Function at 0x413113
Capabilities:
Delete directory
Enumerate gui resources
Get disk size
Log keystrokes
Query or enumerate registry key
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2618
call fcn.004721d0
push esi
push edi
mov dword [ebp - 0x1610], 0xfff7
mov dword [ebp - 0xbc], 0x69ad59e5
mov dword [ebp - 0x1614], 0xe9bf9f36
mov dword [ebp - 0x3dc], 7
mov dword [ebp - 0x3e0], 0xfffffff8
mov dword [ebp - 0x1d2c], 0xfffffffd
mov dword [ebp - 0x1d28], 0xfffffffd
mov dword [ebp - 0x1d24], 0xfffffffd
mov dword [ebp - 0x1d20], 0xfffffffd
lea ecx, [ebp - 0x79d]
call fcn.004012bc
push eax
lea eax, [ebp - 0x1d1c]
push eax
lea eax, [ebp - 0x1d2c]
push eax
lea ecx, [ebp - 0x2558]
call fcn.004012bf
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2180]
call fcn.0040126b
push 1
lea ecx, [ebp - 0x1e14]
call fcn.004011bf
mov dword [ebp - 0x1628], 0xfd6b2214
mov dword [ebp - 0x554], 0
jmp 0x4131e1
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 1
jge 0x413203
push dword [ebp - 0x554]
lea ecx, [ebp - 0x1e14]
call fcn.004012ad
mov dword [eax], 0x268dd2ac
jmp 0x4131d4
mov eax, dword [ebp - 0x1610]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x1614], eax
cmp dword [ebp - 0x1614], 0
jne 0x413230
mov dword [ebp - 0x1618], 1
jmp 0x413237
and dword [ebp - 0x1618], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x2348], eax
mov eax, dword [ebp - 0x3dc]
mov ecx, dword [ebp - 0x3e0]
sub ecx, 0xfffa
sub eax, ecx
cmp eax, dword [ebp - 0x3e0]
jge 0x41326b
mov dword [ebp - 0x15cc], 1
jmp 0x413272
and dword [ebp - 0x15cc], 0
mov eax, dword [ebp - 0x15cc]
sub eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0xbc]
jg 0x413292
mov dword [ebp - 0x17b8], 1
jmp 0x413299
and dword [ebp - 0x17b8], 0
xor eax, eax
sub eax, dword [ebp - 0x3e0]
jne 0x4132b5
cmp dword [ebp - 0xbc], 0
jne 0x4132b5
and dword [ebp - 0x15f8], 0
jmp 0x4132bf
mov dword [ebp - 0x15f8], 1
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x15f8], eax
jge 0x4132d9
mov dword [ebp - 0x790], 1
jmp 0x4132e0
and dword [ebp - 0x790], 0
push 2
lea ecx, [ebp - 0x2180]
call fcn.004012ad
mov ecx, dword [ebp - 0x790]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3dc]
cmp dword [ebp - 0x790], eax
jne 0x41330f
mov dword [ebp - 0x1600], 1
jmp 0x413316
and dword [ebp - 0x1600], 0
cmp dword [ebp - 0x1600], 0xccb0
jge 0x41332e
mov dword [ebp - 0x1608], 1
jmp 0x413335
and dword [ebp - 0x1608], 0
cmp dword [ebp - 0x1608], 0xc51a
jl 0x41334d
mov dword [ebp - 0x6f4], 1
jmp 0x413354
and dword [ebp - 0x6f4], 0
push 0
lea ecx, [ebp - 0x1e14]
call fcn.004012ad
mov ecx, dword [ebp - 0x6f4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3dc]
mov ecx, dword [ebp - 0x6f4]
lea eax, [ecx + eax + 0x4548dea1]
neg eax
sub eax, dword [ebp - 0x1610]
cmp dword [ebp - 0x1618], eax
jg 0x413398
mov dword [ebp - 0x1620], 1
jmp 0x41339f
and dword [ebp - 0x1620], 0
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1628], eax
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x1628], eax
jl 0x4133c5
mov dword [ebp - 0x1630], 1
jmp 0x4133cc
and dword [ebp - 0x1630], 0
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0x1630]
jge 0x4133e6
mov dword [ebp - 0x1638], 1
jmp 0x4133ed
and dword [ebp - 0x1638], 0
mov eax, dword [ebp - 0x3dc]
cmp dword [ebp - 0x1638], eax
jg 0x413407
mov dword [ebp - 0x1680], 1
jmp 0x41340e
and dword [ebp - 0x1680], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x1680], eax
jl 0x413428
mov dword [ebp - 0x1688], 1
jmp 0x41342f
and dword [ebp - 0x1688], 0
mov eax, dword [ebp - 0x3e0]
cmp dword [ebp - 0x1688], eax
jle 0x413449
mov dword [ebp - 0x7d4], 1
jmp 0x413450
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0xbc], eax
lea ecx, [ebp - 0x1e14]
call fcn.00401291
lea ecx, [ebp - 0x2180]
call fcn.00401291
mov dword [ebp - 0x2300], 0xffffffff
mov dword [ebp - 0x2114], 0
mov dword [ebp - 0x2428], 0x58bd4dfb
mov dword [ebp - 0x1144], 0xcc2443ac
mov dword [ebp - 0xf0], 0
jmp 0x4134b3
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x4134cf
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x588], 0x5b9b55bb
jmp 0x4134a6
mov dword [ebp - 0xf0], 0
jmp 0x4134e8
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x413504
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x211c], 0
jmp 0x4134db
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x588], 7
jmp 0x413532
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x588]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x588], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x588], 0xd
jne 0x413565
mov dword [ebp - 0x2308], 0xfffffffe
mov dword [ebp - 0x2124], 0xfffffffe
mov eax, dword [ebp - 0x1144]
inc eax
mov dword [ebp - 0x1144], eax
jmp 0x413517
mov dword [ebp - 0x8dc], 0xfff7
mov dword [ebp - 0xb8], 0x69ad59e5
mov dword [ebp - 0x278], 0xffffffff
mov dword [ebp - 0x1b54], 8
mov dword [ebp - 0x1b50], 8
mov dword [ebp - 0x1b4c], 8
mov dword [ebp - 0x1b48], 8
mov dword [ebp - 0x3e8], 0
jmp 0x4135c4
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 1
jge 0x4135e0
mov eax, dword [ebp - 0x3e8]
mov dword [ebp + eax*4 - 0x2390], 0
jmp 0x4135b7
mov dword [ebp - 0x278], 0
jmp 0x4135f9
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0x1d
jl 0x4137db
mov dword [ebp - 0x9c], 0xffffffff
mov dword [ebp - 0x9c], 0
jmp 0x413629
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jg 0x41365f
mov dword [ebp - 0x212c], 0x6dd8
mov dword [ebp - 0x2310], 0xfffffffe
mov dword [ebp - 0x7dc], 1
mov eax, dword [ebp - 0x7dc]
inc eax
mov dword [ebp - 0x7dc], eax
jmp 0x41361c
mov dword [ebp - 0x9c], 0
jmp 0x413678
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jg 0x4137d6
mov dword [ebp - 0x500], 0x868bb4aa
mov dword [ebp - 0x500], 0
jmp 0x4136a8
mov eax, dword [ebp - 0x500]
inc eax
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 3
jg 0x4137bf
mov dword [ebp - 0x334], 0x348cc383
mov dword [ebp - 0x3f0], 0
jmp 0x4136d8
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 3
jge 0x4136f4
mov eax, dword [ebp - 0x3f0]
mov dword [ebp + eax*4 - 0x2490], 0xfffb
jmp 0x4136cb
mov dword [ebp - 0x334], 0
jmp 0x41370d
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 3
jg 0x4137ba
mov dword [ebp - 0x114c], 0x233fd52
mov eax, dword [ebp - 0x9c]
cmp dword [ebp + eax*4 - 0x1b54], 2
jb 0x413740
mov dword [ebp - 0x1818], 1
jmp 0x413747
and dword [ebp - 0x1818], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2490]
mov dword [ebp - 0x114c], eax
cmp dword [ebp - 0x114c], 1
je 0x41376e
mov dword [ebp - 0x7e4], 1
jmp 0x413775
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x7e4], eax
jle 0x41378f
mov dword [ebp - 0x1820], 1
jmp 0x413796
and dword [ebp - 0x1820], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x2134], eax
mov eax, dword [ebp - 0x334]
mov ecx, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0x1b54], ecx
jmp 0x413700
jmp 0x41369b
mov eax, dword [ebp - 0x9c]
cmp dword [ebp + eax*4 - 0x1b54], 0
je 0x4137d1
jmp 0x4137d6
jmp 0x41366b
jmp 0x4135ec
mov dword [ebp - 0x1264], 0xe9bf9f36
push 3
lea ecx, [ebp - 0x62c]
call fcn.004011bf
mov dword [ebp - 0x8c], 0x6915a136
mov dword [ebp - 0x3f8], 1
mov dword [ebp - 0x11a4], 0x5fdfda84
mov dword [ebp - 0x754], 0xd469
mov dword [ebp - 0x5d0], 0
jmp 0x413833
mov eax, dword [ebp - 0x5d0]
inc eax
mov dword [ebp - 0x5d0], eax
cmp dword [ebp - 0x5d0], 3
jge 0x413855
push dword [ebp - 0x5d0]
lea ecx, [ebp - 0x62c]
call fcn.004012ad
mov dword [eax], 0x8ec0
jmp 0x413826
mov dword [ebp - 0x8c], 0
jmp 0x41386e
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jg 0x413cf9
mov dword [ebp - 0x6c], 0xd53bc6e5
mov dword [ebp - 0x7c], 0x542afa01
mov dword [ebp - 0x80c], 0
mov dword [ebp - 0x11cc], 6
mov dword [ebp - 0x1830], 3
mov dword [ebp - 0x6c], 0
jmp 0x4138b7
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x4138d3
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x62c]
call fcn.004012ad
mov dword [eax], 0xa00f
jmp 0x4138b0
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x62c]
call fcn.004012ad
mov esi, dword [ebp - 0x8c]
push 1
lea ecx, [ebp - 0x62c]
call fcn.004012ad
cmp esi, dword [eax]
jge 0x413907
mov dword [ebp - 0x1154], 1
jmp 0x41390e
and dword [ebp - 0x1154], 0
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x62c]
call fcn.004012ad
mov esi, eax
push 1
lea ecx, [ebp - 0x62c]
call fcn.004012ad
mov ecx, dword [esi]
imul ecx, dword [eax]
add ecx, dword [ebp - 0x1154]
cmp ecx, dword [ebp - 0x8c]
jne 0x41394d
mov dword [ebp - 0x7ec], 1
jmp 0x413954
and dword [ebp - 0x7ec], 0
cmp dword [ebp - 0x7ec], 0xdd9cd443
jne 0x41396c
mov dword [ebp - 0x118c], 1
jmp 0x413973
and dword [ebp - 0x118c], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x118c], eax
jl 0x41398a
mov dword [ebp - 0x7f4], 1
jmp 0x413991
and dword [ebp - 0x7f4], 0
push 1
lea ecx, [ebp - 0x62c]
call fcn.004012ad
mov esi, dword [ebp - 0x7f4]
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0x62c]
call fcn.004012ad
mov eax, dword [eax]
lea eax, [esi + eax + 1]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x7c], 0
jmp 0x4139cd
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jg 0x413cf4
mov dword [ebp - 0x280], 0xfffffffa
mov dword [ebp - 0x63c], 0x39ef5b50
mov dword [ebp - 0x6c], 2
jmp 0x4139fb
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x413a45
mov byte [ebp - 0x24f], 0
movzx eax, byte [ebp - 0x24f]
test eax, eax
je 0x413a1b
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 0x255], 0
movzx eax, byte [ebp - 0x255]
test eax, eax
je 0x413a43
push 0
push 0
push 0x1ec0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x4139f4
cmp dword [ebp - 0x8c], 0
jne 0x413a8d
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x62c]
call fcn.004012ad
mov dword [ebp - 0x1194], eax
push 2
lea ecx, [ebp - 0x62c]
call fcn.004012ad
mov ecx, dword [ebp - 0x1194]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1194]
cmp dword [eax], 0
jne 0x413a8d
and dword [ebp - 0x11bc], 0
jmp 0x413a97
mov dword [ebp - 0x11bc], 1
mov dword [ebp - 0x6c], 3
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x3f8], eax
jne 0x413ac7
mov dword [ebp - 0x7fc], 1
jmp 0x413ace
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x7fc], eax
je 0x413ae5
mov dword [ebp - 0x119c], 1
jmp 0x413aec
and dword [ebp - 0x119c], 0
mov eax, dword [ebp - 0x119c]
sub eax, dword [ebp - 0x280]
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x63c], eax
jle 0x413b18
mov dword [ebp - 0x804], 1
jmp 0x413b1f
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0x11a4], eax
mov eax, dword [ebp - 0x11a4]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x80c], eax
jne 0x413b51
mov dword [ebp - 0x11ac], 1
jmp 0x413b58
and dword [ebp - 0x11ac], 0
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x11ac], eax
jg 0x413b72
mov dword [ebp - 0x814], 1
jmp 0x413b79
and dword [ebp - 0x814], 0
cmp dword [ebp - 0x814], 0xaf53c8cb
ja 0x413b91
mov dword [ebp - 0x11b4], 1
jmp 0x413b98
and dword [ebp - 0x11b4], 0
mov eax, dword [ebp - 0x7c]
imul eax, dword [ebp - 0x11b4]
cmp dword [ebp - 0x280], eax
jl 0x413bb6
mov dword [ebp - 0x81c], 1
jmp 0x413bbd
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x81c]
neg eax
cmp eax, dword [ebp - 0x7c]
jne 0x413bd6
mov dword [ebp - 0x824], 1
jmp 0x413bdd
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x11bc]
cmp eax, dword [ebp - 0x824]
jg 0x413bf7
mov dword [ebp - 0x11c4], 1
jmp 0x413bfe
and dword [ebp - 0x11c4], 0
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp - 0x11c4]
cmp eax, dword [ebp - 0x7c]
jl 0x413c1c
mov dword [ebp - 0x82c], 1
jmp 0x413c23
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x11cc], eax
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x11cc], eax
jne 0x413c49
mov dword [ebp - 0x1828], 1
jmp 0x413c50
and dword [ebp - 0x1828], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x2458], eax
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x280], eax
je 0x413c76
cmp dword [ebp - 0x63c], 0
jne 0x413c76
and dword [ebp - 0x834], 0
jmp 0x413c80
mov dword [ebp - 0x834], 1
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x834], eax
jne 0x413c9a
mov dword [ebp - 0x11d4], 1
jmp 0x413ca1
and dword [ebp - 0x11d4], 0
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x11d4], eax
jl 0x413cbb
mov dword [ebp - 0x83c], 1
jmp 0x413cc2
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x83c], eax
jle 0x413cdc
mov dword [ebp - 0x11dc], 1
jmp 0x413ce3
and dword [ebp - 0x11dc], 0
mov eax, dword [ebp - 0x11dc]
mov dword [ebp - 0x1830], eax
jmp 0x4139c6
jmp 0x413861
push 2
lea ecx, [ebp - 0x62c]
call fcn.004012ad
mov ecx, dword [ebp - 0x3f8]
cmp dword [eax], ecx
jl 0x413d1c
mov dword [ebp - 0x844], 1
jmp 0x413d23
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x3f8], eax
lea ecx, [ebp - 0x62c]
call fcn.00401291
mov dword [ebp - 0x510], 7
mov dword [ebp - 0x94], 0
push 1
lea ecx, [ebp - 0x1658]
call fcn.004011bf
mov dword [ebp - 0x508], 0x7b39
mov dword [ebp - 0x644], 0xfffffff9
mov dword [ebp - 0x6fc], 0
mov dword [ebp - 0x89c], 5
mov dword [ebp - 0x1850], 0xc6833e1a
mov dword [ebp - 0x1938], 0xffffffff
mov dword [ebp - 0x168], 0
jmp 0x413db0
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jge 0x413dcc
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x1648], 7
jmp 0x413da3
mov dword [ebp - 0x168], 0
jmp 0x413de5
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jge 0x413e07
push dword [ebp - 0x168]
lea ecx, [ebp - 0x1658]
call fcn.004012ad
mov dword [eax], 0x829cbc21
jmp 0x413dd8
mov dword [ebp - 0x94], 0
jmp 0x413e20
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jg 0x413e3f
mov dword [ebp - 0x1838], 0x4c23afc3
mov dword [ebp - 0x1838], 1
jmp 0x413e13
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1648]
mov dword [ebp - 0x11e4], eax
push 0
lea ecx, [ebp - 0x1658]
call fcn.004012ad
mov ecx, dword [ebp - 0x11e4]
mov dword [eax], ecx
cmp dword [ebp - 0x11e4], 0
jne 0x413fe3
push 0
lea ecx, [ebp - 0x1658]
call fcn.004012ad
mov ecx, dword [ebp - 0x94]
cmp dword [eax], ecx
jge 0x413e97
mov dword [ebp - 0x854], 1
jmp 0x413e9e
and dword [ebp - 0x854], 0
cmp dword [ebp - 0x94], 1
jne 0x413eb3
mov dword [ebp - 0x84c], 1
jmp 0x413eba
and dword [ebp - 0x84c], 0
cmp dword [ebp - 0x84c], 0x369d
je 0x413ed2
mov dword [ebp - 0x11ec], 1
jmp 0x413ed9
and dword [ebp - 0x11ec], 0
mov eax, dword [ebp - 0x11ec]
sub eax, 0x1432
cmp dword [ebp - 0x854], eax
jge 0x413ef8
mov dword [ebp - 0x11f4], 1
jmp 0x413eff
and dword [ebp - 0x11f4], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x11f4], eax
jne 0x413f19
mov dword [ebp - 0x85c], 1
jmp 0x413f20
and dword [ebp - 0x85c], 0
push 0
lea ecx, [ebp - 0x1658]
call fcn.004012ad
mov ecx, dword [ebp - 0x85c]
cmp ecx, dword [eax]
jne 0x413f43
mov dword [ebp - 0x11fc], 1
jmp 0x413f4a
and dword [ebp - 0x11fc], 0
push 0
lea ecx, [ebp - 0x1658]
call fcn.004012ad
mov ecx, dword [ebp - 0x11fc]
cmp ecx, dword [eax]
jl 0x413f6d
mov dword [ebp - 0x864], 1
jmp 0x413f74
and dword [ebp - 0x864], 0
cmp dword [ebp - 0x864], 0x2afb
jne 0x413f8c
mov dword [ebp - 0x1204], 1
jmp 0x413f93
and dword [ebp - 0x1204], 0
push 0
lea ecx, [ebp - 0x1658]
call fcn.004012ad
mov ecx, dword [ebp - 0x1204]
sub ecx, dword [eax]
imul eax, ecx, 0xc25c
cmp eax, dword [ebp - 0x94]
jg 0x413fc2
mov dword [ebp - 0x86c], 1
jmp 0x413fc9
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x508]
imul eax, dword [ebp - 0x86c]
test eax, eax
jne 0x413fe3
and dword [ebp - 0x1840], 0
jmp 0x413fed
mov dword [ebp - 0x1840], 1
mov eax, 0x29ad
cmp eax, 1
jbe 0x414003
mov dword [ebp - 0x120c], 1
jmp 0x41400a
and dword [ebp - 0x120c], 0
mov eax, dword [ebp - 0x120c]
neg eax
cmp eax, dword [ebp - 0x508]
jle 0x414026
mov dword [ebp - 0x874], 1
jmp 0x41402d
and dword [ebp - 0x874], 0
cmp dword [ebp - 0x874], 0x24015e1b
jl 0x414045
mov dword [ebp - 0x1214], 1
jmp 0x41404c
and dword [ebp - 0x1214], 0
mov eax, dword [ebp - 0x1214]
inc eax
cmp eax, 7
jne 0x414064
mov dword [ebp - 0x87c], 1
jmp 0x41406b
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x87c], eax
jge 0x414085
mov dword [ebp - 0x121c], 1
jmp 0x41408c
and dword [ebp - 0x121c], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x121c]
jg 0x4140a6
mov dword [ebp - 0x884], 1
jmp 0x4140ad
and dword [ebp - 0x884], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1648]
cmp dword [ebp - 0x884], eax
jl 0x4140cd
mov dword [ebp - 0x1224], 1
jmp 0x4140d4
and dword [ebp - 0x1224], 0
mov eax, dword [ebp - 0x1224]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x213c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1648]
mov dword [ebp - 0x2318], eax
push 0
lea ecx, [ebp - 0x1658]
call fcn.004012ad
cmp dword [eax], 0xa909
jge 0x414120
mov dword [ebp - 0x88c], 1
jmp 0x414127
and dword [ebp - 0x88c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1648]
cmp dword [ebp - 0x88c], eax
jl 0x414148
mov dword [ebp - 0x122c], 1
jmp 0x41414f
and dword [ebp - 0x122c], 0
mov eax, dword [ebp - 0x122c]
add eax, 5
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x1648]
cmp eax, dword [ebp - 0x508]
jge 0x41417f
mov eax, 0xbb54
test eax, eax
jne 0x41417f
and dword [ebp - 0x894], 0
jmp 0x414189
mov dword [ebp - 0x894], 1
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x644], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1648]
cmp dword [ebp - 0x644], eax
je 0x4141b6
mov dword [ebp - 0x1234], 1
jmp 0x4141bd
and dword [ebp - 0x1234], 0
mov eax, dword [ebp - 0x1234]
mov dword [ebp - 0x6fc], eax
mov eax, dword [ebp - 0x6fc]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x1648]
jne 0x4141f4
cmp dword [ebp - 0x644], 0
jne 0x4141f4
xor eax, eax
inc eax
jne 0x4141f4
and dword [ebp - 0x1848], 0
jmp 0x4141fe
mov dword [ebp - 0x1848], 1
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x2144], eax
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x2164], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1648]
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x1850], eax
mov dword [ebp - 0x1938], 0x416c0119
lea ecx, [ebp - 0x1658]
call fcn.00401291
mov dword [ebp - 0x410], 0xfffffff8
mov dword [ebp - 0x1d7c], 0xfffffffd
mov dword [ebp - 0x1d78], 0xfffffffd
mov dword [ebp - 0x1d74], 0xfffffffd
mov dword [ebp - 0x1d70], 0xfffffffd
lea ecx, [ebp - 0x785]
call fcn.004012bc
push eax
lea eax, [ebp - 0x1d6c]
push eax
lea eax, [ebp - 0x1d7c]
push eax
lea ecx, [ebp - 0x2588]
call fcn.004012bf
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x21b0]
call fcn.0040126b
mov dword [ebp - 0x400], 0xb905
mov dword [ebp - 0xc8], 5
mov dword [ebp - 0x1a8], 0x59d568d5
mov dword [ebp - 0x64c], 0xc0198ab7
mov dword [ebp - 0x124c], 0x2130
mov dword [ebp - 0x8b4], 4
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x243c], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x216c], eax
imul eax, dword [ebp - 0xc8], 0xffff
cmp eax, dword [ebp - 0x1a8]
jge 0x41432e
mov dword [ebp - 0x123c], 1
jmp 0x414335
and dword [ebp - 0x123c], 0
mov eax, dword [ebp - 0x123c]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
add eax, 0xa
cmp eax, dword [ebp - 0x400]
jle 0x41435e
mov dword [ebp - 0x8a4], 1
jmp 0x414365
and dword [ebp - 0x8a4], 0
cmp dword [ebp - 0x8a4], 3
jge 0x41437a
mov dword [ebp - 0x1244], 1
jmp 0x414381
and dword [ebp - 0x1244], 0
mov eax, dword [ebp - 0x1244]
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 0
je 0x4143ab
cmp dword [ebp - 0x64c], 0
je 0x4143ab
mov dword [ebp - 0x8ac], 1
jmp 0x4143b2
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0x124c], eax
mov eax, dword [ebp - 0x124c]
mov dword [ebp - 0x8b4], eax
mov eax, dword [ebp - 0x8b4]
neg eax
cmp eax, dword [ebp - 0x1a8]
jge 0x4143e6
mov dword [ebp - 0x1254], 1
jmp 0x4143ed
and dword [ebp - 0x1254], 0
mov eax, dword [ebp - 0x400]
cmp dword [ebp - 0x1254], eax
je 0x414407
mov dword [ebp - 0x8bc], 1
jmp 0x41440e
and dword [ebp - 0x8bc], 0
cmp dword [ebp - 0x8bc], 0x693009c
jg 0x414426
mov dword [ebp - 0x1940], 1
jmp 0x41442d
and dword [ebp - 0x1940], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x2328], eax
cmp dword [ebp - 0x400], 1
jae 0x41446b
mov byte [ebp - 0x26b], 0
movzx eax, byte [ebp - 0x26b]
test eax, eax
je 0x414466
push 0x1f26
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x414513
mov dword [ebp - 0x590], 0
jmp 0x414484
mov eax, dword [ebp - 0x590]
inc eax
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 3
jge 0x4144a0
mov eax, dword [ebp - 0x590]
mov dword [ebp + eax*4 - 0x2544], 0
jmp 0x414477
mov dword [ebp - 0x1a8], 0xffffffe3
jmp 0x4144b9
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x3c
jl 0x414513
mov dword [ebp - 0xc8], 0
jmp 0x4144db
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x4144f7
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x2544], 4
jmp 0x4144ce
mov byte [ebp - 0x257], 0
movzx eax, byte [ebp - 0x257]
test eax, eax
je 0x414511
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x4144ac
push 1
lea ecx, [ebp - 0x1d9c]
call fcn.004011bf
mov dword [ebp - 0x1284], 0xfd6b2214
mov dword [ebp - 0x408], 0
jmp 0x414543
mov eax, dword [ebp - 0x408]
inc eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 1
jge 0x414565
push dword [ebp - 0x408]
lea ecx, [ebp - 0x1d9c]
call fcn.004012ad
mov dword [eax], 0x268dd2ac
jmp 0x414536
mov dword [ebp - 0x2c8], 0x2304b25b
mov dword [ebp - 0x784], 0x272a727
mov dword [ebp - 0x704], 0xfffffff9
push 4
lea ecx, [ebp - 0x21a0]
call fcn.004011bf
mov dword [ebp - 0x2174], 0xa83a
mov dword [ebp - 0x23b0], 0
push 3
lea ecx, [ebp - 0x2190]
call fcn.004011bf
mov dword [ebp - 0x654], 1
mov dword [ebp - 0x54], 0
jmp 0x4145cb
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x4145e7
push dword [ebp - 0x54]
lea ecx, [ebp - 0x21a0]
call fcn.004012ad
mov dword [eax], 0x456160cb
jmp 0x4145c4
mov dword [ebp - 0x54], 0
jmp 0x4145f7
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x41460d
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x25e8], 0x5a9c
jmp 0x4145f0
mov dword [ebp - 0x54], 0
jmp 0x41461d
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x414639
push dword [ebp - 0x54]
lea ecx, [ebp - 0x2190]
call fcn.004012ad
mov dword [eax], 0x24489be6
jmp 0x414616
cmp dword [ebp - 0x2c8], 0
je 0x41464b
cmp dword [ebp - 0x2c8], 0
jne 0x41465e
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x2c8]
sub eax, dword [ebp - 0x2c8]
cmp eax, dword [ebp - 0x2c8]
jge 0x41467e
mov dword [ebp - 0x125c], 1
jmp 0x414685
and dword [ebp - 0x125c], 0
mov eax, dword [ebp - 0x784]
cmp eax, dword [ebp - 0x125c]
jne 0x41469f
mov dword [ebp - 0x8c4], 1
jmp 0x4146a6
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0x654]
inc eax
mov dword [ebp - 0x654], eax
mov eax, dword [ebp - 0x704]
sub eax, dword [ebp - 0x654]
mov dword [ebp - 0x704], eax
lea ecx, [ebp - 0x2190]
call fcn.00401291
lea ecx, [ebp - 0x21a0]
call fcn.00401291
mov eax, dword [ebp - 0x8dc]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x1264], eax
cmp dword [ebp - 0x1264], 0
jne 0x414714
mov dword [ebp - 0x127c], 1
jmp 0x41471b
and dword [ebp - 0x127c], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x2184], eax
mov eax, dword [ebp - 0x510]
mov ecx, dword [ebp - 0x410]
sub ecx, 0xfffa
sub eax, ecx
cmp eax, dword [ebp - 0x410]
jge 0x41474f
mov dword [ebp - 0x8cc], 1
jmp 0x414756
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x8cc]
sub eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xb8]
jg 0x414776
mov dword [ebp - 0x1948], 1
jmp 0x41477d
and dword [ebp - 0x1948], 0
xor eax, eax
sub eax, dword [ebp - 0x410]
jne 0x414799
cmp dword [ebp - 0xb8], 0
jne 0x414799
and dword [ebp - 0x126c], 0
jmp 0x4147a3
mov dword [ebp - 0x126c], 1
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x126c], eax
jge 0x4147bd
mov dword [ebp - 0x65c], 1
jmp 0x4147c4
and dword [ebp - 0x65c], 0
push 2
lea ecx, [ebp - 0x21b0]
call fcn.004012ad
mov ecx, dword [ebp - 0x65c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x510]
cmp dword [ebp - 0x65c], eax
jne 0x4147f3
mov dword [ebp - 0x8d4], 1
jmp 0x4147fa
and dword [ebp - 0x8d4], 0
cmp dword [ebp - 0x8d4], 0xccb0
jge 0x414812
mov dword [ebp - 0x1274], 1
jmp 0x414819
and dword [ebp - 0x1274], 0
cmp dword [ebp - 0x1274], 0xc51a
jl 0x414831
mov dword [ebp - 0x75c], 1
jmp 0x414838
and dword [ebp - 0x75c], 0
push 0
lea ecx, [ebp - 0x1d9c]
call fcn.004012ad
mov ecx, dword [ebp - 0x75c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x510]
mov ecx, dword [ebp - 0x75c]
lea eax, [ecx + eax + 0x4548dea1]
neg eax
sub eax, dword [ebp - 0x8dc]
cmp dword [ebp - 0x127c], eax
jg 0x41487c
mov dword [ebp - 0x8e4], 1
jmp 0x414883
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x1284], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x1284], eax
jl 0x4148a9
mov dword [ebp - 0x8ec], 1
jmp 0x4148b0
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x8ec]
jge 0x4148ca
mov dword [ebp - 0x128c], 1
jmp 0x4148d1
and dword [ebp - 0x128c], 0
mov eax, dword [ebp - 0x510]
cmp dword [ebp - 0x128c], eax
jg 0x4148eb
mov dword [ebp - 0x8f4], 1
jmp 0x4148f2
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x8f4], eax
jl 0x41490c
mov dword [ebp - 0x1294], 1
jmp 0x414913
and dword [ebp - 0x1294], 0
mov eax, dword [ebp - 0x410]
cmp dword [ebp - 0x1294], eax
jle 0x41492d
mov dword [ebp - 0x8fc], 1
jmp 0x414934
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x8fc]
mov dword [ebp - 0xb8], eax
lea ecx, [ebp - 0x1d9c]
call fcn.00401291
lea ecx, [ebp - 0x21b0]
call fcn.00401291
push 1
lea ecx, [ebp - 0x1b80]
call fcn.004011bf
push 3
lea ecx, [ebp - 0x16cc]
call fcn.004011bf
push 2
lea ecx, [ebp - 0x178c]
call fcn.004011bf
mov dword [ebp - 0x288], 8
mov dword [ebp - 0x12a4], 4
mov dword [ebp - 0x14], 0
jmp 0x4149a1
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x4149b7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1748], 7
jmp 0x41499a
mov dword [ebp - 0x14], 0
jmp 0x4149c7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x4149e3
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1b80]
call fcn.004012ad
mov dword [eax], 6
jmp 0x4149c0
mov dword [ebp - 0x14], 0
jmp 0x4149f3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x414a0f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x16cc]
call fcn.004012ad
mov dword [eax], 0xfffffffd
jmp 0x4149ec
mov dword [ebp - 0x14], 0
jmp 0x414a1f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x414a38
push dword [ebp - 0x14]
lea ecx, [ebp - 0x178c]
call fcn.004012ad
or dword [eax], 0xffffffff
jmp 0x414a18
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1748]
mov dword [ebp - 0x664], eax
push 0
lea ecx, [ebp - 0x1b80]
call fcn.004012ad
mov ecx, dword [ebp - 0x664]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x16cc]
call fcn.004012ad
mov ecx, dword [ebp - 0x664]
mov dword [eax], ecx
cmp dword [ebp - 0x664], 0
je 0x414ba6
push 0
lea ecx, [ebp - 0x178c]
call fcn.004012ad
cmp dword [eax], 0
je 0x414b7c
push 0
lea ecx, [ebp - 0x178c]
call fcn.004012ad
cmp dword [eax], 7
je 0x414ab6
mov dword [ebp - 0x1950], 1
jmp 0x414abd
and dword [ebp - 0x1950], 0
push 0
lea ecx, [ebp - 0x178c]
call fcn.004012ad
push 0
lea ecx, [ebp - 0x16cc]
call fcn.004012ad
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x1748]
push 1
lea ecx, [ebp - 0x16cc]
call fcn.004012ad
cmp esi, dword [eax]
je 0x414b01
mov dword [ebp - 0x70c], 1
jmp 0x414b08
and dword [ebp - 0x70c], 0
push 0
lea ecx, [ebp - 0x1b80]
call fcn.004012ad
mov ecx, dword [ebp - 0x70c]
mov dword [eax], ecx
cmp dword [ebp - 0x70c], 0
jne 0x414b41
push 1
lea ecx, [ebp - 0x178c]
call fcn.004012ad
cmp dword [eax], 0
jne 0x414b41
and dword [ebp - 0x1958], 0
jmp 0x414b4b
mov dword [ebp - 0x1958], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1748]
mov dword [ebp - 0x2330], eax
push 1
lea ecx, [ebp - 0x16cc]
call fcn.004012ad
cmp dword [eax], 0
jne 0x414b7c
mov dword [ebp - 0x129c], 1
jmp 0x414b83
and dword [ebp - 0x129c], 0
push 1
lea ecx, [ebp - 0x16cc]
call fcn.004012ad
mov eax, dword [eax]
cmp eax, dword [ebp - 0x129c]
jne 0x414ba6
mov dword [ebp - 0x904], 1
jmp 0x414bad
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x288], 0
jmp 0x414bd2
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 1
jg 0x414c10
mov dword [ebp - 0x2194], 0xe7ad53a3
mov dword [ebp - 0x2440], 0
mov eax, dword [ebp - 0x12a4]
inc eax
mov dword [ebp - 0x12a4], eax
mov eax, dword [ebp - 0x288]
cmp dword [ebp + eax*4 - 0x1748], 0
je 0x414c0e
jmp 0x414c10
jmp 0x414bc5
lea ecx, [ebp - 0x178c]
call fcn.00401291
lea ecx, [ebp - 0x16cc]
call fcn.00401291
lea ecx, [ebp - 0x1b80]
call fcn.00401291
mov dword [ebp - 0x7a4], 0x7013
mov dword [ebp - 0xf8], 1
mov dword [ebp - 0x66c], 0x9f89
mov dword [ebp - 0x92c], 0x218670fc
push 1
lea ecx, [ebp - 0x1e2c]
call fcn.004011bf
mov dword [ebp - 0x12bc], 0xf47073e7
mov dword [ebp - 0x1968], 0
mov dword [ebp - 0x610], 0
jmp 0x414c93
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 1
jge 0x414cb5
push dword [ebp - 0x610]
lea ecx, [ebp - 0x1e2c]
call fcn.004012ad
mov dword [eax], 5
jmp 0x414c86
cmp dword [ebp - 0xf8], 0x2759951e
je 0x414ccd
mov dword [ebp - 0x90c], 1
jmp 0x414cd4
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
je 0x414dd7
cmp dword [ebp - 0xf8], 0xffffffff
je 0x414d02
mov dword [ebp - 0x1960], 1
jmp 0x414d09
and dword [ebp - 0x1960], 0
cmp dword [ebp - 0xf8], 0
je 0x414d27
mov eax, 0xf06e
test eax, eax
je 0x414d27
mov dword [ebp - 0x12ac], 1
jmp 0x414d2e
and dword [ebp - 0x12ac], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x12ac], eax
jge 0x414d48
mov dword [ebp - 0x914], 1
jmp 0x414d4f
and dword [ebp - 0x914], 0
cmp dword [ebp - 0x914], 0xcbbbc254
jae 0x414d62
cmp dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x92c]
cmp dword [ebp - 0xf8], eax
jne 0x414d88
mov dword [ebp - 0x12b4], 1
jmp 0x414d8f
and dword [ebp - 0x12b4], 0
mov eax, dword [ebp - 0x12b4]
sub eax, dword [ebp - 0x66c]
mov dword [ebp - 0x91c], eax
push 0
lea ecx, [ebp - 0x1e2c]
call fcn.004012ad
mov ecx, dword [ebp - 0x91c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x12bc], eax
cmp dword [ebp - 0x12bc], 0
je 0x414dd7
mov dword [ebp - 0x924], 1
jmp 0x414dde
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x66c]
cmp dword [ebp - 0x924], eax
jl 0x414df8
mov dword [ebp - 0x12c4], 1
jmp 0x414dff
and dword [ebp - 0x12c4], 0
mov eax, dword [ebp - 0x7a4]
inc eax
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x12c4]
sub eax, dword [ebp - 0x92c]
cmp dword [ebp - 0x7a4], eax
jl 0x414e2c
mov dword [ebp - 0x12cc], 1
jmp 0x414e33
and dword [ebp - 0x12cc], 0
mov eax, dword [ebp - 0x12cc]
mov dword [ebp - 0x1968], eax
mov byte [ebp - 0x265], 0
movzx eax, byte [ebp - 0x265]
test eax, eax
je 0x414e67
push 0
push 0
push 0x1f09
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x1e2c]
call fcn.00401291
push 2
lea ecx, [ebp - 0x3a8]
call fcn.004011bf
mov dword [ebp - 0x714], 0xf93f8de9
push 2
lea ecx, [ebp - 0x1c40]
call fcn.004011bf
mov dword [ebp - 0x12e4], 0x1885a1ec
mov dword [ebp - 0x12ec], 0xffffffff
or dword [ebp - 0x1d04], 0xffffffff
or dword [ebp - 0x1d00], 0xffffffff
or dword [ebp - 0x1cfc], 0xffffffff
or dword [ebp - 0x1cf8], 0xffffffff
lea ecx, [ebp - 0x75d]
call fcn.004012bc
push eax
lea eax, [ebp - 0x1cf4]
push eax
lea eax, [ebp - 0x1d04]
push eax
lea ecx, [ebp - 0x2580]
call fcn.004012bf
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x16d8]
call fcn.0040126b
mov dword [ebp - 0x674], 0x4c5f6b4a
mov dword [ebp - 0x99c], 0xb265
mov dword [ebp - 0x67c], 0x5cd4dcd7
mov dword [ebp - 0x684], 0xd98c6833
mov dword [ebp - 0x68c], 0x1323
mov dword [ebp - 0x9a4], 0x4cec8e44
mov dword [ebp - 0xc], 0
jmp 0x414f47
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x414f5d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x764], 0xfff9
jmp 0x414f40
mov dword [ebp - 0xc], 0
jmp 0x414f6d
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x414f86
push dword [ebp - 0xc]
lea ecx, [ebp - 0x3a8]
call fcn.004012ad
or dword [eax], 0xffffffff
jmp 0x414f66
mov dword [ebp - 0xc], 0
jmp 0x414f96
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x414fb2
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1c40]
call fcn.004012ad
mov dword [eax], 0x121f2059
jmp 0x414f8f
mov dword [ebp - 0xc], 0
jmp 0x414fc2
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x414fd8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x249c], 0xad94
jmp 0x414fbb
push 1
lea ecx, [ebp - 0x3a8]
call fcn.004012ad
and dword [eax], 0
jmp 0x41500e
push 1
lea ecx, [ebp - 0x3a8]
call fcn.004012ad
mov dword [ebp - 0x934], eax
mov eax, dword [ebp - 0x934]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x934]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x3a8]
call fcn.004012ad
cmp dword [eax], 0
jl 0x415048
mov byte [ebp - 0x1dd], 0
movzx eax, byte [ebp - 0x1dd]
test eax, eax
je 0x415046
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
jmp 0x414fea
push 1
lea ecx, [ebp - 0x3a8]
call fcn.004012ad
cmp dword [eax], 0
je 0x4153bc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x764]
mov dword [ebp - 0x21a4], eax
push 0
lea ecx, [ebp - 0x3a8]
call fcn.004012ad
cmp dword [eax], 0x839bf5bf
jbe 0x415092
mov dword [ebp - 0x12d4], 1
jmp 0x415099
and dword [ebp - 0x12d4], 0
cmp dword [ebp - 0x12d4], 0
jne 0x4150ae
mov dword [ebp - 0x93c], 1
jmp 0x4150b5
and dword [ebp - 0x93c], 0
push 1
lea ecx, [ebp - 0x3a8]
call fcn.004012ad
mov ecx, dword [ebp - 0x93c]
cmp ecx, dword [eax]
jge 0x4150d8
mov dword [ebp - 0x12dc], 1
jmp 0x4150df
and dword [ebp - 0x12dc], 0
mov eax, dword [ebp - 0x12dc]
mov dword [ebp - 0x714], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x764]
cmp dword [ebp - 0x714], eax
je 0x41510c
mov dword [ebp - 0x944], 1
jmp 0x415113
and dword [ebp - 0x944], 0
push 1
lea ecx, [ebp - 0x1c40]
call fcn.004012ad
mov ecx, dword [ebp - 0x944]
imul ecx, dword [eax]
mov dword [ebp - 0x12e4], ecx
mov esi, dword [ebp - 0x12e4]
push 1
lea ecx, [ebp - 0x3a8]
call fcn.004012ad
cmp esi, dword [eax]
je 0x415152
mov dword [ebp - 0x94c], 1
jmp 0x415159
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0x12ec], eax
cmp dword [ebp - 0x12ec], 0
je 0x41518c
push 3
lea ecx, [ebp - 0x16d8]
call fcn.004012ad
cmp dword [eax], 0
je 0x41518c
mov dword [ebp - 0x954], 1
jmp 0x415193
and dword [ebp - 0x954], 0
push 1
lea ecx, [ebp - 0x3a8]
call fcn.004012ad
mov ecx, dword [ebp - 0x954]
cmp ecx, dword [eax]
jne 0x4151b6
mov dword [ebp - 0x12f4], 1
jmp 0x4151bd
and dword [ebp - 0x12f4], 0
mov eax, dword [ebp - 0x12f4]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x674]
mov ecx, dword [ebp - 0x99c]
lea esi, [eax + ecx + 1]
push 3
lea ecx, [ebp - 0x16d8]
call fcn.004012ad
cmp esi, dword [eax]
jl 0x4151f6
mov dword [ebp - 0x95c], 1
jmp 0x4151fd
and dword [ebp - 0x95c], 0
cmp dword [ebp - 0x95c], 0xc3f
jne 0x415215
mov dword [ebp - 0x12fc], 1
jmp 0x41521c
and dword [ebp - 0x12fc], 0
push 1
lea ecx, [ebp - 0x3a8]
call fcn.004012ad
mov ecx, dword [ebp - 0x12fc]
imul ecx, dword [eax]
test ecx, ecx
je 0x415254
push 1
lea ecx, [ebp - 0x3a8]
call fcn.004012ad
cmp dword [eax], 0
je 0x415254
mov dword [ebp - 0x964], 1
jmp 0x41525b
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x964]
sub eax, 0xeceb
cmp eax, 0xb115
jge 0x415279
mov dword [ebp - 0x1304], 1
jmp 0x415280
and dword [ebp - 0x1304], 0
cmp dword [ebp - 0x1304], 1
je 0x415295
mov dword [ebp - 0x96c], 1
jmp 0x41529c
and dword [ebp - 0x96c], 0
push 2
lea ecx, [ebp - 0x16d8]
call fcn.004012ad
mov ecx, dword [ebp - 0x96c]
cmp ecx, dword [eax]
jl 0x4152c8
and dword [ebp - 0x131c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x764]
cmp eax, dword [ebp - 0x131c]
je 0x4153ed
cmp dword [ebp - 0x684], 0
je 0x4153ed
mov dword [ebp - 0x984], 1
jmp 0x4153f4
and dword [ebp - 0x984], 0
cmp dword [ebp - 0x984], 0xffffffff
jle 0x415409
mov dword [ebp - 0x1324], 1
jmp 0x415410
and dword [ebp - 0x1324], 0
push 1
lea ecx, [ebp - 0x3a8]
call fcn.004012ad
mov ecx, dword [ebp - 0x1324]
imul ecx, dword [eax]
cmp ecx, 2
jg 0x415437
mov dword [ebp - 0x98c], 1
jmp 0x41543e
and dword [ebp - 0x98c], 0
push 3
lea ecx, [ebp - 0x16d8]
call fcn.004012ad
mov ecx, dword [ebp - 0x98c]
cmp ecx, dword [eax]
jne 0x415461
mov dword [ebp - 0x132c], 1
jmp 0x415468
and dword [ebp - 0x132c], 0
mov eax, dword [ebp - 0x68c]
cmp dword [ebp - 0x132c], eax
jne 0x415482
mov dword [ebp - 0x994], 1
jmp 0x415489
and dword [ebp - 0x994], 0
push 1
lea ecx, [ebp - 0x1c40]
call fcn.004012ad
mov ecx, dword [ebp - 0x994]
cmp ecx, dword [eax]
jge 0x4154ac
mov dword [ebp - 0x1334], 1
jmp 0x4154b3
and dword [ebp - 0x1334], 0
cmp dword [ebp - 0x1334], 1
jle 0x4154c8
mov dword [ebp - 0x71c], 1
jmp 0x4154cf
and dword [ebp - 0x71c], 0
push 1
lea ecx, [ebp - 0x3a8]
call fcn.004012ad
mov ecx, dword [ebp - 0x71c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x99c]
cmp dword [ebp - 0x71c], eax
je 0x4154fe
mov dword [ebp - 0x133c], 1
jmp 0x415505
and dword [ebp - 0x133c], 0
mov eax, dword [ebp - 0x68c]
add eax, dword [ebp - 0x133c]
mov dword [ebp - 0x9a4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x9a4]
mov dword [ebp + eax - 0x249c], ecx
lea ecx, [ebp - 0x16d8]
call fcn.00401291
lea ecx, [ebp - 0x1c40]
call fcn.00401291
lea ecx, [ebp - 0x3a8]
call fcn.00401291
push 1
lea ecx, [ebp - 0x1be0]
call fcn.004011bf
push 3
lea ecx, [ebp - 0x39c]
call fcn.004011bf
mov dword [ebp - 0x19b0], 0
mov dword [ebp - 0x44], 0
jmp 0x41557e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x41559a
push dword [ebp - 0x44]
lea ecx, [ebp - 0x39c]
call fcn.004012ad
mov dword [eax], 6
jmp 0x415577
mov dword [ebp - 0x44], 0
jmp 0x4155aa
cmp dword [ebp - 0x44], 4
jge 0x4155c0
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x17b4], 0xfffffffd
jmp 0x4155a3
mov dword [ebp - 0x44], 0
jmp 0x4155d0