Function at 0x42e574
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push ebx
push esi
push edi
push 2
pop ebx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x110]
mov dword [ebp - 8], 0xd313dd33
push ebx
mov byte [ebp - 0x2d], dl
call fcn.0042e201
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x42e5b2
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x110]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x42e5a3
mov dword [ebp - 8], 0xe
jmp 0x42e5f8
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 3
jmp 0x42e5ef
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
jmp 0x42e5e7
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x110]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x42e5d8
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff9
jge 0x42e5d0
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffec
jne 0x42e5c0
lea ecx, [ebp - 0x110]
call fcn.0042e2d3
mov dword [ebp - 0x14], 0x8b108f82
lea ecx, [ebp - 0xf8]
push 4
call fcn.0042e201
xor eax, eax
mov dword [ebp - 0x20], 0x9333c7d2
xor esi, esi
mov dword [ebp - 8], eax
inc esi
jmp 0x42e63c
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x80], 0x4a55f07c
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42e62e
mov dword [ebp - 8], eax
jmp 0x42e655
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xf8]
mov dword [ecx + edx*4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x42e646
cmp dword [ebp - 0x14], 0xb779c63c
mov ecx, dword [ebp - 0x14]
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, ecx
setge bl
sub ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, ecx
setge dl
cmp edx, 0xfff6
jae 0x42e691
mov edx, esi
cmp dword [ebp - 0x14], eax
jne 0x42e693
mov edx, eax
mov dword [ebp - 0x80], edx
mov ecx, dword [ebp - 0x14]
imul ecx, edx
add ecx, dword [ebp - 0x14]
je 0x42e6ae
mov ecx, dword [ebp - 0xf8]
cmp dword [ecx + 0xc], eax
mov ecx, esi
jne 0x42e6b0
mov ecx, eax
mov edx, dword [ebp - 0x14]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x1438
setl cl
mov dword [ebp - 0x20], ecx
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42e6ed
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x12d7
push 0xa96
push 0x1511
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea ecx, [ebp - 0xf8]
call fcn.0042e2d3
mov eax, dword [0x4a35ec]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 8], 0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 8
push esi
mov dword [ebp - 0x34], eax
call fcn.0042e201
xor eax, eax
mov dword [ebp - 0x24], 0x8ac2
mov dword [ebp - 8], eax
jmp 0x42e73c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x7c]
mov dword [ecx + edx*4], 9
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42e72c
mov dword [ebp - 8], eax
jmp 0x42e754
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x4c], 0xfffffffd
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42e746
mov dword [ebp - 8], eax
jmp 0x42e8f0
push dword [ebp + 8]
movdqa xmm0, xmmword [0xa958d0]
lea ecx, [ebp - 0x164]
push ecx
mov dword [ebp - 0x1c], 0x1ab6ec79
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x20], 0xe0d1
push ecx
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x18], 0x2891ba8
mov dword [ebp - 0x18], esi
push eax
movdqu xmmword [ebp - 0x174], xmm0
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
call fcn.0042e344
push dword [ebp + 8]
movdqa xmm0, xmmword [0xa95900]
lea ecx, [ebp - 0x134]
xor eax, eax
push ecx
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x28], 0xff68e10
push ecx
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x20], 0xb400765e
mov dword [ebp - 0x20], esi
push eax
movdqu xmmword [ebp - 0x144], xmm0
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
call fcn.0042e344
push esi
lea ecx, [ebp - 0x128]
call fcn.0042e201
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
jmp 0x42e828
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x128]
mov dword [ecx + edx*4], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x42e815
mov ecx, dword [ebp - 0x1c]
mov edx, esi
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x20], 0x1813f1a0
mov ecx, dword [ebp - 8]
sub edx, ecx
mov ecx, dword [ebp - 0x20]
cmp ecx, edx
mov ecx, 0x4446
setl bl
sub ecx, ebx
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x7c]
mov dword [ecx], edx
mov dword [ebp - 0x20], edx
inc dword [ebp - 0x24]
jne 0x42e8be
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x70]
add edx, dword [ecx]
mov ecx, dword [ebp - 0x7c]
cmp edx, dword [ecx]
mov ecx, dword [ebp - 8]
setge bl
mov dword [ebp - 0x18], ebx
xor ebx, ebx
cmp dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x1c]
setle bl
xor edx, edx
cmp ebx, ecx
setne dl
cmp edx, 0x2088c4b5
jg 0x42e8c8
mov ecx, dword [ebp - 0x64]
cmp dword [ecx + 0xc], eax
mov ecx, esi
jne 0x42e8ca
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
lea ecx, [ebp - 0x128]
call fcn.0042e2d3
lea ecx, [ebp - 0x64]
call fcn.0042e2d3
lea ecx, [ebp - 0x70]
call fcn.0042e2d3
dec dword [ebp - 8]
push 0
pop eax
cmp dword [ebp - 8], 0xffffffe3
jge 0x42e761
lea ecx, [ebp - 0x7c]
call fcn.0042e2d3
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], 0xac204e2
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xf9986e3
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x18], 0x719d8726
mov dword [ebp - 0x18], 0xd0811fc8
mov dword [ebp - 0x18], 0x1b0cadfb
mov dword [ebp - 0x20], 0x9338886a
mov dword [ebp - 0x18], 0x6cef3cf6
mov dword [ebp - 0x18], 0xfffffff9
push 4
mov dword [ebp - 0x18], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [ebp - 8], eax
pop edx
jmp 0x42e970
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x154], 0xffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x42e95f
mov dword [ebp - 8], eax
jmp 0x42e98b
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x190], 0x77b69c93
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x42e97a
mov dword [ebp - 8], 0x1d
jmp 0x42e9dd
mov dword [ebp - 0x10], 0x197f0a2
mov dword [ebp - 0x10], eax
jmp 0x42e9b6
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x12c], 0x17ca
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x42e9a5
mov dword [ebp - 0x10], eax
jmp 0x42e9d5
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42e9d2
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x42e9c0
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff7
jg 0x42e999
mov dword [ebp - 8], 3
cmp dword [ebp - 8], eax
jl 0x42eb06
mov ebx, 0x72157666
mov dword [ebp - 0x24], 3
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x1c], 0x2206dd2c
push 2
call fcn.0042e201
mov dword [ebp - 0xb0], ebx
xor eax, eax
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x14], 0xb6d700d1
mov dword [ebp - 0x10], eax
jmp 0x42ea4c
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + edx*4], 0xfa2ef703
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x42ea39
mov ecx, dword [ebp - 8]
dec dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xb0]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
sub esi, ecx
mov ecx, dword [ebp - 8]
neg esi
sbb esi, esi
xor edx, edx
inc esi
sub esi, dword [ebp + ecx*4 - 0x154]
mov ecx, dword [ebp - 8]
cmp esi, 0xd97
setge dl
cmp dword [ebp + ecx*4 - 0x154], edx
je 0x42ea9b
cmp dword [ebp - 0x14], eax
jne 0x42ea9b
mov ecx, eax
jmp 0x42ea9e
xor ecx, ecx
inc ecx
xor ebx, ebx
cmp ecx, 0xfffffffe
mov ecx, dword [ebp - 0x24]
setge bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0xd4]
setg dl
mov dword [ecx + 4], edx
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x42eaed
mov dword [ebp - 0x18], 0x7d239f94
mov dword [ebp - 0x14], eax
jmp 0x42eae2
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x190], 0x31ec8e12
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x42ead1
dec dword [ebp - 0x1c]
jns 0x42eac5
lea ecx, [ebp - 0xd4]
call fcn.0042e2d3
dec dword [ebp - 8]
mov ebx, 0x72157666
jns 0x42e9f8
cmp byte [ebp - 0x2d], 0
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [ebp - 0x34]
je 0x42ecb3
cmp ebx, 1
jne 0x42ecb3
push 3
pop ebx
mov dword [ebp - 8], 0xfffd
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x24], 0x16488a
push ebx
call fcn.0042e201
mov dword [ebp - 0x1c], 0x16765654
xor eax, eax
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x20], 0x5e45db0f
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], eax
jmp 0x42eb71
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xbc]
mov dword [ecx + edx*4], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x42eb5e
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xbc]
cmp dword [ecx], 0xffff
sete bl
xor edx, edx
mov dword [ecx + 8], ebx
mov ecx, dword [ebp - 8]
cmp ebx, ecx
setge dl
add edx, dword [ebp - 8]
cmp edx, dword [ebp - 8]
je 0x42ebab
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 0x1c], 0x15b45bea
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xa340
setge dl
xor ebx, ebx
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp edx, ecx
setle bl
xor ecx, ecx
cmp ebx, dword [ebp - 0x18]
setl cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 8]
setne dl
xor ebx, ebx
cmp edx, 0xb03c3fa3
setne bl
xor edx, edx
cmp ebx, ecx
setg dl
xor ebx, ebx
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 8]
setle bl
xor edx, edx
cmp ebx, 0x8a59
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setne bl
xor edx, edx
cmp ebx, ecx
setge dl
mov dword [ebp - 0x18], edx
cmp dword [ebp - 8], eax
je 0x42ec4c
mov ecx, dword [ebp - 0xbc]
cmp dword [ecx + 4], eax
je 0x42ec4c
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0xbc]
call fcn.0042e2d3
mov dword [ebp - 0x18], 0xa684
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
mov dword [edi + 8], 4
je 0x42ec7b
call esi
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x42eca9
push 0x85b
push 0x1253
push 0x17af
push 0x17f4
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov ebx, dword [ebp - 0x34]
mov dword [edi + 0xc], 0x4a35ec
push 2
lea ecx, [ebp - 0xe0]
call fcn.0042e201
push 2
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0
pop edx
jmp 0x42ece6
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], 0xac64a684
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x42ecd3
mov dword [ebp - 0x14], 0
jmp 0x42ed07
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x42ecf4
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x14], 0x1dba3399
call fcn.0042e2d3
cmp dword [ebp - 0x2c], ebx
jge 0x42f6ca
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xc8]
call fcn.0042e201
mov dword [ebp - 8], 0xe7ccc895
mov dword [ebp - 0x10], 0
jmp 0x42ed59
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], 0xd4e06482
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x42ed46
mov eax, dword [ebp - 0xc8]
push 0xffffffffffffffe2
pop edi
mov dword [eax], edi
push ebx
lea ecx, [ebp - 0xec]
call fcn.0042e201
mov dword [ebp - 0x10], 0x13fe662d
mov dword [ebp - 0x18], 0xeafb5d1c
mov dword [ebp - 0x10], 0
jmp 0x42ed9f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0xe5664dc9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x42ed8c
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov ecx, edx
mov eax, dword [ebp - 8]
add eax, edx
imul eax, eax, 0xffff
sub ecx, eax
xor eax, eax
cmp ecx, edx
setle al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x42ee0a
mov dword [ebp - 8], 0xfffffffd
jmp 0x42ee02
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x42edff
push 0x24fc
push 0
push 0x29a
call esi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
dec dword [ebp - 8]
cmp dword [ebp - 8], edi
je 0x42ede0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 5
jg 0x42edd7
lea ecx, [ebp - 0xec]
call fcn.0042e2d3
mov eax, dword [ebp - 0xc8]
inc dword [eax]
cmp dword [eax], 0xfffffff4
jle 0x42ed69
mov dword [ebp - 8], 0xfffffff1
cmp dword [ebp - 8], 0xffffffe3
je 0x42ee59
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42ee50
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
xor eax, eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe3
jne 0x42ee3b
lea ecx, [ebp - 0xc8]
call fcn.0042e2d3
mov dword [ebp - 8], 0xfffffff7
xor ecx, ecx
mov dword [ebp - 0x10], 0xffff
mov edi, 0x4a35f0
mov dword [ebp - 0x14], 0xeae21516
mov dword [ebp - 0x1c], 0x2d50c857
mov dword [ebp - 0x28], 0x3eb61943
mov dword [ebp - 0x24], 0x898d08f4
mov eax, dword [ebp - 8]
cmp eax, 0x1b35d569
setge cl
xor eax, eax
sub ecx, dword [ebp - 0x10]
jne 0x42eeac
cmp dword [ebp - 0x10], eax
je 0x42eeaf
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0x14]
add esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
cmp esi, ecx
setl dl
xor ebx, ebx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
cmp ecx, edx
setge bl
add ebx, dword [ebp - 8]
je 0x42eeef
cmp dword [ebp - 8], eax
je 0x42eeef
xor esi, esi
inc esi
mov ecx, esi
jmp 0x42eef4
xor esi, esi
mov ecx, eax
inc esi
imul ecx, ecx, 0xfffe
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x28], ecx
imul ecx, dword [ebp - 0x28], 0xdda8
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
je 0x42eff4
mov dword [ebp - 0x10], 0x63b6910c
mov dword [ebp - 0x18], 0xde333b8f
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], eax
jmp 0x42efe5
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x236c3428
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42ef65
push eax
push 0x1eaf
push eax
push 0x23d2
push 0x1788
push eax
push 0xab6
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], 0xffff
cmp dword [ebp - 0x20], 6
sbb ecx, ecx
xor ebx, ebx
neg ecx
imul ecx, ecx, 0x5e06
cmp ecx, 0x8385
setl bl
xor edx, edx
imul ebx, dword [ebp - 0x28]
sub ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp ebx, ecx
setne dl
mov dword [ebp - 0x28], edx
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
test ecx, ecx
setns dl
cmp edx, dword [ebp - 0x10]
jne 0x42efbe
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x42efc0
mov edx, esi
mov ecx, dword [ebp - 0x10]
add edx, 0xffffd59a
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0x20]
setne bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [ebp - 0x18], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jge 0x42ef33
jmp 0x42f0bb
push dword [ebp + 8]
movdqa xmm0, xmmword [0xa958f0]
lea ecx, [ebp - 0x154]
push ecx
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x28], esi
push ecx
push eax
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x8c], eax
movdqu xmmword [ebp - 0x164], xmm0
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
call fcn.0042e344
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x42f059
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x1e76
push 0
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0xffffbfd7
mov eax, dword [ebp - 0x28]
setle cl
neg ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
je 0x42f080
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
cmp eax, 0x5ced7c6c
mov eax, dword [ebp - 8]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x8c]
setl cl
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0x8c]
call fcn.0042e2d3
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42f0cf
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
xor eax, eax
cmp dword [ebp - 0x2c], 0
jle 0x42f2ee
mov dword [ebp - 0x14], 0xe91a049f
mov dword [ebp - 0x24], 0xeb987642
mov dword [ebp - 0x28], 0x1654
mov dword [ebp - 0x20], 0x52509e71
mov dword [ebp - 0x18], 0x16b5
mov dword [ebp - 0x14], 0xffffffe5
jmp 0x42f14d
mov dword [ebp - 0x1c], 0xe21afa9b
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], ecx
je 0x42f12b
cmp dword [ebp - 0x28], eax
je 0x42f125
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
cmp edx, ecx
setl bl
mov dword [ebp - 0x18], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
jge 0x42f105
mov ebx, dword [edi]
mov dword [ebp - 0x18], 0x4210
mov dword [ebp - 0x1c], eax
jmp 0x42f172
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0xa0], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x42f161
mov dword [ebp - 0x1c], eax
jmp 0x42f18d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x134], 0x876942a1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x42f17c
mov eax, dword [ebp - 0x130]
lea ecx, [ebp - 0x11c]
sub eax, dword [ebp - 0x18]
neg eax
push 2
sbb eax, eax
inc eax
mov dword [ebp - 0xa0], eax
call fcn.0042e201
push 2
lea ecx, [ebp - 0x104]
call fcn.0042e201
mov dword [ebp - 0x18], esi
xor eax, eax
push 2
mov dword [ebp - 8], eax
pop esi
jmp 0x42f1e1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x11c]
mov dword [ecx + edx*4], 0xb0f73838
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42f1ce
mov dword [ebp - 8], eax
jmp 0x42f1fe
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x104]
mov dword [ecx + edx*4], 0xa9ac70c3
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42f1eb
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x104]
mov dword [ecx + 4], edx
mov dword [ebp - 0x18], edx
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42f22e
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
lea ecx, [ebp - 0x104]
call fcn.0042e2d3
lea ecx, [ebp - 0x11c]
call fcn.0042e2d3
mov esi, dword [edi + 4]
xor eax, eax
mov dword [ebp - 0x1c], 0x3c692bea
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42f265
push 0x24a7
call dword [sym.imp.USER32.dll_GetQueueStatus]
xor eax, eax
mov dword [ebp - 0x1c], 0x1d
jmp 0x42f27d
mov dword [ebp - 0x18], 0xfff8
cmp dword [ebp - 0x18], eax
jne 0x42f283
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x14
jle 0x42f26e
mov dword [ebp - 0x18], eax
add edi, 8
mov dword [ebp - 0x24], 0xe60f951
mov dword [ebp - 0x20], 0x729cf308
mov dword [ebp - 0x20], 0x735b263d
mov dword [ebp - 0x20], 0x3e76e5b1
mov dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x1c], eax
jmp 0x42f2c2
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x1a0], 0x942a1e94
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x42f2b1
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, 0xfffffff8
setne dl
mov dword [ebp - 0x24], edx
dec dword [ebp - 0x20]
test esi, esi
jne 0x42f2e0
add edi, 8
add edi, ebx
dec dword [ebp - 0x2c]
push 1
pop esi
jne 0x42f0d9
mov dword [ebp - 0x18], 0xc05baf43
mov dword [ebp - 0x18], 0x3d8da8e9
mov dword [ebp - 0x18], 0xb4074dd0
mov dword [ebp - 0x18], 0x6f5a9c4c
push 2
pop ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x18], 0xfbf2121f
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0x20e32cf4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0x5720b963
mov dword [ebp - 0x18], 0x6fe23a26
mov dword [ebp - 0x18], 0x3bd6525
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 0xb27fa3df
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
dec dword [ebp - 0x20]
mov esi, dword [edi]
push 3
mov dword [ebp - 0x28], esi
mov dword [ebp - 8], eax
pop edx
jmp 0x42f37f
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x180], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x42f372
mov dword [ebp - 8], eax
jmp 0x42f39a
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x9c], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x42f389
mov dword [ebp - 0x94], eax
jmp 0x42f460
mov dword [ebp - 0x24], 0x98311173
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x42f448
xor edx, edx
inc edx
mov dword [ebp - 0x1c], eax
jmp 0x42f3d3
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x38], 0xd0d3f7bf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x42f3c5
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42f3ff
push eax
push eax
push 0x22d3
push 0x914
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
xor edx, edx
xor eax, eax
inc edx
mov dword [ebp - 0x38], eax
jmp 0x42f43a
mov dword [ebp - 0x2c], 0x2513244d
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x42f437
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
jmp 0x42f42c
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x180], 0xffaf0720
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x42f41b
dec dword [ebp - 0x2c]
jns 0x42f413
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x42f404
dec dword [ebp - 0x24]
jns 0x42f3c0
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42f45a
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
xor eax, eax
inc dword [ebp - 0x94]
cmp dword [ebp - 0x94], ebx
jle 0x42f3aa
mov ecx, dword [edi + 4]
mov dword [ebp - 8], 0x4173
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], 0x2c5b641b
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], eax
jne 0x42f4c3
cmp dword [ebp - 8], eax
jne 0x42f4c3
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x42f4c8
xor ebx, ebx
inc ebx
mov edx, ebx
xor ecx, ecx
cmp edx, 0x1a6e483b
setl cl
cmp dword [ebp - 8], ecx
jl 0x42f4df
mov ecx, ebx
cmp dword [ebp - 0x14], eax
jne 0x42f4e1
mov ecx, eax
mov edx, dword [ebp - 0x14]
xor ebx, ebx
imul edx, ecx
mov ecx, dword [ebp - 8]
cmp edx, ecx
setge bl
sub ebx, dword [ebp - 0x2c]
neg ebx
sbb ebx, ebx
inc ebx
cmp ebx, dword [ebp - 0x14]
jl 0x42f514
mov dword [ebp - 0x18], 0x312b9482
mov dword [ebp - 0x10], 0xfffffffa
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
jmp 0x42f53a
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
jmp 0x42f534
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42f531
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x26
je 0x42f51f
mov dword [ebp - 8], 0xa
jmp 0x42f55a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jne 0x42f560
mov ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x10], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1a
jg 0x42f543
mov dword [ebp - 0x2c], eax
xor ebx, ebx
mov dword [ebp - 0x14], 8
xor edx, edx
mov ecx, dword [ebp - 0x2c]
inc ebx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
cmp ecx, ebx
setle dl
xor ecx, ecx
cmp edx, 0x32b1cecb
setl cl
cmp ecx, dword [ebp - 0x2c]
jl 0x42f5d6
mov dword [ebp - 0x14], eax
jmp 0x42f5ce
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42f5cb
push 0x85b
push 0x1253
push 0x17af
push 0x17f4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffff
je 0x42f598
jmp 0x42f5f3
mov dword [ebp - 0x18], 3
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42f5f3
push eax
call dword [sym.imp.GDI32.dll_GetObjectType]
cmp dword [ebp - 0x20], 0
jne 0x42f6ce
cmp byte [ebp - 0x2d], 0
je 0x42f611
cmp dword [ebp - 0x34], ebx
jne 0x42f611
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [edi + 0xc]
add edi, 0x10
push esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], edi
call fcn.0047c2f1
mov dword [ebp - 0x20], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x90], eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x90]
push eax
push esi
call fcn.004609c3
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov edi, dword [ebp - 0x58]
mov esi, ecx
test eax, eax
jle 0x42f6a4
mov ebx, dword [ebp - 0x18]
mov eax, esi
and eax, 0x80000001
jns 0x42f66d
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x34]
add eax, esi
add eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x2c]
jmp 0x42f682
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x28]
cmp word [edi + edx*2], cx
jne 0x42f67f
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov al, byte [edx + ebx]
mov edx, dword [ebp - 0x20]
mov byte [esi + edx], al
inc esi
mov eax, dword [ebp - 0x28]
cmp esi, eax
jl 0x42f65f
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x20]
mov dword [edx + 4], eax
test edi, edi
je 0x42f6d2
push edi
call fcn.0047d7e6
pop ecx
xor ecx, ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov edi, dword [ebp + 8]
jmp 0x42f6d4
xor ecx, ecx
jmp 0x42f6d4
xor ecx, ecx
jmp 0x42f6c5
mov edi, edx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp + 8], ecx
mov dword [ebp - 0x10], 0x5d764ce3
mov dword [ebp + 8], ecx
jmp 0x42f6ff
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x48], 8
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x42f6f1
xor ebx, ebx
mov dword [ebp + 8], ecx
inc ebx
jmp 0x42f71b
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x3c], 0x98b94be3
inc dword [ebp + 8]
cmp dword [ebp + 8], ebx
jl 0x42f70d
mov eax, dword [ebp - 0x48]
mov edx, ebx
mov eax, dword [ebp - 0x44]
sub edx, eax
mov dword [ebp - 0x20], edx
xor edx, edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp eax, ebx
setle dl
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
dec eax
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp edx, eax
setne bl
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
sub edx, eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
add esi, edx
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, eax
setne dl
cmp dword [ebp - 0x44], edx
jne 0x42f7a7
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x42f817
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x42f817
mov dword [ebp - 0x18], 6
mov dword [ebp + 8], ecx
cmp dword [ebp + 8], ecx
jl 0x42f817
mov eax, dword [ebp + 8]
mov edx, 0xee3199f2
push 2
mov eax, dword [ebp + eax*4 - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 0x18]
cmp edx, eax
sbb eax, eax
xor edx, edx
neg eax
neg eax
cmp esi, eax
mov eax, dword [ebp + 8]
setg dl
mov dword [ebp + eax*4 - 0x3c], edx
pop edx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ecx
jl 0x42f812
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], edx
jg 0x42f80d
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xa051aaf1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x42f7fb
dec dword [ebp - 0x14]
jns 0x42f7f0
dec dword [ebp + 8]
jns 0x42f7b6
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret