Function at 0x403980
Capabilities:
Load ntoskrnl
Query or enumerate registry value
Write file on windows

Disassembly:
mov eax, 0x1360
call fcn.00406d20
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x13], 0
xor bl, bl
call fcn.00403910
mov esi, dword [esp + 0x1374]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
lea eax, [esp + 0x74]
push 0
push eax
push 0
call sub.DDRAW.dll_DirectDrawCreate
test eax, eax
je 0x4039db
push str.DirectDrawCreate_FAILED
push eax
push esi
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
mov eax, dword [esp + 0x74]
push 0x42bb18
push 0x40c2c8
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
je 0x403a0c
push str.QueryInterface_FAILED
push eax
push esi
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ebp, eax
shr ebp, 0x10
cmp ebp, 0xa28
mov dword [esp + 0x24], ebp
jb 0x403b1d
lea edx, [esp + 0x48]
mov dword [0x42bac0], 0x16
push edx
push str.SystemCurrentControlSetControlProductOptions
push 0x80000002
mov dword [0x42bae0], 9
mov dword [0x42bb04], 0x162
mov dword [0x42bae8], 0xfb
mov dword [0x42baf4], 0xf
mov dword [esp + 0x38], 0x104
mov byte [esp + 0x278], 0
mov byte [esp + 0x279], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403b68
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x26c]
push eax
push ecx
push 0
push 0
push str.ProductSuite
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, str.Personal
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
inc ecx
cmp edx, ecx
jbe 0x403b10
mov edi, str.Personal
or ecx, 0xffffffff
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub edx, ecx
dec edx
je 0x403b10
lea eax, [esp + esi + 0x26c]
push str.Personal
push eax
call fcn.0040bb70
add esp, 8
test eax, eax
jne 0x403af5
mov bl, 1
mov edi, str.Personal
or ecx, 0xffffffff
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x2c]
not ecx
dec ecx
sub edx, ecx
dec edx
cmp esi, edx
jb 0x403ada
mov eax, dword [esp + 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403b68
mov eax, 7
mov dword [0x42bac0], 0x280
mov dword [0x42bae0], 0xa
mov dword [0x42bac4], 0x1a0
mov dword [0x42baf0], 0
mov dword [0x42baf8], 0x112
mov dword [0x42bb00], 0x1b5
mov dword [0x42bb14], eax
mov dword [0x42bafc], eax
push 2
push 0
push str.ntoskrnl.exe
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
jne 0x403bd1
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jb 0x403bad
mov ecx, dword [esp + 0x1374]
push str.Error_loading_ntoskrnl.exe._nMake_sure_that_you_have_copied_WinntSystem32_ntoskrnl.exe_from_a_nWindows_2000_system_to_the_WindowsSystem_directory.
push esi
push ecx
call fcn.00403200
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
mov edx, dword [esp + 0x1374]
push str.Error_loading_ntoskrnl.exe.
push 0
push edx
call fcn.00403200
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
lea eax, [esp + 0x18]
push eax
push 1
push esi
call fcn.004030c0
add esp, 0xc
mov dword [esp + 0x28], eax
test eax, eax
jne 0x403c0a
mov ecx, dword [esp + 0x1374]
push str.Failed_to_load_ntoskrnl_bitmap
push eax
push ecx
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
cmp ebp, 0xa28
jb 0x403c8b
mov al, byte [0x42bab8]
test al, al
je 0x403c2f
lea edx, [esp + 0x18]
push edx
push 0xd
push esi
call fcn.004030c0
add esp, 0xc
mov dword [esp + 0x20], eax
xor ecx, ecx
lea eax, [esp + 0x18]
test bl, bl
setne cl
add ecx, 0xa
push eax
push ecx
push esi
call fcn.004030c0
mov dl, bl
add esp, 0xc
neg dl
sbb edx, edx
mov dword [esp + 0x5c], eax
and edx, 0xe
add edx, 0xa4
test bl, bl
mov dword [esp + 0x44], edx
je 0x403c6a
mov eax, 9
jmp 0x403c78
mov al, byte [0x42bab8]
neg al
sbb eax, eax
and al, 0xfc
add eax, 8
lea ecx, [esp + 0x18]
push ecx
push eax
push esi
call fcn.004030c0
add esp, 0xc
mov dword [esp + 0x1c], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.font
push 0
call esi
mov edi, dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
call edi
mov ebx, eax
test ebx, ebx
jne 0x403cca
mov edx, dword [esp + 0x1374]
push str.Failed_to_load_font_bitmap
push eax
push edx
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
push str.logon
push 0
call esi
push eax
call edi
test eax, eax
mov dword [esp + 0x60], eax
jne 0x403cff
push str.Failed_to_load_logon_bitmap
push eax
mov eax, dword [esp + 0x137c]
push eax
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
push 0x42a694
push 0
call esi
push eax
call edi
test eax, eax
mov dword [esp + 0x70], eax
jne 0x403d34
mov ecx, dword [esp + 0x1374]
push str.Failed_to_load_bluescrn_bitmap
push eax
push ecx
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
push str.logon1
push 0
call esi
push eax
call edi
push 0
push 0
push 0
push 0
mov dword [esp + 0x74], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [esp + 0x1374]
mov dword [esp + 0x14], eax
mov eax, dword [0x42bb18]
push 0x11
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
test eax, eax
je 0x403d89
push str.SetCooperativeLevel_FAILED
push eax
push esi
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
mov eax, dword [0x42bb18]
push 8
push 0x1e0
push 0x280
mov ecx, dword [eax]
push eax
call dword [ecx + 0x54]
test eax, eax
je 0x403dda
mov eax, dword [0x42bb18]
push 0x10
push 0x1e0
push 0x280
mov edx, dword [eax]
push eax
call dword [edx + 0x54]
test eax, eax
je 0x403dda
push eax
push str.SetDisplayMode_FAILED:__x
push eax
push esi
call fcn.00403200
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
mov ecx, 0x1b
xor eax, eax
lea edi, [esp + 0x200]
push 0
rep stosd dword es:[edi], eax
mov eax, dword [0x42bb18]
lea edx, [esp + 0x204]
mov dword [esp + 0x204], 0x6c
mov dword [esp + 0x208], 0x21
mov dword [esp + 0x26c], 0x218
mov dword [esp + 0x218], 1
mov ecx, dword [eax]
push 0x42bb1c
push edx
push eax
call dword [ecx + 0x18]
test eax, eax
je 0x403e4e
push str.CreateSurface_FAILED
push eax
push esi
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
mov eax, dword [0x42bb1c]
lea edx, [esp + 0x6c]
mov dword [esp + 0x6c], 4
push 0x42bb20
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x30]
test eax, eax
je 0x403e89
push str.GetAttachedSurface_FAILED
push eax
push esi
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
mov edx, dword [0x42bb18]
push 0
push 0
push 0x1e0
push 0x280
push eax
push ecx
push edx
call fcn.00402410
add esp, 0x1c
mov dword [0x42bb24], eax
test eax, eax
je 0x403fa2
mov eax, dword [esp + 0x18]
mov ecx, dword [0x42bb18]
push 0
push 0
push 0x1e0
push 0x280
push eax
push ebx
push ecx
call fcn.00402410
add esp, 0x1c
mov dword [0x42bb28], eax
test eax, eax
je 0x403fa2
cmp ebp, 0xa28
jb 0x403fc5
mov al, byte [0x42bab8]
test al, al
je 0x403f41
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov ecx, dword [0x42bb18]
push 0
push 0
push 0xb0
push 0x119
push edx
push eax
push ecx
mov dword [0x42bb10], 0x119
mov dword [0x42bae4], 0xb0
call fcn.00402410
add esp, 0x1c
mov dword [esp + 0x68], eax
mov edx, dword [0x42bae0]
mov eax, dword [0x42bac0]
mov ecx, dword [esp + 0x18]
push 0
push 0
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [0x42bb18]
push ecx
push edx
push eax
call fcn.00402410
add esp, 0x1c
mov dword [0x42bb2c], eax
test eax, eax
je 0x403fa2
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x403fbd
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x18]
push 0
push 0
push 0x19
push ecx
push edx
push eax
mov eax, dword [0x42bb18]
push eax
call fcn.00402410
add esp, 0x1c
mov dword [esp + 0x28], eax
test eax, eax
jne 0x403fc5
push str.DDLoadBitmap_FAILED
push 0
push esi
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
mov dword [esp + 0x28], 0
mov ecx, dword [0x42bb18]
push 0x42a5e4
push 0
push ecx
call fcn.00402660
add esp, 0xc
mov dword [0x42bb34], eax
test eax, eax
jne 0x403ffe
push str.DDLoadPalette_FAILED
push eax
push esi
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
mov ebp, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor ebx, ebx
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
mov eax, dword [0x42bb1c]
lea ecx, [esp + 0x98]
push ecx
push 0x1000400
push ebx
mov dword [esp + 0xa4], 0x64
mov dword [esp + 0xf4], 4
mov edx, dword [eax]
push ebx
push ebx
push eax
call dword [edx + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x70]
mov ecx, dword [0x42bb20]
push ebx
push ebx
push edx
push eax
push ecx
call fcn.004024d0
add esp, 0x14
cmp eax, ebx
jne 0x404aa0
mov eax, dword [0x42bb1c]
push 1
push ebx
push eax
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [0x42bad8], ebx
call fcn.00401460
push 1
push 0x4e20
lea eax, [esp + 0x1c]
push ebx
push eax
push 1
call ebp
cmp eax, 0x102
jne 0x404a8e
mov edi, 0x40f6cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xfc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xfc]
push ecx
push 2
call fcn.00403300
mov eax, dword [esp + 0x2c]
add esp, 8
cmp eax, 0xa28
lea edx, [esp + 0xfc]
jb 0x40411a
mov edi, str.Restarting..._n
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xfc]
push ecx
push 2
jmp 0x404145
mov edi, str.Rebooting..._n
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xfc]
push ecx
push ebx
call fcn.00403300
add esp, 8
lea edx, [esp + 0x14]
push 1
push 0x7d0
push ebx
push edx
push 1
call ebp
cmp eax, 0x102
jne 0x404a8e
mov eax, dword [0x42bb1c]
lea edx, [esp + 0x98]
push edx
push 0x1000400
push ebx
mov dword [esp + 0xa4], 0x64
mov dword [esp + 0xf4], ebx
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x14]
mov esi, dword [esp + 0x24]
cmp esi, 0xa28
jb 0x4041af
call fcn.00406739
cdq
mov ecx, 0xbb8
jmp 0x4041ba
call fcn.00406739
cdq
mov ecx, 0x1f4
idiv ecx
push 1
add edx, 0x64
push edx
lea edx, [esp + 0x1c]
push ebx
push edx
push 1
call ebp
cmp eax, 0x102
jne 0x404a8e
cmp esi, 0xa28
jae 0x4044b8
lea eax, [esp + 0xfc]
push str._____________________________Starting_Windows...
push eax
mov dword [0x42bad8], 0x1a
call fcn.0040678f
mov edi, 0x40f6cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x104]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x104]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 1
call fcn.00403300
mov edi, str.________________________________________________________________________________n_n
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.For_troubleshooting_and_advanced_startup_options_for_Windows_2000__press_F8._n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 1
call fcn.00403300
mov ebx, 1
add esp, 0x18
mov dword [esp + 0x1c], ebx
test ebx, ebx
mov dword [0x42bad8], 0x1b
mov byte [esp + 0xfc], 0
jbe 0x404304
mov edx, ebx
mov edi, 0x42a4d0
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xfc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
dec edx
rep movsb byte es:[edi], byte [esi]
jne 0x4042cc
mov ebx, dword [esp + 0x1c]
mov edi, 0x40f6cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xfc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0xfc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 1
call fcn.00403300
add esp, 8
cmp ebx, 0xf
jne 0x404391
mov edi, str._______________________________________________________________________________n
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xfc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x42bad8], 0x1d
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xfc]
push ecx
push 1
call fcn.00403300
add esp, 8
mov eax, dword [0x42bab4]
test eax, eax
je 0x404451
xor esi, esi
call fcn.00406739
cdq
mov ecx, 0x64
idiv ecx
add edx, 0x14
test edx, edx
jle 0x40442d
mov ecx, dword [0x42ba84]
lea edx, [esp + 0x30]
push 0
push edx
lea eax, [esp + 0x378]
push 0x1000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
call fcn.00406739
and eax, 0x8000000f
jns 0x4043ea
dec eax
or eax, 0xfffffff0
inc eax
mov edx, dword [0x42ba84]
shl eax, 0xc
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
lea eax, [esp + 0x1c]
push 0
push eax
push 1
call ebp
cmp eax, 0x102
jne 0x404428
inc esi
call fcn.00406739
cdq
mov ecx, 0x64
idiv ecx
add edx, 0x14
cmp esi, edx
jl 0x4043b4
jmp 0x40442d
mov byte [esp + 0x13], 1
call fcn.00406739
cdq
mov ecx, 0x64
push 1
idiv ecx
push edx
lea edx, [esp + 0x1c]
push 0
push edx
push 1
call ebp
cmp eax, 0x102
jne 0x404488
jmp 0x404476
call fcn.00406739
cdq
mov ecx, 0xc8
push 1
idiv ecx
add edx, 0x64
push edx
lea edx, [esp + 0x1c]
push 0
push edx
push 1
call ebp
cmp eax, 0x102
jne 0x404488
add ebx, 2
cmp ebx, 0x50
mov dword [esp + 0x1c], ebx
jb 0x4042b4
jmp 0x40448d
mov byte [esp + 0x13], 1
push 1
push 0x960
lea eax, [esp + 0x1c]
push 0
push eax
push 1
call ebp
cmp eax, 0x102
jne 0x404a8e
mov al, byte [esp + 0x13]
test al, al
jne 0x404a8e
xor ebx, ebx
push ebx
lea edx, [esp + 0x7c]
push 0x1000000
mov eax, 0x1e0
push edx
mov edx, dword [0x42bb24]
mov dword [esp + 0x90], eax
mov dword [esp + 0xa0], eax
mov eax, dword [0x42bb20]
mov edi, 0x280
push edx
lea edx, [esp + 0x98]
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x90], edi
mov dword [esp + 0xa0], edi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
cmp dword [esp + 0x24], 0xa28
jb 0x404645
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x44]
cmp ecx, ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x58], 0x19
mov dword [esp + 0x54], eax
je 0x40458a
add eax, 0xdc
push ebx
lea esi, [esp + 0x50]
push 0x1000000
mov dword [esp + 0x44], eax
mov eax, dword [0x42bb20]
push esi
push ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x48], pe_nt_image_headers32
mov dword [esp + 0x44], 0xdc
mov dword [esp + 0x50], 0x129
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x14]
mov al, byte [0x42bab8]
test al, al
je 0x404645
mov eax, 0x64
lea ecx, [esp + 0x98]
mov dword [esp + 0x38], eax
mov dword [esp + 0x98], eax
mov eax, dword [0x42bb20]
push ecx
push 0x1000400
push ebx
lea ecx, [esp + 0x40]
mov dword [esp + 0x4c], 0x12c
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], edi
mov dword [esp + 0xf4], ebx
mov edx, dword [eax]
push ebx
push ecx
push eax
call dword [edx + 0x14]
mov eax, dword [0x42bb10]
mov ecx, dword [0x42bae4]
mov esi, eax
sub edi, eax
mov eax, 0xaaaaaaab
mov dword [esp + 0x58], ecx
mul edi
shr edx, 1
mov eax, 0x1e0
add edx, 0xa
sub eax, ecx
mov dword [esp + 0x38], edx
shr eax, 1
add edx, ecx
push ebx
lea ecx, [esp + 0x50]
mov dword [esp + 0x38], eax
push 0x1000000
add eax, esi
push ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x48], eax
mov eax, dword [0x42bb20]
push ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], esi
mov dword [esp + 0x50], edx
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x14]
mov eax, dword [0x42bb1c]
push 1
push ebx
push eax
mov edx, dword [eax]
call dword [edx + 0x2c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1374]
push eax
push ecx
call fcn.00403900
add esp, 8
lea edx, [esp + 0x14]
push 1
push 0x3e8
push ebx
push edx
push 1
call ebp
cmp eax, 0x102
jne 0x404a8e
mov eax, dword [esp + 0x24]
push 1
cmp eax, 0xa28
mov dword [0x42badc], 1
push ebx
jb 0x4046a7
push 0x4037c0
push 0xa
push 0x50
jmp 0x4046b0
push 0x403680
push 0xa
push 0x14
call dword [sym.imp.WINMM.dll_timeSetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x24], 0xa28
jae 0x4046db
mov eax, dword [esp + 0x1c]
push eax
call fcn.00403610
add esp, 4
cmp dword [0x42bab4], ebx
je 0x40479a
xor esi, esi
call fcn.00406739
cdq
mov ecx, 0x2bc
idiv ecx
add edx, 0x1f4
test edx, edx
jle 0x404773
mov ecx, dword [0x42ba84]
lea edx, [esp + 0x30]
push ebx
push edx
lea eax, [esp + 0x378]
push 0x1000
push eax
push ecx
call edi
push ebx
push ebx
call fcn.00406739
and eax, 0x8000000f
jns 0x40472f
dec eax
or eax, 0xfffffff0
inc eax
mov edx, dword [0x42ba84]
shl eax, 0xc
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push ebx
lea eax, [esp + 0x1c]
push ebx
push eax
push 1
call ebp
cmp eax, 0x102
jne 0x40476e
inc esi
call fcn.00406739
cdq
mov ecx, 0x2bc
idiv ecx
add edx, 0x1f4
cmp esi, edx
jl 0x404700
jmp 0x404773
mov byte [esp + 0x13], 1
call fcn.00406739
cdq
mov ecx, 0x64
push 1
idiv ecx
push edx
lea edx, [esp + 0x1c]
push ebx
push edx
push 1
call ebp
cmp eax, 0x102
jne 0x404a71
jmp 0x4047c2
call fcn.00406739
cdq
mov ecx, 0x320
push 1
idiv ecx
add edx, 0x64
push edx
lea edx, [esp + 0x1c]
push ebx
push edx
push 1
call ebp
cmp eax, 0x102
jne 0x404a78
mov eax, dword [esp + 0x1c]
inc eax
cmp eax, 0x14
mov dword [esp + 0x1c], eax
jb 0x4046c4
mov al, byte [esp + 0x13]
test al, al
jne 0x404a83
push 1
push 0x7d0
lea eax, [esp + 0x1c]
push ebx
push eax
push 1
call ebp
mov ecx, dword [esp + 0x20]
cmp eax, 0x102
push ecx
jne 0x404a88
call dword [sym.imp.WINMM.dll_timeKillEvent]
mov eax, dword [0x42bb1c]
lea ecx, [esp + 0x98]
push ecx
push 0x1000400
push ebx
mov dword [esp + 0xa4], 0x64
mov dword [esp + 0xf4], ebx
mov edx, dword [eax]
push ebx
push ebx
push eax
call dword [edx + 0x14]
push 1
push 0x3e8
lea edx, [esp + 0x1c]
push ebx
push edx
push 1
call ebp
cmp eax, 0x102
jne 0x404a8e
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x60]
mov edx, dword [0x42bb20]
push ebx
push ebx
push eax
push ecx
push edx
call fcn.004024d0
add esp, 0x14
cmp eax, ebx
jne 0x404aa0
mov eax, dword [0x42bb1c]
push 1
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [0x42bab4], ebx
je 0x404940
xor esi, esi
call fcn.00406739
cdq
mov ecx, 0x7d0
idiv ecx
add edx, 0x1f4
test edx, edx
jle 0x404919
mov ecx, dword [0x42ba84]
lea edx, [esp + 0x30]
push ebx
push edx
lea eax, [esp + 0x378]
push 0x1000
push eax
push ecx
call edi
push ebx
push ebx
call fcn.00406739
and eax, 0x8000000f
jns 0x4048d5
dec eax
or eax, 0xfffffff0
inc eax
mov edx, dword [0x42ba84]
shl eax, 0xc
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push ebx
lea eax, [esp + 0x1c]
push ebx
push eax
push 1
call ebp
cmp eax, 0x102
jne 0x404914
inc esi
call fcn.00406739
cdq
mov ecx, 0x7d0
idiv ecx
add edx, 0x1f4
cmp esi, edx
jl 0x4048a6
jmp 0x404919
mov byte [esp + 0x13], 1
call fcn.00406739
cdq
mov ecx, 0x3e8
push 1
idiv ecx
push edx
lea edx, [esp + 0x1c]
push ebx
push edx
push 1
call ebp
cmp eax, 0x102
jne 0x404a8e
jmp 0x404968
call fcn.00406739
cdq
mov ecx, 0xbb8
push 1
idiv ecx
add edx, 0x64
push edx
lea edx, [esp + 0x1c]
push ebx
push edx
push 1
call ebp
cmp eax, 0x102
jne 0x404a8e
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x64]
mov edx, dword [0x42bb20]
push ebx
push ebx
push eax
push ecx
push edx
call fcn.004024d0
add esp, 0x14
cmp eax, ebx
jne 0x404ac1
mov eax, dword [0x42bb1c]
push 1
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp eax, ebx
jne 0x404ae2
cmp dword [0x42bab4], ebx
je 0x404a5f
xor esi, esi
call fcn.00406739
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x1f4
test edx, edx
jle 0x404a39
mov ecx, dword [0x42ba84]
lea edx, [esp + 0x30]
push ebx
push edx
lea eax, [esp + 0x378]
push 0x1000
push eax
push ecx
call edi
push ebx
push ebx
call fcn.00406739
and eax, 0x8000000f
jns 0x4049f5
dec eax
or eax, 0xfffffff0
inc eax
mov edx, dword [0x42ba84]
shl eax, 0xc
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push ebx
lea eax, [esp + 0x1c]
push ebx
push eax
push 1
call ebp
cmp eax, 0x102
jne 0x404a34
inc esi
call fcn.00406739
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x1f4
cmp esi, edx
jl 0x4049c6
jmp 0x404a39
mov byte [esp + 0x13], 1
call fcn.00406739
cdq
mov ecx, 0x1f4
idiv ecx
push 1
push edx
lea edx, [esp + 0x1c]
push ebx
push edx
push 1
call ebp
cmp eax, 0x102
jne 0x404a8e
jmp 0x404006
call fcn.00406739
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x64
jmp 0x404a46
mov eax, dword [esp + 0x20]
push eax
jmp 0x404a7d
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.WINMM.dll_timeKillEvent]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.WINMM.dll_timeKillEvent]
call fcn.00403260
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x1360
ret
mov edx, dword [esp + 0x1374]
push str.DDReLoadBitmap_FAILED
push eax
push edx
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
push str.DDReLoadBitmap_FAILED
push eax
mov eax, dword [esp + 0x137c]
push eax
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret
mov ecx, dword [esp + 0x1374]
push str.DDReLoadBitmap_FAILED
push eax
push ecx
call fcn.00403200
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1360
ret