Function at 0x1004b5b8
Capabilities:
Accept command line arguments
Get disk size
Identify system language via api
Modify service
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007adb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf08
push esi
push edi
push 1
lea eax, [ebp - 0xf14]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.1004ae1d
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0xe34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0xe34]
lea edi, [ebp - 0x924]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1d0], 0xfffffff9
mov dword [ebp - 0xb20], 0xfffffff8
mov dword [ebp - 0x8b4], 1
mov dword [ebp - 0xac0], 0xe704f3d4
mov dword [ebp - 0xac8], 0xfffffffe
mov dword [ebp - 0xb14], 6
mov dword [ebp - 0xb1c], 1
mov dword [ebp - 0xb24], 0
mov dword [ebp - 0xb2c], 1
mov dword [ebp - 0xb34], 0xffffffff
mov dword [ebp - 0x8ac], 0x9dc86695
mov dword [ebp - 0xb3c], 0xf9a4d91f
mov dword [ebp - 0x8bc], 9
mov dword [ebp - 0xb44], 0xfffffff9
mov dword [ebp - 0xb4c], 0x89be67e7
mov dword [ebp - 0xb54], 0x33c8a0c0
mov dword [ebp - 0xb5c], 0xfffffffa
mov dword [ebp - 0xb64], 0x52783de7
mov dword [ebp - 0x89c], 0xffeac8e4
mov dword [ebp - 0x8c4], 0
mov dword [ebp - 0x74], 0
jmp 0x1004b6df
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1004b6f5
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xbd4], 0xd7f825e7
jmp 0x1004b6d8
mov dword [ebp - 0x74], 0
jmp 0x1004b705
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1004b71b
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xe4c], 0xfffffff7
jmp 0x1004b6fe
mov dword [ebp - 0x1d0], 2
jmp 0x1004b734
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jl 0x1004b96e
mov dword [ebp - 0x130], 0xb3b9da4d
mov dword [ebp - 0xb6c], 1
mov dword [ebp - 0x8a4], 0x57257ea0
mov dword [ebp - 0xb74], 0xfffffffc
mov dword [ebp - 0xd80], 0xfffffffb
mov dword [ebp - 0xd7c], 0xfffffffb
mov dword [ebp - 0xd78], 0xfffffffb
mov dword [ebp - 0xd74], 0xfffffffb
mov dword [ebp - 0xb7c], 0xfffffff6
mov dword [ebp - 0x130], 0
jmp 0x1004b7b4
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 3
jge 0x1004b7d0
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0xbd4], 0x3ff82ff4
jmp 0x1004b7a7
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xbd4], 0
je 0x1004b882
mov dword [ebp - 0xb84], 0x135e1f6f
mov dword [ebp - 0xb8c], 0xffffffff
mov dword [ebp - 0xb94], 0x32456160
push 1
lea ecx, [ebp - 0xbe4]
call fcn.100164e9
and dword [ebp - 4], 0
mov dword [ebp - 0xb9c], 0
mov dword [ebp - 0x458], 9
mov dword [ebp - 0x270], 0
jmp 0x1004b83f
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x1004b861
push dword [ebp - 0x270]
lea ecx, [ebp - 0xbe4]
call fcn.10016587
mov dword [eax], 0xc2184e5a
jmp 0x1004b832
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe4]
call fcn.1001656b
jmp 0x1004b969
mov dword [ebp - 0x8b0], 0x9ce07b88
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0x89c]
mov ecx, dword [ebp - 0x8a4]
lea eax, [eax + ecx - 0x6ae0e500]
cmp eax, dword [ebp - 0x8ac]
jg 0x1004b8bf
mov dword [ebp - 0x780], 1
jmp 0x1004b8c6
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x8b4]
cmp eax, dword [ebp - 0x780]
jl 0x1004b8e0
mov dword [ebp - 0x788], 1
jmp 0x1004b8e7
and dword [ebp - 0x788], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe4c]
cmp dword [ebp - 0x788], eax
jle 0x1004b907
mov dword [ebp - 0x778], 1
jmp 0x1004b90e
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
sub eax, dword [ebp - 0x8bc]
cmp dword [ebp - 0x130], eax
jg 0x1004b92e
mov dword [ebp - 0x340], 1
jmp 0x1004b935
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
shl eax, 2
cmp eax, 0x6ca241e2
jl 0x1004b951
mov dword [ebp - 0x344], 1
jmp 0x1004b958
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
sub eax, 0x996d
mov dword [ebp - 0x8c4], eax
jmp 0x1004b727
mov dword [ebp - 0x1d8], 1
mov dword [ebp - 0x74c], 0xdcc590f0
push 4
lea ecx, [ebp - 0xa40]
call fcn.100164e9
mov dword [ebp - 4], 1
mov dword [ebp - 0x870], 0x12a7b09f
mov dword [ebp - 0x44], 0
jmp 0x1004b9b0
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1004b9cc
push dword [ebp - 0x44]
lea ecx, [ebp - 0xa40]
call fcn.10016587
mov dword [eax], 9
jmp 0x1004b9a9
mov dword [ebp - 0x44], 0
jmp 0x1004b9dc
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1004b9f2
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xef0], 1
jmp 0x1004b9d5
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 0
je 0x1004ba19
mov eax, 0x498e
test eax, eax
jne 0x1004ba19
and dword [ebp - 0x34c], 0
jmp 0x1004ba23
mov dword [ebp - 0x34c], 1
cmp dword [ebp - 0x34c], 4
jb 0x1004ba38
mov dword [ebp - 0x2f4], 1
jmp 0x1004ba3f
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x574], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x574]
mov dword [ebp + eax - 0xef0], ecx
mov eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x574]
jl 0x1004ba78
mov dword [ebp - 0x354], 1
jmp 0x1004ba7f
and dword [ebp - 0x354], 0
push 0
lea ecx, [ebp - 0xa40]
call fcn.10016587
mov ecx, dword [ebp - 0x2f4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x354]
sub eax, 0x78c0
cmp dword [ebp - 0x2f4], eax
je 0x1004bab3
mov dword [ebp - 0x684], 1
jmp 0x1004baba
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x684], 0xffff
jb 0x1004bad8
cmp dword [ebp - 0x1d8], 0
jne 0x1004bad8
and dword [ebp - 0x35c], 0
jmp 0x1004bae2
mov dword [ebp - 0x35c], 1
cmp dword [ebp - 0x35c], 0xffffffff
jge 0x1004baf7
mov dword [ebp - 0x57c], 1
jmp 0x1004bafe
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x57c], 0xd65f
jle 0x1004bb16
mov dword [ebp - 0x364], 1
jmp 0x1004bb1d
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x870], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa40]
call fcn.1001656b
mov dword [ebp - 0x280], 0xfffffff9
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x240], 0
jmp 0x1004bb62
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jge 0x1004bb7e
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xbf4], 0
jmp 0x1004bb55
mov dword [ebp - 0x28], 0
jmp 0x1004bb8e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x1004bbc0
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1004bbbe
push 0
push 0
push 0x2186
push 0x3a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x1004bb87
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jge 0x1004bbd4
mov dword [ebp - 0x70c], 1
jmp 0x1004bbdb
and dword [ebp - 0x70c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbf4]
imul eax, dword [ebp - 0x70c]
test eax, eax
je 0x1004bc12
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1004bc0d
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x1004bd82
mov dword [ebp - 0x34], 0xdac0faab
mov eax, 0xe58bfc4f
test eax, eax
je 0x1004bd36
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xbac], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbf4]
mov dword [ebp - 0xbb4], eax
cmp dword [ebp - 0x34], 0
je 0x1004bc59
cmp dword [ebp - 0x34], 0
je 0x1004bc59
mov dword [ebp - 0x7f8], 1
jmp 0x1004bc60
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xbbc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xbc4], eax
cmp dword [ebp - 0x28], 0xadf8
jge 0x1004bc87
mov dword [ebp - 0x36c], 1
jmp 0x1004bc8e
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x36c], eax
jl 0x1004bcab
cmp dword [ebp - 0x28], 0
je 0x1004bcab
mov dword [ebp - 0x584], 1
jmp 0x1004bcb2
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x584]
jne 0x1004bcc1
cmp dword [ebp - 0x34], 0
cmp dword [ebp - 0x34], 1
jae 0x1004bcd3
mov dword [ebp - 0x374], 1
jmp 0x1004bcda
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
inc eax
cmp eax, 1
jge 0x1004bcf2
mov dword [ebp - 0x68c], 1
jmp 0x1004bcf9
and dword [ebp - 0x68c], 0
cmp dword [ebp - 0x68c], 0x15b01d9
jle 0x1004bd11
mov dword [ebp - 0x7c4], 1
jmp 0x1004bd18
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xde8], eax
cmp dword [ebp - 0x28], 0x6dab
jg 0x1004bd36
mov dword [ebp - 0x37c], 1
jmp 0x1004bd3d
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1004bd82
push 0x196f
push 0
push 0x268f
push 0x4d7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov dword [ebp - 0xdf0], 0xfffffff8
mov dword [ebp - 0xd8], 0xfffffffa
mov dword [ebp - 0x2d0], 9
push 1
lea ecx, [ebp - 0xa04]
call fcn.100164e9
mov dword [ebp - 4], 2
mov dword [ebp - 0x84], 0
jmp 0x1004bdcd
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x1004bde9
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xe18], 1
jmp 0x1004bdc0
mov dword [ebp - 0x84], 0
jmp 0x1004be02
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1004be21
push dword [ebp - 0x84]
lea ecx, [ebp - 0xa04]
call fcn.10016587
or dword [eax], 0xffffffff
jmp 0x1004bdf5
mov dword [ebp - 0xd8], 0xffffffe8
jmp 0x1004be3a
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xffffffef
jg 0x1004c1a2
mov dword [ebp - 0x314], 0xd3f5
mov dword [ebp - 0xa4], 0xffffffff
mov dword [ebp - 0x4c], 0xafa01777
mov dword [ebp - 0x16c], 0xeec299e
mov dword [ebp - 0x85c], 0x4426
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xdf8], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x1004bea0
cmp dword [ebp - 0x4c], 0
jne 0x1004bea0
and dword [ebp - 0x58c], 0
jmp 0x1004beaa
mov dword [ebp - 0x58c], 1
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x3051ebf0
jl 0x1004bece
mov dword [ebp - 0x384], 1
jmp 0x1004bed5
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
sub eax, 0x307ecdf1
jne 0x1004bef4
mov eax, 0x2f7c
test eax, eax
jne 0x1004bef4
and dword [ebp - 0x78c], 0
jmp 0x1004befe
mov dword [ebp - 0x78c], 1
cmp dword [ebp - 0x78c], 0xffffffff
je 0x1004bf13
mov dword [ebp - 0x38c], 1
jmp 0x1004bf1a
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x38c]
jle 0x1004bf40
mov dword [ebp - 0x594], 1
jmp 0x1004bf47
and dword [ebp - 0x594], 0
imul eax, dword [ebp - 0x594], 0xffffffff
cmp eax, dword [ebp - 0x314]
jg 0x1004bf62
mov dword [ebp - 0x394], 1
jmp 0x1004bf69
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x85c]
cmp dword [ebp - 0x394], eax
jg 0x1004bf8c
cmp dword [ebp - 0xa4], 0
jne 0x1004bf8c
mov dword [ebp - 0x694], 1
jmp 0x1004bf93
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x2d0], eax
jl 0x1004bfc2
cmp dword [ebp - 0x2d0], 0
je 0x1004bfc2
mov dword [ebp - 0x39c], 1
jmp 0x1004bfc9
and dword [ebp - 0x39c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x39c]
mov dword [ebp + eax - 0xe18], ecx
mov dword [ebp - 0xa4], 0
jmp 0x1004bff5
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x17
jle 0x1004c19d
mov dword [ebp - 0x1e0], 0xc7a8
mov dword [ebp - 0x7d4], 0x762969fb
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x1004c04f
push 0x196f
push 0
push 0x268f
push 0x4d7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0xe00], eax
cmp dword [ebp - 0x1e0], 0
je 0x1004c069
xor eax, eax
inc eax
jne 0x1004c07a
xor eax, eax
inc eax
je 0x1004c07a
mov dword [ebp - 0x59c], 1
jmp 0x1004c081
and dword [ebp - 0x59c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe18]
cmp eax, dword [ebp - 0x59c]
jg 0x1004c0a2
mov dword [ebp - 0x3a4], 1
jmp 0x1004c0a9
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x3a4], eax
je 0x1004c0c0
mov dword [ebp - 0x714], 1
jmp 0x1004c0c7
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x714]
cmp eax, dword [ebp - 0x314]
jl 0x1004c0e4
mov dword [ebp - 0x3ac], 1
jmp 0x1004c0eb
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x3ac]
sub eax, dword [ebp - 0x4c]
cmp dword [ebp - 0xa4], eax
jl 0x1004c186
mov dword [ebp - 0x7cc], 0xe848967
mov dword [ebp - 0x16c], 0
jmp 0x1004c123
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x18
je 0x1004c137
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x4c], eax
jmp 0x1004c116
cmp dword [ebp - 0x7cc], 0
je 0x1004c165
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1004c163
push 0
push 0x201f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x1004c184
mov dword [ebp - 0x8d8], 0x32a49e86
push 0
lea ecx, [ebp - 0xa04]
call fcn.10016587
mov eax, dword [eax]
mov dword [ebp - 0x8d8], eax
jmp 0x1004c198
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x7d4], eax
jmp 0x1004bfe8
jmp 0x1004be2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa04]
call fcn.1001656b
mov dword [ebp - 0x82c], 1
push 3
lea ecx, [ebp - 0x330]
call fcn.100164e9
mov dword [ebp - 4], 3
mov dword [ebp - 0x14], 0x25d16df2
mov dword [ebp - 0x2d8], 0x3938
mov dword [ebp - 0x7b4], 0xe547
mov dword [ebp - 0x7c], 0
jmp 0x1004c1fa
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1004c213
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x330]
call fcn.10016587
or dword [eax], 0xffffffff
jmp 0x1004c1f3
mov dword [ebp - 0x7c], 0
jmp 0x1004c223
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1004c239
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x938], 0xa1a8f1ed
jmp 0x1004c21c
mov dword [ebp - 0x14], 2
jmp 0x1004c249
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1004c430
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x54], 0
jmp 0x1004c26a
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x1004c294
push dword [ebp - 0x14]
lea ecx, [ebp - 0x330]
call fcn.10016587
mov esi, eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x330]
call fcn.10016587
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1004c263
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
jl 0x1004c2a8
mov dword [ebp - 0x864], 1
jmp 0x1004c2af
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x7dc], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x330]
call fcn.10016587
mov ecx, dword [ebp - 0x7dc]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x330]
call fcn.10016587
cmp dword [eax], 0
jl 0x1004c2ec
mov dword [ebp - 0x5a4], 1
jmp 0x1004c2f3
and dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x5a4], 0xa441
jne 0x1004c30b
mov dword [ebp - 0x3b4], 1
jmp 0x1004c312
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x3b4], eax
je 0x1004c329
mov dword [ebp - 0x69c], 1
jmp 0x1004c330
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x69c], eax
jne 0x1004c347
mov dword [ebp - 0x3bc], 1
jmp 0x1004c34e
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x3bc]
cmp eax, dword [ebp - 0x14]
jge 0x1004c37b
push 0
lea ecx, [ebp - 0x330]
call fcn.10016587
cmp dword [eax], 0
je 0x1004c37b
mov dword [ebp - 0x5ac], 1
jmp 0x1004c382
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp - 0x5ac], eax
jl 0x1004c39c
mov dword [ebp - 0x3c4], 1
jmp 0x1004c3a3
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp - 0x54], eax
jl 0x1004c3c3
mov dword [ebp - 0x754], 1
jmp 0x1004c3ca
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x754], eax
jne 0x1004c3e1
mov dword [ebp - 0x3cc], 1
jmp 0x1004c3e8
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
add eax, 5
jne 0x1004c40e
push 1
lea ecx, [ebp - 0x330]
call fcn.10016587
cmp dword [eax], 0
jne 0x1004c40e
and dword [ebp - 0x5b4], 0
jmp 0x1004c418
mov dword [ebp - 0x5b4], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5b4]
mov dword [ebp + eax - 0x938], ecx
jmp 0x1004c242
push 1
lea ecx, [ebp - 0x330]
call fcn.10016587
push 0
lea ecx, [ebp - 0x330]
call fcn.10016587
cmp dword [eax], 0x34283644
jl 0x1004c45e
mov dword [ebp - 0x3d4], 1
jmp 0x1004c465
and dword [ebp - 0x3d4], 0
cmp dword [ebp - 0x3d4], 7
jae 0x1004c47a
mov dword [ebp - 0x6a4], 1
jmp 0x1004c481
and dword [ebp - 0x6a4], 0
cmp dword [ebp - 0x6a4], 0xe83a
jle 0x1004c499
mov dword [ebp - 0x3dc], 1
jmp 0x1004c4a0
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0xffffffff
jle 0x1004c4b5
mov dword [ebp - 0x5bc], 1
jmp 0x1004c4bc
and dword [ebp - 0x5bc], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x938], 1
cmp dword [ebp - 0x5bc], 1
jge 0x1004c4e2
mov dword [ebp - 0x3e4], 1
jmp 0x1004c4e9
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x2d8]
cmp eax, dword [ebp - 0x3e4]
jg 0x1004c503
mov dword [ebp - 0x71c], 1
jmp 0x1004c50a
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x7b4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x330]
call fcn.1001656b
mov dword [ebp - 0xe08], 0xe704f3d4
mov dword [ebp - 0x86c], 0x5043
mov dword [ebp - 0x3f4], 0
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x298], 0x315362da
mov dword [ebp - 0x5cc], 0xe91c1785
mov dword [ebp - 0x7ec], 0xffffffff
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1004c59f
push 0
push 0xd0f
push 0x138b
push 0x1698
push 0xd3f
call dword [sym.imp.GDI32.dll_CreateBitmap]
cmp dword [ebp - 0x138], 0x4a41637c
jle 0x1004c5b7
mov dword [ebp - 0x3ec], 1
jmp 0x1004c5be
and dword [ebp - 0x3ec], 0
imul eax, dword [ebp - 0x3ec], 0xa17d
cmp dword [ebp - 0x138], eax
jge 0x1004c5dc
mov dword [ebp - 0x7e4], 1
jmp 0x1004c5e3
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0xddc], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0xd50], eax
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x3f4], 0x13b28858
jne 0x1004c620
mov dword [ebp - 0x5c4], 1
jmp 0x1004c627
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x5c4], eax
jl 0x1004c64a
cmp dword [ebp - 0x138], 0
je 0x1004c64a
mov dword [ebp - 0x6ac], 1
jmp 0x1004c651
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x3f4]
cmp dword [ebp - 0x6ac], eax
jge 0x1004c69d
mov dword [ebp - 0x3fc], 1
mov eax, dword [ebp - 0x3fc]
dec eax
mov dword [ebp - 0x3fc], eax
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x1004c698
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x1004c7a9
mov dword [ebp - 0x178], 0xb39e2240
mov dword [ebp - 0x1e8], 2
mov dword [ebp - 0x40c], 1
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0xdd4], eax
push 3
pop eax
sub eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x5cc], eax
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0x1552
jge 0x1004c706
mov dword [ebp - 0x404], 1
jmp 0x1004c70d
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
sub eax, dword [ebp - 0x7ec]
imul eax, dword [ebp - 0x178]
add eax, dword [ebp - 0x178]
je 0x1004c73d
mov eax, 0xfff8
test eax, eax
je 0x1004c73d
mov dword [ebp - 0x774], 1
jmp 0x1004c744
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x774], eax
jle 0x1004c75e
mov dword [ebp - 0x87c], 1
jmp 0x1004c765
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xa4c], eax
cmp dword [ebp - 0x40c], 0
je 0x1004c783
cmp dword [ebp - 0x178], 0
jne 0x1004c793
push 3
pop eax
test eax, eax
jne 0x1004c793
and dword [ebp - 0x7f4], 0
jmp 0x1004c79d
mov dword [ebp - 0x7f4], 1
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0xbf8], 0xfffffffe
mov dword [ebp - 0x9cc], 4
mov dword [ebp - 0x9c8], 4
mov dword [ebp - 0x9c4], 4
mov dword [ebp - 0x9c0], 4
lea ecx, [ebp - 0x2ad]
call fcn.10008b13
push eax
lea eax, [ebp - 0x9bc]
push eax
lea eax, [ebp - 0x9cc]
push eax
lea ecx, [ebp - 0xe90]
call fcn.10016596
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x90c]
call fcn.10016545
mov dword [ebp - 4], 4
mov dword [ebp - 0xa54], 1
mov dword [ebp - 0x9a4], 2
mov dword [ebp - 0x9a0], 2
mov dword [ebp - 0x99c], 2
mov dword [ebp - 0x998], 2
lea ecx, [ebp - 0x301]
call fcn.10008b13
push eax
lea eax, [ebp - 0x994]
push eax
lea eax, [ebp - 0x9a4]
push eax
lea ecx, [ebp - 0xef8]
call fcn.10016596
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe7c]
call fcn.10016545
mov byte [ebp - 4], 5
mov dword [ebp - 0x414], 0x3dc0e3e7
push 0
lea ecx, [ebp - 0x90c]
call fcn.10016587
and dword [eax], 0
jmp 0x1004c8c2
push 0
lea ecx, [ebp - 0x90c]
call fcn.10016587
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x5d4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5d4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x90c]
call fcn.10016587
cmp dword [eax], 0xfffffff1
jge 0x1004c922
mov dword [ebp - 0xd64], 1
mov dword [ebp - 0xa5c], 0xd568d526
mov dword [ebp - 0xc08], 0x44d513c6
mov dword [ebp - 0xa64], 5
mov dword [ebp - 0xd6c], 0x7207182
mov dword [ebp - 0xa6c], 0xffffffff
mov eax, dword [ebp - 0x414]
dec eax
mov dword [ebp - 0x414], eax
jmp 0x1004c89e
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xe7c]
call fcn.1001656b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90c]
call fcn.1001656b
mov dword [ebp - 0xc18], 6
mov dword [ebp - 0xa74], 1
push 1
lea ecx, [ebp - 0x918]
call fcn.100164e9
mov dword [ebp - 4], 6
mov dword [ebp - 0x174], 0x83c7730f
mov dword [ebp - 0x248], 0
jmp 0x1004c98b
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x1004c9ad
push dword [ebp - 0x248]
lea ecx, [ebp - 0x918]
call fcn.10016587
mov dword [eax], 0xfffffffc
jmp 0x1004c97e
mov byte [ebp - 0xbb], 0
movzx eax, byte [ebp - 0xbb]
test eax, eax
je 0x1004c9e4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1b35
push 0x26ed
push 0x1332
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x174], 0
jmp 0x1004c9fd
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jg 0x1004ca30
push dword [ebp - 0x174]
lea ecx, [ebp - 0x918]
call fcn.10016587
mov esi, eax
push dword [ebp - 0x174]
lea ecx, [ebp - 0x918]
call fcn.10016587
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1004c9f0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x918]
call fcn.1001656b
mov dword [ebp - 0xdfc], 0
mov dword [ebp - 0xa7c], 1
push 4
lea ecx, [ebp - 0xc14]
call fcn.100164e9
mov dword [ebp - 4], 7
mov dword [ebp - 0x1f0], 1
push 2
lea ecx, [ebp - 0xc04]
call fcn.100164e9
mov byte [ebp - 4], 8
mov dword [ebp - 0x88], 0
jmp 0x1004ca9b
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x1004cabd
push dword [ebp - 0x88]
lea ecx, [ebp - 0xc14]
call fcn.10016587
mov dword [eax], 6
jmp 0x1004ca8e
mov dword [ebp - 0x88], 0
jmp 0x1004cad6
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1004caf8
push dword [ebp - 0x88]
lea ecx, [ebp - 0xc04]
call fcn.10016587
mov dword [eax], 0xb8c3ad3b
jmp 0x1004cac9
mov dword [ebp - 0x1f0], 3
jmp 0x1004cb11
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
jl 0x1004cb4a
mov dword [ebp - 0x6b4], 0x77c8748a
mov dword [ebp - 0x41c], 0x62ee6d05
mov eax, dword [ebp - 0x6b4]
inc eax
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
jmp 0x1004cb04
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc04]
call fcn.1001656b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc14]
call fcn.1001656b
mov dword [ebp - 0xc28], 0xffffffff
mov dword [ebp - 0xa84], 0x3c692bea
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1004cb9f
push 0
push 1
push 0x807
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1004cbb7
call dword [sym.imp.USER32.dll_GetMessageTime]
mov dword [ebp - 0x8b8], 0x9dc86695
mov dword [ebp - 0x140], 2
mov dword [ebp - 0x278], 0xffffffff
mov dword [ebp - 0x168], 0x831d26ec
mov dword [ebp - 0x878], 6
mov dword [ebp - 0x5c], 0
jmp 0x1004cbf9
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1004cc0f
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x1a0], 6
jmp 0x1004cbf2
mov dword [ebp - 0x5c], 0
jmp 0x1004cc1f
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x1004cc35
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xf08], 0xfffffff9
jmp 0x1004cc18
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xd58], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x874], 0xffffffff
je 0x1004cc7b
mov dword [ebp - 0x2fc], 1
jmp 0x1004cc82
and dword [ebp - 0x2fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2fc]
mov dword [ebp + eax - 0x1a0], ecx
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xc38], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0xad4], eax
cmp dword [ebp - 0x168], 0
je 0x1004cd02
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a0], 0
je 0x1004cd02
mov dword [ebp - 0x7fc], 1
jmp 0x1004cd09
and dword [ebp - 0x7fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
mov dword [ebp - 0xaa4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, 0x4fd5
imul ecx, ecx, 0xfffffffa
cmp dword [ebp + eax - 0x1a0], ecx
jne 0x1004cd3f
mov dword [ebp - 0x5dc], 1
jmp 0x1004cd46
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x5dc], eax
jle 0x1004cd60
mov dword [ebp - 0x424], 1
jmp 0x1004cd67
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x140]
add eax, dword [ebp - 0x424]
cmp eax, dword [ebp - 0x278]
jne 0x1004cd8d
cmp dword [ebp - 0x168], 0
jne 0x1004cd8d
and dword [ebp - 0x724], 0
jmp 0x1004cd97
mov dword [ebp - 0x724], 1
cmp dword [ebp - 0x724], 0x4752
jne 0x1004cdaf
mov dword [ebp - 0x42c], 1
jmp 0x1004cdb6
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x878]
cmp dword [ebp - 0x42c], eax
jg 0x1004cdd0
mov dword [ebp - 0x5e4], 1
jmp 0x1004cdd7
and dword [ebp - 0x5e4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5e4]
mov dword [ebp + eax - 0x1a0], ecx
mov dword [ebp - 0xadc], 0xf9a4d91f
mov dword [ebp - 0x188], 3
mov dword [ebp - 0x1f8], 0
jmp 0x1004ce17
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 1
jge 0x1004ce33
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0x804], 0x8ec0ae97
jmp 0x1004ce0a
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1004ce4f
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x188], 0
jmp 0x1004ce68
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 1
jge 0x1004ce84
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x804], 0xa136951a
jmp 0x1004ce5b
mov dword [ebp - 0x898], 9
mov dword [ebp - 0xaac], 0xfffffff9
mov dword [ebp - 0xae4], 0x89be67e7
mov dword [ebp - 0xa0], 0x643c
mov dword [ebp - 0x250], 8
mov dword [ebp - 0x124], 0xed3c15d0
mov dword [ebp - 0xe0], 0xfd06bde6
mov dword [ebp - 0x1b0], 0xb1a7a81a
mov dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xab4], eax
cmp dword [ebp - 0x250], 0
jne 0x1004cf00
xor eax, eax
jne 0x1004cf00
and dword [ebp - 0x434], 0
jmp 0x1004cf0a
mov dword [ebp - 0x434], 1
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x434]
jge 0x1004cf24
mov dword [ebp - 0x6bc], 1
jmp 0x1004cf2b
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jne 0x1004cf77
mov eax, 0x13a6
test eax, eax
je 0x1004cf50
cmp dword [ebp - 0xa0], 0
cmp dword [ebp - 0xa0], 0
je 0x1004cf60
cmp dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0xa0], eax
jl 0x1004cf77
and dword [ebp - 0x43c], 0
jmp 0x1004cf81
mov dword [ebp - 0x43c], 1
cmp dword [ebp - 0x43c], 0
jg 0x1004cf96
mov dword [ebp - 0x5ec], 1
jmp 0x1004cf9d
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0xa0], 0x1e707165
jg 0x1004cfcd
mov dword [ebp - 0x444], 1
jmp 0x1004cfd4
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0xa0]
imul eax, dword [ebp - 0x444]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x1b0]
imul eax, dword [ebp - 0xe0]
test eax, eax
je 0x1004d18c
mov dword [ebp - 0x30c], 0xa41b8700
mov dword [ebp - 0x2e0], 0xfffffff9
mov dword [ebp - 0x894], 0x6c8c
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0xe0], 0
je 0x1004d044
cmp dword [ebp - 0xa0], 0
je 0x1004d044
mov dword [ebp - 0x5fc], 1
jmp 0x1004d04b
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0xaec], eax
cmp dword [ebp - 0x30c], 0x56cd219f
jl 0x1004d06f
mov dword [ebp - 0x75c], 1
jmp 0x1004d076
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0xffffffff
jl 0x1004d097
mov dword [ebp - 0x44c], 1
jmp 0x1004d09e
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 0xe34f
jne 0x1004d0b6
mov dword [ebp - 0x5f4], 1
jmp 0x1004d0bd
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x30c]
cmp dword [ebp - 0x5f4], eax
je 0x1004d0d7
mov dword [ebp - 0x454], 1
jmp 0x1004d0de
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0x454], eax
jg 0x1004d0f8
mov dword [ebp - 0x6c4], 1
jmp 0x1004d0ff
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0x6c4], eax
jge 0x1004d119
mov dword [ebp - 0x45c], 1
jmp 0x1004d120
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0x5fc]
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x124], 0xfffffffd
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x1b0], eax
jle 0x1004d174
mov dword [ebp - 0x464], 1
jmp 0x1004d17b
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0xe0], eax
jmp 0x1004d2c8
mov dword [ebp - 0x190], 0xfc5c2da5
mov dword [ebp - 0x2ac], 0xfffffff7
push 3
lea ecx, [ebp - 0xa34]
call fcn.100164e9
mov dword [ebp - 4], 9
mov dword [ebp - 0x200], 0
jmp 0x1004d1cd
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x1004d1ef
push dword [ebp - 0x200]
lea ecx, [ebp - 0xa34]
call fcn.10016587
mov dword [eax], 0xfffffff6
jmp 0x1004d1c0
mov eax, dword [ebp - 0x190]
sub eax, 6
cmp eax, dword [ebp - 0x1b0]
jne 0x1004d20c
mov dword [ebp - 0x80c], 1
jmp 0x1004d213
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x190]
imul eax, dword [ebp - 0x190]
cmp eax, 1
jl 0x1004d23a
cmp dword [ebp - 0x2ac], 0
je 0x1004d23a
mov dword [ebp - 0x72c], 1
jmp 0x1004d241
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x2ac], 0
je 0x1004d262
mov dword [ebp - 0x46c], 1
jmp 0x1004d269
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
je 0x1004d293
cmp dword [ebp - 0x190], 0
je 0x1004d293
mov dword [ebp - 0x604], 1
jmp 0x1004d29a
and dword [ebp - 0x604], 0
imul esi, dword [ebp - 0x604], 0xfff7
add esi, dword [ebp - 0x2ac]
push 2
lea ecx, [ebp - 0xa34]
call fcn.10016587
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa34]
call fcn.1001656b
mov dword [ebp - 0xac4], 0x33c8a0c0
mov dword [ebp - 0xafc], 0xfffffffa
mov dword [ebp - 0xe8], 0xbc6e5c7a
mov dword [ebp - 0x160], 0x54bcd76c
mov dword [ebp - 0x148], 0xfffffffd
cmp dword [ebp - 0xe8], 0
je 0x1004d334
cmp dword [ebp - 0xe8], 0
je 0x1004d318
mov dword [ebp - 0x474], 1
jmp 0x1004d31f
and dword [ebp - 0x474], 0
cmp dword [ebp - 0x474], 0xffffffff
jle 0x1004d334
mov dword [ebp - 0x6cc], 1
jmp 0x1004d33b
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0xe8]
imul eax, dword [ebp - 0x6cc]
xor ecx, ecx
inc ecx
sub ecx, eax
mov dword [ebp - 0x160], ecx
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x160], eax
je 0x1004d36d
mov dword [ebp - 0x47c], 1
jmp 0x1004d374
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x148]
add eax, dword [ebp - 0x47c]
je 0x1004d393
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x160], eax
jmp 0x1004d49d
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x1004d3c9
push 0x133
push 0
push 0
push 0
push 0
push 0x21bf
push 0x2143
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
mov dword [ebp - 0x148], 0xffffffe5
jmp 0x1004d3e2
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xffffffed
jle 0x1004d49d
mov dword [ebp - 0x1a8], 0xfffffffe
cmp dword [ebp - 0x1a8], 0
je 0x1004d417
cmp dword [ebp - 0x160], 0
je 0x1004d417
mov dword [ebp - 0x60c], 1
jmp 0x1004d41e
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x1a8], 0xffffffe6
jmp 0x1004d443
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x1f
jge 0x1004d498
mov dword [ebp - 0xe8], 0
jmp 0x1004d465
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x1004d496
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1004d494
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x1004d458
jmp 0x1004d436
jmp 0x1004d3d5
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1004d4cc
push 0x24bf
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
mov dword [ebp - 0xacc], 0x52783de7
mov dword [ebp - 0x890], 0xffeac8e4
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x208], 0xfffffffa
mov dword [ebp - 0x814], 0xef33
mov dword [ebp - 0x290], 0
jmp 0x1004d51e
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 3
jge 0x1004d53a
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0xe64], 0xcd546735
jmp 0x1004d511
cmp dword [ebp - 0x38], 0x1124f01c
jg 0x1004d72d
mov dword [ebp - 0x61c], 0x78d8
mov dword [ebp - 0x38], 0
jmp 0x1004d561
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xd
jne 0x1004d599
mov dword [ebp - 0x88c], 0x1249
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1004d58b
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x208], eax
jmp 0x1004d55a
cmp dword [ebp - 0x61c], 1
jle 0x1004d5ae
mov dword [ebp - 0x2b4], 1
jmp 0x1004d5b5
and dword [ebp - 0x2b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2b4]
mov dword [ebp + eax - 0xe64], ecx
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x2b4], eax
jl 0x1004d5e2
mov dword [ebp - 0x484], 1
jmp 0x1004d5e9
and dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 0xfffffffe
jne 0x1004d5fe
mov dword [ebp - 0x784], 1
jmp 0x1004d605
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x784], eax
jne 0x1004d61c
mov dword [ebp - 0x48c], 1
jmp 0x1004d623
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x48c]
jge 0x1004d63a
mov dword [ebp - 0x614], 1
jmp 0x1004d641
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0xd714f98c
je 0x1004d659
mov dword [ebp - 0x494], 1
jmp 0x1004d660
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x208]
cmp eax, dword [ebp - 0x494]
je 0x1004d67a
mov dword [ebp - 0x6d4], 1
jmp 0x1004d681
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x6d4], eax
jg 0x1004d698
mov dword [ebp - 0x49c], 1
jmp 0x1004d69f
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x49c]
jl 0x1004d6b6
mov dword [ebp - 0x4a4], 1
jmp 0x1004d6bd
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x61c]
cmp dword [ebp - 0x4a4], eax
jge 0x1004d6d7
mov dword [ebp - 0x734], 1
jmp 0x1004d6de
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x734], 1
jne 0x1004d6f3
mov dword [ebp - 0x4ac], 1
jmp 0x1004d6fa
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 0xf6a0
jg 0x1004d712
mov dword [ebp - 0x624], 1
jmp 0x1004d719
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x814]
add eax, dword [ebp - 0x624]
mov dword [ebp - 0x208], eax
jmp 0x1004d745
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x1004d745
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov dword [ebp - 0xf0], 0x40d7f825
mov dword [ebp - 0x968], 6
mov dword [ebp - 0x964], 6
mov dword [ebp - 0x960], 6
mov dword [ebp - 0x95c], 6
lea ecx, [ebp - 0x2ee]
call fcn.10008b13
push eax
lea eax, [ebp - 0x958]
push eax
lea eax, [ebp - 0x968]
push eax
lea ecx, [ebp - 0xf00]
call fcn.10016596
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc44]
call fcn.10016545
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x73c], 0
mov dword [ebp - 0x198], 0xf69a0165
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1004d7f6
push 0
push 0x588
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov dword [ebp - 0xf0], 0
jmp 0x1004d80f
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x1d
jne 0x1004dd16
mov dword [ebp - 0x990], 0x772304b2
mov dword [ebp - 0x98c], 0x772304b2
mov dword [ebp - 0x988], 0x772304b2
mov dword [ebp - 0x984], 0x772304b2
lea ecx, [ebp - 0x2bd]
call fcn.10008b13
push eax
lea eax, [ebp - 0x980]
push eax
lea eax, [ebp - 0x990]
push eax
lea ecx, [ebp - 0xed8]
call fcn.10016596
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x798]
call fcn.10016545
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x6dc], 0x81eca6c8
push 2
lea ecx, [ebp - 0xc34]
call fcn.100164e9
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x258], 0
jmp 0x1004d8b8
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 2
jge 0x1004d8da
push dword [ebp - 0x258]
lea ecx, [ebp - 0xc34]
call fcn.10016587
mov dword [eax], 7
jmp 0x1004d8ab
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1004d904
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
mov dword [ebp - 0x1c], 0
jmp 0x1004d914
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1004dcf3
mov dword [ebp - 0x150], 0xa445a8cc
mov dword [ebp - 0xb04], 0x58e9d28b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x798]
call fcn.10016587
cmp dword [eax], 0xec21
jne 0x1004d954
mov dword [ebp - 0x4b4], 1
jmp 0x1004d95b
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x6dc], eax
jl 0x1004d984
mov dword [ebp - 0x4bc], 1
jmp 0x1004d98b
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x4bc]
add eax, ecx
cmp eax, dword [ebp - 0x1c]
jne 0x1004d9ae
mov dword [ebp - 0x62c], 1
jmp 0x1004d9b5
and dword [ebp - 0x62c], 0
push 1
lea ecx, [ebp - 0x798]
call fcn.10016587
mov eax, dword [eax]
cmp eax, dword [ebp - 0x62c]
jl 0x1004d9d8
mov dword [ebp - 0x4c4], 1
jmp 0x1004d9df
and dword [ebp - 0x4c4], 0
push 1
lea ecx, [ebp - 0x798]
call fcn.10016587
mov ecx, dword [ebp - 0x4c4]
add ecx, dword [eax]
cmp ecx, 0xfffffffd
je 0x1004da05
mov dword [ebp - 0x764], 1
jmp 0x1004da0c
and dword [ebp - 0x764], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x798]
call fcn.10016587
mov esi, eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x798]
call fcn.10016587
mov ecx, dword [esi]
add ecx, dword [eax]
imul eax, dword [ebp - 0x764], 0x2b4b
cmp ecx, eax
je 0x1004da48
mov dword [ebp - 0x4cc], 1
jmp 0x1004da4f
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x150], 3
jmp 0x1004da74
cmp dword [ebp - 0x150], 0
jl 0x1004dcee
mov dword [ebp - 0x2bc], 0xd28e4879
mov dword [ebp - 0x4d4], 0xa0c09020
mov dword [ebp - 0x1b8], 0x3de76903
mov dword [ebp - 0xb0c], 0x5c8bb6af
cmp dword [ebp - 0xf0], 0
je 0x1004db0f
cmp dword [ebp - 0x1c], 0
je 0x1004dacd
cmp dword [ebp - 0x2bc], 0
je 0x1004dacd
mov dword [ebp - 0x634], 1
jmp 0x1004dad4
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x150]
add eax, dword [ebp - 0x4d4]
imul eax, dword [ebp - 0x1b8]
test eax, eax
je 0x1004db0f
mov dword [ebp - 0x6e4], 1
jmp 0x1004db16
and dword [ebp - 0x6e4], 0
push 3
lea ecx, [ebp - 0xc44]
call fcn.10016587
mov dword [eax], 0x5fcb
cmp dword [ebp - 0x6e4], 0x5fcb
jl 0x1004db41
mov dword [ebp - 0x63c], 1
jmp 0x1004db48
and dword [ebp - 0x63c], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x798]
call fcn.10016587
mov dword [ebp - 0x4dc], eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x798]
call fcn.10016587
mov ecx, dword [ebp - 0x4dc]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x4dc]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x63c]
jne 0x1004db90
mov dword [ebp - 0x4e4], 1
jmp 0x1004db97
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x198], 3
jmp 0x1004dbc8
cmp dword [ebp - 0x198], 0
jl 0x1004dce9
jmp 0x1004d90d
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xc34]
call fcn.1001656b
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x798]
call fcn.1001656b
jmp 0x1004d802
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc44]
call fcn.1001656b
mov dword [ebp - 0x64], 0
jmp 0x1004dd35
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1004dd4b
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xc84], 0xd7f825e7
jmp 0x1004dd2e
mov dword [ebp - 0x64], 0
jmp 0x1004dd5b
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1004dd71
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xe40], 0xfffffff7
jmp 0x1004dd54
mov dword [ebp - 0x280], 2
jmp 0x1004dd8a
cmp dword [ebp - 0x280], 0
jl 0x1004e60a
mov dword [ebp - 0x20], 0x915a
mov dword [ebp - 0x17c], 1
mov dword [ebp - 0x218], 0
jmp 0x1004ddc1
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 3
jge 0x1004dddd
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0x7b0], 0xfffffffd
jmp 0x1004ddb4
mov dword [ebp - 0x20], 0x8ec0ae97
mov dword [ebp - 0x20], 0
jmp 0x1004ddf4
cmp dword [ebp - 0x20], 2
jg 0x1004e0bd
mov dword [ebp - 0x90], 0xffffffff
mov eax, 0x3061ece3
test eax, eax
je 0x1004de3a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7b0]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x7b0]
cmp dword [ebp - 0x90], eax
jne 0x1004de3a
cmp dword [ebp - 0x20], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7b0], 0x4bcd
je 0x1004de59
mov dword [ebp - 0x644], 1
jmp 0x1004de60
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x644], eax
jge 0x1004de81
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x7b0], 0
jne 0x1004de81
and dword [ebp - 0x4f4], 0
jmp 0x1004de8b
mov dword [ebp - 0x4f4], 1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x7b0]
cmp eax, dword [ebp - 0x4f4]
jl 0x1004dea9
mov dword [ebp - 0x6ec], 1
jmp 0x1004deb0
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x90], 0x6eab3cf8
jge 0x1004ded4
mov dword [ebp - 0x4fc], 1
jmp 0x1004dedb
and dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x4fc], 0xeec54165
jbe 0x1004e06b
mov dword [ebp - 0x6c], 1
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xc48], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xae0], eax
xor eax, eax
inc eax
cmp eax, 0xe44f
jge 0x1004df23
mov eax, 0x37b187b3
test eax, eax
je 0x1004df23
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x64c], eax
jne 0x1004df41
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x1004e088
push 0x4a8
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov byte [ebp - 0xac], 0
movzx eax, byte [ebp - 0xac]
test eax, eax
je 0x1004e0b8
mov dword [ebp - 0x170], 0xb3b9da4d
mov dword [ebp - 0xc58], 1
push 4
lea ecx, [ebp - 0xc54]
call fcn.100164e9
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x220], 1
mov dword [ebp - 0xd94], 0xffffffff
mov dword [ebp - 0xd90], 0xffffffff
mov dword [ebp - 0xd8c], 0xffffffff
mov dword [ebp - 0xd88], 0xffffffff
mov dword [ebp - 0x260], 0
jmp 0x1004e130
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 4
jge 0x1004e152
push dword [ebp - 0x260]
lea ecx, [ebp - 0xc54]
call fcn.10016587
mov dword [eax], 4
jmp 0x1004e123
mov dword [ebp - 0x220], 0
jmp 0x1004e16b
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 3
jg 0x1004e1c0
mov dword [ebp - 0x2a0], 1
mov dword [ebp - 0x2a0], 3
jmp 0x1004e197
cmp dword [ebp - 0x2a0], 0
jl 0x1004e1be
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x1004e1bc
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x1004e18a
jmp 0x1004e15e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc54]
call fcn.1001656b
mov dword [ebp - 0x824], 0x57257ea0
push 3
lea ecx, [ebp - 0xc74]
call fcn.100164e9
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x268], 8
mov dword [ebp - 0x514], 1
mov dword [ebp - 0x228], 0
jmp 0x1004e21a
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jge 0x1004e23c
push dword [ebp - 0x228]
lea ecx, [ebp - 0xc74]
call fcn.10016587
mov dword [eax], 0x7571177e
jmp 0x1004e20d
mov dword [ebp - 0x268], 2
jmp 0x1004e255
cmp dword [ebp - 0x268], 0
jl 0x1004e3e9
mov dword [ebp - 0xf8], 0xffffffff
mov dword [ebp - 0x1cc], 6
mov dword [ebp - 0x1d4], 0
push 1
lea ecx, [ebp - 0x8e4]
call fcn.100164e9
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x54c], 0xbbfad0d7
mov dword [ebp - 0x1c8], 0
jmp 0x1004e65f
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 1
jge 0x1004e681
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0x8e4]
call fcn.10016587
mov dword [eax], 0x34e1054
jmp 0x1004e652
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x1004e69e
push 0x4a8
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [ebp - 0xf8], 0
je 0x1004e6bc
mov eax, 0x5faafe30
test eax, eax
je 0x1004e6bc
mov dword [ebp - 0x674], 1
jmp 0x1004e6c3
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d4], eax
je 0x1004e6f8
cmp dword [ebp - 0x1d4], 0
je 0x1004e6f8
mov dword [ebp - 0x664], 1
jmp 0x1004e6ff
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x664], eax
jge 0x1004e719
mov dword [ebp - 0x534], 1
jmp 0x1004e720
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 5
jb 0x1004e735
mov dword [ebp - 0x6fc], 1
jmp 0x1004e73c
and dword [ebp - 0x6fc], 0
cmp dword [ebp - 0x6fc], 0xf4ea
jl 0x1004e754
mov dword [ebp - 0x53c], 1
jmp 0x1004e75b
and dword [ebp - 0x53c], 0
imul eax, dword [ebp - 0x53c], 0xfffffff8
imul eax, dword [ebp - 0xf8]
cmp eax, 0xd77c
jl 0x1004e77c
mov dword [ebp - 0x66c], 1
jmp 0x1004e783
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0xf8]
imul eax, dword [ebp - 0x66c]
test eax, eax
je 0x1004e79b
cmp dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0xb18], eax
push 0
lea ecx, [ebp - 0x8e4]
call fcn.10016587
cmp dword [eax], 0xa5b7
je 0x1004e7c8
mov dword [ebp - 0x544], 1
jmp 0x1004e7cf
and dword [ebp - 0x544], 0
cmp dword [ebp - 0x544], 6
jae 0x1004e7e4