Function at 0x43fbed
Capabilities:
Compare security identifiers
Get common file path
Get graphical window text
Get system information on windows
Identify system language via api
Log keystrokes via polling
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
push esi
mov dword [ebp - 0x114], 0x313dd33a
mov dword [ebp - 0x4ec], 0xfffffff7
mov dword [ebp - 0x114], 0
jmp 0x43fc24
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xc
jl 0x43fc76
mov dword [ebp - 0x174], 0
jmp 0x43fc46
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x43fc62
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x7ac], 0xfffffffb
jmp 0x43fc39
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7ac]
mov dword [ebp - 0x4ec], eax
jmp 0x43fc17
mov dword [ebp - 0x48], 1
push 2
lea ecx, [ebp - 0x1e8]
call fcn.0040f233
mov dword [ebp - 0x90], 6
mov dword [ebp - 0x1a4], 0xfffffffa
mov dword [ebp - 0x11c], 0x2955d482
mov dword [ebp - 0x210], 0xdef05de0
mov dword [ebp - 0x1f8], 0xfffffffc
push 1
lea ecx, [ebp - 0x634]
call fcn.0040f233
mov dword [ebp - 0x454], 0xcf2842c5
mov dword [ebp - 0x270], 0xd1892f88
mov dword [ebp - 0x55c], 0
mov dword [ebp - 0x2a0], 0x826cce71
mov dword [ebp - 0x484], 0x37d796e9
mov dword [ebp - 0x56c], 0x4084f7cb
mov dword [ebp - 0x40], 0
jmp 0x43fd15
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x43fd2e
push dword [ebp - 0x40]
lea ecx, [ebp - 0x1e8]
call fcn.0040f321
and dword [eax], 0
jmp 0x43fd0e
mov dword [ebp - 0x40], 0
jmp 0x43fd3e
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x43fd5a
push dword [ebp - 0x40]
lea ecx, [ebp - 0x634]
call fcn.0040f321
mov dword [eax], 1
jmp 0x43fd37
push 1
lea ecx, [ebp - 0x1e8]
call fcn.0040f321
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x1a4], eax
jle 0x43fd7e
mov dword [ebp - 0x358], 1
jmp 0x43fd85
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x1a4]
cmp eax, dword [ebp - 0x358]
jne 0x43fd9f
mov dword [ebp - 0x4c8], 1
jmp 0x43fda6
and dword [ebp - 0x4c8], 0
push 1
lea ecx, [ebp - 0x1e8]
call fcn.0040f321
mov ecx, dword [ebp - 0x4c8]
cmp ecx, dword [eax]
jle 0x43fdc9
mov dword [ebp - 0x4d0], 1
jmp 0x43fdd0
and dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 0xffffffff
jle 0x43fde5
mov dword [ebp - 0x4d8], 1
jmp 0x43fdec
and dword [ebp - 0x4d8], 0
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x4d8]
imul esi, eax
push 1
lea ecx, [ebp - 0x1e8]
call fcn.0040f321
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x1e8]
call fcn.0040f321
mov dword [eax], esi
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x11c], 0xc761
mov eax, dword [ebp - 0x11c]
neg eax
jne 0x43fede
push 1
lea ecx, [ebp - 0x1e8]
call fcn.0040f321
mov ecx, dword [ebp - 0x90]
cmp dword [eax], ecx
jne 0x43fe64
mov dword [ebp - 0x4e0], 1
jmp 0x43fe6b
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0x4e0], eax
je 0x43fe85
mov dword [ebp - 0x4dc], 1
jmp 0x43fe8c
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x4dc], eax
jg 0x43fea3
mov dword [ebp - 0x2c0], 1
jmp 0x43feaa
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c0]
sub eax, dword [ebp - 0x11c]
cmp eax, 0x31ea
jg 0x43fec9
mov dword [ebp - 0x44c], 1
jmp 0x43fed0
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
neg eax
sub eax, dword [ebp - 0x1f8]
mov eax, 0xc63704b
sub eax, dword [ebp - 0x210]
mov dword [ebp - 0x548], eax
push 0
lea ecx, [ebp - 0x634]
call fcn.0040f321
mov ecx, dword [ebp - 0x548]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x1e8]
call fcn.0040f321
cmp dword [ebp - 0x11c], 0
jne 0x43ff29
cmp dword [ebp - 0x48], 0
jne 0x43ff29
and dword [ebp - 0x260], 0
jmp 0x43ff33
mov dword [ebp - 0x260], 1
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x260]
sub ecx, dword [ebp - 0x1f8]
sub eax, ecx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0xe11f
jne 0x43ff68
mov eax, 0x3fd
test eax, eax
jne 0x43ff68
and dword [ebp - 0x268], 0
jmp 0x43ff72
mov dword [ebp - 0x268], 1
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x268], eax
je 0x43ff8c
mov dword [ebp - 0x45c], 1
jmp 0x43ff93
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x270], eax
mov esi, dword [ebp - 0x270]
push 1
lea ecx, [ebp - 0x1e8]
call fcn.0040f321
cmp dword [eax], esi
jg 0x43ffc2
mov dword [ebp - 0x464], 1
jmp 0x43ffc9
and dword [ebp - 0x464], 0
cmp dword [ebp - 0x464], 0x6a17
jl 0x43ffe1
mov dword [ebp - 0x278], 1
jmp 0x43ffe8
and dword [ebp - 0x278], 0
push 1
lea ecx, [ebp - 0x1e8]
call fcn.0040f321
mov ecx, dword [ebp - 0x278]
cmp ecx, dword [eax]
jg 0x44000b
mov dword [ebp - 0x46c], 1
jmp 0x440012
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x55c]
cmp dword [ebp - 0x46c], eax
jg 0x44002c
mov dword [ebp - 0x280], 1
jmp 0x440033
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x280], eax
jne 0x440045
cmp dword [ebp - 0x2a0], 0
cmp dword [ebp - 0x90], 0x3c3a871d
jl 0x44006c
push 0
lea ecx, [ebp - 0x1e8]
call fcn.0040f321
cmp dword [eax], 0
jne 0x44006c
and dword [ebp - 0x474], 0
jmp 0x440076
mov dword [ebp - 0x474], 1
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x474], eax
je 0x440090
mov dword [ebp - 0x288], 1
jmp 0x440097
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 0xd9e6264a
jne 0x4400af
mov dword [ebp - 0x47c], 1
jmp 0x4400b6
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
imul eax, dword [ebp - 0x210]
mov dword [ebp - 0x564], eax
push 0
lea ecx, [ebp - 0x1e8]
call fcn.0040f321
mov ecx, dword [ebp - 0x564]
mov dword [eax], ecx
cmp dword [ebp - 0x1a4], 0
jb 0x4400f3
mov dword [ebp - 0x290], 1
jmp 0x4400fa
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x484], eax
jg 0x44011d
mov dword [ebp - 0x298], 1
jmp 0x440124
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x298]
sub eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x90], eax
jl 0x440147
mov dword [ebp - 0x48c], 1
jmp 0x44014e
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
sub eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x56c], eax
lea ecx, [ebp - 0x634]
call fcn.0040f305
lea ecx, [ebp - 0x1e8]
call fcn.0040f305
mov dword [ebp - 0x234], 0xffffffff
mov dword [ebp - 0x230], 0xffffffff
mov dword [ebp - 0x22c], 0xffffffff
mov dword [ebp - 0x228], 0xffffffff
mov dword [ebp - 0x98], 0x8bdfadf6
push 2
lea ecx, [ebp - 0x724]
call fcn.0040f233
push 1
lea ecx, [ebp - 0x584]
call fcn.0040f233
mov dword [ebp - 0x2c], 0
jmp 0x4401d2
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x4401eb
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x724]
call fcn.0040f321
and dword [eax], 0
jmp 0x4401cb
mov dword [ebp - 0x2c], 0
jmp 0x4401fb
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x440217
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x584]
call fcn.0040f321
mov dword [eax], 9
jmp 0x4401f4
mov byte [ebp - 0x84], 0
movzx eax, byte [ebp - 0x84]
test eax, eax
je 0x44023f
push 0
push 0
push 0x1df0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea ecx, [ebp - 0x584]
call fcn.0040f321
and dword [eax], 0
jmp 0x440275
push 0
lea ecx, [ebp - 0x584]
call fcn.0040f321
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x494]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x494]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x584]
call fcn.0040f321
cmp dword [eax], 1
jg 0x4402a4
mov byte [ebp - 0x78], 0
movzx eax, byte [ebp - 0x78]
test eax, eax
je 0x4402a2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x440251
lea ecx, [ebp - 0x584]
call fcn.0040f305
lea ecx, [ebp - 0x724]
call fcn.0040f305
mov dword [ebp - 0xa0], 0x78e60d74
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x2a8], 0x746a1c17
mov dword [ebp - 0x574], 0x3dc0e3e7
mov dword [ebp - 0x54], 0xffffffe3
jmp 0x4402ef
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffff0
jle 0x4403dc
mov dword [ebp - 0xc4], 0x111738ab
mov dword [ebp - 0x124], 0
jmp 0x44031c
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jge 0x440338
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x5cc], 0xa473eb90
jmp 0x44030f
mov dword [ebp - 0xc4], 0
jmp 0x440351
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jg 0x4403c1
mov dword [ebp - 0x17c], 0xfffffff7
mov dword [ebp - 0x17c], 0
jmp 0x44037d
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 1
jg 0x4403bf
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x4403a3
push 0x2309
call dword [sym.imp.USER32.dll_GetKeyState]
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0x5cc]
mov dword [ebp + ecx*4 - 0x5cc], eax
jmp 0x440370
jmp 0x440344
mov byte [ebp - 0x7a], 0
movzx eax, byte [ebp - 0x7a]
test eax, eax
je 0x4403d7
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x4402e8
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0x747bb7ab
jne 0x440407
mov dword [ebp - 0x49c], 1
jmp 0x44040e
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x574], eax
mov dword [ebp - 0x504], 0x6de21e5
mov dword [ebp - 0x38], 1
push 2
lea ecx, [ebp - 0x64c]
call fcn.0040f233
mov dword [ebp - 0x12c], 0
jmp 0x440451
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jge 0x440473
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x64c]
call fcn.0040f321
mov dword [eax], 0xffff
jmp 0x440444
mov dword [ebp - 0x38], 0
jmp 0x440483
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffffa
jne 0x4405be
mov dword [ebp - 0x1bc], 0xfda0e60f
mov dword [ebp - 0x6b0], 0xffffffff
mov dword [ebp - 0x6ac], 0xffffffff
mov dword [ebp - 0x6a8], 0xffffffff
mov dword [ebp - 0x6a4], 0xffffffff
mov dword [ebp - 0x1bc], 0
jmp 0x4404d8
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xfffffffb
je 0x4405b9
mov dword [ebp - 0xd4], 0xfffffff8
mov dword [ebp - 0xec], 0x71dfd947
mov dword [ebp - 0xd4], 3
jmp 0x440512
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jl 0x4405b4
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp + eax*4 - 0x6b0]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xec], 0
jmp 0x44054b
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jg 0x4405af
mov dword [ebp - 0x134], 0x896e6a37
mov dword [ebp - 0x134], 0
jmp 0x440577
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 3
jg 0x4405ad
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x4405ab
push 0x21d9
push 0x1939
push 0
push 0
push 0x85
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x44056a
jmp 0x44053e
jmp 0x440505
jmp 0x4404cb
jmp 0x44047c
mov dword [ebp - 0x38], 0
jmp 0x4405ce
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x4405ea
push dword [ebp - 0x38]
lea ecx, [ebp - 0x64c]
call fcn.0040f321
mov dword [eax], 0xf3e7
jmp 0x4405c7
lea ecx, [ebp - 0x64c]
call fcn.0040f305
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x184], 9
mov dword [ebp - 0x2b8], 0xffffffff
mov dword [ebp - 0xdc], 1
cmp dword [ebp - 0x20], 0
je 0x440631
or eax, 0xffffffff
je 0x440631
mov dword [ebp - 0x4a0], 1
jmp 0x440638
and dword [ebp - 0x4a0], 0
mov dword [ebp - 0x184], 0xd2f
cmp dword [ebp - 0x184], 0
jne 0x44065b
push 9
pop eax
test eax, eax
jne 0x44065b
and dword [ebp - 0x578], 0
jmp 0x440665
mov dword [ebp - 0x578], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x184], eax
je 0x440685
mov dword [ebp - 0x2b0], 1
jmp 0x44068c
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2b0], eax
jne 0x4406a3
mov dword [ebp - 0x4a4], 1
jmp 0x4406aa
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2b8], eax
jle 0x4406d0
mov dword [ebp - 0x4ac], 1
jmp 0x4406d7
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x4ac], eax
jne 0x4406f7
cmp dword [ebp - 0x184], 0
je 0x4406f7
mov dword [ebp - 0x4b4], 1
jmp 0x4406fe
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
add eax, 0x185a
cmp eax, 0x307b5ca9
jl 0x44071c
mov dword [ebp - 0x2c8], 1
jmp 0x440723
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x4a0]
cmp eax, dword [ebp - 0x2c8]
jg 0x44073d
mov dword [ebp - 0x54c], 1
jmp 0x440744
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x6ec], eax
mov dword [ebp - 0xdc], 0xfffffffd
mov dword [ebp - 0x20], 0
jmp 0x440767
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x16
jl 0x440823
mov dword [ebp - 0x5f4], 1
mov dword [ebp - 0x5f0], 1
mov dword [ebp - 0x5ec], 1
mov dword [ebp - 0x5e8], 1
lea ecx, [ebp - 0x221]
call fcn.0040f330
push eax
lea eax, [ebp - 0x5e4]
push eax
lea eax, [ebp - 0x5f4]
push eax
lea ecx, [ebp - 0x7e4]
call fcn.0040f333
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7d0]
call fcn.0040f2df
mov dword [ebp - 0xdc], 0
jmp 0x4407e7
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 3
jg 0x440813
mov byte [ebp - 0x7c], 0
movzx eax, byte [ebp - 0x7c]
test eax, eax
je 0x440811
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x4407da
lea ecx, [ebp - 0x7d0]
call fcn.0040f305
jmp 0x440760
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x234], 0
jne 0x440871
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x794], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x234]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x234]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x234]
jl 0x440871
and dword [ebp - 0x3d8], 0
jmp 0x44087b
mov dword [ebp - 0x3d8], 1
mov eax, 0x2fafd11d
sub eax, dword [ebp - 0x3d8]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x234]
jne 0x4408af
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x234], 0
je 0x4408af
mov dword [ebp - 0x2d0], 1
jmp 0x4408b6
and dword [ebp - 0x2d0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x234]
add eax, dword [ebp - 0x2d0]
cmp eax, 5
jg 0x4408da
mov dword [ebp - 0x460], 1
jmp 0x4408e1
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x460]
neg eax
je 0x4420f5
push 1
lea ecx, [ebp - 0x1dc]
call fcn.0040f233
mov dword [ebp - 0xb8], 0x19adb821
mov dword [ebp - 0x2e0], 0xe3ca3691
mov dword [ebp - 0x530], 0x2fa5d872
mov dword [ebp - 0x30], 0
jmp 0x44092a
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x440946
push dword [ebp - 0x30]
lea ecx, [ebp - 0x1dc]
call fcn.0040f321
mov dword [eax], 0xfffffffe
jmp 0x440923
mov dword [ebp - 0x30], 0
jmp 0x440956
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x44096c
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x540], 0x6595ad33
jmp 0x44094f
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040f321
cmp dword [eax], 0xfffffff8
jne 0x440985
cmp dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], eax
jne 0x44099f
mov dword [ebp - 0x2d8], 1
jmp 0x4409a6
and dword [ebp - 0x2d8], 0
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040f321
mov ecx, dword [ebp - 0x2d8]
cmp ecx, dword [eax]
jne 0x4409c9
mov dword [ebp - 0x3e0], 1
jmp 0x4409d0
and dword [ebp - 0x3e0], 0
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040f321
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040f321
mov eax, dword [ebp - 0x3e0]
sub eax, 0x1a5679b5
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x75c], eax
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040f321
mov esi, eax
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040f321
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x440a35
mov dword [ebp - 0x4c4], 1
jmp 0x440a3c
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x4c4], eax
je 0x440a56
mov dword [ebp - 0x2e8], 1
jmp 0x440a5d
and dword [ebp - 0x2e8], 0
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040f321
mov ecx, dword [ebp - 0x2e8]
cmp ecx, dword [eax]
jne 0x440a80
mov dword [ebp - 0x214], 1
jmp 0x440a87
and dword [ebp - 0x214], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x214]
mov dword [ebp + eax - 0x540], ecx
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040f321
mov ecx, dword [ebp - 0x214]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0xb8]
jg 0x440ac3
mov dword [ebp - 0x3e8], 1
jmp 0x440aca
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 0x6e2c
jge 0x440ae2
mov dword [ebp - 0x2f0], 1
jmp 0x440ae9
and dword [ebp - 0x2f0], 0
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040f321
mov ecx, dword [ebp - 0x2f0]
cmp ecx, dword [eax]
jl 0x440b0c
mov dword [ebp - 0x468], 1
jmp 0x440b13
and dword [ebp - 0x468], 0
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040f321
mov ecx, dword [ebp - 0x468]
add ecx, dword [eax]
sub ecx, dword [ebp - 0xb8]
mov dword [ebp - 0x530], ecx
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x440b5c
push 0xa0b
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
lea ecx, [ebp - 0x1dc]
call fcn.0040f305
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x4cc], 0x9a7e1289
mov dword [ebp - 0xe4], 3
mov dword [ebp - 0x98], 0xffffffe4
jmp 0x440b9e
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x35
jge 0x4420f0
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0xcc], 0xebb6748f
mov dword [ebp - 0xc0], 0
jmp 0x440bd8
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffea
jle 0x440f81
mov dword [ebp - 0x64], 0xfffffff8
mov dword [ebp - 0x4a8], 0xffffffff
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
je 0x440c39
mov dword [ebp - 0x2f8], 2
mov dword [ebp - 0x4fc], 1
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x4fc], eax
jmp 0x440f61
mov dword [ebp - 0x200], 0xfffffff6
mov dword [ebp - 0x208], 0x8b4b72b4
mov dword [ebp - 0x18], 0x9b96bc71
mov dword [ebp - 0x13c], 0
jmp 0x440c6d
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x440c89
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x664], 0xf039d3cd
jmp 0x440c60
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x710], eax
cmp dword [ebp - 0x64], 0
jne 0x440cad
cmp dword [ebp - 0x200], 0
jne 0x440cad
and dword [ebp - 0x3f0], 0
jmp 0x440cb7
mov dword [ebp - 0x3f0], 1
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0
jne 0x440cde
cmp dword [ebp - 0xc0], 0
jne 0x440cde
and dword [ebp - 0x300], 0
jmp 0x440ce8
mov dword [ebp - 0x300], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x664]
mov ecx, dword [ebp - 0x300]
lea eax, [ecx + eax - 1]
test eax, eax
je 0x440d15
cmp dword [ebp - 0x64], 0
je 0x440d15
mov dword [ebp - 0x21c], 1
jmp 0x440d1c
and dword [ebp - 0x21c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x21c]
mov dword [ebp + eax - 0x664], ecx
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jne 0x440d56
cmp dword [ebp - 0x4a8], 0
jne 0x440d56
and dword [ebp - 0x308], 0
jmp 0x440d60
mov dword [ebp - 0x308], 1
mov eax, dword [ebp - 0x4a8]
cmp dword [ebp - 0x308], eax
jl 0x440d7a
mov dword [ebp - 0x3f8], 1
jmp 0x440d81
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x440d9f
mov eax, 0xd6cd5387
test eax, eax
jne 0x440db1
mov eax, 0xce404d46
test eax, eax
jne 0x440db1
and dword [ebp - 0x310], 0
jmp 0x440dbb
mov dword [ebp - 0x310], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x310], eax
jl 0x440dd2
mov dword [ebp - 0x470], 1
jmp 0x440dd9
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x470], eax
jle 0x440df0
mov dword [ebp - 0x318], 1
jmp 0x440df7
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x318], eax
jge 0x440e0e
mov dword [ebp - 0x400], 1
jmp 0x440e15
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x400]
cmp eax, 0x2e0c
jge 0x440e31
mov dword [ebp - 0x320], 1
jmp 0x440e38
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x320], eax
jl 0x440e4f
mov dword [ebp - 0x4d4], 1
jmp 0x440e56
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 8
jb 0x440e6b
mov dword [ebp - 0x328], 1
jmp 0x440e72
and dword [ebp - 0x328], 0
cmp dword [ebp - 0x328], 0x9172c2e8
je 0x440e8a
mov dword [ebp - 0x408], 1
jmp 0x440e91
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x408]
jne 0x440ea8
mov dword [ebp - 0x330], 1
jmp 0x440eaf
and dword [ebp - 0x330], 0
cmp dword [ebp - 0x330], 0x47b6
jle 0x440ec7
mov dword [ebp - 0x550], 1
jmp 0x440ece
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x780], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x718], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0x64], 1
jg 0x440f07
mov dword [ebp - 0x478], 1
jmp 0x440f0e
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
sub eax, 7
cmp eax, dword [ebp - 0x18]
jle 0x440f28
mov dword [ebp - 0x338], 1
jmp 0x440f2f
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x338]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0
jmp 0x440f4b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x440f61
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x664], 0x16cf0574
jmp 0x440f44
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x440f7c
push 0x113f
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
jmp 0x440bcb
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x740], 8
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x440fad
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov byte [ebp - 0x6a], 0
movzx eax, byte [ebp - 0x6a]
test eax, eax
je 0x440fcf
push 0
push 0
push 0x1e69
push 0x1ff6
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0x254], 0x2ad14ca7
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x234]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jne 0x441010
mov eax, 0xcc09
test eax, eax
jne 0x441010
and dword [ebp - 0x410], 0
jmp 0x44101a
mov dword [ebp - 0x410], 1
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x441041
cmp dword [ebp - 0xa0], 0
jne 0x441041
and dword [ebp - 0x340], 0
jmp 0x44104b
mov dword [ebp - 0x340], 1
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x220], 0xffffffff
jle 0x44106c
mov dword [ebp - 0x4b0], 1
jmp 0x441073
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
sub eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x1f0], eax
jg 0x44109f
mov dword [ebp - 0x348], 1
jmp 0x4410a6
and dword [ebp - 0x348], 0
imul eax, dword [ebp - 0x348], 0x6e66
cmp eax, 0xc7e7
je 0x4410be
cmp dword [ebp - 0x504], 0
mov eax, 0xe617
cmp eax, 0xfff9
jne 0x4410d6
mov dword [ebp - 0x350], 1
jmp 0x4410dd
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp - 0x350]
je 0x441103
mov dword [ebp - 0x480], 1
jmp 0x44110a
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
sub eax, dword [ebp - 0xe4]
cmp eax, 5
jb 0x441127
mov dword [ebp - 0x420], 1
jmp 0x44112e
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x420], eax
jle 0x441148
mov dword [ebp - 0x360], 1
jmp 0x44114f
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
sub eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x4cc]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x234]
jne 0x44117c
mov dword [ebp - 0x368], 1
jmp 0x441183
and dword [ebp - 0x368], 0
imul eax, dword [ebp - 0x368], 0x270b
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0x234]
je 0x44150d
mov dword [ebp - 0x738], 1
mov dword [ebp - 0x748], 0xfffffffe
mov dword [ebp - 0x554], 8
mov dword [ebp - 0x6b8], 0x328129ec
mov dword [ebp - 0x1ac], 0
jmp 0x4411e1
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jge 0x4411fd
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x828], 0xe8ce6fc2
jmp 0x4411d4
mov byte [ebp - 0x6b], 0
movzx eax, byte [ebp - 0x6b]
test eax, eax
je 0x44120f
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov dword [ebp - 0x554], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x144], 0
jmp 0x441239
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jge 0x441255
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x7b8], 0xeab3cf81
jmp 0x44122c
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x441272
push 1
push 0xfed
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jge 0x441286
mov dword [ebp - 0x428], 1
jmp 0x44128d
and dword [ebp - 0x428], 0
cmp dword [ebp - 0x10], 0
je 0x4412ab
cmp dword [ebp - 0x10], 0
jne 0x44129f
cmp dword [ebp - 0x10], 0
je 0x4412ab
mov dword [ebp - 0x50c], 1
jmp 0x4412b2
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x6c8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x6d0], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x6d8], eax
cmp dword [ebp - 0x10], 0x3e75
je 0x4412eb
mov dword [ebp - 0x370], 1
jmp 0x4412f2
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x370]
jl 0x44130c
mov dword [ebp - 0x488], 1
jmp 0x441313
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x488], eax
jne 0x44132a
mov dword [ebp - 0x378], 1
jmp 0x441331
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x378], eax
je 0x441348
mov dword [ebp - 0x430], 1
jmp 0x44134f
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x430], eax
jle 0x44136c
cmp dword [ebp - 0x10], 0
je 0x44136c
mov dword [ebp - 0x380], 1
jmp 0x441373
and dword [ebp - 0x380], 0
cmp dword [ebp - 0x380], 0xfffffff7
ja 0x441388
mov dword [ebp - 0x4b8], 1
jmp 0x44138f
and dword [ebp - 0x4b8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4b8]
mov dword [ebp + eax - 0x7b8], ecx
mov byte [ebp - 0x6f], 0
movzx eax, byte [ebp - 0x6f]
test eax, eax
je 0x441508
push 1
lea ecx, [ebp - 0x688]
call fcn.0040f233
mov dword [ebp - 0x14c], 0xffffffff
mov dword [ebp - 0x18c], 0
jmp 0x4413e2
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jge 0x441404
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x688]
call fcn.0040f321
mov dword [eax], 0xaf11
jmp 0x4413d5
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x441426
push 0
push 0
push 0x225c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [ebp - 0x14c], 0
jmp 0x44143f
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jg 0x4414e7
mov dword [ebp - 0x1c4], 0xffffffff
mov byte [ebp - 0x73], 0
movzx eax, byte [ebp - 0x73]
test eax, eax
je 0x44146f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [ebp - 0x1c4], 0
jmp 0x441488
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jg 0x4414e2
mov dword [ebp - 0xc8], 0x72159124
mov dword [ebp - 0xc8], 0
jmp 0x4414b4
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x4414d6
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x688]
call fcn.0040f321
mov dword [eax], 1
jmp 0x4414a7
mov dword [ebp - 0xc8], 7
jmp 0x44147b
jmp 0x441432
lea ecx, [ebp - 0x688]
call fcn.0040f305
push 0
push 0
push 0x9cb
push 0xc78
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
jmp 0x4420eb
push 2
lea ecx, [ebp - 0x6a0]
call fcn.0040f233
mov dword [ebp - 0xc], 0
jmp 0x44152a
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x44153d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x50], 0xfffffff7
jmp 0x441523
mov dword [ebp - 0xc], 0
jmp 0x44154d
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x441563
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x77c], 0
jmp 0x441546
mov dword [ebp - 0xc], 0
jmp 0x441573
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x44158f
push dword [ebp - 0xc]
lea ecx, [ebp - 0x6a0]
call fcn.0040f321
mov dword [eax], 0x98422518
jmp 0x44156c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x50], 0
jmp 0x4415b4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x50], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0xd
jne 0x441747
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x154], 0xffffffff
mov dword [ebp - 0x558], 0xfffffffd
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x4c], 0
jne 0x4415fe
cmp dword [ebp - 0x4c], 0
jne 0x4415fe
and dword [ebp - 0x388], 0
jmp 0x441608
mov dword [ebp - 0x388], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
imul eax, dword [ebp - 0x388]
test eax, eax
jne 0x44162d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x77c], 0
je 0x44163b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x77c], 0
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x154]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6fc], eax
cmp dword [ebp - 0x4c], 0
jne 0x44168b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
jne 0x44168b
push 6
pop eax
test eax, eax
jne 0x44168b
and dword [ebp - 0x438], 0
jmp 0x441695
mov dword [ebp - 0x438], 1
cmp dword [ebp - 0x438], 0xffffffff
je 0x4416aa
mov dword [ebp - 0x390], 1
jmp 0x4416b1
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x390], eax
jne 0x4416d8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x77c], 0
je 0x4416d8
mov dword [ebp - 0x490], 1
jmp 0x4416df
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x490], 3
je 0x4416f4
mov dword [ebp - 0x398], 1
jmp 0x4416fb
and dword [ebp - 0x398], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x398]
sub ecx, dword [ebp + eax - 0x50]
mov dword [ebp - 0x440], ecx
push 0
lea ecx, [ebp - 0x6a0]
call fcn.0040f321
mov ecx, dword [ebp - 0x440]
mov dword [eax], ecx
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x154], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov dword [ebp - 0x558], eax
jmp 0x44159f
lea ecx, [ebp - 0x6a0]
call fcn.0040f305
mov dword [ebp - 0xe4], 0
jmp 0x44176b
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jg 0x4420eb
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x194], 0xffffffe2
jmp 0x44179b
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0x1a
jl 0x4417e9
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x4417c2
push 0x4fc
push 0xfee
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
mov byte [ebp - 0x77], 0
movzx eax, byte [ebp - 0x77]
test eax, eax
je 0x4417e7
push 0
push 0
push 0
push 0
push 0
push 0
push 0x208
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x44178e
mov dword [ebp - 0xa0], 3
jmp 0x441802
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x4420e6
mov dword [ebp - 0x1b4], 6
mov dword [ebp - 0x70c], 0xb72b21a3
mov dword [ebp - 0x3a0], 0xfffffff7
mov dword [ebp - 0x15c], 0
jmp 0x441846
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 3
jge 0x441862
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x840], 6
jmp 0x441839
mov dword [ebp - 0x1b4], 0
jmp 0x44187b
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jg 0x4418a4
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x4418a2
push 0x1e2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x44186e
mov eax, dword [ebp - 0x3a0]
dec eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x250], 0x2d5e48d3
mov dword [ebp - 0x24c], 0x2d5e48d3
mov dword [ebp - 0x248], 0x2d5e48d3
mov dword [ebp - 0x244], 0x2d5e48d3
mov dword [ebp - 8], 0x52061f6
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0x28], 0x391cb4e7
mov dword [ebp - 0x1fc], 0x1932e3ca
mov dword [ebp - 0x61c], 0x23edb395
mov dword [ebp - 0x618], 0x23edb395
mov dword [ebp - 0x614], 0x23edb395
mov dword [ebp - 0x610], 0x23edb395
lea ecx, [ebp - 0x215]
call fcn.0040f330
push eax
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0x80c]
call fcn.0040f333
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x694]
call fcn.0040f2df
mov dword [ebp - 0x514], 0xffffffff
mov dword [ebp - 0x560], 0x1f66
mov dword [ebp - 8], 3
jmp 0x44197c
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x441ada
mov dword [ebp - 0x3a8], 0xfffffff9
mov dword [ebp - 0x3b8], 9
cmp dword [ebp - 0xf4], 0
jne 0x4419fb
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x250]
cmp dword [ebp + eax*4 - 0x250], ecx
jl 0x4419d7
mov dword [ebp - 0x4bc], 1
jmp 0x4419de
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4bc]
sub eax, dword [ebp - 0x3a8]
add eax, dword [ebp - 0x3b8]
jne 0x4419fb
and dword [ebp - 0x448], 0
jmp 0x441a05
mov dword [ebp - 0x448], 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x250]
imul ecx, dword [ebp - 0x448]
cmp dword [ebp + eax*4 - 0x250], ecx
jle 0x441a2e
mov dword [ebp - 0x1f4], 1
jmp 0x441a35
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x250], ecx
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x1f4], eax
jl 0x441a5f
mov dword [ebp - 0x3b0], 1
jmp 0x441a66
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
je 0x441a8e
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x441a8e
mov dword [ebp - 0x498], 1
jmp 0x441a95
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
imul eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x450], eax
push 0
lea ecx, [ebp - 0x694]
call fcn.0040f321
mov ecx, dword [ebp - 0x450]
mov dword [eax], ecx
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x514], eax
jmp 0x441975
mov dword [ebp - 0x28], 0
jmp 0x441aea
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x441cfb
mov dword [ebp - 0x164], 0xfff8
mov dword [ebp - 8], 3
jmp 0x441b0e
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x441cd1
mov byte [ebp - 0x7b], 0
movzx eax, byte [ebp - 0x7b]
test eax, eax
je 0x441b3f
push 0x1532
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, 0x10224968
test eax, eax
je 0x441c48
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0xf4], eax
jle 0x441b66
mov dword [ebp - 0x5b8], 1
jmp 0x441b6d
and dword [ebp - 0x5b8], 0
cmp dword [ebp - 0x164], 0xefae07df
jne 0x441b8e
cmp dword [ebp - 0x164], 0
je 0x441b8e
mov dword [ebp - 0x3c0], 1
jmp 0x441b95
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x3c0], eax
jg 0x441bac
mov dword [ebp - 0x51c], 1
jmp 0x441bb3
and dword [ebp - 0x51c], 0
xor eax, eax
inc eax
cmp eax, 1
je 0x441bd1
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x250], 0
jne 0x441bd1
and dword [ebp - 0x4c0], 0
jmp 0x441bdb
mov dword [ebp - 0x4c0], 1
imul eax, dword [ebp - 0x4c0], 0x2987
test eax, eax
jb 0x441bf5
mov dword [ebp - 0x3c8], 1
jmp 0x441bfc
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x250]
cmp dword [ebp - 0x3c8], eax
je 0x441c20
cmp dword [ebp - 0x164], 0
jne 0x441c20
and dword [ebp - 0x458], 0
jmp 0x441c2a
mov dword [ebp - 0x458], 1
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x250]
cmp eax, dword [ebp - 0x458]
je 0x441c48
mov dword [ebp - 0x3d0], 1
jmp 0x441c4f
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x250]
cmp dword [ebp - 0x3d0], eax
jl 0x441c6d
mov dword [ebp - 0x2bc], 1
jmp 0x441c74
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x560]
cmp dword [ebp - 0x2bc], eax
jg 0x441c8e
mov dword [ebp - 0x2c4], 1
jmp 0x441c95
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x2c4], eax
je 0x441caf
mov dword [ebp - 0x2cc], 1
jmp 0x441cb6
and dword [ebp - 0x2cc], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x694]
call fcn.0040f321
mov ecx, dword [ebp - 0x2cc]
mov dword [eax], ecx
jmp 0x441b07
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x441cf6
push 0xfc5
push 0
push 0xea3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp 0x441ae3
lea ecx, [ebp - 0x694]
call fcn.0040f305
mov byte [ebp - 0x81], 0
mov dword [ebp - 0x608], 0xfffffff7
mov dword [ebp - 0x604], 0xfffffff7
mov dword [ebp - 0x600], 0xfffffff7
mov dword [ebp - 0x5fc], 0xfffffff7
lea ecx, [ebp - 0x1e9]
call fcn.0040f330
push eax
lea eax, [ebp - 0x5f8]
push eax
lea eax, [ebp - 0x608]
push eax
lea ecx, [ebp - 0x7ec]
call fcn.0040f333
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1d0]
call fcn.0040f2df
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x588], 0xffffffff
mov dword [ebp - 0x30c], 0x87c4177f
mov dword [ebp - 0x14], 0
jmp 0x441d95
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x442044
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0
jmp 0x441db6
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x441ef7
mov dword [ebp - 0x104], 0
jmp 0x441dd9
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jge 0x441df5
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x524], 0xffffffff
jmp 0x441dcc
mov byte [ebp - 0x7f], 0
movzx eax, byte [ebp - 0x7f]
test eax, eax
je 0x441e09
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1d0]
call fcn.0040f321
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x758], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1d0]
call fcn.0040f321
cmp dword [eax], 0x7aced45b
jne 0x441e42
mov dword [ebp - 0x2d4], 1
jmp 0x441e49
and dword [ebp - 0x2d4], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1d0]
call fcn.0040f321
mov esi, eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1d0]
call fcn.0040f321
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x2d4]
jl 0x441e7f
mov dword [ebp - 0x2dc], 1
jmp 0x441e86
and dword [ebp - 0x2dc], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1d0]
call fcn.0040f321
mov esi, dword [ebp - 0x2dc]
sub esi, dword [eax]
push 3
lea ecx, [ebp - 0x1d0]
call fcn.0040f321
cmp esi, dword [eax]
jl 0x441eb9
mov dword [ebp - 0x2e4], 1
jmp 0x441ec0
and dword [ebp - 0x2e4], 0
cmp dword [ebp - 0x2e4], 0xfffb
jae 0x441ed8
mov dword [ebp - 0x2ec], 1
jmp 0x441edf
and dword [ebp - 0x2ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2ec]
mov dword [ebp + eax - 0x524], ecx
jmp 0x441daf
cmp dword [ebp - 0x14], 0
jne 0x441f1b
push 0
lea ecx, [ebp - 0x1d0]
call fcn.0040f321
cmp dword [eax], 0xf876
je 0x441f1b
and dword [ebp - 0x2f4], 0
jmp 0x441f25
mov dword [ebp - 0x2f4], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2f4], eax
jge 0x441f3c
mov dword [ebp - 0x2fc], 1
jmp 0x441f43
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jne 0x441f63
mov dword [ebp - 0x304], 1
jmp 0x441f6a
and dword [ebp - 0x304], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1d0]
call fcn.0040f321
mov esi, eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1d0]
call fcn.0040f321
mov ecx, dword [ebp - 0x304]
sub ecx, dword [eax]
mov eax, dword [esi]
sub eax, ecx
imul eax, eax, 0x925d
mov ecx, dword [ebp - 0x24]
lea esi, [eax + ecx + 0xfff7]
push 1
lea ecx, [ebp - 0x1d0]
call fcn.0040f321
sub esi, dword [eax]
mov dword [ebp - 0x30c], esi
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x30c], eax
jle 0x441fd0
mov dword [ebp - 0x314], 1
jmp 0x441fd7
and dword [ebp - 0x314], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1d0]
call fcn.0040f321
mov esi, dword [eax]
add esi, dword [ebp - 0x314]
push 1
lea ecx, [ebp - 0x1d0]
call fcn.0040f321
add esi, dword [eax]
cmp esi, 0x874d
jne 0x442010
mov dword [ebp - 0x31c], 1
jmp 0x442017
and dword [ebp - 0x31c], 0
cmp dword [ebp - 0x31c], 0xfff6
jne 0x44202f
mov dword [ebp - 0x324], 1
jmp 0x442036
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x24], eax
jmp 0x441d8e
lea ecx, [ebp - 0x1d0]
call fcn.0040f305
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x4420e1
mov dword [ebp - 0x16c], 0x184c506d
mov dword [ebp - 0x19c], 0
jmp 0x442081
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x44209d
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x804], 0xb57f
jmp 0x442074
mov dword [ebp - 0x16c], 1
jmp 0x4420b6
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jl 0x4420db
mov byte [ebp - 0x83], 0
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x4420d9
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x4420a9
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x4417f5
jmp 0x44175e
jmp 0x440b91
jmp 0x4427cd
mov dword [ebp - 0x790], 8
mov dword [ebp - 0x78c], 8
mov dword [ebp - 0x788], 8
mov dword [ebp - 0x784], 8
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x44213c
push 0x2147
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x44215d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
mov dword [ebp - 0x1c], 0xe8cff0ea
mov dword [ebp - 0xd0], 0xffd81438
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x1c], 0
jmp 0x442192
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe3
jne 0x4421e1
mov dword [ebp - 0x10c], 0
jmp 0x4421b1
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jge 0x4421cd
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x6f8], 0x8f8
jmp 0x4421a4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6f8], 0
je 0x4421df
jmp 0x4421e1
jmp 0x44218b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x760], eax
cmp dword [ebp - 0x1c], 0
je 0x442202
cmp dword [ebp - 0x1c], 0
je 0x442202
mov dword [ebp - 0x32c], 1
jmp 0x442209
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x768], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x1c], eax
jle 0x442259
mov dword [ebp - 0x334], 1
jmp 0x442260
and dword [ebp - 0x334], 0
cmp dword [ebp - 0x334], 4
jne 0x442275
mov dword [ebp - 0x33c], 1
jmp 0x44227c
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x33c], eax
jle 0x442293
mov dword [ebp - 0x52c], 1
jmp 0x44229a
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x7a0], eax
mov eax, dword [ebp - 0xd0]
sub eax, 0xec58
cmp eax, 0xc57f
jge 0x4422c4
mov dword [ebp - 0x344], 1
jmp 0x4422cb
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x344], eax
jl 0x4422e2
mov dword [ebp - 0x568], 1
jmp 0x4422e9
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x764], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x110], eax
jne 0x442323
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x44231e
push 0
push 0xd0f
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x4423e3
mov dword [ebp - 0x534], 0x4a6b2c4e
push 4
lea ecx, [ebp - 0x640]
call fcn.0040f233
mov dword [ebp - 0x5a8], 0x1636717b
mov dword [ebp - 0x118], 0
jmp 0x44235d
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 4
jge 0x44237f
push dword [ebp - 0x118]
lea ecx, [ebp - 0x640]
call fcn.0040f321
mov dword [eax], 1
jmp 0x442350
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xfffffff7
je 0x4423a0
mov dword [ebp - 0x34c], 1
jmp 0x4423a7
and dword [ebp - 0x34c], 0
imul eax, dword [ebp - 0x34c], 0xa8db
mov dword [ebp - 0x354], eax
push 1
lea ecx, [ebp - 0x640]
call fcn.0040f321
mov ecx, dword [ebp - 0x354]
mov dword [eax], ecx
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x5a8], eax
lea ecx, [ebp - 0x640]
call fcn.0040f305
mov byte [ebp - 0x6c], 0
mov dword [ebp - 0x128], 0xfffffffc
mov dword [ebp - 0x120], 0
jmp 0x44240a
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x442426
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x81c], 0
jmp 0x4423fd
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x442447
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [ebp - 0x128], 0
jmp 0x442460
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jg 0x442492
mov byte [ebp - 0x80], 0
movzx eax, byte [ebp - 0x80]
test eax, eax
je 0x442490
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x442453
movzx eax, byte [ebp - 0x6c]
test eax, eax
je 0x4427cd
mov dword [ebp - 4], 0
mov dword [ebp - 0xe0], 0xe1d925b0
mov dword [ebp - 0xd8], 9
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x39c], 6
mov dword [ebp - 0xe8], 1
mov dword [ebp - 0x130], 0
jmp 0x4424f0
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x44250c
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x704], 0xf9e6a012
jmp 0x4424e3
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
jle 0x44253c
mov dword [ebp - 0x35c], 1
jmp 0x442543
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x35c]
jl 0x44255d
mov dword [ebp - 0x374], 1
jmp 0x442564
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
jne 0x442578
mov dword [ebp - 0x364], 1
jmp 0x44257f
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
neg eax
sub eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
cmp eax, 0xbf5f
jl 0x4425a0
mov dword [ebp - 0x36c], 1
jmp 0x4425a7
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0xbc], eax
imul eax, dword [ebp - 0xbc], 0xcaea
cmp eax, dword [ebp - 4]
jne 0x4425ce
mov dword [ebp - 0x37c], 1
jmp 0x4425d5
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x374]
add eax, dword [ebp - 0x37c]
cmp eax, dword [ebp - 0xd8]
jg 0x4425f5
mov dword [ebp - 0x384], 1
jmp 0x4425fc
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x384], eax
jl 0x442619
cmp dword [ebp - 0xe0], 0
jne 0x442619
and dword [ebp - 0x38c], 0
jmp 0x442623
mov dword [ebp - 0x38c], 1
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x38c], eax
jne 0x44263a
mov dword [ebp - 0x394], 1
jmp 0x442641
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
neg eax
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x39c], eax
jge 0x44267e
cmp dword [ebp - 0xe0], 0
jne 0x44267e
cmp dword [ebp - 4], 0
jne 0x44267e
and dword [ebp - 0x3a4], 0
jmp 0x442688
mov dword [ebp - 0x3a4], 1
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0x3a4]
sub ecx, dword [ebp - 0xe8]
sub eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x704]
je 0x442705
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x4426ce
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 0x6e], 0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x442700
push 0
push 0
push 0
push 0xdef
push 0x1557
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x4427b9
mov dword [ebp - 0x3b4], 0
mov dword [ebp - 0xbc], 0
jmp 0x442728
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x18
jge 0x4427b9
mov dword [ebp - 0x3ac], 9
mov dword [ebp - 0x708], 0xffffffff
mov dword [ebp - 0xe8], 0xfffffff9
jmp 0x442762
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x4427a7
mov dword [ebp - 0x53c], 0xfffffff7
mov dword [ebp - 4], 0
jmp 0x442785
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jg 0x44279a
mov eax, dword [ebp - 0x3ac]
dec eax
mov dword [ebp - 0x3ac], eax
jmp 0x44277e
cmp dword [ebp - 0x53c], 0
je 0x4427a5
jmp 0x4427a7
jmp 0x442755
mov eax, dword [ebp - 0x3b4]
dec eax
mov dword [ebp - 0x3b4], eax
jmp 0x44271b
push 0x1dc7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 0x6b4], 0xb2c2
mov dword [ebp - 0x750], 0xffffffff
mov dword [ebp - 0x3bc], 0x88d9
mov dword [ebp - 0x34], 0
jmp 0x4427fb
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x442811
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x834], 0x27689351
jmp 0x4427f4
mov dword [ebp - 0x34], 0
jmp 0x442821
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x442837
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x84c], 0xac46ddcd
jmp 0x44281a
mov eax, dword [ebp - 0x3bc]
dec eax
mov dword [ebp - 0x3bc], eax
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x44312f
mov dword [ebp - 0x138], 0
jmp 0x442869
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 1
jge 0x442885
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x108], 0x4fd3df75
jmp 0x44285c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x108], 7
jmp 0x4428b3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x108], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x108], 0xfffffff1
jl 0x442924
mov dword [ebp - 0x3c4], 1
mov dword [ebp - 0x140], 0
jmp 0x4428e6
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x442902
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x570], 0xfffffffb
jmp 0x4428d9
mov dword [ebp - 0x3c4], 0xa4f402e3
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp + eax - 0x570], ecx
jmp 0x442898
mov dword [ebp - 0x150], 0xad386cce
mov dword [ebp - 0x3cc], 0xffffffff
mov dword [ebp - 0x544], 9
mov dword [ebp - 0x148], 0
jmp 0x44295b
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jge 0x442977
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x7c4], 0xd53b
jmp 0x44294e
mov eax, dword [ebp - 0x3cc]
add eax, 0x4bcd
sub eax, dword [ebp - 0x3cc]
cmp eax, dword [ebp - 0x150]
jl 0x44299c
mov dword [ebp - 0x3d4], 1
jmp 0x4429a3
and dword [ebp - 0x3d4], 0
imul eax, dword [ebp - 0x150], 0xffffffff
mov ecx, dword [ebp - 0x150]
add ecx, dword [ebp - 0x3d4]
cmp eax, ecx
jle 0x4429c6
mov dword [ebp - 0x3dc], 1
jmp 0x4429cd
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 1
je 0x4429e2
mov dword [ebp - 0x3ec], 1
jmp 0x4429e9
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x3e4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp + eax - 0x7c4], ecx
mov eax, dword [ebp - 0x3e4]
cmp eax, dword [ebp - 0x3ec]
jg 0x442a22
mov dword [ebp - 0x3f4], 1
jmp 0x442a29
and dword [ebp - 0x3f4], 0
imul eax, dword [ebp - 0x3f4], 0xddd9
mov dword [ebp - 0x544], eax
mov byte [ebp - 0x82], 0
movzx eax, byte [ebp - 0x82]
test eax, eax
je 0x442a64
push 0
push 0
push 0
push 0
push 0
push 0
push 0x208
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x598], eax
mov dword [ebp - 0x160], 0xfffffffc
mov dword [ebp - 0x158], 0
jmp 0x442a90
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x442aac
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x6c4], 4
jmp 0x442a83
mov dword [ebp - 0x160], 0
jmp 0x442ac5
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jl 0x442b1b
mov byte [ebp - 0x70], 0
movzx eax, byte [ebp - 0x70]
test eax, eax
je 0x442af3
push 0x26cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x442b19
push 0
push 0x1316
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x442ab8
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp - 0x72]
test eax, eax
je 0x442b34
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4f4], eax
push 2
lea ecx, [ebp - 0x594]
call fcn.0040f233
mov dword [ebp - 0x168], 0
jmp 0x442b63
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x442b85
push dword [ebp - 0x168]
lea ecx, [ebp - 0x594]
call fcn.0040f321
mov dword [eax], 0x9b55bb2c
jmp 0x442b56
push 1
lea ecx, [ebp - 0x594]
call fcn.0040f321
mov dword [eax], 0xfffffffd
jmp 0x442bbe
push 1
lea ecx, [ebp - 0x594]
call fcn.0040f321
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x3fc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3fc]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x594]
call fcn.0040f321
cmp dword [eax], 0x14
jle 0x442c17
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x442bfc
push 0
push 0x1610
push 0
push 0x1e8c
push 0x1c1b
push 0
push 0x17cb
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov byte [ebp - 0x74], 0
movzx eax, byte [ebp - 0x74]
test eax, eax
je 0x442c15
push 0x2271
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
jmp 0x442b9a
lea ecx, [ebp - 0x594]
call fcn.0040f305
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x510], eax
mov dword [ebp - 0xb0], 0xd5e48d32
mov dword [ebp - 0x43c], 0xb91359a7
mov dword [ebp - 0x500], 0xffffffff
mov dword [ebp - 0x744], 0xa53e
mov dword [ebp - 0xb0], 0x12
jmp 0x442c7b
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x15
je 0x443114
push 1
lea ecx, [ebp - 0x240]
call fcn.0040f233
mov dword [ebp - 0x3c], 0xee7d214c
mov dword [ebp - 0x26c], 0xa737
mov dword [ebp - 0x508], 0xec53312a
mov dword [ebp - 0x170], 0
jmp 0x442cc9
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x442ceb
push dword [ebp - 0x170]
lea ecx, [ebp - 0x240]
call fcn.0040f321
mov dword [eax], 0x683c8fc5
jmp 0x442cbc
mov dword [ebp - 0x3c], 0
jmp 0x442cfb
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x443104
mov dword [ebp - 0x58], 8
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x258], 7
push 2
lea ecx, [ebp - 0x67c]
call fcn.0040f233
mov dword [ebp - 0x178], 0
jmp 0x442d46
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jge 0x442d68
push dword [ebp - 0x178]
lea ecx, [ebp - 0x67c]
call fcn.0040f321
mov dword [eax], 0xfffffffd
jmp 0x442d39
mov dword [ebp - 0x58], 0
jmp 0x442d78
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jg 0x442db4
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x240]
call fcn.0040f321
cmp dword [eax], 0
je 0x442d93
jmp 0x442db4
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x442db2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x442d71
mov dword [ebp - 0x58], 0
jmp 0x442dc4
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x4430f4
mov dword [ebp - 0x60], 8
push 3
lea ecx, [ebp - 0x5c4]
call fcn.0040f233
mov dword [ebp - 0x180], 0
jmp 0x442dfb
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jge 0x442e1d
push dword [ebp - 0x180]
lea ecx, [ebp - 0x5c4]
call fcn.0040f321
mov dword [eax], 0x7ba27438
jmp 0x442dee
mov dword [ebp - 0x60], 0
jmp 0x442e2d
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jg 0x442f25
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x240]
call fcn.0040f321
cmp dword [eax], 0x35edade0
jl 0x442e59
mov dword [ebp - 0x40c], 1
jmp 0x442e60
and dword [ebp - 0x40c], 0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x240]
call fcn.0040f321
cmp dword [eax], 0xaf72b572
jbe 0x442e82
mov dword [ebp - 0x404], 1
jmp 0x442e89
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x404], eax
jne 0x442ea3
mov dword [ebp - 0x414], 1
jmp 0x442eaa
and dword [ebp - 0x414], 0
mov dword [ebp - 0xa8], 8
mov eax, dword [ebp - 0x40c]
imul eax, dword [ebp - 0x414]
cmp dword [ebp - 0xa8], eax
jg 0x442ed5
mov dword [ebp - 0x41c], 1
jmp 0x442edc
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0xa8], 0
jmp 0x442f01
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x442f20
mov byte [ebp - 0x76], 0
movzx eax, byte [ebp - 0x76]
test eax, eax
je 0x442f1e
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x442ef4
jmp 0x442e26
push 0
lea ecx, [ebp - 0x240]
call fcn.0040f321
push 0
lea ecx, [ebp - 0x67c]
call fcn.0040f321
cmp dword [eax], 0
jne 0x442ffd
cmp dword [ebp - 0x3c], 0
jne 0x442fc6
push 0
lea ecx, [ebp - 0x240]
call fcn.0040f321
push 0
lea ecx, [ebp - 0x240]
call fcn.0040f321
mov eax, dword [eax]
sub eax, 0xbd55
je 0x442f8f
push 0
lea ecx, [ebp - 0x240]
call fcn.0040f321
cmp dword [eax], 0
je 0x442f8f
mov dword [ebp - 0x424], 1
jmp 0x442f96
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x424]
cmp eax, dword [ebp - 0xb0]
jne 0x442fb4
mov dword [ebp - 0x42c], 1
jmp 0x442fbb
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x42c], eax
je 0x442fd8
cmp dword [ebp - 0x3c], 0
je 0x442fd8
mov dword [ebp - 0x434], 1
jmp 0x442fdf
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x442ffd
and dword [ebp - 0x444], 0
jmp 0x443007
mov dword [ebp - 0x444], 1
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0xa8], 0
jg 0x443028
mov dword [ebp - 0x25c], 1
jmp 0x44302f
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x79c], eax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x6d4], eax
push 2
lea ecx, [ebp - 0x5c4]
call fcn.0040f321
push 2
lea ecx, [ebp - 0x5c4]
call fcn.0040f321
cmp dword [eax], 0xffffffff
je 0x443084
mov dword [ebp - 0x264], 1
jmp 0x44308b
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x264], 0xffffffff
jl 0x4430a0
mov dword [ebp - 0x4f8], 1
jmp 0x4430a7
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x74c], eax
mov eax, 0x2e26
test eax, eax
je 0x4430d1
cmp dword [ebp - 0x500], 0
je 0x4430d1
mov dword [ebp - 0x274], 1
jmp 0x4430d8
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x508], eax
lea ecx, [ebp - 0x5c4]
call fcn.0040f305
jmp 0x442dbd
lea ecx, [ebp - 0x67c]
call fcn.0040f305
jmp 0x442cf4
lea ecx, [ebp - 0x240]
call fcn.0040f305
jmp 0x442c6e
mov eax, dword [ebp - 0x510]
push dword [eax]
mov ecx, dword [ebp - 0x518]
call fcn.0040f321
or dword [eax], 0xffffffff
jmp 0x4437c9
push 1
lea ecx, [ebp - 0x734]
call fcn.0040f233
mov dword [ebp - 0x44], 0
jmp 0x44314c
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x443168
push dword [ebp - 0x44]
lea ecx, [ebp - 0x734]
call fcn.0040f321
mov dword [eax], 0x5b57fd54
jmp 0x443145
mov dword [ebp - 0x44], 0
jmp 0x443178
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x44318e
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x4e8], 0x4c506d44
jmp 0x443171
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x4e8], 0
jmp 0x4431bc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4e8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x4e8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4e8], 0
jl 0x443269
mov dword [ebp - 0x190], 5
push 1
lea ecx, [ebp - 0x658]
call fcn.0040f233
mov dword [ebp - 0x188], 0
jmp 0x443200
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 1
jge 0x443222
push dword [ebp - 0x188]
lea ecx, [ebp - 0x658]
call fcn.0040f321
mov dword [eax], 0x2c36544d
jmp 0x4431f3
mov dword [ebp - 0x190], 0
jmp 0x44323b
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jg 0x443259
push 0
lea ecx, [ebp - 0x658]
call fcn.0040f321
mov dword [eax], 0xfef9d786
jmp 0x44322e
lea ecx, [ebp - 0x658]
call fcn.0040f305
jmp 0x4431a1
lea ecx, [ebp - 0x734]
call fcn.0040f305
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x528], eax
push 4
lea ecx, [ebp - 0x628]
call fcn.0040f233
mov dword [ebp - 0xb4], 0xa32b1cec
mov dword [ebp - 0x198], 0
jmp 0x4432ad
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 4
jge 0x4432cc
push dword [ebp - 0x198]
lea ecx, [ebp - 0x628]
call fcn.0040f321
or dword [eax], 0xffffffff
jmp 0x4432a0
mov dword [ebp - 0xb4], 3
jmp 0x4432e5
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jl 0x443351
mov dword [ebp - 0xf0], 0x48f69f7f
mov dword [ebp - 0xf0], 0
jmp 0x443311
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 4
jge 0x443333
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x628]
call fcn.0040f321
mov dword [eax], 6
jmp 0x443304
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x44334f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x4432d8
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xb4], eax
lea ecx, [ebp - 0x628]
call fcn.0040f305
push 1
lea ecx, [ebp - 0x5a4]
call fcn.0040f233
mov dword [ebp - 0xf8], 0x61f
mov dword [ebp - 0x6dc], 0xe0980db9
mov dword [ebp - 0x1a0], 0
jmp 0x4433a2
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 1
jge 0x4433c4
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x5a4]
call fcn.0040f321
mov dword [eax], 0xfffffff9
jmp 0x443395
push 0
lea ecx, [ebp - 0x5a4]
call fcn.0040f321
cmp dword [eax], 0
jne 0x4433e2
mov dword [ebp - 0x27c], 1
jmp 0x4433e9
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf8], 0
jmp 0x44340e
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x16
jle 0x4435a9
mov dword [ebp - 0x100], 1
mov dword [ebp - 0x1a8], 0
jmp 0x44343e
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 4
jge 0x44345a
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x7fc], 0
jmp 0x443431
mov dword [ebp - 0x100], 0
jmp 0x443473
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jg 0x4435a4
mov dword [ebp - 0xfc], 1
mov dword [ebp - 0xfc], 0
jmp 0x4434a3
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jg 0x44359f
mov dword [ebp - 0x1b0], 0
push dword [ebp - 0x100]
lea ecx, [ebp - 0x5a4]
call fcn.0040f321
mov dword [ebp - 0x284], eax
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x5a4]
call fcn.0040f321
mov ecx, dword [ebp - 0x284]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x284]
mov ecx, dword [ecx]
mov dword [ebp + eax - 0x7fc], ecx
mov dword [ebp - 0x1b0], 0
jmp 0x44351a
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xffffffe7
jge 0x44359a
push 3
lea ecx, [ebp - 0x670]
call fcn.0040f233
mov dword [ebp - 0x520], 1
mov dword [ebp - 0x1b8], 0
jmp 0x443553
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 3
jge 0x443575
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x670]
call fcn.0040f321
mov dword [eax], 0xab2a
jmp 0x443546
push 2
lea ecx, [ebp - 0x670]
call fcn.0040f321
mov eax, dword [eax]
mov dword [ebp - 0x520], eax
lea ecx, [ebp - 0x670]
call fcn.0040f305
jmp 0x44350d
jmp 0x443496
jmp 0x443466
jmp 0x443401
lea ecx, [ebp - 0x5a4]
call fcn.0040f305
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x5e0], 1
mov dword [ebp - 0x5dc], 1
mov dword [ebp - 0x5d8], 1
mov dword [ebp - 0x5d4], 1
lea ecx, [ebp - 0x209]
call fcn.0040f330
push eax
lea eax, [ebp - 0x5d0]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea ecx, [ebp - 0x814]
call fcn.0040f333
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5b4]
call fcn.0040f2df
mov dword [ebp - 0x68], 0x184c506d
mov dword [ebp - 0x68], 0
jmp 0x443634
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jg 0x4437ad
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x538], 0x64c9d8d9
mov dword [ebp - 0x1c0], 0
jmp 0x443668
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 3
jge 0x443684
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x7dc], 0x9c6fec1b
jmp 0x44365b
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x76c], eax
push 0
lea ecx, [ebp - 0x5b4]
call fcn.0040f321
push 3
lea ecx, [ebp - 0x5b4]
call fcn.0040f321
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6e4], eax
push dword [ebp - 0x68]
lea ecx, [ebp - 0x5b4]
call fcn.0040f321
mov dword [ebp - 0x28c], eax
push 0
lea ecx, [ebp - 0x5b4]
call fcn.0040f321
mov ecx, dword [ebp - 0x28c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x28c]
cmp dword [ecx], eax
jne 0x4436f4
mov dword [ebp - 0x294], 1
jmp 0x4436fb
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x294], eax
jne 0x443712
mov dword [ebp - 0x29c], 1
jmp 0x443719
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x29c]
imul eax, ecx
cmp eax, dword [ebp - 0x5c]
jne 0x443734
push 4
pop eax
test eax, eax
je 0x443746
cmp dword [ebp - 0x68], 0
je 0x443746
mov dword [ebp - 0x2a4], 1
jmp 0x44374d
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x2a4], eax
jle 0x443764
mov dword [ebp - 0x4f0], 1
jmp 0x44376b
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x754], eax
cmp dword [ebp - 0x538], 0
jne 0x44378c
cmp dword [ebp - 0x5c], 0
jne 0x44378c
and dword [ebp - 0x2ac], 0
jmp 0x443796
mov dword [ebp - 0x2ac], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp + eax - 0x7dc], ecx
jmp 0x44362d
lea ecx, [ebp - 0x5b4]
call fcn.0040f305
mov eax, dword [ebp - 0x2b4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2b4]
mov dword [ecx], eax
pop esi
mov esp, ebp
pop ebp
ret