Function at 0x416a15
Capabilities:
Get keyboard layout
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
push edi
mov edi, ecx
mov dword [ebp - 0xc8], edx
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [edi + 0x10], eax
jne 0x416a38
xor al, al
jmp 0x41859c
push ebx
xor ebx, ebx
push 4
inc ebx
mov dword [ebp - 0x10], ebx
pop edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x34], 0xe0d1
mov dword [ebp - 0x50], 0x748dc164
mov dword [ebp - 0x1c], 0x2f34e401
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x14], 0xfff9
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0xc], eax
jmp 0x416a85
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x304], 0x5eb20068
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x416a74
cmp dword [ebp - 4], eax
je 0x416ab4
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x50]
cmp ecx, 0xfffffff6
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x1c]
cmp edx, 0x380a
mov edx, ebx
setle cl
dec dword [ebp - 0x10]
test ecx, ecx
js 0x416ab6
mov edx, eax
mov ecx, dword [ebp - 0x300]
add ecx, edx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x14], 0xdd3610cb
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x190], 0xdfa860b4
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0x9dbc9b78
mov dword [ebp - 0x18], 0xa938f738
mov dword [ebp - 0x18], 0xcfdfe92
mov byte [ebp - 0x65], al
cmp byte [ebp - 0x65], al
je 0x416b18
push 0x5e9
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
lea ecx, [ebp - 0x190]
call fcn.0041662a
mov dword [ebp - 0x18], 0xe87f6fb8
xor eax, eax
mov dword [ebp - 0x48], 0xe52d
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x24], 0xe9829cbc
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0xc], eax
jmp 0x416b56
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x150], 0xfffffffb
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x416b45
cmp dword [ebp - 0x48], eax
jne 0x416b67
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov ecx, dword [ebp - 0x48]
cmp ecx, 0xfa3a
mov ecx, dword [ebp - 0x48]
push esi
setge dl
push 2
pop esi
sub edx, ecx
je 0x416c5a
push 4
lea ecx, [ebp - 0x204]
call fcn.0040fd61
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0x9c], 0
jmp 0x416bbf
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x204]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], 4
jl 0x416ba6
mov eax, dword [ebp - 0x58]
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x204]
push 2
cmp dword [edx + 4], eax
mov eax, dword [ebp - 0x48]
setg cl
cmp ecx, 0xcc099a56
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x48]
mov esi, dword [ebp - 0x58]
setge cl
xor edx, edx
add ecx, 8
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setne dl
xor ecx, ecx
add edx, 0x7fcc65ad
imul esi, edx
cmp esi, eax
pop esi
setge cl
xor eax, eax
cmp ecx, esi
setne al
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xd0]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x24], eax
call fcn.0040fe33
xor eax, eax
jmp 0x416cd5
mov dword [ebp - 0xa4], 4
xor ebx, ebx
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x58]
cmp edx, ecx
mov edx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xa4]
setne bl
mov dword [ebp - 0x34], ebx
xor ebx, ebx
cmp edx, ecx
setg bl
xor ecx, ecx
neg ebx
cmp ebx, dword [ebp - 0x34]
setne cl
add ecx, 0xbb54
je 0x416cae
cmp dword [ebp - 0xa4], eax
je 0x416cae
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x416cb3
xor ebx, ebx
mov edx, eax
inc ebx
mov ecx, 0xdb9b
sub ecx, edx
sub ecx, dword [ebp - 0x58]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jg 0x416dae
mov esi, 0x12900
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x24]
cmp dword [ebp + ecx*4 - 0x150], ebx
jle 0x416cff
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp + ecx*4 - 0x150]
mov ecx, dword [ebp - 0x24]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x150]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp + ecx*4 - 0x150]
mov ecx, dword [ebp - 0xc]
cmp ecx, 0xebdc
mov ecx, dword [ebp - 0xc]
setne bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0xc]
setg dl
xor ebx, ebx
cmp edx, 0xac07
setne bl
xor edx, edx
cmp ebx, ecx
setg dl
xor ebx, ebx
mov dword [ebp - 0x7c], edx
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + ecx*4 - 0x150]
mov ecx, dword [ebp - 0x7c]
cmp ecx, edx
mov ecx, dword [ebp - 0xc]
setl bl
imul ecx, ebx
test ecx, ecx
jne 0x416e1c
cmp dword [ebp - 0xc], eax
jne 0x416e1c
mov byte [ebp - 5], al
cmp byte [ebp - 5], cl
je 0x416d8f
push 0xe38
push 0x583
push eax
push 0x1348
push eax
call dword [sym.imp.USER32.dll_GetMenuStringW]
xor eax, eax
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x24]
cmp dword [ebp + ecx*4 - 0x150], eax
jne 0x416dab
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x416ce6
push 2
pop esi
mov dword [ebp - 0x18], 0xed7c6ae4
mov dword [ebp - 0x18], 0x403ca955
push 7
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0x57ea0d01
mov dword [ebp - 0x18], 0x44c3f4f8
mov dword [ebp - 0xc], 0x6b9c2d62
mov dword [ebp - 0x50], 0xe5a945cb
mov dword [ebp - 0x14], 0x6c849023
mov dword [ebp - 0x14], 0x5a9c
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x14], 0x8e4c12f6
mov dword [ebp - 0x14], 0x4f6f4846
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], eax
jmp 0x416eb4
xor ebx, ebx
lea ecx, [ebp - 0x1ec]
inc ebx
push ebx
call fcn.0040fd61
mov dword [ebp - 0x34], 0xfff6
mov dword [ebp - 0xac], 0
jmp 0x416e57
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x1ec]
mov dword [eax + ecx*4], 0x77dc9657
inc dword [ebp - 0xac]
cmp dword [ebp - 0xac], ebx
jl 0x416e3e
mov eax, dword [ebp - 0x1ec]
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x150]
mov eax, dword [ebp - 0xc]
add ecx, 0x7801
cmp eax, ecx
setle dl
xor ecx, ecx
imul eax, edx, 0x841a
cmp eax, esi
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x1ec]
call fcn.0040fe33
xor eax, eax
jmp 0x416d92
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x2c4], 8
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x416ea3
mov dword [ebp - 4], eax
jmp 0x416ed0
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x284], 0x93c86992
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x416ebf
cmp dword [ebp - 0x10], eax
jne 0x416f02
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
mov edx, dword [ebp - 0x34]
sub edx, ecx
mov ecx, dword [ebp - 0x2c4]
cmp edx, ecx
mov ecx, 0xc6e20b39
setge bl
sub ecx, ebx
jne 0x416eff
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x416f04
xor ebx, ebx
inc ebx
mov ecx, ebx
inc dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ecx, 0xc130268d
setne dl
sub eax, edx
cmp eax, 0xffffffff
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax, 0x5285
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x2c4], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
sub eax, 0xfffffffa
neg eax
sbb eax, eax
xor ecx, ecx
add eax, 0xfffffff8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setle cl
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0xfffffff9
cmp dword [ebp - 0x10], 0xb
je 0x4179f4
call fcn.004166b8
push esi
lea ecx, [ebp - 0x168]
call fcn.0040fd61
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x18], 0xdc6b79df
call fcn.00412d2c
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xdd8fb8ce
mov dword [ebp - 0x6c], 0xb9f9b31
mov dword [ebp - 0x18], 0x85ffff32
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x18], 0x975a1448
mov dword [ebp - 0x18], 0x2cac2457
mov dword [ebp - 0x18], 0xbdbb389e
mov dword [ebp - 0x6c], eax
jmp 0x4171d2
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xd2c643d4
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 4], eax
jmp 0x417012
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x1e0], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x417005
mov dword [ebp - 4], eax
jmp 0x41702d
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x2d0], 0xc86797b6
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x41701c
mov dword [ebp - 0x64], 0xffffffe3
cmp dword [ebp - 0x64], 0xfffffff5
jg 0x4171cf
push esi
lea ecx, [ebp - 0x1cc]
call fcn.0040fd61
mov dword [ebp - 0x74], 8
xor eax, eax
mov dword [ebp - 0xcc], 0xea311c3f
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x14], 0xfff9
mov dword [ebp - 0x40], eax
jmp 0x417088
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x1cc]
mov dword [ecx + edx*4], 0xf6dd
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jl 0x417075
mov dword [ebp - 0x40], eax
jmp 0x41709f
mov ecx, dword [ebp - 0x40]
mov dword [ebp + ecx*4 - 0x270], ebx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 3
jl 0x417092
mov dword [ebp - 0x74], ebx
cmp dword [ebp - 0x74], eax
jl 0x417116
mov dword [ebp - 0x1b4], 0xffff
lea edx, [ebp - 0x1cc]
mov dword [ebp - 0x180], eax
lea ecx, [ebp - 0x180]
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00415fe4
xor eax, eax
add esp, 0x18
mov byte [ebp - 0x5b], al
cmp byte [ebp - 0x5b], al
je 0x417111
push eax
push eax
push 0x22fe
push 0x1731
push eax
call dword [sym.imp.USER32.dll_ModifyMenuW]
xor eax, eax
dec dword [ebp - 0x74]
jns 0x4170ad
mov ecx, dword [ebp - 0x64]
xor ebx, ebx
dec dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x74], ecx
mov edx, dword [ebp - 0x1e0]
mov ecx, dword [ebp - 0x74]
cmp ecx, edx
mov ecx, dword [ebp - 0x6c]
setg bl
xor edx, edx
cmp ebx, 0x1cd4
setge dl
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 0x1cc]
setne bl
xor edx, edx
cmp ebx, dword [ecx]
setg dl
xor ebx, ebx
mov dword [ebp - 0x2c8], edx
mov ecx, dword [ebp - 0x268]
mov edx, dword [ebp - 0x270]
mov ecx, dword [ebp - 0x1e0]
cmp ecx, edx
mov ecx, dword [ebp - 0xcc]
setne bl
xor edx, edx
cmp ebx, ecx
setge dl
cmp edx, 0xdf100f83
sbb ecx, ecx
neg ecx
add ecx, 0x6cdf50b9
jne 0x4171a5
cmp dword [ebp - 0x18], eax
jne 0x4171a5
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x4171aa
xor ebx, ebx
inc ebx
mov ecx, ebx
xor eax, eax
cmp ecx, 9
lea ecx, [ebp - 0x1cc]
setl al
mov dword [ebp - 0x34], eax
call fcn.0040fe33
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], 0xfffffff5
jle 0x417044
xor eax, eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 6
jg 0x416fe8
mov dword [ebp - 0x104], 5
mov dword [ebp - 0xc], eax
jmp 0x4171fc
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x294], 0xfffffff6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x4171eb
mov byte [ebp - 0x5d], al
cmp byte [ebp - 0x5d], 0
je 0x417223
push 0xdeb
push 0x344
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
xor eax, eax
dec dword [ebp - 0x104]
push eax
lea eax, [ebp - 0x168]
push eax
push 0x7efb
lea eax, [ebp - 0x264]
push eax
push 0x7ed6
call fcn.004186f4
mov dword [ebp - 0x14], 0xb8ee41b
add esp, 0x14
mov dword [ebp - 0x18], 0xe022
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x34], 0xadfb
mov dword [ebp - 0xc], 0
jmp 0x417280
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe8], 0xffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x41726f
mov ecx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0xa22e974a
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov eax, dword [ebp - 0x168]
setg cl
add ecx, 0xad85
mov dword [ebp - 0x34], ecx
mov dword [eax + 4], 0xc
mov eax, dword [ebp - 0x168]
cmp dword [eax + 4], 0xfffffff8
jne 0x4179d9
push 4
pop edi
call fcn.00416785
mov dword [ebp - 0xc], 9
call fcn.00416368
mov dword [ebp - 0x18], 0xfffffff7
lea ecx, [ebp - 0x228]
push edi
call fcn.0040fd61
mov eax, 0xa5d6c05b
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
xor eax, eax
mov dword [ebp - 0x144], eax
jmp 0x41738c
mov dword [ebp - 4], 0x6f5a9c4c
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
jmp 0x417377
mov dword [ebp - 0x1c], 0x65720b96
mov edx, 0xfc429adb
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
sub edx, ecx
add edx, dword [ebp - 0x13c]
mov dword [ebp - 0x1c], edx
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffe3
jge 0x41734e
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x14], ecx
dec dword [ebp - 0x144]
cmp dword [ebp - 0x144], 0xfffffff0
jg 0x41733f
call fcn.0041686a
lea edx, [ebp - 0x228]
lea ecx, [ebp - 0x174]
call fcn.004143ff
call fcn.00416906
mov dword [ebp - 0x44], 0x2db58e46
mov dword [ebp - 0x30], 0x7ad95e17
mov dword [ebp - 0x18], 0xff5f6f59
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x41758c
mov dword [ebp - 4], 0xd72b
mov dword [ebp - 0x1c], 0x44fa7555
mov dword [ebp - 0x14], eax
jmp 0x4173f9
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x8c], 0xb143e95a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x4173e8
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
add ecx, dword [ebp - 0x44]
je 0x417435
cmp dword [ebp - 4], eax
jne 0x417596
jmp 0x417589
mov dword [ebp - 0x14], 0x8317d239
cmp dword [ebp - 0x30], eax
jne 0x417596
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jg 0x417589
push esi
lea ecx, [ebp - 0x1d8]
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0xb4], eax
jmp 0x417487
mov edx, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x1d8]
mov dword [ecx + edx*4], 0x208dd2dc
inc dword [ebp - 0xb4]
cmp dword [ebp - 0xb4], esi
jl 0x41746e
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jg 0x417570
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x8c], eax
je 0x4174a9
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x44]
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1c], edx
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp + ecx*4 - 0x8c]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp + ecx*4 - 0x8c]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp + ecx*4 - 0x8c]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov esi, dword [ebp + ecx*4 - 0x8c]
mov ecx, dword [ebp - 0x1d8]
sub esi, dword [ecx]
mov ecx, dword [ebp - 0x14]
cmp esi, ecx
mov ecx, 0xc65b0b56
sete dl
cmp ecx, edx
mov ecx, dword [ebp - 0x30]
sbb edx, edx
neg edx
mov dword [ebp + ecx*4 - 0x8c], edx
mov ecx, dword [ebp - 0x88]
imul ecx, dword [ebp - 4]
test ecx, ecx
je 0x417537
mov ecx, dword [ebp - 0x1d8]
mov edx, ebx
cmp dword [ecx], eax
jne 0x417539
mov edx, eax
xor ecx, ecx
cmp edx, 0x7a312446
setne cl
xor edx, edx
sub ecx, 0xcc39
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp + ecx*4 - 0x8c]
test ecx, ecx
sete dl
mov dword [ebp - 0x14], edx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x41749b
push 2
pop esi
lea ecx, [ebp - 0x1d8]
call fcn.0040fe33
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jle 0x417451
xor eax, eax
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xfffffff3
jne 0x4173d5
cmp dword [ebp - 0xc], eax
jne 0x4179ce
mov dword [ebp - 0xc], 0xffffffee
cmp dword [ebp - 0xc], 0x31
jne 0x4179a8
jmp 0x4175b4
xor eax, eax
push dword [ebp - 0x174]
movdqa xmm0, xmmword [0xa97d80]
lea ecx, [ebp - 0x294]
push ecx
lea ecx, [ebp - 0x2a4]
mov dword [ebp - 0x14], 0xfd3df75d
push ecx
push eax
lea ecx, [ebp - 0x18c]
mov dword [ebp - 0x18c], eax
movdqu xmmword [ebp - 0x2a4], xmm0
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], eax
call fcn.004114f4
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x41763e
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x80], eax
jmp 0x417623
mov edx, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x18c]
mov dword [ecx + edx*4], 0x937a3a11
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], edi
jl 0x417610
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x41763b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe8
jg 0x417604
lea ecx, [ebp - 0x18c]
call fcn.0040fe33
push edi
lea ecx, [ebp - 0x27c]
call fcn.0040fd61
push esi
lea ecx, [ebp - 0x290]
call fcn.0040fd61
mov dword [ebp - 0xb0], 0xeef20fe6
xor eax, eax
mov dword [ebp - 0x18], 0xad4351cd
mov dword [ebp - 0x4c], eax
jmp 0x417692
mov edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x290]
mov dword [ecx + edx*4], 0x571177e8
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], esi
jl 0x41767f
mov dword [ebp - 0x4c], eax
jmp 0x4176ad
mov ecx, dword [ebp - 0x4c]
mov dword [ebp + ecx*4 - 0x320], 3
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edi
jl 0x41769c
mov dword [ebp - 0xb0], eax
jmp 0x4176d0
mov dword [ebp - 0x108], 0xffffffff
inc dword [ebp - 0x108]
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], ebx
jle 0x4176ba
lea ecx, [ebp - 0x290]
call fcn.0040fe33
mov dword [ebp - 0x100], 0xe7790660
xor eax, eax
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x14], eax
jmp 0x41770b
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x2e4], 0x58e469ad
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x4176fa
mov byte [ebp - 0x6d], al
cmp byte [ebp - 0x6d], al
je 0x41772e
push eax
push 0x15c9
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
inc dword [ebp - 0x110]
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0x27c]
push ecx
push eax
push 0x7ca8
call fcn.004185f1
mov dword [ebp - 0x18], 0x2135
add esp, 0x10
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x120], 0xfffffffc
dec dword [ebp - 0x120]
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x41778d
push 0x25bb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
inc dword [ebp - 0x100]
lea ecx, [ebp - 0x19c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0xb8], 0xfffffff7
push 3
call fcn.0040fd61
mov dword [ebp - 0xc4], edi
lea ecx, [ebp - 0x1c0]
push edi
call fcn.0040fd61
mov dword [ebp - 0x3c], 0xda972737
xor eax, eax
mov dword [ebp - 0x18], 0x320ba2c1
mov dword [ebp - 0x2c], eax
jmp 0x4177eb
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x19c]
mov dword [ecx + edx*4], 0x9ba8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x4177d8
mov dword [ebp - 0x2c], eax
jmp 0x417809
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c0]
mov dword [ecx + edx*4], 0xa9f4f9a0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x4177f6
mov dword [ebp - 0x2c], eax
jmp 0x417824
mov ecx, dword [ebp - 0x2c]
mov dword [ebp + ecx*4 - 0x2f4], 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x417813
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
add ecx, 0xffffd8d8
mov dword [ebp - 0xb8], ecx
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
cmp edx, ecx
setg bl
mov dword [ebp - 0xc4], ebx
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x417956
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x3c], eax
jl 0x417946
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0xb8]
inc edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x1c0]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
add edx, dword [ecx + esi*4]
mov ecx, dword [ebp - 0x19c]
cmp edx, 0xffffffff
mov esi, dword [ebp - 0x18]
setg bl
xor edx, edx
add ebx, dword [ecx + edi*4]
mov ecx, dword [ebp - 0x3c]
imul ecx, ebx
cmp ecx, 0xffff
mov ecx, dword [ebp - 0x19c]
setne dl
sub edx, dword [ecx + esi*4]
cmp edx, dword [ebp - 0x1c]
je 0x417905
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x50]
xor edx, edx
mov dword [ebp - 0xc4], ecx
mov edi, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x1c0]
mov ecx, dword [ebp - 0xc4]
cmp dword [esi + edi*4], ecx
setge dl
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + 4]
mov dword [ebp - 0x2f0], ecx
mov ecx, dword [ebp - 0x3c]
dec dword [ebp - 0x3c]
jns 0x4178a8
push 2
pop esi
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jle 0x417882
push 4
pop edi
lea ecx, [ebp - 0x1c0]
call fcn.0040fe33
lea ecx, [ebp - 0x19c]
call fcn.0040fe33
call fcn.0041647e
push 0x6cf7
lea eax, [ebp - 0x75]
mov byte [ebp - 0x75], 0
push eax
push 0x54e2
push 0
call fcn.00418854
add esp, 0x10
lea ecx, [ebp - 0x27c]
call fcn.0040fe33
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x31
push 1
pop ebx
je 0x4175b2
lea ecx, [ebp - 0x228]
call fcn.0040fe33
mov eax, dword [ebp - 0x168]
dec dword [eax + 4]
mov eax, dword [ebp - 0x168]
cmp dword [eax + 4], 0xfffffff8
je 0x4172f4
jmp 0x4179d9
lea ecx, [ebp - 0x228]
call fcn.0040fe33
lea ecx, [ebp - 0x168]
call fcn.0040fe33
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
jne 0x416f86
mov edi, dword [ebp - 0x20]
push ebx
lea ecx, [ebp - 0x1f8]
call fcn.0040fd61
mov dword [ebp - 0xfc], 0xacc5d9b4
mov dword [ebp - 0x10c], 0xfffffffd
mov dword [ebp - 0x114], 0x28fdeb77
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x11c], 0xe9d60a22
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0xa0], 0
jmp 0x417a5a
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x1f8]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0xa0]
cmp dword [ebp - 0xa0], ebx
jl 0x417a41
mov eax, dword [ebp - 0x1f8]
xor ebx, ebx
mov edx, dword [eax]
test edx, edx
setne bl
xor eax, eax
test edx, edx
sete al
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, edx
mov dword [ebp - 0xfc], ecx
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
sub eax, ebx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x16c], eax
jne 0x417ac4
cmp dword [ebp - 0x11c], 0
jne 0x417ac4
xor ebx, ebx
xor ecx, ecx
inc ebx
jmp 0x417ac9
xor ebx, ebx
inc ebx
mov ecx, ebx
xor eax, eax
cmp ecx, 0x56ee
lea ecx, [ebp - 0x1f8]
setne al
mov dword [ebp - 0x11c], eax
call fcn.0040fe33
xor dl, dl
lea ecx, [ebp - 0xc8]
call fcn.00415aa1
push dword [ebp - 0x1a0]
movdqa xmm0, xmmword [0xa97d80]
lea ecx, [ebp - 0x2a4]
push ecx
xor eax, eax
lea ecx, [ebp - 0x2b4]
push ecx
push eax
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x15c], eax
movdqu xmmword [ebp - 0x2b4], xmm0
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
call fcn.004114f4
mov eax, dword [ebp - 0x15c]
mov dword [eax], 0xf
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x417b57
push 0x132a
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov eax, dword [ebp - 0x15c]
dec dword [eax]
cmp dword [eax], 9
jne 0x417b42
lea ecx, [ebp - 0x15c]
call fcn.0040fe33
mov dword [ebp - 0x84], 0
lea ecx, [ebp - 0x21c]
push 4
call fcn.0040fd61
mov dword [ebp - 0x94], 0
jmp 0x417bab
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x21c]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x94]
cmp dword [ebp - 0x94], 4
jl 0x417b92
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x21c]
push 3
pop esi
mov dword [eax + 4], ecx
mov dword [ebp - 0x84], 0
jmp 0x417bf1
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x417beb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
inc dword [ebp - 0x84]
cmp dword [ebp - 0x84], esi
jle 0x417bd2
lea ecx, [ebp - 0x21c]
call fcn.0040fe33
mov dword [ebp - 0x14], 0
call fcn.004139fc
mov dword [ebp - 0x170], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x10], 0x1a049fe3
mov dword [ebp - 0x10], ecx
jmp 0x417c39
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x118], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x417c28
mov dword [ebp - 0x10], ecx
jmp 0x417c8d
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0xc], ecx
jmp 0x417c85
mov byte [ebp - 0x5c], cl
cmp byte [ebp - 0x5c], 0
je 0x417c6e
push 0x11ee
push ecx
push 0x26ab
push 0x1572
push ecx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + eax*4 - 0x118]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x118], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jle 0x417c4b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jle 0x417c43
mov dword [ebp - 0x14], 0xfffffff2
cmp dword [ebp - 0x14], 0x10
jge 0x417fd5
mov dword [ebp - 0x170], 0x951ad386
mov dword [ebp - 4], 0x3644
mov dword [ebp - 0xc], 0x1b713623
mov dword [ebp - 0x1c], 0x806aa1c3
mov dword [ebp - 0x1c], 0x18ebdb8
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x10], ecx
jmp 0x417ce6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x330], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x417cd9
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, eax
mov eax, dword [ebp - 4]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, eax
setg dl
imul edx, dword [ebp - 4]
cmp edx, 6
je 0x417d17
mov edx, ecx
cmp dword [ebp - 0xc], ecx
je 0x417d19
mov edx, ebx
mov eax, dword [ebp - 4]
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
imul edx, edx, 0xe4bf
cmp edx, eax
setle bl
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], 0x34e401d9
cmp dword [ebp - 0x1c], ecx
je 0x417dd1
mov dword [ebp - 0x20], 0xffffffff
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x20], 0xfffffffe
push 3
mov dword [ebp - 0x20], 0x3f6d1d89
pop esi
mov dword [ebp - 0x20], 0x31137833
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xeb4e5227
push esi
call fcn.0040fd61
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x98], 0
jmp 0x417db6
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x260]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], esi
jl 0x417d9d
dec dword [ebp - 0x134]
lea ecx, [ebp - 0x260]
call fcn.0040fe33
jmp 0x417df5
mov dword [ebp - 0x17c], 0xfffffff6
mov byte [ebp - 0x5a], cl
cmp byte [ebp - 0x5a], 0
je 0x417dec
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor ecx, ecx
push 3
mov dword [ebp - 0x17c], ecx
pop esi
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xf4]
call fcn.0040fd61
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x417e22
mov ecx, dword [ebp - 0x28]
mov dword [ebp + ecx*4 - 0x12c], 0x204e2db5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x417e11
mov dword [ebp - 0x28], eax
jmp 0x417e3f
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xf4]
mov dword [ecx + edx*4], 0x9e57ad95
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x417e2c
mov dword [ebp - 0x28], eax
jmp 0x417e5a
mov ecx, dword [ebp - 0x28]
mov dword [ebp + ecx*4 - 0x250], 0x6b933888
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x417e49
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x417e71
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
mov ecx, dword [ebp - 0xf4]
mov dword [ecx], ebx
mov ecx, dword [ecx]
mov ecx, dword [ebp + ecx*4 - 0x12c]
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ecx]
cmp dword [ebp + ecx*4 - 0x12c], eax
je 0x417ebf
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ecx]
mov ecx, dword [ebp + ecx*4 - 0x12c]
cmp dword [ebp - 0x128], ebx
ja 0x417eb0
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ecx]
mov ecx, dword [ebp + ecx*4 - 0x12c]
mov ecx, dword [ebp - 0xf4]
xor ebx, ebx
mov ecx, dword [ecx]
mov ecx, dword [ebp + ecx*4 - 0x12c]
test ecx, ecx
mov ecx, dword [ebp - 0xf4]
setne bl
xor edx, edx
mov ecx, dword [ecx]
mov ecx, dword [ebp + ecx*4 - 0x12c]
cmp ebx, ecx
setle dl
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24c], 0xffffffff
cmp dword [ebp - 0x24c], eax
jne 0x417f11
mov ecx, dword [ebp - 0xf4]
push 2
pop ebx
dec dword [ecx]
jns 0x417e79
lea ecx, [ebp - 0xf4]
call fcn.0040fe33
xor ebx, ebx
mov byte [ebp - 5], 0
inc ebx
lea ecx, [ebp - 0x234]
push ebx
call fcn.0040fd61
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0xf0b101aa
mov dword [ebp - 0x20], 0xe12aa53f
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x1b0], 0x62b50098
mov dword [ebp - 0x54], 0
jmp 0x417f6d
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x234]
mov dword [eax + ecx*4], 0x7e2799ac
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], ebx
jl 0x417f5a
mov dword [ebp - 0x54], 0
jmp 0x417f8c
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x310], 0xffffffff
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], esi
jl 0x417f7b
lea edx, [ebp - 0x1b0]
lea ecx, [ebp - 0x234]
call fcn.0041618a
lea ecx, [ebp - 0x234]
call fcn.0040fe33
cmp byte [ebp - 5], 0
je 0x417fc5
call fcn.00416502
push 0
call fcn.004188ef
pop ecx
call fcn.00416976
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x10
push 0
pop ecx
jl 0x417ca4
cmp dword [edi + 0x14], 0x10
jb 0x417fdf
mov edx, dword [edi]
jmp 0x417fe1
mov edx, edi
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x130], edx
jb 0x417ff1
mov esi, dword [edi]
jmp 0x417ff3
mov esi, edi
mov eax, dword [edi + 0x10]
add eax, esi
cmp edx, eax
je 0x41854f
mov al, byte [edx]
cmp al, 0x30
jl 0x4184c2
cmp al, 0x39
jg 0x4184c2
mov dword [ebp - 4], 0x643cdf98
mov dword [ebp - 0x10], 0xcc9df78a
push 3
mov dword [ebp - 0x1c], 0x73394210
pop esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], ecx
jmp 0x418043
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe0], 0xc93b4e1
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x418032
mov dword [ebp - 4], ecx
jmp 0x41805f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xc0], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x41804e
mov dword [ebp - 4], ecx
jmp 0x4181ad
mov dword [ebp - 0xc], 0x2b56095d
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xe0]
cmp eax, dword [ebp - 0xe0]
je 0x4180c5
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0xd4]
imul esi, eax, 0xc0bf
mov eax, dword [ebp - 0xdc]
push 3
sub esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xe0]
cmp esi, eax
pop esi
setge dl
dec edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0xc], ecx
jmp 0x4181a1
mov dword [ebp - 0x1c], 0x325cf162
push 5
pop eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
push 0
mov eax, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
sub edx, eax
pop eax
setns al
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 4]
test eax, eax
je 0x418150
mov edx, ebx
cmp dword [ebp - 4], ecx
jne 0x418152
mov edx, ecx
xor eax, eax
cmp edx, 0x8477
setg al
xor edx, edx
cmp eax, 0x457a23a3
mov eax, dword [ebp - 4]
setge dl
xor ebx, ebx
cmp edx, 0xb4ff
setl bl
xor edx, edx
cmp ebx, eax
setl dl
xor ebx, ebx
inc ebx
cmp ebx, edx
sbb eax, eax
add eax, 0x128c
mov dword [ebp - 0x23c], eax
mov edx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe0], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x4180fc
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jle 0x41806d
cmp dword [ebp - 0xc0], ecx
je 0x418221
mov edx, dword [ebp - 4]
xor ebx, ebx
mov eax, dword [ebp - 0xd4]
neg edx
cmp edx, eax
mov eax, dword [ebp - 4]
setne bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0xc0]
sete dl
sub eax, dword [ebp - 0xc0]
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0xc0]
setge bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x10]
setne dl
sub edx, eax
add edx, dword [ebp - 0xbc]
sub edx, 0x86e0daee
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp eax, edx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x10]
jg 0x418221
xor eax, eax
inc eax
jmp 0x418223
mov eax, ecx
mov edx, 0xa760f2f4
cmp edx, eax
sbb eax, eax
xor ebx, ebx
neg eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xbc]
cmp edx, eax
mov eax, dword [ebp - 0xbc]
setg bl
xor edx, edx
cmp ebx, eax
setl dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xd8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xa8], 0xfffffffa
jmp 0x418291
mov byte [ebp - 0x67], cl
cmp byte [ebp - 0x67], 0
je 0x41828b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor ecx, ecx
inc dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 0x1c
jl 0x418273
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x4182ad
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push 2
lea ecx, [ebp - 0x1ac]
call fcn.0040fd61
call fcn.0041628d
mov dword [ebp - 0xc], 0x622ba394
xor eax, eax
mov dword [ebp - 0xc], 0xfcb50bf3
mov dword [ebp - 0x10], eax
jmp 0x4182e5
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x2dc], 0xeac8b13e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4182d4
mov byte [ebp - 0x66], al
cmp byte [ebp - 0x66], al
je 0x418313
push eax
push 0x1986
push 0x7b4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x418329
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x2dc], 0xda0e60f9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x418318
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x18], 0x3fa3c9e4
mov dword [ebp - 0x90], eax
jmp 0x41835d
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x1ac]
mov dword [ecx + edx*4], 6
inc dword [ebp - 0x90]
cmp dword [ebp - 0x90], 2
jl 0x418344
xor ebx, ebx
mov dword [ebp - 0xc], eax
inc ebx
jmp 0x418488
mov dword [ebp - 4], 0x7e17f75
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 4], eax
jmp 0x418466
mov dword [ebp - 0x14], 0x1da622a1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1ac]
cmp dword [ecx + edx*4], eax
jne 0x41846f
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x418463
mov dword [ebp - 0x50], 0x8b15b45b
mov dword [ebp - 0x10], eax
jmp 0x4183c9
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xf8], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4183b8
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1ac]
mov esi, dword [ebp - 0x14]
imul edx, dword [ecx]
mov ecx, dword [ebp - 0xf8]
add esi, edx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov ecx, dword [ebp - 4]
setge dl
imul ecx, edx
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xffffffff
mov ecx, dword [ebp - 4]
setl dl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0xa41b
mov ecx, dword [ebp - 0x1ac]
setg dl
imul edx, dword [ecx]
test edx, edx
je 0x418439
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0xf8]
xor ebx, ebx
mov ecx, dword [ebp - 0x50]
cmp edx, ecx
setge bl
cmp dword [ebp - 0x20], ebx
jle 0x418451
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x18], ebx
dec dword [ebp - 0x14]
jns 0x4183ac
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jle 0x418387
push 0x6110
push eax
push 0x37b6
call fcn.00418681
add esp, 0xc
inc dword [ebp - 0xc]
push 0
pop eax
cmp dword [ebp - 0xc], ebx
jle 0x418371
lea ecx, [ebp - 0x1ac]
call fcn.0040fe33
call fcn.004165b8
mov esi, dword [ebp - 0xc8]
mov edx, dword [ebp - 0x130]
imul ecx, dword [esi], 0xa
movsx eax, byte [edx]
add eax, 0xffffffd0
add eax, ecx
inc edx
mov dword [esi], eax
xor ecx, ecx
jmp 0x417fe1
push 0x4005
lea eax, [ebp - 0xc8]
push eax
push ecx
call fcn.00419590
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x20], 0x9a971867
mov dword [ebp - 0x10], eax
jmp 0x418500
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x210], 0xdb50
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x4184ef
mov ecx, dword [ebp - 0x208]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
je 0x41852a
mov ecx, dword [ebp - 0x208]
mov edx, ebx
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
jne 0x41852c
mov edx, eax
mov ecx, dword [ebp - 0x208]
sub ecx, edx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x59], al
cmp byte [ebp - 0x59], al
je 0x41854b
mov dl, bl
mov ecx, 0x2073
call fcn.00415aa1
xor al, al
jmp 0x41859a
mov dword [ebp - 0x10], ecx
jmp 0x418561
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x254], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x418554
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x418578
push ecx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor ecx, ecx
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x418598
push 0xe38
push 0x583
push ecx
push 0x1348
push ecx
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov al, bl
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret