Function at 0x4278f9
Capabilities:
Get graphical window text
Identify system language via api
Query or enumerate registry key
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x64], ecx
inc edi
mov dword [ebp - 0x14], 0xffffffff
push edi
lea ecx, [ebp - 0x98]
mov byte [ebp - 0x39], dl
call fcn.00427586
mov dword [ebp - 0x1c], 4
xor eax, eax
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x14], eax
jmp 0x427949
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x98]
mov dword [ecx + edx*4], 0xbdf78b15
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x427936
push 3
mov dword [ebp - 0x14], 0x16
pop ebx
jmp 0x427ac4
mov dword [ebp - 0x18], 0x643cdf98
mov dword [ebp - 0x20], 0xe00457a2
mov dword [ebp - 0x2c], 0x14a59e47
mov dword [ebp - 0x18], eax
jmp 0x427988
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0xec], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x427977
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xfffffffb
jne 0x427ab6
mov dword [ebp - 8], 0x8a600164
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x10], 0xe9942c3b
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
mov ecx, dword [ebp - 8]
setg dl
xor ebx, ebx
cmp edx, 0xa973
setne bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x14]
setle dl
mov dword [ebp - 0x28], edx
xor edx, edx
cmp dword [ebp - 0x28], ecx
setle dl
xor ebx, ebx
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp - 0x30]
cmp ecx, 0xffffffff
mov ecx, dword [ebp - 8]
setne bl
xor edx, edx
cmp ebx, ecx
setge dl
mov dword [ebp - 0x38], edx
xor edx, edx
mov ecx, dword [ebp - 0x38]
cmp ecx, 0x6095
setg dl
sub edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
neg edx
sbb edx, edx
xor ebx, ebx
add edx, 2
cmp edx, ecx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x98]
setle bl
add ebx, dword [ecx]
mov ecx, dword [ebp - 0x98]
imul edx, ebx
mov dword [ecx], edx
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0xe8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x28], edi
cmp dword [ecx], eax
je 0x427a7a
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xe8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
mov ecx, dword [ebp - 0xe8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x38]
cmp ecx, edi
mov ecx, dword [ebp - 0x10]
setl bl
xor edx, edx
cmp ebx, ecx
setl dl
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffb
je 0x42799b
push 3
pop ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x98]
mov dword [ecx], edx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffeb
jle 0x42795d
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1c], 0xd
jmp 0x427b00
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x427afd
push 0x1bec
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffd
jge 0x427add
lea ecx, [ebp - 0x98]
call fcn.00427658
xor eax, eax
mov dword [ebp - 0x10], 0x96dd1e1e
mov dword [ebp - 0x10], eax
jmp 0x427b2c
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1fc], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x427b1f
mov dword [ebp - 0x10], eax
jmp 0x427b4b
cmp byte [ebp - 9], 0
je 0x427b48
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
mov byte [ebp - 9], al
jle 0x427b36
cmp byte [ebp - 9], 0
je 0x427b62
call esi
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ebx
lea ecx, [ebp - 0x8c]
call fcn.00427586
mov dword [ebp - 8], 0x2971c1ec
lea ecx, [ebp - 0x150]
push edi
call fcn.00427586
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x427b9b
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + edx*4], 0xa049
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x427b88
mov dword [ebp - 8], eax
jmp 0x427bb8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x150]
mov dword [ecx + edx*4], 0x8716b5b3
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x427ba5
mov dword [ebp - 8], eax
jmp 0x427bd3
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x240], 0xb56411d7
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x427bc2
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jg 0x427c86
mov dword [ebp - 0x38], 0x3e52509e
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x8c]
cmp dword [ecx + edx*4], eax
jne 0x427c80
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x8c]
cmp dword [ecx + edx*4], 0xfffffff6
jge 0x427c1d
mov edx, dword [ebp - 8]
mov esi, edi
mov ecx, dword [ebp - 0x8c]
cmp dword [ecx + edx*4], eax
jne 0x427c1f
mov esi, eax
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
cmp edx, ecx
mov ecx, dword [ebp - 0x150]
mov edx, 0x86f25db2
setle bl
mov dword [ecx], ebx
imul ecx, ebx, 0x8d5f
cmp edx, ecx
sbb ecx, ecx
neg ecx
add ecx, esi
neg ecx
je 0x427c57
mov ecx, edi
test ebx, ebx
jne 0x427c59
mov ecx, eax
cmp ecx, dword [ebp - 8]
jge 0x427c6b
mov ecx, dword [ebp - 0x8c]
cmp dword [ecx + 4], eax
mov ecx, eax
je 0x427c6d
mov ecx, edi
mov dword [ebp - 0x23c], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x427be5
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 8], 0xfffffff8
jmp 0x427cb0
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x427cad
push eax
push eax
push 0x1df4
push 0x16a4
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x17
jne 0x427c8f
lea ecx, [ebp - 0x150]
call fcn.00427658
lea ecx, [ebp - 0x8c]
call fcn.00427658
mov eax, dword [0x4b69fc]
lea ecx, [ebp - 0x180]
push edi
mov dword [ebp - 0x38], eax
call fcn.00427586
mov dword [ebp - 0x10], 0
jmp 0x427cfc
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], 0xb26bdde0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x427ce9
mov eax, dword [ebp - 0x180]
mov dword [eax], 0xfffffffe
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x427d1d
call dword [sym.imp.USER32.dll_ReleaseCapture]
lea ecx, [ebp - 0x180]
call fcn.00427658
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x30], 0x85ed0657
mov dword [ebp - 0x28], 0x1a652065
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x10], eax
jmp 0x427d5c
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x80], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x427d4e
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x427d7a
push 0x1e32
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x427dad
mov dword [ebp - 0x30], edi
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x80], 0x5a51
jle 0x427d98
mov esi, edi
cmp dword [ebp - 0x80], eax
jne 0x427d9a
mov esi, eax
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0x14]
mov esi, edi
setne dl
add ecx, edx
je 0x427daf
mov esi, eax
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov ebx, dword [ebp - 0x38]
cmp esi, ecx
sete dl
cmp byte [ebp - 0x39], 0
mov dword [ebp - 0x28], edx
je 0x428332
cmp ebx, edi
jne 0x428332
push dword [ebp + 8]
movdqa xmm0, xmmword [0xab2e80]
lea ecx, [ebp - 0x214]
push ecx
mov dword [ebp - 0x10], 0x6801
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x20], 0xef7d6512
push ecx
mov dword [ebp - 0x18], 0xde574131
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], edi
push eax
movdqu xmmword [ebp - 0x224], xmm0
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
call fcn.004276c9
push 2
mov dword [ebp - 0x24], 0x4a4e7fb1
lea ecx, [ebp - 0x138]
pop ebx
mov dword [ebp - 0x30], edi
or esi, 0xffffffff
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x34], 0xd0519924
push ebx
call fcn.00427586
push ebx
lea ecx, [ebp - 0x168]
call fcn.00427586
xor eax, eax
mov dword [ebp - 0x24], 0x40421a16
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
jmp 0x427e81
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x138]
mov dword [ecx + edx*4], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x427e6e
mov dword [ebp - 0x1c], eax
jmp 0x427e9e
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x168]
mov dword [ecx + edx*4], 0x54c62b41
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x427e8b
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x18]
cmp ecx, edi
mov ecx, dword [ebp - 8]
setle bl
xor edx, edx
cmp ebx, ecx
setl dl
xor ecx, ecx
cmp edx, 0x7d77fc7d
setle cl
xor edx, edx
cmp ecx, 0x5a4a
mov ecx, dword [ebp - 0x20]
setg dl
inc dword [ebp - 0x10]
cmp ecx, edx
mov edx, edi
cmovle edx, eax
xor ecx, ecx
cmp edx, esi
sete cl
cmp ecx, dword [ebp - 0x18]
je 0x427fa7
mov dword [ebp - 0x30], 0xa93f
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 0x24], 0x3649d959
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x24], 0x5cb296ad
mov dword [ebp - 0x24], 0xd3763964
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x1bc642ee
push edi
call fcn.00427586
mov dword [ebp - 0x20], 0x4f12
mov dword [ebp - 0x10], 0
jmp 0x427f8c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1b0]
and dword [eax + ecx*4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x427f7c
dec dword [ebp - 0x30]
lea ecx, [ebp - 0x1b0]
inc dword [ebp - 0x20]
call fcn.00427658
jmp 0x4280cb
mov dword [ebp - 0x18], 0xfb0c
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], 0x8257
mov dword [ebp - 0x1c], 0xa85e45cf
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x138]
inc esi
neg esi
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x30]
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0x28]
setl dl
xor ebx, ebx
add edx, 0x4791
cmp edx, ecx
setge bl
sub ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
neg ebx
sbb ebx, ebx
xor edx, edx
add ebx, 0xf13a
cmp ebx, ecx
mov ecx, dword [ebp - 0x18]
setne dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x2c]
setg bl
xor edx, edx
sub ebx, 7
cmp ebx, ecx
setge dl
cmp edx, dword [esi + 4]
jge 0x428027
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x20], eax
je 0x4280b1
mov ecx, dword [ebp - 0x20]
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
cmp edx, ecx
mov ecx, dword [ebp - 0xd8]
setge bl
xor edx, edx
cmp ebx, dword [ecx + 4]
mov ecx, dword [ebp - 0x18]
setge dl
mov dword [ebp - 0x34], edx
xor edx, edx
cmp dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x1c]
setl dl
xor ebx, ebx
sub edx, 0x76e958eb
cmp edx, ecx
setge bl
xor edx, edx
add ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp ebx, ecx
mov ecx, dword [ebp - 0x10]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x2c]
setne bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0x18]
setle dl
xor ebx, ebx
cmp edx, ecx
mov edx, edi
setge bl
sub ebx, 0x178d33f6
neg ebx
sbb ebx, ebx
inc ebx
add ebx, 0xffff
jne 0x4280b3
mov edx, eax
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax + 4]
xor eax, eax
mov dword [esi + 4], ecx
neg ecx
cmp ecx, edx
setle al
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x168]
call fcn.00427658
lea ecx, [ebp - 0x138]
call fcn.00427658
lea ecx, [ebp - 0xd8]
call fcn.00427658
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x14], 0x13b91020
mov dword [ebp - 0x20], 0x95e0e2bf
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], edi
mov dword [ebx + 8], 4
mov dword [ebp - 0x10], eax
jmp 0x42811b
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x70], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x428111
mov dword [ebp - 0x14], 0x1b
cmp dword [ebp - 0x14], 9
jl 0x428328
mov dword [ebp - 0x1c], edi
xor edx, edx
mov dword [ebp - 8], 0x74c38b6b
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
mov dword [ebp - 0x70], ecx
setne dl
xor ecx, ecx
cmp edx, 0x55059b8b
sete cl
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], eax
je 0x4281a7
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x1c]
add ecx, edx
cmp ecx, dword [ebp - 0x1c]
jge 0x428178
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp - 0x68]
cmp ecx, dword [ebp - 0x70]
jl 0x42818a
mov esi, eax
cmp dword [ebp - 0x70], eax
je 0x42818c
mov esi, edi
mov ecx, dword [ebp - 0x6c]
xor edx, edx
cmp esi, ecx
mov ecx, edi
setl dl
mov dword [ebp - 8], edx
cmp dword [ebp - 8], eax
jne 0x4281a2
mov ecx, eax
dec ecx
mov ecx, edi
jne 0x4281a9
mov ecx, eax
cmp ecx, dword [ebp - 0x14]
jne 0x4281e9
cmp dword [ebp - 0x70], eax
jne 0x428325
mov dword [ebp - 8], eax
jmp 0x4281de
mov dword [ebp - 0x1c], eax
jmp 0x4281d5
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4281d2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xb
jg 0x4281c1
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffc
je 0x4281bc
jmp 0x428315
mov dword [ebp - 0x30], 0xdb3533b0
lea ecx, [ebp - 0x108]
push 3
call fcn.00427586
mov dword [ebp - 0x10], 0
jmp 0x428219
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x428206
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x11
jge 0x42830a
mov esi, dword [ebp - 0x108]
mov dword [ebp - 0x18], 0x424acdff
lea ecx, [ebp - 0x1e4]
push 2
call fcn.00427586
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x428260
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1e4]
mov dword [ecx + edx*4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x428251
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x6c], eax
jne 0x42827f
cmp dword [ebp - 0x18], eax
jne 0x428276
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x108]
cmp dword [ecx], eax
setne dl
inc dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
xor ebx, ebx
cmp edx, dword [esi + 8]
setg bl
xor edx, edx
neg ebx
cmp ecx, ebx
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x18]
cmp edx, 0xffff
setne cl
mov dword [ebp - 0x70], ecx
cmp dword [ebp - 0x20], eax
je 0x4282cc
mov ecx, edi
cmp dword [ebp - 0x14], eax
jne 0x4282ce
mov ecx, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x4282f2
push 0x1bec
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
lea ecx, [ebp - 0x1e4]
call fcn.00427658
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x11
jl 0x428236
lea ecx, [ebp - 0x108]
call fcn.00427658
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 9
push 0
pop eax
jge 0x428132
mov ebx, dword [ebp + 8]
mov dword [ebx + 0xc], 0x4b69fc
mov ebx, dword [ebp - 0x38]
mov dword [ebp - 0x10], 0x69fdf99f
mov dword [ebp - 0x10], 0xffffffe4
jmp 0x428382
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x428362
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42837f
push 0x124d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffe
jg 0x428342
cmp dword [ebp - 0x64], ebx
jge 0x429472
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x15c]
call fcn.00427586
xor eax, eax
mov dword [ebp - 8], 0x1dbdae4
mov dword [ebp - 8], eax
jmp 0x4283bc
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x44], 0xfffffff9
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4283ae
mov dword [ebp - 8], eax
jmp 0x4283d9
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x15c]
mov dword [ecx + edx*4], 0xfffffffc
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4283c6
mov dword [ebp - 8], eax
jmp 0x4283f4
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x144], 0x66c4a87f
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4283e3
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp ecx, edi
mov ecx, dword [ebp - 0x44]
setl dl
sub edx, ecx
mov ecx, dword [ebp - 0x40]
add ecx, edx
mov edx, dword [ebp - 0x40]
add edx, ecx
jne 0x42841c
mov ecx, eax
cmp dword [ebp - 0x40], eax
je 0x42841e
mov ecx, edi
mov esi, dword [ebp - 0x15c]
xor ebx, ebx
mov edx, dword [ebp - 0x44]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x40]
cmp ecx, edx
setl bl
mov dword [ebp - 0x140], ebx
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
imul ecx, ecx, 0xf29c
cmp ecx, dword [ebp - 0x40]
jl 0x428452
mov ecx, edi
cmp dword [esi + 4], eax
jne 0x428454
mov ecx, eax
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xffff
push 0xfffffffffffffff9
sbb ecx, ecx
inc ecx
pop edx
sub edx, ecx
add edx, dword [ebp - 0x40]
je 0x428492
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], 0xfffffffa
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x428566
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor eax, eax
jmp 0x428566
mov dword [ebp - 0x34], eax
mov dword [ebp - 8], 0xfffffff7
jmp 0x4284e1
mov dword [ebp - 0x14], 0xefa0
cmp dword [ebp - 0x14], eax
jne 0x4284e7
mov dword [ebp - 0x14], eax
jmp 0x4284d9
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4284d6
push 0x1fb9
push 0x16b7
push 0x18b0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x4284af
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x15
jl 0x42849e
mov dword [ebp - 8], eax
jmp 0x428560
mov dword [ebp - 0x10], 0x708bee6d
cmp dword [ebp - 0x40], eax
jne 0x428566
mov dword [ebp - 0x10], eax
jmp 0x428557
push 2
mov dword [ebp - 0x1c], eax
pop edx
jmp 0x428516
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x1d8], 0x687e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x428505
mov dword [ebp - 0x1c], eax
jmp 0x428531
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x204], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x428520
mov edx, dword [ebp - 0x1d4]
xor ebx, ebx
mov ecx, dword [ebp - 0x34]
cmp ecx, edx
mov ecx, dword [ebp - 0x140]
setg bl
sub ecx, ebx
mov dword [ebp - 0x200], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffd
jl 0x4284fd
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffef
jle 0x4284ec
mov dword [ebp - 8], eax
jmp 0x428577
mov eax, dword [esi + 4]
mov dword [ebp - 0x144], eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe3
jle 0x42856b
lea ecx, [ebp - 0x15c]
call fcn.00427658
mov esi, 0x4b6a00
lea ecx, [ebp - 0xa4]
push 4
mov dword [ebp - 0x1c], esi
call fcn.00427586
mov dword [ebp - 0x18], 0x6fe7d8a8
xor eax, eax
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x24], 0x62bb2c59
mov dword [ebp - 0x34], 0xa445a8cc
mov dword [ebp - 0x20], edi
mov dword [ebp - 8], eax
jmp 0x4285d2
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xa4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x4285c3
push 3
mov dword [ebp - 8], eax
pop ebx
jmp 0x4285f1
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x274], 0x4e2b79dc
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4285e0
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x42877f
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x24], 0x2314af1
mov dword [ebp - 0x24], 0xc8a52b4b
mov dword [ebp - 0x24], 0xfffffffb
push 2
call fcn.00427586
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x428645
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x114]
mov dword [ecx + edx*4], 0x4d91f06e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x428632
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xa4]
cmp dword [ecx + edx*4], eax
jne 0x42876f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x428759
mov esi, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 8], 0x2ab60e70
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x4286a1
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xfc], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x42868b
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0xf0], eax
jmp 0x4286b9
mov dword [ebp - 0x2c], 0x77b568be
inc dword [ebp - 0x2c]
inc dword [ebp - 0xf0]
cmp dword [ebp - 0xf0], ebx
jle 0x4286a9
xor ebx, ebx
cmp dword [ecx + 4], 0xd860
mov ecx, dword [ebp - 0xf0]
sete bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setl dl
imul ecx, edx
xor edx, edx
cmp ecx, 0x2449
mov ecx, dword [ebp - 0xf0]
setge dl
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 0x20]
mov edx, edi
setg bl
imul ecx, dword [esi + 4]
inc dword [ebp - 0x20]
cmp ecx, ebx
mov ecx, 0xb9c2
cmovl edx, eax
sub ecx, edx
je 0x428719
mov esi, edi
cmp dword [ebp - 0x14], eax
jne 0x42871b
mov esi, eax
mov ecx, dword [ebp - 8]
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0x30]
setg dl
xor ebx, ebx
cmp edx, dword [ecx + 4]
mov ecx, dword [ebp - 0xa4]
setg bl
cmp dword [ecx], ebx
jl 0x42873d
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x34], 0xffffffff
inc dword [ebp - 0x14]
push 3
pop ebx
cmp dword [ebp - 0x14], ebx
jle 0x42867b
lea ecx, [ebp - 0x114]
call fcn.00427658
dec dword [ebp - 0x18]
jns 0x428602
jmp 0x42877a
lea ecx, [ebp - 0x114]
call fcn.00427658
mov esi, 0x4b6a00
lea ecx, [ebp - 0xa4]
call fcn.00427658
and dword [ebp - 0x28], 0
cmp dword [ebp - 0x64], 0
jle 0x428fdd
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x174]
call fcn.00427586
xor eax, eax
mov dword [ebp - 8], 0x1dbdae4
mov dword [ebp - 8], eax
jmp 0x4287c3
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x4c], 0xfffffff9
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4287b5
mov dword [ebp - 8], eax
jmp 0x4287e0
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x174]
mov dword [ecx + edx*4], 0xfffffffc
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4287cd
mov dword [ebp - 8], eax
jmp 0x4287fb
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x120], 0x66c4a87f
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4287ea
mov ecx, dword [ebp - 0x48]
xor edx, edx
cmp ecx, edi
mov ecx, dword [ebp - 0x4c]
setl dl
sub edx, ecx
mov ecx, dword [ebp - 0x48]
add ecx, edx
mov edx, dword [ebp - 0x48]
add edx, ecx
jne 0x428823
mov ecx, eax
cmp dword [ebp - 0x48], eax
je 0x428825
mov ecx, edi
mov esi, dword [ebp - 0x174]
xor ebx, ebx
mov edx, dword [ebp - 0x4c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x48]
cmp ecx, edx
setl bl
mov dword [ebp - 0x11c], ebx
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
imul ecx, ecx, 0xf29c
cmp ecx, dword [ebp - 0x48]
jl 0x428859
mov ecx, edi
cmp dword [esi + 4], eax
jne 0x42885b
mov ecx, eax
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xffff
push 0xfffffffffffffff9
sbb ecx, ecx
inc ecx
pop edx
sub edx, ecx
add edx, dword [ebp - 0x48]
je 0x428899
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], 0xfffffffa
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42896d
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor eax, eax
jmp 0x42896d
mov dword [ebp - 0x34], eax
mov dword [ebp - 8], 0xfffffff7
jmp 0x4288e8
mov dword [ebp - 0x14], 0xefa0
cmp dword [ebp - 0x14], eax
jne 0x4288ee
mov dword [ebp - 0x14], eax
jmp 0x4288e0
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4288dd
push 0x1fb9
push 0x16b7
push 0x18b0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x4288b6
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x15
jl 0x4288a5
mov dword [ebp - 8], eax
jmp 0x428967
mov dword [ebp - 0x10], 0x708bee6d
cmp dword [ebp - 0x48], eax
jne 0x42896d
mov dword [ebp - 0x10], eax
jmp 0x42895e
push 2
mov dword [ebp - 0x18], eax
pop edx
jmp 0x42891d
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x1ec], 0x687e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x42890c
mov dword [ebp - 0x18], eax
jmp 0x428938
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x1d0], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x428927
mov edx, dword [ebp - 0x1e8]
xor ebx, ebx
mov ecx, dword [ebp - 0x34]
cmp ecx, edx
mov ecx, dword [ebp - 0x11c]
setg bl
sub ecx, ebx
mov dword [ebp - 0x1cc], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffd
jl 0x428904
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffef
jle 0x4288f3
mov dword [ebp - 8], eax
jmp 0x42897e
mov eax, dword [esi + 4]
mov dword [ebp - 0x120], eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe3
jle 0x428972
lea ecx, [ebp - 0x174]
call fcn.00427658
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18c]
push 3
mov eax, dword [esi]
mov dword [ebp - 8], 0xfffffff7
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x24], eax
call fcn.00427586
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x4289c6
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x268], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x4289b9
mov dword [ebp - 0x18], eax
jmp 0x4289e4
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18c]
mov dword [ecx + edx*4], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x4289d1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x13
jg 0x428b2c
mov ecx, dword [ebp - 0x18c]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0x96840eb4
mov dword [ebp - 0x14], 0x7a7bc6c8
mov dword [ebp - 0x10], eax
jmp 0x428a24
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x258], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x428a13
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x428a48
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
xor eax, eax
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x14], eax
je 0x428a53
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 8]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setge dl
xor ebx, ebx
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x25c], ecx
mov edx, dword [ebp - 8]
imul edx, ecx
mov ecx, dword [ebp - 0x14]
cmp edx, 8
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x34]
setg dl
xor ebx, ebx
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x2c]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 0x30]
sete bl
sub ebx, 0xf1eb7e59
neg ebx
sbb ebx, ebx
inc ebx
sub ecx, ebx
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, edi
jbe 0x428ac2
mov esi, edi
cmp dword [ebp - 0x14], eax
jne 0x428ac4
mov esi, eax
mov ecx, dword [ebp - 8]
xor edx, edx
cmp ecx, esi
mov ecx, dword [ebp - 0x14]
mov esi, 0xffff4aec
setl dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setne bl
xor edx, edx
cmp ebx, ecx
setne dl
sub esi, edx
xor edx, edx
add esi, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp esi, ecx
setl dl
xor ecx, ecx
imul edx, dword [ebp - 8]
cmp edx, 0x9843
setg cl
xor edx, edx
imul ecx, ecx, 5
sub ecx, dword [ebp - 8]
cmp ecx, 0x23205e60
setge dl
mov dword [ebp - 0x254], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x13
jle 0x428a00
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18c]
call fcn.00427658
add esi, 4
lea ecx, [ebp - 0x1a4]
push edi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0xf0244c3f
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x50], eax
call fcn.00427586
xor eax, eax
mov dword [ebp - 0x2c], 0x8ee08a9c
mov dword [ebp - 0x10], eax
jmp 0x428b8b
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1a4]
mov dword [ecx + edx*4], 0x8eca74b8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x428b78
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x428ba8
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
setl bl
xor ecx, ecx
cmp ecx, ebx
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, dword [ebp - 0x18]
cmp ecx, edi
mov ecx, dword [ebp - 8]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setl bl
xor edx, edx
cmp ebx, ecx
setg dl
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
sub edx, ecx
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
imul edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
setl bl
xor edx, edx
cmp ecx, ebx
setne dl
cmp edx, dword [ebp - 8]
jge 0x428d41
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0xb0]
push 2
call fcn.00427586
mov dword [ebp - 0x34], 0x1f1b003b
xor eax, eax
mov dword [ebp - 0x34], 0xcc6c9db4
mov dword [ebp - 0x10], eax
jmp 0x428c52
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xb0]
mov dword [ecx + edx*4], 0x46221eb1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x428c3f
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
je 0x428c93
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
cmp ecx, edx
setge bl
test ebx, ebx
jns 0x428c85
cmp dword [ebp - 8], eax
jne 0x428c93
mov ecx, dword [ebp - 0xb0]
cmp dword [ecx + 4], eax
jne 0x428c93
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0xb0]
xor ecx, ecx
mov dword [ebp - 0x34], esi
cmp dword [esi + 4], eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
cmp dword [esi + 4], 8
mov ecx, dword [ebp - 8]
setg bl
xor edx, edx
sub ebx, dword [esi + 4]
mov esi, dword [esi + 4]
cmp ebx, ecx
setl dl
sub edx, 0xfffffff7
add edx, esi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, esi
setg cl
cmp ecx, esi
jge 0x428cea
mov ecx, dword [ebp - 0xb0]
mov edx, eax
cmp dword [ecx], eax
je 0x428cec
mov edx, edi
mov eax, dword [ebp - 0x1a4]
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 8]
cmp edx, eax
mov edx, dword [ebp - 0x34]
setg cl
xor eax, eax
cmp ecx, dword [edx + 4]
setl al
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 8], 0xcebfdcae
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
sub eax, 0x5bc9c74c
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xb0]
call fcn.00427658
mov esi, dword [ebp - 0x1c]
jmp 0x428d69
mov byte [ebp - 9], al
cmp byte [ebp - 9], cl
je 0x428d58
push eax
push 0x1c9
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x428d69
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [ebp - 0x1a4]
call fcn.00427658
push 4
pop ebx
add esi, ebx
lea ecx, [ebp - 0xbc]
push 3
mov dword [ebp - 0x1c], esi
call fcn.00427586
push 2
pop esi
push esi
lea ecx, [ebp - 0x12c]
call fcn.00427586
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x2c], edi
push ebx
call fcn.00427586
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x428dc8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xbc]
mov dword [ecx + edx*4], 0x648
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x428db5
mov dword [ebp - 8], eax
jmp 0x428de6
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x12c]
mov dword [ecx + edx*4], 0xe19d29be
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x428dd3
mov dword [ebp - 8], eax
jmp 0x428e03
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x198]
mov dword [ecx + edx*4], 0xa99da972
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x428df0
mov ebx, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x198]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 4], esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0xffff
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x30]
cmp ecx, 0xa272
mov edi, dword [ebx + 4]
mov esi, dword [ebp - 0xbc]
setne dl
add edx, dword [esi + edi*4]
mov esi, dword [ebp - 0x34]
imul edx, dword [esi + 8]
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebx + 4]
xor ebx, ebx
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ecx + edx*4]
cmp ecx, dword [esi + 4]
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
setge bl
xor edx, edx
cmp ecx, 0xf4ea
setne dl
add edx, 0x3b1d40a1
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp ebx, esi
setge cl
xor ebx, ebx
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
cmp ecx, edx
mov edx, dword [ebp - 0x14]
setge bl
xor edi, edi
xor ecx, ecx
inc edi
cmp ebx, edi
mov ebx, dword [ebp - 0x18]
setg cl
sub ecx, dword [ebp - 0x30]
mov dword [edx + 8], ecx
dec dword [ebx + 4]
jns 0x428e26
mov dword [ebp - 0x20], 3
lea ecx, [ebp - 0x198]
mov eax, dword [ebp - 0x20]
mov dword [ebx + 4], eax
call fcn.00427658
lea ecx, [ebp - 0x12c]
call fcn.00427658
lea ecx, [ebp - 0xbc]
call fcn.00427658
cmp dword [ebp - 0x50], 0
mov esi, dword [ebp - 0x1c]
jne 0x428f02
add esi, 8
mov dword [ebp - 0x2c], 0x778e10a3
xor eax, eax
mov dword [ebp - 0x2c], 0xf9aa2aa
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x10], eax
jmp 0x428f28
cmp dword [ebp - 0x10], 4
jl 0x428f1a
push 4
pop ebx
push ebx
lea ecx, [ebp - 0x1bc]
call fcn.00427586
mov dword [ebp - 0x24], 0x52061f66
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x24], 0
push ebx
call fcn.00427586
xor eax, eax
mov dword [ebp - 0x28], 0xffff
mov dword [ebp - 8], eax
jmp 0x429023
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1bc]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x429014
mov dword [ebp - 8], eax
jmp 0x42903e
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x248], 0xfffffffc
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x42902d
mov dword [ebp - 8], eax
jmp 0x42905c
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1f8]
mov dword [eax + ecx*4], 0x47941ce3
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x429049
dec dword [ebp - 0x28]
lea ecx, [ebp - 0x1f8]
call fcn.00427658
lea ecx, [ebp - 0x1bc]
call fcn.00427658
mov ebx, dword [esi]
xor eax, eax
mov dword [ebp - 0x1c], 0xe8cff0ea
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffeb
mov dword [ebp - 0x24], ebx
jne 0x4290ef
mov dword [ebp - 0x14], 6
xor ebx, ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
setne bl
xor ecx, ecx
cmp ebx, 0x27d373ee
setle cl
imul ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], edi
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffeb
je 0x42909f
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], 0x10
jmp 0x429121
mov dword [ebp - 0x14], eax
jmp 0x429118
cmp dword [ebp - 0x14], eax
jne 0x42911e
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x429115
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffb
jl 0x4290fd
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffef
jle 0x4290f8
mov dword [ebp - 0x14], 0xffffffff
add esi, 4
mov dword [ebp - 8], 0x28c7fffa
mov dword [ebp - 0x24], 0x6c4f32b7
mov dword [ebp - 0x14], 0xfffffff1
cmp dword [ebp - 0x14], 0x17
mov dword [ebp - 0x1c], esi
je 0x4292da
mov dword [ebp - 0x18], 0x6f9b2cfb
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe5
jl 0x429287
push dword [ebp + 8]
movdqa xmm0, xmmword [0xab2e70]
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x234]
mov dword [ebp - 0xe4], eax
push ecx
push eax
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe0], eax
movdqu xmmword [ebp - 0x234], xmm0
mov dword [ebp - 0xdc], eax
call fcn.004276c9
push dword [ebp + 8]
movdqa xmm0, xmmword [0xab2eb0]
lea ecx, [ebp - 0x204]
push ecx
xor eax, eax
mov dword [ebp - 0x20], 0x949f4ffc
lea ecx, [ebp - 0x214]
mov dword [ebp - 0xcc], eax
push ecx
push eax
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xc8], eax
movdqu xmmword [ebp - 0x214], xmm0
mov dword [ebp - 0xc4], eax
call fcn.004276c9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
neg esi
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0xe4]
sbb esi, esi
xor edx, edx
neg esi
cmp eax, ecx
setg dl
imul edx, dword [edi + 0xc]
mov dword [ebp - 0x28], edx
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp esi, eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xcc]
setge dl
imul ecx, dword [ebp - 0x28]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x20]
imul ecx, edx
add ecx, 0x920b
dec dword [edi + 0xc]
cmp ecx, eax
je 0x42925c
xor eax, eax
inc eax
jmp 0x42925e
xor eax, eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0xcc]
call fcn.00427658
lea ecx, [ebp - 0xe4]
call fcn.00427658
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe5
push 0
pop eax
jge 0x42916e
mov dword [ebp - 8], 0x17
jmp 0x4292c4
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4292c1
push 0x1c9c
push eax
push eax
push 0x313
push 0x1367
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor eax, eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0x16
jl 0x429290
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x17
jne 0x429153
mov esi, dword [ebp - 0x1c]
mov esi, dword [esi]
lea ecx, [ebp - 0x1c8]
push 3
mov dword [ebp - 0x20], 0x469ad59e
pop edi
mov dword [ebp - 0x24], 0x290be443
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xc3a0b8ee
push edi
call fcn.00427586
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x18], 0
jmp 0x429328
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x280], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x429317
mov dword [ebp - 0x18], 0
jmp 0x429349
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c8]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x429336
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], 0
jl 0x42937e
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x429379
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
dec dword [ebp - 0x20]
jns 0x42935b
dec dword [ebp - 0x28]
lea ecx, [ebp - 0x1c8]
call fcn.00427658
mov ecx, dword [ebp - 0x1c]
xor edi, edi
test esi, esi
jne 0x429476
inc edi
cmp byte [ebp - 0x39], 0
je 0x4293ae
cmp dword [ebp - 0x38], edi
jne 0x4293ae
mov edx, dword [ebp + 8]
lea eax, [ebx + 0x10]
add dword [edx + 8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 8]
add ecx, 0xc
push ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x1c], ecx
call fcn.0048414d
mov dword [ebp - 0x2c], eax
xor eax, eax
pop ecx
mov dword [ebp - 0xc0], eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0xc0]
push eax
push ebx
call fcn.00451d7f
xor ecx, ecx
mov esi, ecx
mov dword [ebp - 0x28], esi
test ebx, ebx
jle 0x42944c
mov eax, esi
and eax, 0x80000001
jns 0x429404
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x24]
add eax, esi
add eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x50]
cdq
idiv ebx
mov eax, dword [ebp - 0x7c]
cmp word [eax + edx*2], cx
je 0x429434
mov esi, eax
lea eax, [edx + 1]
cdq
idiv ebx
cmp word [esi + edx*2], cx
jne 0x429422
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x7c]
mov word [eax + edx*2], di
mov eax, dword [ebp - 0x1c]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x2c]
mov byte [esi + edx], al
inc esi
mov dword [ebp - 0x28], esi
cmp esi, ebx
jl 0x4293f6
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x7c]
mov dword [esi], ebx
test eax, eax
je 0x42947c
push eax
call fcn.00486ae6
pop ecx
xor ecx, ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
jmp 0x42947c
xor ecx, ecx
jmp 0x429479
xor ecx, ecx
inc edi
mov esi, dword [ebp + 8]
mov dword [ebp + 8], 0xffff
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp + 8], edi
cmp dword [ebp + 8], ecx
jne 0x42949d
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x42949d
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x14], ecx
je 0x4294ba
mov dword [ebp + 8], 0x13d0
dec dword [ebp + 8]
jmp 0x4294fc
mov dword [ebp + 8], edi
xor ebx, ebx
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x24], edi
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
cmp eax, edx
setge bl
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp + 8]
test eax, eax
je 0x4294e7
cmp dword [ebp - 0x14], ecx
jne 0x4294e9
mov edi, ecx
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edi
setne dl
imul ecx, edx, 0xff83
mov dword [ebp - 0x24], ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret