Function at 0x4220d2
Capabilities:
Create directory
Delete file
Get common file path
Get disk size
Get graphical window text
Get keyboard layout
Log keystrokes via polling
Modify service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a48
call fcn.004b4d80
push esi
push edi
mov dword [ebp - 0x12c], 9
mov dword [ebp - 0x1f4], 3
mov dword [ebp - 0x448], 0xd7d393e7
push 3
lea ecx, [ebp - 0x13fc]
call fcn.00421789
mov dword [ebp - 0xe90], 0x7c869b7d
mov dword [ebp - 0xeb0], 8
mov dword [ebp - 0xdf4], 1
mov dword [ebp - 0xf54], 0xfbf26171
mov dword [ebp - 0x338], 0
jmp 0x42214d
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 3
jge 0x42216f
push dword [ebp - 0x338]
lea ecx, [ebp - 0x13fc]
call fcn.0042182a
mov dword [eax], 0xe61780ee
jmp 0x422140
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x14cc], eax
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x12c], eax
jle 0x4221ab
mov eax, 0x5047
test eax, eax
je 0x4221ab
mov dword [ebp - 0xe98], 1
jmp 0x4221b2
and dword [ebp - 0xe98], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x14d8], eax
push 1
lea ecx, [ebp - 0x13fc]
call fcn.0042182a
mov dword [eax], 2
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x14e0], eax
mov eax, dword [ebp - 0x448]
dec eax
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x12c]
add eax, dword [ebp - 0x12c]
cmp eax, 0x3d59
jge 0x422209
mov dword [ebp - 0x76c], 1
jmp 0x422210
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x76c], eax
jne 0x42222a
mov dword [ebp - 0xe80], 1
jmp 0x422231
and dword [ebp - 0xe80], 0
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0xe80], eax
jg 0x42224b
mov dword [ebp - 0xe88], 1
jmp 0x422252
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0xe88]
mov dword [ebp - 0xe90], eax
cmp dword [ebp - 0xe90], 0xfff8
je 0x422276
mov dword [ebp - 0xea0], 1
jmp 0x42227d
and dword [ebp - 0xea0], 0
mov eax, dword [ebp - 0xe98]
cmp eax, dword [ebp - 0xea0]
je 0x422297
mov dword [ebp - 0xea8], 1
jmp 0x42229e
and dword [ebp - 0xea8], 0
mov eax, dword [ebp - 0xea8]
sub eax, dword [ebp - 0x1f4]
mov dword [ebp - 0xeb0], eax
mov eax, dword [ebp - 0xeb0]
mov dword [ebp - 0xdf4], eax
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0xdf4], eax
jl 0x4222d6
mov dword [ebp - 0xce4], 1
jmp 0x4222dd
and dword [ebp - 0xce4], 0
mov eax, dword [ebp - 0x1f4]
add eax, dword [ebp - 0xce4]
sub eax, dword [ebp - 0x1f4]
mov dword [ebp - 0xf54], eax
lea ecx, [ebp - 0x13fc]
call fcn.00421825
mov dword [ebp - 0x78], 0x53b26bdd
mov dword [ebp - 0x1fc], 0x8f90a3cf
mov dword [ebp - 0x18], 0xa67606e8
mov dword [ebp - 0xd24], 0xdfce9586
push 1
lea ecx, [ebp - 0x11a0]
call fcn.00421789
push 2
lea ecx, [ebp - 0x1260]
call fcn.00421789
mov dword [ebp - 0x14e8], 0xffffffff
mov dword [ebp - 0xc4], 0
jmp 0x42235f
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x422381
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x11a0]
call fcn.0042182a
mov dword [eax], 1
jmp 0x422352
mov dword [ebp - 0xc4], 0
jmp 0x42239a
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x4223b9
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x1260]
call fcn.0042182a
or dword [eax], 0xffffffff
jmp 0x42238d
mov dword [ebp - 0x78], 0
jmp 0x4223c9
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xe
jg 0x422933
mov dword [ebp - 0x11c], 0xb7f37c04
mov dword [ebp - 0x22c], 0x63090707
mov dword [ebp - 0x52c], 0xffffffff
mov dword [ebp - 0x14f0], 0xfdda7840
mov dword [ebp - 0x1130], 0xb9bdd189
mov dword [ebp - 0x1120], 0xfffffffd
mov dword [ebp - 0x1128], 0x513e67dc
mov dword [ebp - 0x1118], 6
mov dword [ebp - 0x14f8], 0x5a1b5826
and dword [ebp - 0x1344], 0
and dword [ebp - 0x1340], 0
and dword [ebp - 0x133c], 0
and dword [ebp - 0x1338], 0
lea ecx, [ebp - 0x509]
call fcn.00421839
push eax
lea eax, [ebp - 0x1334]
push eax
lea eax, [ebp - 0x1344]
push eax
lea ecx, [ebp - 0x1958]
call fcn.0042183c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x18d8]
call fcn.004217ff
cmp dword [ebp - 0x11c], 0
je 0x42249c
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1500], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x1508], eax
mov eax, 0xb999fb02
cmp eax, 0x934f545e
je 0x4224b4
mov dword [ebp - 0x55c], 1
jmp 0x4224bb
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x55c], eax
jl 0x4224d5
mov dword [ebp - 0xcec], 1
jmp 0x4224dc
and dword [ebp - 0xcec], 0
mov eax, dword [ebp - 0xcec]
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
je 0x422772
mov dword [ebp - 0x107c], 0x2324015f
mov dword [ebp - 0x524], 1
mov dword [ebp - 0x5a4], 0x3c444c9c
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1510], eax
mov eax, dword [ebp - 0x107c]
cmp dword [ebp - 0x11c], eax
jge 0x422539
mov dword [ebp - 0x56c], 1
jmp 0x422540
and dword [ebp - 0x56c], 0
mov dword [ebp - 0x1fc], 0x291920b2
cmp dword [ebp - 0x1fc], 0xffffa903
je 0x422562
mov dword [ebp - 0x564], 1
jmp 0x422569
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 4
jne 0x42258a
mov dword [ebp - 0xcf4], 1
jmp 0x422591
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0x524]
cmp dword [ebp - 0xcf4], eax
jle 0x4225b1
cmp dword [ebp - 0x524], 0
jne 0x4225b1
and dword [ebp - 0xcfc], 0
jmp 0x4225bb
mov dword [ebp - 0xcfc], 1
mov eax, dword [ebp - 0x56c]
cmp eax, dword [ebp - 0xcfc]
jge 0x4225d5
mov dword [ebp - 0x574], 1
jmp 0x4225dc
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 0x46552ded
jne 0x4225f4
mov dword [ebp - 0xd04], 1
jmp 0x4225fb
and dword [ebp - 0xd04], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xd04], eax
jle 0x422612
mov dword [ebp - 0x57c], 1
jmp 0x422619
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x57c], eax
jge 0x422630
mov dword [ebp - 0xd0c], 1
jmp 0x422637
and dword [ebp - 0xd0c], 0
mov eax, dword [ebp - 0xd0c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jne 0x422652
mov dword [ebp - 0x584], 1
jmp 0x422659
and dword [ebp - 0x584], 0
cmp dword [ebp - 0x584], 0xfffffffe
jg 0x42266e
mov dword [ebp - 0xd14], 1
jmp 0x422675
and dword [ebp - 0xd14], 0
cmp dword [ebp - 0xd14], 0xffffffff
jg 0x42268a
mov dword [ebp - 0x58c], 1
jmp 0x422691
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x52c], eax
jge 0x4226b4
mov dword [ebp - 0xd1c], 1
jmp 0x4226bb
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0x11c]
add eax, dword [ebp - 0xd1c]
cmp eax, dword [ebp - 0x524]
jl 0x4226db
mov dword [ebp - 0x594], 1
jmp 0x4226e2
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0xd24], eax
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0xd24], eax
jge 0x422708
mov dword [ebp - 0x59c], 1
jmp 0x42270f
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x59c], eax
jl 0x422726
mov dword [ebp - 0xd2c], 1
jmp 0x42272d
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0xd2c]
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 0xf34d89bb
jne 0x422751
mov dword [ebp - 0xd34], 1
jmp 0x422758
and dword [ebp - 0xd34], 0
push 0
lea ecx, [ebp - 0x11a0]
call fcn.0042182a
mov ecx, dword [ebp - 0xd34]
mov dword [eax], ecx
jmp 0x42281b
mov dword [ebp - 0x22c], 0
jmp 0x42278b
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 2
jle 0x4227ef
mov dword [ebp - 0x5ac], 0xffffffff
mov dword [ebp - 0x18], 0
jmp 0x4227ae
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jle 0x4227ed
cmp dword [ebp - 0x11c], 0
je 0x4227cc
mov eax, dword [ebp - 0x5ac]
dec eax
mov dword [ebp - 0x5ac], eax
jmp 0x4227eb
mov byte [ebp - 0x1e2], 0
movzx eax, byte [ebp - 0x1e2]
test eax, eax
je 0x4227eb
push 0
push 0x2092
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x4227a7
jmp 0x42277e
mov dword [ebp - 0x18], 0
jmp 0x4227ff
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x42281b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x11a0]
call fcn.0042182a
mov dword [eax], 0xfffffffb
jmp 0x4227f8
push 0
lea ecx, [ebp - 0x1260]
call fcn.0042182a
mov dword [ebp - 0xd3c], eax
mov eax, dword [ebp - 0xd3c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xd3c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x1578], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1580], eax
mov eax, dword [ebp - 0x52c]
cmp dword [ebp - 0x1120], eax
jl 0x42286e
mov dword [ebp - 0x5b4], 1
jmp 0x422875
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x422893
cmp dword [ebp - 0x18], 0
jne 0x422893
and dword [ebp - 0xd44], 0
jmp 0x42289d
mov dword [ebp - 0xd44], 1
mov eax, dword [ebp - 0x1128]
cmp eax, dword [ebp - 0xd44]
jle 0x4228b7
mov dword [ebp - 0x5bc], 1
jmp 0x4228be
and dword [ebp - 0x5bc], 0
push 0
lea ecx, [ebp - 0x1260]
call fcn.0042182a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5bc]
jle 0x4228dc
cmp dword [ebp - 0x11c], 0
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x422901
mov eax, 0x7464
test eax, eax
je 0x422901
cmp dword [ebp - 0x1fc], 0
je 0x422901
mov dword [ebp - 0xd4c], 1
jmp 0x422908
and dword [ebp - 0xd4c], 0
push 0
lea ecx, [ebp - 0x11a0]
call fcn.0042182a
mov ecx, dword [ebp - 0xd4c]
add ecx, dword [eax]
mov dword [ebp - 0x1130], ecx
lea ecx, [ebp - 0x18d8]
call fcn.00421825
jmp 0x4223c2
lea ecx, [ebp - 0x1260]
call fcn.00421825
lea ecx, [ebp - 0x11a0]
call fcn.00421825
mov dword [ebp - 4], 0xfffffffc
mov dword [ebp - 0x270], 0xfffffff6
mov dword [ebp - 0x170], 0xcdfd
mov dword [ebp - 0xf0], 1
mov dword [ebp - 0x88], 0
jmp 0x422987
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x4229a3
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x15c], 0x6af1124f
jmp 0x42297a
mov dword [ebp - 0x88], 0
jmp 0x4229bc
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x4229d8
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x450], 0
jmp 0x4229af
mov dword [ebp - 4], 0
jmp 0x4229e8
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jg 0x422c6a
mov dword [ebp - 0xd54], 4
mov dword [ebp - 0x264], 0xfb9a31c0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x15c]
mov dword [ebp - 0x1588], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x15c]
cmp dword [ebp + eax - 0x15c], ecx
jne 0x422a80
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x15c], 0x86aeba4d
ja 0x422a4b
mov dword [ebp - 0x5c4], 1
jmp 0x422a52
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0xd54], eax
cmp dword [ebp - 0xd54], 0
je 0x422a80
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x15c], 0
je 0x422a80
mov dword [ebp - 0x5cc], 1
jmp 0x422a87
and dword [ebp - 0x5cc], 0
cmp dword [ebp - 0x5cc], 6
jle 0x422a9c
mov dword [ebp - 0x1138], 1
jmp 0x422aa3
and dword [ebp - 0x1138], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x15c]
mov dword [ebp - 0x1590], eax
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x15c], 1
je 0x422acc
mov dword [ebp - 0xd5c], 1
jmp 0x422ad3
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0xd5c]
neg eax
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x15c]
cmp dword [ebp - 0x270], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x15c], 8
jl 0x422b0d
mov dword [ebp - 0x1140], 1
jmp 0x422b14
and dword [ebp - 0x1140], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x15c]
mov dword [ebp - 0x1598], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x15c]
mov dword [ebp - 0x15a0], eax
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x15c], 0x6d5d
jge 0x422b53
mov dword [ebp - 0x5d4], 1
jmp 0x422b5a
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x15a8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 4]
cmp dword [ebp + eax - 0x15c], ecx
jl 0x422b8d
mov dword [ebp - 0xd6c], 1
jmp 0x422b94
and dword [ebp - 0xd6c], 0
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x270]
cmp eax, 0xfffffff9
je 0x422bae
mov dword [ebp - 0xd64], 1
jmp 0x422bb5
and dword [ebp - 0xd64], 0
mov eax, dword [ebp - 0xd64]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x5dc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5dc]
mov dword [ebp + eax - 0x450], ecx
mov eax, dword [ebp - 4]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x15c]
mov edx, dword [ebp - 0x5dc]
lea ecx, [edx + ecx - 1]
sub ecx, dword [ebp - 0x264]
add ecx, dword [ebp + eax*4 - 0x15c]
cmp dword [ebp - 4], ecx
jne 0x422c18
mov dword [ebp - 0x5e4], 1
jmp 0x422c1f
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0xd6c]
cmp eax, dword [ebp - 0x5e4]
jge 0x422c39
mov dword [ebp - 0xd74], 1
jmp 0x422c40
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0x170]
add eax, dword [ebp - 0xd74]
imul eax, dword [ebp - 0x264]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0xf0], eax
jmp 0x4229e1
mov dword [ebp - 4], 3
jmp 0x422c7a
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x18
jg 0x422e43
mov dword [ebp - 0x274], 0x49dd
mov dword [ebp - 0x178], 0x63ccf75b
mov dword [ebp - 0x274], 0xbf60700c
mov dword [ebp - 0x170], 0
jmp 0x422cbb
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
jg 0x422e3e
mov dword [ebp - 0x274], 0
jmp 0x422ce1
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0
jg 0x422dda
mov dword [ebp - 0x278], 0x13d7aff7
mov dword [ebp - 0xf0], 0
jmp 0x422d11
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jg 0x422dd5
mov eax, dword [ebp - 0x170]
cmp dword [ebp + eax*4 - 0x450], 0x47ca
jge 0x422d3d
mov dword [ebp - 0x5ec], 1
jmp 0x422d44
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp + eax*4 - 0x450]
cmp eax, dword [ebp - 0x178]
jle 0x422d92
cmp dword [ebp - 0x278], 0x94d23a2c
jb 0x422d7d
mov dword [ebp - 0xd7c], 1
jmp 0x422d84
and dword [ebp - 0xd7c], 0
mov eax, dword [ebp - 0xd7c]
mov dword [ebp - 0x178], eax
jmp 0x422dd0
mov dword [ebp - 0x278], 0
jmp 0x422dab
mov eax, dword [ebp - 0x278]
dec eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
jl 0x422dd0
mov byte [ebp - 0x1b9], 0
movzx eax, byte [ebp - 0x1b9]
test eax, eax
je 0x422dce
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
jmp 0x422d9e
jmp 0x422d04
jmp 0x422cd4
mov dword [ebp - 0xf0], 0
jmp 0x422df3
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jl 0x422e39
mov dword [ebp - 0x5f4], 0x226f
mov dword [ebp - 0x178], 0
jmp 0x422e1f
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jg 0x422e37
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
jmp 0x422e12
jmp 0x422de6
jmp 0x422cae
jmp 0x422c73
mov dword [ebp - 0x58], 0xfffffff8
mov dword [ebp - 0x3fc], 0
jmp 0x422e63
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 3
jge 0x422e7f
mov eax, dword [ebp - 0x3fc]
mov dword [ebp + eax*4 - 0x18f0], 0
jmp 0x422e56
mov dword [ebp - 0x58], 0
jmp 0x422e8f
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffffff0
jle 0x4230d4
push 2
lea ecx, [ebp - 0xf50]
call fcn.00421789
mov dword [ebp - 0x5fc], 0xfffffffb
mov dword [ebp - 0xa0], 0
jmp 0x422ec9
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x422eeb
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xf50]
call fcn.0042182a
mov dword [eax], 7
jmp 0x422ebc
mov dword [ebp - 0xa0], 0
jmp 0x422f04
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 4
jge 0x422f20
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x19a8], 1
jmp 0x422ef7
push 1
lea ecx, [ebp - 0xf50]
call fcn.0042182a
and dword [eax], 0
jmp 0x422f56
push 1
lea ecx, [ebp - 0xf50]
call fcn.0042182a
mov dword [ebp - 0xd84], eax
mov eax, dword [ebp - 0xd84]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xd84]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xf50]
call fcn.0042182a
cmp dword [eax], 0xffffffe3
jge 0x4230c4
mov dword [ebp - 0x604], 8
mov dword [ebp - 0xd8c], 1
mov dword [ebp - 0x1148], 0x3d1aa12a
xor eax, eax
inc eax
je 0x423066
mov dword [ebp - 0x5fc], 0xfffffffc
cmp dword [ebp - 0x5fc], 0x310c
jge 0x422fb5
mov dword [ebp - 0x60c], 1
jmp 0x422fbc
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x604]
imul eax, dword [ebp - 0x58]
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0xd8c]
sub eax, 0x9f08
cmp eax, dword [ebp - 0x604]
jge 0x422feb
mov dword [ebp - 0xd94], 1
jmp 0x422ff2
and dword [ebp - 0xd94], 0
push 1
lea ecx, [ebp - 0xf50]
call fcn.0042182a
mov ecx, dword [ebp - 0xd94]
cmp ecx, dword [eax]
jg 0x423015
mov dword [ebp - 0x4c8], 1
jmp 0x42301c
and dword [ebp - 0x4c8], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x4c8]
mov dword [ebp + eax - 0x19a8], ecx
mov eax, dword [ebp - 0x60c]
cmp eax, dword [ebp - 0x4c8]
jl 0x423049
mov dword [ebp - 0xd9c], 1
jmp 0x423050
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0xd9c]
neg eax
je 0x423066
mov dword [ebp - 0x614], 1
jmp 0x42306d
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x614], eax
jle 0x42308a
mov eax, 0xa7f4ea14
test eax, eax
jne 0x42308a
and dword [ebp - 0xda4], 0
jmp 0x423094
mov dword [ebp - 0xda4], 1
cmp dword [ebp - 0xda4], 0x4e2bf5f4
jl 0x4230ac
mov dword [ebp - 0x61c], 1
jmp 0x4230b3
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x1148], eax
jmp 0x422f32
lea ecx, [ebp - 0xf50]
call fcn.00421825
jmp 0x422e88
mov dword [ebp - 0x58], 0
jmp 0x4230e4
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x4230fa
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x18f0], 1
jmp 0x4230dd
mov dword [ebp - 0x124], 9
mov dword [ebp - 0x404], 0xd6c05baf
push 4
lea ecx, [ebp - 0x1384]
call fcn.00421789
mov dword [ebp - 0x15b0], 0xffffffff
mov dword [ebp - 0x314], 0
jmp 0x42313e
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 4
jge 0x423160
push dword [ebp - 0x314]
lea ecx, [ebp - 0x1384]
call fcn.0042182a
mov dword [eax], 0x8e17b844
jmp 0x423131
mov dword [ebp - 0x404], 0
jmp 0x423179
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0x1d
je 0x42323f
mov dword [ebp - 0x2b0], 9
mov dword [ebp - 0xdac], 9
mov dword [ebp - 0x31c], 0
jmp 0x4231b3
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 4
jge 0x4231cf
mov eax, dword [ebp - 0x31c]
mov dword [ebp + eax*4 - 0x19c8], 0
jmp 0x4231a6
mov dword [ebp - 0x2b0], 3
jmp 0x4231e8
mov eax, dword [ebp - 0x2b0]
dec eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0
jl 0x42323a
mov dword [ebp - 0x624], 0x90ef307d
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp + eax*4 - 0x19c8], 0
je 0x42320d
jmp 0x42323a
mov dword [ebp - 0xdac], 0
mov eax, dword [ebp - 0xdac]
mov dword [ebp - 0x624], eax
mov esi, dword [ebp - 0x624]
push 3
lea ecx, [ebp - 0x1384]
call fcn.0042182a
mov dword [eax], esi
jmp 0x4231db
jmp 0x42316c
lea ecx, [ebp - 0x1384]
call fcn.00421825
mov dword [ebp - 0x254], 3
mov dword [ebp - 0x4d0], 0xd7d393e7
mov dword [ebp - 0x15b8], 1
mov dword [ebp - 0x15c0], 0xf2c29a3d
mov dword [ebp - 0x15c8], 0x75c19c5a
mov dword [ebp - 0x15d0], 0xd3f46721
mov dword [ebp - 0x15d8], 0x1e29ea41
mov dword [ebp - 0x15e0], 1
mov dword [ebp - 0x15e8], 0xfa72c25f
mov dword [ebp - 0x15f0], 1
push 2
lea ecx, [ebp - 0x1720]
call fcn.00421789
mov dword [ebp - 0x15f8], 0x6d8d3833
mov dword [ebp - 0x1600], 0x3ec9
mov dword [ebp - 0xdb4], 0xfffffff6
mov dword [ebp - 0x40c], 0
jmp 0x4232f2
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 2
jge 0x423314
push dword [ebp - 0x40c]
lea ecx, [ebp - 0x1720]
call fcn.0042182a
mov dword [eax], 7
jmp 0x4232e5
mov byte [ebp - 0x15f], 0
movzx eax, byte [ebp - 0x15f]
test eax, eax
je 0x423335
push 0x1a4f
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [ebp - 0xdb4]
inc eax
mov dword [ebp - 0xdb4], eax
lea ecx, [ebp - 0x1720]
call fcn.00421825
push 3
lea ecx, [ebp - 0x13b4]
call fcn.00421789
mov dword [ebp - 0x70], 0xfffffff6
mov dword [ebp - 0x458], 0x40a98cee
mov dword [ebp - 0x414], 0xffffffff
mov dword [ebp - 0x180], 0xdae89405
mov dword [ebp - 0x664], 0xaf849fb9
mov dword [ebp - 0xe08], 6
mov dword [ebp - 0x324], 0
jmp 0x4233ac
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 3
jge 0x4233c8
mov eax, dword [ebp - 0x324]
mov dword [ebp + eax*4 - 0x1908], 0x6a8acdd1
jmp 0x42339f
mov eax, 0xffff
test eax, eax
je 0x423649
mov dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x414]
add eax, dword [ebp - 0x458]
cmp eax, dword [ebp - 0x70]
jge 0x4233fc
mov dword [ebp - 0x62c], 1
jmp 0x423403
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 0xe2c9bf5e
jae 0x42341b
mov dword [ebp - 0x1150], 1
jmp 0x423422
and dword [ebp - 0x1150], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x1608], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x1610], eax
imul eax, dword [ebp - 0x70], 0xc1c5
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x414], eax
jge 0x42346d
mov eax, 0x419c2b2e
test eax, eax
je 0x42346d
cmp dword [ebp - 0x414], 0
je 0x42346d
mov dword [ebp - 0xdbc], 1
jmp 0x423474
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0xdbc], eax
jg 0x42348e
mov dword [ebp - 0x634], 1
jmp 0x423495
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x180]
imul eax, dword [ebp - 0x634]
cmp eax, dword [ebp - 0x70]
jl 0x4234b3
mov dword [ebp - 0xdc4], 1
jmp 0x4234ba
and dword [ebp - 0xdc4], 0
cmp dword [ebp - 0xdc4], 0
jge 0x4234d0
xor eax, eax
jne 0x4234d0
and dword [ebp - 0x63c], 0
jmp 0x4234da
mov dword [ebp - 0x63c], 1
cmp dword [ebp - 0x63c], 0
je 0x4234ef
mov dword [ebp - 0xdcc], 1
jmp 0x4234f6
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0x180]
add eax, dword [ebp - 0xdcc]
cmp eax, dword [ebp - 0x180]
jne 0x423516
mov dword [ebp - 0x644], 1
jmp 0x42351d
and dword [ebp - 0x644], 0
cmp dword [ebp - 0x644], 0
je 0x423532
mov dword [ebp - 0xdd4], 1
jmp 0x423539
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0xdd4]
imul eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x70]
jge 0x42355a
mov dword [ebp - 0x64c], 1
jmp 0x423561
and dword [ebp - 0x64c], 0
cmp dword [ebp - 0x64c], 0xea37
je 0x423579
mov dword [ebp - 0xddc], 1
jmp 0x423580
and dword [ebp - 0xddc], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0xddc]
jl 0x423597
mov dword [ebp - 0x654], 1
jmp 0x42359e
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x654], eax
jge 0x4235b8
mov dword [ebp - 0xde4], 1
jmp 0x4235bf
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0xde4], eax
jne 0x4235d9
mov dword [ebp - 0x65c], 1
jmp 0x4235e0
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x65c], eax
jg 0x4235f7
mov dword [ebp - 0x1158], 1
jmp 0x4235fe
and dword [ebp - 0x1158], 0
cmp dword [ebp - 0x70], 0xa32987c8
jae 0x423613
mov dword [ebp - 0xdec], 1
jmp 0x42361a
and dword [ebp - 0xdec], 0
mov eax, dword [ebp - 0xdec]
neg eax
mov dword [ebp - 0x664], eax
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0xe08], eax
cmp dword [ebp - 0xe08], 0
je 0x423649
mov dword [ebp - 0x66c], 1
jmp 0x423650
and dword [ebp - 0x66c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x66c]
mov dword [ebp + eax - 0x1908], ecx
mov dword [ebp - 0x708], 0x7c869b7d
mov dword [ebp - 0x718], 8
mov dword [ebp - 0xb08], 1
mov dword [ebp - 0x1074], 0xfbf26171
push 3
lea ecx, [ebp - 0x304]
call fcn.00421789
mov dword [ebp - 0x32c], 0
jmp 0x4236b0
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 3
jge 0x4236d2
push dword [ebp - 0x32c]
lea ecx, [ebp - 0x304]
call fcn.0042182a
mov dword [eax], 0xe387fb0b
jmp 0x4236a3
push 1
lea ecx, [ebp - 0x304]
call fcn.0042182a
cmp dword [eax], 0
je 0x42380d
mov dword [ebp - 0x674], 0xaa165420
mov dword [ebp - 0x41c], 0
jmp 0x42370b
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 4
jge 0x423727
mov eax, dword [ebp - 0x41c]
mov dword [ebp + eax*4 - 0x189c], 0xdee21afa
jmp 0x4236fe
or eax, 0xffffffff
je 0x423789
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x189c]
cmp dword [ebp + eax - 0x189c], ecx
je 0x423753
mov dword [ebp - 0xe10], 1
jmp 0x42375a
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0xe10]
mov dword [ebp - 0x674], eax
mov esi, dword [ebp - 0x674]
push 2
lea ecx, [ebp - 0x304]
call fcn.0042182a
cmp dword [eax], esi
jl 0x423789
mov dword [ebp - 0xe18], 1
jmp 0x423790
and dword [ebp - 0xe18], 0
cmp dword [ebp - 0xe18], 3
jae 0x4237a5
mov dword [ebp - 0x1160], 1
jmp 0x4237ac
and dword [ebp - 0x1160], 0
push 0
lea ecx, [ebp - 0x304]
call fcn.0042182a
cmp dword [eax], 0x9dce
jg 0x4237cd
mov dword [ebp - 0x67c], 1
jmp 0x4237d4
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 0xfffc
je 0x4237ec
mov dword [ebp - 0xe20], 1
jmp 0x4237f3
and dword [ebp - 0xe20], 0
push 1
lea ecx, [ebp - 0x304]
call fcn.0042182a
mov ecx, dword [ebp - 0xe20]
mov dword [eax], ecx
jmp 0x423b2f
mov dword [ebp - 0x438], 1
mov dword [ebp - 0x434], 1
mov dword [ebp - 0x430], 1
mov dword [ebp - 0x42c], 1
push 2
lea ecx, [ebp - 0x139c]
call fcn.00421789
mov dword [ebp - 0x68c], 0xfffffff7
mov dword [ebp - 0x694], 0
mov dword [ebp - 0xd8], 0
jmp 0x42386f
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x423891
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x139c]
call fcn.0042182a
mov dword [eax], 0xfffffff7
jmp 0x423862
mov dword [ebp - 0xd8], 0
jmp 0x4238aa
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x4238c6
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x12ec], 0xfffffffc
jmp 0x42389d
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x438], 0
jmp 0x4238f4
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x438]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x438], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x438], 2
jg 0x423a67
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x438]
lea ecx, [ebp - 0x304]
call fcn.0042182a
cmp dword [eax], 0
je 0x42392a
jmp 0x423a67
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x438]
lea ecx, [ebp - 0x304]
call fcn.0042182a
cmp dword [eax], 0
jl 0x423953
mov dword [ebp - 0xe30], 1
jmp 0x42395a
and dword [ebp - 0xe30], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x438], 0
jne 0x4239b3
push 1
lea ecx, [ebp - 0x139c]
call fcn.0042182a
mov dword [ebp - 0x684], eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x438]
lea ecx, [ebp - 0x304]
call fcn.0042182a
mov ecx, dword [ebp - 0x684]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x684]
cmp dword [eax], 0
jne 0x4239b3
and dword [ebp - 0xe28], 0
jmp 0x4239bd
mov dword [ebp - 0xe28], 1
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x438]
lea ecx, [ebp - 0x304]
call fcn.0042182a
mov esi, dword [ebp - 0xe28]
imul esi, dword [eax]
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x438]
lea ecx, [ebp - 0x304]
call fcn.0042182a
cmp esi, dword [eax]
jne 0x423a06
mov dword [ebp - 0x1168], 1
jmp 0x423a0d
and dword [ebp - 0x1168], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x438]
lea ecx, [ebp - 0x304]
call fcn.0042182a
mov ecx, 0x43b9c309
sub ecx, dword [eax]
mov dword [ebp - 0x68c], ecx
mov esi, dword [ebp - 0x68c]
add esi, dword [ebp - 0xe30]
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x438]
lea ecx, [ebp - 0x304]
call fcn.0042182a
mov dword [eax], esi
mov dword [ebp - 0x694], 0xfffffff7
jmp 0x4238d9
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x438]
push 2
lea ecx, [ebp - 0x304]
call fcn.0042182a
cmp esi, dword [eax]
je 0x423a91
mov dword [ebp - 0x1170], 1
jmp 0x423a98
and dword [ebp - 0x1170], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x12ec]
mov dword [ebp - 0x1618], eax
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0xe38], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe38]
mov dword [ebp + eax - 0x438], ecx
cmp dword [ebp - 0xe38], 1
jg 0x423adf
mov dword [ebp - 0x69c], 1
jmp 0x423ae6
and dword [ebp - 0x69c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x12ec]
cmp dword [ebp - 0x69c], eax
jge 0x423b07
mov dword [ebp - 0xe40], 1
jmp 0x423b0e
and dword [ebp - 0xe40], 0
imul esi, dword [ebp - 0xe40], 0
push 1
lea ecx, [ebp - 0x304]
call fcn.0042182a
mov dword [eax], esi
lea ecx, [ebp - 0x139c]
call fcn.00421825
lea ecx, [ebp - 0x304]
call fcn.00421825
mov dword [ebp - 0x520], 1
mov dword [ebp - 0x1180], 0x383c67ee
mov dword [ebp - 0xa8], 0
jmp 0x423b67
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x423b83
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x11b0], 9
jmp 0x423b5a
mov dword [ebp - 0xa8], 0
jmp 0x423b9c
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x423bb8
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x1178], 0x8d3a18e4
jmp 0x423b8f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x11b0]
mov dword [ebp - 0x6a4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6a4]
mov dword [ebp + eax - 0x1178], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11b0]
cmp eax, dword [ebp - 0x6a4]
jl 0x423bff
mov dword [ebp - 0xe48], 1
jmp 0x423c06
and dword [ebp - 0xe48], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11b0]
add eax, dword [ebp - 0xe48]
cmp eax, 0x3358
jl 0x423c2c
mov dword [ebp - 0x6ac], 1
jmp 0x423c33
and dword [ebp - 0x6ac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11b0]
sub eax, dword [ebp - 0x6ac]
add eax, dword [ebp - 0x520]
mov dword [ebp - 0xe50], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe50]
mov dword [ebp + eax - 0x11b0], ecx
mov eax, dword [ebp - 0x520]
cmp dword [ebp - 0xe50], eax
jl 0x423c7f
mov dword [ebp - 0x6b4], 1
jmp 0x423c86
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x520]
cmp dword [ebp - 0x6b4], eax
jne 0x423ca0
mov dword [ebp - 0xe58], 1
jmp 0x423ca7
and dword [ebp - 0xe58], 0
cmp dword [ebp - 0xe58], 7
jge 0x423cbc
mov dword [ebp - 0x6bc], 1
jmp 0x423cc3
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x1180], eax
mov dword [ebp - 0x424], 0
jmp 0x423ce8
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 3
jge 0x423d0a
push dword [ebp - 0x424]
lea ecx, [ebp - 0x13b4]
call fcn.0042182a
mov dword [eax], 0xe61780ee
jmp 0x423cdb
mov dword [ebp - 0x1620], 0
mov byte [ebp - 0x191], 0
movzx eax, byte [ebp - 0x191]
test eax, eax
je 0x423d2e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x423d52
push 0x12a8
push 0
push 0x20d0
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x8c], 0x822e6e7f
mov dword [ebp - 0x1628], 0x971867b8
mov dword [ebp - 0x1630], 2
mov dword [ebp - 0x13c], 0xcc2fdcba
mov dword [ebp - 0x1638], 0x7c9d5fac
mov dword [ebp - 0xe78], 0xfffffffd
mov dword [ebp - 0x1254], 0x391cb4e7
mov dword [ebp - 0xae8], 0xfffffffe
mov dword [ebp - 0x1640], 0xdade
mov dword [ebp - 0x1648], 0xfffffff7
mov dword [ebp - 0x1650], 0xc1d10227
mov dword [ebp - 0x124c], 0xf72b5725
mov dword [ebp - 0x1658], 0x9694d2b5
mov dword [ebp - 0x1188], 0xadb82134
mov dword [ebp - 0x1660], 0x41ce3cb5
mov dword [ebp - 0x1668], 1
mov dword [ebp - 0x1670], 0x932e3ca3
mov dword [ebp - 0x1678], 0xfffffff6
mov dword [ebp - 0x1190], 0xdb39523d
mov dword [ebp - 0x1680], 0x40a98cee
mov dword [ebp - 0xcf0], 0xb32e2659
mov dword [ebp - 0x334], 0xee91b76
mov dword [ebp - 0x1688], 0xffffffff
mov dword [ebp - 0x1690], 0xc9bf5e4d
push 2
lea ecx, [ebp - 0x444]
call fcn.00421789
mov dword [ebp - 0x1698], 0x1f6657ee
mov dword [ebp - 0x16a0], 0xd402
mov dword [ebp - 0xe00], 0x70105c65
mov dword [ebp - 0x30], 0
jmp 0x423e94
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x423eaa
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1998], 0
jmp 0x423e8d
mov dword [ebp - 0x30], 0
jmp 0x423eba
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x423ed6
push dword [ebp - 0x30]
lea ecx, [ebp - 0x444]
call fcn.0042182a
mov dword [eax], 0x25fc1c57
jmp 0x423eb3
mov dword [ebp - 0x30], 0
jmp 0x423ee6
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x423efc
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x12fc], 0xfffffff7
jmp 0x423edf
cmp dword [ebp - 0x460], 0x558bac04
jge 0x423f14
mov dword [ebp - 0xe68], 1
jmp 0x423f1b
and dword [ebp - 0xe68], 0
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x16a8], eax
cmp dword [ebp - 0xe78], 0
je 0x423f45
cmp dword [ebp - 0xcf0], 0
je 0x423f45
mov dword [ebp - 0x6c4], 1
jmp 0x423f4c
and dword [ebp - 0x6c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x12fc]
inc eax
mov dword [ebp - 0xe60], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe60]
mov dword [ebp + eax - 0x12fc], ecx
mov eax, dword [ebp - 0xe60]
cmp eax, dword [ebp - 0x6c4]
jle 0x423f8d
mov dword [ebp - 0x6cc], 1
jmp 0x423f94
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0xe68]
cmp eax, dword [ebp - 0x6cc]
jle 0x423fae
mov dword [ebp - 0xe70], 1
jmp 0x423fb5
and dword [ebp - 0xe70], 0
mov eax, dword [ebp - 0x460]
sub eax, dword [ebp - 0xe70]
mov dword [ebp - 0x1188], eax
mov dword [ebp - 0x8c], 0
jmp 0x423fe0
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jg 0x4241f0
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x444]
call fcn.0042182a
mov eax, dword [eax]
mov dword [ebp - 0x1190], eax
mov dword [ebp - 0x13c], 1
jmp 0x42401f
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jl 0x4241eb
mov dword [ebp - 0x334], 1
jmp 0x424045
mov eax, dword [ebp - 0x334]
dec eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
jl 0x424067
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x444]
call fcn.0042182a
mov dword [eax], 0xfffffffe
jmp 0x424038
imul esi, dword [ebp - 0xe78], 0x4440
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x444]
call fcn.0042182a
cmp esi, dword [eax]
jge 0x424092
mov dword [ebp - 0x6d8], 1
jmp 0x424099
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0xae8], eax
mov esi, dword [ebp - 0xae8]
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x444]
call fcn.0042182a
mov edi, dword [eax]
add edi, esi
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x444]
call fcn.0042182a
imul edi, dword [eax]
cmp edi, 0xd92
jge 0x4240e8
mov dword [ebp - 0x6e0], 1
jmp 0x4240ef
and dword [ebp - 0x6e0], 0
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x444]
call fcn.0042182a
mov ecx, dword [ebp - 0x6e0]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x124c]
jl 0x424122
cmp dword [ebp - 0xcf0], 0
jne 0x424122
and dword [ebp - 0x6e8], 0
jmp 0x42412c
mov dword [ebp - 0x6e8], 1
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x444]
call fcn.0042182a
mov ecx, dword [ebp - 0x6e8]
imul ecx, dword [eax]
cmp ecx, 5
jne 0x424157
mov dword [ebp - 0xaf0], 1
jmp 0x42415e
and dword [ebp - 0xaf0], 0
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x444]
call fcn.0042182a
mov ecx, dword [ebp - 0xaf0]
cmp ecx, dword [eax]
jne 0x424185
mov dword [ebp - 0x6f0], 1
jmp 0x42418c
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0xe00], eax
mov esi, dword [ebp - 0xe00]
neg esi
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x444]
call fcn.0042182a
cmp dword [eax], esi
jne 0x4241ca
cmp dword [ebp - 0x1254], 0
je 0x4241ca
mov dword [ebp - 0x6f8], 1
jmp 0x4241d1
and dword [ebp - 0x6f8], 0
push 1
lea ecx, [ebp - 0x444]
call fcn.0042182a
mov ecx, dword [ebp - 0x6f8]
mov dword [eax], ecx
jmp 0x424012
jmp 0x423fd3
lea ecx, [ebp - 0x444]
call fcn.00421825
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x16b0], eax
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x124], eax
jle 0x42422a
mov eax, 0x5047
test eax, eax
je 0x42422a
mov dword [ebp - 0xb00], 1
jmp 0x424231
and dword [ebp - 0xb00], 0
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x16b8], eax
push 1
lea ecx, [ebp - 0x13b4]
call fcn.0042182a
mov dword [eax], 2
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x16c0], eax
mov eax, dword [ebp - 0x4d0]
dec eax
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x124]
cmp eax, 0x3d59
jge 0x424288
mov dword [ebp - 0xaf8], 1
jmp 0x42428f
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0xaf8], eax
jne 0x4242a9
mov dword [ebp - 0x700], 1
jmp 0x4242b0
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x700], eax
jg 0x4242ca
mov dword [ebp - 0xcf8], 1
jmp 0x4242d1
and dword [ebp - 0xcf8], 0
mov eax, dword [ebp - 0xcf8]
mov dword [ebp - 0x708], eax
cmp dword [ebp - 0x708], 0xfff8
je 0x4242f5
mov dword [ebp - 0x710], 1
jmp 0x4242fc
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0xb00]
cmp eax, dword [ebp - 0x710]
je 0x424316
mov dword [ebp - 0xe6c], 1
jmp 0x42431d
and dword [ebp - 0xe6c], 0
mov eax, dword [ebp - 0xe6c]
sub eax, dword [ebp - 0x254]
mov dword [ebp - 0x718], eax
mov eax, dword [ebp - 0x718]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0xb08], eax
jl 0x424355
mov dword [ebp - 0x720], 1
jmp 0x42435c
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x254]
add eax, dword [ebp - 0x720]
sub eax, dword [ebp - 0x254]
mov dword [ebp - 0x1074], eax
lea ecx, [ebp - 0x13b4]
call fcn.00421825
mov dword [ebp - 0x4c], 0xb26bdde0
mov dword [ebp - 0x738], 0xffffffff
push 4
lea ecx, [ebp - 0x13e4]
call fcn.00421789
mov dword [ebp - 0x16c8], 0xfffffffd
mov dword [ebp - 0x16d0], 0xb2b3a3c3
mov dword [ebp - 0x3f0], 0
jmp 0x4243ca
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 4
jge 0x4243ec
push dword [ebp - 0x3f0]
lea ecx, [ebp - 0x13e4]
call fcn.0042182a
mov dword [eax], 0x1eaa473e
jmp 0x4243bd
mov dword [ebp - 0x4c], 0xfffffff6
jmp 0x4243fc
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffe7
jne 0x4248ed
mov dword [ebp - 0x204], 1
mov dword [ebp - 0x468], 0xffffffff
mov dword [ebp - 0x1208], 0x9140de19
mov dword [ebp - 0x16d8], 0x22c08f49
mov dword [ebp - 0x16e0], 0x842c5acc
mov dword [ebp - 0x16e8], 0x5a2c03fd
mov dword [ebp - 0x16f0], 0xfffffffb
push 3
lea ecx, [ebp - 0x1730]
call fcn.00421789
mov dword [ebp - 0x100], 0
jmp 0x424472
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 1
jge 0x42448e
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x280], 0xfffffff7
jmp 0x424465
mov dword [ebp - 0x100], 0
jmp 0x4244a7
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x4244c9
push dword [ebp - 0x100]
lea ecx, [ebp - 0x1730]
call fcn.0042182a
mov dword [eax], 0xa513e67d
jmp 0x42449a
cmp dword [ebp - 0x4c], 0
jne 0x424544
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x280]
cmp dword [ebp - 0x4c], eax
jne 0x42452b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x280], 0x90a3cfce
ja 0x424500
mov dword [ebp - 0xd00], 1
jmp 0x424507
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0xd00]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x280]
jl 0x42452b
mov dword [ebp - 0x728], 1
jmp 0x424532
and dword [ebp - 0x728], 0
cmp dword [ebp - 0x728], 0
jne 0x424544
and dword [ebp - 0xb10], 0
jmp 0x42454e
mov dword [ebp - 0xb10], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x280]
cmp dword [ebp - 0xb10], eax
jne 0x424578
mov eax, 0xeb9e
test eax, eax
je 0x424578
mov dword [ebp - 0x730], 1
jmp 0x42457f
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x730]
sub eax, dword [ebp - 0x4c]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x204], 0x12
jmp 0x4245b3
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0xffffffe6
je 0x4248dd
mov dword [ebp - 0x768], 0xfff8
mov dword [ebp - 0xdfc], 0x707e294b
mov dword [ebp - 0x758], 0x61b8
push 4
lea ecx, [ebp - 0x12b4]
call fcn.00421789
mov dword [ebp - 0xf60], 0x1cd5
mov dword [ebp - 0x778], 0x1c9e
mov dword [ebp - 0xb0], 0
jmp 0x424618
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x424634
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x13cc], 0x7da19ae8
jmp 0x42460b
mov dword [ebp - 0xb0], 0
jmp 0x42464d
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 4
jge 0x42466f
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x12b4]
call fcn.0042182a
mov dword [eax], 0xdfce9586
jmp 0x424640
cmp dword [ebp - 0x768], 0
je 0x42483f
mov dword [ebp - 0xdfc], 0xfd8c6581
cmp dword [ebp - 0xdfc], 0
je 0x4246fd
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x13cc], 0
je 0x4246ab
mov dword [ebp - 0xb18], 1
jmp 0x4246b2
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x738]
cmp eax, dword [ebp - 0xb18]
jge 0x4246d5
mov dword [ebp - 0x740], 1
jmp 0x4246dc
and dword [ebp - 0x740], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x13cc]
cmp dword [ebp - 0x740], eax
jg 0x4246fd
mov dword [ebp - 0xd08], 1
jmp 0x424704
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 0x758]
cmp dword [ebp - 0xd08], eax
jle 0x42471e
mov dword [ebp - 0x748], 1
jmp 0x424725
and dword [ebp - 0x748], 0
cmp dword [ebp - 0x748], 0xd4826422
ja 0x42473d
mov dword [ebp - 0xb20], 1
jmp 0x424744
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0xb20], eax
je 0x42475b
mov dword [ebp - 0x750], 1
jmp 0x424762
and dword [ebp - 0x750], 0
push 0
lea ecx, [ebp - 0x12b4]
call fcn.0042182a
mov ecx, dword [ebp - 0x750]
mov dword [eax], ecx
or eax, 0xffffffff
jne 0x424797
push 0
lea ecx, [ebp - 0x12b4]
call fcn.0042182a
cmp dword [eax], 0
jne 0x424797
and dword [ebp - 0xed4], 0
jmp 0x4247a1
mov dword [ebp - 0xed4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x280]
add eax, dword [ebp - 0xed4]
mov dword [ebp - 0x468], eax
imul eax, dword [ebp - 0x468], 0xd89b
cmp eax, dword [ebp - 0xf60]
jl 0x4247d8
mov dword [ebp - 0xb28], 1
jmp 0x4247df
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0x758]
cmp dword [ebp - 0xb28], eax
jl 0x4247f9
mov dword [ebp - 0x760], 1
jmp 0x424800
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x760], eax
je 0x424817
mov dword [ebp - 0xd10], 1
jmp 0x42481e
and dword [ebp - 0xd10], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x13cc]
cmp dword [ebp - 0xd10], eax
jle 0x42483f
mov dword [ebp - 0x508], 1
jmp 0x424846
and dword [ebp - 0x508], 0
push 2
lea ecx, [ebp - 0x13e4]
call fcn.0042182a
mov ecx, dword [ebp - 0x508]
mov dword [eax], ecx
mov eax, dword [ebp - 0x768]
cmp dword [ebp - 0x508], eax
je 0x424875
mov dword [ebp - 0xb30], 1
jmp 0x42487c
and dword [ebp - 0xb30], 0
cmp dword [ebp - 0xb30], 1
je 0x424891
mov dword [ebp - 0x770], 1
jmp 0x424898
and dword [ebp - 0x770], 0
cmp dword [ebp - 0x770], 0xfffffffd
ja 0x4248ad
mov dword [ebp - 0xe04], 1
jmp 0x4248b4
and dword [ebp - 0xe04], 0
mov eax, dword [ebp - 0xe04]
mov dword [ebp - 0x1208], eax
mov eax, dword [ebp - 0x778]
dec eax
mov dword [ebp - 0x778], eax
lea ecx, [ebp - 0x12b4]
call fcn.00421825
jmp 0x4245a6
lea ecx, [ebp - 0x1730]
call fcn.00421825
jmp 0x4243f5
lea ecx, [ebp - 0x13e4]
call fcn.00421825
movzx eax, byte [0xab1b2c]
test eax, eax
je 0x424916
mov esi, 0x4bb748
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x42d6c7
mov dword [ebp - 0x38], 0x53b26bdd
mov dword [ebp - 0x470], 0xffffffff
mov dword [ebp - 0x38], 0
jmp 0x424937
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
je 0x424c55
push 1
lea ecx, [ebp - 0xec0]
call fcn.00421789
mov dword [ebp - 0x2c8], 0x8f4a8fe2
push 3
lea ecx, [ebp - 0x12cc]
call fcn.00421789
mov dword [ebp - 0xe0], 0
jmp 0x42497e
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x4249a0
push dword [ebp - 0xe0]
lea ecx, [ebp - 0xec0]
call fcn.0042182a
mov dword [eax], 0xfff8
jmp 0x424971
mov dword [ebp - 0xe0], 0
jmp 0x4249b9
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jge 0x4249d8
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x12cc]
call fcn.0042182a
and dword [eax], 0
jmp 0x4249ac
push 0
lea ecx, [ebp - 0xec0]
call fcn.0042182a
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x16f8], eax
mov eax, dword [ebp - 0x38]
neg eax
jne 0x4249fc
push 5
pop eax
test eax, eax
je 0x424a11
mov eax, 0x278f
test eax, eax
je 0x424a11
mov dword [ebp - 0xb38], 1
jmp 0x424a18
and dword [ebp - 0xb38], 0
push 0
lea ecx, [ebp - 0xec0]
call fcn.0042182a
mov ecx, dword [ebp - 0xb38]
cmp ecx, dword [eax]
je 0x424a3b
mov dword [ebp - 0x780], 1
jmp 0x424a42
and dword [ebp - 0x780], 0
imul eax, dword [ebp - 0x780], 0xf23e
test eax, eax
jne 0x424a5f
cmp dword [ebp - 0x38], 0
jne 0x424a5f
and dword [ebp - 0xd18], 0
jmp 0x424a69
mov dword [ebp - 0xd18], 1
push 0
lea ecx, [ebp - 0xec0]
call fcn.0042182a
mov ecx, dword [ebp - 0xd18]
cmp ecx, dword [eax]
jge 0x424a8c
mov dword [ebp - 0x788], 1
jmp 0x424a93
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x788], eax
jne 0x424ae3
mov dword [ebp - 0xf68], 0xef4a0426
push 0
lea ecx, [ebp - 0xec0]
call fcn.0042182a
mov eax, dword [eax]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0xf68], 0
je 0x424ae1
lea ecx, [ebp - 0x12cc]
call fcn.00421825
lea ecx, [ebp - 0xec0]
call fcn.00421825
jmp 0x424930
jmp 0x424aed
mov dword [ebp - 0x470], 0xffffffff
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x1700], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jge 0x424b0d
mov dword [ebp - 0x1114], 1
jmp 0x424b14
and dword [ebp - 0x1114], 0
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x1708], eax
mov eax, 0xef7e2919
cmp eax, 0x944dcd6a
jne 0x424b38
mov dword [ebp - 0xb40], 1
jmp 0x424b3f
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0xb40]
sub eax, dword [ebp - 0x38]
imul eax, eax, 0xda19
test eax, eax
je 0x424b5e
mov dword [ebp - 0x790], 1
jmp 0x424b65
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x790]
cmp eax, dword [ebp - 0x2c8]
jg 0x424b82
mov dword [ebp - 0xe74], 1
jmp 0x424b89
and dword [ebp - 0xe74], 0
push 0
lea ecx, [ebp - 0xec0]
call fcn.0042182a
mov ecx, dword [ebp - 0xe74]
cmp ecx, dword [eax]
jge 0x424bac
mov dword [ebp - 0x798], 1
jmp 0x424bb3
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2c8]
imul eax, dword [ebp - 0x470]
cmp eax, 0xfa48
jl 0x424be4
xor eax, eax
inc eax
je 0x424be4
mov dword [ebp - 0xb48], 1
jmp 0x424beb
and dword [ebp - 0xb48], 0
cmp dword [ebp - 0xb48], 7
jne 0x424c00
mov dword [ebp - 0x7a0], 1
jmp 0x424c07
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x7a0], eax
jne 0x424c1e
mov dword [ebp - 0xd20], 1
jmp 0x424c25
and dword [ebp - 0xd20], 0
push 0
lea ecx, [ebp - 0x12cc]
call fcn.0042182a
mov ecx, dword [ebp - 0xd20]
mov dword [eax], ecx
lea ecx, [ebp - 0x12cc]
call fcn.00421825
lea ecx, [ebp - 0xec0]
call fcn.00421825
jmp 0x424930
mov dword [ebp - 0x1710], 0x4bb748
mov dword [ebp - 0x288], 0x1824a8c6
mov dword [ebp - 0xf70], 0x37b1891f
mov dword [ebp - 0x288], 0xfffffff3
jmp 0x424c8c
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xfffffff1
je 0x424ca3
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0xf70], eax
jmp 0x424c7f
mov byte [ebp - 0x1d1], 0
movzx eax, byte [ebp - 0x1d1]
test eax, eax
je 0x424cbb
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x234], 0
jmp 0x424cde
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 2
jle 0x424d12
mov byte [ebp - 0x163], 0
movzx eax, byte [ebp - 0x163]
test eax, eax
je 0x424d10
push 0
push 0x2037
push 0x213b
push 0x1f33
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
jmp 0x424cd1
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x74], 0x53b26bdd
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0xb50], 0x26fbd10c
mov dword [ebp - 0x111c], 0
mov dword [ebp - 0x340], 0
jmp 0x424d59
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 4
jge 0x424d75
mov eax, dword [ebp - 0x340]
mov dword [ebp + eax*4 - 0x18ac], 0x841b3c69
jmp 0x424d4c
mov dword [ebp - 0x40], 0
jmp 0x424d85
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jg 0x424f55
mov dword [ebp - 0x20c], 0x4392f209
mov dword [ebp - 0x4d8], 1
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x18ac], 0
je 0x424e41
cmp dword [ebp - 0x40], 1
jle 0x424dc6
mov dword [ebp - 0x7a8], 1
jmp 0x424dcd
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x7a8], eax
jge 0x424de4
mov dword [ebp - 0x11c4], 1
jmp 0x424deb
and dword [ebp - 0x11c4], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x181c], eax
mov dword [ebp - 0xb50], 0xdd5d
cmp dword [ebp - 0xb50], 6
jg 0x424e17
push 8
pop eax
test eax, eax
jne 0x424e17
and dword [ebp - 0x7b0], 0
jmp 0x424e21
mov dword [ebp - 0x7b0], 1
mov eax, dword [ebp - 0x20c]
imul eax, dword [ebp - 0x7b0]
cmp eax, 0xa40f
jge 0x424e41
mov dword [ebp - 0xe0c], 1
jmp 0x424e48
and dword [ebp - 0xe0c], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0xe0c]
cmp eax, 0x30f8
je 0x424e65
mov dword [ebp - 0x7b8], 1
jmp 0x424e6c
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x7b8]
sub eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x20c]
cmp eax, dword [ebp - 0x4d8]
je 0x424e95
mov eax, 0xfffa
test eax, eax
jne 0x424e95
and dword [ebp - 0xf78], 0
jmp 0x424e9f
mov dword [ebp - 0xf78], 1
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1824], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x4d8]
cmp dword [ebp + eax*4 - 0x18ac], ecx
jg 0x424ec6
mov dword [ebp - 0xb58], 1
jmp 0x424ecd
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0x4d8]
add eax, dword [ebp - 0xb58]
cmp eax, 0xc28c
jne 0x424eec
mov dword [ebp - 0x7c0], 1
jmp 0x424ef3
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x111c], eax
mov dword [ebp - 0x20c], 3
jmp 0x424f18
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jl 0x424f50
mov byte [ebp - 0x199], 0
movzx eax, byte [ebp - 0x199]
test eax, eax
je 0x424f4e
push 0x10bb
push 0
push 0
push 0x197d
push 0
push 0x8e6
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x424f0b
jmp 0x424d7e
mov dword [ebp - 0x210], 0x8f90a3cf
push 4
lea ecx, [ebp - 0x2f8]
call fcn.00421789
mov dword [ebp - 0x3b8], 0xa1e94870
mov dword [ebp - 0xb68], 2
mov dword [ebp - 0xb8], 0
jmp 0x424f99
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x424fb5
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x11c0], 1
jmp 0x424f8c
mov dword [ebp - 0xb8], 0
jmp 0x424fce
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 4
jge 0x424ff0
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
mov dword [eax], 0xca4f833f
jmp 0x424fc1
push 3
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
mov dword [eax], 2
jmp 0x425029
push 3
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
mov dword [ebp - 0xd28], eax
mov eax, dword [ebp - 0xd28]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xd28]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
cmp dword [eax], 0
jl 0x425074
push 3
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
mov esi, dword [eax]
push 3
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
mov eax, dword [eax]
mov ecx, dword [ebp + esi*4 - 0x11c0]
mov dword [ebp + eax*4 - 0x11c0], ecx
cmp dword [ebp - 0x3b8], 0
je 0x425072
jmp 0x425005
jmp 0x425005
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x11c0], 0
ja 0x425090
mov dword [ebp - 0x7c8], 1
jmp 0x425097
and dword [ebp - 0x7c8], 0
imul esi, dword [ebp - 0x7c8], 0xa08e
push 2
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
cmp esi, dword [eax]
jne 0x4250be
mov dword [ebp - 0xf80], 1
jmp 0x4250c5
and dword [ebp - 0xf80], 0
push 3
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x11c0], 1
jae 0x4250f7
cmp dword [ebp - 0xb68], 0
je 0x4250f7
mov dword [ebp - 0xb60], 1
jmp 0x4250fe
and dword [ebp - 0xb60], 0
mov eax, dword [ebp - 0x3b8]
imul eax, dword [ebp - 0xb60]
add eax, 0x11082d9a
jne 0x42512d
push 3
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
cmp dword [eax], 0
jne 0x42512d
and dword [ebp - 0x7d0], 0
jmp 0x425137
mov dword [ebp - 0x7d0], 1
mov eax, dword [ebp - 0x3b8]
sub eax, dword [ebp - 0x7d0]
cmp eax, 0xdfbc43c
jle 0x425156
mov dword [ebp - 0xeac], 1
jmp 0x42515d
and dword [ebp - 0xeac], 0
push 0
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
mov eax, dword [eax]
cmp eax, dword [ebp - 0xeac]
jne 0x425180
mov dword [ebp - 0x478], 1
jmp 0x425187
and dword [ebp - 0x478], 0
push 3
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
mov ecx, dword [ebp - 0x478]
mov dword [eax], ecx
cmp dword [ebp - 0x478], 0
je 0x425318
mov dword [ebp - 0x2b8], 0xba1d
mov dword [ebp - 0x7f8], 1
mov dword [ebp - 0x121c], 0xfffffff7
cmp dword [ebp - 0x2b8], 0x23782ecc
je 0x4251df
mov dword [ebp - 0x530], 1
jmp 0x4251e6
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x182c], eax
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x2b8], eax
jle 0x42520c
mov dword [ebp - 0x7d8], 1
jmp 0x425213
and dword [ebp - 0x7d8], 0
push 3
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
mov ecx, dword [ebp - 0x530]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11c0]
imul eax, dword [ebp - 0x7d8]
cmp dword [ebp - 0x530], eax
jle 0x425250
mov dword [ebp - 0x7e0], 1
jmp 0x425257
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0xb68]
sub eax, dword [ebp - 0x2b8]
imul eax, dword [ebp - 0x7e0]
cmp eax, dword [ebp - 0x2b8]
jle 0x42527e
mov dword [ebp - 0xd30], 1
jmp 0x425285
and dword [ebp - 0xd30], 0
cmp dword [ebp - 0xd30], 0x1f230b56
jl 0x42529d
mov dword [ebp - 0x7e8], 1
jmp 0x4252a4
and dword [ebp - 0x7e8], 0
cmp dword [ebp - 0x7e8], 0x5ee8
je 0x4252bc
mov dword [ebp - 0xb70], 1
jmp 0x4252c3
and dword [ebp - 0xb70], 0
cmp dword [ebp - 0xb70], 0xffffffff
je 0x4252d8
mov dword [ebp - 0x7f0], 1
jmp 0x4252df
and dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 0x86ae
je 0x4252f7
mov dword [ebp - 0xe14], 1
jmp 0x4252fe
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0xe14]
mov dword [ebp - 0x7f8], eax
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0x121c], eax
jmp 0x42534c
mov dword [ebp - 0xf88], 9
mov dword [ebp - 0xf88], 0xfffffffe
push 3
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
mov esi, eax
push 3
lea ecx, [ebp - 0x2f8]
call fcn.0042182a
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x2f8]
call fcn.00421825
mov dword [ebp - 0x10], 0xa67606e8
mov dword [ebp - 0xa70], 0xdfce9586
mov dword [ebp - 0x44], 0xfffffff8
mov dword [ebp - 0x800], 0x26fbd10c
mov dword [ebp - 0x11d4], 0
mov dword [ebp - 0x348], 0
jmp 0x42539c
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 4
jge 0x4253b8
mov eax, dword [ebp - 0x348]
mov dword [ebp + eax*4 - 0x18cc], 0x841b3c69
jmp 0x42538f
mov dword [ebp - 0x44], 0
jmp 0x4253c8
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x425598
mov dword [ebp - 0x24c], 0x4392f209
mov dword [ebp - 0x480], 1
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x18cc], 0
je 0x425484
cmp dword [ebp - 0x44], 1
jle 0x425409
mov dword [ebp - 0xb78], 1
jmp 0x425410
and dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xb78], eax
jge 0x425427
mov dword [ebp - 0x1124], 1
jmp 0x42542e
and dword [ebp - 0x1124], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1834], eax
mov dword [ebp - 0x800], 0xdd5d
cmp dword [ebp - 0x800], 6
jg 0x42545a
push 8
pop eax
test eax, eax
jne 0x42545a
and dword [ebp - 0xd38], 0
jmp 0x425464
mov dword [ebp - 0xd38], 1
mov eax, dword [ebp - 0x24c]
imul eax, dword [ebp - 0xd38]
cmp eax, 0xa40f
jge 0x425484
mov dword [ebp - 0x808], 1
jmp 0x42548b
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x808]
cmp eax, 0x30f8
je 0x4254a8
mov dword [ebp - 0xb80], 1
jmp 0x4254af
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0xb80]
sub eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x24c]
cmp eax, dword [ebp - 0x480]
je 0x4254d8
mov eax, 0xfffa
test eax, eax
jne 0x4254d8
and dword [ebp - 0xf90], 0
jmp 0x4254e2
mov dword [ebp - 0xf90], 1
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x183c], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x480]
cmp dword [ebp + eax*4 - 0x18cc], ecx
jg 0x425509
mov dword [ebp - 0x810], 1
jmp 0x425510
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x480]
add eax, dword [ebp - 0x810]
cmp eax, 0xc28c
jne 0x42552f
mov dword [ebp - 0xe7c], 1
jmp 0x425536
and dword [ebp - 0xe7c], 0
mov eax, dword [ebp - 0xe7c]
mov dword [ebp - 0x11d4], eax
mov dword [ebp - 0x24c], 3
jmp 0x42555b
mov eax, dword [ebp - 0x24c]
dec eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jl 0x425593
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x425591
push 0x10bb
push 0
push 0
push 0x197d
push 0
push 0x8e6
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x42554e
jmp 0x4253c1
push 1
lea ecx, [ebp - 0x11f0]
call fcn.00421789
mov dword [ebp - 0x410], 5
push 1
lea ecx, [ebp - 0x1740]
call fcn.00421789
push 3
lea ecx, [ebp - 0x1420]
call fcn.00421789
mov dword [ebp - 0x20], 0
jmp 0x4255d9
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x4255ef
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1844], 1
jmp 0x4255d2
mov dword [ebp - 0x20], 0
jmp 0x4255ff
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x42561b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1740]
call fcn.0042182a
mov dword [eax], 0x121f90ef
jmp 0x4255f8
mov dword [ebp - 0x20], 0
jmp 0x42562b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x425647
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1420]
call fcn.0042182a
mov dword [eax], 0x1c946b43
jmp 0x425624
mov dword [ebp - 0x410], 0
jmp 0x425660
cmp dword [ebp - 0x410], 0
jg 0x425714
mov dword [ebp - 0x3c0], 0xfffffff6
mov dword [ebp - 0x188c], 0
mov dword [ebp - 0x818], 0xcd49598a
mov dword [ebp - 0x350], 0
jmp 0x4256a4
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 3
jge 0x4256c0
mov eax, dword [ebp - 0x350]
mov dword [ebp + eax*4 - 0x19ec], 0x534bf8f0
jmp 0x425697
mov dword [ebp - 0x3c0], 0
jmp 0x4256d9
cmp dword [ebp - 0x3c0], 0
jg 0x42570f
mov dword [ebp - 0x1878], 5
mov dword [ebp - 0x1838], 8
mov dword [ebp - 0x180c], 0xfffffffe
mov eax, dword [ebp - 0x818]
inc eax
mov dword [ebp - 0x818], eax
jmp 0x4256cc
jmp 0x425653
push 0
lea ecx, [ebp - 0x1420]
call fcn.0042182a
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0xb88]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xb88]
mov dword [ecx], eax
lea ecx, [ebp - 0x1420]
call fcn.00421825
lea ecx, [ebp - 0x1740]
call fcn.00421825
push 2
lea ecx, [ebp - 0x12c0]
call fcn.00421789
mov dword [ebp - 0x1218], 0xcea5d6c0
mov dword [ebp - 0x1214], 0xcea5d6c0
mov dword [ebp - 0x1210], 0xcea5d6c0
mov dword [ebp - 0x120c], 0xcea5d6c0
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x1218], 0xffffffe5
jmp 0x4257b1
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1218], 0xffffffe6
jle 0x42585b
push 1
lea ecx, [ebp - 0x12e4]
call fcn.00421789
mov dword [ebp - 0x358], 0
jmp 0x4257eb
cmp dword [ebp - 0x358], 1
jge 0x42580d
push dword [ebp - 0x358]
lea ecx, [ebp - 0x12e4]
call fcn.0042182a
mov dword [eax], 0xfffffffb
jmp 0x4257de
push 0
lea ecx, [ebp - 0x12e4]
call fcn.0042182a
cmp dword [eax], 0
je 0x42582c
mov byte [ebp - 0x167], 0
movzx eax, byte [ebp - 0x167]
test eax, eax
je 0x42587b
push 1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0x1454], 0xffffffff
mov dword [ebp - 0x290], 0xd95e17ca
mov dword [ebp - 0x4e0], 0xdfba22e9
mov dword [ebp - 0x828], 0xe3e4
mov dword [ebp - 0x488], 1
mov dword [ebp - 0x1448], 0xfffffff9
mov dword [ebp - 0x1444], 0xfffffff9
mov dword [ebp - 0x1440], 0xfffffff9
mov dword [ebp - 0x143c], 0xfffffff9
mov dword [ebp - 0xf98], 1
mov dword [ebp - 0x17ec], 0xfffffffb
mov dword [ebp - 0x145c], 0x3e73
mov dword [ebp - 0x167c], 0xfffffff9
mov dword [ebp - 0x1464], 0xffffffff
mov dword [ebp - 0x17b4], 0xbab
mov dword [ebp - 0x146c], 0
mov dword [ebp - 0x1684], 0xdcec
mov dword [ebp - 0x1474], 0x497ea9b9
mov dword [ebp - 0x17f4], 0xe48f
mov dword [ebp - 0x147c], 5
mov dword [ebp - 0x168c], 2
mov dword [ebp - 0x1858], 0xcb69acb3
mov dword [ebp - 0x1854], 0xcb69acb3
mov dword [ebp - 0x1850], 0xcb69acb3
mov dword [ebp - 0x184c], 0xcb69acb3
mov dword [ebp - 0x838], 3
push 1
lea ecx, [ebp - 0x1750]
call fcn.00421789
mov dword [ebp - 0xf8], 0
jmp 0x4259a5
cmp dword [ebp - 0xf8], 4
jge 0x4259c1
pop edi
pop esi
mov esp, ebp
pop ebp
ret