Function at 0x4aab6e
Capabilities:
Encrypt data using speck
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce563
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xda8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x108], 0
push 2
lea ecx, [ebp - 0xba8]
call fcn.0040bdd2
mov dword [ebp - 0x120], 0
jmp 0x4aabc3
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x4aabe5
push dword [ebp - 0x120]
lea ecx, [ebp - 0xba8]
call fcn.0040bec0
mov dword [eax], 0x2afe
jmp 0x4aabb6
mov dword [ebp - 0x108], 0xfffffff7
mov dword [ebp - 0x108], 0
jmp 0x4aac08
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jg 0x4aac2d
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x4aac2b
push 0
call dword [sym.imp.USER32.dll_CharNextW]
jmp 0x4aabfb
lea ecx, [ebp - 0xba8]
call fcn.0040bea4
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0x28c], 0x3b9da4d0
mov dword [ebp - 0x244], 0xfff7
push 3
lea ecx, [ebp - 0x7dc]
call fcn.0040bdd2
mov dword [ebp - 0xf0], 0xc62bb2c5
mov dword [ebp - 0x588], 0x4db
mov dword [ebp - 0x7fc], str.qenagoyva_omrwrd_eulgq_eoaxhvdgy_rynztoy_ldbbkg_ztc_kfvsmc_mlwcbjeww_hwdys_wwtygx_dszafr_jxuetd
cmp dword [ebp - 0x588], 0x68e
jle 0x4aad0e
and dword [ebp - 0x134], 0
jmp 0x4aacad
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x35f1
jge 0x4aad0e
and dword [ebp - 0x138], 0
jmp 0x4aaccf
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x658e
jge 0x4aad0c
mov eax, dword [ebp - 0x134]
and eax, dword [ebp - 0x138]
cdq
mov dword [ebp - 0x860], eax
mov dword [ebp - 0x85c], edx
push dword [ebp - 0x85c]
push dword [ebp - 0x860]
mov ecx, 0xaa47f8
call fcn.0040bbab
jmp 0x4aacc2
jmp 0x4aaca0
and dword [ebp - 4], 0
cmp dword [ebp - 0x588], 0x116
jge 0x4aad2e
mov edx, dword [ebp - 0x7fc]
mov ecx, 0xaa47f8
call fcn.0040e430
jmp 0x4aad4a
or dword [ebp - 4], 0xffffffff
jmp 0x4aad54
mov dword [ebp - 0x5c], 0
jmp 0x4aad64
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x4aad80
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x7dc]
call fcn.0040bec0
mov dword [eax], 0x9d6b9c2d
jmp 0x4aad5d
mov dword [ebp - 0x5c], 0
jmp 0x4aad90
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x4aada6
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xa10], 0xfffffff6
jmp 0x4aad89
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x244], 0
je 0x4aadf3
cmp dword [ebp - 0x28c], 0
je 0x4aadd9
cmp dword [ebp - 0xc4], 0
je 0x4aadd9
mov dword [ebp - 0x770], 1
jmp 0x4aade0
and dword [ebp - 0x770], 0
imul eax, dword [ebp - 0x244], 0xfffffff8
sub eax, dword [ebp - 0x770]
cmp eax, dword [ebp - 0xc4]
push 0
lea ecx, [ebp - 0x7dc]
call fcn.0040bec0
push 0
lea ecx, [ebp - 0x7dc]
call fcn.0040bec0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xc84], eax
mov eax, 0xffff
test eax, eax
je 0x4aae33
xor eax, eax
inc eax
je 0x4aae33
mov dword [ebp - 0x778], 1
jmp 0x4aae3a
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0xf0], eax
jle 0x4aae60
mov dword [ebp - 0x780], 1
jmp 0x4aae67
and dword [ebp - 0x780], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x780]
mov dword [ebp + eax - 0xa10], ecx
or eax, 0xffffffff
je 0x4aaf42
xor eax, eax
jne 0x4aaf17
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xc48], eax
push 0
lea ecx, [ebp - 0x7dc]
call fcn.0040bec0
mov ecx, 0x913e29f9
sub ecx, dword [eax]
cmp ecx, 1
jne 0x4aaebc
mov dword [ebp - 0x788], 1
jmp 0x4aaec3
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0x788]
test eax, eax
je 0x4aaee9
mov eax, 0x49ef
test eax, eax
je 0x4aaee9
mov dword [ebp - 0x8d0], 1
jmp 0x4aaef0
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xb5c], eax
push 1
lea ecx, [ebp - 0x7dc]
call fcn.0040bec0
cmp dword [eax], 0
jne 0x4aaf17
and dword [ebp - 0x8d8], 0
jmp 0x4aaf21
mov dword [ebp - 0x8d8], 1
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0xc3c], eax
cmp dword [ebp - 0xc4], 0
je 0x4aaf42
mov dword [ebp - 0x74c], 1
jmp 0x4aaf49
and dword [ebp - 0x74c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa10]
add eax, dword [ebp - 0x74c]
mov dword [ebp - 0xf0], eax
lea ecx, [ebp - 0x7dc]
call fcn.0040bea4
push 2
lea ecx, [ebp - 0xbd8]
call fcn.0040bdd2
mov dword [ebp - 0x7f8], 0xfffffff9
mov dword [ebp - 0x7f4], 0xfffffff9
mov dword [ebp - 0x7f0], 0xfffffff9
mov dword [ebp - 0x7ec], 0xfffffff9
mov dword [ebp - 0x24c], 0xfffffff9
mov dword [ebp - 0x2dc], 0xffffffff
mov dword [ebp - 0x63c], 0xffff
mov dword [ebp - 0x2ec], 0xfffffffb
mov dword [ebp - 0x634], 0x627e80a7
mov dword [ebp - 0x1f8], 0
jmp 0x4aafed
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jge 0x4ab009
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0xb88], 5
jmp 0x4aafe0
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x7f8], 0x8bbca631
xor eax, eax
inc eax
je 0x4ab05f
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x140], 0
jmp 0x4ab042
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 9
jl 0x4ab05a
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
jmp 0x4ab035
jmp 0x4ab21c
mov dword [ebp - 0xe8], 0xaae0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x7f8], 0
je 0x4ab18c
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7f8]
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 1
jne 0x4ab0a5
mov dword [ebp - 0x624], 1
jmp 0x4ab0ac
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
sub eax, dword [ebp - 0x24c]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x7f8]
sub ecx, dword [ebp - 0xe8]
cmp eax, ecx
jge 0x4ab0e8
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x7f8], 0
jne 0x4ab0e8
and dword [ebp - 0x2e4], 0
jmp 0x4ab0f2
mov dword [ebp - 0x2e4], 1
mov eax, dword [ebp - 0x2e4]
sub eax, dword [ebp - 0xe8]
mov dword [ebp - 0x8e0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8e0]
mov dword [ebp + eax - 0xb88], ecx
imul eax, dword [ebp - 0x63c], 5
test eax, eax
jne 0x4ab12f
xor eax, eax
jne 0x4ab12f
and dword [ebp - 0x62c], 0
jmp 0x4ab139
mov dword [ebp - 0x62c], 1
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x634], eax
jne 0x4ab16b
mov dword [ebp - 0x2f4], 1
jmp 0x4ab172
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x2f4]
sub eax, dword [ebp - 0x63c]
je 0x4ab18c
mov dword [ebp - 0x2fc], 1
jmp 0x4ab193
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0xe8]
add eax, dword [ebp - 0x2fc]
cmp eax, dword [ebp - 0xe8]
jg 0x4ab1b3
mov dword [ebp - 0x644], 1
jmp 0x4ab1ba
and dword [ebp - 0x644], 0
cmp dword [ebp - 0x644], 0xffffffff
jge 0x4ab1cf
mov dword [ebp - 0x304], 1
jmp 0x4ab1d6
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x304]
neg eax
je 0x4ab200
mov byte [ebp - 0x9e], 0
movzx eax, byte [ebp - 0x9e]
test eax, eax
je 0x4ab1fe
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
jmp 0x4ab21c
mov byte [ebp - 0xa0], 0
movzx eax, byte [ebp - 0xa0]
test eax, eax
je 0x4ab21c
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov dword [ebp - 0x44], 0xac204e2d
mov dword [ebp - 0x900], 0xffffffff
mov dword [ebp - 0xb64], 0xfffffff9
mov dword [ebp - 0x908], 0xcf687292
mov dword [ebp - 0x1a8], 0
jmp 0x4ab25a
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 1
jge 0x4ab276
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x31c], 4
jmp 0x4ab24d
mov dword [ebp - 0x44], 0
jmp 0x4ab286
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffff3
jne 0x4ab51a
mov dword [ebp - 0x2ac], 0x3888
mov dword [ebp - 0x910], 0x2ef703c5
mov dword [ebp - 0x32c], 0x11fc80ae
mov dword [ebp - 0xc50], 0xe3f36a5b
push 3
lea ecx, [ebp - 0xb24]
call fcn.0040bdd2
mov dword [ebp - 0x664], 0xbab1f356
mov dword [ebp - 0x20], 0
jmp 0x4ab2df
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x4ab2f5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x86c], 0xcadfb1af
jmp 0x4ab2d8
mov dword [ebp - 0x20], 0
jmp 0x4ab305
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x4ab31b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa18], 0
jmp 0x4ab2fe
mov dword [ebp - 0x20], 0
jmp 0x4ab32b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x4ab347
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb24]
call fcn.0040bec0
mov dword [eax], 0x2932384
jmp 0x4ab324
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x44], eax
jle 0x4ab367
mov dword [ebp - 0x8e8], 1
jmp 0x4ab36e
and dword [ebp - 0x8e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa18]
inc eax
mov dword [ebp - 0x64c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x64c]
mov dword [ebp + eax - 0xa18], ecx
cmp dword [ebp - 0x64c], 0
jne 0x4ab3aa
mov dword [ebp - 0x30c], 1
jmp 0x4ab3b1
and dword [ebp - 0x30c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x86c]
cmp dword [ebp - 0x30c], eax
jg 0x4ab3d2
mov dword [ebp - 0x8f0], 1
jmp 0x4ab3d9
and dword [ebp - 0x8f0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x86c]
mov dword [ebp - 0xc58], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x44], eax
jle 0x4ab40c
mov dword [ebp - 0x654], 1
jmp 0x4ab413
and dword [ebp - 0x654], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x654]
sub ecx, dword [ebp + eax - 0x31c]
je 0x4ab43d
cmp dword [ebp - 0x32c], 0
je 0x4ab43d
mov dword [ebp - 0x314], 1
jmp 0x4ab444
and dword [ebp - 0x314], 0
cmp dword [ebp - 0x314], 3
je 0x4ab459
mov dword [ebp - 0x65c], 1
jmp 0x4ab460
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x2ac]
imul eax, dword [ebp - 0x65c]
mov dword [ebp - 0x8f8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8f8]
mov dword [ebp + eax - 0x31c], ecx
push 0
lea ecx, [ebp - 0xb24]
call fcn.0040bec0
mov eax, dword [eax]
add eax, 0x4fb389fa
sub eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x664], eax
je 0x4ab4d6
cmp dword [ebp - 0x900], 0
je 0x4ab4d6
cmp dword [ebp - 0x908], 0
je 0x4ab4d6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x86c], 0
je 0x4ab4d6
mov dword [ebp - 0x324], 1
jmp 0x4ab4dd
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x910]
cmp dword [ebp - 0x324], eax
jne 0x4ab4f7
mov dword [ebp - 0x66c], 1
jmp 0x4ab4fe
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x32c], eax
lea ecx, [ebp - 0xb24]
call fcn.0040bea4
jmp 0x4ab27f
mov byte [ebp - 0xa8], 0
movzx eax, byte [ebp - 0xa8]
test eax, eax
je 0x4ab534
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
mov dword [ebp - 0x148], 0
jmp 0x4ab54d
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x4ab56f
push dword [ebp - 0x148]
lea ecx, [ebp - 0xbd8]
call fcn.0040bec0
mov dword [eax], 0x2afe
jmp 0x4ab540
mov dword [ebp - 0xf8], 0xfffffff7
mov dword [ebp - 0x150], 0x53b26bdd
push 3
lea ecx, [ebp - 0xbb8]
call fcn.0040bdd2
mov dword [ebp - 0x674], 0xee28fdeb
mov dword [ebp - 0x1d8], 0
jmp 0x4ab5b3
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jge 0x4ab5d5
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0xbb8]
call fcn.0040bec0
mov dword [eax], 0x6318d581
jmp 0x4ab5a6
mov dword [ebp - 0x150], 0
jmp 0x4ab5ee
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jg 0x4ab66f
mov dword [ebp - 0xca0], 0xed15
mov dword [ebp - 0xb7c], 0x85b7f37c
mov dword [ebp - 0x1b0], 0
jmp 0x4ab624
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jge 0x4ab640
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0xd70], 0x1b88146c
jmp 0x4ab617
mov eax, dword [ebp - 0x674]
dec eax
mov dword [ebp - 0x674], eax
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x4ab66a
push 0x24d5
call dword [sym.imp.GDI32.dll_GetBkColor]
jmp 0x4ab5e1
lea ecx, [ebp - 0xbb8]
call fcn.0040bea4
mov dword [ebp - 0xf8], 0
jmp 0x4ab693
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jg 0x4ac0d1
mov dword [ebp - 0xd8], 8
mov dword [ebp - 0x808], 0x5872
mov dword [ebp - 0x25c], 0xdca27289
mov dword [ebp - 0x854], 0xfffffff6
push 1
lea ecx, [ebp - 0x9c0]
call fcn.0040bdd2
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x294], 0x15e0c0a1
mov dword [ebp - 0x158], 0
jmp 0x4ab702
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x4ab724
push dword [ebp - 0x158]
lea ecx, [ebp - 0x9c0]
call fcn.0040bec0
mov dword [eax], 1
jmp 0x4ab6f5
mov dword [ebp - 0xd8], 0
jmp 0x4ab73d
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jne 0x4abaf7
mov dword [ebp - 0x99c], 0xb34e
mov dword [ebp - 0x95c], 0x6b8d9637
mov dword [ebp - 0xc4c], 0
mov dword [ebp - 0xc54], 0xffffffff
mov dword [ebp - 0xb9c], 0x3ccd2466
mov dword [ebp - 0x8ec], 0xd5493e6
mov dword [ebp - 0xc98], 0
mov dword [ebp - 0x334], 0x6cbd
mov dword [ebp - 0x918], str.oyz_nzc_ebqy_iwehu_rvourdu_npd_abqbtwha_kfewxipi_ocquq_bzrfhxph
cmp dword [ebp - 0x334], 0x6fa6
jle 0x4ab85d
and dword [ebp - 0x1f0], 0
jmp 0x4ab7ca
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x1087
jge 0x4ab85d
and dword [ebp - 0x160], 0
jmp 0x4ab7f0
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x40eb
jge 0x4ab858
and dword [ebp - 0x1b8], 0
jmp 0x4ab812
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0x674a
jge 0x4ab856
mov eax, dword [ebp - 0x1f0]
imul eax, dword [ebp - 0x160]
xor eax, dword [ebp - 0x1b8]
cdq
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x874], edx
push dword [ebp - 0x874]
push dword [ebp - 0x878]
mov ecx, 0xaa47f8
call fcn.0040bbab
jmp 0x4ab805
jmp 0x4ab7e3
jmp 0x4ab7bd
mov dword [ebp - 0xbac], 0xa14c5530
mov dword [ebp - 4], 2
cmp dword [ebp - 0x334], 0x69ba
jge 0x4ab88a
mov edx, dword [ebp - 0x918]
mov ecx, 0xaa47f8
call fcn.0040e430
jmp 0x4ab8a6
or dword [ebp - 4], 0xffffffff
jmp 0x4ab8b0
mov dword [ebp - 0x69c], 1
mov dword [ebp - 0x354], 1
mov dword [ebp - 0x810], 4
mov dword [ebp - 0xc5c], 0xfffffffb
mov dword [ebp - 0x818], 0xc826ffea
mov dword [ebp - 0x168], 0
jmp 0x4ab8fb
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x4ab917
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0xc80], 0x3acb6d64
jmp 0x4ab8ee
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0xbbc], eax
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0xc88], eax
cmp dword [ebp - 0x854], 0
jne 0x4ab944
mov dword [ebp - 0x67c], 1
jmp 0x4ab94b
and dword [ebp - 0x67c], 0
push 0
lea ecx, [ebp - 0x9c0]
call fcn.0040bec0
mov ecx, dword [ebp - 0x67c]
cmp ecx, dword [eax]
je 0x4ab96e
mov dword [ebp - 0x684], 1
jmp 0x4ab975
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
imul eax, dword [ebp - 0x684]
test eax, eax
je 0x4ab9ae
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc80], 0
je 0x4ab9ae
mov dword [ebp - 0x254], 1
jmp 0x4ab9b5
and dword [ebp - 0x254], 0
push 0
lea ecx, [ebp - 0x9c0]
call fcn.0040bec0
mov ecx, dword [ebp - 0x254]
mov dword [eax], ecx
mov eax, dword [ebp - 0x254]
sub eax, dword [ebp - 0x69c]
cmp eax, dword [ebp - 0xd8]
jge 0x4ab9ea
mov dword [ebp - 0x344], 1
jmp 0x4ab9f1
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x8e4], eax
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x83c]
cmp eax, dword [ebp - 0x8e4]
jle 0x4aba30
mov dword [ebp - 0x68c], 1
jmp 0x4aba37
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x810]
imul eax, dword [ebp - 0x68c]
test eax, eax
jne 0x4aba5a
cmp dword [ebp - 0x25c], 0
jne 0x4aba5a
and dword [ebp - 0x34c], 0
jmp 0x4aba64
mov dword [ebp - 0x34c], 1
mov eax, dword [ebp - 0x95c]
cmp dword [ebp - 0x34c], eax
jl 0x4aba7e
mov dword [ebp - 0x694], 1
jmp 0x4aba85
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x354], eax
imul eax, dword [ebp - 0x354], 0x37e1
cmp eax, dword [ebp - 0x25c]
jl 0x4abaaf
mov dword [ebp - 0x35c], 1
jmp 0x4abab6
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x69c]
cmp dword [ebp - 0x35c], eax
jne 0x4abad6
cmp dword [ebp - 0x818], 0
jne 0x4abad6
and dword [ebp - 0x6a4], 0
jmp 0x4abae0
mov dword [ebp - 0x6a4], 1
mov eax, dword [ebp - 0xd8]
sub eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x8ec], eax
jmp 0x4ab730
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x4abb14
push 0x84e
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
lea ecx, [ebp - 0x9c0]
call fcn.0040bea4
mov byte [ebp - 0x9a], 0
mov dword [ebp - 0x28], 0xb064
push 4
lea ecx, [ebp - 0xb0c]
call fcn.0040bdd2
mov dword [ebp - 0x36c], 1
mov dword [ebp - 0x37c], 7
push 2
lea ecx, [ebp - 0x7c4]
call fcn.0040bdd2
mov dword [ebp - 0x2b4], 0x440271db
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x828], 0xfffffff9
mov dword [ebp - 0x8f4], 0xffffffff
mov dword [ebp - 0x80], 0
jmp 0x4abb93
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x4abbaf
push dword [ebp - 0x80]
lea ecx, [ebp - 0xb0c]
call fcn.0040bec0
mov dword [eax], 0x7c10
jmp 0x4abb8c
mov dword [ebp - 0x80], 0
jmp 0x4abbbf
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x4abbdb
push dword [ebp - 0x80]
lea ecx, [ebp - 0x7c4]
call fcn.0040bec0
mov dword [eax], 0xfffffffd
jmp 0x4abbb8
cmp dword [ebp - 0x28], 0x90a624cd
ja 0x4abbf0
mov dword [ebp - 0x364], 1
jmp 0x4abbf7
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x364]
jg 0x4abc0e
mov dword [ebp - 0x6b4], 1
jmp 0x4abc15
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x28], 0
jne 0x4abc2a
cmp dword [ebp - 0x28], 0
jne 0x4abc2a
and dword [ebp - 0x2bc], 0
jmp 0x4abc34
mov dword [ebp - 0x2bc], 1
push 1
lea ecx, [ebp - 0xb0c]
call fcn.0040bec0
mov ecx, dword [ebp - 0x2bc]
mov dword [eax], ecx
cmp dword [ebp - 0x2bc], 0xfffffff6
jle 0x4abc5e
mov dword [ebp - 0x6ac], 1
jmp 0x4abc65
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x6ac]
jne 0x4abc7c
mov dword [ebp - 0x820], 1
jmp 0x4abc83
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xbcc], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc64], eax
mov eax, dword [ebp - 0x36c]
imul eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x36c]
je 0x4abcb3
mov dword [ebp - 0x374], 1
jmp 0x4abcba
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x6b4]
cmp eax, dword [ebp - 0x374]
jge 0x4abe24
mov dword [ebp - 0x264], 0xfffffffb
mov dword [ebp - 0x9a8], 0xb379
push 1
lea ecx, [ebp - 0x7c4]
call fcn.0040bec0
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x6bc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x6bc]
mov dword [ecx], eax
cmp dword [ebp - 0x264], 0
jne 0x4abde8
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x37c], eax
jne 0x4abd37
mov dword [ebp - 0x384], 1
jmp 0x4abd3e
and dword [ebp - 0x384], 0
mov dword [ebp - 0x2b4], 1
cmp dword [ebp - 0x2b4], 0
jne 0x4abda5
push 1
lea ecx, [ebp - 0x7c4]
call fcn.0040bec0
push 9
pop eax
cmp eax, 1
jg 0x4abd72
mov dword [ebp - 0x6c4], 1
jmp 0x4abd79
and dword [ebp - 0x6c4], 0
push 1
lea ecx, [ebp - 0x7c4]
call fcn.0040bec0
mov ecx, dword [ebp - 0x6c4]
imul ecx, dword [eax]
add ecx, 0x2b2faa96
imul eax, ecx, 5
test eax, eax
jne 0x4abda5
and dword [ebp - 0x6cc], 0
jmp 0x4abdaf
mov dword [ebp - 0x6cc], 1
mov eax, dword [ebp - 0x384]
imul eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x1e0], eax
mov esi, dword [ebp - 0x1e0]
add esi, 0x33b8
push 1
lea ecx, [ebp - 0x7c4]
call fcn.0040bec0
cmp esi, dword [eax]
je 0x4abde8
and dword [ebp - 0x38c], 0
jmp 0x4abdf2
mov dword [ebp - 0x38c], 1
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x38c], eax
jne 0x4abe0c
mov dword [ebp - 0x6d4], 1
jmp 0x4abe13
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x828], eax
jmp 0x4abfc0
mov dword [ebp - 0x394], 0x6a75
mov dword [ebp - 0xad4], 0x8c84060a
mov dword [ebp - 0xad0], 0x8c84060a
mov dword [ebp - 0xacc], 0x8c84060a
mov dword [ebp - 0xac8], 0x8c84060a
lea ecx, [ebp - 0x2be]
call fcn.0040becf
push eax
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp - 0xad4]
push eax
lea ecx, [ebp - 0xcfc]
call fcn.0040bed2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbc8]
call fcn.0040be7e
mov dword [ebp - 0x28], 8
jmp 0x4abe9b
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xe
je 0x4abf8e
mov dword [ebp - 0x26c], 0
cmp dword [ebp - 0x28], 0
ja 0x4abec1
mov dword [ebp - 0x6e4], 1
jmp 0x4abec8
and dword [ebp - 0x6e4], 0
cmp dword [ebp - 0x394], 0
jne 0x4abee3
cmp dword [ebp - 0x394], 0
jne 0x4abee3
and dword [ebp - 0x29c], 0
jmp 0x4abeed
mov dword [ebp - 0x29c], 1
push 1
lea ecx, [ebp - 0xbc8]
call fcn.0040bec0
mov ecx, dword [ebp - 0x29c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x29c], eax
jge 0x4abf28
mov dword [ebp - 0x6dc], 1
jmp 0x4abf2f
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x6dc], eax
jne 0x4abf49
mov dword [ebp - 0x39c], 1
jmp 0x4abf50
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
sub eax, dword [ebp - 0x26c]
cmp eax, dword [ebp - 0x26c]
jge 0x4abf70
mov dword [ebp - 0x3a4], 1
jmp 0x4abf77
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x6e4]
sub eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x2b4], eax
jmp 0x4abe94
mov byte [ebp - 0xa4], 0
movzx eax, byte [ebp - 0xa4]
test eax, eax
je 0x4abfb5
push 0x2173
push 0x19c5
push 0x1345
call dword [sym.imp.KERNEL32.dll_MulDiv]
lea ecx, [ebp - 0xbc8]
call fcn.0040bea4
lea ecx, [ebp - 0x7c4]
call fcn.0040bea4
lea ecx, [ebp - 0xb0c]
call fcn.0040bea4
movzx eax, byte [ebp - 0x9a]
test eax, eax
je 0x4ac0cc
push 4
lea ecx, [ebp - 0xb18]
call fcn.0040bdd2
mov dword [ebp - 0x118], 0x2a43d953
mov dword [ebp - 0x170], 0
jmp 0x4ac015
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 4
jge 0x4ac037
push dword [ebp - 0x170]
lea ecx, [ebp - 0xb18]
call fcn.0040bec0
mov dword [eax], 0xe83c773
jmp 0x4ac008
push 3
lea ecx, [ebp - 0xb18]
call fcn.0040bec0
mov eax, dword [eax]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x118], 3
jmp 0x4ac065
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x4ac0b9
mov byte [ebp - 0x9f], 0
movzx eax, byte [ebp - 0x9f]
test eax, eax
je 0x4ac08f
push 0
push 0
push 0x817
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x4ac0b7
push 0xfc0
push 0x253a
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x4ac058
lea ecx, [ebp - 0xb18]
call fcn.0040bea4
push 0
call dword [sym.imp.USER32.dll_CharNextW]
jmp 0x4ab686
lea ecx, [ebp - 0xbd8]
call fcn.0040bea4
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x6fc], 0xfffffff7
mov dword [ebp - 0x3bc], 0x5fe46c2e
mov dword [ebp - 0x1c0], 9
mov dword [ebp - 0x830], 0xf9a0
mov dword [ebp - 0x100], 0x9da9
mov dword [ebp - 0x3dc], 0xbbfad0d7
mov dword [ebp - 0x96c], 0x800f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xbdc], eax
cmp dword [ebp - 0x30], 0
jne 0x4ac192
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jne 0x4ac14c
mov dword [ebp - 0x6ec], 1
jmp 0x4ac153
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
add eax, 6
cmp eax, dword [ebp - 0x30]
je 0x4ac16d
mov dword [ebp - 0x3ac], 1
jmp 0x4ac174
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jne 0x4ac192
and dword [ebp - 0x6f4], 0
jmp 0x4ac19c
mov dword [ebp - 0x6f4], 1
cmp dword [ebp - 0x6f4], 0x7a5e
jl 0x4ac1b4
mov dword [ebp - 0x3b4], 1
jmp 0x4ac1bb
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x3b4], eax
jle 0x4ac1cd
cmp dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x4ac1e1
mov dword [ebp - 0x704], 1
jmp 0x4ac1e8
and dword [ebp - 0x704], 0
mov dword [ebp - 0x6fc], 5
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0x3bc]
imul eax, dword [ebp - 0x704]
cmp eax, dword [ebp - 0x30]
jl 0x4ac21c
mov dword [ebp - 0x3c4], 1
jmp 0x4ac223
and dword [ebp - 0x3c4], 0
imul eax, dword [ebp - 0x3c4], 3
cmp eax, 0xffffffff
jae 0x4ac23b
mov dword [ebp - 0x70c], 1
jmp 0x4ac242
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x70c], eax
je 0x4ac259
mov dword [ebp - 0x3cc], 1
jmp 0x4ac260
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x830]
imul eax, dword [ebp - 0x3cc]
cmp eax, dword [ebp - 0x100]
je 0x4ac28a
cmp dword [ebp - 0x100], 0
je 0x4ac28a
mov dword [ebp - 0x714], 1
jmp 0x4ac291
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x714], eax
jge 0x4ac2ab
mov dword [ebp - 0x3d4], 1
jmp 0x4ac2b2
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x3d4]
je 0x4ac2c9
mov dword [ebp - 0x71c], 1
jmp 0x4ac2d0
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x100]
imul eax, dword [ebp - 0x71c]
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0xca8], eax
or eax, 0xffffffff
ja 0x4ac300
mov dword [ebp - 0x724], 1
jmp 0x4ac307
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x96c]
cmp eax, dword [ebp - 0x724]
jne 0x4ac321
mov dword [ebp - 0x3e4], 1
jmp 0x4ac328
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x3e4], eax
jne 0x4ac342
mov dword [ebp - 0x72c], 1
jmp 0x4ac349
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x180], 0x3eb60693
mov dword [ebp - 0xbec], 1
mov dword [ebp - 0x3fc], 1
mov dword [ebp - 0x178], 0
jmp 0x4ac396
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x4ac3b2
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0xda0], 0xa167c28c
jmp 0x4ac389
cmp dword [ebp - 0x110], 1
jae 0x4ac3c7
mov dword [ebp - 0x3ec], 1
jmp 0x4ac3ce
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x3ec], eax
je 0x4ac3e8
mov dword [ebp - 0x734], 1
jmp 0x4ac3ef
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0x180]
cmp dword [ebp - 0x110], eax
jle 0x4ac40f
mov dword [ebp - 0x3f4], 1
jmp 0x4ac416
and dword [ebp - 0x3f4], 0
cmp dword [ebp - 0x3f4], 0xcd45
jg 0x4ac42e
mov dword [ebp - 0x73c], 1
jmp 0x4ac435
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x73c], eax
jle 0x4ac46b
mov byte [ebp - 0xa3], 0
movzx eax, byte [ebp - 0xa3]
test eax, eax
je 0x4ac466
push 0x1eb4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x4ac562
mov dword [ebp - 0x838], 0xfffe
push 3
lea ecx, [ebp - 0xbe8]
call fcn.0040bdd2
or dword [ebp - 0xa48], 0xffffffff
or dword [ebp - 0xa44], 0xffffffff
or dword [ebp - 0xa40], 0xffffffff
or dword [ebp - 0xa3c], 0xffffffff
lea ecx, [ebp - 0x225]
call fcn.0040becf
push eax
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xa48]
push eax
lea ecx, [ebp - 0xd34]
call fcn.0040bed2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xcb8]
call fcn.0040be7e
mov dword [ebp - 0x200], 0
jmp 0x4ac4ec
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x4ac50b
push dword [ebp - 0x200]
lea ecx, [ebp - 0xbe8]
call fcn.0040bec0
and dword [eax], 0
jmp 0x4ac4df
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xc6c], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xbfc], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xc90], eax
xor eax, eax
neg eax
add eax, dword [ebp - 0x180]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x3fc]
dec eax
mov dword [ebp - 0x3fc], eax
lea ecx, [ebp - 0xcb8]
call fcn.0040bea4
lea ecx, [ebp - 0xbe8]
call fcn.0040bea4
mov dword [ebp - 0xa5c], 0x3a4a
mov dword [ebp - 0xa58], 0x3a4a
mov dword [ebp - 0xa54], 0x3a4a
mov dword [ebp - 0xa50], 0x3a4a
lea ecx, [ebp - 0x231]
call fcn.0040becf
push eax
lea eax, [ebp - 0xa4c]
push eax
lea eax, [ebp - 0xa5c]
push eax
lea ecx, [ebp - 0xd04]
call fcn.0040bed2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xcf4]
call fcn.0040be7e
mov dword [ebp - 0xb2c], 0xfe01bd97
push 1
lea ecx, [ebp - 0xbf8]
call fcn.0040bdd2
mov dword [ebp - 0x64], 0
jmp 0x4ac5e6
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x4ac602
push dword [ebp - 0x64]
lea ecx, [ebp - 0xbf8]
call fcn.0040bec0
mov dword [eax], 0xae8c9f36
jmp 0x4ac5df
mov dword [ebp - 0x64], 0
jmp 0x4ac612
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x4ac628
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xa20], 0xfffffffe
jmp 0x4ac60b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa20]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa20], eax
lea ecx, [ebp - 0xbf8]
call fcn.0040bea4
lea ecx, [ebp - 0xcf4]
call fcn.0040bea4
mov dword [ebp - 0x744], 0x1584
mov dword [ebp - 0x8fc], str.ihwc_qmipb_kqpjiiq_ludwgfhz_fabdd_zoofeed
cmp dword [ebp - 0x744], 0x1639
jle 0x4ac723
and dword [ebp - 0x1c8], 0
jmp 0x4ac693
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x14b5
jge 0x4ac713
and dword [ebp - 0x188], 0
jmp 0x4ac6b5
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x184
jge 0x4ac70e
mov eax, dword [ebp - 0x1c8]
or eax, dword [ebp - 0x188]
cdq
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x880], edx
push dword [ebp - 0x880]
push dword [ebp - 0x884]
lea ecx, [ebp - 0xd94]
call fcn.004019d8
pop ecx
pop ecx
mov ecx, eax
call fcn.0040bba0
push eax
call fcn.004b7f67
pop ecx
lea ecx, [ebp - 0xd94]
call fcn.0040bb96
jmp 0x4ac6a8
jmp 0x4ac686
push 0
push 0
push 1
push 0
push 0
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x3c], 1
mov dword [ebp - 4], 4
cmp dword [ebp - 0x744], 0x139c
jge 0x4ac749
push dword [ebp - 0x8fc]
call fcn.004b7f67
pop ecx
jmp 0x4ac765
or dword [ebp - 4], 0xffffffff
jmp 0x4ac76f
mov dword [ebp - 0x5f8], 0xfffffff7
mov dword [ebp - 0x438], 0x5fe46c2e
mov dword [ebp - 0xec], 0xffffffff
push 1
lea ecx, [ebp - 0x928]
call fcn.0040bdd2
mov dword [ebp - 0x1e8], 0
jmp 0x4ac7b3
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x4ac7d5
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x928]
call fcn.0040bec0
mov dword [eax], 0xf432
jmp 0x4ac7a6
mov dword [ebp - 0xec], 8
jmp 0x4ac7ee
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xfffffff8
je 0x4aca73
mov dword [ebp - 0x2d0], 0xe56f9b2c
mov dword [ebp - 0x2cc], 0xe56f9b2c
mov dword [ebp - 0x2c8], 0xe56f9b2c
mov dword [ebp - 0x2c4], 0xe56f9b2c
mov dword [ebp - 0x274], 0xfa48a2b8
mov dword [ebp - 0x2a4], 1
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2d0], 0xffffffe7
jmp 0x4ac865
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2d0]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2d0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2d0], 0xfffffff8
jne 0x4aca6e
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0x414], 0xfffffff7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2d0]
mov dword [ebp - 0xb30], eax
cmp dword [ebp - 0xd0], 0
jne 0x4ac8c7
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd0]
cmp dword [ebp + eax - 0x2d0], ecx
jge 0x4ac8c7
and dword [ebp - 0x840], 0
jmp 0x4ac8d1
mov dword [ebp - 0x840], 1
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xb38], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2d0]
mov dword [ebp - 0xb40], eax
mov eax, dword [ebp - 0xd0]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x2d0]
cmp eax, dword [ebp - 0xd0]
jl 0x4ac916
mov dword [ebp - 0x404], 1
jmp 0x4ac91d
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0
ja 0x4ac932
mov dword [ebp - 0x750], 1
jmp 0x4ac939
and dword [ebp - 0x750], 0
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp - 0x750]
sub esi, dword [ebp + eax - 0x2d0]
push 0
lea ecx, [ebp - 0x928]
call fcn.0040bec0
cmp esi, dword [eax]
jg 0x4ac969
mov dword [ebp - 0x40c], 1
jmp 0x4ac970
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0xd0], eax
jge 0x4ac996
mov dword [ebp - 0x758], 1
jmp 0x4ac99d
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x2a4], eax
push 0
lea ecx, [ebp - 0x928]
call fcn.0040bec0
cmp dword [eax], 0
jne 0x4aca53
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2d0], 1
jge 0x4ac9e7
mov dword [ebp - 0x760], 1
jmp 0x4ac9ee
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0xec]
imul eax, dword [ebp - 0x760]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2d0]
jne 0x4aca16
mov dword [ebp - 0x768], 1
jmp 0x4aca1d
and dword [ebp - 0x768], 0
push 0
lea ecx, [ebp - 0x928]
call fcn.0040bec0
mov ecx, dword [ebp - 0x2a4]
mov edx, dword [ebp - 0x274]
sub edx, dword [ebp - 0x768]
imul edx, edx, 0xfffa
sub ecx, edx
mov eax, dword [eax]
sub eax, ecx
jne 0x4aca53
and dword [ebp - 0x420], 0
jmp 0x4aca5d
mov dword [ebp - 0x420], 1
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x2a4], eax
jmp 0x4ac84a
jmp 0x4ac7e1
lea ecx, [ebp - 0x928]
call fcn.0040bea4
mov dword [ebp - 0x190], 9
mov dword [ebp - 0x9a0], 0xf9a0
mov dword [ebp - 0xf4], 0x9da9
mov dword [ebp - 0x458], 0xbbfad0d7
mov dword [ebp - 0x848], 0x800f
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xb48], eax
cmp dword [ebp - 0x3c], 0
jne 0x4acb19
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jne 0x4acad3
mov dword [ebp - 0x5f0], 1
jmp 0x4acada
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5f0]
add eax, 6
cmp eax, dword [ebp - 0x3c]
je 0x4acaf4
mov dword [ebp - 0x428], 1
jmp 0x4acafb
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jne 0x4acb19
and dword [ebp - 0x6d8], 0
jmp 0x4acb23
mov dword [ebp - 0x6d8], 1
cmp dword [ebp - 0x6d8], 0x7a5e
jl 0x4acb3b
mov dword [ebp - 0x430], 1
jmp 0x4acb42
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x430], eax
jle 0x4acb54
cmp dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jle 0x4acb68
mov dword [ebp - 0x748], 1
jmp 0x4acb6f
and dword [ebp - 0x748], 0
mov dword [ebp - 0x5f8], 5
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x438]
imul eax, dword [ebp - 0x748]
cmp eax, dword [ebp - 0x3c]
jl 0x4acba3
mov dword [ebp - 0x440], 1
jmp 0x4acbaa
and dword [ebp - 0x440], 0
imul eax, dword [ebp - 0x440], 3
cmp eax, 0xffffffff
jae 0x4acbc2
mov dword [ebp - 0x600], 1
jmp 0x4acbc9
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x600], eax
je 0x4acbe0
mov dword [ebp - 0x448], 1
jmp 0x4acbe7
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x9a0]
imul eax, dword [ebp - 0x448]
cmp eax, dword [ebp - 0xf4]
je 0x4acc11
cmp dword [ebp - 0xf4], 0
je 0x4acc11
mov dword [ebp - 0x6e0], 1
jmp 0x4acc18
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x6e0], eax
jge 0x4acc32
mov dword [ebp - 0x450], 1
jmp 0x4acc39
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x450]
je 0x4acc50
mov dword [ebp - 0x608], 1
jmp 0x4acc57
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0xf4]
imul eax, dword [ebp - 0x608]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0xb50], eax
or eax, 0xffffffff
ja 0x4acc87
mov dword [ebp - 0x784], 1
jmp 0x4acc8e
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x848]
cmp eax, dword [ebp - 0x784]
jne 0x4acca8
mov dword [ebp - 0x460], 1
jmp 0x4accaf
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x460], eax
jne 0x4accc9
mov dword [ebp - 0x610], 1
jmp 0x4accd0
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x190], eax
push 4
lea ecx, [ebp - 0x9fc]
call fcn.0040bdd2
mov dword [ebp - 0x468], 0xe314a5ea
mov dword [ebp - 0x470], 0xffffffff
mov dword [ebp - 0x97c], 0x914cc5c6
mov dword [ebp - 0x74], 0
jmp 0x4acd17
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x4acd2d
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xe0], 0xffffffff
jmp 0x4acd10
mov dword [ebp - 0x74], 0
jmp 0x4acd3d
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x4acd59
push dword [ebp - 0x74]
lea ecx, [ebp - 0x9fc]
call fcn.0040bec0
mov dword [eax], 0x546158d3
jmp 0x4acd36
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xe0], 0xfffffff9
jmp 0x4acd87
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe0], 0xffffffe2
jle 0x4acf55
mov dword [ebp - 0xc8], 0x3b3152c5
mov dword [ebp - 0x904], 0xfadf6285
mov dword [ebp - 0x850], 0xc18ab9c2
mov dword [ebp - 0x1d0], 0
jmp 0x4acdd2
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x4acdee
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0xcd0], 0xfffffffb
jmp 0x4acdc5
mov dword [ebp - 0xc8], 3
jmp 0x4ace07
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x4acf50
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x4ace2c
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0xb58], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0xb68], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x468]
sub eax, 0x64d64ea3
cmp eax, 3
je 0x4ace7f
mov dword [ebp - 0x6e8], 1
jmp 0x4ace86
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x470], eax
mov esi, dword [ebp - 0x470]
sub esi, 0x3d21
push 0
lea ecx, [ebp - 0x9fc]
call fcn.0040bec0
cmp esi, dword [eax]
jg 0x4acebb
mov dword [ebp - 0x618], 1
jmp 0x4acec2
and dword [ebp - 0x618], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
cmp eax, dword [ebp - 0x618]
je 0x4acee3
mov dword [ebp - 0x754], 1
jmp 0x4aceea
and dword [ebp - 0x754], 0
push 4
pop eax
shl eax, 1
lea eax, [ebp + eax - 0xcd0]
mov dword [ebp - 0x478], eax
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x9fc]
call fcn.0040bec0
mov ecx, dword [ebp - 0x478]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x478]
mov eax, dword [eax]
add eax, dword [ebp - 0x754]
cmp eax, 0x15a8df04
jge 0x4acf38
mov dword [ebp - 0x480], 1
jmp 0x4acf3f
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x97c], eax
jmp 0x4acdfa
jmp 0x4acd6c
lea ecx, [ebp - 0x9fc]
call fcn.0040bea4
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x230], 0
mov dword [ebp - 0xb70], 1
mov dword [ebp - 0x75c], 0xfffffffb
push 1
lea ecx, [ebp - 0x224]
call fcn.0040bdd2
mov dword [ebp - 0x710], 0xe31bb000
mov dword [ebp - 0x648], 0x94592404
push 4
lea ecx, [ebp - 0x9cc]
call fcn.0040bdd2
push 3
lea ecx, [ebp - 0x9e4]
call fcn.0040bdd2
mov dword [ebp - 0x24], 0
jmp 0x4acfd0
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x4acfec
push dword [ebp - 0x24]
lea ecx, [ebp - 0x224]
call fcn.0040bec0
mov dword [eax], 0x8e55a441
jmp 0x4acfc9
mov dword [ebp - 0x24], 0
jmp 0x4acffc
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x4ad018
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9cc]
call fcn.0040bec0
mov dword [eax], 0x45464cd0
jmp 0x4acff5
mov dword [ebp - 0x24], 0
jmp 0x4ad028
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x4ad044
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9e4]
call fcn.0040bec0
mov dword [eax], 0xa32fbb2f
jmp 0x4ad021
mov dword [ebp - 0x2c], 2
jmp 0x4ad054
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1a
jne 0x4ad62f
mov dword [ebp - 0x22c], 0x1836ccb0
mov dword [ebp - 0x12c], 0
or dword [ebp - 0xaac], 0xffffffff
or dword [ebp - 0xaa8], 0xffffffff
or dword [ebp - 0xaa4], 0xffffffff
or dword [ebp - 0xaa0], 0xffffffff
lea ecx, [ebp - 0x2b5]
call fcn.0040becf
push eax
lea eax, [ebp - 0xa9c]
push eax
lea eax, [ebp - 0xaac]
push eax
lea ecx, [ebp - 0xd0c]
call fcn.0040bed2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xaf4]
call fcn.0040be7e
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x858], 0x55a5481f
mov dword [ebp - 0x90c], 6
mov dword [ebp - 0x130], 0
jmp 0x4ad0fa
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 3
jge 0x4ad116
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x938], 0xd53d2ae4
jmp 0x4ad0ed
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x938]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x938], eax
mov esi, dword [ebp - 0x12c]
push 0
lea ecx, [ebp - 0x224]
call fcn.0040bec0
mov edi, eax
push 0
lea ecx, [ebp - 0x224]
call fcn.0040bec0
mov ecx, dword [edi]
sub ecx, dword [eax]
sub esi, ecx
jne 0x4ad168
xor eax, eax
jne 0x4ad168
and dword [ebp - 0x620], 0
jmp 0x4ad172
mov dword [ebp - 0x620], 1
mov eax, dword [ebp - 0x648]
cmp dword [ebp - 0x620], eax
jne 0x4ad18c
mov dword [ebp - 0x488], 1
jmp 0x4ad193
and dword [ebp - 0x488], 0
mov esi, dword [ebp - 0x2c]
add esi, dword [ebp - 0x488]
push 3
lea ecx, [ebp - 0xaf4]
call fcn.0040bec0
imul esi, dword [eax]
cmp esi, dword [ebp - 0x75c]
jg 0x4ad1c0
mov dword [ebp - 0x6f0], 1
jmp 0x4ad1c7
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x6f0], eax
jl 0x4ad1e1
mov dword [ebp - 0x490], 1
jmp 0x4ad1e8
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x230]
sub eax, dword [ebp - 0x490]
cmp eax, 0xb017290b
ja 0x4ad207
mov dword [ebp - 0x628], 1
jmp 0x4ad20e
and dword [ebp - 0x628], 0
push 0
lea ecx, [ebp - 0x224]
call fcn.0040bec0
mov ecx, dword [ebp - 0x628]
cmp ecx, dword [eax]
jle 0x4ad23a
cmp dword [ebp - 0x638], 0
je 0x4ad23a
mov dword [ebp - 0x498], 1
jmp 0x4ad241
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x498]
jle 0x4ad25b
mov dword [ebp - 0x798], 1
jmp 0x4ad262
and dword [ebp - 0x798], 0
push 0
lea ecx, [ebp - 0x224]
call fcn.0040bec0
mov ecx, dword [ebp - 0x798]
cmp ecx, dword [eax]
jl 0x4ad285
mov dword [ebp - 0x4a0], 1
jmp 0x4ad28c
and dword [ebp - 0x4a0], 0
push 0
lea ecx, [ebp - 0x224]
call fcn.0040bec0
mov ecx, dword [ebp - 0x4a0]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0x9cc]
call fcn.0040bec0
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x27c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x27c]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 0x27c]
mov dword [edx], ecx
test eax, eax
je 0x4ad4db
push 0
lea ecx, [ebp - 0x224]
call fcn.0040bec0
cmp dword [eax], 0
je 0x4ad342
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xb78], eax
mov eax, 0xe835
cmp eax, 0xe74c
jle 0x4ad30b
mov dword [ebp - 0x630], 1
jmp 0x4ad312
and dword [ebp - 0x630], 0
push 0
lea ecx, [ebp - 0x224]
call fcn.0040bec0
mov ecx, dword [ebp - 0x630]
add ecx, dword [eax]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x938]
jl 0x4ad342
mov dword [ebp - 0x4a8], 1
jmp 0x4ad349
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0xf9695ff7
jae 0x4ad361
mov dword [ebp - 0x6f8], 1
jmp 0x4ad368
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x6f8]
jg 0x4ad382
mov dword [ebp - 0x4b0], 1
jmp 0x4ad389
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0xfffffffc
jbe 0x4ad39e
mov dword [ebp - 0x4b8], 1
jmp 0x4ad3a5
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x638]
cmp dword [ebp - 0x4b8], eax
jge 0x4ad3bf
mov dword [ebp - 0x4c0], 1
jmp 0x4ad3c6
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x75c]
cmp dword [ebp - 0x4c0], eax
jle 0x4ad3e0
mov dword [ebp - 0x640], 1
jmp 0x4ad3e7
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x640], eax
jge 0x4ad401
mov dword [ebp - 0x4c8], 1
jmp 0x4ad408
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x4c8], eax
jge 0x4ad41f
mov dword [ebp - 0x700], 1
jmp 0x4ad426
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x700], eax
jle 0x4ad440
mov dword [ebp - 0x4d0], 1
jmp 0x4ad447
and dword [ebp - 0x4d0], 0
imul eax, dword [ebp - 0x4d0], 0x3b6e
cmp eax, 0xb27c
je 0x4ad464
mov dword [ebp - 0x4d8], 1
jmp 0x4ad46b
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x648]
imul eax, dword [ebp - 0x4d8]
cmp eax, dword [ebp - 0x22c]
jle 0x4ad48c
mov dword [ebp - 0x78c], 1
jmp 0x4ad493
and dword [ebp - 0x78c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x938]
cmp eax, dword [ebp - 0x78c]
jg 0x4ad4b4
mov dword [ebp - 0x4e0], 1
jmp 0x4ad4bb
and dword [ebp - 0x4e0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x938]
add eax, dword [ebp - 0x4e0]
je 0x4ad4db
mov dword [ebp - 0x650], 1
jmp 0x4ad4e2
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x710]
cmp dword [ebp - 0x650], eax
jne 0x4ad505
mov eax, 0x83c5ee74
test eax, eax
je 0x4ad505
mov dword [ebp - 0x4e8], 1
jmp 0x4ad50c
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x4e8], eax
je 0x4ad523
mov dword [ebp - 0x708], 1
jmp 0x4ad52a
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x708], eax
jle 0x4ad544
mov dword [ebp - 0x4f0], 1
jmp 0x4ad54b
and dword [ebp - 0x4f0], 0
cmp dword [ebp - 0x4f0], 0x243b3be7
jne 0x4ad563
mov dword [ebp - 0x658], 1
jmp 0x4ad56a
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x90c], eax
push 0
lea ecx, [ebp - 0x224]
call fcn.0040bec0
cmp dword [eax], 0
je 0x4ad59a
cmp dword [ebp - 0x2c], 0
je 0x4ad59a
mov dword [ebp - 0x4f8], 1
jmp 0x4ad5a1
and dword [ebp - 0x4f8], 0
push 0
lea ecx, [ebp - 0x9e4]
call fcn.0040bec0
mov ecx, dword [ebp - 0x4f8]
cmp ecx, dword [eax]
jl 0x4ad5c4
mov dword [ebp - 0x764], 1
jmp 0x4ad5cb
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x764]
je 0x4ad5e2
mov dword [ebp - 0x500], 1
jmp 0x4ad5e9
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x500], eax
jg 0x4ad603
mov dword [ebp - 0x660], 1
jmp 0x4ad60a
and dword [ebp - 0x660], 0
push 1
lea ecx, [ebp - 0xaf4]
call fcn.0040bec0
mov ecx, dword [ebp - 0x660]
mov dword [eax], ecx
lea ecx, [ebp - 0xaf4]
call fcn.0040bea4
jmp 0x4ad04d
push 0
lea ecx, [ebp - 0x9e4]
call fcn.0040bec0
xor eax, eax
cmp eax, 6
je 0x4ad64f
mov dword [ebp - 0x508], 1
jmp 0x4ad656
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0x82d83ed3
jne 0x4ad66e
mov dword [ebp - 0x510], 1
jmp 0x4ad675
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x710]
cmp dword [ebp - 0x510], eax
jne 0x4ad68f
mov dword [ebp - 0x668], 1
jmp 0x4ad696
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x668]
jl 0x4ad6b3
cmp dword [ebp - 0x2c], 0
je 0x4ad6b3
mov dword [ebp - 0x518], 1
jmp 0x4ad6ba
and dword [ebp - 0x518], 0
mov eax, 0xd88fcbdc
sub eax, dword [ebp - 0x518]
sub eax, 0x6f3b
cmp eax, 0xe53c5305
jne 0x4ad6dd
mov dword [ebp - 0x864], 1
jmp 0x4ad6e4
and dword [ebp - 0x864], 0
push 2
lea ecx, [ebp - 0x9cc]
call fcn.0040bec0
push 0
lea ecx, [ebp - 0x224]
call fcn.0040bec0
mov esi, eax
push 0
lea ecx, [ebp - 0x224]
call fcn.0040bec0
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x9e4]
call fcn.0040bea4
lea ecx, [ebp - 0x9cc]
call fcn.0040bea4
lea ecx, [ebp - 0x224]
call fcn.0040bea4
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x14c], 0x3eb60693
mov dword [ebp - 0xb80], 1
mov dword [ebp - 0x718], 1
mov dword [ebp - 0x13c], 0
jmp 0x4ad773
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x4ad78f
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0xd7c], 0xa167c28c
jmp 0x4ad766
cmp dword [ebp - 0xfc], 1
jae 0x4ad7a4
mov dword [ebp - 0x7a0], 1
jmp 0x4ad7ab
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x7a0], eax
je 0x4ad7c5
mov dword [ebp - 0x520], 1
jmp 0x4ad7cc
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
sub eax, dword [ebp - 0x14c]
cmp dword [ebp - 0xfc], eax
jle 0x4ad7ec
mov dword [ebp - 0x670], 1
jmp 0x4ad7f3
and dword [ebp - 0x670], 0
cmp dword [ebp - 0x670], 0xcd45
jg 0x4ad80b
mov dword [ebp - 0x528], 1
jmp 0x4ad812
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x528], eax
jle 0x4ad848
mov byte [ebp - 0xa7], 0
movzx eax, byte [ebp - 0xa7]
test eax, eax
je 0x4ad843
push 0x1eb4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x4ad93f
mov dword [ebp - 0x9a4], 0xfffe
push 3
lea ecx, [ebp - 0xc08]
call fcn.0040bdd2
or dword [ebp - 0xa70], 0xffffffff
or dword [ebp - 0xa6c], 0xffffffff
or dword [ebp - 0xa68], 0xffffffff
or dword [ebp - 0xa64], 0xffffffff
lea ecx, [ebp - 0x2bd]
call fcn.0040becf
push eax
lea eax, [ebp - 0xa60]
push eax
lea eax, [ebp - 0xa70]
push eax
lea ecx, [ebp - 0xd1c]
call fcn.0040bed2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xce8]
call fcn.0040be7e
mov dword [ebp - 0x144], 0
jmp 0x4ad8c9
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jge 0x4ad8e8
push dword [ebp - 0x144]
lea ecx, [ebp - 0xc08]
call fcn.0040bec0
and dword [eax], 0
jmp 0x4ad8bc
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xb98], eax
xor eax, eax
neg eax
add eax, dword [ebp - 0x14c]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x718]
dec eax
mov dword [ebp - 0x718], eax
lea ecx, [ebp - 0xce8]
call fcn.0040bea4
lea ecx, [ebp - 0xc08]
call fcn.0040bea4
mov dword [ebp - 0x6c], 0xc93b4e1
push 3
lea ecx, [ebp - 0x958]
call fcn.0040bdd2
mov dword [ebp - 0x240], 0xc87778e1
mov dword [ebp - 0x154], 0
jmp 0x4ad976
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x4ad998
push dword [ebp - 0x154]
lea ecx, [ebp - 0x958]
call fcn.0040bec0
mov dword [eax], 0x55ebda18
jmp 0x4ad969
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x4adb00
mov dword [ebp - 0x530], 0x3035
mov dword [ebp - 0x870], str.twahiqmae_btyjqxngh_atmdfz_nsfb_ylesvbral_wsahphp
cmp dword [ebp - 0x530], 0x3185
jle 0x4adaaf
and dword [ebp - 0x15c], 0
jmp 0x4ad9e8
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x6437
jge 0x4adaaf
and dword [ebp - 0x164], 0
jmp 0x4ada0e
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0x6c94
jge 0x4adaaa
and dword [ebp - 0x16c], 0
jmp 0x4ada34
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x38dc
jge 0x4adaa5
and dword [ebp - 0x174], 0
jmp 0x4ada56
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x7a16
jge 0x4adaa3
mov eax, dword [ebp - 0x15c]
and eax, dword [ebp - 0x164]
mov edx, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x174]
sar edx, cl
or eax, edx
cdq
mov dword [ebp - 0x890], eax
mov dword [ebp - 0x88c], edx
push dword [ebp - 0x88c]
push dword [ebp - 0x890]
mov ecx, 0xaa47f8
call fcn.0040bbab
jmp 0x4ada49
jmp 0x4ada27
jmp 0x4ada01
jmp 0x4ad9db
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
mov dword [ebp - 4], 6
cmp dword [ebp - 0x530], 0x2e57
jge 0x4adada
mov edx, dword [ebp - 0x870]
mov ecx, 0xaa47f8
call fcn.0040e430
jmp 0x4adaf6
or dword [ebp - 4], 0xffffffff
jmp 0x4adb00
mov dword [ebp - 0x6c], 0
jmp 0x4adb10
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xffffffe9
jle 0x4ae03c
mov dword [ebp - 0x8c], 7
mov dword [ebp - 0xa98], 0x580090ae
mov dword [ebp - 0xa94], 0x580090ae
mov dword [ebp - 0xa90], 0x580090ae
mov dword [ebp - 0xa8c], 0x580090ae
lea ecx, [ebp - 0x2bf]
call fcn.0040becf
push eax
lea eax, [ebp - 0xa88]
push eax
lea eax, [ebp - 0xa98]
push eax
lea ecx, [ebp - 0xd5c]
call fcn.0040bed2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x948]
call fcn.0040be7e
mov dword [ebp - 0x250], 0xd633c668
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x4adbae
push 0x1eb4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x8c], 0xffffffec
jmp 0x4adbc7
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
je 0x4ae02c
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x38], 0
jmp 0x4adbf2
cmp dword [ebp - 0x38], 0x10
jl 0x4ae027
mov dword [ebp - 0xac], 0xfffffff8
mov dword [ebp - 0x568], 0x4a126529
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jl 0x4adc24
mov dword [ebp - 0x678], 1
jmp 0x4adc2b
and dword [ebp - 0x678], 0
cmp dword [ebp - 0x678], 0xf6cb
jge 0x4adc43
mov dword [ebp - 0x914], 1
jmp 0x4adc4a
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0xac], eax
jne 0x4adc61
mov dword [ebp - 0x238], 1
jmp 0x4adc68
and dword [ebp - 0x238], 0
push 2
lea ecx, [ebp - 0x958]
call fcn.0040bec0
mov ecx, dword [ebp - 0x238]
mov dword [eax], ecx
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x238], eax
jne 0x4adc94
mov dword [ebp - 0x538], 1
jmp 0x4adc9b
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x538]
jle 0x4adcb5
mov dword [ebp - 0x76c], 1
jmp 0x4adcbc
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x76c], eax
jl 0x4adcd3
mov dword [ebp - 0x540], 1
jmp 0x4adcda
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp - 0x540]
inc eax
cmp eax, dword [ebp - 0x6c]
jl 0x4adcf9
jmp 0x4adbba
lea ecx, [ebp - 0x948]
call fcn.0040bea4
jmp 0x4adb09
lea ecx, [ebp - 0x958]
call fcn.0040bea4
push 4
lea ecx, [ebp - 0x9d8]
call fcn.0040bdd2
mov dword [ebp - 0x6a0], 0xe314a5ea
mov dword [ebp - 0x730], 0xffffffff
mov dword [ebp - 0x9ac], 0x914cc5c6
mov dword [ebp - 0x78], 0
jmp 0x4ae082
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x4ae098
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xcc], 0xffffffff
jmp 0x4ae07b
mov dword [ebp - 0x78], 0
jmp 0x4ae0a8
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x4ae0c4
push dword [ebp - 0x78]
lea ecx, [ebp - 0x9d8]
call fcn.0040bec0
mov dword [eax], 0x546158d3
jmp 0x4ae0a1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xcc], 0xfffffff9
jmp 0x4ae0f2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xcc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcc], 0xffffffe2
jle 0x4ae2c0
mov dword [ebp - 0xd4], 0x3b3152c5
mov dword [ebp - 0x91c], 0xfadf6285
mov dword [ebp - 0x894], 0xc18ab9c2
mov dword [ebp - 0x17c], 0
jmp 0x4ae13d
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jge 0x4ae159
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0xcc4], 0xfffffffb
jmp 0x4ae130
mov dword [ebp - 0xd4], 3
jmp 0x4ae172
cmp dword [ebp - 0xd4], 0
jl 0x4ae2bb
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x4ae197
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0xb28], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
mov dword [ebp - 0xc8c], eax
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0xc94], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x6a0]
sub eax, 0x64d64ea3
cmp eax, 3
je 0x4ae1ea
jmp 0x4ae0d7
lea ecx, [ebp - 0x9d8]
call fcn.0040bea4
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x268], 0
mov dword [ebp - 0xc9c], 1
mov dword [ebp - 0x5d8], 0xfffffffb
push 1
lea ecx, [ebp - 0x218]
call fcn.0040bdd2
mov dword [ebp - 0x48c], 0xe31bb000
mov dword [ebp - 0x41c], 0x94592404
push 4
lea ecx, [ebp - 0xa08]
call fcn.0040bdd2
push 3
lea ecx, [ebp - 0x9f0]
call fcn.0040bdd2
mov dword [ebp - 0x1c], 0
jmp 0x4ae33b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x4ae357
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.0040bec0
mov dword [eax], 0x8e55a441
jmp 0x4ae334
mov dword [ebp - 0x1c], 0
jmp 0x4ae367
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x4ae383
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa08]
call fcn.0040bec0
mov dword [eax], 0x45464cd0
jmp 0x4ae360
mov dword [ebp - 0x1c], 0
jmp 0x4ae393
cmp dword [ebp - 0x1c], 3
jge 0x4ae3af