Function at 0x1004bbcb
Capabilities:
Create directory
Enumerate gui resources
Extract resource via kernel32 functions
Get graphical window text
Get keyboard layout
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008939e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x99c
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100500b7
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x678], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6e8], eax
mov dword [ebp - 0x9c], 8
mov dword [ebp - 0xa4], 0xffffffff
push 3
lea ecx, [ebp - 0x608]
call fcn.10017f97
and dword [ebp - 4], 0
mov dword [ebp - 0x208], 0
jmp 0x1004bc46
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jge 0x1004bc68
push dword [ebp - 0x208]
lea ecx, [ebp - 0x608]
call fcn.10018004
mov dword [eax], 0xfffffff7
jmp 0x1004bc39
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x7fc], eax
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], eax
jl 0x1004bc8e
mov dword [ebp - 0x430], 1
jmp 0x1004bc95
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x1004bcbc
cmp dword [ebp - 0xa4], 0
jne 0x1004bcbc
and dword [ebp - 0x5bc], 0
jmp 0x1004bcc6
mov dword [ebp - 0x5bc], 1
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x5bc], eax
jne 0x1004bce0
mov dword [ebp - 0x5c4], 1
jmp 0x1004bce7
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x5c4], eax
jl 0x1004bd01
mov dword [ebp - 0x5dc], 1
jmp 0x1004bd08
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x9c]
sub eax, dword [ebp - 0x5dc]
cmp eax, 0xc54c9751
jb 0x1004bd27
mov dword [ebp - 0x5e4], 1
jmp 0x1004bd2e
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 0x18d
jg 0x1004bd46
mov dword [ebp - 0x5d8], 1
jmp 0x1004bd4d
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0x5d8]
cmp eax, 0xffffffff
jge 0x1004bd6b
mov dword [ebp - 0x51c], 1
jmp 0x1004bd72
and dword [ebp - 0x51c], 0
mov esi, dword [ebp - 0x51c]
inc esi
push 2
lea ecx, [ebp - 0x608]
call fcn.10018004
mov dword [eax], esi
mov dword [ebp - 0xa4], 0xffffffeb
jmp 0x1004bda1
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x10
jl 0x1004bf55
mov dword [ebp - 0x154], 0xffffffff
mov dword [ebp - 0x674], 0x4e785c2f
mov dword [ebp - 0x68], 0
jmp 0x1004bdd2
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1004bde8
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x688], 1
jmp 0x1004bdcb
mov dword [ebp - 0x68], 0
jmp 0x1004bdf8
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1004be0e
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x694], 0x796a
jmp 0x1004bdf1
push 2
lea ecx, [ebp - 0x608]
call fcn.10018004
cmp dword [eax], 0
jne 0x1004bedd
push 2
lea ecx, [ebp - 0x608]
call fcn.10018004
mov eax, dword [eax]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x618], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x618]
mov dword [ebp + eax - 0x688], ecx
push 2
lea ecx, [ebp - 0x608]
call fcn.10018004
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x688]
mov dword [ebp - 0x7e0], eax
xor eax, eax
cmp eax, 0x43ec3e1b
jge 0x1004be8d
mov dword [ebp - 0x248], 1
jmp 0x1004be94
and dword [ebp - 0x248], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x248]
mov dword [ebp + eax - 0x688], ecx
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x248], eax
jg 0x1004bec1
mov dword [ebp - 0x66c], 1
jmp 0x1004bec8
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x7e8], eax
mov eax, 0xfffe
test eax, eax
je 0x1004bef9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x694], 0
je 0x1004bef9
mov dword [ebp - 0x2a4], 1
jmp 0x1004bf00
and dword [ebp - 0x2a4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2a4]
sub ecx, dword [ebp + eax - 0x694]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x694]
jl 0x1004bf2e
mov dword [ebp - 0x524], 1
jmp 0x1004bf35
and dword [ebp - 0x524], 0
push 2
lea ecx, [ebp - 0x608]
call fcn.10018004
mov ecx, dword [ebp - 0x524]
add ecx, dword [eax]
mov dword [ebp - 0x674], ecx
jmp 0x1004bd94
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x608]
call fcn.10017fff
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x27c], 0x2efe8e60
mov dword [ebp - 0x53c], 3
mov dword [ebp - 0x50], 0xefecf47a
push 1
lea ecx, [ebp - 0x5fc]
call fcn.10017f97
mov dword [ebp - 4], 1
mov dword [ebp - 0x6cc], 0x3f43c5ea
mov dword [ebp - 0x664], 0x1b62c3dc
mov dword [ebp - 0x1e8], 0
jmp 0x1004bfc7
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x1004bfe9
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x5fc]
call fcn.10018004
mov dword [eax], 0x2166a3c8
jmp 0x1004bfba
mov eax, dword [ebp - 0x14]
sub eax, 0x568d526d
cmp eax, dword [ebp - 0x14]
jl 0x1004c002
mov dword [ebp - 0x2ac], 1
jmp 0x1004c009
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x2ac]
jne 0x1004c020
mov dword [ebp - 0x52c], 1
jmp 0x1004c027
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x52c]
cmp eax, dword [ebp - 0x14]
jl 0x1004c141
push 4
lea ecx, [ebp - 0x8d8]
call fcn.10017f97
mov byte [ebp - 4], 2
mov dword [ebp - 0x7f0], 0xeca6d78
mov dword [ebp - 0x7f8], 0
mov dword [ebp - 0x800], 0xcb407cb0
mov dword [ebp - 0x808], 4
mov dword [ebp - 0x810], 3
mov dword [ebp - 0x6bc], 0xffffffff
mov dword [ebp - 0x15c], 0
jmp 0x1004c0a0
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 4
jge 0x1004c0bf
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x8d8]
call fcn.10018004
and dword [eax], 0
jmp 0x1004c093
mov eax, dword [ebp - 0x50]
inc eax
cmp eax, dword [ebp - 0x14]
jle 0x1004c0d4
mov dword [ebp - 0x67c], 1
jmp 0x1004c0db
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x14]
sub eax, 0xb8b0
cmp dword [ebp - 0x14], eax
jge 0x1004c0f4
mov dword [ebp - 0x2b4], 1
jmp 0x1004c0fb
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x6bc], eax
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x1004c12d
push 0
push 0xe52
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8d8]
call fcn.10017fff
jmp 0x1004c35a
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x200], 0
jmp 0x1004c161
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x1004c17d
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x6dc], 4
jmp 0x1004c154
mov dword [ebp - 0x27c], 0x8dfe9016
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x534], eax
push 0
lea ecx, [ebp - 0x5fc]
call fcn.10018004
mov ecx, dword [ebp - 0x534]
mov dword [eax], ecx
cmp dword [ebp - 0x534], 0
je 0x1004c2f1
cmp dword [ebp - 0x24], 0
jne 0x1004c25f
cmp dword [ebp - 0x24], 0
jne 0x1004c1ce
cmp dword [ebp - 0x27c], 0
je 0x1004c1e0
cmp dword [ebp - 0x24], 0
je 0x1004c1e0
mov dword [ebp - 0x6c4], 1
jmp 0x1004c1e7
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jg 0x1004c20d
mov dword [ebp - 0x2bc], 1
jmp 0x1004c214
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x6cc]
imul eax, dword [ebp - 0x2bc]
cmp eax, 0xffffffff
je 0x1004c232
mov dword [ebp - 0x6d4], 1
jmp 0x1004c239
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp - 0x53c]
cmp dword [ebp - 0x24], eax
jne 0x1004c25f
and dword [ebp - 0x284], 0
jmp 0x1004c269
mov dword [ebp - 0x284], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x284]
mov dword [ebp + eax - 0x6dc], ecx
cmp dword [ebp - 0x284], 0
jne 0x1004c297
cmp dword [ebp - 0x53c], 0
jne 0x1004c297
and dword [ebp - 0x2c4], 0
jmp 0x1004c2a1
mov dword [ebp - 0x2c4], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2c4], eax
je 0x1004c2be
cmp dword [ebp - 0x14], 0
je 0x1004c2be
mov dword [ebp - 0x544], 1
jmp 0x1004c2c5
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x544]
test eax, eax
je 0x1004c2f1
push 0
lea ecx, [ebp - 0x5fc]
call fcn.10018004
cmp dword [eax], 0
je 0x1004c2f1
mov dword [ebp - 0x2cc], 1
jmp 0x1004c2f8
and dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x2cc], 0x5ed1428a
jne 0x1004c319
mov eax, 0xe652
test eax, eax
je 0x1004c319
mov dword [ebp - 0x54c], 1
jmp 0x1004c320
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
sub eax, dword [ebp - 0x24]
imul eax, eax, 0xffff
cmp dword [ebp - 0x24], eax
jne 0x1004c340
mov dword [ebp - 0x6e4], 1
jmp 0x1004c347
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x664], 1
mov dword [ebp - 0x50], 0
jmp 0x1004c36a
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jg 0x1004c3c1
push dword [ebp - 0x50]
lea ecx, [ebp - 0x5fc]
call fcn.10018004
mov esi, eax
push dword [ebp - 0x50]
lea ecx, [ebp - 0x5fc]
call fcn.10018004
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x14], 0
jmp 0x1004c3a2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x1004c3bf
push dword [ebp - 0x50]
lea ecx, [ebp - 0x5fc]
call fcn.10018004
cmp dword [eax], 0
je 0x1004c3bd
jmp 0x1004c3bf
jmp 0x1004c39b
jmp 0x1004c363
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5fc]
call fcn.10017fff
mov dword [ebp - 0x850], 9
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1004c3f2
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x1004c41b
push 0x1883
push 0
push 0xac
push 0x1091
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [ebp - 0xac], 8
mov dword [ebp - 0x164], 0x68206240
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1004c44c
push 0x22ce
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x164], 0x13
jmp 0x1004c465
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 9
jne 0x1004c48d
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x1004c48b
push 0x73d
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x1004c458
mov dword [ebp - 0xb4], 0xffffffff
mov dword [ebp - 0xf8], 5
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x554], 0x79a7b445
push 1
lea ecx, [ebp - 0x7c4]
call fcn.10017f97
mov dword [ebp - 4], 3
mov dword [ebp - 0x118], 0x1fafbf26
mov dword [ebp - 0x1c4], 0
jmp 0x1004c4ec
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jge 0x1004c50e
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x7c4]
call fcn.10018004
mov dword [eax], 0xf8b243e5
jmp 0x1004c4df
cmp dword [ebp - 0x138], 0
je 0x1004c596
cmp dword [ebp - 0x138], 0x42af
jl 0x1004c52f
mov dword [ebp - 0x2d4], 1
jmp 0x1004c536
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x554], eax
jl 0x1004c55c
mov dword [ebp - 0x2dc], 1
jmp 0x1004c563
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0xce3051eb
jb 0x1004c57b
mov dword [ebp - 0x55c], 1
jmp 0x1004c582
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
dec eax
jne 0x1004c596
xor eax, eax
jne 0x1004c596
cmp dword [ebp - 0xf8], 0
cmp dword [ebp - 0x138], 0xffff
jne 0x1004c5ae
mov dword [ebp - 0x2e4], 1
jmp 0x1004c5b5
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0x2e4]
jne 0x1004c5d1
xor eax, eax
inc eax
jne 0x1004c5d1
and dword [ebp - 0x564], 0
jmp 0x1004c5db
mov dword [ebp - 0x564], 1
mov eax, dword [ebp - 0x564]
sub eax, dword [ebp - 0x138]
imul eax, eax, 0
cmp eax, dword [ebp - 0xf8]
jne 0x1004c5fe
mov dword [ebp - 0x2ec], 1
jmp 0x1004c605
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x2ec]
cmp eax, dword [ebp - 0xf8]
jg 0x1004c625
mov dword [ebp - 0x56c], 1
jmp 0x1004c62c
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x56c], eax
je 0x1004c646
mov dword [ebp - 0x28c], 1
jmp 0x1004c64d
and dword [ebp - 0x28c], 0
push 0
lea ecx, [ebp - 0x7c4]
call fcn.10018004
mov ecx, dword [ebp - 0x28c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x118], 0xffffffee
jmp 0x1004c687
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xd
jge 0x1004c6ac
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x1004c6aa
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x1004c67a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c4]
call fcn.10017fff
push 3
lea ecx, [ebp - 0x614]
call fcn.10017f97
mov dword [ebp - 4], 4
mov dword [ebp - 0x16c], 0
jmp 0x1004c6e8
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x1004c70a
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x614]
call fcn.10018004
mov dword [eax], 0xfffffff7
jmp 0x1004c6db
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0xac], eax
jl 0x1004c730
mov dword [ebp - 0x2f4], 1
jmp 0x1004c737
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jne 0x1004c75e
cmp dword [ebp - 0xb4], 0
jne 0x1004c75e
and dword [ebp - 0x574], 0
jmp 0x1004c768
mov dword [ebp - 0x574], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x574], eax
jne 0x1004c782
mov dword [ebp - 0x2fc], 1
jmp 0x1004c789
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x2fc], eax
jl 0x1004c7a3
mov dword [ebp - 0x57c], 1
jmp 0x1004c7aa
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0x57c]
cmp eax, 0xc54c9751
jb 0x1004c7c9
mov dword [ebp - 0x304], 1
jmp 0x1004c7d0
and dword [ebp - 0x304], 0
cmp dword [ebp - 0x304], 0x18d
jg 0x1004c7e8
mov dword [ebp - 0x584], 1
jmp 0x1004c7ef
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0xac]
imul eax, dword [ebp - 0x584]
cmp eax, 0xffffffff
jge 0x1004c80d
mov dword [ebp - 0x30c], 1
jmp 0x1004c814
and dword [ebp - 0x30c], 0
mov esi, dword [ebp - 0x30c]
inc esi
push 2
lea ecx, [ebp - 0x614]
call fcn.10018004
mov dword [eax], esi
mov dword [ebp - 0xb4], 0xffffffeb
jmp 0x1004c843
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x10
jl 0x1004cfd4
push 2
lea ecx, [ebp - 0x708]
call fcn.10017f97
mov byte [ebp - 4], 5
mov dword [ebp - 0x644], 0x2bbd4aa4
mov dword [ebp - 0x64], 0
jmp 0x1004c87b
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1004c897
push dword [ebp - 0x64]
lea ecx, [ebp - 0x708]
call fcn.10018004
mov dword [eax], 0x9f9b
jmp 0x1004c874
mov dword [ebp - 0x64], 0
jmp 0x1004c8a7
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1004c8bd
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xbc], 0x5c8094a
jmp 0x1004c8a0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xbc], 0
jmp 0x1004c8eb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc], 1
jg 0x1004ca4f
mov dword [ebp - 0x70], 0xfd94fe5f
mov dword [ebp - 0x70], 1
jmp 0x1004c916
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x1004ca4a
mov dword [ebp - 0x31c], 0xafbd13d8
mov dword [ebp - 0x5a4], 0xfffffff9
cmp dword [ebp - 0x70], 0
jne 0x1004c946
mov dword [ebp - 0x58c], 1
jmp 0x1004c94d
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x58c]
cmp eax, 0xbb00868b
je 0x1004c9a7
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xbc]
lea ecx, [ebp - 0x708]
call fcn.10018004
cmp dword [eax], 0xae28de63
jae 0x1004c98a
mov dword [ebp - 0x314], 1
jmp 0x1004c991
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x314]
neg eax
cmp eax, dword [ebp - 0x70]
jl 0x1004c9a7
and dword [ebp - 0x594], 0
jmp 0x1004c9b1
mov dword [ebp - 0x594], 1
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
je 0x1004c9d8
cmp dword [ebp - 0x70], 0
je 0x1004c9d8
mov dword [ebp - 0x59c], 1
jmp 0x1004c9df
and dword [ebp - 0x59c], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xbc]
lea ecx, [ebp - 0x708]
call fcn.10018004
mov eax, dword [eax]
cmp eax, dword [ebp - 0x59c]
jle 0x1004ca26
mov eax, 0x36dc9922
test eax, eax
je 0x1004ca26
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc], 0
je 0x1004ca26
mov dword [ebp - 0x324], 1
jmp 0x1004ca2d
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x644], eax
jmp 0x1004c90f
jmp 0x1004c8d0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x708]
call fcn.10017fff
mov dword [ebp - 0x1e4], 0xffffffff
mov dword [ebp - 0x1cc], 0x69fdf99f
mov dword [ebp - 0x1cc], 0xfffffff4
jmp 0x1004ca8b
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0xffffffea
jle 0x1004cba6
mov dword [ebp - 0x1c0], 0x6bacd795
push 4
lea ecx, [ebp - 0x770]
call fcn.10017f97
mov byte [ebp - 4], 6
mov dword [ebp - 0x174], 0
jmp 0x1004cacc
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 4
jge 0x1004caee
push dword [ebp - 0x174]
lea ecx, [ebp - 0x770]
call fcn.10018004
mov dword [eax], 0xfffffffb
jmp 0x1004cabf
mov byte [ebp - 0xef], 0
movzx eax, byte [ebp - 0xef]
test eax, eax
je 0x1004cb0c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov dword [ebp - 0x1c0], 0
jmp 0x1004cb25
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0xfffffffc
jge 0x1004cb92
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x130], 0
jmp 0x1004cb51
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 4
jge 0x1004cb73
push dword [ebp - 0x130]
lea ecx, [ebp - 0x770]
call fcn.10018004
mov dword [eax], 0x6ec79cf1
jmp 0x1004cb44
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1004cb90
push 0x2600
call dword [sym.imp.USER32.dll_GetQueueStatus]
jmp 0x1004cb18
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x770]
call fcn.10017fff
jmp 0x1004ca7e
mov dword [ebp - 0x17c], 0x69fdf99f
mov dword [ebp - 0x17c], 0xfffffff4
jmp 0x1004cbc9
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0xffffffea
jle 0x1004cce4
mov dword [ebp - 0x184], 0x6bacd795
push 4
lea ecx, [ebp - 0x7a0]
call fcn.10017f97
mov byte [ebp - 4], 7
mov dword [ebp - 0x1d4], 0
jmp 0x1004cc0a
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 4
jge 0x1004cc2c
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x7a0]
call fcn.10018004
mov dword [eax], 0xfffffffb
jmp 0x1004cbfd
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1004cc4a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov dword [ebp - 0x184], 0
jmp 0x1004cc63
mov eax, dword [ebp - 0x184]
dec eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0xfffffffc
jge 0x1004ccd0
mov dword [ebp - 0x120], 0xffffffff
mov dword [ebp - 0x120], 0
jmp 0x1004cc8f
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 4
jge 0x1004ccb1
push dword [ebp - 0x120]
lea ecx, [ebp - 0x7a0]
call fcn.10018004
mov dword [eax], 0x6ec79cf1
jmp 0x1004cc82
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x1004ccce
push 0x2600
call dword [sym.imp.USER32.dll_GetQueueStatus]
jmp 0x1004cc56
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x7a0]
call fcn.10017fff
jmp 0x1004cbbc
mov dword [ebp - 0x630], 0x4e785c2f
mov dword [ebp - 0x58], 0
jmp 0x1004ccfe
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1004cd14
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x6a8], 1
jmp 0x1004ccf7
push 4
lea ecx, [ebp - 0x8e8]
call fcn.10017f97
mov byte [ebp - 4], 8
mov dword [ebp - 0x1dc], 0
jmp 0x1004cd3e
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 4
jge 0x1004cd60
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x8e8]
call fcn.10018004
mov dword [eax], 1
jmp 0x1004cd31
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x1004cd86
push 0x3c1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1004cdb6
push 0x233
push 0x1191
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8e8]
call fcn.10017fff
mov dword [ebp - 0x58], 0
jmp 0x1004cdd5
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1004cdeb
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x6b4], 0x796a
jmp 0x1004cdce
mov dword [ebp - 0x860], 9
mov dword [ebp - 0x868], 9
push 1
lea ecx, [ebp - 0x8f8]
call fcn.10017f97
mov byte [ebp - 4], 9
mov dword [ebp - 0x32c], 0x2d8c
mov dword [ebp - 0x18c], 0
jmp 0x1004ce33
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jge 0x1004ce55
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x8f8]
call fcn.10018004
mov dword [eax], 0x37831e42
jmp 0x1004ce26
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x1004ce7e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8f8]
call fcn.10017fff
push 2
lea ecx, [ebp - 0x614]
call fcn.10018004
cmp dword [eax], 0
jne 0x1004cf5c
push 2
lea ecx, [ebp - 0x614]
call fcn.10018004
mov eax, dword [eax]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x628], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x628]
mov dword [ebp + eax - 0x6a8], ecx
push 2
lea ecx, [ebp - 0x614]
call fcn.10018004
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6a8]
mov dword [ebp - 0x870], eax
xor eax, eax
cmp eax, 0x43ec3e1b
jge 0x1004cf0c
mov dword [ebp - 0x294], 1
jmp 0x1004cf13
and dword [ebp - 0x294], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x294]
mov dword [ebp + eax - 0x6a8], ecx
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x294], eax
jg 0x1004cf40
mov dword [ebp - 0x69c], 1
jmp 0x1004cf47
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x878], eax
mov eax, 0xfffe
test eax, eax
je 0x1004cf78
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6b4], 0
je 0x1004cf78
mov dword [ebp - 0x5ac], 1
jmp 0x1004cf7f
and dword [ebp - 0x5ac], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5ac]
sub ecx, dword [ebp + eax - 0x6b4]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x6b4]
jl 0x1004cfad
mov dword [ebp - 0x5b4], 1
jmp 0x1004cfb4
and dword [ebp - 0x5b4], 0
push 2
lea ecx, [ebp - 0x614]
call fcn.10018004
mov ecx, dword [ebp - 0x5b4]
add ecx, dword [eax]
mov dword [ebp - 0x630], ecx
jmp 0x1004c836
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x614]
call fcn.10017fff
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x19c], 0x8bc8977b
mov dword [ebp - 0x3c8], 0xfffffffd
mov dword [ebp - 0x6c], 0
jmp 0x1004d00e
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1004d021
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x30], 0x4ec2
jmp 0x1004d007
mov dword [ebp - 0x6c], 0
jmp 0x1004d031
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1004d047
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x234], 0x8f381c4e
jmp 0x1004d02a
mov dword [ebp - 0x2c], 0
jmp 0x1004d057
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x1004d5a2
mov dword [ebp - 0x80], 0xc9ebf495
push 1
lea ecx, [ebp - 0x714]
call fcn.10017f97
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x10c], 0x7a140552
mov dword [ebp - 0x4a0], 0x925b974d
mov dword [ebp - 0x5d4], 0x736fa7ab
push 1
lea ecx, [ebp - 0x788]
call fcn.10017f97
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x60], 0
jmp 0x1004d0bb
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1004d0d7
push dword [ebp - 0x60]
lea ecx, [ebp - 0x714]
call fcn.10018004
mov dword [eax], 0x9a56718e
jmp 0x1004d0b4
mov dword [ebp - 0x60], 0
jmp 0x1004d0e7
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1004d103
push dword [ebp - 0x60]
lea ecx, [ebp - 0x788]
call fcn.10018004
mov dword [eax], 0xfffffffb
jmp 0x1004d0e0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x30], 0
je 0x1004d139
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x30]
cmp dword [ebp - 0x2c], eax
jge 0x1004d125
mov dword [ebp - 0x338], 1
jmp 0x1004d12c
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x890], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
jne 0x1004d178
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x30], 0
jne 0x1004d178
and dword [ebp - 0x498], 0
jmp 0x1004d182
mov dword [ebp - 0x498], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp dword [ebp - 0x498], eax
jg 0x1004d1a0
mov dword [ebp - 0x340], 1
jmp 0x1004d1a7
and dword [ebp - 0x340], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp dword [ebp - 0x340], eax
jne 0x1004d1c8
cmp dword [ebp - 0x2c], 0
jne 0x1004d1c8
and dword [ebp - 0x548], 0
jmp 0x1004d1d2
mov dword [ebp - 0x548], 1
push 0
lea ecx, [ebp - 0x714]
call fcn.10018004
mov ecx, dword [ebp - 0x548]
cmp ecx, dword [eax]
jg 0x1004d1f5
mov dword [ebp - 0x348], 1
jmp 0x1004d1fc
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x348]
inc eax
inc eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x80], 0
jmp 0x1004d21a
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jg 0x1004d57f
mov dword [ebp - 0x388], 0xffffffff
mov dword [ebp - 0x368], 8
mov dword [ebp - 0x10c], 0
jmp 0x1004d251
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jg 0x1004d57a
mov dword [ebp - 0xc4], 0xfffffffe
mov dword [ebp - 0x398], 1
mov dword [ebp - 0x194], 0
jmp 0x1004d28b
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jge 0x1004d2a7
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x960], 0
jmp 0x1004d27e
mov dword [ebp - 0xc4], 0
jmp 0x1004d2c0
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jl 0x1004d568
mov dword [ebp - 0x1ec], 7
mov dword [ebp - 0x378], 0x8a746c20
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
inc eax
cmp eax, dword [ebp - 0x1ec]
jne 0x1004d314
mov dword [ebp - 0x350], 1
jmp 0x1004d31b
and dword [ebp - 0x350], 0
cmp dword [ebp - 0x350], 6
jge 0x1004d330
mov dword [ebp - 0x250], 1
jmp 0x1004d337
and dword [ebp - 0x250], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x250]
mov dword [ebp + eax - 0x960], ecx
mov esi, dword [ebp - 0x368]
push 0
lea ecx, [ebp - 0x714]
call fcn.10018004
imul esi, dword [eax]
cmp esi, dword [ebp - 0x250]
je 0x1004d374
mov dword [ebp - 0x5a0], 1
jmp 0x1004d37b
and dword [ebp - 0x5a0], 0
cmp dword [ebp - 0x5a0], 0xfffffff6
jle 0x1004d390
mov dword [ebp - 0x358], 1
jmp 0x1004d397
and dword [ebp - 0x358], 0
cmp dword [ebp - 0x358], 1
jae 0x1004d3ac
mov dword [ebp - 0x4a8], 1
jmp 0x1004d3b3
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x4a8], eax
jge 0x1004d3cd
mov dword [ebp - 0x360], 1
jmp 0x1004d3d4
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x378]
cmp dword [ebp - 0x360], eax
je 0x1004d3ee
mov dword [ebp - 0x550], 1
jmp 0x1004d3f5
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x550], eax
jne 0x1004d40f
mov dword [ebp - 0x4b0], 1
jmp 0x1004d416
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x368]
imul eax, dword [ebp - 0x4b0]
cmp eax, 0x5d487c75
jl 0x1004d436
mov dword [ebp - 0x370], 1
jmp 0x1004d43d
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
sub eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 0xa909f00f
jbe 0x1004d467
mov dword [ebp - 0x4b8], 1
jmp 0x1004d46e
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x378]
cmp dword [ebp - 0x4b8], eax
jle 0x1004d488
mov dword [ebp - 0x380], 1
jmp 0x1004d48f
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x380]
add eax, 0x747eab1a
cmp eax, dword [ebp - 0xc4]
jg 0x1004d4ae
mov dword [ebp - 0x558], 1
jmp 0x1004d4b5
and dword [ebp - 0x558], 0
cmp dword [ebp - 0x558], 4
jae 0x1004d4ca
mov dword [ebp - 0x4c0], 1
jmp 0x1004d4d1
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x4c0], eax
jge 0x1004d4eb
mov dword [ebp - 0x290], 1
jmp 0x1004d4f2
and dword [ebp - 0x290], 0
push 0
lea ecx, [ebp - 0x788]
call fcn.10018004
mov ecx, dword [ebp - 0x290]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x290], eax
jle 0x1004d521
mov dword [ebp - 0x390], 1
jmp 0x1004d528
and dword [ebp - 0x390], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x234]
cmp dword [ebp - 0x390], eax
jge 0x1004d549
mov dword [ebp - 0x5a8], 1
jmp 0x1004d550
and dword [ebp - 0x5a8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5a8]
mov dword [ebp + eax - 0x234], ecx
jmp 0x1004d2b3
mov eax, dword [ebp - 0x398]
dec eax
mov dword [ebp - 0x398], eax
jmp 0x1004d244
jmp 0x1004d213
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x788]
call fcn.10017fff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x714]
call fcn.10017fff
jmp 0x1004d050
cmp dword [ebp - 0x2c], 0
jne 0x1004d68c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0x91f1
jl 0x1004d5c8
mov dword [ebp - 0x3a0], 1
jmp 0x1004d5cf
and dword [ebp - 0x3a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
sub eax, 0x592b
cmp eax, dword [ebp - 0x19c]
jl 0x1004d5f2
mov dword [ebp - 0x4c8], 1
jmp 0x1004d5f9
and dword [ebp - 0x4c8], 0
cmp dword [ebp - 0x4c8], 0x7bd1
jle 0x1004d611
mov dword [ebp - 0x560], 1
jmp 0x1004d618
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x3a0]
neg ecx
sub eax, ecx
mov ecx, dword [ebp - 0x19c]
imul ecx, dword [ebp - 0x560]
push 4
pop edx
shl edx, 0
imul ecx, dword [ebp + edx - 0x234]
cmp eax, ecx
jg 0x1004d653
mov dword [ebp - 0x6a0], 1
jmp 0x1004d65a
and dword [ebp - 0x6a0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x234]
mov dword [ebp - 0x8a0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
jne 0x1004d68c
mov eax, 0xfe3a
test eax, eax
jne 0x1004d68c
and dword [ebp - 0x3a8], 0
jmp 0x1004d696
mov dword [ebp - 0x3a8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x234]
cmp dword [ebp - 0x3a8], eax
jle 0x1004d6b7
mov dword [ebp - 0x4d0], 1
jmp 0x1004d6be
and dword [ebp - 0x4d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x234]
cmp dword [ebp - 0x4d0], eax
jne 0x1004d708
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1004d703
push 0x2389
push 0x11c3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
jmp 0x1004d844
mov dword [ebp - 0x74], 0x8cb2cc2
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x8a8], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x8b0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp + eax - 0x30], ecx
jg 0x1004d73c
mov dword [ebp - 0x3b0], 1
jmp 0x1004d743
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x3b0], eax
jge 0x1004d75a
mov dword [ebp - 0x5d0], 1
jmp 0x1004d761
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x5d0]
jge 0x1004d778
mov dword [ebp - 0x3b8], 1
jmp 0x1004d77f
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3b8]
sub eax, dword [ebp - 0x19c]
cmp eax, dword [ebp - 0x74]
jge 0x1004d79c
mov dword [ebp - 0x4d8], 1
jmp 0x1004d7a3
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x4d8]
je 0x1004d7ba
mov dword [ebp - 0x3c0], 1
jmp 0x1004d7c1
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0x3c0], eax
jg 0x1004d7db
mov dword [ebp - 0x568], 1
jmp 0x1004d7e2
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x74], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x234]
cmp dword [ebp - 0x74], eax
jg 0x1004d809
mov dword [ebp - 0x4e0], 1
jmp 0x1004d810
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0x4e0], eax
jle 0x1004d82a
mov dword [ebp - 0x3d0], 1
jmp 0x1004d831
and dword [ebp - 0x3d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + eax - 0x234], ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x1a4], 0x6af1124f
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x8b8], 0xfb37b048
mov dword [ebp - 0x1b4], 0xcc58a012
mov dword [ebp - 0x20c], 0x3d783989
mov dword [ebp - 0x1ac], 0x2fbb6bc3
mov dword [ebp - 0x8c0], 0x8d383303
mov dword [ebp - 0x8c8], 3
mov dword [ebp - 0x950], 1
mov dword [ebp - 0x204], 0x4e665969
mov dword [ebp - 0x1f4], 0
jmp 0x1004d8ca
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 3
jge 0x1004d8e6
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x990], 1
jmp 0x1004d8bd
mov dword [ebp - 0x1a4], 0xfffffff7
jmp 0x1004d8ff
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0xa
jle 0x1004d9ac
mov dword [ebp - 0x824], 0xffffffff
push 2
lea ecx, [ebp - 0x908]
call fcn.10017f97
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x5b0], 9
mov dword [ebp - 0x1fc], 0
jmp 0x1004d94d
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x1004d96f
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0x908]
call fcn.10018004
mov dword [eax], 0xfffffffb
jmp 0x1004d940
mov byte [ebp - 0x98], 0
movzx eax, byte [ebp - 0x98]
test eax, eax
je 0x1004d98b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov eax, dword [ebp - 0x5b0]
inc eax
mov dword [ebp - 0x5b0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x908]
call fcn.10017fff
jmp 0x1004d8f2
mov dword [ebp - 0x140], 0
jmp 0x1004d9c5
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 2
jg 0x1004dabe
mov dword [ebp - 0x1ac], 2
jmp 0x1004d9eb
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jl 0x1004da21
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1004da1f
push 0
push 0
push 0
push 0
push 0
push 0
push 0x11e7
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1004d9de
mov dword [ebp - 0x204], 0
jmp 0x1004da3a
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
jg 0x1004da83
mov dword [ebp - 0x1b4], 0
jmp 0x1004da5c
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jg 0x1004da81
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x1004da7f
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
jmp 0x1004da4f
jmp 0x1004da2d
mov dword [ebp - 0x20c], 0
jmp 0x1004da9c
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jg 0x1004dab9
mov eax, dword [ebp - 0x140]
cmp dword [ebp + eax*4 - 0x990], 0
je 0x1004dab7
jmp 0x1004dab9
jmp 0x1004da8f
jmp 0x1004d9b8
mov dword [ebp - 0x128], 0xd3c891c5
mov dword [ebp - 0xfc], 0xfffffff6
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x110], 0xef307d7c
mov dword [ebp - 0x6d8], 7
mov dword [ebp - 0xcc], 1
mov eax, dword [ebp - 0xcc]
sub eax, dword [ebp - 0x128]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x128], 0
jmp 0x1004db25
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jl 0x1004de15
mov dword [ebp - 0x648], 0xd045
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x1004db5f
push 0x1f71
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov dword [ebp - 0x110], 0xffffffe3
jmp 0x1004db78
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 3
je 0x1004de10
mov dword [ebp - 0x1bc], 0
jmp 0x1004db9e
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 4
jge 0x1004dbba
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0x73c], 0
jmp 0x1004db91
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x73c]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xcc], 2
jmp 0x1004dbe6
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xfffffff9
je 0x1004de0b
mov dword [ebp - 0x6ac], 0x54ab
mov dword [ebp - 0xfc], 0
jmp 0x1004dc16
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jg 0x1004de06
mov dword [ebp - 0x104], 1
mov dword [ebp - 0x104], 0
jmp 0x1004dc46
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jg 0x1004de01
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x38], 3
jmp 0x1004dc6a
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1004ddfc
mov dword [ebp - 0x638], 0xfffffff8
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x73c], 0xfffffffd
jl 0x1004dc97
mov dword [ebp - 0x258], 1
jmp 0x1004dc9e
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x73c], ecx
xor eax, eax
sub eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x638]
je 0x1004dccd
mov dword [ebp - 0x3d8], 1
jmp 0x1004dcd4
and dword [ebp - 0x3d8], 0
cmp dword [ebp - 0x3d8], 0x137d
jne 0x1004dcec
mov dword [ebp - 0x4e8], 1
jmp 0x1004dcf3
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
sub eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x38]
jne 0x1004dd10
mov dword [ebp - 0x3e0], 1
jmp 0x1004dd17
and dword [ebp - 0x3e0], 0
cmp dword [ebp - 0x3e0], 0x132d
jle 0x1004dd2f
mov dword [ebp - 0x570], 1
jmp 0x1004dd36
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebp - 0x104]
cmp dword [ebp + eax*4 - 0x73c], 0x40b319b
jg 0x1004dd61
mov dword [ebp - 0x640], 1
jmp 0x1004dd68
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x7d4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x8ec], eax
cmp dword [ebp - 0x6ac], 0x79d6
je 0x1004dd9b
mov dword [ebp - 0x3e8], 1
jmp 0x1004dda2
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x648]
add eax, dword [ebp - 0x3e8]
cmp eax, 0xeed1
jle 0x1004ddc1
mov dword [ebp - 0x4f0], 1
jmp 0x1004ddc8
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0x4f0]
jne 0x1004dde2
mov dword [ebp - 0x6f8], 1
jmp 0x1004dde9
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x73c], 0xffffffff
jmp 0x1004dc63
jmp 0x1004dc39
jmp 0x1004dc09
jmp 0x1004dbd9
jmp 0x1004db6b
jmp 0x1004db18
mov dword [ebp - 0x7dc], 9
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1004de37
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1004de60
push 0x1883
push 0
push 0xac
push 0x1091
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x7c], 0x3342eb9
mov dword [ebp - 0x3f8], 0xc42ff18c
push 2
lea ecx, [ebp - 0x7b8]
call fcn.10017f97
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x6b8], 1
mov dword [ebp - 0x278], 1
mov dword [ebp - 0x418], 0x95a52772
mov dword [ebp - 0x508], 0
mov dword [ebp - 0x214], 0
jmp 0x1004decd
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 2
jge 0x1004deef
push dword [ebp - 0x214]
lea ecx, [ebp - 0x7b8]
call fcn.10018004
mov dword [eax], 0x2268f62c
jmp 0x1004dec0
mov dword [ebp - 0x7c], 0
jmp 0x1004deff
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xffffffff
jne 0x1004e0fc
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x40], 0xe
jmp 0x1004df20
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffffe
jl 0x1004e0cf
mov dword [ebp - 0x650], 5
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x7c], eax
jne 0x1004df48
mov dword [ebp - 0x500], 1
jmp 0x1004df4f
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x7c], 0
jne 0x1004df59
cmp dword [ebp - 0x40], 0
cmp dword [ebp - 0x7c], 0
je 0x1004df74
mov eax, 0x7a41
test eax, eax
je 0x1004df74
mov dword [ebp - 0x3f0], 1
jmp 0x1004df7b
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x3f0], eax
jg 0x1004df92
mov dword [ebp - 0x5e0], 1
jmp 0x1004df99
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x88c], eax
push 0
lea ecx, [ebp - 0x7b8]
call fcn.10018004
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x7c]
add ecx, 0x7b831966
imul eax, ecx
cmp eax, 0xd44f4cc5
jb 0x1004dfe9
cmp dword [ebp - 0x650], 0
je 0x1004dfe9
mov dword [ebp - 0x4f8], 1
jmp 0x1004dff0
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 1
ja 0x1004e005
mov dword [ebp - 0x400], 1
jmp 0x1004e00c
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x6b8]
cmp dword [ebp - 0x400], eax
jne 0x1004e026
mov dword [ebp - 0x578], 1
jmp 0x1004e02d
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
jne 0x1004e054
cmp dword [ebp - 0x278], 0
jne 0x1004e054
and dword [ebp - 0x408], 0
jmp 0x1004e05e
mov dword [ebp - 0x408], 1
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x408], eax
jne 0x1004e075
mov dword [ebp - 0x410], 1
jmp 0x1004e07c
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x500]
add eax, dword [ebp - 0x410]
cmp eax, 0xd065
jle 0x1004e09f
push 3
pop eax
test eax, eax
jne 0x1004e09f
and dword [ebp - 0x5b8], 0
jmp 0x1004e0a9
mov dword [ebp - 0x5b8], 1
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x508], eax
jmp 0x1004df19
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x1004e0f7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
jmp 0x1004def8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7b8]
call fcn.10017fff
mov dword [ebp - 0x1c8], 8
mov dword [ebp - 0x7e4], 0x272a7275
mov dword [ebp - 0x94c], 0xfffffff8
mov dword [ebp - 0x7ec], 0xe704f3d
push 2
lea ecx, [ebp - 0x918]
call fcn.10017f97
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x420], 0xffff
mov dword [ebp - 0x44], 0
jmp 0x1004e161
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1004e177
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x894], 0x40d7
jmp 0x1004e15a
mov dword [ebp - 0x44], 0
jmp 0x1004e187
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x1004e1a3
push dword [ebp - 0x44]
lea ecx, [ebp - 0x918]
call fcn.10018004
mov dword [eax], 0xe1f6f084
jmp 0x1004e180
mov dword [ebp - 0x1c8], 0
jmp 0x1004e1bc
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jg 0x1004e278
mov dword [ebp - 0x7f4], 0x4b25
mov dword [ebp - 0x758], 3
mov dword [ebp - 0x754], 3
mov dword [ebp - 0x750], 3
mov dword [ebp - 0x74c], 3
lea ecx, [ebp - 0x271]
call fcn.100090d3
push eax
lea eax, [ebp - 0x748]
push eax
lea eax, [ebp - 0x758]
push eax
lea ecx, [ebp - 0x998]
call fcn.10018013
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x984]
call fcn.10017fd9
mov dword [ebp - 0x8fc], 0xa4d91f06
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x1004e25b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [ebp - 0x420]
dec eax
mov dword [ebp - 0x420], eax
lea ecx, [ebp - 0x984]
call fcn.10017fff
jmp 0x1004e1af
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x1004e292
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x918]
call fcn.10017fff
mov dword [ebp - 0x158], 0x8bc8977b
mov dword [ebp - 0x4cc], 0xfffffffd
mov dword [ebp - 0x510], 0xffffffff
push 3
lea ecx, [ebp - 0x220]
call fcn.10017f97
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x260], 0xfffffff9
mov dword [ebp - 0xd4], 0x34ea
mov dword [ebp - 0x1c], 0
jmp 0x1004e2f7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1004e313
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x220]
call fcn.10018004
mov dword [eax], 0x452a
jmp 0x1004e2f0
mov dword [ebp - 0x1c], 0
jmp 0x1004e323
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1004e339
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x744], 3
jmp 0x1004e31c
mov dword [ebp - 0x1c], 0
jmp 0x1004e349
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1004e35f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6e0], 0
jmp 0x1004e342
push 1
lea ecx, [ebp - 0x220]
call fcn.10018004
cmp dword [eax], 0
jge 0x1004e37d
mov dword [ebp - 0x580], 1
jmp 0x1004e384
and dword [ebp - 0x580], 0
cmp dword [ebp - 0x510], 0
je 0x1004e3a7
push 2
lea ecx, [ebp - 0x220]
call fcn.10018004
push 1
lea ecx, [ebp - 0x220]
call fcn.10018004
push 2
lea ecx, [ebp - 0x220]
call fcn.10018004
mov esi, eax
push 1
lea ecx, [ebp - 0x220]
call fcn.10018004
mov ecx, dword [esi]
sub ecx, dword [eax]
mov dword [ebp - 0x260], ecx
mov eax, dword [ebp - 0x260]
neg eax
mov dword [ebp - 0x428], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x428]
mov dword [ebp + eax - 0x744], ecx
mov esi, dword [ebp - 0x580]
add esi, dword [ebp - 0x428]
push 1
lea ecx, [ebp - 0x220]
call fcn.10018004
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0x220]
call fcn.10018004
cmp esi, dword [eax]
jg 0x1004e426
mov dword [ebp - 0x658], 1
jmp 0x1004e42d
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x260], 0
je 0x1004e457
mov eax, 0x1dbdae4
test eax, eax
je 0x1004e457
mov dword [ebp - 0x288], 1
jmp 0x1004e45e
and dword [ebp - 0x288], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x288]
mov dword [ebp + eax - 0x6e0], ecx
push 1
lea ecx, [ebp - 0x220]
call fcn.10018004
mov ecx, dword [ebp - 0x288]
cmp ecx, dword [eax]
jg 0x1004e494
mov dword [ebp - 0x298], 1
jmp 0x1004e49b
and dword [ebp - 0x298], 0
push 0
lea ecx, [ebp - 0x220]
call fcn.10018004
mov ecx, dword [ebp - 0x298]
cmp ecx, dword [eax]
jle 0x1004e4be
mov dword [ebp - 0x5c8], 1
jmp 0x1004e4c5
and dword [ebp - 0x5c8], 0
push 1
lea ecx, [ebp - 0x220]
call fcn.10018004
mov esi, dword [ebp - 0x5c8]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x220]
call fcn.10018004
add esi, dword [eax]
neg esi
je 0x1004e50b
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1004e509
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1004e561
mov dword [ebp - 0x89c], 0x5950cfdf
mov dword [ebp - 0x804], 0xb6bd0d42
mov dword [ebp - 0x148], 0
jmp 0x1004e538
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 4
jge 0x1004e554
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x9a8], 0xfffffffd
jmp 0x1004e52b
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd4], 0
jmp 0x1004e57a
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jg 0x1004e5c1
mov dword [ebp - 0x660], 0xfffffffa
mov eax, dword [ebp - 0xd4]
cmp dword [ebp + eax*4 - 0x744], 0xd36fbc6a
jb 0x1004e5ac
mov dword [ebp - 0x438], 1
jmp 0x1004e5b3
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x660], eax
jmp 0x1004e56d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.10017fff
mov dword [ebp - 0x48], 0
jmp 0x1004e5e0
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1004e5f3
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x34], 0x4ec2
jmp 0x1004e5d9
mov dword [ebp - 0x48], 0
jmp 0x1004e603
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1004e619
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x244], 0x8f381c4e
jmp 0x1004e5fc
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xdc], 0xde661fbc
mov dword [ebp - 0x3c], 0x1213072c
mov dword [ebp - 0x668], 0xffffffff
mov dword [ebp - 0x954], 0
mov dword [ebp - 0x1f0], 0
jmp 0x1004e65e
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 2
jge 0x1004e67a
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x23c], 0xb659d568
jmp 0x1004e651
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x8a4], eax
cmp dword [ebp - 0x10], 0
jne 0x1004e69e
mov dword [ebp - 0x518], 1
jmp 0x1004e6a5
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xbc07c207
jb 0x1004e6c9
mov dword [ebp - 0x440], 1
jmp 0x1004e6d0
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
sub eax, 0x1bd9d14f
cmp eax, 0xfffffff6
jne 0x1004e6ef
cmp dword [ebp - 0x10], 0
jne 0x1004e6ef
and dword [ebp - 0x588], 0
jmp 0x1004e6f9
mov dword [ebp - 0x588], 1
cmp dword [ebp - 0x588], 0x693009c
jge 0x1004e711
mov dword [ebp - 0x448], 1
jmp 0x1004e718
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x448], eax
jne 0x1004e72f
mov dword [ebp - 0x520], 1
jmp 0x1004e736
and dword [ebp - 0x520], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x23c], 0x9831
imul eax, dword [ebp - 0x520], 0x9831
cmp eax, dword [ebp - 0x10]
jl 0x1004e762
mov dword [ebp - 0x450], 1
jmp 0x1004e769
and dword [ebp - 0x450], 0
cmp dword [ebp - 0x450], 0xfffffff7
jne 0x1004e77e
mov dword [ebp - 0x5c0], 1
jmp 0x1004e785
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0
jmp 0x1004e7a8
cmp dword [ebp - 0x3c], 1
jg 0x1004ea28
mov dword [ebp - 0x114], 0x29b4ccc4
push 2
lea ecx, [ebp - 0x764]
call fcn.10017f97
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x6c0], 3
mov dword [ebp - 0x1d0], 0
jmp 0x1004e7f3
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 2
jge 0x1004e815
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0x764]
call fcn.10018004
mov dword [eax], 1
jmp 0x1004e7e6
mov dword [ebp - 0xdc], 0
jmp 0x1004e82e
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jg 0x1004e884
mov dword [ebp - 0x10], 1
jmp 0x1004e847
cmp dword [ebp - 0x10], 0
jl 0x1004e882
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x1004e86e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0xdc]
cmp dword [ebp + eax*4 - 0x23c], 0
je 0x1004e880
jmp 0x1004e882
jmp 0x1004e840
jmp 0x1004e821
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x23c]
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x81c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x23c]
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x23c], 0
jne 0x1004e8cf
cmp dword [ebp - 0x114], 0
je 0x1004e8d8
cmp dword [ebp - 0x114], 0
jne 0x1004e8f1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x23c], 0
jne 0x1004e8f1
and dword [ebp - 0x458], 0
jmp 0x1004e8fb
mov dword [ebp - 0x458], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x458], eax
jg 0x1004e912
mov dword [ebp - 0x528], 1
jmp 0x1004e919
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x114]
imul eax, dword [ebp - 0x528]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x764]
call fcn.10018004
cmp esi, dword [eax]
jl 0x1004e949
mov dword [ebp - 0x460], 1
jmp 0x1004e950
and dword [ebp - 0x460], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x460]
sub ecx, dword [ebp + eax - 0x23c]
add ecx, dword [ebp - 0x3c]
jne 0x1004e97a
mov dword [ebp - 0x28], 0
jmp 0x1004ea38
cmp dword [ebp - 0x28], 0
jg 0x1004f295
mov dword [ebp - 0x84], 0xc9ebf495
push 1
lea ecx, [ebp - 0x72c]
call fcn.10017f97
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x538], 0xfffffffc
mov dword [ebp - 0x268], 1
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x344], 5
mov dword [ebp - 0x6fc], 0xfffffffc
mov dword [ebp - 0x828], 0xc5674fa7
mov dword [ebp - 0x210], 0
jmp 0x1004eab5
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x1004ead1
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x22c], 0x97ee
jmp 0x1004eaa8
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x22c]
mov dword [ebp - 0x8ac], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x22c]
cmp dword [ebp + eax - 0x22c], ecx
jg 0x1004eb09
mov dword [ebp - 0x478], 1
jmp 0x1004eb10
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x538], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x22c]
cmp dword [ebp - 0x538], eax
jl 0x1004eb3c
mov dword [ebp - 0x480], 1
jmp 0x1004eb43
and dword [ebp - 0x480], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x22c]
cmp eax, dword [ebp - 0x480]
jne 0x1004eb63
mov dword [ebp - 0x598], 1
jmp 0x1004eb6a
and dword [ebp - 0x598], 0
cmp dword [ebp - 0x598], 0xffffffff
jb 0x1004eb7f
mov dword [ebp - 0x488], 1
jmp 0x1004eb86
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x1d8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x22c]
cmp dword [ebp - 0x1d8], eax
jge 0x1004ebbe
mov dword [ebp - 0x124], 0xd6c05baf
push 1
lea ecx, [ebp - 0x794]
call fcn.10017f97
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x14c], 0
jmp 0x1004f2cc
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jge 0x1004f2ee
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x794]
call fcn.10018004
mov dword [eax], 6
jmp 0x1004f2bf
mov dword [ebp - 0x124], 0xfffffffd
jmp 0x1004f307
cmp dword [ebp - 0x124], 0xfffffff9
je 0x1004f583
push 1
lea ecx, [ebp - 0x6f4]
call fcn.10017f97
mov byte [ebp - 4], 0x14
push 1
lea ecx, [ebp - 0x720]
call fcn.10017f97
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x670], 0xfffffffa
mov dword [ebp - 0x54], 0
jmp 0x1004f350
cmp dword [ebp - 0x54], 1
jge 0x1004f36c
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6f4]
call fcn.10018004
mov dword [eax], 0xeede0b40
jmp 0x1004f349
mov dword [ebp - 0x54], 0
jmp 0x1004f37c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x794]
call fcn.10017fff
cmp dword [ebp - 0x28], 0
jne 0x1004f67c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0x91f1
jl 0x1004f5b8
mov dword [ebp - 0x47c], 1
jmp 0x1004f5bf
and dword [ebp - 0x47c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
sub eax, 0x592b
cmp eax, dword [ebp - 0x158]
jl 0x1004f5e2
mov dword [ebp - 0x48c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x244]
cmp dword [ebp - 0x48c], eax
jle 0x1004f6a7
mov dword [ebp - 0x494], 1
jmp 0x1004f6ae
and dword [ebp - 0x494], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x244]
cmp dword [ebp - 0x494], eax
jne 0x1004f6f8
mov dword [ebp - 0x1b0], 0x68206240
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x100500de
push 0x22ce
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x1b0], 0x13
jmp 0x100500f7
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 9
jne 0x1005011f
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1005011d
push 0x73d
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x100500ea
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x108], 5
mov dword [ebp - 0x134], 1
mov dword [ebp - 0x2f8], 0x79a7b445
push 1
lea ecx, [ebp - 0x7ac]
call fcn.10017f97
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x13c], 0x1fafbf26
mov dword [ebp - 0x1b8], 0
jmp 0x1005017d
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jge 0x1005019f
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x7ac]
call fcn.10018004
mov dword [eax], 0xf8b243e5
jmp 0x10050170
cmp dword [ebp - 0x134], 0
je 0x10050227
cmp dword [ebp - 0x134], 0x42af
jl 0x100501c0
mov dword [ebp - 0x2f0], 1
jmp 0x100501c7
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x2f8], eax
jl 0x100501ed
mov dword [ebp - 0x300], 1
jmp 0x100501f4
and dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 0xce3051eb
jb 0x1005020c
mov dword [ebp - 0x308], 1
jmp 0x10050213
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x308]
dec eax
jne 0x10050227
xor eax, eax
jne 0x10050227
cmp dword [ebp - 0x108], 0
cmp dword [ebp - 0x134], 0xffff
jne 0x1005023f
mov dword [ebp - 0x310], 1
jmp 0x10050246
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x310]
jne 0x10050262
xor eax, eax
inc eax
jne 0x10050262
and dword [ebp - 0x318], 0
jmp 0x1005026c
mov dword [ebp - 0x318], 1
mov eax, dword [ebp - 0x318]
sub eax, dword [ebp - 0x134]
imul eax, eax, 0
cmp eax, dword [ebp - 0x108]
jne 0x1005028f
mov dword [ebp - 0x320], 1
jmp 0x10050296
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x108]
add eax, dword [ebp - 0x320]
cmp eax, dword [ebp - 0x108]
jg 0x100502b6
mov dword [ebp - 0x328], 1
jmp 0x100502bd
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x328], eax
je 0x100502d7
mov dword [ebp - 0x26c], 1
jmp 0x100502de
and dword [ebp - 0x26c], 0
push 0
lea ecx, [ebp - 0x7ac]
call fcn.10018004
mov ecx, dword [ebp - 0x26c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x13c], 0xffffffee
jmp 0x10050318
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xd
jge 0x1005033d
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x1005033b
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x1005030b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7ac]
call fcn.10017fff
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x654], eax
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp - 0x144]
mov dword [eax], 0
jmp 0x1005038c
mov eax, dword [ebp - 0x144]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x144]
mov dword [ecx], eax
mov eax, dword [ebp - 0x144]
cmp dword [eax], 3
jge 0x100503b2
mov eax, dword [ebp - 0x144]
push dword [eax]
mov ecx, dword [ebp - 0x65c]
call fcn.10018004
mov dword [eax], 0xfffffff7
jmp 0x1005037b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret