Function at 0x427f00
Capabilities:
Check os version
Get common file path
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
push ebx
push esi
mov byte [esp + 0x44], dl
xor eax, eax
push edi
mov dword [esp + 0x18], 0xb26bdde0
mov dl, cl
push 2
mov dword [esp + 0x24], 0xfffffffb
mov dword [esp + 0x18], eax
pop ebx
jmp 0x427f43
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x1a8], 6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x427f30
push 0xfffffffffffffffd
mov dword [esp + 0x1c], eax
pop esi
jmp 0x427f95
mov dword [esp + 0x20], 0xfb6318d5
mov dword [esp + 0x20], 0xfffffff1
jmp 0x427f8b
mov dword [esp + 0x14], esi
mov dword [esp + 0x14], eax
jmp 0x427f81
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x1a8], 0x4ccb63e8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x427f6e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jg 0x427f64
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffea
jge 0x427f52
xor edi, edi
inc edi
push edi
test dl, dl
je 0x42895c
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x160]
call fcn.0040194d
mov dword [esp + 0x24], 0x4df8e3bf
xor eax, eax
mov dword [esp + 0x34], 0x435
mov dword [esp + 0x14], eax
jmp 0x427fea
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x15c]
mov dword [ecx + edx*4], 0x3638
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x427fd4
push 7
mov dword [esp + 0x1c], 0x11
pop ebx
jmp 0x4280c0
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x28], 0xaf6082f4
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], eax
jl 0x428034
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x15c]
cmp dword [ecx + edx*4], eax
jne 0x428034
dec dword [esp + 0x10]
jns 0x42801e
cmp dword [esp + 0x10], 0xfffffffa
push 7
sbb esi, esi
neg esi
sub esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov ecx, dword [esp + 0x28]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0x1c]
setge bl
xor edx, edx
cmp ebx, ecx
pop ebx
setg dl
cmp edx, ebx
je 0x428076
mov ecx, eax
cmp dword [esp + 0x10], eax
je 0x428078
mov ecx, edi
cmp dword [esp + 0x10], ecx
jg 0x428082
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x34]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
cmp ecx, edi
setg dl
cmp edx, 2
jg 0x4280b6
mov ecx, eax
cmp dword [esp + 0x18], eax
je 0x4280b8
mov ecx, edi
mov dword [esp + 0x10], ecx
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 6
je 0x428000
lea ecx, [esp + 0x15c]
call fcn.00401a1f
xor eax, eax
mov dword [esp + 0x14], 0x91a049fe
push 3
mov dword [esp + 0x18], eax
pop esi
jmp 0x4280fd
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x22c], 0xf84b8114
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x4280ea
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x428116
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x428128
mov dword [esp + 0x28], ebx
dec dword [esp + 0x28]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff2
jge 0x42811c
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x174]
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0xfffffff8
push edi
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x18], 0xde574131
mov dword [esp + 0x14], eax
jmp 0x428176
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x174]
mov dword [ecx + edx*4], 0x858f9c25
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x428160
mov ecx, dword [esp + 0x24]
xor ebx, ebx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
mov ecx, dword [esp + 0x24]
setne bl
add ecx, 0xfffffff6
add ecx, ebx
sub ecx, dword [esp + 0x28]
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [esp + 0x10], ecx
jge 0x4281f0
mov dword [esp + 0x14], eax
jmp 0x4281c0
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x1b8], 9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x4281ad
cmp dword [esp + 0x1c4], eax
jne 0x4281d7
mov ecx, dword [esp + 0x1c4]
mov edx, dword [esp + 0x1c4]
mov ecx, dword [esp + 0x174]
imul edx, dword [ecx]
neg edx
mov dword [esp + 0x28], edx
jmp 0x428247
mov dword [esp + 0x2c], 7
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x42820a
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
cmp dword [esp + 0x24], eax
je 0x42823b
dec dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
add ecx, dword [esp + 0x18]
je 0x42823b
mov dword [esp + 0x10], 0xfffffff5
jmp 0x428232
cmp dword [esp + 0x18], eax
jne 0x428247
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x22
je 0x428228
jmp 0x428247
mov dword [esp + 0x2c], 0xb4af
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], eax
jmp 0x428292
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x428266
push 0x19cb
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x428288
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x428284
push 0xea
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], eax
jle 0x42826c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jle 0x42824d
lea ecx, [esp + 0x174]
call fcn.00401a1f
mov dword [esp + 0x14], 0x3c69aed2
lea ecx, [esp + 0x108]
push edi
call fcn.0040194d
mov dword [esp + 0x30], 0x1c77dcd
xor eax, eax
mov dword [esp + 0x30], 0x5b65ab4d
mov dword [esp + 0x30], 5
mov dword [esp + 0x10], eax
jmp 0x4282ef
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x108]
mov dword [ecx + edx*4], 0x1ff29acd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x4282d9
mov dword [esp + 0x10], eax
jmp 0x42830e
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xdc], 0xfffffff9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x4282fb
mov dword [esp + 0x10], eax
jmp 0x42832e
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xfc], 0xfff6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x42831b
mov ecx, dword [esp + 0x14]
mov edx, 0x23b1a956
sub edx, ecx
jne 0x428354
mov ecx, dword [esp + 0x14]
cmp edx, ecx
mov dword [esp + 0x28], eax
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x14]
jge 0x428358
mov dword [esp + 0x28], edi
mov ecx, dword [esp + 0x14]
xor edx, edx
cmp ecx, 7
mov ecx, dword [esp + 0x14]
setl dl
xor ebx, ebx
cmp edx, dword [esp + 0x28]
setl bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0x108]
setg dl
mov dword [ecx], edx
inc dword [esp + 0xfc]
cmp dword [esp + 0x100], eax
je 0x42839c
cmp dword [esp + 0xdc], eax
je 0x42839c
mov eax, edi
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [esp + 0x104]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xe0]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xdc]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setle dl
xor ecx, ecx
cmp eax, edi
setle cl
xor eax, eax
cmp ecx, edx
setle al
imul ecx, eax, 0x17ba
mov eax, dword [esp + 0x108]
mov dword [eax], ecx
lea ecx, [esp + 0x108]
call fcn.00401a1f
cmp byte [ebp + 0x10], 0
je 0x42850a
push esi
lea ecx, [esp + 0x1cc]
call fcn.0040194d
push 2
mov dword [esp + 0x18], 0
pop ebx
cmp dword [esp + 0x14], esi
jge 0x428437
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
jmp 0x42841d
mov byte [esp + 0x1f], 0
cmp byte [esp + 0x1f], 0
je 0x428451
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov byte [esp + 0x1f], 0
cmp byte [esp + 0x1f], 0
je 0x428465
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [esp + 0x1c8]
call fcn.00401a1f
mov dword [esp + 0x30], 0xb319
xor eax, eax
mov dword [esp + 0x30], 0x5c8094a
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x30], 0x36f6dd8d
mov dword [esp + 0x30], 0x693e93
mov dword [esp + 0x30], 0xfffffffb
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], 0x1b0ae28d
mov dword [esp + 0x10], eax
jmp 0x4284c8
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x224], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x4284b9
mov dword [esp + 0x10], eax
jmp 0x4284e7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x21c], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x4284d4
mov ecx, dword [ebp + 0x18]
dec dword [esp + 0x28]
mov eax, dword [ecx]
test eax, eax
jns 0x429abe
add eax, 0x100
js 0x4284fe
jmp 0x429abc
mov dword [esp + 0x10], 0xbeaa32b1
mov dword [esp + 0x18], 0x7102d149
push 2
mov dword [esp + 0x24], 0xfffffffa
mov dword [esp + 0x18], 0
pop ebx
jmp 0x428542
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x8c], 0x47d1afd0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x42852f
mov eax, dword [esp + 0x10]
mov ecx, 0xc865b49d
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub ecx, eax
mov dword [esp + 0x90], ecx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
add edx, ecx
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x90]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
setle dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [esp + 0x10]
je 0x428717
mov dword [esp + 0x24], 0x1826fbd1
mov byte [esp + 0x1f], 0
cmp byte [esp + 0x1f], 0
je 0x4285d4
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov dword [esp + 0x18], 0
jmp 0x428663
mov dword [esp + 0x14], 0xcf7d
mov dword [esp + 0x30], 6
dec dword [esp + 0x24]
mov dword [esp + 0x10], 0
jmp 0x428708
push esi
lea ecx, [esp + 0xbc]
call fcn.0040194d
mov dword [esp + 0x14], 0
jmp 0x42862f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xb8]
mov dword [eax + ecx*4], 0xd3cd3624
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x428619
mov ebx, dword [esp + 0xb8]
imul eax, dword [esp + 0x10], 0xfffc
mov ecx, dword [ebx + 8]
cmp eax, ecx
je 0x428672
test ecx, ecx
je 0x4286f8
lea ecx, [esp + 0xb8]
call fcn.00401a1f
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x4285e1
jmp 0x42873a
mov dword [esp + 0x2c], 0x72c2e8b5
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], 0
jl 0x4286f8
mov dword [esp + 0x28], 0x3c5ebb4e
mov dword [esp + 0x28], 0xfffffff6
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xb8]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
xor ecx, ecx
mov eax, dword [esp + 0x24]
cmp eax, dword [ebx + 8]
mov eax, dword [esp + 0x10]
setne cl
mov dword [esp + eax*4 + 0x8c], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [ebx + 8]
sub eax, 5
mov dword [esp + 0x20], eax
add ecx, ecx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
add eax, ecx
add edx, eax
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x28], edx
dec dword [esp + 0x14]
jns 0x428689
lea ecx, [esp + 0xb8]
call fcn.00401a1f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x428602
jmp 0x42865f
mov dword [esp + 0x20], 0
jmp 0x428734
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x8c], 0xa90cffae
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jl 0x428721
mov dword [esp + 0x20], 0xfd4914d2
lea ecx, [esp + 0x150]
push edi
call fcn.0040194d
push edi
lea ecx, [esp + 0x124]
call fcn.0040194d
push esi
lea ecx, [esp + 0x148]
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x428783
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x150]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x428771
mov dword [esp + 0x10], eax
jmp 0x4287a1
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x120]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x42878f
mov dword [esp + 0x10], eax
jmp 0x4287bf
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x144]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x4287ad
mov ecx, dword [esp + 0x20]
xor ebx, ebx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x150]
cmp dword [ecx], eax
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x20]
setne bl
xor edx, edx
cmp ebx, dword [eax]
mov eax, dword [esp + 0x144]
sete dl
sub ecx, edx
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [esp + 0x144]
mov eax, dword [esp + 0x120]
setge dl
mov dword [esp + 0x20], edx
mov eax, dword [eax]
mov dword [esp + 0x20], eax
call fcn.00401a1f
lea ecx, [esp + 0x120]
call fcn.00401a1f
lea ecx, [esp + 0x150]
call fcn.00401a1f
push dword [esp + 0x30]
movdqa xmm0, xmmword [0xa76f20]
lea ecx, [esp + 0x208]
push ecx
xor eax, eax
lea ecx, [esp + 0x1fc]
push ecx
push eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x90], eax
movdqu xmmword [esp + 0x204], xmm0
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
call fcn.00401a81
mov dword [esp + 0x20], edi
xor eax, eax
mov dword [esp + 0x30], 0x1e60
mov dword [esp + 0x20], esi
cmp dword [esp + 0x20], eax
jl 0x428942
mov dword [esp + 0x14], 0xc25fa5fe
mov dword [esp + 0x2c], 0xfffffff9
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x80]
mov edx, dword [ecx + edx*4]
sub edx, dword [ecx + esi*4]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x14], edx
jne 0x428919
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x14], 3
jae 0x4288ee
mov edx, edi
cmp dword [esp + 0x14], eax
jne 0x4288f0
mov edx, eax
mov ecx, dword [esp + 0x14]
sub edx, ecx
mov ecx, dword [esp + 0x80]
cmp edx, dword [ecx + 4]
jg 0x42890a
mov edx, edi
cmp dword [esp + 0x14], eax
jne 0x42890c
mov edx, eax
mov ecx, dword [esp + 0x80]
cmp edx, dword [ecx]
mov ecx, eax
jg 0x42891b
mov ecx, edi
mov dword [esp + 0x2c], ecx
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x428938
push 0x1f3e
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
xor eax, eax
dec dword [esp + 0x20]
jns 0x4288a7
lea ecx, [esp + 0x80]
call fcn.00401a1f
mov eax, dword [ebp + 8]
mov dword [eax], 0x21
jmp 0x429abe
lea ecx, [esp + 0xc8]
call fcn.0040194d
mov dword [esp + 0x24], edi
xor eax, eax
push 3
mov dword [esp + 0x38], 7
mov dword [esp + 0x14], eax
pop ebx
jmp 0x428991
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc4]
mov dword [ecx + edx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x42897f
mov dword [esp + 0x10], eax
jmp 0x4289b0
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x210], 0xfffffffc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x42899d
mov ecx, dword [esp + 0x24]
xor edx, edx
mov ecx, dword [esp + 0xc4]
cmp dword [ecx], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc4]
setl dl
sub eax, dword [ecx]
mov esi, dword [ecx]
sub eax, edx
imul edx, eax, 3
xor ecx, ecx
mov eax, dword [esp + 0x24]
cmp edx, eax
setle cl
xor eax, eax
add ecx, esi
cmp ecx, esi
setl al
add eax, esi
je 0x428ae1
push 2
lea ecx, [esp + 0x16c]
call fcn.0040194d
mov dword [esp + 0x28], 0xfffffff7
lea ecx, [esp + 0x12c]
push edi
call fcn.0040194d
mov dword [esp + 0x2c], 0xf6f6d779
mov dword [esp + 0x10], 0
jmp 0x428a3f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x428a2d
mov dword [esp + 0x10], 0
jmp 0x428a66
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x428a50
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x168]
push 0
sub ecx, dword [eax + 4]
mov eax, dword [esp + 0x130]
mov dword [eax], ecx
mov eax, dword [esp + 0xc8]
pop ecx
setne cl
mov edx, dword [eax]
imul ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 6
setg al
xor ecx, ecx
sub eax, edx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0x72b4
lea ecx, [esp + 0x12c]
setl al
mov dword [esp + 0x2c], eax
call fcn.00401a1f
lea ecx, [esp + 0x168]
call fcn.00401a1f
jmp 0x428af8
mov dword [esp + 0x24], 0x4b76fef6
dec dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x218], eax
lea ecx, [esp + 0xc4]
call fcn.00401a1f
or esi, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], esi
push 2
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], eax
pop edx
jmp 0x428b29
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x1b0], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x428b1a
mov dword [esp + 0x10], eax
jmp 0x428b45
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x58], 0x17216709
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x428b35
mov dword [esp + 0x10], eax
jmp 0x428b6a
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x428b66
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
xor eax, eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x428b51
mov dword [esp + 0x10], 0xfffffff8
cmp dword [esp + 0x10], 0xfffffff4
push 0xfffffffffffffff9
pop eax
jl 0x428e1c
jmp 0x428b8b
push 0xfffffffffffffff9
pop eax
mov dword [esp + 0x14], 0xe2fde2bb
lea ecx, [esp + 0x18c]
mov dword [esp + 0x50], 0x52e4a6b2
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], 0xa6f63eed
mov dword [esp + 0x30], 0x5f7a0d7c
push ebx
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x428bd7
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x204], 0xac29f8d9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x428bc4
mov dword [esp + 0x18], eax
jmp 0x428bf9
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18c]
mov dword [ecx + edx*4], 2
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x428be3
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0xfffffff9
jg 0x428e01
mov ebx, dword [esp + 0x18c]
mov dword [esp + 0x38], ebx
push edi
lea ecx, [esp + 0x118]
call fcn.0040194d
push dword [esp + 0x30]
movdqa xmm0, xmmword [0xa76f50]
lea ecx, [esp + 0x1f8]
push ecx
xor eax, eax
mov dword [esp + 0x20], 0x7fc0336a
lea ecx, [esp + 0x1ec]
mov dword [esp + 0x54], 0x38e5161e
push ecx
push eax
lea ecx, [esp + 0xb0]
mov dword [esp + 0xb0], eax
movdqu xmmword [esp + 0x1f4], xmm0
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
call fcn.00401a81
mov dword [esp + 0x44], 0x3f2a6add
xor eax, eax
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], eax
jmp 0x428ca9
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x114]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x428c97
mov ecx, dword [esp + 0x34]
xor ebx, ebx
mov ecx, dword [esp + 0x2c]
cmp ecx, 0x64e48c0c
mov ecx, dword [esp + 0x5c]
setge bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [esp + 0x5c]
setl dl
xor ebx, ebx
cmp edx, edi
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0x50]
setge dl
sub edx, ecx
cmp edx, 0x5199
je 0x428cf1
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
xor edx, edx
mov ecx, dword [esp + 0x44]
inc dword [esp + 0x44]
mov ecx, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x58]
cmp ecx, esi
mov ecx, dword [esp + 0x24]
setl dl
xor ebx, ebx
imul ecx, edx
cmp ecx, edi
setg bl
xor edx, edx
mov dword [esp + 0x58], ebx
mov ecx, dword [esp + 0x4c]
cmp ebx, ecx
setg dl
cmp edx, edi
sbb ecx, ecx
inc ecx
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x1b0]
mov ecx, dword [esp + 0x34]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x114]
mov edx, dword [ecx]
mov ecx, dword [esp + 0xa0]
add edx, 0xa2f6bde0
mov dword [ecx], edx
mov dword [esp + 0x2c], edx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x58]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x114]
sub edx, dword [ecx]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0x58], edx
mov ecx, dword [ecx]
add ecx, edx
je 0x428da7
mov ecx, edi
cmp dword [esp + 0x28], eax
jne 0x428da9
mov ecx, eax
mov ebx, dword [esp + 0x38]
xor edx, edx
mov dword [esp + 0x204], ecx
cmp ecx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
sete dl
sub edx, ecx
neg edx
sbb edx, edx
neg edx
cmp edx, esi
ja 0x428dd1
cmp dword [ebx + 4], eax
je 0x428dd3
mov eax, edi
mov dword [esp + 0x18], eax
lea ecx, [esp + 0xa0]
call fcn.00401a1f
lea ecx, [esp + 0x114]
call fcn.00401a1f
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff9
jle 0x428c19
push 3
pop ebx
lea ecx, [esp + 0x18c]
call fcn.00401a1f
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff4
jge 0x428b88
mov dword [esp + 0x10], 0x5ccc90a3
xor eax, eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x4c], 0x5f72
mov dword [esp + 0x14], eax
jmp 0x428e48
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x3c], 0x75dcec3d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x428e38
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], eax
jl 0x428f58
mov dword [esp + 0x2c], 9
xor ebx, ebx
mov dword [esp + 0x38], 0xfffffffa
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + ecx*4 + 0x3c]
cmp ecx, 0x5f321ee0
sete bl
sub ebx, dword [esp + 0x40]
mov ecx, dword [esp + 0x10]
neg ebx
sbb ebx, ebx
inc ebx
mov edx, dword [esp + ecx*4 + 0x3c]
mov ecx, dword [esp + 0x10]
imul edx, ebx
cmp edx, dword [esp + ecx*4 + 0x3c]
jne 0x428eb6
mov ecx, dword [esp + 0x10]
mov edx, eax
cmp dword [esp + ecx*4 + 0x3c], eax
je 0x428eb8
mov edx, edi
mov ecx, dword [esp + 0x10]
cmp edx, dword [esp + ecx*4 + 0x3c]
jge 0x428ec6
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + ecx*4 + 0x3c]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + ecx*4 + 0x3c]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + ecx*4 + 0x3c]
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x10], eax
je 0x428ef4
mov ecx, edi
cmp dword [esp + 0x3c], eax
jne 0x428ef6
mov ecx, eax
imul ecx, ecx, 0xd832
sub ecx, dword [esp + 0x10]
add ecx, 0x18eb
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x10]
cmp dword [esp + ecx*4 + 0x3c], eax
je 0x428f20
mov ecx, dword [esp + 0x10]
mov edx, edi
cmp dword [esp + ecx*4 + 0x3c], eax
jne 0x428f22
mov edx, eax
xor ecx, ecx
cmp edx, 0x6dfe1602
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
cmp edi, ecx
sbb ecx, ecx
neg ecx
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x2c], 0x9bb5c1ed
sbb ecx, ecx
inc ecx
mov dword [esp + 0x38], ecx
dec dword [esp + 0x10]
jns 0x428e5d
mov dword [esp + 0x10], 0xfffffff4
jmp 0x429036
mov dword [esp + 0x2c], 0x34219042
mov dword [esp + 0x38], 0xe9afb84c
mov dword [esp + 0x14], eax
jmp 0x428f8b
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x6c], 2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x428f7b
mov edx, dword [esp + 0x24]
xor ebx, ebx
mov ecx, dword [esp + 0x24]
sub edx, 0x75700ff
cmp edx, ecx
setl bl
xor ecx, ecx
cmp ebx, 5
setle cl
cmp ecx, dword [esp + 0x70]
jg 0x428fbd
mov ecx, eax
cmp dword [esp + 0x3c], eax
je 0x428fbf
mov ecx, edi
cmp dword [esp + 0x40], ecx
jne 0x428fcd
mov edx, eax
cmp dword [esp + 0x40], eax
je 0x428fcf
mov edx, edi
mov ecx, dword [esp + 0x10]
add edx, 0xfffffff7
xor ebx, ebx
cmp edx, ecx
setge bl
xor ecx, ecx
cmp ebx, 0x365d5a10
setg cl
mov dword [esp + 0x3c], ecx
mov edx, dword [esp + 0x70]
sub edx, ecx
mov ecx, dword [esp + 0x6c]
sub edx, ecx
cmp edx, dword [esp + 0x10]
jg 0x429006
mov edx, eax
cmp dword [esp + 0x70], eax
je 0x429008
mov edx, edi
mov ecx, dword [esp + 0x4c]
imul ecx, edx
sub ecx, dword [esp + 0x70]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x10]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x38], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jge 0x428f65
cmp byte [esp + 0x48], al
je 0x429506
mov dword [esp + 0x10], 0x68ec0ae9
mov dword [esp + 0x20], 0x1ebf0ddd
mov dword [esp + 0x2c], 0x87c5c6a8
mov dword [esp + 0x38], esi
mov dword [esp + 0x10], eax
jmp 0x429098
mov dword [esp + 0x14], esi
mov dword [esp + 0x14], eax
jmp 0x42908d
mov dword [esp + 0x38], 0xfffffffc
cmp dword [esp + 0x10], eax
jne 0x429094
mov ecx, dword [esp + 0x38]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe7
jne 0x429077
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xb
jl 0x42906d
cmp dword [esp + 0x10], eax
jne 0x4290d6
mov ecx, dword [esp + 0x10]
xor ebx, ebx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
sub edx, ecx
mov ecx, dword [esp + 0x20]
cmp edx, ecx
mov edx, eax
setge bl
add ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x20]
cmp ebx, dword [esp + 0x20]
jge 0x4290d8
mov edx, edi
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
mov ebx, 0xffff
push 2
setl cl
mov dword [esp + 0x14], ecx
xor ecx, ecx
imul eax, dword [esp + 0x14], 0x7b18
cmp eax, 0x5f19716e
setg cl
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x13c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x24], 0x24a8c6a5
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], 0x9f5fa318
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x24], 0x5ee56e31
mov dword [esp + 0x18], eax
mov dword [esp + 0x38], 0x3aa9c1c7
mov dword [esp + 0x14], eax
jmp 0x429162
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x138]
mov dword [ecx + edx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x429150
mov dword [esp + 0x20], eax
jmp 0x42918d
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x429189
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor eax, eax
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffe7
jl 0x42916f
cmp dword [esp + 0x20], eax
jne 0x4291ba
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
inc dword [esp + 0x18]
cmp dword [esp + 0x34], eax
jne 0x4291b4
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
cmp dword [esp + 0x28], eax
je 0x4291bc
mov eax, edi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x18], ebx
mov eax, dword [esp + 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setg dl
xor ecx, ecx
cmp edx, 0xfffffff9
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x34]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [esp + 0x38]
setg bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [esp + 0x138]
setle cl
cmp edi, ecx
sbb edx, edx
neg edx
sub edx, dword [eax + 4]
mov eax, dword [esp + 0x4c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
add ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x138]
call fcn.00401a1f
push dword [esp + 0x30]
movdqa xmm0, xmmword [0xa76f90]
lea ecx, [esp + 0x1e8]
push ecx
xor eax, eax
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x1dc]
mov dword [esp + 0x3c], edi
push ecx
mov dword [esp + 0x44], 0xebf9035
lea ecx, [esp + 0x80]
push eax
movdqu xmmword [esp + 0x1e4], xmm0
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
call fcn.00401a81
xor eax, eax
mov dword [esp + 0x30], 0xfffe
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0xffffffe6
jle 0x4294f2
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x44], 0x1b35d569
mov dword [esp + 0x2c], 0x2b058efa
mov dword [esp + 0x14], 0xef9953e8
mov dword [esp + 0x50], 0x7feae215
mov dword [esp + 0x28], 0xcaa5d732
mov dword [esp + 0x10], 0x87b8b0d5
mov dword [esp + 0x18], eax
jmp 0x4292f7
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0xd0], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x4292e8
mov dword [esp + 0x18], eax
jmp 0x429310
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x54], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x429304
inc dword [esp + 0x10]
je 0x429341
mov edx, dword [esp + 0x54]
xor ebx, ebx
mov ecx, dword [esp + 0xd8]
cmp ecx, edx
mov edx, dword [esp + 0x74]
setg bl
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x20]
cmp dword [edx + 4], ecx
mov edx, edi
jge 0x429343
mov edx, eax
mov ecx, dword [esp + 0x14]
sub edx, ecx
je 0x42934f
mov ecx, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], 0x36fe
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, ecx
mov ecx, dword [esp + 0x4c]
setl bl
imul ebx, dword [esp + 0x28]
sub ebx, dword [ecx + 8]
neg ebx
sbb ebx, ebx
inc ebx
cmp ebx, 0x2646899d
jl 0x429455
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], 0xfffffff1
jmp 0x4293fb
mov dword [esp + 0x2c], 0xde33
mov dword [esp + 0x50], 0x8693c25
cmp dword [esp + 0x24], eax
je 0x4293f1
cmp dword [esp + 0x18], eax
je 0x4293cb
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0xd8]
xor edx, edx
test ecx, ecx
mov ecx, dword [esp + 0x18]
setle dl
imul ecx, edx
sub ecx, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x14]
mov ecx, edi
jge 0x4293f3
mov ecx, eax
mov dword [esp + 0x50], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x33
jl 0x42939f
mov ecx, dword [esp + 0x54]
xor ebx, ebx
mov dword [esp + 0xd8], 0xdb2a
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
setne bl
cmp ebx, 0xdb2a
jne 0x429430
cmp dword [esp + 0x28], eax
jne 0x429430
mov edx, eax
mov ecx, dword [esp + 0x10]
sub edx, ecx
jne 0x429443
mov edx, eax
cmp dword [esp + 0xd4], eax
je 0x429445
mov edx, edi
mov ecx, dword [esp + 0x30]
sub edx, ecx
dec edx
mov dword [esp + 0x2c], edx
jmp 0x4294e3
mov dword [esp + 0x28], esi
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 9
jl 0x4294e3
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x50], 0xed7c6c5f
cmp dword [esp + 0xd4], eax
jne 0x429485
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x54]
cmp dword [esp + 0x2c], eax
je 0x42949f
mov ebx, edi
cmp dword [esp + 0x44], eax
jne 0x4294a1
mov ebx, eax
mov ecx, dword [esp + 0x50]
xor edx, edx
cmp ecx, ebx
mov ebx, dword [esp + 0x24]
setle dl
xor ecx, ecx
sub edx, dword [esp + 0x28]
cmp edx, dword [ebx + 4]
setg cl
xor edx, edx
cmp ecx, 0x60806af7
mov ecx, dword [esp + 0x54]
setne dl
sub edx, 0x5fca9972
mov dword [ebx + 4], edx
mov dword [esp + 0x34], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 9
jge 0x42946c
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffe6
jg 0x4292ae
lea ecx, [esp + 0x74]
call fcn.00401a1f
mov eax, dword [ebp + 0x14]
add dword [eax], 0xc
jmp 0x429abe
push 9
pop ebx
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x180]
push 2
call fcn.0040194d
mov dword [esp + 0x28], ebx
xor eax, eax
mov dword [esp + 0x2c], 0xf093d7f2
mov dword [esp + 0x14], eax
jmp 0x429545
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x180]
mov dword [ecx + edx*4], 6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x42952f
mov ecx, dword [esp + 0x18]
mov edx, 0x958a95cd
mov ebx, dword [esp + 0x180]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x34], ebx
sub edx, dword [ebx + 4]
add ecx, edx
mov dword [ebx + 4], ecx
mov dword [esp + 0x18], 0xffffffe8
jmp 0x429685
mov dword [esp + 0x20], esi
mov dword [esp + 0x44], 0xcdf1
push 3
pop ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x2c], 0xfffffff7
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4295c5
push 0xc1c
push eax
push eax
push eax
push eax
push 0x1679
push 0x9c5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
xor eax, eax
mov ecx, dword [esp + 0x18]
neg ecx
je 0x429679
inc dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], eax
je 0x42964a
cmp dword [esp + 0x2c], eax
jne 0x4295f6
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], eax
cmp dword [ecx + 4], eax
je 0x4295fa
mov dword [esp + 0x2c], edi
mov ecx, dword [esp + 0x28]
xor edx, edx
cmp dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x34]
setle dl
mov dword [ecx + 4], edx
cmp edx, dword [esp + 0x14]
je 0x429618
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x44]
mov ecx, dword [esp + 0x14]
sub ecx, ebx
mov ebx, edi
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
imul ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x42964c
mov ebx, eax
mov ecx, dword [esp + 0x20]
mov edx, 0xaf5bfb66
cmp edx, ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, ebx
mov ecx, dword [esp + 0x18]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, edi
setle bl
sub ebx, dword [esp + 0x18]
add ebx, dword [esp + 0x20]
jne 0x42967b
mov ecx, eax
neg ecx
mov dword [esp + 0x2c], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffef
jl 0x42957d
lea ecx, [esp + 0x180]
call fcn.00401a1f
push 2
pop ebx
mov dword [esp + 0x14], 0x9714a025
lea ecx, [esp + 0xac]
push ebx
call fcn.0040194d
mov dword [esp + 0x24], 0
lea ecx, [esp + 0xe4]
push ebx
call fcn.0040194d
mov dword [esp + 0x34], 0x211521fa
xor eax, eax
mov dword [esp + 0x20], 9
mov dword [esp + 0x28], 0xb862b336
mov dword [esp + 0x18], eax
jmp 0x4296ff
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xac]
mov dword [ecx + edx*4], 0xb5542afa
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x4296e9
mov dword [esp + 0x18], eax
jmp 0x429721
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xe4]
mov dword [ecx + edx*4], 0xf4442628
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x42970b
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0xac]
mov ecx, dword [ecx]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0xac]
mov ebx, dword [esp + 0xe4]
mov dword [esp + 0x38], ebx
mov ecx, dword [esi + 4]
lea edx, [ecx + 0xc4dd]
sub edx, ecx
neg edx
sbb edx, edx
inc edx
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov dword [esi + 4], edx
mov dword [ebx + 4], edx
je 0x429784
mov ecx, edi
cmp dword [esi + 4], eax
jne 0x429786
mov ecx, eax
cmp ecx, dword [esp + 0x34]
jle 0x4298a3
mov dword [esp + 0x14], 0xf509e13c
mov dword [esp + 0x10], eax
jmp 0x4297aa
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x64], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x42979e
mov dword [esp + 0x10], eax
jmp 0x4297c6
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x68], 0x832a49e8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x4297b6
mov dword [esp + 0x10], eax
jmp 0x4297e1
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x198], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x4297d2
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
sub ecx, 0x53c8
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x68], ecx
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x14], eax
je 0x429815
mov ecx, dword [esp + 0x68]
mov ecx, dword [esp + 0x198]
mov ecx, 0x7673ed13
mov dword [ebx + 4], ecx
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x198]
mov ecx, dword [esp + 0xe4]
mov ecx, dword [ecx]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
inc ecx
imul ecx, dword [esp + 0x24]
test ecx, ecx
je 0x42984e
mov ecx, dword [esp + 0x64]
xor ecx, ecx
cmp dword [esi + 4], 0xfff8
sete cl
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x14]
imul edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x1a0]
cmp edx, ecx
mov ecx, dword [esp + 0x198]
setg bl
imul ecx, ebx
mov dword [esp + 0x28], ecx
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x429a87
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x429a87
mov dword [esp + 0x24], 0x6993
lea ecx, [esp + 0x94]
push edi
call fcn.0040194d
mov dword [esp + 0x2c], 8
lea ecx, [esp + 0xf0]
push 4
call fcn.0040194d
mov dword [esp + 0x30], 0x9b3eeac6
xor eax, eax
mov dword [esp + 0x30], 0x4cddccf3
mov dword [esp + 0x10], eax
jmp 0x4298fc
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x94]
mov dword [ecx + edx*4], 5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x4298e6
mov dword [esp + 0x10], eax
jmp 0x429918
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x60], 0xfffffff9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x429908
mov dword [esp + 0x10], eax
jmp 0x42993a
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xf0]
mov dword [ecx + edx*4], 0x4c1ce2a3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x429924
mov ecx, dword [esp + 0x24]
xor ebx, ebx
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0xac]
push 0xfffffffffffffff9
mov edx, dword [ecx]
mov ecx, dword [esp + 0x98]
cmp edx, dword [ecx]
pop edx
setne bl
imul ecx, ebx, 0x5a44
cmp edx, ecx
mov ecx, dword [esp + 0x24]
sbb edx, edx
xor ebx, ebx
neg edx
cmp ecx, edx
setge bl
sub ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x94]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [esp + 0x30], ebx
xor ebx, ebx
mov edx, dword [esp + 0x30]
cmp edx, dword [ecx]
mov ecx, dword [esp + 0x28]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0x24]
setg dl
add ecx, 0x267fa09d
cmp ecx, edx
je 0x4299bc
cmp dword [esp + 0x28], eax
jne 0x4299be
mov edi, eax
mov ecx, dword [esp + 0x38]
xor ebx, ebx
mov dword [esp + 0x60], edi
cmp edi, dword [ecx + 4]
mov ecx, dword [esp + 0x94]
setle bl
mov edx, dword [ecx]
mov ecx, dword [esp + 0x20]
sub ebx, ecx
xor ecx, ecx
cmp ebx, edx
setne cl
xor ebx, ebx
cmp ecx, 0x2b4d3a61
setge bl
sub ebx, edx
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0xf0]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
mov dword [ecx], ebx
mov dword [esp + 0x30], ebx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x60]
mov ecx, dword [esp + 0x94]
cmp dword [ecx], eax
mov eax, dword [esp + 0xf0]
setl dl
xor ecx, ecx
cmp edx, dword [eax + 8]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0xac]
setg cl
sub ecx, 2
add edx, ecx
neg edx
mov eax, dword [eax]
sbb edx, edx
xor ecx, ecx
neg edx
imul eax, edx
cmp eax, dword [esi + 4]
setge cl
xor edx, edx
cmp ecx, 8
lea ecx, [esp + 0xf0]
setne dl
xor eax, eax
cmp edx, 0xc366
setne al
mov dword [esp + 0x30], eax
call fcn.00401a1f
lea ecx, [esp + 0x94]
call fcn.00401a1f
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0xe4]
mov dword [eax], ecx
lea ecx, [esp + 0xe4]
call fcn.00401a1f
lea ecx, [esp + 0xac]
call fcn.00401a1f
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
test eax, eax
jns 0x429abe
add eax, 0x100
js 0x429ab5
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret