Function at 0x41fde2
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Delete file
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get file size
Get file system object information
Get graphical window text
Get session user name
Get system information on windows
Identify system language via api
Log keystrokes via polling
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e08
call fcn.004906e0
push ebx
push esi
push edi
push 4
xor eax, eax
mov dword [ebp - 0x50], ecx
pop esi
inc eax
mov byte [ebp - 0x51], dl
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0xbd8]
push esi
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0x30], 0x6e58d020
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x41fe39
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbd8]
call fcn.0040f321
or dword [eax], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x41fe1e
xor eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 3
mov dword [ebp - 0x1c], eax
pop ebx
jmp 0x41fea8
mov dword [ebp - 0x10], 0x5ba77230
mov dword [ebp - 0x10], eax
jmp 0x41fe60
mov dword [ebp - 0x40], 0x72a7
dec dword [ebp - 0x30]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x41fe53
mov dword [ebp - 0x30], eax
jmp 0x41fea0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x41fe8d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbd8]
call fcn.0040f321
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x41fe72
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x41fe9d
push eax
push eax
push eax
call edi
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x41fe6a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
jg 0x41fe47
lea ecx, [ebp - 0xbd8]
call fcn.0040f305
movdqa xmm0, xmmword [0xa8bb80]
lea ecx, [ebp - 0x1b58]
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0xc], 0xfffffffc
mov dword [ebp - 0xc], 0xea388845
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x1628]
push eax
lea eax, [ebp - 0x1638]
push eax
movdqu xmmword [ebp - 0x1638], xmm0
call fcn.0040f333
lea ecx, [ebp - 0x364]
mov esi, eax
call fcn.0040f330
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x12ec]
push dword [esi]
call fcn.0040f2df
xor ebx, ebx
mov dword [ebp - 0x28], 6
push 3
xor eax, eax
inc ebx
pop esi
cmp dword [ebp - 0x28], eax
jle 0x420036
push esi
lea ecx, [ebp - 0x14bc]
call fcn.0040f233
xor eax, eax
lea ecx, [ebp - 0xb9c]
mov dword [ebp - 0x1c], eax
push 2
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x41ff71
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14bc]
call fcn.0040f321
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x41ff57
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x41ff96
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb9c]
call fcn.0040f321
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x41ff7c
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x41ffcf
mov dword [ebp - 0x30], 0x1220985a
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x30], eax
jmp 0x41ffc5
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x40], 0xdfba22e9
dec dword [ebp - 0x3c]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x41ffb1
dec dword [ebp - 0x1c]
jns 0x41ff9e
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0xb9c]
push ebx
call fcn.0040f321
push 3
lea ecx, [ebp - 0x12ec]
mov dword [eax], esi
mov dword [ebp - 0xc], 0x1a6b
mov eax, dword [ebp - 0xc]
sub eax, 0xfffffff9
neg eax
pop esi
sbb eax, eax
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
push esi
call fcn.0040f321
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, ebx
lea ecx, [ebp - 0xb9c]
setge dl
mov dword [eax], edx
call fcn.0040f305
lea ecx, [ebp - 0x14bc]
call fcn.0040f305
dec dword [ebp - 0x28]
xor eax, eax
jmp 0x41ff26
lea ecx, [ebp - 0x12ec]
call fcn.0040f305
mov dword [ebp - 0x24], 0xd5e48d32
mov dword [ebp - 0x3c], 0xb91359a7
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x40], 0xa53e
mov dword [ebp - 0x24], 0x12
jmp 0x420329
push ebx
lea ecx, [ebp - 0x418]
call fcn.0040f233
mov dword [ebp - 0x14], 0xee7d214c
xor eax, eax
mov dword [ebp - 0xc], 0xa737
mov dword [ebp - 0x38], 0xec53312a
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x4200b8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x418]
call fcn.0040f321
mov dword [eax], 0x683c8fc5
xor eax, eax
inc dword [ebp - 0x1c]
inc eax
cmp dword [ebp - 0x1c], eax
jl 0x420094
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x42031b
jmp 0x4200c8
xor eax, eax
mov dword [ebp - 0x10], 8
lea ecx, [ebp - 0xe6c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], 7
push 2
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x420110
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe6c]
call fcn.0040f321
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x4200f1
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x42014e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x418]
call fcn.0040f321
cmp dword [eax], 0
jne 0x42014c
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x420144
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x420118
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x420307
push 8
pop ebx
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x9b8]
push esi
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x420194
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9b8]
call fcn.0040f321
mov dword [eax], 0x7ba27438
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x420176
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jg 0x420219
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x418]
push dword [ebp - 0x14]
call fcn.0040f321
push dword [ebp - 0x14]
mov ecx, 0xaf72b572
cmp ecx, dword [eax]
lea ecx, [ebp - 0x418]
sbb esi, esi
neg esi
call fcn.0040f321
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp esi, ecx
sete dl
xor ecx, ecx
cmp dword [eax], 0x35edade0
mov eax, dword [ebp - 0x30]
setge cl
imul edx, ecx
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], eax
jl 0x42020c
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x420207
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor eax, eax
dec dword [ebp - 0x30]
jns 0x4201f5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x42019c
push 3
xor eax, eax
pop esi
push eax
lea ecx, [ebp - 0x418]
call fcn.0040f321
xor ebx, ebx
lea ecx, [ebp - 0xe6c]
push ebx
call fcn.0040f321
cmp dword [eax], ebx
jne 0x4202ac
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x420294
push eax
lea ecx, [ebp - 0x418]
call fcn.0040f321
push ebx
lea ecx, [ebp - 0x418]
call fcn.0040f321
mov eax, dword [eax]
sub eax, 0xbd55
je 0x420276
push ebx
lea ecx, [ebp - 0x418]
call fcn.0040f321
cmp dword [eax], ebx
je 0x420276
xor eax, eax
lea ecx, [eax + 1]
jmp 0x42027a
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x2c]
imul eax, ecx
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x2c]
je 0x42029b
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x42029d
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x4202a0
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x3c], eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x4202af
jmp 0x4202b1
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x30]
test eax, eax
push 2
setle cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x9b8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0040f321
push 2
lea ecx, [ebp - 0x9b8]
call fcn.0040f321
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x9b8]
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
call fcn.0040f305
dec dword [ebp - 0x10]
jns 0x42015a
lea ecx, [ebp - 0xe6c]
call fcn.0040f305
dec dword [ebp - 0x14]
jns 0x4200c6
lea ecx, [ebp - 0x418]
call fcn.0040f305
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x15
jne 0x420069
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0xbcc]
push 4
call fcn.0040f233
mov eax, 0xf825e7a6
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xadc], eax
xor eax, eax
mov dword [ebp - 0x24], 0xba772304
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x420384
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x42041b
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x3c], 0xbe135e1f
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], eax
jl 0x420418
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x4203ad
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xae8]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0xae8]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setne dl
imul edx, dword [ebp - 0x30]
test edx, edx
je 0x4203ec
mov dword [ebp - 0x20], 7
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x420413
mov eax, dword [ebp - 0x20]
jmp 0x42040b
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jg 0x42040b
inc eax
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x20]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x4203fd
dec dword [ebp - 0xc]
push 0
pop eax
jns 0x42039e
xor ebx, ebx
xor eax, eax
inc ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x42038c
mov dword [ebp - 0x48], 0x6e58d020
mov dword [ebp - 0x24], 0xc3414b5
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x420465
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1360], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x42044c
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x420476
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
jne 0x420476
mov esi, eax
jmp 0x42047b
xor eax, eax
lea esi, [eax + 1]
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setle dl
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
xor edx, edx
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x135c]
cmp esi, ecx
setle dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x1358]
mov eax, dword [ebp - 0x1354]
setg cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jg 0x4204e0
xor eax, eax
cmp dword [ebp - 0xc], eax
je 0x4204e2
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x4204e5
xor eax, eax
xor ebx, ebx
inc ebx
xor ecx, ecx
cmp eax, 0x4cdb8faa
mov eax, dword [ebp - 0xc]
sete cl
xor edx, edx
cmp ecx, eax
push 3
setle dl
xor eax, eax
imul edx, dword [ebp - 0x24]
pop esi
imul edx, dword [ebp - 0x24]
sub edx, 0x5706b379
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x42051f
mov dword [ebp - 0x20], ebx
dec dword [ebp - 0x1c]
jns 0x420517
mov dword [ebp - 0x1c], 0x3ae35568
mov dword [ebp - 0x1c], 0xfffffff6
jmp 0x42055e
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x420542
push eax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x42055b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
je 0x42052f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x420589
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbcc]
call fcn.0040f321
or dword [eax], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x42056d
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x420f5c
mov dword [ebp - 0x34], 0x124f
mov dword [ebp - 0x40], 0xfffffff6
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x4205d2
push 0x175
push 0x1634
push 0x420
push 0x2126
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
xor eax, eax
cmp dword [ebp - 0x34], eax
mov byte [ebp - 0x15], al
je 0x420603
cmp byte [ebp - 0x15], 0
je 0x420612
push 0x1f8
push eax
push eax
push 0x1c70
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x420610
cmp byte [ebp - 0x15], 0
je 0x420612
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov dword [ebp - 0x10], 0x5ba77230
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0xe4ec6f91
mov dword [ebp - 0x14], eax
jmp 0x4207b1
mov dword [ebp - 0x2c], 0xbecba2af
mov dword [ebp - 0xc], 9
mov dword [ebp - 0x34], 0xf5dda301
mov dword [ebp - 0x2c], eax
jmp 0x420682
mov dword [ebp - 0x28], 0x3690f1d8
mov dword [ebp - 0x28], 0xfffffff6
jmp 0x420679
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0x1b
jmp 0x420670
mov dword [ebp - 0x34], 0x44accb24
cmp dword [ebp - 0x34], eax
jne 0x420676
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1d
jle 0x420661
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffed
jle 0x420655
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffee
jne 0x420645
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffef
je 0x4207ae
mov dword [ebp - 0x1c], 0x46cd5fec
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x4206bb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x137c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x4206a7
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4206cd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1b68], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x4206c0
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
xor eax, eax
cmp dword [ebp - 0xc], eax
je 0x420705
cmp dword [ebp - 0x14], eax
jne 0x42070e
cmp dword [ebp - 0x1c], eax
jne 0x42070e
mov edx, eax
jmp 0x420713
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
xor edx, edx
cmp ecx, 0x2966b911
setl dl
xor eax, eax
cmp edx, 0x540f8278
setg al
cmp eax, dword [ebp - 0x14]
jl 0x420752
mov eax, dword [ebp - 0x1378]
mov eax, dword [ebp - 0x1378]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1378]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0xce88
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, eax
setg dl
mov dword [ebp - 0x1b68], edx
mov eax, dword [ebp - 0x38]
add eax, edx
je 0x420796
xor eax, eax
cmp dword [ebp - 0xc], eax
je 0x420798
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x42079b
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffef
push 0
pop eax
jne 0x420695
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jne 0x42062b
mov dword [ebp - 0x10], eax
jmp 0x4208b2
mov dword [ebp - 0x28], 0x3342eb9
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0x5b2906c9
mov dword [ebp - 0x40], 0x8f6c218e
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x4207fb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14d0], 0xef66b17b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x4207e3
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x420842
mov dword [ebp - 0x1c], 0xf54c3c69
mov dword [ebp - 0x34], 0x6ff23b1a
mov dword [ebp - 0x40], 0x52f76ec7
mov dword [ebp - 0x40], 0xbd0a7084
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0xf29acd40
mov dword [ebp - 0x1c], eax
jmp 0x420833
cmp dword [ebp - 0x34], eax
jne 0x420839
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff8
jle 0x42082b
dec dword [ebp - 0x14d0]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe7
jl 0x420800
mov dword [ebp - 0x40], 0x72a7
mov dword [ebp - 0x1c], 0x477862f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x420872
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a2c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x42085e
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe6
je 0x4208ac
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x420895
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0xfffffffffffffff7
pop ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x1a28], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe6
jne 0x42087e
dec dword [ebp - 0x48]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x4207c3
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0xc], 0x17
cmp dword [ebp - 0xc], eax
jge 0x4209b9
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x28], eax
jmp 0x4209a6
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0xfffffffa
jmp 0x420999
mov dword [ebp - 0x784], eax
mov dword [ebp - 0x780], eax
mov dword [ebp - 0x77c], eax
mov dword [ebp - 0x778], eax
mov dword [ebp - 0x3c], 0xa1e1c5a3
mov dword [ebp - 0x34], 0x12530a9b
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x778], 0xfffffffd
jle 0x420996
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x30], 0xfffffff3
jmp 0x420980
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
lea ecx, [eax*2 - 0x2988]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x34], edx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x42097d
push eax
push 0x1610
push eax
push 0x1e8c
push 0x1c1b
push eax
push 0x17cb
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x420939
dec dword [ebp - 0x778]
cmp dword [ebp - 0x778], 0xfffffffd
jg 0x420929
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff3
jne 0x4208f4
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffc
je 0x4208e1
dec dword [ebp - 0xc]
js 0x4208d2
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], esi
jg 0x420f59
push 4
lea ecx, [ebp - 0xbb4]
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0x28], 0xfebaeef2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x4209ff
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbb4]
call fcn.0040f321
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x4209e4
xor eax, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x420a3b
mov dword [ebp - 0x1c], 0x1e2c0d37
mov dword [ebp - 0x1c], eax
jmp 0x420a2a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xbb4]
call fcn.0040f321
mov dword [eax], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x420a13
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x28]
push 0
pop eax
jns 0x420a07
lea ecx, [ebp - 0xbb4]
call fcn.0040f305
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x420b37
push esi
lea ecx, [ebp - 0x6b4]
call fcn.0040f233
mov dword [ebp - 0x30], 0x2086bd08
xor eax, eax
mov dword [ebp - 0x1c], 0xe58bfc4f
mov dword [ebp - 0x1c], eax
jmp 0x420a7e
push dword [ebp - 0x1c]
call fcn.0040f321
mov dword [eax], ebx
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x6b4]
cmp dword [ebp - 0x1c], esi
jl 0x420a71
push 2
call fcn.0040f321
push ebx
lea ecx, [ebp - 0x6b4]
mov esi, eax
call fcn.0040f321
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x420acf
push ebx
lea ecx, [ebp - 0x6b4]
call fcn.0040f321
xor ebx, ebx
cmp dword [eax], ebx
jne 0x420acc
push 2
lea ecx, [ebp - 0x6b4]
call fcn.0040f321
cmp dword [eax], ebx
jne 0x420acc
mov eax, ebx
inc ebx
jmp 0x420ad1
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x420b0f
mov dword [ebp - 0x3c], 0xa26f
mov dword [ebp - 0x30], eax
jmp 0x420af3
dec dword [ebp - 0x3c]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jle 0x420aed
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x420b0c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x420ae1
lea ecx, [ebp - 0x6b4]
call fcn.0040f305
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbcc]
call fcn.0040f321
push 3
pop esi
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x420a50
push 2
pop esi
push esi
lea ecx, [ebp - 0x6f0]
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x420b68
push dword [ebp - 0x1c]
call fcn.0040f321
mov dword [eax], 0x9b55bb2c
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x6f0]
cmp dword [ebp - 0x1c], esi
jl 0x420b57
push ebx
call fcn.0040f321
mov dword [eax], 0xfffffffd
jmp 0x420bcd
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x420baa
push eax
push 0x1610
push eax
push 0x1e8c
push 0x1c1b
push eax
push 0x17cb
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x420bbf
push 0x2271
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push ebx
lea ecx, [ebp - 0x6f0]
call fcn.0040f321
inc dword [eax]
push ebx
lea ecx, [ebp - 0x6f0]
call fcn.0040f321
cmp dword [eax], 0x14
jg 0x420b81
lea ecx, [ebp - 0x6f0]
call fcn.0040f305
mov dword [ebp - 0x40], esi
xor eax, eax
mov dword [ebp - 0x40], 0xb9da4d07
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x420c15
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4f0], 0x5540d7f8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x420bfd
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x420c39
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11ec], ebx
xor eax, eax
inc dword [ebp - 0x10]
inc eax
push eax
pop ebx
cmp dword [ebp - 0x10], eax
jl 0x420c1d
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x4f0], 0xfffffff0
jmp 0x420c55
mov dword [ebp - 0x3c], 0x6e58d020
dec dword [ebp - 0x3c]
dec dword [ebp - 0x4f0]
cmp dword [ebp - 0x4f0], 0xffffffed
jg 0x420c45
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x420c77
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
mov byte [ebp - 0x15], al
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x24], ebx
push esi
call fcn.0040f233
mov dword [ebp - 0x30], 6
lea ecx, [ebp - 0xfd4]
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0xc], 0x2955d482
mov dword [ebp - 0x28], 0xdef05de0
mov dword [ebp - 0x2c], 0xfffffffc
push ebx
call fcn.0040f233
mov dword [ebp - 0x3c], 0xcf2842c5
xor eax, eax
mov dword [ebp - 0x3c], 0xd1892f88
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], 0x826cce71
mov dword [ebp - 0x3c], 0x37d796e9
mov dword [ebp - 0x38], 0x4084f7cb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x420d03
push dword [ebp - 0x10]
lea ecx, [ebp - 0x328]
call fcn.0040f321
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x420ce8
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jge 0x420d2c
push dword [ebp - 0x10]
lea ecx, [ebp - 0xfd4]
call fcn.0040f321
xor esi, esi
inc esi
mov dword [eax], esi
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x420d0e
push eax
lea ecx, [ebp - 0x328]
call fcn.0040f321
xor eax, eax
lea ecx, [ebp - 0x328]
inc eax
push eax
call fcn.0040f321
mov edx, dword [ebp - 0x1c]
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x1c]
setg al
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [esi]
lea ecx, [ebp - 0x328]
setg al
xor ebx, ebx
cmp eax, 0xffffffff
setg bl
xor eax, eax
inc eax
push eax
call fcn.0040f321
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x328]
sub esi, ebx
xor ebx, ebx
imul esi, dword [ebp - 0x24]
push ebx
add esi, dword [eax]
call fcn.0040f321
mov dword [eax], esi
xor esi, esi
dec dword [ebp - 0x30]
inc esi
mov dword [ebp - 0xc], 0xc761
mov eax, dword [ebp - 0xc]
neg eax
jne 0x420dc8
push esi
lea ecx, [ebp - 0x328]
call fcn.0040f321
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x2c]
push ebx
lea ecx, [ebp - 0xfd4]
call fcn.0040f321
mov ecx, dword [ebp - 0x28]
mov edx, 0xc63704b
sub edx, ecx
lea ecx, [ebp - 0x328]
push esi
mov dword [eax], edx
call fcn.0040f321
xor eax, eax
cmp dword [ebp - 0xc], eax
jne 0x420dfc
cmp dword [ebp - 0x24], eax
jne 0x420dfc
mov ecx, eax
jmp 0x420e04
xor eax, eax
xor esi, esi
inc esi
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x24]
sub eax, ecx
lea ecx, [ebp - 0x328]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
dec eax
neg eax
push esi
sbb eax, eax
neg eax
mov dword [ebp - 0x3c], eax
call fcn.0040f321
mov ecx, dword [ebp - 0x3c]
xor edx, edx
push esi
cmp dword [eax], ecx
lea ecx, [ebp - 0x328]
setle dl
xor ebx, ebx
cmp edx, 0x6a17
setge bl
call fcn.0040f321
xor edx, edx
cmp ebx, dword [eax]
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x24]
jne 0x420e65
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x30], 0x3c3a871d
jl 0x420e86
xor ebx, ebx
lea ecx, [ebp - 0x328]
push ebx
call fcn.0040f321
cmp dword [eax], ebx
jne 0x420e86
xor eax, eax
mov esi, eax
jmp 0x420e8b
xor eax, eax
lea esi, [eax + 1]
push eax
lea ecx, [ebp - 0x328]
call fcn.0040f321
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp esi, ecx
setne dl
sub edx, 0xd9e6264a
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
inc ebx
imul edx, dword [ebp - 0x28]
mov dword [eax], edx
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], ebx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0xfd4]
call fcn.0040f305
lea ecx, [ebp - 0x328]
call fcn.0040f305
cmp byte [ebp - 0x15], 0
je 0x420f48
xor eax, eax
mov dword [ebp - 0x40], 0x8c6a53d0
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x420f2c
push eax
push 0x16cd
push 0x1631
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x420f43
push eax
push 0x1ddd
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
xor eax, eax
push eax
push eax
push eax
call edi
inc dword [ebp - 0x48]
push 3
pop esi
cmp dword [ebp - 0x48], esi
jle 0x4209c5
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x16
jg 0x420591
lea ecx, [ebp - 0xbcc]
call fcn.0040f305
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 0xb21a35ca
mov dword [ebp - 0x10], 0xfffffff0
cmp dword [ebp - 0x10], 0xe
jne 0x420fa2
mov dword [ebp - 0x34], 0x33992443
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xe
je 0x420f8a
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffffc
push 4
pop edi
je 0x420fd0
mov dword [ebp - 0x34], 0xe53e58bf
mov dword [ebp - 0x38], 0xd2703d9b
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edi
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffc
jne 0x420fae
xor eax, eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x420ff3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1dcc], 0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x420fdb
xor eax, eax
mov dword [ebp - 0xc], 2
cmp dword [ebp - 0xc], eax
jl 0x421016
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x421011
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
dec dword [ebp - 0xc]
jns 0x420fff
mov ecx, 0xf825e7a6
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0xafc], ecx
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xaf4], ecx
mov dword [ebp - 0x24], 0xba772304
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x421056
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x4210ed
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x3c], 0xbe135e1f
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], eax
jl 0x4210ea
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x42107f
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xb00]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0xb00]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setne dl
imul edx, dword [ebp - 0x30]
test edx, edx
je 0x4210be
mov dword [ebp - 0x20], 7
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x4210e5
mov eax, dword [ebp - 0x20]
jmp 0x4210dd
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], esi
jg 0x4210dd
inc eax
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x20]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x4210cf
dec dword [ebp - 0xc]
push 0
pop eax
jns 0x421070
xor ebx, ebx
xor eax, eax
inc ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x42105e
push ebx
lea ecx, [ebp - 0xe9c]
call fcn.0040f233
xor eax, eax
lea ecx, [ebp - 0xe84]
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x1aae4b9
push 0xfffffffffffffffb
mov dword [ebp - 0x20], 0x64b5c6f8
mov dword [ebp - 0x28], eax
pop eax
push 2
pop esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], esi
push edi
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x42115a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1b80], 0x483bbb66
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x421142
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x421180
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe84]
call fcn.0040f321
mov dword [eax], 0x67bb1a88
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x421162
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x421196
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1cd8], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x421185
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x4211d4
cmp dword [ebp - 0xc], eax
je 0x4211d4
lea edx, [eax + 1]
jmp 0x4211d6
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, 0xe283bc1b
setle cl
cmp eax, ecx
lea ecx, [ebp - 0xe84]
sbb eax, eax
xor ebx, ebx
neg eax
inc ebx
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1b80], eax
mov dword [ebp - 0x3c], 0xfffa
push ebx
call fcn.0040f321
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x421224
cmp dword [ebp - 0x28], eax
je 0x421226
mov eax, ebx
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0xe84]
call fcn.0040f305
or edi, 0xffffffff
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x3c], 0x5f1dbecc
mov dword [ebp - 0x20], 0xffffffef
jmp 0x421281
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x421278
push eax
push 0x1610
push eax
push 0x1e8c
push 0x1c1b
push eax
push 0x17cb
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1d
jne 0x421251
mov dword [ebp - 0x1c], 0xf572
lea ecx, [ebp - 0x1300]
mov dword [ebp - 0x28], 0x30f94f37
push esi
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x4212c5
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1300]
call fcn.0040f321
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4212ab
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4212db
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x88c], 0xfffffff6
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x4212ca
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x28], eax
inc ebx
jmp 0x42136e
mov dword [ebp - 0x3c], 0x1d8b
mov dword [ebp - 0x20], 0xd0e75d5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x42136b
mov dword [ebp - 0xc], 0x42ca8cda
cmp dword [ebp - 0x3c], eax
je 0x42134a
mov eax, dword [ebp - 0x3c]
dec eax
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x9f58
mov eax, dword [ebp - 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x20]
jg 0x421348
xor eax, eax
xor ebx, ebx
inc ebx
lea ecx, [eax + 1]
jmp 0x42134c
xor eax, eax
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x88c], ecx
cmp ecx, 0xf746
push 0
sete al
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], ebx
jle 0x421309
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x4212f3
lea ecx, [ebp - 0x1300]
call fcn.0040f305
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x4213a9
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe9c]
call fcn.0040f321
mov dword [eax], 0xaf11
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x421388
xor eax, eax
mov byte [ebp - 0x15], al
mov dword [ebp - 0x20], 0xfffffffd
push 3
mov dword [ebp - 0x20], eax
pop ebx
cmp dword [ebp - 0x20], ebx
jge 0x4213d2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x18c4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x4213be
xor eax, eax
push 0xc
pop ecx
mov dword [ebp - 0x20], ecx
jmp 0x421404
mov dword [ebp - 0x1c], 0xd4914d2e
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x421401
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x18c4], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x4213e9
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jne 0x4213da
cmp byte [ebp - 0x15], 0
je 0x421559
push ebx
lea ecx, [ebp - 0x10dc]
call fcn.0040f233
mov dword [ebp - 0x1c], 8
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x40], 0x251c6076
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x42145c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x10dc]
call fcn.0040f321
mov dword [eax], 0xa9bdba76
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x42143e
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x42152b
xor eax, eax
lea ecx, [ebp - 0x14e0]
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x40], 0xb7834d8a
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0xa5852835
mov dword [ebp - 0x40], 0xd52aa0a5
push esi
call fcn.0040f233
xor eax, eax
lea ecx, [ebp - 0xbe4]
inc eax
mov dword [ebp - 0x40], eax
push eax
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x4214ce
xor esi, esi
inc esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14e0]
call fcn.0040f321
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x4214b0
push 2
xor eax, eax
pop esi
mov dword [ebp - 0x10], eax
jmp 0x4214ea
push dword [ebp - 0x10]
lea ecx, [ebp - 0xbe4]
call fcn.0040f321
mov dword [eax], 0xa67d9261
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x4214d3
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x10dc]
call fcn.0040f321
lea ecx, [ebp - 0xbe4]
mov dword [eax], edi
xor eax, eax
push eax
call fcn.0040f321
lea ecx, [ebp - 0xbe4]
inc dword [eax]
call fcn.0040f305
lea ecx, [ebp - 0x14e0]
call fcn.0040f305
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x421464
lea ecx, [ebp - 0x10dc]
call fcn.0040f305
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
push eax
push eax
push 0x225c
call edi
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x42155f
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], eax
jg 0x4223ac
jmp 0x421574
mov dword [ebp - 0x28], 0x91a049fe
mov dword [ebp - 0x28], eax
jmp 0x42161d
mov dword [ebp - 0xc], 0xaa39ed08
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], esi
jge 0x4215aa
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x11d8], 0x124f84b8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x421592
xor eax, eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], eax
jl 0x42161a
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ecx
jg 0x4215fe
mov dword [ebp - 0x34], 0xfffffff6
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x11d8]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x4215f1
push 0x1e24
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
inc dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jle 0x4215c4
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x421612
call edi
push eax
call dword [sym.imp.USER32.dll_GetMenu]
xor eax, eax
dec dword [ebp - 0xc]
push 1
pop ecx
jns 0x4215b5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xa
jne 0x421583
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x42163e
push eax
push eax
push 0x554
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
mov dword [ebp - 0x28], 0xffffffff
lea ecx, [ebp - 0x5b0]
push ebx
call fcn.0040f233
mov dword [ebp - 0x40], 0x96840eb4
lea ecx, [ebp - 0xbfc]
mov dword [ebp - 0x34], 0xfbf68593
xor eax, eax
inc eax
mov dword [ebp - 0x20], 0x1d6a56c3
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x38], 0x27f08e22
mov dword [ebp - 0x3c], 0x89f7a9d2
push eax
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x4216ae
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5b0]
call fcn.0040f321
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x421690
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x4216ce
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1314], 0x3388a019
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x4216b6
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jge 0x4216f4
push dword [ebp - 0x14]
lea ecx, [ebp - 0xbfc]
call fcn.0040f321
mov dword [eax], ebx
xor eax, eax
inc dword [ebp - 0x14]
inc eax
cmp dword [ebp - 0x14], eax
jl 0x4216d9
push eax
lea ecx, [ebp - 0x5b0]
call fcn.0040f321
xor ebx, ebx
cmp dword [eax], ebx
je 0x421772
push esi
lea ecx, [ebp - 0x5b0]
call fcn.0040f321
cmp dword [eax], ebx
je 0x421772
push ebx
lea ecx, [ebp - 0xbfc]
call fcn.0040f321
mov esi, eax
lea ecx, [ebp - 0x5b0]
xor eax, eax
inc eax
push eax
call fcn.0040f321
dec dword [esi]
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x421742
mov eax, dword [ebp - 0x1310]
xor esi, esi
lea ecx, [ebp - 0x5b0]
inc esi
push esi
call fcn.0040f321
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x5b0]
mov dword [ebp - 0xc], eax
push esi
call fcn.0040f321
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax]
je 0x42176e
mov eax, esi
jmp 0x421777
xor ebx, ebx
jmp 0x421775
xor esi, esi
inc esi
mov eax, ebx
mov dword [ebp - 0x1310], eax
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
test eax, eax
setg cl
imul eax, ecx, 0xffff0005
test eax, eax
je 0x4217a2
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x4217a4
mov eax, esi
jmp 0x4217a4
xor eax, eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0xbfc]
call fcn.0040f305
lea ecx, [ebp - 0x5b0]
call fcn.0040f305
mov dword [ebp - 0x14], 0xfff7
xor eax, eax
mov dword [ebp - 0x34], 0xbbdebf88
push 3
mov dword [ebp - 0x10], eax
pop ebx
cmp dword [ebp - 0x10], ebx
jge 0x4217ef
push 0xfffffffffffffffb
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9d0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4217db
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x421805
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1d24], 0x2ef703c5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4217f4
cmp dword [ebp - 0x14], 0xa29
jl 0x42181f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x9d0], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x9d0], 0x5898
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x9d0]
mov eax, dword [ebp - 0x9c8]
mov eax, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], 0xfffffff0
jmp 0x421860
cmp byte [ebp - 0x15], 0
je 0x42185d
call edi
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x2a
mov byte [ebp - 0x15], al
jge 0x42184c
mov dword [ebp - 0x24], 0xdd1e1e87
mov dword [ebp - 0x30], 0xc17e5c28
mov dword [ebp - 0x34], 9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
dec eax
dec eax
jne 0x42189f
cmp dword [ebp - 0x24], eax
je 0x4218a1
mov eax, esi
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x4218bf
mov dword [ebp - 0x34], 0x80ebbd48
cmp dword [ebp - 0x24], eax
jne 0x4218c5
cmp dword [ebp - 0x34], eax
jne 0x4218c5
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x11
jle 0x4218ab
cmp byte [ebp - 0x15], al
je 0x421c21
push 2
lea ecx, [ebp - 0xf4]
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x4218ff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], eax
jg 0x4223a0
lea ecx, [ebp - 0xe9c]
call fcn.0040f305
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], eax
jmp 0x4223eb
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x4223e3
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x4223f1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
jge 0x4223c5
xor esi, esi
lea ecx, [ebp - 0xc14]
inc esi
mov dword [ebp - 0x10], esi
push 2
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x42242e
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc14]
call fcn.0040f321
mov dword [eax], 0xffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x42240f
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffffa
jne 0x4224f9
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x30], 0xfda0e60f
mov dword [ebp - 0x1160], 0xffffffff
mov dword [ebp - 0x115c], 0xffffffff
mov dword [ebp - 0x1158], 0xffffffff
mov dword [ebp - 0x1154], 0xffffffff
mov dword [ebp - 0x30], eax
jmp 0x4224e7
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x1c], 0x71dfd947
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x4224e4
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1160]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x4224d5
mov dword [ebp - 0x20], 0x896e6a37
mov dword [ebp - 0x20], eax
jmp 0x4224cd
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x4224ca
push 0x21d9
push 0x1939
push eax
push eax
push 0x85
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x4224a8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x42249c
dec dword [ebp - 0x28]
jns 0x422488
push 0xfffffffffffffffb
xor eax, eax
pop ecx
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jne 0x422472
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffa
je 0x42243e
mov dword [ebp - 0x10], eax
jmp 0x42250f
push dword [ebp - 0x10]
call fcn.0040f321
mov dword [eax], 0xf3e7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
lea ecx, [ebp - 0xc14]
jl 0x4224fe
call fcn.0040f305
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
mov dword [ebp - 0xc], 0x17
cmp dword [ebp - 0xc], eax
jge 0x422620
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x1c], eax
jmp 0x42260d
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xfffffffa
jmp 0x422600
mov dword [ebp - 0x764], eax
mov dword [ebp - 0x760], eax
mov dword [ebp - 0x75c], eax
mov dword [ebp - 0x758], eax
mov dword [ebp - 0x3c], 0xa1e1c5a3
mov dword [ebp - 0x34], 0x12530a9b
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x758], 0xfffffffd
jle 0x4225fd
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x30], 0xfffffff3
jmp 0x4225e7
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
lea ecx, [eax*2 - 0x2988]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x34], edx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x4225e4
push eax
push 0x1610
push eax
push 0x1e8c
push 0x1c1b
push eax
push 0x17cb
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x4225a0
dec dword [ebp - 0x758]
cmp dword [ebp - 0x758], 0xfffffffd
jg 0x422590
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff3
jne 0x42255b
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffc
je 0x422548
dec dword [ebp - 0xc]
js 0x422539
mov dword [ebp - 0x40], 0xd5e4
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x42263a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x42264c
call edi
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 2
lea ecx, [ebp - 0x88]
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x42267d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x118], 0x4e2d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x422664
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x42268f
push dword [ebp - 0x10]
call fcn.0040f321
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
lea ecx, [ebp - 0x88]
jl 0x422682
push esi
call fcn.0040f321
xor ebx, ebx
mov dword [eax], ebx
jmp 0x42295b
push esi
lea ecx, [ebp - 0x88]
call fcn.0040f321
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x118], ebx
je 0x4227d6
push esi
lea ecx, [ebp - 0x88]
call fcn.0040f321
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x118], ebx
jne 0x4226fa
push esi
lea ecx, [ebp - 0x88]
call fcn.0040f321
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x118], ebx
jne 0x4226fa
xor eax, eax
mov edi, eax
inc eax
jmp 0x4226ff
xor eax, eax
inc eax
mov edi, eax
push eax
lea ecx, [ebp - 0x88]
call fcn.0040f321
mov esi, eax
lea ecx, [ebp - 0x88]
xor eax, eax
inc eax
push eax
call fcn.0040f321
mov ecx, dword [esi]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x118]
cmp dword [eax], ecx
lea ecx, [ebp - 0x88]
setg bl
xor esi, esi
push esi
call fcn.0040f321
xor ecx, ecx
cmp dword [eax], edi
setge cl
sub ecx, ebx
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
inc ebx
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x88]
push ebx
call fcn.0040f321
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [eax]
jg 0x42277d
push ebx
lea ecx, [ebp - 0x88]
call fcn.0040f321
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x118], esi
jne 0x42277d
xor eax, eax
inc eax
jmp 0x422782
xor eax, eax
inc eax
mov esi, eax
push eax
lea ecx, [ebp - 0x88]
call fcn.0040f321
xor ebx, ebx
lea ecx, [ebp - 0x88]
inc ebx
push ebx
sub esi, dword [eax]
call fcn.0040f321
push ebx
lea ecx, [ebp - 0x88]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x118]
sub esi, eax
call fcn.0040f321
mov ecx, dword [ebp - 0x114]
xor edx, edx
cmp esi, ecx
setge dl
sub edx, dword [eax]
neg edx
sbb edx, edx
inc edx
cmp edx, 0xffffffff
jae 0x4227d6
xor eax, eax
inc eax
mov esi, eax
jmp 0x4227db
xor eax, eax
mov esi, eax
inc eax
push eax
lea ecx, [ebp - 0x88]
call fcn.0040f321
xor ebx, ebx
lea ecx, [ebp - 0x88]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x118]
cmp esi, eax
setne bl
xor eax, eax
push eax
call fcn.0040f321
lea ecx, [ebp - 0x88]
mov esi, dword [eax]
xor eax, eax
inc eax
add esi, ebx
push eax
call fcn.0040f321
mov eax, dword [eax]
cmp esi, dword [ebp + eax*4 - 0x118]
jge 0x42285f
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x42285a
push eax
push 0x15c5
push eax
push eax
push 0xceb
push 0x204c
push 0x176
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
xor esi, esi
inc esi
jmp 0x4228c3
xor eax, eax
xor esi, esi
mov dword [ebp - 0x20], eax
inc esi
cmp dword [ebp - 0x20], esi
jge 0x42288a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1ec], 0xc80ae7b1
xor eax, eax
inc dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x20], eax
jl 0x42286c
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x1ec], esi
cmp dword [ebp - 0x1ec], eax
jl 0x4228bd
mov dword [ebp - 0x3c], 0x6a6c65b0
inc dword [ebp - 0x3c]
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x4228b5
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
xor eax, eax
dec dword [ebp - 0x1ec]
jns 0x422898
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push esi
lea ecx, [ebp - 0x88]
call fcn.0040f321
xor ebx, ebx
cmp dword [eax], ebx
je 0x42291b
mov dword [ebp - 0xc], 0x559653e3
xor eax, eax
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], eax
jl 0x42294d
mov dword [ebp - 0x3c], esi
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x3c], 0x34ab462a
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
push esi
call fcn.0040f321
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x118], ebx
jne 0x42294d
dec dword [ebp - 0xc]
jns 0x4228e6
jmp 0x42294d
push esi
lea ecx, [ebp - 0x88]
call fcn.0040f321
mov esi, eax
lea ecx, [ebp - 0x88]
xor eax, eax
inc eax
push eax
call fcn.0040f321
mov ecx, dword [esi]
xor esi, esi
inc esi
mov ecx, dword [ebp + ecx*4 - 0x118]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x118], ecx
push esi
lea ecx, [ebp - 0x88]
call fcn.0040f321
inc dword [eax]
push esi
lea ecx, [ebp - 0x88]
call fcn.0040f321
cmp dword [eax], esi
jle 0x4226aa
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x422986
push eax
push 0x186
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea ecx, [ebp - 0x88]
call fcn.0040f305
push 2
lea ecx, [ebp - 0xc44]
call fcn.0040f233
push esi
lea ecx, [ebp - 0xfec]
call fcn.0040f233
push esi
lea ecx, [ebp - 0x5d4]
call fcn.0040f233
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x4229e7
push dword [ebp - 0x10]
lea ecx, [ebp - 0xfec]
call fcn.0040f321
or dword [eax], 0xffffffff
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x4229c6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x422a11