Function at 0x428953
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0x1cecb457
xor eax, eax
push 6
inc eax
mov byte [ebp - 0x35], dl
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov dword [ebp - 0x10], 0xe356
mov edi, ecx
pop edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x18], ebx
push 3
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x3c], edi
mov dword [ebp - 4], ebx
pop ecx
jmp 0x4289a6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xf8], 0x43046b6e
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x428995
mov dword [ebp - 4], ebx
jmp 0x4289bd
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe0], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x4289b0
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0xf4]
mov dword [ebp - 0xf8], esi
mov eax, dword [ebp - 0xe0]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb edx, edx
inc edx
sub edx, eax
mov eax, dword [ebp - 0xd8]
sub edx, 0x6bc712ba
cmp edx, eax
push 0xfffffffffffffffb
setne cl
xor edx, edx
cmp ecx, 0x32e0c280
pop ecx
setg dl
xor eax, eax
cmp edx, ecx
setg al
xor edx, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0xdc]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xdc]
setne cl
add edx, ecx
imul edx, eax
mov eax, dword [ebp - 0x10]
imul eax, edx
sub esi, eax
mov eax, dword [ebp - 8]
dec dword [ebp - 8]
cmp eax, esi
jle 0x428a58
cmp dword [ebp - 0xf8], ebx
je 0x428a58
xor esi, esi
inc esi
mov edx, esi
jmp 0x428a5d
xor esi, esi
mov edx, ebx
inc esi
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 8]
je 0x428a82
mov eax, dword [ebp - 0x20]
mov ecx, esi
cmp dword [ebp - 0x20], ebx
jne 0x428a84
mov ecx, ebx
xor eax, eax
cmp ecx, 0x6652f521
push 4
setl al
imul eax, dword [ebp - 0xf0]
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x30], 0x5dec4f3f
mov dword [ebp - 0x30], 0xa3dbc56e
mov dword [ebp - 0x2c], 0x2e65251c
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0x5a83d87e
mov dword [ebp - 0x30], 0x5077045b
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x51d77f17
mov dword [ebp - 0x30], 0x8ba5
mov dword [ebp - 8], ebx
jmp 0x428b06
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1e4], 0xfcc1031c
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x428af5
push 2
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x428ba2
mov dword [ebp - 0x30], 0x5735
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x30], 0xb76d6092
mov dword [ebp - 4], ebx
jmp 0x428b42
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x18c], 0xfffffffc
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x428b31
mov dword [ebp - 4], ebx
jmp 0x428b5d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x16c], 0x71d0c0b8
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x428b4c
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x16c]
cmp eax, ecx
mov eax, esi
cmovge eax, ebx
imul eax, eax, 0x1d89
test eax, eax
je 0x428b94
cmp dword [ebp - 0x18c], esi
jg 0x428b94
mov eax, esi
cmp dword [ebp - 0x16c], ebx
jne 0x428b96
mov eax, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x14]
push 4
pop ecx
cmp dword [ebp - 0x14], 0x13
jne 0x428b17
push 3
pop ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], 5
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jmp 0x428bd7
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x74], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x428bcd
mov dword [ebp - 4], ebx
jmp 0x428bf2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe8], 7
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x428be1
cmp dword [ebp - 0x74], ebx
jne 0x428c0d
mov eax, dword [ebp - 0x74]
xor ecx, ecx
inc eax
cmp eax, 0x51af7f3e
setg cl
mov dword [ebp - 0x74], ecx
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x60], eax
mov edx, dword [ebp - 0x20]
neg edx
mov dword [ebp - 0x54], 0x4186
neg edx
sbb edx, edx
xor eax, eax
inc edx
dec dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp edx, 0xfffffff6
mov dword [ebp - 0x74], ecx
setne al
mov dword [ebp - 8], eax
lea eax, [ecx + 0x4186]
cmp eax, dword [ebp - 8]
je 0x428c5f
mov ecx, esi
cmp dword [ebp - 0x74], ebx
jne 0x428c61
mov ecx, ebx
xor eax, eax
test ecx, ecx
setns al
sub eax, dword [ebp - 0x20]
jne 0x428c75
cmp dword [ebp - 0xe4], ebx
je 0x428c7c
mov eax, esi
cmp dword [ebp - 0x70], ebx
jne 0x428c7e
mov eax, ebx
add eax, 4
je 0x428c9c
mov dword [ebp - 0x20], 0xd1ad702c
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
cmp ecx, eax
setle dl
mov dword [ebp - 0x20], edx
jmp 0x428ce9
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 8], 0x7dc07178
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], esi
mov esi, dword [0x4915ec]
xor ecx, ecx
mov dword [ebp - 0x10], 0x5c68ec0a
inc ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x30], esi
mov dword [ebp - 8], ebx
jmp 0x428d1c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x184], 0xa3fda37b
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x428d0b
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0x1b
jl 0x428e76
push 0xfffffffffffffffb
pop edi
mov dword [ebp - 0x20], edi
push 2
mov dword [ebp - 0x2c], 0x1521fafb
mov dword [ebp - 4], ebx
pop edx
jmp 0x428d50
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x100], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x428d43
mov dword [ebp - 4], ebx
jmp 0x428d6b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xcc], 0xfffffffd
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x428d5a
mov dword [ebp - 0xc8], ebx
jmp 0x428e30
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
jl 0x428e2a
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x10], ebx
jne 0x428d9a
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc8]
push 0
mov eax, dword [ebp + eax*4 - 0x100]
mov dword [ebp - 4], 0xf2d6273
mov eax, dword [ebp - 4]
sub eax, 0xdb84c6a3
neg eax
sbb eax, eax
inc eax
cmp eax, 0xc869b7d6
sbb eax, eax
inc eax
cmp eax, 7
mov eax, dword [ebp - 0xfc]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ebx, ebx
sub eax, edx
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp + eax*4 - 0x100]
test eax, eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
sete bl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xc8]
setge dl
xor ecx, ecx
imul edx, ebx
pop ebx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x24]
jns 0x428d8f
xor ecx, ecx
inc ecx
inc dword [ebp - 0xc8]
cmp dword [ebp - 0xc8], ecx
jle 0x428d7c
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 0xffffffff
je 0x428e66
mov byte [ebp - 9], bl
cmp byte [ebp - 9], 0
je 0x428e5a
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffff
jne 0x428e45
xor ecx, ecx
inc ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1b
jge 0x428d31
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 4], ebx
jmp 0x428e9d
mov dword [ebp - 0x20], 0x2afe2499
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x428e95
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x14]
jns 0x428e8a
cmp dword [ebp - 0x20], ebx
jne 0x428ea3
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff9
je 0x428e7b
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x10], 0x3d2d
mov dword [ebp - 0x18], 0x34bd
mov dword [ebp - 0x14], 0x5a165f5c
mov dword [ebp - 0x20], 0x4694486c
mov dword [ebp - 8], 6
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x18], 0x7a051aaf
push 2
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
mov dword [ebp - 8], ecx
pop edx
jmp 0x428f1e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x9c], 0xa0cd95ff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x428f0d
mov dword [ebp - 0x10], ecx
jmp 0x428f39
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9c], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x428f28
cmp dword [ebp - 0x14], ecx
jne 0x428f8c
mov eax, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x174], edx
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, 0xa
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 5
neg ecx
sbb ecx, ecx
add ecx, 0xffff4a3a
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setg al
cmp eax, dword [ebp - 0x20]
jg 0x428f8c
xor ecx, ecx
jmp 0x428f8f
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x98]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp byte [ebp - 0x35], 0
mov dword [ebp - 0x2c], ecx
je 0x42904f
xor edx, edx
inc edx
cmp esi, edx
jne 0x42904f
mov dword [ebp - 0x20], 0xffffffff
xor ecx, ecx
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 8], ecx
jmp 0x428ff1
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x4c], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x428fe7
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], 0x1a
jg 0x42901d
mov byte [ebp - 9], cl
cmp byte [ebp - 9], 0
je 0x429011
call dword [sym.imp.USER32.dll_GetCapture]
xor ecx, ecx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x1a
jle 0x429000
xor edx, edx
inc edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov dword [ebx + 8], 4
mov dword [ebx + 0xc], 0x4915ec
xor ecx, ecx
cmp edi, esi
jge 0x429c27
mov dword [ebp - 0x24], 0x2c03342e
xor esi, esi
mov dword [ebp - 0x2c], 5
inc esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x34], 0xe55b65ab
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x34], 0xfffffffa
push 2
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
pop edx
jmp 0x42909e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x88], 0xc69a
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x42908d
mov dword [ebp - 4], ecx
jmp 0x4290b9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x19c], 0x9934b0b4
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x4290a8
mov dword [ebp - 0x24], 0x1b
jmp 0x429125
mov dword [ebp - 8], 0xc4530722
cmp dword [ebp - 0x84], ecx
jne 0x42912b
mov dword [ebp - 8], ecx
jmp 0x42911c
mov byte [ebp - 9], cl
cmp byte [ebp - 9], 0
je 0x429119
push 0xad4
push 0x22fd
push 0x1cc6
push 0x1f99
push 0x1d3e
push 0x2017
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
xor ecx, ecx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe4
jge 0x4290dc
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x12
jle 0x4290c8
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x84], ecx
jne 0x42917c
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x14]
test eax, eax
jne 0x42917c
cmp dword [ebp - 0x20], ecx
je 0x42914b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x190]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, 0x5f17
setle cl
xor edx, edx
mov dword [ebp - 0x190], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x24], eax
jne 0x429182
mov eax, dword [ebp - 0x194]
mov eax, dword [ebp - 0x84]
mov ebx, 0x4915f0
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], ebx
test edi, edi
jle 0x42968f
mov edi, dword [ebx]
mov dword [ebp - 4], 0xffffffff
push 2
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x2c], edi
mov dword [ebp - 8], ecx
pop edx
jmp 0x4291d2
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x14c], 0x74b28ed4
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x4291c1
mov dword [ebp - 4], 4
cmp dword [ebp - 4], 0xfffffff0
je 0x429282
push 0xfffffffffffffffd
pop edi
mov dword [ebp - 8], 0x4ea6801f
mov dword [ebp - 0x40], 9
cmp dword [ebp - 8], ecx
jne 0x429264
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
neg esi
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp - 8]
sbb esi, esi
xor ecx, ecx
neg esi
cmp edx, eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
jne 0x42922d
cmp dword [ebp - 4], ebx
jne 0x42922d
mov ecx, ebx
jmp 0x429230
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 4]
add eax, ecx
imul eax, eax, 0xfffffff7
cmp edi, eax
sbb eax, eax
xor edx, edx
neg eax
sub eax, dword [ebp - 4]
cmp esi, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor esi, esi
add ecx, 0x4579
jne 0x429261
mov eax, ecx
inc esi
jmp 0x429266
xor ecx, ecx
inc esi
mov eax, esi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff0
jne 0x4291eb
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14c]
add ebx, 4
mov dword [ebp - 4], eax
mov eax, 0x6eb81f94
mov dword [ebp - 4], 0xfffffffc
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x20], 0x90031234
mov dword [ebp - 0x50], 3
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 4], 0x1d
cmp dword [ebp - 4], 0xb
mov dword [ebp - 0x24], ebx
jg 0x42952e
push 0xfffffffffffffffb
xor ebx, ebx
pop edi
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x28], 0x40d8eb8a
cmp dword [ebp - 0x1c], ebx
je 0x429320
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
neg edx
cmp edx, eax
setle cl
cmp dword [ebp - 0x1c], ecx
je 0x429361
cmp dword [ebp - 0x1c], ebx
je 0x429361
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x429356
push 0x7a8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp dword [ebp - 0x14], ebx
jne 0x429519
jmp 0x4293cc
mov dword [ebp - 0x18], 0xc0b333ee
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setl dl
xor ecx, ecx
mov dword [ebp - 0xa4], edx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
cmp eax, 0xd9ca
setl cl
cmp ecx, 0xfffffff7
jne 0x4293a3
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x4293a5
mov eax, esi
xor ecx, ecx
cmp eax, 0xce57
mov eax, dword [ebp - 4]
sete cl
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
add edx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setl cl
imul eax, ecx, 0xfffffffa
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
jmp 0x42950f
mov dword [ebp - 0x18], 0xf75bae5b
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], 4
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 8], ebx
jmp 0x429402
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1a8], 0x44351d5e
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4293f1
cmp dword [ebp - 0x14], ebx
jne 0x429413
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], 9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
dec eax
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp eax, 0xe384c83b
setne cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
sub eax, 0x2b50d22
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0xaa4b6d8d
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp edi, ecx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], esi
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa4]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x28], ebx
jmp 0x429506
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x4294d2
push ebx
push 0x34a
push 0x10d9
push 0xace
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x10], 0xffffffe7
jmp 0x4294fd
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x4294fa
push ebx
push 0x2ef
push ebx
push 0x3d4
push 0x15a2
call dword [sym.imp.GDI32.dll_ExtCreatePen]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x12
je 0x4294db
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 5
jl 0x4294b2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
jg 0x4293d4
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xb
jle 0x4292f4
mov ebx, dword [ebp - 0x24]
xor ecx, ecx
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebx]
mov dword [ebp - 4], 8
mov dword [ebp - 8], ecx
jmp 0x42954d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1c8], 0x3342
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x42953c
mov dword [ebp - 4], 3
cmp dword [ebp - 4], ecx
jl 0x4295f9
xor ebx, ebx
mov dword [ebp - 8], ebx
jmp 0x42957b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x10c], 0xaed23b61
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x42956a
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x4295ad
push 0xebe
push ebx
push 0xc8c
push 0x270f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
mov dword [ebp - 0x10c], ebx
jmp 0x4295e2
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x4295dc
push ebx
push 0x6cd
push 0x287
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
inc dword [ebp - 0x10c]
cmp dword [ebp - 0x10c], 3
jle 0x4295b5
dec dword [ebp - 4]
jns 0x429565
mov ebx, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x42960f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1c8], 0xb1a9
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x4295fe
add ebx, 4
mov dword [ebp - 4], ecx
jmp 0x42962a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1d8], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x42961d
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 4
jge 0x42964f
push 0xfffffffffffffffd
pop edx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x11c], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x42963c
mov dword [ebp - 0x114], ecx
jmp 0x42966e
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x1d8], 0xcba2afe0
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 4
jl 0x429657
test esi, esi
jne 0x42967e
add ebx, 8
add ebx, edi
dec dword [ebp - 0x3c]
push 1
mov dword [ebp - 0x24], ebx
pop esi
jne 0x4291a6
mov dword [ebp - 0x10], 0x5c68ec0a
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], 8
mov dword [ebp - 8], ecx
jmp 0x4296b6
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x180], 0xa3fda37b
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4296a5
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x1b
jl 0x42980b
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x2c], eax
push 2
mov dword [ebp - 0x34], 0x1521fafb
mov dword [ebp - 4], ecx
pop edx
jmp 0x4296ea
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd4], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x4296dd
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 4
jge 0x42970e
push 0xfffffffffffffffd
pop edx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xbc], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x4296fb
mov dword [ebp - 0xb8], ecx
jmp 0x4297ca
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], ecx
jl 0x4297c4
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x10], ecx
jne 0x429737
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xb8]
push 0
mov eax, dword [ebp + eax*4 - 0xd4]
mov dword [ebp - 4], 0xf2d6273
mov eax, dword [ebp - 4]
sub eax, 0xdb84c6a3
neg eax
sbb eax, eax
inc eax
cmp eax, 0xc869b7d6
sbb eax, eax
inc eax
cmp eax, 7
mov eax, dword [ebp - 0xd0]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
xor ebx, ebx
sub eax, edx
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp + eax*4 - 0xd4]
test eax, eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
sete bl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xb8]
setge dl
xor ecx, ecx
imul edx, ebx
cmp edx, eax
setne cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x28]
pop ecx
jns 0x42972c
inc dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], esi
jle 0x429719
mov dword [ebp - 4], ecx
jmp 0x4297f5
mov byte [ebp - 9], cl
cmp byte [ebp - 9], 0
je 0x4297f2
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffff
jne 0x4297db
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1b
jge 0x4296c8
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 4], ecx
jmp 0x429832
mov dword [ebp - 0x2c], 0x2afe2499
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ecx
jl 0x42982a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x14]
jns 0x42981f
cmp dword [ebp - 0x2c], ecx
jne 0x429838
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff9
je 0x429810
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
mov dword [ebp - 0x24], 3
push 2
mov dword [ebp - 0x34], 0x8af8716b
mov dword [ebp - 8], ecx
pop edx
jmp 0x429864
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x124], 0x97515801
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x429853
mov byte [ebp - 9], cl
cmp byte [ebp - 9], 0
je 0x42987c
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 2
pop edx
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x24]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x124], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x124]
imul eax, dword [ebp - 0x24], 0x713e
cmp eax, 0x2509e71b
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
xor edx, edx
imul ecx, dword [ebp - 0x24]
inc edx
add ebx, 8
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0xf5fa3187
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x28], edx
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], eax
jge 0x429912
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x80], 0x4a8c
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4298fe
mov dword [ebp - 0x1c], ecx
jmp 0x429928
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x80], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x429917
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
cmp eax, 0x1da7bc99
mov eax, dword [ebp - 0x7c]
push 4
setne cl
sub eax, ecx
neg eax
pop ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, ecx
je 0x429984
mov dword [ebp - 0x34], 0xb382e580
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0x25739271
mov dword [ebp - 0x34], 0xfffffff6
inc dword [ebp - 0x28]
jmp 0x429b37
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x10], 0xee83adeb
mov dword [ebp - 0x28], 6
cmp dword [ebp - 0x28], 0x34
jge 0x429b37
xor ebx, ebx
mov dword [ebp - 0x18], ebx
xor edx, edx
mov dword [ebp - 0x14], 0xde5156be
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setle dl
xor ecx, ecx
add edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
neg edx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor ebx, ebx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
neg eax
jne 0x429a07
cmp dword [ebp - 0x18], ebx
jne 0x429a07
mov eax, ebx
jmp 0x429a0a
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x18]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 4]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 8], ecx
mov dword [ebp - 8], 0xffffffea
jmp 0x429b1a
mov dword [ebp - 0x34], 0xfffc
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 2
jg 0x429b14
mov dword [ebp - 0x18], 0x6a332e52
xor edx, edx
mov dword [ebp - 0x40], 0x6306
mov dword [ebp - 0x2c], 0x7c93e255
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
push 2
setl dl
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], ebx
pop eax
jmp 0x429aff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jl 0x429afc
mov dword [ebp - 0x50], 0xe7d1c2b1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x80], ecx
mov eax, dword [ebp - 0x18]
neg eax
je 0x429a9e
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, 0x2b9a
setl cl
sub ecx, 0x44b1310
mov dword [ebp - 0x50], ecx
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0x40]
cmp eax, 9
setne cl
cmp ecx, 1
sbb eax, eax
neg eax
sub eax, edx
xor edx, edx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
mov dword [ebp - 0x20], edx
dec dword [ebp - 0x14]
jns 0x429a7f
push 2
pop eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x429a77
inc dword [ebp - 4]
cmp dword [ebp - 4], eax
jle 0x429a47
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff6
jge 0x429a33
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x34
jl 0x4299a5
mov ebx, dword [ebp - 0x24]
xor edx, edx
inc edx
test edi, edi
jne 0x429c22
cmp byte [ebp - 0x35], 0
je 0x429b53
cmp dword [ebp - 0x30], edx
jne 0x429b53
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [ebx]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 4]
add ebx, 8
push esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], ebx
call fcn.0046a7d1
mov dword [ebp - 0x2c], eax
xor eax, eax
pop ecx
mov dword [ebp - 0xec], eax
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0xec]
push eax
push esi
call fcn.0044f1ec
mov edi, dword [ebp - 0x94]
xor ecx, ecx
test esi, esi
jle 0x429bf6
mov eax, ecx
and eax, 0x80000001
jns 0x429bb5
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x30]
add eax, ecx
add eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x34]
cdq
idiv esi
xor eax, eax
cmp word [edi + edx*2], ax
je 0x429be1
xor ebx, ebx
lea eax, [edx + 1]
cdq
idiv esi
cmp word [edi + edx*2], bx
jne 0x429bd2
mov ebx, dword [ebp - 0x24]
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov al, byte [edx + ebx]
mov edx, dword [ebp - 0x2c]
mov byte [ecx + edx], al
inc ecx
cmp ecx, esi
jl 0x429ba7
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
mov dword [ebx], esi
mov dword [ebx + 4], eax
test edi, edi
je 0x429c25
push edi
call fcn.0046bcc6
pop ecx
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], ecx
jmp 0x429c27
mov ebx, dword [ebp + 8]
xor ecx, ecx
push 2
xor esi, esi
mov dword [ebp - 0x1c], 0xba76aabe
mov dword [ebp - 0x18], ecx
inc esi
pop edx
cmp dword [ebp - 0x18], edx
jge 0x429c48
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x68], esi
inc dword [ebp - 0x18]
jmp 0x429c37
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x68], eax
cmp eax, dword [ebp - 0x1c]
jne 0x429d40
mov dword [ebp - 0x3c], 0x3a3dbc56
mov dword [ebp - 0x18], ecx
jmp 0x429c74
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1b8], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x429c63
mov dword [ebp - 0x1c], 0xfffffff3
cmp dword [ebp - 0x1c], 0x3c
je 0x429d18
xor ebx, ebx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x30], 0x86fa
mov dword [ebp - 0x34], 7
cmp dword [ebp - 0x1c], ebx
jne 0x429cad
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
jne 0x429cbe
mov edx, ebx
cmp dword [ebp - 0x64], ebx
je 0x429cc0
mov edx, esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x1b8], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x68]
sub eax, 0x5c2f1fcc
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x30]
jg 0x429cf2
mov eax, esi
cmp dword [ebp - 0x34], ebx
jne 0x429cf4
mov eax, ebx
cmp eax, 0xfff9
sbb eax, eax
neg eax
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x3c
jne 0x429c8d
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x429dab
push 0xd83
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
jmp 0x429dab
mov eax, 0x2606
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov byte [ebp - 9], cl
cmp byte [ebp - 9], 0
je 0x429d73
push ecx
push 0xf2b
push ecx
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
mov dword [ebp - 0x1c], 0xffffffea
cmp dword [ebp - 0x1c], 9
jge 0x429dab
xor ebx, ebx
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x429d99
push esi
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
dec dword [ebp - 0x12c]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 9
jl 0x429d82
mov ebx, dword [ebp + 8]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret