Function at 0x423591
Capabilities:
Accept command line arguments
Check os version
Contain obfuscated stackstrings
Get disk information
Identify system language via api
Parse pe header
Query or enumerate registry value
Query service status
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa88
push esi
mov dword [ebp - 0x98], 0xce125d16
mov dword [ebp - 0x120], 0
jmp 0x4235be
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x4235da
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x21c], 0
jmp 0x4235b1
mov dword [ebp - 0x98], 0
jmp 0x4235f3
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jg 0x423729
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x4b0], 0xffffffff
mov dword [ebp - 0x74], 0
jmp 0x423621
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jg 0x42364d
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x42364b
push 0xafb
push 0x1175
push 0
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x42361a
mov dword [ebp - 0x74], 0
jmp 0x42365d
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jg 0x423724
mov dword [ebp - 0x73c], 0xfffffffa
mov eax, dword [ebp - 0x98]
cmp dword [ebp + eax*4 - 0x21c], 0
jne 0x42368d
mov dword [ebp - 0x69c], 1
jmp 0x423694
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp + eax*4 - 0x21c], 0
jne 0x4236c0
mov dword [ebp - 0x4b0], 0x9d0
cmp dword [ebp - 0x4b0], 0
jne 0x4236c0
and dword [ebp - 0x6a4], 0
jmp 0x4236ca
mov dword [ebp - 0x6a4], 1
mov eax, dword [ebp - 0x69c]
cmp eax, dword [ebp - 0x6a4]
jl 0x4236e4
mov dword [ebp - 0x6ac], 1
jmp 0x4236eb
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp + eax*4 - 0x21c]
cmp dword [ebp - 0x6ac], eax
jg 0x42370c
mov dword [ebp - 0x6b4], 1
jmp 0x423713
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x73c], eax
jmp 0x423656
jmp 0x4235e6
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x423754
push 1
push 0x16fa
push 0x1a27
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
and dword [ebp - 0x28], 0
mov dword [ebp - 0x208], 0x5a654fdd
mov dword [ebp - 0x7a0], 1
mov dword [ebp - 0x284], 0xfe0091df
mov dword [ebp - 0x190], 0x83989226
mov dword [ebp - 0x798], 0
mov dword [ebp - 0x504], 0xc3d4e703
mov dword [ebp - 0x1d0], 0x38330377
mov dword [ebp - 0x1f8], 0xffffffff
mov dword [ebp - 0x6bc], 0xfffffff8
mov dword [ebp - 0x4f4], 9
push 2
lea ecx, [ebp - 0x840]
call fcn.0043492e
mov dword [ebp - 0x28c], 0xeae88378
mov dword [ebp - 0x7a8], 0x10f121ad
mov dword [ebp - 0x30], 0
jmp 0x4237ed
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x423803
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x9e4], 0x47cdedfc
jmp 0x4237e6
mov dword [ebp - 0x30], 0
jmp 0x423813
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x42382f
push dword [ebp - 0x30]
lea ecx, [ebp - 0x840]
call fcn.00434a1c
mov dword [eax], 1
jmp 0x42380c
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x208], eax
jge 0x423849
mov dword [ebp - 0x294], 1
jmp 0x423850
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x6bc]
inc eax
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x190], 0
je 0x4238a0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9e4]
dec eax
mov dword [ebp - 0x6c4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x6c4]
mov dword [ebp + eax - 0x9e4], ecx
cmp dword [ebp - 0x6c4], 0
je 0x4238a0
mov dword [ebp - 0x6cc], 1
jmp 0x4238a7
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 0x38e486ae
jl 0x4238bf
mov dword [ebp - 0x274], 1
jmp 0x4238c6
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x984], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0xa38], eax
or eax, 0xffffffff
jb 0x423904
cmp dword [ebp - 0x4f4], 0
je 0x423904
mov dword [ebp - 0x6d4], 1
jmp 0x42390b
and dword [ebp - 0x6d4], 0
mov esi, dword [ebp - 0x6d4]
sub esi, 5
push 0
lea ecx, [ebp - 0x840]
call fcn.00434a1c
cmp esi, dword [eax]
jl 0x423931
mov dword [ebp - 0x26c], 1
jmp 0x423938
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x26c], eax
jge 0x423952
mov dword [ebp - 0x4e4], 1
jmp 0x423959
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x98c], eax
push 0
lea ecx, [ebp - 0x840]
call fcn.00434a1c
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x910], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x918], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x920], eax
push 1
lea ecx, [ebp - 0x840]
call fcn.00434a1c
mov ecx, dword [ebp - 0x504]
cmp dword [eax], ecx
jl 0x4239d1
mov dword [ebp - 0x4ec], 1
jmp 0x4239d8
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x4ec]
je 0x4239f2
mov dword [ebp - 0x27c], 1
jmp 0x4239f9
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x4f4]
cmp dword [ebp - 0x284], eax
jge 0x423a1f
mov dword [ebp - 0x4fc], 1
jmp 0x423a26
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0x7a0]
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x928], eax
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x930], eax
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x190], eax
jne 0x423a64
mov dword [ebp - 0x50c], 1
jmp 0x423a6b
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x294]
cmp eax, dword [ebp - 0x50c]
je 0x423a85
mov dword [ebp - 0x29c], 1
jmp 0x423a8c
and dword [ebp - 0x29c], 0
cmp dword [ebp - 0x29c], 0
jne 0x423aa1
mov dword [ebp - 0x514], 1
jmp 0x423aa8
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x7a8], eax
lea ecx, [ebp - 0x840]
call fcn.00434a00
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x7e4], 5
mov dword [ebp - 0x554], 1
mov dword [ebp - 0x938], 1
mov dword [ebp - 0x7c4], 0xffffffff
mov dword [ebp - 0x7d4], 0xffffffff
mov dword [ebp - 0x7bc], 0x585b7f3
mov dword [ebp - 0x940], 0xb63e8e1b
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x948], 0
mov dword [ebp - 0x51c], 0xe94f934f
mov dword [ebp - 0x2bc], 6
mov dword [ebp - 0x534], 8
mov dword [ebp - 0x1d8], 6
mov dword [ebp - 0x1ac], 0x949f4ffc
mov dword [ebp - 0x180], 0xe93d0b54
mov dword [ebp - 0x7cc], 0x5f99
mov dword [ebp - 0x7dc], 0xfffffff9
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
je 0x423be8
cmp dword [ebp - 0x51c], 0
je 0x423bac
cmp dword [ebp - 0x7bc], 0
je 0x423bac
mov dword [ebp - 0x2a4], 1
jmp 0x423bb3
and dword [ebp - 0x2a4], 0
imul eax, dword [ebp - 0x2a4], 0xb7b8
cmp eax, 0xabff5ecc
je 0x423bd0
mov dword [ebp - 0x2ac], 1
jmp 0x423bd7
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x51c]
imul eax, dword [ebp - 0x2ac]
test eax, eax
jne 0x423bfa
cmp dword [ebp - 0x1ac], 0
jne 0x423bfa
and dword [ebp - 0x524], 0
jmp 0x423c04
mov dword [ebp - 0x524], 1
mov eax, dword [ebp - 0x7c4]
sub eax, dword [ebp - 0x524]
jne 0x423c24
cmp dword [ebp - 0x7cc], 0
jne 0x423c24
and dword [ebp - 0x2b4], 0
jmp 0x423c2e
mov dword [ebp - 0x2b4], 1
mov eax, dword [ebp - 0x180]
imul ecx, dword [ebp - 0x2b4], 0
sub eax, ecx
jne 0x423c5a
cmp dword [ebp - 0x2bc], 0
jne 0x423c5a
cmp dword [ebp - 0x554], 0
jne 0x423c5a
and dword [ebp - 0x52c], 0
jmp 0x423c64
mov dword [ebp - 0x52c], 1
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0x1ac], eax
jne 0x423c96
mov dword [ebp - 0x55c], 1
jmp 0x423c9d
and dword [ebp - 0x55c], 0
push 4
pop eax
test eax, eax
je 0x423cb9
cmp dword [ebp - 0x7dc], 0
je 0x423cb9
mov dword [ebp - 0x53c], 1
jmp 0x423cc0
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x53c], eax
jle 0x423cda
mov dword [ebp - 0x2cc], 1
jmp 0x423ce1
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0
je 0x423d0b
cmp dword [ebp - 0x7e4], 0
je 0x423d0b
mov dword [ebp - 0x2d4], 1
jmp 0x423d12
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x2d4], eax
jle 0x423d2c
mov dword [ebp - 0x54c], 1
jmp 0x423d33
and dword [ebp - 0x54c], 0
imul eax, dword [ebp - 0x54c], 0
imul eax, eax, 0xffffffff
cmp eax, dword [ebp - 0x1d8]
jge 0x423d51
mov dword [ebp - 0x2dc], 1
jmp 0x423d58
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x1ac]
cmp eax, dword [ebp - 0x2dc]
jne 0x423d72
mov dword [ebp - 0x2e4], 1
jmp 0x423d79
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x554]
cmp dword [ebp - 0x2e4], eax
je 0x423d93
mov dword [ebp - 0x2ec], 1
jmp 0x423d9a
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x55c]
imul eax, dword [ebp - 0x2ec]
test eax, eax
jne 0x423dbf
push 4
pop eax
test eax, eax
jne 0x423dbf
xor eax, eax
jne 0x423dbf
and dword [ebp - 0x564], 0
jmp 0x423dc9
mov dword [ebp - 0x564], 1
cmp dword [ebp - 0x564], 0x552ded14
jl 0x423de1
mov dword [ebp - 0x2f4], 1
jmp 0x423de8
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x2f4], eax
jle 0x423e02
mov dword [ebp - 0x56c], 1
jmp 0x423e09
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x58], 0xf94
mov dword [ebp - 0x134], 0
jmp 0x423e35
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x423e51
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x874], 1
jmp 0x423e28
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x874]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x58], 0
jmp 0x423e70
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jg 0x423f6f
mov eax, 0x92bd42ca
test eax, eax
je 0x423e9c
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x874], 0
je 0x423e9c
mov dword [ebp - 0x2fc], 1
jmp 0x423ea3
and dword [ebp - 0x2fc], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x2fc]
sub ecx, dword [ebp + eax - 0x874]
je 0x423ecd
mov eax, 0x9f6a
test eax, eax
je 0x423ecd
mov dword [ebp - 0x7ec], 1
jmp 0x423ed4
and dword [ebp - 0x7ec], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x874]
mov dword [ebp - 0x958], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x874]
mov dword [ebp - 0x960], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x874]
mov dword [ebp - 0x968], eax
mov eax, 0x9f58382b
cmp eax, 1
jbe 0x423f1f
mov dword [ebp - 0x574], 1
jmp 0x423f26
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 0
ja 0x423f3b
mov dword [ebp - 0x304], 1
jmp 0x423f42
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0x874], ecx
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x423f6a
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x423e69
push 1
lea ecx, [ebp - 0x260]
call fcn.0043492e
push 3
lea ecx, [ebp - 0x890]
call fcn.0043492e
mov dword [ebp - 0x218], 0xa0193208
mov dword [ebp - 0x174], 9
mov dword [ebp - 0x594], 0x4b082b00
mov dword [ebp - 0x8c0], 0xfffffff8
mov dword [ebp - 0x8bc], 0xfffffff8
mov dword [ebp - 0x8b8], 0xfffffff8
mov dword [ebp - 0x8b4], 0xfffffff8
lea ecx, [ebp - 0x211]
call fcn.00434a2b
push eax
lea eax, [ebp - 0x8b0]
push eax
lea eax, [ebp - 0x8c0]
push eax
lea ecx, [ebp - 0xa70]
call fcn.00434a2e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9f4]
call fcn.004349da
mov dword [ebp - 0x59c], 0
mov dword [ebp - 0x7fc], 0xfffffff6
mov dword [ebp - 0x810], 4
mov dword [ebp - 0x50], 0
jmp 0x424032
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x42404e
push dword [ebp - 0x50]
lea ecx, [ebp - 0x260]
call fcn.00434a1c
mov dword [eax], 0xd37ad435
jmp 0x42402b
mov dword [ebp - 0x50], 0
jmp 0x42405e
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x42407a
push dword [ebp - 0x50]
lea ecx, [ebp - 0x890]
call fcn.00434a1c
mov dword [eax], 0x489f
jmp 0x424057
push 0
lea ecx, [ebp - 0x260]
call fcn.00434a1c
cmp dword [eax], 0
jne 0x42416a
push 0
lea ecx, [ebp - 0x890]
call fcn.00434a1c
mov dword [eax], 0xec71cb27
push 0
lea ecx, [ebp - 0x260]
call fcn.00434a1c
mov eax, dword [eax]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x4240df
push 0
lea ecx, [ebp - 0x260]
call fcn.00434a1c
cmp dword [eax], 0
je 0x4240df
mov dword [ebp - 0x584], 1
jmp 0x4240e6
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
neg eax
je 0x424105
cmp dword [ebp - 0x218], 0
je 0x424105
mov dword [ebp - 0x30c], 1
jmp 0x42410c
and dword [ebp - 0x30c], 0
push 0
lea ecx, [ebp - 0x260]
call fcn.00434a1c
mov ecx, dword [ebp - 0x30c]
add ecx, dword [eax]
cmp ecx, 0x3005
jl 0x424135
mov dword [ebp - 0x58c], 1
jmp 0x42413c
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x58c], eax
jl 0x424157
push 0
lea ecx, [ebp - 0x260]
call fcn.00434a1c
mov eax, 0x71f0
cmp eax, 6
je 0x42416a
and dword [ebp - 0x314], 0
jmp 0x424174
mov dword [ebp - 0x314], 1
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x594]
imul eax, dword [ebp - 0x174]
neg eax
mov dword [ebp - 0x31c], eax
push 2
lea ecx, [ebp - 0x9f4]
call fcn.00434a1c
mov ecx, dword [ebp - 0x31c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x59c]
add eax, dword [ebp - 0x174]
cmp eax, 1
je 0x4241d3
mov dword [ebp - 0x324], 1
jmp 0x4241da
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
neg eax
je 0x424202
push 0
lea ecx, [ebp - 0x890]
call fcn.00434a1c
cmp dword [eax], 0
je 0x424202
mov dword [ebp - 0x5a4], 1
jmp 0x424209
and dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x5a4], 0xfc4b
jge 0x424221
mov dword [ebp - 0x32c], 1
jmp 0x424228
and dword [ebp - 0x32c], 0
mov esi, dword [ebp - 0x174]
imul esi, dword [ebp - 0x32c]
push 0
lea ecx, [ebp - 0x260]
call fcn.00434a1c
cmp esi, dword [eax]
jl 0x424252
mov dword [ebp - 0x5ac], 1
jmp 0x424259
and dword [ebp - 0x5ac], 0
push 0
lea ecx, [ebp - 0x260]
call fcn.00434a1c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5ac]
jne 0x424282
mov eax, 0x6daafd55
test eax, eax
jne 0x424282
and dword [ebp - 0x7f4], 0
jmp 0x42428c
mov dword [ebp - 0x7f4], 1
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0x970], eax
mov dword [ebp - 0x810], 9
lea ecx, [ebp - 0x9f4]
call fcn.00434a00
lea ecx, [ebp - 0x890]
call fcn.00434a00
lea ecx, [ebp - 0x260]
call fcn.00434a00
mov dword [ebp - 0x100], 0x4ec2e0cf
mov dword [ebp - 0x100], 0
jmp 0x4242e6
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xfffffff1
jge 0x424402
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x13c], 0
jmp 0x424316
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 4
jge 0x424332
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0xa60], 0x495e3b37
jmp 0x424309
mov eax, dword [ebp - 0x194]
neg eax
cmp dword [ebp - 0x194], eax
jg 0x42434e
mov dword [ebp - 0x5b4], 1
jmp 0x424355
and dword [ebp - 0x5b4], 0
xor eax, eax
jne 0x4243a7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa60], 0
je 0x424385
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa60], 0
je 0x424385
mov dword [ebp - 0x334], 1
jmp 0x42438c
and dword [ebp - 0x334], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x334]
sub ecx, dword [ebp + eax - 0xa60]
cmp ecx, dword [ebp - 0x100]
jge 0x4243bc
mov eax, 0xffff
test eax, eax
je 0x4243bc
mov dword [ebp - 0x33c], 1
jmp 0x4243c3
and dword [ebp - 0x33c], 0
imul eax, dword [ebp - 0x5b4], 0x5425
sub eax, dword [ebp - 0x33c]
imul eax, dword [ebp - 0x194]
test eax, eax
jne 0x4243ea
mov dword [ebp - 0x5bc], 1
jmp 0x4243f1
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x194], eax
jmp 0x4242d9
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x42442a
push 0
push 0
push 0x1ef5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0x144], 0
jmp 0x424456
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x424472
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x898], 0xfd5464b5
jmp 0x424449
mov dword [ebp - 0xdc], 0
jmp 0x42448b
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jg 0x4244b0
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [ebp + eax*4 - 0x898]
mov dword [ebp + ecx*4 - 0x898], eax
jmp 0x42447e
mov eax, dword [ebp - 0x1ec]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x424969
mov dword [ebp - 0x344], 1
mov dword [ebp - 0x14c], 0
push 3
lea ecx, [ebp - 0x6e4]
call fcn.0043492e
mov dword [ebp - 0x1a4], 0xffffffff
mov dword [ebp - 0x5dc], 0xfffffffd
mov dword [ebp - 0x17c], 0
jmp 0x424512
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jge 0x424534
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x6e4]
call fcn.00434a1c
mov dword [eax], 0x3111738a
jmp 0x424505
cmp dword [ebp - 0x344], 0
je 0x42462d
cmp dword [ebp - 0x14c], 0
je 0x424590
push 0
lea ecx, [ebp - 0x6e4]
call fcn.00434a1c
mov dword [ebp - 0x5c4], eax
push 2
lea ecx, [ebp - 0x6e4]
call fcn.00434a1c
mov ecx, dword [ebp - 0x5c4]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x344]
mov ecx, dword [ebp - 0x5c4]
add eax, dword [ecx]
je 0x424590
mov dword [ebp - 0x34c], 1
jmp 0x424597
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
neg eax
cmp eax, 1
je 0x4245b9
mov eax, 0xb583
test eax, eax
je 0x4245b9
mov dword [ebp - 0x5cc], 1
jmp 0x4245c0
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
cmp eax, dword [ebp - 0x5cc]
jle 0x4245e4
cmp dword [ebp - 0x14c], 0
je 0x42462d
mov dword [ebp - 0x818], 0xffffffff
push 1
lea ecx, [ebp - 0x6e4]
call fcn.00434a1c
mov eax, dword [eax]
mov dword [ebp - 0x818], eax
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x424628
push 0
push 0
push 0x1383
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x424785
mov dword [ebp - 0x154], 0xc28c
cmp dword [ebp - 0x14c], 0
je 0x424655
cmp dword [ebp - 0x154], 0
je 0x424655
mov dword [ebp - 0x354], 1
jmp 0x42465c
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x5dc]
cmp dword [ebp - 0x354], eax
jl 0x424676
mov dword [ebp - 0x364], 1
jmp 0x42467d
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x14c]
add eax, 0x5d598096
cmp eax, 0xffff
je 0x42469b
mov dword [ebp - 0x5d4], 1
jmp 0x4246a2
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x5d4], eax
jge 0x4246bc
mov dword [ebp - 0x35c], 1
jmp 0x4246c3
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x154]
imul eax, dword [ebp - 0x35c]
imul eax, dword [ebp - 0x5dc]
cmp dword [ebp - 0x364], eax
jge 0x4246eb
mov dword [ebp - 0x5e4], 1
jmp 0x4246f2
and dword [ebp - 0x5e4], 0
push 1
lea ecx, [ebp - 0x6e4]
call fcn.00434a1c
mov ecx, dword [ebp - 0x5e4]
cmp ecx, dword [eax]
jge 0x424724
push 2
lea ecx, [ebp - 0x6e4]
call fcn.00434a1c
cmp dword [eax], 0
jne 0x424724
and dword [ebp - 0x36c], 0
jmp 0x42472e
mov dword [ebp - 0x36c], 1
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x36c], eax
jge 0x424748
mov dword [ebp - 0x5ec], 1
jmp 0x42474f
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0x5ec]
je 0x424769
mov dword [ebp - 0x374], 1
jmp 0x424770
and dword [ebp - 0x374], 0
push 1
lea ecx, [ebp - 0x6e4]
call fcn.00434a1c
mov ecx, dword [ebp - 0x374]
mov dword [eax], ecx
lea ecx, [ebp - 0x6e4]
call fcn.00434a00
mov dword [ebp - 0x820], 0xd9ba07e4
mov dword [ebp - 0x978], 0
mov dword [ebp - 0x980], 0xffffffff
mov dword [ebp - 0x988], 0x8cf4c59c
mov dword [ebp - 0x828], 0xfffffffa
mov dword [ebp - 0x200], 1
mov dword [ebp - 0x830], 0xfffffffd
mov dword [ebp - 0x60c], 1
mov dword [ebp - 0x990], 0x6b8d9637
mov dword [ebp - 0x99c], 0xccb97252
mov dword [ebp - 0x9ac], 1
mov dword [ebp - 0x9b4], 1
mov dword [ebp - 0x1e0], 0x3ccd2466
mov dword [ebp - 0x5f4], 0xfffffff6
mov dword [ebp - 0x9bc], 0x93e623b4
mov dword [ebp - 0x614], 0xfffffff9
mov dword [ebp - 0x790], 0x77
cmp dword [ebp - 0x820], 0
mov dword [ebp - 0x200], 1
mov dword [ebp - 0x5f4], 1
cmp dword [ebp - 0x5f4], 0
je 0x4248ca
mov eax, dword [ebp - 0x828]
mov dword [ebp - 0x9c4], eax
cmp dword [ebp - 0x830], 0
je 0x424885
cmp dword [ebp - 0x200], 0
je 0x424885
and dword [ebp - 0x37c], 0
jmp 0x42488f
mov dword [ebp - 0x37c], 1
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x37c], eax
jge 0x4248a9
mov dword [ebp - 0x5fc], 1
jmp 0x4248b0
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x614]
cmp dword [ebp - 0x5fc], eax
jne 0x4248ca
mov dword [ebp - 0x384], 1
jmp 0x4248d1
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 0x6cc72b75
jne 0x4248e9
mov dword [ebp - 0x604], 1
jmp 0x4248f0
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 0x390f3bd7
jg 0x424908
mov dword [ebp - 0x38c], 1
jmp 0x42490f
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x60c]
mov ecx, dword [ebp - 0x1e0]
lea eax, [eax + ecx + 0x122d800f]
cmp eax, dword [ebp - 0x1e0]
jne 0x424942
mov dword [ebp - 0x394], 1
jmp 0x424949
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x200], eax
xor eax, eax
jmp 0x428390
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0x14], 1
push 1
lea ecx, [ebp - 0x738]
call fcn.0043492e
mov dword [ebp - 0x48], 0
jmp 0x424997
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x4249ad
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x110], 0x4e2db58
jmp 0x424990
mov dword [ebp - 0x48], 0
jmp 0x4249bd
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x4249d9
push dword [ebp - 0x48]
lea ecx, [ebp - 0x738]
call fcn.00434a1c
mov dword [eax], 0xfffffffe
jmp 0x4249b6
mov dword [ebp - 0xe4], 0
jmp 0x4249f2
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jg 0x424c29
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x74c], 0xb1b0cadf
mov dword [ebp - 0x84], 0
jmp 0x424a2c
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jg 0x424c24
mov dword [ebp - 0x3c], 0xffff
mov dword [ebp - 0xf4], 0xfffffff9
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
inc ecx
mov dword [ebp - 0x3c], ecx
test eax, eax
je 0x424acb
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp + eax*4 - 0x110]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x84]
jne 0x424a85
cmp dword [ebp - 0xf4], 0
jne 0x424a85
and dword [ebp - 0x39c], 0
jmp 0x424a8f
mov dword [ebp - 0x39c], 1
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x39c], eax
jg 0x424aa9
mov dword [ebp - 0x61c], 1
jmp 0x424ab0
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
neg eax
cmp eax, 0x74a52027
jg 0x424acb
mov dword [ebp - 0x760], 1
jmp 0x424ad2
and dword [ebp - 0x760], 0
push 0
lea ecx, [ebp - 0x738]
call fcn.00434a1c
push 0
lea ecx, [ebp - 0x738]
call fcn.00434a1c
mov ecx, dword [ebp - 0x84]
cmp dword [eax], ecx
je 0x424b03
push 0
lea ecx, [ebp - 0x738]
call fcn.00434a1c
cmp dword [ebp - 0x74c], 0x6de6
jg 0x424b1b
mov dword [ebp - 0x3a4], 1
jmp 0x424b22
and dword [ebp - 0x3a4], 0
cmp dword [ebp - 0x3a4], 6
jbe 0x424b37
mov dword [ebp - 0x624], 1
jmp 0x424b3e
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp + eax*4 - 0x110]
cmp eax, dword [ebp - 0x624]
je 0x424b69
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x110], 0
jmp 0x424c1f
mov dword [ebp - 0x14], 0
jmp 0x424b79
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1a
je 0x424c05
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x424ba7
push 0x1aff
push 0x49b
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
mov dword [ebp - 0x3c], 0
jmp 0x424bb7
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jg 0x424c00
mov dword [ebp - 0xf4], 0
jmp 0x424bd6
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jg 0x424bfe
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x110], 0xfffffff6
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x110], 0
je 0x424bfc
jmp 0x424bfe
jmp 0x424bc9
jmp 0x424bb0
jmp 0x424b72
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x424c1f
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x424a1f
jmp 0x4249e5
mov dword [ebp - 0x14], 0
jmp 0x424c39
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x424c55
push dword [ebp - 0x14]
lea ecx, [ebp - 0x738]
call fcn.00434a1c
mov dword [eax], 9
jmp 0x424c32
lea ecx, [ebp - 0x738]
call fcn.00434a00
mov eax, dword [ebp - 0x1ec]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x104], ecx
push 3
lea ecx, [ebp - 0x234]
call fcn.0043492e
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x644], 0x97440271
mov dword [ebp - 0x3d4], 0x27e80a7c
mov dword [ebp - 0x754], 0xfffffffe
mov dword [ebp - 0x184], 0
jmp 0x424cbd
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jge 0x424cdf
push dword [ebp - 0x184]
lea ecx, [ebp - 0x234]
call fcn.00434a1c
mov dword [eax], 6
jmp 0x424cb0
mov dword [ebp - 0x1c], 0
jmp 0x424cef
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x424f38
mov dword [ebp - 0x654], 0xffffffff
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x234]
call fcn.00434a1c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x234]
call fcn.00434a1c
cmp dword [eax], 1
jge 0x424d30
mov dword [ebp - 0x3ac], 1
jmp 0x424d37
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x654], eax
push 5
pop eax
cmp eax, 0xfffffffa
je 0x424d57
mov dword [ebp - 0x62c], 1
jmp 0x424d5e
and dword [ebp - 0x62c], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x234]
call fcn.00434a1c
mov ecx, dword [ebp - 0x62c]
cmp ecx, dword [eax]
jge 0x424d82
mov dword [ebp - 0x3b4], 1
jmp 0x424d89
and dword [ebp - 0x3b4], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x234]
call fcn.00434a1c
mov esi, dword [ebp - 0x3b4]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x234]
call fcn.00434a1c
cmp esi, dword [eax]
jl 0x424dbc
mov dword [ebp - 0x634], 1
jmp 0x424dc3
and dword [ebp - 0x634], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x234]
call fcn.00434a1c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x634]
jl 0x424de7
mov dword [ebp - 0x3bc], 1
jmp 0x424dee
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x3bc], eax
jg 0x424e05
mov dword [ebp - 0x63c], 1
jmp 0x424e0c
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 0xffff
jbe 0x424e2a
mov eax, 0x4cff15cc
test eax, eax
jne 0x424e2a
and dword [ebp - 0x3c4], 0
jmp 0x424e34
mov dword [ebp - 0x3c4], 1
mov esi, dword [ebp - 0x3c4]
sub esi, dword [ebp - 0x644]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x234]
call fcn.00434a1c
imul esi, dword [eax]
test esi, esi
jne 0x424e65
push 0xfffffffffffffffc
pop eax
test eax, eax
jne 0x424e65
and dword [ebp - 0x3cc], 0
jmp 0x424e6f
mov dword [ebp - 0x3cc], 1
mov eax, dword [ebp - 0x644]
cmp dword [ebp - 0x3cc], eax
jne 0x424e89
mov dword [ebp - 0x64c], 1
jmp 0x424e90
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0xfffffffd
jl 0x424eb1
mov dword [ebp - 0x7d0], 1
jmp 0x424eb8
and dword [ebp - 0x7d0], 0
push 0
lea ecx, [ebp - 0x234]
call fcn.00434a1c
cmp dword [ebp - 0x654], 0
jne 0x424edb
xor eax, eax
jne 0x424edb
and dword [ebp - 0x3dc], 0
jmp 0x424ee5
mov dword [ebp - 0x3dc], 1
cmp dword [ebp - 0x3dc], 0xf4a1
jg 0x424efd
mov dword [ebp - 0x65c], 1
jmp 0x424f04
and dword [ebp - 0x65c], 0
cmp dword [ebp - 0x65c], 2
jl 0x424f19
mov dword [ebp - 0x3e4], 1
jmp 0x424f20
and dword [ebp - 0x3e4], 0
imul eax, dword [ebp - 0x3e4], 0xffff
imul eax, eax, 9
mov dword [ebp - 0x754], eax
jmp 0x424ce8
lea ecx, [ebp - 0x234]
call fcn.00434a00
mov eax, dword [ebp - 0x104]
cmp dword [eax], 0x4550
je 0x425351
push 1
lea ecx, [ebp - 0x580]
call fcn.0043492e
mov dword [ebp - 0x6c], 0x3838a1f9
mov dword [ebp - 0x404], 0xbfc3938d
mov dword [ebp - 0xa0], 0xad81
mov dword [ebp - 0x7c], 0xfffffff8
mov dword [ebp - 0x3fc], 0xc422d5fb
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0x15c], 0
jmp 0x424fb1
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jge 0x424fd0
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x580]
call fcn.00434a1c
and dword [eax], 0
jmp 0x424fa4
mov dword [ebp - 0x6c], 0
jmp 0x424fe0
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x424ffd
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x580]
call fcn.00434a1c
cmp dword [eax], 0
je 0x424ffb
jmp 0x424ffd
jmp 0x424fd9
cmp dword [ebp - 0xa0], 0
je 0x425034
push 0
lea ecx, [ebp - 0x580]
call fcn.00434a1c
mov esi, eax
push 0
lea ecx, [ebp - 0x580]
call fcn.00434a1c
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x425034
mov dword [ebp - 0x664], 1
jmp 0x42503b
and dword [ebp - 0x664], 0
push 0
lea ecx, [ebp - 0x580]
call fcn.00434a1c
cmp dword [eax], 0xffff
jb 0x42505c
mov dword [ebp - 0x3ec], 1
jmp 0x425063
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x664]
cmp eax, dword [ebp - 0x3ec]
jl 0x42507d
mov dword [ebp - 0x66c], 1
jmp 0x425084
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x66c], eax
jne 0x42509e
mov dword [ebp - 0x3f4], 1
jmp 0x4250a5
and dword [ebp - 0x3f4], 0
imul eax, dword [ebp - 0x3f4], 0x5d7
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jl 0x4250c4
mov dword [ebp - 0x674], 1
jmp 0x4250cb
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x674]
sub eax, 0x4fe74bff
imul eax, eax, 0x6a9d
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0xc2f5a260
je 0x425100
mov eax, 0x281c
test eax, eax
jne 0x425100
and dword [ebp - 0x67c], 0
jmp 0x42510a
mov dword [ebp - 0x67c], 1
cmp dword [ebp - 0x67c], 0x5d840dfe
jle 0x425127
xor eax, eax
inc eax
je 0x425127
mov dword [ebp - 0x81c], 1
jmp 0x42512e
and dword [ebp - 0x81c], 0
mov dword [ebp - 0x6c], 1
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x9cc], eax
cmp dword [ebp - 0x7c], 0
jne 0x425156
cmp dword [ebp - 0x7c], 0
je 0x425197
mov dword [ebp - 0x75c], 7
mov dword [ebp - 0x7d8], 0x2cd8491f
cmp dword [ebp - 0x75c], 0xffffffff
jg 0x42517f
mov dword [ebp - 0x684], 1
jmp 0x425186
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x7d8], eax
jmp 0x42533f
mov dword [ebp - 0x5c], 5
mov dword [ebp - 0x42c], 0xffffffff
mov dword [ebp - 0xa0], 0
jmp 0x4251c1
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xffffffe7
je 0x4252c0
mov dword [ebp - 0x1e8], 3
mov eax, dword [ebp - 0x5c]
add eax, 0x41892350
je 0x42525d
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0xf8], eax
jge 0x4251fc
mov dword [ebp - 0x40c], 1
jmp 0x425203
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x40c], eax
jge 0x42521d
mov dword [ebp - 0x68c], 1
jmp 0x425224
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x68c], eax
jne 0x42523e
mov dword [ebp - 0x694], 1
jmp 0x425245
and dword [ebp - 0x694], 0
cmp dword [ebp - 0x694], 0x6c2d
jge 0x42525d
mov dword [ebp - 0x414], 1
jmp 0x425264
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x5c]
lea eax, [eax + ecx + 0x455628f9]
cmp eax, 0x47a0585c
jl 0x425293
mov dword [ebp - 0x420], 1
jmp 0x42529a
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x420]
sub eax, dword [ebp - 0x5c]
jne 0x4252b2
push 0
lea ecx, [ebp - 0x580]
call fcn.00434a1c
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x6c], eax
jmp 0x4251b4
mov dword [ebp - 0xf8], 5
jmp 0x4252d9
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 7
jne 0x42533f
mov dword [ebp - 0x630], 0xf624
mov eax, dword [ebp - 0x630]
dec eax
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x7c], 0
jmp 0x425309
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jg 0x42533d
mov dword [ebp - 0x5c], 0
jmp 0x42531f
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x42533b
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x580]
call fcn.00434a1c
mov dword [eax], 7
jmp 0x425318
jmp 0x425302
jmp 0x4252cc
lea ecx, [ebp - 0x580]
call fcn.00434a00
xor eax, eax
jmp 0x428390
mov dword [ebp - 0x80c], 0xb3ae3556
mov dword [ebp - 0x808], 0xb3ae3556
mov dword [ebp - 0x804], 0xb3ae3556
mov dword [ebp - 0x800], 0xb3ae3556
mov dword [ebp - 0x9d4], 0xfffffffb
mov dword [ebp - 0xa3c], 0xfffffffc
mov dword [ebp - 0xa44], 0x46a1c17c
mov dword [ebp - 0x90c], 0
mov dword [ebp - 0x764], 0xdc0e3e76
mov dword [ebp - 0xa68], 0xade661fb
mov dword [ebp - 0x7e0], 0
mov dword [ebp - 0x9a8], 0x7cba
push 2
lea ecx, [ebp - 0x8d8]
call fcn.0043492e
mov dword [ebp - 0x8ac], 0x30045702
mov dword [ebp - 0x8a8], 0x30045702
mov dword [ebp - 0x8a4], 0x30045702
mov dword [ebp - 0x8a0], 0x30045702
lea ecx, [ebp - 0x1ed]
call fcn.00434a2b
push eax
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0x8ac]
push eax
lea ecx, [ebp - 0xa78]
call fcn.00434a2e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa04]
call fcn.004349da
mov dword [ebp - 0x19c], 0
jmp 0x42544c
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x42546e
push dword [ebp - 0x19c]
lea ecx, [ebp - 0x8d8]
call fcn.00434a1c
mov dword [eax], 0xa3062a4b
jmp 0x42543f
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x80c], 0x13
jmp 0x42549c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x80c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x80c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x80c], 0xfffffffd
jne 0x4256f1
push 3
lea ecx, [ebp - 0x8cc]
call fcn.0043492e
mov dword [ebp - 0x824], 1
mov dword [ebp - 0x44], 0
jmp 0x4254d7
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x4254ed
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x254], 1
jmp 0x4254d0
mov dword [ebp - 0x44], 0
jmp 0x4254fd
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x425519
push dword [ebp - 0x44]
lea ecx, [ebp - 0x8cc]
call fcn.00434a1c
mov dword [eax], 0xfffffffa
jmp 0x4254f6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x254], 0x1b
jmp 0x425547
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x254]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x254], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x254], 0xffffffea
je 0x4256e1
mov dword [ebp - 0x914], 5
mov dword [ebp - 0x590], 0xce456251
mov dword [ebp - 0x76c], 3
mov dword [ebp - 0x774], 0xf072
mov dword [ebp - 0x844], 6
mov dword [ebp - 0x164], 0
jmp 0x4255a6
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 4
jge 0x4255c2
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0xa88], 0x67c28cae
jmp 0x425599
push 2
lea ecx, [ebp - 0xa04]
call fcn.00434a1c
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x428]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x428]
mov dword [ecx], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0xa64], eax
push 1
lea ecx, [ebp - 0x8cc]
call fcn.00434a1c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x254]
cmp dword [ebp - 0x844], eax
jle 0x425620
mov dword [ebp - 0x588], 1
jmp 0x425627
and dword [ebp - 0x588], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x254]
cmp dword [ebp - 0x588], eax
jle 0x425645
cmp dword [ebp - 0x76c], 0
jne 0x425657
cmp dword [ebp - 0x7e0], 0
jne 0x425657
and dword [ebp - 0x430], 0
jmp 0x425661
mov dword [ebp - 0x430], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa88]
mov ecx, dword [ebp - 0x590]
add ecx, dword [ebp - 0x430]
add ecx, dword [ebp - 0x774]
add eax, ecx
cmp eax, 0x504e
je 0x425695
mov dword [ebp - 0x688], 1
jmp 0x42569c
and dword [ebp - 0x688], 0
push 0
lea ecx, [ebp - 0x8d8]
call fcn.00434a1c
mov ecx, dword [ebp - 0x688]
cmp ecx, dword [eax]
jne 0x4256bf
mov dword [ebp - 0x438], 1
jmp 0x4256c6
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x590], eax
mov dword [ebp - 0x824], 0xffffffff
jmp 0x42552c
lea ecx, [ebp - 0x8cc]
call fcn.00434a00
jmp 0x425481
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x425709
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
lea ecx, [ebp - 0xa04]
call fcn.00434a00
lea ecx, [ebp - 0x8d8]
call fcn.00434a00
push 1
push 1
push dword [ebp - 0x104]
push 1
push 0x3c99
lea eax, [ebp - 0x158]
push eax
push 0x1695
call fcn.0041b2da
add esp, 0x1c
mov dword [ebp - 0x60], 0xd29be1d9
push 1
lea ecx, [ebp - 0x240]
call fcn.0043492e
mov dword [ebp - 0x18c], 0
push 3
lea ecx, [ebp - 0x708]
call fcn.0043492e
mov dword [ebp - 0x5a0], 0x31af6658
mov dword [ebp - 0x470], 1
mov dword [ebp - 0x648], 1
mov dword [ebp - 0x5b8], 0xe7a4860c
push 4
lea ecx, [ebp - 0x8f0]
call fcn.0043492e
mov dword [ebp - 4], 0
jmp 0x4257b4
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x4257d0
push dword [ebp - 4]
lea ecx, [ebp - 0x240]
call fcn.00434a1c
mov dword [eax], 1
jmp 0x4257ad
mov dword [ebp - 4], 0
jmp 0x4257e0
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x4257fc
push dword [ebp - 4]
lea ecx, [ebp - 0x708]
call fcn.00434a1c
mov dword [eax], 0x9ba87a5
jmp 0x4257d9
mov dword [ebp - 4], 0
jmp 0x42580c
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x425822
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1c4], 0xfffffff8
jmp 0x425805
mov dword [ebp - 4], 0
jmp 0x425832
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x42584e
push dword [ebp - 4]
lea ecx, [ebp - 0x8f0]
call fcn.00434a1c
mov dword [eax], 0xa3f0bde8
jmp 0x42582b
push 0
lea ecx, [ebp - 0x240]
call fcn.00434a1c
cmp dword [eax], 0
je 0x425875
mov eax, 0x6b8d9637
test eax, eax
je 0x425875
mov dword [ebp - 0x440], 1
jmp 0x42587c
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jne 0x4258ac
push 0
lea ecx, [ebp - 0x240]
call fcn.00434a1c
cmp dword [eax], 0
jne 0x4258ac
and dword [ebp - 0x638], 0
jmp 0x4258b6
mov dword [ebp - 0x638], 1
push 0
lea ecx, [ebp - 0x240]
call fcn.00434a1c
mov esi, dword [eax]
sub esi, dword [ebp - 0x638]
push 0
lea ecx, [ebp - 0x240]
call fcn.00434a1c
cmp esi, dword [eax]
jg 0x4258e8
mov dword [ebp - 0x448], 1
jmp 0x4258ef
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x448]
jge 0x425906
mov dword [ebp - 0x598], 1
jmp 0x42590d
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x598], eax
jge 0x425924
mov dword [ebp - 0x450], 1
jmp 0x42592b
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x450]
lea eax, [eax + ecx + 0x6000ed0d]
cmp eax, 1
jne 0x42594c
mov dword [ebp - 0x6c8], 1
jmp 0x425953
and dword [ebp - 0x6c8], 0
push 2
lea ecx, [ebp - 0x708]
call fcn.00434a1c
mov ecx, dword [ebp - 0x6c8]
cmp ecx, dword [eax]
je 0x425976
mov dword [ebp - 0x210], 1
jmp 0x42597d
and dword [ebp - 0x210], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x210]
mov dword [ebp + eax - 0x1c4], ecx
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x210]
jg 0x4259a7
mov dword [ebp - 0x458], 1
jmp 0x4259ae
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x18c], 8
cmp dword [ebp - 0x18c], 0
je 0x4259f7
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x5a0], 0
jne 0x4259f7
push 2
lea ecx, [ebp - 0x708]
call fcn.00434a1c
cmp dword [eax], 0
jne 0x4259f7
and dword [ebp - 0x460], 0
jmp 0x425a01
mov dword [ebp - 0x460], 1
push 0
lea ecx, [ebp - 0x240]
call fcn.00434a1c
mov eax, dword [eax]
mov ecx, dword [ebp - 0x460]
lea esi, [ecx + eax + 9]
push 0
lea ecx, [ebp - 0x240]
call fcn.00434a1c
cmp esi, dword [eax]
jge 0x425a37
mov dword [ebp - 0x640], 1
jmp 0x425a3e
and dword [ebp - 0x640], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c4]
cmp eax, dword [ebp - 0x640]
jle 0x425a5f
mov dword [ebp - 0x468], 1
jmp 0x425a66
and dword [ebp - 0x468], 0
mov esi, dword [ebp - 0x468]
neg esi
push 0
lea ecx, [ebp - 0x240]
call fcn.00434a1c
cmp esi, dword [eax]
jg 0x425a8b
mov dword [ebp - 0x5a8], 1
jmp 0x425a92
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x470], eax
mov esi, dword [ebp - 0x470]
push 2
lea ecx, [ebp - 0x708]
call fcn.00434a1c
cmp esi, dword [eax]
jg 0x425ac1
mov dword [ebp - 0x690], 1
jmp 0x425ac8
and dword [ebp - 0x690], 0
push 0
lea ecx, [ebp - 0x708]
call fcn.00434a1c
mov ecx, dword [ebp - 0x690]
cmp ecx, dword [eax]
jge 0x425aeb
mov dword [ebp - 0x478], 1
jmp 0x425af2
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x1c4]
test eax, eax
jle 0x425b1c
mov dword [ebp - 0x5b0], 1
jmp 0x425b23
and dword [ebp - 0x5b0], 0
cmp dword [ebp - 0x5b0], 0xd8e1
jl 0x425b3b
mov dword [ebp - 0x1c8], 1
jmp 0x425b42
and dword [ebp - 0x1c8], 0
push 2
lea ecx, [ebp - 0x708]
call fcn.00434a1c
mov ecx, dword [ebp - 0x1c8]
mov dword [eax], ecx
cmp dword [ebp - 0x1c8], 0
jne 0x425b6c
mov dword [ebp - 0x480], 1
jmp 0x425b73
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 0xa9f4f9a
jle 0x425b97
mov dword [ebp - 0x488], 1
jmp 0x425b9e
and dword [ebp - 0x488], 0
push 0
lea ecx, [ebp - 0x240]
call fcn.00434a1c
mov eax, dword [eax]
sub eax, dword [ebp - 0x488]
mov dword [ebp - 0x5b8], eax
mov esi, dword [ebp - 0x5b8]
push 1
lea ecx, [ebp - 0x8f0]
call fcn.00434a1c
mov dword [eax], esi
lea ecx, [ebp - 0x8f0]
call fcn.00434a00
lea ecx, [ebp - 0x708]
call fcn.00434a00
lea ecx, [ebp - 0x240]
call fcn.00434a00
cmp dword [ebp - 0x158], 0
jne 0x426087
mov dword [ebp - 0xfc], 0xf76ec751
mov dword [ebp - 0x77c], 0xb168f92
mov dword [ebp - 0xec], 0xffffffff
push 1
lea ecx, [ebp - 0x8fc]
call fcn.0043492e
mov dword [ebp - 0x5c0], 0xda7209c3
mov dword [ebp - 0x698], 0x4cc511ec
mov dword [ebp - 0x16c], 0
jmp 0x425c54
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x425c76
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x8fc]
call fcn.00434a1c
mov dword [eax], 1
jmp 0x425c47
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xfc], eax
jl 0x425c9c
mov dword [ebp - 0x490], 1
jmp 0x425ca3
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x77c]
cmp dword [ebp - 0x490], eax
jne 0x425cbd
mov dword [ebp - 0x6b8], 1
jmp 0x425cc4
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0x6b8]
jne 0x425ced
push 0
lea ecx, [ebp - 0x8fc]
call fcn.00434a1c
cmp dword [eax], 0
jne 0x425ced
and dword [ebp - 0x498], 0
jmp 0x425cf7
mov dword [ebp - 0x498], 1
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 0
jne 0x425d18
mov dword [ebp - 0x4a0], 1
jmp 0x425d1f
and dword [ebp - 0x4a0], 0
cmp dword [ebp - 0x4a0], 0x9b3
je 0x425d37
mov dword [ebp - 0x650], 1
jmp 0x425d3e
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x650], eax
jge 0x425d58
mov dword [ebp - 0x4a8], 1
jmp 0x425d5f
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0x6c9
jge 0x425d7d
cmp dword [ebp - 0xec], 0
jne 0x425d7d
and dword [ebp - 0x5c8], 0
jmp 0x425d87
mov dword [ebp - 0x5c8], 1
imul eax, dword [ebp - 0x5c8], 0xfff9
cmp eax, dword [ebp - 0xfc]
je 0x425dae
cmp dword [ebp - 0xfc], 0
je 0x425dae
mov dword [ebp - 0x264], 1
jmp 0x425db5
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 0
je 0x425de4
cmp dword [ebp - 0xec], 0
je 0x425de4
xor eax, eax
inc eax
je 0x425de4
mov dword [ebp - 0x4b8], 1
jmp 0x425deb
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x4b8], eax
je 0x425e05
mov dword [ebp - 0x5d0], 1
jmp 0x425e0c
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0xec], eax
lea ecx, [ebp - 0x8fc]
call fcn.00434a00
mov dword [ebp - 0x68], 0xbac64a68
mov dword [ebp - 0x4c0], 0xf9dbc9b7
mov dword [ebp - 0x784], 0xfffffffc
mov dword [ebp - 0x68], 9
jmp 0x425e4e
cmp dword [ebp - 0x68], 0xf
jl 0x426061
mov dword [ebp - 0x1d4], 1
mov dword [ebp - 0x128], 0x30a4ccfd
mov dword [ebp - 0x1cc], 0xc0d133f2
mov dword [ebp - 0x7e8], 0xfffffff7
mov dword [ebp - 0x1cc], 0xfffffffb
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x9b0], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x924], eax
mov dword [ebp - 0x4c0], 0x401d
mov eax, dword [ebp - 0x4c0]
cmp dword [ebp - 0x128], eax
jl 0x425ec3
mov dword [ebp - 0x658], 1
jmp 0x425eca
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x658]
jle 0x425ee4
mov dword [ebp - 0x4c8], 1
jmp 0x425eeb
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x4c8], eax
jl 0x425f05
mov dword [ebp - 0x5d8], 1
jmp 0x425f0c
and dword [ebp - 0x5d8], 0
cmp dword [ebp - 0x5d8], 0x84868fda
jae 0x425f24
mov dword [ebp - 0x4d0], 1
jmp 0x425f2b
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x1d4]
add eax, dword [ebp - 0x4d0]
je 0x425f4e
cmp dword [ebp - 0x1cc], 0
je 0x425f4e
mov dword [ebp - 0x6d8], 1
jmp 0x425f55
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x6d8]
dec eax
cmp eax, 0x8f73
je 0x425f6f
mov dword [ebp - 0x4d8], 1
jmp 0x425f76
and dword [ebp - 0x4d8], 0
cmp dword [ebp - 0x4d8], 0x2daa
je 0x425f8e
mov dword [ebp - 0x5e0], 1
jmp 0x425f95
and dword [ebp - 0x5e0], 0
cmp dword [ebp - 0x5e0], 0x5950
jge 0x425faa
mov eax, 0x24f63abe
test eax, eax
je 0x425fc2
cmp dword [ebp - 0x68], 0
je 0x425fc2
cmp dword [ebp - 0x68], 0
je 0x425fc2
mov dword [ebp - 0x4e0], 1
jmp 0x425fc9
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x4e0], eax
je 0x425fe3
mov dword [ebp - 0x660], 1
jmp 0x425fea
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x7e8]
cmp dword [ebp - 0x660], eax
jg 0x426004
mov dword [ebp - 0x4e8], 1
jmp 0x42600b
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x4e8], eax
jl 0x426025
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x426080
push 0x856
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
xor eax, eax
jmp 0x428390
mov dword [ebp - 0xe0], 9
mov dword [ebp - 0x6a0], 1
mov dword [ebp - 0xe0], 0
jmp 0x4260b4
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 5
je 0x4261ee
mov dword [ebp - 0x1e4], 0xe9c96c79
mov dword [ebp - 0x1dc], 0xffffffff
push 4
lea ecx, [ebp - 0x908]
call fcn.0043492e
mov dword [ebp - 0x130], 0
jmp 0x4260fb
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 4
jge 0x42611d
push dword [ebp - 0x130]
lea ecx, [ebp - 0x908]
call fcn.00434a1c
mov dword [eax], 1
jmp 0x4260ee
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x6a0], eax
mov dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x1e4], eax
jge 0x42614d
mov dword [ebp - 0x4f8], 1
jmp 0x426154
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x6a0], 0
jle 0x426169
mov dword [ebp - 0x5f0], 1
jmp 0x426170
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x4f8]
cmp eax, dword [ebp - 0x5f0]
jle 0x42618a
mov dword [ebp - 0x500], 1
jmp 0x426191
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x1dc]
imul eax, dword [ebp - 0x500]
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1e4], 0
jne 0x4261bf
cmp dword [ebp - 0xe0], 0
jne 0x4261bf
and dword [ebp - 0x668], 0
jmp 0x4261c9
mov dword [ebp - 0x668], 1
push 0
lea ecx, [ebp - 0x908]
call fcn.00434a1c
mov ecx, dword [ebp - 0x668]
mov dword [eax], ecx
lea ecx, [ebp - 0x908]
call fcn.00434a00
jmp 0x4260a7
push 0x2f8
push 1
lea eax, [ebp - 0x28]
push eax
push 0x53f4
push 0x6c69
push 1
push dword [ebp - 0x1ec]
push dword [ebp - 0x104]
push 1
push 0x71bb
lea eax, [ebp - 0x158]
push eax
push 0x10da
lea eax, [ebp - 0xa08]
push eax
push 0x6fe5
call fcn.00421de1
add esp, 0x38
mov dword [ebp - 0x78c], 0
mov dword [ebp - 0x138], 0
jmp 0x42625b
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x426277
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x1c0], 0xfe1ca29
jmp 0x42624e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1c0], 0x6e87
jne 0x426296
mov dword [ebp - 0x510], 1
jmp 0x42629d
and dword [ebp - 0x510], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1c0], 0xffffffff
jne 0x4262b9
mov dword [ebp - 0x864], 1
jmp 0x4262c0
and dword [ebp - 0x864], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c0]
mov dword [ebp - 0x92c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1c0]
cmp dword [ebp + eax - 0x1c0], ecx
je 0x4262fb
mov dword [ebp - 0x508], 1
jmp 0x426302
and dword [ebp - 0x508], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c0]
cmp eax, dword [ebp - 0x508]
je 0x426323
mov dword [ebp - 0x5f8], 1
jmp 0x42632a
and dword [ebp - 0x5f8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c0]
cmp dword [ebp - 0x5f8], eax
jle 0x42634b
mov dword [ebp - 0x6c0], 1
jmp 0x426352
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x510]
imul eax, dword [ebp - 0x6c0]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1c0]
jge 0x42637a
mov dword [ebp - 0x518], 1
jmp 0x426381
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x78c], eax
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x4263a9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1b86
push 0
push 1
push 0x28ec
push dword [ebp + 8]
push 0x39d0
push 1
push dword [ebp - 0x104]
push dword [ebp - 0x28]
push 0
call fcn.0040d782
add esp, 0x28
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x140], 0
jmp 0x4263f4
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x426410
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x9b8], 0xc0ae9714
jmp 0x4263e7
mov dword [ebp - 0x70], 0
jmp 0x426420
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jg 0x42648a
mov dword [ebp - 0x148], 1
mov dword [ebp - 0x148], 0
jmp 0x426449
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jl 0x426488
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x426486
push 0x32
push 0
push 0x1a53
push 0x16ed
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x42643c
jmp 0x426419
mov dword [ebp - 0x70], 0
jmp 0x42649a
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x4264c6
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x4264c4
push 0x1aff
push 0x49b
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
jmp 0x426493
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x158]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x600], ecx
mov dword [ebp - 0x934], 0x33a4a9bd
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x4264fd
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x426527
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
cmp dword [ebp - 0x600], 0
je 0x426647
mov dword [ebp - 0x4c], 0xfffffff9
push 4
lea ecx, [ebp - 0x8e4]
call fcn.0043492e
mov dword [ebp - 0x150], 0
jmp 0x426561
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 4
jge 0x426583
push dword [ebp - 0x150]
lea ecx, [ebp - 0x8e4]
call fcn.00434a1c
mov dword [eax], 8
jmp 0x426554
mov dword [ebp - 0x4c], 0x18
jmp 0x426593
cmp dword [ebp - 0x4c], 0xfffffff1
jl 0x4265dc
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x4265bd
push 0xe2c
push 0x1420
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x4265da
mov dword [ebp - 0x4c], 0
jmp 0x4265ec
cmp dword [ebp - 0x4c], 4
jge 0x426608
push 4
lea ecx, [ebp - 0x6fc]
call fcn.0043492e
push 3
lea ecx, [ebp - 0x24c]
call fcn.0043492e
mov dword [ebp - 0x794], 0x9bd6
push 3
lea ecx, [ebp - 0x720]
call fcn.0043492e
mov dword [ebp - 0x82c], 0xa68fab8d
mov dword [ebp - 8], 0
jmp 0x426692
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x4266ae
push dword [ebp - 8]
lea ecx, [ebp - 0x6fc]
call fcn.00434a1c
mov dword [eax], 0x20f8
jmp 0x42668b
mov dword [ebp - 8], 0
jmp 0x4266be
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x4266da
push dword [ebp - 8]
lea ecx, [ebp - 0x24c]
call fcn.00434a1c
mov dword [eax], 0x962e
jmp 0x4266b7
mov dword [ebp - 8], 0
jmp 0x4266ea
cmp dword [ebp - 8], 3
jge 0x426706
pop esi
mov esp, ebp
pop ebp
ret