Function at 0x402232
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a18
push edi
lea edi, [ebp - 0x2a18]
push 1
call dword [ebx + 0x40]
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0xe
je 0x40225b
call dword [ebx + 0x38]
cmp eax, 1
jne 0x408da7
mov dword [edi], 0
mov ecx, dword [ebx + 0x148]
add ecx, dword [ebx + 0x6c]
lea eax, [ecx + 0x108]
mov ecx, dword [ecx]
cmp ecx, 3
jne 0x4023d8
push eax
push edi
call fcn.00409657
cmp eax, 1
jne 0x40228f
mov dword [edi], 0x409a58
jmp 0x4022c0
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x5a494c41
push 0x4954494e
push 0x495f4f54
push 0x5f44454c
push 0x49414624
push esp
call dword [ebx + 0x30]
add esp, 0x24
cmp dword [edi], 0
je 0x4023d6
push 0xa
push 0xd732520
push 0x5d24454d
push 0x414e5f52
push 0x45545041
push 0x4441245b
mov ecx, dword [ebx + 0x148]
add ecx, dword [ebx + 0x6c]
lea edx, [ecx + 4]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
add esp, 0x18
lea edx, [edi + 0x38]
push edx
push 0
call dword [edi + 4]
cmp eax, 0
jne 0x4023d6
lea edx, [ebp - 0x27b8]
push edx
lea edx, [ebp - 0x2808]
push edx
lea edx, [ebp - 0x2858]
push edx
push dword [edi + 0x38]
call dword [edi + 0x30]
cmp eax, 0
jne 0x4023d6
push 0xa
push 0xd732520
push 0x5d244552
push 0x41574d52
push 0x49465f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x2858]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
add esp, 0x1c
push 0
push 0xa0d7325
push 0x205d244c
push 0x4c445f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x2808]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x402418
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x48545f59
push 0x425f4445
push 0x54524f50
push 0x5055535f
push 0x544f4e5f
push 0x53495f4c
push 0x4f434f54
push 0x4f525024
push esp
call dword [ebx + 0x30]
add esp, 0x30
cmp dword [edi], 0
je 0x408da7
mov dword [ebp - 0x256c], 0
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
lea edx, [ecx + 2]
push edx
push eax
lea edx, [ebp - 0x2768]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov dword [ebp - 0x245c], 0
cmp dword [esi + 0x270], 0x75736924
jne 0x40612b
cmp dword [esi + 0x274], 0x3037757a
jne 0x40612b
cmp dword [esi + 0x278], 0x5424315f
jne 0x40612b
cmp dword [esi + 0x27c], 0x736e6172
jne 0x40612b
cmp dword [esi + 0x280], 0x6e6f7274
jne 0x40612b
cmp dword [esi + 0x284], 0x3230315b
jne 0x40612b
cmp dword [esi + 0x288], 0x35312f34
jne 0x40612b
cmp dword [esi + 0x28c], 0x322f3633
jne 0x40612b
cmp dword [esi + 0x290], 0x2f383430
jne 0x40612b
cmp dword [esi + 0x294], 0x30363532
jne 0x40612b
cmp dword [esi + 0x298], 0x43205d6b
jne 0x40612b
cmp word [esi + 0x29c], 0x4e41
jne 0x40612b
cmp byte [esi + 0x29e], 0
jne 0x40612b
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402545
cmp eax, 0xb
je 0x402545
cmp eax, 0xa
je 0x402545
cmp eax, 0x17
je 0x402545
cmp eax, 0x18
je 0x402545
cmp eax, 0x38
jne 0x40612b
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x38
jne 0x40269f
push 0x28
push 0
lea edx, [ebp - 0x1032]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
push 0x30
push 0
lea edx, [ebp - 0x100a]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
push 0
push dword [ebx + 0x488]
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x4e
push 0x490056
push 0x450047
push 0x4e0041
push 0x480043
mov dword [ebp - 0x100a], ebx
mov dword [ebp - 0x102e], 0x408dcd
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebp - 0x1022], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [ebp - 0x101e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.DLL_LoadCursorA]
mov dword [ebp - 0x101a], eax
mov dword [ebp - 0x1016], 0x10
mov dword [ebp - 0x100e], esp
lea edx, [ebp - 0x1032]
push edx
call dword [sym.imp.USER32.DLL_RegisterClassW]
lea edx, [ebp - 0x100a]
push edx
push dword [ebp - 0x1022]
push 0
push dword [ebx + 0x488]
push 0
push 0
push 0
push 0
push 0x100c0000
push 0
lea edx, [esp + 0x28]
push edx
push pe_nt_image_headers32
call dword [sym.imp.USER32.DLL_CreateWindowExW]
add esp, 0x14
test eax, eax
je 0x402672
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.DLL_GetMessageW]
test eax, eax
je 0x40266f
push esp
call dword [sym.imp.USER32.DLL_TranslateMessage]
push esp
call dword [sym.imp.USER32.DLL_DispatchMessageW]
jmp 0x40264a
add esp, 0x1c
push 1
push dword [ebx + 0x488]
call dword [sym.imp.USER32.DLL_EnableWindow]
push dword [ebx + 0x488]
call dword [sym.imp.USER32.DLL_SetForegroundWindow]
cmp byte [ebp - 0xffa], 0
jne 0x40269f
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x40612b
push 0x7a120
push 0x800
push 6
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4026da
mov dword [ebp - 0x245c], 1
jmp 0x40612b
push 1
push 0x8000
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x402707
mov dword [ebp - 0x245c], 1
jmp 0x406115
mov dword [ebp - 0xfda], 0xe0070000
mov dword [ebp - 0xfd6], 0xe8070000
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x40273a
cmp eax, 0xb
je 0x40273a
cmp eax, 0xa
je 0x40273a
cmp eax, 0x18
je 0x40273a
cmp eax, 0x38
jne 0x402793
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xffffffffffffffff
push 0
push 4
push 0
push 0x40
push 0
push 6
push 3
push 0
push 0
mov dword [ebp - 0xfd2], esp
mov eax, dword [ebp - 0xfd6]
mov dword [esp + 0x40], eax
mov eax, dword [ebp - 0xfda]
mov dword [esp + 0x5c], eax
push 0
push dword [ebp - 0xfd2]
push 4
call dword [edi]
add esp, 0x60
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x4027db
push 0
push 0
push 0
push 0
push 0
push 5
push 0xe8050000
push 0
push 4
push 0
push 0
push 0
push 5
push 0xffffffffffffffff
push 0
push 4
push 0
push 0
push 0
push 5
push 1
push 0
push 0
mov eax, esp
push 0
push eax
push 4
call dword [edi]
add esp, 0x5c
cmp eax, 0xffffffff
jne 0x4027ef
mov dword [ebp - 0x245c], 1
jmp 0x406115
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402808
cmp eax, 0xa
je 0x402808
cmp eax, 0xb
jne 0x40396c
mov byte [esi + 0x6c], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402825
cmp eax, 0xa
je 0x402825
cmp eax, 0xb
jne 0x402b30
push 0x110fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x402856
mov dword [ebp - 0x245c], 1
jmp 0x402889
lea edx, [ebp - 0x2454]
push edx
push 0x3e8
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x40287c
mov dword [ebp - 0x245c], 1
jmp 0x402889
test eax, eax
je 0x402889
cmp byte [ebp - 0x2450], 0x7e
je 0x402856
cmp dword [ebp - 0x245c], 0
jne 0x402b30
mov byte [esi + 0x6c], 0
mov eax, dword [ebp - 0xfda]
mov dword [ebp - 0x1132], eax
mov dword [ebp - 0x112e], 0x941a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x4028de
cmp eax, 0xffffffff
jne 0x4028ed
mov dword [ebp - 0x245c], 1
jmp 0x402b30
cmp byte [ebp - 0x2450], 0x5a
jne 0x40299c
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402928
cmp ecx, eax
jae 0x402928
mov dl, byte [ebp + ecx - 0x244e]
cmp dl, 0
je 0x402928
cmp dl, 0xff
je 0x402928
cmp dl, 0x2d
je 0x402928
mov byte [ebp + ecx - 0x1430], dl
inc ecx
jmp 0x4028ff
mov byte [ebp + ecx - 0x1430], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402940
cmp eax, 0xa
jne 0x402997
cmp byte [ebp - 0x1430], 0
je 0x402997
lea eax, [ebp - 0x1430]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
jmp 0x402b30
cmp byte [ebp - 0x2450], 0x7f
jne 0x402b30
cmp byte [ebp - 0x244e], 0x11
jne 0x402b30
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
mov dword [ebp - 0xfda], 0x4a020000
mov dword [ebp - 0xfd6], 0x4a060000
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xffffffffffffffff
push 0
push 4
push 0
push 0x40
push 0
push 6
push 3
push 0
push 0
mov dword [ebp - 0xfce], esp
mov eax, dword [ebp - 0xfd6]
mov dword [esp + 0x40], eax
mov eax, dword [ebp - 0xfda]
mov dword [esp + 0x5c], eax
push 0
push dword [ebp - 0xfce]
push 4
call dword [edi]
add esp, 0x60
mov eax, dword [ebp - 0xfda]
mov dword [ebp - 0x1132], eax
mov dword [ebp - 0x112e], 0x941a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x402a77
cmp eax, 0xffffffff
jne 0x402a86
mov dword [ebp - 0x245c], 1
jmp 0x402b30
cmp byte [ebp - 0x2450], 0x5a
jne 0x402b30
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402ac1
cmp ecx, eax
jae 0x402ac1
mov dl, byte [ebp + ecx - 0x244e]
cmp dl, 0
je 0x402ac1
cmp dl, 0xff
je 0x402ac1
cmp dl, 0x2d
je 0x402ac1
mov byte [ebp + ecx - 0x1430], dl
inc ecx
jmp 0x402a98
mov byte [ebp + ecx - 0x1430], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402ad9
cmp eax, 0xa
jne 0x402b30
cmp byte [ebp - 0x1430], 0
je 0x402b30
lea eax, [ebp - 0x1430]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402b44
cmp eax, 0xa
jne 0x4032db
cmp dword [ebp - 0x245c], 0
jne 0x402b8f
mov dword [ebp - 0x112e], 0xb01a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x402b85
cmp eax, 0xffffffff
jne 0x402b8f
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x402c36
mov dword [ebp - 0x112e], 0x951a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x402bd4
cmp eax, 0xffffffff
jne 0x402be0
mov dword [ebp - 0x245c], 1
jmp 0x402c36
cmp byte [ebp - 0x2450], 0x5a
jne 0x402c36
movzx eax, byte [ebp - 0x244d]
mov ah, byte [ebp - 0x244e]
push 0xa
push 0xd642520
push 0x3a244e4f
push 0x49535245
push 0x565f5753
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x402d24
mov dword [ebp - 0x112e], 0x911a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x402c7b
cmp eax, 0xffffffff
jne 0x402c8a
mov dword [ebp - 0x245c], 1
jmp 0x402d24
cmp byte [ebp - 0x2450], 0x5a
jne 0x402d24
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402cc5
cmp ecx, eax
jae 0x402cc5
mov dl, byte [ebp + ecx - 0x244e]
cmp dl, 0
je 0x402cc5
cmp dl, 0xff
je 0x402cc5
cmp dl, 0x2d
je 0x402cc5
mov byte [ebp + ecx - 0x13f0], dl
inc ecx
jmp 0x402c9c
mov byte [ebp + ecx - 0x13f0], 0
cmp byte [ebp - 0x13f0], 0
je 0x402d24
lea eax, [ebp - 0x13f0]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x44524148
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x402e32
mov dword [ebp - 0x112e], 0x921a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x402d69
cmp eax, 0xffffffff
jne 0x402d78
mov dword [ebp - 0x245c], 1
jmp 0x402e32
cmp byte [ebp - 0x2450], 0x5a
jne 0x402e32
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402db3
cmp ecx, eax
jae 0x402db3
mov dl, byte [ebp + ecx - 0x244e]
cmp dl, 0
je 0x402db3
cmp dl, 0xff
je 0x402db3
cmp dl, 0x2d
je 0x402db3
mov byte [ebp + ecx - 0x13b0], dl
inc ecx
jmp 0x402d8a
mov byte [ebp + ecx - 0x13b0], 0
cmp byte [ebp - 0x13b0], 0
je 0x402e32
lea eax, [ebp - 0x13b0]
push 0
push 0xa0d7325
push 0x203a2452
push 0x45424d55
push 0x4e5f4552
push 0x41574452
push 0x41485f55
push 0x43455f52
push 0x4f5f4449
push 0x5f524549
push 0x4c505055
push 0x535f4d45
push 0x54535953
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x48
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x402f38
mov dword [ebp - 0x112e], 0x971a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x402e77
cmp eax, 0xffffffff
jne 0x402e86
mov dword [ebp - 0x245c], 1
jmp 0x402f38
cmp byte [ebp - 0x2450], 0x5a
jne 0x402f38
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402ebc
cmp ecx, eax
jae 0x402ebc
mov dl, byte [ebp + ecx - 0x244e]
cmp dl, 0
je 0x402ebc
cmp dl, 0xff
je 0x402ebc
mov byte [ebp + ecx - 0x1370], dl
inc ecx
jmp 0x402e98
mov byte [ebp + ecx - 0x1370], 0
cmp byte [ebp - 0x1370], 0
je 0x402f38
lea eax, [ebp - 0x1370]
push 0xa
push 0xd732520
push 0x3a244550
push 0x59545f45
push 0x4e49474e
push 0x455f524f
push 0x5f454d41
push 0x4e5f4d45
push 0x54535953
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
lea edx, [ebp - 0x1370]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
cmp dword [ebp - 0x245c], 0
jne 0x403044
mov dword [ebp - 0x112e], 0x981a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x402f7d
cmp eax, 0xffffffff
jne 0x402f8c
mov dword [ebp - 0x245c], 1
jmp 0x403044
cmp byte [ebp - 0x2450], 0x5a
jne 0x403044
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x402fc7
cmp ecx, eax
jae 0x402fc7
mov dl, byte [ebp + ecx - 0x244e]
cmp dl, 0
je 0x402fc7
cmp dl, 0xff
je 0x402fc7
cmp dl, 0x2d
je 0x402fc7
mov byte [ebp + ecx - 0x1330], dl
inc ecx
jmp 0x402f9e
mov byte [ebp + ecx - 0x1330], 0
cmp byte [ebp - 0x1330], 0
je 0x403044
lea eax, [ebp - 0x1330]
push 0xa0d73
push 0x25203a24
push 0x5245424d
push 0x554e5f4c
push 0x41495245
push 0x535f5245
push 0x54534554
push 0x5f524f5f
push 0x45444f43
push 0x5f504f48
push 0x535f5249
push 0x41504552
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x44
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x4030f4
mov dword [ebp - 0x112e], 0x991a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x403089
cmp eax, 0xffffffff
jne 0x403095
mov dword [ebp - 0x245c], 1
jmp 0x4030f4
cmp byte [ebp - 0x2450], 0x5a
jne 0x4030f4
mov eax, dword [ebp - 0x244e]
bswap eax
test eax, eax
je 0x4030f4
push 0xa
push 0xd58382e
push 0x25203a24
push 0x45544144
push 0x5f474e49
push 0x4d4d4152
push 0x474f5250
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x4031b3
mov dword [ebp - 0x112e], 0x9a1a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x403139
cmp eax, 0xffffffff
jne 0x403145
mov dword [ebp - 0x245c], 1
jmp 0x4031b3
cmp byte [ebp - 0x2450], 0x5a
jne 0x4031b3
movzx eax, byte [ebp - 0x244d]
mov ah, byte [ebp - 0x244e]
test eax, eax
je 0x4031b3
push 0xa
push 0xd642520
push 0x3a245245
push 0x49464954
push 0x4e454449
push 0x5f415441
push 0x445f4349
push 0x54534f4e
push 0x47414944
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x4032db
mov dword [ebp - 0x112e], 0xc11a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x4031f8
cmp eax, 0xffffffff
jne 0x403207
mov dword [ebp - 0x245c], 1
jmp 0x4032db
cmp byte [ebp - 0x2450], 0x5a
jne 0x4032db
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x403242
cmp ecx, eax
jae 0x403242
mov dl, byte [ebp + ecx - 0x244e]
cmp dl, 0
je 0x403242
cmp dl, 0xff
je 0x403242
cmp dl, 0x2d
je 0x403242
mov byte [ebp + ecx - 0x12f0], dl
inc ecx
jmp 0x403219
mov byte [ebp + ecx - 0x12f0], 0
cmp byte [ebp - 0x12f0], 0
je 0x4032db
cmp byte [esi + 0x6c], 0
je 0x40326d
push 0x5f
push esp
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 4
lea edx, [ebp - 0x12f0]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x12f0]
push 0xa0d73
push 0x25203a24
push 0x52454946
push 0x49544e45
push 0x44495f31
push 0x30454c55
push 0x444f4d5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4032f4
cmp eax, 0xa
je 0x4032f4
cmp eax, 0xb
jne 0x4033f1
cmp dword [ebp - 0x245c], 0
jne 0x4033f1
mov dword [ebp - 0x112e], 0xc21a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x403339
cmp eax, 0xffffffff
jne 0x403348
mov dword [ebp - 0x245c], 1
jmp 0x4033f1
cmp byte [ebp - 0x2450], 0x5a
jne 0x4033f1
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x403383
cmp ecx, eax
jae 0x403383
mov dl, byte [ebp + ecx - 0x244e]
cmp dl, 0
je 0x403383
cmp dl, 0xff
je 0x403383
cmp dl, 0x2d
je 0x403383
mov byte [ebp + ecx - 0x12b0], dl
inc ecx
jmp 0x40335a
mov byte [ebp + ecx - 0x12b0], 0
cmp byte [ebp - 0x12b0], 0
je 0x4033f1
lea eax, [ebp - 0x12b0]
push 0xa0d73
push 0x25203a24
push 0x52454946
push 0x49544e45
push 0x44495f32
push 0x30454c55
push 0x444f4d5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x403405
cmp eax, 0xa
jne 0x403784
cmp dword [ebp - 0x245c], 0
jne 0x4034b8
mov dword [ebp - 0x112e], 0xc31a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x40344a
cmp eax, 0xffffffff
jne 0x403456
mov dword [ebp - 0x245c], 1
jmp 0x4034b8
cmp byte [ebp - 0x2450], 0x5a
jne 0x4034b8
mov eax, dword [ebp - 0x244e]
bswap eax
test eax, eax
je 0x4034b8
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x3330454c
push 0x55444f4d
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x40356b
mov dword [ebp - 0x112e], 0xc41a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x4034fd
cmp eax, 0xffffffff
jne 0x403509
mov dword [ebp - 0x245c], 1
jmp 0x40356b
cmp byte [ebp - 0x2450], 0x5a
jne 0x40356b
mov eax, dword [ebp - 0x244e]
bswap eax
test eax, eax
je 0x40356b
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x3430454c
push 0x55444f4d
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x40361e
mov dword [ebp - 0x112e], 0xc51a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x4035b0
cmp eax, 0xffffffff
jne 0x4035bc
mov dword [ebp - 0x245c], 1
jmp 0x40361e
cmp byte [ebp - 0x2450], 0x5a
jne 0x40361e
mov eax, dword [ebp - 0x244e]
bswap eax
test eax, eax
je 0x40361e
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x3530454c
push 0x55444f4d
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x4036d1
mov dword [ebp - 0x112e], 0xc61a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x403663
cmp eax, 0xffffffff
jne 0x40366f
mov dword [ebp - 0x245c], 1
jmp 0x4036d1
cmp byte [ebp - 0x2450], 0x5a
jne 0x4036d1
mov eax, dword [ebp - 0x244e]
bswap eax
test eax, eax
je 0x4036d1
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x3630454c
push 0x55444f4d
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x403784
mov dword [ebp - 0x112e], 0xcb1a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x403716
cmp eax, 0xffffffff
jne 0x403722
mov dword [ebp - 0x245c], 1
jmp 0x403784
cmp byte [ebp - 0x2450], 0x5a
jne 0x403784
mov eax, dword [ebp - 0x244e]
bswap eax
test eax, eax
je 0x403784
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x403852
mov dword [ebp - 0x112e], 0xcc1a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x4037c9
cmp eax, 0xffffffff
jne 0x4037d5
mov dword [ebp - 0x245c], 1
jmp 0x403852
cmp byte [ebp - 0x2450], 0x5a
jne 0x403852
mov eax, dword [ebp - 0x244e]
bswap eax
mov dword [ebp - 0x1230], eax
test eax, eax
je 0x403852
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x403800
cmp eax, 0xa
jne 0x403852
push 0xa0d64
push 0x25203a24
push 0x5245424d
push 0x554e5f54
push 0x5241505f
push 0x45524157
push 0x44524148
push 0x24202445
push 0x4d495424
push dword [ebp - 0x1230]
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x403866
cmp eax, 0xa
jne 0x40396c
cmp dword [ebp - 0x245c], 0
jne 0x40396c
mov dword [ebp - 0x112e], 0x901a
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x4038ab
cmp eax, 0xffffffff
jne 0x4038ba
mov dword [ebp - 0x245c], 1
jmp 0x40396c
cmp byte [ebp - 0x2450], 0x5a
jne 0x40396c
sub eax, 6
xor ecx, ecx
cmp ecx, 0x40
jae 0x4038f5
cmp ecx, eax
jae 0x4038f5
mov dl, byte [ebp + ecx - 0x244e]
cmp dl, 0
je 0x4038f5
cmp dl, 0xff
je 0x4038f5
cmp dl, 0x2d
je 0x4038f5
mov byte [ebp + ecx - 0x1270], dl
inc ecx
jmp 0x4038cc
mov byte [ebp + ecx - 0x1270], 0
cmp byte [ebp - 0x1270], 0
je 0x40396c
cmp byte [esi + 0x6c], 0
je 0x40391c
push 0x5f
push esp
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 4
lea edx, [ebp - 0x1270]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x1270]
push 0xa0d
push 0x7325203a
push 0x244e4956
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x403985
cmp eax, 0xb
je 0x403985
cmp eax, 0x38
jne 0x404c40
mov dword [ebp - 0x122c], 0
cmp dword [ebp - 0x245c], 0
jne 0x403bc6
cmp eax, 0xffffffff
jne 0x4039b0
mov dword [ebp - 0x245c], 1
jmp 0x403bc6
mov dword [ebp - 0x1434], 0x20
mov dword [ebp - 0x2568], 0x10
push 0x210fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x4039f8
mov dword [ebp - 0x245c], 1
jmp 0x403bc6
lea edx, [ebp - 0x2454]
push edx
push 0x3e8
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x403a21
mov dword [ebp - 0x245c], 1
jmp 0x403bc6
test eax, eax
jne 0x403a2d
dec dword [ebp - 0x2568]
jne 0x4039c4
push 0x3efe
push 0x1010000
push 0
push 6
push 0
push 0xc0
push 0
push 6
push 0x7c6
push 0
push 0
mov dword [ebp - 0xfca], esp
push 0
push dword [ebp - 0xfca]
push 6
call dword [edi]
add esp, 0x2c
push 0x28fe
push 0x1010000
push esp
push 6
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x403a98
mov dword [ebp - 0x245c], 1
jmp 0x403bc6
lea edx, [ebp - 0x2454]
push edx
push 0x3e8
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x403ac1
mov dword [ebp - 0x245c], 1
jmp 0x403bc6
test eax, eax
jne 0x403ad1
dec dword [ebp - 0x1434]
jne 0x4039ba
test eax, eax
jne 0x403b40
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403b1d
xor eax, eax
jmp 0x403b27
cmp eax, 0x20
jbe 0x403b27
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x403bc6
cmp byte [ebp - 0x2450], 0x68
je 0x403bc6
cmp byte [ebp - 0x2450], 0x7e
je 0x403a98
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403ba8
xor eax, eax
jmp 0x403bb2
cmp eax, 0x20
jbe 0x403bb2
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x403d25
push 0xa2fe
push 0x1010000
push esp
push 6
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x403c07
mov dword [ebp - 0x245c], 1
jmp 0x403d25
lea edx, [ebp - 0x2454]
push edx
push 0x3e8
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x403c30
mov dword [ebp - 0x245c], 1
jmp 0x403d25
test eax, eax
jne 0x403c9f
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403c7c
xor eax, eax
jmp 0x403c86
cmp eax, 0x20
jbe 0x403c86
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x403d25
cmp byte [ebp - 0x2450], 0xe2
je 0x403d25
cmp byte [ebp - 0x2450], 0x7e
je 0x403c07
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403d07
xor eax, eax
jmp 0x403d11
cmp eax, 0x20
jbe 0x403d11
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
mov dword [ebp - 0x2458], 5
cmp dword [ebp - 0x245c], 0
jne 0x404308
cmp byte [ebp - 0x244f], 0
je 0x404308
cmp byte [ebp - 0x244f], 1
je 0x404308
cmp byte [ebp - 0x244f], 0x54
je 0x404308
push 0
mov dword [ebp - 0xfc6], esp
push 0
push dword [ebp - 0xfc6]
push 7
call dword [edi]
add esp, 4
push 0x2af8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x7a120
push 0x800
push 6
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x403dae
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x403ddf
push 1
push 0x8000
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x403ddf
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x403e4c
push 0x110fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x403e19
mov dword [ebp - 0x245c], 1
jmp 0x403e4c
lea edx, [ebp - 0x2454]
push edx
push 0x3e8
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x403e3f
mov dword [ebp - 0x245c], 1
jmp 0x403e4c
test eax, eax
je 0x403e4c
cmp byte [ebp - 0x2450], 0x7e
je 0x403e19
cmp dword [ebp - 0x245c], 0
jne 0x403f0a
mov dword [ebp - 0x1434], 0x10
mov dword [ebp - 0x2568], 5
push 4
push 0xe0070000
push esp
push 5
push 0x9c4
push 0x40
push 6
push 0
call fcn.0040933f
add esp, 8
cmp eax, 0xffffffff
jne 0x403e9b
mov dword [ebp - 0x245c], 1
jmp 0x403f0a
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x403ec1
mov dword [ebp - 0x245c], 1
jmp 0x403f0a
test eax, eax
jne 0x403ed7
dec dword [ebp - 0x2568]
jne 0x403e9b
dec dword [ebp - 0x1434]
jne 0x403e63
jmp 0x403f0a
cmp byte [ebp - 0x2450], 0x7f
jne 0x403ef5
cmp byte [ebp - 0x244e], 0x78
jne 0x403ef5
mov dword [ebp - 0x2568], 5
jmp 0x403e9b
cmp byte [ebp - 0x2450], 0x7e
jne 0x403f0a
mov dword [ebp - 0x2568], 5
jmp 0x403e9b
cmp dword [ebp - 0x245c], 0
jne 0x40412d
mov dword [ebp - 0x1434], 0x20
mov dword [ebp - 0x2568], 0x10
push 0x210fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x403f5f
mov dword [ebp - 0x245c], 1
jmp 0x40412d
lea edx, [ebp - 0x2454]
push edx
push 0x3e8
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x403f88
mov dword [ebp - 0x245c], 1
jmp 0x40412d
test eax, eax
jne 0x403f94
dec dword [ebp - 0x2568]
jne 0x403f2b
push 0x3efe
push 0x1010000
push 0
push 6
push 0
push 0xc0
push 0
push 6
push 0x7d0
push 0
push 0
mov dword [ebp - 0xfc2], esp
push 0
push dword [ebp - 0xfc2]
push 6
call dword [edi]
add esp, 0x2c
push 0x28fe
push 0x1010000
push esp
push 6
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x403fff
mov dword [ebp - 0x245c], 1
jmp 0x40412d
lea edx, [ebp - 0x2454]
push edx
push 0x3e8
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x404028
mov dword [ebp - 0x245c], 1
jmp 0x40412d
test eax, eax
jne 0x404038
dec dword [ebp - 0x1434]
jne 0x403f21
test eax, eax
jne 0x4040a7
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404084
xor eax, eax
jmp 0x40408e
cmp eax, 0x20
jbe 0x40408e
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x40412d
cmp byte [ebp - 0x2450], 0x68
je 0x40412d
cmp byte [ebp - 0x2450], 0x7e
je 0x403fff
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40410f
xor eax, eax
jmp 0x404119
cmp eax, 0x20
jbe 0x404119
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x40428c
push 0xa2fe
push 0x1010000
push esp
push 6
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x40416e
mov dword [ebp - 0x245c], 1
jmp 0x40428c
lea edx, [ebp - 0x2454]
push edx
push 0x3e8
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x404197
mov dword [ebp - 0x245c], 1
jmp 0x40428c
test eax, eax
jne 0x404206
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4041e3
xor eax, eax
jmp 0x4041ed
cmp eax, 0x20
jbe 0x4041ed
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x40428c
cmp byte [ebp - 0x2450], 0xe2
je 0x40428c
cmp byte [ebp - 0x2450], 0x7e
je 0x40416e
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40426e
xor eax, eax
jmp 0x404278
cmp eax, 0x20
jbe 0x404278
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
dec dword [ebp - 0x2458]
jne 0x403d2f
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4042ea
xor eax, eax
jmp 0x4042f4
cmp eax, 0x20
jbe 0x4042f4
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x404464
cmp dword [ebp - 0x245c], 0
jne 0x4043f7
push 0x1a5fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x404358
mov dword [ebp - 0x245c], 1
jmp 0x4043f7
lea edx, [ebp - 0x2454]
push edx
push 0x3e8
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x40437e
mov dword [ebp - 0x245c], 1
jmp 0x4043f7
test eax, eax
jne 0x4043ea
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4043ca
xor eax, eax
jmp 0x4043d4
cmp eax, 0x20
jbe 0x4043d4
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x4043f7
cmp byte [ebp - 0x2450], 0x7e
je 0x404358
cmp dword [ebp - 0x245c], 0
jne 0x404464
push 0x3a5fe
push 0x1010000
push esp
push 7
push 0x9c4
push 0xc0
push 6
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x404431
mov dword [ebp - 0x245c], 1
jmp 0x404464
lea edx, [ebp - 0x2454]
push edx
push 0x3e8
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x404457
mov dword [ebp - 0x245c], 1
jmp 0x404464
test eax, eax
je 0x404464
cmp byte [ebp - 0x2450], 0x7e
je 0x404431
cmp dword [ebp - 0x245c], 0
jne 0x40463d
mov dword [ebp - 0x2568], 0x20
mov eax, dword [ebp - 0xfda]
mov dword [ebp - 0x1132], eax
mov dword [ebp - 0x112e], 0x127
lea edx, [ebp - 0x1132]
push edx
push 6
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
jne 0x4044c9
mov dword [ebp - 0x245c], 1
jmp 0x40463d
cmp eax, 0xffffffff
jne 0x4044dd
mov dword [ebp - 0x245c], 1
jmp 0x40463d
cmp byte [ebp - 0x2450], 0x7f
jne 0x4045c2
cmp byte [ebp - 0x244e], 0x36
jne 0x40450c
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x2568]
jne 0x40447b
jmp 0x40454e
cmp byte [ebp - 0x244e], 0x37
jne 0x40452e
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x2568]
jne 0x40447b
jmp 0x40454e
cmp byte [ebp - 0x244e], 0x22
jne 0x40454e
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x2568]
jne 0x40447b
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4045a2
xor eax, eax
jmp 0x4045ac
cmp eax, 0x20
jbe 0x4045ac
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x40463d
cmp byte [ebp - 0x2450], 0x67
je 0x40463d
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40461f
xor eax, eax
jmp 0x404629
cmp eax, 0x20
jbe 0x404629
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x404c40
cmp eax, 0xb
jne 0x40496a
cmp dword [ebp - 0x244e], 0
jne 0x404669
cmp byte [ebp - 0x244a], 0
je 0x404c40
mov byte [ebp - 0x1228], 0x20
mov byte [ebp - 0x1227], 0xf4
mov dword [ebp - 0x1226], 0x100
mov eax, dword [ebp - 0x244e]
mov dword [ebp - 0x1222], eax
mov al, byte [ebp - 0x244a]
mov byte [ebp - 0x121e], al
cmp dword [ebp - 0x122c], 0
jne 0x4046cc
mov dword [ebp - 0x11aa], 0x281b142e
mov dword [ebp - 0x11a6], 0x5282c5a
mov dword [ebp - 0x11a2], 0x98be1cdf
mov dword [ebp - 0x119e], 0xefcbe971
jmp 0x4046f4
mov dword [ebp - 0x11aa], 0
mov dword [ebp - 0x11a6], 0
mov dword [ebp - 0x11a2], 0
mov dword [ebp - 0x119e], 0
push 0xfa
lea edx, [ebp - 0x266e]
push edx
push 0xf6
lea edx, [ebp - 0x1228]
push edx
call dword [ebx + 0x3c]
cmp eax, 5
je 0x404752
push 0xa0d24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
mov dword [ebp - 0x245c], 1
jmp 0x404965
mov dword [ebp - 0x112e], 0x227
mov eax, dword [ebp - 0x266e]
mov dword [ebp - 0x112c], eax
mov al, byte [ebp - 0x266a]
mov byte [ebp - 0x1128], al
lea edx, [ebp - 0x1132]
push edx
push 0xb
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
jne 0x4047ac
mov dword [ebp - 0x245c], 1
jmp 0x404965
cmp eax, 0xffffffff
jne 0x4047c0
mov dword [ebp - 0x245c], 1
jmp 0x404965
cmp byte [ebp - 0x2450], 0x7f
jne 0x4048ec
cmp byte [ebp - 0x244e], 0x35
jne 0x404827
mov dword [ebp - 0x2568], 0x20
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x9c4]
mov dword [ebp - 0x2564], eax
lea edx, [ebp - 0x2454]
push edx
push 0x64
push 6
push 0
call fcn.004094ad
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2564]
jl 0x4047f2
inc dword [ebp - 0x122c]
cmp dword [ebp - 0x122c], 2
jl 0x40447b
jmp 0x40487a
cmp byte [ebp - 0x244e], 0x36
je 0x404839
cmp byte [ebp - 0x244e], 0x37
jne 0x40487a
mov dword [ebp - 0x2568], 0x20
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x9c4]
mov dword [ebp - 0x2564], eax
lea edx, [ebp - 0x2454]
push edx
push 0x32
push 6
push 0
call fcn.004094ad
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2564]
jl 0x404855
jmp 0x40447b
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4048cc
xor eax, eax
jmp 0x4048d6
cmp eax, 0x20
jbe 0x4048d6
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x404965
cmp byte [ebp - 0x2450], 0x67
je 0x404965
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404947
xor eax, eax
jmp 0x404951
cmp eax, 0x20
jbe 0x404951
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x404c40
cmp word [ebp - 0x244e], 0
je 0x404c40
push 0xe9de
push 0xd0cac9c2
push 0xbfb4b299
push 0x92848281
push 0x736c483e
push 0x281400b0
mov byte [ebp - 0x1228], 0x20
mov byte [ebp - 0x1227], 0xf4
mov eax, dword [ebp - 0x122c]
movzx eax, byte [esp + eax]
mov dword [ebp - 0x1226], eax
mov al, byte [ebp - 0x244e]
mov byte [ebp - 0x1222], al
mov al, byte [ebp - 0x244d]
mov byte [ebp - 0x1221], al
add esp, 0x18
push 0xfa
lea edx, [ebp - 0x266e]
push edx
push 0xf6
lea edx, [ebp - 0x1228]
push edx
call dword [ebx + 0x3c]
cmp eax, 2
je 0x404a2d
push 0xa0d24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
mov dword [ebp - 0x245c], 1
jmp 0x404c40
mov dword [ebp - 0x112e], 0x227
mov al, byte [ebp - 0x266e]
mov byte [ebp - 0x112c], al
mov al, byte [ebp - 0x266d]
mov byte [ebp - 0x112b], al
lea edx, [ebp - 0x1132]
push edx
push 8
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
jne 0x404a87
mov dword [ebp - 0x245c], 1
jmp 0x404c40
cmp eax, 0xffffffff
jne 0x404a9b
mov dword [ebp - 0x245c], 1
jmp 0x404c40
cmp byte [ebp - 0x2450], 0x7f
jne 0x404bc7
cmp byte [ebp - 0x244e], 0x35
jne 0x404b02
mov dword [ebp - 0x2568], 0x20
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x9c4]
mov dword [ebp - 0x2564], eax
lea edx, [ebp - 0x2454]
push edx
push 0x64
push 6
push 0
call fcn.004094ad
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2564]
jl 0x404acd
inc dword [ebp - 0x122c]
cmp dword [ebp - 0x122c], 0x16
jl 0x40447b
jmp 0x404b55
cmp byte [ebp - 0x244e], 0x36
je 0x404b14
cmp byte [ebp - 0x244e], 0x37
jne 0x404b55
mov dword [ebp - 0x2568], 0x20
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x9c4]
mov dword [ebp - 0x2564], eax
lea edx, [ebp - 0x2454]
push edx
push 0x32
push 6
push 0
call fcn.004094ad
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2564]
jl 0x404b30
jmp 0x40447b
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404ba7
xor eax, eax
jmp 0x404bb1
cmp eax, 0x20
jbe 0x404bb1
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x404c40
cmp byte [ebp - 0x2450], 0x67
je 0x404c40
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404c22
xor eax, eax
jmp 0x404c2c
cmp eax, 0x20
jbe 0x404c2c
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x38
jne 0x404d86
cmp dword [ebp - 0x245c], 0
jne 0x404d86
mov dword [ebp - 0x112e], 0x903b
push 0x11
lea edx, [ebp - 0xffa]
push edx
lea edx, [ebp - 0x112c]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
push 0xa0d24
push 0x4e49565f
push 0x474e4947
push 0x4e414843
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
lea edx, [ebp - 0x1132]
push edx
push 0x17
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x404cd2
cmp eax, 0xffffffff
jne 0x404ce1
mov dword [ebp - 0x245c], 1
jmp 0x404d86
cmp byte [ebp - 0x2450], 0x7b
je 0x404d5c
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404d3c
xor eax, eax
jmp 0x404d46
cmp eax, 0x20
jbe 0x404d46
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x404d86
push 0xa0d
push 0x244b4f5f
push 0x4e49565f
push 0x474e4947
push 0x4e414843
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x4052a2
cmp dword [ebp - 0x245c], 0
jne 0x405077
mov dword [ebp - 0x112e], 0x200023
mov dword [ebp - 0x112a], 0x100000
lea edx, [ebp - 0x1132]
push edx
push 0xb
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x404de4
cmp eax, 0xffffffff
jne 0x404df3
mov dword [ebp - 0x245c], 1
jmp 0x405077
cmp byte [ebp - 0x2450], 0x7f
jne 0x404ff5
cmp byte [ebp - 0x244e], 0x31
jne 0x404ff5
mov dword [ebp - 0x112e], 0x180023
mov dword [ebp - 0x112a], 0x100000
lea edx, [ebp - 0x1132]
push edx
push 0xb
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x404e4f
cmp eax, 0xffffffff
jne 0x404e5e
mov dword [ebp - 0x245c], 1
jmp 0x404ff0
cmp byte [ebp - 0x2450], 0x7f
jne 0x404f6e
cmp byte [ebp - 0x244e], 0x31
jne 0x404f6e
mov dword [ebp - 0x112e], 0x100023
mov dword [ebp - 0x112a], 0x100000
lea edx, [ebp - 0x1132]
push edx
push 0xb
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x404eba
cmp eax, 0xffffffff
jne 0x404ec9
mov dword [ebp - 0x245c], 1
jmp 0x404f69
cmp byte [ebp - 0x2450], 0x7f
jne 0x404ee7
cmp byte [ebp - 0x244e], 0x31
jne 0x404ee7
mov dword [esi + 0x14], 0x100000
jmp 0x404f69
cmp byte [ebp - 0x2450], 0x63
je 0x404f62
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404f42
xor eax, eax
jmp 0x404f4c
cmp eax, 0x20
jbe 0x404f4c
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x404f69
mov dword [esi + 0x14], 0x180000
jmp 0x404ff0
cmp byte [ebp - 0x2450], 0x63
je 0x404fe9
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404fc9
xor eax, eax
jmp 0x404fd3
cmp eax, 0x20
jbe 0x404fd3
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x404ff0
mov dword [esi + 0x14], 0x200000
jmp 0x405077
cmp byte [ebp - 0x2450], 0x63
je 0x405070
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405050
xor eax, eax
jmp 0x40505a
cmp eax, 0x20
jbe 0x40505a
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x405077
mov dword [esi + 0x14], 0x280000
cmp dword [ebp - 0x245c], 0
jne 0x405267
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [esi + 0x14]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x24], eax
mov dword [ebp - 0xfbe], 0
mov eax, dword [esi + 0x14]
mov dword [ebp - 0xfba], eax
mov dword [ebp - 0xfb6], 0
shl eax, 0xa
and eax, 0xffff0000
push eax
push 0
push 0x401
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov eax, dword [ebp - 0xfbe]
mov ecx, dword [ebp - 0xfba]
cmp eax, ecx
jae 0x405267
sub ecx, eax
cmp ecx, 0x40
jbe 0x405141
mov ecx, 0x40
mov dword [ebp - 0xfb2], ecx
mov dword [ebp - 0x112e], 0x23
mov byte [ebp - 0x1129], ch
mov byte [ebp - 0x1128], cl
add eax, dword [ebp - 0xfb6]
mov byte [ebp - 0x112b], ah
mov byte [ebp - 0x112a], al
shr eax, 0x10
mov byte [ebp - 0x112d], ah
mov byte [ebp - 0x112c], al
lea edx, [ebp - 0x1132]
push edx
push 0xb
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x4051ac
cmp eax, 0xffffffff
jne 0x4051bb
mov dword [ebp - 0x245c], 1
jmp 0x405267
cmp byte [ebp - 0x2450], 0x63
je 0x405236
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405216
xor eax, eax
jmp 0x405220
cmp eax, 0x20
jbe 0x405220
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x405267
call fcn.004092bc
mov eax, dword [ebp - 0xfb2]
mov ecx, dword [ebp - 0xfbe]
add ecx, dword [esi + 0x24]
add dword [ebp - 0xfbe], eax
push eax
lea edx, [ebp - 0x244b]
push edx
push ecx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
jmp 0x405121
cmp dword [ebp - 0x245c], 0
jne 0x405299
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
jmp 0x4052a2
lea edx, [esi + 0x24]
push edx
call fcn.0040962f
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x405c6e
cmp dword [ebp - 0x245c], 0
jne 0x405b32
mov dword [ebp - 0x583], 0
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov dword [ebp - 0x1434], 3
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x17]
mov dword [ebp - 0x2564], eax
lea edx, [ebp - 0x2454]
push edx
push 0x17
push 6
push 0
call fcn.004094ad
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x2564]
jl 0x405306
mov dword [ebp - 0x112e], 0x34
mov dword [ebp - 0x112a], 0
lea edx, [ebp - 0x1132]
push edx
push 0xa
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x405368
cmp eax, 0xffffffff
jne 0x405377
mov dword [ebp - 0x245c], 1
jmp 0x405409
cmp byte [ebp - 0x2450], 0x74
je 0x405409
dec dword [ebp - 0x1434]
je 0x405399
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x405326
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4053eb
xor eax, eax
jmp 0x4053f5
cmp eax, 0x20
jbe 0x4053f5
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [esi + 0x14], 0x100000
jne 0x405467
mov dword [ebp - 0xf8e], 0x20000
mov dword [ebp - 0xf8a], 0x100000
mov dword [ebp - 0xf86], pe_nt_image_headers32
mov dword [ebp - 0xf82], 0xfffe001c
mov dword [ebp - 0xf7e], 0
mov dword [ebp - 0xf7a], 0
mov dword [ebp - 0xf76], 0
mov dword [ebp - 0xf72], 0
jmp 0x405570
cmp dword [esi + 0x14], 0x180000
jne 0x4054c5
mov dword [ebp - 0xf8e], 0x20000
mov dword [ebp - 0xf8a], 0x180000
mov dword [ebp - 0xf86], 0x800
mov dword [ebp - 0xf82], 0xfffe001c
mov dword [ebp - 0xf7e], 0
mov dword [ebp - 0xf7a], 0
mov dword [ebp - 0xf76], 0
mov dword [ebp - 0xf72], 0
jmp 0x405570
cmp dword [esi + 0x14], 0x200000
jne 0x405520
mov dword [ebp - 0xf8e], 0x40000
mov dword [ebp - 0xf8a], 0x200000
mov dword [ebp - 0xf86], 0x800
mov dword [ebp - 0xf82], 0xfffc001c
mov dword [ebp - 0xf7e], 0
mov dword [ebp - 0xf7a], 0
mov dword [ebp - 0xf76], 0
mov dword [ebp - 0xf72], 0
jmp 0x405570
mov dword [ebp - 0xf8e], 0x30000
mov dword [ebp - 0xf8a], 0x280000
mov dword [ebp - 0xf86], 0x800
mov dword [ebp - 0xf82], 0xfffd001c
mov dword [ebp - 0xf7e], 0
mov dword [ebp - 0xf7a], 0
mov dword [ebp - 0xf76], 0
mov dword [ebp - 0xf72], 0
mov dword [ebp - 0xfae], 0
mov dword [ebp - 0xfaa], 0
cmp dword [ebp - 0xfae], 0x20
jae 0x4055c4
imul ecx, dword [ebp - 0xfae], 0x10
mov eax, dword [ebp + ecx - 0xf8a]
sub eax, dword [ebp + ecx - 0xf8e]
test eax, eax
je 0x4055c4
mov ecx, dword [ebp + ecx - 0xf86]
xor edx, edx
div ecx
test edx, edx
je 0x4055b6
inc eax
add dword [ebp - 0xfaa], eax
inc dword [ebp - 0xfae]
jmp 0x405584
mov eax, dword [ebp - 0xfaa]
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0xfae], 0
imul ecx, dword [ebp - 0xfae], 0x10
mov eax, dword [ebp + ecx - 0xf8e]
mov dword [ebp - 0xfa6], eax
mov eax, dword [ebp + ecx - 0xf8a]
mov dword [ebp - 0xfa2], eax
mov eax, dword [ebp + ecx - 0xf86]
mov dword [ebp - 0xf9e], eax
mov eax, dword [ebp + ecx - 0xf82]
mov dword [ebp - 0xf9a], eax
cmp dword [ebp - 0x245c], 0
jne 0x405911
mov dword [ebp - 0x112e], 0x36
mov dword [ebp - 0x112a], 0
mov dword [ebp - 0x1126], 0x40430100
mov dword [ebp - 0x1122], 0x2d2d2d2d
mov dword [ebp - 0x111e], 0x2d2d2d2d
mov dword [ebp - 0x111a], 0x200
mov dword [ebp - 0x1116], 0x2000100
mov dword [ebp - 0x1112], 0
mov dword [ebp - 0x110e], 0
mov dword [ebp - 0xf96], 0
push 8
lea edx, [ebp - 0x12af]
push edx
lea edx, [ebp - 0x1122]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov ecx, dword [ebp - 0xfa6]
mov edx, dword [esi + 0x20]
cmp ecx, dword [ebp - 0xfa2]
jae 0x4056f8
movzx eax, byte [edx + ecx]
add dword [ebp - 0xf96], eax
inc ecx
jmp 0x4056e3
mov eax, dword [ebp - 0xf96]
mov byte [ebp - 0x1128], ah
mov byte [ebp - 0x1127], al
mov eax, dword [ebp - 0x1230]
mov byte [ebp - 0x1118], ah
mov byte [ebp - 0x1117], al
mov eax, dword [ebp - 0xfa6]
mov byte [ebp - 0x1112], ah
mov byte [ebp - 0x1111], al
shr eax, 0x10
mov byte [ebp - 0x1114], ah
mov byte [ebp - 0x1113], al
mov eax, dword [ebp - 0xfa2]
sub eax, dword [ebp - 0xfa6]
mov byte [ebp - 0x110e], ah
mov byte [ebp - 0x110d], al
shr eax, 0x10
mov byte [ebp - 0x1110], ah
mov byte [ebp - 0x110f], al
mov dword [ebp - 0x2568], 3
mov dword [ebp - 0x1434], 0x100
lea edx, [ebp - 0x1132]
push edx
push 0x26
push 0x1388
push 0x40
push 6
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x4057a5
mov dword [ebp - 0x245c], 1
jmp 0x405911
lea edx, [ebp - 0x2454]
push edx
push 0x3e8
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x4057ce
mov dword [ebp - 0x245c], 1
jmp 0x405911
test eax, eax
jne 0x40585b
dec dword [ebp - 0x2568]
jne 0x4057a5
mov dword [ebp - 0x2568], 3
dec dword [ebp - 0x1434]
jne 0x405778
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405838
xor eax, eax
jmp 0x405842
cmp eax, 0x20
jbe 0x405842
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x405911
cmp byte [ebp - 0x2450], 0x7f
jne 0x40588b
cmp byte [ebp - 0x244e], 0x78
jne 0x40588b
mov dword [ebp - 0x2568], 3
mov dword [ebp - 0x1434], 0x100
jmp 0x4057a5
cmp byte [ebp - 0x2450], 0x76
je 0x405911
cmp byte [ebp - 0x2450], 0x7e
je 0x4057a5
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4058f3
xor eax, eax
jmp 0x4058fd
cmp eax, 0x20
jbe 0x4058fd
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x405b32
mov eax, dword [ebp - 0xfda]
mov dword [ebp - 0xd8e], eax
mov eax, dword [ebp - 0xfa6]
mov ecx, dword [ebp - 0xfa2]
cmp eax, ecx
jae 0x405b32
sub ecx, eax
cmp ecx, dword [ebp - 0xf9e]
jbe 0x40594e
mov ecx, dword [ebp - 0xf9e]
mov dword [ebp - 0xf92], ecx
add eax, dword [ebp - 0xf9a]
mov dword [ebp - 0xd8a], 0x36
mov byte [ebp - 0xd86], ah
mov byte [ebp - 0xd85], al
shr eax, 0x10
mov byte [ebp - 0xd88], ah
mov byte [ebp - 0xd87], al
xor ecx, ecx
mov edx, dword [esi + 0x20]
add edx, dword [ebp - 0xfa6]
cmp ecx, dword [ebp - 0xf92]
jae 0x40599f
mov al, byte [edx + ecx]
mov byte [ebp + ecx - 0xd84], al
inc ecx
jmp 0x40598a
mov dword [ebp - 0x1434], 0x100
mov ecx, dword [ebp - 0xf92]
lea edx, [ebp - 0xd8e]
push edx
lea edx, [ecx + 0xa]
push edx
push 0x9c4
push 0x40
push 6
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x4059de
mov dword [ebp - 0x245c], 1
jmp 0x405b32
lea edx, [ebp - 0x2454]
push edx
push 0x64
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x405a04
mov dword [ebp - 0x245c], 1
jmp 0x405b32
test eax, eax
jne 0x405a7b
dec dword [ebp - 0x1434]
jne 0x4059a9
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2445
push 0x534e4f50
push 0x5345525f
push 0x4f4e5f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405a58
xor eax, eax
jmp 0x405a62
cmp eax, 0x20
jbe 0x405a62
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x405b32
cmp byte [ebp - 0x2450], 0x7f
jne 0x405aa1
cmp byte [ebp - 0x244e], 0x78
jne 0x405aa1
mov dword [ebp - 0x1434], 0x100
jmp 0x4059de
cmp byte [ebp - 0x2450], 0x76
je 0x405b1c
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405afc
xor eax, eax
jmp 0x405b06
cmp eax, 0x20
jbe 0x405b06
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x405b32
call fcn.004092bc
mov eax, dword [ebp - 0xf92]
add dword [ebp - 0xfa6], eax
jmp 0x40592a
cmp dword [ebp - 0x245c], 0
jne 0x405c3e
cmp eax, 0xffffffff
jne 0x405b53
mov dword [ebp - 0x245c], 1
jmp 0x405c3e
mov dword [ebp - 0x2568], 0x20
push 0x20fe
push 0x1010000
push esp
push 6
push 0xa
push 0xc0
push 6
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x405b8e
mov dword [ebp - 0x245c], 1
jmp 0x405c3e
lea edx, [ebp - 0x2454]
push edx
push 0x3e8
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x405bb7
mov dword [ebp - 0x245c], 1
jmp 0x405c3e
test eax, eax
jne 0x405bc5
dec dword [ebp - 0x2568]
jne 0x405b5d
jmp 0x405c3e
cmp byte [ebp - 0x2450], 0x60
je 0x405c3e
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405c20
xor eax, eax
jmp 0x405c2a
cmp eax, 0x20
jbe 0x405c2a
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x405c6e
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x405e31
cmp dword [ebp - 0x245c], 0
jne 0x405e31
push 0x400
push 0
lea edx, [ebp - 0x577]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov dword [ebp - 0x57f], 0
push 0
push 0x1281a903
push 0xe0070000
push esp
push 0xc
push 0xa
push 0
push 5
push 0
call fcn.0040933f
cmp eax, 0xffffffff
jne 0x405cd8
mov dword [ebp - 0x245c], 1
jmp 0x405d3f
lea edx, [ebp - 0x2454]
push edx
push 0x3e8
push 6
push 0
call fcn.004094ad
cmp eax, 0xffffffff
jne 0x405cfe
mov dword [ebp - 0x245c], 1
jmp 0x405d3f
test eax, eax
je 0x405d3f
imul ecx, dword [ebp - 0x57f], 4
movzx eax, byte [ebp - 0x244e]
mov ah, byte [ebp - 0x244f]
mov word [ebp + ecx - 0x577], ax
test eax, eax
je 0x405d3d
movzx eax, byte [ebp - 0x244c]
mov ah, byte [ebp - 0x244d]
mov word [ebp + ecx - 0x575], ax
inc dword [ebp - 0x57f]
jmp 0x405cd8
cmp dword [ebp - 0x245c], 0
jne 0x405e31
push 0xa
push 0xd642520
push 0x3a24544e
push 0x554f435f
push 0x43544424
push dword [ebp - 0x57f]
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
mov dword [ebp - 0x57b], 0
mov ecx, dword [ebp - 0x57b]
cmp ecx, dword [ebp - 0x57f]
jae 0x405e31
imul ecx, ecx, 4
movzx eax, word [ebp + ecx - 0x577]
movzx ecx, ah
and eax, 0xff
cmp ecx, 0xc0
jb 0x405df6
sub ecx, 0xc0
push 0xa0d58
push 0x322e2558
push 0x322e2555
push eax
push ecx
lea eax, [esp + 8]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x1c
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
jmp 0x405e26
push 0xa0d58
push 0x322e2558
push 0x322e2550
push eax
push ecx
lea eax, [esp + 8]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x1c
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
inc dword [ebp - 0x57b]
jmp 0x405d91
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x18
jne 0x4060dc
cmp dword [ebp - 0x245c], 0
jne 0x4060dc
push 0
push 0xa0d2443
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 4
push 0xe0070000
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x2710
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x405e9e
cmp eax, 0xffffffff
jne 0x405ead
mov dword [ebp - 0x245c], 1
jmp 0x4060dc
cmp byte [ebp - 0x2450], 0x7f
jne 0x40603c
cmp byte [ebp - 0x244e], 0x11
jne 0x40603c
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
mov dword [ebp - 0xfda], 0x4a020000
mov dword [ebp - 0xfd6], 0x4a060000
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xffffffffffffffff
push 0
push 4
push 0
push 0x40
push 0
push 6
push 3
push 0
push 0
mov dword [ebp - 0x177], esp
mov eax, dword [ebp - 0xfd6]
mov dword [esp + 0x40], eax
mov eax, dword [ebp - 0xfda]
mov dword [esp + 0x5c], eax
push 0
push dword [ebp - 0x177]
push 4
call dword [edi]
add esp, 0x60
mov eax, dword [ebp - 0xfda]
mov dword [ebp - 0x1132], eax
mov dword [ebp - 0x112e], 4
lea edx, [ebp - 0x1132]
push edx
push 5
lea edx, [ebp - 0x2454]
push edx
push 0x1f4
push 0xbb8
push 0x40
push 6
push 0
call fcn.0040930b
test eax, eax
je 0x405f88
cmp eax, 0xffffffff
jne 0x405f97
mov dword [ebp - 0x245c], 1
jmp 0x406037
cmp byte [ebp - 0x2450], 0x44
je 0x406012
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405ff2
xor eax, eax
jmp 0x405ffc
cmp eax, 0x20
jbe 0x405ffc
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x406037
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x4060dc
cmp byte [ebp - 0x2450], 0x44
je 0x4060b7
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406097
xor eax, eax
jmp 0x4060a1
cmp eax, 0x20
jbe 0x4060a1
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x4060dc
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x4060ec
cmp eax, 0xb
jne 0x406105
push 0
push 0
mov dword [ebp - 0x173], esp
push 0
push dword [ebp - 0x173]
push 7
call dword [edi]
add esp, 8
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0
mov eax, esp
push 0
push eax
push 2
call dword [edi]
add esp, 4
push 0
push 0
push 3
call dword [edi]
cmp dword [esi + 0x270], 0x75736924
jne 0x408bbe
cmp dword [esi + 0x274], 0x3037757a
jne 0x408bbe
cmp dword [esi + 0x278], 0x5424325f
jne 0x408bbe
cmp dword [esi + 0x27c], 0x736e6172
jne 0x408bbe
cmp dword [esi + 0x280], 0x6e6f7274
jne 0x408bbe
cmp dword [esi + 0x284], 0x3231355b
jne 0x408bbe
cmp dword [esi + 0x288], 0x3230312f
jne 0x408bbe
cmp dword [esi + 0x28c], 0x205d6b34
jne 0x408bbe
cmp dword [esi + 0x290], 0x696c2d4b
jne 0x408bbe
cmp word [esi + 0x294], 0x656e
jne 0x408bbe
cmp byte [esi + 0x296], 0
jne 0x408bbe
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4061fa
cmp eax, 0xb
je 0x4061fa
cmp eax, 0xa
je 0x4061fa
cmp eax, 0x17
je 0x4061fa
cmp eax, 0x18
jne 0x408bbe
push 0x28a0
push 0
push 4
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x406225
mov dword [ebp - 0x245c], 1
jmp 0x408bbe
push 1
push 0xc
push 0x258
push 0xa
push 0
push 2
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x406256
mov dword [ebp - 0x245c], 1
jmp 0x408ba8
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x406279
cmp eax, 0xb
je 0x406279
cmp eax, 0xa
je 0x406279
cmp eax, 0x17
je 0x406279
cmp eax, 0x18
jne 0x408ba8
push 0
push 0
push 0
push 0
push 0
push 0
push 0x40000
push 0
push 0x100
push 0
push 0
push 0
push 0x400
push 0
push 1
push 0
push 0
push 0
push 4
push 1
push 0
push 0
mov eax, esp
push 0
push eax
push 4
call dword [edi]
add esp, 0x58
cmp eax, 0xffffffff
je 0x408ba8
push 0x81f11181
push 0
push 4
push 0
push 0
push 0
push 4
push 0
mov dword [ebp - 0x16f], esp
lea edx, [ebp - 0x2454]
push edx
push dword [ebp - 0x16f]
push 0xd
call dword [edi]
add esp, 0x20
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x406304
cmp eax, 0xa
jne 0x406c98
mov byte [ebp - 0x1430], 0
mov byte [ebp - 0x163], 0
mov byte [ebp - 0x122], 0
mov byte [ebp - 0xe1], 0
mov byte [ebp - 0xa0], 0
mov byte [ebp - 0x5f], 0
cmp dword [ebp - 0x245c], 0
jne 0x406448
push 0x94
push 0x1af11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x40636a
cmp eax, 0xffffffff
jne 0x406379
mov dword [ebp - 0x245c], 1
jmp 0x406448
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x406392
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x5a
jne 0x406448
mov ecx, 2
cmp ecx, 0x42
jae 0x4063e9
cmp ecx, dword [ebp - 0x167]
jae 0x4063e9
mov edx, dword [ebp - 0x16b]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x2454]
cmp dl, 0
je 0x4063e9
cmp dl, 0xff
je 0x4063e9
cmp dl, 0x2d
je 0x4063e9
mov byte [ebp + ecx - 0x1432], dl
inc ecx
jmp 0x4063b3
mov byte [ebp + ecx - 0x1432], 0
cmp byte [ebp - 0x1430], 0
je 0x406448
lea eax, [ebp - 0x1430]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x54464f53
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x406519
push 0x95
push 0x1af11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x406487
cmp eax, 0xffffffff
jne 0x406496
mov dword [ebp - 0x245c], 1
jmp 0x406519
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x4064af
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x5a
jne 0x406519
movzx eax, byte [ebp + ecx - 0x2451]
mov ah, byte [ebp + ecx - 0x2452]
push 0xa0d58
push 0x342e2520
push 0x3a244e4f
push 0x49535245
push 0x565f5753
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x406636
push 0x91
push 0x1af11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x406558
cmp eax, 0xffffffff
jne 0x406567
mov dword [ebp - 0x245c], 1
jmp 0x406636
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x406580
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x5a
jne 0x406636
mov ecx, 2
cmp ecx, 0x42
jae 0x4065d7
cmp ecx, dword [ebp - 0x167]
jae 0x4065d7
mov edx, dword [ebp - 0x16b]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x2454]
cmp dl, 0
je 0x4065d7
cmp dl, 0xff
je 0x4065d7
cmp dl, 0x2d
je 0x4065d7
mov byte [ebp + ecx - 0x165], dl
inc ecx
jmp 0x4065a1
mov byte [ebp + ecx - 0x165], 0
cmp byte [ebp - 0x163], 0
je 0x406636
lea eax, [ebp - 0x163]
push 0xa0d
push 0x7325203a
push 0x24524542
push 0x4d554e5f
push 0x45524157
push 0x44524148
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x2c
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x406773
push 0x92
push 0x1af11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x406675
cmp eax, 0xffffffff
jne 0x406684
mov dword [ebp - 0x245c], 1
jmp 0x406773
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x40669d
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x5a
jne 0x406773
mov ecx, 2
cmp ecx, 0x42
jae 0x4066f4
cmp ecx, dword [ebp - 0x167]
jae 0x4066f4
mov edx, dword [ebp - 0x16b]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x2454]
cmp dl, 0
je 0x4066f4
cmp dl, 0xff
je 0x4066f4
cmp dl, 0x2d
je 0x4066f4
mov byte [ebp + ecx - 0x124], dl
inc ecx
jmp 0x4066be
mov byte [ebp + ecx - 0x124], 0
cmp byte [ebp - 0x122], 0
je 0x406773
lea eax, [ebp - 0x122]
push 0
push 0xa0d7325
push 0x203a2452
push 0x45424d55
push 0x4e5f4552
push 0x41574452
push 0x41485f55
push 0x43455f52
push 0x4f5f4449
push 0x5f524549
push 0x4c505055
push 0x535f4d45
push 0x54535953
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x48
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x40689c
push 0x97
push 0x1af11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x4067b2
cmp eax, 0xffffffff
jne 0x4067c1
mov dword [ebp - 0x245c], 1
jmp 0x40689c
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x4067da
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x5a
jne 0x40689c
mov ecx, 2
cmp ecx, 0x42
jae 0x406831
cmp ecx, dword [ebp - 0x167]
jae 0x406831
mov edx, dword [ebp - 0x16b]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x2454]
cmp dl, 0
je 0x406831
cmp dl, 0xff
je 0x406831
cmp dl, 0x2d
je 0x406831
mov byte [ebp + ecx - 0xe3], dl
inc ecx
jmp 0x4067fb
mov byte [ebp + ecx - 0xe3], 0
cmp byte [ebp - 0xe1], 0
je 0x40689c
lea eax, [ebp - 0xe1]
push 0xa
push 0xd732520
push 0x3a244550
push 0x59545f45
push 0x4e49474e
push 0x455f524f
push 0x5f454d41
push 0x4e5f4d45
push 0x54535953
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x4069d7
push 0x98
push 0x1af11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x4068db
cmp eax, 0xffffffff
jne 0x4068ea
mov dword [ebp - 0x245c], 1
jmp 0x4069d7
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x406903
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x5a
jne 0x4069d7
mov ecx, 2
cmp ecx, 0x42
jae 0x40695a
cmp ecx, dword [ebp - 0x167]
jae 0x40695a
mov edx, dword [ebp - 0x16b]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x2454]
cmp dl, 0
je 0x40695a
cmp dl, 0xff
je 0x40695a
cmp dl, 0x2d
je 0x40695a
mov byte [ebp + ecx - 0xa2], dl
inc ecx
jmp 0x406924
mov byte [ebp + ecx - 0xa2], 0
cmp byte [ebp - 0xa0], 0
je 0x4069d7
lea eax, [ebp - 0xa0]
push 0xa0d73
push 0x25203a24
push 0x5245424d
push 0x554e5f4c
push 0x41495245
push 0x535f5245
push 0x54534554
push 0x5f524f5f
push 0x45444f43
push 0x5f504f48
push 0x535f5249
push 0x41504552
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x44
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x406aad
push 0x99
push 0x1af11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x406a16
cmp eax, 0xffffffff
jne 0x406a25
mov dword [ebp - 0x245c], 1
jmp 0x406aad
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x406a3e
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x5a
jne 0x406aad
mov eax, dword [ebp + ecx - 0x2452]
bswap eax
test eax, eax
je 0x406aad
push 0xa
push 0xd58382e
push 0x25203a24
push 0x45544144
push 0x5f474e49
push 0x4d4d4152
push 0x474f5250
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x406b96
push 0x9a
push 0x1af11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x406aec
cmp eax, 0xffffffff
jne 0x406afb
mov dword [ebp - 0x245c], 1
jmp 0x406b96
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x406b14
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x5a
jne 0x406b96
movzx eax, byte [ebp + ecx - 0x2451]
mov ah, byte [ebp + ecx - 0x2452]
test eax, eax
je 0x406b96
push 0xa0d58
push 0x342e2520
push 0x3a245245
push 0x49464954
push 0x4e454449
push 0x5f415441
push 0x445f4349
push 0x54534f4e
push 0x47414944
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x38
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x245c], 0
jne 0x406c98
push 0x90
push 0x1af11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x406bd5
cmp eax, 0xffffffff
jne 0x406be4
mov dword [ebp - 0x245c], 1
jmp 0x406c98
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x406bfd
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x5a
jne 0x406c98
mov ecx, 2
cmp ecx, 0x42
jae 0x406c51
cmp ecx, dword [ebp - 0x167]
jae 0x406c51
mov edx, dword [ebp - 0x16b]
lea edx, [edx + ecx]
mov dl, byte [ebp + edx - 0x2454]
cmp dl, 0
je 0x406c51
cmp dl, 0xff
je 0x406c51
cmp dl, 0x2d
je 0x406c51
mov byte [ebp + ecx - 0x61], dl
inc ecx
jmp 0x406c1e
mov byte [ebp + ecx - 0x61], 0
cmp byte [ebp - 0x5f], 0
je 0x406c98
lea eax, [ebp - 0x5f]
push 0xa0d
push 0x7325203a
push 0x244e4956
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x4074c5
cmp dword [ebp - 0x245c], 0
jne 0x406efc
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0
mov eax, esp
push 0
push eax
push 2
call dword [edi]
add esp, 4
push 0
push 0
push 3
call dword [edi]
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x28a0
push 0
push 4
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
push 1
push 0xc
push 0x258
push 0xa
push 0
push 2
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0
push 0
push 0x40000
push 0
push 0x100
push 0
push 0
push 0
push 0x400
push 0
push 1
push 0
push 0
push 0
push 4
push 1
push 0
push 0
mov eax, esp
push 0
push eax
push 4
call dword [edi]
add esp, 0x58
push 0x81f11181
push 0
push 4
push 0
push 0
push 0
push 4
push 0
mov dword [ebp - 0x12], esp
lea edx, [ebp - 0x2454]
push edx
push dword [ebp - 0x12]
push 0xd
call dword [edi]
add esp, 0x20
push 0x1a5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x86
push 0x10f11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x3e8
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
cmp eax, 0xffffffff
jne 0x406dc4
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x406e10
test eax, eax
jne 0x406e10
push 0
push 0xc
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
push 0x86
push 0x10f11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x3e8
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
push 0x86
push 0x10f11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x1388
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x406e42
cmp eax, 0xffffffff
jne 0x406e51
mov dword [ebp - 0x245c], 1
jmp 0x406efc
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x406e6a
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x50
je 0x406efc
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406ede
xor eax, eax
jmp 0x406ee8
cmp eax, 0x20
jbe 0x406ee8
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x406ff1
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x3ef11181
lea eax, [ebp - 0x2454]
push esp
push 4
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x406f41
cmp eax, 0xffffffff
jne 0x406f50
mov dword [ebp - 0x245c], 1
jmp 0x406ff1
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x406f69
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x7e
je 0x406ff1
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406fd3
xor eax, eax
jmp 0x406fdd
cmp eax, 0x20
jbe 0x406fdd
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x40718c
push 0x6e
push 0xa
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
push 0x13a
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x1000
push 0x35
push 0x8f11180
lea eax, [ebp - 0x2454]
push esp
push 0xc
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x407053
cmp eax, 0xffffffff
jne 0x407062
mov dword [ebp - 0x245c], 1
jmp 0x40718c
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x40707b
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x75
jne 0x40709f
mov dword [esi + 0x14], 0x100000
jmp 0x40718c
push 0x800
push 0x35
push 0x8f11180
lea eax, [ebp - 0x2454]
push esp
push 0xc
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x4070d3
cmp eax, 0xffffffff
jne 0x4070e2
mov dword [ebp - 0x245c], 1
jmp 0x40718c
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x4070fb
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x75
jne 0x40711c
mov dword [esi + 0x14], 0x80000
jmp 0x40718c
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40716e
xor eax, eax
jmp 0x407178
cmp eax, 0x20
jbe 0x407178
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x407390
mov dword [ebp - 0x1e], 0
mov dword [ebp - 0x1a], 0
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x16], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x24], eax
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [ebp - 0x1a]
cmp eax, dword [ebp - 0x16]
jae 0x407390
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x36
push 0x1f11180
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x407227
cmp eax, 0xffffffff
jne 0x407236
mov dword [ebp - 0x245c], 1
jmp 0x407390
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x40724f
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x76
je 0x4072dc
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4072b9
xor eax, eax
jmp 0x4072c3
cmp eax, 0x20
jbe 0x4072c3
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x407390
cmp dword [ebp - 0x1e], 0
jne 0x40733e
mov eax, dword [ebp - 0x16]
mov ecx, dword [ebp - 0x167]
dec ecx
xor edx, edx
div ecx
test edx, edx
je 0x4072f5
inc eax
mov dword [ebp - 0x1e], eax
shl eax, 0x10
and eax, 0xffff0000
push eax
push 0
push 0x401
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
call fcn.004092bc
dec dword [ebp - 0x167]
inc dword [ebp - 0x16b]
mov eax, dword [ebp - 0x16]
sub eax, dword [ebp - 0x1a]
cmp eax, dword [ebp - 0x167]
jbe 0x407363
mov eax, dword [ebp - 0x167]
mov ecx, dword [esi + 0x24]
add ecx, dword [ebp - 0x1a]
mov edx, dword [ebp - 0x16b]
push eax
lea edx, [ebp + edx - 0x2454]
push edx
push ecx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov eax, dword [ebp - 0x167]
add dword [ebp - 0x1a], eax
jmp 0x4071e4
cmp dword [ebp - 0x245c], 0
jne 0x40748a
push 0xb4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x82
push 0x1f11180
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x4073da
cmp eax, 0xffffffff
jne 0x4073e9
mov dword [ebp - 0x245c], 1
jmp 0x40748a
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x407402
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0xc2
je 0x40748a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40746c
xor eax, eax
jmp 0x407476
cmp eax, 0x20
jbe 0x407476
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x4074bc
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
jmp 0x4074c5
lea edx, [esi + 0x24]
push edx
call fcn.0040962f
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x40865c
mov dword [ebp - 0x122c], 0
cmp dword [ebp - 0x245c], 0
jne 0x4075e4
cmp dword [esi + 0x14], 0x80000
jne 0x407549
mov dword [ebp - 0xf8e], 0
mov dword [ebp - 0xf8a], 0x80000
mov dword [ebp - 0xf86], pe_nt_image_headers32
mov dword [ebp - 0xf82], 0
mov dword [ebp - 0xf7e], 0
mov dword [ebp - 0xf7a], 0
mov dword [ebp - 0xf76], 0
mov dword [ebp - 0xf72], 0
jmp 0x4075e4
cmp dword [esi + 0x14], 0x100000
jne 0x4075a4
mov dword [ebp - 0xf8e], 0x20000
mov dword [ebp - 0xf8a], 0x100000
mov dword [ebp - 0xf86], pe_nt_image_headers32
mov dword [ebp - 0xf82], 0
mov dword [ebp - 0xf7e], 0
mov dword [ebp - 0xf7a], 0
mov dword [ebp - 0xf76], 0
mov dword [ebp - 0xf72], 0
jmp 0x4075e4
push 0xa
push 0xd245441
push 0x4d524f46
push 0x5f454c49
push 0x465f4d4f
push 0x525f4445
push 0x54524f50
push 0x5055534e
push 0x555f524f
push 0x52524524
push esp
call dword [ebx + 0x30]
add esp, 0x28
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x4076b1
mov dword [ebp - 0xfae], 0
mov dword [ebp - 0xfaa], 0
cmp dword [ebp - 0xfae], 0x20
jae 0x407645
imul ecx, dword [ebp - 0xfae], 0x10
mov eax, dword [ebp + ecx - 0xf8a]
sub eax, dword [ebp + ecx - 0xf8e]
test eax, eax
je 0x407645
mov ecx, dword [ebp + ecx - 0xf86]
xor edx, edx
div ecx
test edx, edx
je 0x407637
inc eax
add dword [ebp - 0xfaa], eax
inc dword [ebp - 0xfae]
jmp 0x407605
mov eax, dword [ebp - 0xfaa]
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
cmp dword [ebp - 0x245c], 0
jne 0x4077c9
cmp dword [esi + 0x14], 0x100000
jne 0x4076dd
push 0
push 0xc
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
push 0x85
push 0x10f11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x40770f
cmp eax, 0xffffffff
jne 0x40771e
mov dword [ebp - 0x245c], 1
jmp 0x4077c9
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x407737
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x50
je 0x4077c9
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4077ab
xor eax, eax
jmp 0x4077b5
cmp eax, 0x20
jbe 0x4077b5
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x4078bb
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x3ef11181
lea eax, [ebp - 0x2454]
push esp
push 4
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x40780b
cmp eax, 0xffffffff
jne 0x40781a
mov dword [ebp - 0x245c], 1
jmp 0x4078bb
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x407833
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x7e
je 0x4078bb
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40789d
xor eax, eax
jmp 0x4078a7
cmp eax, 0x20
jbe 0x4078a7
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x407aa4
mov dword [ebp - 0x2568], 0x20
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
push 0x27f11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x407909
cmp eax, 0xffffffff
jne 0x407918
mov dword [ebp - 0x245c], 1
jmp 0x407aa4
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x407931
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x7f
jne 0x407a28
cmp byte [ebp + ecx - 0x2452], 0x36
jne 0x407970
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x2568]
jne 0x4078da
jmp 0x4079b4
cmp byte [ebp + ecx - 0x2452], 0x37
jne 0x407993
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x2568]
jne 0x4078da
jmp 0x4079b4
cmp byte [ebp + ecx - 0x2452], 0x22
jne 0x4079b4
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x2568]
jne 0x4078da
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407a08
xor eax, eax
jmp 0x407a12
cmp eax, 0x20
jbe 0x407a12
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x407aa4
cmp byte [ebp + ecx - 0x2454], 0x67
je 0x407aa4
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407a86
xor eax, eax
jmp 0x407a90
cmp eax, 0x20
jbe 0x407a90
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x407d2d
mov ecx, dword [ebp - 0x16b]
cmp word [ebp + ecx - 0x2452], 0
je 0x407d2d
push 0xe9de
push 0xd0cac9c2
push 0xbfb4b299
push 0x92848281
push 0x736c483e
push 0x281400b0
mov byte [ebp - 0x1228], 0x20
mov byte [ebp - 0x1227], 0xf4
mov eax, dword [ebp - 0x122c]
movzx eax, byte [esp + eax]
mov dword [ebp - 0x1226], eax
mov al, byte [ebp + ecx - 0x2452]
mov byte [ebp - 0x1222], al
mov al, byte [ebp + ecx - 0x2451]
mov byte [ebp - 0x1221], al
push 0x7d
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xfa
lea edx, [ebp - 0x266e]
push edx
push 0xf6
lea edx, [ebp - 0x1228]
push edx
call dword [ebx + 0x3c]
cmp eax, 2
je 0x407b82
push 0xa0d24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
mov dword [ebp - 0x245c], 1
jmp 0x407d2a
push 2
push 0x27f11184
mov al, byte [ebp - 0x266e]
mov byte [esp + 5], al
mov al, byte [ebp - 0x266d]
mov byte [esp + 6], al
push esp
push 7
lea edx, [ebp - 0x2454]
push edx
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
add esp, 8
test eax, eax
je 0x407bc8
cmp eax, 0xffffffff
jne 0x407bd7
mov dword [ebp - 0x245c], 1
jmp 0x407d2a
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x407bf0
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x7f
jne 0x407cb0
cmp byte [ebp + ecx - 0x2452], 0x35
jne 0x407c3e
mov dword [ebp - 0x2568], 0x20
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc dword [ebp - 0x122c]
cmp dword [ebp - 0x122c], 0x16
jl 0x4078da
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407c90
xor eax, eax
jmp 0x407c9a
cmp eax, 0x20
jbe 0x407c9a
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x407d2a
cmp byte [ebp + ecx - 0x2454], 0x67
je 0x407d2a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407d0c
xor eax, eax
jmp 0x407d16
cmp eax, 0x20
jbe 0x407d16
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
add esp, 0x18
cmp dword [ebp - 0x245c], 0
jne 0x407e21
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0x83f11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x407d71
cmp eax, 0xffffffff
jne 0x407d80
mov dword [ebp - 0x245c], 1
jmp 0x407e21
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x407d99
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0xc3
je 0x407e21
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407e03
xor eax, eax
jmp 0x407e0d
cmp eax, 0x20
jbe 0x407e0d
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x407f2b
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 3
push 0x83f11187
mov ecx, dword [ebp - 0x16b]
mov eax, dword [ebp + ecx - 0x2452]
mov dword [esp + 5], eax
push esp
push 0xa
lea edx, [ebp - 0x2454]
push edx
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
add esp, 0xc
test eax, eax
je 0x407e7b
cmp eax, 0xffffffff
jne 0x407e8a
mov dword [ebp - 0x245c], 1
jmp 0x407f2b
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x407ea3
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0xc3
je 0x407f2b
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407f0d
xor eax, eax
jmp 0x407f17
cmp eax, 0x20
jbe 0x407f17
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x408350
push 0x6e
push 0xa
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
push 0x1e
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0xfae], 0
cmp dword [ebp - 0xfae], 0x20
jae 0x408350
imul ecx, dword [ebp - 0xfae], 0x10
mov eax, dword [ebp + ecx - 0xf8e]
mov dword [ebp - 0xfa6], eax
mov eax, dword [ebp + ecx - 0xf8a]
mov dword [ebp - 0xfa2], eax
mov eax, dword [ebp + ecx - 0xf86]
mov dword [ebp - 0xf9e], eax
mov eax, dword [ebp + ecx - 0xf82]
mov dword [ebp - 0xf9a], eax
mov eax, dword [ebp - 0xfa2]
sub eax, dword [ebp - 0xfa6]
test eax, eax
je 0x408350
push 0xe
push 0
push 0x34f11188
mov eax, dword [ebp - 0xfa6]
add eax, dword [ebp - 0xf9a]
mov byte [esp + 5], ah
mov byte [esp + 6], al
shr eax, 0x10
mov byte [esp + 4], al
mov eax, dword [ebp - 0xfa2]
sub eax, dword [ebp - 0xfa6]
mov byte [esp + 9], ah
mov byte [esp + 0xa], al
shr eax, 0x10
mov byte [esp + 8], al
push esp
push 0xb
lea edx, [ebp - 0x2454]
push edx
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
add esp, 0xc
test eax, eax
je 0x408026
cmp eax, 0xffffffff
jne 0x408035
mov dword [ebp - 0x245c], 1
jmp 0x4080d6
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x40804e
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x74
je 0x4080d6
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4080b8
xor eax, eax
jmp 0x4080c2
cmp eax, 0x20
jbe 0x4080c2
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x408350
push 0x3c
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp - 0xfa6]
mov ecx, dword [ebp - 0xfa2]
cmp eax, ecx
jae 0x408260
sub ecx, eax
cmp ecx, dword [ebp - 0xf9e]
jbe 0x40810f
mov ecx, dword [ebp - 0xf9e]
mov dword [ebp - 0xf92], ecx
add eax, dword [ebp - 0xf9a]
inc ecx
shl ecx, 0x18
or ecx, 0xf11180
mov dword [ebp - 0xd8e], ecx
mov dword [ebp - 0xd8a], 0x36
xor ecx, ecx
mov edx, dword [esi + 0x20]
add edx, dword [ebp - 0xfa6]
cmp ecx, dword [ebp - 0xf92]
jae 0x408155
mov al, byte [edx + ecx]
mov byte [ebp + ecx - 0xd89], al
inc ecx
jmp 0x408140
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, dword [ebp - 0xf92]
lea edx, [ebp - 0xd8e]
push edx
lea edx, [ecx + 5]
push edx
lea edx, [ebp - 0x2454]
push edx
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x408193
cmp eax, 0xffffffff
jne 0x4081a2
mov dword [ebp - 0x245c], 1
jmp 0x40825b
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x4081bb
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x76
je 0x408245
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408225
xor eax, eax
jmp 0x40822f
cmp eax, 0x20
jbe 0x40822f
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x40825b
call fcn.004092bc
mov eax, dword [ebp - 0xf92]
add dword [ebp - 0xfa6], eax
jmp 0x4080eb
jmp 0x408350
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x37f11181
lea eax, [ebp - 0x2454]
push esp
push 4
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x408295
cmp eax, 0xffffffff
jne 0x4082a4
mov dword [ebp - 0x245c], 1
jmp 0x408345
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x4082bd
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x77
je 0x408345
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408327
xor eax, eax
jmp 0x408331
cmp eax, 0x20
jbe 0x408331
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
inc dword [ebp - 0xfae]
jmp 0x407f60
cmp dword [ebp - 0x245c], 0
jne 0x408444
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 2
push 0x31f11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x408394
cmp eax, 0xffffffff
jne 0x4083a3
mov dword [ebp - 0x245c], 1
jmp 0x408444
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x4083bc
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x71
je 0x408444
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408426
xor eax, eax
jmp 0x408430
cmp eax, 0x20
jbe 0x408430
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x408538
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 3
push 0x31f11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x408488
cmp eax, 0xffffffff
jne 0x408497
mov dword [ebp - 0x245c], 1
jmp 0x408538
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x4084b0
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x71
je 0x408538
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40851a
xor eax, eax
jmp 0x408524
cmp eax, 0x20
jbe 0x408524
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x40862c
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
push 0x11f11182
lea eax, [ebp - 0x2454]
push esp
push 5
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x40857c
cmp eax, 0xffffffff
jne 0x40858b
mov dword [ebp - 0x245c], 1
jmp 0x40862c
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x4085a4
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x51
je 0x40862c
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40860e
xor eax, eax
jmp 0x408618
cmp eax, 0x20
jbe 0x408618
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
cmp dword [ebp - 0x245c], 0
jne 0x40865c
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x408967
cmp dword [ebp - 0x245c], 0
jne 0x40887d
push 0xff00
push 0x18f11184
lea eax, [ebp - 0x2454]
push esp
push 7
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x4086aa
cmp eax, 0xffffffff
jne 0x4086b9
mov dword [ebp - 0x245c], 1
jmp 0x40887d
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x4086d2
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x58
je 0x40875f
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40873c
xor eax, eax
jmp 0x408746
cmp eax, 0x20
jbe 0x408746
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x40887d
movzx eax, byte [ebp + ecx - 0x2453]
mov dword [ebp - 0x57f], eax
push 0xa
push 0xd642520
push 0x3a24544e
push 0x554f435f
push 0x43544424
push dword [ebp - 0x57f]
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
mov dword [ebp - 0x57b], 0
mov ecx, dword [ebp - 0x57b]
cmp ecx, dword [ebp - 0x57f]
jae 0x40887d
imul ecx, ecx, 3
add ecx, dword [ebp - 0x16b]
movzx eax, byte [ebp + ecx - 0x2451]
mov dword [ebp - 0xa], eax
movzx eax, byte [ebp + ecx - 0x2450]
mov dword [ebp - 6], eax
movzx eax, byte [ebp + ecx - 0x2452]
mov dword [ebp - 0xe], eax
cmp eax, 0xc0
jb 0x408836
and eax, 0x3f
push 0xa
push 0xd295832
push 0x2e252858
push 0x322e2558
push 0x322e2555
push dword [ebp - 6]
push dword [ebp - 0xa]
push eax
lea eax, [esp + 0xc]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
jmp 0x408872
push 0xa
push 0xd295832
push 0x2e252858
push 0x322e2558
push 0x322e2550
push dword [ebp - 6]
push dword [ebp - 0xa]
push eax
lea eax, [esp + 0xc]
push eax
lea edx, [ebp - 0x295c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x295c]
push edx
call dword [ebx + 0x30]
inc dword [ebp - 0x57b]
jmp 0x4087b2
cmp dword [ebp - 0x245c], 0
jne 0x408967
push 0x82f11181
lea eax, [ebp - 0x2454]
push esp
push 4
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x4088b7
cmp eax, 0xffffffff
jne 0x4088c6
mov dword [ebp - 0x245c], 1
jmp 0x408967
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x4088df
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0xc2
je 0x408967
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408949
xor eax, eax
jmp 0x408953
cmp eax, 0x20
jbe 0x408953
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x18
jne 0x408b98
cmp dword [ebp - 0x245c], 0
jne 0x408aae
push 0
push 0xa0d2443
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0xff
push 0x14f11183
lea eax, [ebp - 0x2454]
push esp
push 6
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x4089d7
cmp eax, 0xffffffff
jne 0x4089e6
mov dword [ebp - 0x245c], 1
jmp 0x408aae
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x4089ff
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0x54
je 0x408a89
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408a69
xor eax, eax
jmp 0x408a73
cmp eax, 0x20
jbe 0x408a73
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
jmp 0x408aae
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
cmp dword [ebp - 0x245c], 0
jne 0x408b98
push 0x82f11181
lea eax, [ebp - 0x2454]
push esp
push 4
push eax
push 0x9c4
push 0x4e2
push 0
push 4
push 0
call fcn.0040930b
test eax, eax
je 0x408ae8
cmp eax, 0xffffffff
jne 0x408af7
mov dword [ebp - 0x245c], 1
jmp 0x408b98
mov dword [ebp - 0x16b], 3
cmp byte [ebp - 0x2454], 0x80
jne 0x408b10
inc dword [ebp - 0x16b]
mov ecx, dword [ebp - 0x16b]
sub eax, ecx
mov dword [ebp - 0x167], eax
cmp byte [ebp + ecx - 0x2454], 0xc2
je 0x408b98
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x2454]
mov edx, esp
cmp eax, 0xffffffff
jne 0x408b7a
xor eax, eax
jmp 0x408b84
cmp eax, 0x20
jbe 0x408b84
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004094fe
mov dword [ebp - 0x245c], 1
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0
mov eax, esp
push 0
push eax
push 2
call dword [edi]
add esp, 4
push 0
push 0
push 3
call dword [edi]
cmp dword [esi + 0x270], 0x75736924
jne 0x408c62
cmp dword [esi + 0x274], 0x3037757a
jne 0x408c62
cmp dword [esi + 0x278], 0x5424315f
jne 0x408c62
cmp dword [esi + 0x27c], 0x736e6172
jne 0x408c62
cmp dword [esi + 0x280], 0x6e6f7274
jne 0x408c62
cmp dword [esi + 0x284], 0x3230315b
jne 0x408c62
cmp dword [esi + 0x288], 0x35312f34
jne 0x408c62
cmp dword [esi + 0x28c], 0x322f3633
jne 0x408c62
cmp dword [esi + 0x290], 0x2f383430
jne 0x408c62
cmp dword [esi + 0x294], 0x30363532
jne 0x408c62
cmp dword [esi + 0x298], 0x43205d6b
jne 0x408c62
cmp word [esi + 0x29c], 0x4e41
jne 0x408c62
cmp byte [esi + 0x29e], 0
je 0x408d0e
cmp dword [esi + 0x270], 0x75736924
jne 0x408d9f
cmp dword [esi + 0x274], 0x3037757a
jne 0x408d9f
cmp dword [esi + 0x278], 0x5424325f
jne 0x408d9f
cmp dword [esi + 0x27c], 0x736e6172
jne 0x408d9f
cmp dword [esi + 0x280], 0x6e6f7274
jne 0x408d9f
cmp dword [esi + 0x284], 0x3231355b
jne 0x408d9f
cmp dword [esi + 0x288], 0x3230312f
jne 0x408d9f
cmp dword [esi + 0x28c], 0x205d6b34
jne 0x408d9f
cmp dword [esi + 0x290], 0x696c2d4b
jne 0x408d9f
cmp word [esi + 0x294], 0x656e
jne 0x408d9f
cmp byte [esi + 0x296], 0
jne 0x408d9f
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xd
jne 0x408d9f
push dword [esi + 0x14]
push dword [esi + 0x20]
call fcn.004091a5
test eax, eax
jne 0x408d4e
push 0xa0d
push 0x2444494c
push 0x41565f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x14
jmp 0x408d9f
cmp eax, 1
jne 0x408d7a
push 0xa0d
push 0x24444554
push 0x43455252
push 0x4f435f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x408d9f
push 0xa0d
push 0x24444e55
push 0x4f465f54
push 0x4f4e5f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0
push 0
push 3
call dword [edi]
push 0
push esp
push 0x1000001
push 0x40b
push dword [ebx + 0x4c4]
call dword [sym.imp.USER32.DLL_SendMessageW]
add esp, 4
push 0
call dword [ebx + 0x40]
pop edi
leave
ret 8