Function at 0x429515
Capabilities:
Check os version
Get disk size
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0xa8eac8b
mov ebx, ecx
mov dword [ebp - 8], 0xffffffff
push 0
mov dword [ebp - 0x18], 0x451f1e28
mov byte [ebp - 0x2d], dl
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0x1d
pop eax
jmp 0x429563
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x429560
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffc
jg 0x42954a
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], 0x76e5b14f
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
push 1
pop ecx
mov esi, ecx
cmp dword [ebp - 8], eax
jne 0x429591
mov esi, eax
mov ecx, dword [ebp - 8]
xor edx, edx
cmp esi, ecx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
setge dl
mov dword [ebp - 8], edx
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
sub esi, 0x57736d0c
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setge dl
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
mov byte [ebp - 9], al
je 0x429604
cmp byte [ebp - 9], 0
je 0x4295eb
push eax
push 0x262
push 0x337
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
xor eax, eax
mov dword [ebp - 0x18], 5
jmp 0x4295fc
cmp dword [ebp - 8], eax
jne 0x429638
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xb
jge 0x4295f4
jmp 0x429638
cmp byte [ebp - 9], 0
je 0x429627
push eax
push 0x10f9
push 0x2134
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x429638
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov dword [ebp - 0x10], 0x462d5e48
mov dword [ebp - 0x10], 0x11
jmp 0x42965f
mov dword [ebp - 0x2c], 0x558bac04
mov dword [ebp - 0x14], 0x5b4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x429648
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x429678
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x2c], 0x3423637b
inc edx
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x34], 0xc5f93be4
mov dword [ebp - 0x10], eax
jmp 0x4296a9
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x9c], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x429698
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff2
push 2
pop esi
jge 0x42987a
mov ecx, 0x3c69aed2
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], eax
jl 0x429747
mov dword [ebp - 0x14], 0x1a9565e0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x429724
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42970d
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetMenu]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42971f
push eax
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x4296f8
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42973f
push eax
push eax
push 0x18e5
call edi
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
dec dword [ebp - 0x84]
jns 0x4296e9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffed
jle 0x429862
xor edi, edi
inc edi
push esi
lea ecx, [ebp - 0x124]
call fcn.004291a2
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x429778
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x58], 0xfffc
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42976a
mov dword [ebp - 8], eax
jmp 0x429795
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x124]
mov dword [ecx + edx*4], 4
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x429782
mov edx, dword [ebp - 0x58]
xor ebx, ebx
mov ecx, dword [ebp - 0x54]
cmp ecx, edx
mov ecx, dword [ebp - 0x58]
setg bl
xor edx, edx
cmp ecx, 0xb09b
setne dl
xor ecx, ecx
cmp edx, ebx
setg cl
cmp edi, ecx
mov ecx, dword [ebp - 0x18]
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
setle bl
sub ebx, dword [ebp - 0x18]
sub ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
cmp ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
setl bl
xor edx, edx
cmp ebx, ecx
setge dl
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx + 4]
cmp dword [ebp - 0x54], ecx
jl 0x429803
test ecx, ecx
mov ecx, edi
jne 0x429805
mov ecx, eax
mov edx, dword [ebp - 0x54]
xor ebx, ebx
imul edx, ecx
mov ecx, dword [ebp - 0x54]
mov esi, dword [ebp - 0x54]
cmp edx, ecx
setle bl
xor edx, edx
sub esi, ebx
mov dword [ebp - 0x84], esi
mov ecx, dword [ebp - 0x9c]
cmp esi, ecx
setne dl
mov dword [ebp - 0x2c], edx
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42983f
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
lea ecx, [ebp - 0x124]
call fcn.00429274
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffed
push 2
pop esi
jg 0x429757
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
dec dword [ebp - 0x18]
mov ecx, 0x3c69aed2
cmp dword [ebp - 0x18], 0xfffffff2
push 1
pop edx
jl 0x4296c3
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0x6c3f
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x2c], 0xfffffffa
push esi
call fcn.004291a2
xor esi, esi
mov dword [ebp - 0x34], 0x9fe9a5a1
push 2
mov dword [ebp - 8], esi
pop edx
jmp 0x4298b8
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 0xa0cd
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x4298a5
mov dword [ebp - 8], esi
jmp 0x4298cf
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1b4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x4298c2
mov eax, dword [ebp - 0x10]
mov ecx, 0xffff
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
add eax, 0x4ce3
add eax, ecx
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, edx
jl 0x429917
test edx, edx
je 0x429917
xor esi, esi
inc esi
mov dword [ebp - 0x1b4], esi
lea ecx, [ebp - 0x118]
call fcn.00429274
mov ecx, dword [0x4b29fc]
xor edx, edx
mov dword [ebp - 0x28], 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], 0x12e75507
inc edx
mov dword [ebp - 0x28], 0x13
cmp dword [ebp - 0x28], 0xffffffe5
mov dword [ebp - 0x2c], ecx
jg 0x4299c4
mov dword [ebp - 8], 0xfffffffb
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], 0x8b42
mov dword [ebp - 8], eax
jmp 0x4299b2
mov dword [ebp - 0x14], 0x64939e63
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 8]
jl 0x429988
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], 0x10dd
mov ecx, dword [ebp - 0x14]
sub ecx, 0x7319
cmp ecx, dword [ebp - 8]
je 0x4299aa
mov ecx, edx
cmp dword [ebp - 0x14], eax
jne 0x4299ac
mov ecx, eax
mov dword [ebp - 0x14], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 6
jg 0x429967
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe5
jle 0x429951
mov ecx, dword [ebp - 0x2c]
cmp byte [ebp - 0x2d], 0
mov edi, dword [ebp + 8]
push 3
pop esi
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
je 0x429ab6
cmp ecx, edx
jne 0x429ab6
push esi
lea ecx, [ebp - 0x160]
call fcn.004291a2
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 8], eax
jmp 0x429a14
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + edx*4], 0xfdf99ff6
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x429a01
push 4
mov dword [ebp - 8], eax
pop edx
jmp 0x429a2e
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xc0], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x429a21
push 2
pop ecx
mov dword [ebp - 0xb4], ecx
cmp dword [ebp - 0xb4], eax
jl 0x429a9d
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x429a5d
push 0xc73
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 2
xor eax, eax
pop ecx
cmp dword [ebp - 0xc0], eax
je 0x429a89
cmp dword [ebp - 0xb4], eax
je 0x429a89
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x429a95
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x1c]
dec dword [ebp - 0x14]
jns 0x429a7c
jmp 0x429a95
mov dword [ebp - 0x14], 0xb2006887
cmp dword [ebp - 0x14], eax
jne 0x429a9d
dec dword [ebp - 0xb4]
jns 0x429a44
lea ecx, [ebp - 0x160]
call fcn.00429274
mov dword [edi + 8], 4
mov dword [edi + 0xc], 0x4b29fc
push esi
lea ecx, [ebp - 0xf0]
call fcn.004291a2
mov dword [ebp - 0x14], 0x1603
lea ecx, [ebp - 0x10c]
push esi
call fcn.004291a2
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x429aef
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xf0]
mov dword [ecx + edx*4], 0x540d7f82
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x429adc
xor edx, edx
mov dword [ebp - 8], eax
inc edx
jmp 0x429b0a
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x50], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x429afc
mov dword [ebp - 8], eax
jmp 0x429b27
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10c]
mov dword [ecx + edx*4], 0xfffffff7
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x429b14
mov esi, dword [ebp - 0xf0]
xor ecx, ecx
mov dword [esi + 4], eax
cmp dword [esi + 8], eax
setle cl
sub ecx, 0x2dd8607f
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0x50]
cmp dword [esi + 4], eax
je 0x429b56
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0xf0]
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setle cl
lea eax, [edx - 0x259c]
add eax, ecx
add dword [esi + 4], eax
cmp dword [esi + 4], 4
mov eax, dword [ebp - 0x10c]
sbb ecx, ecx
inc ecx
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x10c]
call fcn.00429274
lea ecx, [ebp - 0xf0]
call fcn.00429274
cmp ebx, dword [ebp - 0x2c]
jge 0x42a751
xor eax, eax
xor esi, esi
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x1c], esi
je 0x429bbb
mov dword [ebp - 0x10], 0xffffffff
jmp 0x429bd5
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
je 0x429bc6
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x9000d4e7
lea ecx, [ebp - 0x98]
mov dword [ebp - 8], 0x62751c76
mov edi, 0x4b2a00
mov dword [ebp - 0x14], 0x777bab6e
push 3
mov dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x28], esi
pop esi
push esi
call fcn.004291a2
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x429c22
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x98]
mov dword [ecx + edx*4], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x429c0f
cmp dword [ebp - 0x18], eax
jne 0x429c45
mov ecx, dword [ebp - 0x18]
xor edx, edx
test ecx, ecx
setle dl
sub edx, dword [ebp - 0x18]
cmp edx, 0x82a10aa4
jbe 0x429c45
mov edx, eax
jmp 0x429c48
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0x18]
cmp ecx, edx
jle 0x429d75
mov dword [ebp - 0x14], 0x51ad5b48
xor edx, edx
mov dword [ebp - 0x10], 0xa33ed863
inc edx
mov dword [ebp - 0x10], eax
jmp 0x429c81
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x38], 0x51a9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x429c73
mov ecx, dword [ebp - 0x38]
sub edx, ecx
je 0x429c90
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
neg ecx
mov ecx, dword [ebp - 8]
push 0
pop edx
setns dl
sub edx, ecx
xor ecx, ecx
cmp edx, 0xb913
push 2
setl cl
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
pop edx
cmp edx, ecx
push 3
sbb ecx, ecx
neg ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp - 0x1c]
dec esi
neg esi
sbb esi, esi
xor edx, edx
neg esi
imul esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
cmp esi, ecx
pop esi
setl dl
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
sub ecx, 0x738f5e69
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], esi
mov ecx, dword [ebp - 0x98]
sbb edx, edx
inc edx
mov dword [ecx + 8], edx
xor ecx, ecx
cmp edx, 0x500c330e
mov edx, dword [ebp - 0x14]
sete cl
sub edx, ecx
mov ecx, 0xec334572
neg edx
sbb edx, edx
inc edx
cmp ecx, edx
sbb ecx, ecx
neg ecx
neg ecx
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x96db
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x10]
cmp edx, 0xfffffffe
setg cl
cmp ecx, dword [ebp - 0x38]
je 0x429d6d
mov ecx, dword [ebp - 0x98]
cmp dword [ecx + 4], eax
je 0x429d70
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
jmp 0x429db5
push 2
mov dword [ebp - 8], eax
pop edx
cmp dword [ebp - 8], edx
jg 0x429da1
push edx
pop eax
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0x98]
mov ecx, dword [edx + ecx*4]
mov dword [edx + esi*4], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jle 0x429d82
push 3
xor eax, eax
pop esi
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x429db5
push 0x1cf9
call dword [sym.imp.USER32.dll_GetSysColorBrush]
lea ecx, [ebp - 0x98]
call fcn.00429274
test ebx, ebx
jle 0x42a0ae
mov ecx, 0x90f1d898
mov eax, dword [edi]
xor esi, esi
mov dword [ebp - 0x14], 0x88ad
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x34], 0xfffffff8
inc esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], eax
jmp 0x429e1a
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x4c], 0x446cd5fe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x429e0c
mov ecx, dword [ebp - 0x100]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
sub edx, ecx
add edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
mov ecx, dword [ebp - 0xfc]
setge bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x4c]
setl dl
inc dword [ebp - 0x4c]
mov ebx, dword [edi + 4]
cmp ecx, edx
mov ecx, esi
cmovge ecx, eax
xor edx, edx
cmp ecx, 0x58185f18
setg dl
xor ecx, ecx
cmp edx, esi
setg cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], 7
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x429e89
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x429e9c
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
mov dword [ebp - 0x14], 0xffffffff
add edi, 8
mov dword [ebp - 0x1c], 0x50678e0
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x14], 0xb7e280bf
push 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
pop edx
jmp 0x429ed4
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x48], 0xfff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x429ec6
cmp dword [ebp - 0x48], eax
jne 0x429eff
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov esi, eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
cmp esi, 8
sete dl
sub ecx, edx
cmp ecx, dword [ebp - 0x48]
je 0x429efc
mov edx, eax
jmp 0x429f01
xor esi, esi
inc esi
mov edx, esi
xor ecx, ecx
cmp edx, 0x4ba0
setne cl
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x429f2e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
xor eax, eax
test ebx, ebx
jne 0x429f35
add edi, 8
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaaf650]
mov ecx, 0x9ff60657
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
lea ecx, [ebp - 0x188]
push ecx
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x18], eax
push ecx
push eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], eax
movdqu xmmword [ebp - 0x198], xmm0
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
call fcn.004292e5
mov dword [ebp - 0x14], 0xbdb88dcf
xor esi, esi
mov dword [ebp - 0x1c], 0x53403e1f
push 3
mov dword [ebp - 8], 0xb0c7f2ba
pop ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], esi
jl 0x42a092
mov dword [ebp - 0x28], 6
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x20], 0x6887e08
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0xffffffff
push ebx
call fcn.004291a2
mov dword [ebp - 0x10], esi
jmp 0x429fed
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x429fde
mov eax, dword [ebp - 0xac]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 0x7c]
cmp dword [eax], 0x68ab8ac2
mov eax, dword [ebp - 0xd8]
setg dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x18]
setl cl
cmp ecx, 0xfff9
mov ecx, dword [ebp + eax*4 - 0xb0]
sbb edx, edx
mov eax, dword [ebp - 0x7c]
neg edx
imul ecx, edx
xor edx, edx
mov dword [eax], ecx
lea eax, [ecx + 3]
cmp eax, 0xb077cb11
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xd8]
setg cl
mov dword [eax], ecx
lea ecx, [ebp - 0xd8]
call fcn.00429274
dec dword [ebp - 0x18]
jns 0x429fae
lea ecx, [ebp - 0x7c]
call fcn.00429274
add edi, dword [ebp - 0x3c]
mov ecx, 0x90f1d898
dec dword [ebp - 0x24]
jne 0x429dcd
push 3
pop esi
push 2
pop eax
push eax
lea ecx, [ebp - 0x70]
call fcn.004291a2
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x1c], 5
push 2
mov dword [ebp - 8], eax
pop ecx
cmp dword [ebp - 8], ecx
jge 0x42a0f1
push ecx
pop eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x70]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jl 0x42a0dd
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x42a107
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x178], 0xfffffffd
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42a0f6
mov dword [ebp - 8], eax
jmp 0x42a122
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1c0], 0x962da72d
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42a111
mov ecx, dword [ebp - 0x70]
mov edx, dword [ecx]
test edx, edx
jg 0x42a137
cmp dword [ecx + 4], eax
mov ecx, eax
je 0x42a139
mov ecx, ebx
cmp edx, ecx
jle 0x42a1b1
mov dword [ebp - 0x14], 0x8018d9dc
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], eax
jmp 0x42a15d
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x16c], 0x8591b68d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x42a14c
mov ecx, dword [ebp - 0x70]
mov esi, dword [ecx]
sub esi, dword [ecx + 4]
mov ecx, dword [ebp - 0x14]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setge dl
xor ebx, ebx
mov dword [ebp - 0x24], edx
imul edx, dword [ebp - 0x24], 0xfffd
mov ecx, dword [ebp - 0x14]
cmp ecx, edx
setg bl
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x16c]
neg esi
sbb esi, esi
xor edx, edx
neg esi
mov dword [ebp - 0x16c], esi
mov ecx, dword [ebp - 0x18]
cmp esi, ecx
setg dl
jmp 0x42a220
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x24], 0xf3734bd4
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x70]
imul edx, dword [ecx]
test edx, edx
jne 0x42a1cb
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xdf2f
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x70]
setge dl
sub esi, edx
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, dword [ecx + 4]
mov ecx, dword [ebp - 0x10]
setl dl
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 0x28]
setne bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0x10]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
setg bl
xor edx, edx
cmp ebx, ecx
setge dl
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], eax
jmp 0x42a259
mov dword [ebp - 0x24], 0xbb5c02ac
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42a241
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x178]
inc dword [ebp - 0x1c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x2b
jg 0x42a228
lea ecx, [ebp - 0x70]
call fcn.00429274
mov eax, dword [edi]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0x68206240
push 3
mov dword [ebp - 0x20], 0x68cb667f
mov dword [ebp - 0x10], eax
pop ebx
jmp 0x42a295
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1a4], 0xd979
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x42a284
mov dword [ebp - 0x18], eax
jmp 0x42a2ec
mov dword [ebp - 0x24], 4
xor edx, edx
mov dword [ebp - 0x14], 0x42b9
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xffffffff
setl dl
add edx, 4
cmp dword [ebp - 0x18], edx
jl 0x42a2d9
cmp dword [ebp - 0x14], eax
je 0x42a2d9
xor edx, edx
inc edx
jmp 0x42a2db
mov edx, eax
xor ecx, ecx
cmp edx, 0xfe
sete cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffb
jle 0x42a29f
mov dword [ebp - 0x20], eax
jmp 0x42a304
mov ecx, dword [ebp - 0x20]
mov dword [ebp + ecx*4 - 0x1a4], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x42a2f7
push 2
pop eax
push eax
lea ecx, [ebp - 0x13c]
call fcn.004291a2
xor esi, esi
push 2
mov dword [ebp - 0x10], esi
pop edx
jmp 0x42a335
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x13c]
mov dword [eax + ecx*4], 0xdf99ff60
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x42a322
mov eax, dword [ebp - 0x13c]
lea ecx, [ebp - 0x13c]
mov dword [eax + 4], 0x15
call fcn.00429274
mov eax, dword [edi + 4]
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x20], 0xcb143e95
mov dword [ebp - 0x18], 0xbbbdebf8
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x10], 0x5b5c
push ebx
mov dword [ebp - 0x34], eax
call fcn.004291a2
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x42a39a
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xe4]
mov dword [ecx + edx*4], 0xb1f356d9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x42a387
inc dword [ebp - 0x20]
jne 0x42a3da
mov dword [ebp - 0x18], 0xf998
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [ebp - 0x20]
jne 0x42a3c8
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x20], eax
jne 0x42a3da
xor esi, esi
mov ecx, eax
inc esi
jmp 0x42a3df
xor esi, esi
inc esi
mov ecx, esi
cmp ecx, dword [ebp - 0x1c]
jne 0x42a3e7
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
cmp ecx, esi
mov ecx, dword [ebp - 0x1c]
setge bl
xor edx, edx
cmp ebx, ecx
setge dl
add edx, dword [ebp - 0x1c]
cmp edx, 0xfff9
je 0x42a526
mov dword [ebp - 8], 7
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x14], 0xfffd
mov dword [ebp - 0x3c], 0xfffffff7
push 3
call fcn.004291a2
mov dword [ebp - 0x24], esi
xor eax, eax
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x24], 0xf82eddaa
mov dword [ebp - 0x3c], 0xde902ba9
mov dword [ebp - 0x18], eax
jmp 0x42a45a
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x154]
mov dword [ecx + edx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x42a44b
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov esi, dword [ebp - 0xe4]
cmp ecx, 0xc84
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
setne dl
mov ecx, dword [ebp - 8]
mov dword [esi + 8], edx
xor edx, edx
cmp dword [esi + 8], ecx
setg dl
xor ebx, ebx
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 1
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, dword [esi + 8]
dec edx
add ecx, edx
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setl bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x154]
setne dl
mov dword [ecx + 4], edx
test edx, edx
je 0x42a4e7
mov ecx, dword [ebp - 0xe4]
cmp dword [ecx + 4], eax
je 0x42a4e7
xor esi, esi
inc esi
jmp 0x42a4e9
mov esi, eax
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp esi, ecx
setl dl
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], eax
je 0x42a4fe
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x154]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
call fcn.00429274
jmp 0x42a556
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42a556
push 0x8f2
push 0x266e
push 0x1a33
push 0x1beb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
lea ecx, [ebp - 0xe4]
call fcn.00429274
mov dword [ebp - 0x14], 0xe77d
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x1c], 0x5b263d18
xor esi, esi
mov dword [ebp - 0x24], 0x43eef7d2
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x24], 0xffffffff
push 3
call fcn.004291a2
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x42a5a7
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xcc], 0xf3d4210e
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x42a596
mov dword [ebp - 8], eax
jmp 0x42a5c3
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x148], 0xfffc
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x42a5b2
mov dword [ebp - 8], eax
jmp 0x42a5e1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x130]
mov dword [ecx + edx*4], 0xcc90
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x42a5ce
cmp dword [ebp - 0x14], eax
je 0x42a5fe
mov ecx, dword [ebp - 0x14]
add ecx, 0x4870
je 0x42a5fe
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x42a603
xor ebx, ebx
mov edx, eax
inc ebx
xor ecx, ecx
cmp edx, 0xca4f
setg cl
xor edx, edx
mov dword [ebp - 0xcc], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0x5773
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xcc]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
imul eax, edx
test eax, eax
mov eax, dword [ebp - 0x130]
sets cl
mov dword [eax], ecx
lea ecx, [ebp - 0x130]
call fcn.00429274
cmp dword [ebp - 0x34], esi
jne 0x42a74e
cmp byte [ebp - 0x2d], 0
je 0x42a69d
cmp dword [ebp - 0x2c], ebx
mov ebx, dword [ebp - 0x28]
jne 0x42a6a0
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x10]
add dword [ecx + 8], eax
jmp 0x42a6a0
mov ebx, dword [ebp - 0x28]
mov eax, dword [edi + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [edi + 0xc]
push ebx
mov dword [ebp - 0x40], eax
call fcn.0047fd9a
mov dword [ebp - 0x2c], eax
xor eax, eax
pop ecx
mov dword [ebp - 0xa0], eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0xa0]
push eax
push ebx
call fcn.004503f3
xor ecx, ecx
test ebx, ebx
mov ebx, dword [ebp - 0x64]
jle 0x42a728
mov eax, esi
and eax, 0x80000001
jns 0x42a6ee
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x34]
add eax, esi
add eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x40]
jmp 0x42a703
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x28]
cmp word [ebx + edx*2], cx
jne 0x42a700
xor eax, eax
inc eax
mov word [ebx + edx*2], ax
mov al, byte [edx + edi + 0x10]
mov edx, dword [ebp - 0x2c]
mov byte [esi + edx], al
inc esi
mov eax, dword [ebp - 0x28]
cmp esi, eax
jl 0x42a6e0
jmp 0x42a72b
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp - 0x2c]
mov dword [edi + 4], eax
test ebx, ebx
je 0x42a753
push ebx
call fcn.00482736
pop ecx
xor ecx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
jmp 0x42a753
mov edi, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp + 8], 0xfffffffc
xor eax, eax
push 2
inc eax
mov dword [ebp + 8], eax
pop edx
mov dword [ebp + 8], edx
mov dword [ebp + 8], 0x1accbad8
mov dword [ebp + 8], 0xcb4c23af
mov dword [ebp + 8], 0x5425a80e
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x17c], ecx
mov dword [ebp + 8], 0x223f
mov dword [ebp + 8], 0x72ba29f5
mov dword [ebp - 0x2c], 0xffff
mov dword [ebp + 8], ecx
jmp 0x42a7ba
mov ecx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x1cc], eax
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x42a7ad
mov dword [ebp + 8], eax
mov eax, edi
dec dword [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret