Function at 0x40129e
Capabilities:
Allocate thread local storage
Check os version
Connect pipe
Delete directory
Enumerate gui resources
Get disk information
Get file attributes
Get graphical window text
Identify system language via api
Log keystrokes
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x29a8
call fcn.004bd230
push esi
push edi
mov dword [ebp - 0x1fd4], 0xfffffff9
mov dword [ebp - 0x1fd0], 0xfffffff9
mov dword [ebp - 0x1fcc], 0xfffffff9
mov dword [ebp - 0x1fc8], 0xfffffff9
lea ecx, [ebp - 0x84d]
call fcn.00415bea
push eax
lea eax, [ebp - 0x1fc4]
push eax
lea eax, [ebp - 0x1fd4]
push eax
lea ecx, [ebp - 0x28e0]
call fcn.00415bed
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1df0]
call fcn.00415b99
mov dword [ebp - 0x1c4], 0xffffffff
mov dword [ebp - 0x1790], 0xcd04cd02
mov dword [ebp - 0x1c4], 0
jmp 0x401337
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 3
jg 0x4015a6
mov dword [ebp - 0x1d50], 0x2751c76d
mov dword [ebp - 0x1d4c], 0x2751c76d
mov dword [ebp - 0x1d48], 0x2751c76d
mov dword [ebp - 0x1d44], 0x2751c76d
mov dword [ebp - 0x19ac], 0x83afd470
mov dword [ebp - 0x634], 0
jmp 0x40138f
mov eax, dword [ebp - 0x634]
inc eax
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 2
jge 0x4013ab
mov eax, dword [ebp - 0x634]
mov dword [ebp + eax*4 - 0x2688], 0xbf24
jmp 0x401382
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1d50], 3
jmp 0x4013d9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d50]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1d50], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d50], 0
jl 0x4015a1
mov dword [ebp - 0x8bc], 2
push 3
lea ecx, [ebp - 0x20f0]
call fcn.00415aed
mov dword [ebp - 0x4bc], 0
jmp 0x40141d
mov eax, dword [ebp - 0x4bc]
inc eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 3
jge 0x40143f
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x20f0]
call fcn.00415bdb
mov dword [eax], 0xb1b5
jmp 0x401410
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x1df0]
call fcn.00415bdb
mov dword [eax], 0x4215e1ab
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x2234], eax
push 0
lea ecx, [ebp - 0x1df0]
call fcn.00415bdb
cmp dword [eax], 0xd982
jne 0x401483
mov dword [ebp - 0x11dc], 1
jmp 0x40148a
and dword [ebp - 0x11dc], 0
mov eax, dword [ebp - 0x11dc]
neg eax
add eax, dword [ebp - 0x8bc]
jne 0x4014a7
xor eax, eax
jne 0x4014a7
and dword [ebp - 0x1778], 0
jmp 0x4014b1
mov dword [ebp - 0x1778], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2688]
cmp eax, dword [ebp - 0x1778]
jg 0x4014d2
mov dword [ebp - 0x1780], 1
jmp 0x4014d9
and dword [ebp - 0x1780], 0
cmp dword [ebp - 0x1780], 0xd7d2
jle 0x4014f1
mov dword [ebp - 0x1788], 1
jmp 0x4014f8
and dword [ebp - 0x1788], 0
push 2
lea ecx, [ebp - 0x20f0]
call fcn.00415bdb
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x8c4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x8c4]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1788]
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x1790], eax
mov eax, dword [ebp - 0x1790]
mov ecx, dword [ebp - 0x8c4]
cmp dword [ecx], eax
jne 0x401550
mov dword [ebp - 0x1798], 1
jmp 0x401557
and dword [ebp - 0x1798], 0
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x1df0]
call fcn.00415bdb
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1798]
jne 0x40157e
mov dword [ebp - 0x17a0], 1
jmp 0x401585
and dword [ebp - 0x17a0], 0
mov eax, dword [ebp - 0x17a0]
mov dword [ebp - 0x19ac], eax
lea ecx, [ebp - 0x20f0]
call fcn.00415bbf
jmp 0x4013be
jmp 0x40132a
lea ecx, [ebp - 0x1df0]
call fcn.00415bbf
mov dword [ebp - 0xa0], 0xe8b7
mov dword [ebp - 0x17e8], 0x7555b7ce
push 4
lea ecx, [ebp - 0x2078]
call fcn.00415aed
mov dword [ebp - 0x3c], 0
jmp 0x4015e2
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x4015fe
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x2078]
call fcn.00415bdb
mov dword [eax], 0xfffffffb
jmp 0x4015db
mov dword [ebp - 0x3c], 0
jmp 0x40160e
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x401624
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1b04], 0xfffffff8
jmp 0x401607
mov dword [ebp - 0x3c], 0
jmp 0x401634
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x40164a
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1b0c], 0
jmp 0x40162d
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x17a8], eax
push 0
lea ecx, [ebp - 0x2078]
call fcn.00415bdb
mov ecx, dword [ebp - 0x17a8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x17a8]
jne 0x40168b
cmp dword [ebp - 0xa0], 0
jne 0x40168b
and dword [ebp - 0x17c8], 0
jmp 0x401695
mov dword [ebp - 0x17c8], 1
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x17c8], eax
jl 0x4016af
mov dword [ebp - 0x17d0], 1
jmp 0x4016b6
and dword [ebp - 0x17d0], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x17d0], eax
jle 0x4016d0
mov dword [ebp - 0x1afc], 1
jmp 0x4016d7
and dword [ebp - 0x1afc], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x2424], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xa0], eax
je 0x4016fd
mov dword [ebp - 0x17d8], 1
jmp 0x401704
and dword [ebp - 0x17d8], 0
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0x17d8]
jne 0x401724
mov eax, 0xab06
test eax, eax
jne 0x401724
and dword [ebp - 0x17e0], 0
jmp 0x40172e
mov dword [ebp - 0x17e0], 1
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x17e0], eax
jge 0x401748
mov dword [ebp - 0x8cc], 1
jmp 0x40174f
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x17e8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8cc]
mov dword [ebp + eax - 0x1b04], ecx
mov eax, dword [ebp - 0x17e8]
imul eax, dword [ebp - 0xa0]
imul eax, dword [ebp - 0x8cc]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1b0c], eax
lea ecx, [ebp - 0x2078]
call fcn.00415bbf
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x1cc], 0x3ca30775
mov dword [ebp - 0x271c], 0x44d5
mov dword [ebp - 0x4a8], 0
jmp 0x4017ce
mov eax, dword [ebp - 0x4a8]
inc eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 3
jge 0x4017ea
mov eax, dword [ebp - 0x4a8]
mov dword [ebp + eax*4 - 0x48c], 0xffffffff
jmp 0x4017c1
cmp dword [ebp - 0x10], 0xa4a1
jge 0x4018e9
mov dword [ebp - 0x36c], 0x8872
mov dword [ebp - 0x1b24], 0xfffffffe
mov eax, dword [ebp - 0x36c]
mov ecx, dword [ebp - 0x36c]
inc ecx
mov dword [ebp - 0x36c], ecx
test eax, eax
jne 0x401876
cmp dword [ebp - 0x10], 0
jne 0x401837
mov eax, dword [ebp - 0x10]
dec eax
jne 0x401837
and dword [ebp - 0x1b14], 0
jmp 0x401841
mov dword [ebp - 0x1b14], 1
cmp dword [ebp - 0x36c], 0xfffffffb
jg 0x401856
mov dword [ebp - 0x1b1c], 1
jmp 0x40185d
and dword [ebp - 0x1b1c], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x48c], 0
jne 0x401876
cmp dword [ebp - 0x36c], 0
je 0x40188b
mov eax, 0x3ecf04b0
test eax, eax
je 0x40188b
mov dword [ebp - 0x17f0], 1
jmp 0x401892
and dword [ebp - 0x17f0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x17f0], eax
jge 0x4018a9
mov dword [ebp - 0x17f8], 1
jmp 0x4018b0
and dword [ebp - 0x17f8], 0
mov eax, dword [ebp - 0x1b24]
cmp dword [ebp - 0x17f8], eax
je 0x4018ca
mov dword [ebp - 0x1800], 1
jmp 0x4018d1
and dword [ebp - 0x1800], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1800]
mov dword [ebp + eax - 0x48c], ecx
jmp 0x401b89
mov dword [ebp - 0x3ec], 0xaee51190
mov dword [ebp - 0x10], 0
jmp 0x401903
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x401b89
mov dword [ebp - 0x5fc], 0
jmp 0x401926
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 4
jge 0x401942
mov eax, dword [ebp - 0x5fc]
mov dword [ebp + eax*4 - 0x2958], 6
jmp 0x401919
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x48c]
cmp dword [ebp + eax - 0x48c], ecx
jg 0x40196a
mov dword [ebp - 0x1828], 1
jmp 0x401971
and dword [ebp - 0x1828], 0
cmp dword [ebp - 0x10], 0
jl 0x401983
mov dword [ebp - 0x1b2c], 1
jmp 0x40198a
and dword [ebp - 0x1b2c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x242c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2958]
mov dword [ebp - 0x2674], eax
mov eax, 0x7420
test eax, eax
je 0x4019ca
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x48c], 0
je 0x4019ca
mov dword [ebp - 0x1808], 1
jmp 0x4019d1
and dword [ebp - 0x1808], 0
cmp dword [ebp - 0x1808], 0x6a426232
je 0x4019e9
mov dword [ebp - 0x1810], 1
jmp 0x4019f0
and dword [ebp - 0x1810], 0
cmp dword [ebp - 0x1810], 0
je 0x401a05
mov dword [ebp - 0x1818], 1
jmp 0x401a0c
and dword [ebp - 0x1818], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x48c]
imul eax, dword [ebp - 0x1818]
cmp eax, dword [ebp - 0x3ec]
jne 0x401a33
mov dword [ebp - 0x1820], 1
jmp 0x401a3a
and dword [ebp - 0x1820], 0
mov eax, dword [ebp - 0x1820]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x1828], eax
jg 0x401a60
mov dword [ebp - 0x1830], 1
jmp 0x401a67
and dword [ebp - 0x1830], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x1830]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x48c]
jle 0x401a8b
mov dword [ebp - 0x1838], 1
jmp 0x401a92
and dword [ebp - 0x1838], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1838]
mov dword [ebp + eax - 0x48c], ecx
mov dword [ebp - 0x3ec], 0xfffffffa
jmp 0x401abe
mov eax, dword [ebp - 0x3ec]
dec eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0xfffffff3
jge 0x401b84
mov dword [ebp - 0x4b0], 0
jmp 0x401ae4
mov eax, dword [ebp - 0x4b0]
inc eax
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 2
jge 0x401b00
mov eax, dword [ebp - 0x4b0]
mov dword [ebp + eax*4 - 0x2458], 1
jmp 0x401ad7
mov dword [ebp - 0x1cc], 0x1a
jmp 0x401b19
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0xffffffee
jg 0x401b7f
mov dword [ebp - 0x1b34], 0xb0538fd2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2458], 0
je 0x401b3e
jmp 0x401b7f
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x48c], 1
jle 0x401b57
mov dword [ebp - 0x8dc], 1
jmp 0x401b5e
and dword [ebp - 0x8dc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8dc]
mov dword [ebp + eax - 0x48c], ecx
mov eax, dword [ebp - 0x8dc]
mov dword [ebp - 0x1b34], eax
jmp 0x401b0c
jmp 0x401ab1
jmp 0x4018fc
mov dword [ebp - 0x10], 0xffffffe5
jmp 0x401b99
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffee
jg 0x401d59
mov dword [ebp - 0x4b8], 0xc4f4
mov dword [ebp - 0x1b3c], 0xa55c
mov dword [ebp - 0x5f8], 0
jmp 0x401bd0
mov eax, dword [ebp - 0x5f8]
inc eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 3
jge 0x401bec
mov eax, dword [ebp - 0x5f8]
mov dword [ebp + eax*4 - 0x2854], 0xfffa
jmp 0x401bc3
cmp dword [ebp - 0x4b8], 0
je 0x401ce2
cmp dword [ebp - 0x4b8], 0
je 0x401c51
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x48c]
mov dword [ebp - 0x2434], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48c]
mov dword [ebp - 0x2834], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48c]
add eax, dword [ebp - 0x1cc]
je 0x401c51
cmp dword [ebp - 0x4b8], 0
je 0x401c51
mov dword [ebp - 0x1840], 1
jmp 0x401c58
and dword [ebp - 0x1840], 0
mov eax, dword [ebp - 0x1840]
dec eax
cmp eax, dword [ebp - 0x4b8]
jle 0x401c7c
cmp dword [ebp - 0x1b3c], 0
je 0x401c7c
mov dword [ebp - 0x1848], 1
jmp 0x401c83
and dword [ebp - 0x1848], 0
cmp dword [ebp - 0x1848], 0xd6068d11
jb 0x401c9b
mov dword [ebp - 0x1850], 1
jmp 0x401ca2
and dword [ebp - 0x1850], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x48c]
cmp dword [ebp - 0x1850], eax
jne 0x401cc2
mov dword [ebp - 0x1858], 1
jmp 0x401cc9
and dword [ebp - 0x1858], 0
mov eax, dword [ebp - 0x1858]
add eax, 0xb55e
je 0x401ce2
mov dword [ebp - 0x1860], 1
jmp 0x401ce9
and dword [ebp - 0x1860], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1860]
mov dword [ebp + eax - 0x48c], ecx
mov eax, 0x6a4af129
cmp eax, 1
je 0x401d12
mov dword [ebp - 0x1868], 1
jmp 0x401d19
and dword [ebp - 0x1868], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48c]
cmp dword [ebp - 0x1868], eax
jge 0x401d3a
mov dword [ebp - 0x1870], 1
jmp 0x401d41
and dword [ebp - 0x1870], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1870]
mov dword [ebp + eax - 0x2854], ecx
jmp 0x401b92
mov dword [ebp - 0x1f5c], 0xfffffff9
mov dword [ebp - 0x1f58], 0xfffffff9
mov dword [ebp - 0x1f54], 0xfffffff9
mov dword [ebp - 0x1f50], 0xfffffff9
lea ecx, [ebp - 0x855]
call fcn.00415bea
push eax
lea eax, [ebp - 0x1f4c]
push eax
lea eax, [ebp - 0x1f5c]
push eax
lea ecx, [ebp - 0x2938]
call fcn.00415bed
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1e50]
call fcn.00415b99
mov dword [ebp - 0x98], 0xfffffff6
mov dword [ebp - 0x1410], 0xa6d
mov dword [ebp - 0x9a8], 0xd0e834ab
mov dword [ebp - 0x1b44], 0xdb5a
mov dword [ebp - 0x1b4c], 0xfffa
mov dword [ebp - 0x104], 0
jmp 0x401e01
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jge 0x401e1d
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x444], 4
jmp 0x401df4
mov dword [ebp - 0x104], 0
jmp 0x401e36
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jge 0x401e52
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x2138], 2
jmp 0x401e29
mov dword [ebp - 0x98], 0xe
jmp 0x401e6b
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xfffffffa
jle 0x401ec9
mov dword [ebp - 0x6e0], 0xfffffffc
mov dword [ebp - 0x6e0], 0
jmp 0x401e97
mov eax, dword [ebp - 0x6e0]
inc eax
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 3
jl 0x401eb5
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x98]
mov dword [ebp + eax - 0x444], ecx
jmp 0x401e8a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x444], 0
je 0x401ec7
jmp 0x401e5e
jmp 0x401e5e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x444]
mov dword [ebp - 0x243c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x444], 0x8fc3a8a
jge 0x401efb
mov dword [ebp - 0x1878], 1
jmp 0x401f02
and dword [ebp - 0x1878], 0
mov eax, dword [ebp - 0x1410]
cmp dword [ebp - 0x1878], eax
jl 0x401f1c
mov dword [ebp - 0x13f8], 1
jmp 0x401f23
and dword [ebp - 0x13f8], 0
mov eax, dword [ebp - 0x13f8]
sub eax, 0x37f5185
cmp eax, 0xfffffff7
jne 0x401f3f
mov dword [ebp - 0x990], 1
jmp 0x401f46
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x990], eax
jge 0x401f60
mov dword [ebp - 0x1400], 1
jmp 0x401f67
and dword [ebp - 0x1400], 0
mov eax, dword [ebp - 0x1400]
mov dword [ebp - 0x98], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x444]
mov dword [ebp - 0x267c], eax
mov eax, dword [ebp - 0x98]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x444]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2138]
jge 0x401fb4
mov dword [ebp - 0x998], 1
jmp 0x401fbb
and dword [ebp - 0x998], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2138]
imul eax, dword [ebp - 0x998]
test eax, eax
jne 0x401fe1
xor eax, eax
inc eax
jne 0x401fe1
and dword [ebp - 0x1408], 0
jmp 0x401feb
mov dword [ebp - 0x1408], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x444]
cmp eax, dword [ebp - 0x1408]
jge 0x40200c
mov dword [ebp - 0x9a0], 1
jmp 0x402013
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x9a0]
sub eax, dword [ebp - 0x1410]
mov dword [ebp - 0x9a8], eax
cmp dword [ebp - 0x9a8], 0xa77b
je 0x40203d
mov dword [ebp - 0x1418], 1
jmp 0x402044
and dword [ebp - 0x1418], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x444]
sub eax, dword [ebp - 0x1418]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x444], eax
cmp dword [ebp - 0x1b44], 5
jl 0x402089
mov dword [ebp - 0x9b0], 1
mov eax, dword [ebp - 0x9b0]
inc eax
mov dword [ebp - 0x9b0], eax
jmp 0x40227d
mov dword [ebp - 0x9b8], 0xffffffff
mov dword [ebp - 0x9d8], 0
mov dword [ebp - 0x4c0], 0
jmp 0x4020b6
mov eax, dword [ebp - 0x4c0]
inc eax
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 4
jge 0x4020d2
mov eax, dword [ebp - 0x4c0]
mov dword [ebp + eax*4 - 0x272c], 5
jmp 0x4020a9
mov dword [ebp - 0x98], 0x18
jmp 0x4020eb
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xfffffff5
jle 0x40227d
mov dword [ebp - 0x1b54], 6
mov dword [ebp - 0x8e4], 0x4e26
mov dword [ebp - 0x1430], 0
mov eax, dword [ebp - 0x1b4c]
mov dword [ebp - 0x2444], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x272c], 6
ja 0x40213d
mov dword [ebp - 0x1420], 1
jmp 0x402144
and dword [ebp - 0x1420], 0
mov eax, dword [ebp - 0x1420]
mov dword [ebp - 0x9b8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2138]
cmp dword [ebp - 0x9b8], eax
jle 0x402170
mov dword [ebp - 0x1428], 1
jmp 0x402177
and dword [ebp - 0x1428], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x444]
cmp eax, dword [ebp - 0x1428]
jge 0x402198
mov dword [ebp - 0x9c0], 1
jmp 0x40219f
and dword [ebp - 0x9c0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x9c0]
mov dword [ebp + eax - 0x272c], ecx
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x1430], eax
mov eax, dword [ebp - 0x9d8]
cmp dword [ebp - 0x1430], eax
jl 0x4021d7
mov dword [ebp - 0x9c8], 1
jmp 0x4021de
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x8e4]
cmp dword [ebp - 0x9c8], eax
jne 0x4021f8
mov dword [ebp - 0x1438], 1
jmp 0x4021ff
and dword [ebp - 0x1438], 0
mov eax, dword [ebp - 0x8e4]
imul eax, dword [ebp - 0x1438]
cmp eax, 0x978c
je 0x40221f
mov dword [ebp - 0x9d0], 1
jmp 0x402226
and dword [ebp - 0x9d0], 0
imul eax, dword [ebp - 0x1b54], 0xa183
cmp eax, dword [ebp - 0x9d0]
jne 0x402254
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x272c], 0
je 0x402254
mov dword [ebp - 0x1440], 1
jmp 0x40225b
and dword [ebp - 0x1440], 0
mov eax, dword [ebp - 0x1440]
mov dword [ebp - 0x9d8], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x444], 0xfe298319
jmp 0x4020de
mov dword [ebp - 0x1f4], 0xffffffff
mov dword [ebp - 0x1d4], 0x7e2799ac
mov dword [ebp - 0x2d8], 1
mov dword [ebp - 0x4c8], 0xfffffffa
push 2
lea ecx, [ebp - 0x1ff4]
call fcn.00415aed
mov dword [ebp - 0x1b64], 0xcd1b7e2
mov dword [ebp - 0x600], 0
jmp 0x4022d5
mov eax, dword [ebp - 0x600]
inc eax
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 2
jge 0x4022f7
push dword [ebp - 0x600]
lea ecx, [ebp - 0x1ff4]
call fcn.00415bdb
mov dword [eax], 1
jmp 0x4022c8
mov dword [ebp - 0x1d4], 2
jmp 0x402310
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0xffffffe3
jle 0x40233c
mov dword [ebp - 0x1b5c], 0x14d2edc7
cmp dword [ebp - 0x1b5c], 0
je 0x40232e
jmp 0x40233c
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x4c8], eax
jmp 0x402303
cmp dword [ebp - 0x4c8], 0
je 0x402365
mov dword [ebp - 0x1d4], 8
mov eax, dword [ebp - 0x1d4]
mov ecx, dword [ebp - 0x2d8]
sub ecx, 7
imul eax, ecx
test eax, eax
jne 0x402377
mov eax, 0x14a2af6c
test eax, eax
jne 0x402377
and dword [ebp - 0x1448], 0
jmp 0x402381
mov dword [ebp - 0x1448], 1
mov eax, dword [ebp - 0x4c8]
cmp dword [ebp - 0x1448], eax
jl 0x40239b
mov dword [ebp - 0x9e0], 1
jmp 0x4023a2
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp - 0x1d4], eax
jge 0x4023c8
mov dword [ebp - 0x1450], 1
jmp 0x4023cf
and dword [ebp - 0x1450], 0
mov eax, dword [ebp - 0x1450]
add eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x9e8], eax
push 1
lea ecx, [ebp - 0x1ff4]
call fcn.00415bdb
mov ecx, dword [ebp - 0x9e8]
mov dword [eax], ecx
cmp dword [ebp - 0x9e8], 0
je 0x402414
cmp dword [ebp - 0x2d8], 0
je 0x402414
mov dword [ebp - 0x1458], 1
jmp 0x40241b
and dword [ebp - 0x1458], 0
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp - 0x1458], eax
jne 0x402435
mov dword [ebp - 0x9f0], 1
jmp 0x40243c
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x1b64], eax
lea ecx, [ebp - 0x1ff4]
call fcn.00415bbf
mov dword [ebp - 0x1578], 0xcd04cd02
push 1
lea ecx, [ebp - 0x1964]
call fcn.00415aed
mov dword [ebp - 0x2730], 0
mov dword [ebp - 0x1b6c], 0x3111738a
mov dword [ebp - 0x10c], 0
jmp 0x402497
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x4024b9
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x1964]
call fcn.00415bdb
mov dword [eax], 0x3ae35568
jmp 0x40248a
mov dword [ebp - 0x10c], 0
jmp 0x4024d2
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x4024ee
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x1b74], 0xf7bf
jmp 0x4024c5
push 0
lea ecx, [ebp - 0x1964]
call fcn.00415bdb
mov dword [eax], 0xffffffea
jmp 0x402527
push 0
lea ecx, [ebp - 0x1964]
call fcn.00415bdb
mov dword [ebp - 0x1460], eax
mov eax, dword [ebp - 0x1460]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1460]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1964]
call fcn.00415bdb
cmp dword [eax], 0x13
jne 0x402681
mov dword [ebp - 0x1dc], 0x6d2e
mov dword [ebp - 0x9f8], 0
mov dword [ebp - 0xa10], 0xdbc1c234
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1dc], 0
jmp 0x402581
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jg 0x40267c
mov dword [ebp - 0x1480], 0xffffffff
cmp dword [ebp - 0x1b6c], 0x7dcd
jle 0x402655
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x9f8]
cmp dword [ebp - 0x1480], eax
jle 0x4025ce
mov dword [ebp - 0x1468], 1
jmp 0x4025d5
and dword [ebp - 0x1468], 0
push 0
lea ecx, [ebp - 0x1964]
call fcn.00415bdb
mov ecx, dword [ebp - 0x1468]
cmp ecx, dword [eax]
jl 0x4025f8
mov dword [ebp - 0xa00], 1
jmp 0x4025ff
and dword [ebp - 0xa00], 0
cmp dword [ebp - 0xa00], 9
jbe 0x402614
mov dword [ebp - 0x1470], 1
jmp 0x40261b
and dword [ebp - 0x1470], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b74]
cmp eax, dword [ebp - 0x1470]
jg 0x40263c
mov dword [ebp - 0xa08], 1
jmp 0x402643
and dword [ebp - 0xa08], 0
cmp dword [ebp - 0xa08], 0xfffffffe
je 0x402655
and dword [ebp - 0x1478], 0
jmp 0x40265f
mov dword [ebp - 0x1478], 1
mov eax, dword [ebp - 0x1478]
mov dword [ebp - 0xa10], eax
mov eax, dword [ebp - 0xa10]
mov dword [ebp - 0x1480], eax
jmp 0x402574
jmp 0x402503
lea ecx, [ebp - 0x1964]
call fcn.00415bbf
mov dword [ebp - 0x1f4], 0
jmp 0x4026a5
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 3
jg 0x403eb0
mov dword [ebp - 0x244c], 0xffffffff
mov dword [ebp - 0x4d0], 1
mov dword [ebp - 0x21bc], 0x4964a53a
mov dword [ebp - 0x21c0], 1
mov dword [ebp - 0x21c8], 0xfffffffa
push 1
lea ecx, [ebp - 0x1e08]
call fcn.00415aed
mov dword [ebp - 0x698], 0
jmp 0x40270a
mov eax, dword [ebp - 0x698]
inc eax
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 1
jge 0x40272c
push dword [ebp - 0x698]
lea ecx, [ebp - 0x1e08]
call fcn.00415bdb
mov dword [eax], 0xfffffffe
jmp 0x4026fd
push 0
lea ecx, [ebp - 0x1e08]
call fcn.00415bdb
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0xa18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa18]
mov dword [ecx], eax
mov dword [ebp - 0x4d0], 0x17
jmp 0x402769
mov eax, dword [ebp - 0x4d0]
dec eax
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 0xfffffff5
jge 0x4027c3
mov dword [ebp - 0x354], 0xffff
mov dword [ebp - 0x354], 0xbfc3938d
mov dword [ebp - 0x354], 0
jmp 0x40279f
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 1
jge 0x4027c1
push dword [ebp - 0x354]
lea ecx, [ebp - 0x1e08]
call fcn.00415bdb
mov dword [eax], 8
jmp 0x402792
jmp 0x40275c
lea ecx, [ebp - 0x1e08]
call fcn.00415bbf
mov dword [ebp - 0x1d64], 0x2751c76d
mov dword [ebp - 0x1d60], 0x2751c76d
mov dword [ebp - 0x1d5c], 0x2751c76d
mov dword [ebp - 0x1d58], 0x2751c76d
push 2
lea ecx, [ebp - 0x24d0]
call fcn.00415aed
mov dword [ebp - 0x4d8], 0
mov dword [ebp - 0x608], 0
jmp 0x402826
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 2
jge 0x402848
push dword [ebp - 0x608]
lea ecx, [ebp - 0x24d0]
call fcn.00415bdb
mov dword [eax], 0x862fd41e
jmp 0x402819
mov byte [ebp - 0x2d2], 0
movzx eax, byte [ebp - 0x2d2]
test eax, eax
je 0x402866
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov dword [ebp - 0x4d8], 1
jmp 0x40287f
mov eax, dword [ebp - 0x4d8]
dec eax
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 0
jl 0x4028ca
mov byte [ebp - 0x2bc], 0
movzx eax, byte [ebp - 0x2bc]
test eax, eax
je 0x4028a4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov byte [ebp - 0x26d], 0
movzx eax, byte [ebp - 0x26d]
test eax, eax
je 0x4028c8
push 0x9d0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x402872
lea ecx, [ebp - 0x24d0]
call fcn.00415bbf
mov dword [ebp - 0xb4], 1
push 2
lea ecx, [ebp - 0x1e20]
call fcn.00415aed
mov dword [ebp - 0x154], 0
jmp 0x402905
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x402921
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x91c], 0
jmp 0x4028f8
mov dword [ebp - 0x154], 0
jmp 0x40293a
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x402959
push dword [ebp - 0x154]
lea ecx, [ebp - 0x1e20]
call fcn.00415bdb
or dword [eax], 0xffffffff
jmp 0x40292d
mov dword [ebp - 0xb4], 2
jmp 0x402972
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jl 0x402ec2
push 2
lea ecx, [ebp - 0x780]
call fcn.00415aed
mov dword [ebp - 0x21d0], 0x9b41dbc4
mov dword [ebp - 0x1e4], 0xb167d3d8
mov dword [ebp - 0x708], 0
jmp 0x4029b9
mov eax, dword [ebp - 0x708]
inc eax
mov dword [ebp - 0x708], eax
cmp dword [ebp - 0x708], 2
jge 0x4029db
push dword [ebp - 0x708]
lea ecx, [ebp - 0x780]
call fcn.00415bdb
mov dword [eax], 2
jmp 0x4029ac
push 1
lea ecx, [ebp - 0x780]
call fcn.00415bdb
mov dword [eax], 2
jmp 0x402a14
push 1
lea ecx, [ebp - 0x780]
call fcn.00415bdb
mov dword [ebp - 0x1488], eax
mov eax, dword [ebp - 0x1488]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1488]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x780]
call fcn.00415bdb
cmp dword [eax], 0
jl 0x402eb2
mov dword [ebp - 0x374], 4
mov dword [ebp - 0x21d8], 0xfffffffb
mov dword [ebp - 0x1b8c], 1
mov dword [ebp - 0x1b94], 0x2089ce3
mov dword [ebp - 0x1b9c], 2
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0x91c]
add eax, 0x12af
mov ecx, dword [ebp - 0xb4]
cmp eax, dword [ebp + ecx*4 - 0x91c]
jg 0x402a89
mov dword [ebp - 0xa20], 1
jmp 0x402a90
and dword [ebp - 0xa20], 0
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0x91c]
cmp dword [ebp - 0xa20], eax
jge 0x402ab1
mov dword [ebp - 0x1b7c], 1
jmp 0x402ab8
and dword [ebp - 0x1b7c], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp + eax*4 - 0x91c], 3
jae 0x402ad4
mov dword [ebp - 0x1490], 1
jmp 0x402adb
and dword [ebp - 0x1490], 0
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0x91c]
cmp dword [ebp - 0x1490], eax
jle 0x402afc
mov dword [ebp - 0xa28], 1
jmp 0x402b03
and dword [ebp - 0xa28], 0
cmp dword [ebp - 0xa28], 8
jae 0x402b18
mov dword [ebp - 0x1498], 1
jmp 0x402b1f
and dword [ebp - 0x1498], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x91c]
cmp dword [ebp - 0x1498], eax
jl 0x402b40
mov dword [ebp - 0xa30], 1
jmp 0x402b47
and dword [ebp - 0xa30], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x91c]
cmp dword [ebp - 0xa30], eax
jne 0x402b69
xor eax, eax
jne 0x402b69
and dword [ebp - 0x14a0], 0
jmp 0x402b73
mov dword [ebp - 0x14a0], 1
cmp dword [ebp - 0x14a0], 0xfad0
jge 0x402b92
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x402b92
mov dword [ebp - 0xa38], 1
jmp 0x402b99
and dword [ebp - 0xa38], 0
cmp dword [ebp - 0xa38], 0xb752bf39
jbe 0x402bb1
mov dword [ebp - 0x14a8], 1
jmp 0x402bb8
and dword [ebp - 0x14a8], 0
push 0
lea ecx, [ebp - 0x780]
call fcn.00415bdb
mov ecx, dword [ebp - 0x14a8]
cmp ecx, dword [eax]
jle 0x402bdb
mov dword [ebp - 0xa40], 1
jmp 0x402be2
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0xa40]
jle 0x402bfc
mov dword [ebp - 0x14b0], 1
jmp 0x402c03
and dword [ebp - 0x14b0], 0
cmp dword [ebp - 0x14b0], 0x22d8
je 0x402c1b
mov dword [ebp - 0x1b84], 1
jmp 0x402c22
and dword [ebp - 0x1b84], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x91c]
mov dword [ebp - 0x21e0], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x21e8], eax
push 0
lea ecx, [ebp - 0x780]
call fcn.00415bdb
mov eax, 0xf0e4
neg eax
je 0x402c74
push 1
lea ecx, [ebp - 0x780]
call fcn.00415bdb
cmp dword [eax], 0
je 0x402c74
mov dword [ebp - 0xa48], 1
jmp 0x402c7b
and dword [ebp - 0xa48], 0
cmp dword [ebp - 0xa48], 0xe0c0
jne 0x402c93
mov dword [ebp - 0x14b8], 1
jmp 0x402c9a
and dword [ebp - 0x14b8], 0
push 1
lea ecx, [ebp - 0x780]
call fcn.00415bdb
mov eax, dword [eax]
cmp eax, dword [ebp - 0x14b8]
jl 0x402cbd
mov dword [ebp - 0xa50], 1
jmp 0x402cc4
and dword [ebp - 0xa50], 0
cmp dword [ebp - 0xa50], 1
jle 0x402ce9
mov dword [ebp - 0x21f0], 0xfa1b4415
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
jmp 0x402ead
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x1e4], 0
jmp 0x402d0c
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jg 0x402ead
mov eax, 0x437
test eax, eax
je 0x402dc3
push 1
lea ecx, [ebp - 0x780]
call fcn.00415bdb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x91c]
mov dword [ebp - 0x21f8], eax
mov eax, dword [ebp - 0x1b8c]
mov dword [ebp - 0x2200], eax
cmp dword [ebp - 0x1e4], 0
je 0x402d71
xor eax, eax
inc eax
je 0x402d71
cmp dword [ebp - 0x374], 0
je 0x402d71
mov dword [ebp - 0x14c0], 1
jmp 0x402d78
and dword [ebp - 0x14c0], 0
cmp dword [ebp - 0x14c0], 0x138c4
jg 0x402d9f
push 1
lea ecx, [ebp - 0x1e20]
call fcn.00415bdb
cmp dword [eax], 0
jne 0x402d9f
and dword [ebp - 0xa58], 0
jmp 0x402da9
mov dword [ebp - 0xa58], 1
mov eax, dword [ebp - 0x1b94]
cmp dword [ebp - 0xa58], eax
jne 0x402dc3
mov dword [ebp - 0x14c8], 1
jmp 0x402dca
and dword [ebp - 0x14c8], 0
imul eax, dword [ebp - 0x14c8], 0
cmp eax, dword [ebp - 0x1b9c]
je 0x402de5
mov dword [ebp - 0xa60], 1
jmp 0x402dec
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0xa60]
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x374], 2
jmp 0x402e11
mov eax, dword [ebp - 0x374]
dec eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0
jl 0x402ea8
mov dword [ebp - 0x42c], 0
jmp 0x402e37
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 2
jg 0x402e87
push 1
lea ecx, [ebp - 0x780]
call fcn.00415bdb
mov eax, dword [eax]
mov esi, 0x8afc
sub esi, dword [ebp + eax*4 - 0x91c]
push 1
lea ecx, [ebp - 0x1e20]
call fcn.00415bdb
mov dword [eax], esi
push 1
lea ecx, [ebp - 0x780]
call fcn.00415bdb
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x91c], 0
je 0x402e85
jmp 0x402e87
jmp 0x402e2a
mov byte [ebp - 0x2be], 0
movzx eax, byte [ebp - 0x2be]
test eax, eax
je 0x402ea3
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
jmp 0x402e04
jmp 0x402cff
jmp 0x4029f0
lea ecx, [ebp - 0x780]
call fcn.00415bbf
jmp 0x402965
mov byte [ebp - 0x275], 0
movzx eax, byte [ebp - 0x275]
test eax, eax
je 0x402edc
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea ecx, [ebp - 0x1e20]
call fcn.00415bbf
mov dword [ebp - 0x1c6c], 0x83afd470
push 2
lea ecx, [ebp - 0x1904]
call fcn.00415aed
mov dword [ebp - 0x80], 0x667a876e
mov dword [ebp - 0x4e8], 1
mov dword [ebp - 0x4e0], 0
jmp 0x402f28
mov eax, dword [ebp - 0x4e0]
inc eax
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 2
jge 0x402f4a
push dword [ebp - 0x4e0]
lea ecx, [ebp - 0x1904]
call fcn.00415bdb
mov dword [eax], 0xdf99ff60
jmp 0x402f1b
mov dword [ebp - 0x80], 0
jmp 0x402f5a
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jg 0x403380
push 3
lea ecx, [ebp - 0x750]
call fcn.00415aed
mov dword [ebp - 0x6a0], 0x1f7b4007
mov dword [ebp - 0x35c], 0x3888
mov dword [ebp - 0x610], 0
jmp 0x402f9e
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 3
jge 0x402fc0
push dword [ebp - 0x610]
lea ecx, [ebp - 0x750]
call fcn.00415bdb
mov dword [eax], 1
jmp 0x402f91
push 0
lea ecx, [ebp - 0x1904]
call fcn.00415bdb
mov esi, eax
push 0
lea ecx, [ebp - 0x750]
call fcn.00415bdb
mov edi, eax
push 1
lea ecx, [ebp - 0x750]
call fcn.00415bdb
mov ecx, dword [edi]
add ecx, dword [eax]
cmp dword [esi], ecx
jge 0x403023
push 0
lea ecx, [ebp - 0x750]
call fcn.00415bdb
cmp dword [eax], 0
jne 0x403023
push 0
lea ecx, [ebp - 0x1904]
call fcn.00415bdb
cmp dword [eax], 0
je 0x403023
mov dword [ebp - 0x14d0], 1
jmp 0x40302a
and dword [ebp - 0x14d0], 0
cmp dword [ebp - 0x14d0], 0x33c0
jl 0x403042
mov dword [ebp - 0xa68], 1
jmp 0x403049
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0xa68], eax
jle 0x403066
cmp dword [ebp - 0x80], 0
jne 0x403066
mov dword [ebp - 0x14d8], 1
jmp 0x40306d
and dword [ebp - 0x14d8], 0
cmp dword [ebp - 0x14d8], 0x2891ba8
jg 0x403085
mov dword [ebp - 0x1ba4], 1
jmp 0x40308c
and dword [ebp - 0x1ba4], 0
push 0
lea ecx, [ebp - 0x750]
call fcn.00415bdb
push 0
lea ecx, [ebp - 0x750]
call fcn.00415bdb
mov esi, dword [eax]
sub esi, 0xb607
push 2
lea ecx, [ebp - 0x750]
call fcn.00415bdb
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0x750]
call fcn.00415bdb
cmp esi, dword [eax]
jl 0x4030db
mov dword [ebp - 0xa70], 1
jmp 0x4030e2
and dword [ebp - 0xa70], 0
imul eax, dword [ebp - 0xa70], 0x507e
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x2208], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x2210], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x2218], eax
push 2
lea ecx, [ebp - 0x750]
call fcn.00415bdb
cmp dword [eax], 0
jl 0x40314e
mov byte [ebp - 0x2c0], 0
movzx eax, byte [ebp - 0x2c0]
test eax, eax
je 0x403149
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x403370
mov dword [ebp - 0xa88], 1
mov byte [ebp - 0x27d], 0
movzx eax, byte [ebp - 0x27d]
test eax, eax
je 0x40317e
push 0
push 0x6fe
push 0x76
push 0xd9b
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [ebp - 0x35c], 0
jmp 0x403197
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 1
jg 0x403370
mov dword [ebp - 0x14f8], 0xf2ba
push dword [ebp - 0x80]
lea ecx, [ebp - 0x1904]
call fcn.00415bdb
mov dword [ebp - 0x14e0], eax
push dword [ebp - 0x80]
lea ecx, [ebp - 0x750]
call fcn.00415bdb
mov ecx, dword [ebp - 0x14e0]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14e0]
mov ecx, 0xfffb
sub ecx, dword [eax]
jne 0x403309
push 0
lea ecx, [ebp - 0x1904]
call fcn.00415bdb
mov esi, eax
push dword [ebp - 0x80]
lea ecx, [ebp - 0x1904]
call fcn.00415bdb
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x40321c
mov dword [ebp - 0x1c1c], 1
jmp 0x403223
and dword [ebp - 0x1c1c], 0
push dword [ebp - 0x80]
lea ecx, [ebp - 0x750]
call fcn.00415bdb
push dword [ebp - 0x80]
lea ecx, [ebp - 0x750]
call fcn.00415bdb
cmp dword [eax], 1
ja 0x403250
mov dword [ebp - 0xa78], 1
jmp 0x403257
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0xa88]
cmp dword [ebp - 0xa78], eax
je 0x403271
mov dword [ebp - 0x1c24], 1
jmp 0x403278
and dword [ebp - 0x1c24], 0
cmp dword [ebp - 0x80], 0xfff9
ja 0x40328d
mov dword [ebp - 0x14e8], 1
jmp 0x403294
and dword [ebp - 0x14e8], 0
mov eax, dword [ebp - 0x6a0]
cmp eax, dword [ebp - 0x14e8]
jne 0x4032b7
cmp dword [ebp - 0x35c], 0
je 0x4032b7
mov dword [ebp - 0xa80], 1
jmp 0x4032be
and dword [ebp - 0xa80], 0
cmp dword [ebp - 0xa80], 0x3095
jl 0x4032dc
mov eax, 0x62ed
test eax, eax
jne 0x4032dc
and dword [ebp - 0x14f0], 0
jmp 0x4032e6
mov dword [ebp - 0x14f0], 1
mov eax, dword [ebp - 0x14f0]
mov dword [ebp - 0x14f8], eax
mov eax, dword [ebp - 0xa88]
cmp dword [ebp - 0x14f8], eax
jg 0x403309
and dword [ebp - 0xa90], 0
jmp 0x403313
mov dword [ebp - 0xa90], 1
mov dword [ebp - 0x4e8], 0x9c8c
mov eax, dword [ebp - 0x4e8]
cmp eax, dword [ebp - 0xa90]
jl 0x403337
mov dword [ebp - 0x1500], 1
jmp 0x40333e
and dword [ebp - 0x1500], 0
mov eax, dword [ebp - 0x1500]
mov dword [ebp - 0x6a0], eax
mov byte [ebp - 0x2c2], 0
movzx eax, byte [ebp - 0x2c2]
test eax, eax
je 0x40336b
push 0x2e1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x40318a
lea ecx, [ebp - 0x750]
call fcn.00415bbf
jmp 0x402f53
lea ecx, [ebp - 0x1904]
call fcn.00415bbf
mov dword [ebp - 0x37c], 0
mov dword [ebp - 0x8ec], 0x703d9b95
mov dword [ebp - 0xa98], 0
mov dword [ebp - 0x1518], 0x70512a30
mov dword [ebp - 0xab0], 0xd66c4a87
mov dword [ebp - 0x1c2c], 0
mov byte [ebp - 0x285], 0
movzx eax, byte [ebp - 0x285]
test eax, eax
je 0x4033e1
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x2220], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x2228], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x8ec], eax
mov eax, 0x37c1d6b3
sub eax, dword [ebp - 0x37c]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0xa98]
cmp dword [ebp - 0x8ec], eax
jl 0x403430
mov dword [ebp - 0x1508], 1
jmp 0x403437
and dword [ebp - 0x1508], 0
cmp dword [ebp - 0x1508], 0xfffffffb
je 0x40344c
mov dword [ebp - 0xaa0], 1
jmp 0x403453
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0x37c]
imul eax, dword [ebp - 0xaa0]
imul eax, eax, 0xffff
test eax, eax
jne 0x403476
mov dword [ebp - 0x1510], 1
jmp 0x40347d
and dword [ebp - 0x1510], 0
imul eax, dword [ebp - 0x1510], 0xba33
test eax, eax
je 0x4034a0
cmp dword [ebp - 0x8ec], 0
je 0x4034a0
mov dword [ebp - 0xaa8], 1
jmp 0x4034a7
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0x1518], eax
mov eax, dword [ebp - 0x1518]
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0x1c2c], eax
mov dword [ebp - 0x4f0], 0
jmp 0x4034e4
mov eax, dword [ebp - 0x4f0]
inc eax
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 2
jge 0x403500
mov eax, dword [ebp - 0x4f0]
mov dword [ebp + eax*4 - 0x27fc], 0xbf24
jmp 0x4034d7
mov dword [ebp - 0x618], 0
mov byte [ebp - 0x2c4], 0
movzx eax, byte [ebp - 0x2c4]
test eax, eax
je 0x403537
push 0x13d0
push 0
push 0xa20
push 0x15bd
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x618], 0
jmp 0x403550
mov eax, dword [ebp - 0x618]
inc eax
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 0
jne 0x403632
push 3
lea ecx, [ebp - 0x1e38]
call fcn.00415aed
mov dword [ebp - 0x1ec], 0xa0029bf3
mov dword [ebp - 0x4f8], 0
jmp 0x40358d
mov eax, dword [ebp - 0x4f8]
inc eax
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 3
jge 0x4035ac
push dword [ebp - 0x4f8]
lea ecx, [ebp - 0x1e38]
call fcn.00415bdb
or dword [eax], 0xffffffff
jmp 0x403580
mov dword [ebp - 0x1ec], 0
jmp 0x4035c5
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 2
jg 0x403622
mov dword [ebp - 0x1c34], 0xfffffffc
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x1e38]
call fcn.00415bdb
mov dword [ebp - 0x1520], eax
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x1e38]
call fcn.00415bdb
mov ecx, dword [ebp - 0x1520]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1520]
mov eax, dword [eax]
sub eax, dword [ebp - 0x1ec]
neg eax
mov dword [ebp - 0x1c34], eax
jmp 0x4035b8
lea ecx, [ebp - 0x1e38]
call fcn.00415bbf
jmp 0x403543
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1d64], 3
jmp 0x403660
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d64]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1d64], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d64], 0
jl 0x403eab
mov dword [ebp - 0x90c], 2
push 3
lea ecx, [ebp - 0x20a8]
call fcn.00415aed
mov dword [ebp - 0x1550], 0xffffffff
mov dword [ebp - 0x500], 5
mov dword [ebp - 0x904], 0xffffffff
mov dword [ebp - 0x8f4], 1
mov dword [ebp - 0x1dac], 1
mov dword [ebp - 0x1da8], 1
mov dword [ebp - 0x1da4], 1
mov dword [ebp - 0x1da0], 1
mov dword [ebp - 0x6e8], 0x6721f7d
mov dword [ebp - 0x1530], 1
mov dword [ebp - 0x114], 0
jmp 0x403708
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jge 0x403724
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x1928], 0x99cfe04
jmp 0x4036fb
mov dword [ebp - 0x114], 0
jmp 0x40373d
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jge 0x403759
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x1cfc], 0xfffffffe
jmp 0x403730
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1928]
mov dword [ebp - 0x2230], eax
mov eax, dword [ebp - 0x6e8]
inc eax
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x500], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1dac], 0
mov dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x904]
imul eax, dword [ebp - 0x8f4]
cmp dword [ebp - 0x500], eax
jle 0x4037c1
mov dword [ebp - 0x1c3c], 1
jmp 0x4037c8
and dword [ebp - 0x1c3c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1928]
mov dword [ebp - 0x2238], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1928]
cmp dword [ebp - 0x500], eax
jne 0x4037fc
mov dword [ebp - 0xab8], 1
jmp 0x403803
and dword [ebp - 0xab8], 0
mov eax, dword [ebp - 0x8f4]
cmp dword [ebp - 0xab8], eax
jge 0x40381d
mov dword [ebp - 0x1528], 1
jmp 0x403824
and dword [ebp - 0x1528], 0
mov eax, dword [ebp - 0x1528]
sub eax, dword [ebp - 0x1530]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1928]
lea eax, [eax + ecx + 0x1abdf11c]
cmp eax, 0xffff
jne 0x403857
mov dword [ebp - 0xac0], 1
jmp 0x40385e
and dword [ebp - 0xac0], 0
cmp dword [ebp - 0xac0], 0x1f19
je 0x403876
mov dword [ebp - 0xac8], 1
jmp 0x40387d
and dword [ebp - 0xac8], 0
mov eax, dword [ebp - 0x1530]
cmp dword [ebp - 0xac8], eax
jge 0x4038a4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1dac], 0
jne 0x4038a4
and dword [ebp - 0x1538], 0
jmp 0x4038ae
mov dword [ebp - 0x1538], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1cfc]
mov dword [ebp - 0x1c44], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1538]
sub ecx, dword [ebp + eax - 0x1928]
mov dword [ebp - 0x1c4c], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1cfc]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1cfc], eax
mov eax, dword [ebp - 0x1c44]
cmp eax, dword [ebp - 0x1c4c]
jne 0x40390c
mov dword [ebp - 0xad0], 1
jmp 0x403913
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0x1550], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1928], 0xfffc
jb 0x40393d
mov dword [ebp - 0x1c54], 1
jmp 0x403944
and dword [ebp - 0x1c54], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1cfc], 0
jne 0x403962
or eax, 0xffffffff
jne 0x403962
and dword [ebp - 0x1540], 0
jmp 0x40396c
mov dword [ebp - 0x1540], 1
imul eax, dword [ebp - 0x1540], 0xfff8
cmp eax, 0xbc6c2db6
jb 0x403995
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1928], 0
jne 0x403995
and dword [ebp - 0x1c5c], 0
jmp 0x40399f
mov dword [ebp - 0x1c5c], 1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1cfc], 0xcf63547a
je 0x4039c1
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x4039c1
and dword [ebp - 0xad8], 0
jmp 0x4039cb
mov dword [ebp - 0xad8], 1
cmp dword [ebp - 0xad8], 1
je 0x4039e0
mov dword [ebp - 0x1548], 1
jmp 0x4039e7
and dword [ebp - 0x1548], 0
cmp dword [ebp - 0x1548], 0xfffe
je 0x4039ff
mov dword [ebp - 0xae0], 1
jmp 0x403a06
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0x6e8]
imul eax, dword [ebp - 0xae0]
sub eax, 0xffff
sub eax, dword [ebp - 0x8f4]
cmp eax, dword [ebp - 0x1550]
jl 0x403a32
mov dword [ebp - 0x8fc], 1
jmp 0x403a39
and dword [ebp - 0x8fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8fc]
mov dword [ebp + eax - 0x1dac], ecx
mov eax, dword [ebp - 0x500]
cmp dword [ebp - 0x8fc], eax
jl 0x403a66
mov dword [ebp - 0xae8], 1
jmp 0x403a6d
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0x904], eax
mov dword [ebp - 0x620], 0
mov dword [ebp - 0x620], 0x11
jmp 0x403a9c
mov eax, dword [ebp - 0x620]
dec eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0xffffffeb
je 0x403b7e
mov dword [ebp - 0x508], 1
mov dword [ebp - 0x2740], 7
mov dword [ebp - 0x273c], 7
mov dword [ebp - 0x2738], 7
mov dword [ebp - 0x2734], 7
mov dword [ebp - 0x508], 0
jmp 0x403af4
mov eax, dword [ebp - 0x508]
inc eax
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 3
jle 0x403b79
push 3
lea ecx, [ebp - 0x2108]
call fcn.00415aed
mov dword [ebp - 0x6a8], 0
jmp 0x403b23
mov eax, dword [ebp - 0x6a8]
inc eax
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 3
jge 0x403b45
push dword [ebp - 0x6a8]
lea ecx, [ebp - 0x2108]
call fcn.00415bdb
mov dword [eax], 7
jmp 0x403b16
push 2
lea ecx, [ebp - 0x2108]
call fcn.00415bdb
mov dword [ebp - 0x1558], eax
mov eax, dword [ebp - 0x1558]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1558]
mov dword [ecx], eax
lea ecx, [ebp - 0x2108]
call fcn.00415bbf
jmp 0x403ae7
jmp 0x403a8f
mov dword [ebp - 0x510], 0
jmp 0x403b97
mov eax, dword [ebp - 0x510]
inc eax
mov dword [ebp - 0x510], eax
cmp dword [ebp - 0x510], 3
jge 0x403bb9
push dword [ebp - 0x510]
lea ecx, [ebp - 0x20a8]
call fcn.00415bdb
mov dword [eax], 0xb1b5
jmp 0x403b8a
push 1
lea ecx, [ebp - 0x1d0c]
call fcn.00415aed
mov dword [ebp - 0x1c64], 0
mov dword [ebp - 0x628], 0
jmp 0x403be9
mov eax, dword [ebp - 0x628]
inc eax
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 1
jge 0x403c0b
push dword [ebp - 0x628]
lea ecx, [ebp - 0x1d0c]
call fcn.00415bdb
mov dword [eax], 0x5d6c05ba
jmp 0x403bdc
mov byte [ebp - 0x28d], 0
movzx eax, byte [ebp - 0x28d]
test eax, eax
je 0x403c2b
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
lea ecx, [ebp - 0x1d0c]
call fcn.00415bdb
mov dword [eax], 0xfffffff2
jmp 0x403c64
push 0
lea ecx, [ebp - 0x1d0c]
call fcn.00415bdb
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0xaf0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xaf0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1d0c]
call fcn.00415bdb
cmp dword [eax], 5
jge 0x403d3e
mov dword [ebp - 0x518], 0xe0b4074d
mov dword [ebp - 0xaf8], 1
mov dword [ebp - 0x518], 0
jmp 0x403ca7
mov eax, dword [ebp - 0x518]
dec eax
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 0xffffffee
je 0x403d1f
mov dword [ebp - 0x3f4], 0xfffffffb
mov dword [ebp - 0x3f4], 0xffffffea
jmp 0x403cd3
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 3
je 0x403d1a
cmp dword [ebp - 0x1c64], 1
je 0x403cf7
cmp dword [ebp - 0x3f4], 0
jne 0x403cf7
and dword [ebp - 0x1560], 0
jmp 0x403d01
mov dword [ebp - 0x1560], 1
mov eax, dword [ebp - 0x1560]
mov dword [ebp - 0xaf8], eax
cmp dword [ebp - 0xaf8], 0
je 0x403d18
jmp 0x403cc6
jmp 0x403cc6
jmp 0x403c9a
mov byte [ebp - 0x2c6], 0
movzx eax, byte [ebp - 0x2c6]
test eax, eax
je 0x403d39
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x403c40
lea ecx, [ebp - 0x1d0c]
call fcn.00415bbf
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0x1e50]
call fcn.00415bdb
mov dword [eax], 0x4215e1ab
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x2240], eax
push 0
lea ecx, [ebp - 0x1e50]
call fcn.00415bdb
cmp dword [eax], 0xd982
jne 0x403d8d
mov dword [ebp - 0x1568], 1
jmp 0x403d94
and dword [ebp - 0x1568], 0
mov eax, dword [ebp - 0x1568]
neg eax
add eax, dword [ebp - 0x90c]
jne 0x403db1
xor eax, eax
jne 0x403db1
and dword [ebp - 0xb00], 0
jmp 0x403dbb
mov dword [ebp - 0xb00], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x27fc]
cmp eax, dword [ebp - 0xb00]
jg 0x403ddc
mov dword [ebp - 0x1570], 1
jmp 0x403de3
and dword [ebp - 0x1570], 0
cmp dword [ebp - 0x1570], 0xd7d2
jle 0x403dfb
mov dword [ebp - 0xb08], 1
jmp 0x403e02
and dword [ebp - 0xb08], 0
push 2
lea ecx, [ebp - 0x20a8]
call fcn.00415bdb
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x880]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x880]
mov dword [ecx], eax
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x1578], eax
mov eax, dword [ebp - 0x1578]
mov ecx, dword [ebp - 0x880]
cmp dword [ecx], eax
jne 0x403e5a
mov dword [ebp - 0xb10], 1
jmp 0x403e61
and dword [ebp - 0xb10], 0
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0x1e50]
call fcn.00415bdb
mov eax, dword [eax]
cmp eax, dword [ebp - 0xb10]
jne 0x403e88
mov dword [ebp - 0x1580], 1
jmp 0x403e8f
and dword [ebp - 0x1580], 0
mov eax, dword [ebp - 0x1580]
mov dword [ebp - 0x1c6c], eax
lea ecx, [ebp - 0x20a8]
call fcn.00415bbf
jmp 0x403645
jmp 0x402698
lea ecx, [ebp - 0x1e50]
call fcn.00415bbf
push 3
lea ecx, [ebp - 0x974]
call fcn.00415aed
mov dword [ebp - 0xd0], 0xef20fe6e
mov dword [ebp - 0x728], 0
jmp 0x403eeb
mov eax, dword [ebp - 0x728]
inc eax
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0x728], 3
jge 0x403f0d
push dword [ebp - 0x728]
lea ecx, [ebp - 0x974]
call fcn.00415bdb
mov dword [eax], 0x177e
jmp 0x403ede
mov byte [ebp - 0x295], 0
movzx eax, byte [ebp - 0x295]
test eax, eax
je 0x403f29
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov dword [ebp - 0xd0], 2
jmp 0x403f42
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x404177
mov dword [ebp - 0x384], 0xfffffffc
mov dword [ebp - 0x1fac], 0xeb449523
mov dword [ebp - 0x1fa8], 0xeb449523
mov dword [ebp - 0x1fa4], 0xeb449523
mov dword [ebp - 0x1fa0], 0xeb449523
lea ecx, [ebp - 0x85d]
call fcn.00415bea
push eax
lea eax, [ebp - 0x1f9c]
push eax
lea eax, [ebp - 0x1fac]
push eax
lea ecx, [ebp - 0x28e8]
call fcn.00415bed
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x24e0]
call fcn.00415b99
mov byte [ebp - 0x2c8], 0
movzx eax, byte [ebp - 0x2c8]
test eax, eax
je 0x403fd0
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x974]
call fcn.00415bdb
mov esi, eax
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x974]
call fcn.00415bdb
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x404006
mov dword [ebp - 0xb20], 1
jmp 0x40400d
and dword [ebp - 0xb20], 0
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x974]
call fcn.00415bdb
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x974]
call fcn.00415bdb
cmp dword [eax], 0xffffffff
jb 0x404040
mov dword [ebp - 0xb18], 1
jmp 0x404047
and dword [ebp - 0xb18], 0
imul eax, dword [ebp - 0xb18], 0
cmp eax, 4
jle 0x40405f
mov dword [ebp - 0x1588], 1
jmp 0x404066
and dword [ebp - 0x1588], 0
mov eax, dword [ebp - 0x1588]
mov dword [ebp - 0x384], eax
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x974]
call fcn.00415bdb
push 2
lea ecx, [ebp - 0x24e0]
call fcn.00415bdb
push 0
lea ecx, [ebp - 0x974]
call fcn.00415bdb
cmp dword [eax], 0x4bb4
jle 0x4040b1
mov dword [ebp - 0x1590], 1
jmp 0x4040b8
and dword [ebp - 0x1590], 0
mov eax, dword [ebp - 0xb20]
cmp eax, dword [ebp - 0x1590]
jne 0x4040d2
mov dword [ebp - 0xb28], 1
jmp 0x4040d9
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0xb28]
neg eax
je 0x404144
mov dword [ebp - 0x1c74], 0xffffffff
mov dword [ebp - 0x384], 0
jmp 0x404106
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 2
jg 0x404142
mov byte [ebp - 0x29d], 0
movzx eax, byte [ebp - 0x29d]
test eax, eax
je 0x404136
push 0
push 0x168f
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x1c74], 0x193208af
jmp 0x4040f9
jmp 0x404167
mov dword [ebp - 0x1c7c], 0
mov esi, dword [ebp - 0x1c7c]
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x974]
call fcn.00415bdb
mov dword [eax], esi
lea ecx, [ebp - 0x24e0]
call fcn.00415bbf
jmp 0x403f35
lea ecx, [ebp - 0x974]
call fcn.00415bbf
mov dword [ebp - 0x630], 1
mov dword [ebp - 0x520], 0
jmp 0x4041a5
mov eax, dword [ebp - 0x520]
inc eax
mov dword [ebp - 0x520], eax
cmp dword [ebp - 0x520], 3
jge 0x4041c1
mov eax, dword [ebp - 0x520]
mov dword [ebp + eax*4 - 0x2860], 0xfffe
jmp 0x404198
mov byte [ebp - 0x2ca], 0
movzx eax, byte [ebp - 0x2ca]
test eax, eax
je 0x4041e8
push 0x1bb0
push 0x1376
push 0x12d2
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [ebp - 0x630], 0
jmp 0x404201
mov eax, dword [ebp - 0x630]
inc eax
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 2
jg 0x40421d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2860], 0
je 0x40421b
jmp 0x40421d
jmp 0x4041f4
push 3
lea ecx, [ebp - 0x980]
call fcn.00415aed
mov dword [ebp - 0x2248], 1
mov dword [ebp - 0x2250], 0xfb0b0297
mov dword [ebp - 0x2258], 0xb22124f8
mov dword [ebp - 0x2260], 0xfffffff6
mov dword [ebp - 0x2268], 0xed080c17
mov dword [ebp - 0x2270], 0xfffffff9
mov dword [ebp - 0x1c84], 0x2a3b3f36
push 1
lea ecx, [ebp - 0x24f0]
call fcn.00415aed
mov dword [ebp - 0x1598], 0
mov dword [ebp - 0x528], 0
jmp 0x4042a0
mov eax, dword [ebp - 0x528]
inc eax
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 1
jge 0x4042bf
push dword [ebp - 0x528]
lea ecx, [ebp - 0x24f0]
call fcn.00415bdb
and dword [eax], 0
jmp 0x404293
mov eax, dword [ebp - 0x1598]
inc eax
mov dword [ebp - 0x1598], eax
mov dword [ebp - 0x1c84], 0
lea ecx, [ebp - 0x24f0]
call fcn.00415bbf
mov dword [ebp - 0xd8], 0xef20fe6e
mov dword [ebp - 0xcc], 0x7e2799ac
mov dword [ebp - 0xcc], 0
jmp 0x40430e
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xfffffff2
jl 0x4044a2
mov dword [ebp - 0x16c], 0xffbefa5f
mov dword [ebp - 0x454], 0x50678e04
mov dword [ebp - 0x1c94], 0x46e74a6e
cmp dword [ebp - 0x16c], 1
je 0x40434e
mov dword [ebp - 0xb30], 1
jmp 0x404355
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xb30], eax
je 0x40436f
mov dword [ebp - 0x1c8c], 1
jmp 0x404376
and dword [ebp - 0x1c8c], 0
cmp dword [ebp - 0x16c], 0
jne 0x404386
cmp dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0xcc], eax
jle 0x4043a0
mov dword [ebp - 0x15a0], 1
jmp 0x4043a7
and dword [ebp - 0x15a0], 0
cmp dword [ebp - 0x15a0], 0x6c0
jge 0x4043bf
mov dword [ebp - 0xb38], 1
jmp 0x4043c6
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xb38], eax
jle 0x4043e0
mov dword [ebp - 0x15a8], 1
jmp 0x4043e7
and dword [ebp - 0x15a8], 0
mov eax, dword [ebp - 0xcc]
add eax, dword [ebp - 0x15a8]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x454], eax
jle 0x404413
mov dword [ebp - 0xb40], 1
jmp 0x40441a
and dword [ebp - 0xb40], 0
cmp dword [ebp - 0xb40], 0x7555b7ce
je 0x404449
cmp dword [ebp - 0xcc], 0
je 0x404449
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x1c94], eax
jmp 0x404492
mov dword [ebp - 0x16c], 0xffffffeb
jmp 0x404462
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x1d
jne 0x404492
mov byte [ebp - 0x2a5], 0
movzx eax, byte [ebp - 0x2a5]
test eax, eax
je 0x404490
push 0
push 0
push 0x13fb
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x404455
cmp dword [ebp - 0x454], 0
je 0x40449d
jmp 0x4044a2
jmp 0x404301
push 3
lea ecx, [ebp - 0x1934]
call fcn.00415aed
mov dword [ebp - 0x18c], 8
mov dword [ebp - 0x17c], 0xe0710dd0
mov dword [ebp - 0x394], 1
mov dword [ebp - 0x15e0], 1
mov dword [ebp - 0xf4], 0
jmp 0x4044f0
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 3
jge 0x404512
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x1934]
call fcn.00415bdb
mov dword [eax], 0x8bbc
jmp 0x4044e3
mov dword [ebp - 0xf4], 0
jmp 0x40452b
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x404547
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x1b0], 0xffffffff
jmp 0x40451e
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1b0], 2
jmp 0x404575
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1b0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1b0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1b0], 0
jl 0x404862
mov dword [ebp - 0x3fc], 0x90a624cd
mov dword [ebp - 0x3fc], 0
jmp 0x4045ac
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 2
jg 0x4046f0
mov dword [ebp - 0x38c], 0xb3921ded
mov dword [ebp - 0x38c], 2
jmp 0x4045dc
mov eax, dword [ebp - 0x38c]
dec eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0
jl 0x4046eb
mov dword [ebp - 0x1c9c], 0x32f3
mov byte [ebp - 0x2cc], 0
movzx eax, byte [ebp - 0x2cc]
test eax, eax
je 0x404616
push 0
push 0x61c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1b0]
mov dword [ebp - 0x18c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1b0]
cmp eax, dword [ebp - 0x18c]
jge 0x40464a
mov dword [ebp - 0x15b0], 1
jmp 0x404651
and dword [ebp - 0x15b0], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x1b0]
lea ecx, [ebp - 0x1934]
call fcn.00415bdb
mov ecx, dword [ebp - 0x15b0]
cmp ecx, dword [eax]
jne 0x40467f
mov dword [ebp - 0xb48], 1
jmp 0x404686
and dword [ebp - 0xb48], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1b0]
imul eax, dword [ebp - 0xb48]
test eax, eax
je 0x4046a5
cmp dword [ebp - 0x38c], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x1b0]
lea ecx, [ebp - 0x1934]
call fcn.00415bdb
mov ecx, dword [ebp - 0x1c9c]
cmp dword [eax], ecx
jl 0x4046d3
mov dword [ebp - 0x15b8], 1
jmp 0x4046da
and dword [ebp - 0x15b8], 0
mov eax, dword [ebp - 0x15b8]
mov dword [ebp - 0x17c], eax
jmp 0x4045cf
jmp 0x40459f
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
je 0x40472e
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x1b0]
lea ecx, [ebp - 0x1934]
call fcn.00415bdb
cmp dword [eax], 0
je 0x40472e
mov dword [ebp - 0xb50], 1
jmp 0x404735
and dword [ebp - 0xb50], 0
imul eax, dword [ebp - 0xb50], 0x8cff
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1b0]
jge 0x40475a
mov dword [ebp - 0x15c0], 1
jmp 0x404761
and dword [ebp - 0x15c0], 0
cmp dword [ebp - 0x15c0], 2
jle 0x404776
mov dword [ebp - 0xb58], 1
jmp 0x40477d
and dword [ebp - 0xb58], 0
cmp dword [ebp - 0xb58], 0x7c6d
jge 0x404795
mov dword [ebp - 0x15c8], 1
jmp 0x40479c
and dword [ebp - 0x15c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b0]
add eax, 0xf58a
cmp eax, dword [ebp - 0x15c8]
jg 0x4047c2
mov dword [ebp - 0xb60], 1
jmp 0x4047c9
and dword [ebp - 0xb60], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x1b0]
add esi, dword [ebp - 0xb60]
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x1b0]
lea ecx, [ebp - 0x1934]
call fcn.00415bdb
cmp esi, dword [eax]
jle 0x404804
mov dword [ebp - 0x15d0], 1
jmp 0x40480b
and dword [ebp - 0x15d0], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x1b0]
lea ecx, [ebp - 0x1934]
call fcn.00415bdb
mov eax, dword [eax]
cmp eax, dword [ebp - 0x15d0]
jle 0x404839
mov dword [ebp - 0xb68], 1
jmp 0x404840
and dword [ebp - 0xb68], 0
mov dword [ebp - 0x18c], 0xfff6
mov eax, dword [ebp - 0x18c]
imul eax, dword [ebp - 0xb68]
mov dword [ebp - 0x394], eax
jmp 0x40455a
mov dword [ebp - 0x17c], 0x11
jmp 0x40487b
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0xffffffed
jl 0x404ad7
mov dword [ebp - 0x7cc], 0xffffffff
mov dword [ebp - 0x1cbc], 0x8b047c14
mov dword [ebp - 0x394], 0
jmp 0x4048b5
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 1
jle 0x404ad2
mov dword [ebp - 0x1fc], 0x4969
mov dword [ebp - 0x15f0], 0xffffffff
mov dword [ebp - 0x15e8], 0xd5dd215
mov dword [ebp - 0x18c], 1
jmp 0x4048f9
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xffffffeb
jl 0x40492b
mov dword [ebp - 0x1ca4], 1
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x2278], eax
mov eax, 0x8160
sub eax, dword [ebp - 0x15f0]
mov dword [ebp - 0x1ca4], eax
jmp 0x4048ec
cmp dword [ebp - 0x7cc], 0xb2cfb115
ja 0x404943
mov dword [ebp - 0x15d8], 1
jmp 0x40494a
and dword [ebp - 0x15d8], 0
imul eax, dword [ebp - 0x15e0], 0x4122
cmp eax, dword [ebp - 0x15d8]
jge 0x404968
mov dword [ebp - 0xb70], 1
jmp 0x40496f
and dword [ebp - 0xb70], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1b0]
cmp dword [ebp - 0xb70], eax
jne 0x404990
mov dword [ebp - 0x1cac], 1
jmp 0x404997
and dword [ebp - 0x1cac], 0
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0x2280], eax
mov eax, dword [ebp - 0x1fc]
add eax, dword [ebp - 0x15e0]
cmp eax, 2
jge 0x4049c0
mov dword [ebp - 0xb78], 1
jmp 0x4049c7
and dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0xb78]
add eax, 0x7b11
mov dword [ebp - 0x15e8], eax
jne 0x4049e6
mov dword [ebp - 0xb80], 1
jmp 0x4049ed
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0xb80], eax
jne 0x404a07
mov dword [ebp - 0xb88], 1
jmp 0x404a0e
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x15f0]
cmp dword [ebp - 0xb88], eax
jle 0x404a28
mov dword [ebp - 0x15f8], 1
jmp 0x404a2f
and dword [ebp - 0x15f8], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x15f8], eax
jne 0x404a49
mov dword [ebp - 0xb90], 1
jmp 0x404a50
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0xb90], eax
jge 0x404a6a
mov dword [ebp - 0x1600], 1
jmp 0x404a71
and dword [ebp - 0x1600], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x1600], eax
je 0x404a8b
mov dword [ebp - 0xb98], 1
jmp 0x404a92
and dword [ebp - 0xb98], 0
cmp dword [ebp - 0xb98], 0xfffffffb
jge 0x404aa7
mov dword [ebp - 0x1cb4], 1
jmp 0x404aae
and dword [ebp - 0x1cb4], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x2288], eax
mov eax, dword [ebp - 0x7cc]
imul eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1cbc], eax
jmp 0x4048a8
jmp 0x40486e
lea ecx, [ebp - 0x1934]
call fcn.00415bbf
mov dword [ebp - 0x6b0], 0
jmp 0x404afb
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 3
jge 0x404b1d
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x980]
call fcn.00415bdb
mov dword [eax], 0x177e
jmp 0x404aee
mov dword [ebp - 0x1d78], 0
mov dword [ebp - 0x1d74], 0
mov dword [ebp - 0x1d70], 0
mov dword [ebp - 0x1d6c], 0
mov dword [ebp - 0x434], 0x5052061f
mov dword [ebp - 0x1628], 0x9d5fac12
mov dword [ebp - 0x1618], 0x932e3ca3
mov dword [ebp - 0x8e0], 0x49c23edb
mov dword [ebp - 0x434], 0
jmp 0x404b86
mov eax, dword [ebp - 0x434]
inc eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 3
jg 0x404d66
mov dword [ebp - 0x5c], 0xfffffffa
mov dword [ebp - 0x5c], 0
jmp 0x404baa
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jg 0x404d61
mov dword [ebp - 0x1cc4], 0x6e1ee67b
mov eax, dword [ebp - 0x5c]
cmp dword [ebp + eax*4 - 0x1d78], 0
jne 0x404bd7
mov dword [ebp - 0x1608], 1
jmp 0x404bde
and dword [ebp - 0x1608], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1608], eax
jg 0x404bf5
mov dword [ebp - 0xba0], 1
jmp 0x404bfc
and dword [ebp - 0xba0], 0
cmp dword [ebp - 0xba0], 0
jg 0x404c11
mov dword [ebp - 0x1610], 1
jmp 0x404c18
and dword [ebp - 0x1610], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x1d78]
cmp dword [ebp - 0x1610], eax
je 0x404c36
mov dword [ebp - 0xba8], 1
jmp 0x404c3d
and dword [ebp - 0xba8], 0
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0x1618], eax
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x8e0], eax
cmp dword [ebp - 0x8e0], 0
je 0x404c73
cmp dword [ebp - 0x8e0], 0
je 0x404c73
mov dword [ebp - 0xbb0], 1
jmp 0x404c7a
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0xbb0]
add eax, 3
je 0x404ca0
mov eax, 0xef9a
test eax, eax
je 0x404ca0
cmp dword [ebp - 0x5c], 0
je 0x404ca0
mov dword [ebp - 0x1620], 1
jmp 0x404ca7
and dword [ebp - 0x1620], 0
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x1620]
cmp eax, dword [ebp - 0x5c]
jne 0x404cc2
mov dword [ebp - 0xbb8], 1
jmp 0x404cc9
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x1d78]
cmp dword [ebp - 0xbb8], eax
je 0x404ce7
mov dword [ebp - 0xbc0], 1
jmp 0x404cee
and dword [ebp - 0xbc0], 0
mov dword [ebp - 0x1628], 0xcba8
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x1d78]
imul eax, dword [ebp - 0x1628]
add eax, dword [ebp - 0xbc0]
cmp eax, dword [ebp - 0x434]
jge 0x404d23
mov dword [ebp - 0x1630], 1
jmp 0x404d2a
and dword [ebp - 0x1630], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1630], eax
jg 0x404d41
mov dword [ebp - 0xbc8], 1
jmp 0x404d48
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0x1cc4], eax
cmp dword [ebp - 0x5c], 0
je 0x404d5c
jmp 0x404d61
jmp 0x404ba3
jmp 0x404b79
mov byte [ebp - 0x1b4], 0
mov dword [ebp - 0x2290], 0xfffffff7
mov dword [ebp - 0x2298], 0x7a7c2039
mov dword [ebp - 0x22a0], 0x2167fa5c
mov dword [ebp - 0x22a8], 0x666a756a
mov dword [ebp - 0x22b0], 0xffffffff
mov dword [ebp - 0x22b8], 6
mov dword [ebp - 0x22c0], 1
push 4
lea ecx, [ebp - 0x2500]
call fcn.00415aed
mov dword [ebp - 0x1638], 0xaaf5bfb6
mov dword [ebp - 0x530], 0
jmp 0x404de3
mov eax, dword [ebp - 0x530]
inc eax
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 4
jge 0x404e05
push dword [ebp - 0x530]
lea ecx, [ebp - 0x2500]
call fcn.00415bdb
mov dword [eax], 7
jmp 0x404dd6
mov byte [ebp - 0x1b2], 0
movzx eax, byte [ebp - 0x1b2]
test eax, eax
je 0x404e32
push 0x369
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
mov eax, dword [ebp - 0x1638]
inc eax
mov dword [ebp - 0x1638], eax
lea ecx, [ebp - 0x2500]
call fcn.00415bbf
movzx eax, byte [ebp - 0x1b4]
test eax, eax
je 0x404e5f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov dword [ebp - 0x204], 0xffff
mov dword [ebp - 0x320], 9
mov dword [ebp - 0x7d4], 0
mov dword [ebp - 0x638], 0
jmp 0x404e96
mov eax, dword [ebp - 0x638]
inc eax
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 2
jge 0x404eb2
mov eax, dword [ebp - 0x638]
mov dword [ebp + eax*4 - 0x1ee8], 0x6eb6b9dd
jmp 0x404e89
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x204], 0xffffffe4
jmp 0x404ed8
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x2b
jge 0x40515e
mov dword [ebp - 0x39c], 0xfebb6748
mov dword [ebp - 0x39c], 0x10
jmp 0x404f08
mov eax, dword [ebp - 0x39c]
dec eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0xb
je 0x405159
mov dword [ebp - 0x2e0], 0xfffffff8
mov dword [ebp - 0x1640], 0x920a6ff
mov byte [ebp - 0x1b6], 0
movzx eax, byte [ebp - 0x1b6]
test eax, eax
je 0x404f46
push 0x2366
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x2e0], 0
jmp 0x404f5f
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 1
jg 0x405154
push 3
lea ecx, [ebp - 0x1e68]
call fcn.00415aed
mov dword [ebp - 0x538], 0
jmp 0x404f92
mov eax, dword [ebp - 0x538]
inc eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 3
jge 0x404fb4
push dword [ebp - 0x538]
lea ecx, [ebp - 0x1e68]
call fcn.00415bdb
mov dword [eax], 3
jmp 0x404f85
cmp dword [ebp - 0x204], 0
jne 0x404fcf
cmp dword [ebp - 0x2e0], 0
jne 0x404fcf
and dword [ebp - 0xbd0], 0
jmp 0x404fd9
mov dword [ebp - 0xbd0], 1
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0x1640], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, 0x5206
sub ecx, dword [ebp + eax - 0x1ee8]
imul ecx, dword [ebp - 0x1640]
mov dword [ebp - 0xbd8], ecx
push 0
lea ecx, [ebp - 0x1e68]
call fcn.00415bdb
mov ecx, dword [ebp - 0xbd8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2e0]
mov eax, dword [ebp + eax*4 - 0x1ee8]
cmp eax, dword [ebp - 0xbd8]
jne 0x40503a
mov dword [ebp - 0x1648], 1
jmp 0x405041
and dword [ebp - 0x1648], 0
cmp dword [ebp - 0x1648], 0x1479
jle 0x405059
mov dword [ebp - 0xbe0], 1
jmp 0x405060
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0x39c]
imul eax, dword [ebp - 0xbe0]
test eax, eax
jne 0x40507d
mov dword [ebp - 0x1650], 1
jmp 0x405084
and dword [ebp - 0x1650], 0
mov eax, dword [ebp - 0x1650]
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0xcf7d1649
jb 0x4050a8
mov dword [ebp - 0xbe8], 1
jmp 0x4050af
and dword [ebp - 0xbe8], 0
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 0x881826fb
jne 0x405124
mov dword [ebp - 0x320], 0
jmp 0x4050e0
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0xb
jl 0x40510c
mov byte [ebp - 0x1b8], 0
movzx eax, byte [ebp - 0x1b8]
test eax, eax
je 0x40510a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
jmp 0x4050d3
cmp dword [ebp - 0x7d4], 0
je 0x405122
lea ecx, [ebp - 0x1e68]
call fcn.00415bbf
jmp 0x405154
jmp 0x405144
mov dword [ebp - 0x1ccc], 0x540f
mov dword [ebp - 0x1cd4], 0x357f039d
mov eax, dword [ebp - 0x1ccc]
mov dword [ebp - 0x1cd4], eax
lea ecx, [ebp - 0x1e68]
call fcn.00415bbf
jmp 0x404f52
jmp 0x404efb
jmp 0x404ecb
mov dword [ebp - 0xd8], 2
jmp 0x405177
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x406aa4
mov dword [ebp - 0x6f0], 0xc204e2db
mov dword [ebp - 0x2194], 0x30de9bf9
mov dword [ebp - 0x2190], 0x30de9bf9
mov dword [ebp - 0x218c], 0x30de9bf9
mov dword [ebp - 0x2188], 0x30de9bf9
mov dword [ebp - 0x6f0], 0
jmp 0x4051cf
mov eax, dword [ebp - 0x6f0]
dec eax
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x6f0], 0xfffffffe
jle 0x405294
mov dword [ebp - 0x1658], 0xffffffff
mov dword [ebp - 0x2184], 0xffffffff
mov dword [ebp - 0x2180], 0xffffffff
mov dword [ebp - 0x217c], 0xffffffff
mov dword [ebp - 0x2178], 0xffffffff
mov dword [ebp - 0x540], 0
jmp 0x405227
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 4
jge 0x405243
mov eax, dword [ebp - 0x540]
mov dword [ebp + eax*4 - 0x2918], 0x3a0b8ee4
jmp 0x40521a
mov dword [ebp - 0x1658], 0
mov eax, dword [ebp - 0x1658]
mov dword [ebp - 0xbf0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xbf0]
mov dword [ebp + eax - 0x2184], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xbf0]
mov dword [ebp + eax - 0x2918], ecx
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2194], 0xffffffff
jmp 0x4051c2
mov dword [ebp - 0x46c], 0xfffffffc
mov dword [ebp - 0x22c8], 1
push 2
lea ecx, [ebp - 0x2520]
call fcn.00415aed
mov dword [ebp - 0x22d0], 0xffffffff
mov dword [ebp - 0x22d8], 0
mov dword [ebp - 0x22e0], 7
mov dword [ebp - 0x22e8], 3
mov dword [ebp - 0x22f0], 0xfffffff6
mov dword [ebp - 0x22f8], 0x8c443eb6
push 1
lea ecx, [ebp - 0x2510]
call fcn.00415aed
push 1
lea ecx, [ebp - 0x2168]
call fcn.00415aed
mov dword [ebp - 0x44], 0
jmp 0x40531b
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x405334
push dword [ebp - 0x44]
lea ecx, [ebp - 0x2520]
call fcn.00415bdb
and dword [eax], 0
jmp 0x405314
mov dword [ebp - 0x44], 0
jmp 0x405344
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x40535d
push dword [ebp - 0x44]
lea ecx, [ebp - 0x2510]
call fcn.00415bdb
or dword [eax], 0xffffffff
jmp 0x40533d
mov dword [ebp - 0x44], 0
jmp 0x40536d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x405389
push dword [ebp - 0x44]
lea ecx, [ebp - 0x2168]
call fcn.00415bdb
mov dword [eax], 0x7182
jmp 0x405366
push 0
lea ecx, [ebp - 0x2168]
call fcn.00415bdb
mov dword [ebp - 0x1660], eax
mov eax, dword [ebp - 0x1660]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1660]
mov dword [ecx], eax
lea ecx, [ebp - 0x2168]
call fcn.00415bbf
lea ecx, [ebp - 0x2510]
call fcn.00415bbf
lea ecx, [ebp - 0x2520]
call fcn.00415bbf
mov dword [ebp - 0x1f84], 0xeb449523
mov dword [ebp - 0x1f80], 0xeb449523
mov dword [ebp - 0x1f7c], 0xeb449523
mov dword [ebp - 0x1f78], 0xeb449523
lea ecx, [ebp - 0x8b1]
call fcn.00415bea
push eax
lea eax, [ebp - 0x1f74]
push eax
lea eax, [ebp - 0x1f84]
push eax
lea ecx, [ebp - 0x28f8]
call fcn.00415bed
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2550]
call fcn.00415b99
push 3
lea ecx, [ebp - 0x1e80]
call fcn.00415aed
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x1cdc], 0
mov dword [ebp - 0x640], 0
jmp 0x405465
mov eax, dword [ebp - 0x640]
inc eax
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 3
jge 0x405484
push dword [ebp - 0x640]
lea ecx, [ebp - 0x1e80]
call fcn.00415bdb
or dword [eax], 0xffffffff
jmp 0x405458
mov dword [ebp - 0x2e8], 0
jmp 0x40549d
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 2
jg 0x4054e8
push dword [ebp - 0x2e8]
lea ecx, [ebp - 0x1e80]
call fcn.00415bdb
mov dword [ebp - 0xbf8], eax
push dword [ebp - 0x2e8]
lea ecx, [ebp - 0x1e80]
call fcn.00415bdb
mov ecx, dword [ebp - 0xbf8]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xbf8]
mov eax, dword [eax]
mov dword [ebp - 0x1cdc], eax
jmp 0x405490
lea ecx, [ebp - 0x1e80]
call fcn.00415bbf
mov dword [ebp - 0x404], 0xe0648261
mov dword [ebp - 0x1ce4], 0xfffffff7
mov dword [ebp - 0x404], 0
jmp 0x405520
mov eax, dword [ebp - 0x404]
dec eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0xffffffef
jle 0x405545
mov byte [ebp - 0x1ba], 0
movzx eax, byte [ebp - 0x1ba]
test eax, eax
je 0x405543
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x405513
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x1ce4], eax
mov byte [ebp - 0x1bc], 0
movzx eax, byte [ebp - 0x1bc]
test eax, eax
je 0x40556b
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x980]
call fcn.00415bdb
mov esi, eax
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x980]
call fcn.00415bdb
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x4055a1
mov dword [ebp - 0x1670], 1
jmp 0x4055a8
and dword [ebp - 0x1670], 0
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x980]
call fcn.00415bdb
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x980]
call fcn.00415bdb
cmp dword [eax], 0xffffffff
jb 0x4055db
mov dword [ebp - 0x1668], 1
jmp 0x4055e2
and dword [ebp - 0x1668], 0
imul eax, dword [ebp - 0x1668], 0
cmp eax, 4
jle 0x4055fa
mov dword [ebp - 0xc00], 1
jmp 0x405601
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0xc00]
mov dword [ebp - 0x46c], eax
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x980]
call fcn.00415bdb
push 2
lea ecx, [ebp - 0x2550]
call fcn.00415bdb
push 0
lea ecx, [ebp - 0x980]
call fcn.00415bdb
cmp dword [eax], 0x4bb4
jle 0x40564c
mov dword [ebp - 0xc08], 1
jmp 0x405653
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0x1670]
cmp eax, dword [ebp - 0xc08]
jne 0x40566d
mov dword [ebp - 0x1678], 1
jmp 0x405674
and dword [ebp - 0x1678], 0
mov eax, dword [ebp - 0x1678]
neg eax
je 0x40645f
mov dword [ebp - 0x19e0], 0xffffffff
mov dword [ebp - 0x340], 0xb110c93b
mov dword [ebp - 0x3a4], 0
mov dword [ebp - 0x1d34], 0x35984225
mov dword [ebp - 0xc28], 0xfff6
mov dword [ebp - 0x340], 8
jmp 0x4056cd
mov eax, dword [ebp - 0x340]
dec eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0xfffffff7
jne 0x4058b4
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x548], 0
jmp 0x4056fd
mov eax, dword [ebp - 0x548]
inc eax
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 3
jge 0x405719
mov eax, dword [ebp - 0x548]
mov dword [ebp + eax*4 - 0x2878], 0x59ec1348
jmp 0x4056f0
mov dword [ebp - 0x140], 0xa
jmp 0x405732
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0x14
jl 0x4058af
mov dword [ebp - 0x1cec], 0
mov eax, 0x72ca
test eax, eax
je 0x40580d
cmp dword [ebp - 0x140], 0
je 0x4057e6
mov eax, dword [ebp - 0x140]
neg eax
imul eax, eax, 0x6c9c
imul ecx, dword [ebp - 0x340], 0
cmp eax, ecx
je 0x405788
mov dword [ebp - 0xc10], 1
jmp 0x40578f
and dword [ebp - 0xc10], 0
cmp dword [ebp - 0xc10], 0xffffffff
jl 0x4057a4
mov dword [ebp - 0x1680], 1
jmp 0x4057ab
and dword [ebp - 0x1680], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x1680], eax
je 0x4057c5
mov dword [ebp - 0xc18], 1
jmp 0x4057cc
and dword [ebp - 0xc18], 0
mov eax, dword [ebp - 0x1cec]
add eax, dword [ebp - 0xc18]
je 0x4057e6
mov dword [ebp - 0x1688], 1
jmp 0x4057ed
and dword [ebp - 0x1688], 0
mov eax, dword [ebp - 0x1688]
sub eax, dword [ebp - 0x340]
cmp eax, dword [ebp - 0x140]
jle 0x40580d
mov dword [ebp - 0xc20], 1
jmp 0x405814
and dword [ebp - 0xc20], 0
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0xc20], eax
jle 0x405834
cmp dword [ebp - 0x140], 0
jne 0x405834
and dword [ebp - 0x1690], 0
jmp 0x40583e
mov dword [ebp - 0x1690], 1
mov eax, dword [ebp - 0x1690]
inc eax
je 0x405853
mov dword [ebp - 0x888], 1
jmp 0x40585a
and dword [ebp - 0x888], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x888]
mov dword [ebp + eax - 0x2878], ecx
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x1d34], eax
mov dword [ebp - 0x3a4], 2
jmp 0x405892
mov eax, dword [ebp - 0x3a4]
dec eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
jl 0x4058aa
mov eax, dword [ebp - 0xc28]
inc eax
mov dword [ebp - 0xc28], eax
jmp 0x405885
jmp 0x405725
jmp 0x4056c0
mov dword [ebp - 0x46c], 0
jmp 0x4058cd
mov eax, dword [ebp - 0x46c]
inc eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 2
jg 0x40645a
push 4
lea ecx, [ebp - 0x1e44]
call fcn.00415aed
mov dword [ebp - 0xdc], 0x4a18885c
mov dword [ebp - 0x1dcc], 0x925d3c09
mov dword [ebp - 0x1dc8], 0x925d3c09
mov dword [ebp - 0x1dc4], 0x925d3c09
mov dword [ebp - 0x1dc0], 0x925d3c09
mov dword [ebp - 0x6b8], 0
jmp 0x405932
mov eax, dword [ebp - 0x6b8]
inc eax
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 4
jge 0x405954
push dword [ebp - 0x6b8]
lea ecx, [ebp - 0x1e44]
call fcn.00415bdb
mov dword [eax], 0xb3198a8f
jmp 0x405925
mov dword [ebp - 0xdc], 0
jmp 0x40596d
cmp dword [ebp - 0xdc], 3
jg 0x405daa
mov dword [ebp - 0x19c], 0xffffffff
mov dword [ebp - 0x1a84], 0x4393
mov dword [ebp - 0x1af4], 0xffffffff
push 1
lea ecx, [ebp - 0x20c0]
call fcn.00415aed
mov dword [ebp - 0xc68], 1
mov dword [ebp - 0x19c0], 0
mov dword [ebp - 0x11c], 0
jmp 0x4059d2
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x4059ee
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x2530], 0x69d1fe90
jmp 0x4059c5
mov dword [ebp - 0x11c], 0
jmp 0x405a07
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jge 0x405a29
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x20c0]
call fcn.00415bdb
mov dword [eax], 0x9d6b80f4
jmp 0x4059fa
mov dword [ebp - 0x19c], 0
jmp 0x405a42
cmp dword [ebp - 0x19c], 3
jg 0x405d9a
lea ecx, [ebp - 0x1e44]
call fcn.00415bbf
mov byte [ebp - 0x1be], 0
movzx eax, byte [ebp - 0x1be]
test eax, eax
je 0x40644b
mov dword [ebp - 0x54], 7
mov dword [ebp - 0xec], 0x574417f9
mov dword [ebp - 0xd4], 7
push 3
lea ecx, [ebp - 0x1e98]
call fcn.00415aed
mov dword [ebp - 0x550], 0
jmp 0x405e0c
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 3
jge 0x405e2b
push dword [ebp - 0x550]
lea ecx, [ebp - 0x1e98]
call fcn.00415bdb
or dword [eax], 0xffffffff
jmp 0x405dff
mov dword [ebp - 0x54], 0
jmp 0x405e3b
cmp dword [ebp - 0x54], 1
je 0x406377
mov dword [ebp - 0x328], 1
mov dword [ebp - 0x558], 0x1ad7ba96
mov dword [ebp - 0x19d0], 8
mov dword [ebp - 0x648], 0
jmp 0x405e7c
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
je 0x40638b
mov dword [ebp - 0x19e0], 0x193208af
jmp 0x4058c0
jmp 0x406a94
mov dword [ebp - 0xa8], 1
push 2
lea ecx, [ebp - 0x1eb0]
call fcn.00415aed
mov dword [ebp - 0x124], 0
jmp 0x40648f
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 3
jge 0x4064ab
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x92c], 0
jmp 0x406482
mov dword [ebp - 0x124], 0
jmp 0x4064c4
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jge 0x4064e3
push dword [ebp - 0x124]
lea ecx, [ebp - 0x1eb0]
call fcn.00415bdb
or dword [eax], 0xffffffff
jmp 0x4064b7
mov dword [ebp - 0xa8], 2
jmp 0x4064fc
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x406a4c
push 2
lea ecx, [ebp - 0x7b0]
call fcn.00415aed
mov dword [ebp - 0x2358], 0x9b41dbc4
mov dword [ebp - 0x20c], 0xb167d3d8
mov dword [ebp - 0x710], 0
jmp 0x406543
mov eax, dword [ebp - 0x710]
inc eax
mov dword [ebp - 0x710], eax
cmp dword [ebp - 0x710], 2
jge 0x406565
push dword [ebp - 0x710]
lea ecx, [ebp - 0x7b0]
call fcn.00415bdb
mov dword [eax], 2
jmp 0x406536
push 1
lea ecx, [ebp - 0x7b0]
call fcn.00415bdb
mov dword [eax], 2
jmp 0x40659e
push 1
lea ecx, [ebp - 0x7b0]
call fcn.00415bdb
cmp dword [eax], 0
jl 0x406a3c
mov dword [ebp - 0x3b4], 4
mov dword [ebp - 0x2360], 0xfffffffb
mov dword [ebp - 0x1ce0], 1
mov dword [ebp - 0x19f0], 0x2089ce3
mov dword [ebp - 0x1bd0], 2
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x92c]
add eax, 0x12af
mov ecx, dword [ebp - 0xa8]
cmp eax, dword [ebp + ecx*4 - 0x92c]
jg 0x406613
mov dword [ebp - 0x1728], 1
jmp 0x40661a
and dword [ebp - 0x1728], 0
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x92c]
cmp dword [ebp - 0x1728], eax
jge 0x40663b
mov dword [ebp - 0x1bc8], 1
jmp 0x406642
and dword [ebp - 0x1bc8], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp + eax*4 - 0x92c], 3
jae 0x40665e
mov dword [ebp - 0xcc0], 1
jmp 0x406665
and dword [ebp - 0xcc0], 0
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x92c]
cmp dword [ebp - 0xcc0], eax
jle 0x406686
lea ecx, [ebp - 0x7b0]
call fcn.00415bbf
jmp 0x4064ef
mov byte [ebp - 0x1b5], 0
movzx eax, byte [ebp - 0x1b5]
test eax, eax
je 0x406a66
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea ecx, [ebp - 0x1eb0]
call fcn.00415bbf
mov dword [ebp - 0x19f8], 0
mov esi, dword [ebp - 0x19f8]
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x980]
call fcn.00415bdb
mov dword [eax], esi
lea ecx, [ebp - 0x2550]
call fcn.00415bbf
jmp 0x40516a
lea ecx, [ebp - 0x980]
call fcn.00415bbf
mov dword [ebp - 0x90], 0xfffffff6
mov dword [ebp - 0xd1c], 0xa6d
mov dword [ebp - 0x1784], 0xd0e834ab
mov dword [ebp - 0x1c88], 0xdb5a
mov dword [ebp - 0x1a00], 0xfffa
mov dword [ebp - 0x150], 0
jmp 0x406afa
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jge 0x406b16
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x450], 4
jmp 0x406aed
mov dword [ebp - 0x150], 0
jmp 0x406b2f
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x406b4b
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x2120], 2
jmp 0x406b22
mov dword [ebp - 0x90], 0xe
jmp 0x406b64
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffffa
jle 0x406bc2
mov dword [ebp - 0x560], 0xfffffffc
mov dword [ebp - 0x560], 0
jmp 0x406b90
mov eax, dword [ebp - 0x560]
inc eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 3
jl 0x406bae
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x90]
mov dword [ebp + eax - 0x450], ecx
jmp 0x406b83
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x450], 0
je 0x406bc0
jmp 0x406b57
jmp 0x406b57
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x450]
mov dword [ebp - 0x2390], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x450], 0x8fc3a8a
jge 0x406bf4
mov dword [ebp - 0x1770], 1
jmp 0x406bfb
and dword [ebp - 0x1770], 0
mov eax, dword [ebp - 0xd1c]
cmp dword [ebp - 0x1770], eax
jl 0x406c15
mov dword [ebp - 0xd04], 1
jmp 0x406c1c
and dword [ebp - 0xd04], 0
mov eax, dword [ebp - 0xd04]
sub eax, 0x37f5185
cmp eax, 0xfffffff7
jne 0x406c38
mov dword [ebp - 0x1304], 1
jmp 0x406c3f
and dword [ebp - 0x1304], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x1304], eax
jge 0x406c59
mov dword [ebp - 0xd0c], 1
jmp 0x406c60
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0xd0c]
mov dword [ebp - 0x90], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x450]
mov dword [ebp - 0x2398], eax
mov eax, dword [ebp - 0x90]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x450]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2120]
jge 0x406cad
mov dword [ebp - 0x1604], 1
jmp 0x406cb4
and dword [ebp - 0x1604], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2120]
imul eax, dword [ebp - 0x1604]
test eax, eax
jne 0x406cda
xor eax, eax
inc eax
jne 0x406cda
and dword [ebp - 0xd14], 0
jmp 0x406ce4
mov dword [ebp - 0xd14], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x450]
cmp eax, dword [ebp - 0xd14]
jge 0x406d05
mov dword [ebp - 0x130c], 1
jmp 0x406d0c
and dword [ebp - 0x130c], 0
mov eax, dword [ebp - 0x130c]
sub eax, dword [ebp - 0xd1c]
mov dword [ebp - 0x1784], eax
cmp dword [ebp - 0x1784], 0xa77b
je 0x406d36
mov dword [ebp - 0xd24], 1
jmp 0x406d3d
and dword [ebp - 0xd24], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x450]
sub eax, dword [ebp - 0xd24]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x450], eax
cmp dword [ebp - 0x1c88], 5
jl 0x406d82
mov dword [ebp - 0x1314], 1
mov eax, dword [ebp - 0x1314]
inc eax
mov dword [ebp - 0x1314], eax
jmp 0x406f76
mov dword [ebp - 0x160c], 0xffffffff
mov dword [ebp - 0x1614], 0
mov dword [ebp - 0x650], 0
jmp 0x406daf
mov eax, dword [ebp - 0x650]
inc eax
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 4
jge 0x406dcb
mov eax, dword [ebp - 0x650]
mov dword [ebp + eax*4 - 0x2754], 5
jmp 0x406da2
mov dword [ebp - 0x90], 0x18
jmp 0x406de4
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffff5
jle 0x406f76
mov dword [ebp - 0x1bd8], 6
mov dword [ebp - 0x7e4], 0x4e26
mov dword [ebp - 0xd3c], 0
mov eax, dword [ebp - 0x1a00]
mov dword [ebp - 0x23a0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2754], 6
ja 0x406e36
mov dword [ebp - 0xd2c], 1
jmp 0x406e3d
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0xd2c]
mov dword [ebp - 0x160c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2120]
cmp dword [ebp - 0x160c], eax
jle 0x406e69
mov dword [ebp - 0xd34], 1
jmp 0x406e70
and dword [ebp - 0xd34], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x450]
cmp eax, dword [ebp - 0xd34]
jge 0x406e91
mov dword [ebp - 0x131c], 1
jmp 0x406e98
and dword [ebp - 0x131c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x131c]
mov dword [ebp + eax - 0x2754], ecx
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0xd3c], eax
mov eax, dword [ebp - 0x1614]
cmp dword [ebp - 0xd3c], eax
jl 0x406ed0
mov dword [ebp - 0x184c], 1
jmp 0x406ed7
and dword [ebp - 0x184c], 0
mov eax, dword [ebp - 0x7e4]
cmp dword [ebp - 0x184c], eax
jne 0x406ef1
mov dword [ebp - 0xd44], 1
jmp 0x406ef8
and dword [ebp - 0xd44], 0
mov eax, dword [ebp - 0x7e4]
imul eax, dword [ebp - 0xd44]
cmp eax, 0x978c
je 0x406f18
mov dword [ebp - 0x1324], 1
jmp 0x406f1f
and dword [ebp - 0x1324], 0
imul eax, dword [ebp - 0x1bd8], 0xa183
cmp eax, dword [ebp - 0x1324]
jne 0x406f4d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2754], 0
je 0x406f4d
mov dword [ebp - 0xd4c], 1
jmp 0x406f54
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0xd4c]
mov dword [ebp - 0x1614], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x450], 0xfe298319
jmp 0x406dd7
push 1
lea ecx, [ebp - 0x1970]
call fcn.00415aed
mov dword [ebp - 0x23a8], 0
mov dword [ebp - 0x1a08], 0x3111738a
mov dword [ebp - 0x12c], 0
jmp 0x406fb0
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jge 0x406fd2
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x1970]
call fcn.00415bdb
mov dword [eax], 0x3ae35568
jmp 0x406fa3
mov dword [ebp - 0x12c], 0
jmp 0x406feb
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jge 0x407007
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x1d30], 0xf7bf
jmp 0x406fde
push 0
lea ecx, [ebp - 0x1970]
call fcn.00415bdb
mov dword [eax], 0xffffffea
jmp 0x407040
push 0
lea ecx, [ebp - 0x1970]
call fcn.00415bdb
mov dword [ebp - 0xd54], eax
mov eax, dword [ebp - 0xd54]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xd54]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1970]
call fcn.00415bdb
cmp dword [eax], 0x13
jne 0x40719a
mov dword [ebp - 0x214], 0x6d2e
mov dword [ebp - 0x132c], 0
mov dword [ebp - 0x161c], 0xdbc1c234
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x214], 0
jmp 0x40709a
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jg 0x407195
mov dword [ebp - 0xd74], 0xffffffff
cmp dword [ebp - 0x1a08], 0x7dcd
jle 0x40716e
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x132c], eax
mov eax, dword [ebp - 0x132c]
cmp dword [ebp - 0xd74], eax
jle 0x4070e7
mov dword [ebp - 0xd5c], 1
jmp 0x4070ee
and dword [ebp - 0xd5c], 0
push 0
lea ecx, [ebp - 0x1970]
call fcn.00415bdb
mov ecx, dword [ebp - 0xd5c]
cmp ecx, dword [eax]
jl 0x407111
mov dword [ebp - 0x178c], 1
jmp 0x407118
and dword [ebp - 0x178c], 0
cmp dword [ebp - 0x178c], 9
jbe 0x40712d
mov dword [ebp - 0xd64], 1
jmp 0x407134
and dword [ebp - 0xd64], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d30]
cmp eax, dword [ebp - 0xd64]
jg 0x407155
mov dword [ebp - 0x1334], 1
jmp 0x40715c
and dword [ebp - 0x1334], 0
cmp dword [ebp - 0x1334], 0xfffffffe
je 0x40716e
and dword [ebp - 0xd6c], 0
jmp 0x407178
mov dword [ebp - 0xd6c], 1
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0x161c], eax
mov eax, dword [ebp - 0x161c]
mov dword [ebp - 0xd74], eax
jmp 0x40708d
jmp 0x40701c
lea ecx, [ebp - 0x1970]
call fcn.00415bbf
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x7ec], 0xf2c9
mov dword [ebp - 0x1c90], 0x21f2
mov dword [ebp - 0x568], 0
jmp 0x4071d9
mov eax, dword [ebp - 0x568]
inc eax
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 1
jge 0x4071f2
mov eax, dword [ebp - 0x568]
mov dword [ebp + eax*4 - 0x2c], 0
jmp 0x4071cc
mov dword [ebp - 0x64], 0
jmp 0x407202
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x407215
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x2c], 0x9dada439
jmp 0x4071fb
mov dword [ebp - 0x64], 0
jmp 0x407225
cmp dword [ebp - 0x64], 0
jg 0x407507
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0xda4], 0xfffffffa
mov dword [ebp - 0x890], 9
mov dword [ebp - 0x4c], 0
jmp 0x40725a
cmp dword [ebp - 0x4c], 0
jl 0x4074f6
mov dword [ebp - 0x6c0], 0xded68044
mov dword [ebp - 0x18d4], 0x7904
mov dword [ebp - 0x1a18], 0x34d71b36
mov dword [ebp - 0x6c0], 0
jmp 0x40729b
cmp dword [ebp - 0x6c0], 0
jl 0x4074f1
mov eax, dword [ebp - 0x64]
cmp dword [ebp + eax*4 - 0x2c], 0
je 0x407502
jmp 0x407507
jmp 0x40721e
mov dword [ebp - 0x1f20], 0xfffffff9
mov dword [ebp - 0x1f1c], 0xfffffff9
mov dword [ebp - 0x1f18], 0xfffffff9
mov dword [ebp - 0x1f14], 0xfffffff9
lea ecx, [ebp - 0x7bd]
call fcn.00415bea
push eax
lea eax, [ebp - 0x1f10]
push eax
lea eax, [ebp - 0x1f20]
push eax
lea ecx, [ebp - 0x2900]
call fcn.00415bed
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1dfc]
call fcn.00415b99
mov dword [ebp - 0x570], 0
mov dword [ebp - 0x570], 0x11
jmp 0x407587
cmp dword [ebp - 0x570], 0xffffffeb
je 0x407669
mov dword [ebp - 0x658], 1
mov dword [ebp - 0x2768], 7
mov dword [ebp - 0x2764], 7
mov dword [ebp - 0x2760], 7
mov dword [ebp - 0x275c], 7
mov dword [ebp - 0x658], 0
jmp 0x4075df
cmp dword [ebp - 0x658], 3
jle 0x407664
mov dword [ebp - 0x244], 0xffffffff
mov dword [ebp - 0x2f8], 0
push 1
lea ecx, [ebp - 0x2570]
call fcn.00415aed
mov dword [ebp - 0x350], 0xe541
mov dword [ebp - 0x6f8], 0
jmp 0x4076ad
cmp dword [ebp - 0x6f8], 1
jge 0x4076cf