Function at 0x40207e
Capabilities:
Check for time delay via gettickcount
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e74
push edi
lea edi, [ebp - 0x2e74]
push 1
call dword [ebx + 0x40]
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0xe
je 0x4020a7
call dword [ebx + 0x38]
cmp eax, 1
jne 0x4081d8
mov dword [edi], 0
mov ecx, dword [ebx + 0x148]
add ecx, dword [ebx + 0x6c]
lea eax, [ecx + 0x108]
mov ecx, dword [ecx]
cmp ecx, 3
jne 0x402224
push eax
push edi
call fcn.0040993e
cmp eax, 1
jne 0x4020db
mov dword [edi], 0x409d3f
jmp 0x40210c
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x5a494c41
push 0x4954494e
push 0x495f4f54
push 0x5f44454c
push 0x49414624
push esp
call dword [ebx + 0x30]
add esp, 0x24
cmp dword [edi], 0
je 0x402222
push 0xa
push 0xd732520
push 0x5d24454d
push 0x414e5f52
push 0x45545041
push 0x4441245b
mov ecx, dword [ebx + 0x148]
add ecx, dword [ebx + 0x6c]
lea edx, [ecx + 4]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
add esp, 0x18
lea edx, [edi + 0x38]
push edx
push 0
call dword [edi + 4]
cmp eax, 0
jne 0x402222
lea edx, [ebp - 0x2c14]
push edx
lea edx, [ebp - 0x2c64]
push edx
lea edx, [ebp - 0x2cb4]
push edx
push dword [edi + 0x38]
call dword [edi + 0x30]
cmp eax, 0
jne 0x402222
push 0xa
push 0xd732520
push 0x5d244552
push 0x41574d52
push 0x49465f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x2cb4]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
add esp, 0x1c
push 0
push 0xa0d7325
push 0x205d244c
push 0x4c445f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x2c64]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x402264
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x48545f59
push 0x425f4445
push 0x54524f50
push 0x5055535f
push 0x544f4e5f
push 0x53495f4c
push 0x4f434f54
push 0x4f525024
push esp
call dword [ebx + 0x30]
add esp, 0x30
cmp dword [edi], 0
je 0x4081d8
mov dword [ebp - 0x29c8], 0
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
lea edx, [ecx + 2]
push edx
push eax
lea edx, [ebp - 0x2bc4]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov dword [ebp - 0x28b8], 0
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov byte [esi + 0x6c], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x4022ca
cmp eax, 0xb
jne 0x4023e4
mov byte [ebp - 0x2d4], 0x29
mov byte [ebp - 0x2d3], 2
push 0xfa
lea edx, [ebp - 0x2aca]
push edx
push 2
lea edx, [ebp - 0x2d4]
push edx
call dword [ebx + 0x3c]
cmp eax, 8
je 0x402347
push 0xa0d31
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x45242024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x30
mov dword [ebp - 0x28b8], 1
jmp 0x4023e4
push 0x6d6f
push 0x632e7572
push 0x2e636d6d
mov dword [ebp - 0x2c8], esp
push 0
push 0x7068702e
push 0x74736574
push 0x5f6e6163
push 0x5f373163
push 0x64655f6f
push 0x7375665f
push 0x69687369
push 0x62757374
push 0x696d2f74
push 0x7365742f
lea edx, [ebp - 0x2d0]
push edx
lea edx, [ebp - 0x2aca]
push edx
lea edx, [esp + 8]
push edx
push dword [ebp - 0x2c8]
call fcn.0040a857
mov dword [ebp - 0x28b8], eax
add esp, 0x2c
add esp, 0xc
test eax, eax
jne 0x4023e4
mov byte [ebp - 0x2d2], 0x2a
mov byte [ebp - 0x2d1], 0xa
push 0xfa
lea edx, [ebp - 0x2aca]
push edx
push 0xa
lea edx, [ebp - 0x2d2]
push edx
call dword [ebx + 0x3c]
mov dword [ebp - 0x28b8], 0
cmp dword [esi + 0x270], 0x74696d24
jne 0x402452
cmp dword [esi + 0x274], 0x30387573
jne 0x402452
cmp dword [esi + 0x278], 0x4524315f
jne 0x402452
cmp dword [esi + 0x27c], 0x37314344
jne 0x402452
cmp dword [esi + 0x280], 0x32355043
jne 0x402452
cmp dword [esi + 0x284], 0x3930345b
jne 0x402452
cmp dword [esi + 0x288], 0x205d6b36
jne 0x402452
cmp dword [esi + 0x28c], 0x4e4143
je 0x4024f0
cmp dword [esi + 0x270], 0x74696d24
jne 0x405cd8
cmp dword [esi + 0x274], 0x30387573
jne 0x405cd8
cmp dword [esi + 0x278], 0x2824315f
jne 0x405cd8
cmp dword [esi + 0x27c], 0x54534554
jne 0x405cd8
cmp dword [esi + 0x280], 0x43444529
jne 0x405cd8
cmp dword [esi + 0x284], 0x50433731
jne 0x405cd8
cmp dword [esi + 0x288], 0x345b3235
jne 0x405cd8
cmp dword [esi + 0x28c], 0x6b363930
jne 0x405cd8
cmp dword [esi + 0x290], 0x4143205d
jne 0x405cd8
cmp word [esi + 0x294], 0x4e
jne 0x405cd8
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402513
cmp eax, 0xa
je 0x402513
cmp eax, 0xb
je 0x402513
cmp eax, 0x17
je 0x402513
cmp eax, 0x18
jne 0x405062
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x402527
cmp eax, 0xb
jne 0x4027b4
cmp dword [esi + 0x270], 0x74696d24
jne 0x40258b
cmp dword [esi + 0x274], 0x30387573
jne 0x40258b
cmp dword [esi + 0x278], 0x4524315f
jne 0x40258b
cmp dword [esi + 0x27c], 0x37314344
jne 0x40258b
cmp dword [esi + 0x280], 0x32355043
jne 0x40258b
cmp dword [esi + 0x284], 0x3930345b
jne 0x40258b
cmp dword [esi + 0x288], 0x205d6b36
jne 0x40258b
cmp dword [esi + 0x28c], 0x4e4143
je 0x402629
cmp dword [esi + 0x270], 0x74696d24
jne 0x4027b4
cmp dword [esi + 0x274], 0x30387573
jne 0x4027b4
cmp dword [esi + 0x278], 0x2824315f
jne 0x4027b4
cmp dword [esi + 0x27c], 0x54534554
jne 0x4027b4
cmp dword [esi + 0x280], 0x43444529
jne 0x4027b4
cmp dword [esi + 0x284], 0x50433731
jne 0x4027b4
cmp dword [esi + 0x288], 0x345b3235
jne 0x4027b4
cmp dword [esi + 0x28c], 0x6b363930
jne 0x4027b4
cmp dword [esi + 0x290], 0x4143205d
jne 0x4027b4
cmp word [esi + 0x294], 0x4e
jne 0x4027b4
mov dword [ebp - 0x880], 0xfa00da18
mov dword [ebp - 0x87c], 0xfada18
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x402666
mov dword [ebp - 0x878], section..code
mov dword [ebp - 0x874], 0
mov dword [ebp - 0x870], 0x50
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x40268f
mov dword [ebp - 0x878], 0x401050
mov dword [ebp - 0x874], 0x50
mov dword [ebp - 0x870], 0x50
push 0x200
push 0
lea edx, [ebp - 0x76e]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov byte [ebp - 0x864], 0x21
mov dword [ebp - 0x86c], 0
mov ecx, dword [ebp - 0x86c]
cmp ecx, dword [ebp - 0x870]
jae 0x4027b4
mov eax, dword [ebp - 0x874]
lea eax, [eax + ecx]
mov dword [ebp - 0x862], eax
mov edx, dword [ebp - 0x870]
sub edx, ecx
xor ecx, ecx
cmp ecx, edx
jae 0x402707
cmp ecx, 0xf0
jae 0x402707
mov eax, dword [ebp - 0x878]
add eax, dword [ebp - 0x86c]
mov al, byte [eax + ecx]
mov byte [ebp + ecx - 0x85e], al
inc ecx
jmp 0x4026e2
mov dword [ebp - 0x868], ecx
add ecx, 4
mov byte [ebp - 0x863], cl
push 0xfa
lea edx, [ebp - 0x2aca]
push edx
push 0xf6
lea edx, [ebp - 0x864]
push edx
call dword [ebx + 0x3c]
test eax, eax
jne 0x402784
push 0xa0d32
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x45242024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x30
mov dword [ebp - 0x28b8], 1
jmp 0x4027b4
mov eax, dword [ebp - 0x868]
mov ecx, dword [ebp - 0x86c]
add dword [ebp - 0x86c], eax
push eax
lea edx, [ebp - 0x2aca]
push edx
lea edx, [ebp + ecx - 0x76e]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
jmp 0x4026b7
push 0x7a120
push 0x800
push 6
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4027e2
mov dword [ebp - 0x28b8], 1
jmp 0x405062
push 1
push 0x8000
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x40280f
mov dword [ebp - 0x28b8], 1
jmp 0x40504c
mov dword [ebp - 0x28b4], 0
mov dword [ebp - 0x28b0], 0
mov dword [ebp - 0x28ac], 3
mov dword [ebp - 0x28a8], 6
mov dword [ebp - 0x28a4], 0
mov dword [ebp - 0x28a0], 0x40
mov dword [ebp - 0x289c], 0
mov dword [ebp - 0x2898], 4
mov dword [ebp - 0x2894], 0
mov dword [ebp - 0x2890], 0xffffffff
mov dword [ebp - 0x288c], 6
mov dword [ebp - 0x2888], 0
mov dword [ebp - 0x2884], 0x40
mov dword [ebp - 0x2880], 0
mov dword [ebp - 0x287c], 4
mov dword [ebp - 0x2878], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x2874], eax
mov dword [ebp - 0x2870], 6
mov dword [ebp - 0x286c], 0
mov dword [ebp - 0x2868], 0x40
mov dword [ebp - 0x2864], 0
mov dword [ebp - 0x2860], 4
mov dword [ebp - 0x285c], 0
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x2858], eax
test dword [ebp - 0x880], 0xf8ffff
je 0x40292d
or dword [ebp - 0x28a0], 0x100
or dword [ebp - 0x2884], 0x100
or dword [ebp - 0x2868], 0x100
push 0
lea edx, [ebp - 0x28b4]
push edx
push 4
call dword [edi]
cmp eax, 0xffffffff
jne 0x40294e
mov dword [ebp - 0x28b8], 1
jmp 0x40504c
mov byte [ebp - 0x536], 0
mov byte [ebp - 0x4f6], 0
mov byte [ebp - 0x4b6], 0
mov byte [ebp - 0x476], 0
mov byte [ebp - 0x436], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x40298a
cmp eax, 0xa
je 0x40298a
cmp eax, 0xb
jne 0x402bb1
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x1894], eax
mov dword [ebp - 0x1890], 0x310
test dword [ebp - 0x880], 0xf8ffff
jne 0x4029d3
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x4029fb
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x402a04
cmp eax, 0xffffffff
jne 0x402a10
mov dword [ebp - 0x28b8], 1
jmp 0x402a89
cmp byte [ebp - 0x28b0], 0x50
je 0x402a89
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x402a6b
xor eax, eax
jmp 0x402a75
cmp eax, 0x20
jbe 0x402a75
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x402bb1
push 0xb
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x1890], 0x28f122
test dword [ebp - 0x880], 0xf8ffff
jne 0x402adb
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x402b03
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
je 0x402b0a
cmp eax, 0xffffffff
jne 0x402b19
mov dword [ebp - 0x28b8], 1
jmp 0x402bb1
cmp byte [ebp - 0x28b0], 0x62
jne 0x402bb1
sub eax, 7
xor ecx, ecx
cmp ecx, 0x3f
jae 0x402b54
cmp ecx, eax
jae 0x402b54
mov dl, byte [ebp + ecx - 0x28ad]
cmp dl, 0
je 0x402b54
cmp dl, 0xff
je 0x402b54
cmp dl, 0x2d
je 0x402b54
mov byte [ebp + ecx - 0x536], dl
inc ecx
jmp 0x402b2b
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402b64
cmp eax, 0xa
jne 0x402bb1
mov byte [ebp + ecx - 0x536], 0
cmp byte [ebp - 0x536], 0
je 0x402bb1
lea eax, [ebp - 0x536]
push 0xa
push 0xd732520
push 0x3a245753
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x402bc5
cmp eax, 0xa
jne 0x403264
cmp dword [ebp - 0x28b8], 0
jne 0x402ce0
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x1890], 0x92f122
test dword [ebp - 0x880], 0xf8ffff
jne 0x402c17
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x402c3f
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
je 0x402c46
cmp eax, 0xffffffff
jne 0x402c55
mov dword [ebp - 0x28b8], 1
jmp 0x402ce0
cmp byte [ebp - 0x28b0], 0x62
jne 0x402ce0
sub eax, 7
xor ecx, ecx
cmp ecx, 0x3f
jae 0x402c90
cmp ecx, eax
jae 0x402c90
mov dl, byte [ebp + ecx - 0x28ad]
cmp dl, 0
je 0x402c90
cmp dl, 0xff
je 0x402c90
cmp dl, 0x2d
je 0x402c90
mov byte [ebp + ecx - 0x4f6], dl
inc ecx
jmp 0x402c67
mov byte [ebp + ecx - 0x4f6], 0
cmp byte [ebp - 0x4f6], 0
je 0x402ce0
lea eax, [ebp - 0x4f6]
push 0xa0d
push 0x7325203a
push 0x24544143
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x28b8], 0
jne 0x402e1b
push 0xb
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x1890], 0x18f122
test dword [ebp - 0x880], 0xf8ffff
jne 0x402d32
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x402d5a
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
je 0x402d61
cmp eax, 0xffffffff
jne 0x402d70
mov dword [ebp - 0x28b8], 1
jmp 0x402e1b
cmp byte [ebp - 0x28b0], 0x62
jne 0x402e1b
sub eax, 7
xor ecx, ecx
cmp ecx, 0x3f
jae 0x402db0
cmp ecx, eax
jae 0x402db0
mov dl, byte [ebp + ecx - 0x28ad]
cmp dl, 0
je 0x402db0
cmp dl, 0xff
je 0x402db0
cmp dl, 0x2d
je 0x402db0
cmp dl, 0x20
je 0x402db0
mov byte [ebp + ecx - 0x4b6], dl
inc ecx
jmp 0x402d82
mov byte [ebp + ecx - 0x4b6], 0
cmp byte [ebp - 0x4b6], 0
je 0x402e1b
lea eax, [ebp - 0x4b6]
push 0xa0d
push 0x7325203a
push 0x24545241
push 0x505f454e
push 0x49474e45
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
lea edx, [ebp - 0x4b6]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
cmp dword [ebp - 0x28b8], 0
jne 0x402f5d
push 0x10
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x1890], 0x690122
test dword [ebp - 0x880], 0xf8ffff
jne 0x402e6d
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x402e95
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
je 0x402e9c
cmp eax, 0xffffffff
jne 0x402eab
mov dword [ebp - 0x28b8], 1
jmp 0x402f5d
cmp byte [ebp - 0x28b0], 0x62
jne 0x402f5d
sub eax, 7
xor ecx, ecx
cmp ecx, 0x3f
jae 0x402ee1
cmp ecx, eax
jae 0x402ee1
mov dl, byte [ebp + ecx - 0x28ad]
cmp dl, 0
je 0x402ee1
cmp dl, 0xff
je 0x402ee1
mov byte [ebp + ecx - 0x476], dl
inc ecx
jmp 0x402ebd
mov byte [ebp + ecx - 0x476], 0
cmp byte [ebp - 0x476], 0
je 0x402f5d
lea eax, [ebp - 0x476]
push 0xa0d73
push 0x25203a24
push 0x454c4946
push 0x5f4c4143
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x24
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
cmp byte [esi + 0x6c], 0
je 0x402f4c
push 0x5f
push esp
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 4
lea edx, [ebp - 0x476]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
cmp dword [ebp - 0x28b8], 0
jne 0x40303b
push 0x17
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x1890], 0x6f822
test dword [ebp - 0x880], 0xf8ffff
jne 0x402faf
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x402fd7
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
je 0x402fde
cmp eax, 0xffffffff
jne 0x402fea
mov dword [ebp - 0x28b8], 1
jmp 0x40303b
cmp byte [ebp - 0x28b0], 0x62
jne 0x40303b
cmp eax, 0xb
jne 0x40303b
mov eax, dword [ebp - 0x28ad]
bswap eax
push 0
push 0xa0d5838
push 0x2e25203a
push 0x244e5643
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x24
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
cmp dword [ebp - 0x28b8], 0
jne 0x4030c2
push 4
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x1890], 0x8a1a
test dword [ebp - 0x880], 0xf8ffff
jne 0x403089
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x4030b1
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
je 0x4030b8
cmp eax, 0xffffffff
jne 0x4030c2
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x403149
push 0x11
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x1890], 0x502022
test dword [ebp - 0x880], 0xf8ffff
jne 0x403110
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x403138
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
je 0x40313f
cmp eax, 0xffffffff
jne 0x403149
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x403264
push 8
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x1890], 0x90f122
test dword [ebp - 0x880], 0xf8ffff
jne 0x40319b
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x4031c3
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
je 0x4031ca
cmp eax, 0xffffffff
jne 0x4031d9
mov dword [ebp - 0x28b8], 1
jmp 0x403264
cmp byte [ebp - 0x28b0], 0x62
jne 0x403264
sub eax, 7
xor ecx, ecx
cmp ecx, 0x3f
jae 0x403214
cmp ecx, eax
jae 0x403214
mov dl, byte [ebp + ecx - 0x28ad]
cmp dl, 0
je 0x403214
cmp dl, 0xff
je 0x403214
cmp dl, 0x2d
je 0x403214
mov byte [ebp + ecx - 0x436], dl
inc ecx
jmp 0x4031eb
mov byte [ebp + ecx - 0x436], 0
cmp byte [ebp - 0x436], 0
je 0x403264
lea eax, [ebp - 0x436]
push 0xa0d
push 0x7325203a
push 0x244e4956
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x403afb
cmp dword [ebp - 0x28b8], 0
jne 0x40347b
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x1894], eax
mov dword [ebp - 0x1890], 0x127
push 0x6f
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x29c0], 0x20
test dword [ebp - 0x880], 0xf8ffff
jne 0x4032db
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x403303
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x40330c
cmp eax, 0xffffffff
jne 0x40331b
mov dword [ebp - 0x28b8], 1
jmp 0x40347b
cmp byte [ebp - 0x28b0], 0x7f
jne 0x403400
cmp byte [ebp - 0x28ae], 0x36
jne 0x40334a
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x29c0]
jne 0x4032a8
jmp 0x40338c
cmp byte [ebp - 0x28ae], 0x37
jne 0x40336c
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x29c0]
jne 0x4032a8
jmp 0x40338c
cmp byte [ebp - 0x28ae], 0x22
jne 0x40338c
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x29c0]
jne 0x4032a8
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4033e0
xor eax, eax
jmp 0x4033ea
cmp eax, 0x20
jbe 0x4033ea
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x40347b
cmp byte [ebp - 0x28b0], 0x67
je 0x40347b
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40345d
xor eax, eax
jmp 0x403467
cmp eax, 0x20
jbe 0x403467
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x40367d
cmp dword [ebp - 0x28ae], 0
jne 0x40349e
cmp dword [ebp - 0x28aa], 0
je 0x40367d
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x250]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 6
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x4034b0
mov byte [ebp - 0x3f6], 0x20
mov byte [ebp - 0x3f5], 0xf4
mov dword [ebp - 0x3f4], 1
mov eax, dword [ebp - 0x28ae]
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x28aa]
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x378], 0
push 0xfa
lea edx, [ebp - 0x2aca]
push edx
push 0xf6
lea edx, [ebp - 0x3f6]
push edx
call dword [ebx + 0x3c]
cmp eax, 4
je 0x40357e
push 0
push 0xa0d3320
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x28b8], 1
jmp 0x40367d
mov dword [ebp - 0x1890], 0x227
mov eax, dword [ebp - 0x2aca]
mov dword [ebp - 0x188e], eax
test dword [ebp - 0x880], 0xf8ffff
jne 0x4035c7
lea edx, [ebp - 0x1894]
push edx
push 0xa
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x4035ef
lea edx, [ebp - 0x1894]
push edx
push 0xa
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x4035f8
cmp eax, 0xffffffff
jne 0x403604
mov dword [ebp - 0x28b8], 1
jmp 0x40367d
cmp byte [ebp - 0x28b0], 0x67
je 0x40367d
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40365f
xor eax, eax
jmp 0x403669
cmp eax, 0x20
jbe 0x403669
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x40398e
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [esi + 0x14]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x24], eax
push dword [esi + 0x28]
push 0xff
push eax
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov dword [ebp - 0x56e], 0
mov dword [ebp - 0x56a], 0
cmp dword [ebp - 0x56e], 0x20
jae 0x40371a
imul ecx, dword [ebp - 0x56e], 0x10
mov eax, dword [ebp + ecx - 0x76a]
sub eax, dword [ebp + ecx - 0x76e]
test eax, eax
je 0x40371a
add dword [ebp - 0x56a], eax
inc dword [ebp - 0x56e]
jmp 0x4036ea
mov eax, dword [ebp - 0x56a]
add eax, 0x7ff
and eax, 0xfffff800
shr eax, 0xb
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0x56e], 0
mov dword [ebp - 0x566], 0
cmp dword [ebp - 0x56e], 0x20
jae 0x40398e
imul ecx, dword [ebp - 0x56e], 0x10
mov eax, dword [ebp + ecx - 0x76a]
sub eax, dword [ebp + ecx - 0x76e]
test eax, eax
je 0x40398e
mov eax, dword [ebp + ecx - 0x76e]
mov dword [ebp - 0x562], eax
mov eax, dword [ebp + ecx - 0x76a]
mov dword [ebp - 0x55e], eax
mov eax, dword [ebp + ecx - 0x766]
mov dword [ebp - 0x55a], eax
mov eax, dword [ebp + ecx - 0x762]
mov dword [ebp - 0x556], eax
mov eax, dword [ebp - 0x562]
mov ecx, dword [ebp - 0x55e]
cmp eax, ecx
jae 0x403983
sub ecx, eax
cmp ecx, dword [ebp - 0x556]
jbe 0x403804
mov ecx, dword [ebp - 0x556]
mov dword [ebp - 0x552], ecx
add eax, dword [ebp - 0x55a]
mov dword [ebp - 0x1890], 0x2423
mov byte [ebp - 0x188c], ah
mov byte [ebp - 0x188b], al
shr eax, 0x10
mov byte [ebp - 0x188e], ah
mov byte [ebp - 0x188d], al
mov byte [ebp - 0x188a], ch
mov byte [ebp - 0x1889], cl
push 7
call dword [sym.imp.KERNEL32.DLL_Sleep]
test dword [ebp - 0x880], 0xf8ffff
jne 0x40387c
lea edx, [ebp - 0x1894]
push edx
push 0xc
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x4038a4
lea edx, [ebp - 0x1894]
push edx
push 0xc
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x4038ad
cmp eax, 0xffffffff
jne 0x4038bc
mov dword [ebp - 0x28b8], 1
jmp 0x403981
cmp byte [ebp - 0x28b0], 0x63
je 0x403937
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403917
xor eax, eax
jmp 0x403921
cmp eax, 0x20
jbe 0x403921
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x403981
mov eax, dword [ebp - 0x562]
and eax, 0xfffff800
cmp eax, dword [ebp - 0x566]
je 0x403955
mov dword [ebp - 0x566], eax
call fcn.0040831d
mov eax, dword [ebp - 0x552]
mov ecx, dword [esi + 0x24]
add ecx, dword [ebp - 0x562]
add dword [ebp - 0x562], eax
push eax
lea edx, [ebp - 0x28af]
push edx
push ecx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
jmp 0x4037e0
jmp 0x40398e
inc dword [ebp - 0x56e]
jmp 0x403782
cmp dword [ebp - 0x28b8], 0
jne 0x4039c0
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
jmp 0x4039c9
lea edx, [esi + 0x24]
push edx
call fcn.0040867e
cmp dword [ebp - 0x28b8], 0
jne 0x403afb
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0xd0]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 6
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x4039e8
mov dword [ebp - 0x1890], 0x110
test dword [ebp - 0x880], 0xf8ffff
jne 0x403a45
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x403a6d
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x403a76
cmp eax, 0xffffffff
jne 0x403a82
mov dword [ebp - 0x28b8], 1
jmp 0x403afb
cmp byte [ebp - 0x28b0], 0x50
je 0x403afb
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403add
xor eax, eax
jmp 0x403ae7
cmp eax, 0x20
jbe 0x403ae7
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x404bb2
cmp dword [ebp - 0x28b8], 0
jne 0x403c48
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x1894], eax
mov dword [ebp - 0x1890], 0x210
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x256]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 6
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x403b3f
test dword [ebp - 0x880], 0xf8ffff
jne 0x403b92
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x403bba
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x403bc3
cmp eax, 0xffffffff
jne 0x403bcf
mov dword [ebp - 0x28b8], 1
jmp 0x403c48
cmp byte [ebp - 0x28b0], 0x50
je 0x403c48
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403c34
xor eax, eax
jmp 0x403c3e
cmp eax, 0x20
jbe 0x403c3e
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
cmp dword [ebp - 0x28b8], 0
jne 0x403e6b
mov dword [ebp - 0x1890], 0x527
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x41]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 6
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x403c6e
mov dword [ebp - 0x29c0], 0x20
test dword [ebp - 0x880], 0xf8ffff
jne 0x403ccb
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x403cf3
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x403cfc
cmp eax, 0xffffffff
jne 0x403d0b
mov dword [ebp - 0x28b8], 1
jmp 0x403e6b
cmp byte [ebp - 0x28b0], 0x7f
jne 0x403df0
cmp byte [ebp - 0x28ae], 0x36
jne 0x403d3a
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x29c0]
jne 0x403c98
jmp 0x403d7c
cmp byte [ebp - 0x28ae], 0x37
jne 0x403d5c
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x29c0]
jne 0x403c98
jmp 0x403d7c
cmp byte [ebp - 0x28ae], 0x22
jne 0x403d7c
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x29c0]
jne 0x403c98
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403dd0
xor eax, eax
jmp 0x403dda
cmp eax, 0x20
jbe 0x403dda
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x403e6b
cmp byte [ebp - 0x28b0], 0x67
je 0x403e6b
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403e4d
xor eax, eax
jmp 0x403e57
cmp eax, 0x20
jbe 0x403e57
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x40406b
cmp dword [ebp - 0x28ae], 0
jne 0x403e8e
cmp dword [ebp - 0x28aa], 0
je 0x40406b
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x256]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 6
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x403ea0
mov byte [ebp - 0x3f6], 0x20
mov byte [ebp - 0x3f5], 0xf4
mov dword [ebp - 0x3f4], 2
mov eax, dword [ebp - 0x28ae]
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x28aa]
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x378], 0
push 0xfa
lea edx, [ebp - 0x2aca]
push edx
push 0xf6
lea edx, [ebp - 0x3f6]
push edx
call dword [ebx + 0x3c]
cmp eax, 4
je 0x403f6c
push 0xa0d34
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x45242024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x30
mov dword [ebp - 0x28b8], 1
jmp 0x40406b
mov dword [ebp - 0x1890], 0x627
mov eax, dword [ebp - 0x2aca]
mov dword [ebp - 0x188e], eax
test dword [ebp - 0x880], 0xf8ffff
jne 0x403fb5
lea edx, [ebp - 0x1894]
push edx
push 0xa
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x403fdd
lea edx, [ebp - 0x1894]
push edx
push 0xa
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x403fe6
cmp eax, 0xffffffff
jne 0x403ff2
mov dword [ebp - 0x28b8], 1
jmp 0x40406b
cmp byte [ebp - 0x28b0], 0x67
je 0x40406b
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40404d
xor eax, eax
jmp 0x404057
cmp eax, 0x20
jbe 0x404057
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x4049d7
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov dword [ebp - 0x56e], 0
mov dword [ebp - 0x56a], 0
cmp dword [ebp - 0x56e], 0x20
jae 0x4040e1
imul ecx, dword [ebp - 0x56e], 0x10
mov eax, dword [ebp + ecx - 0x76a]
sub eax, dword [ebp + ecx - 0x76e]
test eax, eax
je 0x4040e1
add dword [ebp - 0x56a], eax
inc dword [ebp - 0x56e]
jmp 0x4040b1
mov eax, dword [ebp - 0x56a]
add eax, 0xfff
and eax, 0xfffff000
shr eax, 0xc
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0x56e], 0
mov dword [ebp - 0x566], 0
cmp dword [ebp - 0x56e], 0x20
jae 0x4049d7
imul ecx, dword [ebp - 0x56e], 0x10
mov eax, dword [ebp + ecx - 0x76a]
sub eax, dword [ebp + ecx - 0x76e]
test eax, eax
je 0x4049d7
mov eax, dword [ebp + ecx - 0x76e]
mov dword [ebp - 0x562], eax
mov eax, dword [ebp + ecx - 0x76a]
mov dword [ebp - 0x55e], eax
mov eax, dword [ebp + ecx - 0x766]
mov dword [ebp - 0x55a], eax
test dword [ebp + ecx - 0x762], 1
je 0x404532
mov dword [ebp - 0x1890], 0x5af12e
mov dword [ebp - 0x188c], 0x400
mov dword [ebp - 0x1888], 0
mov dword [ebp - 0x1884], 0
lea edx, [ebp - 0x54e]
push edx
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx eax, word [ebp - 0x54e]
mov byte [ebp - 0x188a], al
movzx eax, word [ebp - 0x54c]
mov byte [ebp - 0x1889], al
movzx eax, word [ebp - 0x548]
mov byte [ebp - 0x1888], al
mov dword [ebp - 0x53e], 2
mov dword [ebp - 0x53a], 0
mov edx, dword [ebp - 0x562]
add edx, dword [esi + 0x20]
mov edx, dword [edx + 0x10]
sub edx, dword [ebp - 0x55a]
cmp edx, dword [ebp - 0x562]
jb 0x404306
cmp edx, dword [ebp - 0x55e]
jae 0x404306
add edx, dword [esi + 0x20]
mov edx, dword [edx + 0xc]
sub edx, dword [ebp - 0x55a]
cmp edx, dword [ebp - 0x562]
jb 0x404306
cmp edx, dword [ebp - 0x55e]
jae 0x404306
add edx, dword [esi + 0x20]
xor ecx, ecx
cmp ecx, 0xd
jae 0x404288
mov al, byte [edx + ecx]
cmp al, 0x2f
jbe 0x404288
cmp al, 0x3a
jae 0x404288
mov byte [ebp + ecx - 0x53a], al
inc ecx
jmp 0x40426e
mov byte [ebp + ecx - 0x53a], 0
mov dword [ebp - 0x53e], 0
cmp dword [ebp - 0x53e], 3
jae 0x404306
imul ecx, dword [ebp - 0x53e], 0xd
mov eax, dword [ebp + ecx - 0x536]
cmp eax, dword [ebp - 0x53a]
je 0x4042c1
inc dword [ebp - 0x53e]
jmp 0x40429a
mov eax, dword [ebp + ecx - 0x532]
cmp eax, dword [ebp - 0x536]
je 0x4042d8
inc dword [ebp - 0x53e]
jmp 0x40429a
mov eax, dword [ebp + ecx - 0x52e]
cmp eax, dword [ebp - 0x532]
je 0x4042ef
inc dword [ebp - 0x53e]
jmp 0x40429a
mov al, byte [ebp + ecx - 0x52a]
cmp al, byte [ebp - 0x52e]
je 0x404306
inc dword [ebp - 0x53e]
jmp 0x40429a
mov eax, dword [ebp - 0x53e]
mov byte [ebp - 0x188d], al
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x71]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 6
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x404321
test dword [ebp - 0x880], 0xf8ffff
jne 0x404374
lea edx, [ebp - 0x1894]
push edx
push 0x11
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x40439c
lea edx, [ebp - 0x1894]
push edx
push 0x11
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x4043a5
cmp eax, 0xffffffff
jne 0x4043b1
mov dword [ebp - 0x28b8], 1
jmp 0x40442a
cmp byte [ebp - 0x28b0], 0x6e
je 0x40442a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40440c
xor eax, eax
jmp 0x404416
cmp eax, 0x20
jbe 0x404416
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x404532
mov dword [ebp - 0x1890], 0xff0131
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
test dword [ebp - 0x880], 0xf8ffff
jne 0x40447c
lea edx, [ebp - 0x1894]
push edx
push 0x11
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x4044a4
lea edx, [ebp - 0x1894]
push edx
push 0x11
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x4044ad
cmp eax, 0xffffffff
jne 0x4044b9
mov dword [ebp - 0x28b8], 1
jmp 0x404532
cmp byte [ebp - 0x28b0], 0x71
je 0x404532
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404514
xor eax, eax
jmp 0x40451e
cmp eax, 0x20
jbe 0x40451e
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x4046d5
mov dword [ebp - 0x1890], 0x440034
mov eax, dword [ebp - 0x562]
mov ecx, dword [ebp - 0x55e]
sub ecx, eax
add eax, dword [ebp - 0x55a]
mov byte [ebp - 0x188b], ah
mov byte [ebp - 0x188a], al
shr eax, 0x10
mov byte [ebp - 0x188d], ah
mov byte [ebp - 0x188c], al
mov byte [ebp - 0x1887], ch
mov byte [ebp - 0x1886], cl
shr ecx, 0x10
mov byte [ebp - 0x1889], ch
mov byte [ebp - 0x1888], cl
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x3a]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 6
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x4045a2
test dword [ebp - 0x880], 0xf8ffff
jne 0x4045f5
lea edx, [ebp - 0x1894]
push edx
push 0xf
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x40461d
lea edx, [ebp - 0x1894]
push edx
push 0xf
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x404626
cmp eax, 0xffffffff
jne 0x404635
mov dword [ebp - 0x28b8], 1
jmp 0x4046d5
cmp byte [ebp - 0x28b0], 0x74
je 0x4046b0
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404690
xor eax, eax
jmp 0x40469a
cmp eax, 0x20
jbe 0x40469a
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x4046d5
mov ecx, 6
xor edx, edx
cmp ecx, 0xa
jae 0x4046cd
cmp ecx, eax
jae 0x4046cd
shl edx, 8
mov dl, byte [ebp + ecx - 0x28b4]
inc ecx
jmp 0x4046b7
dec edx
dec edx
mov dword [ebp - 0x300], edx
cmp dword [ebp - 0x28b8], 0
jne 0x4049d7
mov dword [ebp - 0x2fc], 1
mov eax, dword [ebp - 0x562]
mov ecx, dword [ebp - 0x55e]
cmp eax, ecx
jae 0x4048a5
sub ecx, eax
cmp ecx, dword [ebp - 0x300]
jbe 0x404710
mov ecx, dword [ebp - 0x300]
mov dword [ebp - 0x552], ecx
mov dword [ebp - 0x1890], 0x36
add eax, dword [esi + 0x20]
push ecx
push eax
lea edx, [ebp - 0x188e]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov eax, dword [ebp - 0x2fc]
mov byte [ebp - 0x188f], al
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0xe1]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 6
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x404753
mov ecx, dword [ebp - 0x552]
test dword [ebp - 0x880], 0xf8ffff
jne 0x4047ae
lea edx, [ebp - 0x1894]
push edx
lea edx, [ecx + 6]
push edx
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x4047d8
lea edx, [ebp - 0x1894]
push edx
lea edx, [ecx + 6]
push edx
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x4047e1
cmp eax, 0xffffffff
jne 0x4047f0
mov dword [ebp - 0x28b8], 1
jmp 0x4048a0
cmp byte [ebp - 0x28b0], 0x76
je 0x40486b
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40484b
xor eax, eax
jmp 0x404855
cmp eax, 0x20
jbe 0x404855
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x4048a0
mov eax, dword [ebp - 0x562]
and eax, 0xfffff000
cmp eax, dword [ebp - 0x566]
je 0x404889
mov dword [ebp - 0x566], eax
call fcn.0040831d
mov eax, dword [ebp - 0x552]
add dword [ebp - 0x562], eax
inc dword [ebp - 0x2fc]
jmp 0x4046ec
jmp 0x4049d7
mov dword [ebp - 0x1890], 0x37
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x31]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 6
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x4048be
test dword [ebp - 0x880], 0xf8ffff
jne 0x404911
lea edx, [ebp - 0x1894]
push edx
push 5
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x404939
lea edx, [ebp - 0x1894]
push edx
push 5
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x404942
cmp eax, 0xffffffff
jne 0x404951
mov dword [ebp - 0x28b8], 1
jmp 0x4049d7
cmp byte [ebp - 0x28b0], 0x77
je 0x4049cc
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4049ac
xor eax, eax
jmp 0x4049b6
cmp eax, 0x20
jbe 0x4049b6
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x4049d7
inc dword [ebp - 0x56e]
jmp 0x404149
cmp dword [ebp - 0x28b8], 0
jne 0x404ad7
mov dword [ebp - 0x1890], 0x1ff0131
test dword [ebp - 0x880], 0xf8ffff
jne 0x404a21
lea edx, [ebp - 0x1894]
push edx
push 8
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x404a49
lea edx, [ebp - 0x1894]
push edx
push 8
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x404a52
cmp eax, 0xffffffff
jne 0x404a5e
mov dword [ebp - 0x28b8], 1
jmp 0x404ad7
cmp byte [ebp - 0x28b0], 0x71
je 0x404ad7
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404ab9
xor eax, eax
jmp 0x404ac3
cmp eax, 0x20
jbe 0x404ac3
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x404bb2
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov dword [ebp - 0x1890], 0x111
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x42]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 6
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x404b24
test dword [ebp - 0x880], 0xf8ffff
jne 0x404b77
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x404b9f
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x404ba8
cmp eax, 0xffffffff
jne 0x404bb2
mov dword [ebp - 0x28b8], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x404ed5
cmp dword [ebp - 0x28b8], 0
jne 0x404ccd
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x1894], eax
mov dword [ebp - 0x1890], 0x110
test dword [ebp - 0x880], 0xf8ffff
jne 0x404c17
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x404c3f
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x404c48
cmp eax, 0xffffffff
jne 0x404c54
mov dword [ebp - 0x28b8], 1
jmp 0x404ccd
cmp byte [ebp - 0x28b0], 0x50
je 0x404ccd
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404caf
xor eax, eax
jmp 0x404cb9
cmp eax, 0x20
jbe 0x404cb9
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x404ed5
mov dword [ebp - 0x1890], 0x8f0219
test dword [ebp - 0x880], 0xf8ffff
jne 0x404d17
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x404d3f
lea edx, [ebp - 0x1894]
push edx
push 7
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x404d48
cmp eax, 0xffffffff
jne 0x404d57
mov dword [ebp - 0x28b8], 1
jmp 0x404ed5
cmp byte [ebp - 0x28b0], 0x59
je 0x404dd5
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404db2
xor eax, eax
jmp 0x404dbc
cmp eax, 0x20
jbe 0x404dbc
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x404ed5
sub eax, 7
shr eax, 2
mov dword [ebp - 0x2f8], eax
push 0
push 0xa0d6425
push 0x203a2454
push 0x4e554f43
push 0x5f435444
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
mov dword [ebp - 0x2f4], 0
mov ecx, dword [ebp - 0x2f4]
cmp ecx, dword [ebp - 0x2f8]
jae 0x404ed5
shl ecx, 2
movzx eax, byte [ebp + ecx - 0x28ad]
mov dword [ebp - 0x2f0], eax
movzx eax, byte [ebp + ecx - 0x28ac]
mov dword [ebp - 0x2ec], eax
movzx eax, byte [ebp + ecx - 0x28ab]
mov dword [ebp - 0x2e8], eax
movzx eax, byte [ebp + ecx - 0x28aa]
mov dword [ebp - 0x2e4], eax
push 0xa
push 0xd58322e
push 0x252d5832
push 0x2e252d58
push 0x322e2558
push 0x322e2550
push dword [ebp - 0x2e4]
push dword [ebp - 0x2e8]
push dword [ebp - 0x2ec]
push dword [ebp - 0x2f0]
lea eax, [esp + 0x10]
push eax
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
inc dword [ebp - 0x2f4]
jmp 0x404e2b
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x18
jne 0x40503c
cmp dword [ebp - 0x28b8], 0
jne 0x40503c
push 0
push 0xa0d2443
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x1894], eax
mov dword [ebp - 0x1890], 0xffffff14
test dword [ebp - 0x880], 0xf8ffff
jne 0x404f5c
lea edx, [ebp - 0x1894]
push edx
push 8
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x40
push 6
push 0
call fcn.0040836c
jmp 0x404f84
lea edx, [ebp - 0x1894]
push edx
push 8
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0x6d7
push 0x140
push 6
push 0
call fcn.0040836c
test eax, eax
je 0x404f8d
cmp eax, 0xffffffff
jne 0x404f9c
mov dword [ebp - 0x28b8], 1
jmp 0x40503c
cmp byte [ebp - 0x28b0], 0x54
je 0x405017
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404ff7
xor eax, eax
jmp 0x405001
cmp eax, 0x20
jbe 0x405001
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x40503c
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0
mov eax, esp
push 0
push eax
push 2
call dword [edi]
add esp, 4
push 0
push 0
push 3
call dword [edi]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xd
jne 0x405cd8
mov eax, 3
pushal
mov dword [ebp - 0x28b8], 0
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x20]
cmp ebx, 0x24
jbe 0x40554b
cmp dword [edi + ebx - 4], 0xcafeaffe
jne 0x405543
cmp dword [edi + ebx - 8], 0xfadecafe
jne 0x405543
push ebx
xor ecx, ecx
inc ecx
movzx eax, word [edi + ebx - 0x1c]
cmp ebx, 0x3c
jbe 0x4050d6
cmp eax, ecx
je 0x4050d6
inc ecx
sub ebx, 0x20
cmp dword [edi + ebx - 4], 0xcafeaffe
jne 0x4050d6
cmp dword [edi + ebx - 8], 0xfadecafe
je 0x4050b0
cmp eax, ecx
jne 0x405542
movzx eax, word [edi + ebx - 0x1c]
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2c0], 0
mov ecx, dword [ebp - 0x2c0]
cmp ecx, dword [ebp - 0x2c4]
jae 0x40553f
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
cmp dword [edi + ecx + 8], 0x1000
jne 0x405279
mov eax, dword [edi + ecx - 0x10]
mov edx, dword [edi + ecx - 0xc]
cmp eax, 0x80400000
jae 0x405136
cmp eax, 0x80000000
jb 0x405136
sub eax, 0x80000000
jmp 0x405173
cmp eax, 0x80a00000
jae 0x40514b
cmp eax, 0x80800000
jb 0x40514b
sub eax, 0x80600000
jmp 0x405173
cmp eax, 0x81100000
jae 0x405160
cmp eax, 0x81000000
jb 0x405160
sub eax, 0x80c00000
jmp 0x405173
cmp eax, 0x84380000
jae 0x405173
cmp eax, 0x84002000
jb 0x405173
sub eax, 0x83c00000
cmp edx, 0x80400000
jae 0x40518b
cmp edx, 0x80000000
jb 0x40518b
sub edx, 0x80000000
jmp 0x4051d1
cmp edx, 0x80a00000
jae 0x4051a3
cmp edx, 0x80800000
jb 0x4051a3
sub edx, 0x80600000
jmp 0x4051d1
cmp edx, 0x81100000
jae 0x4051bb
cmp edx, 0x81000000
jb 0x4051bb
sub edx, 0x80c00000
jmp 0x4051d1
cmp edx, 0x84380000
jae 0x4051d1
cmp edx, 0x84002000
jb 0x4051d1
sub edx, 0x83c00000
dec edx
and edx, 0xfffffffc
push edx
push eax
push edi
call fcn.004086a6
mov ecx, dword [ebp - 0x2c0]
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
mov ecx, dword [edi + ecx - 0xc]
dec ecx
and ecx, 0xfffffffc
cmp ecx, 0x80400000
jae 0x405209
cmp ecx, 0x80000000
jb 0x405209
sub ecx, 0x80000000
jmp 0x40524f
cmp ecx, 0x80a00000
jae 0x405221
cmp ecx, 0x80800000
jb 0x405221
sub ecx, 0x80600000
jmp 0x40524f
cmp ecx, 0x81100000
jae 0x405239
cmp ecx, 0x81000000
jb 0x405239
sub ecx, 0x80c00000
jmp 0x40524f
cmp ecx, 0x84380000
jae 0x40524f
cmp ecx, 0x84002000
jb 0x40524f
sub ecx, 0x83c00000
cmp dword [edi + ecx], eax
jne 0x405269
cmp dword [esp + 0x20], 3
jne 0x405534
mov dword [esp + 0x20], 0
jmp 0x405274
mov dword [esp + 0x20], 1
mov dword [edi + ecx], eax
jmp 0x405534
cmp dword [edi + ecx + 8], 0x1001
jne 0x4053a6
mov eax, dword [edi + ecx - 8]
sub eax, dword [edi + ecx - 4]
mov dword [ebp - 0x2bc], eax
mov edx, dword [edi + ecx - 0xc]
mov ecx, dword [edi + ecx - 0x10]
cmp ecx, 0x80400000
jae 0x4052b5
cmp ecx, 0x80000000
jb 0x4052b5
sub ecx, 0x80000000
jmp 0x4052fb
cmp ecx, 0x80a00000
jae 0x4052cd
cmp ecx, 0x80800000
jb 0x4052cd
sub ecx, 0x80600000
jmp 0x4052fb
cmp ecx, 0x81100000
jae 0x4052e5
cmp ecx, 0x81000000
jb 0x4052e5
sub ecx, 0x80c00000
jmp 0x4052fb
cmp ecx, 0x84380000
jae 0x4052fb
cmp ecx, 0x84002000
jb 0x4052fb
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x405313
cmp edx, 0x80000000
jb 0x405313
sub edx, 0x80000000
jmp 0x405359
cmp edx, 0x80a00000
jae 0x40532b
cmp edx, 0x80800000
jb 0x40532b
sub edx, 0x80600000
jmp 0x405359
cmp edx, 0x81100000
jae 0x405343
cmp edx, 0x81000000
jb 0x405343
sub edx, 0x80c00000
jmp 0x405359
cmp edx, 0x84380000
jae 0x405359
cmp edx, 0x84002000
jb 0x405359
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
cmp ecx, edx
jae 0x405371
mov eax, dword [edi + ecx]
add dword [ebp - 0x2bc], eax
add ecx, 4
jmp 0x40535f
cmp dword [ebp - 0x2bc], 0
jne 0x40538f
cmp dword [esp + 0x20], 3
jne 0x405534
mov dword [esp + 0x20], 0
jmp 0x4053a1
mov dword [esp + 0x20], 1
sub eax, dword [ebp - 0x2bc]
mov dword [edi + edx - 4], eax
jmp 0x405534
cmp dword [edi + ecx + 8], 0x1010
jne 0x405534
mov eax, dword [edi + ecx - 4]
sub eax, dword [edi + ecx - 8]
mov dword [ebp - 0x2bc], eax
mov edx, dword [edi + ecx - 0xc]
mov ecx, dword [edi + ecx - 0x10]
cmp ecx, 0x80400000
jae 0x4053e2
cmp ecx, 0x80000000
jb 0x4053e2
sub ecx, 0x80000000
jmp 0x405428
cmp ecx, 0x80a00000
jae 0x4053fa
cmp ecx, 0x80800000
jb 0x4053fa
sub ecx, 0x80600000
jmp 0x405428
cmp ecx, 0x81100000
jae 0x405412
cmp ecx, 0x81000000
jb 0x405412
sub ecx, 0x80c00000
jmp 0x405428
cmp ecx, 0x84380000
jae 0x405428
cmp ecx, 0x84002000
jb 0x405428
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x405440
cmp edx, 0x80000000
jb 0x405440
sub edx, 0x80000000
jmp 0x405486
cmp edx, 0x80a00000
jae 0x405458
cmp edx, 0x80800000
jb 0x405458
sub edx, 0x80600000
jmp 0x405486
cmp edx, 0x81100000
jae 0x405470
cmp edx, 0x81000000
jb 0x405470
sub edx, 0x80c00000
jmp 0x405486
cmp edx, 0x84380000
jae 0x405486
cmp edx, 0x84002000
jb 0x405486
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
sub edx, 4
cmp ecx, edx
jae 0x4054a2
movzx eax, word [edi + ecx]
sub dword [ebp - 0x2bc], eax
add ecx, 2
jmp 0x40548f
mov ecx, dword [ebp - 0x2c0]
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
mov ecx, dword [edi + ecx - 0xc]
cmp ecx, 0x80400000
jae 0x4054ca
cmp ecx, 0x80000000
jb 0x4054ca
sub ecx, 0x80000000
jmp 0x405510
cmp ecx, 0x80a00000
jae 0x4054e2
cmp ecx, 0x80800000
jb 0x4054e2
sub ecx, 0x80600000
jmp 0x405510
cmp ecx, 0x81100000
jae 0x4054fa
cmp ecx, 0x81000000
jb 0x4054fa
sub ecx, 0x80c00000
jmp 0x405510
cmp ecx, 0x84380000
jae 0x405510
cmp ecx, 0x84002000
jb 0x405510
sub ecx, 0x83c00000
add ecx, 3
and ecx, 0xfffffffc
mov eax, dword [edi + ecx - 4]
cmp eax, dword [ebp - 0x2bc]
je 0x405534
mov dword [esp + 0x20], 1
mov eax, dword [ebp - 0x2bc]
mov dword [edi + ecx - 4], eax
inc dword [ebp - 0x2c0]
jmp 0x4050f3
pop eax
jmp 0x405543
pop ebx
sub ebx, 4
jmp 0x405087
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x218], 0xffffffff
cmp ebx, 0x24
jbe 0x4057e3
mov eax, dword [edi + ebx - 8]
xor eax, 0xffffffff
cmp eax, dword [edi + ebx - 4]
jne 0x405667
mov eax, dword [edi + ebx - 0x10]
mov ecx, dword [edi + ebx - 0xc]
cmp eax, 0x80400000
jae 0x40559c
cmp eax, 0x80000000
jb 0x40559c
sub eax, 0x80000000
jmp 0x4055d9
cmp eax, 0x80a00000
jae 0x4055b1
cmp eax, 0x80800000
jb 0x4055b1
sub eax, 0x80600000
jmp 0x4055d9
cmp eax, 0x81100000
jae 0x4055c6
cmp eax, 0x81000000
jb 0x4055c6
sub eax, 0x80c00000
jmp 0x4055d9
cmp eax, 0x84380000
jae 0x4055d9
cmp eax, 0x84002000
jb 0x4055d9
sub eax, 0x83c00000
cmp ecx, 0x80400000
jae 0x4055f1
cmp ecx, 0x80000000
jb 0x4055f1
sub ecx, 0x80000000
jmp 0x405637
cmp ecx, 0x80a00000
jae 0x405609
cmp ecx, 0x80800000
jb 0x405609
sub ecx, 0x80600000
jmp 0x405637
cmp ecx, 0x81100000
jae 0x405621
cmp ecx, 0x81000000
jb 0x405621
sub ecx, 0x80c00000
jmp 0x405637
cmp ecx, 0x84380000
jae 0x405637
cmp ecx, 0x84002000
jb 0x405637
sub ecx, 0x83c00000
add ecx, 3
and ecx, 0xfffffffc
cmp eax, ecx
jae 0x405667
cmp ecx, dword [esi + 0x14]
jae 0x405667
mov eax, dword [ebp - 0x218]
sub eax, ebx
cmp eax, 0x10
je 0x405659
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
sub ebx, 0x10
jmp 0x405565
cmp dword [ebp - 0x21c], 0xffffffff
je 0x4057db
mov eax, dword [ebp - 0x21c]
sub eax, ebx
cmp eax, 0x40
jb 0x4057d1
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x21c]
ja 0x4057d1
mov ecx, dword [edi + eax - 0x10]
mov edx, dword [edi + eax - 0xc]
cmp ecx, 0x80400000
jae 0x4056b7
cmp ecx, 0x80000000
jb 0x4056b7
sub ecx, 0x80000000
jmp 0x4056fd
cmp ecx, 0x80a00000
jae 0x4056cf
cmp ecx, 0x80800000
jb 0x4056cf
sub ecx, 0x80600000
jmp 0x4056fd
cmp ecx, 0x81100000
jae 0x4056e7
cmp ecx, 0x81000000
jb 0x4056e7
sub ecx, 0x80c00000
jmp 0x4056fd
cmp ecx, 0x84380000
jae 0x4056fd
cmp ecx, 0x84002000
jb 0x4056fd
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x405715
cmp edx, 0x80000000
jb 0x405715
sub edx, 0x80000000
jmp 0x40575b
cmp edx, 0x80a00000
jae 0x40572d
cmp edx, 0x80800000
jb 0x40572d
sub edx, 0x80600000
jmp 0x40575b
cmp edx, 0x81100000
jae 0x405745
cmp edx, 0x81000000
jb 0x405745
sub edx, 0x80c00000
jmp 0x40575b
cmp edx, 0x84380000
jae 0x40575b
cmp edx, 0x84002000
jb 0x40575b
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
mov dword [ebp - 0x214], 0
cmp ecx, edx
jae 0x40577e
movzx eax, word [edi + ecx]
add dword [ebp - 0x214], eax
add ecx, 2
jmp 0x40576b
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [edi + eax - 8]
je 0x4057a6
cmp dword [edi + eax - 8], 0xcafeaffe
je 0x4057a6
mov dword [esp + 0x20], 1
mov dword [edi + eax - 8], ecx
xor ecx, 0xffffffff
cmp ecx, dword [edi + eax - 4]
je 0x4057c5
cmp dword [edi + eax - 4], 0x35015001
je 0x4057c5
mov dword [esp + 0x20], 1
mov dword [edi + eax - 4], ecx
add dword [ebp - 0x218], 0x10
jmp 0x405685
mov dword [ebp - 0x21c], 0xffffffff
sub ebx, 4
jmp 0x405565
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x20]
cmp ebx, 0x24
jbe 0x405c60
cmp dword [edi + ebx - 4], 0xcafeaffe
jne 0x405c58
cmp dword [edi + ebx - 8], 0xfadecafe
jne 0x405c58
push ebx
xor ecx, ecx
inc ecx
movzx eax, word [edi + ebx - 0x1c]
cmp ebx, 0x3c
jbe 0x405838
cmp eax, ecx
je 0x405838
inc ecx
sub ebx, 0x20
cmp dword [edi + ebx - 4], 0xcafeaffe
jne 0x405838
cmp dword [edi + ebx - 8], 0xfadecafe
je 0x405812
cmp eax, ecx
jne 0x405c57
movzx eax, word [edi + ebx - 0x1c]
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2c0], 0
mov ecx, dword [ebp - 0x2c0]
cmp ecx, dword [ebp - 0x2c4]
jae 0x405c54
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
cmp dword [edi + ecx + 8], 0x1000
jne 0x40598e
mov eax, dword [edi + ecx - 0x10]
mov edx, dword [edi + ecx - 0xc]
cmp eax, 0x80400000
jae 0x405898
cmp eax, 0x80000000
jb 0x405898
sub eax, 0x80000000
jmp 0x4058d5
cmp eax, 0x80a00000
jae 0x4058ad
cmp eax, 0x80800000
jb 0x4058ad
sub eax, 0x80600000
jmp 0x4058d5
cmp eax, 0x81100000
jae 0x4058c2
cmp eax, 0x81000000
jb 0x4058c2
sub eax, 0x80c00000
jmp 0x4058d5
cmp eax, 0x84380000
jae 0x4058d5
cmp eax, 0x84002000
jb 0x4058d5
sub eax, 0x83c00000
cmp edx, 0x80400000
jae 0x4058ed
cmp edx, 0x80000000
jb 0x4058ed
sub edx, 0x80000000
jmp 0x405933
cmp edx, 0x80a00000
jae 0x405905
cmp edx, 0x80800000
jb 0x405905
sub edx, 0x80600000
jmp 0x405933
cmp edx, 0x81100000
jae 0x40591d
cmp edx, 0x81000000
jb 0x40591d
sub edx, 0x80c00000
jmp 0x405933
cmp edx, 0x84380000
jae 0x405933
cmp edx, 0x84002000
jb 0x405933
sub edx, 0x83c00000
dec edx
and edx, 0xfffffffc
push edx
push eax
push edi
call fcn.004086a6
mov ecx, dword [ebp - 0x2c0]
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
mov ecx, dword [edi + ecx - 0xc]
dec ecx
and ecx, 0x5ffffffc
cmp ecx, 0x800000
jb 0x405964
sub ecx, 0x600000
cmp dword [edi + ecx], eax
jne 0x40597e
cmp dword [esp + 0x20], 3
jne 0x405c49
mov dword [esp + 0x20], 0
jmp 0x405989
mov dword [esp + 0x20], 1
mov dword [edi + ecx], eax
jmp 0x405c49
cmp dword [edi + ecx + 8], 0x1001
jne 0x405abb
mov eax, dword [edi + ecx - 8]
sub eax, dword [edi + ecx - 4]
mov dword [ebp - 0x2bc], eax
mov edx, dword [edi + ecx - 0xc]
mov ecx, dword [edi + ecx - 0x10]
cmp ecx, 0x80400000
jae 0x4059ca
cmp ecx, 0x80000000
jb 0x4059ca
sub ecx, 0x80000000
jmp 0x405a10
cmp ecx, 0x80a00000
jae 0x4059e2
cmp ecx, 0x80800000
jb 0x4059e2
sub ecx, 0x80600000
jmp 0x405a10
cmp ecx, 0x81100000
jae 0x4059fa
cmp ecx, 0x81000000
jb 0x4059fa
sub ecx, 0x80c00000
jmp 0x405a10
cmp ecx, 0x84380000
jae 0x405a10
cmp ecx, 0x84002000
jb 0x405a10
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x405a28
cmp edx, 0x80000000
jb 0x405a28
sub edx, 0x80000000
jmp 0x405a6e
cmp edx, 0x80a00000
jae 0x405a40
cmp edx, 0x80800000
jb 0x405a40
sub edx, 0x80600000
jmp 0x405a6e
cmp edx, 0x81100000
jae 0x405a58
cmp edx, 0x81000000
jb 0x405a58
sub edx, 0x80c00000
jmp 0x405a6e
cmp edx, 0x84380000
jae 0x405a6e
cmp edx, 0x84002000
jb 0x405a6e
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
cmp ecx, edx
jae 0x405a86
mov eax, dword [edi + ecx]
add dword [ebp - 0x2bc], eax
add ecx, 4
jmp 0x405a74
cmp dword [ebp - 0x2bc], 0
jne 0x405aa4
cmp dword [esp + 0x20], 3
jne 0x405c49
mov dword [esp + 0x20], 0
jmp 0x405ab6
mov dword [esp + 0x20], 1
sub eax, dword [ebp - 0x2bc]
mov dword [edi + edx - 4], eax
jmp 0x405c49
cmp dword [edi + ecx + 8], 0x1010
jne 0x405c49
mov eax, dword [edi + ecx - 4]
sub eax, dword [edi + ecx - 8]
mov dword [ebp - 0x2bc], eax
mov edx, dword [edi + ecx - 0xc]
mov ecx, dword [edi + ecx - 0x10]
cmp ecx, 0x80400000
jae 0x405af7
cmp ecx, 0x80000000
jb 0x405af7
sub ecx, 0x80000000
jmp 0x405b3d
cmp ecx, 0x80a00000
jae 0x405b0f
cmp ecx, 0x80800000
jb 0x405b0f
sub ecx, 0x80600000
jmp 0x405b3d
cmp ecx, 0x81100000
jae 0x405b27
cmp ecx, 0x81000000
jb 0x405b27
sub ecx, 0x80c00000
jmp 0x405b3d
cmp ecx, 0x84380000
jae 0x405b3d
cmp ecx, 0x84002000
jb 0x405b3d
sub ecx, 0x83c00000
cmp edx, 0x80400000
jae 0x405b55
cmp edx, 0x80000000
jb 0x405b55
sub edx, 0x80000000
jmp 0x405b9b
cmp edx, 0x80a00000
jae 0x405b6d
cmp edx, 0x80800000
jb 0x405b6d
sub edx, 0x80600000
jmp 0x405b9b
cmp edx, 0x81100000
jae 0x405b85
cmp edx, 0x81000000
jb 0x405b85
sub edx, 0x80c00000
jmp 0x405b9b
cmp edx, 0x84380000
jae 0x405b9b
cmp edx, 0x84002000
jb 0x405b9b
sub edx, 0x83c00000
add edx, 3
and edx, 0xfffffffc
sub edx, 4
cmp ecx, edx
jae 0x405bb7
movzx eax, word [edi + ecx]
sub dword [ebp - 0x2bc], eax
add ecx, 2
jmp 0x405ba4
mov ecx, dword [ebp - 0x2c0]
imul ecx, ecx, 0x20
lea ecx, [ecx + ebx]
mov ecx, dword [edi + ecx - 0xc]
cmp ecx, 0x80400000
jae 0x405bdf
cmp ecx, 0x80000000
jb 0x405bdf
sub ecx, 0x80000000
jmp 0x405c25
cmp ecx, 0x80a00000
jae 0x405bf7
cmp ecx, 0x80800000
jb 0x405bf7
sub ecx, 0x80600000
jmp 0x405c25
cmp ecx, 0x81100000
jae 0x405c0f
cmp ecx, 0x81000000
jb 0x405c0f
sub ecx, 0x80c00000
jmp 0x405c25
cmp ecx, 0x84380000
jae 0x405c25
cmp ecx, 0x84002000
jb 0x405c25
sub ecx, 0x83c00000
add ecx, 3
and ecx, 0xfffffffc
mov eax, dword [edi + ecx - 4]
cmp eax, dword [ebp - 0x2bc]
je 0x405c49
mov dword [esp + 0x20], 1
mov eax, dword [ebp - 0x2bc]
mov dword [edi + ecx - 4], eax
inc dword [ebp - 0x2c0]
jmp 0x405855
pop eax
jmp 0x405c58
pop ebx
sub ebx, 4
jmp 0x4057e9
popal
test eax, eax
jne 0x405c87
push 0xa0d
push 0x2444494c
push 0x41565f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x14
jmp 0x405cd8
cmp eax, 1
jne 0x405cb3
push 0xa0d
push 0x24444554
push 0x43455252
push 0x4f435f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x405cd8
push 0xa0d
push 0x24444e55
push 0x4f465f54
push 0x4f4e5f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
cmp dword [esi + 0x270], 0x74696d24
jne 0x405d3c
cmp dword [esi + 0x274], 0x30387573
jne 0x405d3c
cmp dword [esi + 0x278], 0x4524325f
jne 0x405d3c
cmp dword [esi + 0x27c], 0x43374344
jne 0x405d3c
cmp dword [esi + 0x280], 0x34315b34
jne 0x405d3c
cmp dword [esi + 0x284], 0x5d6b3237
jne 0x405d3c
cmp dword [esi + 0x288], 0x6c2d4b20
jne 0x405d3c
cmp dword [esi + 0x28c], 0x656e69
je 0x405dda
cmp dword [esi + 0x270], 0x74696d24
jne 0x4081d0
cmp dword [esi + 0x274], 0x30387573
jne 0x4081d0
cmp dword [esi + 0x278], 0x2824325f
jne 0x4081d0
cmp dword [esi + 0x27c], 0x54534554
jne 0x4081d0
cmp dword [esi + 0x280], 0x43444529
jne 0x4081d0
cmp dword [esi + 0x284], 0x5b344337
jne 0x4081d0
cmp dword [esi + 0x288], 0x32373431
jne 0x4081d0
cmp dword [esi + 0x28c], 0x4b205d6b
jne 0x4081d0
cmp dword [esi + 0x290], 0x6e696c2d
jne 0x4081d0
cmp word [esi + 0x294], 0x65
jne 0x4081d0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x405dee
cmp eax, 0xb
jne 0x406057
cmp dword [esi + 0x270], 0x74696d24
jne 0x405e52
cmp dword [esi + 0x274], 0x30387573
jne 0x405e52
cmp dword [esi + 0x278], 0x4524325f
jne 0x405e52
cmp dword [esi + 0x27c], 0x43374344
jne 0x405e52
cmp dword [esi + 0x280], 0x34315b34
jne 0x405e52
cmp dword [esi + 0x284], 0x5d6b3237
jne 0x405e52
cmp dword [esi + 0x288], 0x6c2d4b20
jne 0x405e52
cmp dword [esi + 0x28c], 0x656e69
je 0x405ee0
cmp dword [esi + 0x270], 0x74696d24
jne 0x405f32
cmp dword [esi + 0x274], 0x30387573
jne 0x405f32
cmp dword [esi + 0x278], 0x2824325f
jne 0x405f32
cmp dword [esi + 0x27c], 0x54534554
jne 0x405f32
cmp dword [esi + 0x280], 0x43444529
jne 0x405f32
cmp dword [esi + 0x284], 0x5b344337
jne 0x405f32
cmp dword [esi + 0x288], 0x32373431
jne 0x405f32
cmp dword [esi + 0x28c], 0x4b205d6b
jne 0x405f32
cmp dword [esi + 0x290], 0x6e696c2d
jne 0x405f32
cmp word [esi + 0x294], 0x65
jne 0x405f32
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x405f09
mov dword [ebp - 0x878], 0x4010a0
mov dword [ebp - 0x874], 0xa0
mov dword [ebp - 0x870], 0x50
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x405f32
mov dword [ebp - 0x878], 0x4010f0
mov dword [ebp - 0x874], 0xf0
mov dword [ebp - 0x870], 0x50
push 0x200
push 0
lea edx, [ebp - 0x76e]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov byte [ebp - 0x864], 0x21
mov dword [ebp - 0x86c], 0
mov ecx, dword [ebp - 0x86c]
cmp ecx, dword [ebp - 0x870]
jae 0x406057
mov eax, dword [ebp - 0x874]
lea eax, [eax + ecx]
mov dword [ebp - 0x862], eax
mov edx, dword [ebp - 0x870]
sub edx, ecx
xor ecx, ecx
cmp ecx, edx
jae 0x405faa
cmp ecx, 0xf0
jae 0x405faa
mov eax, dword [ebp - 0x878]
add eax, dword [ebp - 0x86c]
mov al, byte [eax + ecx]
mov byte [ebp + ecx - 0x85e], al
inc ecx
jmp 0x405f85
mov dword [ebp - 0x868], ecx
add ecx, 4
mov byte [ebp - 0x863], cl
push 0xfa
lea edx, [ebp - 0x2aca]
push edx
push 0xf6
lea edx, [ebp - 0x864]
push edx
call dword [ebx + 0x3c]
test eax, eax
jne 0x406027
push 0xa0d35
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x45242024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x30
mov dword [ebp - 0x28b8], 1
jmp 0x406057
mov eax, dword [ebp - 0x868]
mov ecx, dword [ebp - 0x86c]
add dword [ebp - 0x86c], eax
push eax
lea edx, [ebp - 0x2aca]
push edx
lea edx, [ebp + ecx - 0x76e]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
jmp 0x405f5a
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x40607a
cmp eax, 0xa
je 0x40607a
cmp eax, 0xb
je 0x40607a
cmp eax, 0x17
je 0x40607a
cmp eax, 0x18
jne 0x408098
cmp dword [ebp - 0x28b8], 0
jne 0x408098
push 0x28a0
push 0x1000
push 4
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4060b5
mov dword [ebp - 0x28b8], 1
jmp 0x408098
push 0
push 3
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4060df
mov dword [ebp - 0x28b8], 1
jmp 0x408082
push 0
push 0
push 0
push 0
push 0
push 4
push 0
push 0
push 0x20000
push 0
push 0
push 0
push 0x40000
push 0
push 2
push 0
push 0
push 0
push 4
push 1
push 0
push 0
mov eax, esp
push 0
push eax
push 4
call dword [edi]
add esp, 0x58
cmp eax, 0xffffffff
jne 0x406131
mov dword [ebp - 0x28b8], 1
jmp 0x408082
push 0x81f11081
push 0
push 4
push 0
push 0
push 0
push 4
push 0
lea edx, [ebp - 0x28b4]
push edx
lea edx, [esp + 4]
push edx
push 0xd
call dword [edi]
add esp, 0x20
mov byte [ebp - 0x4b6], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x406172
cmp eax, 0xa
jne 0x4065ed
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0xca]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x406184
push 0x9a2102
lea eax, [ebp - 0x28b4]
push esp
push 3
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x4061d1
cmp eax, 0xffffffff
jne 0x4061e0
mov dword [ebp - 0x28b8], 1
jmp 0x4062da
cmp byte [ebp - 0x28b4], 0
jne 0x4061fb
cmp byte [ebp - 0x28b3], 0x3f
jb 0x4061fb
cmp byte [ebp - 0x28b2], 0x61
je 0x406215
cmp byte [ebp - 0x28b4], 0x3f
jae 0x4062da
cmp byte [ebp - 0x28b3], 0x61
jne 0x4062da
pushal
cmp byte [ebp - 0x28b4], 0
jne 0x406231
movzx eax, byte [ebp - 0x28b3]
lea edx, [ebp - 0x28b0]
lea eax, [eax - 4]
jmp 0x406241
movzx eax, byte [ebp - 0x28b4]
lea edx, [ebp - 0x28b1]
lea eax, [eax - 3]
mov dword [ebp - 0x210], eax
xor ecx, ecx
xor ebx, ebx
cmp ecx, 0x3f
jae 0x40626e
cmp ecx, dword [ebp - 0x210]
jae 0x40626e
mov al, byte [edx + ecx]
test al, al
je 0x40626e
cmp al, 0x20
je 0x40626b
mov byte [ebp + ebx - 0x4b6], al
inc ebx
inc ecx
jmp 0x40624b
mov byte [ebp + ebx - 0x4b6], 0
popal
cmp byte [ebp - 0x4b6], 0
je 0x4062da
lea eax, [ebp - 0x4b6]
push 0xa0d
push 0x7325203a
push 0x24545241
push 0x505f454e
push 0x49474e45
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
lea edx, [ebp - 0x4b6]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
cmp dword [ebp - 0x28b8], 0
jne 0x4063ed
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x35]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x4062f6
push 0x31002
lea eax, [ebp - 0x28b4]
push esp
push 3
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x406343
cmp eax, 0xffffffff
jne 0x406352
mov dword [ebp - 0x28b8], 1
jmp 0x4063ed
cmp byte [ebp - 0x28b4], 0
jne 0x40636d
cmp byte [ebp - 0x28b3], 0x3f
jb 0x40636d
cmp byte [ebp - 0x28b2], 0x50
jne 0x40637f
cmp byte [ebp - 0x28b4], 0x3f
jae 0x4063ed
cmp byte [ebp - 0x28b3], 0x50
je 0x4063ed
push 0x37
call dword [sym.imp.KERNEL32.DLL_Sleep]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x37]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x406396
push 0x861002
lea eax, [ebp - 0x28b4]
push esp
push 3
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x4063e3
cmp eax, 0xffffffff
jne 0x4063ed
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x4065ed
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x48]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x406409
push 0x1210
push 0x22305
lea eax, [ebp - 0x28b4]
push esp
push 6
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x40645b
cmp eax, 0xffffffff
jne 0x40646a
mov dword [ebp - 0x28b8], 1
jmp 0x4065ed
cmp byte [ebp - 0x28b4], 0
jne 0x40651c
cmp byte [ebp - 0x28b3], 0x3f
jb 0x40651c
cmp byte [ebp - 0x28b2], 0x63
je 0x40651c
cmp byte [ebp - 0x28b4], 0x3f
jae 0x40651c
cmp byte [ebp - 0x28b3], 0x3f
je 0x40651c
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4064f9
xor eax, eax
jmp 0x406503
cmp eax, 0x20
jbe 0x406503
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x4065ed
pushal
cmp byte [ebp - 0x28b4], 0
jne 0x406535
movzx eax, byte [ebp - 0x28b3]
lea edx, [ebp - 0x28b1]
jmp 0x406542
movzx eax, byte [ebp - 0x28b4]
lea edx, [ebp - 0x28b2]
dec eax
mov dword [ebp - 0x210], eax
xor ecx, ecx
xor ebx, ebx
cmp ecx, 0x3f
jae 0x406570
cmp ecx, dword [ebp - 0x210]
jae 0x406570
mov al, byte [edx + ecx]
test al, al
je 0x406570
cmp al, 0x20
je 0x40656d
mov byte [ebp + ebx - 0x476], al
inc ebx
inc ecx
jmp 0x40654d
mov byte [ebp + ebx - 0x476], 0
popal
cmp byte [ebp - 0x476], 0
je 0x4065ed
lea eax, [ebp - 0x476]
push 0xa0d73
push 0x25203a24
push 0x454c4946
push 0x5f4c4143
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x24
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
cmp byte [esi + 0x6c], 0
je 0x4065dc
push 0x5f
push esp
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 4
lea edx, [ebp - 0x476]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x406c16
cmp dword [ebp - 0x28b8], 0
jne 0x4066f6
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x87861003
lea eax, [ebp - 0x28b4]
push esp
push 4
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x40663e
cmp eax, 0xffffffff
jne 0x40664d
mov dword [ebp - 0x28b8], 1
jmp 0x4066f6
cmp byte [ebp - 0x28b4], 0
jne 0x4066f6
cmp byte [ebp - 0x28b3], 0x3f
jb 0x4066f6
cmp byte [ebp - 0x28b2], 0x50
je 0x4066f6
cmp byte [ebp - 0x28b4], 0x3f
jae 0x4066f6
cmp byte [ebp - 0x28b3], 0x50
je 0x4066f6
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4066d8
xor eax, eax
jmp 0x4066e2
cmp eax, 0x20
jbe 0x4066e2
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x406733
push 0x1e780
push 1
push 0
push 0xc
push 0
push 0xa
push 0x19
push 7
push 0
push 4
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x2c
cmp eax, 0xffffffff
jne 0x406733
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x40685c
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x201]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x406752
push 0x140505
push 0x5038307
lea eax, [ebp - 0x28b4]
push esp
push 8
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x4067a4
cmp eax, 0xffffffff
jne 0x4067b3
mov dword [ebp - 0x28b8], 1
jmp 0x40685c
cmp byte [ebp - 0x28b4], 0
jne 0x40685c
cmp byte [ebp - 0x28b3], 0x3f
jb 0x40685c
cmp byte [ebp - 0x28b2], 0xc3
je 0x40685c
cmp byte [ebp - 0x28b4], 0x3f
jae 0x40685c
cmp byte [ebp - 0x28b3], 0xc3
je 0x40685c
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40683e
xor eax, eax
jmp 0x406848
cmp eax, 0x20
jbe 0x406848
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x4068cb
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x37]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x406874
push 0x31002
lea eax, [ebp - 0x28b4]
push esp
push 3
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x4068c1
cmp eax, 0xffffffff
jne 0x4068cb
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x406bdb
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [esi + 0x14]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x24], eax
push dword [esi + 0x28]
push 0xff
push eax
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov dword [ebp - 0x56e], 0
mov dword [ebp - 0x56a], 0
cmp dword [ebp - 0x56e], 0x20
jae 0x406968
imul ecx, dword [ebp - 0x56e], 0x10
mov eax, dword [ebp + ecx - 0x76a]
sub eax, dword [ebp + ecx - 0x76e]
test eax, eax
je 0x406968
add dword [ebp - 0x56a], eax
inc dword [ebp - 0x56e]
jmp 0x406938
mov eax, dword [ebp - 0x56a]
add eax, 0x7ff
and eax, 0xfffff800
shr eax, 0xb
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0x56e], 0
mov dword [ebp - 0x566], 0
cmp dword [ebp - 0x56e], 0x20
jae 0x406bdb
imul ecx, dword [ebp - 0x56e], 0x10
mov eax, dword [ebp + ecx - 0x76a]
sub eax, dword [ebp + ecx - 0x76e]
test eax, eax
je 0x406bdb
mov eax, dword [ebp + ecx - 0x76e]
mov dword [ebp - 0x562], eax
mov eax, dword [ebp + ecx - 0x76a]
mov dword [ebp - 0x55e], eax
mov eax, dword [ebp + ecx - 0x766]
mov dword [ebp - 0x55a], eax
mov eax, dword [ebp + ecx - 0x762]
mov dword [ebp - 0x556], eax
mov eax, dword [ebp - 0x562]
mov ecx, dword [ebp - 0x55e]
cmp eax, ecx
jae 0x406bd0
sub ecx, eax
cmp ecx, dword [ebp - 0x556]
jbe 0x406a52
mov ecx, dword [ebp - 0x556]
mov dword [ebp - 0x552], ecx
mov dword [ebp - 0x1894], 0x2305
add eax, dword [ebp - 0x55a]
mov byte [ebp - 0x1891], ah
mov byte [ebp - 0x1890], al
shr eax, 0x10
mov byte [ebp - 0x1892], al
mov byte [ebp - 0x188f], cl
push 3
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea edx, [ebp - 0x1894]
push edx
push 6
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x406ab9
cmp eax, 0xffffffff
jne 0x406ac8
mov dword [ebp - 0x28b8], 1
jmp 0x406bce
cmp byte [ebp - 0x28b4], 0
jne 0x406b73
cmp byte [ebp - 0x28b3], 0x3f
jb 0x406b73
cmp byte [ebp - 0x28b2], 0x63
je 0x406b73
cmp byte [ebp - 0x28b4], 0x3f
jae 0x406b73
cmp byte [ebp - 0x28b3], 0x63
je 0x406b73
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406b53
xor eax, eax
jmp 0x406b5d
cmp eax, 0x20
jbe 0x406b5d
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x406bce
mov eax, dword [ebp - 0x562]
and eax, 0xfffff800
cmp eax, dword [ebp - 0x566]
je 0x406b91
mov dword [ebp - 0x566], eax
call fcn.0040831d
cmp byte [ebp - 0x28b4], 0
jne 0x406ba2
lea ecx, [ebp - 0x28b1]
jmp 0x406ba8
lea ecx, [ebp - 0x28b2]
mov edx, dword [ebp - 0x562]
mov eax, dword [ebp - 0x552]
add dword [ebp - 0x562], eax
add edx, dword [esi + 0x24]
push eax
push ecx
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
jmp 0x406a2e
jmp 0x406bdb
inc dword [ebp - 0x56e]
jmp 0x4069d0
cmp dword [ebp - 0x28b8], 0
jne 0x406c0d
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
jmp 0x406c16
lea edx, [esi + 0x24]
push edx
call fcn.0040867e
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x407b89
cmp dword [ebp - 0x28b8], 0
jne 0x406d49
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0xcc]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x406c44
push 0x87021003
lea eax, [ebp - 0x28b4]
push esp
push 4
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x406c91
cmp eax, 0xffffffff
jne 0x406ca0
mov dword [ebp - 0x28b8], 1
jmp 0x406d49
cmp byte [ebp - 0x28b4], 0
jne 0x406d49
cmp byte [ebp - 0x28b3], 0x3f
jb 0x406d49
cmp byte [ebp - 0x28b2], 0x50
je 0x406d49
cmp byte [ebp - 0x28b4], 0x3f
jae 0x406d49
cmp byte [ebp - 0x28b3], 0x50
je 0x406d49
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406d2b
xor eax, eax
jmp 0x406d35
cmp eax, 0x20
jbe 0x406d35
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x406d86
push 0x1e780
push 1
push 0
push 0xc
push 0
push 0xa
push 0x19
push 7
push 0
push 4
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x2c
cmp eax, 0xffffffff
jne 0x406d86
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x406eaf
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x205]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x406da5
push 0x140505
push 0x5038307
lea eax, [ebp - 0x28b4]
push esp
push 8
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x406df7
cmp eax, 0xffffffff
jne 0x406e06
mov dword [ebp - 0x28b8], 1
jmp 0x406eaf
cmp byte [ebp - 0x28b4], 0
jne 0x406eaf
cmp byte [ebp - 0x28b3], 0x3f
jb 0x406eaf
cmp byte [ebp - 0x28b2], 0xc3
je 0x406eaf
cmp byte [ebp - 0x28b4], 0x3f
jae 0x406eaf
cmp byte [ebp - 0x28b3], 0xc3
je 0x406eaf
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406e91
xor eax, eax
jmp 0x406e9b
cmp eax, 0x20
jbe 0x406e9b
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x407b89
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov dword [ebp - 0x56e], 0
mov dword [ebp - 0x56a], 0
cmp dword [ebp - 0x56e], 0x20
jae 0x406f25
imul ecx, dword [ebp - 0x56e], 0x10
mov eax, dword [ebp + ecx - 0x76a]
sub eax, dword [ebp + ecx - 0x76e]
test eax, eax
je 0x406f25
add dword [ebp - 0x56a], eax
inc dword [ebp - 0x56e]
jmp 0x406ef5
mov eax, dword [ebp - 0x56a]
add eax, 0xfff
and eax, 0xfffff000
shr eax, 0xc
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x4c8]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0x56e], 0
mov dword [ebp - 0x566], 0
cmp dword [ebp - 0x56e], 0x20
jae 0x407a3f
imul ecx, dword [ebp - 0x56e], 0x10
mov eax, dword [ebp + ecx - 0x76a]
sub eax, dword [ebp + ecx - 0x76e]
test eax, eax
je 0x407a3f
mov eax, dword [ebp + ecx - 0x76e]
mov dword [ebp - 0x562], eax
mov eax, dword [ebp + ecx - 0x76a]
mov dword [ebp - 0x55e], eax
mov eax, dword [ebp + ecx - 0x766]
mov dword [ebp - 0x55a], eax
mov dword [ebp - 0x1894], 0x23108
mov eax, dword [ebp - 0x562]
mov ecx, dword [ebp - 0x55e]
cmp eax, 0
jne 0x407006
cmp ecx, 0xfe000
jne 0x407006
mov ecx, 0x100000
add eax, dword [ebp - 0x55a]
add ecx, dword [ebp - 0x55a]
dec ecx
mov byte [ebp - 0x1890], ah
mov byte [ebp - 0x188f], al
shr eax, 0x10
mov byte [ebp - 0x1891], al
mov byte [ebp - 0x188d], ch
mov byte [ebp - 0x188c], cl
shr ecx, 0x10
mov byte [ebp - 0x188e], cl
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x266]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x40704f
lea edx, [ebp - 0x1894]
push edx
push 9
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x40709d
cmp eax, 0xffffffff
jne 0x4070ac
mov dword [ebp - 0x28b8], 1
jmp 0x407155
cmp byte [ebp - 0x28b4], 0
jne 0x407155
cmp byte [ebp - 0x28b3], 0x3f
jb 0x407155
cmp byte [ebp - 0x28b2], 0x71
je 0x407155
cmp byte [ebp - 0x28b4], 0x3f
jae 0x407155
cmp byte [ebp - 0x28b3], 0x71
je 0x407155
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407137
xor eax, eax
jmp 0x407141
cmp eax, 0x20
jbe 0x407141
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x4072c2
push 0x23302
lea eax, [ebp - 0x28b4]
push esp
push 3
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x40718f
cmp eax, 0xffffffff
jne 0x40719e
mov dword [ebp - 0x28b8], 1
jmp 0x4072c2
cmp byte [ebp - 0x28b4], 0
jne 0x4071c2
cmp byte [ebp - 0x28b3], 0x3f
jb 0x4071c2
cmp byte [ebp - 0x28b2], 0x7f
jne 0x4071c2
cmp byte [ebp - 0x28b0], 0xfb
je 0x4071dd
cmp byte [ebp - 0x28b4], 0x3f
jae 0x407219
cmp byte [ebp - 0x28b3], 0x7f
jne 0x407219
cmp byte [ebp - 0x28b1], 0xfb
jne 0x407219
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x1fc]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x4071ef
jmp 0x407162
cmp byte [ebp - 0x28b4], 0
jne 0x4072c2
cmp byte [ebp - 0x28b3], 0x3f
jb 0x4072c2
cmp byte [ebp - 0x28b2], 0x73
je 0x4072c2
cmp byte [ebp - 0x28b4], 0x3f
jae 0x4072c2
cmp byte [ebp - 0x28b3], 0x73
je 0x4072c2
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4072a4
xor eax, eax
jmp 0x4072ae
cmp eax, 0x20
jbe 0x4072ae
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x407460
mov dword [ebp - 0x1894], 0x3408
mov eax, dword [ebp - 0x562]
mov ecx, dword [ebp - 0x55e]
sub ecx, eax
add eax, dword [ebp - 0x55a]
mov byte [ebp - 0x1891], ah
mov byte [ebp - 0x1890], al
shr eax, 0x10
mov byte [ebp - 0x1892], al
mov byte [ebp - 0x188d], ch
mov byte [ebp - 0x188c], cl
shr ecx, 0x10
mov byte [ebp - 0x188f], ch
mov byte [ebp - 0x188e], cl
push 8
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea edx, [ebp - 0x1894]
push edx
push 9
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x407353
cmp eax, 0xffffffff
jne 0x407362
mov dword [ebp - 0x28b8], 1
jmp 0x407460
cmp byte [ebp - 0x28b4], 0
jne 0x40740d
cmp byte [ebp - 0x28b3], 0x3f
jb 0x40740d
cmp byte [ebp - 0x28b2], 0x74
je 0x40740d
cmp byte [ebp - 0x28b4], 0x3f
jae 0x40740d
cmp byte [ebp - 0x28b3], 0x74
je 0x40740d
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4073ed
xor eax, eax
jmp 0x4073f7
cmp eax, 0x20
jbe 0x4073f7
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x407460
cmp byte [ebp - 0x28b4], 0
jne 0x40743c
mov ecx, 3
xor edx, edx
cmp ecx, 7
jae 0x407433
cmp ecx, eax
jae 0x407433
shl edx, 8
mov dl, byte [ebp + ecx - 0x28b4]
inc ecx
jmp 0x40741d
dec edx
mov dword [ebp - 0x300], edx
jmp 0x407460
mov ecx, 2
xor edx, edx
cmp ecx, 6
jae 0x407459
cmp ecx, eax
jae 0x407459
shl edx, 8
mov dl, byte [ebp + ecx - 0x28b4]
inc ecx
jmp 0x407443
dec edx
mov dword [ebp - 0x300], edx
cmp dword [ebp - 0x28b8], 0
jne 0x407a3f
mov eax, dword [ebp - 0x562]
mov ecx, dword [ebp - 0x55e]
cmp eax, ecx
jae 0x40761e
sub ecx, eax
cmp ecx, dword [ebp - 0x300]
jbe 0x407491
mov ecx, dword [ebp - 0x300]
mov dword [ebp - 0x552], ecx
add eax, dword [esi + 0x20]
inc ecx
cmp ecx, 0x3f
jae 0x4074ca
mov byte [ebp - 0x1894], cl
mov byte [ebp - 0x1893], 0x36
push ecx
push eax
lea edx, [ebp - 0x1892]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov ecx, dword [ebp - 0x552]
lea ecx, [ecx + 2]
jmp 0x4074f9
mov byte [ebp - 0x1894], 0
mov byte [ebp - 0x1893], cl
mov byte [ebp - 0x1892], 0x36
push ecx
push eax
lea edx, [ebp - 0x1891]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov ecx, dword [ebp - 0x552]
lea ecx, [ecx + 3]
pushal
push 0x14
call dword [sym.imp.KERNEL32.DLL_Sleep]
popal
lea edx, [ebp - 0x1894]
push edx
push ecx
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x407530
cmp eax, 0xffffffff
jne 0x40753f
mov dword [ebp - 0x28b8], 1
jmp 0x407619
cmp byte [ebp - 0x28b4], 0
jne 0x4075ea
cmp byte [ebp - 0x28b3], 0x3f
jb 0x4075ea
cmp byte [ebp - 0x28b2], 0x76
je 0x4075ea
cmp byte [ebp - 0x28b4], 0x3f
jae 0x4075ea
cmp byte [ebp - 0x28b3], 0x76
je 0x4075ea
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4075ca
xor eax, eax
jmp 0x4075d4
cmp eax, 0x20
jbe 0x4075d4
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x407619
mov eax, dword [ebp - 0x562]
and eax, 0xfffff000
cmp eax, dword [ebp - 0x566]
je 0x407608
mov dword [ebp - 0x566], eax
call fcn.0040831d
mov eax, dword [ebp - 0x552]
add dword [ebp - 0x562], eax
jmp 0x40746d
jmp 0x407a3f
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0xde]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x407630
push 0x3701
lea eax, [ebp - 0x28b4]
push esp
push 2
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x40767d
cmp eax, 0xffffffff
jne 0x40768c
mov dword [ebp - 0x28b8], 1
jmp 0x407735
cmp byte [ebp - 0x28b4], 0
jne 0x407735
cmp byte [ebp - 0x28b3], 0x3f
jb 0x407735
cmp byte [ebp - 0x28b2], 0x77
je 0x407735
cmp byte [ebp - 0x28b4], 0x3f
jae 0x407735
cmp byte [ebp - 0x28b3], 0x77
je 0x407735
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407717
xor eax, eax
jmp 0x407721
cmp eax, 0x20
jbe 0x407721
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x4078cc
mov dword [ebp - 0x1894], 0x1310a
imul edx, dword [ebp - 0x56e], 0x10
mov eax, dword [ebp + edx - 0x76e]
mov dword [ebp - 0x562], eax
mov ecx, dword [ebp + edx - 0x76a]
mov dword [ebp - 0x55e], ecx
add eax, dword [ebp + edx - 0x766]
add ecx, dword [ebp + edx - 0x766]
dec ecx
mov byte [ebp - 0x1890], ah
mov byte [ebp - 0x188f], al
shr eax, 0x10
mov byte [ebp - 0x1891], al
mov byte [ebp - 0x188d], ch
mov byte [ebp - 0x188c], cl
shr ecx, 0x10
mov byte [ebp - 0x188e], cl
xor ecx, ecx
mov dword [ebp - 0x2dc], ecx
mov ecx, dword [ebp - 0x562]
mov edx, dword [esi + 0x20]
cmp ecx, dword [ebp - 0x55e]
jae 0x4077cc
movzx eax, byte [edx + ecx]
add dword [ebp - 0x2dc], eax
inc ecx
jmp 0x4077b7
mov eax, dword [ebp - 0x2dc]
mov byte [ebp - 0x188b], ah
mov byte [ebp - 0x188a], al
push 4
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea edx, [ebp - 0x1894]
push edx
push 0xb
lea edx, [ebp - 0x28b4]
push edx
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x407814
cmp eax, 0xffffffff
jne 0x407823
mov dword [ebp - 0x28b8], 1
jmp 0x4078cc
cmp byte [ebp - 0x28b4], 0
jne 0x4078cc
cmp byte [ebp - 0x28b3], 0x3f
jb 0x4078cc
cmp byte [ebp - 0x28b2], 0x71
je 0x4078cc
cmp byte [ebp - 0x28b4], 0x3f
jae 0x4078cc
cmp byte [ebp - 0x28b3], 0x71
je 0x4078cc
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4078ae
xor eax, eax
jmp 0x4078b8
cmp eax, 0x20
jbe 0x4078b8
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
cmp dword [ebp - 0x28b8], 0
jne 0x407a3f
push 3
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x13302
lea eax, [ebp - 0x28b4]
push esp
push 3
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x40790e
cmp eax, 0xffffffff
jne 0x40791d
mov dword [ebp - 0x28b8], 1
jmp 0x407a3f
cmp byte [ebp - 0x28b4], 0
jne 0x407941
cmp byte [ebp - 0x28b3], 0x3f
jb 0x407941
cmp byte [ebp - 0x28b2], 0x7f
jne 0x407941
cmp byte [ebp - 0x28b0], 0x23
je 0x40795c
cmp byte [ebp - 0x28b4], 0x3f
jae 0x407995
cmp byte [ebp - 0x28b3], 0x7f
jne 0x407995
cmp byte [ebp - 0x28b1], 0x23
jne 0x407995
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x14]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x40796b
jmp 0x4078e1
cmp byte [ebp - 0x28b4], 0
jne 0x4079b0
cmp byte [ebp - 0x28b3], 0x3f
jb 0x4079b0
cmp byte [ebp - 0x28b2], 0x73
jne 0x4079c2
cmp byte [ebp - 0x28b4], 0x3f
jae 0x407a34
cmp byte [ebp - 0x28b3], 0x73
je 0x407a34
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407a14
xor eax, eax
jmp 0x407a1e
cmp eax, 0x20
jbe 0x407a1e
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x407a3f
inc dword [ebp - 0x56e]
jmp 0x406f8d
cmp dword [ebp - 0x28b8], 0
jne 0x407b89
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x3f]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x407a5b
push 0x11102
lea eax, [ebp - 0x28b4]
push esp
push 3
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x407aa8
cmp eax, 0xffffffff
jne 0x407ab7
mov dword [ebp - 0x28b8], 1
jmp 0x407b89
cmp byte [ebp - 0x28b4], 0
jne 0x407b62
cmp byte [ebp - 0x28b3], 0x3f
jb 0x407b62
cmp byte [ebp - 0x28b2], 0x51
je 0x407b62
cmp byte [ebp - 0x28b4], 0x3f
jae 0x407b62
cmp byte [ebp - 0x28b3], 0x51
je 0x407b62
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407b42
xor eax, eax
jmp 0x407b4c
cmp eax, 0x20
jbe 0x407b4c
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x407b89
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x18
jne 0x407bbf
cmp dword [ebp - 0x28b8], 0
jne 0x407bbf
push 0
push 0xa0d2443
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
je 0x407bd3
cmp eax, 0x18
jne 0x407cc5
cmp dword [ebp - 0x28b8], 0
jne 0x407cc5
push 0x811002
lea eax, [ebp - 0x28b4]
push esp
push 3
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x407c0d
cmp eax, 0xffffffff
jne 0x407c1c
mov dword [ebp - 0x28b8], 1
jmp 0x407cc5
cmp byte [ebp - 0x28b4], 0
jne 0x407cc5
cmp byte [ebp - 0x28b3], 0x3f
jb 0x407cc5
cmp byte [ebp - 0x28b2], 0x50
je 0x407cc5
cmp byte [ebp - 0x28b4], 0x3f
jae 0x407cc5
cmp byte [ebp - 0x28b3], 0x50
je 0x407cc5
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407ca7
xor eax, eax
jmp 0x407cb1
cmp eax, 0x20
jbe 0x407cb1
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x407f1b
cmp dword [ebp - 0x28b8], 0
jne 0x407f1b
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x3c]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x407cf0
push 0x8021903
lea eax, [ebp - 0x28b4]
push esp
push 4
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x407d3d
cmp eax, 0xffffffff
jne 0x407d4c
mov dword [ebp - 0x28b8], 1
jmp 0x407f1b
cmp byte [ebp - 0x28b4], 0
jne 0x407dfe
cmp byte [ebp - 0x28b3], 0x3f
jb 0x407dfe
cmp byte [ebp - 0x28b2], 0x59
je 0x407dfe
cmp byte [ebp - 0x28b4], 0x3f
jae 0x407dfe
cmp byte [ebp - 0x28b3], 0x59
je 0x407dfe
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407ddb
xor eax, eax
jmp 0x407de5
cmp eax, 0x20
jbe 0x407de5
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x407f1b
cmp byte [ebp - 0x28b4], 0
jne 0x407e16
movzx eax, byte [ebp - 0x28b3]
lea ecx, [ebp - 0x28af]
jmp 0x407e23
movzx eax, byte [ebp - 0x28b4]
lea ecx, [ebp - 0x28b0]
shr eax, 2
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2e0], ecx
push 0
push 0xa0d6425
push 0x203a2454
push 0x4e554f43
push 0x5f435444
push 0x24202445
push 0x4d495424
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
mov dword [ebp - 0x2f4], 0
mov ecx, dword [ebp - 0x2f4]
cmp ecx, dword [ebp - 0x2f8]
jae 0x407f1b
shl ecx, 2
add ecx, dword [ebp - 0x2e0]
movzx eax, byte [ecx]
mov dword [ebp - 0x2f0], eax
movzx eax, byte [ecx + 1]
mov dword [ebp - 0x2ec], eax
movzx eax, byte [ecx + 2]
mov dword [ebp - 0x2e8], eax
movzx eax, byte [ecx + 3]
mov dword [ebp - 0x2e4], eax
push 0xa
push 0xd58322e
push 0x252d5832
push 0x2e252d58
push 0x322e2558
push 0x322e2550
push dword [ebp - 0x2e4]
push dword [ebp - 0x2e8]
push dword [ebp - 0x2ec]
push dword [ebp - 0x2f0]
lea eax, [esp + 0x10]
push eax
lea edx, [ebp - 0x2db8]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x2db8]
push edx
call dword [ebx + 0x30]
inc dword [ebp - 0x2f4]
jmp 0x407e7c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x18
jne 0x408072
cmp dword [ebp - 0x28b8], 0
jne 0x408072
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [eax + 0x42]
mov dword [ebp - 0x29c4], eax
lea edx, [ebp - 0x28b4]
push edx
push 0x14
push 4
push 0
call fcn.004084fc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, dword [ebp - 0x29c4]
jl 0x407f46
push 0x8021903
lea eax, [ebp - 0x28b4]
push esp
push 4
push eax
push 0x1f4
push 0xdac
push 0
push 4
push 0
call fcn.0040836c
test eax, eax
je 0x407f93
cmp eax, 0xffffffff
jne 0x407fa2
mov dword [ebp - 0x28b8], 1
jmp 0x408072
cmp byte [ebp - 0x28b4], 0
jne 0x40804d
cmp byte [ebp - 0x28b3], 0x3f
jb 0x40804d
cmp byte [ebp - 0x28b2], 0x54
je 0x40804d
cmp byte [ebp - 0x28b4], 0x3f
jae 0x40804d
cmp byte [ebp - 0x28b3], 0x54
je 0x40804d
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x28b4]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40802d
xor eax, eax
jmp 0x408037
cmp eax, 0x20
jbe 0x408037
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.0040854d
mov dword [ebp - 0x28b8], 1
jmp 0x408072
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0
mov eax, esp
push 0
push eax
push 2
call dword [edi]
add esp, 4
push 0
push 0
push 3
call dword [edi]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xd
jne 0x4081d0
mov dword [ebp - 0x2d8], 0
push 0x120000
push dword [esi + 0x14]
push dword [esi + 0x20]
call fcn.00408729
cmp eax, 3
je 0x408159
test eax, eax
je 0x4080d8
mov dword [ebp - 0x2d8], 1
push 0
push dword [esi + 0x14]
push dword [esi + 0x20]
call fcn.00408729
cmp eax, 3
je 0x408159
test eax, eax
je 0x4080f8
mov dword [ebp - 0x2d8], 1
push 0x40000
push dword [esi + 0x14]
push dword [esi + 0x20]
call fcn.00408729
cmp eax, 3
jne 0x40811d
push 0xa0000
push dword [esi + 0x14]
push dword [esi + 0x20]
call fcn.00408729
cmp eax, 3
je 0x408159
test eax, eax
je 0x408130
mov dword [ebp - 0x2d8], 1
push 0xc0000
push dword [esi + 0x14]
push dword [esi + 0x20]
call fcn.00408729
cmp eax, 3
je 0x408159
test eax, eax
je 0x408153
mov dword [ebp - 0x2d8], 1
mov eax, dword [ebp - 0x2d8]
test eax, eax
jne 0x40817f
push 0xa0d
push 0x2444494c
push 0x41565f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x14
jmp 0x4081d0
cmp eax, 1
jne 0x4081ab
push 0xa0d
push 0x24444554
push 0x43455252
push 0x4f435f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x4081d0
push 0xa0d
push 0x24444e55
push 0x4f465f54
push 0x4f4e5f4d
push 0x55534b43
push 0x45484324
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0
push 0
push 3
call dword [edi]
cmp dword [ebx + 0x7ac], 0
je 0x4082f7
push 0x3e6c
push 0x6d74682f
push 0x3c3e7964
push 0x6f622f3c
push esp
call dword [ebx + 0x34]
add esp, 0x10
cmp dword [ebx + 0x7ac], 0
je 0x40821f
push dword [ebx + 0x7ac]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebx + 0x7ac], 0
push 0x7a672e
lea edx, [ebx + 0x6a8]
push edx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push esp
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 4
lea edx, [ebp - 0x20c]
push edx
lea edx, [ebx + 0x6a8]
push edx
call dword [ebx + 0x44]
test eax, eax
je 0x4082f7
lea edx, [ebx + 0x6a8]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea edx, [ebp - 0x20c]
push edx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.shlwapi.dll_PathStripPathA]
push 0x6d6f
push 0x632e7572
push 0x2e636d6d
mov dword [ebp - 4], esp
push 0
push 0x7068702e
push 0x74736574
push 0x5f6e6163
push 0x5f373163
push 0x64655f6f
push 0x7375665f
push 0x69687369
push 0x62757374
push 0x696d2f74
push 0x7365742f
lea edx, [ebp - 0x108]
push edx
lea edx, [ebp - 0x20c]
push edx
lea edx, [esp + 8]
push edx
push dword [ebp - 4]
call fcn.0040af2b
add esp, 0x2c
add esp, 0xc
push 0
push esp
push 0x1000001
push 0x40b
push dword [ebx + 0x4c4]
call dword [sym.imp.USER32.DLL_SendMessageW]
add esp, 4
push 0
call dword [ebx + 0x40]
pop edi
leave
ret 8