Function at 0x4134ea
Capabilities:
Get common file path
Get graphical window text
Get system information on windows
Log keystrokes via polling
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
push 2
pop esi
push esi
lea ecx, [ebp - 0xd4]
call fcn.0040f233
xor eax, eax
push 0xfffffffffffffff7
mov dword [ebp - 0x1c], eax
pop edi
jmp 0x413519
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x2c], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x41350f
mov dword [ebp - 0x1c], eax
jmp 0x413531
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0xf8], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x413524
mov dword [ebp - 0x1c], eax
jmp 0x41354f
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + edx*4], 0x98422518
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x41353c
push 3
mov dword [ebp - 0x2c], eax
pop ebx
jmp 0x4135e8
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], 0xfffffffd
mov ecx, dword [ebp - 8]
cmp dword [ebp - 8], eax
jne 0x41357c
mov edx, eax
jmp 0x41357f
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x2c]
imul ecx, edx
test ecx, ecx
jne 0x413591
cmp dword [ebp - 0xf4], eax
je 0x413597
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
sub edx, ecx
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 8], eax
jne 0x4135b3
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 8], 1
jne 0x4135c6
cmp dword [ebp - 0xf4], eax
je 0x4135c6
xor ecx, ecx
inc ecx
jmp 0x4135c8
mov ecx, eax
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0x2c]
setne dl
sub edx, ecx
mov ecx, dword [ebp - 0xd4]
mov dword [ecx], edx
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xd
je 0x41355f
lea ecx, [ebp - 0xd4]
call fcn.0040f305
push 6
pop edx
mov dword [ebp - 0x68], edx
xor eax, eax
mov dword [ebp - 0x6c], 0xb72b21a3
mov dword [ebp - 0xa4], edi
mov dword [ebp - 8], eax
jmp 0x413624
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x14c], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x413617
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x68], eax
jmp 0x413650
mov byte [ebp - 0x44], al
cmp byte [ebp - 0x44], 0
je 0x41364d
push 0x1e2c
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
inc dword [ebp - 0x68]
cmp dword [ebp - 0x68], esi
jle 0x413634
dec dword [ebp - 0xa4]
mov ecx, 0x2d5e48d3
push dword [ebp - 0x6c]
movdqa xmm0, xmmword [0xa8bb40]
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], ecx
lea ecx, [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x130]
mov dword [ebp - 0xc], 0x52061f6
push ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xb8]
mov dword [ebp - 8], 0x391cb4e7
mov dword [ebp - 0x10], 0x1932e3ca
push eax
movdqu xmmword [ebp - 0x130], xmm0
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
call fcn.004108a1
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
mov dword [ebp - 0x28], 0x1f66
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], eax
jl 0x413796
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x14], 9
cmp dword [ebp - 4], eax
jne 0x413732
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + ecx*4 - 0xa0]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp + ecx*4 - 0xa0]
cmp edx, ecx
setge bl
sub ebx, dword [ebp - 0x10]
add ebx, dword [ebp - 0x14]
jne 0x413732
mov esi, eax
jmp 0x413735
xor esi, esi
inc esi
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
mov edx, dword [ebp + ecx*4 - 0xa0]
mov ecx, dword [ebp - 0xc]
imul edx, esi
mov ecx, dword [ebp + ecx*4 - 0xa0]
cmp ecx, edx
mov ecx, dword [ebp - 0xc]
setg bl
xor edx, edx
mov dword [ebp + ecx*4 - 0xa0], ebx
mov ecx, dword [ebp - 4]
cmp ebx, ecx
setge dl
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
imul edx, ecx
mov ecx, dword [ebp - 0xb8]
mov dword [ecx], edx
mov dword [ebp - 0x14], edx
dec dword [ebp - 0xc]
jns 0x4136ef
push 3
pop ebx
mov dword [ebp - 8], eax
jmp 0x41386c
mov dword [ebp - 0x14], 0xfff8
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], eax
jl 0x41384a
mov byte [ebp - 0x42], al
cmp byte [ebp - 0x42], 0
je 0x4137ce
push 0x1532
push eax
call edi
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
cmp dword [ebp - 0x14], 0xefae07df
jne 0x4137da
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0xa0], 1
je 0x4137f9
cmp dword [ebp - 0x14], eax
jne 0x4137f9
mov edx, eax
jmp 0x4137fc
xor edx, edx
inc edx
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0xa0]
cmp ecx, edx
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 8]
setne bl
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0xa0]
cmp ebx, ecx
mov ecx, dword [ebp - 0x28]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x10]
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0xb8]
setne dl
mov dword [ecx + esi*4], edx
dec dword [ebp - 0xc]
jns 0x4137b1
push 3
pop ebx
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x413869
push 0xfc5
push eax
push 0xea3
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x41379e
lea ecx, [ebp - 0xb8]
call fcn.0040f305
push dword [ebp - 0x6c]
movdqa xmm0, xmmword [0xa8bb90]
lea ecx, [ebp - 0x110]
push ecx
xor eax, eax
mov dword [ebp - 0x90], 0xffffffff
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x8c], 0xffffffff
push ecx
mov dword [ebp - 0x88], 0xffffffff
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x84], 0xffffffff
push eax
movdqu xmmword [ebp - 0x120], xmm0
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
call fcn.004108a1
mov dword [ebp - 0xc], 0xfffffffa
xor eax, eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x14], 0x87c4177f
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jg 0x413a50
mov ebx, dword [ebp - 0x80]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jg 0x4139b0
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], eax
jmp 0x413936
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xc8], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 1
jl 0x413925
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x41394e
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp - 0x80]
mov edi, dword [ebx + ecx*4]
xor ecx, ecx
add edi, dword [ebx + edx*4]
cmp dword [ebx + esi*4], 0x7aced45b
sete cl
xor edx, edx
cmp edi, ecx
mov ecx, dword [ebp - 0x28]
setge dl
sub edx, dword [ebx + ecx*4]
xor ecx, ecx
mov ebx, dword [ebp - 0x14]
cmp edx, dword [ebx + 0xc]
setge cl
cmp ecx, 0xfffb
sbb ecx, ecx
neg ecx
mov dword [ebp - 0xc8], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jle 0x413920
mov ebx, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
jne 0x4139c4
mov ecx, dword [ebp - 0x80]
cmp dword [ecx], 0xf876
je 0x4139c4
mov esi, eax
jmp 0x4139c7
xor esi, esi
inc esi
mov ecx, dword [ebp - 0xc]
xor edx, edx
cmp esi, ecx
setl dl
mov dword [ebp - 0x28], edx
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x80]
mov edi, dword [edx + ecx*4]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 8]
add edi, dword [edx + esi*4]
neg ecx
sbb ecx, ecx
inc ecx
sub edi, ecx
mov ecx, dword [ebp - 8]
imul edx, edi, 0x925d
add ecx, 0xfff7
sub edx, dword [ebx + 4]
xor ebx, ebx
add ecx, edx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
cmp ecx, edx
mov ecx, dword [ebp - 0x80]
setg bl
add ebx, dword [ecx + esi*4]
mov ecx, dword [ebp - 0x10]
sub ebx, 0x874d
add ebx, dword [ecx + 4]
neg ebx
sbb ebx, ebx
add ebx, 0xffff000b
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x413906
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x80]
call fcn.0040f305
mov dword [ebp - 8], 0x8bdfadf6
xor eax, eax
push 2
mov dword [ebp - 0x74], 0x184c506d
mov dword [ebp - 4], eax
pop esi
jmp 0x413a81
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x138], 0xb57f
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x413a70
xor ebx, ebx
inc ebx
mov dword [ebp - 0x74], ebx
cmp dword [ebp - 0x74], eax
jl 0x413aa8
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x413aa3
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
dec dword [ebp - 0x74]
jns 0x413a91
mov dword [ebp - 0x3c], 0x78e60d74
push 8
pop ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], ecx
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0xfc], ecx
mov byte [ebp - 0x3e], al
cmp byte [ebp - 0x3e], 0
je 0x413ae1
push 0x2147
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov byte [ebp - 0x40], al
cmp byte [ebp - 0x40], 0
je 0x413af6
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
xor eax, eax
mov dword [ebp - 0x6c], 0x6de21e5
mov dword [ebp - 0x24], 0xe8cff0ea
mov dword [ebp - 0x60], 0xffd81438
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], eax
jmp 0x413b3c
mov dword [ebp - 4], eax
jmp 0x413b2c
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x110], 0x8f8
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x413b1b
cmp dword [ebp - 0x10c], eax
jne 0x413b42
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe3
je 0x413b16
mov ecx, dword [ebp - 0x24]
mov ecx, ebx
cmp dword [ebp - 0x24], eax
jne 0x413b4e
mov ecx, eax
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x24]
jne 0x413b9c
mov byte [ebp - 0x43], al
cmp byte [ebp - 0x43], 0
je 0x413c0f
push eax
push 0xd0f
push eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x413c0d
mov dword [ebp - 0xc0], 0x4a6b2c4e
lea ecx, [ebp - 0xe0]
push 4
call fcn.0040f233
xor eax, eax
mov dword [ebp - 0xc4], 0x1636717b
mov dword [ebp - 0x58], eax
jmp 0x413bd3
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 4
jl 0x413bc4
mov eax, dword [ebp - 0xc0]
xor ecx, ecx
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
cmp eax, 0xfffffff7
mov eax, dword [ebp - 0xe0]
setne cl
imul ecx, ecx, 0xa8db
mov dword [eax + 4], ecx
mov dword [ebp - 0xc4], ecx
lea ecx, [ebp - 0xe0]
call fcn.0040f305
xor eax, eax
mov dword [ebp - 4], 0xfffffffc
mov dword [ebp - 4], eax
jmp 0x413c28
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x140], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x413c1b
mov byte [ebp - 0x2e], al
cmp byte [ebp - 0x2e], 0
je 0x413c42
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x413c68
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x413c65
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jle 0x413c47
cmp dword [ebp - 0x84], eax
jne 0x413c90
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x90]
sub edx, ecx
cmp edx, dword [ebp - 0x84]
mov edx, eax
jge 0x413c92
mov edx, ebx
mov ecx, 0x2fafd11d
sub ecx, edx
cmp ecx, dword [ebp - 0x88]
jne 0x413cab
mov edx, ebx
cmp dword [ebp - 0x88], eax
jne 0x413cad
mov edx, eax
mov ecx, dword [ebp - 0x84]
add ecx, edx
xor edx, edx
cmp ecx, 5
setle dl
neg edx
je 0x413fd1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x70], 0xe1d925b0
mov dword [ebp - 0x54], 9
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 4], eax
jmp 0x413cf9
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xe8], 0xf9e6a012
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x413ce8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
neg edx
sbb edx, edx
inc edx
add ecx, edx
mov edx, dword [ebp - 0x20]
add edx, ecx
xor ecx, ecx
neg edx
cmp edx, 0xbf5f
setge cl
xor ebx, ebx
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
cmp edx, ecx
mov ecx, dword [ebp - 0x54]
setg bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0x34]
setge dl
xor ebx, ebx
mov dword [ebp - 0x28], edx
imul edx, ecx, 0xcaea
mov ecx, dword [ebp - 0x20]
cmp edx, ecx
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x54]
sete bl
add edx, ebx
xor ebx, ebx
cmp edx, ecx
setle bl
cmp ebx, dword [ebp - 0x20]
jl 0x413d79
cmp dword [ebp - 0x70], eax
jne 0x413d79
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x413d7e
xor ebx, ebx
inc ebx
mov esi, ebx
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, ecx
sete dl
mov dword [ebp - 0x54], edx
mov ecx, dword [ebp - 0x54]
neg ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x20]
jge 0x413da7
cmp dword [ebp - 0x70], eax
jne 0x413da7
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x413da9
mov ecx, ebx
mov edx, dword [ebp - 0x70]
sub edx, ecx
mov ecx, dword [ebp - 0xe8]
sub edx, ecx
mov ecx, dword [ebp - 0x4c]
add ecx, edx
je 0x413e02
mov byte [ebp - 0x46], al
cmp byte [ebp - 0x46], 0
je 0x413dd3
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
mov byte [ebp - 0x3f], al
cmp byte [ebp - 0x3f], 0
je 0x413e64
push eax
push eax
push eax
push 0xdef
push 0x1557
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
jmp 0x413e64
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x18
jge 0x413e64
push 2
pop esi
mov dword [ebp - 0xac], 9
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x4c], 0xfffffff9
jmp 0x413e50
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x20], eax
jmp 0x413e43
dec dword [ebp - 0xac]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x413e3a
cmp dword [ebp - 0x28], eax
jne 0x413e55
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], esi
jl 0x413e2e
dec dword [ebp - 0xa8]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x18
jl 0x413e14
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
jmp 0x413e7a
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x5c], 0x4fd3df75
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x413e6c
mov dword [ebp - 0x5c], 7
jmp 0x413eb9
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], eax
jmp 0x413ea1
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xbc], 0xfffffffb
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x413e90
mov dword [ebp - 0x10], 0xa4f402e3
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xbc], ecx
dec dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0xfffffff1
jge 0x413e88
push 3
mov dword [ebp - 0xc], 0x9a7e1289
pop esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 8], 0xffffffe4
cmp dword [ebp - 8], 0x35
jge 0x413feb
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0x2ad14ca7
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jne 0x413f05
mov ecx, eax
cmp dword [ebp - 0x3c], eax
je 0x413f07
mov ecx, ebx
mov dword [ebp - 0x14], ecx
xor edx, edx
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xffffffff
setg dl
xor ebx, ebx
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
cmp ecx, edx
setle bl
imul ecx, ebx, 0x6e66
cmp ecx, 0xc7e7
je 0x413f39
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x50]
cmp ecx, 5
mov ecx, dword [ebp - 4]
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
setg bl
sub ebx, dword [ebp - 8]
add ebx, dword [ebp - 0xc]
sub ebx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x84]
neg ebx
sbb ebx, ebx
inc ebx
imul ecx, ebx, 0x270b
add edx, ecx
je 0x413f8b
lea edx, [ebp - 0x2f]
mov byte [ebp - 0x2f], al
xor cl, cl
call fcn.00413262
jmp 0x413fbc
mov dword [ebp - 0x50], eax
jmp 0x413fb7
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x3c], eax
jl 0x413fb4
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x413faf
mov edx, 0x3ac1
mov cl, 1
call fcn.00413262
xor eax, eax
dec dword [ebp - 0x3c]
jns 0x413f98
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], esi
jle 0x413f90
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x35
push 0
pop eax
push 1
pop ebx
jl 0x413edd
jmp 0x413fe9
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x413feb
push 0x1dc7
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x64], 0xffffffe2
jmp 0x414033
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x414013
push 0x4fc
push 0xfee
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x414030
push eax
push eax
push eax
push eax
push eax
push eax
push 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor eax, eax
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], 0x1a
jge 0x413ff7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret