Function at 0x44d259
Capabilities:
Create process on windows
Get keyboard layout
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x474
push ebx
mov dword [esp + 0x10], 0x86cce57b
xor eax, eax
push esi
mov dword [esp + 0x18], 0x6e28
push edi
mov dword [esp + 0x3c], edx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0xc], eax
jmp 0x44d29b
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x9c], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x44d288
mov dword [esp + 0x18], 0xa0256915
push 1
pop edx
cmp dword [esp + 0x18], eax
jne 0x44d2c3
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, eax
jmp 0x44d2c5
mov ecx, edx
mov dword [esp + 0xa4], ecx
mov edi, dword [esp + 0xa4]
mov esi, dword [esp + 0xa4]
neg edi
mov ecx, dword [esp + 0xa8]
sbb edi, edi
add esi, 0x501bb0b
neg edi
neg esi
push 0xfffffffffffffffd
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
pop ecx
sete dl
cmp ecx, edx
mov ecx, dword [esp + 0x1c]
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setg dl
xor ecx, ecx
cmp edx, 0x7c5c6a81
setle cl
xor edx, edx
imul ecx, dword [esp + 0xa4]
cmp edi, ecx
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.USER32.dll_GetDC]
setne dl
sub edx, 0x99e68fc7
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [esp + 0xa4]
setge bl
xor edx, edx
add ebx, 0x2c7e
cmp ebx, ecx
setle dl
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], eax
je 0x44d55d
mov dword [esp + 0x30], 0xffffffff
xor ebx, ebx
mov dword [esp + 0x44], eax
inc ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], 0xb862
mov dword [esp + 0xc], eax
jmp 0x44d398
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x464], 9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x44d385
mov dword [esp + 0x18], eax
jmp 0x44d543
mov dword [esp + 0x34], 0xa44bab92
mov dword [esp + 0x48], 0x98c53483
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 3
jg 0x44d53f
push 2
lea ecx, [esp + 0x180]
call fcn.0041796c
mov dword [esp + 0xc], 0
jmp 0x44d3f5
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x17c]
mov dword [eax + ecx*4], 5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x44d3df
mov esi, dword [esp + 0x17c]
mov dword [esi], 3
push ebx
lea ecx, [esp + 0x198]
call fcn.0041796c
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x44d434
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x194]
mov dword [ecx + edx*4], 0xf0936a74
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jl 0x44d41e
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
mov ecx, dword [esp + ecx*4 + 0x9c]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
cmp ecx, edx
mov ecx, dword [esp + 0x48]
setne bl
xor edx, edx
cmp ebx, ecx
setge dl
xor ecx, ecx
add edx, 0x138d7ef
cmp edx, 0x78356026
setne cl
xor ebx, ebx
cmp ecx, 0xfd57
mov ecx, dword [esp + 0x1c]
setle bl
xor edx, edx
mov ecx, dword [esp + ecx*4 + 0x9c]
cmp ebx, ecx
mov ecx, dword [esp + 0x1c]
setl dl
cmp edx, dword [esp + ecx*4 + 0x9c]
jne 0x44d4a7
cmp dword [esp + 0x30], eax
je 0x44d4a7
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x44d4ac
xor ebx, ebx
mov ecx, eax
inc ebx
xor edx, edx
cmp ecx, 0x98a80146
mov ecx, dword [esp + 0x18]
setne dl
mov dword [esp + ecx*4 + 0x9c], edx
mov ecx, dword [esp + 0x194]
mov dword [ecx], edx
lea ecx, [esp + 0x194]
cmp dword [esi + 4], eax
jne 0x44d4ed
call fcn.00417a3e
mov eax, dword [esp + 0x17c]
dec dword [eax]
jns 0x44d409
jmp 0x44d4f2
call fcn.00417a3e
mov byte [esp + 0x2b], 0
cmp byte [esp + 0x2b], 0
je 0x44d522
push 0x150c
push 0x2431
push 0x168d
push 0x1b2d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
lea ecx, [esp + 0x17c]
call fcn.00417a3e
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x44d3c7
xor eax, eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x44d3a8
inc dword [esp + 0x40]
xor esi, esi
inc esi
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x44d59a
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xa4], ecx
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], al
je 0x44d552
push eax
push eax
push eax
push eax
push 0x1f26
xor esi, esi
inc esi
push esi
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x44d555
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x470], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x44d58b
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], al
je 0x44d5bd
push 0x5c8
push 0x1857
call dword [sym.imp.USER32.dll_SetCaretPos]
xor eax, eax
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], 0
je 0x44d5d5
push eax
push eax
push 0x1c50
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov dword [esp + 0x24], 0x6df37d45
lea ecx, [esp + 0x2c0]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x48], 0xdbf4
mov dword [esp + 0x50], 0xf402
mov dword [esp + 0x38], 0xff74f57b
push esi
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x34], 0x4b505d01
mov dword [esp + 0x10], eax
jmp 0x44d625
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x328], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x44d616
mov dword [esp + 0x10], eax
jmp 0x44d644
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c0]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x44d632
mov dword [esp + 0x2c], eax
jmp 0x44d71d
mov dword [esp + 0x1c], 0x70ade21
mov dword [esp + 0x30], 0xc1dfe936
mov dword [esp + 0xc], eax
jmp 0x44d678
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0xac], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x44d669
mov dword [esp + 0x1c], eax
jmp 0x44d708
mov dword [esp + 0x40], 5
xor ebx, ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 4
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + ecx*4 + 0x328]
imul ecx, dword [esp + 0x2c]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
cmp edx, ecx
setg bl
imul edx, ebx, 0xf4f8
add edx, 3
imul edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x40]
lea ecx, [ecx + edx*4]
xor edx, edx
cmp ecx, 0xfffffff7
setle dl
xor ebx, ebx
add edx, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
cmp edx, ecx
setg bl
mov dword [esp + 0xac], ebx
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0xac]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x44d687
cmp dword [esp + 0x48], eax
jne 0x44d728
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 5
jge 0x44d653
cmp dword [esp + 0x328], eax
jne 0x44d773
mov eax, dword [esp + 0x50]
xor edx, edx
add eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x2c0]
mov ecx, dword [esp + 0x328]
mov dword [eax], 0xe256654e
mov eax, dword [esp + 0x38]
cmp eax, ecx
mov eax, dword [esp + 0x2c]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x34], 6
lea ecx, [esp + 0x2c0]
call fcn.00417a3e
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x40], 0xfffffffd
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x48], 0x425a33ed
mov dword [esp + 0x10], eax
jmp 0x44d7be
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xec], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x44d7ab
mov dword [esp + 0x10], eax
jmp 0x44d7da
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x1c4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x44d7cb
cmp dword [esp + 0xec], eax
je 0x44d92f
mov dword [esp + 0x1c], 0x880e033c
mov dword [esp + 0x30], 0xfffffff8
mov dword [esp + 0xc], esi
mov dword [esp + 0x30], 0xcd021aa2
mov dword [esp + 0x38], 9
mov dword [esp + 0x34], 0xffffffff
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], al
je 0x44d837
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor eax, eax
cmp dword [esp + 0x1c], eax
jne 0x44d844
mov ecx, dword [esp + 0xec]
mov ecx, dword [esp + 0xec]
xor ebx, ebx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
cmp edx, ecx
setg bl
sub ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0xf0]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [esp + 0x34], ebx
xor ebx, ebx
cmp ecx, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
setne bl
xor edx, edx
cmp ecx, ebx
setle dl
mov dword [esp + 0x30], edx
mov edx, 0xafd47030
mov ecx, dword [esp + 0x30]
cmp edx, ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0xc]
cmp ecx, edx
setne bl
xor ecx, ecx
mov dword [esp + 0xc], ebx
mov edx, dword [esp + 0xc]
neg edx
add edx, edx
cmp edx, 0x69376522
setl cl
xor edx, edx
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
mov eax, dword [esp + 0xec]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x1c4], ecx
cmp ecx, dword [esp + 0x1c]
jle 0x44d90c
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x1c4]
xor ecx, ecx
mov eax, dword [esp + 0xec]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x48]
cmp eax, esi
setl cl
mov dword [esp + 0x34], ecx
jmp 0x44d972
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], al
je 0x44d94f
push 0x2055
push eax
push eax
push eax
push 0x8ad
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
mov dword [esp + 0x2c], eax
jmp 0x44d96c
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], 0
je 0x44d968
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor eax, eax
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], esi
jle 0x44d955
push 3
lea ecx, [esp + 0x294]
call fcn.0041796c
push 2
lea ecx, [esp + 0x174]
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x1c], 0x9bdba76a
mov dword [esp + 0xc], eax
jmp 0x44d9b4
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x170]
mov dword [ecx + edx*4], 0xfffffff7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x44d99e
mov dword [esp + 0x1c], eax
jmp 0x44da4a
mov dword [esp + 0xc], eax
jmp 0x44d9dd
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x408], 0xfffffff9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x44d9ca
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov edx, dword [esp + 0x170]
mov ecx, dword [esp + 0x1c]
cmp dword [edx + esi*4], ecx
sete bl
mov dword [esp + 0x40c], ebx
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x170]
mov dword [esp + 0x34], ebx
xor ebx, ebx
mov ecx, dword [edx + ecx*4]
cmp ecx, dword [edx + esi*4]
setl bl
cmp ebx, dword [esp + 0x34]
je 0x44da94
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], 0
je 0x44da43
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
xor esi, esi
inc esi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jle 0x44d9c4
lea ecx, [esp + 0x170]
call fcn.00417a3e
mov dword [esp + 0x30], 0xdca27289
xor eax, eax
mov dword [esp + 0x10], 0xfffffffc
mov dword [esp + 0xc], 0x65786371
mov dword [esp + 0x38], esi
mov dword [esp + 0x20], 5
mov dword [esp + 0x2c], 4
mov dword [esp + 0xc], eax
jmp 0x44dadc
xor esi, esi
inc esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x2c], eax
jmp 0x44dac0
mov dword [esp + 0x34], 0x7f451d52
xor ebx, ebx
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
cmp edx, ecx
setle bl
mov dword [esp + 0x34], ebx
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0x10
jne 0x44daa1
jmp 0x44da46
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x5c], 0xc3099cf
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x44dacc
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], al
je 0x44db00
push 0x1690
push eax
push eax
push 0x3d3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor eax, eax
cmp dword [esp + 0x10], eax
je 0x44db2a
mov ecx, dword [esp + 0x10]
mov edx, esi
mov dword [esp + 0xc], 3
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x10]
jmp 0x44db2c
mov edx, eax
xor ecx, ecx
cmp edx, 0xe7ad53a3
setne cl
xor ebx, ebx
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
cmp ecx, edx
mov esi, dword [esp + 0x10]
setne bl
mov dword [esp + 0x5c], esi
mov ecx, dword [esp + 0x10]
sub ebx, 0x711db608
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, ecx
setge dl
xor ecx, ecx
cmp edx, 0x95f7
setle cl
xor ebx, ebx
cmp esi, ecx
jg 0x44dc0e
mov dword [esp + 0x1c], 0x9b95520
mov dword [esp + 0x38], 0x4b13b106
mov dword [esp + 0x30], 7
mov dword [esp + 0x34], 4
dec dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
imul ecx, dword [esp + 0x1c]
cmp ecx, 8
mov ecx, dword [esp + 0x1c]
setge bl
xor edx, edx
cmp ecx, ebx
setge dl
xor ebx, ebx
mov dword [esp + 0x38], edx
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x5c]
cmp ecx, edx
mov ecx, dword [esp + 0x30]
setge bl
xor edx, edx
sub ebx, ecx
mov ecx, dword [esp + 0x2c]
cmp ebx, ecx
setg dl
cmp dword [esp + 0x5c], edx
jl 0x44dc02
cmp dword [esp + 0x38], eax
je 0x44dc02
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x44dc05
xor ebx, ebx
inc ebx
mov dword [esp + 0x20], eax
jmp 0x44dcaf
mov dword [esp + 0x18], 0xbbb30732
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0xc]
cmp edx, ecx
mov ecx, dword [esp + 0x18]
setl bl
xor edx, edx
cmp ebx, ecx
sete dl
neg edx
mov dword [esp + 0x5c], edx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
neg edx
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, ecx
mov ecx, dword [esp + 0x20]
sete bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ebx, ebx
mov dword [esp + 0x2c], edx
inc ebx
mov ecx, dword [esp + 0x18]
xor edx, edx
cmp ecx, ebx
setge dl
mov dword [esp + 0x18], edx
mov dword [esp + 0x18], 0x19
jmp 0x44dca8
mov dword [esp + 0x10], eax
jmp 0x44dc9e
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x5c], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x44dc8e
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffffb
jl 0x44dc88
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x164]
mov dword [esp + 0x30], 0xfffffff7
push 2
call fcn.0041796c
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x29c]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x30], ebx
mov dword [esp + 0x48], 0x68da
push ebx
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x44dd10
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x164]
mov dword [ecx + edx*4], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x44dcfa
mov dword [esp + 0x10], eax
jmp 0x44dd33
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x29c]
mov dword [ecx + edx*4], 3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x44dd1d
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
jg 0x44de9c
push dword [esp + 0x78]
movdqa xmm0, xmmword [0xa6cc80]
lea ecx, [esp + 0x3c0]
push ecx
lea ecx, [esp + 0x3b4]
mov dword [esp + 0x154], eax
push ecx
push eax
lea ecx, [esp + 0x15c]
mov dword [esp + 0x160], eax
movdqu xmmword [esp + 0x3bc], xmm0
mov dword [esp + 0x164], eax
call fcn.00419199
mov dword [esp + 0x34], 0xea5d
xor ecx, ecx
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x164]
cmp dword [edi + eax*4], 0x7ab6dad8
mov edx, dword [edi + edx*4]
setne cl
add edx, 0xfffd
sub edx, ecx
neg edx
sbb edx, edx
xor eax, eax
add edx, 5
imul edx, dword [edi + esi*4]
cmp dword [edi + ebx*4], edx
setl al
xor edx, edx
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x164]
cmp dword [ecx + esi*4], eax
mov eax, 0x9e3d3b0c
sete dl
cmp eax, edx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x5d76270
mov eax, dword [esp + 0x164]
setg cl
add ecx, dword [eax + edi*4]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14c]
mov dword [eax], ecx
imul eax, dword [esp + 0x10], 0x2d5f
test eax, eax
jne 0x44de35
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x34]
xor eax, eax
cmp dword [esp + 0x48], eax
jne 0x44de4e
cmp dword [esp + 0xc], eax
jne 0x44de4e
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x44de53
xor ebx, ebx
inc ebx
mov edx, ebx
mov ecx, dword [esp + 0x29c]
mov dword [ecx], edx
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], al
je 0x44de79
push eax
push 0x20bd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
lea ecx, [esp + 0x14c]
call fcn.00417a3e
inc dword [esp + 0x10]
push 0
pop eax
cmp dword [esp + 0x10], ebx
jle 0x44dd47
mov edi, dword [sym.imp.USER32.dll_GetDC]
lea ecx, [esp + 0x29c]
call fcn.00417a3e
lea ecx, [esp + 0x164]
call fcn.00417a3e
mov dword [esp + 0x34], 0xffffffff
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xece3051e
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x34], 0x1521fafb
mov dword [esp + 0xc], eax
jmp 0x44def3
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x420], 6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x44dee0
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], ecx
cmp dword [esp + 0xc], eax
jne 0x44df2d
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0x10]
cmp ecx, 0x6178
mov ecx, 0xc299e885
setg dl
cmp ecx, edx
mov edx, eax
sbb ecx, ecx
inc ecx
mov dword [esp + 0xc], ecx
je 0x44df2f
mov edx, ebx
mov ecx, dword [esp + 0x10]
sub edx, ecx
je 0x44df3f
mov esi, ebx
cmp dword [esp + 0x20], eax
jne 0x44df41
mov esi, eax
mov ecx, dword [esp + 0x10]
xor edx, edx
cmp ecx, esi
setne dl
cmp edx, dword [esp + 0x20]
je 0x44df56
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
xor edx, edx
test ecx, ecx
setns dl
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], eax
jmp 0x44dfa3
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], 0
je 0x44df9f
push eax
push 0x1147
push 0x134d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
xor eax, eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x44df77
push 3
pop edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 0xbe7e5505
mov dword [esp + 0x38], ebx
mov dword [esp + 0xc], 0xbab59342
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x30], 0xfffffff9
mov dword [esp + 0x1c], 4
mov dword [esp + 0x34], 0xf9020c5a
mov dword [esp + 0x48], 0xc0d6813f
mov dword [esp + 0x40], 0xfffffffb
mov dword [esp + 0x20], eax
jmp 0x44e00a
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x68], 9
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x44dffa
mov ecx, dword [esp + 0x6c]
neg ecx
jne 0x44e043
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0xc]
neg esi
sbb esi, esi
xor edx, edx
neg esi
sub esi, ecx
imul esi, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
neg esi
cmp esi, ecx
mov ecx, eax
setne dl
sub edx, dword [esp + 0xc]
je 0x44e045
mov ecx, ebx
mov edx, dword [esp + 0x6c]
xor ebx, ebx
imul edx, ecx
mov ecx, dword [esp + 0x2c]
add ecx, edx
imul ecx, dword [esp + 0x6c]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x68]
cmp ecx, edx
setl bl
cmp ebx, dword [esp + 0x68]
jl 0x44e082
cmp dword [esp + 0x6c], eax
jne 0x44e082
mov esi, eax
jmp 0x44e085
xor esi, esi
inc esi
mov ecx, dword [esp + 0x2c]
xor edx, edx
cmp ecx, esi
mov ecx, dword [esp + 0x1c]
setg dl
inc dword [esp + 0x1c]
cmp ecx, edx
jg 0x44e0af
cmp dword [esp + 0x30], eax
jne 0x44e0af
cmp dword [esp + 0x6c], eax
jne 0x44e0af
xor esi, esi
mov ecx, eax
inc esi
jmp 0x44e0b4
xor esi, esi
inc esi
mov ecx, esi
cmp ecx, dword [esp + 0x68]
jne 0x44e17f
mov dword [esp + 0x40], 0xc3cb8784
mov dword [esp + 0x20], 0x29123eba
mov dword [esp + 0x1c], eax
jmp 0x44e0e0
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x7c], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x44e0d4
mov dword [esp + 0x40], 0xc66b3191
xor ebx, ebx
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
sub edx, ecx
mov ecx, dword [esp + 0xc]
cmp edx, ecx
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x48]
setle bl
mov dword [esp + 0x34], ebx
xor ebx, ebx
cmp edx, ecx
setge bl
xor ecx, ecx
cmp dword [esp + 0x34], ebx
setle cl
sub ecx, dword [esp + 0x7c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x2c], 0x1ba8
mov dword [esp + 0x40], esi
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
sub ecx, 0x72090f9c
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
test ecx, ecx
mov ecx, dword [esp + 0x20]
setle bl
xor edx, edx
cmp ebx, ecx
setl dl
mov dword [esp + 0x20], edx
mov dword [esp + 0x7c], 0xb8492355
jmp 0x44e1a1
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], 0
je 0x44e1a1
push 0xf20
push 0x2356
push 0x1fd
call dword [sym.imp.KERNEL32.dll_MulDiv]
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x44e1bd
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x290]
mov dword [eax + ecx*4], 0xf58
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x44e1a7
push 2
pop ebx
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x218]
mov dword [esp + 0x20], 0xd72d7671
mov dword [esp + 0x10], 0xfffffffa
push esi
call fcn.0041796c
xor eax, eax
mov dword [esp + 0xc], 0xfffffffc
mov dword [esp + 0x10], eax
jmp 0x44e206
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xe4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x44e1f7
mov dword [esp + 0x10], eax
jmp 0x44e224
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x218]
mov dword [ecx + edx*4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x44e212
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x1c], eax
jl 0x44e355
push dword [esp + 0x78]
lea ecx, [esp + 0x3d0]
mov dword [esp + 0x24], 0x4f402e31
push ecx
lea ecx, [esp + 0x3c4]
mov dword [esp + 0x4c], 0xf7e7308
push ecx
xorps xmm0, xmm0
mov dword [esp + 0x14c], eax
push eax
lea ecx, [esp + 0x150]
mov dword [esp + 0x154], eax
movdqu xmmword [esp + 0x3cc], xmm0
mov dword [esp + 0x158], eax
call fcn.00419199
mov dword [esp + 0x20], 0
jmp 0x44e31b
mov dword [esp + 0x44], 0xbedcc590
lea ecx, [esp + 0x278]
mov dword [esp + 0x44], 7
mov dword [esp + 0x44], 0x889a278c
push edi
call fcn.0041796c
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x44e2da
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x278]
mov dword [ecx + edx*4], 0x189f42c6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x44e2c4
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], al
je 0x44e302
push eax
push 0xe86
push 0x1e55
push 0x1e2d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov eax, dword [esp + 0x278]
lea ecx, [esp + 0x278]
inc dword [eax]
call fcn.00417a3e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jle 0x44e297
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x140]
cmp dword [esp + eax*4 + 0xe4], 0
jne 0x44e34e
call fcn.00417a3e
dec dword [esp + 0x1c]
push 0
pop eax
jns 0x44e238
jmp 0x44e353
call fcn.00417a3e
xor eax, eax
mov dword [esp + 0x20], esi
cmp dword [esp + 0x20], eax
jl 0x44e45b
mov dword [esp + 0x2c], 0x89ced66e
mov dword [esp + 0x10], esi
cmp dword [esp + 0x10], eax
jl 0x44e3ed
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], 0
je 0x44e389
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
mov ecx, dword [esp + 0x20]
cmp dword [esp + ecx*4 + 0xe4], eax
je 0x44e3d9
mov ecx, dword [esp + 0x20]
xor ebx, ebx
mov edx, dword [esp + ecx*4 + 0xe4]
mov ecx, dword [esp + 0xe4]
cmp ecx, edx
setge bl
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x1c]
neg ecx
jne 0x44e3bf
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x218]
xor edx, edx
cmp dword [ecx], eax
setne dl
imul ecx, edx, 0x7304
mov edx, esi
test ecx, ecx
jne 0x44e3db
mov edx, eax
xor ecx, ecx
cmp edx, 0xfffffff7
sete cl
mov dword [esp + 0xc], ecx
dec dword [esp + 0x10]
jns 0x44e375
mov dword [esp + 0xc], eax
jmp 0x44e447
mov dword [esp + 0x1c], esi
xor ebx, ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
cmp edx, ecx
setl bl
cmp ebx, 0xffffffff
jne 0x44e423
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x30], eax
jne 0x44e43d
mov ecx, eax
cmp dword [esp + 0x2c], eax
je 0x44e43f
mov ecx, esi
mov dword [esp + 0x2c], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x18
jge 0x44e3f3
dec dword [esp + 0x20]
jns 0x44e363
push 2
pop ebx
lea ecx, [esp + 0x218]
call fcn.00417a3e
mov byte [esp + 0x17], 0
lea ecx, [esp + 0xc0]
push ebx
call fcn.0041796c
mov dword [esp + 0x2c], 0x193e0566
xor eax, eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], 0xfffffffc
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], 0xe91cb64b
mov dword [esp + 0x40], 0x121a
mov dword [esp + 0xc], 0xb4f12b15
mov dword [esp + 0xc], eax
jmp 0x44e4cb
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc0]
mov dword [ecx + edx*4], 0x849f845d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jl 0x44e4b5
mov ecx, dword [esp + 0xc0]
cmp dword [ecx], 0xe048
jle 0x44e4e6
cmp dword [ecx], eax
mov ecx, eax
jne 0x44e4e8
mov ecx, esi
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x2c], eax
jne 0x44e500
mov ecx, dword [esp + 0xc0]
mov edx, eax
cmp dword [ecx + 4], eax
je 0x44e502
mov edx, esi
xor ecx, ecx
cmp edx, 0xb0f7
mov edx, 0xfffb
sete cl
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0xc0]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x1c]
cmp edx, ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [edi + 4]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x1c]
sub edx, ecx
je 0x44e566
mov ecx, esi
cmp dword [esp + 0x10], eax
jne 0x44e568
mov ecx, eax
xor ebx, ebx
cmp ecx, 0xc010
mov ecx, dword [esp + 0x1c]
setge bl
xor edx, edx
cmp ebx, ecx
setle dl
cmp edx, 0xfffffffb
ja 0x44e6b8
mov dword [esp + 0xc], 0xc0c7
or ebx, 0xffffffff
mov dword [esp + 0x30], esi
mov dword [esp + 0x2dc], ebx
mov dword [esp + 0x2e0], ebx
mov dword [esp + 0x2e4], ebx
mov dword [esp + 0x2e8], ebx
mov dword [esp + 0x34], 0xfffffffc
mov dword [esp + 0x20], eax
jmp 0x44e5d3
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x3cc], 0xd1f73e70
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x44e5c0
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x2c], eax
jne 0x44e5f0
mov ecx, eax
cmp dword [esp + 0xc], eax
je 0x44e5f2
mov ecx, esi
cmp ecx, 0xe972f33b
sbb ecx, ecx
neg ecx
cmp ecx, dword [esp + 0xc]
jle 0x44e606
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
xor edx, edx
mov dword [esp + 0x3d0], ecx
mov dword [esp + 0x2e4], ecx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x3d8]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc0]
mov esi, dword [edi + 4]
cmp dword [ecx], ebx
mov ecx, dword [esp + 0x30]
setne dl
sub esi, edx
xor edx, edx
add esi, 0x707d8eb7
cmp esi, ecx
sete dl
xor ecx, ecx
cmp edx, 0x161dbfa2
setg cl
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x1c], eax
je 0x44e675
cmp dword [esp + 0x2c], eax
je 0x44e675
xor edi, edi
inc edi
mov ecx, edi
jmp 0x44e67a
xor edi, edi
mov ecx, eax
inc edi
neg ecx
mov dword [esp + 0x34], ecx
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], al
je 0x44e78a
push 0x34
push 0x196d
push 0xb24
push 0x1963
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
jmp 0x44e78a
mov dword [esp + 0x1c], 0xa880e1b4
mov dword [esp + 0x30], 0xfffffff7
mov dword [esp + 0x30], 9
mov dword [esp + 0x38], 0x7a74
mov dword [esp + 0x34], esi
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc0]
mov ecx, dword [ecx]
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x30], eax
je 0x44e6fd
cmp dword [esp + 0x1c], eax
jne 0x44e6ff
mov esi, eax
dec dword [esp + 0x40]
jne 0x44e71d
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
cmp dword [edi + 4], ecx
jg 0x44e71d
xor edi, edi
inc edi
mov ecx, edi
jmp 0x44e722
xor edi, edi
mov ecx, eax
inc edi
xor ebx, ebx
cmp ecx, 3
mov ecx, dword [esp + 0x18]
setle bl
xor edx, edx
cmp ebx, ecx
setg dl
cmp edx, dword [esp + 0x38]
jl 0x44e743
mov ecx, edi
cmp dword [esp + 0x38], eax
jne 0x44e745
mov ecx, eax
mov dword [esp + 0xc], ecx
xor ebx, ebx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
cmp ecx, edx
setle bl
imul ebx, esi
add ebx, dword [esp + 0x38]
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x10]
imul ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x44e77e
cmp dword [esp + 0x1c], eax
je 0x44e77e
cmp dword [esp + 0x10], eax
je 0x44e77e
mov eax, edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], edi
lea ecx, [esp + 0xc0]
call fcn.00417a3e
cmp byte [esp + 0x17], 0
je 0x44e8a4
xor eax, eax
mov dword [esp + 0x20], 0x70a5
mov dword [esp + 0xc], eax
mov dword [esp + 0xc], eax
jmp 0x44e7c8
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0xb0], 0xfffffffd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x44e7b5
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0xbc]
sub ecx, dword [esp + 0xbc]
jne 0x44e7f8
mov ecx, dword [esp + 0xbc]
mov ecx, dword [esp + 0xb8]
mov ecx, dword [esp + 0xbc]
mov ecx, dword [esp + 0xbc]
mov ecx, dword [esp + 0xb0]
mov ecx, dword [esp + 0xb0]
mov esi, dword [esp + 0xbc]
mov ecx, dword [esp + 0xbc]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
sete dl
mov dword [esp + 0xc], edx
mov dword [esp + 0x20], 0xfffffff3
jmp 0x44e889
mov dword [esp + 0xc], eax
jmp 0x44e87e
mov dword [esp + 0x1c], 0xdb74a71a
mov dword [esp + 0x1c], 3
cmp dword [esp + 0x1c], eax
jl 0x44e87a
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x44e874
push 0xf20
push 0x2356
push 0x1fd
call dword [sym.imp.KERNEL32.dll_MulDiv]
xor eax, eax
dec dword [esp + 0x1c]
jns 0x44e852
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x12
jge 0x44e83c
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x29
jl 0x44e836
push eax
push eax
push eax
push eax
push 0x1f26
push edi
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x24]
imul esi, eax
dec edx
mov eax, dword [esp + 0x290]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [eax], esi
mov eax, dword [esp + 0x24]
cmp edx, eax
setl cl
xor edx, edx
imul eax, ecx, 0x2524
sub eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov ecx, dword [esp + 0x30]
setg dl
xor ebx, ebx
cmp edx, esi
setne bl
sub ecx, dword [esp + 0x24]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ebx, ecx
lea ecx, [esp + 0x290]
setle al
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x34], eax
call fcn.00417a3e
push 6
pop ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], 5
mov dword [esp + 0x30], 2
push 0x19
mov dword [esp + 0x48], 0xfffffffe
pop esi
mov dword [esp + 0x2c], esi
cmp dword [esp + 0x2c], 5
jge 0x44e9cd
xor eax, eax
mov dword [esp + 0xc], 5
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x44e990
push eax
push 0x1154
push 0x223e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x44e9bb
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x44e9b7
push eax
push eax
push eax
push eax
push 0x1f26
push edi
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x15
jl 0x44e996
dec dword [esp + 0x2c]
cmp dword [esp + 0x2c], 5
jl 0x44e95c
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
neg edx
neg edx
sbb edx, edx
xor ecx, ecx
sub eax, ebx
inc edx
cmp edx, eax
setle cl
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0xc], eax
jmp 0x44ea3c
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x428], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x44ea2d
mov dword [esp + 0xc], edi
cmp dword [esp + 0xc], eax
jl 0x44ea8e
mov dword [esp + 0x30], 0x210b999f
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x44ea84
push eax
push eax
push eax
push 0x1ae9
push 0xd15
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
dec dword [esp + 0x30]
dec dword [esp + 0xc]
jns 0x44ea4d
mov dword [esp + 0x18], 0x8a61928c
mov dword [esp + 0x1c], 0x14b81230
mov dword [esp + 0x24], edi
push 0xfffffffffffffff9
pop ecx
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], ecx
mov dword [esp + 0x1ec], ecx
mov dword [esp + 0x1f0], ecx
mov dword [esp + 0x18], eax
jmp 0x44ebbf
mov dword [esp + 0x20], 0xdb6084ed
xor edx, edx
mov dword [esp + 0xc], 0xdfe9f48
mov dword [esp + 0x30], 2
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x20]
cmp ecx, 0xba25
mov ecx, dword [esp + 0x18]
setge dl
xor ebx, ebx
cmp edx, ecx
setne bl
xor edx, edx
imul ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp ebx, ecx
mov ecx, dword [esp + 0xc]
setne dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0x18]
setge bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0x18]
setl dl
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [esp + 0x18]
setge bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ebx, ebx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
cmp ecx, edx
setg bl
sub ebx, dword [esp + 0xc]
imul ebx, dword [esp + 0x18]
inc ebx
je 0x44eb67
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
cmp ecx, 0x67f5
mov ecx, dword [esp + 0x24]
setle dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0x30]
setge bl
xor edx, edx
cmp ebx, ecx
setge dl
sub edx, 0x24b13b10
cmp dword [esp + 0x18], edx
jge 0x44ebb3
mov ecx, eax
cmp dword [esp + 0x1e4], eax
je 0x44ebb5
mov ecx, edi
neg ecx
mov dword [esp + 0xc], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
je 0x44eaca
mov dword [esp + 0x18], 0xfffffffd
jmp 0x44ec6a
mov dword [esp + 0x38], 0xa24e
xor edx, edx
mov dword [esp + 0x34], edi
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x38]
cmp ecx, 0x2b293353
setg dl
sub edx, 0xb0debf62
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp ecx, edx
sbb ecx, ecx
neg ecx
dec ecx
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], 0xdb602708
ja 0x44ec1f
mov ecx, edi
cmp dword [esp + 0x24], eax
jne 0x44ec21
mov ecx, eax
mov dword [esp + 0x24], ecx
mov edx, edi
cmp dword [esp + 0x24], eax
jne 0x44ec2f
mov edx, eax
mov ecx, dword [esp + 0x1e4]
imul ecx, edx
cmp ecx, 0xffffffff
jbe 0x44ec46
mov ecx, edi
cmp dword [esp + 0x38], eax
jne 0x44ec48
mov ecx, eax
mov dword [esp + 0x34], ecx
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x44ec66
cmp dword [esp + 0x18], 0xa
jge 0x44ebd6
mov dword [esp + 0x44], 7
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x44ec99
push eax
push 0x4f4
push 0x53
push eax
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
xor eax, eax
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x44ecb1
push 0x239e
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor eax, eax
mov dword [esp + 0x18], 0xfffffffc
mov dword [esp + 0x10], eax
push 4
mov dword [esp + 0x38], 0xfe2cf45
mov dword [esp + 0x10], eax
pop ebx
jmp 0x44ece1
cmp dword [esp + 0xc], ebx
jl 0x44ecce