Function at 0x40237e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a58
push edi
lea edi, [ebp - 0x2a58]
push 1
call dword [ebx + 0x44]
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0xe
je 0x4023a7
call dword [ebx + 0x3c]
cmp eax, 1
jne 0x408f68
mov dword [edi], 0
mov ecx, dword [ebx + 0x15c]
add ecx, dword [ebx + 0x74]
lea eax, [ecx + 0x108]
mov ecx, dword [ecx]
cmp ecx, 3
jne 0x402524
push eax
push edi
call fcn.00409861
cmp eax, 1
jne 0x4023db
mov dword [edi], 0x409c62
jmp 0x40240c
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x5a494c41
push 0x4954494e
push 0x495f4f54
push 0x5f44454c
push 0x49414624
push esp
call dword [ebx + 0x30]
add esp, 0x24
cmp dword [edi], 0
je 0x402522
push 0xa
push 0xd732520
push 0x5d24454d
push 0x414e5f52
push 0x45545041
push 0x4441245b
mov ecx, dword [ebx + 0x15c]
add ecx, dword [ebx + 0x74]
lea edx, [ecx + 4]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
add esp, 0x18
lea edx, [edi + 0x38]
push edx
push 0
call dword [edi + 4]
cmp eax, 0
jne 0x402522
lea edx, [ebp - 0x27f8]
push edx
lea edx, [ebp - 0x2848]
push edx
lea edx, [ebp - 0x2898]
push edx
push dword [edi + 0x38]
call dword [edi + 0x30]
cmp eax, 0
jne 0x402522
push 0xa
push 0xd732520
push 0x5d244552
push 0x41574d52
push 0x49465f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x2898]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
add esp, 0x1c
push 0
push 0xa0d7325
push 0x205d244c
push 0x4c445f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x2848]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x402564
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x48545f59
push 0x425f4445
push 0x54524f50
push 0x5055535f
push 0x544f4e5f
push 0x53495f4c
push 0x4f434f54
push 0x4f525024
push esp
call dword [ebx + 0x30]
add esp, 0x30
cmp dword [edi], 0
je 0x408f68
mov dword [ebp - 0x25ac], 0
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
lea edx, [ecx + 2]
push edx
push eax
lea edx, [ebp - 0x27a8]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov dword [ebp - 0x249c], 0
cmp dword [esi + 0x270], 0x75736924
jne 0x406384
cmp dword [esi + 0x274], 0x3037757a
jne 0x406384
cmp dword [esi + 0x278], 0x5424315f
jne 0x406384
cmp dword [esi + 0x27c], 0x736e6172
jne 0x406384
cmp dword [esi + 0x280], 0x6e6f7274
jne 0x406384
cmp dword [esi + 0x284], 0x3230315b
jne 0x406384
cmp dword [esi + 0x288], 0x35312f34
jne 0x406384
cmp dword [esi + 0x28c], 0x322f3633
jne 0x406384
cmp dword [esi + 0x290], 0x2f383430
jne 0x406384
cmp dword [esi + 0x294], 0x30363532
jne 0x406384
cmp dword [esi + 0x298], 0x43205d6b
jne 0x406384
cmp word [esi + 0x29c], 0x4e41
jne 0x406384
cmp byte [esi + 0x29e], 0
jne 0x406384
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402691
cmp eax, 0xb
je 0x402691
cmp eax, 0xa
je 0x402691
cmp eax, 0x17
je 0x402691
cmp eax, 0x18
je 0x402691
cmp eax, 0x38
jne 0x406384
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x38
jne 0x4027eb
push 0x28
push 0
lea edx, [ebp - 0x1072]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
push 0x30
push 0
lea edx, [ebp - 0x104a]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
push 0
push dword [ebx + 0x8ac]
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x4e
push 0x490056
push 0x450047
push 0x4e0041
push 0x480043
mov dword [ebp - 0x104a], ebx
mov dword [ebp - 0x106e], 0x408f8e
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebp - 0x1062], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [ebp - 0x105e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.DLL_LoadCursorA]
mov dword [ebp - 0x105a], eax
mov dword [ebp - 0x1056], 0x10
mov dword [ebp - 0x104e], esp
lea edx, [ebp - 0x1072]
push edx
call dword [sym.imp.USER32.DLL_RegisterClassW]
lea edx, [ebp - 0x104a]
push edx
push dword [ebp - 0x1062]
push 0
push dword [ebx + 0x8ac]
push 0
push 0
push 0
push 0
push 0x100c0000
push 0
lea edx, [esp + 0x28]
push edx
push pe_nt_image_headers32
call dword [sym.imp.USER32.DLL_CreateWindowExW]
add esp, 0x14
test eax, eax
je 0x4027be
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.DLL_GetMessageW]
test eax, eax
je 0x4027bb
push esp
call dword [sym.imp.USER32.DLL_TranslateMessage]
push esp
call dword [sym.imp.USER32.DLL_DispatchMessageW]
jmp 0x402796
add esp, 0x1c
push 1
push dword [ebx + 0x8ac]
call dword [sym.imp.USER32.DLL_EnableWindow]
push dword [ebx + 0x8ac]
call dword [sym.imp.USER32.DLL_SetForegroundWindow]
cmp byte [ebp - 0x103a], 0
jne 0x4027eb
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x406384
push 0x7a120
push 0x800
push 6
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x402826
mov dword [ebp - 0x249c], 1
jmp 0x406384
push 1
push 0x23
push 1
push 0x8000
push 0
push 2
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x402857
mov dword [ebp - 0x249c], 1
jmp 0x40636e
mov dword [ebp - 0x101a], 0xe0070000
mov dword [ebp - 0x1016], 0xe8070000
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x40288a
cmp eax, 0xb
je 0x40288a
cmp eax, 0xa
je 0x40288a
cmp eax, 0x18
je 0x40288a
cmp eax, 0x38
jne 0x4028e3
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xffffffffffffffff
push 0
push 4
push 0
push 0x40
push 0
push 6
push 3
push 0
push 0
mov dword [ebp - 0x1012], esp
mov eax, dword [ebp - 0x1016]
mov dword [esp + 0x40], eax
mov eax, dword [ebp - 0x101a]
mov dword [esp + 0x5c], eax
push 0
push dword [ebp - 0x1012]
push 4
call dword [edi]
add esp, 0x60
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x40292b
push 0
push 0
push 0
push 0
push 0
push 5
push 0xe8050000
push 0
push 4
push 0
push 0
push 0
push 5
push 0xffffffffffffffff
push 0
push 4
push 0
push 0
push 0
push 5
push 1
push 0
push 0
mov eax, esp
push 0
push eax
push 4
call dword [edi]
add esp, 0x5c
cmp eax, 0xffffffff
jne 0x40293f
mov dword [ebp - 0x249c], 1
jmp 0x40636e
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402958
cmp eax, 0xa
je 0x402958
cmp eax, 0xb
jne 0x403b23
mov byte [esi + 0x6c], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402975
cmp eax, 0xa
je 0x402975
cmp eax, 0xb
jne 0x402c80
push 0x110fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x4029a6
mov dword [ebp - 0x249c], 1
jmp 0x4029d9
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x4029cc
mov dword [ebp - 0x249c], 1
jmp 0x4029d9
test eax, eax
je 0x4029d9
cmp byte [ebp - 0x2490], 0x7e
je 0x4029a6
cmp dword [ebp - 0x249c], 0
jne 0x402c80
mov byte [esi + 0x6c], 0
mov eax, dword [ebp - 0x101a]
mov dword [ebp - 0x1172], eax
mov dword [ebp - 0x116e], 0x941a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x402a2e
cmp eax, 0xffffffff
jne 0x402a3d
mov dword [ebp - 0x249c], 1
jmp 0x402c80
cmp byte [ebp - 0x2490], 0x5a
jne 0x402aec
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402a78
cmp ecx, eax
jae 0x402a78
mov dl, byte [ebp + ecx - 0x248e]
cmp dl, 0
je 0x402a78
cmp dl, 0xff
je 0x402a78
cmp dl, 0x2d
je 0x402a78
mov byte [ebp + ecx - 0x1470], dl
inc ecx
jmp 0x402a4f
mov byte [ebp + ecx - 0x1470], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402a90
cmp eax, 0xa
jne 0x402ae7
cmp byte [ebp - 0x1470], 0
je 0x402ae7
lea eax, [ebp - 0x1470]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
jmp 0x402c80
cmp byte [ebp - 0x2490], 0x7f
jne 0x402c80
cmp byte [ebp - 0x248e], 0x11
jne 0x402c80
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
mov dword [ebp - 0x101a], 0x4a020000
mov dword [ebp - 0x1016], 0x4a060000
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xffffffffffffffff
push 0
push 4
push 0
push 0x40
push 0
push 6
push 3
push 0
push 0
mov dword [ebp - 0x100e], esp
mov eax, dword [ebp - 0x1016]
mov dword [esp + 0x40], eax
mov eax, dword [ebp - 0x101a]
mov dword [esp + 0x5c], eax
push 0
push dword [ebp - 0x100e]
push 4
call dword [edi]
add esp, 0x60
mov eax, dword [ebp - 0x101a]
mov dword [ebp - 0x1172], eax
mov dword [ebp - 0x116e], 0x941a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x402bc7
cmp eax, 0xffffffff
jne 0x402bd6
mov dword [ebp - 0x249c], 1
jmp 0x402c80
cmp byte [ebp - 0x2490], 0x5a
jne 0x402c80
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402c11
cmp ecx, eax
jae 0x402c11
mov dl, byte [ebp + ecx - 0x248e]
cmp dl, 0
je 0x402c11
cmp dl, 0xff
je 0x402c11
cmp dl, 0x2d
je 0x402c11
mov byte [ebp + ecx - 0x1470], dl
inc ecx
jmp 0x402be8
mov byte [ebp + ecx - 0x1470], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402c29
cmp eax, 0xa
jne 0x402c80
cmp byte [ebp - 0x1470], 0
je 0x402c80
lea eax, [ebp - 0x1470]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402c94
cmp eax, 0xa
jne 0x403492
cmp dword [ebp - 0x249c], 0
jne 0x402cdf
mov dword [ebp - 0x116e], 0xb01a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x402cd5
cmp eax, 0xffffffff
jne 0x402cdf
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x402d86
mov dword [ebp - 0x116e], 0x951a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x402d24
cmp eax, 0xffffffff
jne 0x402d30
mov dword [ebp - 0x249c], 1
jmp 0x402d86
cmp byte [ebp - 0x2490], 0x5a
jne 0x402d86
movzx eax, byte [ebp - 0x248d]
mov ah, byte [ebp - 0x248e]
push 0xa
push 0xd642520
push 0x3a244e4f
push 0x49535245
push 0x565f5753
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x402e74
mov dword [ebp - 0x116e], 0x911a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x402dcb
cmp eax, 0xffffffff
jne 0x402dda
mov dword [ebp - 0x249c], 1
jmp 0x402e74
cmp byte [ebp - 0x2490], 0x5a
jne 0x402e74
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402e15
cmp ecx, eax
jae 0x402e15
mov dl, byte [ebp + ecx - 0x248e]
cmp dl, 0
je 0x402e15
cmp dl, 0xff
je 0x402e15
cmp dl, 0x2d
je 0x402e15
mov byte [ebp + ecx - 0x1430], dl
inc ecx
jmp 0x402dec
mov byte [ebp + ecx - 0x1430], 0
cmp byte [ebp - 0x1430], 0
je 0x402e74
lea eax, [ebp - 0x1430]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x44524148
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x402fe9
mov dword [ebp - 0x25a8], 5
mov dword [ebp - 0x116e], 0x921a
lea edx, [ebp - 0x1172]
push edx
push 6
push 0x9c4
push 0x40
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x402ec2
mov dword [ebp - 0x249c], 1
jmp 0x402fe9
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x402eeb
mov dword [ebp - 0x249c], 1
jmp 0x402fe9
test eax, eax
jne 0x402efc
dec dword [ebp - 0x25a8]
jne 0x402ec2
jmp 0x402fe9
cmp byte [ebp - 0x2490], 0x7f
jne 0x402f1a
cmp byte [ebp - 0x248e], 0x78
jne 0x402f1a
mov dword [ebp - 0x25a8], 5
jmp 0x402ec2
cmp byte [ebp - 0x2490], 0x7e
jne 0x402f2f
mov dword [ebp - 0x25a8], 5
jmp 0x402ec2
cmp byte [ebp - 0x2490], 0x5a
jne 0x402fe9
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402f6a
cmp ecx, eax
jae 0x402f6a
mov dl, byte [ebp + ecx - 0x248e]
cmp dl, 0
je 0x402f6a
cmp dl, 0xff
je 0x402f6a
cmp dl, 0x2d
je 0x402f6a
mov byte [ebp + ecx - 0x13f0], dl
inc ecx
jmp 0x402f41
mov byte [ebp + ecx - 0x13f0], 0
cmp byte [ebp - 0x13f0], 0
je 0x402fe9
lea eax, [ebp - 0x13f0]
push 0
push 0xa0d7325
push 0x203a2452
push 0x45424d55
push 0x4e5f4552
push 0x41574452
push 0x41485f55
push 0x43455f52
push 0x4f5f4449
push 0x5f524549
push 0x4c505055
push 0x535f4d45
push 0x54535953
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x48
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x4030ef
mov dword [ebp - 0x116e], 0x971a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x40302e
cmp eax, 0xffffffff
jne 0x40303d
mov dword [ebp - 0x249c], 1
jmp 0x4030ef
cmp byte [ebp - 0x2490], 0x5a
jne 0x4030ef
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x403073
cmp ecx, eax
jae 0x403073
mov dl, byte [ebp + ecx - 0x248e]
cmp dl, 0
je 0x403073
cmp dl, 0xff
je 0x403073
mov byte [ebp + ecx - 0x13b0], dl
inc ecx
jmp 0x40304f
mov byte [ebp + ecx - 0x13b0], 0
cmp byte [ebp - 0x13b0], 0
je 0x4030ef
lea eax, [ebp - 0x13b0]
push 0xa
push 0xd732520
push 0x3a244550
push 0x59545f45
push 0x4e49474e
push 0x455f524f
push 0x5f454d41
push 0x4e5f4d45
push 0x54535953
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
lea edx, [ebp - 0x13b0]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
cmp dword [ebp - 0x249c], 0
jne 0x4031fb
mov dword [ebp - 0x116e], 0x981a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x403134
cmp eax, 0xffffffff
jne 0x403143
mov dword [ebp - 0x249c], 1
jmp 0x4031fb
cmp byte [ebp - 0x2490], 0x5a
jne 0x4031fb
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x40317e
cmp ecx, eax
jae 0x40317e
mov dl, byte [ebp + ecx - 0x248e]
cmp dl, 0
je 0x40317e
cmp dl, 0xff
je 0x40317e
cmp dl, 0x2d
je 0x40317e
mov byte [ebp + ecx - 0x1370], dl
inc ecx
jmp 0x403155
mov byte [ebp + ecx - 0x1370], 0
cmp byte [ebp - 0x1370], 0
je 0x4031fb
lea eax, [ebp - 0x1370]
push 0xa0d73
push 0x25203a24
push 0x5245424d
push 0x554e5f4c
push 0x41495245
push 0x535f5245
push 0x54534554
push 0x5f524f5f
push 0x45444f43
push 0x5f504f48
push 0x535f5249
push 0x41504552
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x44
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x4032ab
mov dword [ebp - 0x116e], 0x991a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x403240
cmp eax, 0xffffffff
jne 0x40324c
mov dword [ebp - 0x249c], 1
jmp 0x4032ab
cmp byte [ebp - 0x2490], 0x5a
jne 0x4032ab
mov eax, dword [ebp - 0x248e]
bswap eax
test eax, eax
je 0x4032ab
push 0xa
push 0xd58382e
push 0x25203a24
push 0x45544144
push 0x5f474e49
push 0x4d4d4152
push 0x474f5250
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x40336a
mov dword [ebp - 0x116e], 0x9a1a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x4032f0
cmp eax, 0xffffffff
jne 0x4032fc
mov dword [ebp - 0x249c], 1
jmp 0x40336a
cmp byte [ebp - 0x2490], 0x5a
jne 0x40336a
movzx eax, byte [ebp - 0x248d]
mov ah, byte [ebp - 0x248e]
test eax, eax
je 0x40336a
push 0xa
push 0xd642520
push 0x3a245245
push 0x49464954
push 0x4e454449
push 0x5f415441
push 0x445f4349
push 0x54534f4e
push 0x47414944
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x403492
mov dword [ebp - 0x116e], 0xc11a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x4033af
cmp eax, 0xffffffff
jne 0x4033be
mov dword [ebp - 0x249c], 1
jmp 0x403492
cmp byte [ebp - 0x2490], 0x5a
jne 0x403492
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x4033f9
cmp ecx, eax
jae 0x4033f9
mov dl, byte [ebp + ecx - 0x248e]
cmp dl, 0
je 0x4033f9
cmp dl, 0xff
je 0x4033f9
cmp dl, 0x2d
je 0x4033f9
mov byte [ebp + ecx - 0x1330], dl
inc ecx
jmp 0x4033d0
mov byte [ebp + ecx - 0x1330], 0
cmp byte [ebp - 0x1330], 0
je 0x403492
cmp byte [esi + 0x6c], 0
je 0x403424
push 0x5f
push esp
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 4
lea edx, [ebp - 0x1330]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x1330]
push 0xa0d73
push 0x25203a24
push 0x52454946
push 0x49544e45
push 0x44495f31
push 0x30454c55
push 0x444f4d5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4034ab
cmp eax, 0xa
je 0x4034ab
cmp eax, 0xb
jne 0x4035a8
cmp dword [ebp - 0x249c], 0
jne 0x4035a8
mov dword [ebp - 0x116e], 0xc21a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x4034f0
cmp eax, 0xffffffff
jne 0x4034ff
mov dword [ebp - 0x249c], 1
jmp 0x4035a8
cmp byte [ebp - 0x2490], 0x5a
jne 0x4035a8
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x40353a
cmp ecx, eax
jae 0x40353a
mov dl, byte [ebp + ecx - 0x248e]
cmp dl, 0
je 0x40353a
cmp dl, 0xff
je 0x40353a
cmp dl, 0x2d
je 0x40353a
mov byte [ebp + ecx - 0x12f0], dl
inc ecx
jmp 0x403511
mov byte [ebp + ecx - 0x12f0], 0
cmp byte [ebp - 0x12f0], 0
je 0x4035a8
lea eax, [ebp - 0x12f0]
push 0xa0d73
push 0x25203a24
push 0x52454946
push 0x49544e45
push 0x44495f32
push 0x30454c55
push 0x444f4d5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4035bc
cmp eax, 0xa
jne 0x40393b
cmp dword [ebp - 0x249c], 0
jne 0x40366f
mov dword [ebp - 0x116e], 0xc31a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x403601
cmp eax, 0xffffffff
jne 0x40360d
mov dword [ebp - 0x249c], 1
jmp 0x40366f
cmp byte [ebp - 0x2490], 0x5a
jne 0x40366f
mov eax, dword [ebp - 0x248e]
bswap eax
test eax, eax
je 0x40366f
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x3330454c
push 0x55444f4d
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x403722
mov dword [ebp - 0x116e], 0xc41a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x4036b4
cmp eax, 0xffffffff
jne 0x4036c0
mov dword [ebp - 0x249c], 1
jmp 0x403722
cmp byte [ebp - 0x2490], 0x5a
jne 0x403722
mov eax, dword [ebp - 0x248e]
bswap eax
test eax, eax
je 0x403722
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x3430454c
push 0x55444f4d
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x4037d5
mov dword [ebp - 0x116e], 0xc51a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x403767
cmp eax, 0xffffffff
jne 0x403773
mov dword [ebp - 0x249c], 1
jmp 0x4037d5
cmp byte [ebp - 0x2490], 0x5a
jne 0x4037d5
mov eax, dword [ebp - 0x248e]
bswap eax
test eax, eax
je 0x4037d5
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x3530454c
push 0x55444f4d
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x403888
mov dword [ebp - 0x116e], 0xc61a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x40381a
cmp eax, 0xffffffff
jne 0x403826
mov dword [ebp - 0x249c], 1
jmp 0x403888
cmp byte [ebp - 0x2490], 0x5a
jne 0x403888
mov eax, dword [ebp - 0x248e]
bswap eax
test eax, eax
je 0x403888
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x3630454c
push 0x55444f4d
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x40393b
mov dword [ebp - 0x116e], 0xcb1a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x4038cd
cmp eax, 0xffffffff
jne 0x4038d9
mov dword [ebp - 0x249c], 1
jmp 0x40393b
cmp byte [ebp - 0x2490], 0x5a
jne 0x40393b
mov eax, dword [ebp - 0x248e]
bswap eax
test eax, eax
je 0x40393b
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x403a09
mov dword [ebp - 0x116e], 0xcc1a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x403980
cmp eax, 0xffffffff
jne 0x40398c
mov dword [ebp - 0x249c], 1
jmp 0x403a09
cmp byte [ebp - 0x2490], 0x5a
jne 0x403a09
mov eax, dword [ebp - 0x248e]
bswap eax
mov dword [ebp - 0x1270], eax
test eax, eax
je 0x403a09
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4039b7
cmp eax, 0xa
jne 0x403a09
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x45524157
push 0x44524148
push 0x24202445
push 0x4d495424
push dword [ebp - 0x1270]
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x403a1d
cmp eax, 0xa
jne 0x403b23
cmp dword [ebp - 0x249c], 0
jne 0x403b23
mov dword [ebp - 0x116e], 0x901a
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x403a62
cmp eax, 0xffffffff
jne 0x403a71
mov dword [ebp - 0x249c], 1
jmp 0x403b23
cmp byte [ebp - 0x2490], 0x5a
jne 0x403b23
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x403aac
cmp ecx, eax
jae 0x403aac
mov dl, byte [ebp + ecx - 0x248e]
cmp dl, 0
je 0x403aac
cmp dl, 0xff
je 0x403aac
cmp dl, 0x2d
je 0x403aac
mov byte [ebp + ecx - 0x12b0], dl
inc ecx
jmp 0x403a83
mov byte [ebp + ecx - 0x12b0], 0
cmp byte [ebp - 0x12b0], 0
je 0x403b23
cmp byte [esi + 0x6c], 0
je 0x403ad3
push 0x5f
push esp
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 4
lea edx, [ebp - 0x12b0]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x12b0]
push 0xa0d
push 0x7325203a
push 0x244e4956
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x403b3c
cmp eax, 0xb
je 0x403b3c
cmp eax, 0x38
jne 0x404dea
mov dword [ebp - 0x126c], 0
cmp dword [ebp - 0x249c], 0
jne 0x403d7d
cmp eax, 0xffffffff
jne 0x403b67
mov dword [ebp - 0x249c], 1
jmp 0x403d7d
mov dword [ebp - 0x1474], 0x20
mov dword [ebp - 0x25a8], 0x10
push 0x210fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x403baf
mov dword [ebp - 0x249c], 1
jmp 0x403d7d
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x403bd8
mov dword [ebp - 0x249c], 1
jmp 0x403d7d
test eax, eax
jne 0x403be4
dec dword [ebp - 0x25a8]
jne 0x403b7b
push 0x3efe
push 0x1010000
push 0
push 6
push 0
push 0xc0
push 0
push 6
push 0x7c6
push 0
push 0
mov dword [ebp - 0x100a], esp
push 0
push dword [ebp - 0x100a]
push 6
call dword [edi]
add esp, 0x2c
push 0x28fe
push 0x1010000
push esp
push 6
push 0x9c4
push 0xc0
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x403c4f
mov dword [ebp - 0x249c], 1
jmp 0x403d7d
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x403c78
mov dword [ebp - 0x249c], 1
jmp 0x403d7d
test eax, eax
jne 0x403c88
dec dword [ebp - 0x1474]
jne 0x403b71
test eax, eax
jne 0x403cf7
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403cd4
xor eax, eax
jmp 0x403cde
cmp eax, 0x20
jbe 0x403cde
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x403d7d
cmp byte [ebp - 0x2490], 0x68
je 0x403d7d
cmp byte [ebp - 0x2490], 0x7e
je 0x403c4f
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403d5f
xor eax, eax
jmp 0x403d69
cmp eax, 0x20
jbe 0x403d69
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x403edc
push 0xa2fe
push 0x1010000
push esp
push 6
push 0x9c4
push 0xc0
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x403dbe
mov dword [ebp - 0x249c], 1
jmp 0x403edc
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x403de7
mov dword [ebp - 0x249c], 1
jmp 0x403edc
test eax, eax
jne 0x403e56
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403e33
xor eax, eax
jmp 0x403e3d
cmp eax, 0x20
jbe 0x403e3d
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x403edc
cmp byte [ebp - 0x2490], 0xe2
je 0x403edc
cmp byte [ebp - 0x2490], 0x7e
je 0x403dbe
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403ebe
xor eax, eax
jmp 0x403ec8
cmp eax, 0x20
jbe 0x403ec8
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
mov dword [ebp - 0x2498], 5
cmp dword [ebp - 0x249c], 0
jne 0x4044b2
cmp byte [ebp - 0x248f], 0
je 0x4044b2
cmp byte [ebp - 0x248f], 1
je 0x4044b2
cmp byte [ebp - 0x248f], 0x54
je 0x4044b2
cmp byte [ebp - 0x248f], 0x55
je 0x4044b2
push 0
mov dword [ebp - 0x1006], esp
push 0
push dword [ebp - 0x1006]
push 7
call dword [edi]
add esp, 4
push 0x2af8
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp eax, 0xffffffff
jne 0x403f58
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x403f89
push 1
push 0x8000
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x403f89
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x403ff6
push 0x110fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x403fc3
mov dword [ebp - 0x249c], 1
jmp 0x403ff6
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x403fe9
mov dword [ebp - 0x249c], 1
jmp 0x403ff6
test eax, eax
je 0x403ff6
cmp byte [ebp - 0x2490], 0x7e
je 0x403fc3
cmp dword [ebp - 0x249c], 0
jne 0x4040b4
mov dword [ebp - 0x1474], 0x10
mov dword [ebp - 0x25a8], 5
push 4
push 0xe0070000
push esp
push 5
push 0x9c4
push 0x40
push 6
push 0
call fcn.00409549
add esp, 8
cmp eax, 0xffffffff
jne 0x404045
mov dword [ebp - 0x249c], 1
jmp 0x4040b4
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x40406b
mov dword [ebp - 0x249c], 1
jmp 0x4040b4
test eax, eax
jne 0x404081
dec dword [ebp - 0x25a8]
jne 0x404045
dec dword [ebp - 0x1474]
jne 0x40400d
jmp 0x4040b4
cmp byte [ebp - 0x2490], 0x7f
jne 0x40409f
cmp byte [ebp - 0x248e], 0x78
jne 0x40409f
mov dword [ebp - 0x25a8], 5
jmp 0x404045
cmp byte [ebp - 0x2490], 0x7e
jne 0x4040b4
mov dword [ebp - 0x25a8], 5
jmp 0x404045
cmp dword [ebp - 0x249c], 0
jne 0x4042d7
mov dword [ebp - 0x1474], 0x20
mov dword [ebp - 0x25a8], 0x10
push 0x210fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x404109
mov dword [ebp - 0x249c], 1
jmp 0x4042d7
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x404132
mov dword [ebp - 0x249c], 1
jmp 0x4042d7
test eax, eax
jne 0x40413e
dec dword [ebp - 0x25a8]
jne 0x4040d5
push 0x3efe
push 0x1010000
push 0
push 6
push 0
push 0xc0
push 0
push 6
push 0x7d0
push 0
push 0
mov dword [ebp - 0x1002], esp
push 0
push dword [ebp - 0x1002]
push 6
call dword [edi]
add esp, 0x2c
push 0x28fe
push 0x1010000
push esp
push 6
push 0x9c4
push 0xc0
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x4041a9
mov dword [ebp - 0x249c], 1
jmp 0x4042d7
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x4041d2
mov dword [ebp - 0x249c], 1
jmp 0x4042d7
test eax, eax
jne 0x4041e2
dec dword [ebp - 0x1474]
jne 0x4040cb
test eax, eax
jne 0x404251
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40422e
xor eax, eax
jmp 0x404238
cmp eax, 0x20
jbe 0x404238
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x4042d7
cmp byte [ebp - 0x2490], 0x68
je 0x4042d7
cmp byte [ebp - 0x2490], 0x7e
je 0x4041a9
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4042b9
xor eax, eax
jmp 0x4042c3
cmp eax, 0x20
jbe 0x4042c3
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x404436
push 0xa2fe
push 0x1010000
push esp
push 6
push 0x9c4
push 0xc0
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x404318
mov dword [ebp - 0x249c], 1
jmp 0x404436
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x404341
mov dword [ebp - 0x249c], 1
jmp 0x404436
test eax, eax
jne 0x4043b0
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40438d
xor eax, eax
jmp 0x404397
cmp eax, 0x20
jbe 0x404397
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x404436
cmp byte [ebp - 0x2490], 0xe2
je 0x404436
cmp byte [ebp - 0x2490], 0x7e
je 0x404318
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404418
xor eax, eax
jmp 0x404422
cmp eax, 0x20
jbe 0x404422
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
dec dword [ebp - 0x2498]
jne 0x403ee6
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404494
xor eax, eax
jmp 0x40449e
cmp eax, 0x20
jbe 0x40449e
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x40460e
cmp dword [ebp - 0x249c], 0
jne 0x4045a1
push 0x1a5fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x404502
mov dword [ebp - 0x249c], 1
jmp 0x4045a1
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x404528
mov dword [ebp - 0x249c], 1
jmp 0x4045a1
test eax, eax
jne 0x404594
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404574
xor eax, eax
jmp 0x40457e
cmp eax, 0x20
jbe 0x40457e
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x4045a1
cmp byte [ebp - 0x2490], 0x7e
je 0x404502
cmp dword [ebp - 0x249c], 0
jne 0x40460e
push 0x3a5fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x4045db
mov dword [ebp - 0x249c], 1
jmp 0x40460e
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x404601
mov dword [ebp - 0x249c], 1
jmp 0x40460e
test eax, eax
je 0x40460e
cmp byte [ebp - 0x2490], 0x7e
je 0x4045db
cmp dword [ebp - 0x249c], 0
jne 0x4047e7
mov dword [ebp - 0x25a8], 0x20
mov eax, dword [ebp - 0x101a]
mov dword [ebp - 0x1172], eax
mov dword [ebp - 0x116e], 0x127
lea edx, [ebp - 0x1172]
push edx
push 6
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
jne 0x404673
mov dword [ebp - 0x249c], 1
jmp 0x4047e7
cmp eax, 0xffffffff
jne 0x404687
mov dword [ebp - 0x249c], 1
jmp 0x4047e7
cmp byte [ebp - 0x2490], 0x7f
jne 0x40476c
cmp byte [ebp - 0x248e], 0x36
jne 0x4046b6
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x25a8]
jne 0x404625
jmp 0x4046f8
cmp byte [ebp - 0x248e], 0x37
jne 0x4046d8
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x25a8]
jne 0x404625
jmp 0x4046f8
cmp byte [ebp - 0x248e], 0x22
jne 0x4046f8
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x25a8]
jne 0x404625
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40474c
xor eax, eax
jmp 0x404756
cmp eax, 0x20
jbe 0x404756
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x4047e7
cmp byte [ebp - 0x2490], 0x67
je 0x4047e7
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4047c9
xor eax, eax
jmp 0x4047d3
cmp eax, 0x20
jbe 0x4047d3
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x404dea
cmp eax, 0xb
jne 0x404b14
cmp dword [ebp - 0x248e], 0
jne 0x404813
cmp byte [ebp - 0x248a], 0
je 0x404dea
mov byte [ebp - 0x1268], 0x20
mov byte [ebp - 0x1267], 0xf4
mov dword [ebp - 0x1266], 0x100
mov eax, dword [ebp - 0x248e]
mov dword [ebp - 0x1262], eax
mov al, byte [ebp - 0x248a]
mov byte [ebp - 0x125e], al
cmp dword [ebp - 0x126c], 0
jne 0x404876
mov dword [ebp - 0x11ea], 0x281b142e
mov dword [ebp - 0x11e6], 0x5282c5a
mov dword [ebp - 0x11e2], 0x98be1cdf
mov dword [ebp - 0x11de], 0xefcbe971
jmp 0x40489e
mov dword [ebp - 0x11ea], 0
mov dword [ebp - 0x11e6], 0
mov dword [ebp - 0x11e2], 0
mov dword [ebp - 0x11de], 0
push 0xfa
lea edx, [ebp - 0x26ae]
push edx
push 0xf6
lea edx, [ebp - 0x1268]
push edx
call dword [ebx + 0x40]
cmp eax, 5
je 0x4048fc
push 0xa0d24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
mov dword [ebp - 0x249c], 1
jmp 0x404b0f
mov dword [ebp - 0x116e], 0x227
mov eax, dword [ebp - 0x26ae]
mov dword [ebp - 0x116c], eax
mov al, byte [ebp - 0x26aa]
mov byte [ebp - 0x1168], al
lea edx, [ebp - 0x1172]
push edx
push 0xb
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
jne 0x404956
mov dword [ebp - 0x249c], 1
jmp 0x404b0f
cmp eax, 0xffffffff
jne 0x40496a
mov dword [ebp - 0x249c], 1
jmp 0x404b0f
cmp byte [ebp - 0x2490], 0x7f
jne 0x404a96
cmp byte [ebp - 0x248e], 0x35
jne 0x4049d1
mov dword [ebp - 0x25a8], 0x20
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x9c4]
mov dword [ebp - 0x25a4], eax
lea edx, [ebp - 0x2494]
push edx
push 0x64
push 6
push 0
call fcn.004096b7
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x25a4]
jl 0x40499c
inc dword [ebp - 0x126c]
cmp dword [ebp - 0x126c], 2
jl 0x404625
jmp 0x404a24
cmp byte [ebp - 0x248e], 0x36
je 0x4049e3
cmp byte [ebp - 0x248e], 0x37
jne 0x404a24
mov dword [ebp - 0x25a8], 0x20
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x9c4]
mov dword [ebp - 0x25a4], eax
lea edx, [ebp - 0x2494]
push edx
push 0x32
push 6
push 0
call fcn.004096b7
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x25a4]
jl 0x4049ff
jmp 0x404625
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404a76
xor eax, eax
jmp 0x404a80
cmp eax, 0x20
jbe 0x404a80
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x404b0f
cmp byte [ebp - 0x2490], 0x67
je 0x404b0f
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404af1
xor eax, eax
jmp 0x404afb
cmp eax, 0x20
jbe 0x404afb
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x404dea
cmp word [ebp - 0x248e], 0
je 0x404dea
push 0xe9de
push 0xd0cac9c2
push 0xbfb4b299
push 0x92848281
push 0x736c483e
push 0x281400b0
mov byte [ebp - 0x1268], 0x20
mov byte [ebp - 0x1267], 0xf4
mov eax, dword [ebp - 0x126c]
movzx eax, byte [esp + eax]
mov dword [ebp - 0x1266], eax
mov al, byte [ebp - 0x248e]
mov byte [ebp - 0x1262], al
mov al, byte [ebp - 0x248d]
mov byte [ebp - 0x1261], al
add esp, 0x18
push 0xfa
lea edx, [ebp - 0x26ae]
push edx
push 0xf6
lea edx, [ebp - 0x1268]
push edx
call dword [ebx + 0x40]
cmp eax, 2
je 0x404bd7
push 0xa0d24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
mov dword [ebp - 0x249c], 1
jmp 0x404dea
mov dword [ebp - 0x116e], 0x227
mov al, byte [ebp - 0x26ae]
mov byte [ebp - 0x116c], al
mov al, byte [ebp - 0x26ad]
mov byte [ebp - 0x116b], al
lea edx, [ebp - 0x1172]
push edx
push 8
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
jne 0x404c31
mov dword [ebp - 0x249c], 1
jmp 0x404dea
cmp eax, 0xffffffff
jne 0x404c45
mov dword [ebp - 0x249c], 1
jmp 0x404dea
cmp byte [ebp - 0x2490], 0x7f
jne 0x404d71
cmp byte [ebp - 0x248e], 0x35
jne 0x404cac
mov dword [ebp - 0x25a8], 0x20
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x9c4]
mov dword [ebp - 0x25a4], eax
lea edx, [ebp - 0x2494]
push edx
push 0x64
push 6
push 0
call fcn.004096b7
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x25a4]
jl 0x404c77
inc dword [ebp - 0x126c]
cmp dword [ebp - 0x126c], 0x16
jl 0x404625
jmp 0x404cff
cmp byte [ebp - 0x248e], 0x36
je 0x404cbe
cmp byte [ebp - 0x248e], 0x37
jne 0x404cff
mov dword [ebp - 0x25a8], 0x20
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x9c4]
mov dword [ebp - 0x25a4], eax
lea edx, [ebp - 0x2494]
push edx
push 0x32
push 6
push 0
call fcn.004096b7
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x25a4]
jl 0x404cda
jmp 0x404625
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404d51
xor eax, eax
jmp 0x404d5b
cmp eax, 0x20
jbe 0x404d5b
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x404dea
cmp byte [ebp - 0x2490], 0x67
je 0x404dea
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404dcc
xor eax, eax
jmp 0x404dd6
cmp eax, 0x20
jbe 0x404dd6
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x38
jne 0x404f30
cmp dword [ebp - 0x249c], 0
jne 0x404f30
mov dword [ebp - 0x116e], 0x903b
push 0x11
lea edx, [ebp - 0x103a]
push edx
lea edx, [ebp - 0x116c]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
push 0xa0d24
push 0x4e49565f
push 0x474e4947
push 0x4e414843
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
lea edx, [ebp - 0x1172]
push edx
push 0x17
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x404e7c
cmp eax, 0xffffffff
jne 0x404e8b
mov dword [ebp - 0x249c], 1
jmp 0x404f30
cmp byte [ebp - 0x2490], 0x7b
je 0x404f06
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404ee6
xor eax, eax
jmp 0x404ef0
cmp eax, 0x20
jbe 0x404ef0
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x404f30
push 0xa0d
push 0x244b4f5f
push 0x4e49565f
push 0x474e4947
push 0x4e414843
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x40544c
cmp dword [ebp - 0x249c], 0
jne 0x405221
mov dword [ebp - 0x116e], 0x200023
mov dword [ebp - 0x116a], 0x100000
lea edx, [ebp - 0x1172]
push edx
push 0xb
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x404f8e
cmp eax, 0xffffffff
jne 0x404f9d
mov dword [ebp - 0x249c], 1
jmp 0x405221
cmp byte [ebp - 0x2490], 0x7f
jne 0x40519f
cmp byte [ebp - 0x248e], 0x31
jne 0x40519f
mov dword [ebp - 0x116e], 0x180023
mov dword [ebp - 0x116a], 0x100000
lea edx, [ebp - 0x1172]
push edx
push 0xb
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x404ff9
cmp eax, 0xffffffff
jne 0x405008
mov dword [ebp - 0x249c], 1
jmp 0x40519a
cmp byte [ebp - 0x2490], 0x7f
jne 0x405118
cmp byte [ebp - 0x248e], 0x31
jne 0x405118
mov dword [ebp - 0x116e], 0x100023
mov dword [ebp - 0x116a], 0x100000
lea edx, [ebp - 0x1172]
push edx
push 0xb
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x405064
cmp eax, 0xffffffff
jne 0x405073
mov dword [ebp - 0x249c], 1
jmp 0x405113
cmp byte [ebp - 0x2490], 0x7f
jne 0x405091
cmp byte [ebp - 0x248e], 0x31
jne 0x405091
mov dword [esi + 0x14], 0x100000
jmp 0x405113
cmp byte [ebp - 0x2490], 0x63
je 0x40510c
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4050ec
xor eax, eax
jmp 0x4050f6
cmp eax, 0x20
jbe 0x4050f6
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x405113
mov dword [esi + 0x14], 0x180000
jmp 0x40519a
cmp byte [ebp - 0x2490], 0x63
je 0x405193
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405173
xor eax, eax
jmp 0x40517d
cmp eax, 0x20
jbe 0x40517d
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x40519a
mov dword [esi + 0x14], 0x200000
jmp 0x405221
cmp byte [ebp - 0x2490], 0x63
je 0x40521a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4051fa
xor eax, eax
jmp 0x405204
cmp eax, 0x20
jbe 0x405204
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x405221
mov dword [esi + 0x14], 0x280000
cmp dword [ebp - 0x249c], 0
jne 0x405411
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [esi + 0x14]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x24], eax
mov dword [ebp - 0xffe], 0
mov eax, dword [esi + 0x14]
mov dword [ebp - 0xffa], eax
mov dword [ebp - 0xff6], 0
shl eax, 0xa
and eax, 0xffff0000
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov eax, dword [ebp - 0xffe]
mov ecx, dword [ebp - 0xffa]
cmp eax, ecx
jae 0x405411
sub ecx, eax
cmp ecx, 0x40
jbe 0x4052eb
mov ecx, 0x40
mov dword [ebp - 0xff2], ecx
mov dword [ebp - 0x116e], 0x23
mov byte [ebp - 0x1169], ch
mov byte [ebp - 0x1168], cl
add eax, dword [ebp - 0xff6]
mov byte [ebp - 0x116b], ah
mov byte [ebp - 0x116a], al
shr eax, 0x10
mov byte [ebp - 0x116d], ah
mov byte [ebp - 0x116c], al
lea edx, [ebp - 0x1172]
push edx
push 0xb
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x405356
cmp eax, 0xffffffff
jne 0x405365
mov dword [ebp - 0x249c], 1
jmp 0x405411
cmp byte [ebp - 0x2490], 0x63
je 0x4053e0
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4053c0
xor eax, eax
jmp 0x4053ca
cmp eax, 0x20
jbe 0x4053ca
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x405411
call fcn.004094c6
mov eax, dword [ebp - 0xff2]
mov ecx, dword [ebp - 0xffe]
add ecx, dword [esi + 0x24]
add dword [ebp - 0xffe], eax
push eax
lea edx, [ebp - 0x248b]
push edx
push ecx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
jmp 0x4052cb
cmp dword [ebp - 0x249c], 0
jne 0x405443
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
jmp 0x40544c
lea edx, [esi + 0x24]
push edx
call fcn.00409839
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x405ec7
cmp dword [ebp - 0x249c], 0
jne 0x40547a
push 2
push 0x30
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
cmp dword [ebp - 0x249c], 0
jne 0x405d8b
mov dword [ebp - 0x5c3], 0
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov dword [ebp - 0x1474], 3
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x17]
mov dword [ebp - 0x25a4], eax
lea edx, [ebp - 0x2494]
push edx
push 0x17
push 6
push 0
call fcn.004096b7
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x25a4]
jl 0x4054cf
mov dword [ebp - 0x116e], 0x34
mov dword [ebp - 0x116a], 0
lea edx, [ebp - 0x1172]
push edx
push 0xa
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x405531
cmp eax, 0xffffffff
jne 0x405540
mov dword [ebp - 0x249c], 1
jmp 0x4055d2
cmp byte [ebp - 0x2490], 0x74
je 0x4055d2
dec dword [ebp - 0x1474]
je 0x405562
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4054ef
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4055b4
xor eax, eax
jmp 0x4055be
cmp eax, 0x20
jbe 0x4055be
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [esi + 0x14], 0x100000
jne 0x405630
mov dword [ebp - 0xfce], 0x20000
mov dword [ebp - 0xfca], 0x100000
mov dword [ebp - 0xfc6], pe_nt_image_headers32
mov dword [ebp - 0xfc2], 0xfffe001c
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
jmp 0x4057a3
cmp dword [esi + 0x14], 0x180000
jne 0x40568e
mov dword [ebp - 0xfce], 0x20000
mov dword [ebp - 0xfca], 0x180000
mov dword [ebp - 0xfc6], 0x800
mov dword [ebp - 0xfc2], 0xfffe001c
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
jmp 0x4057a3
cmp dword [esi + 0x14], 0x200000
jne 0x4056ec
mov dword [ebp - 0xfce], 0x40000
mov dword [ebp - 0xfca], 0x200000
mov dword [ebp - 0xfc6], 0x800
mov dword [ebp - 0xfc2], 0xfffc001c
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
jmp 0x4057a3
cmp dword [esi + 0x14], 0x280000
jne 0x4057a3
mov edx, dword [esi + 0x20]
cmp dword [edx + 0x2fff4], 0xffffffff
jne 0x405753
cmp dword [edx + 0x2fff8], 0xffffffff
jne 0x405753
cmp dword [edx + 0x2fffc], 0xffffffff
jne 0x405753
cmp dword [edx + 0x30000], 0xffffffff
je 0x405753
cmp dword [edx + 0x30000], 0
je 0x405753
mov dword [ebp - 0xfce], 0x30000
mov dword [ebp - 0xfca], 0x280000
mov dword [ebp - 0xfc6], 0x800
mov dword [ebp - 0xfc2], 0xfffd001c
jmp 0x40577b
mov dword [ebp - 0xfce], 0x40000
mov dword [ebp - 0xfca], 0x280000
mov dword [ebp - 0xfc6], 0x800
mov dword [ebp - 0xfc2], 0xfffc001c
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
mov dword [ebp - 0xfee], 0
mov dword [ebp - 0xfea], 0
cmp dword [ebp - 0xfee], 0x20
jae 0x4057f7
imul ecx, dword [ebp - 0xfee], 0x10
mov eax, dword [ebp + ecx - 0xfca]
sub eax, dword [ebp + ecx - 0xfce]
test eax, eax
je 0x4057f7
mov ecx, dword [ebp + ecx - 0xfc6]
xor edx, edx
div ecx
test edx, edx
je 0x4057e9
inc eax
add dword [ebp - 0xfea], eax
inc dword [ebp - 0xfee]
jmp 0x4057b7
mov eax, dword [ebp - 0xfea]
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0xfee], 0
imul ecx, dword [ebp - 0xfee], 0x10
mov eax, dword [ebp + ecx - 0xfce]
mov dword [ebp - 0xfe6], eax
mov eax, dword [ebp + ecx - 0xfca]
mov dword [ebp - 0xfe2], eax
mov eax, dword [ebp + ecx - 0xfc6]
mov dword [ebp - 0xfde], eax
mov eax, dword [ebp + ecx - 0xfc2]
mov dword [ebp - 0xfda], eax
cmp dword [ebp - 0x249c], 0
jne 0x405b6a
mov dword [ebp - 0x116e], 0x36
mov dword [ebp - 0x116a], 0
mov dword [ebp - 0x1166], 0x40430100
mov dword [ebp - 0x1162], 0x2d2d2d2d
mov dword [ebp - 0x115e], 0x2d2d2d2d
mov dword [ebp - 0x115a], 0x200
mov dword [ebp - 0x1156], 0x2000100
mov dword [ebp - 0x1152], 0
mov dword [ebp - 0x114e], 0
mov dword [ebp - 0xfd6], 0
cmp dword [ebp - 0x12ef], 0
jne 0x40591a
cmp dword [ebp - 0x12eb], 0
jne 0x40591a
mov dword [ebp - 0x12ef], 0x2d2d2d2d
mov dword [ebp - 0x12eb], 0x2d2d2d2d
push 8
lea edx, [ebp - 0x12ef]
push edx
lea edx, [ebp - 0x1162]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov ecx, dword [ebp - 0xfe6]
mov edx, dword [esi + 0x20]
cmp ecx, dword [ebp - 0xfe2]
jae 0x405951
movzx eax, byte [edx + ecx]
add dword [ebp - 0xfd6], eax
inc ecx
jmp 0x40593c
mov eax, dword [ebp - 0xfd6]
mov byte [ebp - 0x1168], ah
mov byte [ebp - 0x1167], al
mov eax, dword [ebp - 0x1270]
mov byte [ebp - 0x1158], ah
mov byte [ebp - 0x1157], al
mov eax, dword [ebp - 0xfe6]
mov byte [ebp - 0x1152], ah
mov byte [ebp - 0x1151], al
shr eax, 0x10
mov byte [ebp - 0x1154], ah
mov byte [ebp - 0x1153], al
mov eax, dword [ebp - 0xfe2]
sub eax, dword [ebp - 0xfe6]
mov byte [ebp - 0x114e], ah
mov byte [ebp - 0x114d], al
shr eax, 0x10
mov byte [ebp - 0x1150], ah
mov byte [ebp - 0x114f], al
mov dword [ebp - 0x25a8], 3
mov dword [ebp - 0x1474], 0x100
lea edx, [ebp - 0x1172]
push edx
push 0x26
push 0x1388
push 0x40
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x4059fe
mov dword [ebp - 0x249c], 1
jmp 0x405b6a
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x405a27
mov dword [ebp - 0x249c], 1
jmp 0x405b6a
test eax, eax
jne 0x405ab4
dec dword [ebp - 0x25a8]
jne 0x4059fe
mov dword [ebp - 0x25a8], 3
dec dword [ebp - 0x1474]
jne 0x4059d1
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405a91
xor eax, eax
jmp 0x405a9b
cmp eax, 0x20
jbe 0x405a9b
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x405b6a
cmp byte [ebp - 0x2490], 0x7f
jne 0x405ae4
cmp byte [ebp - 0x248e], 0x78
jne 0x405ae4
mov dword [ebp - 0x25a8], 3
mov dword [ebp - 0x1474], 0x100
jmp 0x4059fe
cmp byte [ebp - 0x2490], 0x76
je 0x405b6a
cmp byte [ebp - 0x2490], 0x7e
je 0x4059fe
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405b4c
xor eax, eax
jmp 0x405b56
cmp eax, 0x20
jbe 0x405b56
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x405d8b
mov eax, dword [ebp - 0x101a]
mov dword [ebp - 0xdce], eax
mov eax, dword [ebp - 0xfe6]
mov ecx, dword [ebp - 0xfe2]
cmp eax, ecx
jae 0x405d8b
sub ecx, eax
cmp ecx, dword [ebp - 0xfde]
jbe 0x405ba7
mov ecx, dword [ebp - 0xfde]
mov dword [ebp - 0xfd2], ecx
add eax, dword [ebp - 0xfda]
mov dword [ebp - 0xdca], 0x36
mov byte [ebp - 0xdc6], ah
mov byte [ebp - 0xdc5], al
shr eax, 0x10
mov byte [ebp - 0xdc8], ah
mov byte [ebp - 0xdc7], al
xor ecx, ecx
mov edx, dword [esi + 0x20]
add edx, dword [ebp - 0xfe6]
cmp ecx, dword [ebp - 0xfd2]
jae 0x405bf8
mov al, byte [edx + ecx]
mov byte [ebp + ecx - 0xdc4], al
inc ecx
jmp 0x405be3
mov dword [ebp - 0x1474], 0x100
mov ecx, dword [ebp - 0xfd2]
lea edx, [ebp - 0xdce]
push edx
lea edx, [ecx + 0xa]
push edx
push 0x9c4
push 0x40
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x405c37
mov dword [ebp - 0x249c], 1
jmp 0x405d8b
lea edx, [ebp - 0x2494]
push edx
push 0x64
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x405c5d
mov dword [ebp - 0x249c], 1
jmp 0x405d8b
test eax, eax
jne 0x405cd4
dec dword [ebp - 0x1474]
jne 0x405c02
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405cb1
xor eax, eax
jmp 0x405cbb
cmp eax, 0x20
jbe 0x405cbb
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x405d8b
cmp byte [ebp - 0x2490], 0x7f
jne 0x405cfa
cmp byte [ebp - 0x248e], 0x78
jne 0x405cfa
mov dword [ebp - 0x1474], 0x100
jmp 0x405c37
cmp byte [ebp - 0x2490], 0x76
je 0x405d75
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405d55
xor eax, eax
jmp 0x405d5f
cmp eax, 0x20
jbe 0x405d5f
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x405d8b
call fcn.004094c6
mov eax, dword [ebp - 0xfd2]
add dword [ebp - 0xfe6], eax
jmp 0x405b83
cmp dword [ebp - 0x249c], 0
jne 0x405e97
cmp eax, 0xffffffff
jne 0x405dac
mov dword [ebp - 0x249c], 1
jmp 0x405e97
mov dword [ebp - 0x25a8], 0x20
push 0x20fe
push 0x1010000
push esp
push 6
push 0xa
push 0xc0
push 6
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x405de7
mov dword [ebp - 0x249c], 1
jmp 0x405e97
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x405e10
mov dword [ebp - 0x249c], 1
jmp 0x405e97
test eax, eax
jne 0x405e1e
dec dword [ebp - 0x25a8]
jne 0x405db6
jmp 0x405e97
cmp byte [ebp - 0x2490], 0x60
je 0x405e97
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405e79
xor eax, eax
jmp 0x405e83
cmp eax, 0x20
jbe 0x405e83
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x405ec7
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x40608a
cmp dword [ebp - 0x249c], 0
jne 0x40608a
push 0x400
push 0
lea edx, [ebp - 0x5b7]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov dword [ebp - 0x5bf], 0
push 0
push 0x1281a903
push 0xe0070000
push esp
push 0xc
push 0xa
push 0
push 5
push 0
call fcn.00409549
cmp eax, 0xffffffff
jne 0x405f31
mov dword [ebp - 0x249c], 1
jmp 0x405f98
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
cmp eax, 0xffffffff
jne 0x405f57
mov dword [ebp - 0x249c], 1
jmp 0x405f98
test eax, eax
je 0x405f98
imul ecx, dword [ebp - 0x5bf], 4
movzx eax, byte [ebp - 0x248e]
mov ah, byte [ebp - 0x248f]
mov word [ebp + ecx - 0x5b7], ax
test eax, eax
je 0x405f96
movzx eax, byte [ebp - 0x248c]
mov ah, byte [ebp - 0x248d]
mov word [ebp + ecx - 0x5b5], ax
inc dword [ebp - 0x5bf]
jmp 0x405f31
cmp dword [ebp - 0x249c], 0
jne 0x40608a
push 0xa
push 0xd642520
push 0x3a24544e
push 0x554f435f
push 0x43544424
push dword [ebp - 0x5bf]
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
mov dword [ebp - 0x5bb], 0
mov ecx, dword [ebp - 0x5bb]
cmp ecx, dword [ebp - 0x5bf]
jae 0x40608a
imul ecx, ecx, 4
movzx eax, word [ebp + ecx - 0x5b7]
movzx ecx, ah
and eax, 0xff
cmp ecx, 0xc0
jb 0x40604f
sub ecx, 0xc0
push 0xa0d58
push 0x322e2558
push 0x322e2555
push eax
push ecx
lea eax, [esp + 8]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x1c
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
jmp 0x40607f
push 0xa0d58
push 0x322e2558
push 0x322e2550
push eax
push ecx
lea eax, [esp + 8]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x1c
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
inc dword [ebp - 0x5bb]
jmp 0x405fea
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x18
jne 0x406335
cmp dword [ebp - 0x249c], 0
jne 0x406335
push 0
push 0xa0d2443
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 4
push 0xe0070000
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x2710
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x4060f7
cmp eax, 0xffffffff
jne 0x406106
mov dword [ebp - 0x249c], 1
jmp 0x406335
cmp byte [ebp - 0x2490], 0x7f
jne 0x406295
cmp byte [ebp - 0x248e], 0x11
jne 0x406295
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
mov dword [ebp - 0x101a], 0x4a020000
mov dword [ebp - 0x1016], 0x4a060000
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xffffffffffffffff
push 0
push 4
push 0
push 0x40
push 0
push 6
push 3
push 0
push 0
mov dword [ebp - 0x1b7], esp
mov eax, dword [ebp - 0x1016]
mov dword [esp + 0x40], eax
mov eax, dword [ebp - 0x101a]
mov dword [esp + 0x5c], eax
push 0
push dword [ebp - 0x1b7]
push 4
call dword [edi]
add esp, 0x60
mov eax, dword [ebp - 0x101a]
mov dword [ebp - 0x1172], eax
mov dword [ebp - 0x116e], 4
lea edx, [ebp - 0x1172]
push edx
push 5
lea edx, [ebp - 0x2494]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.00409515
test eax, eax
je 0x4061e1
cmp eax, 0xffffffff
jne 0x4061f0
mov dword [ebp - 0x249c], 1
jmp 0x406290
cmp byte [ebp - 0x2490], 0x44
je 0x40626b
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40624b
xor eax, eax
jmp 0x406255
cmp eax, 0x20
jbe 0x406255
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x406290
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x406335
cmp byte [ebp - 0x2490], 0x44
je 0x406310
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4062f0
xor eax, eax
jmp 0x4062fa
cmp eax, 0x20
jbe 0x4062fa
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x406335
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x406345
cmp eax, 0xb
jne 0x40635e
push 0
push 0
mov dword [ebp - 0x1b3], esp
push 0
push dword [ebp - 0x1b3]
push 7
call dword [edi]
add esp, 8
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0
mov eax, esp
push 0
push eax
push 2
call dword [edi]
add esp, 4
push 0
push 0
push 3
call dword [edi]
cmp dword [esi + 0x270], 0x75736924
jne 0x408d7f
cmp dword [esi + 0x274], 0x3037757a
jne 0x408d7f
cmp dword [esi + 0x278], 0x5424325f
jne 0x408d7f
cmp dword [esi + 0x27c], 0x736e6172
jne 0x408d7f
cmp dword [esi + 0x280], 0x6e6f7274
jne 0x408d7f
cmp dword [esi + 0x284], 0x3231355b
jne 0x408d7f
cmp dword [esi + 0x288], 0x3230312f
jne 0x408d7f
cmp dword [esi + 0x28c], 0x205d6b34
jne 0x408d7f
cmp dword [esi + 0x290], 0x696c2d4b
jne 0x408d7f
cmp word [esi + 0x294], 0x656e
jne 0x408d7f
cmp byte [esi + 0x296], 0
jne 0x408d7f
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x406453
cmp eax, 0xb
je 0x406453
cmp eax, 0xa
je 0x406453
cmp eax, 0x17
je 0x406453
cmp eax, 0x18
jne 0x408d7f
push 0x28a0
push 0
push 4
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x40647e
mov dword [ebp - 0x249c], 1
jmp 0x408d7f
push 0xa
push 0xc
push 0x258
push 0xa
push 2
push 0xc
push 0
push 3
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x24
cmp eax, 0xffffffff
jne 0x4064b3
mov dword [ebp - 0x249c], 1
jmp 0x408d69
push 0x1af
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4064e1
cmp eax, 0xb
je 0x4064e1
cmp eax, 0xa
je 0x4064e1
cmp eax, 0x17
je 0x4064e1
cmp eax, 0x18
jne 0x408d69
push 0
push 0
push 0
push 0
push 0
push 0
push 0x40000
push 0
push 0x100
push 0
push 0
push 0
push 0x400
push 0
push 1
push 0
push 0
push 0
push 4
push 1
push 0
push 0
mov eax, esp
push 0
push eax
push 4
call dword [edi]
add esp, 0x58
cmp eax, 0xffffffff
je 0x408d69
mov dword [0x40effe], eax
push 0x81f11181
push 0
push 4
push 0
push 0
push 0
push 4
push 0
mov dword [ebp - 0x1af], esp
lea edx, [ebp - 0x2494]
push edx
push dword [ebp - 0x1af]
push 0xd
call dword [edi]
add esp, 0x20
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x406571
cmp eax, 0xa
jne 0x407024
mov byte [ebp - 0x1470], 0
mov byte [ebp - 0x1a3], 0
mov byte [ebp - 0x162], 0
mov byte [ebp - 0x121], 0
mov byte [ebp - 0xe0], 0
mov byte [ebp - 0x9f], 0
mov byte [ebp - 0x5e], 0
cmp dword [ebp - 0x249c], 0
jne 0x4066bc
push 0x94
push 0x1af11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x4065de
cmp eax, 0xffffffff
jne 0x4065ed
mov dword [ebp - 0x249c], 1
jmp 0x4066bc
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x406606
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x5a
jne 0x4066bc
mov ecx, 2
cmp ecx, 0x42
jae 0x40665d
cmp ecx, dword [ebp - 0x1a7]
jae 0x40665d
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x2494]
cmp dl, 0
je 0x40665d
cmp dl, 0xff
je 0x40665d
cmp dl, 0x2d
je 0x40665d
mov byte [ebp + ecx - 0x1472], dl
inc ecx
jmp 0x406627
mov byte [ebp + ecx - 0x1472], 0
cmp byte [ebp - 0x1470], 0
je 0x4066bc
lea eax, [ebp - 0x1470]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x40678d
push 0x95
push 0x1af11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x4066fb
cmp eax, 0xffffffff
jne 0x40670a
mov dword [ebp - 0x249c], 1
jmp 0x40678d
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x406723
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x5a
jne 0x40678d
movzx eax, byte [ebp + ecx - 0x2491]
mov ah, byte [ebp + ecx - 0x2492]
push 0xa0d58
push 0x342e2520
push 0x3a244e4f
push 0x49535245
push 0x565f5753
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x4068aa
push 0x91
push 0x1af11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x4067cc
cmp eax, 0xffffffff
jne 0x4067db
mov dword [ebp - 0x249c], 1
jmp 0x4068aa
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x4067f4
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x5a
jne 0x4068aa
mov ecx, 2
cmp ecx, 0x42
jae 0x40684b
cmp ecx, dword [ebp - 0x1a7]
jae 0x40684b
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x2494]
cmp dl, 0
je 0x40684b
cmp dl, 0xff
je 0x40684b
cmp dl, 0x2d
je 0x40684b
mov byte [ebp + ecx - 0x1a5], dl
inc ecx
jmp 0x406815
mov byte [ebp + ecx - 0x1a5], 0
cmp byte [ebp - 0x1a3], 0
je 0x4068aa
lea eax, [ebp - 0x1a3]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x44524148
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x4069c2
push pe_nt_image_headers32
push 0x1af11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x4068e9
cmp eax, 0xffffffff
jne 0x4068f8
mov dword [ebp - 0x249c], 1
jmp 0x4069c2
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x406911
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x5a
jne 0x4069c2
mov ecx, 2
cmp ecx, 0x42
jae 0x406968
cmp ecx, dword [ebp - 0x1a7]
jae 0x406968
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x2494]
cmp dl, 0
je 0x406968
cmp dl, 0xff
je 0x406968
cmp dl, 0x2d
je 0x406968
mov byte [ebp + ecx - 0x164], dl
inc ecx
jmp 0x406932
mov byte [ebp + ecx - 0x164], 0
cmp byte [ebp - 0x162], 0
je 0x4069c2
lea eax, [ebp - 0x162]
push 0xa0d
push 0x7325203a
push 0x24545241
push 0x505f454e
push 0x49474e45
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x406aff
push 0x92
push 0x1af11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x406a01
cmp eax, 0xffffffff
jne 0x406a10
mov dword [ebp - 0x249c], 1
jmp 0x406aff
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x406a29
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x5a
jne 0x406aff
mov ecx, 2
cmp ecx, 0x42
jae 0x406a80
cmp ecx, dword [ebp - 0x1a7]
jae 0x406a80
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x2494]
cmp dl, 0
je 0x406a80
cmp dl, 0xff
je 0x406a80
cmp dl, 0x2d
je 0x406a80
mov byte [ebp + ecx - 0x123], dl
inc ecx
jmp 0x406a4a
mov byte [ebp + ecx - 0x123], 0
cmp byte [ebp - 0x121], 0
je 0x406aff
lea eax, [ebp - 0x121]
push 0
push 0xa0d7325
push 0x203a2452
push 0x45424d55
push 0x4e5f4552
push 0x41574452
push 0x41485f55
push 0x43455f52
push 0x4f5f4449
push 0x5f524549
push 0x4c505055
push 0x535f4d45
push 0x54535953
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x48
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x406c28
push 0x97
push 0x1af11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x406b3e
cmp eax, 0xffffffff
jne 0x406b4d
mov dword [ebp - 0x249c], 1
jmp 0x406c28
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x406b66
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x5a
jne 0x406c28
mov ecx, 2
cmp ecx, 0x42
jae 0x406bbd
cmp ecx, dword [ebp - 0x1a7]
jae 0x406bbd
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x2494]
cmp dl, 0
je 0x406bbd
cmp dl, 0xff
je 0x406bbd
cmp dl, 0x2d
je 0x406bbd
mov byte [ebp + ecx - 0xe2], dl
inc ecx
jmp 0x406b87
mov byte [ebp + ecx - 0xe2], 0
cmp byte [ebp - 0xe0], 0
je 0x406c28
lea eax, [ebp - 0xe0]
push 0xa
push 0xd732520
push 0x3a244550
push 0x59545f45
push 0x4e49474e
push 0x455f524f
push 0x5f454d41
push 0x4e5f4d45
push 0x54535953
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x406d63
push 0x98
push 0x1af11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x406c67
cmp eax, 0xffffffff
jne 0x406c76
mov dword [ebp - 0x249c], 1
jmp 0x406d63
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x406c8f
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x5a
jne 0x406d63
mov ecx, 2
cmp ecx, 0x42
jae 0x406ce6
cmp ecx, dword [ebp - 0x1a7]
jae 0x406ce6
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x2494]
cmp dl, 0
je 0x406ce6
cmp dl, 0xff
je 0x406ce6
cmp dl, 0x2d
je 0x406ce6
mov byte [ebp + ecx - 0xa1], dl
inc ecx
jmp 0x406cb0
mov byte [ebp + ecx - 0xa1], 0
cmp byte [ebp - 0x9f], 0
je 0x406d63
lea eax, [ebp - 0x9f]
push 0xa0d73
push 0x25203a24
push 0x5245424d
push 0x554e5f4c
push 0x41495245
push 0x535f5245
push 0x54534554
push 0x5f524f5f
push 0x45444f43
push 0x5f504f48
push 0x535f5249
push 0x41504552
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x44
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x406e39
push 0x99
push 0x1af11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x406da2
cmp eax, 0xffffffff
jne 0x406db1
mov dword [ebp - 0x249c], 1
jmp 0x406e39
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x406dca
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x5a
jne 0x406e39
mov eax, dword [ebp + ecx - 0x2492]
bswap eax
test eax, eax
je 0x406e39
push 0xa
push 0xd58382e
push 0x25203a24
push 0x45544144
push 0x5f474e49
push 0x4d4d4152
push 0x474f5250
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x406f22
push 0x9a
push 0x1af11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x406e78
cmp eax, 0xffffffff
jne 0x406e87
mov dword [ebp - 0x249c], 1
jmp 0x406f22
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x406ea0
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x5a
jne 0x406f22
movzx eax, byte [ebp + ecx - 0x2491]
mov ah, byte [ebp + ecx - 0x2492]
test eax, eax
je 0x406f22
push 0xa0d58
push 0x342e2520
push 0x3a245245
push 0x49464954
push 0x4e454449
push 0x5f415441
push 0x445f4349
push 0x54534f4e
push 0x47414944
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x249c], 0
jne 0x407024
push 0x90
push 0x1af11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x406f61
cmp eax, 0xffffffff
jne 0x406f70
mov dword [ebp - 0x249c], 1
jmp 0x407024
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x406f89
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x5a
jne 0x407024
mov ecx, 2
cmp ecx, 0x42
jae 0x406fdd
cmp ecx, dword [ebp - 0x1a7]
jae 0x406fdd
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x2494]
cmp dl, 0
je 0x406fdd
cmp dl, 0xff
je 0x406fdd
cmp dl, 0x2d
je 0x406fdd
mov byte [ebp + ecx - 0x60], dl
inc ecx
jmp 0x406faa
mov byte [ebp + ecx - 0x60], 0
cmp byte [ebp - 0x5e], 0
je 0x407024
lea eax, [ebp - 0x5e]
push 0xa0d
push 0x7325203a
push 0x244e4956
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x407824
cmp dword [ebp - 0x249c], 0
jne 0x40725b
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
push 0xc
push 0x258
push 0xa
push 0
push 2
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0
push 0
push 0x40000
push 0
push 0x100
push 0
push 0
push 0
push 0x400
push 0
push 1
push 0
push 0
push 0
push 4
push 1
push 0
push 0
mov eax, esp
push 0
push eax
push 4
call dword [edi]
add esp, 0x58
push 0x81f11181
push 0
push 4
push 0
push 0
push 0
push 4
push 0
mov dword [ebp - 0x11], esp
lea edx, [ebp - 0x2494]
push edx
push dword [ebp - 0x11]
push 0xd
call dword [edi]
add esp, 0x20
push 0x1a5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x86
push 0x10f11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x3e8
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
cmp eax, 0xffffffff
jne 0x407123
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x40716f
test eax, eax
jne 0x40716f
push 0
push 0xc
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
push 0x86
push 0x10f11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x3e8
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
push 0x86
push 0x10f11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x1388
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x4071a1
cmp eax, 0xffffffff
jne 0x4071b0
mov dword [ebp - 0x249c], 1
jmp 0x40725b
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x4071c9
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x50
je 0x40725b
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40723d
xor eax, eax
jmp 0x407247
cmp eax, 0x20
jbe 0x407247
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x407350
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x3ef11181
lea eax, [ebp - 0x2494]
push esp
push 4
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x4072a0
cmp eax, 0xffffffff
jne 0x4072af
mov dword [ebp - 0x249c], 1
jmp 0x407350
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x4072c8
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x7e
je 0x407350
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407332
xor eax, eax
jmp 0x40733c
cmp eax, 0x20
jbe 0x40733c
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x4074eb
push 0x6e
push 0xa
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
push 0x13a
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x1000
push 0x35
push 0x8f11180
lea eax, [ebp - 0x2494]
push esp
push 0xc
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x4073b2
cmp eax, 0xffffffff
jne 0x4073c1
mov dword [ebp - 0x249c], 1
jmp 0x4074eb
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x4073da
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x75
jne 0x4073fe
mov dword [esi + 0x14], 0x100000
jmp 0x4074eb
push 0x800
push 0x35
push 0x8f11180
lea eax, [ebp - 0x2494]
push esp
push 0xc
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x407432
cmp eax, 0xffffffff
jne 0x407441
mov dword [ebp - 0x249c], 1
jmp 0x4074eb
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x40745a
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x75
jne 0x40747b
mov dword [esi + 0x14], 0x80000
jmp 0x4074eb
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4074cd
xor eax, eax
jmp 0x4074d7
cmp eax, 0x20
jbe 0x4074d7
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x4076ef
mov dword [ebp - 0x1d], 0
mov dword [ebp - 0x19], 0
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x15], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x24], eax
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [ebp - 0x19]
cmp eax, dword [ebp - 0x15]
jae 0x4076ef
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x36
push 0x1f11180
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x407586
cmp eax, 0xffffffff
jne 0x407595
mov dword [ebp - 0x249c], 1
jmp 0x4076ef
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x4075ae
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x76
je 0x40763b
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407618
xor eax, eax
jmp 0x407622
cmp eax, 0x20
jbe 0x407622
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x4076ef
cmp dword [ebp - 0x1d], 0
jne 0x40769d
mov eax, dword [ebp - 0x15]
mov ecx, dword [ebp - 0x1a7]
dec ecx
xor edx, edx
div ecx
test edx, edx
je 0x407654
inc eax
mov dword [ebp - 0x1d], eax
shl eax, 0x10
and eax, 0xffff0000
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
call fcn.004094c6
dec dword [ebp - 0x1a7]
inc dword [ebp - 0x1ab]
mov eax, dword [ebp - 0x15]
sub eax, dword [ebp - 0x19]
cmp eax, dword [ebp - 0x1a7]
jbe 0x4076c2
mov eax, dword [ebp - 0x1a7]
mov ecx, dword [esi + 0x24]
add ecx, dword [ebp - 0x19]
mov edx, dword [ebp - 0x1ab]
push eax
lea edx, [ebp + edx - 0x2494]
push edx
push ecx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov eax, dword [ebp - 0x1a7]
add dword [ebp - 0x19], eax
jmp 0x407543
cmp dword [ebp - 0x249c], 0
jne 0x4077e9
push 0xb4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x82
push 0x1f11180
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x407739
cmp eax, 0xffffffff
jne 0x407748
mov dword [ebp - 0x249c], 1
jmp 0x4077e9
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x407761
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0xc2
je 0x4077e9
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4077cb
xor eax, eax
jmp 0x4077d5
cmp eax, 0x20
jbe 0x4077d5
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x40781b
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
jmp 0x407824
lea edx, [esi + 0x24]
push edx
call fcn.00409839
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x4089bb
mov dword [ebp - 0x126c], 0
cmp dword [ebp - 0x249c], 0
jne 0x407943
cmp dword [esi + 0x14], 0x80000
jne 0x4078a8
mov dword [ebp - 0xfce], 0
mov dword [ebp - 0xfca], 0x80000
mov dword [ebp - 0xfc6], pe_nt_image_headers32
mov dword [ebp - 0xfc2], 0
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
jmp 0x407943
cmp dword [esi + 0x14], 0x100000
jne 0x407903
mov dword [ebp - 0xfce], 0x20000
mov dword [ebp - 0xfca], 0x100000
mov dword [ebp - 0xfc6], pe_nt_image_headers32
mov dword [ebp - 0xfc2], 0
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
jmp 0x407943
push 0xa
push 0xd245441
push 0x4d524f46
push 0x5f454c49
push 0x465f4d4f
push 0x525f4445
push 0x54524f50
push 0x5055534e
push 0x555f524f
push 0x52524524
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x407a10
mov dword [ebp - 0xfee], 0
mov dword [ebp - 0xfea], 0
cmp dword [ebp - 0xfee], 0x20
jae 0x4079a4
imul ecx, dword [ebp - 0xfee], 0x10
mov eax, dword [ebp + ecx - 0xfca]
sub eax, dword [ebp + ecx - 0xfce]
test eax, eax
je 0x4079a4
mov ecx, dword [ebp + ecx - 0xfc6]
xor edx, edx
div ecx
test edx, edx
je 0x407996
inc eax
add dword [ebp - 0xfea], eax
inc dword [ebp - 0xfee]
jmp 0x407964
mov eax, dword [ebp - 0xfea]
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
cmp dword [ebp - 0x249c], 0
jne 0x407b28
cmp dword [esi + 0x14], 0x100000
jne 0x407a3c
push 0
push 0xc
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
push 0x85
push 0x10f11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x407a6e
cmp eax, 0xffffffff
jne 0x407a7d
mov dword [ebp - 0x249c], 1
jmp 0x407b28
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x407a96
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x50
je 0x407b28
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407b0a
xor eax, eax
jmp 0x407b14
cmp eax, 0x20
jbe 0x407b14
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x407c1a
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x3ef11181
lea eax, [ebp - 0x2494]
push esp
push 4
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x407b6a
cmp eax, 0xffffffff
jne 0x407b79
mov dword [ebp - 0x249c], 1
jmp 0x407c1a
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x407b92
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x7e
je 0x407c1a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407bfc
xor eax, eax
jmp 0x407c06
cmp eax, 0x20
jbe 0x407c06
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x407e03
mov dword [ebp - 0x25a8], 0x20
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
push 0x27f11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x407c68
cmp eax, 0xffffffff
jne 0x407c77
mov dword [ebp - 0x249c], 1
jmp 0x407e03
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x407c90
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x7f
jne 0x407d87
cmp byte [ebp + ecx - 0x2492], 0x36
jne 0x407ccf
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x25a8]
jne 0x407c39
jmp 0x407d13
cmp byte [ebp + ecx - 0x2492], 0x37
jne 0x407cf2
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x25a8]
jne 0x407c39
jmp 0x407d13
cmp byte [ebp + ecx - 0x2492], 0x22
jne 0x407d13
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x25a8]
jne 0x407c39
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407d67
xor eax, eax
jmp 0x407d71
cmp eax, 0x20
jbe 0x407d71
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x407e03
cmp byte [ebp + ecx - 0x2494], 0x67
je 0x407e03
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407de5
xor eax, eax
jmp 0x407def
cmp eax, 0x20
jbe 0x407def
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x40808c
mov ecx, dword [ebp - 0x1ab]
cmp word [ebp + ecx - 0x2492], 0
je 0x40808c
push 0xe9de
push 0xd0cac9c2
push 0xbfb4b299
push 0x92848281
push 0x736c483e
push 0x281400b0
mov byte [ebp - 0x1268], 0x20
mov byte [ebp - 0x1267], 0xf4
mov eax, dword [ebp - 0x126c]
movzx eax, byte [esp + eax]
mov dword [ebp - 0x1266], eax
mov al, byte [ebp + ecx - 0x2492]
mov byte [ebp - 0x1262], al
mov al, byte [ebp + ecx - 0x2491]
mov byte [ebp - 0x1261], al
push 0x7d
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xfa
lea edx, [ebp - 0x26ae]
push edx
push 0xf6
lea edx, [ebp - 0x1268]
push edx
call dword [ebx + 0x40]
cmp eax, 2
je 0x407ee1
push 0xa0d24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
mov dword [ebp - 0x249c], 1
jmp 0x408089
push 2
push 0x27f11184
mov al, byte [ebp - 0x26ae]
mov byte [esp + 5], al
mov al, byte [ebp - 0x26ad]
mov byte [esp + 6], al
push esp
push 7
lea edx, [ebp - 0x2494]
push edx
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
add esp, 8
test eax, eax
je 0x407f27
cmp eax, 0xffffffff
jne 0x407f36
mov dword [ebp - 0x249c], 1
jmp 0x408089
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x407f4f
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x7f
jne 0x40800f
cmp byte [ebp + ecx - 0x2492], 0x35
jne 0x407f9d
mov dword [ebp - 0x25a8], 0x20
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc dword [ebp - 0x126c]
cmp dword [ebp - 0x126c], 0x16
jl 0x407c39
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407fef
xor eax, eax
jmp 0x407ff9
cmp eax, 0x20
jbe 0x407ff9
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x408089
cmp byte [ebp + ecx - 0x2494], 0x67
je 0x408089
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40806b
xor eax, eax
jmp 0x408075
cmp eax, 0x20
jbe 0x408075
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
add esp, 0x18
cmp dword [ebp - 0x249c], 0
jne 0x408180
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0x83f11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x4080d0
cmp eax, 0xffffffff
jne 0x4080df
mov dword [ebp - 0x249c], 1
jmp 0x408180
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x4080f8
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0xc3
je 0x408180
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408162
xor eax, eax
jmp 0x40816c
cmp eax, 0x20
jbe 0x40816c
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x40828a
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 3
push 0x83f11187
mov ecx, dword [ebp - 0x1ab]
mov eax, dword [ebp + ecx - 0x2492]
mov dword [esp + 5], eax
push esp
push 0xa
lea edx, [ebp - 0x2494]
push edx
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
add esp, 0xc
test eax, eax
je 0x4081da
cmp eax, 0xffffffff
jne 0x4081e9
mov dword [ebp - 0x249c], 1
jmp 0x40828a
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x408202
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0xc3
je 0x40828a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40826c
xor eax, eax
jmp 0x408276
cmp eax, 0x20
jbe 0x408276
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x4086af
push 0x6e
push 0xa
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
push 0x1e
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0xfee], 0
cmp dword [ebp - 0xfee], 0x20
jae 0x4086af
imul ecx, dword [ebp - 0xfee], 0x10
mov eax, dword [ebp + ecx - 0xfce]
mov dword [ebp - 0xfe6], eax
mov eax, dword [ebp + ecx - 0xfca]
mov dword [ebp - 0xfe2], eax
mov eax, dword [ebp + ecx - 0xfc6]
mov dword [ebp - 0xfde], eax
mov eax, dword [ebp + ecx - 0xfc2]
mov dword [ebp - 0xfda], eax
mov eax, dword [ebp - 0xfe2]
sub eax, dword [ebp - 0xfe6]
test eax, eax
je 0x4086af
push 0xe
push 0
push 0x34f11188
mov eax, dword [ebp - 0xfe6]
add eax, dword [ebp - 0xfda]
mov byte [esp + 5], ah
mov byte [esp + 6], al
shr eax, 0x10
mov byte [esp + 4], al
mov eax, dword [ebp - 0xfe2]
sub eax, dword [ebp - 0xfe6]
mov byte [esp + 9], ah
mov byte [esp + 0xa], al
shr eax, 0x10
mov byte [esp + 8], al
push esp
push 0xb
lea edx, [ebp - 0x2494]
push edx
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
add esp, 0xc
test eax, eax
je 0x408385
cmp eax, 0xffffffff
jne 0x408394
mov dword [ebp - 0x249c], 1
jmp 0x408435
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x4083ad
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x74
je 0x408435
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408417
xor eax, eax
jmp 0x408421
cmp eax, 0x20
jbe 0x408421
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x4086af
push 0x3c
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp - 0xfe6]
mov ecx, dword [ebp - 0xfe2]
cmp eax, ecx
jae 0x4085bf
sub ecx, eax
cmp ecx, dword [ebp - 0xfde]
jbe 0x40846e
mov ecx, dword [ebp - 0xfde]
mov dword [ebp - 0xfd2], ecx
add eax, dword [ebp - 0xfda]
inc ecx
shl ecx, 0x18
or ecx, 0xf11180
mov dword [ebp - 0xdce], ecx
mov dword [ebp - 0xdca], 0x36
xor ecx, ecx
mov edx, dword [esi + 0x20]
add edx, dword [ebp - 0xfe6]
cmp ecx, dword [ebp - 0xfd2]
jae 0x4084b4
mov al, byte [edx + ecx]
mov byte [ebp + ecx - 0xdc9], al
inc ecx
jmp 0x40849f
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, dword [ebp - 0xfd2]
lea edx, [ebp - 0xdce]
push edx
lea edx, [ecx + 5]
push edx
lea edx, [ebp - 0x2494]
push edx
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x4084f2
cmp eax, 0xffffffff
jne 0x408501
mov dword [ebp - 0x249c], 1
jmp 0x4085ba
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x40851a
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x76
je 0x4085a4
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408584
xor eax, eax
jmp 0x40858e
cmp eax, 0x20
jbe 0x40858e
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x4085ba
call fcn.004094c6
mov eax, dword [ebp - 0xfd2]
add dword [ebp - 0xfe6], eax
jmp 0x40844a
jmp 0x4086af
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x37f11181
lea eax, [ebp - 0x2494]
push esp
push 4
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x4085f4
cmp eax, 0xffffffff
jne 0x408603
mov dword [ebp - 0x249c], 1
jmp 0x4086a4
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x40861c
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x77
je 0x4086a4
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408686
xor eax, eax
jmp 0x408690
cmp eax, 0x20
jbe 0x408690
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
inc dword [ebp - 0xfee]
jmp 0x4082bf
cmp dword [ebp - 0x249c], 0
jne 0x4087a3
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 2
push 0x31f11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x4086f3
cmp eax, 0xffffffff
jne 0x408702
mov dword [ebp - 0x249c], 1
jmp 0x4087a3
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x40871b
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x71
je 0x4087a3
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408785
xor eax, eax
jmp 0x40878f
cmp eax, 0x20
jbe 0x40878f
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x408897
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 3
push 0x31f11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x4087e7
cmp eax, 0xffffffff
jne 0x4087f6
mov dword [ebp - 0x249c], 1
jmp 0x408897
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x40880f
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x71
je 0x408897
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408879
xor eax, eax
jmp 0x408883
cmp eax, 0x20
jbe 0x408883
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x40898b
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
push 0x11f11182
lea eax, [ebp - 0x2494]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x4088db
cmp eax, 0xffffffff
jne 0x4088ea
mov dword [ebp - 0x249c], 1
jmp 0x40898b
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x408903
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x51
je 0x40898b
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40896d
xor eax, eax
jmp 0x408977
cmp eax, 0x20
jbe 0x408977
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
cmp dword [ebp - 0x249c], 0
jne 0x4089bb
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x408bdc
cmp dword [ebp - 0x249c], 0
jne 0x408bdc
push 0xff00
push 0x18f11184
lea eax, [ebp - 0x2494]
push esp
push 7
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x408a09
cmp eax, 0xffffffff
jne 0x408a18
mov dword [ebp - 0x249c], 1
jmp 0x408bdc
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x408a31
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x58
je 0x408abe
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408a9b
xor eax, eax
jmp 0x408aa5
cmp eax, 0x20
jbe 0x408aa5
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x408bdc
movzx eax, byte [ebp + ecx - 0x2493]
mov dword [ebp - 0x5bf], eax
push 0xa
push 0xd642520
push 0x3a24544e
push 0x554f435f
push 0x43544424
push dword [ebp - 0x5bf]
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
mov dword [ebp - 0x5bb], 0
mov ecx, dword [ebp - 0x5bb]
cmp ecx, dword [ebp - 0x5bf]
jae 0x408bdc
imul ecx, ecx, 3
add ecx, dword [ebp - 0x1ab]
movzx eax, byte [ebp + ecx - 0x2491]
mov dword [ebp - 9], eax
movzx eax, byte [ebp + ecx - 0x2490]
mov dword [ebp - 5], eax
movzx eax, byte [ebp + ecx - 0x2492]
mov dword [ebp - 0xd], eax
cmp eax, 0xc0
jb 0x408b95
and eax, 0x3f
push 0xa
push 0xd295832
push 0x2e252858
push 0x322e2558
push 0x322e2555
push dword [ebp - 5]
push dword [ebp - 9]
push eax
lea eax, [esp + 0xc]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
jmp 0x408bd1
push 0xa
push 0xd295832
push 0x2e252858
push 0x322e2558
push 0x322e2550
push dword [ebp - 5]
push dword [ebp - 9]
push eax
lea eax, [esp + 0xc]
push eax
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x299c]
push edx
call dword [ebx + 0x30]
inc dword [ebp - 0x5bb]
jmp 0x408b11
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x18
jne 0x408d23
cmp dword [ebp - 0x249c], 0
jne 0x408d23
push 0
push 0xa0d2443
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0xff
push 0x14f11183
lea eax, [ebp - 0x2494]
push esp
push 6
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.00409515
test eax, eax
je 0x408c4c
cmp eax, 0xffffffff
jne 0x408c5b
mov dword [ebp - 0x249c], 1
jmp 0x408d23
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x2494], 0x80
jne 0x408c74
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x2494], 0x54
je 0x408cfe
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2494]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408cde
xor eax, eax
jmp 0x408ce8
cmp eax, 0x20
jbe 0x408ce8
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.00409708
mov dword [ebp - 0x249c], 1
jmp 0x408d23
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
cmp dword [ebp - 0x249c], 0
jne 0x408d59
push 0x82f11181
push esp
push 4
push 0x4e2
push 0
push 4
push 0
call fcn.00409549
lea edx, [ebp - 0x2494]
push edx
push 0x3e8
push 6
push 0
call fcn.004096b7
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0
mov eax, esp
push 0
push eax
push 2
call dword [edi]
add esp, 4
push 0
push 0
push 3
call dword [edi]
cmp dword [esi + 0x270], 0x75736924
jne 0x408e23
cmp dword [esi + 0x274], 0x3037757a
jne 0x408e23
cmp dword [esi + 0x278], 0x5424315f
jne 0x408e23
cmp dword [esi + 0x27c], 0x736e6172
jne 0x408e23
cmp dword [esi + 0x280], 0x6e6f7274
jne 0x408e23
cmp dword [esi + 0x284], 0x3230315b
jne 0x408e23
cmp dword [esi + 0x288], 0x35312f34
jne 0x408e23
cmp dword [esi + 0x28c], 0x322f3633
jne 0x408e23
cmp dword [esi + 0x290], 0x2f383430
jne 0x408e23
cmp dword [esi + 0x294], 0x30363532
jne 0x408e23
cmp dword [esi + 0x298], 0x43205d6b
jne 0x408e23
cmp word [esi + 0x29c], 0x4e41
jne 0x408e23
cmp byte [esi + 0x29e], 0
je 0x408ecf
cmp dword [esi + 0x270], 0x75736924
jne 0x408f60
cmp dword [esi + 0x274], 0x3037757a
jne 0x408f60
cmp dword [esi + 0x278], 0x5424325f
jne 0x408f60
cmp dword [esi + 0x27c], 0x736e6172
jne 0x408f60
cmp dword [esi + 0x280], 0x6e6f7274
jne 0x408f60
cmp dword [esi + 0x284], 0x3231355b
jne 0x408f60
cmp dword [esi + 0x288], 0x3230312f
jne 0x408f60
cmp dword [esi + 0x28c], 0x205d6b34
jne 0x408f60
cmp dword [esi + 0x290], 0x696c2d4b
jne 0x408f60
cmp word [esi + 0x294], 0x656e
jne 0x408f60
cmp byte [esi + 0x296], 0
jne 0x408f60
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xd
jne 0x408f60
push dword [esi + 0x14]
push dword [esi + 0x20]
call fcn.00409366
test eax, eax
jne 0x408f0f
push 0xa0d
push 0x2444494c
push 0x41565f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x14
jmp 0x408f60
cmp eax, 1
jne 0x408f3b
push 0xa0d
push 0x24444554
push 0x43455252
push 0x4f435f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x408f60
push 0xa0d
push 0x24444e55
push 0x4f465f54
push 0x4f4e5f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0
push 0
push 3
call dword [edi]
push 0
push esp
push 0x1000001
push 0x40b
push dword [ebx + 0x8e8]
call dword [sym.imp.USER32.DLL_SendMessageW]
add esp, 4
push 0
call dword [ebx + 0x44]
pop edi
leave
ret 8