Function at 0x432e80
Capabilities:
Compare security identifiers
Create pipe
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push ebx
mov dword [ebp - 0x14], 0
push esi
mov dword [ebp - 0x18], 0xd0b0a353
mov esi, ecx
mov dword [ebp - 0x18], 0xba13b288
lea ecx, [ebp - 0x1b4]
push edi
mov dword [ebp - 0x2c], 0xf9dbc9b7
mov dword [ebp - 0x18], 0x868fdadf
mov dword [ebp - 0x18], 0x82f744ed
push 4
mov byte [ebp - 0x31], dl
mov dword [ebp - 0x28], esi
call fcn.00432b0d
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], eax
jmp 0x432ee6
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x190], 0xa6847dfa
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x432ed5
push 2
mov dword [ebp - 8], eax
pop ebx
jmp 0x432f03
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1b4]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x432ef4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x432f1f
push 0x122d
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
mov dword [ebp - 0x14], ebx
push 1
pop edi
cmp dword [ebp - 0x14], eax
jl 0x433052
mov dword [ebp - 0x1c], 0x33992443
lea ecx, [ebp - 0x19c]
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x18], 0x4a41637c
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x18], 0xd66c4a87
push ebx
call fcn.00432b0d
mov dword [ebp - 0xc], 0
jmp 0x432f7c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x19c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x432f6d
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0
jl 0x43303e
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x1e8]
mov dword [ebp - 0x18], 0x8112def9
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x18], 0x9e22401d
mov dword [ebp - 0x18], edi
push 4
call fcn.00432b0d
mov dword [ebp - 8], 0xf63abefa
mov dword [ebp - 0xc], 0
jmp 0x432fd9
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1e8]
mov dword [eax + ecx*4], 0x1434a938
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x432fc6
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x190]
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x20]
test eax, eax
je 0x432ffd
mov eax, dword [ebp - 0x24]
dec eax
je 0x432ffd
mov ecx, edi
jmp 0x432fff
xor ecx, ecx
mov eax, dword [ebp - 0x188]
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 8]
mov eax, 0xfc4f
setge dl
imul ecx, dword [ebp - 0x1c]
sub ecx, edx
imul ecx, dword [ebp - 0x1c]
sub eax, ecx
lea ecx, [ebp - 0x1e8]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
inc dword [ebp - 8]
call fcn.00432bdf
dec dword [ebp - 0x1c]
jns 0x432f8e
lea ecx, [ebp - 0x19c]
call fcn.00432bdf
dec dword [ebp - 0x14]
jns 0x432f2e
lea ecx, [ebp - 0x1b4]
call fcn.00432bdf
push edi
lea ecx, [ebp - 0x94]
call fcn.00432b0d
mov dword [ebp - 0x14], 0x158d32ff
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x2c], 0x9b347d17
mov dword [ebp - 0x24], 0x6f0c3da5
mov dword [ebp - 0x18], 0xb566e66b
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x18], 0xfffffffa
push edi
call fcn.00432b0d
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4330ca
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x94]
mov dword [ecx + edx*4], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4330bb
mov dword [ebp - 8], eax
jmp 0x4330e7
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + edx*4], 0xed4033e2
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4330d4
mov ecx, dword [ebp - 0x94]
xor edx, edx
cmp dword [ecx], eax
setg dl
inc edx
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x94]
mov edx, dword [ecx]
xor ecx, ecx
cmp edx, 0xd743ccc
sete cl
xor ebx, ebx
cmp ecx, edx
lea ecx, [edx + 1]
setle bl
xor edx, edx
cmp ecx, ebx
setg dl
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
jne 0x433134
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x94]
xor ebx, ebx
mov ecx, dword [edx]
cmp dword [edx], 6
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
setne bl
sub ecx, ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
jmp 0x4331ae
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x18], 0xe18bd2e8
mov dword [ebp - 0x18], 0x2406c49a
mov dword [ebp - 0x18], 0xed5b6062
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0xc], eax
jmp 0x4331a2
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x230], 0xe695ef2b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x433191
inc dword [ebp - 0x2c]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jge 0x433154
lea ecx, [ebp - 0x160]
call fcn.00432bdf
lea ecx, [ebp - 0x94]
call fcn.00432bdf
mov dword [ebp - 8], edi
xor eax, eax
mov dword [ebp - 0xc], 0xfffffffd
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], eax
jmp 0x4331ef
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xa0], 0xf2c0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x4331de
mov ecx, dword [ebp - 8]
neg ecx
je 0x433202
mov ecx, edi
cmp dword [ebp - 8], eax
jne 0x433204
mov ecx, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 0xa6deec54
jb 0x433323
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0xc], 0xf6c74aa0
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x1c]
jge 0x433258
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
setne bl
test ebx, ebx
je 0x433258
mov edx, eax
jmp 0x43325b
xor edx, edx
inc edx
xor ecx, ecx
cmp edx, 0xfffffffd
setne cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jne 0x43326e
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
je 0x433299
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x433326
push eax
push eax
call edi
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
jmp 0x43331f
mov dword [ebp - 0x1c], 0x5c6a
xor ebx, ebx
mov dword [ebp - 0x20], 0x5fef4072
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
cmp edx, ecx
setg bl
xor edx, edx
add ebx, dword [ebp - 0x2c]
add ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
cmp ebx, ecx
setle dl
xor ebx, ebx
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
setne bl
sub edx, ecx
cmp edx, ebx
jl 0x4332e3
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
xor edx, edx
test ecx, ecx
mov ecx, 0x9af2c67a
setns dl
cmp ecx, edx
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x433326
push eax
push eax
push eax
push eax
push 0x1c57
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
jmp 0x433326
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
jmp 0x43334b
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], eax
jmp 0x433343
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0xa0]
mov dword [ebp - 0x24], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jle 0x433333
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x43332b
mov edx, dword [0x4ad5ec]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], 0x51c76d7b
mov dword [ebp - 0x20], 0x33c
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x2c], edx
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebp - 0xc], eax
jmp 0x43338f
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x54], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x433381
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
je 0x4333b0
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x14]
jle 0x4333b0
xor ecx, ecx
inc ecx
jmp 0x4333b2
mov ecx, eax
cmp ecx, 0xfff9
mov dword [ebp - 0x24], 0xffff
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0x24], ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x54], ecx
neg ecx
je 0x43351c
mov dword [ebp - 8], 0x6a05
mov dword [ebp - 0x24], 0x9425a33e
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0xc], eax
jmp 0x433405
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xac], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4333f4
mov ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 8], 0xfffffff0
cmp dword [ebp - 8], 0x1d
jl 0x433526
xor ebx, ebx
inc ebx
mov dword [ebp - 0x20], 0x30b9
mov dword [ebp - 0xc], eax
jmp 0x433451
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x9c], 0xfffffffa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x433440
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x43347f
push eax
push eax
push 0x252e
push eax
push 0x18d3
push eax
push 0x14ec
push 0xa48
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
cmp dword [ebp - 8], eax
je 0x43349c
mov ecx, dword [ebp - 0x50]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0xa8], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xa8]
cmp ecx, 0x3533
mov ecx, dword [ebp - 0x1c]
setl dl
xor ebx, ebx
cmp edx, ecx
sete bl
sub ebx, dword [ebp - 0x20]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
mov dword [ebp - 0x50], ebx
mov ecx, dword [ebp - 8]
cmp ebx, ecx
setl dl
cmp edx, dword [ebp - 8]
jl 0x4334ec
cmp dword [ebp - 0x14], eax
jne 0x4334ec
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x4334f1
xor ebx, ebx
inc ebx
mov edx, ebx
mov ecx, dword [ebp - 0x14]
add ecx, edx
jne 0x433502
mov ecx, eax
cmp dword [ebp - 0xa8], eax
je 0x433504
mov ecx, ebx
mov dword [ebp - 0x24], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1d
jge 0x433434
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 0x2c]
jmp 0x433526
mov dword [ebp - 0x20], 0xc3cb8784
dec dword [ebp - 0x20]
cmp byte [ebp - 0x31], 0
je 0x43386b
cmp edx, 1
jne 0x43386b
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], 0xbc42206d
mov dword [ebp - 0x18], 0x105fa2ef
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x18], 0xb1b0cadf
mov dword [ebp - 0x18], 0xd66de6b9
mov dword [ebp - 0x18], 0x6a6c65b0
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x68], 0x77b69c93
mov dword [ebp - 0x18], 0x731e7bf5
mov dword [ebp - 0x40], 0xfff8
mov dword [ebp - 0x30], 0x19c7
mov dword [ebp - 8], eax
jmp 0x4335af
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x98], 0x7f0a290b
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x43359e
mov dword [ebp - 8], eax
jmp 0x4335ca
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x88], 4
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x4335b9
mov dword [ebp - 8], eax
jmp 0x4335e5
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x208], 0x4fc3
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x4335d4
mov dword [ebp - 8], eax
jmp 0x4335fd
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x214], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4335f0
mov dword [ebp - 0x14], eax
jmp 0x433615
mov dword [ebp - 0xc], 0x95e17ca0
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffee
jl 0x433608
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x43374a
push 3
lea ecx, [ebp - 0x154]
call fcn.00432b0d
mov dword [ebp - 8], 0x34111d01
lea ecx, [ebp - 0x118]
push 1
call fcn.00432b0d
mov dword [ebp - 0x18], 0xffffffff
xor eax, eax
mov dword [ebp - 0x24], 0xebf8
mov dword [ebp - 0x44], 0x64361a6b
mov dword [ebp - 0xc], 0xa18394d2
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x1c], 0x584d75f0
mov dword [ebp - 8], eax
jmp 0x43368c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x154]
mov dword [ecx + edx*4], 0xfba22e97
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x433679
mov dword [ebp - 8], eax
jmp 0x4336a6
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x118]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x433697
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x4336bc
push eax
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
inc dword [ebp - 0x1fc]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0xf04e266b
setne cl
mov dword [ebp - 0x20c], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x40]
jne 0x4336fb
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x154]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
lea ecx, [ebp - 0x118]
call fcn.00432bdf
lea ecx, [ebp - 0x154]
call fcn.00432bdf
dec dword [ebp - 0x14]
jns 0x433627
mov dword [ebp - 0x14], 0x469ad59e
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x18], 0xfffffff9
push 2
mov dword [ebx + 8], 4
call fcn.00432b0d
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
xor edx, edx
mov dword [ebp - 8], eax
inc edx
jmp 0x433787
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x48], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x43377d
mov dword [ebp - 8], eax
jmp 0x43379e
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1cc], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x433791
mov dword [ebp - 8], eax
jmp 0x4337bc
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x130]
mov dword [ecx + edx*4], 0x63b0a6d0
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x4337a9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x4337e1
push 0x94
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x433859
mov dword [ebp - 0xc], 0xffffffff
xor edx, edx
mov dword [ebp - 0x20], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
neg ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x1b1
setle dl
mov dword [ebp - 0x20], edx
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp + ecx*4 - 0x48]
cmp ecx, 1
setne dl
cmp edx, dword [ebp - 0x1c8]
jg 0x43383b
cmp dword [ebp - 0x20], eax
jne 0x43383b
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp + ecx*4 - 0x48]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + ecx*4 - 0x48]
mov ecx, dword [ebp - 0x130]
mov dword [ecx], edx
mov dword [ebp - 0x18], edx
dec dword [ebp - 0x14]
jns 0x4337e9
lea ecx, [ebp - 0x130]
call fcn.00432bdf
mov dword [ebx + 0xc], 0x4ad5ec
push 2
pop ebx
mov dword [ebp - 0xc], 0x5540d7f8
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0x20], 0xfffffff6
push ebx
call fcn.00432b0d
mov dword [ebp - 0x30], 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x18], 0xedb7758b
mov dword [ebp - 8], eax
jmp 0x4338b3
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xf4]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4338a4
xor ebx, ebx
mov dword [ebp - 8], eax
inc ebx
jmp 0x4338ce
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x4c], 0x8cca6991
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4338c0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xfffffff3
jge 0x43399e
mov edi, dword [ebp - 0xf4]
mov dword [ebp - 0x40], 0x14af12a8
mov dword [ebp - 0x44], 0x593c8699
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x1c], 0x5a9cea44
mov dword [ebp - 0x44], 0x86695cd1
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x20], 0xbbbc254e
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x20]
inc dword [ebp - 0x20]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
or dword [edi + 4], 0xffffffff
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xa4716037
sbb edx, edx
add edx, 0xffff63bf
neg edx
sbb edx, edx
or ecx, 0xffffffff
inc edx
sub ecx, edx
cmp ecx, dword [ebp - 0x14]
jne 0x43395b
mov esi, eax
cmp dword [ebp - 0x14], eax
je 0x43395d
mov esi, ebx
xor edx, edx
mov dword [ebp - 0x20], 9
mov ecx, dword [ebp - 0x44]
cmp esi, ecx
mov ecx, dword [ebp - 0xc]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x20]
push 1
setne bl
xor edx, edx
cmp ecx, 0x4b25b3b9
setg dl
add ebx, edx
mov dword [ebp - 0x4c], ebx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff3
pop ebx
jl 0x4338e6
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0xf4]
call fcn.00432bdf
cmp esi, dword [ebp - 0x2c]
jge 0x43461d
mov dword [ebp - 0x14], 0xfffffff8
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x20], 0x864896e6
push 3
call fcn.00432b0d
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4339e7
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x148]
mov dword [ecx + edx*4], 0xb051af7f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4339d4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x433a11
push 0x1568
push 0x1a91
push eax
push eax
push 0x98
push 0x801
call dword [sym.imp.USER32.dll_ToUnicode]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
lea ecx, [ebp - 0x148]
setg dl
sub edx, dword [ebp - 0x14]
imul edx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x148]
mov dword [eax], ebx
call fcn.00432bdf
mov dword [ebp - 0x1c], 0xa75c
mov edi, 0x4ad5f0
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
xor eax, eax
mov dword [ebp - 0x20], 0x5537
mov dword [ebp - 8], edi
cmp dword [ebp - 0x1c], eax
je 0x433b32
mov dword [ebp - 0xc], 8
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x433aa4
push 0x5bc
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x433b26
mov dword [ebp - 0x14], 0x4ea6801f
mov dword [ebp - 0x14], eax
jmp 0x433ac6
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xbc], 0xeee2fde2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x433ab5
cmp dword [ebp - 0xc], eax
jne 0x433b08
cmp dword [ebp - 0x14], eax
je 0x433afd
cmp dword [ebp - 0xc], ebx
jle 0x433ae2
mov edx, ebx
cmp dword [ebp - 0xc], eax
jne 0x433ae4
mov edx, eax
mov ecx, dword [ebp - 0xb4]
sub edx, ecx
je 0x433afd
cmp dword [ebp - 0x14], eax
je 0x433afd
mov edx, ebx
cmp dword [ebp - 0xb4], eax
jne 0x433aff
mov edx, eax
mov ecx, dword [ebp - 0xc]
sub edx, ecx
mov ecx, eax
je 0x433b0a
mov ecx, ebx
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0x1c]
setge dl
sub edx, 6
neg edx
sbb edx, edx
inc edx
mov dword [ebp + ecx*4 - 0xbc], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x433aa9
jmp 0x433b4b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x433b4b
push 0x1b54
push eax
push 0x7ce
call dword [sym.imp.KERNEL32.dll_OpenProcess]
dec dword [ebp - 0x20]
test esi, esi
jle 0x433f62
push 3
lea ecx, [ebp - 0x100]
call fcn.00432b0d
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x433b7d
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x100]
mov dword [ecx + edx*4], 8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x433b6a
mov ecx, dword [ebp - 0x100]
or dword [ecx + 8], 0xffffffff
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x433b9d
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
lea ecx, [ebp - 0x100]
call fcn.00432bdf
mov eax, dword [edi]
lea ecx, [ebp - 0xc8]
push 4
mov dword [ebp - 0x30], eax
call fcn.00432b0d
push 2
mov dword [ebp - 0x20], 0xfffffffd
lea ecx, [ebp - 0x124]
pop esi
mov dword [ebp - 0x1c], 0x9b950315
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], 6
push esi
call fcn.00432b0d
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x1c0]
push esi
call fcn.00432b0d
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x433c04
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1a8], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x433bf7
mov dword [ebp - 8], eax
jmp 0x433c22
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc8]
mov dword [ecx + edx*4], 0x860b4ffb
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x433c0f
mov dword [ebp - 8], eax
jmp 0x433c3e
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x220], 0x72b21a35
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x433c2d
mov dword [ebp - 8], eax
jmp 0x433c58
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x124]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x433c49
mov dword [ebp - 8], eax
jmp 0x433c71
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c0]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x433c62
mov esi, dword [ebp - 0xc8]
mov dword [esi + 0xc], eax
mov dword [ebp - 0xc], 0x17e2f9d4
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x32a17d0b
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0xc], eax
jmp 0x433cb4
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x10c], 0xf145ba13
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x433ca3
mov ecx, dword [esi + 0xc]
cmp dword [ebp + ecx*4 - 0x1a8], eax
jne 0x433ccd
inc dword [ebp - 0x1c]
jne 0x433ccd
mov ebx, eax
mov ecx, dword [esi + 0xc]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x1a8]
cmp ecx, ebx
mov ecx, dword [ebp - 0x10c]
setne dl
imul ecx, edx
imul ecx, ecx, 0xfffb
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], eax
jmp 0x433d08
mov edx, dword [ebp - 0x108]
mov ecx, dword [esi + 0xc]
mov dword [ebp + ecx*4 - 0x10c], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x433cf5
inc dword [esi + 0xc]
cmp dword [esi + 0xc], 2
push 1
pop ebx
jle 0x433c7f
dec dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x124]
cmp eax, dword [edx + 4]
setl cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
add eax, 0xebe1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
xor eax, eax
mov edx, dword [ebp - 0xc8]
mov dword [ebp - 0x21c], ecx
cmp ecx, dword [edx + 8]
lea ecx, [ebp - 0x1c0]
setl al
mov dword [edx + 8], eax
call fcn.00432bdf
lea ecx, [ebp - 0x124]
call fcn.00432bdf
lea ecx, [ebp - 0xc8]
call fcn.00432bdf
push dword [ebp + 8]
movdqa xmm0, xmmword [0xa9efa0]
lea ecx, [ebp - 0x1e8]
push ecx
xor eax, eax
lea ecx, [ebp - 0x1f8]
push ecx
push eax
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xe0], eax
movdqu xmmword [ebp - 0x1f8], xmm0
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
call fcn.00432c50
push 6
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0xc7c8a6b9
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 0x78abc106
mov dword [ebp - 0x18], eax
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d0], eax
xor eax, eax
push 3
mov dword [ebp - 0x20], 0x17ca
mov dword [ebp - 0xc], eax
pop edx
jmp 0x433e48
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 8], eax
jmp 0x433e21
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x228], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x433e14
mov dword [ebp - 8], eax
jmp 0x433e3d
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x23c], 0x7865925e
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x433e2c
dec dword [ebp - 0x20]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jle 0x433e08
lea ecx, [ebp - 0xe0]
call fcn.00432bdf
mov esi, dword [edi + 4]
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0x51dba339
mov dword [ebp - 0x18], 0xa5043c4a
mov dword [ebp - 0x18], 0x90edcad2
push ebx
call fcn.00432b0d
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0xc], 0
jmp 0x433ead
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], 0x85c9e53e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x433e9a
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x178]
dec dword [ebp - 0x1c]
call fcn.00432bdf
add edi, 8
test esi, esi
jne 0x433ecd
add edi, 8
mov dword [ebp - 0x14], 0x4ebb
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x433eeb
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov esi, ebx
mov dword [ebp - 0xc], ecx
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
sub esi, ecx
mov ecx, dword [ebp - 0x14]
cmp esi, ecx
setge dl
cmp edx, 0xcdf98a59
je 0x433f17
mov ecx, eax
cmp dword [ebp - 0xc], eax
je 0x433f19
mov ecx, ebx
neg ecx
mov byte [ebp - 0xd], al
je 0x433f34
cmp byte [ebp - 0xd], al
je 0x433f4d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
jmp 0x433f4d
cmp byte [ebp - 0xd], al
je 0x433f4d
push 0x1d43
push eax
push eax
push eax
push 0xea3
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
add edi, dword [ebp - 0x30]
dec dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jne 0x433b56
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x184]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x28], 0x377d6446
mov dword [ebp - 0x18], 0xffffffff
push ebx
call fcn.00432b0d
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x433fab
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x184]
mov dword [ecx + edx*4], 0xb818
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x433f98
cmp dword [ebp - 0x14], eax
je 0x433ffa
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
sub ecx, 0xae4f78d7
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, 0xb012
mov ecx, dword [ebp - 0x14]
setl bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0xb15d
je 0x433fed
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x14], eax
je 0x433ffa
mov eax, ebx
xor edx, edx
cmp eax, 4
mov eax, dword [ebp - 0x14]
sete dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x14]
cmp eax, 0xf300
setne cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x184]
mov dword [ebp - 0x28], 0xf6a191a8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
call fcn.00432bdf
mov eax, dword [edi]
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 0x836ccb03
push 2
mov dword [ebp - 0x28], eax
call fcn.00432b0d
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x43406c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x43405d
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x4341a7
mov dword [ebp - 0x24], 0x939f
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4340a7
push 0xd89
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x43418f
mov dword [ebp - 0xc], 0xfffffff7
mov dword [ebp - 0x20], 0x55a44198
mov dword [ebp - 0x20], 0xf8b4dfec
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x43411e
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x499
push 0xc6
push 0x265d
push eax
push 0x16c6
push 0x2529
call esi
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
push 0xc50
push 0x10ad
push 0x8a8
push 0xe18
call esi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jg 0x43418c
mov ebx, dword [ebp - 0xd4]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], 0xfffffffd
xor edx, edx
mov dword [ebp - 0x20], 0xffffffff
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
neg ecx
cmp dword [ebx + 4], ecx
mov ecx, dword [ebp - 0xd4]
setg dl
sub esi, edx
neg esi
sbb esi, esi
xor ebx, ebx
inc esi
imul esi, dword [ecx + edi*4]
mov dword [ebp - 0x20], esi
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
cmp edx, ecx
setne bl
sub ebx, dword [ebp - 0x24]
dec ebx
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x18], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
mov ebx, dword [ebp - 0x30]
jle 0x43412f
xor ebx, ebx
inc ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x4340af
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x434087
mov edi, dword [ebp - 8]
lea ecx, [ebp - 0xd4]
call fcn.00432bdf
mov dword [ebp - 8], 0xffffffff
push 4
pop eax
mov dword [ebp - 0xc], ebx
add edi, eax
mov dword [ebp - 0x24], 0xfcf62392
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4341e0
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x3c], 0x871c7bf0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4341d2
mov ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 8], eax
jmp 0x434365
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
xor ebx, ebx
mov dword [ebp - 0x14], 0xf885bd5
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x38]
cmp ecx, 1
mov ecx, dword [ebp - 8]
setle bl
xor edx, edx
cmp ebx, ecx
setne dl
xor ebx, ebx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x3c]
mov ecx, dword [ebp - 0xc]
cmp edx, ecx
setne bl
mov dword [ebp - 0x14], ebx
xor ebx, ebx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp + ecx*4 - 0x3c]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
cmp edx, ecx
setge bl
imul esi, ebx
test esi, esi
je 0x43426a
cmp dword [ebp - 0x3c], eax
je 0x43426a
xor esi, esi
inc esi
jmp 0x43426c
mov esi, eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x3c]
cmp esi, ecx
mov ecx, dword [ebp - 8]
setle dl
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x3c]
cmp edx, ecx
mov ecx, dword [ebp - 8]
setge bl
add ebx, dword [ebp + ecx*4 - 0x3c]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x3c], ebx
xor ebx, ebx
inc ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x434362
cmp dword [ebp - 0x60], eax
jne 0x4342db
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x3c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x3c]
mov ecx, dword [ebp - 0x60]
cmp ecx, edx
setl bl
cmp ebx, dword [ebp - 0x60]
je 0x4342ce
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x3c]
mov ecx, dword [ebp - 8]
xor ebx, ebx
inc ebx
mov ecx, dword [ebp + ecx*4 - 0x3c]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x3c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x3c]
mov dword [ebp - 0x58], 0xffffffff
cmp dword [ebp - 8], eax
jne 0x43431f
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x3c]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x3c]
mov dword [ebp - 0xc], ebx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x3c]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x3c]
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 8]
setl bl
xor edx, edx
add ebx, dword [ebp + ecx*4 - 0x3c]
mov ecx, dword [ebp - 0x14]
cmp ebx, ecx
setge dl
xor ebx, ebx
xor ecx, ecx
inc ebx
cmp edx, ebx
setge cl
sub ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0x14]
jns 0x4342a5
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x4341f4
mov ecx, dword [edi]
mov dword [ebp - 0x14], 0xca631852
mov dword [ebp - 0x14], 0xb
cmp dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x40], ecx
jle 0x434448
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x16c]
push 3
call fcn.00432b0d
mov dword [ebp - 0xc], 0
jmp 0x4343b7
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x16c]
mov dword [eax + ecx*4], 3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4343a4
mov dword [ebp - 0x1c], 0
jmp 0x434428
push 2
lea ecx, [ebp - 0x13c]
call fcn.00432b0d
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4343ed
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x13c]
mov dword [ecx + edx*4], 0xded68044
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4343da
mov esi, dword [ebp - 0x13c]
mov dword [esi + 4], 2
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x434415
push ebx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor eax, eax
dec dword [esi + 4]
jns 0x434400
lea ecx, [ebp - 0x13c]
call fcn.00432bdf
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffeb
je 0x4343c6
lea ecx, [ebp - 0x16c]
call fcn.00432bdf
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff7
jg 0x43438b
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x434494
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x1629
push 0x8e1
push 0x1f9e
call esi
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
push 0x1115
push 0x697
push 0xa2b
push 0x3fe
call esi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
xor eax, eax
mov ecx, 0xffb871c7
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x18], 0x3531f145
mov dword [ebp - 0x24], 0xfffffffc
push 2
mov dword [ebp - 0x30], 0xfffe
mov dword [ebp - 0xc], eax
pop edx
jmp 0x4344d2
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xe8], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x4344c5
mov dword [ebp - 0xe4], 0x6f3f17e2
mov ecx, dword [ebp - 0x7c]
neg ecx
cmp ecx, dword [ebp - 0x84]
jge 0x4344fa
cmp dword [ebp - 0x7c], eax
je 0x4344fa
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x4344ff
xor ebx, ebx
mov esi, eax
inc ebx
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp esi, ecx
setge dl
cmp edx, 0x3f29c8dd
jl 0x43451b
mov ecx, eax
cmp dword [ebp - 0xe4], eax
je 0x43451d
mov ecx, ebx
mov dword [ebp - 0x24], ecx
xor ebx, ebx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x7c]
add edx, ecx
mov ecx, dword [ebp - 0x7c]
cmp ecx, edx
setl bl
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x43454c
push eax
push eax
push 0x22fb
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
cmp dword [ebp - 0x40], 0
jne 0x43461d
cmp byte [ebp - 0x31], 0
mov ebx, dword [ebp - 0x28]
je 0x43456e
cmp dword [ebp - 0x2c], 1
jne 0x43456e
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x10]
add dword [ecx + 8], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 8]
add edi, 0xc
push ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 8], edi
call fcn.004864c4
mov dword [ebp - 0x24], eax
xor eax, eax
pop ecx
mov dword [ebp - 0xa4], eax
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0xa4]
push eax
push ebx
call fcn.0046783f
mov edi, dword [ebp - 0x74]
xor ecx, ecx
mov esi, ecx
test ebx, ebx
jle 0x4345fa
mov eax, esi
and eax, 0x80000001
jns 0x4345c4
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x18]
add eax, esi
add eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x30]
jmp 0x4345d9
lea eax, [edx + 1]
cdq
idiv ebx
cmp word [edi + edx*2], cx
jne 0x4345d6
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov eax, dword [ebp - 8]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x24]
mov byte [esi + edx], al
inc esi
cmp esi, ebx
jl 0x4345b6
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
mov dword [esi], ebx
mov dword [esi + 4], eax
test edi, edi
je 0x434622
push edi
call fcn.004879d6
pop ecx
xor ecx, ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
jmp 0x434622
mov esi, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0xc], 0x69fdf99f
mov dword [ebp - 0xc], 0xfffffff4
jmp 0x43464c
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x434644
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor ecx, ecx
cmp dword [ebp - 0xc], ecx
jne 0x434652
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffa
jg 0x434632
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret