Function at 0x40122e
Capabilities:
Create process on windows
Get keyboard layout
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2414
call fcn.0047a560
push esi
push edi
mov dword [ebp - 0x5c], 0xac204e2d
mov dword [ebp - 0x152c], 0x1ba028ea
mov dword [ebp - 0x1534], 0xfffffff7
mov dword [ebp - 0x153c], 1
mov dword [ebp - 0x1704], 0x188753e1
mov dword [ebp - 0x154c], 0xffffffff
mov dword [ebp - 0x1884], 6
mov dword [ebp - 0x5c], 0
jmp 0x401290
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x1b
jge 0x4012b9
mov byte [ebp - 0x195], 0
movzx eax, byte [ebp - 0x195]
test eax, eax
je 0x4012b7
push 0
push 0x16cf
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
jmp 0x401289
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], eax
je 0x4012cd
mov dword [ebp - 0xf90], 1
jmp 0x4012d4
and dword [ebp - 0xf90], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1e10], eax
mov eax, dword [ebp - 0xf90]
mov dword [ebp - 0x152c], eax
mov eax, dword [ebp - 0x152c]
mov dword [ebp - 0x1db8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1dc0], eax
mov dword [ebp - 0x1534], 0
mov eax, dword [ebp - 0x1534]
mov dword [ebp - 0x153c], eax
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x153c]
jge 0x40132f
mov dword [ebp - 0x1544], 1
jmp 0x401336
and dword [ebp - 0x1544], 0
mov eax, dword [ebp - 0x1544]
mov dword [ebp - 0x1704], eax
imul eax, dword [ebp - 0x5c], 0xfffd
mov dword [ebp - 0x154c], eax
mov eax, dword [ebp - 0x154c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1884], eax
mov dword [ebp - 0x68], 0xfffffffc
mov dword [ebp - 0x478], 0x65786371
mov dword [ebp - 0x6b0], 1
mov dword [ebp - 0x360], 5
mov dword [ebp - 0x5b8], 4
mov dword [ebp - 0x350], 0
jmp 0x4013a9
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 1
jge 0x4013c5
mov eax, dword [ebp - 0x350]
mov dword [ebp + eax*4 - 0x260], 0xc3099cf
jmp 0x40139c
mov byte [ebp - 0x251], 0
movzx eax, byte [ebp - 0x251]
test eax, eax
je 0x4013eb
push 0x1690
push 0
push 0
push 0x3d3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp dword [ebp - 0x68], 0
je 0x401476
cmp dword [ebp - 0x68], 0
jne 0x401413
mov eax, 0x917ab6da
test eax, eax
jne 0x401413
cmp dword [ebp - 0x68], 0
jne 0x401413
and dword [ebp - 0x1554], 0
jmp 0x40141d
mov dword [ebp - 0x1554], 1
imul eax, dword [ebp - 0x1554], 3
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x6b0]
add eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x68]
neg ecx
add ecx, eax
je 0x401458
xor eax, eax
je 0x401458
mov dword [ebp - 0x155c], 1
jmp 0x40145f
and dword [ebp - 0x155c], 0
mov eax, dword [ebp - 0x155c]
sub eax, 4
je 0x401476
mov dword [ebp - 0x1564], 1
jmp 0x40147d
and dword [ebp - 0x1564], 0
cmp dword [ebp - 0x1564], 0xe7ad53a3
je 0x401495
mov dword [ebp - 0x156c], 1
jmp 0x40149c
and dword [ebp - 0x156c], 0
mov eax, dword [ebp - 0x156c]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x68], eax
je 0x4014bf
mov dword [ebp - 0x1574], 1
jmp 0x4014c6
and dword [ebp - 0x1574], 0
cmp dword [ebp - 0x1574], 0x711db608
jne 0x4014e3
xor eax, eax
inc eax
je 0x4014e3
mov dword [ebp - 0x157c], 1
jmp 0x4014ea
and dword [ebp - 0x157c], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x157c], eax
jl 0x401501
mov dword [ebp - 0x15f4], 1
jmp 0x401508
and dword [ebp - 0x15f4], 0
cmp dword [ebp - 0x15f4], 0x95f7
jg 0x401520
mov dword [ebp - 0x760], 1
jmp 0x401527
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x15fc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x15fc]
mov dword [ebp + eax - 0x260], ecx
mov eax, dword [ebp - 0x15fc]
cmp eax, dword [ebp - 0x760]
jg 0x401700
mov dword [ebp - 0x1b8], 0x9b95520
mov dword [ebp - 0x5b0], 0x4b13b106
mov dword [ebp - 0x111c], 7
mov dword [ebp - 0x1894], 4
mov eax, 0xfffe
test eax, eax
je 0x401690
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
imul eax, dword [ebp - 0x1b8]
cmp eax, 8
jl 0x4015b5
mov dword [ebp - 0x1104], 1
jmp 0x4015bc
and dword [ebp - 0x1104], 0
mov eax, dword [ebp - 0x1b8]
cmp eax, dword [ebp - 0x1104]
jl 0x4015d6
mov dword [ebp - 0x768], 1
jmp 0x4015dd
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x5b0], eax
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x5b0], eax
jne 0x401603
mov dword [ebp - 0x110c], 1
jmp 0x40160a
and dword [ebp - 0x110c], 0
cmp dword [ebp - 0x110c], 0xffffffff
jne 0x40161f
mov dword [ebp - 0x770], 1
jmp 0x401626
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x1b8]
cmp eax, dword [ebp - 0x770]
jl 0x401640
mov dword [ebp - 0x1114], 1
jmp 0x401647
and dword [ebp - 0x1114], 0
cmp dword [ebp - 0x1114], 9
jne 0x40165c
mov dword [ebp - 0x188c], 1
jmp 0x401663
and dword [ebp - 0x188c], 0
mov eax, dword [ebp - 0x111c]
mov dword [ebp - 0x1dc8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1894]
cmp dword [ebp + eax - 0x260], ecx
jl 0x401690
mov dword [ebp - 0x778], 1
jmp 0x401697
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
sub eax, dword [ebp - 0x111c]
cmp eax, dword [ebp - 0x5b8]
jle 0x4016b7
mov dword [ebp - 0x780], 1
jmp 0x4016be
and dword [ebp - 0x780], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
cmp eax, dword [ebp - 0x780]
jl 0x4016e8
cmp dword [ebp - 0x5b0], 0
je 0x4016e8
mov dword [ebp - 0x1124], 1
jmp 0x4016ef
and dword [ebp - 0x1124], 0
mov eax, dword [ebp - 0x1124]
mov dword [ebp - 0x360], eax
jmp 0x4018da
mov dword [ebp - 0x90], 0xbbb30732
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x6b0], eax
jge 0x401724
mov dword [ebp - 0x790], 1
jmp 0x40172b
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x478], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
cmp eax, dword [ebp - 0x478]
jge 0x401758
mov dword [ebp - 0x788], 1
jmp 0x40175f
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x788], eax
jne 0x401779
mov dword [ebp - 0x112c], 1
jmp 0x401780
and dword [ebp - 0x112c], 0
mov eax, dword [ebp - 0x112c]
neg eax
mov dword [ebp - 0x1134], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1134]
mov dword [ebp + eax - 0x260], ecx
mov eax, dword [ebp - 0x790]
cmp eax, dword [ebp - 0x1134]
jl 0x4017bb
mov dword [ebp - 0x189c], 1
jmp 0x4017c2
and dword [ebp - 0x189c], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1dd0], eax
cmp dword [ebp - 0x90], 0
je 0x4017ec
mov eax, 0x75d7b1e
test eax, eax
je 0x4017ec
mov dword [ebp - 0x798], 1
jmp 0x4017f3
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x798], eax
jne 0x40180d
mov dword [ebp - 0x113c], 1
jmp 0x401814
and dword [ebp - 0x113c], 0
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x113c], eax
jg 0x40182e
mov dword [ebp - 0x7a0], 1
jmp 0x401835
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x5b8], eax
mov eax, 0xadc7
imul eax, eax, 0x270
test eax, eax
jle 0x40185c
mov dword [ebp - 0x1144], 1
jmp 0x401863
and dword [ebp - 0x1144], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x1144], eax
jg 0x40187d
mov dword [ebp - 0x7a8], 1
jmp 0x401884
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x90], 0x19
jmp 0x4018a9
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffffb
jge 0x4018da
mov dword [ebp - 0x68], 0
jmp 0x4018c2
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x4018d8
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x260], 6
jmp 0x4018bb
jmp 0x40189c
mov dword [ebp - 0x60], 0xac204e2d
push 2
lea ecx, [ebp - 0x158c]
call fcn.0041796c
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x508], 0xffffffff
mov dword [ebp - 0x1164], 1
mov dword [ebp - 0x18bc], 0x68da
push 1
lea ecx, [ebp - 0x1ccc]
call fcn.0041796c
mov dword [ebp - 0xbc], 0
jmp 0x40193c
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x40195e
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x158c]
call fcn.00417a5a
mov dword [eax], 0xfffffffe
jmp 0x40192f
mov dword [ebp - 0xbc], 0
jmp 0x401977
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x401999
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x1ccc]
call fcn.00417a5a
mov dword [eax], 3
jmp 0x40196a
mov dword [ebp - 0x8c], 0
jmp 0x4019b2
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jg 0x401c49
mov dword [ebp - 0x1c04], 1
mov dword [ebp - 0x1c00], 1
mov dword [ebp - 0x1bfc], 1
mov dword [ebp - 0x1bf8], 1
lea ecx, [ebp - 0x6a1]
call fcn.00417a69
push eax
lea eax, [ebp - 0x1bf4]
push eax
lea eax, [ebp - 0x1c04]
push eax
lea ecx, [ebp - 0x2374]
call fcn.00417a6c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2100]
call fcn.00417a18
mov dword [ebp - 0x18b4], 0xea5d
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x158c]
call fcn.00417a5a
cmp dword [eax], 0x7ab6dad8
je 0x401a4b
mov dword [ebp - 0x114c], 1
jmp 0x401a52
and dword [ebp - 0x114c], 0
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x158c]
call fcn.00417a5a
mov eax, dword [eax]
add eax, 0xfffd
cmp eax, dword [ebp - 0x114c]
jne 0x401a7e
mov dword [ebp - 0x7b0], 1
jmp 0x401a85
and dword [ebp - 0x7b0], 0
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x158c]
call fcn.00417a5a
mov esi, eax
mov edi, dword [ebp - 0x7b0]
add edi, 4
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x158c]
call fcn.00417a5a
imul edi, dword [eax]
cmp dword [esi], edi
jge 0x401ac5
mov dword [ebp - 0x1154], 1
jmp 0x401acc
and dword [ebp - 0x1154], 0
mov eax, dword [ebp - 0x1154]
mov dword [ebp - 0x508], eax
mov esi, dword [ebp - 0x508]
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x158c]
call fcn.00417a5a
cmp dword [eax], esi
jne 0x401aff
mov dword [ebp - 0x7b8], 1
jmp 0x401b06
and dword [ebp - 0x7b8], 0
cmp dword [ebp - 0x7b8], 0x9e3d3b0c
ja 0x401b1e
mov dword [ebp - 0x115c], 1
jmp 0x401b25
and dword [ebp - 0x115c], 0
cmp dword [ebp - 0x115c], 0x5d76270
jle 0x401b3d
mov dword [ebp - 0x7c0], 1
jmp 0x401b44
and dword [ebp - 0x7c0], 0
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x158c]
call fcn.00417a5a
mov ecx, dword [ebp - 0x7c0]
add ecx, dword [eax]
mov dword [ebp - 0x1164], ecx
mov eax, dword [ebp - 0x1164]
mov dword [ebp - 0x7c8], eax
push 0
lea ecx, [ebp - 0x2100]
call fcn.00417a5a
mov ecx, dword [ebp - 0x7c8]
mov dword [eax], ecx
cmp dword [ebp - 0x7c8], 0x3dec995f
jne 0x401b9c
mov dword [ebp - 0x18a4], 1
jmp 0x401ba3
and dword [ebp - 0x18a4], 0
imul eax, dword [ebp - 0x8c], 0x2d5f
test eax, eax
jne 0x401bc3
cmp dword [ebp - 0x508], 0
jne 0x401bc3
and dword [ebp - 0x18ac], 0
jmp 0x401bcd
mov dword [ebp - 0x18ac], 1
mov eax, dword [ebp - 0x18b4]
mov dword [ebp - 0x1dd8], eax
cmp dword [ebp - 0x18bc], 0
jne 0x401bf4
cmp dword [ebp - 0x508], 0
jne 0x401bf4
and dword [ebp - 0x116c], 0
jmp 0x401bfe
mov dword [ebp - 0x116c], 1
push 0
lea ecx, [ebp - 0x1ccc]
call fcn.00417a5a
mov ecx, dword [ebp - 0x116c]
mov dword [eax], ecx
mov byte [ebp - 0x1f1], 0
movzx eax, byte [ebp - 0x1f1]
test eax, eax
je 0x401c39
push 0
push 0x20bd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
lea ecx, [ebp - 0x2100]
call fcn.00417a3e
jmp 0x4019a5
lea ecx, [ebp - 0x1ccc]
call fcn.00417a3e
lea ecx, [ebp - 0x158c]
call fcn.00417a3e
mov dword [ebp - 0x1314], 0x1ba028ea
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x2bc], 0xece3051e
mov dword [ebp - 0x480], 0xfffffffd
mov dword [ebp - 0x18e0], 0x1521fafb
mov dword [ebp - 0x368], 0
jmp 0x401caa
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 2
jge 0x401cc6
mov eax, dword [ebp - 0x368]
mov dword [ebp + eax*4 - 0x23dc], 6
jmp 0x401c9d
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
jne 0x401d43
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x1de0], eax
cmp dword [ebp - 0x94], 0x6178
jle 0x401cff
mov dword [ebp - 0x7d0], 1
jmp 0x401d06
and dword [ebp - 0x7d0], 0
cmp dword [ebp - 0x7d0], 0xc299e885
ja 0x401d1e
mov dword [ebp - 0x1174], 1
jmp 0x401d25
and dword [ebp - 0x1174], 0
mov eax, dword [ebp - 0x1174]
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
jne 0x401d43
and dword [ebp - 0x7d8], 0
jmp 0x401d4d
mov dword [ebp - 0x7d8], 1
mov eax, dword [ebp - 0x7d8]
sub eax, dword [ebp - 0x94]
je 0x401d70
cmp dword [ebp - 0x480], 0
je 0x401d70
mov dword [ebp - 0x117c], 1
jmp 0x401d77
and dword [ebp - 0x117c], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x117c]
je 0x401d91
mov dword [ebp - 0x7e0], 1
jmp 0x401d98
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x480]
cmp dword [ebp - 0x7e0], eax
je 0x401dbb
cmp dword [ebp - 0x94], 0
je 0x401dbb
mov dword [ebp - 0x18c4], 1
jmp 0x401dc2
and dword [ebp - 0x18c4], 0
mov eax, 0xdb84c6a3
cmp eax, 0x869b7d6b
ja 0x401dda
mov dword [ebp - 0x1184], 1
jmp 0x401de1
and dword [ebp - 0x1184], 0
mov eax, dword [ebp - 0x480]
cmp dword [ebp - 0x1184], eax
jg 0x401dfb
mov dword [ebp - 0x7e8], 1
jmp 0x401e02
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xffff
jbe 0x401e26
mov dword [ebp - 0x118c], 1
jmp 0x401e2d
and dword [ebp - 0x118c], 0
cmp dword [ebp - 0x118c], 1
jne 0x401e42
mov dword [ebp - 0x7f0], 1
jmp 0x401e49
and dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 5
jae 0x401e5e
mov dword [ebp - 0x18cc], 1
jmp 0x401e65
and dword [ebp - 0x18cc], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x18e0], eax
mov dword [ebp - 0x94], 0
jmp 0x401e8a
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jg 0x401ec7
mov byte [ebp - 0x257], 0
movzx eax, byte [ebp - 0x257]
test eax, eax
je 0x401ec5
push 0
push 0x1147
push 0x134d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
jmp 0x401e7d
mov dword [ebp - 0x978], 0xfffffff7
mov dword [ebp - 0x11cc], 3
mov dword [ebp - 0x5c8], 0xbe7e5505
mov dword [ebp - 0x660], 1
mov dword [ebp - 0x268], 0xbab59342
mov dword [ebp - 0x1de8], 0xffffffff
mov dword [ebp - 0x810], 0xfffffff9
mov dword [ebp - 0x5c0], 4
mov dword [ebp - 0x18e8], 0xf9020c5a
mov dword [ebp - 0x18f0], 0xc0d6813f
mov dword [ebp - 0x11c4], 0xfffffffb
mov dword [ebp - 0x370], 0
jmp 0x401f4e
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 2
jge 0x401f6a
mov eax, dword [ebp - 0x370]
mov dword [ebp + eax*4 - 0x358], 9
jmp 0x401f41
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x358]
neg eax
jne 0x401fe3
cmp dword [ebp - 0x660], 0
je 0x401f95
or eax, 0xffffffff
je 0x401f95
mov dword [ebp - 0x1194], 1
jmp 0x401f9c
and dword [ebp - 0x1194], 0
mov eax, dword [ebp - 0x1194]
sub eax, dword [ebp - 0x268]
neg eax
imul eax, dword [ebp - 0x11cc]
cmp eax, dword [ebp - 0x268]
je 0x401fc5
mov dword [ebp - 0x7f8], 1
jmp 0x401fcc
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x7f8]
sub eax, dword [ebp - 0x268]
jne 0x401fe3
and dword [ebp - 0x119c], 0
jmp 0x401fed
mov dword [ebp - 0x119c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x358]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x358]
imul ecx, dword [ebp - 0x119c]
add ecx, dword [ebp - 0x5c8]
imul eax, ecx
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0x660]
mov dword [ebp - 0x268], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x358]
cmp eax, dword [ebp - 0x268]
jge 0x40204a
mov dword [ebp - 0x800], 1
jmp 0x402051
and dword [ebp - 0x800], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x358]
cmp dword [ebp - 0x800], eax
jl 0x40207f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x358], 0
jne 0x40207f
and dword [ebp - 0x11a4], 0
jmp 0x402089
mov dword [ebp - 0x11a4], 1
mov eax, dword [ebp - 0x5c8]
cmp eax, dword [ebp - 0x11a4]
jle 0x4020a3
mov dword [ebp - 0x808], 1
jmp 0x4020aa
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x5c0]
mov ecx, dword [ebp - 0x808]
mov edx, dword [ebp - 0x5c0]
inc edx
mov dword [ebp - 0x5c0], edx
cmp eax, ecx
jg 0x4020e9
cmp dword [ebp - 0x810], 0
jne 0x4020e9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x358], 0
jne 0x4020e9
and dword [ebp - 0x11ac], 0
jmp 0x4020f3
mov dword [ebp - 0x11ac], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x358]
cmp dword [ebp - 0x11ac], eax
jne 0x4022ff
mov dword [ebp - 0x11b4], 0xc3cb8784
mov dword [ebp - 0x2a8], 0x29123eba
mov dword [ebp - 0x550], 0
jmp 0x402139
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 1
jge 0x402155
mov eax, dword [ebp - 0x550]
mov dword [ebp + eax*4 - 0x668], 0
jmp 0x40212c
mov eax, dword [ebp - 0x810]
sub eax, dword [ebp - 0x18e8]
cmp eax, dword [ebp - 0x268]
jg 0x402175
mov dword [ebp - 0x818], 1
jmp 0x40217c
and dword [ebp - 0x818], 0
mov dword [ebp - 0x11b4], 0xc66b3191
mov eax, dword [ebp - 0x18f0]
cmp dword [ebp - 0x11b4], eax
jl 0x4021a0
mov dword [ebp - 0x11bc], 1
jmp 0x4021a7
and dword [ebp - 0x11bc], 0
mov eax, dword [ebp - 0x818]
cmp eax, dword [ebp - 0x11bc]
jg 0x4021c1
mov dword [ebp - 0x820], 1
jmp 0x4021c8
and dword [ebp - 0x820], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x668]
cmp dword [ebp - 0x820], eax
jne 0x4021e9
mov dword [ebp - 0x6b4], 1
jmp 0x4021f0
and dword [ebp - 0x6b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6b4]
mov dword [ebp + eax - 0x668], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6b4]
mov dword [ebp + eax - 0x358], ecx
mov dword [ebp - 0x5c8], 0x1ba8
mov dword [ebp - 0x11c4], 1
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x11c4], eax
jg 0x402244
mov dword [ebp - 0x828], 1
jmp 0x40224b
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x828], eax
jl 0x402265
mov dword [ebp - 0x18f8], 1
jmp 0x40226c
and dword [ebp - 0x18f8], 0
mov eax, dword [ebp - 0x11cc]
mov dword [ebp - 0x1df0], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x1df8], eax
cmp dword [ebp - 0x2a8], 0x72090f9c
jne 0x40229c
mov dword [ebp - 0x830], 1
jmp 0x4022a3
and dword [ebp - 0x830], 0
cmp dword [ebp - 0x830], 0
jg 0x4022b8
mov dword [ebp - 0x11d4], 1
jmp 0x4022bf
and dword [ebp - 0x11d4], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x11d4], eax
jge 0x4022d9
mov dword [ebp - 0x838], 1
jmp 0x4022e0
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x2a8], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x668], 0xb8492355
jmp 0x402326
mov byte [ebp - 0x1f9], 0
movzx eax, byte [ebp - 0x1f9]
test eax, eax
je 0x402326
push 0xf20
push 0x2356
push 0x1fd
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x131c], 1
mov dword [ebp - 0x1c0], 2
mov dword [ebp - 0x270], 0xd72d7671
mov dword [ebp - 0x380], 0xfffffffa
push 1
lea ecx, [ebp - 0x1ad4]
call fcn.0041796c
mov dword [ebp - 0x31c], 0xfffffffc
mov dword [ebp - 0xd0], 0
jmp 0x40237e
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x40239a
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x1688], 1
jmp 0x402371
mov dword [ebp - 0xd0], 0
jmp 0x4023b3
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jge 0x4023d5
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x1ad4]
call fcn.00417a5a
mov dword [eax], 1
jmp 0x4023a6
mov dword [ebp - 0x1c0], 1
jmp 0x4023ee
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jl 0x40257a
mov dword [ebp - 0x378], 0x4f402e31
mov dword [ebp - 0x1e00], 0xf7e7308
and dword [ebp - 0x1bc8], 0
and dword [ebp - 0x1bc4], 0
and dword [ebp - 0x1bc0], 0
and dword [ebp - 0x1bbc], 0
lea ecx, [ebp - 0x655]
call fcn.00417a69
push eax
lea eax, [ebp - 0x1bb8]
push eax
lea eax, [ebp - 0x1bc8]
push eax
lea ecx, [ebp - 0x23c4]
call fcn.00417a6c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2110]
call fcn.00417a18
mov dword [ebp - 0x378], 0
jmp 0x402479
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 1
jg 0x40254d
mov dword [ebp - 0x1e60], 0xbedcc590
mov dword [ebp - 0x1e68], 7
mov dword [ebp - 0x1e70], 0x889a278c
push 3
lea ecx, [ebp - 0x1d14]
call fcn.0041796c
mov dword [ebp - 0x488], 0
jmp 0x4024ca
mov eax, dword [ebp - 0x488]
inc eax
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 3
jge 0x4024ec
push dword [ebp - 0x488]
lea ecx, [ebp - 0x1d14]
call fcn.00417a5a
mov dword [eax], 0x189f42c6
jmp 0x4024bd
mov byte [ebp - 0x253], 0
movzx eax, byte [ebp - 0x253]
test eax, eax
je 0x402519
push 0
push 0xe86
push 0x1e55
push 0x1e2d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
lea ecx, [ebp - 0x1d14]
call fcn.00417a5a
mov dword [ebp - 0x11dc], eax
mov eax, dword [ebp - 0x11dc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x11dc]
mov dword [ecx], eax
lea ecx, [ebp - 0x1d14]
call fcn.00417a3e
jmp 0x40246c
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp + eax*4 - 0x1688], 0
je 0x40256a
lea ecx, [ebp - 0x2110]
call fcn.00417a3e
jmp 0x40257a
lea ecx, [ebp - 0x2110]
call fcn.00417a3e
jmp 0x4023e1
mov dword [ebp - 0x270], 1
jmp 0x402593
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jl 0x4027fc
mov dword [ebp - 0x2c4], 0x89ced66e
mov dword [ebp - 0x380], 1
jmp 0x4025c3
mov eax, dword [ebp - 0x380]
dec eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0
jl 0x4026cf
mov byte [ebp - 0x201], 0
movzx eax, byte [ebp - 0x201]
test eax, eax
je 0x4025ea
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [ebp - 0x270]
cmp dword [ebp + eax*4 - 0x1688], 0
je 0x40269b
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x270]
mov ecx, dword [ebp + ecx*4 - 0x1688]
cmp dword [ebp + eax - 0x1688], ecx
jl 0x402626
mov dword [ebp - 0x840], 1
jmp 0x40262d
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x840]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
neg eax
jne 0x40264a
cmp dword [ebp - 0x2c4], 0
push 0
lea ecx, [ebp - 0x1ad4]
call fcn.00417a5a
cmp dword [eax], 0
je 0x40267a
push 0
lea ecx, [ebp - 0x1ad4]
call fcn.00417a5a
cmp dword [eax], 0
je 0x40267a
mov dword [ebp - 0x11e4], 1
jmp 0x402681
and dword [ebp - 0x11e4], 0
imul eax, dword [ebp - 0x11e4], 0x7304
test eax, eax
je 0x40269b
mov dword [ebp - 0x848], 1
jmp 0x4026a2
and dword [ebp - 0x848], 0
cmp dword [ebp - 0x848], 0xfffffff7
jne 0x4026b7
mov dword [ebp - 0x11ec], 1
jmp 0x4026be
and dword [ebp - 0x11ec], 0
mov eax, dword [ebp - 0x11ec]
mov dword [ebp - 0x31c], eax
jmp 0x4025b6
mov dword [ebp - 0x31c], 0
jmp 0x4026e8
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x18
jl 0x4027f7
mov dword [ebp - 0x510], 1
mov dword [ebp - 0x1910], 1
mov dword [ebp - 0x858], 0xffffffff
cmp dword [ebp - 0x510], 0
jne 0x40272e
mov eax, 0x3337672a
test eax, eax
jne 0x40272e
and dword [ebp - 0x1900], 0
jmp 0x402738
mov dword [ebp - 0x1900], 1
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x1e78], eax
mov eax, dword [ebp - 0x510]
cmp dword [ebp - 0x510], eax
jge 0x40275e
mov dword [ebp - 0x850], 1
jmp 0x402765
and dword [ebp - 0x850], 0
cmp dword [ebp - 0x850], 0xffffffff
jne 0x402780
cmp dword [ebp - 0x510], 0
jne 0x402780
and dword [ebp - 0x11f4], 0
jmp 0x40278a
mov dword [ebp - 0x11f4], 1
cmp dword [ebp - 0x11f4], 0xa5563b4b
jle 0x4027a2
mov dword [ebp - 0x1908], 1
jmp 0x4027a9
and dword [ebp - 0x1908], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x1e80], eax
mov eax, dword [ebp - 0x1910]
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x858], 0
jne 0x4027dc
cmp dword [ebp - 0x2c4], 0
jne 0x4027dc
and dword [ebp - 0x11fc], 0
jmp 0x4027e6
mov dword [ebp - 0x11fc], 1
mov eax, dword [ebp - 0x11fc]
mov dword [ebp - 0x2c4], eax
jmp 0x4026db
jmp 0x402586
lea ecx, [ebp - 0x1ad4]
call fcn.00417a3e
mov dword [ebp - 0x1950], 0x188753e1
mov dword [ebp - 0x1324], 0xffffffff
mov dword [ebp - 0x1958], 6
push 2
lea ecx, [ebp - 0x2fc]
call fcn.0041796c
mov dword [ebp - 0xac], 0x193e0566
mov dword [ebp - 0x304], 0xffffffff
mov dword [ebp - 0x1d8], 0xfffffffc
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x888], 0xe91cb64b
mov dword [ebp - 0x5d0], 0x121a
mov dword [ebp - 0x1274], 0xb4f12b15
mov dword [ebp - 0x388], 0
jmp 0x402891
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 2
jge 0x4028b3
push dword [ebp - 0x388]
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
mov dword [eax], 0x849f845d
jmp 0x402884
push 0
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
cmp dword [eax], 0xe048
jle 0x40292f
push 0
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
mov esi, eax
push 0
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x402908
push 1
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
cmp dword [eax], 0
je 0x402908
mov dword [ebp - 0x860], 1
jmp 0x40290f
and dword [ebp - 0x860], 0
push 0
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x860]
je 0x40292f
and dword [ebp - 0x1204], 0
jmp 0x402939
mov dword [ebp - 0x1204], 1
mov eax, dword [ebp - 0x1204]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jne 0x402969
push 1
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
cmp dword [eax], 0
jne 0x402969
and dword [ebp - 0x868], 0
jmp 0x402973
mov dword [ebp - 0x868], 1
cmp dword [ebp - 0x868], 0xb0f7
jne 0x40298b
mov dword [ebp - 0x120c], 1
jmp 0x402992
and dword [ebp - 0x120c], 0
mov eax, dword [ebp - 0x120c]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1e88], eax
cmp dword [ebp - 0x304], 0xfffb
ja 0x4029c2
mov dword [ebp - 0x870], 1
jmp 0x4029c9
and dword [ebp - 0x870], 0
push 1
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
mov ecx, dword [ebp - 0x870]
cmp ecx, dword [eax]
jne 0x4029ec
mov dword [ebp - 0x1214], 1
jmp 0x4029f3
and dword [ebp - 0x1214], 0
mov eax, dword [ebp - 0x1214]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1d0], eax
mov esi, dword [ebp - 0x1d0]
push 0
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
cmp esi, dword [eax]
jl 0x402a2e
mov dword [ebp - 0x878], 1
jmp 0x402a35
and dword [ebp - 0x878], 0
cmp dword [ebp - 0x878], 0xea5d840d
jbe 0x402a4d
mov dword [ebp - 0x121c], 1
jmp 0x402a54
and dword [ebp - 0x121c], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
imul eax, dword [ebp - 0x121c]
test eax, eax
je 0x402a8f
push 0
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
cmp dword [eax], 0
je 0x402a8f
mov dword [ebp - 0x880], 1
jmp 0x402a96
and dword [ebp - 0x880], 0
push 0
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
mov ecx, dword [ebp - 0x880]
add ecx, dword [eax]
cmp ecx, 1
jae 0x402abc
mov dword [ebp - 0x1224], 1
jmp 0x402ac3
and dword [ebp - 0x1224], 0
mov eax, dword [ebp - 0x888]
cmp dword [ebp - 0x1224], eax
jne 0x402ae4
push 6
pop eax
test eax, eax
je 0x402ae4
mov dword [ebp - 0x1918], 1
jmp 0x402aeb
and dword [ebp - 0x1918], 0
mov eax, dword [ebp - 0x304]
sub eax, dword [ebp - 0x888]
je 0x402b0e
cmp dword [ebp - 0x1d0], 0
je 0x402b0e
mov dword [ebp - 0x122c], 1
jmp 0x402b15
and dword [ebp - 0x122c], 0
cmp dword [ebp - 0x122c], 0xc010
jl 0x402b2d
mov dword [ebp - 0x890], 1
jmp 0x402b34
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x304]
cmp dword [ebp - 0x890], eax
jg 0x402b4e
mov dword [ebp - 0x1234], 1
jmp 0x402b55
and dword [ebp - 0x1234], 0
cmp dword [ebp - 0x1234], 0xfffffffb
ja 0x402dca
mov dword [ebp - 0x290], 0xc0c7
mov dword [ebp - 0x8a8], 1
mov dword [ebp - 0x1d60], 0xffffffff
mov dword [ebp - 0x1d5c], 0xffffffff
mov dword [ebp - 0x1d58], 0xffffffff
mov dword [ebp - 0x1d54], 0xffffffff
mov dword [ebp - 0x1928], 0xfffffffc
mov dword [ebp - 0x490], 0
jmp 0x402bc1
mov eax, dword [ebp - 0x490]
inc eax
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 4
jge 0x402bdd
mov eax, dword [ebp - 0x490]
mov dword [ebp + eax*4 - 0x22c8], 0xd1f73e70
jmp 0x402bb4
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jne 0x402c04
cmp dword [ebp - 0x290], 0
jne 0x402c04
and dword [ebp - 0x898], 0
jmp 0x402c0e
mov dword [ebp - 0x898], 1
cmp dword [ebp - 0x898], 0xe972f33b
jae 0x402c26
mov dword [ebp - 0x123c], 1
jmp 0x402c2d
and dword [ebp - 0x123c], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x123c], eax
jle 0x402c42
cmp dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x8a0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8a0]
mov dword [ebp + eax - 0x22c8], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x8a0]
mov dword [ebp + eax - 0x1d60], ecx
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1e90], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x22c8], 0x732bab2
jle 0x402c9e
mov dword [ebp - 0x1920], 1
jmp 0x402ca5
and dword [ebp - 0x1920], 0
push 0
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
push 0
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
cmp dword [eax], 0xffffffff
je 0x402cd0
mov dword [ebp - 0x1244], 1
jmp 0x402cd7
and dword [ebp - 0x1244], 0
mov esi, 0x707d8eb7
sub esi, dword [ebp - 0x1244]
push 1
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
add esi, dword [eax]
cmp esi, dword [ebp - 0x8a8]
jne 0x402d05
mov dword [ebp - 0x124c], 1
jmp 0x402d0c
and dword [ebp - 0x124c], 0
cmp dword [ebp - 0x124c], 0x161dbfa2
jle 0x402d24
mov dword [ebp - 0x8b0], 1
jmp 0x402d2b
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x1e98], eax
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x1ea0], eax
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1ea8], eax
cmp dword [ebp - 0x304], 0
je 0x402d79
cmp dword [ebp - 0xac], 0
je 0x402d79
mov dword [ebp - 0x1254], 1
jmp 0x402d80
and dword [ebp - 0x1254], 0
mov eax, dword [ebp - 0x1254]
neg eax
mov dword [ebp - 0x1928], eax
mov byte [ebp - 0x24a], 0
movzx eax, byte [ebp - 0x24a]
test eax, eax
je 0x402dc5
push 0x34
push 0x196d
push 0xb24
push 0x1963
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
jmp 0x402fed
mov dword [ebp - 0x1c8], 0xa880e1b4
mov dword [ebp - 0x8b8], 0xfffffff7
mov dword [ebp - 0x125c], 9
mov dword [ebp - 0x6cc], 0x7a74
mov dword [ebp - 0x1930], 1
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1eb0], eax
push 0
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
mov eax, dword [eax]
mov dword [ebp - 0x8b8], eax
cmp dword [ebp - 0x8b8], 0
je 0x402e48
cmp dword [ebp - 0x1c8], 0
je 0x402e48
mov dword [ebp - 0x8d8], 1
jmp 0x402e4f
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x5d0]
dec eax
mov dword [ebp - 0x5d0], eax
jne 0x402e8d
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x125c], eax
mov esi, dword [ebp - 0x125c]
push 1
lea ecx, [ebp - 0x2fc]
call fcn.00417a5a
cmp dword [eax], esi
jg 0x402e8d
mov dword [ebp - 0x8c0], 1
jmp 0x402e94
and dword [ebp - 0x8c0], 0
cmp dword [ebp - 0x8c0], 3
jle 0x402ea9
mov dword [ebp - 0x1264], 1
jmp 0x402eb0
and dword [ebp - 0x1264], 0
cmp dword [ebp - 0x1264], 0
jne 0x402ec5
mov dword [ebp - 0x8c8], 1
jmp 0x402ecc
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x8c8], eax
jle 0x402ee6
mov dword [ebp - 0x126c], 1
jmp 0x402eed
and dword [ebp - 0x126c], 0
mov eax, dword [ebp - 0x6cc]
cmp dword [ebp - 0x126c], eax
jl 0x402f10
cmp dword [ebp - 0x6cc], 0
je 0x402f10
mov dword [ebp - 0x8d0], 1
jmp 0x402f17
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x1274], eax
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x1274], eax
jg 0x402f3d
mov dword [ebp - 0x127c], 1
jmp 0x402f44
and dword [ebp - 0x127c], 0
mov eax, dword [ebp - 0x8d8]
imul eax, dword [ebp - 0x127c]
add eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1d0]
imul eax, dword [ebp - 0xac]
test eax, eax
je 0x402f8c
cmp dword [ebp - 0x1c8], 0
je 0x402f8c
cmp dword [ebp - 0x1d0], 0
je 0x402f8c
mov dword [ebp - 0x8e0], 1
jmp 0x402f93
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0x8f1b1e9
jne 0x402fb7
mov dword [ebp - 0x1284], 1
jmp 0x402fbe
and dword [ebp - 0x1284], 0
cmp dword [ebp - 0x1284], 0
jne 0x402fd7
push 7
pop eax
test eax, eax
jne 0x402fd7
and dword [ebp - 0x8e8], 0
jmp 0x402fe1
mov dword [ebp - 0x8e8], 1
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0x1930], eax
lea ecx, [ebp - 0x2fc]
call fcn.00417a3e
mov dword [ebp - 0x60], 0
jmp 0x403008
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x1b
jge 0x4036c3
mov dword [ebp - 0x590], 0xffffffff
mov dword [ebp - 0x390], 0
jmp 0x403035
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 2
jge 0x403051
mov eax, dword [ebp - 0x390]
mov dword [ebp + eax*4 - 0x23bc], 1
jmp 0x403028
mov dword [ebp - 0x590], 1
jmp 0x40306a
mov eax, dword [ebp - 0x590]
dec eax
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 0
jl 0x4030c4
mov dword [ebp - 0x128c], 0x210b999f
mov byte [ebp - 0x18e], 0
movzx eax, byte [ebp - 0x18e]
test eax, eax
je 0x4030b5
push 0
push 0
push 0
push 0x1ae9
push 0xd15
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
mov eax, dword [ebp - 0x128c]
dec eax
mov dword [ebp - 0x128c], eax
jmp 0x40305d
mov dword [ebp - 0x18], 0x8a61928c
mov dword [ebp - 0x498], 0x14b81230
mov dword [ebp - 0x1e0], 1
mov dword [ebp - 0x1b68], 0xfffffff9
mov dword [ebp - 0x1b64], 0xfffffff9
mov dword [ebp - 0x1b60], 0xfffffff9
mov dword [ebp - 0x1b5c], 0xfffffff9
mov dword [ebp - 0x18], 0
jmp 0x403117
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x19
jne 0x403374
mov dword [ebp - 0x398], 0xdb6084ed
mov dword [ebp - 0x2cc], 0xdfe9f48
mov dword [ebp - 0x918], 2
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x1eb8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1ec0], eax
mov eax, dword [ebp - 0x398]
sub eax, dword [ebp - 0x398]
cmp eax, 0xba25
jl 0x403173
mov dword [ebp - 0x8f0], 1
jmp 0x40317a
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x8f0], eax
je 0x403191
mov dword [ebp - 0x1294], 1
jmp 0x403198
and dword [ebp - 0x1294], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1294]
cmp eax, dword [ebp - 0x18]
je 0x4031b3
mov dword [ebp - 0x8f8], 1
jmp 0x4031ba
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x8f8], eax
jl 0x4031d4
mov dword [ebp - 0x129c], 1
jmp 0x4031db
and dword [ebp - 0x129c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x129c], eax
jge 0x4031f2
mov dword [ebp - 0x900], 1
jmp 0x4031f9
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x900]
jl 0x403210
mov dword [ebp - 0x12a4], 1
jmp 0x403217
and dword [ebp - 0x12a4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x12a4], eax
jg 0x40322e
mov dword [ebp - 0x908], 1
jmp 0x403235
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x498], eax
jle 0x40325b
mov dword [ebp - 0x12ac], 1
jmp 0x403262
and dword [ebp - 0x12ac], 0
mov eax, dword [ebp - 0x12ac]
sub eax, dword [ebp - 0x2cc]
imul eax, dword [ebp - 0x18]
inc eax
je 0x40328a
cmp dword [ebp - 0x398], 0
je 0x40328a
mov dword [ebp - 0x910], 1
jmp 0x403291
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x2cc]
add eax, dword [ebp - 0x910]
cmp eax, dword [ebp - 0x18]
jge 0x4032ae
mov dword [ebp - 0x1938], 1
jmp 0x4032b5
and dword [ebp - 0x1938], 0
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x1ec8], eax
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x1ed0], eax
cmp dword [ebp - 0x1e0], 0x67f5
jg 0x4032e5
mov dword [ebp - 0x12b4], 1
jmp 0x4032ec
and dword [ebp - 0x12b4], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x12b4], eax
jl 0x403306
mov dword [ebp - 0x12bc], 1
jmp 0x40330d
and dword [ebp - 0x12bc], 0
mov eax, dword [ebp - 0x918]
cmp dword [ebp - 0x12bc], eax
jl 0x403327
mov dword [ebp - 0x920], 1
jmp 0x40332e
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x920]
sub eax, 0x24b13b10
cmp dword [ebp - 0x18], eax
jge 0x403357
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b68], 0
jne 0x403357
and dword [ebp - 0x12c4], 0
jmp 0x403361
mov dword [ebp - 0x12c4], 1
mov eax, dword [ebp - 0x12c4]
neg eax
mov dword [ebp - 0x2cc], eax
jmp 0x403110
mov dword [ebp - 0x18], 0xfffffffd
jmp 0x403384
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xa
jl 0x4034d5
mov dword [ebp - 0x5d8], 0xa24e
mov dword [ebp - 0x1940], 1
cmp dword [ebp - 0x5d8], 0x2b293353
jle 0x4033ba
mov dword [ebp - 0x928], 1
jmp 0x4033c1
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x1ed8], eax
cmp dword [ebp - 0x928], 0xb0debf62
jne 0x4033e5
mov dword [ebp - 0x12cc], 1
jmp 0x4033ec
and dword [ebp - 0x12cc], 0
cmp dword [ebp - 0x12cc], 0
jbe 0x403401
mov dword [ebp - 0x930], 1
jmp 0x403408
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x930]
dec eax
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0xdb602708
ja 0x403436
cmp dword [ebp - 0x1e0], 0
je 0x403436
mov dword [ebp - 0x12d4], 1
jmp 0x40343d
and dword [ebp - 0x12d4], 0
mov eax, dword [ebp - 0x12d4]
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
je 0x403467
cmp dword [ebp - 0x1e0], 0
je 0x403467
mov dword [ebp - 0x938], 1
jmp 0x40346e
and dword [ebp - 0x938], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b68]
imul eax, dword [ebp - 0x938]
cmp eax, 0xffffffff
jbe 0x40349c
cmp dword [ebp - 0x5d8], 0
je 0x40349c
mov dword [ebp - 0x12dc], 1
jmp 0x4034a3
and dword [ebp - 0x12dc], 0
mov eax, dword [ebp - 0x12dc]
mov dword [ebp - 0x1940], eax
mov byte [ebp - 0x190], 0
movzx eax, byte [ebp - 0x190]
test eax, eax
je 0x4034d0
push 0xc52
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
jmp 0x40337d
mov byte [ebp - 0x196], 0
mov dword [ebp - 0x1ee0], 7
mov byte [ebp - 0x192], 0
movzx eax, byte [ebp - 0x192]
test eax, eax
je 0x403509
push 0
push 0x4f4
push 0x53
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
mov byte [ebp - 0x194], 0
movzx eax, byte [ebp - 0x194]
test eax, eax
je 0x403526
push 0x239e
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, byte [ebp - 0x196]
test eax, eax
je 0x4036be
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x1948], 0xfe2cf45
mov dword [ebp - 0x3a0], 0
jmp 0x40355f
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 4
jge 0x40357b
mov eax, dword [ebp - 0x3a0]
mov dword [ebp + eax*4 - 0x2384], 0x1a6e483b
jmp 0x403552
mov byte [ebp - 0x198], 0
movzx eax, byte [ebp - 0x198]
test eax, eax
je 0x40359c
push 0
push 0x1d16
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x1ee8], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x1ef0], eax
mov eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x7c]
je 0x4035c8
cmp dword [ebp - 0x7c], 0
jne 0x4035c8
and dword [ebp - 0x940], 0
jmp 0x4035d2
mov dword [ebp - 0x940], 1
cmp dword [ebp - 0x940], 0x33e3
jle 0x4035ea
mov dword [ebp - 0x12e4], 1
jmp 0x4035f1
and dword [ebp - 0x12e4], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x12e4], eax
jl 0x403600
cmp dword [ebp - 0x7c], 0
cmp dword [ebp - 0x7c], 3
jge 0x403612
mov dword [ebp - 0x948], 1
jmp 0x403619
and dword [ebp - 0x948], 0
cmp dword [ebp - 0x948], 0xfffffffe
jg 0x40362e
mov dword [ebp - 0x12ec], 1
jmp 0x403635
and dword [ebp - 0x12ec], 0
mov eax, dword [ebp - 0x1948]
cmp dword [ebp - 0x12ec], eax
jg 0x40364f
mov dword [ebp - 0x950], 1
jmp 0x403656
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x950]
jne 0x40366d
mov dword [ebp - 0x12f4], 1
jmp 0x403674
and dword [ebp - 0x12f4], 0
mov eax, dword [ebp - 0x7c]
imul eax, dword [ebp - 0x12f4]
cmp eax, dword [ebp - 0x7c]
jle 0x40368f
mov dword [ebp - 0x958], 1
jmp 0x403696
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x958]
sub eax, 0x70a6e8d3
neg eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2384], eax
push 0
push 0x16cf
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
jmp 0x403001
mov dword [ebp - 0x32c], 0x70a5
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x518], 0
jmp 0x4036f0
mov eax, dword [ebp - 0x518]
inc eax
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 4
jge 0x40370c
mov eax, dword [ebp - 0x518]
mov dword [ebp + eax*4 - 0x161c], 0xfffffffd
jmp 0x4036e3
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x1ef8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x161c]
push 4
pop ecx
imul ecx, ecx, 3
sub eax, dword [ebp + ecx - 0x161c]
jne 0x403772
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x161c]
mov dword [ebp - 0x1f00], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x161c]
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0x161c]
neg eax
add eax, 0xf0d3
jne 0x403772
and dword [ebp - 0x12fc], 0
jmp 0x40377c
mov dword [ebp - 0x12fc], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x161c]
cmp dword [ebp - 0x12fc], eax
jg 0x40379d
mov dword [ebp - 0x960], 1
jmp 0x4037a4
and dword [ebp - 0x960], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x161c]
imul eax, dword [ebp - 0x960]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x161c]
jne 0x4037db
mov eax, 0x5ab0
test eax, eax
jne 0x4037db
and dword [ebp - 0x1304], 0
jmp 0x4037e5
mov dword [ebp - 0x1304], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x161c]
imul eax, dword [ebp - 0x1304]
test eax, eax
je 0x403812
mov eax, 0x5b641b44
test eax, eax
je 0x403812
mov dword [ebp - 0x968], 1
jmp 0x403819
and dword [ebp - 0x968], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x161c]
cmp dword [ebp - 0x968], eax
jne 0x40383a
mov dword [ebp - 0x130c], 1
jmp 0x403841
and dword [ebp - 0x130c], 0
mov eax, dword [ebp - 0x130c]
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x32c], 0xfffffff3
jmp 0x403866
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0x29
jge 0x4038ed
mov dword [ebp - 0x2d4], 0
jmp 0x403888
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x12
jl 0x4038e8
mov dword [ebp - 0x3a8], 0xdb74a71a
mov dword [ebp - 0x3a8], 3
jmp 0x4038b4
mov eax, dword [ebp - 0x3a8]
dec eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0
jl 0x4038e6
mov byte [ebp - 0x19a], 0
movzx eax, byte [ebp - 0x19a]
test eax, eax
je 0x4038e4
push 0xf20
push 0x2356
push 0x1fd
call dword [sym.imp.KERNEL32.dll_MulDiv]
jmp 0x4038a7
jmp 0x40387b
jmp 0x403859
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], eax
je 0x403901
mov dword [ebp - 0x970], 1
jmp 0x403908
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1f08], eax
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0x1314], eax
mov eax, dword [ebp - 0x1314]
mov dword [ebp - 0x1f10], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1f18], eax
mov dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x131c], eax
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x131c]
jge 0x403963
mov dword [ebp - 0x980], 1
jmp 0x40396a
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x1950], eax
imul eax, dword [ebp - 0x60], 0xfffd
mov dword [ebp - 0x1324], eax
mov eax, dword [ebp - 0x1324]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1958], eax
mov dword [ebp - 0x15c], 0x6df37d45
mov dword [ebp - 0x988], 0
push 3
lea ecx, [ebp - 0x1c30]
call fcn.0041796c
mov dword [ebp - 0x133c], 0xdca27289
mov dword [ebp - 0x9a0], 0xffffffff
mov dword [ebp - 0x9b0], 0xfffffff7
mov dword [ebp - 0x1960], 0xffffffff
mov dword [ebp - 0x4a0], 0
jmp 0x4039f7
mov eax, dword [ebp - 0x4a0]
inc eax
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 3
jge 0x403a19
push dword [ebp - 0x4a0]
lea ecx, [ebp - 0x1c30]
call fcn.00417a5a
mov dword [eax], 0xf58
jmp 0x4039ea
mov byte [ebp - 0x19c], 0
movzx eax, byte [ebp - 0x19c]
test eax, eax
je 0x403a48
push 0
push 0
push 0
push 0
push 0x1f26
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x15c], eax
jle 0x403a62
mov dword [ebp - 0x132c], 1
jmp 0x403a69
and dword [ebp - 0x132c], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x988], eax
mov eax, dword [ebp - 0x15c]
imul eax, dword [ebp - 0x988]
mov dword [ebp - 0x990], eax
push 0
lea ecx, [ebp - 0x1c30]
call fcn.00417a5a
mov ecx, dword [ebp - 0x990]
mov dword [eax], ecx
mov eax, dword [ebp - 0x132c]
cmp eax, dword [ebp - 0x990]
je 0x403ab7
mov dword [ebp - 0x1344], 1
jmp 0x403abe
and dword [ebp - 0x1344], 0
cmp dword [ebp - 0x15c], 1
jne 0x403ad3
mov dword [ebp - 0x1334], 1
jmp 0x403ada
and dword [ebp - 0x1334], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x1334], eax
jge 0x403af4
mov dword [ebp - 0x998], 1
jmp 0x403afb
and dword [ebp - 0x998], 0
imul eax, dword [ebp - 0x998], 0x2524
sub eax, dword [ebp - 0x15c]
mov dword [ebp - 0x133c], eax
mov eax, dword [ebp - 0x133c]
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x9a0], eax
jne 0x403b37
mov dword [ebp - 0x9a8], 1
jmp 0x403b3e
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x1344]
cmp eax, dword [ebp - 0x9a8]
jg 0x403b58
mov dword [ebp - 0x134c], 1
jmp 0x403b5f
and dword [ebp - 0x134c], 0
mov eax, dword [ebp - 0x134c]
mov dword [ebp - 0x9b0], eax
mov eax, dword [ebp - 0x9b0]
mov dword [ebp - 0x1960], eax
lea ecx, [ebp - 0x1c30]
call fcn.00417a3e
mov dword [ebp - 0x558], 0xfffffffc
mov dword [ebp - 0x1f20], 0x35c5735e
mov dword [ebp - 0x1f28], 0x94b2ab76
mov dword [ebp - 0x1f30], 0xfffffff8
mov dword [ebp - 0x1f38], 0
mov dword [ebp - 0x3b0], 0
jmp 0x403bcd
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 1
jge 0x403be9
mov eax, dword [ebp - 0x3b0]
mov dword [ebp + eax*4 - 0x1f40], 9
jmp 0x403bc0
mov dword [ebp - 0x558], 0
jmp 0x403c02
mov eax, dword [ebp - 0x558]
dec eax
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 0
jl 0x403ce8
mov dword [ebp - 0x4a8], 0
mov dword [ebp - 0x3c0], 0
mov dword [ebp - 0x1f48], 3
mov dword [ebp - 0x1f50], 2
mov dword [ebp - 0x3b8], 0
jmp 0x403c50
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 2
jge 0x403c6c
mov eax, dword [ebp - 0x3b8]
mov dword [ebp + eax*4 - 0x1ba0], 0x1d52aa0a
jmp 0x403c43
mov dword [ebp - 0x4a8], 0
jmp 0x403c85
mov eax, dword [ebp - 0x4a8]
dec eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0
jl 0x403ce3
mov dword [ebp - 0x1968], 0xc35240ca
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ba0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1ba0], eax
mov dword [ebp - 0x3c0], 0
jmp 0x403ccc
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0
jg 0x403ce1
mov dword [ebp - 0x1968], 0x6fda0246
jmp 0x403cbf
jmp 0x403c78
jmp 0x403bf5
push 3
lea ecx, [ebp - 0x16b8]
call fcn.0041796c
mov dword [ebp - 0x30c], 0xf57a7c20
push 4
lea ecx, [ebp - 0x1ae0]
call fcn.0041796c
mov dword [ebp - 0x130], 0
jmp 0x403d25
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 3
jge 0x403d47
push dword [ebp - 0x130]
lea ecx, [ebp - 0x16b8]
call fcn.00417a5a
mov dword [eax], 0x77862fd4
jmp 0x403d18
mov dword [ebp - 0x130], 0
jmp 0x403d60
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 4
jge 0x403d82
push dword [ebp - 0x130]
lea ecx, [ebp - 0x1ae0]
call fcn.00417a5a
mov dword [eax], 0x39ba095a
jmp 0x403d53
mov byte [ebp - 0x19e], 0
movzx eax, byte [ebp - 0x19e]
test eax, eax
je 0x403d9a
call dword [sym.imp.USER32.dll_DestroyCaret]
mov dword [ebp - 0x30c], 0
jmp 0x403db3
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 2
jg 0x403f7d
mov dword [ebp - 0x2dc], 0xffffffff
mov dword [ebp - 0x520], 0
jmp 0x403de3
mov eax, dword [ebp - 0x520]
inc eax
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 4
jge 0x403dff
mov eax, dword [ebp - 0x520]
mov dword [ebp + eax*4 - 0x18dc], 0xc62e0897
jmp 0x403dd6
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x18dc], 0
jmp 0x403e2a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x18dc]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x18dc], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x18dc], 2
jg 0x403e8a
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x18dc]
lea ecx, [ebp - 0x16b8]
call fcn.00417a5a
mov dword [ebp - 0x1354], eax
push dword [ebp - 0x30c]
lea ecx, [ebp - 0x16b8]
call fcn.00417a5a
mov ecx, dword [ebp - 0x1354]
mov eax, dword [eax]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x1ae0]
call fcn.00417a5a
mov ecx, dword [ebp - 0x1354]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x403e11
mov dword [ebp - 0x2dc], 0xffffffec
jmp 0x403ea3
cmp dword [ebp - 0x2dc], 0xffffffe4
jle 0x403f78
push 0
lea ecx, [ebp - 0x16b8]
call fcn.00417a5a
imul esi, dword [eax], 0x1bbb
push 0
lea ecx, [ebp - 0x1ae0]
call fcn.00417a5a
cmp esi, dword [eax]
jne 0x403ee0
mov dword [ebp - 0x9b8], 1
jmp 0x403ee7
and dword [ebp - 0x9b8], 0
push 1
lea ecx, [ebp - 0x16b8]
call fcn.00417a5a
imul ecx, dword [ebp - 0x9b8], 0x3dc9
cmp dword [eax], ecx
je 0x403f0e
mov dword [ebp - 0x135c], 1
jmp 0x403f15
and dword [ebp - 0x135c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x18dc]
cmp dword [ebp - 0x135c], eax
jge 0x403f35
jmp 0x403da6
lea ecx, [ebp - 0x1ae0]
call fcn.00417a3e
lea ecx, [ebp - 0x16b8]
call fcn.00417a3e
mov dword [ebp - 0x168], 0x6df37d45
mov dword [ebp - 0xa70], 0
push 2
lea ecx, [ebp - 0x1c3c]
call fcn.0041796c
mov dword [ebp - 0x324], 7
mov dword [ebp - 0x3c8], 0
jmp 0x403fd7
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 2
jge 0x403ff6
push dword [ebp - 0x3c8]
lea ecx, [ebp - 0x1c3c]
call fcn.00417a5a
or dword [eax], 0xffffffff
jmp 0x403fca
mov dword [ebp - 0x324], 1
jmp 0x40400f
mov eax, dword [ebp - 0x324]
dec eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
jl 0x40412d
mov dword [ebp - 0x4b0], 0x4f402e31
mov dword [ebp - 0x4b0], 1
jmp 0x40403f
cmp dword [ebp - 0x4b0], 0
jl 0x404128
mov dword [ebp - 0x3d0], 0x144ad72d
mov dword [ebp - 0x3d0], 1
jmp 0x40406f
cmp dword [ebp - 0x3d0], 0
jl 0x404108
mov byte [ebp - 0x1a0], 0
movzx eax, byte [ebp - 0x1a0]
test eax, eax
je 0x4040df
push dword [ebp - 0x324]
lea ecx, [ebp - 0x1c3c]
call fcn.00417a5a
cmp dword [eax], 0
je 0x404123
jmp 0x404002
lea ecx, [ebp - 0x1c3c]
call fcn.00417a3e
push 3
lea ecx, [ebp - 0x1c9c]
call fcn.0041796c
mov dword [ebp - 0x3d8], 0x245f1dbe
mov dword [ebp - 0x4b8], 0xffffffff
mov dword [ebp - 0x9d8], 0xad4351cd
push 3
lea ecx, [ebp - 0x159c]
call fcn.0041796c
mov dword [ebp - 0x9c8], 0
mov dword [ebp - 0x670], 0x221e9c96
mov dword [ebp - 0x578], 0x8373b2c
push 1
lea ecx, [ebp - 0x1af8]
call fcn.0041796c
mov dword [ebp - 0x1da0], 0xfffffff8
mov dword [ebp - 0x1d9c], 0xfffffff8
mov dword [ebp - 0x1d98], 0xfffffff8
mov dword [ebp - 0x1d94], 0xfffffff8
mov dword [ebp - 0xd8], 0
jmp 0x4041dc
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x4041fe
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x159c]
call fcn.00417a5a
mov dword [eax], 0xfffffffc
jmp 0x4041cf
mov dword [ebp - 0xd8], 0
jmp 0x404217
cmp dword [ebp - 0xd8], 1
jge 0x404239
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x1af8]
call fcn.00417a5a
mov dword [eax], 9
jmp 0x40420a
mov eax, dword [ebp - 0x578]
dec eax
mov dword [ebp - 0x578], eax
jne 0x4044b5