Function at 0x42e0ad
Capabilities:
Check os version
Create directory
Get disk information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e8
push ebx
push edi
mov dword [ebp - 0x30], ecx
xor ecx, ecx
push 1
mov dword [ebp - 8], 0x15252cb1
mov byte [ebp - 0x29], dl
mov dword [ebp - 0x18], ecx
pop edi
jmp 0x42e0dc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1dc], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x42e0cf
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 9], cl
cmp byte [ebp - 9], cl
je 0x42e107
push 0x7aa
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
xor ecx, ecx
push esi
push 2
pop esi
mov dword [ebp - 8], esi
cmp dword [ebp - 8], ecx
jl 0x42e13d
mov byte [ebp - 9], cl
cmp byte [ebp - 9], 0
je 0x42e124
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor ecx, ecx
mov byte [ebp - 9], cl
cmp byte [ebp - 9], 0
je 0x42e138
call ebx
push eax
call dword [sym.imp.USER32.dll_GetParent]
xor ecx, ecx
dec dword [ebp - 8]
jns 0x42e113
mov dword [ebp - 8], 0x5c8094a
lea ecx, [ebp - 0x184]
mov dword [ebp - 0x14], 0xfffffffe
xor ebx, ebx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0x921b0ae2
mov dword [ebp - 0x14], 0xc5b1510a
mov dword [ebp - 0x14], 0x3fc0233f
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x14], 0x2a19820b
mov dword [ebp - 0x14], 0xb874bdba
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x14], 0x5e1bfeda
mov dword [ebp - 0x14], 0xffffffff
push edi
call fcn.0042dd3a
mov dword [ebp - 0x1c], 0x4a78
mov dword [ebp - 4], ebx
jmp 0x42e1c2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x198], 0xf9b3
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x42e1b1
mov dword [ebp - 4], ebx
jmp 0x42e1df
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x184]
mov dword [eax + ecx*4], 0x87c4177f
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x42e1cc
mov dword [ebp - 8], ebx
jmp 0x42e2c5
mov dword [ebp - 4], 0xfffffffa
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x14], 0x3607a988
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 0x14], 0x5378470e
mov dword [ebp - 0x14], 0xeb8e136d
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 0xbbd4aa41
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 0x5a2f617a
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 0xfffffff6
push 3
call fcn.0042dd3a
push 3
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x42e261
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x16c]
mov dword [eax + ecx*4], 0x9b885b3d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x42e24e
mov dword [ebp - 4], ebx
jmp 0x42e2b2
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], ebx
jmp 0x42e284
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1e8], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x42e273
mov dword [ebp - 0x10], ebx
jmp 0x42e2a7
mov dword [ebp - 0x14], 6
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x198], ebx
jne 0x42e2ac
inc dword [ebp - 0x38]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x42e28e
inc dword [ebp - 0x1c]
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jle 0x42e26b
lea ecx, [ebp - 0x16c]
call fcn.0042de0c
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x42e1ec
lea ecx, [ebp - 0x184]
call fcn.0042de0c
push 3
lea ecx, [ebp - 0x140]
call fcn.0042dd3a
mov dword [ebp - 8], ebx
jmp 0x42e2fa
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x42e2eb
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x42e30f
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x42e329
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x702
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x140]
call fcn.0042de0c
mov dword [ebp - 8], ebx
jmp 0x42e346
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb8], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x42e339
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x42e35a
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov dword [ebp - 0xb0], ebx
jmp 0x42e3cb
push esi
lea ecx, [ebp - 0x190]
call fcn.0042dd3a
mov dword [ebp - 8], 0x942a1e94
mov dword [ebp - 8], ebx
jmp 0x42e389
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x190]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42e37a
mov dword [ebp - 8], edi
cmp dword [ebp - 8], ebx
jl 0x42e3ba
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x42e3b5
push ebx
push 0x1230
push ebx
push 0xeff
push 0x1164
call dword [sym.imp.GDI32.dll_ExtCreatePen]
dec dword [ebp - 8]
jns 0x42e396
lea ecx, [ebp - 0x190]
call fcn.0042de0c
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], 0x15
jg 0x42e362
mov eax, dword [0x4a25ec]
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0xe0fc36fe
push 3
mov dword [ebp - 0x38], eax
call fcn.0042dd3a
mov dword [ebp - 0x1c], 0xcefbde28
lea ecx, [ebp - 0x128]
push 4
call fcn.0042dd3a
mov dword [ebp - 0x20], 0xf16de6ea
mov dword [ebp - 4], ebx
jmp 0x42e429
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x42e41a
mov dword [ebp - 4], ebx
jmp 0x42e447
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 0xcd1b7e28
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x42e434
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setge dl
add edx, dword [ebp - 0x10]
jne 0x42e4aa
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov esi, dword [ebp - 0xc8]
setne dl
mov dword [ebp - 0x1c], edx
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0xc8]
setge dl
xor ebx, ebx
cmp edx, dword [esi + 4]
setle bl
xor ecx, ecx
cmp ebx, dword [eax]
setle cl
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [esi + 4]
mov eax, ebx
jge 0x42e4ac
mov eax, edi
mov esi, dword [ebp - 0xc8]
xor ecx, ecx
mov edx, dword [esi + 4]
imul edx, eax
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov eax, dword [ebp - 0x128]
sete cl
add ecx, 0xffffdeb3
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax + 0xc], ecx
imul eax, ecx, 9
xor ecx, ecx
add eax, 2
cmp eax, dword [esi + 4]
setle cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x128]
call fcn.0042de0c
lea ecx, [ebp - 0xc8]
call fcn.0042de0c
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0x9ed9ba07
mov dword [ebp - 0x20], 0x7cccaea0
mov dword [ebp - 8], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
jmp 0x42e52c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x48], 0xdb34e6d4
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x42e51e
cmp dword [ebp - 0x40], ebx
jne 0x42e550
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, 0x89ff
setne cl
cmp dword [ebp - 0x48], ecx
jle 0x42e550
xor esi, esi
mov ecx, ebx
inc esi
jmp 0x42e555
xor esi, esi
inc esi
mov ecx, esi
mov eax, dword [ebp - 0x40]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
setg cl
add edx, ecx
mov ecx, dword [ebp - 0x40]
neg edx
sbb edx, edx
neg edx
add eax, edx
imul ecx, eax
test ecx, ecx
je 0x42e586
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 4]
sub eax, 0xa1c2e56
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], ebx
jmp 0x42e5b3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x48], 6
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x42e5a5
cmp byte [ebp - 0x29], 0
mov ecx, dword [ebp - 0x38]
je 0x42e7e4
cmp ecx, esi
jne 0x42e7e4
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xec]
push esi
call fcn.0042dd3a
mov dword [ebp - 0x14], 0x5a258d3b
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], 0xd625c2a3
mov dword [ebp - 0x14], 0x87e17710
mov dword [ebp - 0x14], 0x2e6ba999
mov dword [ebp - 0x14], 0xe131a3a4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], 0x3a43
mov dword [ebp - 4], ebx
jmp 0x42e63a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xec]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x42e62a
mov dword [ebp - 4], ebx
jmp 0x42e655
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1d0], 0x992350c1
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x42e644
mov dword [ebp - 4], 0x1c
jmp 0x42e7bb
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x18], 0xe74e8003
mov dword [ebp - 8], 0x1cf04157
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 6
jge 0x42e7b8
mov eax, 0xe7975358
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], 0x7f5e1753
mov dword [ebp - 0x1c], 0x262b096
mov dword [ebp - 8], ebx
jmp 0x42e6cd
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1a8], 0xde2e510b
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x42e6bc
mov edx, dword [ebp - 0x10]
dec edx
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x98], edx
mov ecx, dword [ebp - 4]
neg ecx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, edx
setl al
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x42e700
mov eax, dword [ebp - 4]
mov dword [ebp - 8], esi
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], 0xfff9
cmp dword [ebp - 8], ebx
jne 0x42e727
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 4]
dec eax
neg eax
push 0
sbb eax, eax
xor edx, edx
neg eax
add ecx, eax
mov eax, dword [ebp - 4]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 4]
setne bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setg cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xec]
cmp ecx, dword [eax]
setge dl
mov dword [ebp - 0x1c], edx
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xec]
cmp ecx, dword [eax]
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 4]
setle dl
inc edx
neg edx
sbb edx, edx
inc edx
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x1a4], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jl 0x42e689
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffea
jl 0x42e667
inc dword [ebp - 0x28]
lea ecx, [ebp - 0xec]
call fcn.0042de0c
mov ecx, dword [ebp - 0x38]
mov dword [edi + 8], 4
mov dword [edi + 0xc], 0x4a25ec
mov dword [ebp - 0x20], 0x4ee7d214
mov dword [ebp - 8], ebx
jmp 0x42e7fa
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x3c], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42e7f0
mov dword [ebp - 0x3c], 0x14
jmp 0x42e818
mov dword [ebp - 0x20], 3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffe5
jl 0x42e808
mov esi, dword [ebp - 0x30]
cmp esi, ecx
jge 0x42f19b
mov dword [ebp - 0x14], 0x3a4a
lea ecx, [ebp - 0x104]
xor edi, edi
mov dword [ebp - 0x14], ebx
inc edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x14], 8
push edi
call fcn.0042dd3a
mov dword [ebp - 4], ebx
jmp 0x42e86b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x42e858
mov dword [ebp - 4], ebx
jmp 0x42e882
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1c0], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x42e875
mov eax, dword [ebp - 0x104]
lea ecx, [ebp - 0x104]
dec dword [eax]
call fcn.0042de0c
mov ebx, 0x4a25f0
test esi, esi
jle 0x42ecb5
mov dword [ebp - 0x18], 0x8a6b
lea ecx, [ebp - 0x11c]
push 2
call fcn.0042dd3a
mov dword [ebp - 0x10], 9
xor edx, edx
mov dword [ebp - 0x1c], 0x457d6700
mov dword [ebp - 0x1c], 0x86524f20
mov dword [ebp - 0x20], edx
mov dword [ebp - 8], edx
jmp 0x42e8ee
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], 0x1bf2b299
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x42e8db
mov eax, dword [ebp - 0x10]
mov esi, edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jne 0x42e903
mov esi, edx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x11c]
imul edx, esi
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, edx
setg cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x11c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
call fcn.0042de0c
mov eax, dword [ebx]
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x24], eax
inc esi
mov dword [ebp - 8], ecx
jmp 0x42e95f
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x4c], 0x94801897
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42e951
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x10], ecx
jmp 0x42e97a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4c], 0xfd4914d2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x42e96c
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 6
cmp dword [ebp - 0x28], ecx
je 0x42e9a1
mov dword [ebp - 0x20], 0xfff9
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
jmp 0x42e9b0
mov byte [ebp - 9], cl
cmp byte [ebp - 9], cl
je 0x42e9b0
push ecx
call dword [sym.imp.GDI32.dll_CreatePalette]
mov edi, dword [ebx + 4]
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x10], esi
push 2
call fcn.0042dd3a
mov dword [ebp - 0x1c], 0xfffffff9
xor edx, edx
mov dword [ebp - 0x28], 0xe10d32de
mov dword [ebp - 0x20], 0x4bc795c3
mov dword [ebp - 0x34], esi
mov dword [ebp - 4], edx
jmp 0x42e9f2
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xd4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x42e9e2
mov dword [ebp - 4], edx
jmp 0x42ea0b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x80], 0x806a
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x42e9fd
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffffb
jle 0x42ea4c
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov esi, dword [ebp - 0xd4]
setne dl
mov dword [esi + 4], edx
xor edx, edx
cmp dword [ebp - 0x7c], edx
jne 0x42ea49
cmp dword [esi + 4], edx
jne 0x42ea49
xor esi, esi
mov eax, edx
inc esi
jmp 0x42ea4e
xor esi, esi
inc esi
mov eax, esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x80]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
cmp dword [ebp - 0x10], ecx
jge 0x42ea6f
mov ecx, esi
cmp dword [ebp - 0x1c], edx
jne 0x42ea71
mov ecx, edx
xor eax, eax
cmp ecx, 0xfffffffb
setg al
xor ecx, ecx
cmp eax, 0x3e018ebd
setge cl
sub ecx, dword [ebp - 0x7c]
jne 0x42ea95
mov eax, dword [ebp - 0xd4]
mov ecx, edx
cmp dword [eax + 4], edx
je 0x42ea97
mov ecx, esi
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xd4]
call fcn.0042de0c
mov dword [ebp - 0x10], 0xdf99ff60
add ebx, 8
mov dword [ebp - 0x28], esi
xor edx, edx
mov dword [ebp - 0x1c], 0x63f6d1d8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], edx
jmp 0x42eaf0
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x8c], 0xfffffff7
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x42eadf
mov dword [ebp - 4], edx
jmp 0x42eb08
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x160], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x42eafb
mov dword [ebp - 0x10], 0x13
jmp 0x42ebe2
mov dword [ebp - 4], 0x485bf25c
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], edx
jmp 0x42ebd5
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x8c], edx
je 0x42ebcb
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x88], edx
jne 0x42eb50
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x84]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x8c]
test eax, eax
sets cl
test ecx, ecx
je 0x42eb75
mov eax, esi
cmp dword [ebp - 0x10], edx
jne 0x42eb77
mov eax, edx
xor edx, edx
cmp eax, 0xff68e1
sete dl
sub edx, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xffffffff
jb 0x42eb9f
cmp dword [ebp - 0x10], eax
je 0x42ebab
cmp dword [ebp - 4], eax
je 0x42ebab
mov edx, esi
cmp dword [ebp - 0x28], eax
jne 0x42ebad
mov edx, eax
mov dword [ebp - 0x160], edx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], 0x43d9c8c7
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jle 0x42eb2c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x15
jne 0x42eb1a
test edi, edi
jne 0x42ebf6
add ebx, 8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 5
lea ecx, [ebp - 0x178]
push esi
call fcn.0042dd3a
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x42ec23
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], 0x6f9b
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42ec10
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x14
jge 0x42ec9b
xor ebx, ebx
push 2
lea ecx, [ebp - 0xf8]
call fcn.0042dd3a
mov dword [ebp - 8], ebx
jmp 0x42ec58
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0xd5816210
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x42ec45
mov esi, dword [ebp - 0xf8]
mov dword [esi + 4], ebx
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x42ec7c
push 0x1695
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
inc dword [esi + 4]
cmp dword [esi + 4], ebx
jle 0x42ec67
lea ecx, [ebp - 0xf8]
call fcn.0042de0c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jl 0x42ec33
mov ebx, dword [ebp - 0x18]
lea ecx, [ebp - 0x178]
call fcn.0042de0c
add ebx, dword [ebp - 0x24]
dec dword [ebp - 0x30]
push 1
pop edi
jne 0x42e8a8
mov edi, dword [ebx]
xor eax, eax
mov dword [ebp - 0x14], 0xad6f2ee7
mov byte [ebp - 9], al
mov dword [ebp - 0x20], edi
cmp byte [ebp - 9], al
je 0x42ecd4
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42ecf4
push 0x119a
push 0x1702
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, 0xdd1e1e87
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 8], 0xffffffff
push 2
call fcn.0042dd3a
xor edx, edx
mov dword [ebp - 0x24], 0x6717b38e
mov dword [ebp - 4], edx
jmp 0x42ed3a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], 0x4b5e4957
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x42ed27
mov dword [ebp - 4], edx
jmp 0x42ed56
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x14c], 7
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x42ed45
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x6c], edx
jne 0x42ed89
mov esi, dword [ebp - 0x134]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub edx, dword [esi + 4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, dword [esi + 4]
jle 0x42ed89
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x144], 1
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x24], eax
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x42edc9
push edx
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
lea ecx, [ebp - 0x134]
call fcn.0042de0c
mov esi, dword [ebx + 4]
xor eax, eax
mov dword [ebp - 0x18], 0x86e5
mov dword [ebp - 0x10], 0x75d5f8d9
mov dword [ebp - 0x30], 0x752570e
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jmp 0x42ee0a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1b8], 0x6c715341
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x42edf9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
sub edx, 0xf746e33
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, 0xcc099a56
setg cl
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xb9db
setl cl
imul eax, ecx, 0x9d8f
xor ecx, ecx
cmp eax, 0x487223b1
mov eax, dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x18]
setne cl
imul ecx, eax
mov eax, dword [ebp - 0x30]
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42ee94
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
add ebx, 8
mov dword [ebp - 4], eax
push 1
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x18], ebx
call fcn.0042dd3a
mov dword [ebp - 0x24], 0x5a258d3b
xor eax, eax
mov dword [ebp - 0x24], 0xffffffff
inc eax
mov dword [ebp - 0x24], 6
xor edx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xd625c2a3
mov dword [ebp - 0x24], 0x87e17710
mov dword [ebp - 0x24], 0x2e6ba999
mov dword [ebp - 0x24], 0xe131a3a4
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x30], 0x3a43
mov dword [ebp - 4], edx
cmp dword [ebp - 4], eax
jge 0x42ef1a
xor edi, edi
inc edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xe0]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x42ef02
mov edi, dword [ebp - 0x20]
mov dword [ebp - 4], edx
jmp 0x42ef30
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1c8], 0x992350c1
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x42ef1f
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 4], 0xffffffea
jge 0x42f0b3
xor esi, esi
inc esi
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x1c], 0xe74e8003
mov dword [ebp - 8], 0x1cf04157
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 6
jge 0x42f09d
mov eax, 0xe7975358
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x28], 0x7f5e1753
mov dword [ebp - 0x28], 0x262b096
mov dword [ebp - 8], edx
jmp 0x42efb0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1a0], 0xde2e510b
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x42ef9f
mov edx, dword [ebp - 0x10]
dec edx
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0xa8], edx
mov ecx, dword [ebp - 4]
neg ecx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, edx
setl al
xor edi, edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jne 0x42efe5
mov eax, dword [ebp - 4]
mov dword [ebp - 8], esi
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], 0xfff9
cmp dword [ebp - 8], edi
jne 0x42f00c
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 4]
dec eax
neg eax
push 0
sbb eax, eax
xor edx, edx
neg eax
add ecx, eax
mov eax, dword [ebp - 4]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 4]
setne bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xe0]
cmp ecx, dword [eax]
setge dl
mov dword [ebp - 0x28], edx
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xe0]
cmp ecx, dword [eax]
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 4]
setle dl
inc edx
neg edx
sbb edx, edx
inc edx
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
pop edx
setge cl
mov dword [ebp - 0x19c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jl 0x42ef6c
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffea
jl 0x42ef4a
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
inc dword [ebp - 0x30]
lea ecx, [ebp - 0xe0]
call fcn.0042de0c
test esi, esi
jne 0x42f196
cmp byte [ebp - 0x29], 0
je 0x42f0de
cmp dword [ebp - 0x38], 1
jne 0x42f0de
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
add ebx, 8
push edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], ebx
call fcn.0047b994
mov ebx, eax
xor eax, eax
pop ecx
mov dword [ebp - 0xbc], eax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0xbc]
push eax
push edi
mov dword [ebp - 0x20], ebx
call fcn.0045e0be
mov esi, dword [ebp - 0x78]
xor ecx, ecx
test edi, edi
jle 0x42f174
mov eax, ecx
and eax, 0x80000001
jns 0x42f133
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x14]
add eax, ecx
add eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x24]
cdq
idiv edi
xor eax, eax
cmp word [esi + edx*2], ax
je 0x42f15f
xor ebx, ebx
lea eax, [edx + 1]
cdq
idiv edi
cmp word [esi + edx*2], bx
jne 0x42f150
mov ebx, dword [ebp - 0x20]
xor eax, eax
inc eax
mov word [esi + edx*2], ax
mov eax, dword [ebp - 0x18]
mov al, byte [edx + eax]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jl 0x42f125
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov edi, eax
mov dword [edi + 4], ebx
test esi, esi
je 0x42f199
push esi
call fcn.0047ce86
xor ebx, ebx
pop ecx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
jmp 0x42f19b
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x5c], 0xdd1e1e87
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x58], 0xdd1e1e87
mov dword [ebp - 0x54], 0xdd1e1e87
mov dword [ebp - 0x50], 0xdd1e1e87
mov dword [ebp - 8], 0xffffffff
push 2
call fcn.0042dd3a
mov dword [ebp + 8], 0x6717b38e
mov dword [ebp + 8], ebx
jmp 0x42f1ea
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0x4b5e4957
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x42f1d7
mov dword [ebp + 8], ebx
jmp 0x42f206
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x158], 7
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x42f1f5
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x5c], ebx
jne 0x42f237
mov esi, dword [ebp - 0x110]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub edx, dword [esi + 4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, dword [esi + 4]
jle 0x42f237
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 8]
xor eax, eax
inc eax
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x150]
mov dword [ebp + 8], eax
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
pop esi
je 0x42f277
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
lea ecx, [ebp - 0x110]
call fcn.0042de0c
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret