Function at 0x4335bd
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x28], 0x76b0f738
push 3
mov byte [ebp - 0x29], dl
call fcn.0043324a
push 2
pop edi
mov dword [ebp - 0x28], 0xedb5
lea ecx, [ebp - 0x194]
push edi
call fcn.0043324a
mov dword [ebp - 0x18], 0x752f67d5
xor eax, eax
mov dword [ebp - 0x1c], 0x5466
mov dword [ebp - 0x14], 0xffff
mov dword [ebp - 0x24], 0x1f9531de
mov dword [ebp - 8], eax
jmp 0x43362b
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x154]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x43361c
mov dword [ebp - 8], eax
jmp 0x433645
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x194]
mov dword [eax + ecx*4], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x433636
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x194]
mov eax, dword [ebp - 0x154]
mov dword [eax], 0xb0cf
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
call fcn.0043331c
lea ecx, [ebp - 0x154]
call fcn.0043331c
xor ebx, ebx
mov dword [ebp - 0x1c], 0x62fd41e5
inc ebx
lea ecx, [ebp - 0xe4]
xor esi, esi
mov dword [ebp - 0x10], esi
push ebx
call fcn.0043324a
mov dword [ebp - 0x18], 0xa6c2e3a4
xor eax, eax
mov dword [ebp - 0x28], 0x8ca929ef
mov dword [ebp - 8], eax
jmp 0x4336c8
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x94], 0x98070ade
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4336b7
mov dword [ebp - 8], eax
jmp 0x4336e3
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xf8], 0x756a3367
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4336d2
mov dword [ebp - 8], eax
jmp 0x433700
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xe4]
mov dword [ecx + edx*4], 7
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4336ed
mov ecx, dword [ebp - 0xe4]
inc dword [ecx]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff2
jg 0x43395e
mov esi, 0xce3d978
jmp 0x433723
xor eax, eax
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa0bd0]
lea ecx, [ebp - 0x1c4]
push ecx
lea ecx, [ebp - 0x1d4]
mov dword [ebp - 0x3c], eax
push ecx
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x38], eax
movdqu xmmword [ebp - 0x1d4], xmm0
mov dword [ebp - 0x34], eax
call fcn.0043338d
mov dword [ebp - 8], 0xfc75
xor ecx, ecx
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov esi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
cmp dword [esi + 8], eax
mov eax, dword [ebp - 8]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
cmp edx, 0x83800955
mov dword [ebp - 0xf8], edx
mov eax, dword [ebp - 0x90]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x90]
setg dl
imul edx, dword [esi + 8]
imul eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x10], 8
je 0x4337e4
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x43386a
push eax
push eax
push 0x1ec5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
jmp 0x433868
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa0bc0]
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0xf0], eax
push ecx
push eax
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xec], eax
movdqu xmmword [ebp - 0x214], xmm0
mov dword [ebp - 0xe8], eax
call fcn.0043338d
xor esi, esi
cmp dword [ebp - 0x44], esi
jne 0x43382f
cmp dword [ebp - 0x48], esi
je 0x433831
mov esi, ebx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x3c]
push 0
mov eax, dword [eax]
dec eax
pop eax
sets al
xor edx, edx
cmp esi, eax
mov eax, dword [ebp - 0xe4]
setge dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0xf0]
call fcn.0043331c
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jg 0x433944
mov dword [ebp - 0x28], 9
xor edx, edx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0x3c]
mov ecx, dword [edi + ecx*4]
cmp ecx, dword [edi + esi*4]
setg dl
cmp edx, dword [edi + ebx*4]
jle 0x4338de
mov edi, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x3c]
sub esi, dword [ecx + edx*4]
mov ecx, dword [ebp - 0x3c]
neg esi
sbb esi, esi
inc esi
mov edi, dword [ecx + edi*4]
add edi, esi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0xf4], edi
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0x3c]
mov ecx, dword [edx + ecx*4]
add ecx, edi
imul ecx, dword [edx + esi*4]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
je 0x4338de
xor ebx, ebx
inc ebx
jmp 0x4338e0
mov ebx, eax
mov esi, dword [ebp - 8]
xor edx, edx
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x90]
cmp ebx, ecx
mov ecx, dword [ebp - 0x3c]
setge dl
xor ebx, ebx
cmp edx, dword [ecx + esi*4]
setl bl
sub ebx, dword [ecx + edi*4]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x28], ebx
xor ebx, ebx
mov edx, dword [ebp - 0x28]
cmp edx, dword [ecx]
mov ecx, dword [ebp - 0x10]
setle bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [ebp - 0x28], edx
xor edx, edx
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [esi + edi*4]
setge dl
mov dword [ebp - 0x28], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jle 0x433877
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x3c]
call fcn.0043331c
dec dword [ebp - 0x10]
mov esi, 0xce3d978
cmp dword [ebp - 0x10], 0xfffffff2
jle 0x433721
lea ecx, [ebp - 0xe4]
call fcn.0043331c
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa0bf0]
lea ecx, [ebp - 0x1d4]
mov edi, dword [0x4af5ec]
xor eax, eax
push ecx
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 0x28], edi
push ecx
push eax
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0xbc], eax
movdqu xmmword [ebp - 0x1e4], xmm0
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
call fcn.0043338d
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], esi
jl 0x4339ec
mov dword [ebp - 0x18], 0x59b8bc58
mov dword [ebp - 0x18], 0x5934215e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x14]
jns 0x4339c4
lea ecx, [ebp - 0xbc]
call fcn.0043331c
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x84]
xor eax, eax
push 3
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
call fcn.0043324a
push 2
pop esi
mov dword [ebp - 8], 0x6aabecba
lea ecx, [ebp - 0x178]
push esi
call fcn.0043324a
xor eax, eax
mov dword [ebp - 0x18], 0x4e7ccce1
mov dword [ebp - 8], eax
jmp 0x433a4b
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x84]
mov dword [ecx + edx*4], 0x313dd33a
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x433a38
mov dword [ebp - 8], eax
jmp 0x433a69
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x178]
mov dword [ecx + edx*4], 0x77045b3
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x433a56
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jg 0x433b83
mov edi, dword [ebp - 0x84]
xor ebx, ebx
inc ebx
push dword [ebp + 8]
movdqa xmm0, xmmword [str._a_a_a_a]
lea ecx, [ebp - 0x1f4]
push ecx
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x18], ebx
push ecx
mov dword [ebp - 0x18], 0xf446cd5f
lea ecx, [ebp - 0x78]
push eax
movdqu xmmword [ebp - 0x204], xmm0
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
call fcn.0043338d
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 0x84]
cmp dword [eax + ecx*4], 0xb241
setle dl
xor eax, eax
cmp edx, dword [ebp - 8]
je 0x433ae3
mov esi, eax
cmp dword [edi + 4], eax
je 0x433ae5
mov esi, ebx
mov edx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0x84]
cmp esi, dword [ecx + edx*4]
mov ecx, dword [ebp - 0x178]
setne bl
mov dword [ecx], ebx
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x84]
mov esi, dword [ebp - 0x78]
mov ecx, dword [ecx + edx*4]
mov edx, dword [edi + 4]
dec edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 8]
add ecx, edx
xor edx, edx
cmp ecx, 0xac25
mov ecx, dword [ebp - 0x18]
setle dl
xor ebx, ebx
cmp edx, dword [esi + 4]
setne bl
xor edx, edx
cmp ecx, ebx
setl dl
sub edx, dword [esi + 4]
je 0x433b52
mov ecx, dword [ebp - 0x78]
cmp dword [ecx], eax
je 0x433b52
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x433b57
xor ebx, ebx
mov ecx, eax
inc ebx
xor eax, eax
cmp ecx, 0xba928f0b
lea ecx, [ebp - 0x78]
setne al
mov dword [ebp - 0x18], eax
call fcn.0043331c
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
push 0
pop eax
jle 0x433a83
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0x178]
call fcn.0043331c
lea ecx, [ebp - 0x84]
call fcn.0043331c
cmp byte [ebp - 0x29], 0
je 0x433d31
cmp edi, 1
jne 0x433d31
mov dword [ebp - 0x10], 0x540d7f82
xor eax, eax
mov dword [ebp - 0x18], 0xdb7758b3
mov dword [ebp - 0x18], 0x792891f4
mov dword [ebp - 0x10], 0x14
cmp dword [ebp - 0x10], 0xfffffff5
jne 0x433c81
mov dword [ebp - 8], 0xa7275995
mov dword [ebp - 0x14], 0x4d4e2b79
mov dword [ebp - 0x1c], 0x70fc2448
mov dword [ebp - 0x18], edi
cmp dword [ebp - 8], eax
je 0x433c53
cmp dword [ebp - 0x10], eax
je 0x433c01
cmp dword [ebp - 0x10], 0xf1e5
mov edx, edi
jne 0x433c03
mov edx, eax
mov ecx, dword [ebp - 8]
imul ecx, edx
add ecx, 0x5a9c
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
sub edx, 0x578cca6
neg edx
sbb edx, edx
inc edx
sub ecx, edx
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x10]
jge 0x433c47
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jmp 0x433c6b
mov dword [ebp - 0x18], 0x752783de
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 6
je 0x433c61
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff5
je 0x433bd4
mov edi, dword [ebp - 0x28]
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x433ca0
push eax
push eax
push 0xce9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa0bf0]
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x224]
mov dword [ebx + 8], 4
push ecx
push eax
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xa0], eax
movdqu xmmword [ebp - 0x224], xmm0
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
call fcn.0043338d
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], esi
jl 0x433d1f
mov dword [ebp - 0x18], 0x59b8bc58
mov dword [ebp - 0x18], 0x5934215e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x14]
jns 0x433cf7
lea ecx, [ebp - 0xa0]
call fcn.0043331c
mov dword [ebx + 0xc], 0x4af5ec
xor ebx, ebx
mov dword [ebp - 8], 0xcea5d6c0
inc ebx
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], 5
cmp dword [ebp - 8], 0xffffffe4
jg 0x433e96
mov ecx, 0xb319bd1
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x18], 0xc8a2db63
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0x37d6
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setle dl
cmp edx, dword [ebp - 8]
jle 0x433da9
cmp dword [ebp - 0x10], eax
je 0x433db0
mov esi, ebx
cmp dword [ebp - 0x10], eax
jne 0x433db2
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp esi, ecx
sete dl
imul ecx, edx, 3
mov edx, 0xaf48770c
sub edx, ecx
add edx, dword [ebp - 0x10]
je 0x433dd2
mov ecx, ebx
cmp dword [ebp - 0x10], eax
jne 0x433dd4
mov ecx, eax
cmp ecx, dword [ebp - 0x10]
jge 0x433ddc
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xac]
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 0xac]
setl bl
xor edx, edx
cmp ebx, ecx
setl dl
sub edx, 0x34f9565
cmp edx, 0xffffffff
je 0x433e25
cmp dword [ebp - 0x14], eax
jne 0x433e25
mov ecx, eax
jmp 0x433e28
xor ecx, ecx
inc ecx
xor edx, edx
cmp ecx, 0xc1731d4
mov ecx, dword [ebp - 0x10]
setne dl
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 8]
setg bl
xor edx, edx
cmp ebx, ecx
setge dl
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp - 8]
je 0x433e5c
cmp dword [ebp - 0xac], eax
jne 0x433e68
cmp dword [ebp - 0x14], eax
jne 0x433e68
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x433e6d
xor ebx, ebx
inc ebx
mov esi, ebx
mov ecx, dword [ebp - 8]
xor edx, edx
cmp esi, ecx
setne dl
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov ecx, 0xb319bd1
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe4
jle 0x433d56
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x433eaf
push eax
push eax
push 0x733
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor eax, eax
mov esi, dword [ebp - 0x20]
cmp esi, edi
jge 0x4349c3
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x18], 0xe17f7596
mov dword [ebp - 0x18], 0x371247ad
mov dword [ebp - 0x18], 0xa7525d2d
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x433efb
push 0x20ba
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jne 0x433f0d
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x433f0f
mov edx, ebx
mov ecx, dword [ebp - 0x14]
mov edi, 0x4af5f0
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
add ecx, edx
xor edx, edx
cmp ecx, 0x15d0
mov ecx, dword [ebp - 0x14]
setne dl
xor ebx, ebx
cmp ecx, edx
setge bl
imul ebx, dword [ebp - 0x18]
add ebx, dword [ebp - 0x14]
neg ebx
sbb ebx, ebx
neg ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
jmp 0x433f60
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x250], 0xfff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x433f4f
mov dword [ebp - 0x10], eax
jmp 0x433f85
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x433f82
push 0x1b6a
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x433f6b
mov dword [ebp - 0x10], 0x11
jmp 0x433fa9
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x433fa6
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
jle 0x433f94
xor ebx, ebx
inc ebx
test esi, esi
jle 0x434464
jmp 0x433fbe
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff6
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x1c], 0xf95751cf
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 8], eax
push ebx
call fcn.0043324a
xor esi, esi
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x14], esi
jmp 0x434007
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x124]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x433ff7
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x10]
test eax, eax
je 0x434024
cmp dword [ebp - 0x18], esi
je 0x434024
mov esi, ebx
mov dword [ebp - 0x1c], 0x1fa147b8
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
xor eax, eax
cmp ecx, esi
setle al
xor ecx, ecx
cmp eax, 0xfffffff7
setne cl
xor eax, eax
cmp ecx, 9
setg al
neg eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
lea ecx, [ebp - 0x124]
call fcn.0043331c
mov eax, dword [edi]
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x18], 0x7207
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x43409f
push 0x976
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0xfffffff8
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4340c8
push eax
push 0x1562
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor eax, eax
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, 0xc07c2076
setne dl
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
jmp 0x4340f2
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x244], 0xfff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x4340e1
push 2
mov dword [ebp - 0x10], eax
pop esi
jmp 0x43411a
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x434117
push 0x1b6a
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x434100
mov dword [ebp - 0x10], 0x11
jmp 0x43413d
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x43413a
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
jle 0x434128
mov ebx, dword [edi + 4]
lea ecx, [ebp - 0x10c]
push esi
call fcn.0043324a
xor eax, eax
mov dword [ebp - 0x14], 0x57976326
mov dword [ebp - 0x14], eax
jmp 0x43416f
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10c]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x434160
xor esi, esi
inc esi
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x434192
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10c]
cmp dword [ecx + edx*4], eax
jne 0x434192
dec dword [ebp - 0x14]
jns 0x43417f
lea ecx, [ebp - 0x10c]
call fcn.0043331c
mov dword [ebp - 0x18], 2
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 0x18], esi
add edi, 8
mov dword [ebp - 0x18], 0x1d925b0e
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0xcf2e5664
mov dword [ebp - 0x18], 0xba07e4fc
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x18], 0xfffffffd
push esi
call fcn.0043324a
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0xddca
mov dword [ebp - 0x1c], esi
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x434213
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x238], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x434202
xor edx, edx
mov dword [ebp - 0x10], esi
inc edx
jmp 0x434234
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1b0]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x434221
dec dword [ebp - 0x18]
lea ecx, [ebp - 0x1b0]
dec dword [ebp - 0x1c]
call fcn.0043331c
test ebx, ebx
jne 0x434251
add edi, 8
push 4
lea ecx, [ebp - 0x13c]
call fcn.0043324a
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x18], 0xdc99cdf9
push 3
mov dword [ebp - 0x18], 0xbe856dfc
mov dword [ebp - 0x18], esi
pop esi
push esi
call fcn.0043324a
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], eax
jmp 0x4342a8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x13c]
mov dword [ecx + edx*4], 0xfffffffc
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x434295
mov dword [ebp - 8], eax
jmp 0x4342c0
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x188], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4342b3
mov dword [ebp - 8], eax
jmp 0x4342d9
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1bc]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4342ca
mov dword [ebp - 0x10], eax
jmp 0x4342f4
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x13c]
cmp dword [ecx + edx*4], eax
jne 0x4342f9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x4342e3
mov dword [ebp - 0x10], eax
jmp 0x434435
mov dword [ebp - 0x1c], 0x74b666a7
mov dword [ebp - 0x18], 0xeb4c8f0d
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x18], 0x4dcc80fc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0x5ac3d6c1
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x14], eax
jmp 0x434340
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x260], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x434333
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x18
jle 0x434432
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x184]
mov dword [ebp - 0x14], 0x2dd78f4f
mov dword [ebp - 0x14], 0xbefcdf1
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x14], 0xde450bb
push 2
call fcn.0043324a
push dword [ebp + 8]
lea ecx, [ebp - 0x1e4]
xor eax, eax
push ecx
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 0xd8], eax
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0xd4], eax
push eax
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0xd0], eax
movdqu xmmword [ebp - 0x1f4], xmm0
call fcn.0043338d
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x4343d5
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x184]
mov dword [ecx + edx*4], 0x4d07ddbf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x4343c2
mov dword [ebp - 8], eax
jmp 0x434403
mov dword [ebp - 0x14], eax
jmp 0x4343f2
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x230], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x4343e5
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x14], ecx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffa
jne 0x4343e0
dec dword [ebp - 0x18]
lea ecx, [ebp - 0xd8]
call fcn.0043331c
lea ecx, [ebp - 0x184]
call fcn.0043331c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x18
push 0
pop eax
jg 0x434353
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1a
jg 0x434301
lea ecx, [ebp - 0x1bc]
call fcn.0043331c
lea ecx, [ebp - 0x13c]
call fcn.0043331c
add edi, dword [ebp - 0x24]
dec dword [ebp - 0x20]
mov dword [ebp - 0x18], edi
jne 0x433fbc
xor esi, esi
lea ecx, [ebp - 0x16c]
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0xf446cd5f
mov dword [ebp - 0x20], 0x8451d77f
push ebx
call fcn.0043324a
push 2
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], esi
jmp 0x43449e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x100], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x434491
mov dword [ebp - 0x10], esi
jmp 0x4344bb
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x16c]
mov dword [eax + ecx*4], 3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4344a8
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xfc], 0x51efdb
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
add ecx, 0x105a83d8
cmp ecx, eax
mov eax, dword [ebp - 8]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 0x16c]
setne dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 8]
cmp edx, eax
setg cl
sub ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0xffff6858
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x24], eax
call fcn.0043331c
mov ebx, dword [edi]
xor eax, eax
mov dword [ebp - 8], 0x2e91a04
inc eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x24], 0xe857b1a0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], eax
jmp 0x434580
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x1a4], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x43456f
mov dword [ebp - 8], 0x19
jmp 0x4345a9
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4345a6
push 0x1a6f
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 8
jle 0x43458f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jg 0x434652
xor edi, edi
inc edi
mov dword [ebp - 0x20], edi
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4345d4
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor eax, eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x60]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x60]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x60]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x60]
mov ecx, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x60]
mov ecx, dword [ebp - 8]
sub edx, dword [ebp + ecx*4 - 0x60]
mov ecx, dword [ebp - 0x1a0]
inc ecx
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, edx
mov ecx, dword [ebp - 8]
setge bl
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x60]
cmp ecx, ebx
mov ecx, dword [ebp - 0x1a0]
sete dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x24]
setge bl
xor edx, edx
cmp ebx, ecx
sete dl
mov dword [ebp - 0x20], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jle 0x4345bf
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x14], 0xfffffff6
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x18], 0xffffffff
push 3
call fcn.0043324a
mov eax, 0x663c10b4
xor esi, esi
mov dword [ebp - 0xcc], eax
xor ecx, ecx
mov dword [ebp - 0xc8], eax
inc ecx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x20], 0xcafdf115
mov dword [ebp - 8], esi
jmp 0x4346a9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x40], 5
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x43469b
mov dword [ebp - 8], esi
jmp 0x4346c1
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x30], 0x3cef3392
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x4346b3
mov dword [ebp - 8], esi
jmp 0x4346de
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 0x93dd61fb
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4346cb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x43480f
mov dword [ebp - 0x14], 0x15912491
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x1c], 0xfc2f92e6
mov dword [ebp - 0x24], 0x3ee67684
push 4
call fcn.0043324a
mov dword [ebp - 0x10], 0xf7ff
xor eax, eax
mov dword [ebp - 0x24], 0xa7b48fe2
mov dword [ebp - 0x1c], eax
jmp 0x43473c
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x118]
mov dword [ecx + edx*4], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x434729
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
inc dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x118]
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov dword [edx + 0xc], 0xecb515fe
cmp dword [ebp - 0x14], eax
jne 0x434793
mov ecx, dword [ebp - 0x40]
cmp dword [edx + 0xc], eax
jne 0x43479b
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
cmp ecx, 1
setl dl
sub edx, dword [ebp - 0x30]
je 0x4347c6
mov dword [ebp - 0x24], 0x60517e40
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
jmp 0x434802
mov dword [ebp - 0x14], eax
jmp 0x4347ed
mov dword [ebp - 0x10], eax
jmp 0x4347e5
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x130]
mov ecx, dword [edx + ecx*4]
mov dword [edx + esi*4], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x4347d0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jle 0x4347cb
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x434802
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
lea ecx, [ebp - 0x118]
call fcn.0043331c
jmp 0x43481c
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x130]
call fcn.0043331c
mov esi, dword [edi + 4]
xor ecx, ecx
mov dword [ebp - 0x18], 0x65797632
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0x161ab6ec
cmp dword [ebp - 0x18], ecx
je 0x43486b
mov byte [ebp - 9], cl
cmp byte [ebp - 9], cl
je 0x434859
push ecx
push 0x21e4
push ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
xor ecx, ecx
xor edx, edx
inc edx
mov dword [ebp - 0x1c], 0xdf99ff60
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
jmp 0x4348ba
xor edx, edx
mov dword [ebp - 0x20], 0x9454
mov dword [ebp - 0x1c], ecx
inc edx
jmp 0x434887
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x88], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x43487a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x88], eax
jmp 0x43485c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1c4], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x4348a9
mov dword [ebp - 0x1c], ecx
jmp 0x4348f2
mov dword [ebp - 0x20], 0x4f09
mov dword [ebp - 0x18], 0x73292c5e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x20]
cmp eax, 0x4446
mov eax, edx
cmovne eax, ecx
mov dword [ebp - 0x1c4], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
jle 0x4348c5
test esi, esi
jne 0x4349c5
cmp byte [ebp - 0x29], 0
je 0x434914
cmp dword [ebp - 0x28], edx
jne 0x434914
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x10]
add dword [ecx + 8], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0xc]
add edi, 0x10
push ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edi
call fcn.00488a81
mov dword [ebp - 0x28], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x8c]
push eax
push ebx
call fcn.0046c1d3
mov edi, dword [ebp - 0x6c]
xor ecx, ecx
mov esi, ecx
test ebx, ebx
jle 0x4349a0
mov eax, esi
and eax, 0x80000001
jns 0x43496a
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x24]
add eax, esi
add eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x20]
jmp 0x43497f
lea eax, [edx + 1]
cdq
idiv ebx
cmp word [edi + edx*2], cx
jne 0x43497c
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov eax, dword [ebp - 0x18]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x28]
mov byte [esi + edx], al
inc esi
cmp esi, ebx
jl 0x43495c
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
mov dword [edx], ebx
mov dword [edx + 4], eax
test edi, edi
je 0x4349c5
push edi
call fcn.00489f76
pop ecx
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
jmp 0x4349c5
xor ecx, ecx
mov dword [ebp - 8], 0xb3152c58
xor edi, edi
mov dword [ebp - 0x10], 0xffffffff
inc edi
mov dword [ebp - 0x24], 0x99843334
xor ebx, ebx
mov dword [ebp - 0x14], 0xfab8d232
mov dword [ebp - 0x18], edi
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp edx, eax
setne bl
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jge 0x434a04
cmp dword [ebp - 0x10], ecx
je 0x434a06
mov ecx, edi
mov eax, dword [ebp - 8]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
setge cl
sub edx, ecx
neg eax
sbb eax, eax
neg eax
imul edx, eax
test edx, edx
jg 0x434acc
push edi
lea ecx, [ebp - 0x148]
call fcn.0043324a
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x434a59
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x148]
mov dword [ecx + edx*4], 0x78ac
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x434a46
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x434a79
push 0xef5
push 0x24dd
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x434abc
mov dword [ebp - 0x10], eax
jmp 0x434ab4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x148]
cmp dword [ecx + edx*4], eax
mov byte [ebp - 9], al
je 0x434aa2
cmp byte [ebp - 9], 0
je 0x434ab1
call dword [sym.imp.KERNEL32.dll_GetVersion]
jmp 0x434aaf
cmp byte [ebp - 9], 0
je 0x434ab1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x434a83
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jle 0x434a7e
lea ecx, [ebp - 0x148]
jmp 0x434b86
mov dword [ebp - 0x24], 0x4ea3
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x20], 0xee1d459
mov dword [ebp - 0x28], 0xc51978e6
push 2
call fcn.0043324a
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x434b08
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + edx*4], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x434af5
cmp dword [ebp - 0x24], eax
jne 0x434b7b
mov ecx, dword [ebp - 8]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x10], edi
sbb esi, esi
inc esi
sub esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, esi
mov ecx, dword [ebp - 0x10]
setne dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
setle bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0x10]
setge dl
mov dword [ebp - 0x24], edx
xor edx, edx
cmp dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x160]
setle dl
xor ebx, ebx
cmp edx, 0xb15a
setl bl
mov dword [ecx], ebx
cmp ebx, dword [ebp - 0x14]
jle 0x434b72
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x434b74
mov edx, edi
mov ecx, dword [ebp - 0x28]
sub edx, ecx
je 0x434b7d
mov eax, edi
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x160]
call fcn.0043331c
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret