Function at 0x4143ff
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], 5
xor edi, edi
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0xb0], ecx
inc edi
mov dword [ebp - 0x10], eax
jmp 0x414436
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x74], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x414428
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x41445e
push 0xdeb
push 0x344
call ebx
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
xor eax, eax
dec dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 0xb8ee41b
mov dword [ebp - 0x30], 0xe022
mov dword [ebp - 0x1c], eax
push 2
mov dword [ebp - 0x28], 0xadfb
mov dword [ebp - 0x10], eax
pop esi
jmp 0x414492
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x58], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x414484
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
neg edx
sbb edx, edx
neg edx
add ecx, edx
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0xa22e974a
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp ecx, edi
setg dl
add edx, 0xad85
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x7ab61b58
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0xcae2fe81
mov dword [ebp - 8], 0xfffffffe
mov dword [ebp - 0x1c], 0xbc1c234a
mov dword [ebp - 0x10], 0xffffffe4
cmp dword [ebp - 0x10], 0xffffffe9
je 0x414567
mov dword [ebp - 0x30], 0xeb905d09
lea ecx, [ebp - 0x100]
push esi
call fcn.0040fd61
mov dword [ebp - 0x18], 0
jmp 0x41453c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0x111738ab
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x414529
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x100]
mov eax, dword [ebp - 0x100]
mov dword [eax + 4], 0xd2e8588d
call fcn.0040fe33
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe9
jne 0x41450d
xor eax, eax
mov ecx, dword [ebp - 4]
inc dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
sub edx, 0xfffffffd
neg edx
sbb edx, edx
add edx, 0x9bb942d8
neg edx
sbb edx, edx
inc edx
dec dword [ebp - 0x14]
cmp ecx, edx
mov ecx, edi
cmovge ecx, eax
mov eax, dword [ebp - 4]
sub eax, 0x71bc7dcd
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
sub eax, ecx
add eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov dword [ebp - 8], 0xfffffff2
cmp dword [ebp - 8], 0x10
jge 0x4148a6
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
push 4
lea ecx, [ebp - 0x170]
call fcn.0040fd61
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x28], 0x4f2887cf
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x28], 0xe1c97412
mov dword [ebp - 0x28], 0xffffffff
push 4
pop edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x28], 0xccc89593
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0x289fff12
mov dword [ebp - 0x28], 0x466e9f08
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0
jmp 0x414647
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x170]
mov dword [eax + ecx*4], 0x4826
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x414634
mov dword [ebp - 4], 0
jmp 0x414666
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1d8], 1
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x414655
mov byte [ebp - 0x21], 0
cmp byte [ebp - 0x21], 0
je 0x41467f
call ebx
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], 0
jl 0x4146f0
mov dword [ebp - 0x28], 0xfffffffb
lea ecx, [ebp - 0x14c]
push 3
call fcn.0040fd61
mov dword [ebp - 0x10], 0
jmp 0x4146bc
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x4146a9
mov byte [ebp - 0x21], 0
cmp byte [ebp - 0x21], 0
je 0x4146dd
push 0x9f4
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
dec dword [ebp - 0x14]
lea ecx, [ebp - 0x14c]
call fcn.0040fe33
dec dword [ebp - 0x1c]
jns 0x41468c
lea ecx, [ebp - 0x170]
call fcn.0040fe33
mov eax, 0xa5d6c05b
mov dword [ebp - 0x2c], 0x951ad386
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
xor eax, eax
mov dword [ebp - 0x8c], eax
jmp 0x414773
mov dword [ebp - 0x18], 0x6f5a9c4c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
jmp 0x41475e
mov dword [ebp - 0x1c], 0x65720b96
mov edx, 0xfc429adb
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
sub edx, ecx
add edx, dword [ebp - 0x84]
mov dword [ebp - 0x1c], edx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe3
jge 0x414735
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x14], ecx
dec dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], 0xfffffff0
jg 0x414726
mov byte [ebp - 9], al
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x1c], 0xd9964974
mov dword [ebp - 0x10], eax
jmp 0x4147a3
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1a4], 0xa7c6dd3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x414792
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x4147c2
push 0x421
push 0x452
call ebx
push eax
call esi
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, 0xb91e
mov ecx, dword [ebp - 0x18]
setge bl
xor edx, edx
cmp ebx, ecx
setg dl
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
add ecx, ecx
jne 0x414809
cmp dword [ebp - 0x18], eax
jne 0x414809
mov ecx, eax
jmp 0x41480c
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1a4], ecx
cmp byte [ebp - 9], 0
je 0x41488d
push 0xfffffffffffffffc
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], 0xf2e5664d
mov dword [ebp - 0x10], ecx
jmp 0x41486c
mov dword [ebp - 0x1c], 0x45db
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x41484f
push 0x421
push 0x452
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
je 0x414864
cmp dword [ebp - 0x10], eax
je 0x414864
xor ecx, ecx
inc ecx
jmp 0x414866
mov ecx, eax
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffa
je 0x41482a
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1c], 0x7e4fc22
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x414893
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x10
jl 0x4145d2
xor edi, edi
push 2
inc edi
pop esi
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [ebp - 4], 0xe0d1
mov dword [ebp - 0x2c], 0x748dc164
mov dword [ebp - 0x30], 0x2f34e401
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x14], 0xfff9
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x10], eax
jmp 0x4148ef
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x200], 0x5eb20068
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x4148de
cmp dword [ebp - 0x18], eax
je 0x41491f
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xfffffff6
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x30]
cmp edx, 0x380a
mov edx, edi
setle cl
dec dword [ebp - 0x1c]
test ecx, ecx
js 0x414921
mov edx, eax
mov ecx, dword [ebp - 0x1fc]
add ecx, edx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], 0xdd3610cb
mov dword [ebp - 4], 0x2db58e46
mov dword [ebp - 8], 0x7ad95e17
mov dword [ebp - 0x2c], 0xff5f6f59
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
jmp 0x414ae9
mov dword [ebp - 0x18], 0xd72b
mov dword [ebp - 0x14], 0x44fa7555
mov dword [ebp - 0x10], eax
jmp 0x414986
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x38], 0xb143e95a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x414978
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 4]
je 0x4149b6
cmp dword [ebp - 0x18], eax
jne 0x414af3
jmp 0x414ae6
mov dword [ebp - 0x1c], 0x8317d239
cmp dword [ebp - 8], eax
jne 0x414af3
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jg 0x414ae6
push esi
lea ecx, [ebp - 0xec]
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x10], eax
jmp 0x4149ff
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xec]
mov dword [ecx + edx*4], 0x208dd2dc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4149ec
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jg 0x414acd
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x38], eax
je 0x414a1b
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x38]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x38]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x38]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp + ecx*4 - 0x38]
mov ecx, dword [ebp - 0xec]
sub esi, dword [ecx]
mov ecx, dword [ebp - 0x1c]
cmp esi, ecx
mov ecx, 0xc65b0b56
sete dl
cmp ecx, edx
mov ecx, dword [ebp - 8]
sbb edx, edx
neg edx
mov dword [ebp + ecx*4 - 0x38], edx
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x414a97
mov ecx, dword [ebp - 0xec]
mov edx, edi
cmp dword [ecx], eax
jne 0x414a99
mov edx, eax
xor ecx, ecx
cmp edx, 0x7a312446
setne cl
xor edx, edx
sub ecx, 0xcc39
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x38]
test ecx, ecx
sete dl
mov dword [ebp - 0x1c], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x414a10
push 2
pop esi
lea ecx, [ebp - 0xec]
call fcn.0040fe33
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x4149d2
xor eax, eax
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff3
jne 0x414965
push esi
lea ecx, [ebp - 0xa8]
call fcn.0040fd61
push dword [ebp - 0x74]
movdqa xmm0, xmmword [0xa97d80]
lea ecx, [ebp - 0x1b4]
push ecx
xor eax, eax
mov dword [ebp - 0x18], 0xfd3df75d
lea ecx, [ebp - 0x1c4]
mov dword [ebp - 0x98], eax
push ecx
push eax
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x94], eax
movdqu xmmword [ebp - 0x1c4], xmm0
mov dword [ebp - 0x90], eax
call fcn.004114f4
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x414b89
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x414b6d
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x98]
mov dword [ecx + edx*4], 0x937a3a11
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x414b5a
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x414b86
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
jg 0x414b4e
lea ecx, [ebp - 0x98]
call fcn.0040fe33
mov dword [ebp - 0x10], 0x622ba394
lea ecx, [ebp - 0x19c]
push esi
call fcn.0040fd61
mov dword [ebp - 0x10], 0xeef20fe6
xor eax, eax
mov dword [ebp - 0x28], 0xad4351cd
mov dword [ebp - 4], eax
jmp 0x414bd5
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x19c]
mov dword [ecx + edx*4], 0x571177e8
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x414bc2
mov dword [ebp - 4], eax
jmp 0x414bf0
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x21c], 3
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x414bdf
mov dword [ebp - 0x10], eax
jmp 0x414c08
mov dword [ebp - 0x1c], 0xffffffff
inc dword [ebp - 0x1c]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x414bfb
lea ecx, [ebp - 0x19c]
call fcn.0040fe33
mov dword [ebp - 0x28], 5
xor eax, eax
mov dword [ebp - 0x20], 0x3fa3c9e4
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], eax
jmp 0x414c41
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1f0], 0x58e469ad
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x414c30
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x414c60
push eax
push 0x15c9
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
inc dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x2135
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0xfffffffc
dec dword [ebp - 0x1c]
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x414c97
push 0x25bb
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x414caf
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xa8]
mov dword [ecx + edx*4], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x414c9c
mov dword [ebp - 0x10], eax
jmp 0x415811
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x1c], 0xfffffff7
push 3
call fcn.0040fd61
push 4
pop ebx
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0xc8]
push ebx
call fcn.0040fd61
mov dword [ebp - 8], 0xda972737
xor eax, eax
mov dword [ebp - 0x2c], 0x320ba2c1
mov dword [ebp - 8], eax
jmp 0x414d0d
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xbc]
mov dword [ecx + edx*4], 0x9ba8
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x414cfa
mov dword [ebp - 8], eax
jmp 0x414d2b
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc8]
mov dword [ecx + edx*4], 0xa9f4f9a0
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x414d18
mov dword [ebp - 8], eax
jmp 0x414d46
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1e8], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x414d35
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
neg ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
add ecx, 0xffffd8d8
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp edx, ecx
setg bl
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jg 0x414e69
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xac], 5
mov dword [ebp - 8], esi
cmp dword [ebp - 8], eax
jl 0x414e59
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
inc edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0xc8]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
add edx, dword [ecx + esi*4]
mov ecx, dword [ebp - 0xbc]
cmp edx, 0xffffffff
mov esi, dword [ebp - 0x2c]
setg bl
xor edx, edx
add ebx, dword [ecx + edi*4]
mov ecx, dword [ebp - 8]
imul ecx, ebx
cmp ecx, 0xffff
mov ecx, dword [ebp - 0xbc]
setne dl
sub edx, dword [ecx + esi*4]
cmp edx, dword [ebp - 0x18]
je 0x414e1b
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x14], ecx
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x14]
cmp dword [esi + edi*4], ecx
setge dl
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
add ecx, dword [edx + 4]
mov dword [ebp - 0x1e4], ecx
mov ecx, dword [ebp - 8]
dec dword [ebp - 8]
jns 0x414dc1
push 2
pop esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jle 0x414d98
xor edi, edi
inc edi
lea ecx, [ebp - 0xc8]
call fcn.0040fe33
lea ecx, [ebp - 0xbc]
call fcn.0040fe33
mov dword [ebp - 0x18], 0x7e17f75
lea ecx, [ebp - 0x118]
push edi
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x18], eax
jmp 0x414eb3
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x118]
mov dword [ecx + edx*4], 0x1c7b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x414ea0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
jmp 0x414ef7
mov dword [ebp - 4], 0xd2086bd0
mov dword [ebp - 4], eax
jmp 0x414ede
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x118]
mov ecx, dword [edx + ecx*4]
mov dword [edx + esi*4], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
jle 0x414ecc
mov ecx, dword [ebp - 0x18]
mov ecx, edi
add ecx, 0xfffff4f6
mov dword [ebp - 4], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x13
jg 0x414ec0
lea ecx, [ebp - 0x118]
call fcn.0040fe33
xor eax, eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x415583
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x130]
push 4
call fcn.0040fd61
mov dword [ebp - 8], 0
jmp 0x414f45
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x414f32
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x130]
mov dword [eax + 4], ecx
mov dword [ebp - 4], 0
jmp 0x414f7c
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x414f79
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jle 0x414f60
lea ecx, [ebp - 0x130]
call fcn.0040fe33
mov dword [ebp - 0x1c], 0x1da622a1
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x20], 0xfba2522a
mov dword [ebp - 0x20], 0xf5a260df
mov dword [ebp - 8], eax
jmp 0x414fcb
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x190], 9
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x414fba
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov ecx, dword [ebp - 4]
push 0xfffffffffffffff7
pop edx
sub edx, ecx
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
setge bl
mov dword [ebp - 0x18c], ebx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
imul edx, ebx
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 0x1c]
setg bl
xor edx, edx
cmp ebx, ecx
setg dl
cmp edx, dword [ebp - 0x14]
jle 0x415012
mov edx, edi
cmp dword [ebp - 4], eax
jne 0x415014
mov edx, eax
mov ecx, dword [ebp - 4]
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setne bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ebx, ebx
cmp edx, 0x8bff9cf0
setle bl
xor edx, edx
imul ebx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
sub ebx, 0xdec9
cmp ebx, ecx
setl dl
xor ebx, ebx
imul edx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setne bl
xor edx, edx
cmp ecx, ebx
setl dl
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], 0x1a049fe3
mov dword [ebp - 0x14], eax
jmp 0x41507c
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x78], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x41506e
mov dword [ebp - 0x14], eax
jmp 0x4150ca
mov dword [ebp - 4], edi
mov dword [ebp - 4], eax
jmp 0x4150c2
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4150b1
push 0x11ee
push eax
push 0x26ab
push 0x1572
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*4 - 0x78]
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x78], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], eax
jle 0x41508e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xd
jle 0x415086
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx + edx*4], eax
jne 0x41558c
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x415580
mov dword [ebp - 4], 0x3644
mov dword [ebp - 8], 0x1b713623
mov dword [ebp - 0x14], 0x806aa1c3
mov dword [ebp - 0x14], 0x18ebdb8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], eax
jmp 0x415126
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x22c], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x415119
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add esi, ecx
mov ecx, dword [ebp - 4]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setg dl
imul edx, dword [ebp - 4]
cmp edx, 6
je 0x415157
mov edx, eax
cmp dword [ebp - 8], eax
je 0x415159
mov edx, edi
mov ecx, dword [ebp - 4]
xor ebx, ebx
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
imul edx, edx, 0xe4bf
cmp edx, ecx
setle bl
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], 0x34e401d9
cmp dword [ebp - 0x14], eax
je 0x4151fb
mov dword [ebp - 0x20], 0xffffffff
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x20], 0xfffffffe
push 3
mov dword [ebp - 0x20], 0x3f6d1d89
pop esi
mov dword [ebp - 0x20], 0x31137833
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xeb4e5227
push esi
call fcn.0040fd61
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
jmp 0x4151e6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x188]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x4151d3
dec dword [ebp - 4]
lea ecx, [ebp - 0x188]
call fcn.0040fe33
jmp 0x415219
mov dword [ebp - 0x20], 0xfffffff6
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x415213
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop esi
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x64]
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 8], eax
jmp 0x41523d
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x70], 0x204e2db5
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x41522f
mov dword [ebp - 8], eax
jmp 0x415257
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x64]
mov dword [ecx + edx*4], 0x9e57ad95
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x415247
mov dword [ebp - 8], eax
jmp 0x415272
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x158], 0x6b933888
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x415261
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x415289
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
mov ecx, dword [ebp - 0x64]
mov dword [ecx], ebx
mov ecx, dword [ecx]
mov ecx, dword [ebp + ecx*4 - 0x70]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
cmp dword [ebp + ecx*4 - 0x70], eax
je 0x4152b9
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
mov ecx, dword [ebp + ecx*4 - 0x70]
cmp dword [ebp - 0x6c], ebx
ja 0x4152b0
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
mov ecx, dword [ebp + ecx*4 - 0x70]
mov ecx, dword [ebp - 0x64]
xor ebx, ebx
mov ecx, dword [ecx]
mov ecx, dword [ebp + ecx*4 - 0x70]
test ecx, ecx
mov ecx, dword [ebp - 0x64]
setne bl
xor edx, edx
mov ecx, dword [ecx]
mov ecx, dword [ebp + ecx*4 - 0x70]
cmp ebx, ecx
setle dl
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x154], 0xffffffff
cmp dword [ebp - 0x154], eax
jne 0x4152f8
mov ecx, dword [ebp - 0x64]
push 2
pop ebx
dec dword [ecx]
jns 0x41528e
lea ecx, [ebp - 0x64]
call fcn.0040fe33
mov dword [ebp - 8], 0x8b15b45b
lea ecx, [ebp - 0x10c]
push edi
call fcn.0040fd61
mov dword [ebp - 0x20], edi
xor eax, eax
mov dword [ebp - 0x20], 0xf0b101aa
mov dword [ebp - 0x20], 0xe12aa53f
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x20], 0x62b50098
mov dword [ebp - 4], eax
jmp 0x41534c
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10c]
mov dword [ecx + edx*4], 0x7e2799ac
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x415339
mov dword [ebp - 4], eax
jmp 0x415367
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x20c], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x415356
mov ecx, dword [ebp - 0x10c]
mov dword [ecx], eax
lea ecx, [ebp - 0x10c]
call fcn.0040fe33
push dword [ebp - 0x74]
movdqa xmm0, xmmword [0xa97e00]
lea ecx, [ebp - 0x1a4]
push ecx
xor eax, eax
lea ecx, [ebp - 0x1b4]
push ecx
push eax
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0xd4], eax
movdqu xmmword [ebp - 0x1b4], xmm0
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
call fcn.004114f4
mov dword [ebp - 0x14], 0xa8e97eed
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x20], 0x891c5534
push esi
call fcn.0040fd61
mov dword [ebp - 0x20], 0x88e1
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
jmp 0x415402
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x164]
mov dword [ecx + edx*4], 0xe6f7fbf2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x4153ef
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x41542e
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x415429
push eax
push 0x827
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x41540f
inc dword [ebp - 4]
lea ecx, [ebp - 0x164]
call fcn.0040fe33
lea ecx, [ebp - 0xd4]
call fcn.0040fe33
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x41545c
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x7c], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x41544e
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 4], 0xe008
mov dword [ebp - 0x20], 0x28405cef
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x415499
push 0x20
push 0x234a
push 0x2525
call dword [sym.imp.KERNEL32.dll_HeapCreate]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x4154b3
mov edx, edi
cmp dword [ebp - 0x14], edi
je 0x4154a7
mov edx, eax
mov ecx, dword [ebp - 0x14]
add ecx, edx
mov edx, eax
mov dword [ebp - 0x20], ecx
je 0x4154b5
mov edx, edi
xor ecx, ecx
cmp edx, 0xfffffff7
setle cl
xor ebx, ebx
cmp ecx, edi
mov ecx, dword [ebp - 4]
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 4]
setg dl
xor ebx, ebx
cmp edx, 0xb44cf59
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 4]
setle dl
mov dword [ebp - 0x20], edx
xor edx, edx
cmp dword [ebp - 0x20], ecx
setge dl
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xa8]
mov esi, dword [ebp - 0x1c]
imul edx, dword [ecx]
mov ecx, dword [ebp - 0x7c]
add esi, edx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov ecx, dword [ebp - 0x18]
setge dl
imul ecx, edx
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xffffffff
mov ecx, dword [ebp - 0x18]
setl dl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0xa41b
mov ecx, dword [ebp - 0xa8]
setg dl
imul edx, dword [ecx]
test edx, edx
je 0x41555c
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x7c]
xor ebx, ebx
mov ecx, dword [ebp - 8]
cmp edx, ecx
setge bl
cmp dword [ebp - 0x28], ebx
jle 0x415571
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edi
dec dword [ebp - 0x1c]
jns 0x4150ee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x414f19
mov byte [ebp - 9], al
mov dword [ebp - 8], 0x643cdf98
mov dword [ebp - 0x14], 0xcc9df78a
mov dword [ebp - 0x1c], 0x73394210
mov dword [ebp - 0x20], 3
mov dword [ebp - 4], eax
jmp 0x4155be
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x50], 0xc93b4e1
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x4155b0
mov dword [ebp - 4], eax
jmp 0x4155d7
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x40], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x4155c9
mov dword [ebp - 8], eax
jmp 0x4156f8
mov dword [ebp - 0x18], 0x2b56095d
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
cmp ecx, dword [ebp - 0x50]
je 0x415625
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 0x44]
imul esi, ecx, 0xc0bf
mov ecx, dword [ebp - 0x4c]
sub esi, ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
cmp esi, ecx
setge dl
dec edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], eax
jmp 0x4156eb
mov dword [ebp - 0x1c], 0x325cf162
push 5
pop ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
push 0
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
sub edx, ecx
pop ecx
setns cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 8]
test ecx, ecx
je 0x4156a1
mov edx, edi
cmp dword [ebp - 8], eax
jne 0x4156a3
mov edx, eax
xor ecx, ecx
cmp edx, 0x8477
setg cl
xor edx, edx
cmp ecx, 0x457a23a3
mov ecx, dword [ebp - 8]
setge dl
xor ebx, ebx
cmp edx, 0xb4ff
setl bl
xor edx, edx
cmp ebx, ecx
setl dl
cmp edi, edx
sbb ecx, ecx
add ecx, 0x128c
mov dword [ebp - 0x138], ecx
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x50], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x415650
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jle 0x4155e5
cmp dword [ebp - 0x40], eax
je 0x415758
mov edx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0x44]
neg edx
mov esi, dword [ebp - 0x40]
cmp edx, ecx
setne bl
sub esi, dword [ebp - 0x40]
mov ecx, dword [ebp - 8]
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x40]
sete dl
xor ebx, ebx
cmp esi, edx
setge bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x14]
setne dl
sub edx, ecx
add edx, dword [ebp - 0x3c]
sub edx, 0x86e0daee
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp ecx, edx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x14]
mov ecx, edi
jle 0x41575a
mov ecx, eax
mov edx, 0xa760f2f4
cmp edx, ecx
push 2
sbb ecx, ecx
xor ebx, ebx
neg ecx
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 8]
cmp ecx, edx
mov ecx, dword [ebp - 0x3c]
setg bl
xor edx, edx
cmp ebx, ecx
pop esi
setl dl
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x1c]
sub edx, ecx
mov dword [ebp - 0x20], edx
cmp byte [ebp - 9], 0
je 0x41580e
push esi
lea ecx, [ebp - 0x124]
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 0x20], 0xce57bf5c
mov dword [ebp - 0x1c], eax
jmp 0x4157bf
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x124]
mov dword [ecx + edx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x4157b0
mov ecx, dword [ebp - 0x124]
mov edx, 0xc0ae9714
mov dword [ecx], edx
mov dword [ebp - 0x20], edx
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x4157f9
push eax
push 0x23a7
push eax
push 0x9d9
push 0x1ca
push eax
push 0x1ea9
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea ecx, [ebp - 0x124]
call fcn.0040fe33
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x414cbc
lea ecx, [ebp - 0xa8]
call fcn.0040fe33
mov dword [ebp - 8], 0xb9f9b31
xor eax, eax
mov dword [ebp - 0x28], 0x85ffff32
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0x975a1448
mov dword [ebp - 0x28], 0x2cac2457
mov dword [ebp - 0x20], 0xbdbb389e
mov dword [ebp - 8], eax
jmp 0x415a6b
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0xd2c643d4
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 4], eax
jmp 0x415883
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xf4], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x415876
mov dword [ebp - 4], eax
jmp 0x41589e
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x1d0], 0xc86797b6
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x41588d
mov dword [ebp - 0x10], 0xffffffe3
cmp dword [ebp - 0x10], 0xfffffff5
jg 0x415a68
push esi
lea ecx, [ebp - 0xe0]
call fcn.0040fd61
mov dword [ebp - 0x18], 8
xor eax, eax
mov dword [ebp - 0x1c], 0xea311c3f
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], 0xfff9
mov dword [ebp - 4], eax
jmp 0x4158f3
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xe0]
mov dword [ecx + edx*4], 0xf6dd
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x4158e0
mov dword [ebp - 4], eax
jmp 0x41590a
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x17c], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x4158fd
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x4159bd
mov dword [ebp - 0x30], 0xffff
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edi
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x52a42bbd
setl cl
cmp ecx, 0xfffffffa
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
sub edx, ecx
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov ecx, dword [ebp - 0xe0]
setle bl
xor edx, edx
cmp ebx, 0xa3205f5
setne dl
add edx, dword [ecx + esi*4]
mov dword [ebp - 4], edx
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 8]
cmp ecx, edi
setl dl
mov dword [ebp - 0x28], edx
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4159b1
push eax
push eax
push 0x22fe
push 0x1731
push eax
call dword [sym.imp.USER32.dll_ModifyMenuW]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x41591c
push 2
pop esi
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
dec dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xf4]
cmp edx, ecx
mov ecx, dword [ebp - 8]
setg bl
xor edx, edx
cmp ebx, 0x1cd4
setge dl
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 0xe0]
setne bl
xor edx, edx
cmp ebx, dword [ecx]
setg dl
xor ebx, ebx
mov dword [ebp - 0x1c8], edx
mov ecx, dword [ebp - 0x174]
mov edx, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0xf4]
cmp ecx, edx
mov ecx, dword [ebp - 0x1c]
setne bl
xor edx, edx
cmp ebx, ecx
setge dl
cmp edx, 0xdf100f83
sbb ecx, ecx
neg ecx
add ecx, 0x6cdf50b9
jne 0x415a41
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x415a43
mov ecx, edi
xor eax, eax
cmp ecx, 9
lea ecx, [ebp - 0xe0]
setl al
mov dword [ebp - 0x28], eax
call fcn.0040fe33
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff5
jle 0x4158b5
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 6
jg 0x415859
mov edx, dword [ebp - 0xb0]
mov dword [edx], eax
cmp dword [edx], 4
jge 0x415a9a
mov esi, dword [ebp - 0x9c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [edx]
cmp dword [edx], 4
jl 0x415a88
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret