Function at 0x4198f4
Capabilities:
Allocate thread local storage
Check os version
Create pipe
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
movdqa xmm0, xmmword [0xaa48e0]
xor eax, eax
mov dword [ebp - 0x14], ecx
push ebx
push esi
push edi
push dword [ebp - 0x20]
test dl, dl
je 0x41b146
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x78], eax
push ecx
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x74], eax
push ecx
push eax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x70], eax
movdqu xmmword [ebp - 0x264], xmm0
call fcn.00414b1a
push 3
mov dword [ebp - 0x10], 0x184c506d
xor eax, eax
pop esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], esi
push 1
pop edi
cmp dword [ebp - 0x10], eax
jl 0x4199be
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x18], eax
jmp 0x4199b4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x78]
cmp dword [edx + ecx*4], eax
jne 0x419979
cmp dword [edx + 0xc], 0xffffffff
mov ebx, eax
jge 0x41997b
mov ebx, edi
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ebx, ecx
setg dl
cmp edx, 0x8659
je 0x41999a
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x78]
cmp dword [ecx + edx*4], eax
mov ecx, eax
je 0x41999c
mov ecx, edi
mov dword [ebp - 0x24], ecx
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4199b1
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x419966
dec dword [ebp - 0x10]
jns 0x41995a
lea ecx, [ebp - 0x78]
call fcn.004134bd
mov dword [ebp - 8], edi
lea ecx, [ebp - 0x9c]
push esi
call fcn.004133eb
mov dword [ebp - 0x1c], 0xd7d2
lea ecx, [ebp - 0x1c4]
mov dword [ebp - 0x18], 0xfffffffe
push edi
call fcn.004133eb
mov dword [ebp - 0x18], 0x21c760fc
xor eax, eax
mov dword [ebp - 0x18], 0xd777
mov dword [ebp - 0x14], eax
jmp 0x419a17
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + edx*4], 0x5934215e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x419a04
mov dword [ebp - 0x14], eax
jmp 0x419a32
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xe0], 0x69376522
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x419a21
mov dword [ebp - 0x14], eax
jmp 0x419a50
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c4]
mov dword [ecx + edx*4], 0xae5685e9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x419a3d
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x9c]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ecx]
neg edx
sbb edx, edx
inc edx
dec edx
je 0x419a7a
mov ebx, edi
cmp dword [ebp - 0x1c], eax
jne 0x419a7c
mov ebx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov edx, dword [ebp - 0x9c]
cmp ebx, eax
setne cl
xor eax, eax
add ecx, dword [edx + 8]
neg ecx
cmp ecx, 0xfffffffa
mov dword [ebp - 0xe0], ecx
setle al
neg eax
cmp eax, dword [edx + 8]
jl 0x419aac
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
xor edx, edx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 0x1c4]
setge dl
sub edx, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x18], edx
xor edx, edx
mov eax, dword [ebp - 0x18]
sub eax, ecx
cmp eax, ecx
mov eax, dword [ebp - 0x9c]
setl dl
xor ecx, ecx
mov dword [ebp - 0x18], edx
mov edx, dword [eax]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setne cl
imul ecx, edx
imul eax, ecx, 0x6ea1
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x9c]
setne cl
sub ecx, dword [eax + 4]
mov dword [eax], ecx
lea ecx, [ebp - 0x1c4]
call fcn.004134bd
lea ecx, [ebp - 0x9c]
call fcn.004134bd
push 2
pop ebx
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x104]
push ebx
call fcn.004133eb
mov dword [ebp - 0x14], 0x862f
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x1c], 0x5300ce3
mov dword [ebp - 0x24], 0xe26b5cfd
mov dword [ebp - 0x28], 0x5c7e4ddb
mov dword [ebp - 0x30], 0x255bb5fb
mov dword [ebp - 0x20], 0x1b09c821
mov dword [ebp - 0x20], 0x2da3bb1d
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x38], 0xfffffffb
push esi
call fcn.004133eb
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x10], 0
jmp 0x419ba1
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x170]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x419b8e
inc dword [ebp - 0x14]
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0x3a
jg 0x419d28
mov dword [ebp - 4], 0x70ade21
lea ecx, [ebp - 0x200]
push esi
call fcn.004133eb
push edi
lea ecx, [ebp - 0x1e8]
call fcn.004133eb
mov dword [ebp - 8], 0xe219
xor eax, eax
mov dword [ebp - 0x10], 0xc710
mov dword [ebp - 4], eax
jmp 0x419c01
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x200]
mov dword [ecx + edx*4], 0x367f
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x419bee
mov dword [ebp - 4], eax
jmp 0x419c1e
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1e8]
mov dword [ecx + edx*4], 0x21b78cd9
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x419c0b
mov dword [ebp - 4], 0xfffffff9
jmp 0x419c92
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x419c8f
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x419c5c
push 0x167e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x1c], eax
je 0x419c7d
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x200]
cmp dword [ecx + edx*4], eax
mov edx, eax
je 0x419c7f
mov edx, edi
xor ecx, ecx
cmp edx, 0xfffffffd
setl cl
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x10]
jns 0x419c37
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
je 0x419c2c
dec dword [ebp - 8]
je 0x419cae
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, esi
setle dl
cmp edx, dword [ebp - 0x38]
jl 0x419cae
mov eax, edi
mov ecx, dword [ebp - 0x30]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x1e8]
setge cl
mov dword [ebp - 0x10], ecx
mov esi, dword [eax]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
dec eax
neg eax
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x170]
setge cl
xor edx, edx
sub ecx, esi
cmp ecx, edi
lea ecx, [ebp - 0x1e8]
setl dl
add edx, esi
mov dword [eax], edx
call fcn.004134bd
lea ecx, [ebp - 0x200]
call fcn.004134bd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x3a
push 3
pop esi
jle 0x419bba
lea ecx, [ebp - 0x170]
call fcn.004134bd
mov dword [ebp - 0x10], 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0x90ac204e
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x30], 0x584e
mov dword [ebp - 0x28], 0x3f04e266
mov dword [ebp - 4], 0x13
cmp dword [ebp - 4], 0xffffffe9
jg 0x419e4a
mov dword [ebp - 8], 0xf390197f
mov dword [ebp - 0x14], eax
jmp 0x419d7f
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x40], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x419d71
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x419e42
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], eax
jmp 0x419e30
mov dword [ebp - 0x28], 0x2b90f998
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x419dcf
push 0x1be
push 0x1d1f
push 0x521
push 0xa39
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
xor eax, eax
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x40]
cmp ecx, 0x1e01
mov edx, dword [ebp - 0x14]
setg bl
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, ebx
setge cl
xor ebx, ebx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + ecx*4 - 0x40]
mov ecx, dword [ebp - 4]
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setle bl
xor edx, edx
add ebx, 0x8f01
cmp ebx, 0xfffffff7
setge dl
add edx, dword [ebp + ecx*4 - 0x40]
sub edx, 0xdd2cc910
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x28], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x419da2
dec dword [ebp - 8]
jns 0x419d90
dec dword [ebp - 4]
jmp 0x419d5b
cmp dword [ebp - 4], eax
jne 0x419e5d
mov ecx, 0x1ac8
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
cmp ecx, edx
mov ecx, dword [ebp - 0x30]
setne bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 0xccdf
mov dword [ebp - 8], eax
jmp 0x419eb4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x104]
mov dword [ecx + edx*4], 0xd69f4288
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x419ea1
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x20]
movdqa xmm0, xmmword [str._t_t_t_t]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x264]
push ecx
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x110], eax
push ecx
push eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x10c], eax
movdqu xmmword [ebp - 0x274], xmm0
mov dword [ebp - 0x108], eax
call fcn.00414b1a
mov dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 0x1b8]
mov dword [ebp - 0x28], edi
push esi
call fcn.004133eb
mov dword [ebp - 8], 0
jmp 0x419f31
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1b8]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x419f1e
mov dword [ebp - 8], esi
cmp dword [ebp - 8], 0
jl 0x419f52
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1b8]
mov dword [eax], ecx
dec dword [ebp - 8]
jns 0x419f3f
lea ecx, [ebp - 0x1b8]
call fcn.004134bd
lea ecx, [ebp - 0x110]
call fcn.004134bd
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jg 0x41aaee
jmp 0x419f7a
xor eax, eax
mov dword [ebp - 4], 0x5bf2d3f5
mov dword [ebp - 8], eax
jmp 0x419f97
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x134], 0x76eea530
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x419f86
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
neg edx
sbb edx, edx
xor ebx, ebx
add edx, 2
mov dword [ebp - 0x134], edx
mov ecx, dword [ebp - 4]
cmp edx, ecx
mov ecx, dword [ebp - 4]
setle bl
xor edx, edx
cmp ebx, ecx
setl dl
sub edx, 0x1fad
sub edx, dword [ebp - 4]
neg edx
sbb edx, edx
inc edx
sub edx, 0xcb55
je 0x419fe4
mov ecx, edi
cmp dword [ebp - 0x134], eax
jne 0x419fe6
mov ecx, eax
cmp ecx, dword [ebp - 4]
jge 0x41a09d
push dword [ebp - 0x20]
movdqa xmm0, xmmword [0xaa48d0]
lea ecx, [ebp - 0x274]
push ecx
lea ecx, [ebp - 0x284]
mov dword [ebp - 0xb4], eax
push ecx
push eax
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xb0], eax
movdqu xmmword [ebp - 0x284], xmm0
mov dword [ebp - 0xac], eax
call fcn.00414b1a
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x41a08b
mov dword [ebp - 0x10], 0x6eab3cf8
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], eax
jl 0x41a088
mov ebx, dword [ebp - 0xb4]
mov dword [ebp - 0x1c], 0x243e5ec3
mov dword [ebp - 8], eax
jmp 0x41a064
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x60], 0xfffffff8
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x41a056
mov ecx, dword [ebp - 0x60]
xor edx, edx
cmp ecx, 0x7128
setg dl
add edx, dword [ebx + 4]
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x10]
jns 0x41a04a
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
je 0x41a035
lea ecx, [ebp - 0xb4]
call fcn.004134bd
jmp 0x41a0ae
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x41a0b0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x41a0c3
push eax
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push edi
lea ecx, [ebp - 0x84]
call fcn.004133eb
mov dword [ebp - 0x1c], 0x3818264d
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x1c], 0x1b5f7a0d
mov dword [ebp - 8], eax
jmp 0x41a0fc
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x2c8], 0x5c96dd1e
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x41a0eb
mov dword [ebp - 0x10], eax
jmp 0x41a12b
mov dword [ebp - 0x20], edi
mov dword [ebp - 8], eax
jmp 0x41a11f
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x2bc], 7
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x41a10e
inc dword [ebp - 0x1c]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x41a106
mov dword [ebp - 8], eax
jmp 0x41a145
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x84]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x41a136
mov dword [ebp - 0x10], 0xa860
lea ecx, [ebp - 0xf8]
mov dword [ebp - 4], 5
push 4
call fcn.004133eb
mov dword [ebp - 0x28], 0xfaab39e
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 8], 0x34a938f7
mov dword [ebp - 0x30], 0x8bee6da
mov dword [ebp - 8], eax
jmp 0x41a197
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xf8]
mov dword [ecx + edx*4], 0xaab72b21
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x41a184
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xf8]
mov dword [ebp - 4], 0x85c9e53
cmp dword [ecx + 8], 0xd8bc
jg 0x41a1c5
cmp dword [ebp - 0x28], eax
je 0x41a1c5
mov esi, edi
cmp dword [ecx + 8], eax
jne 0x41a1c7
mov esi, eax
mov ecx, dword [ebp - 0xf8]
xor edx, edx
cmp esi, dword [ecx + 0xc]
setg dl
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], 0xdf860956
cmp dword [ebp - 8], eax
je 0x41a1ed
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xf8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
call fcn.004134bd
mov edx, dword [ebp - 0x18]
xor eax, eax
mov ecx, dword [ebp - 0x104]
cmp dword [ecx + edx*4], eax
jne 0x41aae3
mov dword [ebp - 4], 0x9ae77ab3
mov dword [ebp - 0x14], 0x11f3813b
mov dword [ebp - 0x10], 0xea4c5706
mov dword [ebp - 8], eax
jmp 0x41a246
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x34], 0x80c3414b
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x41a238
mov ecx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x34]
test ecx, ecx
mov dword [ebp - 0x34], ecx
setne dl
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edx
jl 0x41a274
cmp dword [ebp - 4], eax
je 0x41a26e
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov ecx, dword [ebp - 0x10]
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x10]
setle dl
cmp edx, 7
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setne dl
cmp edx, dword [ebp - 0x10]
jge 0x41a33c
mov dword [ebp - 0x10], 0xbf5b
push 3
mov dword [ebp - 8], edi
pop esi
mov dword [ebp - 4], esi
cmp dword [ebp - 4], 7
je 0x41a31b
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x34]
jg 0x41a2d9
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 8]
sub esi, ecx
mov ecx, dword [ebp - 0x14]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, esi
setl dl
mov dword [ebp - 0x34], edx
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x41a30f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor eax, eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 7
jne 0x41a2c1
push 3
pop esi
mov eax, dword [ebp - 0x84]
mov dword [eax], edi
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xec]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 4], eax
jmp 0x41a3ad
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x41a318
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x41a355
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x41a390
mov dword [ebp - 4], eax
jmp 0x41a388
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 8], eax
jmp 0x41a379
mov edx, dword [ebp + ecx*4 - 0x34]
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x34], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
jle 0x41a36b
mov ecx, dword [ebp + ecx*4 - 0x34]
inc dword [ebp - 4]
cmp dword [ebp - 4], eax
jle 0x41a35f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x41a35a
inc dword [ebp - 0x10]
jmp 0x41a33f
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xec]
mov dword [ecx + edx*4], 0xfffffffc
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x41a39a
mov dword [ebp - 4], eax
jmp 0x41a3c8
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x21c], 0xfffffff8
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x41a3b7
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x41a3de
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xec]
mov dword [ecx], 0xffffffe6
mov dword [ebp - 0x10], 0x6210
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], eax
jmp 0x41a447
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], eax
jl 0x41a438
mov dword [ebp - 8], eax
mov dword [ebp - 8], eax
jmp 0x41a42e
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x41a42b
mov ecx, dword [ebp - 0x10]
cmp dword [ebp + ecx*4 - 0x21c], eax
jne 0x41a42b
dec dword [ebp - 0x14]
jns 0x41a41a
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x41a40f
dec dword [ebp - 4]
jns 0x41a407
mov ecx, dword [ebp - 0x10]
cmp dword [ebp + ecx*4 - 0x21c], eax
jne 0x41a44c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x41a3ff
mov ecx, dword [ebp - 0xec]
inc dword [ecx]
cmp dword [ecx], 0xb
jl 0x41a3ea
lea ecx, [ebp - 0xec]
call fcn.004134bd
mov dword [ebp - 0x14], 0xe327439c
mov dword [ebp - 4], 0x862fd41e
mov dword [ebp - 4], 0xffffffef
jmp 0x41a594
mov dword [ebp - 8], 0
jmp 0x41a498
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd8], 0x2167fa5c
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x41a487
mov dword [ebp - 0xd0], 0
jmp 0x41a577
push ebx
lea ecx, [ebp - 0x188]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x1c], 0x9ba095a9
mov dword [ebp - 8], eax
jmp 0x41a4d9
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x188]
mov dword [ecx + edx*4], 0xc000
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x41a4c6
cmp dword [ebp - 4], eax
jne 0x41a586
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x41a566
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x10], 0xd4a0d461
mov dword [ebp - 0x10], eax
jmp 0x41a55c
mov dword [ebp - 8], edi
mov dword [ebp - 8], eax
jmp 0x41a554
mov dword [ebp - 0x14], 0x8f4f823a
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jl 0x41a551
mov dword [ebp - 0x2c], 0xbefc
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
neg edx
add ecx, edx
neg ecx
mov dword [ebp - 0x28], ecx
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x41a54c
push eax
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x41a520
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x41a511
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x41a509
dec dword [ebp - 0x1c]
jns 0x41a4ef
lea ecx, [ebp - 0x188]
call fcn.004134bd
dec dword [ebp - 0xd0]
cmp dword [ebp - 0xd0], 0xfffffff1
je 0x41a4ac
jmp 0x41a591
lea ecx, [ebp - 0x188]
call fcn.004134bd
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff3
jg 0x41a47e
push 4
lea ecx, [ebp - 0x194]
call fcn.004133eb
mov dword [ebp - 0x14], 0x862f
lea ecx, [ebp - 0x1dc]
mov dword [ebp - 0x1c], 0x5300ce3
mov dword [ebp - 0x28], 0xe26b5cfd
mov dword [ebp - 0x20], 0x5c7e4ddb
mov dword [ebp - 0x24], 0x255bb5fb
mov dword [ebp - 0x28], 0x1b09c821
mov dword [ebp - 0x28], 0x2da3bb1d
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x38], 0xfffffffb
push esi
call fcn.004133eb
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 8], 0
jmp 0x41a615
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1dc]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x41a602
inc dword [ebp - 0x14]
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0x3a
jg 0x41a79c
mov dword [ebp - 4], 0x70ade21
lea ecx, [ebp - 0x1a0]
push esi
call fcn.004133eb
push edi
lea ecx, [ebp - 0x1f4]
call fcn.004133eb
mov dword [ebp - 0x2c], 0xe219
xor eax, eax
mov dword [ebp - 8], 0xc710
mov dword [ebp - 4], eax
jmp 0x41a675
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1a0]
mov dword [ecx + edx*4], 0x367f
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x41a662
mov dword [ebp - 4], eax
jmp 0x41a692
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1f4]
mov dword [ecx + edx*4], 0x21b78cd9
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x41a67f
mov dword [ebp - 4], 0xfffffff9
jmp 0x41a706
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x41a703
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x41a6d0
push 0x167e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x1c], eax
je 0x41a6f1
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1a0]
cmp dword [ecx + edx*4], eax
mov edx, eax
je 0x41a6f3
mov edx, edi
xor ecx, ecx
cmp edx, 0xfffffffd
setl cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x10]
jns 0x41a6ab
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
je 0x41a6a0
dec dword [ebp - 0x2c]
je 0x41a722
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp ecx, esi
setle dl
cmp edx, dword [ebp - 0x38]
jl 0x41a722
mov eax, edi
mov ecx, dword [ebp - 0x24]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x1f4]
setge cl
mov dword [ebp - 8], ecx
mov esi, dword [eax]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
dec eax
neg eax
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x1dc]
setge cl
xor edx, edx
sub ecx, esi
cmp ecx, edi
lea ecx, [ebp - 0x1f4]
setl dl
add edx, esi
mov dword [eax], edx
call fcn.004134bd
lea ecx, [ebp - 0x1a0]
call fcn.004134bd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x3a
push 3
pop esi
jle 0x41a62e
lea ecx, [ebp - 0x1dc]
call fcn.004134bd
push edi
lea ecx, [ebp - 0x254]
call fcn.004133eb
mov dword [ebp - 0x20], 0x77862fd4
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x41a7dd
push 0x2471
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x41a7ed
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 4], 0
jmp 0x41a809
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x194]
mov dword [eax + ecx*4], 0x9f5f
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x41a7f6
push edi
lea ecx, [ebp - 0x230]
call fcn.004133eb
mov dword [ebp - 0x1c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x20], 0x2a28
mov dword [ebp - 0x28], 7
mov dword [ebp - 8], eax
jmp 0x41a84a
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x230]
mov dword [ecx + edx*4], 0x64a6
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x41a837
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x41a8b5
mov dword [ebp - 4], 0x362daab7
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 8], 0x88586fd5
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
je 0x41a886
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 4]
test ecx, ecx
mov ecx, dword [ebp - 0x20]
setns dl
xor ebx, ebx
cmp edx, 0xfffffffc
setge bl
xor edx, edx
cmp ebx, ecx
setl dl
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x28], edx
dec dword [ebp - 0x1c]
jns 0x41a857
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x41a8c4
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ecx, [ebp - 0x230]
call fcn.004134bd
mov dword [ebp - 4], 0
jmp 0x41a8e7
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x254]
mov dword [eax + ecx*4], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x41a8d8
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], edi
jg 0x41aaa6
mov eax, dword [ebp - 0x104]
mov ebx, dword [ebp - 0x194]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 9
lea ecx, [ebp - 0x164]
push 2
call fcn.004133eb
push esi
lea ecx, [ebp - 0x158]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
jmp 0x41a948
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x164]
mov dword [ecx + edx*4], 0x14c405b4
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x41a935
mov dword [ebp - 4], eax
jmp 0x41a966
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x158]
mov dword [ecx + edx*4], 0xdcba
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x41a953
cmp dword [ebp - 0x1c], eax
je 0x41a981
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x41a9f0
push eax
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x41a9f0
mov dword [ebp - 4], 0x61f66568
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 8], eax
jmp 0x41a9a1
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x3c], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x41a997
mov ecx, dword [ebp - 0x158]
inc dword [ecx]
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x3c], eax
je 0x41a9ce
cmp dword [ebp - 4], eax
je 0x41a9c6
mov ecx, dword [ebp - 0x164]
cmp dword [ecx + 4], eax
je 0x41a9c8
mov eax, edi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setl dl
mov dword [ebp - 0x3c], edx
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x158]
call fcn.004134bd
lea ecx, [ebp - 0x164]
call fcn.004134bd
push edi
lea ecx, [ebp - 0x17c]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x41aa2b
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x17c]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x41aa1c
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x18]
inc dword [ebx + 0xc]
cmp ecx, edi
mov ecx, dword [ebp - 0x20]
setl dl
mov dword [ebp - 0x10], edx
cmp dword [ecx + 4], eax
je 0x41aa62
mov ecx, dword [ebp - 0x84]
xor edx, edx
cmp dword [ecx], eax
mov eax, dword [ebp - 0x17c]
sete dl
mov dword [eax], edx
jmp 0x41aa8f
mov dword [ebp - 0x10], eax
jmp 0x41aa89
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x41aa86
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x41aa81
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x41aa6f
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffea
jne 0x41aa67
lea ecx, [ebp - 0x17c]
call fcn.004134bd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x41a90b
lea ecx, [ebp - 0x254]
call fcn.004134bd
lea ecx, [ebp - 0x194]
call fcn.004134bd
mov eax, dword [ebp - 0x84]
dec dword [eax]
jns 0x41a323
lea ecx, [ebp - 0x84]
call fcn.004134bd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x419f78
jmp 0x41aaee
lea ecx, [ebp - 0x84]
call fcn.004134bd
lea ecx, [ebp - 0x104]
call fcn.004134bd
push dword [ebp - 0x20]
movdqa xmm0, xmmword [0xaa4880]
lea ecx, [ebp - 0x284]
push ecx
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x294]
mov dword [ebp - 0xc0], eax
push ecx
push eax
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xbc], eax
movdqu xmmword [ebp - 0x294], xmm0
mov dword [ebp - 0xb8], eax
call fcn.00414b1a
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], 0xe19e95d1
jbe 0x41ab60
mov edx, edi
cmp dword [ebp - 0x18], eax
jne 0x41ab62
mov edx, eax
mov ecx, dword [ebp - 0xc0]
xor ebx, ebx
mov dword [ebp - 0x28], ecx
mov esi, dword [ecx + 4]
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
setle bl
xor edx, edx
cmp ebx, ecx
setge dl
xor ecx, ecx
cmp edx, esi
setg cl
cmp ecx, 0x6d21
jge 0x41ab97
mov ecx, edi
test esi, esi
jne 0x41ab99
mov ecx, eax
xor ebx, ebx
cmp ecx, 8
mov ecx, dword [ebp - 0x20]
setne bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [ebp - 0x10], edx
mov esi, dword [ebp - 0x18]
sub esi, dword [ebp - 0x18]
neg esi
sbb esi, esi
xor edx, edx
inc esi
imul esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
mov ecx, dword [ebp - 0x28]
setne dl
sub edx, dword [ecx + 4]
je 0x41abf7
mov dword [ebp - 0x10], eax
jmp 0x41abef
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x41abec
push 0x23ad
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff6
je 0x41abd4
jmp 0x41ac26
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x41ac26
push eax
push 0x8cf
push 0x2496
push 0x742
push 0x150e
push 0x6ed
push 0x53c
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 0xc0]
call fcn.004134bd
mov dword [ebp - 0x14], 0xf82d83d7
xor eax, eax
mov dword [ebp - 0x18], 0xd5467356
push 4
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], eax
pop edx
jmp 0x41ac5e
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x50], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x41ac50
mov dword [ebp - 4], eax
jmp 0x41ac79
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x12c], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x41ac68
mov dword [ebp - 4], eax
jmp 0x41ac94
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x210], 0x76fbfcc0
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x41ac83
cmp dword [ebp - 0x44], eax
je 0x41ad11
cmp dword [ebp - 0x50], eax
jne 0x41acc5
cmp dword [ebp - 0x44], eax
jne 0x41acaf
mov esi, eax
cmp dword [ebp - 0x14], eax
je 0x41acb1
mov esi, edi
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp esi, ecx
setg dl
mov dword [ebp - 0x18], edx
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x41acc7
mov edx, edi
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x12c], edx
mov dword [ebp - 4], edx
xor edx, edx
mov esi, dword [ebp - 0x48]
mov ecx, dword [ebp - 4]
imul esi, ecx
mov ecx, dword [ebp - 0x44]
cmp esi, ecx
mov ecx, dword [ebp - 0x44]
setne dl
xor ebx, ebx
cmp edx, 0x6c0b
setne bl
sub ebx, 0x3ee6
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, ecx
mov dword [ebp - 0x204], ebx
mov ecx, dword [ebp - 0x14]
mov ecx, edi
jmp 0x41ad13
mov ecx, eax
mov esi, dword [ebp - 0x48]
xor edx, edx
imul esi, ecx
mov ecx, dword [ebp - 0x14]
push 3
cmp esi, ecx
pop esi
setg dl
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x14], eax
jmp 0x41ae31
mov dword [ebp - 0x1c], 0x57e8f534
mov dword [ebp - 4], esi
cmp dword [ebp - 4], eax
jl 0x41ae2e
mov dword [ebp - 0x10], 0x5375bb79
mov ecx, dword [ebp - 0x14]
cmp dword [ebp + ecx*4 - 0x50], eax
je 0x41ae07
mov dword [ebp - 0x24], 0xa8b036c8
mov dword [ebp - 0x18], eax
jmp 0x41adfc
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x12c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + ecx*4 - 0x12c]
mov ecx, dword [ebp - 0x1c]
neg ecx
cmp ecx, edx
mov ecx, dword [ebp - 0x14]
setne bl
xor edx, edx
mov dword [ebp + ecx*4 - 0x50], ebx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x210]
cmp ecx, 0x14c7c747
mov ecx, dword [ebp - 0x14]
sete dl
cmp edx, 0xffffffff
sbb edx, edx
neg edx
mov dword [ebp + ecx*4 - 0x210], edx
jne 0x41add0
mov ecx, dword [ebp - 0x14]
mov ebx, eax
cmp dword [ebp + ecx*4 - 0x50], eax
je 0x41add2
mov ebx, edi
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x12c]
sub ebx, ecx
sub ebx, dword [ebp - 0x1c]
imul ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp ebx, ecx
mov ecx, dword [ebp - 0x14]
setg dl
mov dword [ebp + ecx*4 - 0x12c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x41ad67
jmp 0x41ae25
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x41ae25
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + ecx*4 - 0x210]
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x50], edx
dec dword [ebp - 0x10]
jns 0x41ae0f
dec dword [ebp - 4]
jns 0x41ad44
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x41ad31
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x23c]
call fcn.004133eb
mov dword [ebp - 0x20], 0xf5f49900
mov dword [ebp - 0x18], 0xb4e76ab2
mov dword [ebp - 4], 0
jmp 0x41ae73
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x23c]
mov dword [eax + ecx*4], 6
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x41ae60
mov dword [ebp - 4], 0
jmp 0x41ae92
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x2d4], 0xfffffffb
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x41ae81
inc dword [ebp - 0x18]
mov dword [ebp - 0x18], 0xb
jmp 0x41aeb4
mov dword [ebp - 0x20], 0x8213af72
mov dword [ebp - 0x20], 0xdb959c45
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x21
jg 0x41aea3
lea ecx, [ebp - 0x23c]
call fcn.004134bd
movdqa xmm0, xmmword [0xaa4860]
lea ecx, [ebp - 0x2a4]
mov dword [ebp - 4], 0xa4f833fc
xor eax, eax
mov dword [ebp - 0x10], 0x4956
mov dword [ebp - 0x20], 6
push dword [ebp - 0x20]
mov dword [ebp - 8], 0x262
push ecx
lea ecx, [ebp - 0x2b4]
mov dword [ebp - 0x28], 0xd4ad
push ecx
mov dword [ebp - 0x18], 0x28ec7dff
lea ecx, [ebp - 0x90]
push eax
movdqu xmmword [ebp - 0x2b4], xmm0
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
call fcn.00414b1a
mov dword [ebp - 4], 0xfffffffa
cmp dword [ebp - 4], 0
je 0x41afd7
push ebx
lea ecx, [ebp - 0x140]
call fcn.004133eb
mov dword [ebp - 0x20], 0x5b263d18
xor eax, eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 8], eax
jmp 0x41af75
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x140]
mov dword [ecx + edx*4], 0xda0e60f9
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x41af62
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x41af93
push eax
push 0x1a63
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jg 0x41afcc
mov edx, dword [ebp - 0x140]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
cmp eax, 8
setne cl
mov dword [ebp - 0x20], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jle 0x41afa1
lea ecx, [ebp - 0x140]
jmp 0x41b0df
push edi
lea ecx, [ebp - 0x6c]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], eax
jmp 0x41aff6
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x6c]
mov dword [ecx + edx*4], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x41afea
mov edx, dword [ebp - 0x6c]
cmp dword [edx], eax
je 0x41b038
mov edx, dword [edx]
cmp dword [ebp - 0x20], edx
jle 0x41b024
xor ecx, ecx
cmp edx, 0xfffffff7
setle cl
sub ecx, edx
mov edx, eax
neg ecx
sbb ecx, ecx
add ecx, 0x842c
cmp ecx, 4
je 0x41b026
mov edx, edi
xor ecx, ecx
cmp edx, 0xc23782e
mov edx, edi
setl cl
cmp ecx, 0xfffffff7
je 0x41b03a
mov edx, eax
mov ecx, dword [ebp - 4]
sub edx, ecx
mov ecx, dword [ebp - 0x6c]
imul edx, dword [ecx]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x41b0dc
push esi
lea ecx, [ebp - 0x1ac]
call fcn.004133eb
mov dword [ebp - 8], 0
jmp 0x41b07c
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1ac]
mov dword [eax + ecx*4], 0x177106cf
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x41b069
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], 0x81f5
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6c]
imul ecx, dword [eax]
mov eax, dword [ebp - 0x1ac]
sub ecx, 0x3e85184b
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [ebp - 0x18], 0
jmp 0x41b0c3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], 0x1656
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x41b0b3
lea ecx, [ebp - 0x1ac]
call fcn.004134bd
dec dword [ebp - 0x10]
jns 0x41b054
lea ecx, [ebp - 0x6c]
call fcn.004134bd
mov dword [ebp - 8], 0
cmp dword [ebp - 8], esi
jg 0x41b12e
mov edi, dword [ebp - 0x90]
mov dword [ebp - 0x18], 0xfad6770d
mov eax, dword [ebp - 0x18]
mov dword [edi + 0xc], eax
mov dword [ebp - 0x18], 0
jmp 0x41b121
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x90]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x41b10c
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x41b0f6
lea ecx, [ebp - 0x90]
call fcn.004134bd
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
and dword [eax], 0
jmp 0x41b698
lea ecx, [ebp - 0x294]
mov dword [ebp - 0xa8], eax
push ecx
lea ecx, [ebp - 0x2a4]
mov dword [ebp - 0xa4], eax
push ecx
push eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xa0], eax
movdqu xmmword [ebp - 0x2a4], xmm0
call fcn.00414b1a
push 3
mov dword [ebp - 0x10], 0x184c506d
xor eax, eax
pop esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], esi
push 1
pop edi
cmp dword [ebp - 0x10], eax
jl 0x41b1fe
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x18], eax
jmp 0x41b1f4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xa8]
cmp dword [edx + ecx*4], eax
jne 0x41b1b6
cmp dword [edx + 0xc], 0xffffffff
mov ebx, eax
jge 0x41b1b8
mov ebx, edi
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ebx, ecx
setg dl
cmp edx, 0x8659
je 0x41b1da
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx + edx*4], eax
mov ecx, eax
je 0x41b1dc
mov ecx, edi
mov dword [ebp - 0x20], ecx
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x41b1f1
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x41b1a0
dec dword [ebp - 0x10]
jns 0x41b194
lea ecx, [ebp - 0xa8]
call fcn.004134bd
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], 0x53644469
mov dword [ebp - 0x20], 0xf25cbd94
mov dword [ebp - 0x20], 6
push 8
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 0x887e08a1
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x1c2e9378
mov dword [ebp - 0x20], 0x63cc1dab
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x20], 0xffffffff
push 7
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], 0x1b
pop edx
jmp 0x41b2a6
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0x96141e4f
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0x82c32b96
mov dword [ebp - 0x28], 0x1b713623
dec dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
dec dword [ebp - 8]
push 8
pop ecx
cmp dword [ebp - 8], 0xffffffe9
jle 0x41b268
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xcc]
push edi
call fcn.004133eb
mov dword [ebp - 0x18], 0xb24adc9f
xor eax, eax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 8], eax
jmp 0x41b2df
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xcc]
mov dword [ecx + edx*4], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x41b2d0
mov dword [ebp - 4], eax
jmp 0x41b3cc
mov dword [ebp - 0x1c], 0x25
mov dword [ebp - 0x2c], 0x94e8fe75
mov dword [ebp - 0x24], 0xc5d177cc
mov dword [ebp - 8], 0x7974498b
mov dword [ebp - 0x24], 0xffdeabfd
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xcc]
push 0xfffffffffffffff8
mov dword [ecx], edx
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0xcc]
pop edx
mov dword [ebp - 0x24], eax
sub edx, dword [ecx]
mov ecx, dword [ebp - 0x1c]
add ecx, edx
mov edx, dword [ebp - 0xcc]
je 0x41b344
mov ecx, edi
cmp dword [edx], eax
jne 0x41b346
mov ecx, eax
mov dword [edx], ecx
test ecx, ecx
je 0x41b353
mov ebx, edi
cmp dword [ebp - 8], eax
jne 0x41b355
mov ebx, eax
mov ecx, dword [ebp - 4]
xor edx, edx
cmp ebx, ecx
setl dl
xor ebx, ebx
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
cmp ecx, edx
setl bl
xor ecx, ecx
cmp ebx, 0x64c7b7f6
setne cl
sub ecx, dword [ebp - 4]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jne 0x41b39a
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0x24], 7
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
cmp edx, ecx
mov ecx, dword [ebp - 8]
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setle dl
add ecx, 0x58f5e11d
add ecx, edx
mov dword [ebp - 8], ecx
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff7
jge 0x41b2ec
lea ecx, [ebp - 0xcc]
call fcn.004134bd
mov dword [ebp - 0x38], 0x862fd41e
lea ecx, [ebp - 0x248]
push 4
call fcn.004133eb
mov dword [ebp - 0x24], 0x7fa5c62e
xor eax, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 8], eax
jmp 0x41b429
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x248]
mov dword [eax + ecx*4], 0xf57a7c2
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x41b416
inc dword [ebp - 0x1c]
xor ebx, ebx
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setl bl
neg ebx
sub ebx, edx
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setl cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x248]
call fcn.004134bd
push edi
lea ecx, [ebp - 0x11c]
call fcn.004133eb
push esi
lea ecx, [ebp - 0x1d0]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 8], 0x693e9323
mov dword [ebp - 4], eax
jmp 0x41b4a0
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x224], 0xffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x41b48f
mov dword [ebp - 4], eax
jmp 0x41b4ba
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x11c]
mov dword [ecx + edx*4], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x41b4ab
mov dword [ebp - 4], eax
jmp 0x41b4d7
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1d0]
mov dword [ecx + edx*4], 0x94fe5f36
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x41b4c4
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x1d0]
mov dword [ecx], eax
or dword [edx + 8], 0xffffffff
mov ecx, dword [ecx]
mov ecx, dword [ebp + ecx*4 - 0x224]
mov ecx, dword [ebp - 0x11c]
inc dword [ecx]
cmp dword [ecx], edi
jle 0x41b4ea
mov dword [ebp - 8], 0xffffffeb
jmp 0x41b514
cmp dword [edx + 8], eax
jne 0x41b51a
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x15
jl 0x41b50c
lea ecx, [ebp - 0x1d0]
call fcn.004134bd
lea ecx, [ebp - 0x11c]
call fcn.004134bd
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0xc5416513
mov dword [ebp - 0x20], 0x8dc509ca
mov dword [ebp - 0x20], 0xb187b35f
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x18], 0xffffffea
jmp 0x41b653
push esi
lea ecx, [ebp - 0x14c]
call fcn.004133eb
mov dword [ebp - 0x10], 0xf2d3f504
xor eax, eax
mov dword [ebp - 0x24], 7
mov dword [ebp - 4], eax
jmp 0x41b58a
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x5c], 0x36951ad3
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x41b57c
mov dword [ebp - 4], eax
jmp 0x41b5a7
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14c]
mov dword [ecx + edx*4], 0x4aa0d722
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x41b594
mov dword [ebp - 0x58], eax
jmp 0x41b5be
mov dword [ebp - 0x20], 9
dec dword [ebp - 0x10]
dec dword [ebp - 0x58]
cmp dword [ebp - 0x58], 0xffffffe9
jge 0x41b5b1
mov ecx, dword [ebp - 0x24]
cmp dword [ebp - 0x10], ecx
jle 0x41b5d3
mov ebx, edi
cmp dword [ebp - 0x18], eax
jne 0x41b5d5
mov ebx, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0x43e2
setg cl
xor edx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp eax, ebx
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x10]
je 0x41b601
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov ecx, dword [ebp - 0x14c]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x24]
cmp dword [ecx + 8], eax
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
setle bl
imul edx, ebx
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x14c]
call fcn.004134bd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
je 0x41b55b
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 4], 0
jge 0x41b675
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
inc dword [ebp - 4]
js 0x41b66a
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x41b698
mov esi, dword [ebp - 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xa5f27a41
inc dword [edx]
cmp dword [edx], 2
jl 0x41b686
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret