Function at 0x4021e4
Capabilities:
Delete file
Extract resource via kernel32 functions
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4440
push edi
lea edi, [ebp - 0x4440]
push 1
call dword [ebx + 0x44]
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0xe
je 0x40220d
call dword [ebx + 0x3c]
cmp eax, 1
jne 0x407e04
mov dword [edi], 0
mov ecx, dword [ebx + 0x15c]
add ecx, dword [ebx + 0x74]
lea eax, [ecx + 0x108]
mov ecx, dword [ecx]
cmp ecx, 3
jne 0x40238a
push eax
push edi
call fcn.004082fa
cmp eax, 1
jne 0x402241
mov dword [edi], 0x4086fb
jmp 0x402272
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x5a494c41
push 0x4954494e
push 0x495f4f54
push 0x5f44454c
push 0x49414624
push esp
call dword [ebx + 0x30]
add esp, 0x24
cmp dword [edi], 0
je 0x402388
push 0xa
push 0xd732520
push 0x5d24454d
push 0x414e5f52
push 0x45545041
push 0x4441245b
mov ecx, dword [ebx + 0x15c]
add ecx, dword [ebx + 0x74]
lea edx, [ecx + 4]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
add esp, 0x18
lea edx, [edi + 0x38]
push edx
push 0
call dword [edi + 4]
cmp eax, 0
jne 0x402388
lea edx, [ebp - 0x41e0]
push edx
lea edx, [ebp - 0x4230]
push edx
lea edx, [ebp - 0x4280]
push edx
push dword [edi + 0x38]
call dword [edi + 0x30]
cmp eax, 0
jne 0x402388
push 0xa
push 0xd732520
push 0x5d244552
push 0x41574d52
push 0x49465f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x4280]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
add esp, 0x1c
push 0
push 0xa0d7325
push 0x205d244c
push 0x4c445f52
push 0x45545041
push 0x4441245b
lea edx, [ebp - 0x4230]
push edx
lea edx, [esp + 4]
push edx
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x4023ca
push 0
push 0xa0d2452
push 0x45545041
push 0x44415f45
push 0x48545f59
push 0x425f4445
push 0x54524f50
push 0x5055535f
push 0x544f4e5f
push 0x53495f4c
push 0x4f434f54
push 0x4f525024
push esp
call dword [ebx + 0x30]
add esp, 0x30
cmp dword [edi], 0
je 0x407e04
mov dword [ebp - 0x3f94], 0
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
lea edx, [ecx + 2]
push edx
push eax
lea edx, [ebp - 0x4190]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov dword [ebp - 0x3e88], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x2b
je 0x40242b
cmp eax, 0x22
je 0x40242b
cmp eax, 0x14
je 0x40242b
cmp eax, 0x15
je 0x40242b
cmp eax, 0xa
je 0x40242b
cmp eax, 0xb
jne 0x402547
mov byte [ebp - 0x2e60], 0x29
mov byte [ebp - 0x2e5f], 2
push 0xfa
lea edx, [ebp - 0x4096]
push edx
push 2
lea edx, [ebp - 0x2e60]
push edx
call dword [ebx + 0x40]
cmp eax, 8
je 0x4024aa
push 0
push 0xa0d3331
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x45242024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x3e88], 1
jmp 0x402547
push 0x6d6f
push 0x632e7572
push 0x2e636d6d
mov dword [ebp - 0x2e54], esp
push 0
push 0x7068702e
push 0x74736574
push 0x5f6e6163
push 0x5f6b3633
push 0x35315f30
push 0x35347463
push 0x645f6d63
push 0x745f6472
push 0x6f662f74
push 0x7365742f
lea edx, [ebp - 0x2e5c]
push edx
lea edx, [ebp - 0x4096]
push edx
lea edx, [esp + 8]
push edx
push dword [ebp - 0x2e54]
call fcn.00409a45
mov dword [ebp - 0x3e88], eax
add esp, 0x2c
add esp, 0xc
test eax, eax
jne 0x402547
mov byte [ebp - 0x2e5e], 0x2a
mov byte [ebp - 0x2e5d], 0xa
push 0xfa
lea edx, [ebp - 0x4096]
push edx
push 0xa
lea edx, [ebp - 0x2e5e]
push edx
call dword [ebx + 0x40]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x2b
je 0x402565
cmp eax, 0x22
je 0x402565
cmp eax, 0x14
je 0x402565
cmp eax, 0x15
jne 0x405796
mov dword [ebp - 0x2e40], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x15
jne 0x40292b
cmp dword [ebp - 0x3e88], 0
jne 0x40292b
push 0x200
push 0
lea edx, [ebp - 0x2e38]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
cmp dword [esi + 0x270], 0x726f6624
jne 0x4025f6
cmp dword [esi + 0x274], 0x5f323764
jne 0x4025f6
cmp dword [esi + 0x278], 0x43442431
jne 0x4025f6
cmp dword [esi + 0x27c], 0x30353454
jne 0x4025f6
cmp dword [esi + 0x280], 0x3335315b
jne 0x4025f6
cmp dword [esi + 0x284], 0x205d6b36
jne 0x4025f6
cmp dword [esi + 0x288], 0x4e4143
je 0x402660
cmp dword [esi + 0x270], 0x726f6624
jne 0x402674
cmp dword [esi + 0x274], 0x5f323764
jne 0x402674
cmp dword [esi + 0x278], 0x54282431
jne 0x402674
cmp dword [esi + 0x27c], 0x29545345
jne 0x402674
cmp dword [esi + 0x280], 0x34544344
jne 0x402674
cmp dword [esi + 0x284], 0x315b3035
jne 0x402674
cmp dword [esi + 0x288], 0x6b363335
jne 0x402674
cmp dword [esi + 0x28c], 0x4143205d
jne 0x402674
cmp word [esi + 0x290], 0x4e
jne 0x402674
mov dword [ebp - 0x2e38], 0
mov dword [ebp - 0x2e34], 0x2000
mov dword [ebp - 0x2e50], 0
mov dword [ebp - 0x2e4c], 0
mov dword [ebp - 0x2e48], 0
cmp dword [ebp - 0x2e50], 0x20
jae 0x4026da
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0x2e34]
sub eax, dword [ebp + ecx - 0x2e38]
test eax, eax
je 0x4026da
shr eax, 2
add dword [ebp - 0x2e4c], eax
mov eax, dword [ebp + ecx - 0x2e34]
cmp dword [ebp - 0x2e48], eax
jae 0x4026d2
mov dword [ebp - 0x2e48], eax
inc dword [ebp - 0x2e50]
jmp 0x402692
mov eax, dword [ebp - 0x2e4c]
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x4c
push 0
lea edx, [ebp - 0x2c38]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
push 0
mov dword [ebp - 0x2ae8], esp
push 0x6e6962
mov dword [ebp - 0x2ae4], esp
push 0
push 0x2a2e2a
push 0x73656c
push 0x6966206c
push 0x6c41006e
push 0x69622e2a
push 0x656c69
push 0x66207972
push 0x616e6942
mov dword [ebp - 0x2ae0], esp
mov dword [ebp - 0x2c38], 0x4c
mov eax, dword [ebx + 0x8ac]
mov dword [ebp - 0x2c34], eax
mov dword [ebp - 0x2c20], 1
mov eax, dword [ebp - 0x2ae0]
mov dword [ebp - 0x2c2c], eax
lea eax, [ebp - 0x2bec]
mov dword [ebp - 0x2c1c], eax
mov dword [ebp - 0x2c18], 0x104
mov eax, dword [ebp - 0x2ae8]
mov dword [ebp - 0x2c0c], eax
mov dword [ebp - 0x2c08], eax
mov eax, dword [ebp - 0x2ae4]
mov dword [ebp - 0x2bfc], eax
mov dword [ebp - 0x2c04], 0x1800
lea edx, [ebp - 0x2c38]
push edx
call dword [sym.imp.COMDLG32.DLL_GetOpenFileNameA]
add esp, 0x24
add esp, 4
add esp, 4
test eax, eax
jne 0x40280b
mov dword [ebp - 0x3e88], 1
jmp 0x40292b
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x2bec]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
jne 0x40287d
lea eax, [ebp - 0x2bec]
push 0xa0d
push 0x7325203a
push 0x24454c49
push 0x465f474e
push 0x494e4550
push 0x4f5f524f
push 0x52524524
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
jmp 0x40292b
mov dword [ebp - 0x2e44], eax
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, dword [ebp - 0x2e48]
je 0x4028ef
push 0xa
push 0xd245345
push 0x54594224
push 0x20642520
push 0x3a244542
push 0x5f545355
push 0x4d5f455a
push 0x49535f45
push 0x4c494624
push dword [ebp - 0x2e48]
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
mov dword [ebp - 0x3e88], 1
jmp 0x40291f
push dword [ebp - 0x2e48]
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [ebp - 0x2e40], eax
push 0
lea edx, [ebp - 0x2e3c]
push edx
push dword [ebp - 0x2e48]
push eax
push dword [ebp - 0x2e44]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp - 0x2e44]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x3e88], 0
jne 0x405796
push 0x7a120
push 0x800
push 6
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x402966
mov dword [ebp - 0x3e88], 1
jmp 0x405796
push 1
push 0x8000
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x402993
mov dword [ebp - 0x3e88], 1
jmp 0x405780
push 0x24
push 0x474e494e
push 0x52415724
mov dword [ebp - 0x2adc], esp
push 0x244e4f
push 0x5f4e4548
push 0x545f444e
push 0x415f4646
push 0x4f5f4e4f
push 0x4954494e
push 0x47495f4e
push 0x52555424
mov dword [ebp - 0x2ad8], esp
push 0
push 0xa0d2446
push 0x464f5f4e
push 0x4f495449
push 0x4e47495f
push 0x4e525554
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
lea eax, [ebp - 0x4384]
push eax
push dword [ebp - 0x2adc]
push dword [ebx + 0x184]
call dword [ebx + 0x2c]
lea eax, [ebp - 0x2ad0]
push eax
push dword [ebp - 0x2ad8]
push dword [ebx + 0x184]
call dword [ebx + 0x2c]
lea eax, [ebp - 0x4384]
lea ecx, [ebp - 0x2ad0]
push 0x40000
push eax
push ecx
push dword [ebx + 0x8ac]
call dword [sym.imp.USER32.DLL_MessageBoxW]
add esp, 0x20
add esp, 0xc
mov dword [ebp - 0x3f90], 0x284
push 0x8410
push 0x48060000
push esp
push 6
push 0x14
push 0x40
push 6
push 0
call fcn.00407ff4
cmp eax, 0xffffffff
jne 0x402a85
mov dword [ebp - 0x3e88], 1
jmp 0x402aa1
test dword [ebp - 0x3f90], 3
jne 0x402a99
push 0xf
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x3f90]
jne 0x402a5a
cmp dword [ebp - 0x3e88], 0
jne 0x405780
push 0x48060000
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0x49060000
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xffffffffffffffff
push 0
push 4
push 0
push 0x40
push 0
push 6
push 3
push 0
push 0
mov eax, esp
push 0
push eax
push 4
call dword [edi]
add esp, 0x60
cmp eax, 0xffffffff
jne 0x402b04
mov dword [ebp - 0x3e88], 1
jmp 0x405780
push 0
push 0
lea edx, [esp + 4]
push edx
push 0xa
call dword [edi]
push 0
lea edx, [esp + 4]
push edx
push 0xb
call dword [edi]
add esp, 4
push 0x6e
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x8410
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x402b59
cmp eax, 0xffffffff
jne 0x402b68
mov dword [ebp - 0x3e88], 1
jmp 0x402beb
cmp byte [ebp - 0x3e80], 0x50
je 0x402beb
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x402bcd
xor eax, eax
jmp 0x402bd7
cmp eax, 0x20
jbe 0x402bd7
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x402d1f
push 0xf
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xff10
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x402c32
cmp eax, 0xffffffff
jne 0x402c41
mov dword [ebp - 0x3e88], 1
jmp 0x402d1f
cmp byte [ebp - 0x3e80], 0x7f
jne 0x402d1f
cmp byte [ebp - 0x3e7e], 0x12
jne 0x402d1f
push 0x8410
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x402c8d
cmp eax, 0xffffffff
jne 0x402c9c
mov dword [ebp - 0x3e88], 1
jmp 0x402d1f
cmp byte [ebp - 0x3e80], 0x50
je 0x402d1f
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x402d01
xor eax, eax
jmp 0x402d0b
cmp eax, 0x20
jbe 0x402d0b
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x402da1
push 0x8a1a
push 0x48060000
push esp
push 6
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407ff4
cmp eax, 0xffffffff
jne 0x402d56
mov dword [ebp - 0x3e88], 1
jmp 0x402da1
lea edx, [ebp - 0x3e84]
push edx
push 0x6e
push 3
push 0
call fcn.00408150
test eax, eax
je 0x402d71
cmp eax, 0xffffffff
jne 0x402d7d
mov dword [ebp - 0x3e88], 1
jmp 0x402da1
cmp byte [ebp - 0x3e80], 0x7f
jne 0x402d98
cmp byte [ebp - 0x3e7f], 0x1a
jne 0x402d56
cmp byte [ebp - 0x3e7e], 0x78
jmp 0x402da1
cmp byte [ebp - 0x3e80], 0x5a
jne 0x402d56
cmp dword [ebp - 0x3e88], 0
jne 0x402de6
push 0x8b1a
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x402ddc
cmp eax, 0xffffffff
jne 0x402de6
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x402f5f
mov dword [ebp - 0x3f90], 0x20
push 0xfa27
push 0x48060000
push esp
push 6
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407ff4
cmp eax, 0xffffffff
jne 0x402e2e
mov dword [ebp - 0x3e88], 1
jmp 0x402f5f
lea edx, [ebp - 0x3e84]
push edx
push 0x7d0
push 3
push 0
call fcn.00408150
test eax, eax
je 0x402e4c
cmp eax, 0xffffffff
jne 0x402e5b
mov dword [ebp - 0x3e88], 1
jmp 0x402f5f
cmp byte [ebp - 0x3e80], 0x7f
jne 0x402f52
cmp byte [ebp - 0x3e7f], 0x27
jne 0x402e2e
cmp byte [ebp - 0x3e7e], 0x78
je 0x402e2e
cmp byte [ebp - 0x3e7e], 0x36
jne 0x402e9c
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x3f90]
jne 0x402dfd
jmp 0x402ede
cmp byte [ebp - 0x3e7e], 0x37
jne 0x402ebe
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x3f90]
jne 0x402dfd
jmp 0x402ede
cmp byte [ebp - 0x3e7e], 0x22
jne 0x402ede
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x3f90]
jne 0x402dfd
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x402f32
xor eax, eax
jmp 0x402f3c
cmp eax, 0x20
jbe 0x402f3c
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x402f5f
cmp byte [ebp - 0x3e80], 0x67
jne 0x402e2e
cmp dword [ebp - 0x3e88], 0
jne 0x4030d9
mov byte [ebp - 0x28c8], 0x20
mov byte [ebp - 0x28c7], 0xf4
mov dword [ebp - 0x28c6], 1
mov eax, dword [ebp - 0x3e7e]
mov dword [ebp - 0x28c2], eax
push 0xfa
lea edx, [ebp - 0x4096]
push edx
push 0xf6
lea edx, [ebp - 0x28c8]
push edx
call dword [ebx + 0x40]
cmp eax, 4
je 0x403004
push 0
push 0xa0d3120
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202c24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x3e88], 1
jmp 0x4030d9
push 0
push 0xfb27
push 0x48060000
mov eax, dword [ebp - 0x4096]
mov dword [esp + 6], eax
push esp
push 0xa
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
add esp, 0xc
test eax, eax
jne 0x40304f
mov dword [ebp - 0x3e88], 1
jmp 0x4030d9
cmp eax, 0xffffffff
jne 0x403060
mov dword [ebp - 0x3e88], 1
jmp 0x4030d9
cmp byte [ebp - 0x3e80], 0x67
je 0x4030d9
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4030bb
xor eax, eax
jmp 0x4030c5
cmp eax, 0x20
jbe 0x4030c5
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x40319d
push 0x1fb31
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 7
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x403118
cmp eax, 0xffffffff
jne 0x403124
mov dword [ebp - 0x3e88], 1
jmp 0x40319d
cmp byte [ebp - 0x3e80], 0x71
je 0x40319d
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40317f
xor eax, eax
jmp 0x403189
cmp eax, 0x20
jbe 0x403189
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x4033b1
cmp dword [esi + 0x270], 0x726f6624
jne 0x4031fe
cmp dword [esi + 0x274], 0x5f323764
jne 0x4031fe
cmp dword [esi + 0x278], 0x43442431
jne 0x4031fe
cmp dword [esi + 0x27c], 0x30353454
jne 0x4031fe
cmp dword [esi + 0x280], 0x3335315b
jne 0x4031fe
cmp dword [esi + 0x284], 0x205d6b36
jne 0x4031fe
cmp dword [esi + 0x288], 0x4e4143
je 0x40326c
cmp dword [esi + 0x270], 0x726f6624
jne 0x403294
cmp dword [esi + 0x274], 0x5f323764
jne 0x403294
cmp dword [esi + 0x278], 0x54282431
jne 0x403294
cmp dword [esi + 0x27c], 0x29545345
jne 0x403294
cmp dword [esi + 0x280], 0x34544344
jne 0x403294
cmp dword [esi + 0x284], 0x315b3035
jne 0x403294
cmp dword [esi + 0x288], 0x6b363335
jne 0x403294
cmp dword [esi + 0x28c], 0x4143205d
jne 0x403294
cmp word [esi + 0x290], 0x4e
jne 0x403294
mov dword [ebp - 0x27d2], 0
mov dword [ebp - 0x27ce], 0xa38
mov dword [ebp - 0x27ca], 0xd4000000
mov dword [ebp - 0x27c6], 0x40a188
push 0
push 0
push 0x34
push 0x48060000
mov eax, dword [ebp - 0x27d2]
mov ecx, dword [ebp - 0x27ce]
sub ecx, eax
add eax, dword [ebp - 0x27ca]
mov byte [esp + 7], ah
mov byte [esp + 8], al
shr eax, 0x10
mov byte [esp + 5], ah
mov byte [esp + 6], al
mov byte [esp + 0xc], ch
mov byte [esp + 0xd], cl
shr ecx, 0x10
mov byte [esp + 0xa], ch
mov byte [esp + 0xb], cl
push esp
push 0xe
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
add esp, 0x10
test eax, eax
je 0x403304
cmp eax, 0xffffffff
jne 0x403313
mov dword [ebp - 0x3e88], 1
jmp 0x4033b1
cmp byte [ebp - 0x3e80], 0x74
je 0x40338e
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40336e
xor eax, eax
jmp 0x403378
cmp eax, 0x20
jbe 0x403378
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x4033b1
mov ecx, 5
xor edx, edx
cmp ecx, 9
jae 0x4033ab
cmp ecx, eax
jae 0x4033ab
shl edx, 8
mov dl, byte [ebp + ecx - 0x3e84]
inc ecx
jmp 0x403395
mov dword [ebp - 0x27c2], edx
cmp dword [ebp - 0x3e88], 0
jne 0x40363c
push 0xa0d24
push 0x544f4f42
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x10
mov eax, dword [ebp - 0x27ce]
sub eax, dword [ebp - 0x27d2]
mov ecx, dword [ebp - 0x27c2]
dec ecx
xor edx, edx
div ecx
test edx, edx
je 0x4033f5
inc eax
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0x27ba], 0x48060000
mov byte [ebp - 0x27b6], 0x36
mov eax, dword [ebp - 0x27d2]
mov ecx, dword [ebp - 0x27ce]
cmp eax, ecx
jae 0x403563
sub ecx, eax
mov edx, dword [ebp - 0x27c2]
dec edx
cmp ecx, edx
jbe 0x40346a
mov ecx, edx
mov dword [ebp - 0x27be], ecx
add eax, dword [ebp - 0x27c6]
push ecx
push eax
lea edx, [ebp - 0x27b5]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov ecx, dword [ebp - 0x27be]
lea edx, [ebp - 0x27ba]
push edx
lea edx, [ecx + 5]
push edx
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x4034be
cmp eax, 0xffffffff
jne 0x4034cd
mov dword [ebp - 0x3e88], 1
jmp 0x40355e
cmp byte [ebp - 0x3e80], 0x76
je 0x403548
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403528
xor eax, eax
jmp 0x403532
cmp eax, 0x20
jbe 0x403532
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x40355e
call fcn.00407f71
mov ecx, dword [ebp - 0x27be]
add dword [ebp - 0x27d2], ecx
jmp 0x403447
jmp 0x40363c
push 0x37
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 5
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x403592
cmp eax, 0xffffffff
jne 0x4035a1
mov dword [ebp - 0x3e88], 1
jmp 0x40363c
cmp byte [ebp - 0x3e80], 0x77
je 0x40361c
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4035fc
xor eax, eax
jmp 0x403606
cmp eax, 0x20
jbe 0x403606
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x40363c
push 0xa0d
push 0x244b4f5f
push 0x544f4f42
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x14
cmp dword [ebp - 0x3e88], 0
jne 0x403770
push 0xf
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xff10
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x403683
cmp eax, 0xffffffff
jne 0x403692
mov dword [ebp - 0x3e88], 1
jmp 0x403770
cmp byte [ebp - 0x3e80], 0x7f
jne 0x403770
cmp byte [ebp - 0x3e7e], 0x12
jne 0x403770
push 0x8410
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x4036de
cmp eax, 0xffffffff
jne 0x4036ed
mov dword [ebp - 0x3e88], 1
jmp 0x403770
cmp byte [ebp - 0x3e80], 0x50
je 0x403770
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403752
xor eax, eax
jmp 0x40375c
cmp eax, 0x20
jbe 0x40375c
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x4037f4
push 0x8a1a
push 0x48060000
push esp
push 6
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407ff4
cmp eax, 0xffffffff
jne 0x4037a7
mov dword [ebp - 0x3e88], 1
jmp 0x4037f4
lea edx, [ebp - 0x3e84]
push edx
push 0x6e
push 3
push 0
call fcn.00408150
test eax, eax
je 0x4037c2
cmp eax, 0xffffffff
jne 0x4037ce
mov dword [ebp - 0x3e88], 1
jmp 0x4037f4
cmp byte [ebp - 0x3e80], 0x7f
jne 0x4037eb
cmp byte [ebp - 0x3e7f], 0x1a
jne 0x4037a7
cmp byte [ebp - 0x3e7e], 0x78
je 0x4037a7
jmp 0x4037f4
cmp byte [ebp - 0x3e80], 0x5a
jne 0x4037a7
cmp dword [ebp - 0x3e88], 0
jne 0x403839
push 0x8b1a
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x40382f
cmp eax, 0xffffffff
jne 0x403839
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x4039fc
mov dword [ebp - 0x3f90], 0x20
push 0xfa27
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
jne 0x40388c
mov dword [ebp - 0x3e88], 1
jmp 0x4039fc
cmp eax, 0xffffffff
jne 0x4038a0
mov dword [ebp - 0x3e88], 1
jmp 0x4039fc
cmp byte [ebp - 0x3e80], 0x7f
jne 0x403981
cmp byte [ebp - 0x3e7e], 0x36
jne 0x4038cb
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x3f90]
jne 0x403850
jmp 0x40390d
cmp byte [ebp - 0x3e7e], 0x37
jne 0x4038ed
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x3f90]
jne 0x403850
jmp 0x40390d
cmp byte [ebp - 0x3e7e], 0x22
jne 0x40390d
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x3f90]
jne 0x403850
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403961
xor eax, eax
jmp 0x40396b
cmp eax, 0x20
jbe 0x40396b
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x4039fc
cmp byte [ebp - 0x3e80], 0x67
je 0x4039fc
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4039de
xor eax, eax
jmp 0x4039e8
cmp eax, 0x20
jbe 0x4039e8
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x403b76
mov byte [ebp - 0x28c8], 0x20
mov byte [ebp - 0x28c7], 0xf4
mov dword [ebp - 0x28c6], 1
mov eax, dword [ebp - 0x3e7e]
mov dword [ebp - 0x28c2], eax
push 0xfa
lea edx, [ebp - 0x4096]
push edx
push 0xf6
lea edx, [ebp - 0x28c8]
push edx
call dword [ebx + 0x40]
cmp eax, 4
je 0x403aa1
push 0
push 0xa0d3120
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202c24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x3e88], 1
jmp 0x403b76
push 0
push 0xfb27
push 0x48060000
mov eax, dword [ebp - 0x4096]
mov dword [esp + 6], eax
push esp
push 0xa
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
add esp, 0xc
test eax, eax
jne 0x403aec
mov dword [ebp - 0x3e88], 1
jmp 0x403b76
cmp eax, 0xffffffff
jne 0x403afd
mov dword [ebp - 0x3e88], 1
jmp 0x403b76
cmp byte [ebp - 0x3e80], 0x67
je 0x403b76
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403b58
xor eax, eax
jmp 0x403b62
cmp eax, 0x20
jbe 0x403b62
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x403c3a
push 0x1fb31
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 7
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x403bb5
cmp eax, 0xffffffff
jne 0x403bc1
mov dword [ebp - 0x3e88], 1
jmp 0x403c3a
cmp byte [ebp - 0x3e80], 0x71
je 0x403c3a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403c1c
xor eax, eax
jmp 0x403c26
cmp eax, 0x20
jbe 0x403c26
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x403d00
push 0
push 0xd438
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 9
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x403c7b
cmp eax, 0xffffffff
jne 0x403c87
mov dword [ebp - 0x3e88], 1
jmp 0x403d00
cmp byte [ebp - 0x3e80], 0x78
je 0x403d00
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403ce2
xor eax, eax
jmp 0x403cec
cmp eax, 0x20
jbe 0x403cec
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x403dc1
push 0x3e
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 5
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x403d3c
cmp eax, 0xffffffff
jne 0x403d48
mov dword [ebp - 0x3e88], 1
jmp 0x403dc1
cmp byte [ebp - 0x3e80], 0x7e
je 0x403dc1
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403da3
xor eax, eax
jmp 0x403dad
cmp eax, 0x20
jbe 0x403dad
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x403ed0
push 0x4a2
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 7
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x403e00
cmp eax, 0xffffffff
jne 0x403e0f
mov dword [ebp - 0x3e88], 1
jmp 0x403ed0
cmp byte [ebp - 0x3e80], 0xe2
je 0x403e8a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403e6a
xor eax, eax
jmp 0x403e74
cmp eax, 0x20
jbe 0x403e74
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x403ed0
mov eax, dword [ebp - 0x3e7d]
cmp eax, 0x8b02
je 0x403ed0
push 0xa0d24
push 0x45505954
push 0x5f554345
push 0x5f474e4f
push 0x52575f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x403f9e
push 0x6e
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0xa7
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 0xb
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x403f19
cmp eax, 0xffffffff
jne 0x403f25
mov dword [ebp - 0x3e88], 1
jmp 0x403f9e
cmp byte [ebp - 0x3e80], 0xe7
je 0x403f9e
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x403f80
xor eax, eax
jmp 0x403f8a
cmp eax, 0x20
jbe 0x403f8a
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x22
jne 0x40438c
cmp dword [ebp - 0x3e88], 0
jne 0x40438c
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [esi + 0x14]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x24], eax
push 0x200
push 0
lea edx, [ebp - 0x23a2]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
cmp dword [esi + 0x270], 0x726f6624
jne 0x40405f
cmp dword [esi + 0x274], 0x5f323764
jne 0x40405f
cmp dword [esi + 0x278], 0x43442431
jne 0x40405f
cmp dword [esi + 0x27c], 0x30353454
jne 0x40405f
cmp dword [esi + 0x280], 0x3335315b
jne 0x40405f
cmp dword [esi + 0x284], 0x205d6b36
jne 0x40405f
cmp dword [esi + 0x288], 0x4e4143
je 0x4040cd
cmp dword [esi + 0x270], 0x726f6624
jne 0x4040f5
cmp dword [esi + 0x274], 0x5f323764
jne 0x4040f5
cmp dword [esi + 0x278], 0x54282431
jne 0x4040f5
cmp dword [esi + 0x27c], 0x29545345
jne 0x4040f5
cmp dword [esi + 0x280], 0x34544344
jne 0x4040f5
cmp dword [esi + 0x284], 0x315b3035
jne 0x4040f5
cmp dword [esi + 0x288], 0x6b363335
jne 0x4040f5
cmp dword [esi + 0x28c], 0x4143205d
jne 0x4040f5
cmp word [esi + 0x290], 0x4e
jne 0x4040f5
mov dword [ebp - 0x23a2], 0
mov dword [ebp - 0x239e], esp
mov dword [ebp - 0x239a], 0xa0000000
mov dword [ebp - 0x2396], 0xff0
mov dword [ebp - 0x2e50], 0
mov dword [ebp - 0x23ba], 0
cmp dword [ebp - 0x2e50], 0x20
jae 0x404149
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0x239e]
sub eax, dword [ebp + ecx - 0x23a2]
test eax, eax
je 0x404149
mov ecx, dword [ebp + ecx - 0x2396]
xor edx, edx
div ecx
test edx, edx
je 0x40413b
inc eax
add dword [ebp - 0x23ba], eax
inc dword [ebp - 0x2e50]
jmp 0x404109
mov eax, dword [ebp - 0x23ba]
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0x2e50], 0
push 0xa00000
push 0xff0b3
push 0x48060000
cmp dword [ebp - 0x2e50], 0x20
jae 0x40434e
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0x23a2]
mov dword [ebp - 0x23b6], eax
mov eax, dword [ebp + ecx - 0x239e]
mov dword [ebp - 0x23b2], eax
sub eax, dword [ebp - 0x23b6]
test eax, eax
je 0x40434e
mov eax, dword [ebp + ecx - 0x239a]
mov dword [ebp - 0x23ae], eax
mov eax, dword [ebp + ecx - 0x2396]
mov dword [ebp - 0x23aa], eax
mov eax, dword [ebp - 0x23b6]
mov ecx, dword [ebp - 0x23b2]
cmp eax, ecx
jae 0x404343
sub ecx, eax
cmp ecx, dword [ebp - 0x23aa]
jbe 0x404223
mov ecx, dword [ebp - 0x23aa]
mov dword [ebp - 0x23a6], ecx
add eax, dword [ebp - 0x23ae]
mov byte [esp + 8], ah
mov byte [esp + 7], al
shr eax, 0x10
mov byte [esp + 0xa], ah
mov byte [esp + 9], al
mov byte [esp + 6], ch
mov byte [esp + 5], cl
push esp
push 0xb
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x404272
cmp eax, 0xffffffff
jne 0x404281
mov dword [ebp - 0x3e88], 1
jmp 0x404341
cmp byte [ebp - 0x3e80], 0xf3
je 0x4042fc
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4042dc
xor eax, eax
jmp 0x4042e6
cmp eax, 0x20
jbe 0x4042e6
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x404341
cmp dword [ebp - 0x23a6], 1
je 0x40430a
cmp eax, 6
je 0x40432b
mov eax, dword [ebp - 0x23a6]
mov ecx, dword [esi + 0x24]
add ecx, dword [ebp - 0x23b6]
push eax
lea edx, [ebp - 0x3e7f]
push edx
push ecx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
call fcn.00407f71
mov eax, dword [ebp - 0x23a6]
add dword [ebp - 0x23b6], eax
jmp 0x4041ff
jmp 0x40434e
inc dword [ebp - 0x2e50]
jmp 0x4041a9
add esp, 0xc
cmp dword [ebp - 0x3e88], 0
je 0x404365
lea edx, [esi + 0x24]
push edx
call fcn.004082d2
jmp 0x40438c
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x2b
jne 0x404a37
cmp dword [ebp - 0x3e88], 0
jne 0x404a37
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0x200
push 0
lea edx, [ebp - 0x2192]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
cmp dword [esi + 0x270], 0x726f6624
jne 0x40443c
cmp dword [esi + 0x274], 0x5f323764
jne 0x40443c
cmp dword [esi + 0x278], 0x43442431
jne 0x40443c
cmp dword [esi + 0x27c], 0x30353454
jne 0x40443c
cmp dword [esi + 0x280], 0x3335315b
jne 0x40443c
cmp dword [esi + 0x284], 0x205d6b36
jne 0x40443c
cmp dword [esi + 0x288], 0x4e4143
je 0x4044ca
cmp dword [esi + 0x270], 0x726f6624
jne 0x40465a
cmp dword [esi + 0x274], 0x5f323764
jne 0x40465a
cmp dword [esi + 0x278], 0x54282431
jne 0x40465a
cmp dword [esi + 0x27c], 0x29545345
jne 0x40465a
cmp dword [esi + 0x280], 0x34544344
jne 0x40465a
cmp dword [esi + 0x284], 0x315b3035
jne 0x40465a
cmp dword [esi + 0x288], 0x6b363335
jne 0x40465a
cmp dword [esi + 0x28c], 0x4143205d
jne 0x40465a
cmp word [esi + 0x290], 0x4e
jne 0x40465a
mov dword [ebp - 0x2192], 0x8000
mov dword [ebp - 0x218e], 0xc000
mov dword [ebp - 0x218a], 0xa0000000
mov dword [ebp - 0x2186], 0x800
mov dword [ebp - 0x2182], 0xc000
mov dword [ebp - 0x217e], 0x10000
mov dword [ebp - 0x217a], 0xa0000000
mov dword [ebp - 0x2176], 0x800
mov dword [ebp - 0x2172], 0x10000
mov dword [ebp - 0x216e], 0x14000
mov dword [ebp - 0x216a], 0xa0000000
mov dword [ebp - 0x2166], 0x800
mov dword [ebp - 0x2162], 0x14000
mov dword [ebp - 0x215e], 0x18000
mov dword [ebp - 0x215a], 0xa0000000
mov dword [ebp - 0x2156], 0x800
mov dword [ebp - 0x2152], 0x18000
mov dword [ebp - 0x214e], 0x1c000
mov dword [ebp - 0x214a], 0xa0000000
mov dword [ebp - 0x2146], 0x800
mov dword [ebp - 0x2142], 0x1c000
mov dword [ebp - 0x213e], 0x20000
mov dword [ebp - 0x213a], 0xa0000000
mov dword [ebp - 0x2136], 0x800
mov dword [ebp - 0x2132], 0x20000
mov dword [ebp - 0x212e], 0x40000
mov dword [ebp - 0x212a], 0xa0000000
mov dword [ebp - 0x2126], 0x800
mov dword [ebp - 0x2122], 0x40000
mov dword [ebp - 0x211e], 0x80000
mov dword [ebp - 0x211a], 0xa0000000
mov dword [ebp - 0x2116], 0x800
mov dword [ebp - 0x2112], 0x80000
mov dword [ebp - 0x210e], 0x100000
mov dword [ebp - 0x210a], 0xa0000000
mov dword [ebp - 0x2106], 0x800
mov dword [ebp - 0x2102], 0x100000
mov dword [ebp - 0x20fe], esp
mov dword [ebp - 0x20fa], 0xa0000000
mov dword [ebp - 0x20f6], 0x800
mov dword [ebp - 0x2e50], 0
mov dword [ebp - 0x2e4c], 0
cmp dword [ebp - 0x2e50], 0x20
jae 0x4046ae
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0x218e]
sub eax, dword [ebp + ecx - 0x2192]
test eax, eax
je 0x4046ae
mov ecx, dword [ebp + ecx - 0x2186]
xor edx, edx
div ecx
test edx, edx
je 0x4046a0
inc eax
add dword [ebp - 0x2e4c], eax
inc dword [ebp - 0x2e50]
jmp 0x40466e
mov eax, dword [ebp - 0x2e4c]
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [ebp - 0x2e50], 0
cmp dword [ebp - 0x2e50], 0x20
jae 0x404853
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0x2192]
mov dword [ebp - 0x21a2], eax
mov eax, dword [ebp + ecx - 0x218e]
mov dword [ebp - 0x219e], eax
sub eax, dword [ebp - 0x21a2]
test eax, eax
je 0x404853
mov eax, dword [ebp + ecx - 0x218a]
mov dword [ebp - 0x219a], eax
mov eax, dword [ebp + ecx - 0x2186]
mov dword [ebp - 0x2196], eax
push 0
push 0xb1
push 0x48060000
mov eax, dword [ebp - 0x21a2]
mov ecx, dword [ebp - 0x219e]
sub ecx, eax
add eax, dword [ebp - 0x219a]
mov byte [esp + 5], ch
shr ecx, 0x10
mov byte [esp + 6], cl
mov byte [esp + 7], al
mov byte [esp + 8], ah
shr eax, 0x10
mov byte [esp + 9], al
mov byte [esp + 0xa], ah
push esp
push 0xb
lea edx, [ebp - 0x3e84]
push edx
push 0xbb8
push 0x4e20
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x4047bb
cmp eax, 0xffffffff
jne 0x4047ca
mov dword [ebp - 0x3e88], 1
jmp 0x404850
cmp byte [ebp - 0x3e80], 0xf1
je 0x404845
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404825
xor eax, eax
jmp 0x40482f
cmp eax, 0x20
jbe 0x40482f
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x404850
inc dword [ebp - 0x2e50]
jmp 0x4046ff
add esp, 0xc
mov dword [ebp - 0x2e50], 0
cmp dword [ebp - 0x2e50], 0x20
jae 0x404a07
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0x2192]
mov dword [ebp - 0x21a2], eax
mov eax, dword [ebp + ecx - 0x218e]
mov dword [ebp - 0x219e], eax
sub eax, dword [ebp - 0x21a2]
test eax, eax
je 0x404a07
mov eax, dword [ebp + ecx - 0x218a]
mov dword [ebp - 0x219a], eax
mov eax, dword [ebp + ecx - 0x2186]
mov dword [ebp - 0x2196], eax
mov dword [ebp - 0x1f92], 0x48060000
mov byte [ebp - 0x1f8e], 0xb4
mov eax, dword [ebp - 0x21a2]
mov ecx, dword [ebp - 0x219e]
cmp eax, ecx
jae 0x4049fc
sub ecx, eax
cmp ecx, dword [ebp - 0x2196]
jbe 0x4048e8
mov ecx, dword [ebp - 0x2196]
mov dword [ebp - 0x27be], ecx
add eax, dword [esi + 0x20]
push ecx
push eax
lea edx, [ebp - 0x1f8a]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov eax, dword [ebp - 0x21a2]
add eax, dword [ebp - 0x219a]
mov byte [ebp - 0x1f8d], ah
shr eax, 0x10
mov byte [ebp - 0x1f8c], al
mov byte [ebp - 0x1f8b], ah
mov ecx, dword [ebp - 0x27be]
lea edx, [ebp - 0x1f92]
push edx
lea edx, [ecx + 0xa]
push edx
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x5dc
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x40495a
cmp eax, 0xffffffff
jne 0x404969
mov dword [ebp - 0x3e88], 1
jmp 0x4049fa
cmp byte [ebp - 0x3e80], 0xf4
je 0x4049e4
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4049c4
xor eax, eax
jmp 0x4049ce
cmp eax, 0x20
jbe 0x4049ce
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x4049fa
mov ecx, dword [ebp - 0x27be]
add dword [ebp - 0x21a2], ecx
call fcn.00407f71
jmp 0x4048c4
jmp 0x404a07
inc dword [ebp - 0x2e50]
jmp 0x40485d
cmp dword [ebp - 0x3e88], 0
jne 0x404a37
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x14
jne 0x404f9a
cmp dword [ebp - 0x3e88], 0
jne 0x404f9a
push 0xa
push 0xd244d4f
push 0x52504545
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
push 0x200
push 0
lea edx, [ebp - 0xf82]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
cmp dword [esi + 0x270], 0x726f6624
jne 0x404ae5
cmp dword [esi + 0x274], 0x5f323764
jne 0x404ae5
cmp dword [esi + 0x278], 0x43442431
jne 0x404ae5
cmp dword [esi + 0x27c], 0x30353454
jne 0x404ae5
cmp dword [esi + 0x280], 0x3335315b
jne 0x404ae5
cmp dword [esi + 0x284], 0x205d6b36
jne 0x404ae5
cmp dword [esi + 0x288], 0x4e4143
je 0x404b4f
cmp dword [esi + 0x270], 0x726f6624
jne 0x404b63
cmp dword [esi + 0x274], 0x5f323764
jne 0x404b63
cmp dword [esi + 0x278], 0x54282431
jne 0x404b63
cmp dword [esi + 0x27c], 0x29545345
jne 0x404b63
cmp dword [esi + 0x280], 0x34544344
jne 0x404b63
cmp dword [esi + 0x284], 0x315b3035
jne 0x404b63
cmp dword [esi + 0x288], 0x6b363335
jne 0x404b63
cmp dword [esi + 0x28c], 0x4143205d
jne 0x404b63
cmp word [esi + 0x290], 0x4e
jne 0x404b63
mov dword [ebp - 0xf82], 0
mov dword [ebp - 0xf7e], 0x2000
mov dword [ebp - 0x2e50], 0
mov dword [ebp - 0x23ba], 0
mov dword [ebp - 0x2e48], 0
cmp dword [ebp - 0x2e50], 0x20
jae 0x404bc9
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0xf7e]
sub eax, dword [ebp + ecx - 0xf82]
test eax, eax
je 0x404bc9
shr eax, 2
add dword [ebp - 0x23ba], eax
mov eax, dword [ebp + ecx - 0xf7e]
cmp dword [ebp - 0x2e48], eax
jae 0x404bc1
mov dword [ebp - 0x2e48], eax
inc dword [ebp - 0x2e50]
jmp 0x404b81
mov eax, dword [ebp - 0x23ba]
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push dword [ebp - 0x2e48]
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [ebp - 0x2e40], eax
mov dword [ebp - 0x2e50], 0
push 0
push 0x93
push 0x48060000
cmp dword [ebp - 0x2e50], 0x20
jae 0x404d86
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0xf82]
mov dword [ebp - 0x23b6], eax
mov eax, dword [ebp + ecx - 0xf7e]
mov dword [ebp - 0x23b2], eax
sub eax, dword [ebp - 0x23b6]
test eax, eax
je 0x404d86
mov eax, dword [ebp - 0xf7a]
mov dword [ebp - 0x23ae], eax
mov eax, dword [ebp - 0x23b6]
mov ecx, dword [ebp - 0x23b2]
cmp eax, ecx
jae 0x404d86
add eax, dword [ebp - 0x23ae]
mov byte [esp + 5], ah
mov byte [esp + 6], al
push esp
push 0xb
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x404ccc
cmp eax, 0xffffffff
jne 0x404cdb
mov dword [ebp - 0x3e88], 1
jmp 0x404d86
cmp byte [ebp - 0x3e80], 0xd3
je 0x404d56
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x404d36
xor eax, eax
jmp 0x404d40
cmp eax, 0x20
jbe 0x404d40
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x404d86
mov eax, dword [ebp - 0x23b6]
add eax, dword [ebp - 0x2e40]
push 4
lea edx, [ebp - 0x3e7d]
push edx
push eax
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
call fcn.00407f71
add dword [ebp - 0x23b6], 4
jmp 0x404c82
add esp, 0xc
cmp dword [ebp - 0x3e88], 0
jne 0x404f84
push 0
push 0xa0d244b
push 0x4f5f4d4f
push 0x52504545
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
mov byte [ebp - 0x2bec], 0
push 0x4c
push 0
lea edx, [ebp - 0x2c38]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
push 0
mov dword [ebp - 0xd82], esp
push 0x6e6962
mov dword [ebp - 0xd7e], esp
push 0
push 0x2a2e2a
push 0x73656c
push 0x6966206c
push 0x6c41006e
push 0x69622e2a
push 0x656c69
push 0x66207972
push 0x616e6942
mov dword [ebp - 0xd7a], esp
mov dword [ebp - 0x2c38], 0x4c
mov eax, dword [ebx + 0x8ac]
mov dword [ebp - 0x2c34], eax
mov dword [ebp - 0x2c20], 1
mov eax, dword [ebp - 0xd7a]
mov dword [ebp - 0x2c2c], eax
lea eax, [ebp - 0x2bec]
mov dword [ebp - 0x2c1c], eax
mov dword [ebp - 0x2c18], 0x104
mov eax, dword [ebp - 0xd82]
mov dword [ebp - 0x2c0c], eax
mov dword [ebp - 0x2c08], eax
mov eax, dword [ebp - 0xd7e]
mov dword [ebp - 0x2bfc], eax
mov dword [ebp - 0x2c04], 2
lea edx, [ebp - 0x2c38]
push edx
call dword [sym.imp.COMDLG32.DLL_GetSaveFileNameA]
add esp, 0x24
add esp, 4
add esp, 4
test eax, eax
je 0x404f84
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x2bec]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
jne 0x404f17
lea eax, [ebp - 0x2bec]
push 0xa0d73
push 0x25203a24
push 0x454c4946
push 0x5f474e49
push 0x54414552
push 0x435f524f
push 0x52524524
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
jmp 0x404f84
mov dword [ebp - 0x2e44], eax
push 0
lea edx, [ebp - 0x2e3c]
push edx
push dword [ebp - 0x2e48]
push dword [ebp - 0x2e40]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [ebp - 0x2e44]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x2bec]
push 0xa0d
push 0x7325203a
push 0x24444556
push 0x41535f45
push 0x4c494624
push eax
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
push dword [ebp - 0x2e40]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [ebp - 0x2e40], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x15
jne 0x405770
cmp dword [ebp - 0x3e88], 0
jne 0x405770
push 0xa
push 0xd244d4f
push 0x52504545
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov dword [ebp - 0x2e50], 0
cmp dword [ebp - 0x2e50], 0x20
jae 0x40573b
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0x2e38]
mov dword [ebp - 0x21a2], eax
mov eax, dword [ebp + ecx - 0x2e34]
mov dword [ebp - 0x219e], eax
sub eax, dword [ebp - 0x21a2]
test eax, eax
je 0x40573b
mov eax, dword [ebp + ecx - 0x2e30]
mov dword [ebp - 0x219a], eax
mov dword [ebp - 0x2e64], 0x20
mov dword [ebp - 0x3f90], 0x20
mov eax, dword [ebp - 0x21a2]
mov ecx, dword [ebp - 0x219e]
cmp eax, ecx
jae 0x405730
push 0
push 0x93
push 0x48060000
add eax, dword [ebp - 0x219a]
mov byte [esp + 5], ah
mov byte [esp + 6], al
push esp
push 0xb
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
add esp, 0xc
test eax, eax
je 0x40509d
cmp eax, 0xffffffff
jne 0x4050ac
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
cmp byte [ebp - 0x3e80], 0xd3
je 0x40512a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405107
xor eax, eax
jmp 0x405111
cmp eax, 0x20
jbe 0x405111
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
mov eax, dword [ebp - 0x21a2]
add eax, dword [ebp - 0x2e40]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3e7d]
jne 0x405165
add dword [ebp - 0x21a2], 4
call fcn.00407f71
mov dword [ebp - 0x2e64], 0x20
mov dword [ebp - 0x3f90], 0x20
jmp 0x40503a
dec dword [ebp - 0x2e64]
jne 0x4051e2
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4051bf
xor eax, eax
jmp 0x4051c9
cmp eax, 0x20
jbe 0x4051c9
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
push 0x96
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 5
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x405214
cmp eax, 0xffffffff
jne 0x405223
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
cmp byte [ebp - 0x3e80], 0xd6
je 0x4052a1
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40527e
xor eax, eax
jmp 0x405288
cmp eax, 0x20
jbe 0x405288
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
push 0x91
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x4052d3
cmp eax, 0xffffffff
jne 0x4052e2
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
cmp byte [ebp - 0x3e80], 0xd1
je 0x405360
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40533d
xor eax, eax
jmp 0x405347
cmp eax, 0x20
jbe 0x405347
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
push 0x95
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x405392
cmp eax, 0xffffffff
jne 0x4053a1
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
cmp byte [ebp - 0x3e80], 0xd5
je 0x40541f
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4053fc
xor eax, eax
jmp 0x405406
cmp eax, 0x20
jbe 0x405406
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
push 0x96
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 5
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x405451
cmp eax, 0xffffffff
jne 0x405460
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
cmp byte [ebp - 0x3e80], 0xd6
je 0x4054de
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4054bb
xor eax, eax
jmp 0x4054c5
cmp eax, 0x20
jbe 0x4054c5
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
push 0
push 0x92
push 0x48060000
mov eax, dword [ebp - 0x21a2]
add eax, dword [ebp - 0x219a]
mov byte [esp + 5], ah
mov byte [esp + 6], al
mov eax, dword [ebp - 0x21a2]
add eax, dword [ebp - 0x2e40]
push 4
push eax
lea edx, [esp + 0xf]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
push esp
push 0xb
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
add esp, 0xc
test eax, eax
je 0x405546
cmp eax, 0xffffffff
jne 0x405555
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
cmp byte [ebp - 0x3e80], 0xd2
je 0x4055d3
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4055b0
xor eax, eax
jmp 0x4055ba
cmp eax, 0x20
jbe 0x4055ba
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
push 0xf
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x95
push 0x48060000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x40560d
cmp eax, 0xffffffff
jne 0x40561c
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
cmp byte [ebp - 0x3e80], 0xd5
je 0x40569a
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405677
xor eax, eax
jmp 0x405681
cmp eax, 0x20
jbe 0x405681
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x40572e
cmp byte [ebp - 0x3e7f], 3
je 0x4056b2
push 0xf
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40503a
dec dword [ebp - 0x3f90]
jne 0x4055db
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405710
xor eax, eax
jmp 0x40571a
cmp eax, 0x20
jbe 0x40571a
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x40573b
inc dword [ebp - 0x2e50]
jmp 0x404fe7
cmp dword [ebp - 0x3e88], 0
jne 0x405770
push 0
push 0xa0d244b
push 0x4f5f4d4f
push 0x52504545
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x20
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0
mov eax, esp
push 0
push eax
push 2
call dword [edi]
add esp, 4
push 0
push 0
push 3
call dword [edi]
cmp dword [ebp - 0x2e40], 0
je 0x4057ab
push dword [ebp - 0x2e40]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x4057ce
cmp eax, 0xb
je 0x4057ce
cmp eax, 0xa
je 0x4057ce
cmp eax, 0x17
je 0x4057ce
cmp eax, 0x18
jne 0x407dfc
push 0x7a120
push 0x800
push 6
push 0
mov eax, esp
push 0
push eax
push 1
call dword [edi]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4057fc
mov dword [ebp - 0x3e88], 1
jmp 0x407dfc
push 1
push 0x8000
push 0
push 1
push 0
mov eax, esp
push 0
push eax
push 8
call dword [edi]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x405829
mov dword [ebp - 0x3e88], 1
jmp 0x407de6
push 0xe1070000
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xe9070000
push 0
push 4
push 0
push 0x40
push 0
push 6
push 0xffffffffffffffff
push 0
push 4
push 0
push 0x40
push 0
push 6
push 3
push 0
push 0
mov eax, esp
push 0
push eax
push 4
call dword [edi]
add esp, 0x60
cmp eax, 0xffffffff
jne 0x40587f
mov dword [ebp - 0x3e88], 1
jmp 0x407de6
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xe
je 0x405893
cmp eax, 0xa
jne 0x405e00
mov byte [ebp - 0xd76], 0
mov byte [ebp - 0xc72], 0
mov byte [ebp - 0xb6e], 0
mov byte [ebp - 0xa6a], 0
mov byte [ebp - 0x966], 0
cmp dword [ebp - 0x3e88], 0
jne 0x405953
push 0x88f122
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 7
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
cmp eax, 0
je 0x4058f6
cmp eax, 0xffffffff
jne 0x405902
mov dword [ebp - 0x3e88], 1
jmp 0x405953
cmp byte [ebp - 0x3e80], 0x62
jne 0x405953
sub eax, 7
xor ecx, ecx
cmp ecx, 0x104
jae 0x40594b
cmp ecx, eax
jae 0x40594b
cmp byte [ebp + ecx - 0x3e7d], 0
je 0x40594b
cmp byte [ebp + ecx - 0x3e7d], 0x20
je 0x40594b
cmp byte [ebp + ecx - 0x3e7d], 0xff
je 0x40594b
mov dl, byte [ebp + ecx - 0x3e7d]
mov byte [ebp + ecx - 0xd76], dl
inc ecx
jmp 0x405910
mov byte [ebp + ecx - 0xd76], 0
cmp dword [ebp - 0x3e88], 0
jne 0x4059fd
cmp byte [ebp - 0xd76], 0
jne 0x4059fd
push 0x409
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
cmp eax, 0
je 0x4059a0
cmp eax, 0xffffffff
jne 0x4059ac
mov dword [ebp - 0x3e88], 1
jmp 0x4059fd
cmp byte [ebp - 0x3e80], 0x49
jne 0x4059fd
sub eax, 7
xor ecx, ecx
cmp ecx, 0x104
jae 0x4059f5
cmp ecx, eax
jae 0x4059f5
cmp byte [ebp + ecx - 0x3e7d], 0
je 0x4059f5
cmp byte [ebp + ecx - 0x3e7d], 0x20
je 0x4059f5
cmp byte [ebp + ecx - 0x3e7d], 0xff
je 0x4059f5
mov dl, byte [ebp + ecx - 0x3e7d]
mov byte [ebp + ecx - 0xd76], dl
inc ecx
jmp 0x4059ba
mov byte [ebp + ecx - 0xd76], 0
cmp dword [ebp - 0x3e88], 0
jne 0x405a9a
push 0x11f122
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 7
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
cmp eax, 0
je 0x405a3d
cmp eax, 0xffffffff
jne 0x405a49
mov dword [ebp - 0x3e88], 1
jmp 0x405a9a
cmp byte [ebp - 0x3e80], 0x62
jne 0x405a9a
sub eax, 7
xor ecx, ecx
cmp ecx, 0x104
jae 0x405a92
cmp ecx, eax
jae 0x405a92
cmp byte [ebp + ecx - 0x3e7d], 0
je 0x405a92
cmp byte [ebp + ecx - 0x3e7d], 0x20
je 0x405a92
cmp byte [ebp + ecx - 0x3e7d], 0xff
je 0x405a92
mov dl, byte [ebp + ecx - 0x3e7d]
mov byte [ebp + ecx - 0xc72], dl
inc ecx
jmp 0x405a57
mov byte [ebp + ecx - 0xc72], 0
cmp dword [ebp - 0x3e88], 0
jne 0x405b37
push 0x13f122
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 7
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
cmp eax, 0
je 0x405ada
cmp eax, 0xffffffff
jne 0x405ae6
mov dword [ebp - 0x3e88], 1
jmp 0x405b37
cmp byte [ebp - 0x3e80], 0x62
jne 0x405b37
sub eax, 7
xor ecx, ecx
cmp ecx, 0x104
jae 0x405b2f
cmp ecx, eax
jae 0x405b2f
cmp byte [ebp + ecx - 0x3e7d], 0
je 0x405b2f
cmp byte [ebp + ecx - 0x3e7d], 0x20
je 0x405b2f
cmp byte [ebp + ecx - 0x3e7d], 0xff
je 0x405b2f
mov dl, byte [ebp + ecx - 0x3e7d]
mov byte [ebp + ecx - 0xb6e], dl
inc ecx
jmp 0x405af4
mov byte [ebp + ecx - 0xb6e], 0
cmp dword [ebp - 0x3e88], 0
jne 0x405bd4
push 0x8cf122
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 7
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
cmp eax, 0
je 0x405b77
cmp eax, 0xffffffff
jne 0x405b83
mov dword [ebp - 0x3e88], 1
jmp 0x405bd4
cmp byte [ebp - 0x3e80], 0x62
jne 0x405bd4
sub eax, 7
xor ecx, ecx
cmp ecx, 0x104
jae 0x405bcc
cmp ecx, eax
jae 0x405bcc
cmp byte [ebp + ecx - 0x3e7d], 0
je 0x405bcc
cmp byte [ebp + ecx - 0x3e7d], 0x20
je 0x405bcc
cmp byte [ebp + ecx - 0x3e7d], 0xff
je 0x405bcc
mov dl, byte [ebp + ecx - 0x3e7d]
mov byte [ebp + ecx - 0xa6a], dl
inc ecx
jmp 0x405b91
mov byte [ebp + ecx - 0xa6a], 0
cmp dword [ebp - 0x3e88], 0
jne 0x405c71
push 0x24f122
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 7
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
cmp eax, 0
je 0x405c14
cmp eax, 0xffffffff
jne 0x405c20
mov dword [ebp - 0x3e88], 1
jmp 0x405c71
cmp byte [ebp - 0x3e80], 0x62
jne 0x405c71
sub eax, 7
xor ecx, ecx
cmp ecx, 0x104
jae 0x405c69
cmp ecx, eax
jae 0x405c69
cmp byte [ebp + ecx - 0x3e7d], 0
je 0x405c69
cmp byte [ebp + ecx - 0x3e7d], 0x20
je 0x405c69
cmp byte [ebp + ecx - 0x3e7d], 0xff
je 0x405c69
mov dl, byte [ebp + ecx - 0x3e7d]
mov byte [ebp + ecx - 0x966], dl
inc ecx
jmp 0x405c2e
mov byte [ebp + ecx - 0x966], 0
cmp dword [ebp - 0x3e88], 0
jne 0x405e00
cmp byte [ebp - 0xd76], 0
je 0x405cde
lea ecx, [ebp - 0xd76]
push 0xa
push 0xd732520
push 0x3a244e4f
push 0x49535245
push 0x565f5753
push 0x24202445
push 0x4d495424
push ecx
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x28
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
lea edx, [ebp - 0xd76]
push edx
lea edx, [esi + 0x6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
cmp byte [ebp - 0x966], 0
je 0x405d26
lea ecx, [ebp - 0x966]
push 0xa0d
push 0x7325203a
push 0x244c4143
push 0x24202445
push 0x4d495424
push ecx
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
cmp byte [ebp - 0xc72], 0
je 0x405d73
lea ecx, [ebp - 0xc72]
push 0xa0d
push 0x7325203a
push 0x24545241
push 0x505f5441
push 0x24202445
push 0x4d495424
push ecx
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x24
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
cmp byte [ebp - 0xb6e], 0
je 0x405dbb
lea ecx, [ebp - 0xb6e]
push 0xa0d
push 0x7325203a
push 0x24544143
push 0x24202445
push 0x4d495424
push ecx
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
cmp byte [ebp - 0xa6a], 0
je 0x405e00
lea ecx, [ebp - 0xa6a]
push 0xa
push 0xd732520
push 0x3a244e53
push 0x24202445
push 0x4d495424
push ecx
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
je 0x405e14
cmp eax, 0xa
jne 0x406b7c
cmp dword [ebp - 0x3e88], 0
jne 0x405ee5
push 0x210
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x405e53
cmp eax, 0xffffffff
jne 0x405e62
mov dword [ebp - 0x3e88], 1
jmp 0x405ee5
cmp byte [ebp - 0x3e80], 0x50
je 0x405ee5
push 0x203a24
push 0x45444f43
push 0x5f524f52
push 0x52452420
push 0x2c244544
push 0x4f4d5f47
push 0x4e494d4d
push 0x4152474f
push 0x52505f54
push 0x45535f54
push 0x4f4e5f4e
push 0x41435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x405ec7
xor eax, eax
jmp 0x405ed1
cmp eax, 0x20
jbe 0x405ed1
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x4060ca
mov dword [ebp - 0x3f90], 0x20
push 0x127
push 0xe1070000
push esp
push 6
push 0x1f4
push 0x40
push 6
push 0
call fcn.00407ff4
cmp eax, 0xffffffff
jne 0x405f2d
mov dword [ebp - 0x3e88], 1
jmp 0x4060ca
lea edx, [ebp - 0x3e84]
push edx
push 0x6e
push 3
push 0
call fcn.00408150
test eax, eax
je 0x405f48
cmp eax, 0xffffffff
jne 0x405f57
mov dword [ebp - 0x3e88], 1
jmp 0x4060ca
cmp byte [ebp - 0x3e80], 0x7f
jne 0x40604f
cmp byte [ebp - 0x3e7f], 0x27
je 0x405f77
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x405f2d
cmp byte [ebp - 0x3e7e], 0x36
jne 0x405f99
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x3f90]
jne 0x405efc
jmp 0x405fdb
cmp byte [ebp - 0x3e7e], 0x37
jne 0x405fbb
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x3f90]
jne 0x405efc
jmp 0x405fdb
cmp byte [ebp - 0x3e7e], 0x22
jne 0x405fdb
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp - 0x3f90]
jne 0x405efc
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40602f
xor eax, eax
jmp 0x406039
cmp eax, 0x20
jbe 0x406039
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x4060ca
cmp byte [ebp - 0x3e80], 0x67
je 0x4060ca
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x244e4f49
push 0x54415a49
push 0x524f4854
push 0x55415f54
push 0x53455551
push 0x45525f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4060ac
xor eax, eax
jmp 0x4060b6
cmp eax, 0x20
jbe 0x4060b6
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x406244
mov byte [ebp - 0x28c8], 0x20
mov byte [ebp - 0x28c7], 0xf4
mov dword [ebp - 0x28c6], 0
mov eax, dword [ebp - 0x3e7e]
mov dword [ebp - 0x28c2], eax
push 0xfa
lea edx, [ebp - 0x4096]
push edx
push 0xf6
lea edx, [ebp - 0x28c8]
push edx
call dword [ebx + 0x40]
cmp eax, 3
je 0x40616f
push 0
push 0xa0d3120
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202c24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x3e88], 1
jmp 0x406244
push 0
push 0x227
push 0xe1070000
mov eax, dword [ebp - 0x4096]
mov dword [esp + 6], eax
push esp
push 9
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
add esp, 0xc
test eax, eax
jne 0x4061ba
mov dword [ebp - 0x3e88], 1
jmp 0x406244
cmp eax, 0xffffffff
jne 0x4061cb
mov dword [ebp - 0x3e88], 1
jmp 0x406244
cmp byte [ebp - 0x3e80], 0x67
je 0x406244
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c244e
push 0x4f495441
push 0x5a49524f
push 0x48545541
push 0x5f4b4345
push 0x48435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406226
xor eax, eax
jmp 0x406230
cmp eax, 0x20
jbe 0x406230
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x406b7c
push 0xa0d24
push 0x544f4f42
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x10
push 0x200
push 0
lea edx, [ebp - 0x842]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
cmp dword [esi + 0x270], 0x726f6624
jne 0x4062db
cmp dword [esi + 0x274], 0x5f323764
jne 0x4062db
cmp dword [esi + 0x278], 0x43442431
jne 0x4062db
cmp dword [esi + 0x27c], 0x30353454
jne 0x4062db
cmp dword [esi + 0x280], 0x3335315b
jne 0x4062db
cmp dword [esi + 0x284], 0x205d6b36
jne 0x4062db
cmp dword [esi + 0x288], 0x4e4143
je 0x406369
cmp dword [esi + 0x270], 0x726f6624
jne 0x406553
cmp dword [esi + 0x274], 0x5f323764
jne 0x406553
cmp dword [esi + 0x278], 0x54282431
jne 0x406553
cmp dword [esi + 0x27c], 0x29545345
jne 0x406553
cmp dword [esi + 0x280], 0x34544344
jne 0x406553
cmp dword [esi + 0x284], 0x315b3035
jne 0x406553
cmp dword [esi + 0x288], 0x6b363335
jne 0x406553
cmp dword [esi + 0x28c], 0x4143205d
jne 0x406553
cmp word [esi + 0x290], 0x4e
jne 0x406553
push 0xa
push 1
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
jne 0x4063ce
push 0
push 0xa0d3220
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202c24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x3e88], 1
jmp 0x406549
mov dword [ebp - 0x85e], eax
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 0x85a], eax
push dword [ebp - 0x85e]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x40644b
push 0
push 0xa0d3220
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202c24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x3e88], 1
jmp 0x406549
mov dword [ebp - 0x856], eax
mov dword [ebp - 0x842], 0
cmp byte [eax + 3], 8
je 0x4064b5
push 0
push 0xa0d3320
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202c24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x3e88], 1
jmp 0x40653d
mov ecx, dword [ebp - 0x85a]
mov eax, dword [ecx + eax - 4]
mov dword [ebp - 0x83e], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [ebp - 0x852], eax
push dword [ebp - 0x83e]
push eax
push dword [ebp - 0x85a]
push dword [ebp - 0x856]
call dword [ebx + 0x4c]
test eax, eax
jne 0x40653d
push 0
push 0xa0d3420
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202c24
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x34
mov dword [ebp - 0x3e88], 1
push dword [ebp - 0x856]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov dword [ebp - 0x83a], 0xd0000000
cmp dword [ebp - 0x3e88], 0
jne 0x406b7c
mov dword [ebp - 0x2e50], 0
mov dword [ebp - 0x84e], 0
mov dword [ebp - 0x84a], 0
cmp dword [ebp - 0x2e50], 0x20
jae 0x4065ae
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0x83e]
sub eax, dword [ebp + ecx - 0x842]
test eax, eax
je 0x4065ae
add dword [ebp - 0x84a], eax
inc dword [ebp - 0x2e50]
jmp 0x40657e
mov dword [ebp - 0x2e50], 0
cmp dword [ebp - 0x2e50], 0x20
jae 0x4069a4
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0x842]
mov dword [ebp - 0x27d2], eax
mov eax, dword [ebp + ecx - 0x83e]
mov dword [ebp - 0x27ce], eax
sub eax, dword [ebp - 0x27d2]
test eax, eax
je 0x4069a4
mov eax, dword [ebp + ecx - 0x83a]
mov dword [ebp - 0x27ca], eax
push 0
push 0
push 0x440034
push 0xe1070000
mov eax, dword [ebp - 0x27d2]
mov ecx, dword [ebp - 0x27ce]
sub ecx, eax
add eax, dword [ebp - 0x27ca]
mov byte [esp + 9], ah
mov byte [esp + 0xa], al
shr eax, 0x10
mov byte [esp + 7], ah
mov byte [esp + 8], al
mov byte [esp + 0xd], ch
mov byte [esp + 0xe], cl
shr ecx, 0x10
mov byte [esp + 0xb], ch
mov byte [esp + 0xc], cl
push esp
push 0xf
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
add esp, 0x10
test eax, eax
je 0x406674
cmp eax, 0xffffffff
jne 0x406683
mov dword [ebp - 0x3e88], 1
jmp 0x40678b
cmp byte [ebp - 0x3e80], 0x74
je 0x406701
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4066de
xor eax, eax
jmp 0x4066e8
cmp eax, 0x20
jbe 0x4066e8
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x40678b
mov ecx, 6
xor edx, edx
cmp ecx, 0xa
jae 0x40671e
cmp ecx, eax
jae 0x40671e
shl edx, 8
mov dl, byte [ebp + ecx - 0x3e84]
inc ecx
jmp 0x406708
mov dword [ebp - 0x27c2], edx
cmp dword [ebp - 0x84e], 0
jne 0x40678b
mov eax, dword [ebp - 0x84a]
mov ecx, dword [ebp - 0x27c2]
dec ecx
dec ecx
xor edx, edx
div ecx
test edx, edx
je 0x406744
inc eax
mov dword [ebp - 0x84e], eax
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
cmp dword [ebp - 0x3e88], 0
jne 0x4069a4
mov dword [ebp - 0x1f92], 0xe1070000
mov byte [ebp - 0x1f8e], 0x36
mov dword [ebp - 0x846], 1
mov eax, dword [ebp - 0x27d2]
mov ecx, dword [ebp - 0x27ce]
cmp eax, ecx
jae 0x4068e0
sub ecx, eax
mov edx, dword [ebp - 0x27c2]
dec edx
dec edx
cmp ecx, edx
jbe 0x4067d7
mov ecx, edx
mov dword [ebp - 0x27be], ecx
add eax, dword [ebp - 0x852]
push ecx
push eax
lea edx, [ebp - 0x1f8c]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov eax, dword [ebp - 0x846]
mov byte [ebp - 0x1f8d], al
mov ecx, dword [ebp - 0x27be]
lea edx, [ebp - 0x1f92]
push edx
lea edx, [ecx + 6]
push edx
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
je 0x406835
cmp eax, 0xffffffff
jne 0x406844
mov dword [ebp - 0x3e88], 1
jmp 0x4068db
cmp byte [ebp - 0x3e80], 0x76
je 0x4068bf
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40689f
xor eax, eax
jmp 0x4068a9
cmp eax, 0x20
jbe 0x4068a9
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x4068db
call fcn.00407f71
inc dword [ebp - 0x846]
mov ecx, dword [ebp - 0x27be]
add dword [ebp - 0x27d2], ecx
jmp 0x4067b3
jmp 0x4069a4
push 0x37
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 5
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x40690f
cmp eax, 0xffffffff
jne 0x40691e
mov dword [ebp - 0x3e88], 1
jmp 0x4069a4
cmp byte [ebp - 0x3e80], 0x77
je 0x406999
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406979
xor eax, eax
jmp 0x406983
cmp eax, 0x20
jbe 0x406983
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x4069a4
inc dword [ebp - 0x2e50]
jmp 0x4065b8
cmp dword [ebp - 0x3e88], 0
jne 0x406b53
cmp dword [esi + 0x270], 0x726f6624
jne 0x406a09
cmp dword [esi + 0x274], 0x5f323764
jne 0x406a09
cmp dword [esi + 0x278], 0x43442431
jne 0x406a09
cmp dword [esi + 0x27c], 0x30353454
jne 0x406a09
cmp dword [esi + 0x280], 0x3335315b
jne 0x406a09
cmp dword [esi + 0x284], 0x205d6b36
jne 0x406a09
cmp dword [esi + 0x288], 0x4e4143
je 0x406a97
cmp dword [esi + 0x270], 0x726f6624
jne 0x406b53
cmp dword [esi + 0x274], 0x5f323764
jne 0x406b53
cmp dword [esi + 0x278], 0x54282431
jne 0x406b53
cmp dword [esi + 0x27c], 0x29545345
jne 0x406b53
cmp dword [esi + 0x280], 0x34544344
jne 0x406b53
cmp dword [esi + 0x284], 0x315b3035
jne 0x406b53
cmp dword [esi + 0x288], 0x6b363335
jne 0x406b53
cmp dword [esi + 0x28c], 0x4143205d
jne 0x406b53
cmp word [esi + 0x290], 0x4e
jne 0x406b53
push 0x280000d0
push 0x1030131
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 0xc
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x406ace
cmp eax, 0xffffffff
jne 0x406ada
mov dword [ebp - 0x3e88], 1
jmp 0x406b53
cmp byte [ebp - 0x3e80], 0x71
je 0x406b53
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406b35
xor eax, eax
jmp 0x406b3f
cmp eax, 0x20
jbe 0x406b3f
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x406b7c
push 0xa0d
push 0x244b4f5f
push 0x544f4f42
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x14
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
jne 0x407113
cmp dword [ebp - 0x3e88], 0
jne 0x407113
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
mov eax, dword [esi + 0x14]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x24], eax
push 0x200
push 0
lea edx, [ebp - 0x23a2]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
cmp dword [esi + 0x270], 0x726f6624
jne 0x406c3d
cmp dword [esi + 0x274], 0x5f323764
jne 0x406c3d
cmp dword [esi + 0x278], 0x43442431
jne 0x406c3d
cmp dword [esi + 0x27c], 0x30353454
jne 0x406c3d
cmp dword [esi + 0x280], 0x3335315b
jne 0x406c3d
cmp dword [esi + 0x284], 0x205d6b36
jne 0x406c3d
cmp dword [esi + 0x288], 0x4e4143
je 0x406ca7
cmp dword [esi + 0x270], 0x726f6624
jne 0x406cc5
cmp dword [esi + 0x274], 0x5f323764
jne 0x406cc5
cmp dword [esi + 0x278], 0x54282431
jne 0x406cc5
cmp dword [esi + 0x27c], 0x29545345
jne 0x406cc5
cmp dword [esi + 0x280], 0x34544344
jne 0x406cc5
cmp dword [esi + 0x284], 0x315b3035
jne 0x406cc5
cmp dword [esi + 0x288], 0x6b363335
jne 0x406cc5
cmp dword [esi + 0x28c], 0x4143205d
jne 0x406cc5
cmp word [esi + 0x290], 0x4e
jne 0x406cc5
mov dword [ebp - 0x23a2], 0x18000
mov dword [ebp - 0x239e], esp
mov dword [ebp - 0x239a], 0x80000000
mov dword [ebp - 0x2e50], 0
mov dword [ebp - 0x23ba], 0
mov dword [ebp - 0x642], 0
cmp dword [ebp - 0x2e50], 0x20
jae 0x406d13
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0x239e]
sub eax, dword [ebp + ecx - 0x23a2]
test eax, eax
je 0x406d13
add dword [ebp - 0x642], eax
inc dword [ebp - 0x2e50]
jmp 0x406ce3
mov dword [ebp - 0x2e50], 0
cmp dword [ebp - 0x2e50], 0x20
jae 0x4070d8
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0x23a2]
mov dword [ebp - 0x23b6], eax
mov eax, dword [ebp + ecx - 0x239e]
mov dword [ebp - 0x23b2], eax
sub eax, dword [ebp - 0x23b6]
test eax, eax
je 0x4070d8
mov eax, dword [ebp + ecx - 0x239a]
mov dword [ebp - 0x23ae], eax
push 0
push 0
push 0x440035
push 0xe1070000
mov eax, dword [ebp - 0x23b6]
mov ecx, dword [ebp - 0x23b2]
sub ecx, eax
add eax, dword [ebp - 0x23ae]
mov byte [esp + 9], ah
mov byte [esp + 0xa], al
shr eax, 0x10
mov byte [esp + 7], ah
mov byte [esp + 8], al
mov byte [esp + 0xd], ch
mov byte [esp + 0xe], cl
shr ecx, 0x10
mov byte [esp + 0xb], ch
mov byte [esp + 0xc], cl
push esp
push 0xf
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
add esp, 0x10
test eax, eax
je 0x406dd9
cmp eax, 0xffffffff
jne 0x406de8
mov dword [ebp - 0x3e88], 1
jmp 0x406ef0
cmp byte [ebp - 0x3e80], 0x75
je 0x406e66
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406e43
xor eax, eax
jmp 0x406e4d
cmp eax, 0x20
jbe 0x406e4d
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x406ef0
mov ecx, 6
xor edx, edx
cmp ecx, 0xa
jae 0x406e83
cmp ecx, eax
jae 0x406e83
shl edx, 8
mov dl, byte [ebp + ecx - 0x3e84]
inc ecx
jmp 0x406e6d
mov dword [ebp - 0x63e], edx
cmp dword [ebp - 0x23ba], 0
jne 0x406ef0
mov eax, dword [ebp - 0x642]
mov ecx, dword [ebp - 0x63e]
dec ecx
dec ecx
xor edx, edx
div ecx
test edx, edx
je 0x406ea9
inc eax
mov dword [ebp - 0x23ba], eax
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
cmp dword [ebp - 0x3e88], 0
jne 0x4070d8
mov dword [ebp - 0x846], 1
mov eax, dword [ebp - 0x23b6]
mov ecx, dword [ebp - 0x23b2]
cmp eax, ecx
jae 0x407014
push 0x36
push 0xe1070000
mov eax, dword [ebp - 0x846]
mov byte [esp + 5], al
push esp
push 6
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
add esp, 8
test eax, eax
je 0x406f57
cmp eax, 0xffffffff
jne 0x406f66
mov dword [ebp - 0x3e88], 1
jmp 0x40700f
cmp byte [ebp - 0x3e80], 0x76
je 0x406fe1
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x406fc1
xor eax, eax
jmp 0x406fcb
cmp eax, 0x20
jbe 0x406fcb
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x40700f
sub eax, 6
mov ecx, dword [ebp - 0x23b6]
add dword [ebp - 0x23b6], eax
add ecx, dword [esi + 0x24]
push eax
lea edx, [ebp - 0x3e7e]
push edx
push ecx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
call fcn.00407f71
jmp 0x406f07
jmp 0x4070d8
push 0x37
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 5
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x407043
cmp eax, 0xffffffff
jne 0x407052
mov dword [ebp - 0x3e88], 1
jmp 0x4070d8
cmp byte [ebp - 0x3e80], 0x77
je 0x4070cd
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4070ad
xor eax, eax
jmp 0x4070b7
cmp eax, 0x20
jbe 0x4070b7
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x4070d8
inc dword [ebp - 0x2e50]
jmp 0x406d1d
cmp dword [ebp - 0x3e88], 0
jne 0x40710a
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x44414552
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
jmp 0x407113
lea edx, [esi + 0x24]
push edx
call fcn.004082d2
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xb
jne 0x4077b8
cmp dword [ebp - 0x3e88], 0
jne 0x4077b8
push 0xa0d
push 0x244d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0x200
push 0
lea edx, [ebp - 0x2192]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
cmp dword [esi + 0x270], 0x726f6624
jne 0x4071bf
cmp dword [esi + 0x274], 0x5f323764
jne 0x4071bf
cmp dword [esi + 0x278], 0x43442431
jne 0x4071bf
cmp dword [esi + 0x27c], 0x30353454
jne 0x4071bf
cmp dword [esi + 0x280], 0x3335315b
jne 0x4071bf
cmp dword [esi + 0x284], 0x205d6b36
jne 0x4071bf
cmp dword [esi + 0x288], 0x4e4143
je 0x407229
cmp dword [esi + 0x270], 0x726f6624
jne 0x407247
cmp dword [esi + 0x274], 0x5f323764
jne 0x407247
cmp dword [esi + 0x278], 0x54282431
jne 0x407247
cmp dword [esi + 0x27c], 0x29545345
jne 0x407247
cmp dword [esi + 0x280], 0x34544344
jne 0x407247
cmp dword [esi + 0x284], 0x315b3035
jne 0x407247
cmp dword [esi + 0x288], 0x6b363335
jne 0x407247
cmp dword [esi + 0x28c], 0x4143205d
jne 0x407247
cmp word [esi + 0x290], 0x4e
jne 0x407247
mov dword [ebp - 0x2192], 0x18000
mov dword [ebp - 0x218e], esp
mov dword [ebp - 0x218a], 0x80000000
mov dword [ebp - 0x2e50], 0
mov dword [ebp - 0x2e4c], 0
mov dword [ebp - 0x63a], 0
cmp dword [ebp - 0x2e50], 0x20
jae 0x407295
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0x218e]
sub eax, dword [ebp + ecx - 0x2192]
test eax, eax
je 0x407295
add dword [ebp - 0x63a], eax
inc dword [ebp - 0x2e50]
jmp 0x407265
mov dword [ebp - 0x2e50], 0
cmp dword [ebp - 0x2e50], 0x20
jae 0x407788
imul ecx, dword [ebp - 0x2e50], 0x10
mov eax, dword [ebp + ecx - 0x2192]
mov dword [ebp - 0x21a2], eax
mov eax, dword [ebp + ecx - 0x218e]
mov dword [ebp - 0x219e], eax
sub eax, dword [ebp - 0x21a2]
test eax, eax
je 0x407788
mov eax, dword [ebp + ecx - 0x218a]
mov dword [ebp - 0x219a], eax
push 0
push 0
push 0xff0131
push 0xe1070000
mov eax, dword [ebp - 0x21a2]
mov ecx, dword [ebp - 0x219e]
sub ecx, eax
add eax, dword [ebp - 0x219a]
mov byte [esp + 0xa], ah
mov byte [esp + 0xb], al
shr eax, 0x10
mov byte [esp + 8], ah
mov byte [esp + 9], al
mov byte [esp + 0xe], ch
mov byte [esp + 0xf], cl
shr ecx, 0x10
mov byte [esp + 0xc], ch
mov byte [esp + 0xd], cl
push esp
push 0x10
lea edx, [ebp - 0x3e84]
push edx
push 0xbb8
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
add esp, 0x10
je 0x407359
cmp eax, 0xffffffff
jne 0x407365
mov dword [ebp - 0x3e88], 1
jmp 0x4073db
cmp byte [ebp - 0x3e80], 0x71
je 0x4073db
push 0
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x24524f52
push 0x52455f4d
push 0x4f525f47
push 0x4e495341
push 0x52455f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4073bd
xor eax, eax
jmp 0x4073c7
cmp eax, 0x20
jbe 0x4073c7
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x407572
push 0
push 0
push 0x440034
push 0xe1070000
mov eax, dword [ebp - 0x21a2]
mov ecx, dword [ebp - 0x219e]
sub ecx, eax
add eax, dword [ebp - 0x219a]
mov byte [esp + 9], ah
mov byte [esp + 0xa], al
shr eax, 0x10
mov byte [esp + 7], ah
mov byte [esp + 8], al
mov byte [esp + 0xd], ch
mov byte [esp + 0xe], cl
shr ecx, 0x10
mov byte [esp + 0xb], ch
mov byte [esp + 0xc], cl
push esp
push 0xf
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
add esp, 0x10
test eax, eax
je 0x40745b
cmp eax, 0xffffffff
jne 0x40746a
mov dword [ebp - 0x3e88], 1
jmp 0x407572
cmp byte [ebp - 0x3e80], 0x74
je 0x4074e8
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4074c5
xor eax, eax
jmp 0x4074cf
cmp eax, 0x20
jbe 0x4074cf
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x407572
mov ecx, 6
xor edx, edx
cmp ecx, 0xa
jae 0x407505
cmp ecx, eax
jae 0x407505
shl edx, 8
mov dl, byte [ebp + ecx - 0x3e84]
inc ecx
jmp 0x4074ef
mov dword [ebp - 0x27c2], edx
cmp dword [ebp - 0x2e4c], 0
jne 0x407572
mov eax, dword [ebp - 0x63a]
mov ecx, dword [ebp - 0x27c2]
dec ecx
dec ecx
xor edx, edx
div ecx
test edx, edx
je 0x40752b
inc eax
mov dword [ebp - 0x2e4c], eax
shl eax, 0x10
push eax
push 0
push 0x401
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [ebx + 0x8ec]
call dword [sym.imp.USER32.DLL_SendMessageA]
cmp dword [ebp - 0x3e88], 0
jne 0x407788
mov dword [ebp - 0x1f92], 0xe1070000
mov byte [ebp - 0x1f8e], 0x36
mov dword [ebp - 0x846], 1
mov eax, dword [ebp - 0x21a2]
mov ecx, dword [ebp - 0x219e]
cmp eax, ecx
jae 0x4076c4
sub ecx, eax
mov edx, dword [ebp - 0x27c2]
dec edx
dec edx
cmp ecx, edx
jbe 0x4075be
mov ecx, edx
mov dword [ebp - 0x27be], ecx
add eax, dword [esi + 0x20]
push ecx
push eax
lea edx, [ebp - 0x1f8c]
push edx
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
mov eax, dword [ebp - 0x846]
mov byte [ebp - 0x1f8d], al
mov ecx, dword [ebp - 0x27be]
lea edx, [ebp - 0x1f92]
push edx
lea edx, [ecx + 6]
push edx
lea edx, [ebp - 0x3e84]
push edx
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
je 0x407619
cmp eax, 0xffffffff
jne 0x407628
mov dword [ebp - 0x3e88], 1
jmp 0x4076bf
cmp byte [ebp - 0x3e80], 0x76
je 0x4076a3
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407683
xor eax, eax
jmp 0x40768d
cmp eax, 0x20
jbe 0x40768d
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x4076bf
call fcn.00407f71
inc dword [ebp - 0x846]
mov ecx, dword [ebp - 0x27be]
add dword [ebp - 0x21a2], ecx
jmp 0x40759a
jmp 0x407788
push 0x37
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 5
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x4076f3
cmp eax, 0xffffffff
jne 0x407702
mov dword [ebp - 0x3e88], 1
jmp 0x407788
cmp byte [ebp - 0x3e80], 0x77
je 0x40777d
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40775d
xor eax, eax
jmp 0x407767
cmp eax, 0x20
jbe 0x407767
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x407788
inc dword [ebp - 0x2e50]
jmp 0x40729f
cmp dword [ebp - 0x3e88], 0
jne 0x4077b8
push 0xa
push 0xd244b4f
push 0x5f4d4f52
push 0x5f474e49
push 0x54495257
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x1c
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0xa
je 0x4077cc
cmp eax, 0xb
jne 0x4079c2
cmp dword [ebp - 0x3e88], 0
jne 0x407898
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x111
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x407813
cmp eax, 0xffffffff
jne 0x40781f
mov dword [ebp - 0x3e88], 1
jmp 0x407898
cmp byte [ebp - 0x3e80], 0x51
je 0x407898
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x40787a
xor eax, eax
jmp 0x407884
cmp eax, 0x20
jbe 0x407884
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x4078d8
push 0x9f3
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xffffff14
push 0xdf070000
push esp
push 8
push 0xc8
push 0x40
push 6
push 0
call fcn.00407ff4
cmp eax, 0xffffffff
jne 0x4078d8
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x4079c2
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0
lea edx, [esp + 4]
push edx
push 0xa
call dword [edi]
push 0
lea edx, [esp + 4]
push edx
push 0xb
call dword [edi]
add esp, 4
push 0xffffff14
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 8
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x40793d
cmp eax, 0xffffffff
jne 0x407949
mov dword [ebp - 0x3e88], 1
jmp 0x4079c2
cmp byte [ebp - 0x3e80], 0x54
je 0x4079c2
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x4079a4
xor eax, eax
jmp 0x4079ae
cmp eax, 0x20
jbe 0x4079ae
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x17
jne 0x407c5c
cmp dword [ebp - 0x3e88], 0
jne 0x407a95
push 0x110
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 6
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x407a10
cmp eax, 0xffffffff
jne 0x407a1c
mov dword [ebp - 0x3e88], 1
jmp 0x407a95
cmp byte [ebp - 0x3e80], 0x50
je 0x407a95
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407a77
xor eax, eax
jmp 0x407a81
cmp eax, 0x20
jbe 0x407a81
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x407c5c
push 0x8f0219
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 7
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x407ad4
cmp eax, 0xffffffff
jne 0x407ae3
mov dword [ebp - 0x3e88], 1
jmp 0x407c5c
cmp byte [ebp - 0x3e80], 0x59
je 0x407b61
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407b3e
xor eax, eax
jmp 0x407b48
cmp eax, 0x20
jbe 0x407b48
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x407c5c
sub eax, 7
shr eax, 2
mov dword [ebp - 0x636], eax
mov dword [ebp - 0x632], 0
push 0xa
push 0xd642520
push 0x3a24544e
push 0x554f435f
push 0x43544424
push dword [ebp - 0x636]
lea eax, [esp + 4]
push eax
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x20
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
mov ecx, dword [ebp - 0x632]
cmp ecx, dword [ebp - 0x636]
jae 0x407c5c
imul ecx, ecx, 4
movzx eax, byte [ebp + ecx - 0x3e7d]
mov dword [ebp - 0x62e], eax
movzx eax, byte [ebp + ecx - 0x3e7c]
mov dword [ebp - 0x62a], eax
movzx eax, byte [ebp + ecx - 0x3e7b]
mov dword [ebp - 0x626], eax
movzx eax, byte [ebp + ecx - 0x3e7a]
mov dword [ebp - 0x622], eax
push 0xa
push 0xd58322e
push 0x252d5832
push 0x2e252d58
push 0x322e2558
push 0x322e2550
push dword [ebp - 0x622]
push dword [ebp - 0x626]
push dword [ebp - 0x62a]
push dword [ebp - 0x62e]
lea eax, [esp + 0x10]
push eax
lea edx, [ebp - 0x4384]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
lea edx, [ebp - 0x4384]
push edx
call dword [ebx + 0x30]
inc dword [ebp - 0x632]
jmp 0x407bb2
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp eax, 0x18
jne 0x407dd6
cmp dword [ebp - 0x3e88], 0
jne 0x407cc2
push 0
push 0xa0d2443
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0xffffff14
push 0xdf070000
push esp
push 8
push 0xc8
push 0x40
push 6
push 0
call fcn.00407ff4
cmp eax, 0xffffffff
jne 0x407cc2
mov dword [ebp - 0x3e88], 1
cmp dword [ebp - 0x3e88], 0
jne 0x407dd6
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0
lea edx, [esp + 4]
push edx
push 0xa
call dword [edi]
push 0
lea edx, [esp + 4]
push edx
push 0xb
call dword [edi]
add esp, 4
push 0xffffff14
push 0xe1070000
lea eax, [ebp - 0x3e84]
push esp
push 8
push eax
push 0x1f4
push 0x6d6
push 0x40
push 6
push 0
call fcn.00407fc0
test eax, eax
je 0x407d27
cmp eax, 0xffffffff
jne 0x407d36
mov dword [ebp - 0x3e88], 1
jmp 0x407dd6
cmp byte [ebp - 0x3e80], 0x54
je 0x407db1
push 0x203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x202c2452
push 0x4f525245
push 0x5f4e4f49
push 0x54414349
push 0x4e554d4d
push 0x4f435f52
push 0x4f525245
push 0x24202445
push 0x4d495424
lea ecx, [ebp - 0x3e84]
mov edx, esp
cmp eax, 0xffffffff
jne 0x407d91
xor eax, eax
jmp 0x407d9b
cmp eax, 0x20
jbe 0x407d9b
mov eax, 0x20
push ecx
push eax
push edx
push 0
call fcn.004081a1
mov dword [ebp - 0x3e88], 1
jmp 0x407dd6
push 0xa0d24
push 0x4b4f5f43
push 0x54445f45
push 0x53415245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x18
push 0
push 0
mov eax, esp
push 0
push eax
push 5
call dword [edi]
add esp, 8
push 0
mov eax, esp
push 0
push eax
push 2
call dword [edi]
add esp, 4
push 0
push 0
push 3
call dword [edi]
push 0
push 0
push 3
call dword [edi]
pop edi
cmp dword [ebx + 0xcd4], 0
je 0x407f4c
push 0x3e6c
push 0x6d74682f
push 0x3c3e7964
push 0x6f622f3c
push esp
call dword [ebx + 0x38]
add esp, 0x10
cmp dword [ebx + 0xcd4], 0
je 0x407e4c
push dword [ebx + 0xcd4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebx + 0xcd4], 0
push 0x7a
push 0x67002e
lea edx, [ebx + 0xacc]
push edx
lea edx, [ebp - 0x61e]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push esp
lea edx, [ebp - 0x61e]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
add esp, 8
lea edx, [ebp - 0x61e]
push edx
lea edx, [ebx + 0xacc]
push edx
call dword [ebx + 0x48]
test eax, eax
je 0x407f4c
lea edx, [ebx + 0xacc]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x61e]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push 0
push 0
push eax
lea edx, [ebp - 0x20e]
push edx
push 0xffffffffffffffff
lea edx, [ebp - 0x61e]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
lea edx, [ebp - 0x20e]
push edx
call dword [sym.imp.shlwapi.dll_PathStripPathA]
push 0x6d6f
push 0x632e7572
push 0x2e636d6d
mov dword [ebp - 6], esp
push 0
push 0x7068702e
push 0x74736574
push 0x5f6e6163
push 0x5f6b3231
push 0x355f3430
push 0x3138686d
push 0x5f6d6374
push 0x5f757374
push 0x696d2f74
push 0x7365742f
lea edx, [ebp - 0x20e]
push edx
lea edx, [ebp - 0x61e]
push edx
lea edx, [esp + 8]
push edx
push dword [ebp - 6]
call fcn.0040924a
add esp, 0x2c
add esp, 0xc
push 0
push esp
push 0x1000001
push 0x40b
push dword [ebx + 0x8e8]
call dword [sym.imp.USER32.DLL_SendMessageW]
add esp, 4
push 0
call dword [ebx + 0x44]
leave
ret 8