7c0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x84], 0
je 0x404f07
mov dword [ebp - 0x18c0], 0x239f
mov dword [ebp - 0x84], 0
jmp 0x404cfa
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jg 0x404ee1
mov dword [ebp - 0x5d4], 0xf0adc109
mov dword [ebp - 0x1cb0], 0xa0f83931
mov dword [ebp - 0x78], 0
jmp 0x404d2b
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jg 0x404edc
push 2
lea ecx, [ebp - 0x1f0c]
call fcn.004147f5
mov dword [ebp - 0x4ec], 0
jmp 0x404d5b
mov eax, dword [ebp - 0x4ec]
inc eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 2
jge 0x404d7a
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x1f0c]
call fcn.004148e3
or dword [eax], 0xffffffff
jmp 0x404d4e
mov eax, dword [ebp - 0x5d4]
dec eax
mov dword [ebp - 0x5d4], eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x440]
call fcn.004148e3
push dword [ebp - 0x84]
lea ecx, [ebp - 0x440]
call fcn.004148e3
mov ecx, dword [ebp - 0x5d4]
cmp dword [eax], ecx
jg 0x404dbc
mov dword [ebp - 0x1b2c], 1
jmp 0x404dc3
and dword [ebp - 0x1b2c], 0
push 0
lea ecx, [ebp - 0x440]
call fcn.004148e3
push 0
lea ecx, [ebp - 0x440]
call fcn.004148e3
mov eax, dword [eax]
sub eax, dword [ebp - 0x5d4]
add eax, 0xffff
cmp eax, 0xd1a0c8
jl 0x404dfd
mov dword [ebp - 0x14e8], 1
jmp 0x404e04
and dword [ebp - 0x14e8], 0
push dword [ebp - 0x78]
lea ecx, [ebp - 0x440]
call fcn.004148e3
mov ecx, dword [ebp - 0x14e8]
cmp ecx, dword [eax]
jg 0x404e28
mov dword [ebp - 0xbd0], 1
jmp 0x404e2f
and dword [ebp - 0xbd0], 0
push dword [ebp - 0x84]
lea ecx, [ebp - 0x440]
call fcn.004148e3
mov eax, dword [eax]
cmp eax, dword [ebp - 0xbd0]
jge 0x404e56
mov dword [ebp - 0x6f8], 1
jmp 0x404e5d
and dword [ebp - 0x6f8], 0
push 0
lea ecx, [ebp - 0x1f0c]
call fcn.004148e3
mov ecx, dword [ebp - 0x6f8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18c0]
cmp dword [ebp - 0x6f8], eax
jl 0x404e8c
mov dword [ebp - 0x14f0], 1
jmp 0x404e93
and dword [ebp - 0x14f0], 0
push dword [ebp - 0x78]
lea ecx, [ebp - 0x440]
call fcn.004148e3
mov eax, dword [eax]
add eax, dword [ebp - 0x14f0]
mov dword [ebp - 0x1cb0], eax
push 0
lea ecx, [ebp - 0x440]
call fcn.004148e3
mov dword [eax], 0x8e12b6a3
mov dword [ebp - 0x4f4], 0x8e12b6a3
lea ecx, [ebp - 0x1f0c]
call fcn.004148c7
jmp 0x404d24
jmp 0x404ced
mov byte [ebp - 0x256], 0
movzx eax, byte [ebp - 0x256]
test eax, eax
je 0x404f02
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x404feb
mov dword [ebp - 0x2d0], 0xfffffffd
mov dword [ebp - 0x1b34], 0xbda3fa0b
push 0
lea ecx, [ebp - 0x440]
call fcn.004148e3
push 0
lea ecx, [ebp - 0x440]
call fcn.004148e3
mov esi, eax
push 0
lea ecx, [ebp - 0x440]
call fcn.004148e3
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x404f56
mov dword [ebp - 0xbd8], 1
jmp 0x404f5d
and dword [ebp - 0xbd8], 0
mov eax, dword [ebp - 0x2d0]
add eax, dword [ebp - 0xbd8]
imul eax, eax, 0x78c7
cmp dword [ebp - 0x2d0], eax
jne 0x404f8c
cmp dword [ebp - 0x2d0], 0
je 0x404f8c
mov dword [ebp - 0x18c8], 1
jmp 0x404f93
and dword [ebp - 0x18c8], 0
mov eax, dword [ebp - 0x2d0]
cmp dword [ebp - 0x4f4], eax
je 0x404fad
mov dword [ebp - 0x14f8], 1
jmp 0x404fb4
and dword [ebp - 0x14f8], 0
cmp dword [ebp - 0x14f8], 0x85e3970c
jae 0x404fcc
mov dword [ebp - 0xbe0], 1
jmp 0x404fd3
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x1b34], eax
push 0
lea ecx, [ebp - 0x440]
call fcn.004148e3
push 0
lea ecx, [ebp - 0x440]
call fcn.004148e3
mov dword [eax], 0x51ef224b
mov dword [ebp - 0x4f4], 0x51ef224b
lea ecx, [ebp - 0x440]
call fcn.004148c7
mov dword [ebp - 0x1b3c], 0x456a9e5f
mov dword [ebp - 0x340], 0xffffffff
mov dword [ebp - 0x218c], 0x18c9a01c
mov dword [ebp - 0x69c], 0
jmp 0x405057
mov eax, dword [ebp - 0x69c]
inc eax
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 4
jge 0x405073
mov eax, dword [ebp - 0x69c]
mov dword [ebp + eax*4 - 0x2604], 0xffff
jmp 0x40504a
xor eax, eax
inc eax
je 0x4051a2
cmp dword [ebp - 0x340], 0
je 0x4051a2
cmp dword [ebp - 0x340], 0
je 0x4051a2
mov dword [ebp - 0x2194], 0x209c3997
mov dword [ebp - 0x4fc], 0
jmp 0x4050b9
mov eax, dword [ebp - 0x4fc]
inc eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 1
jge 0x4050d5
mov eax, dword [ebp - 0x4fc]
mov dword [ebp + eax*4 - 0x219c], 0xd02268f6
jmp 0x4050ac
mov dword [ebp - 0x340], 3
jmp 0x4050ee
mov eax, dword [ebp - 0x340]
dec eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0
jl 0x405173
mov dword [ebp - 0x5dc], 0xbdd7770b
mov dword [ebp - 0x21a4], 0xb8575526
mov dword [ebp - 0x5dc], 0
jmp 0x405124
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 3
jg 0x40516e
mov dword [ebp - 0x1500], 0xfffffffa
mov byte [ebp - 0x258], 0
movzx eax, byte [ebp - 0x258]
test eax, eax
je 0x40515f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
mov eax, dword [ebp - 0x1500]
dec eax
mov dword [ebp - 0x1500], eax
jmp 0x405117
jmp 0x4050e1
mov byte [ebp - 0x1de], 0
movzx eax, byte [ebp - 0x1de]
test eax, eax
je 0x4051a0
push 0x12ce
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
jmp 0x4051b9
mov dword [ebp - 0xbe8], 0xcc51
mov eax, dword [ebp - 0xbe8]
inc eax
mov dword [ebp - 0xbe8], eax
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x2d8], eax
jne 0x4051d3
mov dword [ebp - 0x18d0], 1
jmp 0x4051da
and dword [ebp - 0x18d0], 0
mov eax, dword [ebp - 0x1c5c]
mov dword [ebp - 0x21ac], eax
mov eax, dword [ebp - 0x18d8]
sub eax, 0x2ce7bce5
cmp eax, dword [ebp - 0x30]
jge 0x405202
mov dword [ebp - 0x1508], 1
jmp 0x405209
and dword [ebp - 0x1508], 0
cmp dword [ebp - 0x1508], 0xa6b9
jg 0x405221
mov dword [ebp - 0xbf0], 1
jmp 0x405228
and dword [ebp - 0xbf0], 0
mov eax, dword [ebp - 0xbf0]
add eax, 0x10f71350
jne 0x405241
mov dword [ebp - 0x1510], 1
jmp 0x405248
and dword [ebp - 0x1510], 0
cmp dword [ebp - 0x1510], 1
jl 0x40525d
mov dword [ebp - 0xbf8], 1
jmp 0x405264
and dword [ebp - 0xbf8], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x44c]
call fcn.004148e3
mov eax, 0x2edcddcd
cmp eax, 1
jb 0x405288
mov dword [ebp - 0x1518], 1
jmp 0x40528f
and dword [ebp - 0x1518], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x1518]
lea esi, [ecx + eax + 0x9032]
imul esi, dword [ebp - 0x1b3c]
push 1
lea ecx, [ebp - 0x1e00]
call fcn.004148e3
cmp esi, dword [eax]
je 0x4052c3
mov dword [ebp - 0xc00], 1
jmp 0x4052ca
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0xc00]
mov dword [ebp - 0x1520], eax
mov esi, dword [ebp - 0x1520]
push 0
lea ecx, [ebp - 0x1e00]
call fcn.004148e3
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0x44c]
call fcn.004148e3
mov dword [eax], esi
jmp 0x404aff
jmp 0x404279
lea ecx, [ebp - 0x1e00]
call fcn.004148c7
jmp 0x4066ff
mov dword [ebp - 0x1b8], 0xdb3ae355
mov dword [ebp - 0x198], 0x63d62a04
mov dword [ebp - 0x828], 8
mov dword [ebp - 0xc10], 0x5291260e
mov dword [ebp - 0x1b8], 0xfffffff2
jmp 0x405355
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xd
jle 0x405704
mov dword [ebp - 0xc4], 0xa473eb90
mov dword [ebp - 0x21b4], 0x7006986d
mov dword [ebp - 0x154], 0
jmp 0x40538f
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x4053ab
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x1bd8], 0xffffffff
jmp 0x405382
mov dword [ebp - 0x154], 0
jmp 0x4053c4
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x4053e0
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x24e0], 0xffffffff
jmp 0x4053b7
mov dword [ebp - 0xc4], 0
jmp 0x4053f9
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 7
jge 0x40556d
mov dword [ebp - 0x1cb8], 0xfffffffd
mov dword [ebp - 0xc08], 0x213072c0
mov dword [ebp - 0x1530], 0x3d076c56
mov dword [ebp - 0xc08], 1
cmp dword [ebp - 0xc08], 0x7bf4
jle 0x405446
mov dword [ebp - 0x18e0], 1
jmp 0x40544d
and dword [ebp - 0x18e0], 0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x21bc], eax
mov eax, dword [ebp - 0x1cb8]
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x198], 0x29a2
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 0x2377
je 0x405493
mov dword [ebp - 0x1538], 1
jmp 0x40549a
and dword [ebp - 0x1538], 0
cmp dword [ebp - 0xc4], 0
je 0x40550c
cmp dword [ebp - 0x1b8], 0
ja 0x4054b8
mov dword [ebp - 0x1528], 1
jmp 0x4054bf
and dword [ebp - 0x1528], 0
mov eax, dword [ebp - 0x1528]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp - 0xc10]
sub eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x1530]
jg 0x4054eb
mov dword [ebp - 0xc18], 1
jmp 0x4054f2
and dword [ebp - 0xc18], 0
mov eax, dword [ebp - 0x1530]
cmp eax, dword [ebp - 0xc18]
jge 0x40550c
mov dword [ebp - 0xc20], 1
jmp 0x405513
and dword [ebp - 0xc20], 0
mov eax, dword [ebp - 0x1538]
cmp eax, dword [ebp - 0xc20]
jge 0x40552d
mov dword [ebp - 0x1540], 1
jmp 0x405534
and dword [ebp - 0x1540], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x1540], eax
jl 0x40554e
mov dword [ebp - 0xc28], 1
jmp 0x405555
and dword [ebp - 0xc28], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc28]
mov dword [ebp + eax - 0x1bd8], ecx
jmp 0x4053ec
mov dword [ebp - 0x198], 0xfffffffe
jmp 0x405586
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xa
jge 0x4056ff
mov dword [ebp - 0xc30], 1
mov dword [ebp - 0xc4], 0
jmp 0x4055b6
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jg 0x4056d2
cmp dword [ebp - 0x1b8], 0
jne 0x40565b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1bd8], 0
jne 0x4055ee
or eax, 0xffffffff
jne 0x4055ee
and dword [ebp - 0x18e8], 0
jmp 0x4055f8
mov dword [ebp - 0x18e8], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1bd8], 1
jg 0x405614
mov dword [ebp - 0x1548], 1
jmp 0x40561b
and dword [ebp - 0x1548], 0
mov eax, dword [ebp - 0x1548]
sub eax, dword [ebp - 0xc30]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1bd8]
jne 0x405642
mov dword [ebp - 0x1b44], 1
jmp 0x405649
and dword [ebp - 0x1b44], 0
cmp dword [ebp - 0xc30], 8
jne 0x40565b
and dword [ebp - 0x1550], 0
jmp 0x405665
mov dword [ebp - 0x1550], 1
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x1550], eax
jl 0x40567f
mov dword [ebp - 0x700], 1
jmp 0x405686
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x700]
mov dword [ebp + eax*4 - 0x1bd8], ecx
mov eax, dword [ebp - 0x828]
cmp dword [ebp - 0x700], eax
jle 0x4056b3
mov dword [ebp - 0xc38], 1
jmp 0x4056ba
and dword [ebp - 0xc38], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc38]
mov dword [ebp + eax - 0x24e0], ecx
jmp 0x4055a9
mov byte [ebp - 0x1df], 0
movzx eax, byte [ebp - 0x1df]
test eax, eax
je 0x4056fa
push 0x59
push 0
push 0xe26
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
jmp 0x405579
jmp 0x405348
mov dword [ebp - 0xd30], 0x66802143
mov dword [ebp - 0x1d8], 0xc68ec0ae
mov dword [ebp - 0x1558], 0xffffffff
mov dword [ebp - 0xc40], 0x3051ebf0
mov dword [ebp - 0x1560], 0xb5542afa
mov dword [ebp - 0x18f0], 0x273d
mov dword [ebp - 0x1c6c], 0x69b7d6b5
mov dword [ebp - 0x1908], 0xfffffff8
mov dword [ebp - 0x1d8], 0x19
jmp 0x40576d
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xffffffe7
jne 0x405997
mov dword [ebp - 0xc48], 2
mov dword [ebp - 0xc60], 0x11521faf
mov dword [ebp - 0x1900], 0x3372585f
mov dword [ebp - 0x1cc0], 0x289aa508
mov dword [ebp - 0x504], 0
jmp 0x4057bb
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 2
jge 0x4057d7
mov eax, dword [ebp - 0x504]
mov dword [ebp + eax*4 - 0x19d4], 0x431f
jmp 0x4057ae
cmp dword [ebp - 0x1d8], 0xd76c
jg 0x4057ef
mov dword [ebp - 0xc50], 1
jmp 0x4057f6
and dword [ebp - 0xc50], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x18f0]
sub eax, dword [ebp - 0x1c6c]
mov dword [ebp - 0x1558], eax
mov eax, dword [ebp - 0x1558]
mov dword [ebp - 0xc40], eax
cmp dword [ebp - 0xc40], 0x17c7128a
jge 0x40582f
mov dword [ebp - 0x1568], 1
jmp 0x405836
and dword [ebp - 0x1568], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x19d4]
mov dword [ebp - 0x1560], eax
mov eax, dword [ebp - 0x1560]
mov dword [ebp - 0xc48], eax
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0x18f8], eax
mov eax, dword [ebp - 0x1568]
mov dword [ebp - 0x1b4c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x19d4]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x19d4], eax
mov eax, dword [ebp - 0x18f8]
cmp eax, dword [ebp - 0x1b4c]
jle 0x4058a2
mov dword [ebp - 0x1570], 1
jmp 0x4058a9
and dword [ebp - 0x1570], 0
mov eax, dword [ebp - 0xc50]
cmp eax, dword [ebp - 0x1570]
jne 0x4058c3
mov dword [ebp - 0xc58], 1
jmp 0x4058ca
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0xc58], eax
jg 0x4058e4
mov dword [ebp - 0x1578], 1
jmp 0x4058eb
and dword [ebp - 0x1578], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x1578]
mov dword [ebp - 0xc60], eax
jne 0x40590c
push 3
pop eax
test eax, eax
jne 0x40590c
and dword [ebp - 0x1580], 0
jmp 0x405916
mov dword [ebp - 0x1580], 1
mov eax, dword [ebp - 0x1d8]
add eax, dword [ebp - 0x1580]
add eax, dword [ebp - 0x1900]
add eax, dword [ebp - 0x1d8]
cmp eax, 0xffffffff
jae 0x40593f
mov dword [ebp - 0xc68], 1
jmp 0x405946
and dword [ebp - 0xc68], 0
cmp dword [ebp - 0xc68], 0xfda3
jl 0x40595e
mov dword [ebp - 0x1588], 1
jmp 0x405965
and dword [ebp - 0x1588], 0
mov eax, dword [ebp - 0x1cc0]
cmp dword [ebp - 0x1588], eax
jne 0x40597f
mov dword [ebp - 0xc70], 1
jmp 0x405986
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0xc70]
mov dword [ebp - 0x1908], eax
jmp 0x405760
mov byte [ebp - 0x1e1], 0
movzx eax, byte [ebp - 0x1e1]
test eax, eax
je 0x4059b7
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 0x1938], 1
mov dword [ebp - 0x64c], 0xb0647dc4
push 1
lea ecx, [ebp - 0x1be8]
call fcn.004147f5
mov dword [ebp - 0x1b54], 0xcff26af9
mov dword [ebp - 0xc90], 0xd3ed23c5
mov dword [ebp - 0x60], 0
jmp 0x4059fc
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x405a12
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x2484], 0xfff6
jmp 0x4059f5
mov dword [ebp - 0x60], 0
jmp 0x405a22
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x405a3e
push dword [ebp - 0x60]
lea ecx, [ebp - 0x1be8]
call fcn.004148e3
mov dword [eax], 0x5132d7af
jmp 0x405a1b
mov dword [ebp - 0x60], 0
jmp 0x405a4e
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x405a64
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x1f24], 0x813bf58a
jmp 0x405a47
cmp dword [ebp - 0x64c], 0
jne 0x405ab4
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2484], 0xfffffffd
cmp dword [ebp - 0x64c], 0x90611bc3
jae 0x405a96
mov dword [ebp - 0x1590], 1
jmp 0x405a9d
and dword [ebp - 0x1590], 0
imul eax, dword [ebp - 0x1590], 0xfffffff7
sub eax, 0x839e
jne 0x405ab4
and dword [ebp - 0x7c8], 0
jmp 0x405abe
mov dword [ebp - 0x7c8], 1
push 0
lea ecx, [ebp - 0x1be8]
call fcn.004148e3
mov ecx, dword [ebp - 0x7c8]
mov dword [eax], ecx
cmp dword [ebp - 0x7c8], 0xdfddae9
jle 0x405aef
push 3
pop eax
test eax, eax
jne 0x405aef
and dword [ebp - 0xc78], 0
jmp 0x405af9
mov dword [ebp - 0xc78], 1
mov eax, dword [ebp - 0x64c]
imul eax, dword [ebp - 0xc78]
test eax, eax
je 0x405b28
push 0
lea ecx, [ebp - 0x1be8]
call fcn.004148e3
cmp dword [eax], 0
je 0x405b28
mov dword [ebp - 0x1598], 1
jmp 0x405b2f
and dword [ebp - 0x1598], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1f24]
cmp dword [ebp - 0x1598], eax
jg 0x405b5c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f24], 0
jne 0x405b5c
and dword [ebp - 0xc80], 0
jmp 0x405b66
mov dword [ebp - 0xc80], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc80]
sub ecx, dword [ebp + eax - 0x1f24]
cmp ecx, 5
jge 0x405b8a
mov dword [ebp - 0x15a0], 1
jmp 0x405b91
and dword [ebp - 0x15a0], 0
cmp dword [ebp - 0x15a0], 0xff15cc7c
je 0x405bb8
push 0
lea ecx, [ebp - 0x1be8]
call fcn.004148e3
cmp dword [eax], 0
jne 0x405bb8
and dword [ebp - 0xc88], 0
jmp 0x405bc2
mov dword [ebp - 0xc88], 1
mov eax, dword [ebp - 0x64c]
cmp eax, dword [ebp - 0xc88]
jg 0x405bdc
mov dword [ebp - 0x15a8], 1
jmp 0x405be3
and dword [ebp - 0x15a8], 0
mov eax, dword [ebp - 0x15a8]
sub eax, 0x271dbcab
mov dword [ebp - 0x1b54], eax
mov eax, dword [ebp - 0xc90]
dec eax
mov dword [ebp - 0xc90], eax
lea ecx, [ebp - 0x1be8]
call fcn.004148c7
mov byte [ebp - 0x1e3], 0
mov dword [ebp - 0x1a0], 0x7ddc85f7
mov dword [ebp - 0x1910], 0x1b40e11a
mov dword [ebp - 0x84c], 0x653ffd03
mov dword [ebp - 0x1cc8], 0x914cc5c6
mov dword [ebp - 0x21c4], 0
mov dword [ebp - 0x1a0], 0
jmp 0x405c5e
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xfffffffc
jl 0x405e22
mov dword [ebp - 0x3a0], 1
mov dword [ebp - 0x708], 1
mov dword [ebp - 0xca0], 0x364d64ea
mov dword [ebp - 0x1918], 1
mov dword [ebp - 0x15d8], 0x17a68fa
mov dword [ebp - 0x1b5c], 0
cmp dword [ebp - 0x3a0], 0
jne 0x405dcb
cmp dword [ebp - 0x3a0], 0
jne 0x405ccd
cmp dword [ebp - 0x1a0], 0
jne 0x405ccd
cmp dword [ebp - 0x1a0], 0
cmp dword [ebp - 0x3a0], 0
jbe 0x405ce2
mov dword [ebp - 0x15b8], 1
jmp 0x405ce9
and dword [ebp - 0x15b8], 0
mov eax, dword [ebp - 0x15b8]
mov dword [ebp - 0x708], eax
cmp dword [ebp - 0x708], 0
je 0x405d13
cmp dword [ebp - 0x708], 0
je 0x405d13
mov dword [ebp - 0xc98], 1
jmp 0x405d1a
and dword [ebp - 0xc98], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0xc98], eax
jne 0x405d34
mov dword [ebp - 0x15c0], 1
jmp 0x405d3b
and dword [ebp - 0x15c0], 0
mov eax, dword [ebp - 0x15c0]
mov dword [ebp - 0xca0], eax
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0x1910], eax
mov eax, 0xda3c
test eax, eax
je 0x405d6d
xor eax, eax
inc eax
je 0x405d6d
mov dword [ebp - 0x15c8], 1
jmp 0x405d74
and dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x15c8], eax
jge 0x405d8e
mov dword [ebp - 0xca8], 1
jmp 0x405d95
and dword [ebp - 0xca8], 0
mov eax, dword [ebp - 0xca8]
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0x21cc], eax
mov eax, dword [ebp - 0x1cc8]
mov dword [ebp - 0x21d4], eax
cmp dword [ebp - 0x84c], 0xfffffff7
jg 0x405dcb
and dword [ebp - 0x15d0], 0
jmp 0x405dd5
mov dword [ebp - 0x15d0], 1
mov eax, dword [ebp - 0x3a0]
sub eax, dword [ebp - 0x15d0]
add eax, dword [ebp - 0x3a0]
je 0x405dfe
cmp dword [ebp - 0x1918], 0
je 0x405dfe
mov dword [ebp - 0xcb0], 1
jmp 0x405e05
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0xcb0]
mov dword [ebp - 0x15d8], eax
mov eax, dword [ebp - 0x15d8]
mov dword [ebp - 0x1b5c], eax
jmp 0x405c51
movzx eax, byte [ebp - 0x1e3]
test eax, eax
je 0x406602
mov dword [ebp - 0x40c], 0x16df251d
mov dword [ebp - 0xcc8], 0xd383de46
mov dword [ebp - 0xbc], 0x37f1
push 2
lea ecx, [ebp - 0x8b8]
call fcn.004147f5
mov dword [ebp - 0x720], 0xffffffff
mov dword [ebp - 0x1628], 0xfffffffa
mov dword [ebp - 0xfc], 1
mov dword [ebp - 0x14], 0
jmp 0x405e8a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x405ea0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d34], 0xa53d
jmp 0x405e83
mov dword [ebp - 0x14], 0
jmp 0x405eb0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x405ecc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x8b8]
call fcn.004148e3
mov dword [eax], 0x248e6bae
jmp 0x405ea9
mov dword [ebp - 0x14], 0
jmp 0x405edc
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x405ef2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1630], 0x764fe605
jmp 0x405ed5
mov dword [ebp - 0x14], 0
jmp 0x405f02
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x405f18
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x19e0], 0
jmp 0x405efb
mov dword [ebp - 0x40c], 2
jmp 0x405f31
mov eax, dword [ebp - 0x40c]
dec eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jl 0x406398
mov dword [ebp - 0x320], 0
mov dword [ebp - 0xd08], 0xb017
mov dword [ebp - 0x7d0], 0x592840cc
push 1
lea ecx, [ebp - 0x1f6c]
call fcn.004147f5
mov dword [ebp - 0x50c], 0
jmp 0x405f82
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 1
jge 0x405fa4
push dword [ebp - 0x50c]
lea ecx, [ebp - 0x1f6c]
call fcn.004148e3
mov dword [eax], 0xe8236511
jmp 0x405f75
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d34], 0
jne 0x4062ec
mov eax, 0x7540
test eax, eax
je 0x40624a
cmp dword [ebp - 0x40c], 1
jb 0x405fda
mov dword [ebp - 0xcb8], 1
jmp 0x405fe1
and dword [ebp - 0xcb8], 0
cmp dword [ebp - 0xcb8], 1
jge 0x405ff6
mov dword [ebp - 0x15e0], 1
jmp 0x405ffd
and dword [ebp - 0x15e0], 0
cmp dword [ebp - 0x15e0], 0xfffffff9
jne 0x406012
mov dword [ebp - 0xcc0], 1
jmp 0x406019
and dword [ebp - 0xcc0], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0xcc0], eax
jl 0x406033
mov dword [ebp - 0x15e8], 1
jmp 0x40603a
and dword [ebp - 0x15e8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d34]
cmp dword [ebp - 0x15e8], eax
jg 0x40605a
mov dword [ebp - 0x15f0], 1
jmp 0x406061
and dword [ebp - 0x15f0], 0
mov dword [ebp - 0xcc8], 0xffffffff
mov eax, dword [ebp - 0xcc8]
cmp eax, dword [ebp - 0x15f0]
jge 0x406085
mov dword [ebp - 0xcd0], 1
jmp 0x40608c
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0xcd0], eax
jg 0x4060a6
mov dword [ebp - 0x710], 1
jmp 0x4060ad
and dword [ebp - 0x710], 0
push 0
lea ecx, [ebp - 0x8b8]
call fcn.004148e3
mov ecx, dword [ebp - 0x710]
mov dword [eax], ecx
mov eax, dword [ebp - 0x710]
dec eax
cmp eax, 0x3fa9dfee
jge 0x4060dc
mov dword [ebp - 0x15f8], 1
jmp 0x4060e3
and dword [ebp - 0x15f8], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x15f8], eax
jle 0x4060fd
mov dword [ebp - 0xcd8], 1
jmp 0x406104
and dword [ebp - 0xcd8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d34]
imul eax, dword [ebp - 0xcd8]
cmp eax, dword [ebp - 0xd08]
jle 0x40612c
mov dword [ebp - 0x1600], 1
jmp 0x406133
and dword [ebp - 0x1600], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x1600], eax
jl 0x40614d
mov dword [ebp - 0xce0], 1
jmp 0x406154
and dword [ebp - 0xce0], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0xce0], eax
je 0x40616e
mov dword [ebp - 0x1608], 1
jmp 0x406175
and dword [ebp - 0x1608], 0
cmp dword [ebp - 0x1608], 0x7001
jge 0x40619f
push 0
lea ecx, [ebp - 0x8b8]
call fcn.004148e3
cmp dword [eax], 0
je 0x40619f
mov dword [ebp - 0xce8], 1
jmp 0x4061a6
and dword [ebp - 0xce8], 0
mov eax, dword [ebp - 0xce8]
mov dword [ebp - 0x7d0], eax
cmp dword [ebp - 0x7d0], 0
je 0x4061c2
cmp dword [ebp - 0x7d0], 0
push 0
lea ecx, [ebp - 0x8b8]
call fcn.004148e3
cmp dword [eax], 0
jne 0x4061e4
push 4
pop eax
test eax, eax
jne 0x4061e4
and dword [ebp - 0x718], 0
jmp 0x4061ee
mov dword [ebp - 0x718], 1
push 0
lea ecx, [ebp - 0x1f6c]
call fcn.004148e3
mov ecx, dword [ebp - 0x718]
mov dword [eax], ecx
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x718], eax
jne 0x40621f
or eax, 0xffffffff
jne 0x40621f
and dword [ebp - 0x1610], 0
jmp 0x406229
mov dword [ebp - 0x1610], 1
mov eax, dword [ebp - 0x1610]
mov dword [ebp - 0x720], eax
cmp dword [ebp - 0x720], 0
je 0x40624a
mov dword [ebp - 0xcf0], 1
jmp 0x406251
and dword [ebp - 0xcf0], 0
cmp dword [ebp - 0xcf0], 0
jne 0x406266
mov dword [ebp - 0x1618], 1
jmp 0x40626d
and dword [ebp - 0x1618], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x1618], eax
jl 0x406287
mov dword [ebp - 0xcf8], 1
jmp 0x40628e
and dword [ebp - 0xcf8], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0xcf8], eax
jne 0x4062a8
mov dword [ebp - 0x1620], 1
jmp 0x4062af
and dword [ebp - 0x1620], 0
cmp dword [ebp - 0x1620], 0x830a
jne 0x4062c7
mov dword [ebp - 0xd00], 1
jmp 0x4062ce
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0xd00]
mov dword [ebp - 0x1628], eax
cmp dword [ebp - 0x1628], 1
je 0x4062ec
and dword [ebp - 0x830], 0
jmp 0x4062f6
mov dword [ebp - 0x830], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x830]
mov dword [ebp + eax - 0x1630], ecx
mov eax, dword [ebp - 0xd08]
cmp dword [ebp - 0x830], eax
jg 0x406323
mov dword [ebp - 0x1920], 1
jmp 0x40632a
and dword [ebp - 0x1920], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1630]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xfc], 2
jmp 0x406356
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x406388
mov byte [ebp - 0x1e5], 0
movzx eax, byte [ebp - 0x1e5]
test eax, eax
je 0x406386
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x406349
lea ecx, [ebp - 0x1f6c]
call fcn.004148c7
jmp 0x405f24
mov dword [ebp - 0xfc], 0xfffffff3
jmp 0x4063b1
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xfffffffb
jg 0x4065ed
mov dword [ebp - 0x728], 0
mov dword [ebp - 0x834], 0x2630673e
mov dword [ebp - 0x5e4], 0
jmp 0x4063eb
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 1
jge 0x406407
mov eax, dword [ebp - 0x5e4]
mov dword [ebp + eax*4 - 0x7d8], 0xc3d2
jmp 0x4063de
mov dword [ebp - 0xbc], 1
jmp 0x406420
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x4065e8
mov dword [ebp - 0xd10], 0x12742e7f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7d8]
mov dword [ebp - 0x728], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xd10], eax
mov esi, dword [ebp - 0x720]
mov edi, dword [ebp - 0x728]
sub edi, dword [ebp - 0xd10]
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x8b8]
call fcn.004148e3
mov eax, dword [eax]
sub eax, edi
cmp eax, esi
jne 0x40649f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7d8], 0
jne 0x40649f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x19e0], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x19e0], 0x3b720fae
jg 0x4064be
mov dword [ebp - 0x1638], 1
jmp 0x4064c5
and dword [ebp - 0x1638], 0
mov eax, dword [ebp - 0x1638]
mov dword [ebp - 0x834], eax
mov eax, 0xffff
test eax, eax
je 0x4064f9
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x8b8]
call fcn.004148e3
cmp dword [eax], 0
je 0x4064f9
and dword [ebp - 0xd20], 0
jmp 0x406503
mov dword [ebp - 0xd20], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d34], 9
jbe 0x406524
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x8b8]
call fcn.004148e3
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x7d8]
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x8b8]
call fcn.004148e3
cmp esi, dword [eax]
jl 0x406552
mov dword [ebp - 0xd18], 1
jmp 0x406559
and dword [ebp - 0xd18], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x19e0]
cmp eax, dword [ebp - 0xd18]
jle 0x40657a
mov dword [ebp - 0x1c78], 1
jmp 0x406581
and dword [ebp - 0x1c78], 0
xor eax, eax
inc eax
jne 0x4065a5
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x8b8]
call fcn.004148e3
cmp dword [eax], 0
jne 0x4065a5
and dword [ebp - 0x1640], 0
jmp 0x4065af
mov dword [ebp - 0x1640], 1
mov eax, dword [ebp - 0x834]
cmp eax, dword [ebp - 0x1640]
jge 0x4065c9
mov dword [ebp - 0x1928], 1
jmp 0x4065d0
and dword [ebp - 0x1928], 0
mov eax, dword [ebp - 0x728]
imul eax, dword [ebp - 0xd20]
mov dword [ebp - 0x834], eax
jmp 0x406413
jmp 0x4063a4
lea ecx, [ebp - 0x8b8]
call fcn.004148c7
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x21dc], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x21e4], eax
cmp dword [ebp - 0x88], 0xfffffff9
jae 0x40662c
mov dword [ebp - 0x1b64], 1
jmp 0x406633
and dword [ebp - 0x1b64], 0
cmp dword [ebp - 0x40], 0xe516
jl 0x406648
mov dword [ebp - 0x1648], 1
jmp 0x40664f
and dword [ebp - 0x1648], 0
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x1648]
je 0x40666c
cmp dword [ebp - 0x40], 0
je 0x40666c
mov dword [ebp - 0xd28], 1
jmp 0x406673
and dword [ebp - 0xd28], 0
mov eax, dword [ebp - 0x1930]
cmp dword [ebp - 0xd28], eax
jg 0x40668d
mov dword [ebp - 0x1c7c], 1
jmp 0x406694
and dword [ebp - 0x1c7c], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x21ec], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1650], eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x44c]
call fcn.004148e3
mov ecx, dword [ebp - 0x1650]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1650]
mov dword [ebp - 0xd30], eax
mov eax, dword [ebp - 0xd30]
imul eax, dword [ebp - 0x1938]
cmp eax, dword [ebp - 0x1c0]
jl 0x4066ec
mov dword [ebp - 0x1658], 1
jmp 0x4066f3
and dword [ebp - 0x1658], 0
mov eax, dword [ebp - 0x1658]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x40], 3
jmp 0x40670f
cmp dword [ebp - 0x40], 0
jl 0x4071ce
push 3
lea ecx, [ebp - 0x8dc]
call fcn.004147f5
push 1
lea ecx, [ebp - 0x1f84]
call fcn.004147f5
mov dword [ebp - 0x70], 0
jmp 0x406743
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x40675f
push dword [ebp - 0x70]
lea ecx, [ebp - 0x8dc]
call fcn.004148e3
mov dword [eax], 0x177e
jmp 0x40673c
mov dword [ebp - 0x70], 0
jmp 0x40676f
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x406785
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x1880], 0xeef20fe6
jmp 0x406768
mov dword [ebp - 0x70], 0
jmp 0x406795
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x4067b1
push dword [ebp - 0x70]
lea ecx, [ebp - 0x1f84]
call fcn.004148e3
mov dword [eax], 0xfffffffa
jmp 0x40678e
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1880], 2
jmp 0x4067df
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1880]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1880], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1880], 0
jl 0x406e6e
mov dword [ebp - 0x368], 0xffffffff
mov dword [ebp - 0x3a8], 1
mov dword [ebp - 0x514], 0
jmp 0x406820
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 3
jge 0x40683c
mov eax, dword [ebp - 0x514]
mov dword [ebp + eax*4 - 0x2504], 0x1183d964
jmp 0x406813
mov dword [ebp - 0x368], 2
jmp 0x406855
mov eax, dword [ebp - 0x368]
dec eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0
jl 0x406e69
mov dword [ebp - 0x1e68], 0x64f14790
mov dword [ebp - 0x1e64], 0x64f14790
mov dword [ebp - 0x1e60], 0x64f14790
mov dword [ebp - 0x1e5c], 0x64f14790
lea ecx, [ebp - 0x829]
call fcn.004148f2
push eax
lea eax, [ebp - 0x1e58]
push eax
lea eax, [ebp - 0x1e68]
push eax
lea ecx, [ebp - 0x25f4]
call fcn.004148f5
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x47c]
call fcn.004148a1
push 1
lea ecx, [ebp - 0x1df4]
call fcn.004147f5
mov dword [ebp - 0x1940], 1
mov dword [ebp - 0x684], 0
jmp 0x4068ef
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 1
jge 0x406911
push dword [ebp - 0x684]
lea ecx, [ebp - 0x1df4]
call fcn.004148e3
mov dword [eax], 0x283019c3
jmp 0x4068e2
push 2
lea ecx, [ebp - 0x47c]
call fcn.004148e3
mov dword [eax], 2
jmp 0x40694a
push 2
lea ecx, [ebp - 0x47c]
call fcn.004148e3
mov dword [ebp - 0xd38], eax
mov eax, dword [ebp - 0xd38]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xd38]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x47c]
call fcn.004148e3
cmp dword [eax], 0
jl 0x406e4e
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x1cbc], 0
mov dword [ebp - 0x204], 0
jmp 0x40698d
cmp dword [ebp - 0x204], 2
jg 0x406e49
mov dword [ebp - 0x5ec], 0x4fb7d476
push 1
lea ecx, [ebp - 0x8dc]
call fcn.004148e3
cmp dword [eax], 0
jne 0x4069c2
mov dword [ebp - 0xd48], 1
jmp 0x4069c9
and dword [ebp - 0xd48], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x368]
cmp dword [ebp + eax - 0x1880], ecx
jne 0x4069ea
mov dword [ebp - 0x1660], 1
jmp 0x4069f1
and dword [ebp - 0x1660], 0
push 2
lea ecx, [ebp - 0x47c]
call fcn.004148e3
push dword [eax]
lea ecx, [ebp - 0x8dc]
call fcn.004148e3
mov ecx, dword [ebp - 0x1660]
add ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp + eax - 0x1880]
cmp ecx, dword [ebp - 0x3a8]
jge 0x406a35
mov dword [ebp - 0xd40], 1
jmp 0x406a3c
and dword [ebp - 0xd40], 0
push 2
lea ecx, [ebp - 0x47c]
call fcn.004148e3
push dword [eax]
lea ecx, [ebp - 0x8dc]
call fcn.004148e3
mov esi, eax
imul edi, dword [ebp - 0xd40], 9
push 2
lea ecx, [ebp - 0x47c]
call fcn.004148e3
sub edi, dword [eax]
mov esi, dword [esi]
sub esi, edi
push 2
lea ecx, [ebp - 0x47c]
call fcn.004148e3
cmp esi, dword [eax]
jl 0x406a8f
mov dword [ebp - 0x1668], 1
jmp 0x406a96
and dword [ebp - 0x1668], 0
mov eax, dword [ebp - 0x1668]
add eax, 0x5cb51404
cmp dword [ebp - 0xd48], eax
jle 0x406ab5
mov dword [ebp - 0x1670], 1
jmp 0x406abc
and dword [ebp - 0x1670], 0
mov eax, dword [ebp - 0x1670]
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 0
jne 0x406aea
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1880], 0
jne 0x406aea
mov dword [ebp - 0xd50], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1880]
add eax, dword [ebp - 0xd50]
je 0x406b1e
jmp 0x406926
lea ecx, [ebp - 0x1df4]
call fcn.004148c7
lea ecx, [ebp - 0x47c]
call fcn.004148c7
jmp 0x406848
jmp 0x4067c4
lea ecx, [ebp - 0x1f84]
call fcn.004148c7
lea ecx, [ebp - 0x8dc]
call fcn.004148c7
mov dword [ebp - 0x3f4], 0xb363f9e9
push 4
lea ecx, [ebp - 0x1818]
call fcn.004147f5
mov dword [ebp - 0x16e0], 4
mov dword [ebp - 0x1950], 0x6bcfb656
mov dword [ebp - 0x134], 0
jmp 0x406ec8
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x406eea
push dword [ebp - 0x134]
lea ecx, [ebp - 0x1818]
call fcn.004148e3
mov dword [eax], 0x7fc0549e
jmp 0x406ebb
mov dword [ebp - 0x134], 0
jmp 0x406f03
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x406f1f
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x1cf0], 0x5b689063
jmp 0x406ef6
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x2210], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x221c], eax
push 3
lea ecx, [ebp - 0x1818]
call fcn.004148e3
mov esi, eax
push 3
lea ecx, [ebp - 0x1818]
call fcn.004148e3
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x406f65
mov dword [ebp - 0xd88], 1
jmp 0x406f6c
and dword [ebp - 0xd88], 0
push 3
lea ecx, [ebp - 0x1818]
call fcn.004148e3
mov ecx, dword [ebp - 0xd88]
cmp ecx, dword [eax]
jl 0x406f8f
mov dword [ebp - 0x16b0], 1
jmp 0x406f96
and dword [ebp - 0x16b0], 0
cmp dword [ebp - 0x16b0], 0x89f7
jg 0x406fae
mov dword [ebp - 0xd90], 1
jmp 0x406fb5
and dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0x3f4]
cmp dword [ebp - 0xd90], eax
jge 0x406fcf
mov dword [ebp - 0x1948], 1
jmp 0x406fd6
and dword [ebp - 0x1948], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1cf0], 9
jg 0x406ff2
mov dword [ebp - 0x16b8], 1
jmp 0x406ff9
and dword [ebp - 0x16b8], 0
cmp dword [ebp - 0x16b8], 0xffffffff
jle 0x40700e
mov dword [ebp - 0xd98], 1
jmp 0x407015
and dword [ebp - 0xd98], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cf0]
cmp dword [ebp - 0xd98], eax
jge 0x407036
mov dword [ebp - 0x16c0], 1
jmp 0x40703d
and dword [ebp - 0x16c0], 0
cmp dword [ebp - 0x16c0], 0x877e
jle 0x407062
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1cf0], 0
jne 0x407062
and dword [ebp - 0xda0], 0
jmp 0x40706c
mov dword [ebp - 0xda0], 1
cmp dword [ebp - 0xda0], 0x7f3c88fe
je 0x407084
mov dword [ebp - 0x16c8], 1
jmp 0x40708b
and dword [ebp - 0x16c8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1cf0]
cmp dword [ebp - 0x16c8], eax
jge 0x4070ac
mov dword [ebp - 0xda8], 1
jmp 0x4070b3
and dword [ebp - 0xda8], 0
imul eax, dword [ebp - 0xda8], 6
test eax, eax
jl 0x4070ca
mov dword [ebp - 0x16d0], 1
jmp 0x4070d1
and dword [ebp - 0x16d0], 0
mov eax, dword [ebp - 0x3f4]
cmp eax, dword [ebp - 0x16d0]
jge 0x4070eb
mov dword [ebp - 0xdb0], 1
jmp 0x4070f2
and dword [ebp - 0xdb0], 0
mov eax, dword [ebp - 0x3f4]
cmp eax, dword [ebp - 0xdb0]
jle 0x40710c
jmp 0x402773
lea ecx, [ebp - 0x44c]
call fcn.004148c7
mov dword [ebp - 0x2e0], 0x642c70bb
mov dword [ebp - 0x524], 0
jmp 0x407201
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 1
jge 0x40721d
mov eax, dword [ebp - 0x524]
mov dword [ebp + eax*4 - 0x1c84], 1
jmp 0x4071f4
mov dword [ebp - 0x2e0], 0
jmp 0x407236
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 1
jge 0x407252
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0x1c84], 0
jmp 0x407229
mov dword [ebp - 0x2e0], 1
mov dword [ebp - 0x654], 1
mov dword [ebp - 0x2234], 0x94543beb
mov dword [ebp - 0x654], 0x1d
jmp 0x407289
mov eax, dword [ebp - 0x654]
dec eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 0xffffffef
jl 0x4072c8
mov dword [ebp - 0x1958], 0x44696a48
mov byte [ebp - 0x1e7], 0
movzx eax, byte [ebp - 0x1e7]
test eax, eax
je 0x4072bc
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 0x1958], 0x876e6bac
jmp 0x40727c
mov dword [ebp - 0x52c], 0xa8eac8b
mov byte [ebp - 0x1e9], 0
movzx eax, byte [ebp - 0x1e9]
test eax, eax
je 0x407304
push 0
push 0xa4e
push 0x1f59
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov dword [ebp - 0x52c], 0
jmp 0x40731d
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 1
jle 0x40733d
mov dword [ebp - 0x1b7c], 0x7dd68876
cmp dword [ebp - 0x1b7c], 0
je 0x40733b
jmp 0x40733d
jmp 0x407310
mov dword [ebp - 0x2dc], 0x77c8748a
mov dword [ebp - 0x534], 0xffffffff
mov dword [ebp - 0x5f4], 0
jmp 0x40736a
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 2
jge 0x407386
mov eax, dword [ebp - 0x5f4]
mov dword [ebp + eax*4 - 0x2554], 0xf9b3
jmp 0x40735d
mov dword [ebp - 0x534], 1
jmp 0x40739f
mov eax, dword [ebp - 0x534]
dec eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0
jl 0x4073d7
mov byte [ebp - 0x1eb], 0
movzx eax, byte [ebp - 0x1eb]
test eax, eax
je 0x4073d5
push 0
push 0
push 0x1069
push 0x6ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
jmp 0x407392
mov dword [ebp - 0x1a8], 0xe0648261
mov dword [ebp - 0x6ac], 0
jmp 0x4073fa
mov eax, dword [ebp - 0x6ac]
inc eax
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 1
jge 0x407416
mov eax, dword [ebp - 0x6ac]
mov dword [ebp + eax*4 - 0x2240], 0xfffffff9
jmp 0x4073ed
mov dword [ebp - 0x1a8], 0x1b
jmp 0x40742f
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xa
jle 0x407470
mov dword [ebp - 0x1960], 0x6df3
mov dword [ebp - 0x2244], 0xd9ba07e4
mov dword [ebp - 0xdc0], 0xffffffff
cmp dword [ebp - 0x1960], 0
je 0x407461
jmp 0x407470
mov eax, dword [ebp - 0xdc0]
inc eax
mov dword [ebp - 0xdc0], eax
jmp 0x407422
mov dword [ebp - 0x1a8], 0
jmp 0x407489
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jg 0x4074db
mov byte [ebp - 0x1ed], 0
movzx eax, byte [ebp - 0x1ed]
test eax, eax
je 0x4074bf
push 0
push 0
push 0x1069
push 0x6ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
mov byte [ebp - 0x1ef], 0
movzx eax, byte [ebp - 0x1ef]
test eax, eax
je 0x4074d9
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x40747c
mov dword [ebp - 0x360], 0x1928c176
mov dword [ebp - 0x360], 0x16
jmp 0x4074fe
mov eax, dword [ebp - 0x360]
dec eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0xd
je 0x40755d
mov dword [ebp - 0x16f8], 0x662a2b3b
mov eax, dword [ebp - 0x360]
imul eax, dword [ebp - 0x360]
test eax, eax
je 0x407539
mov dword [ebp - 0x1cac], 0xfffb
cmp dword [ebp - 0x1cac], 0
je 0x407537
jmp 0x40755d
jmp 0x40755b
mov dword [ebp - 0x1968], 0xffffffff
mov eax, dword [ebp - 0x16f8]
inc eax
mov dword [ebp - 0x16f8], eax
cmp dword [ebp - 0x1968], 0
je 0x40755b
jmp 0x4074f1
jmp 0x4074f1
mov dword [ebp - 0x38], 0x9bd697e7
mov dword [ebp - 0x53c], 0
jmp 0x40757d
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 3
jge 0x407599
mov eax, dword [ebp - 0x53c]
mov dword [ebp + eax*4 - 0x1830], 1
jmp 0x407570
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1830], 0xfffffff4
jmp 0x4075c7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1830]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1830], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1830], 0x1a
je 0x4078d2
mov dword [ebp - 0xec], 0
mov dword [ebp - 0x5fc], 0
jmp 0x4075fe
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 3
jge 0x40761a
mov eax, dword [ebp - 0x5fc]
mov dword [ebp + eax*4 - 0x1bf8], 0x3eb905d0
jmp 0x4075f1
mov dword [ebp - 0xec], 2
jmp 0x407633
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x4078ac
mov dword [ebp - 0x1d0], 0xd0d3f7bf
mov dword [ebp - 0x1a3c], 0xaa9dade6
mov byte [ebp - 0x1f1], 0
movzx eax, byte [ebp - 0x1f1]
test eax, eax
je 0x40767c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x1d0], 0
jmp 0x407695
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 2
jg 0x4078a7
mov dword [ebp - 0x7e0], 0xa8bc
mov dword [ebp - 0xdd0], 9
mov eax, dword [ebp - 0xec]
cmp dword [ebp + eax*4 - 0x1bf8], 0
je 0x4076cb
jmp 0x4078a7
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0x1b84], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1970], eax
mov eax, dword [ebp - 0x7e0]
inc eax
mov dword [ebp - 0x7e0], eax
mov eax, dword [ebp - 0x1b84]
cmp eax, dword [ebp - 0x1970]
jne 0x40770a
mov dword [ebp - 0xdd8], 1
jmp 0x407711
and dword [ebp - 0xdd8], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1830], 2
jl 0x40772d
mov dword [ebp - 0xdc8], 1
jmp 0x407734
and dword [ebp - 0xdc8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1830]
cmp dword [ebp - 0xdc8], eax
je 0x407755
mov dword [ebp - 0x1700], 1
jmp 0x40775c
and dword [ebp - 0x1700], 0
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp + eax*4 - 0x1bf8]
add eax, dword [ebp - 0x1700]
mov dword [ebp - 0xdd0], eax
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0xdd0], eax
jg 0x407795
cmp dword [ebp - 0x1d0], 0
jne 0x407795
and dword [ebp - 0x1708], 0
jmp 0x40779f
mov dword [ebp - 0x1708], 1
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp + eax*4 - 0x1bf8]
add eax, dword [ebp - 0x1708]
cmp eax, 0xc89d73ae
jbe 0x4077c5
mov dword [ebp - 0x1710], 1
jmp 0x4077cc
and dword [ebp - 0x1710], 0
mov eax, dword [ebp - 0xdd8]
cmp eax, dword [ebp - 0x1710]
je 0x4077e6
mov dword [ebp - 0xde0], 1
jmp 0x4077ed
and dword [ebp - 0xde0], 0
mov eax, dword [ebp - 0x1d0]
mov eax, dword [ebp + eax*4 - 0x1bf8]
imul eax, dword [ebp - 0xde0]
test eax, eax
jne 0x40781d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1830], 0
jne 0x40781d
and dword [ebp - 0x1718], 0
jmp 0x407827
mov dword [ebp - 0x1718], 1
mov eax, dword [ebp - 0x1a3c]
cmp dword [ebp - 0x1718], eax
jl 0x407843
xor eax, eax
inc eax
jne 0x407843
and dword [ebp - 0xde8], 0
jmp 0x40784d
mov dword [ebp - 0xde8], 1
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0xde8], eax
jle 0x407867
mov dword [ebp - 0x1720], 1
jmp 0x40786e
and dword [ebp - 0x1720], 0
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x1720]
jl 0x407888
mov dword [ebp - 0xdf0], 1
jmp 0x40788f
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xdf0]
mov dword [ebp + eax*4 - 0x1bf8], ecx
jmp 0x407688
jmp 0x407626
mov byte [ebp - 0x1f3], 0
movzx eax, byte [ebp - 0x1f3]
test eax, eax
je 0x4078cd
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x4075ac
mov dword [ebp - 0x98], 0xf8d19c92
mov dword [ebp - 0x54], 0x443250e6
mov dword [ebp - 0x1980], 2
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
je 0x407901
mov dword [ebp - 0x1728], 1
jmp 0x407908
and dword [ebp - 0x1728], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x1728]
lea ecx, [edx + ecx + 1]
imul eax, ecx
cmp eax, 0xbf0b
jge 0x40792e
mov dword [ebp - 0xdf8], 1
jmp 0x407935
and dword [ebp - 0xdf8], 0
mov eax, dword [ebp - 0xdf8]
sub eax, dword [ebp - 0x54]
cmp eax, 0x35ca4204
jg 0x407b7b
push 1
lea ecx, [ebp - 0x1860]
call fcn.004147f5
mov dword [ebp - 0x1738], 0x80f885bd
mov dword [ebp - 0x1730], 0xcfdfe92
mov dword [ebp - 0xe10], 0xfffffffe
mov dword [ebp - 0x1a40], 0x8d36fbc6
mov dword [ebp - 0x544], 0
jmp 0x407997
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 1
jge 0x4079b9
push dword [ebp - 0x544]
lea ecx, [ebp - 0x1860]
call fcn.004148e3
mov dword [eax], 0x12def906
jmp 0x40798a
push 0
lea ecx, [ebp - 0x1860]
call fcn.004148e3
mov dword [ebp - 0x1730], 2
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x1730], eax
jg 0x4079e7
mov dword [ebp - 0xe00], 1
jmp 0x4079ee
and dword [ebp - 0xe00], 0
cmp dword [ebp - 0xe00], 0xfffb
ja 0x407a06
mov dword [ebp - 0xe08], 1
jmp 0x407a0d
and dword [ebp - 0xe08], 0
mov dword [ebp - 0x1738], 0xbdae4f9d
mov esi, dword [ebp - 0x1738]
push 0
lea ecx, [ebp - 0x1860]
call fcn.004148e3
mov ecx, dword [ebp - 0xe08]
imul ecx, dword [eax]
cmp esi, ecx
jle 0x407a43
mov dword [ebp - 0x1740], 1
jmp 0x407a4a
and dword [ebp - 0x1740], 0
mov eax, dword [ebp - 0x1740]
mov dword [ebp - 0xe10], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x2248], eax
mov eax, dword [ebp - 0xe10]
mov dword [ebp - 0x2250], eax
mov eax, 0xd015b01d
cmp eax, 0xd9935ff5
jb 0x407a83
mov dword [ebp - 0x1748], 1
jmp 0x407a8a
and dword [ebp - 0x1748], 0
push 0
lea ecx, [ebp - 0x1860]
call fcn.004148e3
mov ecx, dword [ebp - 0x1748]
cmp ecx, dword [eax]
je 0x407aad
mov dword [ebp - 0x1978], 1
jmp 0x407ab4
and dword [ebp - 0x1978], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x2258], eax
cmp dword [ebp - 0x54], 0x25e4
jl 0x407ad2
mov dword [ebp - 0xe18], 1
jmp 0x407ad9
and dword [ebp - 0xe18], 0
cmp dword [ebp - 0xe18], 0xfff7
jae 0x407af1
mov dword [ebp - 0x1750], 1
jmp 0x407af8
and dword [ebp - 0x1750], 0
cmp dword [ebp - 0x1750], 0xb3bf
jl 0x407b10
mov dword [ebp - 0xe20], 1
jmp 0x407b17
and dword [ebp - 0xe20], 0
mov eax, dword [ebp - 0xe20]
neg eax
je 0x407b3f
push 0
lea ecx, [ebp - 0x1860]
call fcn.004148e3
cmp dword [eax], 0
je 0x407b3f
mov dword [ebp - 0x1758], 1
jmp 0x407b46
and dword [ebp - 0x1758], 0
mov eax, dword [ebp - 0x1758]
mov dword [ebp - 0x1a40], eax
mov byte [ebp - 0x1f5], 0
movzx eax, byte [ebp - 0x1f5]
test eax, eax
je 0x407b6e
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
lea ecx, [ebp - 0x1860]
call fcn.004148c7
jmp 0x407bf1
mov dword [ebp - 0x65c], 0
jmp 0x407b94
mov eax, dword [ebp - 0x65c]
inc eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 3
jge 0x407bb0
mov eax, dword [ebp - 0x65c]
mov dword [ebp + eax*4 - 0x251c], 0x5c526587
jmp 0x407b87
mov dword [ebp - 0x54], 0xfffffff0
jmp 0x407bc0
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x26
jg 0x407bf1
mov dword [ebp - 0x738], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x738]
mov dword [ebp + eax - 0x251c], ecx
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x738], eax
jmp 0x407bb9
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1980], eax
push 4
lea ecx, [ebp - 0x464]
call fcn.004147f5
mov dword [ebp - 0x3b0], 0x48bbca63
mov dword [ebp - 0x3b0], 0
jmp 0x407c2a
mov eax, dword [ebp - 0x3b0]
dec eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0xfffffffa
jl 0x407c5f
mov byte [ebp - 0x25a], 0
movzx eax, byte [ebp - 0x25a]
test eax, eax
je 0x407c52
push 0x1901
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
cmp dword [ebp - 0x3b0], 0
je 0x407c5d
jmp 0x407c5f
jmp 0x407c1d
mov dword [ebp - 0x54c], 0x39ed
mov dword [ebp - 0xe30], 0xfffffffe
mov dword [ebp - 0x1e90], 0x16542076
mov dword [ebp - 0x1e8c], 0x16542076
mov dword [ebp - 0x1e88], 0x16542076
mov dword [ebp - 0x1e84], 0x16542076
lea ecx, [ebp - 0x811]
call fcn.004148f2
push eax
lea eax, [ebp - 0x1e80]
push eax
lea eax, [ebp - 0x1e90]
push eax
lea ecx, [ebp - 0x25d4]
call fcn.004148f5
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2330]
call fcn.004148a1
mov dword [ebp - 0x1a48], 0x75158018
mov dword [ebp - 0x174], 0
jmp 0x407cf3
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 4
jge 0x407d0f
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x25ec], 0xfffffffb
jmp 0x407ce6
mov dword [ebp - 0x174], 0
jmp 0x407d28
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jge 0x407d44
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x1e40], 0x350d8af8
jmp 0x407d1b
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0xe28], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xe28]
mov dword [ebp + eax - 0x25ec], ecx
mov eax, dword [ebp - 0x54c]
cmp dword [ebp - 0xe28], eax
jl 0x407d7c
mov dword [ebp - 0x1760], 1
jmp 0x407d83
and dword [ebp - 0x1760], 0
mov eax, dword [ebp - 0x54c]
cmp eax, dword [ebp - 0x1760]
jl 0x407d9d
mov dword [ebp - 0x1768], 1
jmp 0x407da4
and dword [ebp - 0x1768], 0
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0xe30], eax
mov eax, dword [ebp - 0xe30]
mov ecx, dword [ebp - 0x1768]
add ecx, 0x7211de51
add eax, ecx
cmp eax, 0xb64fda7e
jae 0x407dd7
mov dword [ebp - 0xe38], 1
jmp 0x407dde
and dword [ebp - 0xe38], 0
cmp dword [ebp - 0xe38], 0xa326
jge 0x407df6
mov dword [ebp - 0x1770], 1
jmp 0x407dfd
and dword [ebp - 0x1770], 0
cmp dword [ebp - 0x1770], 0
je 0x407e12
mov dword [ebp - 0x85c], 1
jmp 0x407e19
and dword [ebp - 0x85c], 0
push 1
lea ecx, [ebp - 0x2330]
call fcn.004148e3
mov ecx, dword [ebp - 0x85c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0x1a48], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e40]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1e40], eax
lea ecx, [ebp - 0x2330]
call fcn.004148c7
mov dword [ebp - 0x184], 0xffffffff
mov dword [ebp - 0x10c], 0xba76aabe
mov dword [ebp - 0xe5c], 0x66fa4bc4
mov dword [ebp - 0x604], 0
jmp 0x407e97
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 4
jge 0x407eb3
mov eax, dword [ebp - 0x604]
mov dword [ebp + eax*4 - 0x1d10], 1
jmp 0x407e8a
mov dword [ebp - 0x10c], 3
jmp 0x407ecc
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jl 0x408447
mov dword [ebp - 0xe84], 0x3d12ef61
mov dword [ebp - 0x13c], 0
jmp 0x407efc
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x407f18
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x8a0], 1
jmp 0x407eef
mov dword [ebp - 0x13c], 0
jmp 0x407f31
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x407f4d
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x2534], 0x4aba13e9
jmp 0x407f24
mov byte [ebp - 0x1e0], 0
movzx eax, byte [ebp - 0x1e0]
test eax, eax
je 0x407f75
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x8a0], 3
jmp 0x407fa0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8a0]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x8a0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x8a0], 0
jl 0x408442
mov dword [ebp - 0x20c], 0xefa20bd0
mov dword [ebp - 0x2e8], 0x825062d7
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x1a50], 0
mov dword [ebp - 0x20c], 0
jmp 0x407ff4
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 3
jg 0x408353
mov dword [ebp - 0x740], 0
mov dword [ebp - 0x7e8], 0xffffffff
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x2e8], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x20c]
je 0x408041
cmp dword [ebp - 0x2e8], 0
je 0x408041
mov dword [ebp - 0x1778], 1
jmp 0x408048
and dword [ebp - 0x1778], 0
mov eax, dword [ebp - 0x1778]
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x2260], eax
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x20c]
cmp dword [ebp + eax*4 - 0x1d10], ecx
jg 0x408081
mov dword [ebp - 0xe44], 1
jmp 0x408088
and dword [ebp - 0xe44], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d10]
imul eax, dword [ebp - 0xe44]
cmp eax, 0xfffffff9
je 0x4080ad
mov dword [ebp - 0x1338], 1
jmp 0x4080b4
and dword [ebp - 0x1338], 0
cmp dword [ebp - 0x1338], 0xfffffff8
jbe 0x4080c9
mov dword [ebp - 0xe4c], 1
jmp 0x4080d0
and dword [ebp - 0xe4c], 0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0xe4c], eax
je 0x4080ea
mov dword [ebp - 0x133c], 1
jmp 0x4080f1
and dword [ebp - 0x133c], 0
mov eax, dword [ebp - 0x133c]
mov dword [ebp - 0x7e8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d10]
cmp dword [ebp - 0x7e8], eax
jne 0x40811e
mov dword [ebp - 0xe54], 1
jmp 0x408125
and dword [ebp - 0xe54], 0
cmp dword [ebp - 0xe54], 0xaccb24ce
jb 0x408140
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x8a0], 0
je 0x408158
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8a0]
mov dword [ebp - 0xe5c], eax
jmp 0x40834e
mov dword [ebp - 0x554], 0
jmp 0x408171
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 1
jge 0x40818d
mov eax, dword [ebp - 0x554]
mov dword [ebp + eax*4 - 0x68c], 0xffff
jmp 0x408164
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x68c], 0
je 0x40825f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1d10], 0
je 0x40823e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x68c], 0x1d4d
jl 0x4081d4
mov dword [ebp - 0x15b0], 1
jmp 0x4081db
and dword [ebp - 0x15b0], 0
mov eax, dword [ebp - 0x15b0]
sub eax, dword [ebp - 0x214]
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0x740]
imul eax, dword [ebp - 0xe5c]
push 4
pop ecx
shl ecx, 1
cmp dword [ebp + ecx - 0x8a0], eax
jg 0x40821d
mov eax, 0x6dfe5350
test eax, eax
je 0x40821d
mov dword [ebp - 0x1344], 1
jmp 0x408224
and dword [ebp - 0x1344], 0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0x1344], eax
jne 0x40823e
mov dword [ebp - 0xe64], 1
jmp 0x408245
and dword [ebp - 0xe64], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xe64], eax
jl 0x40825f
mov dword [ebp - 0x15b4], 1
jmp 0x408266
and dword [ebp - 0x15b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x15b4]
sub ecx, dword [ebp + eax - 0x68c]
cmp ecx, dword [ebp - 0x214]
jl 0x40828d
mov dword [ebp - 0xe6c], 1
jmp 0x408294
and dword [ebp - 0xe6c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8a0]
add eax, dword [ebp - 0xe6c]
cmp eax, 0xffff
jae 0x4082b9
mov dword [ebp - 0x134c], 1
jmp 0x4082c0
and dword [ebp - 0x134c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x68c]
cmp dword [ebp - 0x134c], eax
je 0x4082e1
mov dword [ebp - 0x1988], 1
jmp 0x4082e8
and dword [ebp - 0x1988], 0
cmp dword [ebp - 0x214], 0
jne 0x40830a
mov eax, dword [ebp - 0x10c]
cmp dword [ebp + eax*4 - 0x1d10], 0
jne 0x40830a
and dword [ebp - 0xe74], 0
jmp 0x408314
mov dword [ebp - 0xe74], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8a0]
add eax, dword [ebp - 0xe74]
cmp eax, dword [ebp - 0x214]
jle 0x40833b
mov dword [ebp - 0x16f0], 1
jmp 0x408342
and dword [ebp - 0x16f0], 0
mov eax, dword [ebp - 0x16f0]
mov dword [ebp - 0x7e8], eax
jmp 0x407fe7
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x214], eax
je 0x40836d
mov dword [ebp - 0xe7c], 1
jmp 0x408374
and dword [ebp - 0xe7c], 0
mov eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0xe7c]
jg 0x40838e
mov dword [ebp - 0x1354], 1
jmp 0x408395
and dword [ebp - 0x1354], 0
mov eax, dword [ebp - 0x1a50]
mov dword [ebp - 0x2268], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8a0]
add eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x1354], eax
jne 0x4083c7
mov dword [ebp - 0x15bc], 1
jmp 0x4083ce
and dword [ebp - 0x15bc], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0xe84], eax
mov eax, dword [ebp - 0xe84]
cmp eax, dword [ebp - 0x15bc]
jne 0x4083f4
mov dword [ebp - 0x1990], 1
jmp 0x4083fb
and dword [ebp - 0x1990], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x2270], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d10]
add eax, 0xde8e
mov dword [ebp - 0xe8c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe8c]
mov dword [ebp + eax - 0x2534], ecx
mov eax, dword [ebp - 0xe8c]
mov dword [ebp - 0x2e8], eax
jmp 0x407f87
jmp 0x407ebf
mov dword [ebp - 0x1a14], 1
mov dword [ebp - 0xcc], 0xfffffffd
mov dword [ebp - 0x135c], 0x37182abb
mov dword [ebp - 0x41c], 0xc520ea0c
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x2278], eax
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xcc], eax
je 0x408495
mov dword [ebp - 0x16ec], 1
jmp 0x40849c
and dword [ebp - 0x16ec], 0
cmp dword [ebp - 0x135c], 0x627f5e24
je 0x4084b4
mov dword [ebp - 0xe94], 1
jmp 0x4084bb
and dword [ebp - 0xe94], 0
mov eax, dword [ebp - 0x135c]
cmp eax, dword [ebp - 0xe94]
jle 0x4084d5
mov dword [ebp - 0xe9c], 1
jmp 0x4084dc
and dword [ebp - 0xe9c], 0
mov eax, dword [ebp - 0x16ec]
add eax, dword [ebp - 0xe9c]
add eax, dword [ebp - 0xcc]
cmp eax, 0xfffffffe
jae 0x4084ff
mov dword [ebp - 0x1364], 1
jmp 0x408506
and dword [ebp - 0x1364], 0
mov eax, dword [ebp - 0x1364]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x2280], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x41c], 0
jmp 0x408543
mov eax, dword [ebp - 0x41c]
dec eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0xfffffffb
jge 0x4085c8
mov dword [ebp - 0xcc], 0
jmp 0x408565
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffeb
jne 0x4085c3
mov byte [ebp - 0x25c], 0
movzx eax, byte [ebp - 0x25c]
test eax, eax
je 0x40858f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov byte [ebp - 0x1e2], 0
movzx eax, byte [ebp - 0x1e2]
test eax, eax
je 0x4085c1
push 0
push 0x89c
push 0x22b4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
jmp 0x408558
jmp 0x408536
mov dword [ebp - 0x55c], 0
jmp 0x4085e1
mov eax, dword [ebp - 0x55c]
inc eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 4
jge 0x408603
push dword [ebp - 0x55c]
lea ecx, [ebp - 0x464]
call fcn.004148e3
mov dword [eax], 0xcde9e843
jmp 0x4085d4
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0x328], 0x9a97
mov dword [ebp - 0x748], 0xffffffff
mov dword [ebp - 0xf4], 0
jmp 0x40863a
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xffffffef
jg 0x4086ab
mov dword [ebp - 0x60c], 1
mov dword [ebp - 0x1998], 0xf499
mov dword [ebp - 0x60c], 0
jmp 0x408670
mov eax, dword [ebp - 0x60c]
dec eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0xfffffff8
jge 0x4086a9
mov dword [ebp - 0x1a58], 0x4ddbc370
mov eax, dword [ebp - 0x1a58]
mov dword [ebp - 0x2288], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x1998], eax
jmp 0x408663
jmp 0x40862d
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x2290], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x2298], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x22a0], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x22a8], eax
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x22b0], eax
mov eax, dword [ebp - 0x328]
cmp dword [ebp - 0x328], eax
jle 0x408701
mov dword [ebp - 0xea4], 1
jmp 0x408708
and dword [ebp - 0xea4], 0
cmp dword [ebp - 0xea4], 5
jb 0x40871d
mov dword [ebp - 0x15c4], 1
jmp 0x408724
and dword [ebp - 0x15c4], 0
mov eax, dword [ebp - 0x328]
cmp dword [ebp - 0x15c4], eax
jge 0x408747
cmp dword [ebp - 0xf4], 0
je 0x408747
mov dword [ebp - 0x1a60], 1
jmp 0x40874e
and dword [ebp - 0x1a60], 0
push 3
pop eax
sub eax, 0x6f49c23e
cmp eax, dword [ebp - 0x748]
je 0x40876a
mov dword [ebp - 0xeac], 1
jmp 0x408771
and dword [ebp - 0xeac], 0
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0xeac]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
je 0x4087a3
xor eax, eax
inc eax
je 0x4087a3
mov dword [ebp - 0x136c], 1
jmp 0x4087aa
and dword [ebp - 0x136c], 0
cmp dword [ebp - 0x136c], 0x3e86f8c7
jne 0x4087c2
mov dword [ebp - 0xeb4], 1
jmp 0x4087c9
and dword [ebp - 0xeb4], 0
mov eax, dword [ebp - 0xeb4]
inc eax
je 0x4087e7
cmp dword [ebp - 0x2dc], 0
je 0x4087e7
mov dword [ebp - 0x177c], 1
jmp 0x4087ee
and dword [ebp - 0x177c], 0
mov eax, dword [ebp - 0x177c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x38], 0
jmp 0x408810
cmp dword [ebp - 0x38], 3
jg 0x40b5d9
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x1ae0], 0x503ecef3
mov dword [ebp - 0x2f0], 0xed15de05
mov dword [ebp - 0xeec], 2
mov dword [ebp - 0x348], 0x2215256e
mov dword [ebp - 0xecc], 0xf05f4326
mov dword [ebp - 0xed4], 1
mov dword [ebp - 0x19a0], 0x7da19ae8
mov dword [ebp - 0x564], 0
jmp 0x408880
mov eax, dword [ebp - 0x564]
inc eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 1
jge 0x40889c
mov eax, dword [ebp - 0x564]
mov dword [ebp + eax*4 - 0x137c], 0x23e93d0b
jmp 0x408873
mov eax, dword [ebp - 0x2f0]
cmp dword [ebp - 0x2f0], eax
jl 0x4088b6
mov dword [ebp - 0xec4], 1
jmp 0x4088bd
and dword [ebp - 0xec4], 0
mov eax, dword [ebp - 0x2f0]
cmp dword [ebp - 0x2f0], eax
jge 0x4088d7
mov dword [ebp - 0xebc], 1
jmp 0x4088de
and dword [ebp - 0xebc], 0
cmp dword [ebp - 0xebc], 0x5d9b4e94
jl 0x4088f6
mov dword [ebp - 0x1374], 1
jmp 0x4088fd
and dword [ebp - 0x1374], 0
mov eax, dword [ebp - 0x2f0]
mov ecx, dword [ebp - 0x2f0]
add ecx, dword [ebp - 0x1374]
sub eax, ecx
sub eax, dword [ebp - 0xeec]
cmp dword [ebp - 0xec4], eax
jl 0x40892b
mov dword [ebp - 0x15cc], 1
jmp 0x408932
and dword [ebp - 0x15cc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x15cc]
sub ecx, dword [ebp + eax - 0x137c]
add ecx, 0xffff
mov dword [ebp - 0x348], ecx
mov dword [ebp - 0x348], 0xd
jmp 0x40896a
mov eax, dword [ebp - 0x348]
dec eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0xa
je 0x408acb
mov dword [ebp - 0x2f8], 0x48a2
mov eax, dword [ebp - 0x2f8]
dec eax
mov dword [ebp - 0x2f8], eax
jne 0x40899d
mov eax, 0xc39d
test eax, eax
je 0x408a7f
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0xecc], eax
cmp dword [ebp - 0xecc], 0
jne 0x4089be
mov dword [ebp - 0xedc], 1
jmp 0x4089c5
and dword [ebp - 0xedc], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x22b8], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0xed4], eax
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x137c], 0x4dcd
cmp dword [ebp - 0xed4], eax
je 0x408a02
mov dword [ebp - 0x16f4], 1
jmp 0x408a09
and dword [ebp - 0x16f4], 0
cmp dword [ebp - 0x16f4], 8
jne 0x408a1e
mov dword [ebp - 0x1384], 1
jmp 0x408a25
and dword [ebp - 0x1384], 0
mov eax, dword [ebp - 0xedc]
imul eax, dword [ebp - 0x1384]
test eax, eax
jne 0x408a42
mov dword [ebp - 0xee4], 1
jmp 0x408a49
and dword [ebp - 0xee4], 0
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0xee4], eax
jge 0x408a63
mov dword [ebp - 0x15d4], 1
jmp 0x408a6a
and dword [ebp - 0x15d4], 0
cmp dword [ebp - 0x15d4], 0
jbe 0x408a7f
mov dword [ebp - 0x138c], 1
jmp 0x408a86
and dword [ebp - 0x138c], 0
mov eax, dword [ebp - 0xeec]
imul eax, dword [ebp - 0x138c]
mov dword [ebp - 0x19a0], eax
mov byte [ebp - 0x25e], 0
movzx eax, byte [ebp - 0x25e]
test eax, eax
je 0x408ac6
push 0
push 0
push 0x24d5
push 0x1c18
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jmp 0x40895d
push dword [ebp - 0x38]
lea ecx, [ebp - 0x464]
call fcn.004148e3
cmp dword [eax], 0
je 0x408afd
push dword [ebp - 0x38]
lea ecx, [ebp - 0x464]
call fcn.004148e3
cmp dword [eax], 0
je 0x408afd
mov dword [ebp - 0xef4], 1
jmp 0x408b04
and dword [ebp - 0xef4], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x464]
call fcn.004148e3
mov ecx, dword [ebp - 0xef4]
cmp ecx, dword [eax]
jge 0x408b28
mov dword [ebp - 0x17c4], 1
jmp 0x408b2f
and dword [ebp - 0x17c4], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x464]
call fcn.004148e3
mov ecx, dword [ebp - 0x17c4]
add ecx, dword [eax]
jne 0x408b53
mov dword [ebp - 0xefc], 1
jmp 0x408b5a
and dword [ebp - 0xefc], 0
mov eax, dword [ebp - 0xefc]
mov dword [ebp - 0x44], eax
mov esi, dword [ebp - 0x44]
push 3
lea ecx, [ebp - 0x464]
call fcn.004148e3
cmp esi, dword [eax]
jle 0x408b83
mov dword [ebp - 0x1a68], 1
jmp 0x408b8a
and dword [ebp - 0x1a68], 0
mov dword [ebp - 0x98], 8
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x22c0], eax
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x22c8], eax
push 0
lea ecx, [ebp - 0x464]
call fcn.004148e3
push 2
pop eax
test eax, eax
je 0x408bd5
cmp dword [ebp - 0x98], 0
je 0x408bd5
mov dword [ebp - 0x1394], 1
jmp 0x408bdc
and dword [ebp - 0x1394], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x464]
call fcn.004148e3
mov ecx, dword [ebp - 0x1394]
cmp ecx, dword [eax]
jge 0x408c00
mov dword [ebp - 0xf04], 1
jmp 0x408c07
and dword [ebp - 0xf04], 0
cmp dword [ebp - 0xf04], 0
jl 0x408c1c
mov dword [ebp - 0x15dc], 1
jmp 0x408c23
and dword [ebp - 0x15dc], 0
push 3
lea ecx, [ebp - 0x464]
call fcn.004148e3
mov ecx, dword [ebp - 0x15dc]
cmp ecx, dword [eax]
jg 0x408c46
mov dword [ebp - 0x19a8], 1
jmp 0x408c4d
and dword [ebp - 0x19a8], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x464]
call fcn.004148e3
mov eax, dword [eax]
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0x197cbb40
jne 0x408c7b
mov dword [ebp - 0xf0c], 1
jmp 0x408c82
and dword [ebp - 0xf0c], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x464]
call fcn.004148e3
mov eax, dword [eax]
cmp eax, dword [ebp - 0xf0c]
jne 0x408ca6
mov dword [ebp - 0x139c], 1
jmp 0x408cad
and dword [ebp - 0x139c], 0
mov eax, dword [ebp - 0x139c]
sub eax, 0xa
je 0x40aae4
push 2
lea ecx, [ebp - 0x1ddc]
call fcn.004147f5
mov dword [ebp - 0x2ac], 1
push 2
lea ecx, [ebp - 0x1d4c]
call fcn.004147f5
mov dword [ebp - 0x1a70], 0xacb314b8
mov dword [ebp - 0x664], 0
jmp 0x408d03
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 2
jge 0x408d25
push dword [ebp - 0x664]
lea ecx, [ebp - 0x1d4c]
call fcn.004148e3
mov dword [eax], 0x49f845d8
jmp 0x408cf6
mov dword [ebp - 0x2ac], 0xffffffec
jmp 0x408d3e
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0x1a
jne 0x409142
mov dword [ebp - 0x3b8], 0
mov dword [ebp - 0x19b0], 0x7c1abdf
mov dword [ebp - 0x2a4], 0x1e2cd849
mov dword [ebp - 0x3b8], 0
jmp 0x408d82
mov eax, dword [ebp - 0x3b8]
dec eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0xffffffec
jle 0x40913d
mov dword [ebp - 0x330], 0
mov dword [ebp - 0x330], 1
jmp 0x408db2
cmp dword [ebp - 0x330], 0
jl 0x409138
mov dword [ebp - 0x29c], 0xfc3938dd
mov dword [ebp - 0x19b8], 5
mov dword [ebp - 0x29c], 0
jmp 0x408dec
cmp dword [ebp - 0x29c], 1
jg 0x4090e5
jmp 0x408d75
jmp 0x408d31
lea ecx, [ebp - 0x1d4c]
call fcn.004148c7
mov dword [ebp - 0x614], 0
jmp 0x409166
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 2
jge 0x409188
push dword [ebp - 0x614]
lea ecx, [ebp - 0x1ddc]
call fcn.004148e3
mov dword [eax], 0x8b9db5df
jmp 0x409159
mov dword [ebp - 0x44], 0
jmp 0x409198
cmp dword [ebp - 0x44], 2
jne 0x409573
mov dword [ebp - 0x22d0], 0
mov byte [ebp - 0x1e6], 0
movzx eax, byte [ebp - 0x1e6]
test eax, eax
je 0x4091e6
push 0x19a6
push 0x23b4
push 0x1141
push 0x1069
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
mov byte [ebp - 0x262], 0
movzx eax, byte [ebp - 0x262]
test eax, eax
je 0x409200
mov dword [ebp - 0x245c], 0xba6b42be
mov dword [ebp - 0xf54], 1
mov dword [ebp - 0x144], 0
jmp 0x4095a0
cmp dword [ebp - 0x144], 1
jge 0x4095bc
mov dword [ebp - 0x10f4], 0x66802143
mov dword [ebp - 0x1b8c], 1
mov dword [ebp - 0x5a4], 0
jmp 0x40ab11
mov eax, dword [ebp - 0x5a4]
inc eax
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 3
jge 0x40ab2d
mov eax, dword [ebp - 0x5a4]
mov dword [ebp + eax*4 - 0x1848], 1
jmp 0x40ab04
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1848], 0xfffffff4
jmp 0x40ab5b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1848], 0x1a
je 0x40ae66
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0x674], 0
jmp 0x40ab92
mov eax, dword [ebp - 0x674]
inc eax
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 3
jge 0x40abae
mov eax, dword [ebp - 0x674]
mov dword [ebp + eax*4 - 0x1c18], 0x3eb905d0
jmp 0x40ab85
mov dword [ebp - 0xe8], 2
jmp 0x40abc7
cmp dword [ebp - 0xe8], 0
jl 0x40ae40
mov dword [ebp - 0x180], 0xd0d3f7bf
mov dword [ebp - 0x1ad0], 0xaa9dade6
mov byte [ebp - 0x1ec], 0
movzx eax, byte [ebp - 0x1ec]
test eax, eax
je 0x40ac10
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x180], 0
jmp 0x40ac29
mov byte [ebp - 0x268], 0
movzx eax, byte [ebp - 0x268]
test eax, eax
je 0x40ae61
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x40ab40
mov byte [ebp - 0x1ee], 0
movzx eax, byte [ebp - 0x1ee]
test eax, eax
je 0x40b066
mov dword [ebp - 0x1e38], 0x2d14
mov dword [ebp - 0x1e34], 0x2d14
mov dword [ebp - 0x1e30], 0x2d14
mov dword [ebp - 0x1e2c], 0x2d14
mov dword [ebp - 0x10dc], 0xd1e814b7
mov dword [ebp - 0x2e4], 2
mov dword [ebp - 0x768], 0xfdad
mov dword [ebp - 0x10cc], 0xd5d08818
mov dword [ebp - 0x1734], 0
mov dword [ebp - 0x5ac], 0
jmp 0x40aeef
mov eax, dword [ebp - 0x5ac]
inc eax
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 2
jge 0x40af0b
mov eax, dword [ebp - 0x5ac]
mov dword [ebp + eax*4 - 0x1e20], 0x6eb6b9dd
jmp 0x40aee2
mov eax, dword [ebp - 0x768]
inc eax
mov dword [ebp - 0x768], eax
jne 0x40af2c
cmp dword [ebp - 0x2e4], 0
jne 0x40af2c
and dword [ebp - 0x1484], 0
jmp 0x40af36
mov dword [ebp - 0x1484], 1
cmp dword [ebp - 0x2e4], 0x21
jl 0x40af4b
mov dword [ebp - 0x860], 1
jmp 0x40af52
and dword [ebp - 0x860], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x860]
mov dword [ebp + eax - 0x1e20], ecx
mov eax, dword [ebp - 0x10cc]
cmp dword [ebp - 0x860], eax
je 0x40af7f
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2090], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x2274], eax
cmp dword [ebp - 0x98], 0xfffffff9
jae 0x40b090
mov dword [ebp - 0x1ad8], 1
jmp 0x40b097
and dword [ebp - 0x1ad8], 0
cmp dword [ebp - 0x44], 0xe516
jl 0x40b0ac
mov dword [ebp - 0x1654], 1
jmp 0x40b0b3
and dword [ebp - 0x1654], 0
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x1654]
je 0x40b0d0
cmp dword [ebp - 0x44], 0
je 0x40b0d0
mov dword [ebp - 0x10ec], 1
jmp 0x40b0d7
and dword [ebp - 0x10ec], 0
mov eax, dword [ebp - 0x1ae0]
cmp dword [ebp - 0x10ec], eax
jg 0x40b0f1
mov dword [ebp - 0x1a44], 1
jmp 0x40b0f8
and dword [ebp - 0x1a44], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2098], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x148c], eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x464]
call fcn.004148e3
mov ecx, dword [ebp - 0x148c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148c]
mov dword [ebp - 0x10f4], eax
mov eax, dword [ebp - 0x10f4]
imul eax, dword [ebp - 0x1b8c]
cmp eax, dword [ebp - 0x184]
jl 0x40b150
lea ecx, [ebp - 0x464]
call fcn.004148c7
push 3
lea ecx, [ebp - 0x2370]
call fcn.004147f5
mov dword [ebp - 0x5bc], 0xffffffff
mov dword [ebp - 0x227c], 0x91f782a1
mov dword [ebp - 0x6b4], 0
jmp 0x40b61e
mov eax, dword [ebp - 0x6b4]
inc eax
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 3
jge 0x40b63d
push dword [ebp - 0x6b4]
lea ecx, [ebp - 0x2370]
call fcn.004148e3
and dword [eax], 0
jmp 0x40b611
mov dword [ebp - 0x5bc], 2
jmp 0x40b656
mov eax, dword [ebp - 0x5bc]
dec eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0
jl 0x40b6a1
mov byte [ebp - 0x26a], 0
movzx eax, byte [ebp - 0x26a]
test eax, eax
je 0x40b67b
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov byte [ebp - 0x26c], 0
movzx eax, byte [ebp - 0x26c]
test eax, eax
je 0x40b69f
push 0x120d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x40b649
mov byte [ebp - 0x1f2], 0
movzx eax, byte [ebp - 0x1f2]
test eax, eax
je 0x40b6e0
push 0x1835
push 0x80d
push 0x16f5
push 0x1df4
push 0xe41
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
lea ecx, [ebp - 0x2370]
call fcn.004148c7
mov dword [ebp - 0x2f4], 0x642c70bb
mov dword [ebp - 0x63c], 0
jmp 0x40b70e
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 1
jge 0x40b72a
mov eax, dword [ebp - 0x63c]
mov dword [ebp + eax*4 - 0x1a4c], 1
jmp 0x40b701
mov dword [ebp - 0x2f4], 0
jmp 0x40b743
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 1
jge 0x40b75f
mov eax, dword [ebp - 0x2f4]
mov dword [ebp + eax*4 - 0x1a4c], 0
jmp 0x40b736
mov dword [ebp - 0x2f4], 1
mov dword [ebp - 0x5c4], 0xea5d6c05
mov dword [ebp - 0x20a8], 0xffff
mov dword [ebp - 0x5c4], 0
jmp 0x40b796
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 0
je 0x40b7f7
mov dword [ebp - 0x67c], 0xfffffff8
mov dword [ebp - 0x67c], 0
jmp 0x40b7c2
mov eax, dword [ebp - 0x67c]
dec eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0xfffffff0
jle 0x40b7f5
mov byte [ebp - 0x26e], 0
movzx eax, byte [ebp - 0x26e]
test eax, eax
je 0x40b7f3
push 0
push 0
push 0x131
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
jmp 0x40b7b5
jmp 0x40b789
push 3
lea ecx, [ebp - 0x2384]
call fcn.004147f5
mov dword [ebp - 0x4e4], 0xffffffff
mov dword [ebp - 0x24bc], 0x91f782a1
mov dword [ebp - 0x5cc], 0
jmp 0x40b831
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 3
jge 0x40b850
push dword [ebp - 0x5cc]
lea ecx, [ebp - 0x2384]
call fcn.004148e3
and dword [eax], 0
jmp 0x40b824
mov dword [ebp - 0x4e4], 2
jmp 0x40b869
mov eax, dword [ebp - 0x4e4]
dec eax
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 0
jl 0x40b8b4
mov byte [ebp - 0x1f4], 0
movzx eax, byte [ebp - 0x1f4]
test eax, eax
je 0x40b88e
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov byte [ebp - 0x270], 0
movzx eax, byte [ebp - 0x270]
test eax, eax
je 0x40b8b2
push 0x120d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x40b85c
mov byte [ebp - 0x1f6], 0
movzx eax, byte [ebp - 0x1f6]
test eax, eax
je 0x40b8f3
push 0x1835
push 0x80d
push 0x16f5
push 0x1df4
push 0xe41
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
lea ecx, [ebp - 0x2384]
call fcn.004148c7
mov dword [ebp - 0xa0], 0xfffffff6
mov dword [ebp - 0x848], 4
mov dword [ebp - 0x4f0], 0xbc00eadd
mov dword [ebp - 0x780], 0xea90
mov dword [ebp - 0x1ccc], 0
mov dword [ebp - 0xa0], 0xffffffeb
jmp 0x40b949
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xffffffed
je 0x40bb0e
mov dword [ebp - 0x3e0], 1
mov dword [ebp - 0x778], 8
mov dword [ebp - 0x1b94], 0xfffffffb
mov dword [ebp - 0x4e8], 0
jmp 0x40b98d
mov eax, dword [ebp - 0x4e8]
inc eax
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 1
jge 0x40b9a9
mov eax, dword [ebp - 0x4e8]
mov dword [ebp + eax*4 - 0x17a4], 0xffffffff
jmp 0x40b980
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3e0]
mov dword [ebp + eax - 0x17a4], ecx
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x3e0], eax
jle 0x40b9d6
mov dword [ebp - 0x1c8c], 1
jmp 0x40b9dd
and dword [ebp - 0x1c8c], 0
mov eax, 0x392f2092
sub eax, 0x6ff609d7
neg eax
cmp eax, dword [ebp - 0x3e0]
jl 0x40b9fd
mov dword [ebp - 0x112c], 1
jmp 0x40ba04
and dword [ebp - 0x112c], 0
cmp dword [ebp - 0x112c], 0xe96f8f9e
je 0x40ba1c
mov dword [ebp - 0x14ac], 1
jmp 0x40ba23
and dword [ebp - 0x14ac], 0
mov eax, dword [ebp - 0x778]
cmp dword [ebp - 0x14ac], eax
jne 0x40ba43
mov eax, 0xffff
test eax, eax
jne 0x40ba43
and dword [ebp - 0x1134], 0
jmp 0x40ba4d
mov dword [ebp - 0x1134], 1
mov eax, dword [ebp - 0x1134]
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x20b0], eax
cmp dword [ebp - 0x778], 6
ja 0x40ba7a
mov dword [ebp - 0x1a54], 1
jmp 0x40ba81
and dword [ebp - 0x1a54], 0
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x2284], eax
mov eax, dword [ebp - 0x3e0]
cmp dword [ebp - 0x848], eax
jge 0x40baad
cmp dword [ebp - 0xa0], 0
jne 0x40baad
and dword [ebp - 0x113c], 0
jmp 0x40bab7
mov dword [ebp - 0x113c], 1
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x14b4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14b4]
mov dword [ebp + eax - 0x17a4], ecx
mov eax, dword [ebp - 0x778]
add eax, dword [ebp - 0x113c]
cmp dword [ebp - 0x14b4], eax
jge 0x40baf6
mov dword [ebp - 0x1144], 1
jmp 0x40bafd
and dword [ebp - 0x1144], 0
mov eax, dword [ebp - 0x1144]
mov dword [ebp - 0x1b94], eax
jmp 0x40b93c
mov dword [ebp - 0xa0], 0
jmp 0x40bb27
cmp dword [ebp - 0xa0], 0xfffffffb
jg 0x40bd7e
mov dword [ebp - 0x2fc], 0xd6cd5387
mov dword [ebp - 0x304], 0xe45a9172
mov dword [ebp - 0x370], 0xfffffff6
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x20b8], eax
mov eax, dword [ebp - 0x780]
dec eax
mov dword [ebp - 0x780], eax
je 0x40bbaf
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x370], eax
je 0x40bb87
mov dword [ebp - 0x166c], 1
jmp 0x40bb8e
and dword [ebp - 0x166c], 0
cmp dword [ebp - 0x166c], 0x71f8
jg 0x40bbaf
cmp dword [ebp - 0xa0], 0
je 0x40bbaf
mov dword [ebp - 0x1a5c], 1
jmp 0x40bbb6
and dword [ebp - 0x1a5c], 0
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0xa0]
imul ecx, dword [ebp - 0x370]
sub eax, ecx
cmp eax, dword [ebp - 0x370]
je 0x40bbdf
mov dword [ebp - 0x114c], 1
jmp 0x40bbe6
and dword [ebp - 0x114c], 0
mov eax, dword [ebp - 0x114c]
sub eax, dword [ebp - 0x2fc]
cmp eax, dword [ebp - 0x2fc]
jl 0x40bc06
mov dword [ebp - 0x14bc], 1
jmp 0x40bc0d
and dword [ebp - 0x14bc], 0
mov eax, dword [ebp - 0x370]
cmp dword [ebp - 0x14bc], eax
jle 0x40bc27
mov dword [ebp - 0x1154], 1
jmp 0x40bc2e
and dword [ebp - 0x1154], 0
mov dword [ebp - 0x4f0], 0x87b332e
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x1154]
shl eax, 2
cmp dword [ebp - 0x304], eax
jne 0x40bc61
mov dword [ebp - 0x1744], 1
jmp 0x40bc68
and dword [ebp - 0x1744], 0
cmp dword [ebp - 0x1744], 0x99fd
je 0x40bc80
mov dword [ebp - 0x115c], 1
jmp 0x40bc87
and dword [ebp - 0x115c], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x115c], eax
jg 0x40bca1
mov dword [ebp - 0x14c4], 1
jmp 0x40bca8
and dword [ebp - 0x14c4], 0
mov eax, dword [ebp - 0x2fc]
cmp eax, dword [ebp - 0x14c4]
je 0x40bcc2
mov dword [ebp - 0x1164], 1
jmp 0x40bcc9
and dword [ebp - 0x1164], 0
mov eax, dword [ebp - 0x1164]
dec eax
cmp eax, dword [ebp - 0x370]
jle 0x40bce4
mov dword [ebp - 0xa8], 0xfffffff9
mov dword [ebp - 0x21c], 0xfffffff7
mov dword [ebp - 0x4f8], 0xffffffff
mov dword [ebp - 0x14f4], 1
mov dword [ebp - 0xa8], 0xfffffff5
jmp 0x40bdbf
cmp dword [ebp - 0xa8], 3
jg 0x40c171
mov dword [ebp - 0x194], 0xfffffffe
mov dword [ebp - 0x36c], 0x95196ee4
mov dword [ebp - 0x37c], 0xfffffff7
cmp dword [ebp - 0x194], 0
jne 0x40be05
cmp dword [ebp - 0xa8], 0
jne 0x40be05
and dword [ebp - 0x1174], 0
jmp 0x40be0f
mov dword [ebp - 0x1174], 1
cmp dword [ebp - 0x194], 0x4d63a88e
jg 0x40be27
mov dword [ebp - 0x14cc], 1
jmp 0x40be2e
and dword [ebp - 0x14cc], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x14cc], eax
jl 0x40be48
mov dword [ebp - 0x1804], 1
jmp 0x40be4f
and dword [ebp - 0x1804], 0
mov eax, dword [ebp - 0x1174]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x1804]
jl 0x40be75
mov dword [ebp - 0x117c], 1
jmp 0x40be7c
and dword [ebp - 0x117c], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x117c], eax
jg 0x40be96
mov dword [ebp - 0x14d4], 1
jmp 0x40be9d
and dword [ebp - 0x14d4], 0
mov eax, dword [ebp - 0x14d4]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
add eax, dword [ebp - 0xa8]
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x23dc], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x20c0], eax
cmp dword [ebp - 0x36c], 0xffffffff
je 0x40bef4
mov dword [ebp - 0x1184], 1
jmp 0x40befb
and dword [ebp - 0x1184], 0
mov eax, dword [ebp - 0x21c]
cmp dword [ebp - 0x1184], eax
jg 0x40bf15
mov dword [ebp - 0x31c], 0x642c70bb
mov dword [ebp - 0x94], 0xfffffffb
mov dword [ebp - 0x7c], 0x41b66baf
push 2
lea ecx, [ebp - 0x434]
call fcn.004147f5
mov dword [ebp - 0x518], 1
mov dword [ebp - 0x228c], 0x1d584d75
mov dword [ebp - 0x500], 0
jmp 0x40c1c6
mov eax, dword [ebp - 0x500]
inc eax
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 2
jge 0x40c1e8
push dword [ebp - 0x500]
lea ecx, [ebp - 0x434]
call fcn.004148e3
mov dword [eax], 0x3b0a6d08
jmp 0x40c1b9
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x20c8], eax
cmp dword [ebp - 0x7c], 0
je 0x40c2e0
cmp dword [ebp - 0x7c], 0
jne 0x40c216
cmp dword [ebp - 0x94], 0
jne 0x40c216
and dword [ebp - 0x11d4], 0
jmp 0x40c220
mov dword [ebp - 0x11d4], 1
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x94], eax
je 0x40c237
mov dword [ebp - 0x11cc], 1
jmp 0x40c23e
and dword [ebp - 0x11cc], 0
mov eax, dword [ebp - 0x11cc]
sub eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x7c]
jl 0x40c25b
mov dword [ebp - 0x14fc], 1
jmp 0x40c262
and dword [ebp - 0x14fc], 0
mov eax, dword [ebp - 0x14fc]
sub eax, 4
jne 0x40c27c
and dword [ebp - 0x11e4], 0
imul eax, dword [ebp - 0x11e4], 0xfffffff9
sub eax, 0x703c5764
cmp eax, dword [ebp - 0x7c]
jg 0x40c304
mov dword [ebp - 0x808], 1
jmp 0x40c30b
and dword [ebp - 0x808], 0
push 0
lea ecx, [ebp - 0x434]
call fcn.004148e3
mov ecx, dword [ebp - 0x808]
mov dword [eax], ecx
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x94], 0
je 0x40c569
mov dword [ebp - 0x1a6c], 0x239f
mov dword [ebp - 0x94], 0
jmp 0x40c35c
cmp dword [ebp - 0x94], 1
jg 0x40c543
mov dword [ebp - 0x30c], 0xfffffffd
mov dword [ebp - 0x1ba4], 0xbda3fa0b
push 0
lea ecx, [ebp - 0x434]
call fcn.004148e3
push 0
lea ecx, [ebp - 0x434]
call fcn.004148e3
mov esi, eax
push 0
lea ecx, [ebp - 0x434]
call fcn.004148e3
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x40c5b8
mov dword [ebp - 0x11f4], 1
jmp 0x40c5bf
and dword [ebp - 0x11f4], 0
mov eax, dword [ebp - 0x30c]
add eax, dword [ebp - 0x11f4]
imul eax, eax, 0x78c7
cmp dword [ebp - 0x30c], eax
jne 0x40c5ee