Function at 0x426596
Capabilities:
Connect pipe
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
xor ebx, ebx
mov dword [ebp - 8], 0xfb871c7b
inc ebx
mov dword [ebp - 0x28], 0x3abefa02
push esi
xor eax, eax
mov dword [ebp - 0x28], ebx
push edi
mov byte [ebp - 0x2d], dl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 8], eax
jmp 0x4265d4
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xb8], 0xc64a6847
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x4265c3
push 3
mov dword [ebp - 8], eax
pop esi
jmp 0x4265f3
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x15c], 7
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4265e2
mov dword [ebp - 8], eax
jmp 0x42660a
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x194], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4265fd
mov dword [ebp - 8], esi
cmp dword [ebp - 8], eax
jl 0x42664d
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x426634
push 0xb0e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x426648
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
dec dword [ebp - 8]
jns 0x426617
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jg 0x426760
mov dword [ebp - 0x18], 0xc8dd
mov dword [ebp - 0x3c], 0x52a28486
mov dword [ebp - 0x28], 0x5610
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42668a
push 0xc7f
push 0x8cb
push eax
call dword [sym.imp.USER32.dll_InflateRect]
xor eax, eax
mov dword [ebp - 0x15c], ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0xb8], eax
jne 0x4266d0
cmp dword [ebp - 0x158], eax
jne 0x4266b9
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0xb8]
add ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x18], ecx
je 0x4266c0
mov edx, ebx
cmp dword [ebp - 0x18], eax
jne 0x4266c2
mov edx, eax
mov ecx, dword [ebp - 8]
cmp edx, dword [ebp + ecx*4 - 0xb8]
mov edx, eax
jl 0x4266d2
mov edx, ebx
mov ecx, dword [ebp - 0xac]
add ecx, edx
mov edx, 0xa938f738
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0xb4], eax
je 0x426709
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0xb8], eax
mov ecx, ebx
jne 0x42670b
mov ecx, eax
xor edx, edx
cmp ecx, 0x6d99
mov ecx, dword [ebp - 0xac]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 8]
push 3
setg bl
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0xb8]
cmp ecx, ebx
mov ecx, dword [ebp - 8]
setle dl
imul esi, edx, 0xbee6
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0xb8]
cmp esi, ecx
pop esi
setg dl
mov dword [ebp - 0x28], edx
inc dword [ebp - 8]
push 1
pop ebx
cmp dword [ebp - 8], esi
jle 0x426659
push esi
lea ecx, [ebp - 0x98]
call fcn.00426223
push 5
pop eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x24], 0x5fbc01d4
mov dword [ebp - 0x10], eax
jmp 0x426793
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x98]
mov dword [ecx + edx*4], 0xbbca6318
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x426780
push 2
mov dword [ebp - 8], eax
pop edi
jmp 0x4267d1
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4267b6
push 0x14dc
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4267ce
push eax
push 0x19b3
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x4267a0
mov dword [ebp - 8], edi
cmp dword [ebp - 8], eax
jl 0x426933
mov dword [ebp - 0x20], 0x1ded6804
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4267ff
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x4268c5
mov dword [ebp - 0x14], 0xda7fe64f
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jg 0x4268b9
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x98]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x98]
sub ecx, dword [ebx]
cmp ecx, dword [esi + edi*4]
mov ecx, dword [ebp - 0x28]
setg dl
mov ecx, dword [ebx + ecx*4]
sub ecx, edx
mov edx, dword [ebp - 0x3c]
add ecx, 0x40c47301
imul ecx, dword [ebx + edx*4]
test ecx, ecx
jne 0x426887
cmp dword [ebp - 0x18], eax
jne 0x426887
inc dword [ebp - 0x1c]
jmp 0x4268a7
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x98]
mov dword [ecx + edx*4], eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4268a7
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor eax, eax
inc dword [ebp - 0x14]
push 2
pop edi
cmp dword [ebp - 0x14], edi
jle 0x426821
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 8]
dec dword [ebp - 0x20]
jns 0x42680b
mov dword [ebp - 0x1c], eax
jmp 0x42691f
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x98]
push 0xfffffffffffffffd
pop esi
push 2
sub esi, dword [ecx + edx*4]
xor edx, edx
mov ecx, dword [ebp - 0x98]
add edi, esi
mov esi, dword [ebp - 0x28]
imul edi, dword [ecx + ebx*4]
mov ecx, dword [ebp - 0x1c]
cmp edi, ecx
mov ecx, dword [ebp - 0x98]
pop edi
setl dl
mov dword [ecx + esi*4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x4268ca
dec dword [ebp - 8]
push 1
pop ebx
jns 0x4267e2
push 3
pop esi
lea ecx, [ebp - 0x98]
call fcn.004262f5
mov ebx, dword [sym.imp.USER32.dll_GetDC]
xor eax, eax
mov dword [ebp - 0x10], edi
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42696a
push eax
push 0xe6c
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x42698a
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x426987
push eax
push eax
push 0x12b
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
jl 0x42696f
mov dword [ebp - 0x1c], eax
mov ecx, 0x43e1243b
mov dword [ebp - 8], 9
or edi, 0xffffffff
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x18c], ecx
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], eax
jmp 0x4269da
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x8c], 0x33563700
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4269c9
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x1c]
jne 0x426b3a
mov dword [ebp - 0x14], 0xb000e2e4
mov dword [ebp - 8], eax
jmp 0x426b2e
mov dword [ebp - 0x28], 0x1ae7d512
xor ebx, ebx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
add edx, 0x4e5477a7
cmp edx, ecx
setge bl
xor ecx, ecx
sub ebx, dword [ebp - 0x8c]
cmp ebx, esi
setne cl
cmp ecx, 0xc3e5f885
mov ecx, dword [ebp - 0x14]
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x14]
setg dl
xor ebx, ebx
imul edx, edx, 0x3239
cmp ecx, edx
mov ecx, dword [ebp - 0x1c]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x14]
setg dl
mov dword [ebp - 0x28], edx
xor edx, edx
cmp dword [ebp - 0x28], ecx
setl dl
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], eax
je 0x426aa7
cmp dword [ebp - 0x14], eax
je 0x426aa7
xor edx, edx
inc edx
mov ecx, edx
jmp 0x426aac
xor edx, edx
mov ecx, eax
inc edx
cmp ecx, dword [ebp - 0x84]
je 0x426ac2
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0x8c], eax
jne 0x426ac2
mov edx, eax
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0x8c], edx
jl 0x426ae3
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x426b2b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor eax, eax
jmp 0x426b2b
mov ecx, 0x3044b131
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x118]
dec edx
mov esi, dword [ebp - 0x118]
neg edx
push 3
sbb edx, edx
neg edx
add ecx, edx
xor edx, edx
imul esi, ecx
mov ecx, dword [ebp - 8]
cmp esi, ecx
pop esi
setl dl
mov dword [ebp - 0x28], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x426a15
jmp 0x426b6b
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x426b4c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x426b6b
push 0x146f
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_Polygon]
mov edx, dword [ebp - 0x8c]
xor ecx, ecx
mov eax, dword [ebp - 0x8c]
sub edx, eax
mov eax, dword [ebp - 8]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
push 6
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 8]
setl bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor esi, esi
sub ecx, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, esi
setl cl
mov dword [ebp - 0x184], ecx
mov eax, dword [ebp - 8]
sub eax, ecx
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x84]
push 0xfffffffffffffff8
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
add eax, 0x255f
xor ebx, ebx
cmp eax, edx
setne bl
sub ebx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
mov ebx, dword [0x4b09fc]
pop eax
sete cl
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], 0x7a4a12b5
mov dword [ebp - 0x18], 0xe011b55e
mov dword [ebp - 0x18], 0xcf7a0211
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 3
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x18], 0x30971cf7
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], 0x7f44fb66
push 2
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], eax
pop edx
jmp 0x426c62
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x4c], 0xe2799ac7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x426c54
mov dword [ebp - 0x1c], eax
jmp 0x426c7d
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x1f0], 0x8b74
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x426c6c
mov dword [ebp - 8], esi
cmp dword [ebp - 8], eax
jl 0x426df2
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
jmp 0x426ca6
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x210], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x426c99
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x4c]
cmp edx, ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x4c]
mov ecx, dword [ebp - 0x18]
cmp ecx, edx
setne bl
cmp ebx, dword [ebp - 8]
jle 0x426ce4
mov edx, eax
cmp dword [ebp - 8], eax
je 0x426ce6
mov edx, esi
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x4c]
cmp edx, ecx
mov ecx, dword [ebp - 8]
setle bl
xor edx, edx
add ebx, dword [ebp + ecx*4 - 0x4c]
mov ecx, dword [ebp - 0x48]
cmp ebx, ecx
setle dl
xor ecx, ecx
cmp edx, edi
setl cl
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x4c]
mov ecx, dword [ebp - 0x18]
cmp ecx, edx
mov ecx, dword [ebp - 8]
setne bl
sub ebx, dword [ebp + ecx*4 - 0x4c]
mov ecx, dword [ebp - 0x4c]
neg ebx
mov esi, dword [ebp - 8]
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setl dl
add esi, edx
mov ecx, dword [ebp + ecx*4 - 0x4c]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, esi
setne dl
mov dword [ebp - 0x18], edx
xor edx, edx
mov ecx, dword [ebp - 8]
inc edx
mov esi, dword [ebp + ecx*4 - 0x4c]
mov ecx, dword [ebp - 0x18]
sub edx, ecx
sub edx, dword [ebp - 8]
add esi, edx
jne 0x426d95
cmp dword [ebp - 0x24], eax
jne 0x426d95
mov edx, eax
inc esi
jmp 0x426d9a
xor esi, esi
inc esi
mov edx, esi
mov ecx, dword [ebp - 8]
xor ebx, ebx
push 2
mov ecx, dword [ebp + ecx*4 - 0x4c]
imul ecx, dword [ebp - 8]
cmp ecx, edx
setle bl
sub ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, 0x4b0f4f2d
setl dl
xor ebx, ebx
imul edx, dword [ebp + ecx*4 - 0x4c]
mov ecx, dword [ebp - 0x48]
cmp edx, ecx
mov ecx, dword [ebp - 8]
pop edx
setge bl
sub ebx, 0x5f7f7777
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp + ecx*4 - 0x4c], ebx
dec dword [ebp - 8]
jns 0x426c8e
mov ebx, dword [ebp - 0x3c]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
jmp 0x426e1d
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x5c], 0x9714
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x426e0f
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x426e3f
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor eax, eax
cmp byte [ebp - 0x2d], 0
je 0x426fcb
cmp ebx, esi
jne 0x426fcb
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xd8]
call fcn.00426223
xor esi, esi
mov dword [ebp - 0x14], 0x2ee76f50
mov dword [ebp - 0x10], esi
jmp 0x426e7d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x426e6e
mov dword [ebp - 0x14], esi
xor esi, esi
inc esi
cmp dword [ebp - 0x14], esi
jg 0x426eeb
mov esi, dword [ebp - 0xd8]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0x8589
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd8]
add ecx, 0x7b5c6eff
mov edx, dword [eax + edx*4]
add edx, ecx
mov ecx, dword [ebp - 0x14]
imul edx, dword [esi + 4]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], edx
xor eax, eax
cmp edx, 0xd697
setge al
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x426e96
xor esi, esi
inc esi
lea ecx, [ebp - 0xd8]
call fcn.004262f5
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x36b16b47
mov dword [ebx + 8], 4
mov dword [ebp - 0x10], eax
jmp 0x426f1e
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x50], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x426f14
mov dword [ebp - 8], eax
jmp 0x426fb8
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], eax
jmp 0x426f4d
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x50]
test ecx, ecx
setne dl
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x426f33
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x426fb5
mov dword [ebp - 0x18], 0xfffffff8
xor edx, edx
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
push 0xffffffffffffffff
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov edi, dword [ebp - 0x18]
sub edi, ecx
imul edi, dword [ebp - 0x50]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp + ecx*4 - 0x50]
neg edi
mov ecx, dword [ebp - 8]
cmp ecx, edi
pop edi
setle dl
xor ecx, ecx
cmp esi, edx
setg cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x426f5a
xor esi, esi
or edi, edi
inc esi
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jle 0x426f2b
mov dword [ebp - 0x24], edi
mov dword [ebx + 0xc], 0x4b09fc
mov dword [ebp - 0x10], 0xd4e06482
mov dword [ebp - 0x10], 0xfffffff7
jmp 0x426ff4
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x426ff1
push 0x1ea0
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jle 0x426fdb
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x10], 0x5b0e446d
cmp ebx, dword [ebp - 0x3c]
jge 0x428139
mov dword [ebp - 0x1c], eax
push 3
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
pop edx
jmp 0x427025
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x68], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x42701b
push 2
pop ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jl 0x4270f0
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x28], 0xe60a2fc5
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42705c
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor eax, eax
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp + ecx*4 - 0x68], eax
jne 0x4270b1
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + ecx*4 - 0x68]
mov ecx, dword [ebp - 0x60]
sub edx, ecx
mov ecx, dword [ebp - 0x24]
imul ecx, edx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], edi
je 0x427082
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x68]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x68]
test ecx, ecx
mov ecx, dword [ebp - 0x64]
setne bl
xor edx, edx
cmp ebx, ecx
setne dl
cmp edx, 0xfffffff7
mov edx, eax
jne 0x4270b3
mov edx, esi
mov ecx, dword [ebp - 0x1c]
cmp edx, dword [ebp + ecx*4 - 0x68]
jge 0x4270c7
mov ecx, dword [ebp - 0x1c]
mov edx, esi
cmp dword [ebp + ecx*4 - 0x68], eax
jne 0x4270c9
mov edx, eax
xor ecx, ecx
cmp edx, esi
sete cl
add ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x60]
jg 0x4270db
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x1c]
jns 0x427039
mov ebx, dword [ebp - 0x34]
or edx, 0xffffffff
mov edi, 0x4b0a00
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 8], 0x1c36b586
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], eax
jmp 0x42711a
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1e8], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x42710d
mov ecx, dword [ebp - 0x24]
cmp dword [ebp - 0x20], ecx
jne 0x4271b3
push 4
lea ecx, [ebp - 0x1b8]
call fcn.00426223
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x427153
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1b8]
mov dword [eax + ecx*4], 0x88adae8c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x427140
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], esi
jl 0x4271a3
xor esi, esi
inc esi
mov dword [ebp - 0x10], 0x83d87e3b
mov ecx, esi
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
cmp eax, esi
setg cl
mov dword [ebp - 8], ecx
dec dword [ebp - 0x20]
jns 0x427168
jmp 0x4271a6
xor esi, esi
inc esi
lea ecx, [ebp - 0x1b8]
call fcn.004262f5
jmp 0x42722a
mov dword [ebp - 0x14], 0x51cd25bb
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4271d4
push 0x2704
push 0x14c6
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1e4], eax
cmp eax, dword [ebp - 0x14]
jge 0x4271e5
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1e4]
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
neg edx
push 0xfffffffffffffff8
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x28], eax
test ebx, ebx
jle 0x427a33
mov eax, 0x5021c3a2
jmp 0x427241
xor esi, esi
inc esi
mov dword [ebp - 0xa8], eax
lea ecx, [ebp - 0x180]
push 3
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
pop ebx
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x18], 0xdc9fe9a5
push ebx
call fcn.00426223
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x427284
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x38], 0x5b9b55bb
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x427276
mov dword [ebp - 8], eax
jmp 0x4272a1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x180]
mov dword [ecx + edx*4], 0x94486cae
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x42728e
mov dword [ebp - 0x38], 0xb
cmp dword [ebp - 0x38], esi
jge 0x42737d
push 2
pop edi
mov dword [ebp - 0x14], 0xc5d177cc
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xa8], edi
cmp dword [ebp - 0x38], eax
jne 0x427331
cmp dword [ebp - 0xa8], eax
jne 0x4272f0
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [ebp - 0xa4]
jge 0x4272ea
mov ecx, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x38]
jle 0x4272ff
mov edx, esi
cmp dword [ebp - 0x14], eax
jne 0x427301
mov edx, eax
mov ecx, dword [ebp - 0x38]
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
sete bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [ebp - 0xa4], edx
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x18], ecx
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x427333
mov ecx, esi
mov edx, dword [ebp - 0x14]
xor ebx, ebx
add edx, ecx
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
mov ecx, dword [ebp - 0x38]
setl bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x180]
setge dl
xor ebx, ebx
mov dword [ecx], edx
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setne bl
xor edx, edx
cmp ebx, ecx
setg dl
mov dword [ebp - 0x14], edx
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x4272b9
mov edi, dword [ebp - 0x1c]
push 3
pop ebx
lea ecx, [ebp - 0x180]
call fcn.004262f5
mov eax, dword [edi]
lea ecx, [ebp - 0x1ac]
push 0xfffffffffffffff8
mov dword [ebp - 0x20], 0x90ac204e
mov dword [ebp - 0x2c], eax
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x1b66bafc
push 2
mov dword [ebp - 0x18], esi
pop eax
mov dword [ebp - 0x18], 0x8f01ba02
mov dword [ebp - 0x18], 0xe974a520
mov dword [ebp - 0x18], 0xf34111d0
push eax
call fcn.00426223
xor eax, eax
push 2
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x4273f1
push ecx
pop eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1ac]
mov dword [ecx + edx*4], 0xfa2ef703
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jl 0x4273d7
xor eax, eax
mov dword [ebp - 0x20], 0xf
cmp dword [ebp - 0x20], 9
je 0x4274e6
mov ecx, 0xe1e01b17
mov dword [ebp - 0x14], 0x95e17ca0
mov dword [ebp - 0x18], 0x5aad8530
mov dword [ebp - 0x18], 0x4515fdc8
mov dword [ebp - 0x1c8], ecx
mov dword [ebp - 0x1c4], ecx
mov dword [ebp - 0x1c0], ecx
mov dword [ebp - 0x1bc], ecx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x14], 0xffffffe4
cmp dword [ebp - 0x14], 0xfffffffb
je 0x4274d6
mov dword [ebp - 0x18], 0xa9576c3a
push 0xfffffffffffffff6
mov dword [ebp - 0x18], esi
pop ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0x87263b0a
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], esi
push ebx
call fcn.00426223
push 7
pop edx
mov dword [ebp - 0x18], edx
xor esi, esi
mov dword [ebp - 0x18], 0x3268dd2a
mov dword [ebp - 0x10], esi
jmp 0x4274ac
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1a0]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x42749d
inc dword [ebp - 0x110]
lea ecx, [ebp - 0x1a0]
call fcn.004262f5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffb
push 0
pop eax
push 1
pop esi
jne 0x427459
mov ecx, 0xe1e01b17
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jne 0x427407
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0x17
cmp dword [ebp - 0x14], 0xffffffea
jg 0x427571
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x18], 0x2932
jne 0x427559
push esi
lea ecx, [ebp - 0x174]
call fcn.00426223
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], esi
xor esi, esi
mov dword [ebp - 0x18], 0x2b6a
mov dword [ebp - 0x10], esi
inc esi
jmp 0x42753a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x174]
mov dword [eax + ecx*4], 0xa0c8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x427527
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
dec dword [eax]
dec dword [ebp - 0x18]
call fcn.004262f5
xor eax, eax
jmp 0x427565
mov dword [ebp - 0x18], 0x6fbc
cmp dword [ebp - 0x18], eax
jne 0x42756e
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffea
jle 0x4274f3
mov edi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1ac]
call fcn.004262f5
mov dword [ebp - 0x14], 0xa290be44
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x18], 0x8b081589
push esi
call fcn.00426223
xor esi, esi
xor edx, edx
mov dword [ebp - 0x24], esi
inc edx
push 5
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0xcb090aec
mov dword [ebp - 0x1c], 0xf839313
mov dword [ebp - 0x10], esi
jmp 0x4275d8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0xa6d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x4275c5
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x14]
cmp eax, edx
setne cl
xor ebx, ebx
cmp ecx, edx
setl bl
xor ecx, ecx
add ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ebx, eax
mov eax, dword [ebp - 0x14]
setl cl
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
sub ecx, 0x9d66
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xcc]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0xdc10
setne cl
xor eax, eax
neg ecx
cmp ecx, 0x34ab
setne al
xor edx, edx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setne dl
add edx, 0xa
jne 0x427680
cmp dword [ebp - 0x20], esi
jne 0x427680
xor ebx, ebx
mov edx, esi
inc ebx
jmp 0x427685
xor ebx, ebx
inc ebx
mov edx, ebx
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ecx]
imul eax, edx
mov dword [ebp - 0x18], eax
cmp dword [ecx], esi
jne 0x4276b2
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, 0xd1a0c8
setne cl
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xcc]
add ecx, dword [eax]
je 0x4276b4
mov esi, ebx
cmp esi, 0xde360abe
mov ecx, 0x978317d2
sbb eax, eax
neg eax
add eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0xcc]
call fcn.004262f5
mov ebx, dword [edi + 4]
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], esi
push 3
pop edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x18], 0x259dba5c
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x24], 9
ja 0x4277a3
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x427791
push 0x22b3
push 0x1d0a
push 0x17ac
push 0x1558
push 0x146b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x178a
push 0x1adf
push 0x3a3
push 0x114d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4277e3
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x4277e3
mov dword [ebp - 0x18], 0x26f37911
push 0xfffffffffffffff8
mov dword [ebp - 0x18], esi
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], 0x23279329
mov dword [ebp - 0x10], eax
jmp 0x4277cc
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x21c], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x4277bf
mov dword [ebp - 0x14], esi
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x4277e3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 8
mov dword [ebp - 0x10], esi
push esi
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x1c], edi
call fcn.00426223
push 2
pop edi
push edi
lea ecx, [ebp - 0x144]
call fcn.00426223
push dword [ebp + 8]
lea eax, [ebp - 0x1c8]
mov dword [ebp - 0x18], 0xc4307e
push eax
xor esi, esi
lea eax, [ebp - 0x1d8]
push eax
xorps xmm0, xmm0
mov dword [ebp - 0xe8], esi
push esi
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xe4], esi
movdqu xmmword [ebp - 0x1d8], xmm0
mov dword [ebp - 0xe0], esi
call fcn.00426366
xor edx, edx
mov dword [ebp - 8], esi
inc edx
jmp 0x427865
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], 0xa439beb0
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x427852
mov dword [ebp - 8], esi
jmp 0x427882
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], 0x9e2a
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x42786f
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x144]
mov dword [eax], edi
inc dword [edx + 4]
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx + 4]
setg cl
xor edx, edx
sub edi, ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
add ecx, edi
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xe8]
setne cl
mov dword [eax], ecx
lea ecx, [ebp - 0xe8]
call fcn.004262f5
lea ecx, [ebp - 0x144]
call fcn.004262f5
lea ecx, [ebp - 0x12c]
call fcn.004262f5
test ebx, ebx
jne 0x4278fc
add dword [ebp - 0x1c], 8
push 3
pop edi
or ebx, 0xffffffff
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], 9
push edi
call fcn.00426223
push edi
lea ecx, [ebp - 0xf4]
call fcn.00426223
push edi
lea ecx, [ebp - 0x150]
call fcn.00426223
mov dword [ebp - 8], esi
jmp 0x427944
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x427935
mov dword [ebp - 8], esi
jmp 0x427961
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xf4]
mov dword [eax + ecx*4], 0xdd66408
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x42794e
mov dword [ebp - 8], esi
jmp 0x42797e
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0x51ac
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x42796b
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
neg ecx
mov edi, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0xf4]
setge dl
add edx, dword [eax + 4]
mov eax, dword [ebp - 0x18]
sub edi, edx
neg edi
sbb edi, edi
xor ecx, ecx
inc edi
cmp edi, eax
mov eax, dword [ebp - 0x150]
setl cl
xor edx, edx
cmp ecx, dword [eax]
setl dl
xor eax, eax
cmp edx, 3
setge al
cmp dword [ebp - 0x24], eax
jge 0x4279da
mov eax, dword [ebp - 0x168]
cmp dword [eax + 8], esi
je 0x4279dd
xor esi, esi
inc esi
push 6
pop eax
cmp eax, esi
mov eax, dword [ebp - 0xf4]
sbb ecx, ecx
add ecx, 0xffff7a8f
mov dword [eax], ecx
lea ecx, [ebp - 0x150]
call fcn.004262f5
lea ecx, [ebp - 0xf4]
call fcn.004262f5
lea ecx, [ebp - 0x168]
call fcn.004262f5
mov edi, dword [ebp - 0x1c]
mov eax, 0x5021c3a2
add edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x28]
inc ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], ebx
cmp ebx, dword [ebp - 0x34]
jl 0x42723e
xor eax, eax
push 2
mov dword [ebp - 0x10], 0xea311c3f
mov dword [ebp - 8], eax
pop edx
jmp 0x427a53
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xc0], 0x98a8f939
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x427a42
mov dword [ebp - 8], eax
jmp 0x427a6b
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x44], 0x885c6f1b
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x427a5d
xor esi, esi
mov dword [ebp - 0x44], eax
inc esi
cmp dword [ebp - 0x44], esi
jg 0x427bcf
push 0xfffffffffffffff6
pop edi
mov dword [ebp - 0x14], 0xdd8d1303
mov dword [ebp - 8], 0x9ea7eb8e
mov dword [ebp - 0x28], 0xfffffffd
inc dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x427bb7
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], 0x4ee3b919
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x44]
cmp dword [ebp + ecx*4 - 0xc0], eax
jle 0x427ada
mov ecx, dword [ebp - 0x44]
cmp dword [ebp + ecx*4 - 0xc0], eax
jne 0x427ada
mov ecx, eax
cmp dword [ebp - 0x44], eax
je 0x427adc
mov ecx, esi
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
sub ecx, 0x6dc9
cmp edi, ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
jmp 0x427bab
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], esi
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x427b15
push 0xcd4
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x427b9f
mov dword [ebp - 0x28], esi
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp + ecx*4 - 0xc0]
mov ecx, dword [ebp - 0x34]
cmp dword [ebp - 0x28], eax
jne 0x427b42
mov edx, eax
cmp dword [ebp - 0x34], eax
je 0x427b44
mov edx, esi
mov ecx, dword [ebp - 0x44]
imul ecx, edx
imul ecx, ecx, 0x8390
test ecx, ecx
jne 0x427b57
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
cmp edx, ecx
setge bl
xor ecx, ecx
cmp ecx, ebx
mov ecx, dword [ebp - 0x14]
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setg dl
xor esi, esi
mov dword [ebp - 0x28], edx
inc esi
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x2c], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x427b1d
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x427af8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x427aa2
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jle 0x427a82
mov edi, dword [ebp - 0x1c]
mov eax, dword [edi]
lea ecx, [ebp - 0x138]
or ebx, 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x28], ebx
push 4
mov dword [ebp - 0x18], eax
call fcn.00426223
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x427c02
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x200], 0xcba2
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x427bf1
mov dword [ebp - 8], eax
jmp 0x427c1c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x138]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x427c0d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 7
jg 0x427d5a
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], 0x28f3b8c1
mov dword [ebp - 8], eax
jmp 0x427c4c
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x80], 0x97a888ad
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x427c3e
mov dword [ebp - 8], eax
jmp 0x427c61
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x58], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x427c57
mov dword [ebp - 0x78], eax
jmp 0x427c7c
mov ecx, dword [ebp - 0x78]
mov dword [ebp + ecx*4 - 0x200], 0x690f
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], 4
jl 0x427c6b
mov dword [ebp - 8], 0xfffffff9
cmp dword [ebp - 8], 0xb
jne 0x427d4a
mov dword [ebp - 0x20], 0x51d5
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
cmp ecx, edx
mov ecx, dword [ebp - 0x138]
setle bl
mov dword [ebp - 0x58], ebx
mov dword [ecx], ebx
cmp ebx, dword [ebp - 0x14]
jne 0x427cc4
mov edi, eax
cmp dword [ebp - 0x14], eax
je 0x427cc6
mov edi, esi
mov esi, dword [ebp - 0x7c]
xor ebx, ebx
mov dword [ebp - 0x78], esi
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
cmp ecx, edx
setg bl
xor ecx, ecx
add ebx, esi
cmp ebx, edi
setge cl
cmp ecx, dword [ebp - 0x14]
jle 0x427d96
cmp dword [ebp - 0x78], eax
jne 0x427d96
mov dword [ebp - 0x14], 0x1a
cmp dword [ebp - 0x14], 0x18
jg 0x427d26
push 2
pop ecx
mov dword [ebp - 0x20], eax
jmp 0x427d18
mov dword [ebp - 0x2c], 0xf844
cmp dword [ebp - 0x2c], eax
jne 0x427d1d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x427d09
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x18
jle 0x427d04
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x427d37
call dword [sym.imp.KERNEL32.dll_GetACP]
xor eax, eax
xor esi, esi
inc esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xb
je 0x427c93
or ebx, 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
jle 0x427c2f
mov edi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x138]
call fcn.004262f5
mov dword [ebp - 0x20], 0x2a4f
lea ecx, [ebp - 0x74]
mov dword [ebp - 8], esi
add edi, 4
mov dword [ebp - 0x14], 0xedac7a8c
mov dword [ebp - 0x24], esi
push 3
mov dword [ebp - 0x1c], edi
call fcn.00426223
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x427db1
xor esi, esi
inc esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x7c], esi
jmp 0x427d3a
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x74]
mov dword [ecx + edx*4], 0xfff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x427da1
cmp dword [ebp - 0x20], eax
je 0x427dd5
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x20]
mov ecx, esi
je 0x427dd7
mov ecx, eax
push 6
pop esi
sub esi, ecx
imul esi, dword [ebp - 0x20]
sub esi, dword [ebp - 0x20]
neg esi
sbb esi, esi
xor edx, edx
inc esi
sub esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
cmp esi, ecx
setne dl
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
imul edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x20]
jg 0x427f54
cmp dword [ebp - 0x14], eax
jne 0x427f54
mov dword [ebp - 0x10], 0x241a
mov dword [ebp - 0x34], 0xfffffffe
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x427e45
push eax
push 0xe6c
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
xor eax, eax
push 2
mov dword [ebp - 8], eax
pop ecx
cmp dword [ebp - 8], ecx
jg 0x427f76
mov dword [ebp - 0x28], ebx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x74]
cmp dword [ecx + edx*4], eax
jne 0x427e6a
cmp dword [ebp - 8], eax
jne 0x427e6a
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x74]
push 5
sub esi, dword [ecx + edx*4]
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x74]
pop esi
push 2
cmp esi, dword [ecx + edx*4]
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x34], ecx
pop ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x427f43
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x74]
cmp dword [ecx + edx*4], eax
jne 0x427ecd
cmp dword [ebp - 0x24], eax
je 0x427ecd
xor edi, edi
inc edi
jmp 0x427ecf
mov edi, eax
mov esi, dword [ebp - 0x14]
xor ebx, ebx
mov edx, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x10]
cmp dword [edx + esi*4], ecx
mov ecx, dword [ebp - 0x34]
sete bl
xor edx, edx
cmp ecx, edi
setle dl
sub ebx, edx
cmp ebx, dword [ebp - 0x10]
jge 0x427f01
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x74]
cmp dword [ecx + edx*4], eax
je 0x427f01
xor edi, edi
inc edi
jmp 0x427f03
mov edi, eax
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x24]
sub edi, ecx
xor ecx, ecx
cmp edi, dword [edx + esi*4]
setle cl
or ebx, 0xffffffff
cmp ecx, ebx
jne 0x427f31
cmp dword [ebp - 0x34], eax
jne 0x427f31
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x74]
cmp dword [ecx + edx*4], eax
jne 0x427f31
mov ecx, eax
jmp 0x427f34
xor ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x14]
jns 0x427eb8
push 2
pop ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jle 0x427e54
mov edi, dword [ebp - 0x1c]
jmp 0x427f76
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x427f76
push eax
push 0x1031
push 0x41b
push eax
push 0xe2
push 0x54
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x74]
call fcn.004262f5
mov esi, dword [edi]
xor eax, eax
mov dword [ebp - 0x2c], 0xbca63185
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x427fac
push 0xe3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
xor eax, eax
xor ebx, ebx
mov byte [ebp - 9], al
inc ebx
cmp byte [ebp - 9], 0
je 0x427fc4
push eax
push eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
xor eax, eax
push 2
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
jmp 0x427fe0
mov ecx, dword [ebp - 0x24]
mov dword [ebp + ecx*4 - 0x54], 0x62d5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x427fd2
mov dword [ebp - 0x14], eax
jmp 0x427ff8
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x54], 0xf4f4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x427fea
cmp dword [ebp - 0x14], eax
je 0x428041
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x54], 0xee5a9864
mov ecx, dword [ebp - 0x54]
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setne bl
or edx, 0xffffffff
add ecx, ebx
imul ecx, ecx, 0x80db
sub edx, ecx
xor ecx, ecx
cmp edx, 0x45c1d102
setle cl
xor ebx, ebx
inc ebx
cmp ecx, dword [ebp - 0x54]
mov ecx, ebx
jne 0x428043
mov ecx, eax
mov eax, dword [ebp - 0x54]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xf7919adb
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
test esi, esi
jne 0x428139
cmp byte [ebp - 0x2d], 0
je 0x428085
cmp dword [ebp - 0x3c], ebx
mov ebx, dword [ebp - 0x18]
jne 0x428088
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x10]
add dword [ecx + 8], eax
jmp 0x428088
mov ebx, dword [ebp - 0x18]
mov eax, dword [edi + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 8]
add edi, 0xc
push ebx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x1c], edi
call fcn.0047e3a8
pop ecx
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x100]
lea eax, [ebp - 0xdc]
xor esi, esi
push eax
push ebx
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0xf8], esi
call fcn.00452610
mov edi, dword [ebp - 0x100]
mov ecx, esi
test ebx, ebx
jle 0x428121
mov eax, ecx
and eax, 0x80000001
jns 0x4280eb
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x2c]
add eax, ecx
imul eax, dword [ebp - 0x5c]
jmp 0x428100
lea eax, [edx + 1]
cdq
idiv ebx
cmp word [edi + edx*2], si
jne 0x4280fd
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov eax, dword [ebp - 0x1c]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x58]
mov byte [edx + ecx], al
inc ecx
cmp ecx, ebx
jl 0x4280dd
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x58]
mov dword [esi], ebx
mov dword [esi + 4], eax
test edi, edi
je 0x42813c
push edi
call fcn.00480d46
pop ecx
jmp 0x42813c
mov esi, dword [ebp + 8]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret