Function at 0x425074
Capabilities:
Create process on windows
Get file system object information
Get graphical window text
Get session user name
Modify service
Parse pe header
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa34
push esi
and dword [ebp - 0x30], 0
push 1
lea ecx, [ebp - 0x900]
call fcn.00432a80
mov dword [ebp - 0x954], 0xe56f9b2c
mov dword [ebp - 0x818], 0xd5816210
mov dword [ebp - 0x820], 0xfffffff8
mov dword [ebp - 0x828], 0xffffffff
mov dword [ebp - 0x830], 1
mov dword [ebp - 0x950], 1
mov dword [ebp - 0x94c], 1
mov dword [ebp - 0x948], 1
mov dword [ebp - 0x944], 1
mov dword [ebp - 0x838], 0xcdead9ba
mov dword [ebp - 0x850], 0x4e94f934
mov dword [ebp - 0x858], 1
mov dword [ebp - 0x860], 5
mov dword [ebp - 0x868], 0xe2949f4f
mov dword [ebp - 0x870], 0x3e93d0b5
mov dword [ebp - 0x878], 0
mov dword [ebp - 0x880], 0xffffffff
mov dword [ebp - 0x888], 5
mov dword [ebp - 0x890], 0x5f43260
mov dword [ebp - 0x898], 0xffaa2324
mov dword [ebp - 0x2c8], 0xffffffff
mov dword [ebp - 0x4c], 0
jmp 0x425171
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x42518d
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x900]
call fcn.00432b6e
mov dword [eax], 0xdde0
jmp 0x42516a
mov dword [ebp - 0x4c], 0
jmp 0x42519d
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x4251b3
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x8a0], 6
jmp 0x425196
mov eax, dword [ebp - 0x2c8]
dec eax
mov dword [ebp - 0x2c8], eax
lea ecx, [ebp - 0x900]
call fcn.00432b52
mov dword [ebp - 0xc], 0xf5cd
mov dword [ebp - 0x50], 0x229a275f
mov dword [ebp - 0x5b4], 0xc509ca4f
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x260], 0x2fd89d68
mov dword [ebp - 0x11c], 0
jmp 0x425210
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jge 0x42522c
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x5e4], 1
jmp 0x425203
mov eax, dword [ebp - 0xc]
neg eax
cmp eax, 0xbc6e5c7a
jne 0x425244
mov dword [ebp - 0x248], 1
jmp 0x42524b
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x8a8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x8b0], eax
cmp dword [ebp - 0xc], 0xfffffffb
jne 0x42526f
mov dword [ebp - 0x594], 1
jmp 0x425276
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
sub eax, dword [ebp - 0xc]
cmp eax, 1
jge 0x425290
mov dword [ebp - 0x59c], 1
jmp 0x425297
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x50], eax
jl 0x4252b4
mov dword [ebp - 0x60c], 1
jmp 0x4252bb
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x8c0], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x50], eax
je 0x4252e1
mov dword [ebp - 0x5a4], 1
jmp 0x4252e8
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x5a4]
neg eax
cmp eax, dword [ebp - 0xc]
jl 0x425305
push 5
pop eax
test eax, eax
jne 0x425305
and dword [ebp - 0x5ac], 0
jmp 0x42530f
mov dword [ebp - 0x5ac], 1
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x5b4], eax
mov eax, dword [ebp - 0x5b4]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x5e4]
cmp eax, dword [ebp - 0xc]
jne 0x42533f
mov dword [ebp - 0x5bc], 1
jmp 0x425346
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x5bc]
jg 0x42535d
mov dword [ebp - 0x5c8], 1
jmp 0x425364
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c4]
add eax, dword [ebp - 0x5c8]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x5e4]
jg 0x425384
or eax, 0xffffffff
jne 0x425396
mov eax, 0xc2af
test eax, eax
jne 0x425396
and dword [ebp - 0x5d0], 0
jmp 0x4253a0
mov dword [ebp - 0x5d0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5e4]
cmp dword [ebp - 0x5d0], eax
jle 0x4253c1
mov dword [ebp - 0x4f0], 1
jmp 0x4253c8
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x5c4]
add eax, dword [ebp - 0x4f0]
jne 0x4253e5
cmp dword [ebp - 0xc], 0
jne 0x4253e5
and dword [ebp - 0x4f8], 0
jmp 0x4253ef
mov dword [ebp - 0x4f8], 1
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x248]
cmp eax, dword [ebp - 0x4f8]
jg 0x42540c
mov dword [ebp - 0x250], 1
jmp 0x425413
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0xc], 0xffffffe7
jmp 0x42542f
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jl 0x4255d1
mov dword [ebp - 0x508], 0x8cbf698b
mov dword [ebp - 0x50], 9
jmp 0x425453
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jne 0x4255cc
mov dword [ebp - 0x1bc], 0x7835
mov dword [ebp - 0x500], 0
mov dword [ebp - 0x7c8], 0x646d9140
mov dword [ebp - 0x7c4], 0x646d9140
mov dword [ebp - 0x7c0], 0x646d9140
mov dword [ebp - 0x7bc], 0x646d9140
lea ecx, [ebp - 0x1a1]
call fcn.00432b7d
push eax
lea eax, [ebp - 0x7b8]
push eax
lea eax, [ebp - 0x7c8]
push eax
lea ecx, [ebp - 0x9c4]
call fcn.00432b80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x910]
call fcn.00432b2c
mov dword [ebp - 0x624], 0xfffffffe
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0
jne 0x4254f9
mov dword [ebp - 0x614], 1
jmp 0x425500
and dword [ebp - 0x614], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5e4], 0
jne 0x425517
cmp dword [ebp - 0x1bc], 0
mov eax, 0xdd6b9ec4
cmp eax, 0x138d7e
je 0x42552f
mov dword [ebp - 0x258], 1
jmp 0x425536
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x258]
add eax, 0xae54
je 0x425558
cmp dword [ebp - 0x508], 0
je 0x425558
mov dword [ebp - 0x61c], 1
jmp 0x42555f
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x8d8], eax
mov esi, dword [ebp - 0x1bc]
sub esi, 0x5411f810
push 3
lea ecx, [ebp - 0x910]
call fcn.00432b6e
cmp esi, dword [eax]
jne 0x4255a9
mov dword [ebp - 0x510], 1
jmp 0x4255b0
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x624], eax
lea ecx, [ebp - 0x910]
call fcn.00432b52
jmp 0x42544c
jmp 0x425428
mov dword [ebp - 0x8e0], 0xfffffff8
mov dword [ebp - 0x8e8], 0x7d8a8701
mov dword [ebp - 0x8f0], 0x5ba77230
mov dword [ebp - 0x980], 0x9da4d073
mov dword [ebp - 0x988], 0xc0272a72
mov dword [ebp - 0x990], 0xa66e58d0
mov dword [ebp - 0x998], 0xb60e704f
mov dword [ebp - 0x964], 8
mov dword [ebp - 0x960], 8
mov dword [ebp - 0x95c], 8
mov dword [ebp - 0x958], 8
mov dword [ebp - 0x268], 0x9c213245
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1ec]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x425ac4
or dword [ebp - 0x7a0], 0xffffffff
or dword [ebp - 0x79c], 0xffffffff
or dword [ebp - 0x798], 0xffffffff
or dword [ebp - 0x794], 0xffffffff
lea ecx, [ebp - 0x1a9]
call fcn.00432b7d
push eax
lea eax, [ebp - 0x790]
push eax
lea eax, [ebp - 0x7a0]
push eax
lea ecx, [ebp - 0xa14]
call fcn.00432b80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x6a0]
call fcn.00432b2c
mov dword [ebp - 0x530], 3
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x154], 0
jmp 0x4256fb
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jge 0x425714
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x24], 0xffffffff
jmp 0x4256ee
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x24], 0
jmp 0x425739
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x24], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 3
jg 0x4258ec
mov dword [ebp - 0x62c], 5
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x24]
lea ecx, [ebp - 0x6a0]
call fcn.00432b6e
cmp dword [eax], 0
je 0x4258d4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0
jne 0x42578c
xor eax, eax
jne 0x42578c
and dword [ebp - 0x518], 0
jmp 0x425796
mov dword [ebp - 0x518], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp dword [ebp - 0x518], eax
je 0x4257b4
mov dword [ebp - 0x270], 1
jmp 0x4257bb
and dword [ebp - 0x270], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp dword [ebp - 0x270], eax
jl 0x4257d9
mov dword [ebp - 0x520], 1
jmp 0x4257e0
and dword [ebp - 0x520], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x24]
lea ecx, [ebp - 0x6a0]
call fcn.00432b6e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x520]
jne 0x42580b
mov dword [ebp - 0x278], 1
jmp 0x425812
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0x2a7b09f5
jg 0x425836
mov dword [ebp - 0x280], 1
jmp 0x42583d
and dword [ebp - 0x280], 0
cmp dword [ebp - 0x280], 0x64e6
je 0x425855
mov dword [ebp - 0x538], 1
jmp 0x42585c
and dword [ebp - 0x538], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x24]
lea ecx, [ebp - 0x6a0]
call fcn.00432b6e
mov eax, dword [eax]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x288]
cmp eax, dword [ebp - 0x538]
jle 0x42589f
mov dword [ebp - 0x290], 1
jmp 0x4258a6
and dword [ebp - 0x290], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x24]
lea ecx, [ebp - 0x6a0]
call fcn.00432b6e
mov ecx, dword [ebp - 0x290]
imul ecx, dword [eax]
test ecx, ecx
je 0x4258d4
mov dword [ebp - 0x540], 1
jmp 0x4258db
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x62c], eax
jmp 0x425724
lea ecx, [ebp - 0x6a0]
call fcn.00432b52
push 3
lea ecx, [ebp - 0x71c]
call fcn.00432a80
mov dword [ebp - 0x158], 1
mov dword [ebp - 0x640], 0xfdb7b241
mov dword [ebp - 0x124], 0
jmp 0x425931
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 3
jge 0x425953
push dword [ebp - 0x124]
lea ecx, [ebp - 0x71c]
call fcn.00432b6e
mov dword [eax], 0x33a4a9bd
jmp 0x425924
mov dword [ebp - 0x158], 0
jmp 0x42596c
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jg 0x425a95
mov dword [ebp - 0x58], 2
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x4259a5
push 0
push 0xd4b
push 0
push 0x2074
push 0x2251
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov dword [ebp - 0x58], 0
jmp 0x4259b5
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jg 0x425a90
mov dword [ebp - 0x1c4], 0
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x4259e8
push 0x3cb
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x58]
jle 0x425a02
mov dword [ebp - 0x298], 1
jmp 0x425a09
and dword [ebp - 0x298], 0
push 2
lea ecx, [ebp - 0x71c]
call fcn.00432b6e
mov ecx, dword [ebp - 0x58]
cmp dword [eax], ecx
jle 0x425a29
mov dword [ebp - 0x1e4], 1
jmp 0x425a30
and dword [ebp - 0x1e4], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0x71c]
call fcn.00432b6e
mov ecx, dword [ebp - 0x1e4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x1e4]
lea eax, [ecx + eax - 1]
mov ecx, 0xffff
sub ecx, eax
cmp dword [ebp - 0x298], ecx
jge 0x425a71
mov dword [ebp - 0x548], 1
jmp 0x425a78
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x1c4]
imul eax, dword [ebp - 0x548]
mov dword [ebp - 0x640], eax
jmp 0x4259ae
jmp 0x42595f
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x425ab2
push 0
push 0
push 0x1028
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea ecx, [ebp - 0x71c]
call fcn.00432b52
xor eax, eax
jmp 0x4296b6
push 1
lea ecx, [ebp - 0x108]
call fcn.00432a80
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0xc8], 0xbfa32a17
mov dword [ebp - 0x560], 0x7854c3eb
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x12c], 0
jmp 0x425b0f
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jge 0x425b2e
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x108]
call fcn.00432b6e
and dword [eax], 0
jmp 0x425b02
mov dword [ebp - 0x14], 0
jmp 0x425b3e
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x425d4b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x108]
call fcn.00432b6e
cmp dword [eax], 0
je 0x425d25
mov dword [ebp - 0xb8], 0xfffffffb
mov dword [ebp - 0x750], 0x6d8bc0d
mov dword [ebp - 0x74c], 0x6d8bc0d
mov dword [ebp - 0x748], 0x6d8bc0d
mov dword [ebp - 0x744], 0x6d8bc0d
lea ecx, [ebp - 0x1de]
call fcn.00432b7d
push eax
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x9cc]
call fcn.00432b80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7e8]
call fcn.00432b2c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x108]
call fcn.00432b6e
cmp dword [eax], 0
je 0x425be9
lea ecx, [ebp - 0x7e8]
call fcn.00432b52
jmp 0x425d4b
mov dword [ebp - 0xb8], 0
jmp 0x425c02
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x425d18
mov dword [ebp - 0x648], 1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x108]
call fcn.00432b6e
mov ecx, dword [ebp - 0xb8]
cmp dword [eax], ecx
jle 0x425c3d
mov dword [ebp - 0x550], 1
jmp 0x425c44
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x9a0], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x108]
call fcn.00432b6e
cmp dword [eax], 0
je 0x425c7f
cmp dword [ebp - 0xb8], 0
je 0x425c7f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x108]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x425c9b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x108]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x425c9b
and dword [ebp - 0x2a0], 0
jmp 0x425ca5
mov dword [ebp - 0x2a0], 1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x108]
call fcn.00432b6e
mov eax, dword [eax]
add eax, dword [ebp - 0x2a0]
add eax, dword [ebp - 0x648]
cmp dword [ebp - 0x550], eax
jne 0x425cd5
mov dword [ebp - 0x2a8], 1
jmp 0x425cdc
and dword [ebp - 0x2a8], 0
push 0
lea ecx, [ebp - 0x7e8]
call fcn.00432b6e
mov ecx, dword [ebp - 0x2a8]
mov dword [eax], ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x108]
call fcn.00432b6e
mov esi, eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x108]
call fcn.00432b6e
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x425bf5
lea ecx, [ebp - 0x7e8]
call fcn.00432b52
jmp 0x425d46
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x425d46
push 0
push 0x2423
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
jmp 0x425b37
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x9a8], eax
mov esi, dword [ebp - 0xc8]
push 0
lea ecx, [ebp - 0x108]
call fcn.00432b6e
cmp esi, dword [eax]
jge 0x425d77
mov dword [ebp - 0x558], 1
jmp 0x425d7e
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x558], eax
jl 0x425d98
mov dword [ebp - 0x2b0], 1
jmp 0x425d9f
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 0
jne 0x425dca
mov eax, 0x52b9
test eax, eax
jne 0x425dca
and dword [ebp - 0x2b8], 0
jmp 0x425dd4
mov dword [ebp - 0x2b8], 1
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x2b8], eax
jle 0x425dee
mov dword [ebp - 0x568], 1
jmp 0x425df5
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x568]
jle 0x425e12
mov eax, 0xb1aa
test eax, eax
jne 0x425e12
and dword [ebp - 0x2c0], 0
jmp 0x425e1c
mov dword [ebp - 0x2c0], 1
push 0
lea ecx, [ebp - 0x108]
call fcn.00432b6e
mov ecx, dword [ebp - 0x2c0]
add ecx, 0x7342
imul ecx, dword [ebp - 0xc8]
cmp dword [eax], ecx
je 0x425e4c
mov dword [ebp - 0x570], 1
jmp 0x425e53
and dword [ebp - 0x570], 0
push 0
lea ecx, [ebp - 0x108]
call fcn.00432b6e
mov ecx, dword [ebp - 0x570]
cmp ecx, dword [eax]
jg 0x425e76
mov dword [ebp - 0x578], 1
jmp 0x425e7d
and dword [ebp - 0x578], 0
mov esi, dword [ebp - 0x578]
sub esi, 0x252079f7
push 0
lea ecx, [ebp - 0x108]
call fcn.00432b6e
cmp esi, dword [eax]
je 0x425ea6
mov dword [ebp - 0x2cc], 1
jmp 0x425ead
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2cc], eax
jl 0x425ecd
cmp dword [ebp - 0xc8], 0
je 0x425ecd
mov dword [ebp - 0x45c], 1
jmp 0x425ed4
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x650], eax
lea ecx, [ebp - 0x108]
call fcn.00432b52
mov eax, dword [ebp - 0x1ec]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0x10], 0
push 1
lea ecx, [ebp - 0x194]
call fcn.00432a80
mov dword [ebp - 0x174], 0
jmp 0x425f2a
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jge 0x425f49
push dword [ebp - 0x174]
lea ecx, [ebp - 0x194]
call fcn.00432b6e
and dword [eax], 0
jmp 0x425f1d
mov dword [ebp - 0x10], 4
jmp 0x425f59
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1a
jge 0x425f74
push 0
lea ecx, [ebp - 0x194]
call fcn.00432b6e
mov dword [eax], 0xe42a43d9
jmp 0x425f52
mov dword [ebp - 0x10], 0
jmp 0x425f84
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x4260fa
push dword [ebp - 0x10]
lea ecx, [ebp - 0x194]
call fcn.00432b6e
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x194]
call fcn.00432b6e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x425fbe
mov dword [ebp - 0x464], 1
jmp 0x425fc5
and dword [ebp - 0x464], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x194]
call fcn.00432b6e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x194]
call fcn.00432b6e
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x194]
call fcn.00432b6e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x426003
mov dword [ebp - 0x2d4], 1
jmp 0x42600a
and dword [ebp - 0x2d4], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x194]
call fcn.00432b6e
mov ecx, dword [ebp - 0x2d4]
sub ecx, dword [eax]
cmp ecx, 0xfffa
ja 0x426034
mov dword [ebp - 0x524], 1
jmp 0x42603b
and dword [ebp - 0x524], 0
push 0
lea ecx, [ebp - 0x194]
call fcn.00432b6e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x524]
je 0x42605e
mov dword [ebp - 0x2dc], 1
jmp 0x426065
and dword [ebp - 0x2dc], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x194]
call fcn.00432b6e
mov ecx, dword [ebp - 0x2dc]
sub ecx, dword [eax]
cmp dword [ebp - 0x464], ecx
jne 0x42608f
mov dword [ebp - 0x2e4], 1
jmp 0x426096
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x2e4], eax
jge 0x4260ad
mov dword [ebp - 0x588], 1
jmp 0x4260b4
and dword [ebp - 0x588], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x194]
call fcn.00432b6e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x588]
jg 0x4260d8
mov dword [ebp - 0x2ec], 1
jmp 0x4260df
and dword [ebp - 0x2ec], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x194]
call fcn.00432b6e
mov ecx, dword [ebp - 0x2ec]
mov dword [eax], ecx
jmp 0x425f7d
lea ecx, [ebp - 0x194]
call fcn.00432b52
mov eax, dword [ebp - 0xe4]
cmp dword [eax], 0x4550
je 0x42645f
mov dword [ebp - 0xd0], 0xfffffff9
mov dword [ebp - 0xd0], 3
jmp 0x42613a
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x19
je 0x4261d4
push 2
lea ecx, [ebp - 0x6e0]
call fcn.00432a80
mov dword [ebp - 0x134], 0
jmp 0x42616d
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jge 0x42618f
push dword [ebp - 0x134]
lea ecx, [ebp - 0x6e0]
call fcn.00432b6e
mov dword [eax], 0xbacd
jmp 0x426160
push 0
lea ecx, [ebp - 0x6e0]
call fcn.00432b6e
cmp dword [eax], 0
je 0x4261ae
lea ecx, [ebp - 0x6e0]
call fcn.00432b52
jmp 0x4261d4
cmp dword [ebp - 0xd0], 0
je 0x4261c4
lea ecx, [ebp - 0x6e0]
call fcn.00432b52
jmp 0x4261d4
lea ecx, [ebp - 0x6e0]
call fcn.00432b52
jmp 0x42612d
or dword [ebp - 0x764], 0xffffffff
or dword [ebp - 0x760], 0xffffffff
or dword [ebp - 0x75c], 0xffffffff
or dword [ebp - 0x758], 0xffffffff
lea ecx, [ebp - 0x1d5]
call fcn.00432b7d
push eax
lea eax, [ebp - 0x754]
push eax
lea eax, [ebp - 0x764]
push eax
lea ecx, [ebp - 0x9d4]
call fcn.00432b80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x6f0]
call fcn.00432b2c
mov dword [ebp - 0x5b0], 3
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x164], 0
jmp 0x42625c
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x426275
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x2c], 0xffffffff
jmp 0x42624f
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2c], 0
jmp 0x42629a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 3
jg 0x42644d
mov dword [ebp - 0x658], 5
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x2c]
lea ecx, [ebp - 0x6f0]
call fcn.00432b6e
cmp dword [eax], 0
je 0x426435
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0
jne 0x4262ed
xor eax, eax
jne 0x4262ed
and dword [ebp - 0x46c], 0
jmp 0x4262f7
mov dword [ebp - 0x46c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x46c], eax
je 0x426315
mov dword [ebp - 0x2f4], 1
jmp 0x42631c
and dword [ebp - 0x2f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x2f4], eax
jl 0x42633a
mov dword [ebp - 0x52c], 1
jmp 0x426341
and dword [ebp - 0x52c], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x2c]
lea ecx, [ebp - 0x6f0]
call fcn.00432b6e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x52c]
jne 0x42636c
mov dword [ebp - 0x2fc], 1
jmp 0x426373
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0x2a7b09f5
jg 0x426397
mov dword [ebp - 0x304], 1
jmp 0x42639e
and dword [ebp - 0x304], 0
cmp dword [ebp - 0x304], 0x64e6
je 0x4263b6
mov dword [ebp - 0x47c], 1
jmp 0x4263bd
and dword [ebp - 0x47c], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x2c]
lea ecx, [ebp - 0x6f0]
call fcn.00432b6e
mov eax, dword [eax]
mov dword [ebp - 0x5b0], eax
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x30c]
cmp eax, dword [ebp - 0x47c]
jle 0x426400
mov dword [ebp - 0x314], 1
jmp 0x426407
and dword [ebp - 0x314], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x2c]
lea ecx, [ebp - 0x6f0]
call fcn.00432b6e
mov ecx, dword [ebp - 0x314]
imul ecx, dword [eax]
test ecx, ecx
je 0x426435
mov dword [ebp - 0x534], 1
jmp 0x42643c
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x658], eax
jmp 0x426285
lea ecx, [ebp - 0x6f0]
call fcn.00432b52
xor eax, eax
jmp 0x4296b6
mov dword [ebp - 4], 0xccba
mov dword [ebp - 0x184], 0xd8475761
mov dword [ebp - 0x13c], 0x28ad64de
mov dword [ebp - 0x1f8], 5
mov dword [ebp - 0x668], 0
mov dword [ebp - 0xdc], 0xba4fdaf0
mov dword [ebp - 0x598], 0x6bd0c7f1
mov byte [ebp - 0x5f], 0
movzx eax, byte [ebp - 0x5f]
test eax, eax
je 0x4264c9
push 0
push 0
push 0x1971
push 0xfb6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp dword [ebp - 4], 0
je 0x426658
mov eax, dword [ebp - 4]
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0xffffffff
jge 0x4264f1
mov dword [ebp - 0x31c], 1
jmp 0x4264f8
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
add eax, dword [ebp - 4]
imul eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
cmp eax, 0x526c
jle 0x426527
mov dword [ebp - 0x484], 1
jmp 0x42652e
and dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 1
jg 0x42653d
cmp dword [ebp - 4], 0
jne 0x42654c
cmp dword [ebp - 4], 0
jne 0x42654c
and dword [ebp - 0x324], 0
jmp 0x426556
mov dword [ebp - 0x324], 1
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x1f8], eax
imul eax, dword [ebp - 0x1f8], 0xad6c
cmp eax, dword [ebp - 4]
jg 0x42657d
mov dword [ebp - 0x590], 1
jmp 0x426584
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 0xdd4d
jg 0x42659c
mov dword [ebp - 0x32c], 1
jmp 0x4265a3
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x32c], eax
jle 0x4265bd
cmp dword [ebp - 4], 0
jne 0x4265bd
and dword [ebp - 0x48c], 0
jmp 0x4265c7
mov dword [ebp - 0x48c], 1
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x48c], eax
jl 0x4265de
mov dword [ebp - 0x334], 1
jmp 0x4265e5
and dword [ebp - 0x334], 0
cmp dword [ebp - 0x334], 1
jne 0x4265fa
mov dword [ebp - 0x53c], 1
jmp 0x426601
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x53c], eax
jl 0x426618
mov dword [ebp - 0x33c], 1
jmp 0x42661f
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x13c], eax
jle 0x426639
mov dword [ebp - 0x494], 1
jmp 0x426640
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0xbcae26e1
jb 0x426658
mov dword [ebp - 0x344], 1
jmp 0x42665f
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x344], eax
jle 0x426676
mov dword [ebp - 0x5c0], 1
jmp 0x42667d
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 0xffffffff
ja 0x426692
mov dword [ebp - 0x660], 1
jmp 0x426699
and dword [ebp - 0x660], 0
cmp dword [ebp - 0x1f8], 0
jne 0x4266b4
cmp dword [ebp - 0x184], 0
jne 0x4266b4
and dword [ebp - 0x34c], 0
jmp 0x4266be
mov dword [ebp - 0x34c], 1
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x9b0], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x99c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x1262
jne 0x426700
mov dword [ebp - 0x49c], 1
jmp 0x426707
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x49c], eax
jne 0x42671e
mov dword [ebp - 0x354], 1
jmp 0x426725
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x354], eax
je 0x42677f
mov dword [ebp - 0x8c4], 0
mov dword [ebp - 0x670], 7
mov dword [ebp - 0xdc], 1
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x670], eax
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x42677a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
jmp 0x42693c
mov dword [ebp - 0x544], 0xffffffff
mov dword [ebp - 0x680], 0xffffffff
mov dword [ebp - 0x78c], 0xfffffff8
mov dword [ebp - 0x788], 0xfffffff8
mov dword [ebp - 0x784], 0xfffffff8
mov dword [ebp - 0x780], 0xfffffff8
lea ecx, [ebp - 0x1e5]
call fcn.00432b7d
push eax
lea eax, [ebp - 0x77c]
push eax
lea eax, [ebp - 0x78c]
push eax
lea ecx, [ebp - 0x9ec]
call fcn.00432b80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x608]
call fcn.00432b2c
mov eax, dword [ebp - 4]
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x544], 1
jge 0x42680e
mov dword [ebp - 0x35c], 1
jmp 0x426815
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x544]
cmp dword [ebp - 0x35c], eax
jle 0x426833
push 2
pop eax
test eax, eax
jne 0x426833
and dword [ebp - 0x678], 0
jmp 0x42683d
mov dword [ebp - 0x678], 1
mov eax, dword [ebp - 0x680]
cmp dword [ebp - 0x184], eax
jle 0x426857
mov dword [ebp - 0x4a4], 1
jmp 0x42685e
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0xad1d
jne 0x426876
mov dword [ebp - 0x364], 1
jmp 0x42687d
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 0
jne 0x4268ad
push 3
lea ecx, [ebp - 0x608]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x4268ad
and dword [ebp - 0x688], 0
jmp 0x4268b7
mov dword [ebp - 0x688], 1
push 3
lea ecx, [ebp - 0x608]
call fcn.00432b6e
push 3
lea ecx, [ebp - 0x608]
call fcn.00432b6e
cmp dword [eax], 0x89ee
jge 0x4268e5
mov dword [ebp - 0x36c], 1
jmp 0x4268ec
and dword [ebp - 0x36c], 0
mov esi, dword [ebp - 0xdc]
add esi, dword [ebp - 0x36c]
push 3
lea ecx, [ebp - 0x608]
call fcn.00432b6e
cmp esi, dword [eax]
jge 0x426915
mov dword [ebp - 0x4ac], 1
jmp 0x42691c
and dword [ebp - 0x4ac], 0
push 3
lea ecx, [ebp - 0x608]
call fcn.00432b6e
mov ecx, dword [ebp - 0x4ac]
mov dword [eax], ecx
lea ecx, [ebp - 0x608]
call fcn.00432b52
push 1
push 1
push 0x20f3
push 0x5a06
lea eax, [ebp - 0x140]
push eax
push 0x401a
push 0x517c
push 0x73e3
push dword [ebp - 0xe4]
push 0x7f7b
push 0xa29
push 1
push 0x5110
push 1
push 0xcdb
call fcn.0041ae81
add esp, 0x3c
cmp dword [ebp - 0x140], 0
jne 0x426c4c
mov dword [ebp - 0x16c], 0x184c506d
mov dword [ebp - 0x144], 0
jmp 0x4269b6
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x4269d2
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x690], 0xffffffff
jmp 0x4269a9
mov dword [ebp - 0x16c], 0
jmp 0x4269eb
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jg 0x426b96
mov dword [ebp - 0x14c], 0x7c8a6b95
mov dword [ebp - 0x14c], 0
jmp 0x426a1b
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jg 0x426b91
mov dword [ebp - 0x17c], 0
jmp 0x426a41
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x426a5d
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x5f4], 0xfffffff9
jmp 0x426a34
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x5f4], 0
jmp 0x426a8b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5f4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x5f4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5f4], 0
jl 0x426b64
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xec], 0
jmp 0x426ac2
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x426b49
mov dword [ebp - 0x114], 0xffffffff
mov dword [ebp - 0x114], 0
jmp 0x426aee
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jg 0x426b1f
mov eax, dword [ebp - 0xec]
cmp dword [ebp + eax*4 - 0x690], 0
je 0x426b09
jmp 0x426b1f
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x426b1d
push 0
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x426ae1
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x426b44
push 0x501
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
jmp 0x426ab5
mov byte [ebp - 0x63], 0
movzx eax, byte [ebp - 0x63]
test eax, eax
je 0x426b5f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x426a70
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x426b8c
push 0x136a
push 0
push 0
push 0x5cc
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
jmp 0x426a0e
jmp 0x4269de
mov dword [ebp - 0x7b4], 0x3df75dce
mov dword [ebp - 0x7b0], 0x3df75dce
mov dword [ebp - 0x7ac], 0x3df75dce
mov dword [ebp - 0x7a8], 0x3df75dce
lea ecx, [ebp - 0x1b1]
call fcn.00432b7d
push eax
lea eax, [ebp - 0x7a4]
push eax
lea eax, [ebp - 0x7b4]
push eax
lea ecx, [ebp - 0x9fc]
call fcn.00432b80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9bc]
call fcn.00432b2c
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x10c], 0
jmp 0x426c16
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jg 0x426c3a
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x426c38
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
jmp 0x426c09
lea ecx, [ebp - 0x9bc]
call fcn.00432b52
xor eax, eax
jmp 0x4296b6
mov dword [ebp - 0x70], 0xf76ec751
mov dword [ebp - 0x610], 0xff29acd4
push 4
lea ecx, [ebp - 0x1a0]
call fcn.00432a80
mov dword [ebp - 0x1cc], 0xc295a527
mov dword [ebp - 0x38c], 0x48e01afe
push 3
lea ecx, [ebp - 0x5dc]
call fcn.00432a80
mov dword [ebp - 0x4cc], 0x3aed5eba
push 3
lea ecx, [ebp - 0x710]
call fcn.00432a80
mov dword [ebp - 8], 0
jmp 0x426cb2
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x426cce
push dword [ebp - 8]
lea ecx, [ebp - 0x1a0]
call fcn.00432b6e
mov dword [eax], 3
jmp 0x426cab
mov dword [ebp - 8], 0
jmp 0x426cde
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x426cfa
push dword [ebp - 8]
lea ecx, [ebp - 0x5dc]
call fcn.00432b6e
mov dword [eax], 0xfffffffc
jmp 0x426cd7
mov dword [ebp - 8], 0
jmp 0x426d0a
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x426d26
push dword [ebp - 8]
lea ecx, [ebp - 0x710]
call fcn.00432b6e
mov dword [eax], 0x6f576105
jmp 0x426d03
mov dword [ebp - 8], 0
jmp 0x426d36
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x426d4c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa0c], 0xd55a9d45
jmp 0x426d2f
push 2
lea ecx, [ebp - 0x1a0]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x426d6a
mov dword [ebp - 0x374], 1
jmp 0x426d71
and dword [ebp - 0x374], 0
push 1
lea ecx, [ebp - 0x1a0]
call fcn.00432b6e
mov eax, dword [eax]
sub eax, dword [ebp - 0x70]
cmp dword [ebp - 0x374], eax
jge 0x426d97
mov dword [ebp - 0x54c], 1
jmp 0x426d9e
and dword [ebp - 0x54c], 0
push 3
lea ecx, [ebp - 0x1a0]
call fcn.00432b6e
mov ecx, dword [ebp - 0x54c]
cmp ecx, dword [eax]
jne 0x426dc1
mov dword [ebp - 0x37c], 1
jmp 0x426dc8
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x1cc], eax
mov esi, dword [ebp - 0x1cc]
imul esi, dword [ebp - 0x70]
push 3
lea ecx, [ebp - 0x1a0]
call fcn.00432b6e
cmp esi, dword [eax]
jg 0x426dfb
mov dword [ebp - 0x4b4], 1
jmp 0x426e02
and dword [ebp - 0x4b4], 0
push 2
lea ecx, [ebp - 0x1a0]
call fcn.00432b6e
mov ecx, dword [ebp - 0x4b4]
cmp ecx, dword [eax]
jl 0x426e39
or eax, 0xffffffff
jne 0x426e39
push 3
lea ecx, [ebp - 0x1a0]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x426e39
and dword [ebp - 0x384], 0
jmp 0x426e43
mov dword [ebp - 0x384], 1
push 2
lea ecx, [ebp - 0x1a0]
call fcn.00432b6e
mov ecx, dword [ebp - 0x384]
cmp ecx, dword [eax]
jle 0x426e66
mov dword [ebp - 0x5b8], 1
jmp 0x426e6d
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
add eax, dword [ebp - 0x70]
cmp eax, 0x7736
jge 0x426e95
mov dword [ebp - 0x4bc], 1
jmp 0x426e9c
and dword [ebp - 0x4bc], 0
cmp dword [ebp - 0x4bc], 0
je 0x426ec3
push 2
lea ecx, [ebp - 0x1a0]
call fcn.00432b6e
cmp dword [eax], 0
je 0x426ec3
mov dword [ebp - 0x394], 1
jmp 0x426eca
and dword [ebp - 0x394], 0
push 2
lea ecx, [ebp - 0x1a0]
call fcn.00432b6e
mov ecx, dword [ebp - 0x394]
cmp ecx, dword [eax]
jle 0x426eed
mov dword [ebp - 0x554], 1
jmp 0x426ef4
and dword [ebp - 0x554], 0
push 1
lea ecx, [ebp - 0x5dc]
call fcn.00432b6e
mov eax, dword [eax]
mov ecx, dword [ebp - 0x554]
lea eax, [ecx + eax + 1]
cmp eax, 1
jbe 0x426f1e
mov dword [ebp - 0x39c], 1
jmp 0x426f25
and dword [ebp - 0x39c], 0
push 1
lea ecx, [ebp - 0x5dc]
call fcn.00432b6e
mov ecx, dword [ebp - 0x39c]
cmp ecx, dword [eax]
jg 0x426f48
mov dword [ebp - 0x4c4], 1
jmp 0x426f4f
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x4c4], eax
jle 0x426f66
mov dword [ebp - 0x3a4], 1
jmp 0x426f6d
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x3a4]
inc eax
cmp eax, 0x2fd17ba7
jne 0x426f87
mov dword [ebp - 0x5a0], 1
jmp 0x426f8e
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x5a0], eax
jne 0x426fab
cmp dword [ebp - 0x1cc], 0
jne 0x426fab
and dword [ebp - 0x3ac], 0
jmp 0x426fb5
mov dword [ebp - 0x3ac], 1
mov eax, dword [ebp - 0x610]
cmp eax, dword [ebp - 0x3ac]
jl 0x426fcf
mov dword [ebp - 0x618], 1
jmp 0x426fd6
and dword [ebp - 0x618], 0
mov dword [ebp - 0x4cc], 0x3c239170
mov esi, dword [ebp - 0x4cc]
push 1
lea ecx, [ebp - 0x5dc]
call fcn.00432b6e
cmp esi, dword [eax]
jge 0x427003
mov dword [ebp - 0x3b4], 1
jmp 0x42700a
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x3b4]
jl 0x427021
mov dword [ebp - 0x55c], 1
jmp 0x427028
and dword [ebp - 0x55c], 0
push 2
lea ecx, [ebp - 0x1a0]
call fcn.00432b6e
mov ecx, dword [ebp - 0x55c]
cmp ecx, dword [eax]
jg 0x42704b
mov dword [ebp - 0x3bc], 1
jmp 0x427052
and dword [ebp - 0x3bc], 0
push 0
lea ecx, [ebp - 0x710]
call fcn.00432b6e
mov ecx, dword [ebp - 0x3bc]
sub ecx, dword [eax]
cmp ecx, 0x463a4739
jl 0x42707b
mov dword [ebp - 0x6d0], 1
jmp 0x427082
and dword [ebp - 0x6d0], 0
push 1
lea ecx, [ebp - 0x5dc]
call fcn.00432b6e
or eax, 0xffffffff
jne 0x4270a6
mov eax, 0xbd5f
test eax, eax
jne 0x4270a6
and dword [ebp - 0x4d4], 0
jmp 0x4270b0
mov dword [ebp - 0x4d4], 1
push 0
lea ecx, [ebp - 0x710]
call fcn.00432b6e
mov ecx, dword [ebp - 0x4d4]
cmp ecx, dword [eax]
jg 0x4270d3
mov dword [ebp - 0x3c4], 1
jmp 0x4270da
and dword [ebp - 0x3c4], 0
push 0
lea ecx, [ebp - 0x5dc]
call fcn.00432b6e
mov ecx, dword [ebp - 0x3c4]
cmp ecx, dword [eax]
jle 0x4270fd
mov dword [ebp - 0x5cc], 1
jmp 0x427104
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x70], eax
lea ecx, [ebp - 0x710]
call fcn.00432b52
lea ecx, [ebp - 0x5dc]
call fcn.00432b52
lea ecx, [ebp - 0x1a0]
call fcn.00432b52
push 0
push 1
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0xe4]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x840]
push eax
push dword [ebp - 0x1ec]
push 0x4457
push 1
push 0x78b9
push 0x1d84
push 0x1438
push 1
push 1
push 1
call fcn.0042bd87
add esp, 0x3c
mov dword [ebp - 0x54], 0x1897a4a1
mov dword [ebp - 0xb0], 0x7e280bfe
mov dword [ebp - 0x3dc], 1
mov dword [ebp - 0x3e4], 0xae50714b
mov dword [ebp - 0x5a8], 0xd56a4262
mov dword [ebp - 0x118], 0
jmp 0x4271bc
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 2
jge 0x4271d8
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0x638], 0xffffffff
jmp 0x4271af
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x620], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x620]
mov dword [ebp + eax - 0x638], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x638], 0
jne 0x427210
mov dword [ebp - 0x6ac], 1
jmp 0x427217
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x848], eax
or eax, 0xffffffff
je 0x427241
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x638], 0
je 0x427241
mov dword [ebp - 0x3cc], 1
jmp 0x427248
and dword [ebp - 0x3cc], 0
cmp dword [ebp - 0x3cc], 1
jae 0x42725d
mov dword [ebp - 0x4dc], 1
jmp 0x427264
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 0xfffffff9
jne 0x427279
mov dword [ebp - 0x3d4], 1
jmp 0x427280
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x3d4]
je 0x4272a0
mov eax, 0xf591
test eax, eax
je 0x4272a0
mov dword [ebp - 0x564], 1
jmp 0x4272a7
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
sub eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x54]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x3dc], eax
jge 0x4272e3
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x4272e3
mov dword [ebp - 0x628], 1
jmp 0x4272ea
and dword [ebp - 0x628], 0
mov eax, 0xe011b55e
cmp eax, 0xb948214d
je 0x427302
mov dword [ebp - 0x4e4], 1
jmp 0x427309
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3e4]
cmp dword [ebp - 0x54], eax
je 0x427365
mov dword [ebp - 0xb0], 0x13
jmp 0x42733c
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xffffffe4
jle 0x427363
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x427361
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
jmp 0x42732f
jmp 0x427390
mov dword [ebp - 0x81c], 8
mov byte [ebp - 0x67], 0
movzx eax, byte [ebp - 0x67]
test eax, eax
je 0x427383
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x5a8]
inc eax
mov dword [ebp - 0x5a8], eax
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x4273b6
push 0x90f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [ebp - 0xe4]
push dword [ebp + 8]
push 1
push 0
push dword [ebp - 0x30]
push 0xbdc
push 0x1b29
push 0
call fcn.0041ece0
add esp, 0x20
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x140]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x580], ecx
je 0x4275fe
mov dword [ebp - 0x20], 0x5683c8fc
mov dword [ebp - 0x93c], 0xfffffffe
mov dword [ebp - 0x824], 0xaf72b572
mov dword [ebp - 0x8cc], 9
mov dword [ebp - 0x82c], 0xf3d47941
mov dword [ebp - 0xd4], 0xc8b166c1
cmp dword [ebp - 0x20], 0
jne 0x427444
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x427444
and dword [ebp - 0x3ec], 0
jmp 0x42744e
mov dword [ebp - 0x3ec], 1
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x3ec]
jg 0x4274af
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jne 0x42746d
mov dword [ebp - 0x4ec], 1
jmp 0x427474
and dword [ebp - 0x4ec], 0
imul eax, dword [ebp - 0x4ec], 0
cmp dword [ebp - 0x20], eax
jge 0x42748c
mov dword [ebp - 0x3f4], 1
jmp 0x427493
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
sub eax, dword [ebp - 0x20]
cmp eax, 0xfac1
jne 0x4274af
mov dword [ebp - 0x56c], 1
jmp 0x4274b6
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xffffffff
jmp 0x4274cf
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x11
jge 0x4275ca
mov dword [ebp - 0xd8], 0x76ab2aee
mov dword [ebp - 0x6d4], 0x9694d2b5
mov dword [ebp - 0xd8], 0
jmp 0x427506
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 7
jne 0x427536
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x427534
push 0x501
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
jmp 0x4274f9
cmp dword [ebp - 0x20], 0
je 0x42754b
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
jmp 0x4275c5
cmp dword [ebp - 0x6d4], 0
je 0x427569
cmp dword [ebp - 0xd4], 0
je 0x427569
mov dword [ebp - 0x3fc], 1
jmp 0x427570
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x3fc]
je 0x42758a
mov dword [ebp - 0x4f4], 1
jmp 0x427591
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
neg eax
cmp eax, 0x80ee
jg 0x4275ac
mov dword [ebp - 0x404], 1
jmp 0x4275b3
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
sub eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd8], eax
jmp 0x4274c8
push 0
push dword [ebp - 0x580]
push 0x78e7
push 0x66ab
push 1
push 0x5932
push dword [ebp - 0x30]
push 0
push 1
push 0x5be0
push 1
push 0x5e16
call fcn.0042233c
add esp, 0x30
mov dword [ebp - 0x128], 0xd4e06482
mov dword [ebp - 0x120], 0
jmp 0x427621
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x42763d
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x630], 0xffffffff
jmp 0x427614
mov dword [ebp - 0x128], 3
jmp 0x427656
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x15
jl 0x4276a0
mov dword [ebp - 0xe0], 0xdf37d45d
mov dword [ebp - 0xe0], 0
jmp 0x427682
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x42769e
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x630], 1
jmp 0x427675
jmp 0x427649
mov byte [ebp - 0x5a], 0
movzx eax, byte [ebp - 0x5a]
test eax, eax
je 0x4276bb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
push dword [ebp - 0x30]
call fcn.004157e0
pop ecx
test eax, eax
jne 0x4279fd
push 2
lea ecx, [ebp - 0x208]
call fcn.00432a80
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x6f4], 6
mov dword [ebp - 0x50c], 0xfff6
mov dword [ebp - 0x130], 0
jmp 0x42770d
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x42772c
push dword [ebp - 0x130]
lea ecx, [ebp - 0x208]
call fcn.00432b6e
and dword [eax], 0
jmp 0x427700
push 1
lea ecx, [ebp - 0x208]
call fcn.00432b6e
cmp dword [eax], 1
jle 0x42774a
mov dword [ebp - 0x40c], 1
jmp 0x427751
and dword [ebp - 0x40c], 0
push 1
lea ecx, [ebp - 0x208]
call fcn.00432b6e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x40c]
jg 0x427774
mov dword [ebp - 0x41c], 1
jmp 0x42777b
and dword [ebp - 0x41c], 0
push 1
lea ecx, [ebp - 0x208]
call fcn.00432b6e
mov ecx, dword [ebp - 0x44]
cmp dword [eax], ecx
jle 0x42779b
mov dword [ebp - 0x4fc], 1
jmp 0x4277a2
and dword [ebp - 0x4fc], 0
push 0
lea ecx, [ebp - 0x208]
call fcn.00432b6e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4fc]
jge 0x4277c5
mov dword [ebp - 0x414], 1
jmp 0x4277cc
and dword [ebp - 0x414], 0
cmp dword [ebp - 0x414], 0x1705
je 0x4277ea
mov eax, 0xc2132456
test eax, eax
jne 0x4277ea
and dword [ebp - 0x574], 0
jmp 0x4277f4
mov dword [ebp - 0x574], 1
mov eax, dword [ebp - 0x574]
sub eax, dword [ebp - 0x44]
cmp dword [ebp - 0x41c], eax
jl 0x4279c6
mov dword [ebp - 0x78], 0xffffffff
mov byte [ebp - 0x5c], 0
movzx eax, byte [ebp - 0x5c]
test eax, eax
je 0x427824
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov dword [ebp - 0x44], 0
jmp 0x427834
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x4279c4
mov dword [ebp - 0x18], 0x8d303f02
mov dword [ebp - 0x18], 1
jmp 0x427855
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x427920
mov dword [ebp - 0x63c], 0xfffffffe
push dword [ebp - 0x44]
lea ecx, [ebp - 0x208]
call fcn.00432b6e
cmp dword [eax], 0
jne 0x427888
mov dword [ebp - 0x424], 1
jmp 0x42788f
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x940], eax
cmp dword [ebp - 0x78], 0
jne 0x4278ad
cmp dword [ebp - 0x44], 0
jne 0x4278ad
and dword [ebp - 0x504], 0
jmp 0x4278b7
mov dword [ebp - 0x504], 1
cmp dword [ebp - 0x504], 0
jb 0x4278cc
mov dword [ebp - 0x6b4], 1
jmp 0x4278d3
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x834], eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0x208]
call fcn.00432b6e
cmp dword [eax], 0xffff
jae 0x4278fe
mov dword [ebp - 0x584], 1
jmp 0x427905
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x424]
imul eax, dword [ebp - 0x584]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x63c], eax
jmp 0x42784e
mov dword [ebp - 0x18], 1
jmp 0x427930
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x42799a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x208]
call fcn.00432b6e
cmp dword [eax], 0
je 0x42794b
jmp 0x42799a
mov dword [ebp - 0x78], 0
jmp 0x42795b
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jg 0x427998
push dword [ebp - 0x78]
lea ecx, [ebp - 0x208]
call fcn.00432b6e
cmp dword [eax], 0x7218
jge 0x427983
mov dword [ebp - 0x42c], 1
jmp 0x42798a
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x6f4], eax
jmp 0x427954
jmp 0x427929
mov dword [ebp - 0x18], 1
jmp 0x4279aa
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x4279bf
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
jmp 0x4279a3
jmp 0x42782d
jmp 0x4279eb
mov byte [ebp - 0x5e], 0
movzx eax, byte [ebp - 0x5e]
test eax, eax
je 0x4279eb
push 0xe77
push 0x1e52
push 0
push 0xd5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 0x208]
call fcn.00432b52
xor eax, eax
jmp 0x4296b6
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x80], 0x3718
mov dword [ebp - 0x38], 0
jmp 0x427a1b
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x427a31
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x5fc], 0xfffffff6
jmp 0x427a14
mov dword [ebp - 0x38], 0
jmp 0x427a41
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x427a57
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x644], 0xfffffff9
jmp 0x427a3a
mov dword [ebp - 0x34], 0
jmp 0x427a67
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jg 0x427b47
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x5fc], 0
je 0x427ad1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x8d4], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x98c], eax
cmp dword [ebp - 0x80], 0x9d585ed0
je 0x427aae
mov dword [ebp - 0x434], 1
jmp 0x427ab5
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0xfffffff6
jne 0x427aca
mov dword [ebp - 0x57c], 1
jmp 0x427ad1
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x5fc], 0
je 0x427aef
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x5fc], 0
je 0x427aed
jmp 0x427b47
jmp 0x427b30
mov dword [ebp - 0x80], 0
jmp 0x427aff
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jg 0x427b17
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x34]
mov dword [ebp + eax - 0x644], ecx
jmp 0x427af8
mov byte [ebp - 0x60], 0
movzx eax, byte [ebp - 0x60]
test eax, eax
je 0x427b30
push 0x1d0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x5fc], 0
je 0x427b42
jmp 0x427a60
jmp 0x427a60
push 0
push 0x7fec
push 1
push 1
push 0x7caa
push 1
push 0x3785
push 0xd85
push 0x5f3d
push dword [ebp - 0x30]
push 0xdf2
push 0x3e24
push 1
call fcn.0042295a
add esp, 0x34
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x454], 0xfffffffb
mov dword [ebp - 0x1c], 0
jmp 0x427baa
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x427bc0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x80c], 0x25429297
jmp 0x427ba3
mov dword [ebp - 0x1c], 0
jmp 0x427bd0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x427be6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9e4], 0x6a08376f
jmp 0x427bc9
mov dword [ebp - 0x1c], 0
jmp 0x427bf6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x427c0c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x64c], 3
jmp 0x427bef
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jl 0x427c20
mov dword [ebp - 0x43c], 1
jmp 0x427c27
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x28], 0x5969
jne 0x427c3c
mov dword [ebp - 0x514], 1
jmp 0x427c43
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x43c]
dec ecx
dec ecx
sub eax, ecx
sub eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0x28]
jl 0x427c67
mov dword [ebp - 0x444], 1
jmp 0x427c6e
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x444]
cmp eax, 0x6478c38e
jle 0x427c8b
mov dword [ebp - 0x58c], 1
jmp 0x427c92
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x1d4]
imul eax, dword [ebp - 0x58c]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x44c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x44c]
mov dword [ebp + eax - 0x80c], ecx
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x44c], eax
jle 0x427cd5
mov dword [ebp - 0x51c], 1
jmp 0x427cdc
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x454]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x1d4]
jl 0x427d05
mov dword [ebp - 0x2c4], 1
jmp 0x427d0c
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x2c4], eax
jl 0x427d23
mov dword [ebp - 0x6bc], 1
jmp 0x427d2a
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x844], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9e4]
cmp dword [ebp - 0x28], eax
jg 0x427d51
mov dword [ebp - 0x23c], 1
jmp 0x427d58
and dword [ebp - 0x23c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x23c]
mov dword [ebp + eax - 0x64c], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x429524
mov dword [ebp - 0x1fc], 2
mov dword [ebp - 0x88], 3
push 1
lea ecx, [ebp - 0x220]
call fcn.00432a80
mov dword [ebp - 0xb4], 0xd4b4
mov dword [ebp - 0x300], 0xffffffff
mov dword [ebp - 0x310], 0xffffffff
mov dword [ebp - 0x328], 0xffffffff
mov dword [ebp - 0x138], 0
jmp 0x427ddc
mov dword [ebp - 0x914], 0xe00f
mov dword [ebp - 0x89c], 0x1c0f8067
mov dword [ebp - 0x9a4], 0xffffffff
mov dword [ebp - 0x8a4], 0xfffffffe
push 2
lea ecx, [ebp - 0x930]
call fcn.00432a80
mov dword [ebp - 0x924], 0x4142
mov dword [ebp - 0x2b4], 0xd004dde9
mov dword [ebp - 0x8ac], 0xfffffffb
mov dword [ebp - 0x48], 0
jmp 0x429587
pop esi
mov esp, ebp
pop ebp
ret