Function at 0x4023a1
Capabilities:
Check for time delay via gettickcount
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a70
push edi
lea edi, [ebp - 0x2a70]
push 1
call dword [ebx + 0x44]
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0xe
je 0x4023ca
call dword [ebx + 0x3c]
cmp eax, 1
jne 0x409abc
mov dword [edi], 0
mov ecx, dword [ebx + 0x15c]
add ecx, dword [ebx + 0x74]
lea eax, [ecx + 0x108]
mov ecx, dword [ecx]
cmp ecx, 3
jne 0x402547
push eax
push edi
call fcn.0040a3b5
cmp eax, 1
jne 0x4023fe
mov dword [edi], 0x40a7b6
jmp 0x40242f
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x5a494c41
push 0x4954494e
push 0x495f4f54
push 0x5f44454c
push 0x49414624
push esp
call dword [ebx + 0x30]
add esp, 0x24
cmp dword [edi], 0
je 0x402545
push 0xa
push 0xd732520
push 0x5d24454d
push 0x414e5f52
push 0x45545041
push 0x4441245b
mov ecx, dword [ebx + 0x15c]
add ecx, dword [ebx + 0x74]
lea edx, [ecx + 4]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
add esp, 0x18
lea edx, [edi + 0x38]
push edx
push 0
call dword [edi + 4]
cmp eax, 0
jne 0x402545
lea edx, [ebp - 0x2810]
push edx
lea edx, [ebp - 0x2860]
push edx
lea edx, [ebp - 0x28b0]
push edx
push dword [edi + 0x38]
call dword [edi + 0x30]
cmp eax, 0
jne 0x402545
push 0xa
push 0xd732520
push 0x5d244552
push 0x41574d52
push 0x49465f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x28b0]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
add esp, 0x1c
push 0
push 0xa0d7325
push 0x205d244c
push 0x4c445f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x2860]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x402587
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x48545f59
push 0x425f4445
push 0x54524f50
push 0x5055535f
push 0x544f4e5f
push 0x53495f4c
push 0x4f434f54
push 0x4f525024
push esp
call dword [ebx + 0x30]
add esp, 0x30
cmp dword [edi], 0
je 0x409abc
mov dword [ebp - 0x25c4], 0
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
lea edx, [ecx + 2]
push edx
push eax
lea edx, [ebp - 0x27c0]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov dword [ebp - 0x24b4], 0
mov dword [ebp - 0x1076], 0xffffffff
cmp dword [esi + 0x270], 0x75736924
jne 0x406ec7
cmp dword [esi + 0x274], 0x3037757a
jne 0x406ec7
cmp dword [esi + 0x278], 0x5424315f
jne 0x406ec7
cmp dword [esi + 0x27c], 0x736e6172
jne 0x406ec7
cmp dword [esi + 0x280], 0x6e6f7274
jne 0x406ec7
cmp dword [esi + 0x284], 0x3230315b
jne 0x406ec7
cmp dword [esi + 0x288], 0x35312f34
jne 0x406ec7
cmp dword [esi + 0x28c], 0x322f3633
jne 0x406ec7
cmp dword [esi + 0x290], 0x2f383430
jne 0x406ec7
cmp dword [esi + 0x294], 0x30363532
jne 0x406ec7
cmp dword [esi + 0x298], 0x38332f6b
jne 0x406ec7
cmp dword [esi + 0x29c], 0x5d6b3034
jne 0x406ec7
cmp dword [esi + 0x2a0], 0x4e414320
jne 0x406ec7
cmp byte [esi + 0x2a4], 0
jne 0x406ec7
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4026cf
cmp eax, 0xb
je 0x4026cf
cmp eax, 0xa
je 0x4026cf
cmp eax, 0x17
je 0x4026cf
cmp eax, 0x18
je 0x4026cf
cmp eax, 0x38
jne 0x406ec7
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x38
jne 0x402829
push 0x28
push 0
lea edx, [ebp - 0x1072]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
push 0x30
push 0
lea edx, [ebp - 0x104a]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
push 0
push dword [ebx + 0x8ac]
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x4e
push 0x490056
push 0x450047
push 0x4e0041
push 0x480043
mov dword [ebp - 0x104a], ebx
mov dword [ebp - 0x106e], 0x409ae2
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebp - 0x1062], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [ebp - 0x105e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.DLL_LoadCursorA]
mov dword [ebp - 0x105a], eax
mov dword [ebp - 0x1056], 0x10
mov dword [ebp - 0x104e], esp
lea edx, [ebp - 0x1072]
push edx
call dword [sym.imp.USER32.DLL_RegisterClassW]
lea edx, [ebp - 0x104a]
push edx
push dword [ebp - 0x1062]
push 0
push dword [ebx + 0x8ac]
push 0
push 0
push 0
push 0
push 0x100c0000
push 0
lea edx, [esp + 0x28]
push edx
push pe_nt_image_headers32
call dword [sym.imp.USER32.DLL_CreateWindowExW]
add esp, 0x14
test eax, eax
je 0x4027fc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.DLL_GetMessageW]
test eax, eax
je 0x4027f9
push esp
call dword [sym.imp.USER32.DLL_TranslateMessage]
push esp
call dword [sym.imp.USER32.DLL_DispatchMessageW]
jmp 0x4027d4
add esp, 0x1c
push 1
push dword [ebx + 0x8ac]
call dword [sym.imp.USER32.DLL_EnableWindow]
push dword [ebx + 0x8ac]
call dword [sym.imp.USER32.DLL_SetForegroundWindow]
cmp byte [ebp - 0x103a], 0
jne 0x402829
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x406ec7
push 0x7a120
push 0x800
push 6
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x402864
mov dword [ebp - 0x24b4], 1
jmp 0x406ec7
push 1
push 0x23
push 1
push 0x8000
push 0
push 2
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x402895
mov dword [ebp - 0x24b4], 1
jmp 0x406eb1
mov dword [ebp - 0x101a], 0xe0070000
mov dword [ebp - 0x1016], 0xe8070000
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4028c8
cmp eax, 0xb
je 0x4028c8
cmp eax, 0xa
je 0x4028c8
cmp eax, 0x18
je 0x4028c8
cmp eax, 0x38
jne 0x402921
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xffffffffffffffff
push 0
push 4
push 0
push 0x40
push 0
push 6
push 3
push 0
push 0
mov dword [ebp - 0x1012], esp
mov eax, dword [ebp - 0x1016]
mov dword [esp + 0x40], eax
mov eax, dword [ebp - 0x101a]
mov dword [esp + 0x5c], eax
push 0
push dword [ebp - 0x1012]
push 4
call dword [edi]
add esp, 0x60
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x402969
push 0
push 0
push 0
push 0
push 0
push 5
push 0xe8050000
push 0
push 4
push 0
push 0
push 0
push 5
push 0xffffffffffffffff
push 0
push 4
push 0
push 0
push 0
push 5
push 1
push 0
push 0
mov eax, esp
push 0
push eax
push 4
call dword [edi]
add esp, 0x5c
cmp eax, 0xffffffff
jne 0x40297d
mov dword [ebp - 0x24b4], 1
jmp 0x406eb1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402996
cmp eax, 0xa
je 0x402996
cmp eax, 0xb
jne 0x403b61
mov byte [esi + 0x6c], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4029b3
cmp eax, 0xa
je 0x4029b3
cmp eax, 0xb
jne 0x402cbe
push 0x110fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x4029e4
mov dword [ebp - 0x24b4], 1
jmp 0x402a17
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x402a0a
mov dword [ebp - 0x24b4], 1
jmp 0x402a17
test eax, eax
je 0x402a17
cmp byte [ebp - 0x24a8], 0x7e
je 0x4029e4
cmp dword [ebp - 0x24b4], 0
jne 0x402cbe
mov byte [esi + 0x6c], 0
mov eax, dword [ebp - 0x101a]
mov dword [ebp - 0x118a], eax
mov dword [ebp - 0x1186], 0x941a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x402a6c
cmp eax, 0xffffffff
jne 0x402a7b
mov dword [ebp - 0x24b4], 1
jmp 0x402cbe
cmp byte [ebp - 0x24a8], 0x5a
jne 0x402b2a
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402ab6
cmp ecx, eax
jae 0x402ab6
mov dl, byte [ebp + ecx - 0x24a6]
cmp dl, 0
je 0x402ab6
cmp dl, 0xff
je 0x402ab6
cmp dl, 0x2d
je 0x402ab6
mov byte [ebp + ecx - 0x1488], dl
inc ecx
jmp 0x402a8d
mov byte [ebp + ecx - 0x1488], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402ace
cmp eax, 0xa
jne 0x402b25
cmp byte [ebp - 0x1488], 0
je 0x402b25
lea eax, [ebp - 0x1488]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
jmp 0x402cbe
cmp byte [ebp - 0x24a8], 0x7f
jne 0x402cbe
cmp byte [ebp - 0x24a6], 0x11
jne 0x402cbe
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
mov dword [ebp - 0x101a], 0x4a020000
mov dword [ebp - 0x1016], 0x4a060000
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xffffffffffffffff
push 0
push 4
push 0
push 0x40
push 0
push 6
push 3
push 0
push 0
mov dword [ebp - 0x100e], esp
mov eax, dword [ebp - 0x1016]
mov dword [esp + 0x40], eax
mov eax, dword [ebp - 0x101a]
mov dword [esp + 0x5c], eax
push 0
push dword [ebp - 0x100e]
push 4
call dword [edi]
add esp, 0x60
mov eax, dword [ebp - 0x101a]
mov dword [ebp - 0x118a], eax
mov dword [ebp - 0x1186], 0x941a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x402c05
cmp eax, 0xffffffff
jne 0x402c14
mov dword [ebp - 0x24b4], 1
jmp 0x402cbe
cmp byte [ebp - 0x24a8], 0x5a
jne 0x402cbe
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402c4f
cmp ecx, eax
jae 0x402c4f
mov dl, byte [ebp + ecx - 0x24a6]
cmp dl, 0
je 0x402c4f
cmp dl, 0xff
je 0x402c4f
cmp dl, 0x2d
je 0x402c4f
mov byte [ebp + ecx - 0x1488], dl
inc ecx
jmp 0x402c26
mov byte [ebp + ecx - 0x1488], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402c67
cmp eax, 0xa
jne 0x402cbe
cmp byte [ebp - 0x1488], 0
je 0x402cbe
lea eax, [ebp - 0x1488]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402cd2
cmp eax, 0xa
jne 0x4034d0
cmp dword [ebp - 0x24b4], 0
jne 0x402d1d
mov dword [ebp - 0x1186], 0xb01a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x402d13
cmp eax, 0xffffffff
jne 0x402d1d
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x402dc4
mov dword [ebp - 0x1186], 0x951a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x402d62
cmp eax, 0xffffffff
jne 0x402d6e
mov dword [ebp - 0x24b4], 1
jmp 0x402dc4
cmp byte [ebp - 0x24a8], 0x5a
jne 0x402dc4
movzx eax, byte [ebp - 0x24a5]
mov ah, byte [ebp - 0x24a6]
push 0xa
push 0xd642520
push 0x3a244e4f
push 0x49535245
push 0x565f5753
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x402eb2
mov dword [ebp - 0x1186], 0x911a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x402e09
cmp eax, 0xffffffff
jne 0x402e18
mov dword [ebp - 0x24b4], 1
jmp 0x402eb2
cmp byte [ebp - 0x24a8], 0x5a
jne 0x402eb2
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402e53
cmp ecx, eax
jae 0x402e53
mov dl, byte [ebp + ecx - 0x24a6]
cmp dl, 0
je 0x402e53
cmp dl, 0xff
je 0x402e53
cmp dl, 0x2d
je 0x402e53
mov byte [ebp + ecx - 0x1448], dl
inc ecx
jmp 0x402e2a
mov byte [ebp + ecx - 0x1448], 0
cmp byte [ebp - 0x1448], 0
je 0x402eb2
lea eax, [ebp - 0x1448]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x44524148
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x403027
mov dword [ebp - 0x25c0], 5
mov dword [ebp - 0x1186], 0x921a
lea edx, [ebp - 0x118a]
push edx
push 6
push 0x9c4
push 0x40
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x402f00
mov dword [ebp - 0x24b4], 1
jmp 0x403027
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x402f29
mov dword [ebp - 0x24b4], 1
jmp 0x403027
test eax, eax
jne 0x402f3a
dec dword [ebp - 0x25c0]
jne 0x402f00
jmp 0x403027
cmp byte [ebp - 0x24a8], 0x7f
jne 0x402f58
cmp byte [ebp - 0x24a6], 0x78
jne 0x402f58
mov dword [ebp - 0x25c0], 5
jmp 0x402f00
cmp byte [ebp - 0x24a8], 0x7e
jne 0x402f6d
mov dword [ebp - 0x25c0], 5
jmp 0x402f00
cmp byte [ebp - 0x24a8], 0x5a
jne 0x403027
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402fa8
cmp ecx, eax
jae 0x402fa8
mov dl, byte [ebp + ecx - 0x24a6]
cmp dl, 0
je 0x402fa8
cmp dl, 0xff
je 0x402fa8
cmp dl, 0x2d
je 0x402fa8
mov byte [ebp + ecx - 0x1408], dl
inc ecx
jmp 0x402f7f
mov byte [ebp + ecx - 0x1408], 0
cmp byte [ebp - 0x1408], 0
je 0x403027
lea eax, [ebp - 0x1408]
push 0
push 0xa0d7325
push 0x203a2452
push 0x45424d55
push 0x4e5f4552
push 0x41574452
push 0x41485f55
push 0x43455f52
push 0x4f5f4449
push 0x5f524549
push 0x4c505055
push 0x535f4d45
push 0x54535953
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x48
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x40312d
mov dword [ebp - 0x1186], 0x971a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x40306c
cmp eax, 0xffffffff
jne 0x40307b
mov dword [ebp - 0x24b4], 1
jmp 0x40312d
cmp byte [ebp - 0x24a8], 0x5a
jne 0x40312d
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x4030b1
cmp ecx, eax
jae 0x4030b1
mov dl, byte [ebp + ecx - 0x24a6]
cmp dl, 0
je 0x4030b1
cmp dl, 0xff
je 0x4030b1
mov byte [ebp + ecx - 0x13c8], dl
inc ecx
jmp 0x40308d
mov byte [ebp + ecx - 0x13c8], 0
cmp byte [ebp - 0x13c8], 0
je 0x40312d
lea eax, [ebp - 0x13c8]
push 0xa
push 0xd732520
push 0x3a244550
push 0x59545f45
push 0x4e49474e
push 0x455f524f
push 0x5f454d41
push 0x4e5f4d45
push 0x54535953
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
lea edx, [ebp - 0x13c8]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
cmp dword [ebp - 0x24b4], 0
jne 0x403239
mov dword [ebp - 0x1186], 0x981a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x403172
cmp eax, 0xffffffff
jne 0x403181
mov dword [ebp - 0x24b4], 1
jmp 0x403239
cmp byte [ebp - 0x24a8], 0x5a
jne 0x403239
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x4031bc
cmp ecx, eax
jae 0x4031bc
mov dl, byte [ebp + ecx - 0x24a6]
cmp dl, 0
je 0x4031bc
cmp dl, 0xff
je 0x4031bc
cmp dl, 0x2d
je 0x4031bc
mov byte [ebp + ecx - 0x1388], dl
inc ecx
jmp 0x403193
mov byte [ebp + ecx - 0x1388], 0
cmp byte [ebp - 0x1388], 0
je 0x403239
lea eax, [ebp - 0x1388]
push 0xa0d73
push 0x25203a24
push 0x5245424d
push 0x554e5f4c
push 0x41495245
push 0x535f5245
push 0x54534554
push 0x5f524f5f
push 0x45444f43
push 0x5f504f48
push 0x535f5249
push 0x41504552
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x44
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x4032e9
mov dword [ebp - 0x1186], 0x991a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x40327e
cmp eax, 0xffffffff
jne 0x40328a
mov dword [ebp - 0x24b4], 1
jmp 0x4032e9
cmp byte [ebp - 0x24a8], 0x5a
jne 0x4032e9
mov eax, dword [ebp - 0x24a6]
bswap eax
test eax, eax
je 0x4032e9
push 0xa
push 0xd58382e
push 0x25203a24
push 0x45544144
push 0x5f474e49
push 0x4d4d4152
push 0x474f5250
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x4033a8
mov dword [ebp - 0x1186], 0x9a1a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x40332e
cmp eax, 0xffffffff
jne 0x40333a
mov dword [ebp - 0x24b4], 1
jmp 0x4033a8
cmp byte [ebp - 0x24a8], 0x5a
jne 0x4033a8
movzx eax, byte [ebp - 0x24a5]
mov ah, byte [ebp - 0x24a6]
test eax, eax
je 0x4033a8
push 0xa
push 0xd642520
push 0x3a245245
push 0x49464954
push 0x4e454449
push 0x5f415441
push 0x445f4349
push 0x54534f4e
push 0x47414944
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x4034d0
mov dword [ebp - 0x1186], 0xc11a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x4033ed
cmp eax, 0xffffffff
jne 0x4033fc
mov dword [ebp - 0x24b4], 1
jmp 0x4034d0
cmp byte [ebp - 0x24a8], 0x5a
jne 0x4034d0
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x403437
cmp ecx, eax
jae 0x403437
mov dl, byte [ebp + ecx - 0x24a6]
cmp dl, 0
je 0x403437
cmp dl, 0xff
je 0x403437
cmp dl, 0x2d
je 0x403437
mov byte [ebp + ecx - 0x1348], dl
inc ecx
jmp 0x40340e
mov byte [ebp + ecx - 0x1348], 0
cmp byte [ebp - 0x1348], 0
je 0x4034d0
cmp byte [esi + 0x6c], 0
je 0x403462
push 0x5f
push esp
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 4
lea edx, [ebp - 0x1348]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x1348]
push 0xa0d73
push 0x25203a24
push 0x52454946
push 0x49544e45
push 0x44495f31
push 0x30454c55
push 0x444f4d5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4034e9
cmp eax, 0xa
je 0x4034e9
cmp eax, 0xb
jne 0x4035e6
cmp dword [ebp - 0x24b4], 0
jne 0x4035e6
mov dword [ebp - 0x1186], reloc.KERNEL32.DLL_ReadFile
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x40352e
cmp eax, 0xffffffff
jne 0x40353d
mov dword [ebp - 0x24b4], 1
jmp 0x4035e6
cmp byte [ebp - 0x24a8], 0x5a
jne 0x4035e6
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x403578
cmp ecx, eax
jae 0x403578
mov dl, byte [ebp + ecx - 0x24a6]
cmp dl, 0
je 0x403578
cmp dl, 0xff
je 0x403578
cmp dl, 0x2d
je 0x403578
mov byte [ebp + ecx - 0x1308], dl
inc ecx
jmp 0x40354f
mov byte [ebp + ecx - 0x1308], 0
cmp byte [ebp - 0x1308], 0
je 0x4035e6
lea eax, [ebp - 0x1308]
push 0xa0d73
push 0x25203a24
push 0x52454946
push 0x49544e45
push 0x44495f32
push 0x30454c55
push 0x444f4d5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4035fa
cmp eax, 0xa
jne 0x403979
cmp dword [ebp - 0x24b4], 0
jne 0x4036ad
mov dword [ebp - 0x1186], 0xc31a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x40363f
cmp eax, 0xffffffff
jne 0x40364b
mov dword [ebp - 0x24b4], 1
jmp 0x4036ad
cmp byte [ebp - 0x24a8], 0x5a
jne 0x4036ad
mov eax, dword [ebp - 0x24a6]
bswap eax
test eax, eax
je 0x4036ad
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x3330454c
push 0x55444f4d
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x403760
mov dword [ebp - 0x1186], GetWindowLongA
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x4036f2
cmp eax, 0xffffffff
jne 0x4036fe
mov dword [ebp - 0x24b4], 1
jmp 0x403760
cmp byte [ebp - 0x24a8], 0x5a
jne 0x403760
mov eax, dword [ebp - 0x24a6]
bswap eax
test eax, eax
je 0x403760
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x3430454c
push 0x55444f4d
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x403813
mov dword [ebp - 0x1186], 0xc51a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x4037a5
cmp eax, 0xffffffff
jne 0x4037b1
mov dword [ebp - 0x24b4], 1
jmp 0x403813
cmp byte [ebp - 0x24a8], 0x5a
jne 0x403813
mov eax, dword [ebp - 0x24a6]
bswap eax
test eax, eax
je 0x403813
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x3530454c
push 0x55444f4d
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x4038c6
mov dword [ebp - 0x1186], 0xc61a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x403858
cmp eax, 0xffffffff
jne 0x403864
mov dword [ebp - 0x24b4], 1
jmp 0x4038c6
cmp byte [ebp - 0x24a8], 0x5a
jne 0x4038c6
mov eax, dword [ebp - 0x24a6]
bswap eax
test eax, eax
je 0x4038c6
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x3630454c
push 0x55444f4d
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x403979
mov dword [ebp - 0x1186], 0xcb1a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x40390b
cmp eax, 0xffffffff
jne 0x403917
mov dword [ebp - 0x24b4], 1
jmp 0x403979
cmp byte [ebp - 0x24a8], 0x5a
jne 0x403979
mov eax, dword [ebp - 0x24a6]
bswap eax
test eax, eax
je 0x403979
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x403a47
mov dword [ebp - 0x1186], 0xcc1a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x4039be
cmp eax, 0xffffffff
jne 0x4039ca
mov dword [ebp - 0x24b4], 1
jmp 0x403a47
cmp byte [ebp - 0x24a8], 0x5a
jne 0x403a47
mov eax, dword [ebp - 0x24a6]
bswap eax
mov dword [ebp - 0x1288], eax
test eax, eax
je 0x403a47
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4039f5
cmp eax, 0xa
jne 0x403a47
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x45524157
push 0x44524148
push 0x24202445
push 0x4d495424
push dword [ebp - 0x1288]
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x403a5b
cmp eax, 0xa
jne 0x403b61
cmp dword [ebp - 0x24b4], 0
jne 0x403b61
mov dword [ebp - 0x1186], 0x901a
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x403aa0
cmp eax, 0xffffffff
jne 0x403aaf
mov dword [ebp - 0x24b4], 1
jmp 0x403b61
cmp byte [ebp - 0x24a8], 0x5a
jne 0x403b61
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x403aea
cmp ecx, eax
jae 0x403aea
mov dl, byte [ebp + ecx - 0x24a6]
cmp dl, 0
je 0x403aea
cmp dl, 0xff
je 0x403aea
cmp dl, 0x2d
je 0x403aea
mov byte [ebp + ecx - 0x12c8], dl
inc ecx
jmp 0x403ac1
mov byte [ebp + ecx - 0x12c8], 0
cmp byte [ebp - 0x12c8], 0
je 0x403b61
cmp byte [esi + 0x6c], 0
je 0x403b11
push 0x5f
push esp
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 4
lea edx, [ebp - 0x12c8]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x12c8]
push 0xa0d
push 0x7325203a
push 0x244e4956
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x403bd7
cmp dword [esi + 0x14], 0x3c0000
jne 0x403bd7
mov eax, dword [ebp - 0x1288]
and eax, 0xffff
cmp eax, 0xe13c
jne 0x403b93
mov dword [ebp - 0x108a], 1
jmp 0x403bd7
cmp eax, 0xbc3e
jne 0x403ba6
mov dword [ebp - 0x108a], 2
jmp 0x403bd7
push 0xa
push 0xd245543
push 0x455f4445
push 0x54524f50
push 0x5055534e
push 0x555f524f
push 0x52524524
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov dword [ebp - 0x24b4], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x403bf0
cmp eax, 0xb
je 0x403bf0
cmp eax, 0x38
jne 0x404e9e
mov dword [ebp - 0x1284], 0
cmp dword [ebp - 0x24b4], 0
jne 0x403e31
cmp eax, 0xffffffff
jne 0x403c1b
mov dword [ebp - 0x24b4], 1
jmp 0x403e31
mov dword [ebp - 0x148c], 0x20
mov dword [ebp - 0x25c0], 0x10
push 0x210fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x403c63
mov dword [ebp - 0x24b4], 1
jmp 0x403e31
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x403c8c
mov dword [ebp - 0x24b4], 1
jmp 0x403e31
test eax, eax
jne 0x403c98
dec dword [ebp - 0x25c0]
jne 0x403c2f
push 0x3efe
push 0x1010000
push 0
push 6
push 0
push 0xc0
push 0
push 6
push 0x7c6
push 0
push 0
mov dword [ebp - 0x100a], esp
push 0
push dword [ebp - 0x100a]
push 6
call dword [edi]
add esp, 0x2c
push 0x28fe
push 0x1010000
push esp
push 6
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x403d03
mov dword [ebp - 0x24b4], 1
jmp 0x403e31
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x403d2c
mov dword [ebp - 0x24b4], 1
jmp 0x403e31
test eax, eax
jne 0x403d3c
dec dword [ebp - 0x148c]
jne 0x403c25
test eax, eax
jne 0x403dab
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403d88
xor eax, eax
jmp 0x403d92
cmp eax, 0x20
jbe 0x403d92
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x403e31
cmp byte [ebp - 0x24a8], 0x68
je 0x403e31
cmp byte [ebp - 0x24a8], 0x7e
je 0x403d03
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403e13
xor eax, eax
jmp 0x403e1d
cmp eax, 0x20
jbe 0x403e1d
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x403f90
push 0xa2fe
push 0x1010000
push esp
push 6
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x403e72
mov dword [ebp - 0x24b4], 1
jmp 0x403f90
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x403e9b
mov dword [ebp - 0x24b4], 1
jmp 0x403f90
test eax, eax
jne 0x403f0a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403ee7
xor eax, eax
jmp 0x403ef1
cmp eax, 0x20
jbe 0x403ef1
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x403f90
cmp byte [ebp - 0x24a8], 0xe2
je 0x403f90
cmp byte [ebp - 0x24a8], 0x7e
je 0x403e72
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403f72
xor eax, eax
jmp 0x403f7c
cmp eax, 0x20
jbe 0x403f7c
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
mov dword [ebp - 0x24b0], 5
cmp dword [ebp - 0x24b4], 0
jne 0x404566
cmp byte [ebp - 0x24a7], 0
je 0x404566
cmp byte [ebp - 0x24a7], 1
je 0x404566
cmp byte [ebp - 0x24a7], 0x54
je 0x404566
cmp byte [ebp - 0x24a7], 0x55
je 0x404566
push 0
mov dword [ebp - 0x1006], esp
push 0
push dword [ebp - 0x1006]
push 7
call dword [edi]
add esp, 4
push 0x2af8
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp eax, 0xffffffff
jne 0x40400c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x40403d
push 1
push 0x8000
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x40403d
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x4040aa
push 0x110fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x404077
mov dword [ebp - 0x24b4], 1
jmp 0x4040aa
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x40409d
mov dword [ebp - 0x24b4], 1
jmp 0x4040aa
test eax, eax
je 0x4040aa
cmp byte [ebp - 0x24a8], 0x7e
je 0x404077
cmp dword [ebp - 0x24b4], 0
jne 0x404168
mov dword [ebp - 0x148c], 0x10
mov dword [ebp - 0x25c0], 5
push 4
push 0xe0070000
push esp
push 5
push 0x9c4
push 0x40
push 6
push 0
call fcn.0040a09d
add esp, 8
cmp eax, 0xffffffff
jne 0x4040f9
mov dword [ebp - 0x24b4], 1
jmp 0x404168
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x40411f
mov dword [ebp - 0x24b4], 1
jmp 0x404168
test eax, eax
jne 0x404135
dec dword [ebp - 0x25c0]
jne 0x4040f9
dec dword [ebp - 0x148c]
jne 0x4040c1
jmp 0x404168
cmp byte [ebp - 0x24a8], 0x7f
jne 0x404153
cmp byte [ebp - 0x24a6], 0x78
jne 0x404153
mov dword [ebp - 0x25c0], 5
jmp 0x4040f9
cmp byte [ebp - 0x24a8], 0x7e
jne 0x404168
mov dword [ebp - 0x25c0], 5
jmp 0x4040f9
cmp dword [ebp - 0x24b4], 0
jne 0x40438b
mov dword [ebp - 0x148c], 0x20
mov dword [ebp - 0x25c0], 0x10
push 0x210fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x4041bd
mov dword [ebp - 0x24b4], 1
jmp 0x40438b
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x4041e6
mov dword [ebp - 0x24b4], 1
jmp 0x40438b
test eax, eax
jne 0x4041f2
dec dword [ebp - 0x25c0]
jne 0x404189
push 0x3efe
push 0x1010000
push 0
push 6
push 0
push 0xc0
push 0
push 6
push 0x7d0
push 0
push 0
mov dword [ebp - 0x1002], esp
push 0
push dword [ebp - 0x1002]
push 6
call dword [edi]
add esp, 0x2c
push 0x28fe
push 0x1010000
push esp
push 6
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x40425d
mov dword [ebp - 0x24b4], 1
jmp 0x40438b
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x404286
mov dword [ebp - 0x24b4], 1
jmp 0x40438b
test eax, eax
jne 0x404296
dec dword [ebp - 0x148c]
jne 0x40417f
test eax, eax
jne 0x404305
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4042e2
xor eax, eax
jmp 0x4042ec
cmp eax, 0x20
jbe 0x4042ec
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x40438b
cmp byte [ebp - 0x24a8], 0x68
je 0x40438b
cmp byte [ebp - 0x24a8], 0x7e
je 0x40425d
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40436d
xor eax, eax
jmp 0x404377
cmp eax, 0x20
jbe 0x404377
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x4044ea
push 0xa2fe
push 0x1010000
push esp
push 6
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x4043cc
mov dword [ebp - 0x24b4], 1
jmp 0x4044ea
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x4043f5
mov dword [ebp - 0x24b4], 1
jmp 0x4044ea
test eax, eax
jne 0x404464
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404441
xor eax, eax
jmp 0x40444b
cmp eax, 0x20
jbe 0x40444b
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x4044ea
cmp byte [ebp - 0x24a8], 0xe2
je 0x4044ea
cmp byte [ebp - 0x24a8], 0x7e
je 0x4043cc
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4044cc
xor eax, eax
jmp 0x4044d6
cmp eax, 0x20
jbe 0x4044d6
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
dec dword [ebp - 0x24b0]
jne 0x403f9a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404548
xor eax, eax
jmp 0x404552
cmp eax, 0x20
jbe 0x404552
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x4046c2
cmp dword [ebp - 0x24b4], 0
jne 0x404655
push 0x1a5fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x4045b6
mov dword [ebp - 0x24b4], 1
jmp 0x404655
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x4045dc
mov dword [ebp - 0x24b4], 1
jmp 0x404655
test eax, eax
jne 0x404648
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404628
xor eax, eax
jmp 0x404632
cmp eax, 0x20
jbe 0x404632
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x404655
cmp byte [ebp - 0x24a8], 0x7e
je 0x4045b6
cmp dword [ebp - 0x24b4], 0
jne 0x4046c2
push 0x3a5fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x40468f
mov dword [ebp - 0x24b4], 1
jmp 0x4046c2
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x4046b5
mov dword [ebp - 0x24b4], 1
jmp 0x4046c2
test eax, eax
je 0x4046c2
cmp byte [ebp - 0x24a8], 0x7e
je 0x40468f
cmp dword [ebp - 0x24b4], 0
jne 0x40489b
mov dword [ebp - 0x25c0], 0x20
mov eax, dword [ebp - 0x101a]
mov dword [ebp - 0x118a], eax
mov dword [ebp - 0x1186], 0x127
lea edx, [ebp - 0x118a]
push edx
push 6
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
jne 0x404727
mov dword [ebp - 0x24b4], 1
jmp 0x40489b
cmp eax, 0xffffffff
jne 0x40473b
mov dword [ebp - 0x24b4], 1
jmp 0x40489b
cmp byte [ebp - 0x24a8], 0x7f
jne 0x404820
cmp byte [ebp - 0x24a6], 0x36
jne 0x40476a
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x25c0]
jne 0x4046d9
jmp 0x4047ac
cmp byte [ebp - 0x24a6], 0x37
jne 0x40478c
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x25c0]
jne 0x4046d9
jmp 0x4047ac
cmp byte [ebp - 0x24a6], 0x22
jne 0x4047ac
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x25c0]
jne 0x4046d9
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404800
xor eax, eax
jmp 0x40480a
cmp eax, 0x20
jbe 0x40480a
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x40489b
cmp byte [ebp - 0x24a8], 0x67
je 0x40489b
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40487d
xor eax, eax
jmp 0x404887
cmp eax, 0x20
jbe 0x404887
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x404e9e
cmp eax, 0xb
jne 0x404bc8
cmp dword [ebp - 0x24a6], 0
jne 0x4048c7
cmp byte [ebp - 0x24a2], 0
je 0x404e9e
mov byte [ebp - 0x1280], 0x20
mov byte [ebp - 0x127f], 0xf4
mov dword [ebp - 0x127e], 0x100
mov eax, dword [ebp - 0x24a6]
mov dword [ebp - 0x127a], eax
mov al, byte [ebp - 0x24a2]
mov byte [ebp - 0x1276], al
cmp dword [ebp - 0x1284], 0
jne 0x40492a
mov dword [ebp - 0x1202], 0x281b142e
mov dword [ebp - 0x11fe], 0x5282c5a
mov dword [ebp - 0x11fa], 0x98be1cdf
mov dword [ebp - 0x11f6], 0xefcbe971
jmp 0x404952
mov dword [ebp - 0x1202], 0
mov dword [ebp - 0x11fe], 0
mov dword [ebp - 0x11fa], 0
mov dword [ebp - 0x11f6], 0
push 0xfa
lea edx, [ebp - 0x26c6]
push edx
push 0xf6
lea edx, [ebp - 0x1280]
push edx
call dword [ebx + 0x40]
cmp eax, 5
je 0x4049b0
push 0xa0d24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
mov dword [ebp - 0x24b4], 1
jmp 0x404bc3
mov dword [ebp - 0x1186], 0x227
mov eax, dword [ebp - 0x26c6]
mov dword [ebp - 0x1184], eax
mov al, byte [ebp - 0x26c2]
mov byte [ebp - 0x1180], al
lea edx, [ebp - 0x118a]
push edx
push 0xb
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
jne 0x404a0a
mov dword [ebp - 0x24b4], 1
jmp 0x404bc3
cmp eax, 0xffffffff
jne 0x404a1e
mov dword [ebp - 0x24b4], 1
jmp 0x404bc3
cmp byte [ebp - 0x24a8], 0x7f
jne 0x404b4a
cmp byte [ebp - 0x24a6], 0x35
jne 0x404a85
mov dword [ebp - 0x25c0], 0x20
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x9c4]
mov dword [ebp - 0x25bc], eax
lea edx, [ebp - 0x24ac]
push edx
push 0x64
push 6
push 0
call fcn.0040a20b
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x25bc]
jl 0x404a50
inc dword [ebp - 0x1284]
cmp dword [ebp - 0x1284], 2
jl 0x4046d9
jmp 0x404ad8
cmp byte [ebp - 0x24a6], 0x36
je 0x404a97
cmp byte [ebp - 0x24a6], 0x37
jne 0x404ad8
mov dword [ebp - 0x25c0], 0x20
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x9c4]
mov dword [ebp - 0x25bc], eax
lea edx, [ebp - 0x24ac]
push edx
push 0x32
push 6
push 0
call fcn.0040a20b
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x25bc]
jl 0x404ab3
jmp 0x4046d9
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404b2a
xor eax, eax
jmp 0x404b34
cmp eax, 0x20
jbe 0x404b34
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x404bc3
cmp byte [ebp - 0x24a8], 0x67
je 0x404bc3
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404ba5
xor eax, eax
jmp 0x404baf
cmp eax, 0x20
jbe 0x404baf
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x404e9e
cmp word [ebp - 0x24a6], 0
je 0x404e9e
push 0xe9de
push 0xd0cac9c2
push 0xbfb4b299
push 0x92848281
push 0x736c483e
push 0x281400b0
mov byte [ebp - 0x1280], 0x20
mov byte [ebp - 0x127f], 0xf4
mov eax, dword [ebp - 0x1284]
movzx eax, byte [esp + eax]
mov dword [ebp - 0x127e], eax
mov al, byte [ebp - 0x24a6]
mov byte [ebp - 0x127a], al
mov al, byte [ebp - 0x24a5]
mov byte [ebp - 0x1279], al
add esp, 0x18
push 0xfa
lea edx, [ebp - 0x26c6]
push edx
push 0xf6
lea edx, [ebp - 0x1280]
push edx
call dword [ebx + 0x40]
cmp eax, 2
je 0x404c8b
push 0xa0d24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
mov dword [ebp - 0x24b4], 1
jmp 0x404e9e
mov dword [ebp - 0x1186], 0x227
mov al, byte [ebp - 0x26c6]
mov byte [ebp - 0x1184], al
mov al, byte [ebp - 0x26c5]
mov byte [ebp - 0x1183], al
lea edx, [ebp - 0x118a]
push edx
push 8
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
jne 0x404ce5
mov dword [ebp - 0x24b4], 1
jmp 0x404e9e
cmp eax, 0xffffffff
jne 0x404cf9
mov dword [ebp - 0x24b4], 1
jmp 0x404e9e
cmp byte [ebp - 0x24a8], 0x7f
jne 0x404e25
cmp byte [ebp - 0x24a6], 0x35
jne 0x404d60
mov dword [ebp - 0x25c0], 0x20
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x9c4]
mov dword [ebp - 0x25bc], eax
lea edx, [ebp - 0x24ac]
push edx
push 0x64
push 6
push 0
call fcn.0040a20b
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x25bc]
jl 0x404d2b
inc dword [ebp - 0x1284]
cmp dword [ebp - 0x1284], 0x16
jl 0x4046d9
jmp 0x404db3
cmp byte [ebp - 0x24a6], 0x36
je 0x404d72
cmp byte [ebp - 0x24a6], 0x37
jne 0x404db3
mov dword [ebp - 0x25c0], 0x20
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x9c4]
mov dword [ebp - 0x25bc], eax
lea edx, [ebp - 0x24ac]
push edx
push 0x32
push 6
push 0
call fcn.0040a20b
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x25bc]
jl 0x404d8e
jmp 0x4046d9
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404e05
xor eax, eax
jmp 0x404e0f
cmp eax, 0x20
jbe 0x404e0f
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x404e9e
cmp byte [ebp - 0x24a8], 0x67
je 0x404e9e
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404e80
xor eax, eax
jmp 0x404e8a
cmp eax, 0x20
jbe 0x404e8a
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x38
jne 0x404fe4
cmp dword [ebp - 0x24b4], 0
jne 0x404fe4
mov dword [ebp - 0x1186], 0x903b
push 0x11
lea edx, [ebp - 0x103a]
push edx
lea edx, [ebp - 0x1184]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
push 0xa0d24
push 0x4e49565f
push 0x474e4947
push 0x4e414843
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
lea edx, [ebp - 0x118a]
push edx
push 0x17
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x404f30
cmp eax, 0xffffffff
jne 0x404f3f
mov dword [ebp - 0x24b4], 1
jmp 0x404fe4
cmp byte [ebp - 0x24a8], 0x7b
je 0x404fba
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404f9a
xor eax, eax
jmp 0x404fa4
cmp eax, 0x20
jbe 0x404fa4
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x404fe4
push 0xa0d
push 0x244b4f5f
push 0x4e49565f
push 0x474e4947
push 0x4e414843
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x405574
cmp dword [ebp - 0x24b4], 0
jne 0x405349
mov dword [ebp - 0x1186], 0x280023
mov dword [ebp - 0x1182], 0x100000
lea edx, [ebp - 0x118a]
push edx
push 0xb
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x405042
cmp eax, 0xffffffff
jne 0x405051
mov dword [ebp - 0x24b4], 1
jmp 0x405349
cmp byte [ebp - 0x24a8], 0x7f
jne 0x405342
cmp byte [ebp - 0x24a6], 0x31
jne 0x405342
mov dword [ebp - 0x1186], 0x200023
mov dword [ebp - 0x1182], 0x100000
lea edx, [ebp - 0x118a]
push edx
push 0xb
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x4050ad
cmp eax, 0xffffffff
jne 0x4050bc
mov dword [ebp - 0x24b4], 1
jmp 0x405340
cmp byte [ebp - 0x24a8], 0x7f
jne 0x4052be
cmp byte [ebp - 0x24a6], 0x31
jne 0x4052be
mov dword [ebp - 0x1186], 0x180023
mov dword [ebp - 0x1182], 0x100000
lea edx, [ebp - 0x118a]
push edx
push 0xb
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x405118
cmp eax, 0xffffffff
jne 0x405127
mov dword [ebp - 0x24b4], 1
jmp 0x4052b9
cmp byte [ebp - 0x24a8], 0x7f
jne 0x405237
cmp byte [ebp - 0x24a6], 0x31
jne 0x405237
mov dword [ebp - 0x1186], 0x100023
mov dword [ebp - 0x1182], 0x100000
lea edx, [ebp - 0x118a]
push edx
push 0xb
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x405183
cmp eax, 0xffffffff
jne 0x405192
mov dword [ebp - 0x24b4], 1
jmp 0x405232
cmp byte [ebp - 0x24a8], 0x7f
jne 0x4051b0
cmp byte [ebp - 0x24a6], 0x31
jne 0x4051b0
mov dword [esi + 0x14], 0x100000
jmp 0x405232
cmp byte [ebp - 0x24a8], 0x63
je 0x40522b
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40520b
xor eax, eax
jmp 0x405215
cmp eax, 0x20
jbe 0x405215
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x405232
mov dword [esi + 0x14], 0x180000
jmp 0x4052b9
cmp byte [ebp - 0x24a8], 0x63
je 0x4052b2
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405292
xor eax, eax
jmp 0x40529c
cmp eax, 0x20
jbe 0x40529c
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x4052b9
mov dword [esi + 0x14], 0x200000
jmp 0x405340
cmp byte [ebp - 0x24a8], 0x63
je 0x405339
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405319
xor eax, eax
jmp 0x405323
cmp eax, 0x20
jbe 0x405323
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x405340
mov dword [esi + 0x14], 0x280000
jmp 0x405349
mov dword [esi + 0x14], 0x3c0000
cmp dword [ebp - 0x24b4], 0
jne 0x405539
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [esi + 0x14]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x24], eax
mov dword [ebp - 0xffe], 0
mov eax, dword [esi + 0x14]
mov dword [ebp - 0xffa], eax
mov dword [ebp - 0xff6], 0
shl eax, 0xa
and eax, 0xffff0000
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov eax, dword [ebp - 0xffe]
mov ecx, dword [ebp - 0xffa]
cmp eax, ecx
jae 0x405539
sub ecx, eax
cmp ecx, 0x40
jbe 0x405413
mov ecx, 0x40
mov dword [ebp - 0xff2], ecx
mov dword [ebp - 0x1186], 0x23
mov byte [ebp - 0x1181], ch
mov byte [ebp - 0x1180], cl
add eax, dword [ebp - 0xff6]
mov byte [ebp - 0x1183], ah
mov byte [ebp - 0x1182], al
shr eax, 0x10
mov byte [ebp - 0x1185], ah
mov byte [ebp - 0x1184], al
lea edx, [ebp - 0x118a]
push edx
push 0xb
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x40547e
cmp eax, 0xffffffff
jne 0x40548d
mov dword [ebp - 0x24b4], 1
jmp 0x405539
cmp byte [ebp - 0x24a8], 0x63
je 0x405508
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4054e8
xor eax, eax
jmp 0x4054f2
cmp eax, 0x20
jbe 0x4054f2
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x405539
call fcn.0040a01a
mov eax, dword [ebp - 0xff2]
mov ecx, dword [ebp - 0xffe]
add ecx, dword [esi + 0x24]
add dword [ebp - 0xffe], eax
push eax
lea edx, [ebp - 0x24a3]
push edx
push ecx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
jmp 0x4053f3
cmp dword [ebp - 0x24b4], 0
jne 0x40556b
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
jmp 0x405574
lea edx, [esi + 0x24]
push edx
call fcn.0040a38d
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x406a0a
cmp dword [ebp - 0x24b4], 0
jne 0x4055a2
push 2
push 0x30
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
cmp dword [ebp - 0x24b4], 0
jne 0x4055b5
mov dword [ebp - 0x5c3], 0
cmp dword [esi + 0x14], 0x3c0000
jne 0x405f3c
cmp dword [ebp - 0x24b4], 0
jne 0x4057c4
push 0
push 0xa0d3120
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
push 0xa
push dword [ebp - 0x108a]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
jne 0x40565f
push 0
push 0xa0d3120
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202c24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x24b4], 1
jmp 0x4057c4
mov dword [ebp - 0x1086], eax
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 0x1082], eax
push dword [ebp - 0x1086]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x4056dc
push 0
push 0xa0d3220
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202c24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x24b4], 1
jmp 0x4057c4
mov dword [ebp - 0x107e], eax
cmp byte [eax + 3], 8
je 0x40573c
push 0
push 0xa0d3320
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202c24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x24b4], 1
jmp 0x4057c4
mov ecx, dword [ebp - 0x1082]
mov eax, dword [ecx + eax - 4]
mov dword [ebp - 0x107a], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [ebp - 0x1076], eax
push dword [ebp - 0x107a]
push eax
push dword [ebp - 0x1082]
push dword [ebp - 0x107e]
call dword [ebx + 0x4c]
test eax, eax
jne 0x4057c4
push 0
push 0xa0d3420
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202c24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x4058b7
mov dword [ebp - 0x1186], 0x20000034
mov dword [ebp - 0x1182], 0x1c00
lea edx, [ebp - 0x118a]
push edx
push 0xa
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x405813
cmp eax, 0xffffffff
jne 0x405822
mov dword [ebp - 0x24b4], 1
jmp 0x4058b7
cmp byte [ebp - 0x24a8], 0x74
je 0x4058b7
dec dword [ebp - 0x148c]
je 0x405847
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x404d8e
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405899
xor eax, eax
jmp 0x4058a3
cmp eax, 0x20
jbe 0x4058a3
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x405cd1
mov dword [ebp - 0xfce], 0
mov dword [ebp - 0xfca], 0x200000
mov dword [ebp - 0xfc6], 0x800
mov dword [ebp - 0xfc2], 0x1c
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
mov dword [ebp - 0xfee], 0
mov dword [ebp - 0xfea], 0
cmp dword [ebp - 0xfee], 0x20
jae 0x405968
imul ecx, dword [ebp - 0xfee], 0x10
mov eax, dword [ebp + ecx - 0xfca]
sub eax, dword [ebp + ecx - 0xfce]
test eax, eax
je 0x405968
mov ecx, dword [ebp + ecx - 0xfc6]
xor edx, edx
div ecx
test edx, edx
je 0x40595a
inc eax
add dword [ebp - 0xfea], eax
inc dword [ebp - 0xfee]
jmp 0x405928
mov eax, dword [ebp - 0xfea]
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0xfee], 0
imul ecx, dword [ebp - 0xfee], 0x10
mov eax, dword [ebp + ecx - 0xfce]
mov dword [ebp - 0xfe6], eax
mov eax, dword [ebp + ecx - 0xfca]
mov dword [ebp - 0xfe2], eax
mov eax, dword [ebp + ecx - 0xfc6]
mov dword [ebp - 0xfde], eax
mov eax, dword [ebp + ecx - 0xfc2]
mov dword [ebp - 0xfda], eax
mov dword [ebp - 0x1186], 0x36
mov dword [ebp - 0x1182], 0
mov dword [ebp - 0x117e], 0x40431000
mov dword [ebp - 0x117a], 0x2d2d2d2d
mov dword [ebp - 0x1176], 0x2d2d2d2d
mov dword [ebp - 0x1172], 0x100
mov dword [ebp - 0x116e], 0x100
mov dword [ebp - 0x116a], 0
mov dword [ebp - 0x1166], 0
cmp dword [ebp - 0x1307], 0
jne 0x405a74
cmp dword [ebp - 0x1303], 0
jne 0x405a74
mov dword [ebp - 0x1307], 0x2d2d2d2d
mov dword [ebp - 0x1303], 0x2d2d2d2d
push 8
lea edx, [ebp - 0x1307]
push edx
lea edx, [ebp - 0x117a]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov ecx, dword [ebp - 0xfe6]
mov edx, dword [ebp - 0x1076]
mov dword [ebp - 0xfd6], 0
cmp ecx, dword [ebp - 0xfe2]
jae 0x405ab8
movzx eax, byte [edx + ecx]
add dword [ebp - 0xfd6], eax
inc ecx
jmp 0x405aa3
mov eax, dword [ebp - 0xfd6]
mov byte [ebp - 0x1180], ah
mov byte [ebp - 0x117f], al
mov eax, dword [ebp - 0x1288]
mov byte [ebp - 0x1170], ah
mov byte [ebp - 0x116f], al
mov eax, dword [ebp - 0xfe6]
mov byte [ebp - 0x116a], ah
mov byte [ebp - 0x1169], al
shr eax, 0x10
mov byte [ebp - 0x116c], ah
mov byte [ebp - 0x116b], al
mov eax, dword [ebp - 0xfe2]
sub eax, dword [ebp - 0xfe6]
mov byte [ebp - 0x1166], ah
mov byte [ebp - 0x1165], al
shr eax, 0x10
mov byte [ebp - 0x1168], ah
mov byte [ebp - 0x1167], al
mov dword [ebp - 0x25c0], 3
mov dword [ebp - 0x148c], 0x100
lea edx, [ebp - 0x118a]
push edx
push 0x26
push 0x1388
push 0x40
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x405b65
mov dword [ebp - 0x24b4], 1
jmp 0x405cd1
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x405b8e
mov dword [ebp - 0x24b4], 1
jmp 0x405cd1
test eax, eax
jne 0x405c1b
dec dword [ebp - 0x25c0]
jne 0x405b65
mov dword [ebp - 0x25c0], 3
dec dword [ebp - 0x148c]
jne 0x405b38
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405bf8
xor eax, eax
jmp 0x405c02
cmp eax, 0x20
jbe 0x405c02
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x405cd1
cmp byte [ebp - 0x24a8], 0x7f
jne 0x405c4b
cmp byte [ebp - 0x24a6], 0x78
jne 0x405c4b
mov dword [ebp - 0x25c0], 3
mov dword [ebp - 0x148c], 0x100
jmp 0x405b65
cmp byte [ebp - 0x24a8], 0x76
je 0x405cd1
cmp byte [ebp - 0x24a8], 0x7e
je 0x405b65
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405cb3
xor eax, eax
jmp 0x405cbd
cmp eax, 0x20
jbe 0x405cbd
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x405ef5
mov eax, dword [ebp - 0x101a]
mov dword [ebp - 0xdce], eax
mov eax, dword [ebp - 0xfe6]
mov ecx, dword [ebp - 0xfe2]
cmp eax, ecx
jae 0x405ef5
sub ecx, eax
cmp ecx, dword [ebp - 0xfde]
jbe 0x405d0e
mov ecx, dword [ebp - 0xfde]
mov dword [ebp - 0xfd2], ecx
add eax, dword [ebp - 0xfda]
mov dword [ebp - 0xdca], 0x36
mov byte [ebp - 0xdc6], ah
mov byte [ebp - 0xdc5], al
shr eax, 0x10
mov byte [ebp - 0xdc8], ah
mov byte [ebp - 0xdc7], al
xor ecx, ecx
mov edx, dword [ebp - 0x1076]
add edx, dword [ebp - 0xfe6]
cmp ecx, dword [ebp - 0xfd2]
jae 0x405d62
mov al, byte [edx + ecx]
mov byte [ebp + ecx - 0xdc4], al
inc ecx
jmp 0x405d4d
mov dword [ebp - 0x148c], 0x100
mov ecx, dword [ebp - 0xfd2]
lea edx, [ebp - 0xdce]
push edx
lea edx, [ecx + 0xa]
push edx
push 0x9c4
push 0x40
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x405da1
mov dword [ebp - 0x24b4], 1
jmp 0x405ef5
lea edx, [ebp - 0x24ac]
push edx
push 0x64
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x405dc7
mov dword [ebp - 0x24b4], 1
jmp 0x405ef5
test eax, eax
jne 0x405e3e
dec dword [ebp - 0x148c]
jne 0x405d6c
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405e1b
xor eax, eax
jmp 0x405e25
cmp eax, 0x20
jbe 0x405e25
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x405ef5
cmp byte [ebp - 0x24a8], 0x7f
jne 0x405e64
cmp byte [ebp - 0x24a6], 0x78
jne 0x405e64
mov dword [ebp - 0x148c], 0x100
jmp 0x405da1
cmp byte [ebp - 0x24a8], 0x76
je 0x405edf
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405ebf
xor eax, eax
jmp 0x405ec9
cmp eax, 0x20
jbe 0x405ec9
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x405ef5
call fcn.0040a01a
mov eax, dword [ebp - 0xfd2]
add dword [ebp - 0xfe6], eax
jmp 0x405cea
cmp dword [ebp - 0x24b4], 0
jne 0x405f25
push 0
push 0xa0d3220
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
cmp dword [ebp - 0x1076], 0xffffffff
je 0x405f3a
push dword [ebp - 0x1076]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
jmp 0x405f61
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
cmp dword [ebp - 0x24b4], 0
jne 0x4068ce
mov dword [ebp - 0x148c], 3
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x17]
mov dword [ebp - 0x25bc], eax
lea edx, [ebp - 0x24ac]
push edx
push 0x17
push 6
push 0
call fcn.0040a20b
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x25bc]
jl 0x405f87
cmp dword [esi + 0x14], 0x3c0000
jne 0x405fc6
mov dword [ebp - 0x1186], 0x39000034
mov dword [ebp - 0x1182], 0x1c00
jmp 0x405fda
mov dword [ebp - 0x1186], 0x34
mov dword [ebp - 0x1182], 0
lea edx, [ebp - 0x118a]
push edx
push 0xa
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x406008
cmp eax, 0xffffffff
jne 0x406017
mov dword [ebp - 0x24b4], 1
jmp 0x4060ac
cmp byte [ebp - 0x24a8], 0x74
je 0x4060ac
dec dword [ebp - 0x148c]
je 0x40603c
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x405fa7
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40608e
xor eax, eax
jmp 0x406098
cmp eax, 0x20
jbe 0x406098
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [esi + 0x14], 0x100000
jne 0x40610a
mov dword [ebp - 0xfce], 0x20000
mov dword [ebp - 0xfca], 0x100000
mov dword [ebp - 0xfc6], pe_nt_image_headers32
mov dword [ebp - 0xfc2], 0xfffe001c
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
jmp 0x4062cf
cmp dword [esi + 0x14], 0x180000
jne 0x406168
mov dword [ebp - 0xfce], 0x20000
mov dword [ebp - 0xfca], 0x180000
mov dword [ebp - 0xfc6], 0x800
mov dword [ebp - 0xfc2], 0xfffe001c
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
jmp 0x4062cf
cmp dword [esi + 0x14], 0x200000
jne 0x4061c6
mov dword [ebp - 0xfce], 0x40000
mov dword [ebp - 0xfca], 0x200000
mov dword [ebp - 0xfc6], 0x800
mov dword [ebp - 0xfc2], 0xfffc001c
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
jmp 0x4062cf
cmp dword [esi + 0x14], 0x280000
jne 0x40627f
mov edx, dword [esi + 0x20]
cmp dword [edx + 0x2fff4], 0xffffffff
jne 0x40622d
cmp dword [edx + 0x2fff8], 0xffffffff
jne 0x40622d
cmp dword [edx + 0x2fffc], 0xffffffff
jne 0x40622d
cmp dword [edx + 0x30000], 0xffffffff
je 0x40622d
cmp dword [edx + 0x30000], 0
je 0x40622d
mov dword [ebp - 0xfce], 0x30000
mov dword [ebp - 0xfca], 0x280000
mov dword [ebp - 0xfc6], 0x800
mov dword [ebp - 0xfc2], 0xfffd001c
jmp 0x406255
mov dword [ebp - 0xfce], 0x40000
mov dword [ebp - 0xfca], 0x280000
mov dword [ebp - 0xfc6], 0x800
mov dword [ebp - 0xfc2], 0xfffc001c
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
jmp 0x4062cf
mov dword [ebp - 0xfce], 0x30000
mov dword [ebp - 0xfca], 0x3c0000
mov dword [ebp - 0xfc6], 0x800
mov dword [ebp - 0xfc2], 0xfffd001c
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
mov dword [ebp - 0xfee], 0
mov dword [ebp - 0xfea], 0
cmp dword [ebp - 0xfee], 0x20
jae 0x406323
imul ecx, dword [ebp - 0xfee], 0x10
mov eax, dword [ebp + ecx - 0xfca]
sub eax, dword [ebp + ecx - 0xfce]
test eax, eax
je 0x406323
mov ecx, dword [ebp + ecx - 0xfc6]
xor edx, edx
div ecx
test edx, edx
je 0x406315
inc eax
add dword [ebp - 0xfea], eax
inc dword [ebp - 0xfee]
jmp 0x4062e3
mov eax, dword [ebp - 0xfea]
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0xfee], 0
imul ecx, dword [ebp - 0xfee], 0x10
mov eax, dword [ebp + ecx - 0xfce]
mov dword [ebp - 0xfe6], eax
mov eax, dword [ebp + ecx - 0xfca]
mov dword [ebp - 0xfe2], eax
mov eax, dword [ebp + ecx - 0xfc6]
mov dword [ebp - 0xfde], eax
mov eax, dword [ebp + ecx - 0xfc2]
mov dword [ebp - 0xfda], eax
cmp dword [ebp - 0x24b4], 0
jne 0x4066ad
mov dword [ebp - 0x1186], 0x36
mov dword [ebp - 0x1182], 0
mov dword [ebp - 0x117e], 0x40430100
mov dword [ebp - 0x117a], 0x2d2d2d2d
mov dword [ebp - 0x1176], 0x2d2d2d2d
mov dword [ebp - 0x1172], 0x200
mov dword [ebp - 0x116e], 0x2000100
mov dword [ebp - 0x116a], 0
mov dword [ebp - 0x1166], 0
mov dword [ebp - 0xfd6], 0
cmp dword [esi + 0x14], 0x3c0000
jne 0x406437
mov byte [ebp - 0x1172], 0
mov byte [ebp - 0x1171], 1
cmp dword [ebp - 0x1307], 0
jne 0x40645d
cmp dword [ebp - 0x1303], 0
jne 0x40645d
mov dword [ebp - 0x1307], 0x2d2d2d2d
mov dword [ebp - 0x1303], 0x2d2d2d2d
push 8
lea edx, [ebp - 0x1307]
push edx
lea edx, [ebp - 0x117a]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov ecx, dword [ebp - 0xfe6]
mov edx, dword [esi + 0x20]
cmp ecx, dword [ebp - 0xfe2]
jae 0x406494
movzx eax, byte [edx + ecx]
add dword [ebp - 0xfd6], eax
inc ecx
jmp 0x40647f
mov eax, dword [ebp - 0xfd6]
mov byte [ebp - 0x1180], ah
mov byte [ebp - 0x117f], al
mov eax, dword [ebp - 0x1288]
mov byte [ebp - 0x1170], ah
mov byte [ebp - 0x116f], al
mov eax, dword [ebp - 0xfe6]
mov byte [ebp - 0x116a], ah
mov byte [ebp - 0x1169], al
shr eax, 0x10
mov byte [ebp - 0x116c], ah
mov byte [ebp - 0x116b], al
mov eax, dword [ebp - 0xfe2]
sub eax, dword [ebp - 0xfe6]
mov byte [ebp - 0x1166], ah
mov byte [ebp - 0x1165], al
shr eax, 0x10
mov byte [ebp - 0x1168], ah
mov byte [ebp - 0x1167], al
mov dword [ebp - 0x25c0], 3
mov dword [ebp - 0x148c], 0x100
lea edx, [ebp - 0x118a]
push edx
push 0x26
push 0x1388
push 0x40
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x406541
mov dword [ebp - 0x24b4], 1
jmp 0x4066ad
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x40656a
mov dword [ebp - 0x24b4], 1
jmp 0x4066ad
test eax, eax
jne 0x4065f7
dec dword [ebp - 0x25c0]
jne 0x406541
mov dword [ebp - 0x25c0], 3
dec dword [ebp - 0x148c]
jne 0x406514
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4065d4
xor eax, eax
jmp 0x4065de
cmp eax, 0x20
jbe 0x4065de
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x4066ad
cmp byte [ebp - 0x24a8], 0x7f
jne 0x406627
cmp byte [ebp - 0x24a6], 0x78
jne 0x406627
mov dword [ebp - 0x25c0], 3
mov dword [ebp - 0x148c], 0x100
jmp 0x406541
cmp byte [ebp - 0x24a8], 0x76
je 0x4066ad
cmp byte [ebp - 0x24a8], 0x7e
je 0x406541
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40668f
xor eax, eax
jmp 0x406699
cmp eax, 0x20
jbe 0x406699
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x4068ce
mov eax, dword [ebp - 0x101a]
mov dword [ebp - 0xdce], eax
mov eax, dword [ebp - 0xfe6]
mov ecx, dword [ebp - 0xfe2]
cmp eax, ecx
jae 0x4068ce
sub ecx, eax
cmp ecx, dword [ebp - 0xfde]
jbe 0x4066ea
mov ecx, dword [ebp - 0xfde]
mov dword [ebp - 0xfd2], ecx
add eax, dword [ebp - 0xfda]
mov dword [ebp - 0xdca], 0x36
mov byte [ebp - 0xdc6], ah
mov byte [ebp - 0xdc5], al
shr eax, 0x10
mov byte [ebp - 0xdc8], ah
mov byte [ebp - 0xdc7], al
xor ecx, ecx
mov edx, dword [esi + 0x20]
add edx, dword [ebp - 0xfe6]
cmp ecx, dword [ebp - 0xfd2]
jae 0x40673b
mov al, byte [edx + ecx]
mov byte [ebp + ecx - 0xdc4], al
inc ecx
jmp 0x406726
mov dword [ebp - 0x148c], 0x100
mov ecx, dword [ebp - 0xfd2]
lea edx, [ebp - 0xdce]
push edx
lea edx, [ecx + 0xa]
push edx
push 0x9c4
push 0x40
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x40677a
mov dword [ebp - 0x24b4], 1
jmp 0x4068ce
lea edx, [ebp - 0x24ac]
push edx
push 0x64
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x4067a0
mov dword [ebp - 0x24b4], 1
jmp 0x4068ce
test eax, eax
jne 0x406817
dec dword [ebp - 0x148c]
jne 0x406745
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4067f4
xor eax, eax
jmp 0x4067fe
cmp eax, 0x20
jbe 0x4067fe
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x4068ce
cmp byte [ebp - 0x24a8], 0x7f
jne 0x40683d
cmp byte [ebp - 0x24a6], 0x78
jne 0x40683d
mov dword [ebp - 0x148c], 0x100
jmp 0x40677a
cmp byte [ebp - 0x24a8], 0x76
je 0x4068b8
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406898
xor eax, eax
jmp 0x4068a2
cmp eax, 0x20
jbe 0x4068a2
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x4068ce
call fcn.0040a01a
mov eax, dword [ebp - 0xfd2]
add dword [ebp - 0xfe6], eax
jmp 0x4066c6
cmp dword [ebp - 0x24b4], 0
jne 0x4069da
cmp eax, 0xffffffff
jne 0x4068ef
mov dword [ebp - 0x24b4], 1
jmp 0x4069da
mov dword [ebp - 0x25c0], 0x20
push 0x20fe
push 0x1010000
push esp
push 6
push 0xa
push 0xc0
push 6
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x40692a
mov dword [ebp - 0x24b4], 1
jmp 0x4069da
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x406953
mov dword [ebp - 0x24b4], 1
jmp 0x4069da
test eax, eax
jne 0x406961
dec dword [ebp - 0x25c0]
jne 0x4068f9
jmp 0x4069da
cmp byte [ebp - 0x24a8], 0x60
je 0x4069da
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4069bc
xor eax, eax
jmp 0x4069c6
cmp eax, 0x20
jbe 0x4069c6
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x406a0a
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x406bcd
cmp dword [ebp - 0x24b4], 0
jne 0x406bcd
push 0x400
push 0
lea edx, [ebp - 0x5b7]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov dword [ebp - 0x5bf], 0
push 0
push 0x1281a903
push 0xe0070000
push esp
push 0xc
push 0xa
push 0
push 5
push 0
call fcn.0040a09d
cmp eax, 0xffffffff
jne 0x406a74
mov dword [ebp - 0x24b4], 1
jmp 0x406adb
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
cmp eax, 0xffffffff
jne 0x406a9a
mov dword [ebp - 0x24b4], 1
jmp 0x406adb
test eax, eax
je 0x406adb
imul ecx, dword [ebp - 0x5bf], 4
movzx eax, byte [ebp - 0x24a6]
mov ah, byte [ebp - 0x24a7]
mov word [ebp + ecx - 0x5b7], ax
test eax, eax
je 0x406ad9
movzx eax, byte [ebp - 0x24a4]
mov ah, byte [ebp - 0x24a5]
mov word [ebp + ecx - 0x5b5], ax
inc dword [ebp - 0x5bf]
jmp 0x406a74
cmp dword [ebp - 0x24b4], 0
jne 0x406bcd
push 0xa
push 0xd642520
push 0x3a24544e
push 0x554f435f
push 0x43544424
push dword [ebp - 0x5bf]
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
mov dword [ebp - 0x5bb], 0
mov ecx, dword [ebp - 0x5bb]
cmp ecx, dword [ebp - 0x5bf]
jae 0x406bcd
imul ecx, ecx, 4
movzx eax, word [ebp + ecx - 0x5b7]
movzx ecx, ah
and eax, 0xff
cmp ecx, 0xc0
jb 0x406b92
sub ecx, 0xc0
push 0xa0d58
push 0x322e2558
push 0x322e2555
push eax
push ecx
lea eax, [esp + 8]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x1c
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
jmp 0x406bc2
push 0xa0d58
push 0x322e2558
push 0x322e2550
push eax
push ecx
lea eax, [esp + 8]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x1c
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
inc dword [ebp - 0x5bb]
jmp 0x406b2d
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x18
jne 0x406e78
cmp dword [ebp - 0x24b4], 0
jne 0x406e78
push 0
push 0xa0d2443
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 4
push 0xe0070000
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x2710
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x406c3a
cmp eax, 0xffffffff
jne 0x406c49
mov dword [ebp - 0x24b4], 1
jmp 0x406e78
cmp byte [ebp - 0x24a8], 0x7f
jne 0x406dd8
cmp byte [ebp - 0x24a6], 0x11
jne 0x406dd8
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
mov dword [ebp - 0x101a], 0x4a020000
mov dword [ebp - 0x1016], 0x4a060000
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xffffffffffffffff
push 0
push 4
push 0
push 0x40
push 0
push 6
push 3
push 0
push 0
mov dword [ebp - 0x1b7], esp
mov eax, dword [ebp - 0x1016]
mov dword [esp + 0x40], eax
mov eax, dword [ebp - 0x101a]
mov dword [esp + 0x5c], eax
push 0
push dword [ebp - 0x1b7]
push 4
call dword [edi]
add esp, 0x60
mov eax, dword [ebp - 0x101a]
mov dword [ebp - 0x118a], eax
mov dword [ebp - 0x1186], 4
lea edx, [ebp - 0x118a]
push edx
push 5
lea edx, [ebp - 0x24ac]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040a069
test eax, eax
je 0x406d24
cmp eax, 0xffffffff
jne 0x406d33
mov dword [ebp - 0x24b4], 1
jmp 0x406dd3
cmp byte [ebp - 0x24a8], 0x44
je 0x406dae
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406d8e
xor eax, eax
jmp 0x406d98
cmp eax, 0x20
jbe 0x406d98
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x406dd3
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x406e78
cmp byte [ebp - 0x24a8], 0x44
je 0x406e53
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406e33
xor eax, eax
jmp 0x406e3d
cmp eax, 0x20
jbe 0x406e3d
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x406e78
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x406e88
cmp eax, 0xb
jne 0x406ea1
push 0
push 0
mov dword [ebp - 0x1b3], esp
push 0
push dword [ebp - 0x1b3]
push 7
call dword [edi]
add esp, 8
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0
mov eax, esp
push 0
push eax
push 2
call dword [edi]
add esp, 4
push 0
push 0
push 3
call dword [edi]
cmp dword [esi + 0x270], 0x75736924
jne 0x4098c2
cmp dword [esi + 0x274], 0x3037757a
jne 0x4098c2
cmp dword [esi + 0x278], 0x5424325f
jne 0x4098c2
cmp dword [esi + 0x27c], 0x736e6172
jne 0x4098c2
cmp dword [esi + 0x280], 0x6e6f7274
jne 0x4098c2
cmp dword [esi + 0x284], 0x3231355b
jne 0x4098c2
cmp dword [esi + 0x288], 0x3230312f
jne 0x4098c2
cmp dword [esi + 0x28c], 0x205d6b34
jne 0x4098c2
cmp dword [esi + 0x290], 0x696c2d4b
jne 0x4098c2
cmp word [esi + 0x294], 0x656e
jne 0x4098c2
cmp byte [esi + 0x296], 0
jne 0x4098c2
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x406f96
cmp eax, 0xb
je 0x406f96
cmp eax, 0xa
je 0x406f96
cmp eax, 0x17
je 0x406f96
cmp eax, 0x18
jne 0x4098c2
push 0x28a0
push 0
push 4
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x406fc1
mov dword [ebp - 0x24b4], 1
jmp 0x4098c2
push 0xa
push 0xc
push 0x258
push 0xa
push 2
push 0xc
push 0
push 3
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x24
cmp eax, 0xffffffff
jne 0x406ff6
mov dword [ebp - 0x24b4], 1
jmp 0x4098ac
push 0x1af
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x407024
cmp eax, 0xb
je 0x407024
cmp eax, 0xa
je 0x407024
cmp eax, 0x17
je 0x407024
cmp eax, 0x18
jne 0x4098ac
push 0
push 0
push 0
push 0
push 0
push 0
push 0x40000
push 0
push 0x100
push 0
push 0
push 0
push 0x400
push 0
push 1
push 0
push 0
push 0
push 4
push 1
push 0
push 0
mov eax, esp
push 0
push eax
push 4
call dword [edi]
add esp, 0x58
cmp eax, 0xffffffff
je 0x4098ac
mov dword [0x41001a], eax
push 0x81f11181
push 0
push 4
push 0
push 0
push 0
push 4
push 0
mov dword [ebp - 0x1af], esp
lea edx, [ebp - 0x24ac]
push edx
push dword [ebp - 0x1af]
push 0xd
call dword [edi]
add esp, 0x20
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4070b4
cmp eax, 0xa
jne 0x407b67
mov byte [ebp - 0x1488], 0
mov byte [ebp - 0x1a3], 0
mov byte [ebp - 0x162], 0
mov byte [ebp - 0x121], 0
mov byte [ebp - 0xe0], 0
mov byte [ebp - 0x9f], 0
mov byte [ebp - 0x5e], 0
cmp dword [ebp - 0x24b4], 0
jne 0x4071ff
push 0x94
push 0x1af11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x407121
cmp eax, 0xffffffff
jne 0x407130
mov dword [ebp - 0x24b4], 1
jmp 0x4071ff
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x407149
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x5a
jne 0x4071ff
mov ecx, 2
cmp ecx, 0x42
jae 0x4071a0
cmp ecx, dword [ebp - 0x1a7]
jae 0x4071a0
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x24ac]
cmp dl, 0
je 0x4071a0
cmp dl, 0xff
je 0x4071a0
cmp dl, 0x2d
je 0x4071a0
mov byte [ebp + ecx - 0x148a], dl
inc ecx
jmp 0x40716a
mov byte [ebp + ecx - 0x148a], 0
cmp byte [ebp - 0x1488], 0
je 0x4071ff
lea eax, [ebp - 0x1488]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x4072d0
push 0x95
push 0x1af11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x40723e
cmp eax, 0xffffffff
jne 0x40724d
mov dword [ebp - 0x24b4], 1
jmp 0x4072d0
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x407266
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x5a
jne 0x4072d0
movzx eax, byte [ebp + ecx - 0x24a9]
mov ah, byte [ebp + ecx - 0x24aa]
push 0xa0d58
push 0x342e2520
push 0x3a244e4f
push 0x49535245
push 0x565f5753
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x4073ed
push 0x91
push 0x1af11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x40730f
cmp eax, 0xffffffff
jne 0x40731e
mov dword [ebp - 0x24b4], 1
jmp 0x4073ed
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x407337
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x5a
jne 0x4073ed
mov ecx, 2
cmp ecx, 0x42
jae 0x40738e
cmp ecx, dword [ebp - 0x1a7]
jae 0x40738e
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x24ac]
cmp dl, 0
je 0x40738e
cmp dl, 0xff
je 0x40738e
cmp dl, 0x2d
je 0x40738e
mov byte [ebp + ecx - 0x1a5], dl
inc ecx
jmp 0x407358
mov byte [ebp + ecx - 0x1a5], 0
cmp byte [ebp - 0x1a3], 0
je 0x4073ed
lea eax, [ebp - 0x1a3]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x44524148
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x407505
push pe_nt_image_headers32
push 0x1af11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x40742c
cmp eax, 0xffffffff
jne 0x40743b
mov dword [ebp - 0x24b4], 1
jmp 0x407505
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x407454
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x5a
jne 0x407505
mov ecx, 2
cmp ecx, 0x42
jae 0x4074ab
cmp ecx, dword [ebp - 0x1a7]
jae 0x4074ab
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x24ac]
cmp dl, 0
je 0x4074ab
cmp dl, 0xff
je 0x4074ab
cmp dl, 0x2d
je 0x4074ab
mov byte [ebp + ecx - 0x164], dl
inc ecx
jmp 0x407475
mov byte [ebp + ecx - 0x164], 0
cmp byte [ebp - 0x162], 0
je 0x407505
lea eax, [ebp - 0x162]
push 0xa0d
push 0x7325203a
push 0x24545241
push 0x505f454e
push 0x49474e45
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x407642
push 0x92
push 0x1af11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x407544
cmp eax, 0xffffffff
jne 0x407553
mov dword [ebp - 0x24b4], 1
jmp 0x407642
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x40756c
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x5a
jne 0x407642
mov ecx, 2
cmp ecx, 0x42
jae 0x4075c3
cmp ecx, dword [ebp - 0x1a7]
jae 0x4075c3
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x24ac]
cmp dl, 0
je 0x4075c3
cmp dl, 0xff
je 0x4075c3
cmp dl, 0x2d
je 0x4075c3
mov byte [ebp + ecx - 0x123], dl
inc ecx
jmp 0x40758d
mov byte [ebp + ecx - 0x123], 0
cmp byte [ebp - 0x121], 0
je 0x407642
lea eax, [ebp - 0x121]
push 0
push 0xa0d7325
push 0x203a2452
push 0x45424d55
push 0x4e5f4552
push 0x41574452
push 0x41485f55
push 0x43455f52
push 0x4f5f4449
push 0x5f524549
push 0x4c505055
push 0x535f4d45
push 0x54535953
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x48
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x40776b
push 0x97
push 0x1af11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x407681
cmp eax, 0xffffffff
jne 0x407690
mov dword [ebp - 0x24b4], 1
jmp 0x40776b
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x4076a9
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x5a
jne 0x40776b
mov ecx, 2
cmp ecx, 0x42
jae 0x407700
cmp ecx, dword [ebp - 0x1a7]
jae 0x407700
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x24ac]
cmp dl, 0
je 0x407700
cmp dl, 0xff
je 0x407700
cmp dl, 0x2d
je 0x407700
mov byte [ebp + ecx - 0xe2], dl
inc ecx
jmp 0x4076ca
mov byte [ebp + ecx - 0xe2], 0
cmp byte [ebp - 0xe0], 0
je 0x40776b
lea eax, [ebp - 0xe0]
push 0xa
push 0xd732520
push 0x3a244550
push 0x59545f45
push 0x4e49474e
push 0x455f524f
push 0x5f454d41
push 0x4e5f4d45
push 0x54535953
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x4078a6
push 0x98
push 0x1af11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x4077aa
cmp eax, 0xffffffff
jne 0x4077b9
mov dword [ebp - 0x24b4], 1
jmp 0x4078a6
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x4077d2
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x5a
jne 0x4078a6
mov ecx, 2
cmp ecx, 0x42
jae 0x407829
cmp ecx, dword [ebp - 0x1a7]
jae 0x407829
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x24ac]
cmp dl, 0
je 0x407829
cmp dl, 0xff
je 0x407829
cmp dl, 0x2d
je 0x407829
mov byte [ebp + ecx - 0xa1], dl
inc ecx
jmp 0x4077f3
mov byte [ebp + ecx - 0xa1], 0
cmp byte [ebp - 0x9f], 0
je 0x4078a6
lea eax, [ebp - 0x9f]
push 0xa0d73
push 0x25203a24
push 0x5245424d
push 0x554e5f4c
push 0x41495245
push 0x535f5245
push 0x54534554
push 0x5f524f5f
push 0x45444f43
push 0x5f504f48
push 0x535f5249
push 0x41504552
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x44
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x40797c
push 0x99
push 0x1af11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x4078e5
cmp eax, 0xffffffff
jne 0x4078f4
mov dword [ebp - 0x24b4], 1
jmp 0x40797c
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x40790d
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x5a
jne 0x40797c
mov eax, dword [ebp + ecx - 0x24aa]
bswap eax
test eax, eax
je 0x40797c
push 0xa
push 0xd58382e
push 0x25203a24
push 0x45544144
push 0x5f474e49
push 0x4d4d4152
push 0x474f5250
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x407a65
push 0x9a
push 0x1af11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x4079bb
cmp eax, 0xffffffff
jne 0x4079ca
mov dword [ebp - 0x24b4], 1
jmp 0x407a65
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x4079e3
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x5a
jne 0x407a65
movzx eax, byte [ebp + ecx - 0x24a9]
mov ah, byte [ebp + ecx - 0x24aa]
test eax, eax
je 0x407a65
push 0xa0d58
push 0x342e2520
push 0x3a245245
push 0x49464954
push 0x4e454449
push 0x5f415441
push 0x445f4349
push 0x54534f4e
push 0x47414944
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x24b4], 0
jne 0x407b67
push 0x90
push 0x1af11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x407aa4
cmp eax, 0xffffffff
jne 0x407ab3
mov dword [ebp - 0x24b4], 1
jmp 0x407b67
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x407acc
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x5a
jne 0x407b67
mov ecx, 2
cmp ecx, 0x42
jae 0x407b20
cmp ecx, dword [ebp - 0x1a7]
jae 0x407b20
mov edx, dword [ebp - 0x1ab]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x24ac]
cmp dl, 0
je 0x407b20
cmp dl, 0xff
je 0x407b20
cmp dl, 0x2d
je 0x407b20
mov byte [ebp + ecx - 0x60], dl
inc ecx
jmp 0x407aed
mov byte [ebp + ecx - 0x60], 0
cmp byte [ebp - 0x5e], 0
je 0x407b67
lea eax, [ebp - 0x5e]
push 0xa0d
push 0x7325203a
push 0x244e4956
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x408367
cmp dword [ebp - 0x24b4], 0
jne 0x407d9e
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
push 0xc
push 0x258
push 0xa
push 0
push 2
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0
push 0
push 0x40000
push 0
push 0x100
push 0
push 0
push 0
push 0x400
push 0
push 1
push 0
push 0
push 0
push 4
push 1
push 0
push 0
mov eax, esp
push 0
push eax
push 4
call dword [edi]
add esp, 0x58
push 0x81f11181
push 0
push 4
push 0
push 0
push 0
push 4
push 0
mov dword [ebp - 0x11], esp
lea edx, [ebp - 0x24ac]
push edx
push dword [ebp - 0x11]
push 0xd
call dword [edi]
add esp, 0x20
push 0x1a5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x86
push 0x10f11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x3e8
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
cmp eax, 0xffffffff
jne 0x407c66
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x407cb2
test eax, eax
jne 0x407cb2
push 0
push 0xc
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
push 0x86
push 0x10f11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x3e8
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
push 0x86
push 0x10f11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x1388
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x407ce4
cmp eax, 0xffffffff
jne 0x407cf3
mov dword [ebp - 0x24b4], 1
jmp 0x407d9e
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x407d0c
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x50
je 0x407d9e
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407d80
xor eax, eax
jmp 0x407d8a
cmp eax, 0x20
jbe 0x407d8a
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x407e93
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x3ef11181
lea eax, [ebp - 0x24ac]
push esp
push 4
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x407de3
cmp eax, 0xffffffff
jne 0x407df2
mov dword [ebp - 0x24b4], 1
jmp 0x407e93
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x407e0b
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x7e
je 0x407e93
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407e75
xor eax, eax
jmp 0x407e7f
cmp eax, 0x20
jbe 0x407e7f
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x40802e
push 0x6e
push 0xa
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
push 0x13a
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x1000
push 0x35
push 0x8f11180
lea eax, [ebp - 0x24ac]
push esp
push 0xc
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x407ef5
cmp eax, 0xffffffff
jne 0x407f04
mov dword [ebp - 0x24b4], 1
jmp 0x40802e
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x407f1d
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x75
jne 0x407f41
mov dword [esi + 0x14], 0x100000
jmp 0x40802e
push 0x800
push 0x35
push 0x8f11180
lea eax, [ebp - 0x24ac]
push esp
push 0xc
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x407f75
cmp eax, 0xffffffff
jne 0x407f84
mov dword [ebp - 0x24b4], 1
jmp 0x40802e
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x407f9d
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x75
jne 0x407fbe
mov dword [esi + 0x14], 0x80000
jmp 0x40802e
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408010
xor eax, eax
jmp 0x40801a
cmp eax, 0x20
jbe 0x40801a
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x408232
mov dword [ebp - 0x1d], 0
mov dword [ebp - 0x19], 0
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x15], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x24], eax
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [ebp - 0x19]
cmp eax, dword [ebp - 0x15]
jae 0x408232
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x36
push 0x1f11180
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x4080c9
cmp eax, 0xffffffff
jne 0x4080d8
mov dword [ebp - 0x24b4], 1
jmp 0x408232
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x4080f1
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x76
je 0x40817e
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40815b
xor eax, eax
jmp 0x408165
cmp eax, 0x20
jbe 0x408165
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x408232
cmp dword [ebp - 0x1d], 0
jne 0x4081e0
mov eax, dword [ebp - 0x15]
mov ecx, dword [ebp - 0x1a7]
dec ecx
xor edx, edx
div ecx
test edx, edx
je 0x408197
inc eax
mov dword [ebp - 0x1d], eax
shl eax, 0x10
and eax, 0xffff0000
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
call fcn.0040a01a
dec dword [ebp - 0x1a7]
inc dword [ebp - 0x1ab]
mov eax, dword [ebp - 0x15]
sub eax, dword [ebp - 0x19]
cmp eax, dword [ebp - 0x1a7]
jbe 0x408205
mov eax, dword [ebp - 0x1a7]
mov ecx, dword [esi + 0x24]
add ecx, dword [ebp - 0x19]
mov edx, dword [ebp - 0x1ab]
push eax
lea edx, [ebp + edx - 0x24ac]
push edx
push ecx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov eax, dword [ebp - 0x1a7]
add dword [ebp - 0x19], eax
jmp 0x408086
cmp dword [ebp - 0x24b4], 0
jne 0x40832c
push 0xb4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x82
push 0x1f11180
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x40827c
cmp eax, 0xffffffff
jne 0x40828b
mov dword [ebp - 0x24b4], 1
jmp 0x40832c
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x4082a4
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0xc2
je 0x40832c
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40830e
xor eax, eax
jmp 0x408318
cmp eax, 0x20
jbe 0x408318
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x40835e
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
jmp 0x408367
lea edx, [esi + 0x24]
push edx
call fcn.0040a38d
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x4094fe
mov dword [ebp - 0x1284], 0
cmp dword [ebp - 0x24b4], 0
jne 0x408486
cmp dword [esi + 0x14], 0x80000
jne 0x4083eb
mov dword [ebp - 0xfce], 0
mov dword [ebp - 0xfca], 0x80000
mov dword [ebp - 0xfc6], pe_nt_image_headers32
mov dword [ebp - 0xfc2], 0
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
jmp 0x408486
cmp dword [esi + 0x14], 0x100000
jne 0x408446
mov dword [ebp - 0xfce], 0x20000
mov dword [ebp - 0xfca], 0x100000
mov dword [ebp - 0xfc6], pe_nt_image_headers32
mov dword [ebp - 0xfc2], 0
mov dword [ebp - 0xfbe], 0
mov dword [ebp - 0xfba], 0
mov dword [ebp - 0xfb6], 0
mov dword [ebp - 0xfb2], 0
jmp 0x408486
push 0xa
push 0xd245441
push 0x4d524f46
push 0x5f454c49
push 0x465f4d4f
push 0x525f4445
push 0x54524f50
push 0x5055534e
push 0x555f524f
push 0x52524524
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x408553
mov dword [ebp - 0xfee], 0
mov dword [ebp - 0xfea], 0
cmp dword [ebp - 0xfee], 0x20
jae 0x4084e7
imul ecx, dword [ebp - 0xfee], 0x10
mov eax, dword [ebp + ecx - 0xfca]
sub eax, dword [ebp + ecx - 0xfce]
test eax, eax
je 0x4084e7
mov ecx, dword [ebp + ecx - 0xfc6]
xor edx, edx
div ecx
test edx, edx
je 0x4084d9
inc eax
add dword [ebp - 0xfea], eax
inc dword [ebp - 0xfee]
jmp 0x4084a7
mov eax, dword [ebp - 0xfea]
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
cmp dword [ebp - 0x24b4], 0
jne 0x40866b
cmp dword [esi + 0x14], 0x100000
jne 0x40857f
push 0
push 0xc
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
push 0x85
push 0x10f11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x4085b1
cmp eax, 0xffffffff
jne 0x4085c0
mov dword [ebp - 0x24b4], 1
jmp 0x40866b
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x4085d9
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x50
je 0x40866b
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40864d
xor eax, eax
jmp 0x408657
cmp eax, 0x20
jbe 0x408657
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x40875d
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x3ef11181
lea eax, [ebp - 0x24ac]
push esp
push 4
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x4086ad
cmp eax, 0xffffffff
jne 0x4086bc
mov dword [ebp - 0x24b4], 1
jmp 0x40875d
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x4086d5
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x7e
je 0x40875d
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40873f
xor eax, eax
jmp 0x408749
cmp eax, 0x20
jbe 0x408749
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x408946
mov dword [ebp - 0x25c0], 0x20
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
push 0x27f11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x4087ab
cmp eax, 0xffffffff
jne 0x4087ba
mov dword [ebp - 0x24b4], 1
jmp 0x408946
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x4087d3
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x7f
jne 0x4088ca
cmp byte [ebp + ecx - 0x24aa], 0x36
jne 0x408812
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x25c0]
jne 0x40877c
jmp 0x408856
cmp byte [ebp + ecx - 0x24aa], 0x37
jne 0x408835
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x25c0]
jne 0x40877c
jmp 0x408856
cmp byte [ebp + ecx - 0x24aa], 0x22
jne 0x408856
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x25c0]
jne 0x40877c
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4088aa
xor eax, eax
jmp 0x4088b4
cmp eax, 0x20
jbe 0x4088b4
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x408946
cmp byte [ebp + ecx - 0x24ac], 0x67
je 0x408946
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408928
xor eax, eax
jmp 0x408932
cmp eax, 0x20
jbe 0x408932
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x408bcf
mov ecx, dword [ebp - 0x1ab]
cmp word [ebp + ecx - 0x24aa], 0
je 0x408bcf
push 0xe9de
push 0xd0cac9c2
push 0xbfb4b299
push 0x92848281
push 0x736c483e
push 0x281400b0
mov byte [ebp - 0x1280], 0x20
mov byte [ebp - 0x127f], 0xf4
mov eax, dword [ebp - 0x1284]
movzx eax, byte [esp + eax]
mov dword [ebp - 0x127e], eax
mov al, byte [ebp + ecx - 0x24aa]
mov byte [ebp - 0x127a], al
mov al, byte [ebp + ecx - 0x24a9]
mov byte [ebp - 0x1279], al
push 0x7d
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xfa
lea edx, [ebp - 0x26c6]
push edx
push 0xf6
lea edx, [ebp - 0x1280]
push edx
call dword [ebx + 0x40]
cmp eax, 2
je 0x408a24
push 0xa0d24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
mov dword [ebp - 0x24b4], 1
jmp 0x408bcc
push 2
push 0x27f11184
mov al, byte [ebp - 0x26c6]
mov byte [esp + 5], al
mov al, byte [ebp - 0x26c5]
mov byte [esp + 6], al
push esp
push 7
lea edx, [ebp - 0x24ac]
push edx
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
add esp, 8
test eax, eax
je 0x408a6a
cmp eax, 0xffffffff
jne 0x408a79
mov dword [ebp - 0x24b4], 1
jmp 0x408bcc
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x408a92
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x7f
jne 0x408b52
cmp byte [ebp + ecx - 0x24aa], 0x35
jne 0x408ae0
mov dword [ebp - 0x25c0], 0x20
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc dword [ebp - 0x1284]
cmp dword [ebp - 0x1284], 0x16
jl 0x40877c
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408b32
xor eax, eax
jmp 0x408b3c
cmp eax, 0x20
jbe 0x408b3c
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x408bcc
cmp byte [ebp + ecx - 0x24ac], 0x67
je 0x408bcc
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408bae
xor eax, eax
jmp 0x408bb8
cmp eax, 0x20
jbe 0x408bb8
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
add esp, 0x18
cmp dword [ebp - 0x24b4], 0
jne 0x408cc3
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0x83f11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x408c13
cmp eax, 0xffffffff
jne 0x408c22
mov dword [ebp - 0x24b4], 1
jmp 0x408cc3
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x408c3b
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0xc3
je 0x408cc3
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408ca5
xor eax, eax
jmp 0x408caf
cmp eax, 0x20
jbe 0x408caf
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x408dcd
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 3
push 0x83f11187
mov ecx, dword [ebp - 0x1ab]
mov eax, dword [ebp + ecx - 0x24aa]
mov dword [esp + 5], eax
push esp
push 0xa
lea edx, [ebp - 0x24ac]
push edx
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
add esp, 0xc
test eax, eax
je 0x408d1d
cmp eax, 0xffffffff
jne 0x408d2c
mov dword [ebp - 0x24b4], 1
jmp 0x408dcd
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x408d45
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0xc3
je 0x408dcd
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408daf
xor eax, eax
jmp 0x408db9
cmp eax, 0x20
jbe 0x408db9
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x4091f2
push 0x6e
push 0xa
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
push 0x1e
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0xfee], 0
cmp dword [ebp - 0xfee], 0x20
jae 0x4091f2
imul ecx, dword [ebp - 0xfee], 0x10
mov eax, dword [ebp + ecx - 0xfce]
mov dword [ebp - 0xfe6], eax
mov eax, dword [ebp + ecx - 0xfca]
mov dword [ebp - 0xfe2], eax
mov eax, dword [ebp + ecx - 0xfc6]
mov dword [ebp - 0xfde], eax
mov eax, dword [ebp + ecx - 0xfc2]
mov dword [ebp - 0xfda], eax
mov eax, dword [ebp - 0xfe2]
sub eax, dword [ebp - 0xfe6]
test eax, eax
je 0x4091f2
push 0xe
push 0
push 0x34f11188
mov eax, dword [ebp - 0xfe6]
add eax, dword [ebp - 0xfda]
mov byte [esp + 5], ah
mov byte [esp + 6], al
shr eax, 0x10
mov byte [esp + 4], al
mov eax, dword [ebp - 0xfe2]
sub eax, dword [ebp - 0xfe6]
mov byte [esp + 9], ah
mov byte [esp + 0xa], al
shr eax, 0x10
mov byte [esp + 8], al
push esp
push 0xb
lea edx, [ebp - 0x24ac]
push edx
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
add esp, 0xc
test eax, eax
je 0x408ec8
cmp eax, 0xffffffff
jne 0x408ed7
mov dword [ebp - 0x24b4], 1
jmp 0x408f78
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x408ef0
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x74
je 0x408f78
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408f5a
xor eax, eax
jmp 0x408f64
cmp eax, 0x20
jbe 0x408f64
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x4091f2
push 0x3c
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp - 0xfe6]
mov ecx, dword [ebp - 0xfe2]
cmp eax, ecx
jae 0x409102
sub ecx, eax
cmp ecx, dword [ebp - 0xfde]
jbe 0x408fb1
mov ecx, dword [ebp - 0xfde]
mov dword [ebp - 0xfd2], ecx
add eax, dword [ebp - 0xfda]
inc ecx
shl ecx, 0x18
or ecx, 0xf11180
mov dword [ebp - 0xdce], ecx
mov dword [ebp - 0xdca], 0x36
xor ecx, ecx
mov edx, dword [esi + 0x20]
add edx, dword [ebp - 0xfe6]
cmp ecx, dword [ebp - 0xfd2]
jae 0x408ff7
mov al, byte [edx + ecx]
mov byte [ebp + ecx - 0xdc9], al
inc ecx
jmp 0x408fe2
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, dword [ebp - 0xfd2]
lea edx, [ebp - 0xdce]
push edx
lea edx, [ecx + 5]
push edx
lea edx, [ebp - 0x24ac]
push edx
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x409035
cmp eax, 0xffffffff
jne 0x409044
mov dword [ebp - 0x24b4], 1
jmp 0x4090fd
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x40905d
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x76
je 0x4090e7
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4090c7
xor eax, eax
jmp 0x4090d1
cmp eax, 0x20
jbe 0x4090d1
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x4090fd
call fcn.0040a01a
mov eax, dword [ebp - 0xfd2]
add dword [ebp - 0xfe6], eax
jmp 0x408f8d
jmp 0x4091f2
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x37f11181
lea eax, [ebp - 0x24ac]
push esp
push 4
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x409137
cmp eax, 0xffffffff
jne 0x409146
mov dword [ebp - 0x24b4], 1
jmp 0x4091e7
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x40915f
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x77
je 0x4091e7
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4091c9
xor eax, eax
jmp 0x4091d3
cmp eax, 0x20
jbe 0x4091d3
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
inc dword [ebp - 0xfee]
jmp 0x408e02
cmp dword [ebp - 0x24b4], 0
jne 0x4092e6
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 2
push 0x31f11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x409236
cmp eax, 0xffffffff
jne 0x409245
mov dword [ebp - 0x24b4], 1
jmp 0x4092e6
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x40925e
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x71
je 0x4092e6
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4092c8
xor eax, eax
jmp 0x4092d2
cmp eax, 0x20
jbe 0x4092d2
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x4093da
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 3
push 0x31f11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x40932a
cmp eax, 0xffffffff
jne 0x409339
mov dword [ebp - 0x24b4], 1
jmp 0x4093da
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x409352
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x71
je 0x4093da
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4093bc
xor eax, eax
jmp 0x4093c6
cmp eax, 0x20
jbe 0x4093c6
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x4094ce
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
push 0x11f11182
lea eax, [ebp - 0x24ac]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x40941e
cmp eax, 0xffffffff
jne 0x40942d
mov dword [ebp - 0x24b4], 1
jmp 0x4094ce
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x409446
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x51
je 0x4094ce
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4094b0
xor eax, eax
jmp 0x4094ba
cmp eax, 0x20
jbe 0x4094ba
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
cmp dword [ebp - 0x24b4], 0
jne 0x4094fe
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x40971f
cmp dword [ebp - 0x24b4], 0
jne 0x40971f
push 0xff00
push 0x18f11184
lea eax, [ebp - 0x24ac]
push esp
push 7
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x40954c
cmp eax, 0xffffffff
jne 0x40955b
mov dword [ebp - 0x24b4], 1
jmp 0x40971f
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x409574
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x58
je 0x409601
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4095de
xor eax, eax
jmp 0x4095e8
cmp eax, 0x20
jbe 0x4095e8
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x40971f
movzx eax, byte [ebp + ecx - 0x24ab]
mov dword [ebp - 0x5bf], eax
push 0xa
push 0xd642520
push 0x3a24544e
push 0x554f435f
push 0x43544424
push dword [ebp - 0x5bf]
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
mov dword [ebp - 0x5bb], 0
mov ecx, dword [ebp - 0x5bb]
cmp ecx, dword [ebp - 0x5bf]
jae 0x40971f
imul ecx, ecx, 3
add ecx, dword [ebp - 0x1ab]
movzx eax, byte [ebp + ecx - 0x24a9]
mov dword [ebp - 9], eax
movzx eax, byte [ebp + ecx - 0x24a8]
mov dword [ebp - 5], eax
movzx eax, byte [ebp + ecx - 0x24aa]
mov dword [ebp - 0xd], eax
cmp eax, 0xc0
jb 0x4096d8
and eax, 0x3f
push 0xa
push 0xd295832
push 0x2e252858
push 0x322e2558
push 0x322e2555
push dword [ebp - 5]
push dword [ebp - 9]
push eax
lea eax, [esp + 0xc]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
jmp 0x409714
push 0xa
push 0xd295832
push 0x2e252858
push 0x322e2558
push 0x322e2550
push dword [ebp - 5]
push dword [ebp - 9]
push eax
lea eax, [esp + 0xc]
push eax
lea edx, [ebp - 0x29b4]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x29b4]
push edx
call dword [ebx + 0x30]
inc dword [ebp - 0x5bb]
jmp 0x409654
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x18
jne 0x409866
cmp dword [ebp - 0x24b4], 0
jne 0x409866
push 0
push 0xa0d2443
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0xff
push 0x14f11183
lea eax, [ebp - 0x24ac]
push esp
push 6
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a069
test eax, eax
je 0x40978f
cmp eax, 0xffffffff
jne 0x40979e
mov dword [ebp - 0x24b4], 1
jmp 0x409866
mov dword [ebp - 0x1ab], 3
cmp byte [ebp - 0x24ac], 0x80
jne 0x4097b7
inc dword [ebp - 0x1ab]
mov ecx, dword [ebp - 0x1ab]
sub eax, ecx
mov dword [ebp - 0x1a7], eax
cmp byte [ebp + ecx - 0x24ac], 0x54
je 0x409841
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x24ac]
mov edx, esp
cmp eax, 0xffffffff
jne 0x409821
xor eax, eax
jmp 0x40982b
cmp eax, 0x20
jbe 0x40982b
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040a25c
mov dword [ebp - 0x24b4], 1
jmp 0x409866
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
cmp dword [ebp - 0x24b4], 0
jne 0x40989c
push 0x82f11181
push esp
push 4
push 0x4e2
push 0
push 4
push 0
call fcn.0040a09d
lea edx, [ebp - 0x24ac]
push edx
push 0x3e8
push 6
push 0
call fcn.0040a20b
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0
mov eax, esp
push 0
push eax
push 2
call dword [edi]
add esp, 4
push 0
push 0
push 3
call dword [edi]
cmp dword [esi + 0x270], 0x75736924
jne 0x409977
cmp dword [esi + 0x274], 0x3037757a
jne 0x409977
cmp dword [esi + 0x278], 0x5424315f
jne 0x409977
cmp dword [esi + 0x27c], 0x736e6172
jne 0x409977
cmp dword [esi + 0x280], 0x6e6f7274
jne 0x409977
cmp dword [esi + 0x284], 0x3230315b
jne 0x409977
cmp dword [esi + 0x288], 0x35312f34
jne 0x409977
cmp dword [esi + 0x28c], 0x322f3633
jne 0x409977
cmp dword [esi + 0x290], 0x2f383430
jne 0x409977
cmp dword [esi + 0x294], 0x30363532
jne 0x409977
cmp dword [esi + 0x298], 0x38332f6b
jne 0x409977
cmp dword [esi + 0x29c], 0x5d6b3034
jne 0x409977
cmp dword [esi + 0x2a0], 0x4e414320
jne 0x409977
cmp byte [esi + 0x2a4], 0
je 0x409a23
cmp dword [esi + 0x270], 0x75736924
jne 0x409ab4
cmp dword [esi + 0x274], 0x3037757a
jne 0x409ab4
cmp dword [esi + 0x278], 0x5424325f
jne 0x409ab4
cmp dword [esi + 0x27c], 0x736e6172
jne 0x409ab4
cmp dword [esi + 0x280], 0x6e6f7274
jne 0x409ab4
cmp dword [esi + 0x284], 0x3231355b
jne 0x409ab4
cmp dword [esi + 0x288], 0x3230312f
jne 0x409ab4
cmp dword [esi + 0x28c], 0x205d6b34
jne 0x409ab4
cmp dword [esi + 0x290], 0x696c2d4b
jne 0x409ab4
cmp word [esi + 0x294], 0x656e
jne 0x409ab4
cmp byte [esi + 0x296], 0
jne 0x409ab4
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xd
jne 0x409ab4
push dword [esi + 0x14]
push dword [esi + 0x20]
call fcn.00409eba
test eax, eax
jne 0x409a63
push 0xa0d
push 0x2444494c
push 0x41565f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x14
jmp 0x409ab4
cmp eax, 1
jne 0x409a8f
push 0xa0d
push 0x24444554
push 0x43455252
push 0x4f435f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x409ab4
push 0xa0d
push 0x24444e55
push 0x4f465f54
push 0x4f4e5f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0
push 0
push 3
call dword [edi]
push 0
push esp
push 0x1000001
push 0x40b
push dword [ebx + 0x8e8]
call dword [sym.imp.USER32.DLL_SendMessageW]
add esp, 4
push 0
call dword [ebx + 0x44]
pop edi
leave
ret 8