Function at 0x40174d
Capabilities:
Create directory
Get file attributes
Modify service
Query environment variable
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc50
push ebx
push esi
push edi
xor edi, edi
mov byte [ebp - 0x3d], dl
inc edi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x28], edi
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x20], 0xf78d7cba
mov dword [ebp - 0x24], 0x7d6446bd
cmp dword [ebp - 0x28], eax
je 0x401783
mov eax, edi
push 3
mov dword [ebp - 0x20], eax
mov ebx, 0x4360575
pop ecx
xor eax, eax
push 9
pop edx
cmp dword [ebp - 0x20], eax
ja 0x401857
mov dword [ebp - 0x14], 0x3c61
mov dword [ebp - 0x20], 0x72c02a30
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ecx
jge 0x4017c6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xbb0], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x4017b2
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4017d8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xbc8], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x4017cb
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x401825
mov dword [ebp - 0xbac], 0xfbc9fa8b
mov ecx, ebx
mov eax, dword [ebp - 0x14]
sub ecx, eax
xor eax, eax
sub ecx, dword [ebp - 0x14]
je 0x401806
mov ecx, edi
cmp dword [ebp - 0x28], eax
jne 0x401808
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor eax, eax
test ecx, ecx
setle al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x401827
mov eax, edi
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0xd3e9
setge dl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xbc4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
cmp ecx, edi
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
jmp 0x401865
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x401865
call dword [sym.imp.GDI32.dll_GdiFlush]
push 2
pop esi
push esi
lea ecx, [ebp - 0x384]
call fcn.0041257d
xor eax, eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x40189b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x384]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x401881
xor eax, eax
mov dword [ebp - 0xc], edi
push 4
pop esi
cmp dword [ebp - 0xc], eax
jl 0x40193c
jmp 0x4018ae
xor eax, eax
mov dword [ebp - 0x20], 0x8e2294bb
mov dword [ebp - 0x24], 0x89063530
mov dword [ebp - 0x14], eax
jmp 0x4018d2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc08], 0x9d2e819d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x4018c1
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
push 9
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0xc00], ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0xc]
imul edx, ecx
sub edx, eax
je 0x401918
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x40191a
mov esi, edi
jmp 0x40191c
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0x384]
push 4
cmp dword [eax + ecx*4], esi
pop esi
setg dl
mov dword [ebp - 0x24], edx
dec dword [ebp - 0xc]
jns 0x4018ac
lea ecx, [ebp - 0x384]
call fcn.004129c0
movdqa xmm0, xmmword [0xaa3240]
lea ecx, [ebp - 0xa0c]
push ecx
lea eax, [ebp - 0x9fc]
mov dword [ebp - 0x28], 0xfffffffe
push eax
push ecx
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x668]
movdqu xmmword [ebp - 0xa0c], xmm0
call fcn.004125f3
mov dword [ebp - 0x1c], 0xfffffffa
xor eax, eax
mov dword [ebp - 0x24], 0xa133a5b7
mov dword [ebp - 0x14], eax
jmp 0x4019a5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8fc], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x401994
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 8
push 0xffffffffffffffff
pop ecx
je 0x401b5e
mov esi, dword [ebp - 0x668]
jmp 0x4019cf
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x14], 0x1591
xor edx, edx
mov dword [ebp - 0x20], 0x6d5d64f6
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0xd19f
setle al
xor ecx, ecx
cmp eax, 0xfffffff9
setg cl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0x333e
jg 0x401a1c
xor eax, eax
mov edx, eax
cmp dword [esi + 8], eax
je 0x401a1e
mov edx, edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
setl cl
or edx, 0xffffffff
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8f0]
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, 8
setne al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x8f0], eax
xor eax, eax
cmp dword [esi + 8], eax
setne al
cmp eax, dword [esi + 4]
je 0x401a7f
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x401a86
mov eax, edi
jmp 0x401a81
xor eax, eax
cmp dword [ebp - 0x14], eax
jg 0x401a9d
mov dword [ebp - 0x24], 0xb42b8ffd
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x401b5e
jmp 0x401b51
push 4
pop edx
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x494]
push edx
call fcn.0041257d
xor eax, eax
mov dword [ebp - 0x34], 0xa5cd
push 4
mov dword [ebp - 0xc], eax
pop edx
jmp 0x401acf
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x494]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x401ac0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x20]
jge 0x401aee
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x401af0
mov eax, edi
add eax, dword [esi + 8]
cmp eax, 0xccf75bae
sbb eax, eax
inc eax
cmp eax, dword [esi + 8]
jg 0x401b09
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x401b0b
mov edx, edi
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x494]
setg cl
neg ecx
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x668]
imul ecx, dword [eax], 0x226f
mov eax, dword [ebp - 0x1c]
add eax, ecx
lea ecx, [ebp - 0x494]
mov dword [ebp - 0x24], eax
call fcn.004129c0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 8
jne 0x4019ca
lea ecx, [ebp - 0x668]
call fcn.004129c0
mov dword [ebp - 0x1c], edi
xor eax, eax
mov dword [ebp - 0x20], 0x9e57ad95
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x401b95
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x160], 0xc204e2db
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x401b7d
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jl 0x401bb3
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x401bae
call dword [sym.imp.USER32.dll_CreateMenu]
xor eax, eax
dec dword [ebp - 0x20]
jns 0x401b9d
mov eax, dword [ebp - 0x160]
or ecx, 0xffffffff
mov dword [ebp - 0x160], eax
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0xc], 0x6de713a
mov dword [ebp - 0x24], ecx
push 2
mov dword [ebp - 0x14], eax
pop esi
cmp dword [ebp - 0x14], esi
jge 0x401bf4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x198], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x401be0
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x401c37
mov dword [ebp - 0x20], 0x83111738
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x401c34
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x198]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x198], ecx
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x401c2d
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
dec dword [ebp - 0x20]
jns 0x401c08
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jle 0x401bf9
mov eax, dword [ebp - 0xc]
xor eax, eax
cmp dword [ebp - 0xc], eax
je 0x401c48
mov eax, edi
cmp dword [ebp - 0x198], eax
jg 0x401c56
mov eax, dword [ebp - 0x198]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax
sub ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x198]
mov eax, dword [ebp - 0xc]
cmp ecx, 0x4f78
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xfffffff7
mov ecx, 0x3b2b74c3
setne al
or edx, 0xffffffff
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x20], 0xf78d7cba
mov dword [ebp - 0x28], 0x102071b1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0x28], eax
je 0x401cb6
mov dword [ebp - 0xc], eax
jmp 0x401d7b
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x28], 0x1c
cmp dword [ebp - 0x28], 0x39
jl 0x401d4a
push 4
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xfffffff8
jg 0x401d21
mov dword [ebp - 0x18], 0x61bab593
mov dword [ebp - 0x18], eax
jmp 0x401d0f
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x401d09
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
dec dword [ebp - 0x14]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
jle 0x401cf6
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff8
jle 0x401cea
push 4
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ecx
jge 0x401d41
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x41c], 0x552bf338
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x401d29
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x39
jge 0x401ce1
mov dword [ebp - 0x14], 0xffffffe2
jmp 0x401d75
cmp dword [ebp - 0x418], eax
jne 0x401d7b
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x401d72
push 0x81c
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jle 0x401d53
or eax, 0xffffffff
mov dword [ebp - 0x24], 0x7d6446bd
lea ecx, [ebp - 0xa3c]
mov dword [ebp - 0x10], eax
push ecx
lea eax, [ebp - 0xa2c]
xorps xmm0, xmm0
push eax
push ecx
lea ecx, [ebp - 0x9d8]
movdqu xmmword [ebp - 0xa3c], xmm0
call fcn.004125f3
mov dword [ebp - 0x20], 0x7f28
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x10], 0x1f997ec5
mov dword [ebp - 0x10], 0x81b27067
mov dword [ebp - 0x24], 0x50eb6ba8
push 3
mov dword [ebp - 0x34], eax
pop ecx
cmp dword [ebp - 0x34], ecx
jge 0x401df1
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xa4], 0xd41e5596
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x401dd9
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x401e10
or edx, 0xffffffff
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x8e0], edx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x401dfc
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x401e22
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x4ac], edi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x401e15
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0xa4], eax
je 0x401eb9
mov eax, dword [ebp - 0x9c]
sub eax, dword [ebp - 0xa0]
cmp eax, 0xfffffffb
jne 0x401e51
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa0]
xor edx, edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x9d8]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x8e0], eax
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0xa0]
setl dl
cmp edx, 0xf57b17b4
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x4ac]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x20]
jl 0x401eb7
mov ecx, edi
jmp 0x401ebb
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, edi
sete al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4ac]
mov edx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
mov eax, dword [ebp - 0xa4]
cmp edx, eax
setl cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x9d8]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x24], 0
call fcn.004129c0
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x401f32
mov eax, edi
mov dword [ebp - 0x20], eax
or ecx, 0xffffffff
push 9
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x30], 0x2971c1e
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x10], 0xf75d
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edi
jge 0x401f77
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x858], 0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x401f5f
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x401f97
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xbe8], 0xac54c975
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x401f7f
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x401fc2
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1cc8
push 0x7d9
push 0x6fc
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor eax, eax
or ecx, 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x20], eax
ja 0x402777
mov dword [ebp - 0x10], 0x67e307b5
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x4c4]
push 3
call fcn.0041257d
mov dword [ebp - 0x14], 0xfe831e34
xor eax, eax
mov dword [ebp - 0x28], 0xeeff
mov dword [ebp - 0x18], 0x73439d6f
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jge 0x402018
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x5c], edi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x402007
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jge 0x402038
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x8c], 0x4dde9ab
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x402020
xor eax, eax
mov dword [ebp - 0x34], eax
xor edx, edx
cmp dword [ebp - 0x34], 3
jge 0x402054
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c4]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x34]
jmp 0x40203d
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x8c]
cmp eax, ecx
mov eax, edi
cmovl eax, edx
cmp dword [ebp - 0x10], edx
je 0x402076
cmp dword [ebp - 0x5c], edx
je 0x402076
mov edx, edi
imul eax, eax, 0xfbe5
xor ecx, ecx
cmp eax, 0x9968
setl cl
xor eax, eax
cmp edx, 0xcd9796a
sete al
sub ecx, eax
mov eax, 0xfffb
cmp eax, ecx
mov eax, dword [ebp - 0x5c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x5c], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x402131
mov dword [ebp - 0x20], 0x33e235bd
xor ecx, ecx
mov dword [ebp - 0x28], 0xf9d9
mov dword [ebp - 0xc], 0x714a8a5a
mov dword [ebp - 0x24], eax
push 4
pop edx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c4]
cmp dword [eax], ecx
setge cl
xor eax, eax
cmp dword [ebp - 0x5c], ecx
jge 0x402120
cmp dword [ebp - 0x28], eax
je 0x402120
mov eax, edi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x18]
jmp 0x4021df
mov dword [ebp - 0x20], 0x7bd5
lea ecx, [ebp - 0x644]
mov dword [ebp - 0x14], eax
push esi
call fcn.0041257d
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x40216b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x644]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x402151
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x402172
mov eax, edi
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x644]
mov dword [ebp - 0x5c], esi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0xfffffff9
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp esi, ecx
setl al
mov dword [edi + 4], eax
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x4021c8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x4021c5
mov dword [edi + 4], 0x1f29c70a
dec dword [ebp - 0x14]
jns 0x4021b9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 5
jg 0x4021b1
lea ecx, [ebp - 0x644]
call fcn.004129c0
xor edi, edi
push 2
inc edi
pop esi
lea ecx, [ebp - 0x4c4]
call fcn.004129c0
mov dword [ebp - 0x2c], 0x3c61
xor eax, eax
mov dword [ebp - 0x14], 0x39b6
mov dword [ebp - 0x20], 0x39e3cf95
mov dword [ebp - 0x24], 0x277ebd00
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x40221e
push 0x338
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x402293
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0xc01e6e2b
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x20], eax
jle 0x402244
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x10], eax
je 0x402246
mov ecx, edi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
imul eax, ecx
test eax, eax
je 0x402269
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x40226b
mov ecx, edi
jmp 0x40226d
xor eax, eax
mov ecx, eax
xor eax, eax
cmp ecx, 0xde9a
setle al
xor edx, edx
cmp eax, 0xfffffff7
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setg cl
mov dword [ebp - 0x20], ecx
jmp 0x4022a8
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x4022aa
push eax
push 0xf06
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
mov dword [ebp - 0x20], 0x72c02a30
mov dword [ebp - 0x30], 0x13638ecf
mov dword [ebp - 0x30], 0x9aed23b6
mov dword [ebp - 0x20], 0xffff
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x4022e6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc30], 0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x4022ce
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x402306
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xbf0], 0x53072226
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x4022ee
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x40231b
push 0x2478
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0xc], 0x24a8c6a5
push 3
call fcn.0041257d
push edi
lea ecx, [ebp - 0x6ec]
call fcn.0041257d
xor eax, eax
push 3
mov dword [ebp - 0xc], eax
pop edx
cmp dword [ebp - 0xc], edx
jge 0x402361
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1a8]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x40234b
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x402379
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x6ec]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x402366
mov dword [ebp - 0xc], 0xffffffef
cmp dword [ebp - 0xc], 0xffffffee
jle 0x402418
mov esi, dword [ebp - 0x1a8]
mov dword [ebp - 0x18], 0xd69f4288
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x18], edx
jmp 0x4023bd
mov dword [ebp - 0x24], 0xd21dfe4b
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1a8]
mov dword [eax], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff9
jne 0x4023a8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x4023d3
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6ec]
xor edx, edx
push 3
and dword [eax], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1a8]
neg edx
sbb edx, edx
inc edx
imul edx, dword [eax]
mov dword [esi + 4], edx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffee
pop edx
jg 0x402395
push 2
pop esi
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], eax
jl 0x402437
or edx, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1a8]
mov dword [eax + ecx*4 + 4], edx
dec dword [ebp - 0xc]
jns 0x402425
lea ecx, [ebp - 0x6ec]
call fcn.004129c0
lea ecx, [ebp - 0x1a8]
call fcn.004129c0
xor eax, eax
push 3
mov dword [ebp - 0xc], eax
pop ecx
cmp dword [ebp - 0xc], ecx
jge 0x402471
push 9
pop edx
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xbe0], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x40245d
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ecx
jge 0x40248d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xbd4], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x402479
xor eax, eax
mov dword [ebp - 0x28], 0xac204e2
or edx, 0xffffffff
mov dword [ebp - 0x20], edx
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x4024ba
push eax
push 0xe77
push eax
push 0x14b6
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
push 3
xor eax, eax
pop ecx
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffffd
jg 0x4026f7
jmp 0x4024cc
push 3
pop ecx
push ecx
mov dword [ebp - 0x18], 0x90197f0a
lea ecx, [ebp - 0x39c]
call fcn.0041257d
push esi
lea ecx, [ebp - 0x470]
call fcn.0041257d
xor eax, eax
mov dword [ebp - 0x24], 0xe95
push 3
mov dword [ebp - 0x34], eax
pop edx
cmp dword [ebp - 0x34], edx
jge 0x402517
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x240], 0
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x4024ff
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
jge 0x402539
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x39c]
mov dword [eax + ecx*4], 0x9fa18394
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x40251f
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jge 0x40255b
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x470]
mov dword [eax + ecx*4], 0x4ad8a0f8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jl 0x402541
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jg 0x4026d4
push 9
pop ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jg 0x4026c8
mov esi, dword [ebp - 0x470]
mov dword [ebp - 0x20], 0xb90f9986
mov dword [ebp - 0x10], 0x76e8d2ca
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x14], eax
jmp 0x4025aa
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x164], 0x6bb2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x402599
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x240]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x240], edi
mov dword [ebp - 0x238], 0xfffffff8
cmp dword [ebp - 0x20], edx
je 0x402623
mov eax, dword [ebp - 0x39c]
cmp dword [eax], edx
je 0x402623
mov eax, dword [ebp - 0x18]
mov ecx, 0xd997
mov dword [esi + 4], ecx
mov dword [ebp + eax*4 - 0x240], ecx
mov ecx, 0xffff2669
mov eax, dword [ebp - 0xc]
sub ecx, eax
shl ecx, 2
cmp ecx, dword [ebp - 0xc]
jne 0x40261f
cmp dword [ebp - 0x164], edx
je 0x402623
mov ecx, edi
jmp 0x402625
mov ecx, edx
mov eax, dword [ebp - 0x18]
sub ecx, eax
add ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x28], ecx
jge 0x402639
mov ecx, edi
cmp dword [ebp - 0x18], edx
jne 0x40263b
mov ecx, edx
mov eax, dword [ebp - 0x164]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x39c]
setge cl
cmp ecx, dword [eax]
je 0x402671
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x240], ecx
je 0x40267a
jmp 0x402673
xor ecx, ecx
mov edx, edi
cmp dword [ebp - 0xc], ecx
jne 0x40267c
mov edx, ecx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, 0xd2dc
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 0xfff8
cmp eax, dword [ebp - 0x24]
je 0x4026a4
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [esi + 4]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0xc]
push 2
pop eax
cmp dword [ebp - 0xc], eax
push 0
pop eax
jle 0x40257f
push 2
pop esi
push 9
pop ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x40256a
lea ecx, [ebp - 0x470]
call fcn.004129c0
lea ecx, [ebp - 0x39c]
call fcn.004129c0
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffd
jle 0x4024c9
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0
jne 0x402740
mov dword [ebp - 0xbdc], 0xfbc9fa8b
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
sub ecx, eax
sub ecx, dword [ebp - 0x2c]
je 0x40271f
mov ecx, edi
cmp dword [ebp - 0x1c], ebx
jne 0x402721
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
xor eax, eax
test ecx, ecx
setle al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jne 0x402742
mov eax, ebx
jmp 0x402744
xor ebx, ebx
mov eax, edi
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0xd3e9
setge dl
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xbd0]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
cmp ecx, edi
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
jmp 0x402a65
mov dword [ebp - 0x14], 3
xor ebx, ebx
mov dword [ebp - 0x14], 0x17
cmp dword [ebp - 0x14], edi
jg 0x40282a
mov dword [ebp - 0x1c], 0xef20fe6e
lea ecx, [ebp - 0x840]
push edi
call fcn.0041257d
mov dword [ebp - 0x1c], ebx
jmp 0x4027bb
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x840]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x4027a8
mov dword [ebp - 0x1c], 8
jmp 0x4027f3
mov dword [ebp - 0x20], 0x3f9e923e
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x4027f0
mov byte [ebp - 0x35], bl
cmp byte [ebp - 0x35], bl
je 0x4027eb
push 0x7cc
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
dec dword [ebp - 0x20]
jns 0x4027d8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1a
jle 0x4027c9
mov byte [ebp - 0x35], bl
cmp byte [ebp - 0x35], bl
je 0x402817
push 0x17d3
push 0xb45
push ebx
push 0x252b
call dword [sym.imp.USER32.dll_CreateCaret]
lea ecx, [ebp - 0x840]
call fcn.004129c0
dec dword [ebp - 0x14]
jmp 0x402787
push 4
pop edx
push edx
lea ecx, [ebp - 0x65c]
call fcn.0041257d
or eax, 0xffffffff
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], eax
push esi
call fcn.0041257d
push 4
mov dword [ebp - 0xc], ebx
pop edx
jmp 0x40286c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x65c]
mov dword [eax + ecx*4], 0xf75dcec3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x402859
mov dword [ebp - 0xc], ebx
jmp 0x402885
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x4dc]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x402876
mov dword [ebp - 0xc], 3
cmp dword [ebp - 0xc], ebx
jl 0x40290f
mov dword [ebp - 0x30], 0x3498e64e
mov dword [ebp - 0x30], 0x8f4727ca
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edi
jge 0x4028c1
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xec], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x4028af
dec dword [ebp - 0xec]
xor ecx, ecx
mov edx, dword [ebp - 0xec]
inc ecx
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
sub ecx, eax
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x65c]
setge al
xor edx, edx
push 0
cmp dword [ecx + esi*4], eax
setle dl
xor eax, eax
inc eax
cmp eax, dword [ecx + edi*4]
sbb eax, eax
inc eax
add edx, eax
mov dword [ecx + ebx*4], edx
dec dword [ebp - 0xc]
pop ebx
push 1
pop edi
jns 0x402896
push 2
pop esi
mov dword [ebp - 0xc], 0xfffffff6
jmp 0x40292b
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x24], edi
cmp dword [eax], ebx
jne 0x402931
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff4
jne 0x402918
lea ecx, [ebp - 0x4dc]
call fcn.004129c0
lea ecx, [ebp - 0x65c]
call fcn.004129c0
mov byte [ebp - 5], bl
mov dword [ebp - 0x1c], 0xe0a8eac8
mov dword [ebp - 0x1c], 0x17
jmp 0x40296f
cmp byte [ebp - 0x35], 0
je 0x40296c
push 0x876
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffed
mov byte [ebp - 0x35], bl
jl 0x40295a
cmp byte [ebp - 0x35], 0
je 0x402990
push ebx
push 0xcc5
push ebx
push 0x1918
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
cmp byte [ebp - 5], 0
je 0x402a65
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], 0x2f1fcc10
mov dword [ebp - 0x1c], ebx
jmp 0x4029b6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x94c], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x4029a9
mov dword [ebp - 0x28], ebx
jmp 0x402a53
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], 3
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x4029e5
push ebx
push 0x2133
call dword [sym.imp.USER32.dll_BeginPaint]
or edx, 0xffffffff
mov dword [ebp - 0x94c], 0xfffffff7
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
imul ecx, dword [ebp - 0x14]
cmp ecx, 0xd5fec46b
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x28]
jle 0x402a16
mov ecx, edi
cmp dword [ebp - 0x14], ebx
jne 0x402a18
mov ecx, ebx
mov dword [ebp - 0x20], 0xdec4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, edx
setne cl
xor edx, edx
sub ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
dec dword [ebp - 0x28]
or edx, 0xffffffff
cmp dword [ebp - 0x28], edx
jle 0x4029c3
call dword [sym.imp.GDI32.dll_GdiFlush]
mov dword [ebp - 0x14], 0xfffffffa
or ecx, 0xffffffff
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0xf20bab1f
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x1c], ebx
jmp 0x402a9c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x454], 0x42c8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x402a8b
mov dword [ebp - 0x14], 0xffffffea
cmp dword [ebp - 0x14], 0xfffffff6
jle 0x402be3
lea eax, [ebp - 0x7b8]
lea ecx, [ebp - 0x7a8]
push ecx
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x290]
push eax
movdqu xmmword [ebp - 0x7b8], xmm0
call fcn.004125f3
mov esi, dword [ebp - 0x290]
mov dword [ebp - 0x20], 0xf36a5b5c
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], 0x8dd2ac30
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], eax
or eax, 0xffffffff
cmp eax, dword [esi + 4]
mov dword [ebp - 0x20], 7
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
push 9
setg cl
add ecx, dword [ebp - 0x20]
pop eax
cmp ecx, eax
jge 0x402b1f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x290]
neg ecx
sbb ecx, ecx
neg ecx
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, 0xbab72157
cmp eax, ecx
sbb eax, eax
xor edx, edx
neg eax
imul eax, eax, 0x1cd1
cmp eax, 0xc6dc
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov eax, dword [ebp - 0x290]
setle cl
xor edx, edx
cmp ecx, dword [eax + 0xc]
setg dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
dec eax
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x290]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ecx + 8]
mov eax, dword [ebp - 0x14]
setl dl
xor ebx, ebx
cmp edx, eax
sete bl
xor ecx, ecx
mov dword [ebp - 0x454], ebx
sub ebx, dword [esi + 4]
cmp dword [esi + 4], ebx
mov eax, dword [ebp - 0x10]
setge cl
imul eax, ecx
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x24], eax
call fcn.004129c0
inc dword [ebp - 0x14]
lea eax, [ebp - 0x7b8]
cmp dword [ebp - 0x14], 0xfffffff6
lea ecx, [ebp - 0x7a8]
jg 0x402abe
push 2
xor ebx, ebx
or ecx, 0xffffffff
pop esi
mov dword [ebp - 0x28], ebx
jmp 0x402bf9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x454], 0xadcf
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x402be8
mov dword [ebp - 0x10], 0x67e307b5
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x764]
push 3
call fcn.0041257d
mov dword [ebp - 0x14], 0xfe831e34
mov dword [ebp - 0x1c], 0xeeff
mov dword [ebp - 0xc], 0x73439d6f
mov dword [ebp - 0x34], ebx
jmp 0x402c3c
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x58], edi
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x402c32
mov dword [ebp - 0x34], ebx
jmp 0x402c54
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x74], 0x4dde9ab
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x402c46
push 3
mov dword [ebp - 0x34], ebx
pop edx
jmp 0x402c70
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x764]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jl 0x402c61
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x74]
cmp eax, ecx
mov eax, edi
cmovl eax, ebx
cmp dword [ebp - 0x10], ebx
je 0x402c91
mov edx, edi
cmp dword [ebp - 0x58], ebx
jne 0x402c93
mov edx, ebx
imul eax, eax, 0xfbe5
xor ecx, ecx
cmp eax, 0x9968
setl cl
xor eax, eax
cmp edx, 0xcd9796a
sete al
sub ecx, eax
mov eax, 0xfffb
cmp eax, ecx
mov eax, dword [ebp - 0x58]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x14], ebx
je 0x402d46
mov dword [ebp - 0x20], 0x33e235bd
xor ecx, ecx
mov dword [ebp - 0x1c], 0xf9d9
mov dword [ebp - 0x28], 0x714a8a5a
mov dword [ebp - 0x24], ebx
push 4
pop eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x764]
cmp dword [eax], ebx
setge cl
cmp dword [ebp - 0x58], ecx
jge 0x402d33
mov eax, edi
cmp dword [ebp - 0x1c], ebx
jne 0x402d35
mov eax, ebx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0xc]
jmp 0x402ded
mov dword [ebp - 0x20], 0x7bd5
lea ecx, [ebp - 0x4f4]
mov dword [ebp - 0x14], ebx
push esi
call fcn.0041257d
mov dword [ebp - 0x1c], ebx
jmp 0x402d74
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4f4]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x402d61
mov eax, edi
cmp dword [ebp - 0x20], ebx
jne 0x402d82
mov eax, ebx
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x4f4]
mov dword [ebp - 0x58], esi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0xfffffff9
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp esi, ecx
setl al
mov dword [edi + 4], eax
mov dword [ebp - 0x1c], ebx
jmp 0x402dd6
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x402dd3
mov dword [edi + 4], 0x1f29c70a
dec dword [ebp - 0x14]
jns 0x402dc7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 5
jg 0x402dbf
lea ecx, [ebp - 0x4f4]
call fcn.004129c0
xor edi, edi
push 2
inc edi
pop esi
lea ecx, [ebp - 0x764]
call fcn.004129c0
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0x984]
mov dword [ebp - 0x20], 0xcd4431fa
mov dword [ebp - 0x1c], 0x3e75cb55
mov dword [ebp - 0x30], 0x629c4ddb
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], 0x229a275f
mov dword [ebp - 0x10], 0x7c7128ab
mov dword [ebp - 0x10], 0x3e5ec352
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], 0x1718bc69
mov dword [ebp - 0x14], 0xfffffffe
push esi
call fcn.0041257d
push edi
lea ecx, [ebp - 0x50c]
call fcn.0041257d
push 4
mov dword [ebp - 0x30], 0x13c9
mov dword [ebp - 0x2c], ebx
pop edx
jmp 0x402e78
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x2e4], 0xa136951a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x402e67
mov dword [ebp - 0x2c], ebx
jmp 0x402e95
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x984]
mov dword [eax + ecx*4], 0x2e633725
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x402e82
mov dword [ebp - 0x2c], ebx
jmp 0x402eae
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x50c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x402e9f
mov dword [ebp - 0x2c], ebx
jmp 0x402ec9
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7d8], 0xdbf12959
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x402eb8
mov eax, dword [ebp - 0x2e4]
mov eax, dword [ebp - 0x2e4]
mov eax, dword [ebp - 0x2e4]
mov eax, dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x2dc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2e4]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x2e0], ebx
jne 0x402f2b
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x50c]
cmp dword [eax], edi
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
mov ecx, ebx
cmp dword [ebp - 0x1c], 0xfda8
jl 0x402f2d
mov ecx, edi
mov eax, dword [ebp - 0x7d0]
dec dword [ebp - 0x7d0]
cmp eax, ecx
mov ecx, edi
cmovne ecx, ebx
xor eax, eax
cmp ecx, edi
setne al
imul eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jg 0x402f5a
mov eax, edi
cmp dword [ebp - 0x7d0], ebx
jne 0x402f5c
mov eax, ebx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x50c]
call fcn.004129c0
lea ecx, [ebp - 0x984]
call fcn.004129c0
mov dword [ebp - 0x30], ebx
xor edx, edx
mov dword [ebp - 0x30], 6
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], 0xa3191b49
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
cmp eax, 0xb051
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
neg ecx
cmp ecx, dword [ebp - 0x1c]
je 0x402fda
mov dword [ebp - 0x20], edi
jmp 0x403046
mov dword [ebp - 0x24], 0xfffffffe
lea ecx, [ebp - 0x674]
push edi
call fcn.0041257d
mov dword [ebp - 0x1c], ebx
jmp 0x403005
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x674]
mov dword [eax + ecx*4], 0x68451f1e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x402ff2
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x674]
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
mov dword [ebp - 0xc], ebx
jmp 0x403035
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x403032
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x2c
je 0x403021
lea ecx, [ebp - 0x674]
call fcn.004129c0
mov dword [ebp - 0x30], 0x85c6f1bf
or eax, 0xffffffff
mov dword [ebp - 0x28], 0xea75c96d
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x40307e
push 0x125c
push ebx
push 0x22d
call dword [sym.imp.USER32.dll_GetClassNameW]
mov dword [ebp - 0x28], 7
cmp dword [ebp - 0x28], 0xfffffff0
jg 0x403129
mov dword [ebp - 0x20], 0x5121ac48
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x20], ebx
jne 0x4030e3
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x42c]
cmp eax, 6
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x20]
push 0
setle bl
xor ecx, ecx
cmp eax, 0x2df2
setl cl
xor eax, eax
cmp ecx, ebx
pop ebx
setne al
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff0
jle 0x40308f
or eax, 0xffffffff
lea ecx, [ebp - 0x7f4]
mov dword [ebp - 0x30], eax
push esi
call fcn.0041257d
mov dword [ebp - 0x2c], 0xa98815cb
lea ecx, [ebp - 0x524]
mov dword [ebp - 0x28], 0x5020f89b
mov dword [ebp - 0x10], 0xffd03b15
push esi
call fcn.0041257d
mov dword [ebp - 0xc], ebx
jmp 0x40316e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x170], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x403161
mov dword [ebp - 0xc], ebx
jmp 0x40318b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x524]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x403178
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], ebx
jl 0x403371
push 4
pop esi
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x3b4]
mov dword [ebp - 0x20], 0x9642e40
mov dword [ebp - 0x34], 0xfffffffe
push esi
call fcn.0041257d
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
jmp 0x4031da
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3b4]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x4031c7
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], edi
jg 0x403329
mov edi, dword [ebp - 0x3b4]
xor esi, esi
inc esi
push 9
pop eax
mov dword [ebp - 0x24], 0x4a90c6d2
lea ecx, [ebp - 0x854]
mov dword [ebp - 0x30], eax
push 3
call fcn.0041257d
push 3
mov dword [ebp - 0x30], 0x5a2e712c
mov dword [ebp - 0xc], ebx
pop edx
jmp 0x40322e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1b4], 0xfd11d962
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x40321d
mov dword [ebp - 0xc], ebx
jmp 0x40324b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x854]
mov dword [eax + ecx*4], 0xd6364d64
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x403238
mov dword [ebp - 0x1b4], ebx
jmp 0x403274
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x40326e
push ebx
push 0x9be
push ebx
call dword [sym.imp.KERNEL32.dll_HeapFree]
inc dword [ebp - 0x1b4]
cmp dword [ebp - 0x1b4], esi
jle 0x403258
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x170]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x524]
add ecx, 6
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [eax]
test ecx, ecx
jne 0x4032a5
mov ecx, ebx
cmp dword [ebp - 0x10], ebx
je 0x4032a7
mov ecx, esi
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + eax*4 - 0x170]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x170], esi
dec dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
sub edx, ecx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
or eax, 0xffffffff
imul ecx, dword [ebp - 0x18]
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1b4]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x28]
setge cl
xor edx, edx
cmp esi, ecx
lea ecx, [ebp - 0x854]
setge dl
sub edx, eax
xor eax, eax
cmp edx, dword [edi + 8]
setle al
mov dword [ebp - 0x10], eax
call fcn.004129c0
inc dword [ebp - 0x14]
xor esi, esi
inc esi
cmp dword [ebp - 0x14], esi
jle 0x4031f4
xor edi, edi
push 4
inc edi
pop esi
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x170]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x170], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x18]
imul edx, dword [ebp - 0x18]
imul edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, edx
mov eax, dword [ebp - 0x3b4]
setl cl
mov dword [eax], ecx
lea ecx, [ebp - 0x3b4]
call fcn.004129c0
dec dword [ebp - 0x28]
jns 0x40319f
push 2
pop esi
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x403382
push ebx
push ebx
call dword [sym.imp.USER32.dll_UnregisterClassA]
lea ecx, [ebp - 0x524]
call fcn.004129c0
mov dword [ebp - 0x1c], ebx
jmp 0x4033a1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x7f4]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x403392
dec dword [ebp - 0x2c]
lea ecx, [ebp - 0x7f4]
call fcn.004129c0
mov dword [ebp - 0xc], 0x41e55969
mov dword [ebp - 0x10], 0x17b4d2c2
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x1c], 6
push 0xfffffffffffffff9
mov dword [ebp - 0x10], 0x126315bf
pop eax
mov dword [ebp - 0x10], 0x1081b270
mov dword [ebp - 0x14], eax
push 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc], ebx
pop edx
jmp 0x403400
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x204], 0xfffffffa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x4033ef
push 3
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x40341e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xba4], 0x52f093d7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x40340d
mov dword [ebp - 0xc], ebx
jmp 0x403435
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x204], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x403428
cmp dword [ebp - 0x200], ebx
je 0x4034f6
mov dword [ebp - 0xba4], 0xfffc
xor edx, edx
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
sub edx, 0x299fa9ef
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
neg edx
cmp edx, eax
setne cl
xor edx, edx
imul ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
test eax, eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x32da
setle al
sub eax, dword [ebp - 0x200]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], edi
xor eax, eax
mov ecx, dword [ebp - 0x204]
imul ecx, dword [ebp - 0x10]
neg ecx
test ecx, ecx
setg al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], eax
jne 0x4034d7
mov ecx, edi
cmp dword [ebp - 0x14], ebx
jne 0x4034d9
mov ecx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
add ecx, 0xfffffffc
cmp ecx, eax
mov eax, dword [ebp - 0x1fc]
setl dl
sub edx, eax
cmp edx, dword [ebp - 0x14]
jl 0x4034f6
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x204]
mov eax, dword [ebp - 0x200]
mov eax, dword [ebp - 0x14]
cmp eax, 0x2408
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
push 9
setg dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp edx, eax
pop eax
setl cl
xor edx, edx
imul ecx, ecx, 0xff24
add ecx, eax
mov eax, dword [ebp - 0x204]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
cmp edi, edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
or eax, 0xffffffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x314], edi
mov dword [ebp - 0x310], edi
mov dword [ebp - 0x30c], edi
mov dword [ebp - 0x308], edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0xb0d1
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], 7
mov dword [ebp - 0xc], 0x3e91cb64
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], ebx
jl 0x4036b8
mov dword [ebp - 0x28], 0x80849f84
lea ecx, [ebp - 0x3cc]
push edi
call fcn.0041257d
mov dword [ebp - 0x1c], ebx
jmp 0x4035d1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3cc]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x4035c2
mov dword [ebp - 0x28], ebx
jmp 0x40369a
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], 6
inc dword [ebp - 0x20]
imul eax, dword [ebp - 0x20], 0xe124
test eax, eax
jne 0x403658
cmp dword [ebp - 0x28], 3
jle 0x4035de
lea ecx, [ebp - 0x3cc]
call fcn.004129c0
dec dword [ebp - 0x14]
jns 0x4035aa
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x704]
mov dword [ebp - 0x1c], 0xfffffffd
push edi
call fcn.0041257d
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], ebx
jmp 0x4036e9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x704]
mov dword [eax + ecx*4], 0x24039b64
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x4036d6
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x403706
push ebx
push ebx
push 0x1b5a
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], ebx
jmp 0x40371e
cmp dword [ebp - 0x14], edi
jl 0x40370b