Function at 0x1004ce6d
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c0
push esi
push edi
mov dword [ebp - 0xd4], 0xfffffff9
mov dword [ebp - 0x17c], 0xf368a901
mov dword [ebp - 0x3ac], 0xffffffff
mov dword [ebp - 0x184], 0xa6fdd8fb
mov dword [ebp - 0x51c], 5
mov dword [ebp - 0x644], 0x5e19f8c5
mov dword [ebp - 0x640], 0x5e19f8c5
mov dword [ebp - 0x63c], 0x5e19f8c5
mov dword [ebp - 0x638], 0x5e19f8c5
mov dword [ebp - 0x120], 0
jmp 0x1004ceeb
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jge 0x1004cf07
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x75c], 0xfffffff7
jmp 0x1004cede
mov dword [ebp - 0xd4], 0
jmp 0x1004cf20
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xffffffe9
jg 0x1004d16d
mov dword [ebp - 0x4ec], 5
mov dword [ebp - 0x1b0], 0xfffffff7
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5d0], 0x9855eec8
mov dword [ebp - 0x6f8], 0xffffffff
mov dword [ebp - 0x360], 0xffffffff
mov dword [ebp - 0x72c], 0xdfa
mov dword [ebp - 0x6ec], 9
mov dword [ebp - 0x71c], 4
mov dword [ebp - 0x118], 0
jmp 0x1004cfa0
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jge 0x1004cfbc
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0x5c8], 0x1ad7ba96
jmp 0x1004cf93
cmp dword [ebp - 0x4ec], 0
jne 0x1004d049
mov dword [ebp - 0x17c], 0x12af
cmp dword [ebp - 0x17c], 0
jne 0x1004d049
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x644]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x644], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x4ec], eax
jg 0x1004d027
mov dword [ebp - 0x1a8], 1
jmp 0x1004d02e
and dword [ebp - 0x1a8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1a8]
mov dword [ebp + eax - 0x75c], ecx
cmp dword [ebp - 0x1a8], 0
je 0x1004d05b
mov eax, 0xe7c650ba
test eax, eax
jne 0x1004d05b
and dword [ebp - 0x4f4], 0
jmp 0x1004d065
mov dword [ebp - 0x4f4], 1
mov eax, dword [ebp - 0x51c]
cmp dword [ebp - 0x4f4], eax
jle 0x1004d07a
cmp dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x5c0], eax
jle 0x1004d094
mov dword [ebp - 0x508], 1
jmp 0x1004d09b
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0
jl 0x1004d0b0
mov dword [ebp - 0x490], 1
jmp 0x1004d0b7
and dword [ebp - 0x490], 0
mov eax, 0xfffc
sub eax, dword [ebp - 0x490]
add eax, 0x277fa1ad
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x1b0], eax
je 0x1004d0e7
mov dword [ebp - 0x39c], 1
jmp 0x1004d0ee
and dword [ebp - 0x39c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c8]
cmp dword [ebp - 0x39c], eax
jle 0x1004d10f
mov dword [ebp - 0x1dc], 1
jmp 0x1004d116
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x1dc], eax
je 0x1004d130
mov dword [ebp - 0x3a4], 1
jmp 0x1004d137
and dword [ebp - 0x3a4], 0
cmp dword [ebp - 0x3a4], 0xd496
jl 0x1004d14f
mov dword [ebp - 0x1e4], 1
jmp 0x1004d156
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x5d0]
add eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x3ac], eax
jmp 0x1004cf13
mov dword [ebp - 0x2c], 0xd8d1
mov dword [ebp - 0xe4], 0x3607a988
mov dword [ebp - 0x4c], 0xa94fe874
mov dword [ebp - 0xc8], 0x2bb6
mov dword [ebp - 0xdc], 0
jmp 0x1004d1a8
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jge 0x1004d1c4
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x500], 1
jmp 0x1004d19b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1ec], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ec]
mov dword [ebp + eax - 0x500], ecx
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x1ec]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xe4], eax
jle 0x1004d207
mov dword [ebp - 0x3b4], 1
jmp 0x1004d20e
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x2c], 0xb4aad9dd
jne 0x1004d22c
mov dword [ebp - 0x1f4], 1
jmp 0x1004d233
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x3b4]
cmp eax, dword [ebp - 0x1f4]
jle 0x1004d24d
mov dword [ebp - 0x3bc], 1
jmp 0x1004d254
and dword [ebp - 0x3bc], 0
cmp dword [ebp - 0x3bc], 1
jbe 0x1004d269
mov dword [ebp - 0x1fc], 1
jmp 0x1004d270
and dword [ebp - 0x1fc], 0
cmp dword [ebp - 0x1fc], 0x198a
jne 0x1004d5e6
mov dword [ebp - 0x18c], 0x1510
mov dword [ebp - 0x124], 0xffffffff
mov dword [ebp - 0x3dc], 1
mov dword [ebp - 0xc4], 0xfffffffc
mov dword [ebp - 0x1a4], 0xffffffff
mov dword [ebp - 0x224], 1
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jne 0x1004d47f
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x4c], eax
jne 0x1004d2f9
mov dword [ebp - 0x5ec], 1
jmp 0x1004d300
and dword [ebp - 0x5ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x500]
mov dword [ebp - 0x6e0], eax
xor eax, eax
jne 0x1004d329
cmp dword [ebp - 0xc4], 0
jne 0x1004d329
and dword [ebp - 0x3c4], 0
jmp 0x1004d333
mov dword [ebp - 0x3c4], 1
cmp dword [ebp - 0x3c4], 0
jne 0x1004d348
mov dword [ebp - 0x204], 1
jmp 0x1004d34f
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x204]
add eax, 8
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xe4], eax
jne 0x1004d384
mov dword [ebp - 0x3cc], 1
jmp 0x1004d38b
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x3cc], eax
jge 0x1004d3a5
mov dword [ebp - 0x20c], 1
jmp 0x1004d3ac
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x3dc]
imul ecx, dword [ebp - 0x20c], 0x2457
imul ecx, dword [ebp - 0xc8]
add eax, ecx
neg eax
cmp eax, dword [ebp - 0x1a4]
jl 0x1004d3db
mov dword [ebp - 0x3d4], 1
jmp 0x1004d3e2
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x3d4], eax
jle 0x1004d3fc
mov dword [ebp - 0x214], 1
jmp 0x1004d403
and dword [ebp - 0x214], 0
cmp dword [ebp - 0x214], 0xfffffff8
jne 0x1004d418
mov dword [ebp - 0x5f4], 1
jmp 0x1004d41f
and dword [ebp - 0x5f4], 0
cmp dword [ebp - 0x4c], 0xfffffff9
jb 0x1004d433
xor eax, eax
inc eax
jne 0x1004d433
and dword [ebp - 0x21c], 0
jmp 0x1004d43d
mov dword [ebp - 0x21c], 1
mov eax, dword [ebp - 0x3dc]
cmp dword [ebp - 0x21c], eax
jge 0x1004d457
mov dword [ebp - 0x3e4], 1
jmp 0x1004d45e
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x76568c07
je 0x1004d47f
and dword [ebp - 0x3ec], 0
jmp 0x1004d489
mov dword [ebp - 0x3ec], 1
mov eax, dword [ebp - 0x18c]
add eax, dword [ebp - 0x3ec]
jne 0x1004d4a9
mov eax, 0xcd4e
test eax, eax
jne 0x1004d4a9
and dword [ebp - 0x22c], 0
jmp 0x1004d4b3
mov dword [ebp - 0x22c], 1
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0x18c]
test eax, eax
je 0x1004d4f1
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x1004d4ec
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x1004d5e1
mov dword [ebp - 0x608], 0x8616691c
mov dword [ebp - 0x59c], 0xa52c43da
mov dword [ebp - 0x2c], 0x1a
jmp 0x1004d515
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1d
jle 0x1004d5e1
mov dword [ebp - 0x23c], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x500], 5
test eax, eax
jne 0x1004d547
mov dword [ebp - 0x3f4], 1
jmp 0x1004d54e
and dword [ebp - 0x3f4], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x500], 0
jne 0x1004d56a
mov dword [ebp - 0x234], 1
jmp 0x1004d571
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x3f4]
cmp eax, dword [ebp - 0x234]
je 0x1004d58b
mov dword [ebp - 0x3fc], 1
jmp 0x1004d592
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x3fc]
sub ecx, dword [ebp - 0x23c]
add ecx, 0x6a1e
imul ecx, ecx, 9
add eax, ecx
cmp dword [ebp - 0x608], eax
jg 0x1004d5c3
mov dword [ebp - 0x404], 1
jmp 0x1004d5ca
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x59c], eax
jmp 0x1004d50e
jmp 0x1004d7d2
mov dword [ebp - 0x25c], 0x5f77832
mov dword [ebp - 0x528], 2
mov dword [ebp - 0x12c], 0
jmp 0x1004d613
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jge 0x1004d62f
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x6b8], 0x8cacf640
jmp 0x1004d606
mov dword [ebp - 0x4c], 0
jmp 0x1004d63f
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x1c
jle 0x1004d7d2
mov dword [ebp - 0x5a0], 0xfffffffe
mov dword [ebp - 0xec], 0
jmp 0x1004d66c
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 1
jge 0x1004d688
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x134], 0xfffffffa
jmp 0x1004d65f
mov eax, 0x15ac
test eax, eax
je 0x1004d7ba
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x134], 0xfff7
jae 0x1004d6b4
mov dword [ebp - 0x244], 1
jmp 0x1004d6bb
and dword [ebp - 0x244], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x134]
cmp dword [ebp - 0x244], eax
jg 0x1004d6dc
mov dword [ebp - 0x40c], 1
jmp 0x1004d6e3
and dword [ebp - 0x40c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x500]
add eax, dword [ebp - 0x40c]
cmp dword [ebp - 0xc8], eax
jl 0x1004d70a
mov dword [ebp - 0x24c], 1
jmp 0x1004d711
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x24c], eax
jg 0x1004d72b
mov dword [ebp - 0x414], 1
jmp 0x1004d732
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x414], eax
jg 0x1004d74c
mov dword [ebp - 0x254], 1
jmp 0x1004d753
and dword [ebp - 0x254], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6b8]
add eax, dword [ebp - 0x254]
cmp eax, 0xaa0c7d0b
je 0x1004d779
mov dword [ebp - 0x41c], 1
jmp 0x1004d780
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
sub eax, dword [ebp - 0x25c]
sub eax, dword [ebp - 0x528]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x134]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x134]
jg 0x1004d7ba
mov dword [ebp - 0x424], 1
jmp 0x1004d7c1
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x5a0], eax
jmp 0x1004d638
mov dword [ebp - 0x13c], 0x3638ecf5
mov dword [ebp - 0xf4], 0
jmp 0x1004d7f5
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x1004d811
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x77c], 0x42eb90da
jmp 0x1004d7e8
mov byte [ebp - 0x5a], 0
movzx eax, byte [ebp - 0x5a]
test eax, eax
je 0x1004d825
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov dword [ebp - 0x13c], 0
jmp 0x1004d83e
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jg 0x1004d892
mov dword [ebp - 0xfc], 0xc4530722
mov dword [ebp - 0xfc], 1
jmp 0x1004d86a
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x1004d890
mov byte [ebp - 0x51], 0
movzx eax, byte [ebp - 0x51]
test eax, eax
je 0x1004d88e
push 0
push 0x1f19
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
jmp 0x1004d85d
jmp 0x1004d831
mov dword [ebp - 0x5bc], 0xfffffff9
mov dword [ebp - 0xbc], 0xffffffff
mov dword [ebp - 0x144], 0
jmp 0x1004d8bf
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 4
jge 0x1004d8db
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x7c0], 0x530de9bf
jmp 0x1004d8b2
mov dword [ebp - 0xbc], 0xa
jmp 0x1004d8f4
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xc
jne 0x1004d957
mov dword [ebp - 0xb0], 3
mov dword [ebp - 0x530], 0
mov dword [ebp - 0xb0], 0xb
jmp 0x1004d92a
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xfffffff1
jle 0x1004d955
mov dword [ebp - 0x5b8], 0xfffffffe
mov dword [ebp - 0x530], 0x97f0a290
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x5b8], eax
jmp 0x1004d91d
jmp 0x1004d8e7
mov dword [ebp - 0xbc], 0x6bafcb14
mov dword [ebp - 0x40], 0x659d
mov dword [ebp - 0xb4], 0xab61b583
mov dword [ebp - 0x540], 0
mov dword [ebp - 0x104], 0
jmp 0x1004d995
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jge 0x1004d9b1
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x6e8], 0xfa8b
jmp 0x1004d988
cmp dword [ebp - 0x40], 5
jl 0x1004d9c3
mov dword [ebp - 0x538], 1
jmp 0x1004d9ca
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jne 0x1004d9de
mov dword [ebp - 0x264], 1
jmp 0x1004d9e5
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x264]
jle 0x1004d9fc
mov dword [ebp - 0x42c], 1
jmp 0x1004da03
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x42c]
cmp eax, dword [ebp - 0x40]
jg 0x1004da1d
mov dword [ebp - 0x5ac], 1
jmp 0x1004da24
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jl 0x1004da38
mov dword [ebp - 0x26c], 1
jmp 0x1004da3f
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x26c], eax
jle 0x1004da59
mov dword [ebp - 0x434], 1
jmp 0x1004da60
and dword [ebp - 0x434], 0
imul eax, dword [ebp - 0x434], 0xe3e
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x540], eax
mov dword [ebp - 0xb4], 0
jmp 0x1004da8c
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jg 0x1004daab
mov byte [ebp - 0x5c], 0
movzx eax, byte [ebp - 0x5c]
test eax, eax
je 0x1004daa9
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x1004da7f
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0x5d8], 0x5c17
mov dword [ebp - 0x6f0], 0xfffffff9
mov dword [ebp - 0x14c], 0
jmp 0x1004dadf
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jge 0x1004dafb
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x5e4], 0xffff
jmp 0x1004dad2
mov dword [ebp - 0x48], 0
jmp 0x1004db0b
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jg 0x1004dc00
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x1004db44
push 0
push 0x148b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x5e4]
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x48], 0x865b49d5
jne 0x1004db69
mov dword [ebp - 0x274], 1
jmp 0x1004db70
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x5e4]
cmp dword [ebp - 0x274], eax
jle 0x1004db8e
mov dword [ebp - 0x43c], 1
jmp 0x1004db95
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
add eax, 0xfa42
cmp eax, 0x5a40
je 0x1004dbb3
mov dword [ebp - 0x27c], 1
jmp 0x1004dbba
and dword [ebp - 0x27c], 0
cmp dword [ebp - 0x27c], 0xeb6b9dd9
ja 0x1004dbcf
mov eax, 0xdad5a519
test eax, eax
je 0x1004dbe8
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x5e4], 0
je 0x1004dbe8
mov dword [ebp - 0x444], 1
jmp 0x1004dbef
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x5d8], eax
jmp 0x1004db04
mov dword [ebp - 0xc], 0
jmp 0x1004dc10
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x1004dc26
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x618], 4
jmp 0x1004dc09
mov dword [ebp - 8], 0xbea12209
mov dword [ebp - 0x68], 0x7263b0a6
mov dword [ebp - 0x5dc], 0
mov dword [ebp - 0x10c], 0
jmp 0x1004dc57
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 4
jge 0x1004dc73
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x66c], 0x7b1b0cad
jmp 0x1004dc4a
mov byte [ebp - 0x5e], 0
movzx eax, byte [ebp - 0x5e]
test eax, eax
je 0x1004dc8e
push 0
push 0x1021
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x710], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x718], eax
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 8]
cmp eax, dword [ebp - 8]
je 0x1004dcb8
mov dword [ebp - 0x284], 1
jmp 0x1004dcbf
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x68], eax
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x66c], 1
mov eax, 0x3388
inc eax
cmp eax, 0xa6c6
jge 0x1004dcf2
mov dword [ebp - 0x44c], 1
jmp 0x1004dcf9
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x44c], eax
je 0x1004dd10
mov dword [ebp - 0x28c], 1
jmp 0x1004dd17
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x28c], eax
jg 0x1004dd2e
mov dword [ebp - 0x454], 1
jmp 0x1004dd35
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0x454]
add eax, ecx
cmp eax, dword [ebp - 8]
jle 0x1004dd71
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x66c], 0
je 0x1004dd71
cmp dword [ebp - 8], 0
je 0x1004dd71
cmp dword [ebp - 0x68], 0
je 0x1004dd71
mov dword [ebp - 0x294], 1
jmp 0x1004dd78
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x294]
cmp eax, 0x31e7bf5c
jne 0x1004dd94
mov dword [ebp - 0x45c], 1
jmp 0x1004dd9b
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x45c]
jl 0x1004ddb2
mov dword [ebp - 0x548], 1
jmp 0x1004ddb9
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x720], eax
or eax, 0xffffffff
je 0x1004dddc
mov eax, 0xcdee94cc
test eax, eax
je 0x1004dddc
mov dword [ebp - 0x29c], 1
jmp 0x1004dde3
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x29c]
sub eax, dword [ebp - 8]
jne 0x1004ddfb
mov eax, 0x6e3268d
test eax, eax
je 0x1004e01d
mov dword [ebp - 0x474], 0xe2bba6da
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x5b4], 0x764457c1
mov dword [ebp - 0x68], 5
jmp 0x1004de26
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x16
jle 0x1004dff9
mov dword [ebp - 0x46c], 0xfffffffa
mov dword [ebp - 0x154], 0
jmp 0x1004de53
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 4
jge 0x1004de6f
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x750], 0x85e3970c
jmp 0x1004de46
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x66c]
cmp dword [ebp + eax - 0x66c], ecx
jle 0x1004de97
mov dword [ebp - 0x464], 1
jmp 0x1004de9e
and dword [ebp - 0x464], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x66c]
cmp dword [ebp - 0x464], eax
jne 0x1004debf
mov dword [ebp - 0x2a4], 1
jmp 0x1004dec6
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x46c]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x750]
cmp eax, 1
jb 0x1004def7
mov dword [ebp - 0x2ac], 1
jmp 0x1004defe
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x68]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x750]
test eax, eax
jne 0x1004df32
mov dword [ebp - 0x2b4], 1
jmp 0x1004df39
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x2b4]
jl 0x1004df50
mov dword [ebp - 0x47c], 1
jmp 0x1004df57
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x47c], eax
je 0x1004df6e
mov dword [ebp - 0x2bc], 1
jmp 0x1004df75
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x1004df90
mov dword [ebp - 0x484], 1
jmp 0x1004df97
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x5b4], eax
mov dword [ebp - 0x70], 0
jmp 0x1004dfb3
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jg 0x1004dff4
mov dword [ebp - 8], 0
jmp 0x1004dfc9
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jg 0x1004dff2
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x1004dff0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
jmp 0x1004dfc2
jmp 0x1004dfac
jmp 0x1004de1f
mov byte [ebp - 0x60], 0
movzx eax, byte [ebp - 0x60]
test eax, eax
je 0x1004e01b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
jmp 0x1004e092
mov dword [ebp - 0x550], 1
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x558], 0xa312446b
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1004e057
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
cmp dword [ebp - 0x550], 0
cmp dword [ebp - 0x5dc], 1
jle 0x1004e073
mov dword [ebp - 0x2c4], 1
jmp 0x1004e07a
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x558], eax
mov dword [ebp - 0xc], 0
jmp 0x1004e0a2
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x1004e0b5
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x28], 0x252cb136
jmp 0x1004e09b
mov dword [ebp - 0xc], 0
jmp 0x1004e0c5
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x1004e0db
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x78c], 0x1c77dcd
jmp 0x1004e0be
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x28], 0
jmp 0x1004e100
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x28], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 3
jg 0x1004e2ee
mov dword [ebp - 0x494], 1
mov dword [ebp - 0x560], 0x8c84b7b8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp + eax*4 - 0x618], 0
je 0x1004e168
cmp dword [ebp - 0x5bc], 0
jae 0x1004e14e
mov dword [ebp - 0x2cc], 1
jmp 0x1004e155
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x28]
mov ecx, dword [ebp + ecx*4 - 0x618]
cmp dword [ebp + eax*4 - 0x618], ecx
jg 0x1004e198
mov dword [ebp - 0x2d4], 1
jmp 0x1004e19f
and dword [ebp - 0x2d4], 0
cmp dword [ebp - 0x2d4], 0x89bdd777
jbe 0x1004e1b7
mov dword [ebp - 0x49c], 1
jmp 0x1004e1be
and dword [ebp - 0x49c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x28]
mov edx, dword [ebp - 0x49c]
sub edx, dword [ebp + ecx*4 - 0x618]
cmp dword [ebp + eax*4 - 0x618], edx
jg 0x1004e1f4
mov dword [ebp - 0x2dc], 1
jmp 0x1004e1fb
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0x928d9ba5
je 0x1004e213
mov dword [ebp - 0x4a4], 1
jmp 0x1004e21a
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0x5261
jge 0x1004e232
mov dword [ebp - 0x2e4], 1
jmp 0x1004e239
and dword [ebp - 0x2e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov eax, dword [ebp + eax*4 - 0x618]
cmp dword [ebp - 0x2e4], eax
jle 0x1004e25e
mov dword [ebp - 0x4ac], 1
jmp 0x1004e265
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
neg eax
mov dword [ebp - 0x2ec], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2ec]
mov dword [ebp + eax - 0x78c], ecx
cmp dword [ebp - 0x2ec], 0xfffffff9
jl 0x1004e29b
mov dword [ebp - 0x4b4], 1
jmp 0x1004e2a2
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 8
jae 0x1004e2b7
mov dword [ebp - 0x2f4], 1
jmp 0x1004e2be
and dword [ebp - 0x2f4], 0
imul eax, dword [ebp - 0x2f4], 0xfffffffd
mov dword [ebp - 0x560], eax
mov byte [ebp - 0x62], 0
movzx eax, byte [ebp - 0x62]
test eax, eax
je 0x1004e2e9
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1004e0eb
mov dword [ebp - 0x160], 0x897a4a12
mov dword [ebp - 0x114], 0
jmp 0x1004e311
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jge 0x1004e32d
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x7b0], 1
jmp 0x1004e304
mov dword [ebp - 0x160], 0
jmp 0x1004e346
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 2
jg 0x1004e389
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x1004e373
push 0x220b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x1004e387
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
jmp 0x1004e339
mov dword [ebp - 0x170], 8
mov dword [ebp - 0x16c], 8
mov dword [ebp - 0x168], 8
mov dword [ebp - 0x164], 8
mov dword [ebp - 0x450], 0xfff9
mov dword [ebp - 0x11c], 0xebe1552b
mov dword [ebp - 0x10], 0x13ec752f
mov dword [ebp - 0x604], 0
mov dword [ebp - 0x600], 0
mov dword [ebp - 0x5fc], 0
mov dword [ebp - 0x5f8], 0
mov dword [ebp - 0x568], 0xe3c8
mov dword [ebp - 0x34], 0
jmp 0x1004e40e
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1004e424
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x518], 0x270e7ad5
jmp 0x1004e407
mov dword [ebp - 0x34], 0
jmp 0x1004e434
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1004e44a
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x4dc], 0
jmp 0x1004e42d
mov eax, dword [ebp - 0x10]
sub eax, 0xd50f
cmp eax, dword [ebp - 0x10]
jl 0x1004e463
mov dword [ebp - 0x4c4], 1
jmp 0x1004e46a
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x10], 1
ja 0x1004e47c
mov dword [ebp - 0x4bc], 1
jmp 0x1004e483
and dword [ebp - 0x4bc], 0
cmp dword [ebp - 0x4bc], 0xab6d
jge 0x1004e49b
mov dword [ebp - 0x2fc], 1
jmp 0x1004e4a2
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x2fc]
cmp eax, 1
ja 0x1004e4bd
mov dword [ebp - 0x304], 1
jmp 0x1004e4c4
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0x304]
jg 0x1004e4de
mov dword [ebp - 0x4cc], 1
jmp 0x1004e4e5
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x4cc], eax
jle 0x1004e4fc
mov dword [ebp - 0x30c], 1
jmp 0x1004e503
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
sub eax, 0x7863
je 0x1004e514
cmp dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x518]
cmp dword [ebp - 0x10], eax
jl 0x1004e538
mov dword [ebp - 0x4d4], 1
jmp 0x1004e53f
and dword [ebp - 0x4d4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4d4]
sub ecx, dword [ebp + eax - 0x518]
mov eax, 0xfe04
sub eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x518]
je 0x1004e584
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x518], 0
je 0x1004e584
mov dword [ebp - 0x1b4], 1
jmp 0x1004e58b
and dword [ebp - 0x1b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp + eax - 0x518], ecx
cmp dword [ebp - 0x1b4], 0
je 0x1004e5bc
mov eax, 0xf762
test eax, eax
je 0x1004e5bc
mov dword [ebp - 0x314], 1
jmp 0x1004e5c3
and dword [ebp - 0x314], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x314]
mov dword [ebp + eax - 0x4dc], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4e4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp + eax - 0x4dc], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x604]
imul eax, dword [ebp - 0x4e4]
cmp eax, 0x13b1
jg 0x1004e619
mov dword [ebp - 0x320], 1
jmp 0x1004e620
and dword [ebp - 0x320], 0
cmp dword [ebp - 0x320], 0xffff0314
jg 0x1004e638
mov dword [ebp - 0x418], 1
jmp 0x1004e63f
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x418]
test eax, eax
je 0x1004e669
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x604], 0
je 0x1004e669
mov dword [ebp - 0x328], 1
jmp 0x1004e670
and dword [ebp - 0x328], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x604]
cmp dword [ebp - 0x328], eax
jg 0x1004e691
mov dword [ebp - 0x4d0], 1
jmp 0x1004e698
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x4d0]
je 0x1004e6b5
mov eax, 0x5cf4
test eax, eax
je 0x1004e6b5
and dword [ebp - 0x330], 0
jmp 0x1004e6bf
mov dword [ebp - 0x330], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x518]
sub eax, dword [ebp - 0x330]
cmp eax, 0xffff
ja 0x1004e6eb
mov eax, 0x6b87
test eax, eax
jne 0x1004e6eb
and dword [ebp - 0x5f0], 0
jmp 0x1004e6f5
mov dword [ebp - 0x5f0], 1
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x728], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x604]
sub eax, 0x26ae
mov dword [ebp - 0x10], eax
jne 0x1004e72a
mov eax, 0xa9b22354
test eax, eax
jne 0x1004e72a
and dword [ebp - 0x420], 0
jmp 0x1004e734
mov dword [ebp - 0x420], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x420]
mov dword [ebp + eax - 0x518], ecx
mov dword [ebp - 0x15c], 0
jmp 0x1004e760
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jge 0x1004e77c
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x6ac], 0x35c52658
jmp 0x1004e753
mov dword [ebp - 0x38], 0
jmp 0x1004e78c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1004e7a2
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xb8], 0xfff6
jmp 0x1004e785
mov dword [ebp - 0x38], 0
jmp 0x1004e7b2
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1004e7c8
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1c4], 0xf94f3783
jmp 0x1004e7ab
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb8], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1c4], 0
jmp 0x1004e804
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1c4]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1c4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1c4], 0xfffffffd
je 0x1004eb93
mov dword [ebp - 0x30], 0x37186542
mov dword [ebp - 0x9c], 0xd0d1d847
mov dword [ebp - 0x570], 0x7f726845
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c4]
mov dword [ebp - 0x730], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
mov dword [ebp - 0x738], eax
xor eax, eax
add eax, 0xffff6142
je 0x1004e87c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1c4], 0
je 0x1004e87c
mov dword [ebp - 0x338], 1
jmp 0x1004e883
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x338], eax
je 0x1004e89a
mov dword [ebp - 0x498], 1
jmp 0x1004e8a1
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
add eax, 0x9b3a
cmp dword [ebp - 0x30], eax
jge 0x1004e8bc
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
jmp 0x1004eb8e
mov dword [ebp - 0x50], 0x6f80366e
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1c4]
cmp dword [ebp + eax - 0xb8], ecx
jge 0x1004e8eb
mov dword [ebp - 0x340], 1
jmp 0x1004e8f2
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x340]
jg 0x1004e909
mov dword [ebp - 0x428], 1
jmp 0x1004e910
and dword [ebp - 0x428], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb8], 0x4b71
jg 0x1004e92f
mov dword [ebp - 0x348], 1
jmp 0x1004e936
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x348]
jl 0x1004e950
mov dword [ebp - 0x4f0], 1
jmp 0x1004e957
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
sub eax, dword [ebp - 0x50]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1c4]
jge 0x1004e97b
mov dword [ebp - 0x350], 1
jmp 0x1004e982
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x350], eax
jg 0x1004e999
mov dword [ebp - 0x430], 1
jmp 0x1004e9a0
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x430], eax
jl 0x1004e9b7
mov dword [ebp - 0x358], 1
jmp 0x1004e9be
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x358]
jg 0x1004e9d8
mov dword [ebp - 0x4a0], 1
jmp 0x1004e9df
and dword [ebp - 0x4a0], 0
cmp dword [ebp - 0x4a0], 0xfff9
ja 0x1004e9f7
mov dword [ebp - 0x1d0], 1
jmp 0x1004e9fe
and dword [ebp - 0x1d0], 0
imul eax, dword [ebp - 0x1d0], 0x3922
test eax, eax
je 0x1004ea1e
cmp dword [ebp - 0x50], 0
je 0x1004ea1e
mov dword [ebp - 0x438], 1
jmp 0x1004ea25
and dword [ebp - 0x438], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c4]
cmp dword [ebp - 0x438], eax
je 0x1004ea46
mov dword [ebp - 0x368], 1
jmp 0x1004ea4d
and dword [ebp - 0x368], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1c4]
add eax, dword [ebp - 0x368]
cmp eax, 0xffffffff
je 0x1004ea70
mov dword [ebp - 0x4d8], 1
jmp 0x1004ea77
and dword [ebp - 0x4d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
cmp dword [ebp - 0x4d8], eax
jg 0x1004ea98
mov dword [ebp - 0x370], 1
jmp 0x1004ea9f
and dword [ebp - 0x370], 0
imul eax, dword [ebp - 0x370], 0xb392
cmp eax, 0xfffffffd
je 0x1004eaba
mov dword [ebp - 0x5c4], 1
jmp 0x1004eac1
and dword [ebp - 0x5c4], 0
cmp dword [ebp - 0x9c], 0
je 0x1004eb61
mov dword [ebp - 0x30], 0
jmp 0x1004eade
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1004eb5f
mov dword [ebp - 0x50], 0
jmp 0x1004eaf4
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jg 0x1004eb5a
mov byte [ebp - 0x52], 0
movzx eax, byte [ebp - 0x52]
test eax, eax
je 0x1004eb22
push 0xe6d
push 0xaf3
push 0x71b
push 0x1908
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov dword [ebp - 0x9c], 0
jmp 0x1004eb3b
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jg 0x1004eb58
mov byte [ebp - 0x53], 0
movzx eax, byte [ebp - 0x53]
test eax, eax
je 0x1004eb56
call dword [sym.imp.USER32.dll_GetCapture]
jmp 0x1004eb2e
jmp 0x1004eaed
jmp 0x1004ead7
jmp 0x1004eb8e
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x1004eb83
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
cmp dword [ebp - 0x570], 0
je 0x1004eb8e
jmp 0x1004eb93
jmp 0x1004e7eb
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x170]
mov dword [ebp - 0x740], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x170]
cmp dword [ebp + eax - 0x170], ecx
jge 0x1004ebce
mov dword [ebp - 0x440], 1
jmp 0x1004ebd5
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
add eax, 7
cmp eax, 1
jle 0x1004ebef
mov dword [ebp - 0x378], 1
jmp 0x1004ebf6
and dword [ebp - 0x378], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x378]
sub ecx, dword [ebp + eax - 0x170]
cmp ecx, 0xd0b6
jle 0x1004ec1d
mov dword [ebp - 0x4a8], 1
jmp 0x1004ec24
and dword [ebp - 0x4a8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0x4a8], eax
jle 0x1004ec45
mov dword [ebp - 0x380], 1
jmp 0x1004ec4c
and dword [ebp - 0x380], 0
cmp dword [ebp - 0x380], 0xffffffff
jle 0x1004ec71
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x170], 0
je 0x1004ec71
mov dword [ebp - 0x448], 1
jmp 0x1004ec78
and dword [ebp - 0x448], 0
cmp dword [ebp - 0x448], 7
jne 0x1004ec8d
mov dword [ebp - 0x388], 1
jmp 0x1004ec94
and dword [ebp - 0x388], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x170]
cmp eax, dword [ebp - 0x388]
je 0x1004ecb5
mov dword [ebp - 0x504], 1
jmp 0x1004ecbc
and dword [ebp - 0x504], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0x504], eax
jle 0x1004ecdd
mov dword [ebp - 0x390], 1
jmp 0x1004ece4
and dword [ebp - 0x390], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x170]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x170]
test eax, eax
jne 0x1004ed1b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x170], 0
jne 0x1004ed1b
and dword [ebp - 0x5e8], 0
jmp 0x1004ed25
mov dword [ebp - 0x5e8], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x170], 0
jne 0x1004ed47
mov eax, 0xfffa
test eax, eax
jne 0x1004ed47
and dword [ebp - 0x578], 0
jmp 0x1004ed51
mov dword [ebp - 0x578], 1
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x73c], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x170], 0
je 0x1004ed87
cmp dword [ebp - 0x450], 0
je 0x1004ed87
xor eax, eax
inc eax
je 0x1004ed87
mov dword [ebp - 0x398], 1
jmp 0x1004ed8e
and dword [ebp - 0x398], 0
cmp dword [ebp - 0x398], 0
je 0x1004eda3
mov dword [ebp - 0x4b0], 1
jmp 0x1004edaa
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x3a0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3a0]
mov dword [ebp + eax - 0x6ac], ecx
cmp dword [ebp - 0x3a0], 0
je 0x1004faec
mov dword [ebp - 0x1c], 0xfb0b0297
mov dword [ebp - 0x20], 0
mov dword [ebp - 0xa8], 0xb058efa9
mov dword [ebp - 0x4e8], 0x498a597f
mov dword [ebp - 0x698], 0xcdcc21d2
cmp dword [ebp - 0x1c], 0
jne 0x1004ef6e
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jne 0x1004ee38
mov dword [ebp - 0x4e0], 1
jmp 0x1004ee3f
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x6c8], eax
cmp dword [ebp - 0x1c], 0xfffffffa
ja 0x1004ee54
cmp dword [ebp - 0x20], 0
jne 0x1004ee63
cmp dword [ebp - 0x20], 0
jne 0x1004ee63
and dword [ebp - 0x458], 0
jmp 0x1004ee6d
mov dword [ebp - 0x458], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x458], eax
jge 0x1004ee8a
cmp dword [ebp - 0x20], 0
je 0x1004ee8a
mov dword [ebp - 0x3a8], 1
jmp 0x1004ee91
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x4e0], eax
jne 0x1004eeb7
mov dword [ebp - 0x3b0], 1
jmp 0x1004eebe
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x3b0], eax
jl 0x1004eed5
mov dword [ebp - 0x5cc], 1
jmp 0x1004eedc
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x6a4], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
je 0x1004eefc
mov dword [ebp - 0x460], 1
jmp 0x1004ef03
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x460]
cmp eax, dword [ebp - 0x20]
je 0x1004ef1e
mov dword [ebp - 0x3b8], 1
jmp 0x1004ef25
and dword [ebp - 0x3b8], 0
cmp dword [ebp - 0x3b8], 0x51162d50
je 0x1004ef3d
mov dword [ebp - 0x4b8], 1
jmp 0x1004ef44
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x4b8], eax
jge 0x1004ef5b
mov dword [ebp - 0x3c0], 1
jmp 0x1004ef62
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 0xc0dc
jge 0x1004ef93
mov dword [ebp - 0x580], 0
mov dword [ebp - 0x5d4], 0xec3e1b8d
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x5d4], eax
jmp 0x1004f36f
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x194], 7
mov dword [ebp - 0x19c], 0xdb817bb5
mov dword [ebp - 0x6d0], 8
mov dword [ebp - 0x158], 0
jmp 0x1004efd1
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jge 0x1004efed
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x7a4], 0xffffffff
jmp 0x1004efc4
cmp dword [ebp - 0x78], 0
je 0x1004f0e5
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jne 0x1004f0a6
xor eax, eax
inc eax
je 0x1004f027
cmp dword [ebp - 0x78], 0
je 0x1004f027
mov dword [ebp - 0x468], 1
jmp 0x1004f02e
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x468], eax
jle 0x1004f045
mov dword [ebp - 0x3c8], 1
jmp 0x1004f04c
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3c8], eax
je 0x1004f063
mov dword [ebp - 0x4f8], 1
jmp 0x1004f06a
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 0xffffffff
jb 0x1004f07f
mov dword [ebp - 0x3d0], 1
jmp 0x1004f086
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
sub eax, 9
jne 0x1004f0a6
mov dword [ebp - 0x470], 1
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x470]
jg 0x1004f0c7
mov dword [ebp - 0x3d8], 1
jmp 0x1004f0ce
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d8]
sub eax, dword [ebp - 0x20]
je 0x1004f0e5
mov dword [ebp - 0x4c0], 1
jmp 0x1004f0ec
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4c0], eax
je 0x1004f103
mov dword [ebp - 0x3e0], 1
jmp 0x1004f10a
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x3e0]
jle 0x1004f127
cmp dword [ebp - 0x78], 0
je 0x1004f127
mov dword [ebp - 0x478], 1
jmp 0x1004f12e
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x478], eax
jge 0x1004f145
mov dword [ebp - 0x3e8], 1
jmp 0x1004f14c
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x4e8]
cmp dword [ebp - 0x3e8], eax
jle 0x1004f166
mov dword [ebp - 0x3f0], 1
jmp 0x1004f16d
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x4e8]
cmp dword [ebp - 0x3f0], eax
jle 0x1004f187
mov dword [ebp - 0x480], 1
jmp 0x1004f18e
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x19c], eax
jne 0x1004f1b1
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x1004f38a
push 0
push 1
push 0x10a7
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 0x88], 0xffffffff
mov dword [ebp - 0x90], 0x69002fc
mov dword [ebp - 0x5b0], 1
mov dword [ebp - 0x88], 8
push 8
pop eax
test eax, eax
jne 0x1004f3c6
xor eax, eax
jne 0x1004f3c6
and dword [ebp - 0x410], 0
jmp 0x1004f3d0
mov dword [ebp - 0x410], 1
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x410]
cmp eax, 0x1817887b
jg 0x1004f3ef
mov dword [ebp - 0x318], 1
jmp 0x1004f3f6
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x318]
je 0x1004f410
mov dword [ebp - 0x31c], 1
jmp 0x1004f417
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x31c], eax
jle 0x1004f431
mov dword [ebp - 0x324], 1
jmp 0x1004f438
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x324]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x170]
jne 0x1004f45f
mov dword [ebp - 0x32c], 1
jmp 0x1004f466
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x32c]
sub eax, 0xfffe
sub eax, dword [ebp - 0x90]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0x170]
mov dword [ebp - 0x5b0], eax
mov dword [ebp - 0x34c], 1
mov dword [ebp - 0x520], 0xefdb7b24
mov dword [ebp - 0x148], 0
jmp 0x1004f4c4
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jge 0x1004f4e0
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x678], 0x4ce55459
jmp 0x1004f4b7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x678]
mov dword [ebp - 0x6fc], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x678]
cmp dword [ebp + eax - 0x678], ecx
jne 0x1004f51a
mov dword [ebp - 0x334], 1
jmp 0x1004f521
and dword [ebp - 0x334], 0
cmp dword [ebp - 0x334], 0x3dbc56e7
jne 0x1004f539
mov dword [ebp - 0x33c], 1
jmp 0x1004f540
and dword [ebp - 0x33c], 0
cmp dword [ebp - 0x33c], 0x2e65
jne 0x1004f558
mov dword [ebp - 0x344], 1
jmp 0x1004f55f
and dword [ebp - 0x344], 0
mov dword [ebp - 0x34c], 3
xor eax, eax
inc eax
sub eax, dword [ebp - 0x344]
cmp dword [ebp - 0x34c], eax
jle 0x1004f586
mov dword [ebp - 0x354], 1
jmp 0x1004f58d
and dword [ebp - 0x354], 0
cmp dword [ebp - 0x354], 1
jl 0x1004f5a2
mov dword [ebp - 0x35c], 1
jmp 0x1004f5a9
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 0x2d7b
jg 0x1004f5ff
mov dword [ebp - 0x130], 0
jmp 0x1004f5ce
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x1004f5ea
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x6a0], 4
jmp 0x1004f5c1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x520]
mov dword [ebp + eax - 0x6a0], ecx
jmp 0x1004f64c
mov byte [ebp - 0x5b], 0
movzx eax, byte [ebp - 0x5b]
test eax, eax
je 0x1004f629
push 0xf09
push 0x9b0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x1004f64c
push 0xf2b
push 0x21bf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [ebp - 0x88], 0
jmp 0x1004f665
cmp dword [ebp - 0x88], 0x10
jle 0x1004fae7
mov dword [ebp - 0x200], 0xc655ef1c
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0x384], 0x66c93ee3
mov dword [ebp - 0xa0], 0xffffffff
mov dword [ebp - 0x180], 0x717be9fb
mov dword [ebp - 0x37c], 0x789328a0
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x534], 6
mov dword [ebp - 0x3c], 0
jmp 0x1004f6d2
jmp 0x1005037f
mov dword [ebp - 4], 0
mov dword [ebp - 0x724], 0x2b46
mov dword [ebp - 0xd0], 0
jmp 0x1004fb16
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x1004fb32
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x178], 5
jmp 0x1004fb09
mov dword [ebp - 4], 0
jmp 0x1004fb42
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1b
jne 0x1004fd99
mov dword [ebp - 0x24], 0x97eede0b
mov dword [ebp - 0xd8], 0
jmp 0x1004fb6c
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jge 0x1004fb88
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x53c], 0x38ca
jmp 0x1004fb5f
mov dword [ebp - 0x24], 0xfffffffa
jmp 0x1004fb98
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe9
jne 0x1004fd94
mov dword [ebp - 0x220], 0xfffffffa
mov dword [ebp - 0x228], 0xa9b27fa
mov dword [ebp - 0xe0], 0
jmp 0x1004fbcf
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jge 0x1004fbeb
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x1cc], 0
jmp 0x1004fbc2
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 4], 0
je 0x1004fce0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
cmp eax, 0xb653
je 0x1004fc18
mov dword [ebp - 0x208], 1
jmp 0x1004fc1f
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x208], eax
jg 0x1004fc36
mov dword [ebp - 0x210], 1
jmp 0x1004fc3d
and dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0x2104
jl 0x1004fc57
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1cc], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1cc]
cmp dword [ebp + eax - 0x1cc], ecx
jge 0x1004fc7f
mov dword [ebp - 0x218], 1
jmp 0x1004fc86
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x218], eax
je 0x1004fc9d
mov dword [ebp - 0x230], 1
jmp 0x1004fca4
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x228], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
sub eax, dword [ebp - 0x228]
sub eax, dword [ebp - 0x230]
je 0x1004fce0
mov dword [ebp - 0x238], 1
jmp 0x1004fce7
and dword [ebp - 0x238], 0
cmp dword [ebp - 0x238], 0x66ef3b06
jg 0x1004fcff
mov dword [ebp - 0x240], 1
jmp 0x1004fd06
and dword [ebp - 0x240], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
cmp dword [ebp - 0x240], eax
je 0x1004fd27
mov dword [ebp - 0x248], 1
jmp 0x1004fd2e
and dword [ebp - 0x248], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
cmp dword [ebp - 0x248], eax
jne 0x1004fd68
mov eax, 0x1dd2
test eax, eax
je 0x1004fd68
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x53c], 0
je 0x1004fd68
mov dword [ebp - 0x250], 1
jmp 0x1004fd6f
and dword [ebp - 0x250], 0
cmp dword [ebp - 0x250], 0xc1e0f758
jb 0x1004fd7f
cmp dword [ebp - 4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x24]
mov dword [ebp + eax - 0x178], ecx
jmp 0x1004fb91
jmp 0x1004fb3b
cmp dword [ebp - 4], 0
je 0x1004fde9
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, 0xb100
sub edx, dword [ebp + ecx - 0x178]
cmp dword [ebp + eax - 0x178], edx
jne 0x1004fdcc
mov dword [ebp - 0x258], 1
jmp 0x1004fdd3
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x258]
neg eax
je 0x1004fde9
mov dword [ebp - 0x260], 1
jmp 0x1004fdf0
and dword [ebp - 0x260], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x178]
cmp eax, dword [ebp - 0x260]
jge 0x1004fe11
mov dword [ebp - 0x268], 1
jmp 0x1004fe18
and dword [ebp - 0x268], 0
cmp dword [ebp - 0x268], 0xc2fb
je 0x1004fe32
or eax, 0xffffffff
jne 0x1004fe32
and dword [ebp - 0x544], 0
jmp 0x1004fe3c
mov dword [ebp - 0x544], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x178]
mov dword [ebp - 0x70c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x178], 0x3899
jl 0x1004fe68
cmp dword [ebp - 4], 0
je 0x1004fee4
mov dword [ebp - 4], 0
jmp 0x1004fe78
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jg 0x1004fee2
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x44], 1
jmp 0x1004fe95
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1004feb9
mov byte [ebp - 0x54], 0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x1004feb7
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
jmp 0x1004fe8e
mov dword [ebp - 0x44], 0
jmp 0x1004fec9
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x1004fee0
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x178], 0
je 0x1004fede
jmp 0x1004fee0
jmp 0x1004fec2
jmp 0x1004fe71
jmp 0x1004ff3b
mov dword [ebp - 0x54c], 0x9c906054
mov dword [ebp - 4], 0
jmp 0x1004fefe
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jg 0x1004ff18
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x178], 0
je 0x1004ff16
jmp 0x1004ff18
jmp 0x1004fef7
mov dword [ebp - 4], 0xe
jmp 0x1004ff28
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xfffffff4
jl 0x1004ff3b
cmp dword [ebp - 0x54c], 0
je 0x1004ff39
jmp 0x1004ff3b
jmp 0x1004ff21
mov dword [ebp - 0xf0], 0xfffffff9
mov dword [ebp - 0x188], 0xf368a901
mov dword [ebp - 0x2b8], 0xffffffff
mov dword [ebp - 0x1a0], 0xa6fdd8fb
mov dword [ebp - 0x554], 5
mov dword [ebp - 0x634], 0x5e19f8c5
mov dword [ebp - 0x630], 0x5e19f8c5
mov dword [ebp - 0x62c], 0x5e19f8c5
mov dword [ebp - 0x628], 0x5e19f8c5
mov dword [ebp - 0xe8], 0
jmp 0x1004ffae
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 3
jge 0x1004ffca
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x774], 0xfffffff7
jmp 0x1004ffa1
mov dword [ebp - 0xf0], 0
jmp 0x1004ffe3
cmp dword [ebp - 0xf0], 0xffffffe9
jg 0x10050230
mov dword [ebp - 0x278], 5
mov dword [ebp - 0x198], 0xfffffff7
mov dword [ebp - 0x55c], 0
mov dword [ebp - 0x56c], 0x9855eec8
mov dword [ebp - 0x6d4], 0xffffffff
mov dword [ebp - 0x270], 0xffffffff
mov dword [ebp - 0x734], 0xdfa
mov dword [ebp - 0x6dc], 9
mov dword [ebp - 0x714], 4
mov dword [ebp - 0xf8], 0
jmp 0x10050063
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jge 0x1005007f
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x564], 0x1ad7ba96
jmp 0x10050056
cmp dword [ebp - 0x278], 0
jne 0x1005010c
mov dword [ebp - 0x188], 0x12af
cmp dword [ebp - 0x188], 0
jne 0x1005010c
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x634]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x634], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x6e4], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x278], eax
jg 0x100500ea
mov dword [ebp - 0x190], 1
jmp 0x100500f1
and dword [ebp - 0x190], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x190]
mov dword [ebp + eax - 0x774], ecx
cmp dword [ebp - 0x190], 0
je 0x1005011e
mov eax, 0xe7c650ba
test eax, eax
jne 0x1005011e
and dword [ebp - 0x280], 0
jmp 0x10050128
mov dword [ebp - 0x280], 1
mov eax, dword [ebp - 0x554]
cmp dword [ebp - 0x280], eax
jle 0x1005013d
cmp dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x55c], eax
jle 0x10050157
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1005037f
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x574], 0xffffffff
mov dword [ebp - 0x100], 0
jmp 0x1005026a
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 1
jge 0x10050286
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x57c], 0xfffffff8
jmp 0x1005025d
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x100502a6
push 0
push 0x165a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jne 0x100502bd
mov dword [ebp - 0x2d0], 1
jmp 0x100502c4
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jge 0x100502eb
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x584], 0xffffffff
mov dword [ebp - 0x108], 0
jmp 0x100503a9
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jge 0x100503c5
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x58c], 0xfffffff8
jmp 0x1005039c
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x100503eb
push 0
push 0x165a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jne 0x10050402
mov dword [ebp - 0x2f8], 1
jmp 0x10050409
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jge 0x10050430