Function at 0x401ecc
Capabilities:
Delete registry key
Delete service
Get user security identifier
Log keystrokes
Log keystrokes via polling
Parse credit card information
Query or enumerate registry key
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0xffffffd3
mov eax, 0x24
sub eax, dword [0x438574]
test eax, eax
je 0x401f08
xor ecx, ecx
cmp dword [0x438570], 0x37
setge cl
mov edx, dword [0x438598]
or edx, ecx
mov dword [0x438598], edx
mov dword [ebp - 0x20], 0x2d
mov ecx, dword [0x438598]
imul ecx, dword [str.__]
mov eax, dword [0x4385a0]
sar eax, cl
mov dword [0x4385a0], eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x20]
setl dl
mov eax, dword [ebp - 0x20]
mov ecx, edx
shl eax, cl
mov dword [ebp - 0x20], eax
xor ecx, ecx
cmp dword [ebp - 0x20], 0x25
setne cl
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
or ecx, eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xffffffc1
jl 0x401f70
mov edx, dword [ebp - 0x24]
sub edx, 0x27
mov eax, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x20], eax
xor ecx, ecx
cmp dword [ebp - 0x20], 0x32
setg cl
mov edx, dword [ebp - 0x24]
sar edx, cl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, dword [ebp - 0x24]
setge cl
mov edx, dword [ebp - 0x24]
sar edx, cl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
sub eax, 0x2a
test eax, eax
je 0x401faf
xor ecx, ecx
cmp dword [ebp - 0x24], 0x2e
setne cl
mov edx, dword [ebp - 0x24]
sub edx, ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], 0
mov eax, 4
test eax, eax
je 0x401fd0
xor ecx, ecx
cmp dword [ebp - 0x24], 0x28
setg cl
mov edx, dword [ebp - 0x20]
or edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jne 0x401fe8
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
sar edx, cl
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
or edx, ecx
mov dword [ebp - 0x20], edx
push fcn.00406d52
mov eax, dword [ebp - 0x24]
xor eax, 0xffffffda
test eax, eax
je 0x402017
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
shl edx, cl
mov eax, dword [ebp - 0x24]
mov ecx, edx
shl eax, cl
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
xor ecx, 0x33
mov edx, dword [ebp - 0x24]
or edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
or al, 0x37
mov ecx, dword [ebp - 0x24]
or ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
xor eax, eax
cmp edx, dword [ebp - 0x24]
setne al
mov ecx, dword [ebp - 0x24]
and ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x20]
je 0x40205c
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
shl eax, cl
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setge dl
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
or edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
shl eax, cl
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
and edx, 0xffffffd7
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
add edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
or eax, dword [ebp - 0x20]
test eax, eax
je 0x4020bc
mov ecx, dword [ebp - 0x20]
or ecx, 0x71
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
xor eax, eax
cmp edx, dword [ebp - 0x24]
sete al
mov ecx, dword [ebp - 0x24]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x4020fb
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x20]
setne dl
mov eax, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x2e
test ecx, ecx
je 0x402113
mov edx, dword [ebp - 0x20]
and edx, 0x25
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x2a
mov edx, dword [ebp - 0x20]
xor edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
sub eax, 0xe
mov dword [ebp - 0x24], eax
mov edx, 0x2a
mov ecx, dword [ebp - 0x20]
sar edx, cl
mov eax, dword [ebp - 0x24]
mov ecx, edx
shl eax, cl
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
and ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x40214e
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
push dword fs:[0]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
sar eax, cl
test eax, eax
je 0x402171
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
sar edx, cl
mov eax, dword [ebp - 0x24]
xor eax, edx
mov dword [ebp - 0x24], eax
mov edx, 0x2c
mov ecx, dword [ebp - 0x24]
shl edx, cl
mov eax, dword [ebp - 0x24]
sub eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
shl edx, cl
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
xor ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
shl eax, cl
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x32
jle 0x4021ae
mov ecx, dword [ebp - 0x20]
and ecx, 0x1a
mov dword [ebp - 0x20], ecx
xor edx, edx
cmp dword [ebp - 0x20], 0xffffffcb
setne dl
mov eax, dword [ebp - 0x24]
xor eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setne dl
mov eax, dword [ebp - 0x24]
mov ecx, edx
sar eax, cl
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sar ecx, 0xc5
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add eax, 0x2a
mov ecx, dword [ebp - 0x20]
and ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
or edx, 0x23
test edx, edx
je 0x402208
mov eax, dword [ebp - 0x24]
xor eax, 0xffffffd0
mov ecx, dword [ebp - 0x20]
xor ecx, eax
mov dword [ebp - 0x20], ecx
xor edx, edx
test edx, edx
je 0x402221
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, dword [ebp - 0x24]
setg cl
mov edx, dword [ebp - 0x20]
xor edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
imul eax, eax, 0x2a
test eax, eax
je 0x40223e
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
sete dl
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [ebp - 0x20], eax
xor ecx, ecx
cmp dword [ebp - 0x24], 0x27
setl cl
mov edx, dword [ebp - 0x24]
and edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, dword [ebp - 0x24]
setge cl
mov edx, dword [ebp - 0x24]
and edx, ecx
mov dword [ebp - 0x24], edx
xor eax, eax
cmp dword [ebp - 0x20], 0x21
sete al
mov ecx, dword [ebp - 0x24]
or ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
xor edx, dword [ebp - 0x20]
test edx, edx
je 0x40228f
mov eax, 0xffffffd7
mov ecx, dword [ebp - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0x24]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
or eax, edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x24], 0x3a
jne 0x4022b2
mov ecx, dword [ebp - 0x20]
sub ecx, 0x30
mov edx, dword [ebp - 0x24]
sar edx, cl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
sar eax, 0xcb
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x20], ecx
xor ecx, ecx
cmp dword [ebp - 0x24], 0x2c
setl cl
mov edx, dword [ebp - 0x24]
sar edx, cl
mov dword [ebp - 0x24], edx
mov dword fs:[0], esp
mov ecx, dword [ebp - 0x24]
shl ecx, 0x2a
mov eax, dword [ebp - 0x20]
sar eax, cl
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
and ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
and edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
test eax, eax
je 0x402311
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setne dl
mov eax, dword [ebp - 0x24]
or eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
or ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
mov eax, 0x36
sub eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, 0xffffffc3
mov ecx, dword [ebp - 0x24]
sar edx, cl
mov eax, dword [ebp - 0x20]
or eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
and ecx, 0x3b
mov edx, dword [ebp - 0x20]
and edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
shl eax, cl
mov ecx, dword [ebp - 0x24]
or ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
xor eax, eax
cmp edx, dword [ebp - 0x20]
setl al
mov ecx, dword [ebp - 0x24]
xor ecx, eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
xor eax, eax
cmp dword [ebp - 0x24], 0xffffffe0
setg al
mov ecx, dword [ebp - 0x24]
or ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
xor edx, 0x2b
mov eax, dword [ebp - 0x20]
and eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
xor ecx, 0x36
mov edx, dword [ebp - 0x24]
and edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
and eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x24], ecx
xor edx, edx
cmp dword [ebp - 0x20], 0xffffffc6
setl dl
mov eax, dword [ebp - 0x24]
or eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
mov edx, 0x3d
mov ecx, dword [ebp - 0x20]
shl edx, cl
test edx, edx
je 0x40240d
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, dword [ebp - 0x24]
sete cl
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
imul eax, eax, 0x21
test eax, eax
je 0x402428
xor ecx, ecx
cmp dword [ebp - 0x20], 0x22
setl cl
mov edx, dword [ebp - 0x24]
sub edx, ecx
mov dword [ebp - 0x24], edx
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, dword [ebp - 0x20]
setne cl
mov edx, dword [ebp - 0x20]
shl edx, cl
mov dword [ebp - 0x20], edx
xor eax, eax
cmp dword [ebp - 0x20], 0x3d
sete al
mov ecx, dword [ebp - 0x24]
add ecx, eax
mov dword [ebp - 0x24], ecx
push 0x23
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [ebp - 0x20]
xor eax, eax
cmp edx, dword [ebp - 0x20]
setg al
mov ecx, dword [ebp - 0x24]
and ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x6c
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x4c], 0x16
mov byte [ebp - 0x5c], 0x1a
mov byte [ebp - 0x5b], 0
xor eax, eax
mov dword [ebp - 0x5a], eax
mov dword [ebp - 0x56], eax
mov dword [ebp - 0x52], eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], 0x3e
push 0x26
mov edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
call sub.USER32.dll_DdeAddData
mov edx, 0xffffffc8
mov ecx, dword [ebp - 0x20]
sar edx, cl
push edx
call fcn.0040d78b
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
xor ecx, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0x31
jge 0x4024e8
xor edx, edx
cmp dword [ebp - 0x20], 0xffffffd7
setl dl
mov eax, dword [ebp - 0x24]
sub eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x60], 0x32
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x70]
push edx
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x60]
push ecx
push 0
call sub.ADVAPI32.dll_LsaLookupNames
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
or ecx, 0x2c
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xa0], 0x2c
mov byte [ebp - 0x94], 0x40
mov byte [ebp - 0x93], 0
xor eax, eax
mov dword [ebp - 0x92], eax
mov dword [ebp - 0x8e], eax
mov dword [ebp - 0x8a], eax
mov dword [ebp - 0x86], eax
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x80], 0x20
mov dword [ebp - 0x98], 0x39
push 0xfb2
mov edx, dword [ebp - 0x98]
push edx
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x9c]
push ecx
push 0x2d
mov edx, dword [ebp - 0xa0]
push edx
call dword [sym.imp.USER32.dll_ToUnicode]
cmp dword [ebp - 0x24], 0xffffffd8
jl 0x4025af
mov eax, dword [ebp - 0x20]
shl eax, 0x32
push eax
call fcn.0040d78b
mov dword [ebp - 0xa4], eax
xor ecx, ecx
cmp dword [ebp - 0x24], 0xffffffdc
setne cl
mov edx, dword [ebp - 0x24]
sar edx, cl
mov dword [ebp - 0x24], edx
xor eax, eax
cmp dword [ebp - 0x24], 0x2c
setl al
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x20], ecx
lea edx, [ebp - 0xac]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
cmp dword [ebp - 0x20], 0x3f
jge 0x4025f2
mov eax, dword [ebp - 0x24]
xor eax, 0x28
mov ecx, dword [ebp - 0x24]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
xor eax, eax
cmp edx, dword [ebp - 0x20]
setge al
push eax
call fcn.0040d78b
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
or edx, ecx
mov dword [ebp - 0x24], edx
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov eax, dword [ebp - 0x24]
xor eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
xor ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
imul edx, edx, 0xffffffcd
test edx, edx
je 0x402641
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sar eax, cl
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc8], 0x2d
lea ecx, [ebp - 0xc4]
push ecx
lea edx, [ebp - 0xb8]
push edx
mov eax, dword [ebp - 0xc8]
push eax
call sub.USER32.dll_DdeSetQualityOfService
mov ecx, dword [ebp - 0x20]
or ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
sar edx, cl
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0x26
jge 0x402689
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
shl eax, cl
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x24], ecx
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
xor eax, eax
test eax, eax
je 0x4026b9
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setge dl
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xfc], str.oS8O3Mo1B76
mov dword [ebp - 0xe0], 0x32
mov dword [ebp - 0xe4], 0
lea ecx, [ebp - 0xe4]
push ecx
push 1
push 1
lea edx, [ebp - 0xdc]
push edx
mov eax, dword [ebp - 0xe0]
push eax
push 0xf74
push 0xeaf
lea ecx, [ebp - 0xf8]
push ecx
push str.febsmihriokxslmrkm
mov edx, dword [ebp - 0xfc]
push edx
push 0
push str.a5nk57uol740R0p8n3x
call dword [sym.imp.ADVAPI32.dll_ObjectOpenAuditAlarmA]
cmp dword [ebp - 0x24], 0x38
jg 0x402729
mov eax, dword [ebp - 0x20]
or eax, 0xfffffff3
mov dword [ebp - 0x20], eax
xor ecx, ecx
cmp dword [ebp - 0x24], 0x36
sete cl
mov edx, dword [ebp - 0x20]
sar edx, cl
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x100], 0x3a
mov eax, dword [ebp - 0x100]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [ebp - 0x20]
setne dl
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
shl edx, cl
test edx, edx
je 0x40277e
mov eax, dword [ebp - 0x20]
xor eax, 0xffffffc7
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10c], 0x16
mov byte [ebp - 0x11c], 0x1a
mov byte [ebp - 0x11b], 0
xor edx, edx
mov dword [ebp - 0x11a], edx
mov dword [ebp - 0x116], edx
mov dword [ebp - 0x112], edx
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], 0x3f
push 0x34
mov ecx, dword [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x10c]
push eax
call sub.USER32.dll_DdeAddData
cmp dword [ebp - 0x24], 0x22
jge 0x4027f0
mov ecx, dword [ebp - 0x24]
or ecx, 0x2e
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, dword [ebp - 0x20]
setg cl
mov edx, dword [ebp - 0x20]
shl edx, cl
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x128], 0x20
mov dword [ebp - 0x120], 0x37
mov dword [ebp - 0x124], 0x36
mov eax, dword [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x128]
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor eax, eax
cmp dword [ebp - 0x20], 0x3b
setne al
mov ecx, dword [ebp - 0x24]
and ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sar edx, cl
test edx, edx
je 0x40286c
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, dword [ebp - 0x24]
setne cl
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x130], 0x2c
mov dword [ebp - 0x14c], 0x40
mov dword [ebp - 0x134], 0x29
mov dword [ebp - 0x12c], 0
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x14c]
push edx
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x15c]
push ecx
mov edx, dword [ebp - 0x130]
push edx
push 0x3e
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.ADVAPI32.dll_AccessCheck]
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
sar edx, cl
mov eax, dword [ebp - 0x24]
mov ecx, edx
shl eax, cl
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x20], 0xffffffc7
jne 0x4028f3
mov ecx, dword [ebp - 0x24]
and ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
xor edx, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x174], 0x23
push 0x34
mov eax, dword [ebp - 0x174]
push eax
call sub.USER32.dll_FreeDDElParam
cmp dword [ebp - 0x20], 0x3e
jl 0x402923
mov edx, 0x2f
mov ecx, dword [ebp - 0x20]
shl edx, cl
mov eax, dword [ebp - 0x20]
or eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
xor ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
or edx, ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x178], 0x35
push 0x25
lea eax, [ebp - 0x180]
push eax
mov cl, byte [ebp - 0x178]
push ecx
push 0
push 0
call sub.ADVAPI32.dll_LsaRemoveAccountRights
mov ecx, dword [ebp - 0x20]
and ecx, 0x20
mov edx, dword [ebp - 0x20]
shl edx, cl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
jl 0x40297f
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setge dl
mov eax, dword [ebp - 0x20]
mov ecx, edx
shl eax, cl
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1b0], 0x2c
lea ecx, [ebp - 0x1ac]
push ecx
push 1
push 0x20
mov edx, dword [ebp - 0x1b0]
push edx
call dword [sym.imp.USER32.dll_GetMenuItemInfoA]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
test eax, eax
je 0x4029bc
xor ecx, ecx
cmp dword [ebp - 0x20], 0xffffffc3
setg cl
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
test eax, eax
je 0x4029d5
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
and edx, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1b4], 0x27
push 0x35
mov eax, dword [ebp - 0x1b4]
push eax
call sub.USER32.dll_FreeDDElParam
mov ecx, dword [ebp - 0x24]
xor ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x402a05
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x24
mov eax, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
and ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x402a1d
mov ecx, dword [ebp - 0x20]
sub ecx, 0x21
mov edx, dword [ebp - 0x24]
sar edx, cl
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1b8], 0xffffffe0
push str.K1a775MAN4N7C6582
mov eax, dword [ebp - 0x1b8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setge dl
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
xor ecx, 0xffffffd0
test ecx, ecx
je 0x402a64
mov edx, dword [ebp - 0x24]
shl edx, 0xc9
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c4], 0x38
mov dword [ebp - 0x1c0], 0x2d
mov dword [ebp - 0x1bc], 0x32
lea ecx, [ebp - 0x1bc]
push ecx
mov edx, dword [ebp - 0x1c0]
push edx
push 0
lea eax, [ebp - 0x1c4]
push eax
push 0
call sub.ADVAPI32.dll_LsaEnumerateTrustedDomains
mov edx, 0xffffffdd
mov ecx, dword [ebp - 0x20]
sar edx, cl
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
and ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x402acd
xor edx, edx
cmp dword [ebp - 0x24], 0xffffffda
setne dl
mov eax, dword [ebp - 0x24]
or eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c8], 0x28
mov ecx, dword [ebp - 0x1c8]
push ecx
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edx, dword [ebp - 0x20]
or edx, dword [ebp - 0x24]
test edx, edx
je 0x402b01
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, dword [ebp - 0x20]
setg cl
mov edx, dword [ebp - 0x20]
shl edx, cl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
add ecx, eax
mov dword [ebp - 0x24], ecx
push 0
push 0
push str.S45F00N3156
call dword [sym.imp.ADVAPI32.dll_ObjectDeleteAuditAlarmA]
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x24]
jge 0x402b39
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, dword [ebp - 0x20]
setl cl
mov edx, dword [ebp - 0x20]
add edx, ecx
mov dword [ebp - 0x20], edx
xor eax, eax
cmp dword [ebp - 0x20], 0x39
setl al
mov ecx, dword [ebp - 0x20]
or ecx, eax
mov dword [ebp - 0x20], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, dword [ebp - 0x24]
xor eax, eax
cmp edx, dword [ebp - 0x24]
setl al
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
or eax, edx
mov dword [ebp - 0x20], eax
push 0x20
call dword [sym.imp.USER32.dll_OemKeyScan]
mov ecx, dword [ebp - 0x20]
shl ecx, 0x2a
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x24]
xor eax, eax
cmp edx, dword [ebp - 0x20]
setne al
mov ecx, dword [ebp - 0x24]
and ecx, eax
mov dword [ebp - 0x24], ecx
lea edx, [ebp - 0x1d8]
push edx
lea eax, [ebp - 0x1d0]
push eax
push 0
call sub.ADVAPI32.dll_LsaStorePrivateData
mov ecx, dword [ebp - 0x24]
and ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, dword [ebp - 0x20]
setg cl
mov edx, dword [ebp - 0x24]
add edx, ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1dc], 0x3c
mov dword [ebp - 0x1e0], 0x22
mov eax, dword [ebp - 0x1e0]
push eax
mov ecx, dword [ebp - 0x1dc]
push ecx
call dword [sym.imp.USER32.dll_FlashWindow]
xor ecx, ecx
cmp dword [ebp - 0x24], 0x21
setne cl
mov edx, dword [ebp - 0x20]
shl edx, cl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
xor eax, 0x29
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1e8], 0x3e
mov dword [ebp - 0x1e4], 0x21
push 0
push 0xf91
mov edx, dword [ebp - 0x1e4]
push edx
push 0x2a
mov eax, dword [ebp - 0x1e8]
push eax
call sub.USER32.dll_ReuseDDElParam
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setl dl
mov eax, dword [ebp - 0x24]
and eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
xor ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x402c70
xor ecx, ecx
cmp dword [ebp - 0x20], 0xffffffc6
sete cl
mov edx, dword [ebp - 0x24]
sar edx, cl
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1ec], 0x2f
lea eax, [ebp - 0x1ec]
push eax
lea ecx, [ebp - 0x1f4]
push ecx
push 0
push 0
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
mov edx, dword [ebp - 0x24]
xor eax, eax
cmp edx, dword [ebp - 0x24]
setne al
mov ecx, dword [ebp - 0x24]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov eax, 1
test eax, eax
je 0x402ccf
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x2b
mov edx, dword [ebp - 0x24]
sar edx, cl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, dword [ebp - 0x20]
sete cl
mov edx, dword [ebp - 0x24]
xor edx, ecx
mov dword [ebp - 0x24], edx
push 0x16a
push 2
push 0x2b
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, dword [ebp - 0x24]
setg cl
mov edx, dword [ebp - 0x20]
sar edx, cl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
sub eax, 0x31
test eax, eax
je 0x402d1f
xor ecx, ecx
cmp dword [ebp - 0x24], 0x29
setg cl
mov edx, dword [ebp - 0x24]
and edx, ecx
mov dword [ebp - 0x24], edx
call dword [sym.imp.USER32.dll_GetOpenClipboardWindow]
cmp dword [ebp - 0x20], 0x32
je 0x402d3b
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
sar eax, cl
mov ecx, dword [ebp - 0x20]
or ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x3a
test edx, edx
je 0x402d53
mov eax, dword [ebp - 0x24]
or eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
or ecx, eax
mov dword [ebp - 0x20], ecx
push 0x953
push 0x2f
call dword [sym.imp.ADVAPI32.dll_AreAnyAccessesGranted]
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
xor ecx, ecx
test ecx, ecx
je 0x402d86
xor edx, edx
cmp dword [ebp - 0x24], 0x28
setne dl
mov eax, dword [ebp - 0x24]
and eax, edx
mov dword [ebp - 0x24], eax
push 0
call sub.USER32.dll_BlockInput
mov edx, 0x35
mov ecx, dword [ebp - 0x24]
sar edx, cl
push edx
call fcn.0040d78b
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x3f
mov ecx, dword [ebp - 0x24]
or ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x31
push edx
call fcn.0040d78b
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
shl eax, 0xce
mov ecx, dword [ebp - 0x20]
xor ecx, eax
mov dword [ebp - 0x20], ecx
push 1
push str.RRlS7
push 0x93b
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
mov edx, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, dword [ebp - 0x20]
setge cl
mov eax, dword [ebp - 0x20]
sar eax, cl
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
shl ecx, 0xd4
mov edx, dword [ebp - 0x20]
shl edx, cl
mov dword [ebp - 0x20], edx
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x1fc]
push ecx
push 0
call sub.ADVAPI32.dll_LsaRetrievePrivateData
cmp dword [ebp - 0x24], 0x30
jg 0x402e29
mov ecx, dword [ebp - 0x24]
or ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
shl edx, cl
mov dword [ebp - 0x20], edx
xor eax, eax
cmp dword [ebp - 0x20], 0x3d
setg al
mov ecx, dword [ebp - 0x24]
or ecx, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x230], 0x3b
mov dword [ebp - 0x208], 0x39
mov dword [ebp - 0x218], 0x3b
mov dword [ebp - 0x21c], 0x28
mov dword [ebp - 0x228], 0x36
mov dword [ebp - 0x22c], 0x33
mov dword [ebp - 0x210], 0x20
mov dword [ebp - 0x20c], 0x21
mov dword [ebp - 0x234], 0x30
mov dword [ebp - 0x214], 0x31
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x234]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x208]
push edx
push str.n4Ebt1XPsMHa
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
xor ecx, ecx
cmp dword [ebp - 0x24], 0xffffffd1
sete cl
mov edx, dword [ebp - 0x24]
xor edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
push eax
call fcn.0040da12
mov dword [ebp - 0x10], eax
mov edx, 0x38
mov ecx, dword [ebp - 0x20]
shl edx, cl
mov eax, dword [ebp - 0x24]
mov ecx, edx
shl eax, cl
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x244], 0x44
mov byte [ebp - 0x243], 0
xor ecx, ecx
mov dword [ebp - 0x242], ecx
mov dword [ebp - 0x23e], ecx
lea edx, [ebp - 0x244]
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x238], 0x34
mov eax, dword [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.USER32.dll_LookupIconIdFromDirectory]
xor edx, edx
cmp dword [ebp - 0x24], 0x22
setne dl
push edx
xor eax, eax
cmp dword [ebp - 0x20], 0x2a
sete al
push eax
mov ecx, dword [ebp - 0x20]
and ecx, dword [ebp - 0x20]
push ecx
call fcn.0040d8c8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x20]
xor edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
xor ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
or edx, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x250], 0x29
mov dword [ebp - 0x24c], 0x3a
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x250]
push ecx
push 0x4b8
push str.uj5G0LuA8oS
push 0x80000007
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 0x24]
and ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, dword [ebp - 0x20]
setl cl
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
or eax, dword [ebp - 0x24]
test eax, eax
je 0x403020
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
xor edx, ecx
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x24]
or ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
shl eax, cl
mov dword [ebp - 0x24], eax
mov ecx, 0x3a
sub ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
add edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
add eax, 0x23
test eax, eax
je 0x40305c
mov edx, 0x2a
mov ecx, dword [ebp - 0x24]
shl edx, cl
mov eax, dword [ebp - 0x20]
mov ecx, edx
sar eax, cl
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sar edx, cl
test edx, edx
je 0x403076
mov eax, dword [ebp - 0x24]
xor eax, 0x34
mov ecx, dword [ebp - 0x20]
and ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
xor eax, eax
cmp edx, dword [ebp - 0x24]
setg al
mov ecx, dword [ebp - 0x24]
and ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
xor eax, 0x28
mov ecx, dword [ebp - 0x20]
and ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
shl edx, cl
test edx, edx
je 0x4030b6
mov eax, dword [ebp - 0x24]
and al, 0xca
mov ecx, dword [ebp - 0x20]
xor ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x24]
and edx, 0x3c
test edx, edx
je 0x4030d1
xor eax, eax
cmp dword [ebp - 0x24], 0xffffffdb
setl al
mov ecx, dword [ebp - 0x24]
and ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
xor edx, 0xffffffab
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
or ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sar edx, cl
mov eax, dword [ebp - 0x24]
xor eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x403110
mov ecx, dword [ebp - 0x24]
sar ecx, 0xca
mov edx, dword [ebp - 0x20]
shl edx, cl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jle 0x40312d
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setne dl
mov eax, dword [ebp - 0x24]
mov ecx, edx
sar eax, cl
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sar edx, cl
mov eax, dword [ebp - 0x24]
xor eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
or ecx, 0xfffffffa
mov dword [ebp - 0x24], ecx
xor edx, edx
cmp dword [ebp - 0x24], 0x24
sete dl
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x20], 0x2f
je 0x403170
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setge dl
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [ebp - 0x20], eax
xor ecx, ecx
cmp dword [ebp - 0x24], 0xffffffdb
sete cl
mov edx, dword [ebp - 0x20]
sar edx, cl
mov dword [ebp - 0x20], edx
mov eax, 1
test eax, eax
je 0x40319b
xor ecx, ecx
cmp dword [ebp - 0x20], 0x32
setne cl
mov edx, dword [ebp - 0x24]
and edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, dword [ebp - 0x20]
setne cl
mov edx, dword [ebp - 0x24]
or edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
or al, 0x21
mov ecx, dword [ebp - 0x24]
xor ecx, eax
mov dword [ebp - 0x24], ecx
xor ecx, ecx
cmp dword [ebp - 0x20], 0x22
setg cl
mov edx, dword [ebp - 0x20]
shl edx, cl
mov dword [ebp - 0x20], edx
cmp dword [0x4385b4], 0
je 0x4036b4
xor eax, eax
cmp dword [ebp - 0x24], 0x34
setl al
mov ecx, dword [ebp - 0x20]
xor ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
imul edx, edx, 0x21
mov eax, dword [ebp - 0x20]
or eax, edx
mov dword [ebp - 0x20], eax
xor ecx, ecx
cmp dword [ebp - 0x20], 0x3d
setg cl
mov edx, dword [ebp - 0x20]
and edx, ecx
mov dword [ebp - 0x20], edx
mov eax, 0xffffffc4
mov ecx, dword [ebp - 0x24]
shl eax, cl
mov ecx, dword [ebp - 0x20]
xor ecx, eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x24], 0x3a
jne 0x403231
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
sar edx, cl
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x40324e
mov edx, dword [ebp - 0x20]
xor eax, eax
cmp edx, dword [ebp - 0x24]
setge al
mov ecx, dword [ebp - 0x24]
or ecx, eax
mov dword [ebp - 0x24], ecx
xor edx, edx
cmp dword [ebp - 0x24], 0xffffffd9
setl dl
mov eax, dword [ebp - 0x24]
sub eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
or ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
sub edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0x24]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
shl edx, cl
test edx, edx
je 0x40329a
xor eax, eax
cmp dword [ebp - 0x24], 0x20
setge al
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [0x4385b4]
sub ecx, 1
mov dword [0x4385b4], ecx
mov ecx, dword [ebp - 0x20]
and ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
sar edx, cl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
shl eax, 0xd3
test eax, eax
je 0x4032e2
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x20]
setne dl
mov eax, dword [ebp - 0x24]
or eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
lea eax, [edx + ecx + 0x21]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x20]
je 0x40330a
mov edx, dword [ebp - 0x20]
xor eax, eax
cmp edx, dword [ebp - 0x24]
setge al
mov ecx, dword [ebp - 0x24]
and ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
shl edx, cl
mov eax, dword [ebp - 0x24]
xor eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
xor ecx, 0x2b
test ecx, ecx
je 0x403337
mov edx, dword [ebp - 0x20]
xor eax, eax
cmp edx, dword [ebp - 0x24]
sete al
mov ecx, dword [ebp - 0x20]
and ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
sub eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [ebp - 0x20]
setge dl
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0x24], eax
xor ecx, ecx
test ecx, ecx
je 0x403371
mov edx, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, dword [ebp - 0x20]
sete cl
mov eax, dword [ebp - 0x24]
sar eax, cl
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
and ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
xor eax, eax
cmp dword [ebp - 0x24], 0x29
setle al
mov ecx, dword [ebp - 0x20]
xor ecx, eax
mov dword [ebp - 0x20], ecx
xor edx, edx
cmp dword [ebp - 0x24], 0xffffffc6
sete dl
mov eax, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
shl edx, cl
mov eax, dword [ebp - 0x24]
and eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
add edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
and al, 0xcc
mov ecx, dword [ebp - 0x20]
or ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
xor eax, eax
cmp edx, dword [ebp - 0x20]
setne al
mov ecx, dword [ebp - 0x24]
or ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
imul edx, edx, 0x22
test edx, edx
je 0x4033f0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x20], 0x2f
je 0x403407
xor ecx, ecx
cmp dword [ebp - 0x24], 0xffffffdb
setle cl
mov edx, dword [ebp - 0x24]
sub edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
or eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
xor ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x20]
jge 0x403430
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, dword [ebp - 0x24]
setge cl
mov edx, dword [ebp - 0x20]
xor edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
or al, 0x2a
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x258], 0x3a
lea edx, [ebp - 0x258]
push edx
push 0
lea eax, [ebp - 0x260]
push eax
push 0
call sub.ADVAPI32.dll_LsaEnumerateAccountsWithUserRight
mov ecx, dword [ebp - 0x24]
sar ecx, 0x34
mov edx, dword [ebp - 0x24]
xor edx, ecx
mov dword [ebp - 0x24], edx
mov eax, 0x39
mov ecx, dword [ebp - 0x24]
shl eax, cl
push eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x20]
sete dl
push edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, dword [ebp - 0x24]
setl cl
push ecx
push 1
call fcn.00406957
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x268], 0x3e
mov dword [ebp - 0x264], 0x25
lea eax, [ebp - 0x264]
push eax
push 0x22
push 0
mov ecx, dword [ebp - 0x268]
push ecx
push 0
call dword [sym.imp.USER32.dll_GetUserObjectInformationA]
xor edx, edx
cmp dword [ebp - 0x24], 0xffffffd6
sete dl
mov eax, dword [ebp - 0x24]
or eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
or ecx, 0x3e
mov edx, dword [ebp - 0x20]
shl edx, cl
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x24], 0x3f
jge 0x40350b
mov eax, dword [ebp - 0x24]
add eax, 0x32
mov ecx, dword [ebp - 0x20]
xor ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x3c
test edx, edx
je 0x403523
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0xffffffc8
mov eax, dword [ebp - 0x20]
sar eax, cl
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x20]
setne dl
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
or ecx, 0x8f0
mov dword [ebp - 0x20], ecx
xor edx, edx
test edx, edx
je 0x403551
mov eax, dword [ebp - 0x24]
add eax, 8
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
shl edx, cl
mov eax, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x20], eax
mov edx, 0x35
mov ecx, dword [ebp - 0x24]
sar edx, cl
mov eax, dword [ebp - 0x20]
or eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x403586
mov edx, dword [ebp - 0x20]
xor edx, 0xfffffffd
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sar eax, cl
test eax, eax
je 0x40359b
mov ecx, dword [ebp - 0x20]
and ecx, 0xe
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
imul eax, eax, 0x39
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
and ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
shl edx, cl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
sar eax, cl
test eax, eax
je 0x4035de
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [ebp - 0x20]
sete dl
mov eax, dword [ebp - 0x20]
mov ecx, edx
shl eax, cl
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
sar edx, cl
mov eax, dword [ebp - 0x24]
mov ecx, edx
sar eax, cl
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x20]
je 0x403606
mov ecx, dword [ebp - 0x24]
xor ecx, 0xffffffd4
mov edx, dword [ebp - 0x24]
sar edx, cl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
and eax, 0x30
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
sar edx, 0x2b
mov eax, dword [ebp - 0x24]
xor eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x20]
setne dl
mov eax, dword [ebp - 0x20]
mov ecx, edx
sar eax, cl
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setl dl
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [ebp - 0x20], eax
xor ecx, ecx
cmp dword [ebp - 0x24], 0x3a
setl cl
mov edx, dword [ebp - 0x24]
add edx, ecx
mov dword [ebp - 0x24], edx
mov eax, 7
test eax, eax
je 0x403679
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setg dl
mov eax, dword [ebp - 0x24]
mov ecx, edx
shl eax, cl
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [ebp - 0x20]
sete dl
mov eax, dword [ebp - 0x20]
or eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
sete dl
mov eax, dword [ebp - 0x24]
sub eax, edx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sar edx, cl
mov eax, dword [ebp - 0x24]
and eax, edx
mov dword [ebp - 0x24], eax
jmp 0x4031cc
xor ecx, ecx
cmp dword [ebp - 0x20], 0xffffffe0
setl cl
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
shl eax, cl
mov edx, dword [ebp - 0x24]
mov ecx, eax
sar edx, cl
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
sar eax, cl
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x3c
test ecx, ecx
je 0x4036fd
mov edx, dword [ebp - 0x20]
xor edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
and eax, edx
mov dword [ebp - 0x24], eax
xor ecx, ecx
cmp dword [ebp - 0x20], 0x2b
sete cl
mov edx, dword [ebp - 0x20]
shl edx, cl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x16
mov dword [ebp - 0x24], eax
xor ecx, ecx
test ecx, ecx
je 0x40372b
mov edx, dword [ebp - 0x20]
imul edx, edx, 0x24
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x403746
xor edx, edx
cmp dword [ebp - 0x24], 0xffffffc6
setle dl
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
and ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
imul edx, edx, 0xffffffc4
test edx, edx
je 0x403767
mov eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
xor ecx, eax
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
shl edx, cl
mov eax, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x24], 0xffffffc8
jle 0x40378f
mov edx, 0x23
mov ecx, dword [ebp - 0x20]
sar edx, cl
mov eax, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0x57037
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
xor edx, ecx
mov dword [ebp - 0x24], edx
xor eax, eax
cmp dword [ebp - 0x24], 0x3d
setl al
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, 0x23
mov ecx, dword [ebp - 0x24]
sar edx, cl
mov eax, dword [ebp - 0x24]
sub eax, edx
mov dword [ebp - 0x24], eax
xor ecx, ecx
cmp dword [ebp - 0x20], 0x35
setg cl
mov edx, dword [ebp - 0x24]
sar edx, cl
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0x20
je 0x4037e5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x20]
je 0x4037fc
mov edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sar edx, cl
test edx, edx
je 0x403816
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
shl eax, cl
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
shl edx, cl
mov eax, dword [ebp - 0x24]
xor eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setl dl
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [ebp - 0x20]
setne dl
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 4], 0
je 0x40391b
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [ebp - 0x20]
sete dl
mov eax, dword [ebp - 0x20]
mov ecx, edx
shl eax, cl
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
or ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
add edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
test eax, eax
je 0x403896
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp ecx, dword [ebp - 0x24]
setg dl
mov eax, dword [ebp - 0x24]
or eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
imul ecx, ecx, 0xffffffcb
mov edx, dword [ebp - 0x24]
add edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x2e
mov ecx, dword [ebp - 0x20]
or ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
sar edx, 0xd8
mov eax, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
lea ecx, [eax + edx - 0x2c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
xor edx, 0x5b
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x24]
add ecx, 0x28
mov eax, dword [ebp - 0x20]
sar eax, cl
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
or ecx, 0x22
mov edx, dword [ebp - 0x20]
xor edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
or eax, 0xffffffe0
test eax, eax
je 0x403916
xor ecx, ecx
cmp dword [ebp - 0x24], 0xffffffcb
setne cl
mov edx, dword [ebp - 0x20]
xor edx, ecx
mov dword [ebp - 0x20], edx
jmp 0x40384c
cmp dword [ebp - 0x20], 0xffffffde
jle 0x403927
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
xor edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
or al, 0x2e
test eax, eax
je 0x403952
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, dword [ebp - 0x20]
sete dl
mov eax, dword [ebp - 0x20]
and eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x3a
mov edx, dword [ebp - 0x24]
and edx, ecx
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x20]
xor ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
sar eax, cl
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x24], 0xffffffc9
je 0x403985
xor ecx, ecx
cmp dword [ebp - 0x20], 0x27
sete cl
mov edx, dword [ebp - 0x24]
xor edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, dword [ebp - 0x24]
setne cl
mov edx, dword [ebp - 0x24]
xor edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
or al, 0x32
mov ecx, dword [ebp - 0x24]
add ecx, eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x20], 0xffffffc2
je 0x4039b9
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x20], eax
mov ecx, 0x3b
test ecx, ecx
je 0x4039d0
mov edx, dword [ebp - 0x24]
and edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
call fcn.00406d52
mov ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
and edx, ecx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x20], 0x3a
jge 0x403a0e
mov eax, 0xffffffcd
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
xor ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x24]
xor edx, 0xffffffc7
test edx, edx
je 0x403a26
mov eax, dword [ebp - 0x20]
sar eax, 0x2a
mov ecx, dword [ebp - 0x20]
and ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
sar edx, cl
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
shl ecx, 0x36
mov edx, dword [ebp - 0x20]
add edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
test eax, eax
je 0x403a57
mov ecx, dword [ebp - 0x20]
add ecx, 0x11
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
imul edx, edx, 0x35
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
and ecx, 0x22
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, dword [ebp - 0x24]
sete cl
mov edx, dword [ebp - 0x24]
add edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
and ecx, eax
mov dword [ebp - 0x24], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret