Function at 0x498b96
Capabilities:
Allocate thread local storage
Create pipe
Encrypt data using speck
Get common file path
Get disk information
Get geographical location
Identify system language via api
Log keystrokes via polling
Modify service
Read .ini file
Start service

Disassembly:
mov eax, 0x4bce53
call fcn.004bbda0
sub esp, 0xc18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x74], dl
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x38], 0x67e307b5
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x3b8]
call fcn.00406726
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x1c], 0
jmp 0x498beb
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3b8]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x498bd8
mov eax, dword [ebp - 0x38]
xor edx, edx
or esi, 0xffffffff
cmp eax, esi
setge dl
mov eax, dword [ebp - 0x3b8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, 0x9869ec42
setne cl
mov eax, 0xc4185a1f
cmp eax, ecx
sbb eax, eax
neg eax
xor ecx, ecx
cmp eax, 0xfffffffc
setl cl
xor eax, eax
sub ecx, edx
je 0x498c38
cmp dword [ebp - 0x38], eax
je 0x498c38
xor edi, edi
inc edi
mov ecx, edi
jmp 0x498c3d
mov ecx, eax
xor edi, edi
inc edi
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x498c52
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [ebp - 0x3b8]
call fcn.004067f8
mov dword [ebp - 0x34], 0x4aa0d722
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], 0x71a4
cmp dword [ebp - 0x3c], 0x755f
jle 0x498cdc
mov ebx, eax
mov dword [ebp - 0x48], eax
mov esi, eax
mov edi, eax
mov dword [ebp - 0x30], ebx
mov ecx, esi
shl ebx, cl
mov eax, ebx
or eax, edi
cdq
push edx
push eax
mov ecx, 0xace058
call fcn.004063d1
inc edi
cmp edi, 0x4c1a
jl 0x498c89
inc esi
cmp esi, 0x2369
push 0
pop eax
mov ebx, dword [ebp - 0x48]
jl 0x498c80
inc ebx
mov dword [ebp - 0x48], ebx
cmp ebx, 0xc88
jl 0x498c7e
push 0x17d
xor ebx, ebx
push ebx
push 0x8d8
call dword [sym.imp.USER32.dll_GetClassNameW]
xor eax, eax
xor edi, edi
inc edi
push 3
pop ebx
or esi, 0xffffffff
mov dword [ebp - 0x34], 0x28abf8b2
mov dword [ebp - 4], eax
cmp dword [ebp - 0x3c], 0x6ecc
jge 0x498cfe
mov edx, str.hjqn_xhlkr_uyceykvf_mgcsejae_olreeptg_qrknd_ijwm_nmcbje_rpsyy_xxdjjcyn
mov ecx, 0xace058
call fcn.00409042
mov dword [ebp - 4], esi
jmp 0x498d27
push 9
pop esi
mov dword [ebp - 0x48], 0x509c
push edi
lea ecx, [ebp - 0x574]
call fcn.00406726
mov dword [ebp - 0x24], 0
jmp 0x498d53
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x704], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x498d46
mov dword [ebp - 0x24], 0
jmp 0x498d74
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x574]
mov dword [eax + ecx*4], 0x2e63372
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x498d61
mov dword [ebp - 0x48], edi
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x574]
mov dword [eax], 0xfffffff9
lea ecx, [ebp - 0x574]
call fcn.004067f8
mov dword [ebp - 0x18], 0x283d1f0d
mov dword [ebp - 0x44], 0xe2ad21dd
mov dword [ebp - 0x50], 0x2130bec3
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x498dcd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd4], 0xa8eac8b1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x498db5
xor eax, eax
mov dword [ebp - 0x24], eax
push 2
pop esi
cmp dword [ebp - 0x24], esi
jge 0x498df0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x84], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x498dd8
xor eax, eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], esi
jg 0x498ed3
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x1c], eax
jmp 0x498e19
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc8], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x498e08
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp + eax*4 - 0xd4]
sub ecx, eax
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp + eax*4 - 0xd4]
xor edx, edx
cmp ecx, eax
setne dl
mov eax, dword [ebp - 0x80]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, 0x9a48
setle cl
sub ecx, 0x60bae246
je 0x498ebd
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x2c], 0xf22a1efe
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], esi
push 0
pop eax
jle 0x498dfc
cmp dword [ebp - 0x80], eax
je 0x498f2c
cmp dword [ebp - 0x44], eax
jne 0x498f10
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x80]
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x498f06
cmp dword [ebp - 0x80], eax
je 0x498f06
mov eax, edi
imul eax, eax, 0xc16
test eax, eax
je 0x498f12
mov eax, edi
xor ecx, ecx
cmp eax, 0x8e87
setg cl
mov eax, dword [ebp - 0x80]
add eax, ecx
cmp dword [ebp - 0x18], eax
jg 0x498f2a
mov eax, edi
jmp 0x498f2c
xor eax, eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x44]
jl 0x498f43
xor eax, eax
cmp dword [ebp - 0x80], eax
mov ecx, eax
je 0x498f45
mov ecx, edi
mov eax, dword [ebp - 0xd4]
imul eax, ecx
test eax, eax
je 0x498f69
xor eax, eax
mov dword [ebp - 0x50], eax
jmp 0x498f61
cmp dword [ebp - 0x44], eax
jne 0x498f82
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xf
jg 0x498f59
jmp 0x498f82
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x498f80
push eax
push eax
push 0xa60
call dword [sym.imp.USER32.dll_SetPropA]
xor eax, eax
mov dword [ebp - 0x3c], 0xfff7
mov dword [ebp - 0x34], 0x15747814
mov dword [ebp - 0x30], 0x76715f0e
mov dword [ebp - 0x18], 0x7a4bedcc
mov dword [ebp - 0x34], 0x23498e64
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x1c], eax
jmp 0x498fcb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14c], 0xff44cacf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x498fba
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp - 0x38]
add ecx, eax
mov eax, dword [ebp - 0x48]
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp - 0x3c]
jne 0x499007
xor eax, eax
cmp dword [ebp - 0x38], eax
mov ecx, eax
je 0x499009
mov ecx, edi
xor eax, eax
cmp ecx, 0x36fc75df
setge al
imul eax, eax, 0x71d6
cmp eax, 0x4087
jl 0x49902a
xor eax, eax
cmp dword [ebp - 0x18], eax
mov ecx, eax
je 0x49902c
mov ecx, edi
mov eax, dword [ebp - 0x4c]
dec eax
add ecx, eax
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 0x4c]
cmp eax, ecx
jg 0x499049
cmp dword [ebp - 0x14c], 0
je 0x499049
mov eax, edi
jmp 0x49904b
xor eax, eax
mov dword [ebp - 0x18], eax
push edi
lea ecx, [ebp - 0x180]
call fcn.00406726
mov dword [ebp - 0x2c], 0xd45b0e82
mov dword [ebp - 0x18], 0x413e458c
mov dword [ebp - 0x24], 0
jmp 0x499080
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x499071
mov dword [ebp - 0x24], 0
jmp 0x49909f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2a8], 0xc6f1bf50
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x49908e
mov ecx, dword [ebp - 0x180]
mov eax, dword [ecx]
mov dword [ebp - 0x2a0], eax
test eax, eax
je 0x499163
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x2a0]
sub eax, ecx
jne 0x4990e0
lea eax, [ecx + 3]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x180]
cmp eax, dword [ecx]
jne 0x4990e6
xor edx, edx
jmp 0x4990e8
mov ecx, dword [ebp - 0x180]
mov edx, edi
xor eax, eax
cmp edx, 0x34d0
sete al
mov dword [ebp - 0x2a0], eax
cmp eax, dword [ecx]
jle 0x499163
mov dword [ebp - 0x1c], 0xed99ea7e
push edi
lea ecx, [ebp - 0x6e8]
call fcn.00406726
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x499130
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6e8]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x49911a
xor eax, eax
dec dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x49914d
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x49914a
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff0
jl 0x499138
lea ecx, [ebp - 0x6e8]
call fcn.004067f8
jmp 0x499301
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x48], 0xaf47dfb0
mov dword [ebp - 0x48], 0x57fc
cmp dword [ebp - 0x48], 0x59d3
jle 0x4991b7
xor edi, edi
xor esi, esi
xor ebx, ebx
mov eax, ebx
and eax, esi
xor eax, edi
cdq
push edx
push eax
mov ecx, 0xace058
call fcn.004063d1
inc ebx
cmp ebx, 0x33e5
jl 0x499183
inc esi
cmp esi, 0x5762
jl 0x499181
inc edi
cmp edi, 0x23da
jl 0x49917f
xor edi, edi
inc edi
push 2
pop esi
mov dword [ebp - 0x3c], 0x86b464bb
mov dword [ebp - 4], esi
cmp dword [ebp - 0x48], 0x541b
jge 0x4991d9
mov edx, str.fryalyd_igkhkmtt_yzu_zfxbw_yaqzjx_haiqmhox_mssqpt_lzvqrwtyh
mov ecx, 0xace058
call fcn.00409042
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x499204
mov dword [ebp - 0x1c], eax
jmp 0x49921a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8c], 0x2a4f2a6c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x499209
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
mov eax, dword [ebp - 0x180]
cmp dword [eax], 0xfffffffc
sete cl
mov eax, dword [ebp - 0x18]
imul eax, ecx
test eax, eax
je 0x499243
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x180]
mov esi, dword [eax]
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp eax, 0xfffffff8
setl dl
xor ecx, ecx
cmp edx, esi
setle cl
xor eax, eax
cmp ecx, esi
setl al
imul eax, eax, 0xfffb
test eax, eax
je 0x49927b
cmp dword [ebp - 0x8c], 0
je 0x49927b
mov edx, edi
jmp 0x49927d
xor edx, edx
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x2a0]
add eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, 0x257b06f8
setg cl
cmp ecx, 0x6691cfe0
jl 0x4992b1
xor eax, eax
cmp dword [ebp - 0x38], eax
mov edx, eax
je 0x4992b3
mov edx, edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
push 4
pop ebx
cmp ebx, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x2c]
push 2
pop esi
sub eax, esi
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
mov ebx, 0xffff
cmp ebx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x180]
call fcn.004067f8
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x24], 0
jmp 0x49932d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb8], 0xcb457102
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x49931c
mov dword [ebp - 0x24], 0
jmp 0x49934c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x34c], 0xbc00eadd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x49933b
cmp dword [ebp - 0xb4], 0
je 0x499394
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb4]
xor edx, edx
cmp eax, edi
setge dl
mov eax, dword [ebp - 0xb8]
xor ecx, ecx
cmp edx, eax
setne cl
imul eax, ecx, 0xc8d
add eax, 0x63a40750
je 0x499394
mov edx, edi
jmp 0x499396
xor edx, edx
neg edx
mov eax, dword [ebp - 0xb4]
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0xb4], ecx
inc dword [ebp - 0x34c]
mov dword [ebp - 0x18], 0x283d1f0d
mov dword [ebp - 0x50], 0xfffffff6
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x2c], 0xfffffff6
push edi
lea ecx, [ebp - 0x868]
call fcn.00406726
mov dword [ebp - 0x4c], 0x45e5
cmp dword [ebp - 0x4c], 0x4664
jle 0x49945f
xor eax, eax
mov dword [ebp - 0x38], eax
xor esi, esi
mov dword [ebp - 0x3c], esi
and dword [ebp - 0x30], 0
cdq
idiv esi
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x48], 0x7e0a
xor ebx, ebx
mov esi, dword [ebp - 0x30]
mov eax, esi
cdq
push edx
push eax
lea ecx, [ebp - 0xb24]
call fcn.00401a01
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x499423
mov eax, dword [eax]
push eax
call fcn.004a68c7
pop ecx
push ebx
push edi
lea ecx, [ebp - 0xb24]
call fcn.00406da6
add esi, dword [ebp - 0x54]
dec dword [ebp - 0x48]
jne 0x499409
mov esi, dword [ebp - 0x3c]
inc esi
mov dword [ebp - 0x3c], esi
cmp esi, 0x2ead
mov eax, dword [ebp - 0x38]
jl 0x4993f3
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x55fd
jl 0x4993ee
push 2
pop esi
mov dword [ebp - 0x1c], 0
jmp 0x49947b
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x868]
mov dword [eax + ecx*4], 0x2d3d4782
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x499468
mov dword [ebp - 4], 4
cmp dword [ebp - 0x4c], 0x447d
jge 0x49949b
push str.cxpqe_lttyaain_wanckys_lbyrhdo_asoiksz_eckaifa_nhre_mvx_ecloo_idhkf_esoafil_nan_izrdbqiy
call fcn.004a68c7
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x4994c5
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], 0x6ce125d1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp eax, 0xcd9d75
setne dl
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
cmp ecx, 5
setg dl
inc edx
neg edx
sbb edx, edx
inc edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xfffffff8
setne al
imul eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
cmp eax, 6
sbb eax, eax
neg eax
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x50], eax
jmp 0x499554
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], bl
je 0x499551
push eax
push eax
push 0x223
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
xor eax, eax
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jle 0x499538
lea ecx, [ebp - 0x868]
call fcn.004067f8
mov dword [ebp - 0x44], 0xe2ad21dd
mov dword [ebp - 0x38], 0x67e307b5
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x3ac]
call fcn.00406726
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x1c], 0
jmp 0x4995a4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3ac]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x499591
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp eax, 0xffffffff
setge dl
mov eax, dword [ebp - 0x3ac]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, 0x9869ec42
setne cl
mov eax, 0xc4185a1f
cmp eax, ecx
sbb eax, eax
neg eax
xor ecx, ecx
cmp eax, 0xfffffffc
setl cl
xor eax, eax
sub ecx, edx
je 0x4995ea
cmp dword [ebp - 0x38], eax
mov ecx, edi
jne 0x4995ec
mov ecx, eax
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x499601
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [ebp - 0x3ac]
call fcn.004067f8
mov dword [ebp - 0x50], 0x2130bec3
mov dword [ebp - 0x24], 0
jmp 0x49962d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe4], 0xa8eac8b1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x49961c
mov dword [ebp - 0x34], 0x4aa0d722
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x34], 0x28abf8b2
mov dword [ebp - 0x48], 0x509c
push edi
lea ecx, [ebp - 0x4e4]
call fcn.00406726
mov dword [ebp - 0x24], 0
jmp 0x499674
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x814], 9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x499663
mov dword [ebp - 0x24], 0
jmp 0x499695
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4e4]
mov dword [eax + ecx*4], 0x2e63372
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x499682
mov dword [ebp - 0x48], edi
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4e4]
mov dword [eax], 0xfffffff9
lea ecx, [ebp - 0x4e4]
call fcn.004067f8
mov dword [ebp - 0x48], 0xf6a
cmp dword [ebp - 0x48], 0xfe8
jle 0x4996f0
xor esi, esi
xor ebx, ebx
lea eax, [ebx + esi]
cdq
push edx
push eax
mov ecx, 0xace058
call fcn.004063d1
inc ebx
cmp ebx, 0x975
jl 0x4996cb
inc esi
cmp esi, 0x4e10
jl 0x4996c9
push 2
pop esi
mov dword [ebp - 0x24], 0
or ebx, 0xffffffff
cmp dword [ebp - 0x24], esi
jge 0x49970b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x70], ebx
inc dword [ebp - 0x24]
jmp 0x4996fa
mov dword [ebp - 4], 6
cmp dword [ebp - 0x48], 0xd64
jge 0x49972a
mov edx, str.nwbtxfh_fpglimfvp_svyevkuti_gowv_brpp_kro_irdmsiu_jnrftm_dhjx_eirhurwpy_nruc_areopbyr
mov ecx, 0xace058
call fcn.00409042
mov dword [ebp - 4], ebx
jmp 0x499755
mov dword [ebp - 0x50], 0xfffffff6
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], 0xfffffff6
push edi
lea ecx, [ebp - 0x700]
call fcn.00406726
mov dword [ebp - 0x1c], 0
jmp 0x49978e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x700]
mov dword [eax + ecx*4], 0x2d3d4782
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x49977b
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], 0x6ce125d1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp eax, 0xcd9d75
setne dl
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
cmp ecx, 5
setg dl
inc edx
neg edx
sbb edx, edx
inc edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xfffffff8
setne al
imul eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
cmp eax, 6
sbb eax, eax
neg eax
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x50], eax
jmp 0x499822
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], bl
je 0x49981f
push eax
push eax
push 0x223
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
xor eax, eax
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jle 0x499806
lea ecx, [ebp - 0x700]
call fcn.004067f8
xor eax, eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], esi
jg 0x499d88
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x34], 0x624039b6
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x499866
push eax
push eax
push 0x17c2
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x499877
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x40], 0x1b6b
push esi
lea ecx, [ebp - 0x3c4]
call fcn.00406726
mov dword [ebp - 0x48], 0xac6914f0
mov dword [ebp - 0x4c], 0xfff9
mov dword [ebp - 0x48], 0x361ae7d5
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x1c], 0
jmp 0x4998cc
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c4]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x4998b9
mov dword [ebp - 0x24], 0xfffffffe
cmp dword [ebp - 0x24], 0x1a
jne 0x4999f2
push 3
pop ebx
mov dword [ebp - 0x2c], 0xd21dfe4b
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x34], 0xffffffff
push ebx
lea ecx, [ebp - 0x7e0]
call fcn.00406726
mov eax, 0xbb32
mov dword [ebp - 0x898], eax
mov dword [ebp - 0x894], eax
mov dword [ebp - 0x890], eax
mov dword [ebp - 0x88c], eax
mov dword [ebp - 0x48], 0xaa9c1c73
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x49994e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x7e0]
mov dword [eax + ecx*4], 0xbe2d3d47
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x499934
xor eax, eax
cmp dword [ebp - 0x2c], 0x836ccb03
ja 0x4999a5
cmp dword [ebp - 0x24], eax
je 0x499964
cmp dword [ebp - 0x2c], eax
je 0x499964
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], 0
jne 0x499973
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jg 0x499987
xor eax, eax
cmp dword [ebp - 0x24], eax
mov ecx, eax
je 0x499989
mov ecx, edi
mov eax, dword [ebp - 0x24]
sub ecx, eax
je 0x49999a
cmp dword [ebp - 0x20], 0
je 0x49999a
mov eax, edi
jmp 0x49999c
xor eax, eax
cmp eax, dword [ebp - 0x20]
jl 0x4999a5
xor eax, eax
jmp 0x4999a7
mov eax, edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xa
jmp 0x4999d4
mov dword [ebp - 0x1c], 0
jmp 0x4999c9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9fc], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x4999bc
dec dword [ebp - 0x48]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff2
jg 0x4999b3
lea ecx, [ebp - 0x7e0]
call fcn.004067f8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1a
je 0x4998e5
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x24], 0
jne 0x499a3d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
sub edx, eax
mov eax, dword [ebp - 0x3c4]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x24]
add ecx, edx
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x40]
imul edx, dword [ebp - 0x40]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add eax, 0xc5fd78d
cmp eax, dword [ebp - 0x40]
jg 0x499a3d
xor edx, edx
jmp 0x499a3f
mov edx, edi
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, 0x6546d79
mov dword [ebp - 0x48], ecx
je 0x499a57
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
xor edx, edx
cmp eax, edi
setg dl
add edx, 9
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
inc eax
push 0xfffffffffffffff9
pop ecx
sub ecx, eax
mov eax, dword [ebp - 0x40]
xor edx, edx
cmp ecx, eax
setne dl
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x4c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x3c4]
call fcn.004067f8
mov dword [ebp - 0x2c], 0x53b26bdd
push edi
lea ecx, [ebp - 0x5ec]
call fcn.00406726
mov dword [ebp - 0x30], 0xd1456b86
mov dword [ebp - 0x1c], 0
jmp 0x499ae5
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x5ec]
mov dword [eax + ecx*4], 0xdae5a60d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x499ad2
mov dword [ebp - 0x2c], 0xfffffffa
jmp 0x499b47
push esi
lea ecx, [ebp - 0x710]
call fcn.00406726
or edx, 0xffffffff
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x1c], 0
jmp 0x499b1d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x710]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x499b0e
mov eax, dword [ebp - 0x5ec]
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
test eax, eax
setg cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x710]
call fcn.004067f8
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe5
jg 0x499af3
lea ecx, [ebp - 0x5ec]
call fcn.004067f8
mov dword [ebp - 0x1c], 0
jmp 0x499b72
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd8], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x499b61
movdqa xmm0, xmmword [0xac2dd0]
movdqu xmmword [ebp - 0x8c8], xmm0
push ecx
lea eax, [ebp - 0x8b8]
push eax
lea eax, [ebp - 0x8c8]
push eax
lea ecx, [ebp - 0x168]
call fcn.004067d2
mov dword [ebp - 0x24], 0xd4081c29
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], eax
jl 0x499c71
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x30], eax
xor ebx, ebx
mov dword [ebp - 0x48], 0xfffffffe
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x168]
cmp dword [eax + ecx*4], ebx
jne 0x499be9
xor eax, eax
xor ebx, ebx
cmp dword [ebp - 0x24], eax
mov dword [ebp - 0x48], eax
je 0x499bec
mov dword [ebp - 0x48], edi
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x54], edi
xor edx, edx
mov eax, dword [ebp - 0x168]
mov edi, dword [ebp - 0x48]
cmp edi, dword [eax + ecx*4]
sete dl
mov ecx, dword [ebp - 0x3c]
sub ecx, edx
neg ecx
sbb ecx, ecx
add ecx, 7
mov eax, dword [ebp - 0x30]
imul ecx, dword [eax + 8]
xor eax, eax
mov edx, dword [ebp - 0x168]
cmp dword [edx + esi*4], ecx
setl al
xor ecx, ecx
cmp eax, 0x1a93
setl cl
xor eax, eax
mov edi, dword [ebp - 0x54]
cmp ecx, dword [edx + edi*4]
setl al
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x168]
mov eax, dword [ebp - 0x48]
add eax, dword [ecx + edx*4]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x168]
mov eax, dword [ecx]
mov dword [ecx + edx*4], eax
dec dword [ebp - 0x24]
push 1
pop edi
jns 0x499bc8
push 2
pop esi
lea ecx, [ebp - 0x168]
call fcn.004067f8
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0xe4]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp + eax*4 - 0xe4]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0xe4]
sub ecx, eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0xe4]
xor edx, edx
cmp ecx, eax
setne dl
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0xe4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xd8], eax
push esi
lea ecx, [ebp - 0x3dc]
call fcn.00406726
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x499cfe
xor ebx, ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3dc]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x499ce8
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x499d10
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [ebp - 0x3dc]
mov dword [eax], 0x4a8c6a53
lea ecx, [ebp - 0x3dc]
call fcn.004067f8
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0xe4]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0xe4]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0xe4]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, 0x9a48
setle cl
sub ecx, 0x60bae246
je 0x499d72
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x2c], 0xf22a1efe
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], esi
push 0
pop eax
jle 0x499840
cmp dword [ebp - 0x6c], eax
je 0x499de1
cmp dword [ebp - 0x44], eax
jne 0x499dc5
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x6c]
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x499dbb
cmp dword [ebp - 0x6c], eax
je 0x499dbb
mov eax, edi
imul eax, eax, 0xc16
test eax, eax
je 0x499dc7
mov eax, edi
xor ecx, ecx
cmp eax, 0x8e87
setg cl
mov eax, dword [ebp - 0x6c]
add eax, ecx
cmp dword [ebp - 0x18], eax
jg 0x499ddf
mov eax, edi
jmp 0x499de1
xor eax, eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x44]
jl 0x499df8
xor eax, eax
cmp dword [ebp - 0x6c], eax
mov ecx, eax
je 0x499dfa
mov ecx, edi
mov eax, dword [ebp - 0xe4]
imul eax, ecx
test eax, eax
je 0x499fb9
mov dword [ebp - 0x50], 0
cmp dword [ebp - 0x50], 0xf
jle 0x49a54f
push 3
pop ebx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x18], 0xe3e7631
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x48], 0xfc53d8b3
push ebx
lea ecx, [ebp - 0x4fc]
call fcn.00406726
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x499e63
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4fc]
mov dword [eax + ecx*4], 0xdd5c0aec
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x499e49
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x499e94
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x18ed
push 0xc16
push 0x2120
push 0x93a
push 0x1fd6
call dword [sym.imp.GDI32.dll_CreateFontA]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, dword [ebp - 0x18]
imul eax, ecx
xor edx, edx
cmp eax, 0xa9da
setg dl
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x40]
je 0x499ece
cmp dword [ebp - 0x40], 0
je 0x499ece
mov edx, edi
jmp 0x499ed0
xor edx, edx
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, edx
setge cl
add ecx, dword [ebp - 0x40]
je 0x499eee
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], 0x6986d6
jmp 0x499f92
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x30], 0x9b4ccc41
mov dword [ebp - 0x20], 0xffffffe3
jmp 0x499f88
push ebx
lea ecx, [ebp - 0x840]
call fcn.00406726
mov dword [ebp - 0x54], 0xffffffff
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x499f3b
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x840]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x499f25
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x499f5f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4fc]
mov eax, dword [ebp - 0x38]
add eax, dword [ecx + 4]
jne 0x499f5d
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x499f6b
cmp dword [ebp - 0x30], eax
mov edx, edi
jne 0x499f6d
mov edx, eax
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x20]
add eax, edx
add ecx, eax
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x840]
call fcn.004067f8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffa
jl 0x499f08
lea ecx, [ebp - 0x4fc]
call fcn.004067f8
cmp dword [ebp - 0x44], 0
jne 0x49a54f
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xf
jg 0x499e1f
jmp 0x49a54f
xor eax, eax
mov dword [ebp - 0x1c], eax
push 3
pop ebx
cmp dword [ebp - 0x1c], ebx
jge 0x499fde
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x298], 0xe1757117
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x499fc6
xor eax, eax
mov dword [ebp - 0x290], eax
jmp 0x49a02b
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x1c], 0xffffffe3
jmp 0x49a01f
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x49a01c
push 0xd92
push 0x18f2
push 0x9d6
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe9
jl 0x499ff6
dec dword [ebp - 0x290]
cmp dword [ebp - 0x290], 0xffffffef
jne 0x499fe6
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x44], 0x70d2
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x40], 0x22525a52
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x4c], 0x39fc
cmp dword [ebp - 0x4c], 0x3c3c
jle 0x49a0d4
mov dword [ebp - 0x38], eax
mov edi, eax
mov dword [ebp - 0x3c], eax
mov esi, eax
mov dword [ebp - 0x48], eax
mov ebx, eax
mov dword [ebp - 0x30], edi
mov ecx, esi
mov esi, edi
sar esi, cl
mov edi, dword [ebp - 0x38]
mov eax, esi
mov ecx, ebx
sar eax, cl
xor eax, edi
cdq
push edx
push eax
mov ecx, 0xace058
call fcn.004063d1
inc ebx
cmp ebx, 0x1fb4
jl 0x49a07d
mov esi, dword [ebp - 0x48]
inc esi
mov dword [ebp - 0x48], esi
cmp esi, 0x29dc
push 0
pop eax
mov edi, dword [ebp - 0x3c]
jl 0x49a06f
inc edi
mov dword [ebp - 0x3c], edi
cmp edi, 0x4e06
jl 0x49a06a
mov ecx, dword [ebp - 0x38]
inc ecx
mov dword [ebp - 0x38], ecx
cmp ecx, 0x3f44
jl 0x49a065
xor edi, edi
inc edi
push 2
pop esi
push 3
pop ebx
mov dword [ebp - 0x38], edi
mov dword [ebp - 4], 8
cmp dword [ebp - 0x4c], 0x3976
jge 0x49a0f6
mov edx, str.sdwzcp_ucrm_nixbopjnm_ekipxpq_zdyiejyxt_dnjuqj_qdyc_upj
mov ecx, 0xace058
call fcn.00409042
or ecx, 0xffffffff
mov dword [ebp - 4], ecx
xor eax, eax
jmp 0x49a12b
mov dword [ebp - 0x24], eax
jmp 0x49a27d
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x30], 0x951e
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], 0xb39d2057
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xe
jg 0x49a274
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x1c], eax
jmp 0x49a176
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x728], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x49a165
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
imul edx, eax
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x728]
sub edx, eax
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0x6e58d020
setl cl
xor eax, eax
cmp ecx, edx
setne al
add eax, dword [ebp - 0x24]
je 0x49a1d1
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x49a1c9
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], eax
jne 0x49a245
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x10
jne 0x49a1be
jmp 0x49a245
mov dword [ebp - 0x1c], 0
jmp 0x49a1e7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7f8], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x49a1da
mov dword [ebp - 0x50], 0
jmp 0x49a1fb
inc dword [ebp - 0x3c]
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], esi
jle 0x49a1f5
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x7f8], eax
je 0x49a21a
cmp dword [ebp - 0x20], eax
je 0x49a21a
mov eax, edi
mov dword [ebp - 0x724], eax
mov ecx, 0xa60c437f
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, 0xc8e4
jle 0x49a23c
xor eax, eax
cmp dword [ebp - 0x7f8], eax
je 0x49a23e
mov eax, edi
neg eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x49a261
push eax
push eax
push 0x1bc1
push 0x12f4
push eax
call dword [sym.imp.USER32.dll_ModifyMenuW]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xe
push 0
pop eax
push 0xffffffffffffffff
pop ecx
jle 0x49a157
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x24]
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0x24], 0xa
jle 0x49a133
cmp dword [ebp - 0x18], eax
je 0x49a295
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x18], 0
jne 0x49a298
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, 0x732b
setne cl
cmp ecx, 0xb90c
jle 0x49a2bb
cmp dword [ebp - 0x24], 0
je 0x49a2bb
mov ecx, edi
jmp 0x49a2bd
xor ecx, ecx
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x24]
imul eax, ecx
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
je 0x49a2e0
xor eax, eax
cmp dword [ebp - 0x64], eax
jne 0x49a2e7
jmp 0x49a2e2
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x49a2e9
mov eax, edi
cmp eax, 0xfffffff7
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x49a54f
mov dword [ebp - 0x50], 0xd313dd33
mov dword [ebp - 0x2c], 0x85f1871d
mov dword [ebp - 0x34], 0x177c4186
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x7a0], eax
mov dword [ebp - 0x79c], eax
mov dword [ebp - 0x798], eax
mov dword [ebp - 0x794], eax
mov dword [ebp - 0x50], 0x1a
cmp dword [ebp - 0x50], 0xffffffe8
jl 0x49a542
mov dword [ebp - 0x24], 0xfe01bd97
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x34], 0x8c37f2e4
mov dword [ebp - 0x38], 0x79c4
cmp dword [ebp - 0x38], 0x7a90
jle 0x49a3c8
mov esi, eax
mov dword [ebp - 0x3c], esi
xor ebx, ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x48], 0x32f
mov eax, esi
cdq
push edx
push eax
lea ecx, [ebp - 0xb9c]
call fcn.00401a01
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x49a399
mov eax, dword [eax]
push eax
call fcn.004a68c7
pop ecx
push ebx
push edi
lea ecx, [ebp - 0xb9c]
call fcn.00406da6
dec esi
dec dword [ebp - 0x48]
jne 0x49a37f
mov esi, dword [ebp - 0x3c]
inc esi
mov dword [ebp - 0x3c], esi
cmp esi, 0x5c77
jl 0x49a375
push 2
pop esi
push 3
pop ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x38], 0x7653
jge 0x49a3e6
push str.auxoblr_neglr_rcny_gapa_ewhj_ztanwhedd_igsbrlesq_motkuvta_eumdh
call fcn.004a68c7
pop ecx
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x49a417
push 4
pop ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x49a43a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x354], 0xfb361f3d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x49a422
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1a
jle 0x49a538
jmp 0x49a44c
push 4
pop ecx
push ecx
lea ecx, [ebp - 0x3f4]
call fcn.00406726
mov dword [ebp - 0x48], 0x7bbda73a
mov dword [ebp - 0x34], 0x2f400034
mov dword [ebp - 0x1c], 0
push 4
pop edx
jmp 0x49a481
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3f4]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x49a472
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0
je 0x49a4d8
mov esi, dword [ebp - 0x3f4]
mov ecx, dword [esi + 0xc]
sub ecx, 0x77f17245
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
setg dl
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setg cl
mov eax, 0xa66fa4bc
cmp eax, ecx
sbb eax, eax
inc eax
xor ecx, ecx
cmp eax, ebx
setl cl
mov eax, dword [ebp - 0x50]
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [esi + 0xc]
neg edx
sbb edx, edx
inc edx
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp eax, ecx
setl dl
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x24]
je 0x49a4fa
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x50]
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
jmp 0x49a50e
mov dword [ebp - 0x30], 0x9efec1a2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x2b
jle 0x49a504
dec dword [ebp - 0x350]
lea ecx, [ebp - 0x3f4]
call fcn.004067f8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1a
push 3
pop ebx
jg 0x49a449
push 2
pop esi
dec dword [ebp - 0x50]
xor eax, eax
jmp 0x49a33c
push eax
push eax
push 0xa60
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 0x24], 0x62e08974
mov dword [ebp - 0x48], 0x66fe
mov dword [ebp - 0x50], 0xcb0b
push edi
lea ecx, [ebp - 0x274]
call fcn.00406726
or edx, 0xffffffff
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], 0
jmp 0x49a592
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x274]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x49a57f
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0
je 0x49a5af
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x50]
neg ecx
sub ecx, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
inc ecx
mov eax, dword [ebp - 0x274]
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x49a691
mov dword [ebp - 0x38], 0x3a21b78c
mov dword [ebp - 0x30], 0x32da3bb1
mov dword [ebp - 0x50], eax
jmp 0x49a686
mov dword [ebp - 0x34], 0xa2e255bb
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x49a66b
push 4
pop ebx
push ebx
lea ecx, [ebp - 0x58c]
call fcn.00406726
mov dword [ebp - 0x1c], 0
jmp 0x49a61f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x58c]
mov dword [eax + ecx*4], 0x6652f093
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x49a60c
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp eax, edi
setge dl
sub edx, dword [ebp - 0x38]
neg edx
sbb edx, edx
inc edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x274]
xor ebx, ebx
lea ecx, [ebp - 0x58c]
cmp dword [eax], ebx
jne 0x49a664
call fcn.004067f8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x49a5f4
jmp 0x49a669
call fcn.004067f8
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x49a683
push eax
push 0x19b8
push eax
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
xor eax, eax
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jle 0x49a5e5
jmp 0x49a6aa
mov dword [ebp - 0x2c], eax
jmp 0x49a6a5
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x274]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x49a696
lea ecx, [ebp - 0x274]
call fcn.004067f8
mov eax, 0x50fccc
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x18], 0x283d1f0d
mov dword [ebp - 0x44], 0xe2ad21dd
mov dword [ebp - 0x50], 0x2130bec3
xor eax, eax
mov dword [ebp - 0x24], eax
push 3
pop ebx
cmp dword [ebp - 0x24], ebx
jge 0x49a6fa
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf8], 0xa8eac8b1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x49a6e2
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x49a717
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7c], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x49a702
xor eax, eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], esi
jg 0x49a7fa
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x1c], eax
jmp 0x49a740
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc4], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x49a72f
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xf8]
sub ecx, eax
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xf8]
xor edx, edx
cmp ecx, eax
setne dl
mov eax, dword [ebp - 0x78]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, 0x9a48
setle cl
sub ecx, 0x60bae246
je 0x49a7e4
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x2c], 0xf22a1efe
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], esi
push 0
pop eax
jle 0x49a723
cmp dword [ebp - 0x78], eax
je 0x49a853
cmp dword [ebp - 0x44], eax
jne 0x49a837
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x78]
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x49a82d
cmp dword [ebp - 0x78], eax
je 0x49a82d
mov eax, edi
imul eax, eax, 0xc16
test eax, eax
je 0x49a839
mov eax, edi
xor ecx, ecx
cmp eax, 0x8e87
setg cl
mov eax, dword [ebp - 0x78]
add eax, ecx
cmp dword [ebp - 0x18], eax
jg 0x49a851
mov eax, edi
jmp 0x49a853
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x44]
jl 0x49a86a
xor eax, eax
cmp dword [ebp - 0x78], eax
mov ecx, eax
je 0x49a86c
mov ecx, edi
mov eax, dword [ebp - 0xf8]
imul eax, ecx
test eax, eax
je 0x49a890
xor eax, eax
mov dword [ebp - 0x50], eax
jmp 0x49a888
cmp dword [ebp - 0x44], eax
jne 0x49a8a9
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xf
jg 0x49a880
jmp 0x49a8a9
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x49a8a7
push eax
push eax
push 0xa60
call dword [sym.imp.USER32.dll_SetPropA]
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x657689a
mov dword [ebp - 0x2c], 0xa519d814
mov dword [ebp - 0x3c], 0x145c1747
mov dword [ebp - 0x50], 0x688
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x1c], eax
jmp 0x49a8e1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x40c], 0xafd061a6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x49a8d0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0
jne 0x49a902
mov dword [ebp - 0x48], edi
mov ecx, dword [ebp - 0x48]
mov eax, 0xaa29
sub eax, ecx
jne 0x49a902
mov ecx, edi
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, eax
sete dl
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setge cl
imul eax, ecx, 0xfffa
test eax, eax
jne 0x49a962