Function at 0x421c67
Capabilities:
Get graphical window text
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
movdqa xmm0, xmmword [0xa5c870]
xor eax, eax
push ebx
push esi
push edi
push 3
pop esi
push dword [esp + 0x44]
mov dword [esp + 0x38], ecx
xor ebx, ebx
mov byte [esp + 0x34], dl
lea ecx, [esp + 0x1f8]
push ecx
inc ebx
mov dword [esp + 0xe0], eax
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x1ec]
mov dword [esp + 0x2c], 0xfffffffc
push ecx
mov dword [esp + 0x30], 0xd2edc755
lea ecx, [esp + 0xe4]
mov dword [esp + 0x30], esi
mov dword [esp + 0x30], eax
push eax
movdqu xmmword [esp + 0x1f4], xmm0
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
call fcn.004114da
mov dword [esp + 0x24], 0xa4ad744d
mov dword [esp + 0x24], 8
mov dword [esp + 0x14], 5
mov dword [esp + 0x18], 0
jmp 0x421d1e
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x21c], 0xfffffff7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x421d0b
push 2
mov dword [esp + 0x1c], 0
pop edi
jmp 0x421d44
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1fc], 0xa50b5f0
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x421d31
dec dword [esp + 0x14]
lea ecx, [esp + 0xd8]
call fcn.00411478
xor eax, eax
cmp byte [ebp + 0x1c], al
je 0x423390
mov dword [esp + 0x14], 0xfffffffc
mov dword [esp + 0x28], 0xf261718b
mov dword [esp + 0x20], eax
jmp 0x421d8e
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0xe4], 0x3bc6
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x421d7b
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x14], eax
jmp 0x421ed8
mov dword [esp + 0x18], 0xfffffff6
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x18], eax
jmp 0x421eca
mov dword [esp + 0x20], eax
jmp 0x421dd5
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0xa0], 0xfffffffb
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x421dc2
mov dword [esp + 0xac], ebx
cmp dword [esp + 0xac], eax
jl 0x421ec6
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], eax
jmp 0x421e11
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x180], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x421dfe
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], eax
jl 0x421e44
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x421e3e
push eax
push eax
push 0x1eaf
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
dec dword [esp + 0x1c]
jns 0x421e21
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], eax
jl 0x421eb9
mov ecx, dword [esp + 0xac]
cmp dword [esp + ecx*4 + 0xe4], eax
jne 0x421e62
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xac]
mov edx, dword [esp + ecx*4 + 0xe4]
imul edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
dec edx
neg edx
sbb edx, edx
neg edx
imul ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x180], ecx
mov ecx, dword [esp + 0xac]
imul ecx, dword [esp + 0x18]
mov dword [esp + 0x28], ecx
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x421eb3
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor eax, eax
dec dword [esp + 0x1c]
jns 0x421e4e
dec dword [esp + 0xac]
jns 0x421df0
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x421dbc
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xe
jl 0x421da3
mov dword [esp + 0x24], 0xffffffff
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x421efe
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x421f0f
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 4
lea ecx, [esp + 0x144]
call fcn.004113a6
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x421f3b
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x140]
mov dword [ecx + edx*4], 4
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x421f25
mov dword [esp + 0x18], eax
jmp 0x421f58
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x48], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x421f48
mov dword [esp + 0x4c], eax
jmp 0x421f7a
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 0x2f4a8b10
inc dword [esp + 0x4c]
cmp dword [esp + 0x4c], 4
jl 0x421f64
lea ecx, [esp + 0x140]
call fcn.00411478
push 3
lea ecx, [esp + 0x54]
call fcn.004113a6
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0xb4]
push edi
call fcn.004113a6
mov dword [esp + 0x20], ebx
xor eax, eax
mov dword [esp + 0x14], 0xf9aa2aa
mov dword [esp + 0x28], 0x9e478dfc
mov dword [esp + 0x24], 0xb3fe78de
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], eax
jmp 0x421fe8
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x50]
mov dword [ecx + edx*4], 0x3b4e1a36
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x421fd5
mov dword [esp + 0x18], eax
jmp 0x422007
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xb4]
mov dword [ecx + edx*4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x421ff5
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], edi
jg 0x4221ac
mov edi, dword [esp + 0x50]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], 0xa1265296
mov dword [esp + 0x14], eax
jmp 0x42204c
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x10c], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x422039
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x50]
mov dword [ecx + edx*4], esi
xor edx, edx
mov ecx, dword [esp + 0xb4]
cmp esi, 0xffffffff
setle dl
add edx, dword [ecx]
jne 0x4220b2
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x50]
cmp dword [ecx + edx*4], eax
jne 0x422089
mov ecx, dword [esp + 0x114]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov ecx, dword [esp + 0x50]
mov edx, dword [edi + 8]
cmp edx, dword [ecx + esi*4]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x50]
setle bl
mov dword [ecx + edx*4], ebx
test ebx, ebx
jne 0x4220af
mov ebx, eax
jmp 0x4220b2
xor ebx, ebx
inc ebx
xor ecx, ecx
cmp ebx, 0x2758e92e
setne cl
xor ebx, ebx
cmp ecx, 0xa16
mov ecx, dword [esp + 0x114]
setg bl
xor edx, edx
cmp ecx, ebx
setge dl
xor ebx, ebx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0xb4]
mov dword [edi + 4], 0x5b45
mov edx, dword [ecx]
mov ecx, dword [esp + 0x50]
cmp edx, dword [ecx + esi*4]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x50]
setl bl
mov dword [ecx + edx*4], ebx
mov ecx, dword [esp + 0x18]
xor ecx, ecx
cmp dword [edi + 8], eax
setne cl
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
cmp edx, ecx
mov ecx, dword [esp + 0x114]
setge bl
sub ecx, 0xfffffffb
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, ebx
mov dword [esp + 0x14], ecx
mov esi, dword [esp + 0x14]
add esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setg dl
add edx, dword [esp + 0x20]
jne 0x42217c
cmp dword [esp + 0x114], eax
jne 0x42217c
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x422181
xor ebx, ebx
inc ebx
mov edx, ebx
mov ecx, dword [esp + 0x114]
imul ecx, dword [esp + 0x1c]
imul ecx, edx
mov dword [esp + 0x28], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x42201f
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
pop edi
dec dword [esp + 0x2c]
lea ecx, [esp + 0xb4]
call fcn.00411478
lea ecx, [esp + 0x50]
call fcn.00411478
mov dword [esp + 0x2c], 0xfffffffb
or eax, 0xffffffff
mov dword [esp + 0x2c], 0xfffffffa
mov dword [esp + 0x28], 3
mov dword [esp + 0x24], 0xe5664dc9
mov dword [esp + 0x24], 0xfffffffc
mov dword [esp + 0x24], 9
mov dword [esp + 0x24], 0x5872d9ee
mov dword [esp + 0x1a4], eax
mov dword [esp + 0x1a8], eax
mov dword [esp + 0x1ac], eax
mov dword [esp + 0x1b0], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], 0
jmp 0x42223d
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x104], 0x7f4e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x42222a
mov dword [esp + 0x2c], 0x1f9c28ad
lea ecx, [esp + 0x134]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
dec dword [esp + 0x108]
push edi
call fcn.004113a6
xor eax, eax
mov dword [esp + 0x28], 0xc2076acb
mov dword [esp + 0x1c], eax
jmp 0x42228f
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x60], 0xffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x42227f
mov dword [esp + 0x1c], eax
jmp 0x4222ab
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x5c], 0xd3f7bf4
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jl 0x42229b
mov dword [esp + 0x1c], eax
jmp 0x4222cd
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x134]
mov dword [ecx + edx*4], 0x1615e82a
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x4222b7
cmp dword [esp + 0x60], eax
jne 0x422316
mov dword [esp + 0x5c], 0x8d526d2e
xor ebx, ebx
mov ecx, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x5c]
add ecx, 0x7ab6
test ecx, ecx
mov ecx, dword [esp + 0x134]
setle bl
sub edx, ebx
mov dword [ecx + 4], edx
jne 0x422313
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x422318
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [esp + 0x60]
sub ecx, eax
mov eax, 0xfffc
add ecx, eax
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x134]
call fcn.00411478
xor eax, eax
mov dword [esp + 0x20], 0x20e83c77
mov dword [esp + 0x14], eax
jmp 0x422355
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x68], 8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x422345
mov dword [esp + 0x20], eax
jmp 0x42236d
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x68], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jl 0x422361
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x20], ecx
cmp byte [esp + 0x30], al
je 0x4231bf
mov dword [esp + 0x1c], 0x125d16df
lea ecx, [esp + 0x70]
mov dword [esp + 0x20], 0x88a137b1
mov dword [esp + 0x18], 0x8a1bab0
push 3
call fcn.004113a6
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x4223c0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x70]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x4223b0
mov ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
je 0x422426
mov dword [esp + 0x14], eax
jmp 0x4223ee
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x204], 0x1836ccb0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x4223db
mov dword [esp + 0x20], eax
jmp 0x42241b
mov dword [esp + 0x2c], 7
mov dword [esp + 0x1c], eax
jmp 0x422411
dec dword [esp + 0x2c]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x422409
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jle 0x4223fb
jmp 0x422562
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x11c]
push 4
call fcn.004113a6
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x42244c
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x6c], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x422440
mov dword [esp + 0x18], eax
jmp 0x42246e
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x11c]
mov dword [ecx + edx*4], 0x2840cc74
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x422458
mov dword [esp + 0x1c], eax
jmp 0x422496
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x422492
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x42247b
mov dword [esp + 0x1c], 0xfffffff3
cmp dword [esp + 0x1c], 0xa
je 0x422554
mov dword [esp + 0x14], 4
xor edx, edx
mov dword [esp + 0x2c], 0x5860bc23
mov ecx, dword [esp + 0x6c]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x6c]
mov ecx, dword [esp + 0x28]
add ecx, 0x4bb3
cmp ecx, 0xfffffffe
mov ecx, 0xfffc
setle dl
cmp ecx, edx
mov ecx, dword [esp + 0x1c]
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, esi
setg dl
cmp edx, 0xfffffffc
jle 0x422519
cmp dword [esp + 0x14], eax
jne 0x42251b
mov ebx, eax
mov ecx, dword [esp + 0x1c]
xor edx, edx
cmp ebx, ecx
push 1
sete dl
xor ebx, ebx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
cmp ecx, edx
mov ecx, dword [esp + 0x120]
setle bl
mov dword [ecx], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0xa
pop ebx
jne 0x4224af
lea ecx, [esp + 0x11c]
call fcn.00411478
xor eax, eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], edi
jg 0x422610
jmp 0x422575
xor ebx, ebx
inc ebx
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x70]
cmp dword [ecx + edx*4], eax
jne 0x422594
mov ecx, dword [esp + 0x20]
mov edx, eax
imul ecx, dword [esp + 0x1c], 0x4191
test ecx, ecx
je 0x422596
mov edx, ebx
mov esi, dword [esp + 0x18]
xor ebx, ebx
mov ecx, dword [esp + 0x1c]
cmp edx, ecx
mov ecx, dword [esp + 0x70]
setl bl
xor edx, edx
cmp dword [ecx + esi*4], ebx
setne dl
cmp edx, 0xfffffffb
jne 0x4225c0
cmp dword [esp + 0x1c], eax
jne 0x4225c0
mov esi, eax
jmp 0x4225c3
xor esi, esi
inc esi
mov edi, dword [esp + 0x18]
xor ebx, ebx
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], ecx
imul ecx, esi, 0x5481
mov esi, dword [esp + 0x70]
push 2
cmp ecx, dword [esi + edx*4]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
setg bl
imul ebx, dword [esi + edi*4]
pop edi
neg ebx
mov dword [esi + ecx*4], ebx
mov ecx, dword [esp + 0x70]
cmp dword [ecx + edx*4], eax
jne 0x422610
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x422572
lea ecx, [esp + 0x70]
call fcn.00411478
xor esi, esi
lea ecx, [esp + 0xc0]
inc esi
push esi
call fcn.004113a6
mov dword [esp + 0x24], 0xfffffff7
lea ecx, [esp + 0x174]
push edi
call fcn.004113a6
mov dword [esp + 0x18], 0
jmp 0x42265e
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 0x53b26bdd
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x422648
mov dword [esp + 0x18], 0
jmp 0x422684
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], 0x5a60d005
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x42266e
mov eax, dword [esp + 0xc0]
and dword [eax], 0
mov dword [esp + 0x2c], esi
lea ecx, [esp + 0x194]
mov dword [esp + 0x24], 0
mov dword [esp + 0x24], 0xee28fdeb
mov dword [esp + 0x24], 3
push esi
call fcn.004113a6
xor eax, eax
mov dword [esp + 0x24], 5
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], eax
jmp 0x4226e7
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x194]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x4226d5
cmp dword [esp + 0x2c], eax
je 0x422733
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x422716
push 0x928
push 0xeea
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x422743
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
xor eax, eax
jmp 0x422743
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], esi
inc dword [esp + 0x28]
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x42275b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
lea ecx, [esp + 0x194]
call fcn.00411478
mov eax, dword [esp + 0xc0]
dec dword [eax]
cmp dword [eax], 0xfffffff2
jg 0x422694
lea ecx, [esp + 0x174]
call fcn.00411478
lea ecx, [esp + 0xc0]
call fcn.00411478
push esi
lea ecx, [esp + 0x150]
call fcn.004113a6
push dword [esp + 0x44]
movdqa xmm0, xmmword [0xa5c860]
lea ecx, [esp + 0x1e8]
push ecx
xor eax, eax
lea ecx, [esp + 0x1dc]
push ecx
push eax
lea ecx, [esp + 0x98]
mov dword [esp + 0x98], eax
movdqu xmmword [esp + 0x1e4], xmm0
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
call fcn.004114da
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], eax
jmp 0x422809
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14c]
mov dword [ecx + edx*4], 0x9102071b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x4227f3
mov edi, dword [esp + 0x88]
mov dword [edi + 8], eax
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x128]
mov dword [esp + 0x28], 0xe35fe57b
push 4
call fcn.004113a6
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x422851
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x128]
mov dword [ecx + edx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x42283f
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x422877
push 0x588
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], eax
jg 0x42297e
mov edx, dword [esp + 0x88]
mov ecx, dword [esp + 0x128]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], 0x9d43467
mov dword [esp + 0x28], esi
mov dword [esp + 0x14], eax
jmp 0x4228b9
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x40], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x4228ad
dec dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp dword [edx + 0xc], ecx
jl 0x4228d6
cmp dword [esp + 0x20], eax
je 0x4228d8
mov esi, eax
mov dword [esp + 0x28], 0xabb7
xor ebx, ebx
mov ecx, dword [esp + 0x18]
cmp esi, ecx
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
setne bl
xor edx, edx
dec ebx
cmp ebx, ecx
mov ecx, dword [esp + 0x28]
push 1
setge dl
sub esi, edx
xor edx, edx
cmp ecx, esi
setl dl
xor ecx, ecx
add edx, dword [edi + 8]
cmp edx, 9
setne cl
xor ebx, ebx
mov dword [esp + 0x2c], ecx
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
imul ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
sub edx, ecx
mov ecx, dword [esp + 0x150]
cmp dword [ecx + esi*4], edx
pop esi
setge bl
xor edx, edx
mov dword [esp + 0x28], ebx
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov ecx, dword [esp + 0x40]
setns dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0x40]
setl bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0x2c]
setg dl
mov dword [ecx + 4], edx
inc dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
cmp dword [esp + 0x20], eax
jle 0x42289b
lea ecx, [esp + 0x128]
call fcn.00411478
inc dword [edi + 8]
cmp dword [edi + 8], 0
jle 0x422819
lea ecx, [esp + 0x88]
call fcn.00411478
lea ecx, [esp + 0x14c]
call fcn.00411478
mov eax, 0x5bb2c213
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
xor eax, eax
mov dword [esp + 0x24], 0x5010f7a7
mov dword [esp + 0x24], 0x443ac46d
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x24], 0x34bdac84
mov dword [esp + 0x24], 0x96753f3a
mov dword [esp + 0x24], 0x1ae9a07b
push 3
mov dword [esp + 0x28], esi
pop ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], eax
jmp 0x422a2a
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0xb0], 9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x422a17
push 2
mov dword [esp + 0x1c], eax
pop edi
jmp 0x422a4c
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0xfc], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x422a39
cmp dword [esp + 0xf8], eax
je 0x422b3c
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x188]
mov dword [esp + 0x24], 0xfbd6c3f0
mov dword [esp + 0x18], 0x1c3a23fe
mov dword [esp + 0x24], 0x52d0da0b
push edi
call fcn.004113a6
xor eax, eax
mov dword [esp + 0x28], 0xf34ffdea
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
jmp 0x422ab2
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x188]
mov dword [ecx + edx*4], 0xd95da228
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x422a9c
mov edx, dword [esp + 0xfc]
xor ebx, ebx
mov ecx, dword [esp + 0x18]
add edx, 0x9b6d5beb
cmp ecx, edx
setg bl
sub ebx, dword [esp + 0x28]
jne 0x422ade
mov edi, eax
cmp dword [esp + 0x2c], eax
je 0x422ae0
mov edi, esi
dec dword [esp + 0x20]
xor ebx, ebx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xf8]
cmp edx, ecx
mov ecx, dword [esp + 0x28]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0xfc]
setle dl
xor ebx, ebx
cmp edx, edi
setg bl
xor edx, edx
cmp ebx, ecx
setle dl
cmp dword [esp + 0x20], edx
jge 0x422b24
cmp dword [esp + 0x24], eax
je 0x422b24
mov eax, esi
lea ecx, [esp + 0x188]
mov dword [esp + 0x2c], eax
call fcn.00411478
push 2
pop edi
push 3
pop ebx
jmp 0x422b6e
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x422b5b
push eax
push eax
push 0x1969
push 0x8e0
push eax
call dword [sym.imp.USER32.dll_ModifyMenuW]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x422b6e
push eax
push eax
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push ebx
lea ecx, [esp + 0x98]
call fcn.004113a6
push dword [esp + 0xb0]
movdqa xmm0, xmmword [0xa5c810]
lea ecx, [esp + 0x1d8]
push ecx
xor eax, eax
mov dword [esp + 0x28], 4
lea ecx, [esp + 0x1cc]
mov dword [esp + 0xd4], eax
push ecx
push eax
lea ecx, [esp + 0xdc]
mov dword [esp + 0xe0], eax
movdqu xmmword [esp + 0x1d4], xmm0
mov dword [esp + 0xe4], eax
call fcn.004114da
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x422bea
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x210], 5
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x422bd7
mov dword [esp + 0x18], eax
jmp 0x422c09
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x94]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x422bf6
mov ecx, dword [esp + 0x94]
mov dword [ecx], eax
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], eax
jl 0x422c4e
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x422c40
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor eax, eax
mov dword [esp + 0x20], 0xfffffffc
dec dword [esp + 0x14]
jns 0x422c2a
mov ecx, dword [esp + 0x94]
inc dword [ecx]
cmp dword [ecx], edi
jle 0x422c18
mov dword [esp + 0x20], 0xffffffee
jmp 0x422c9e
mov dword [esp + 0x24], 0x31d2
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x94]
mov dword [ecx], edx
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x422c9a
push 0x588
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x16
jl 0x422c65
lea ecx, [esp + 0xcc]
call fcn.00411478
lea ecx, [esp + 0x94]
call fcn.00411478
mov dword [esp + 0x1c], 0xd1454bcd
lea ecx, [esp + 0x7c]
mov dword [esp + 0x20], 0xfffffffb
mov dword [esp + 0x14], esi
push esi
call fcn.004113a6
mov dword [esp + 0x24], 0x5fef4072
mov eax, 0x1af53c8c
mov dword [esp + 0x14], 0x4f5fdfda
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], eax
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x422d27
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x7c]
mov dword [ecx + edx*4], 0x73ed1322
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x422d14
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x422d41
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
xor eax, eax
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
cmp edx, ecx
setge bl
xor edx, edx
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
cmp ecx, 0xfffffffd
setge dl
sub edx, dword [esp + 0x1c]
cmp edx, 0x87b35f19
sbb ecx, ecx
xor ebx, ebx
inc ecx
imul ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
cmp edx, ecx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x7c]
setl bl
add edx, 0x6c7a
add edx, ebx
mov dword [ecx], edx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x7c]
cmp dword [ecx], esi
sbb ecx, ecx
neg ecx
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x7c]
sub edx, dword [ecx]
je 0x422dd5
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x20], eax
jne 0x422ded
mov ecx, dword [esp + 0x7c]
cmp dword [ecx], eax
mov ecx, eax
je 0x422def
mov ecx, esi
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0x14]
jne 0x422e05
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x160], eax
lea ecx, [esp + 0x7c]
call fcn.00411478
mov dword [esp + 0x1c], 0xfffffffc
xor eax, eax
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], eax
jmp 0x422e44
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x1a0], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x422e35
cmp dword [esp + 0x1c], eax
je 0x422e70
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x422f2f
push eax
push 0xd22
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
jmp 0x422f2f
mov dword [esp + 0x20], 0xb441791e
mov dword [esp + 0x24], 3
cmp dword [esp + 0x1c], eax
je 0x422eb7
mov ecx, dword [esp + 0x1c]
add ecx, 0x8068
imul ecx, dword [esp + 0x1c]
sub ecx, 0x478c9dff
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], esi
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
xor ebx, ebx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x20]
imul edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
cmp edx, ecx
setl bl
xor ecx, ecx
cmp ebx, 0xffffffff
setne cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x24], ecx
setle dl
xor ecx, ecx
test edx, edx
setns cl
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
jmp 0x422f28
xor eax, eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], eax
jl 0x422f60
mov dword [esp + 0x34], 0x69ad59e5
mov dword [esp + 0x14], eax
jmp 0x4231dd
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x44], 7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x4231cd
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x4231f3
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x168]
mov dword [esp + 0x44], eax
push ebx
call fcn.004113a6
mov dword [esp + 0x14], 0
jmp 0x423224
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x423212
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x42325a
push 0x1dc1
push 0x1e42
push 0xca6
push 0x1bad
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x42326f
call esi
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
lea ecx, [esp + 0x168]
call fcn.00411478
mov dword [esp + 0x18], 0xfffffffa
xor eax, eax
mov dword [esp + 0x14], 0xc42206dd
mov dword [esp + 0x14], eax
jmp 0x4232a6
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x1f4], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x423293
mov dword [esp + 0x18], eax
jmp 0x423319
mov dword [esp + 0x20], 0xfffffffc
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
neg edi
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
sbb edi, edi
xor edx, edx
neg edi
cmp ecx, 0x74952f34
setle dl
imul ecx, edx, 0xffff
mov edx, dword [esp + 0x20]
sub edx, ecx
mov ecx, dword [esp + 0x20]
cmp ebx, edx
sbb esi, esi
xor edx, edx
neg esi
sub esi, 2
cmp esi, ecx
mov ecx, 0xdebf889e
setg dl
cmp ecx, edx
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [esp + 0x20]
cmp edi, edx
setg cl
mov dword [esp + 0x14], ecx
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe6
je 0x4232b2
mov dword [esp + 0x18], eax
jmp 0x42337d
mov dword [esp + 0x28], 0x886a6c65
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], eax
jl 0x423379
mov dword [esp + 0x20], 4
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], eax
jl 0x42336f
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x423369
push 0x1709
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
xor eax, eax
dec dword [esp + 0x20]
jns 0x42334a
dec dword [esp + 0x28]
dec dword [esp + 0x14]
jns 0x423338
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffeb
jle 0x423326
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x4233e5
mov dword [esp + 0x14], eax
mov dword [esp + 0x34], 0x45f1dbec
mov dword [esp + 0x34], 0x37ad4351
mov dword [esp + 0x34], 0xe923e64f
mov dword [esp + 0x14], 0x11
jmp 0x4233c6
mov dword [esp + 0x20], edi
inc dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffeb
jne 0x4233b6
mov byte [esp + 0x3c], al
mov byte [esp + 0x38], bl
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x4233e5
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret