Function at 0x41c164
Capabilities:
Get common file path
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov byte [ebp - 0x28], dl
mov dword [ebp - 0x24], ecx
je 0x41c7ff
push 3
lea ecx, [ebp - 0xcc]
call fcn.00401e5e
push 2
lea ecx, [ebp - 0x78]
call fcn.00401e5e
xor eax, eax
mov dword [ebp + 0xc], eax
jmp 0x41c1b1
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xcc]
mov dword [ecx + edx*4], 0x7d45db34
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 3
jl 0x41c19e
mov dword [ebp + 0xc], eax
jmp 0x41c1cc
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x78]
mov dword [ecx + edx*4], 6
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 2
jl 0x41c1bc
xor edi, edi
mov dword [ebp + 0xc], eax
inc edi
jmp 0x41c1e4
mov ecx, dword [ebp + 0xc]
mov dword [ebp + ecx*4 - 0x60], eax
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], edi
jl 0x41c1da
mov esi, dword [ebp - 0xcc]
mov ecx, dword [esi]
sub ecx, dword [esi + 4]
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 0xfe47
cmp ecx, 0x7ccc
mov ecx, dword [ebp - 0x78]
setl dl
mov dword [ecx], edx
xor ecx, ecx
cmp dword [esi], eax
sete cl
mov dword [ebp - 0x60], ecx
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], al
je 0x41c226
call dword [sym.imp.USER32.dll_DestroyCaret]
lea ecx, [ebp - 0x78]
call fcn.00401f30
lea ecx, [ebp - 0xcc]
call fcn.00401f30
xor eax, eax
mov dword [ebp + 0xc], eax
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], al
je 0x41c267
push 0x25bb
push 0xb36
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
xor eax, eax
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], 0
je 0x41c27e
push 0x2515
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
mov dword [ebp - 0xc], 0x2667
xor edx, edx
mov dword [ebp + 0xc], 0xffffffff
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp + 0xc], edi
mov dword [ebp + 0xc], 0x2275dd36
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp + 0xc], 0x3e1fe01
mov dword [ebp + 0xc], 0x1994
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp + 0xc]
cmp ecx, edi
setg dl
xor ecx, ecx
add edx, dword [ebp - 0xc]
cmp edx, 0x13b01d91
setg cl
xor ebx, ebx
cmp ecx, 0xffffffff
mov ecx, dword [ebp - 8]
sete bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0xc]
setne dl
sub ecx, edx
je 0x41c2fd
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], 0
je 0x41c32e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41c32e
mov dword [ebp - 8], 0xffffffe6
jmp 0x41c328
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], 0
je 0x41c31e
push 0x124e
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor eax, eax
mov dword [ebp + 0xc], 0x3e25468d
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x3c
jg 0x41c306
mov eax, dword [ebp - 8]
mov dword [ebp + 0xc], eax
xor eax, eax
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], eax
je 0x41c345
mov edx, edi
cmp dword [ebp - 8], eax
jne 0x41c347
mov edx, eax
mov ecx, dword [ebp - 8]
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 8]
setle bl
xor edx, edx
cmp ebx, ecx
setg dl
cmp edx, 0xec73f5cf
sbb ecx, ecx
xor ebx, ebx
neg ecx
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp edx, ecx
setg bl
mov dword [ebp - 0x24], ebx
xor ebx, ebx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
cmp ecx, edx
mov ecx, dword [ebp - 0xc]
setge bl
xor edx, edx
cmp ebx, ecx
setg dl
imul ecx, edx, 0x5d90
test ecx, ecx
jne 0x41c3a8
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
push 2
cmp byte [ebp + 8], al
je 0x41c5c9
lea ecx, [ebp - 0x6c]
call fcn.00401e5e
xor eax, eax
mov dword [ebp + 0xc], 0x4e55b65a
mov dword [ebp + 0xc], eax
jmp 0x41c3e2
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x6c]
mov dword [ecx + edx*4], 0x342eb90d
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 2
jl 0x41c3d2
mov dword [ebp + 0xc], eax
jmp 0x41c3fb
mov ecx, dword [ebp + 0xc]
mov dword [ebp + ecx*4 - 0x1c], 0x13638ecf
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], edi
jl 0x41c3ed
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x41c45d
mov dword [ebp + 0xc], 0x18c84b7b
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x6c]
mov ecx, dword [edx + ecx*4]
mov dword [edx + esi*4], ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
add ecx, 4
add ecx, edx
jne 0x41c438
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x41c43a
mov edx, edi
mov ecx, dword [ebp - 0x1c]
sub edx, ecx
add edx, 0xffff
je 0x41c44e
mov edx, edi
cmp dword [ebp - 0x1c], eax
jne 0x41c450
mov edx, eax
mov ecx, dword [ebp - 0x6c]
sub edx, dword [ecx]
mov dword [ebp + 0xc], edx
dec dword [ebp - 0x1c]
jns 0x41c408
lea ecx, [ebp - 0x6c]
call fcn.00401f30
movdqa xmm0, xmmword [0xa5dbb0]
lea ecx, [ebp - 0x104]
push 4
pop ebx
mov dword [ebp - 0xc], ebx
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], 0xffffffff
push 8
mov dword [ebp - 0x10], 0x40194ddb
pop edi
mov dword [ebp + 0xc], 0xfffffff9
mov dword [ebp + 0xc], 0xcc2fdcb
mov dword [ebp + 0xc], edi
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0xfffffff8
push ecx
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x18], 0xeb2391cb
push ecx
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], eax
movdqu xmmword [ebp - 0x114], xmm0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
call fcn.00401f92
mov dword [ebp - 0x24], 0x100
xor esi, esi
mov dword [ebp - 0x14], 0xffff
mov dword [ebp - 0xc], esi
jmp 0x41c53a
mov dword [ebp + 0xc], 0xffffffff
lea ecx, [ebp - 0xf8]
push ebx
call fcn.00401e5e
mov dword [ebp + 0xc], 0x595ad338
mov dword [ebp + 0xc], 0x423b19d8
mov dword [ebp - 0x18], edi
mov dword [ebp + 0xc], esi
jmp 0x41c524
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], ebx
jl 0x41c511
dec dword [ebp - 0x18]
lea ecx, [ebp - 0xf8]
call fcn.00401f30
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe3
je 0x41c4e8
mov dword [ebp + 0xc], esi
jmp 0x41c5b0
mov dword [ebp - 0x18], 0xfffffffe
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
xor edx, edx
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, 0xffffffff
setle cl
mov dword [eax + edi*4], ecx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x10]
je 0x41c58f
mov eax, dword [ebp - 0x40]
cmp dword [eax + 4], esi
jne 0x41c592
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 3
jle 0x41c545
lea ecx, [ebp - 0x40]
call fcn.00401f30
mov eax, dword [ebp + 0x14]
add dword [eax], 0xe
jmp 0x41d02a
pop ebx
push ebx
lea ecx, [ebp - 0xa8]
call fcn.00401e5e
mov dword [ebp + 0xc], 0xf2f4a8b1
xor esi, esi
mov dword [ebp + 0xc], 0xfffffffc
mov dword [ebp + 0xc], edi
mov dword [ebp + 0xc], 0xfde2bbef
mov dword [ebp + 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp + 0xc], esi
jmp 0x41c60e
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xa8]
mov dword [eax + ecx*4], 0x75c9
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], ebx
jl 0x41c5fb
mov dword [ebp + 0xc], esi
jmp 0x41c629
mov eax, dword [ebp + 0xc]
mov dword [ebp + eax*4 - 0x144], 0x99d94b4b
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 4
jl 0x41c618
mov eax, dword [ebp - 0xa8]
lea ecx, [ebp - 0xa8]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
inc dword [ebp - 0x10]
call fcn.00401f30
push ebx
lea ecx, [ebp - 0xd8]
call fcn.00401e5e
mov dword [ebp + 0xc], 0xf2f4a8b1
mov dword [ebp + 0xc], 0xfffffffc
mov dword [ebp + 0xc], edi
mov dword [ebp + 0xc], 0xfde2bbef
mov dword [ebp + 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp + 0xc], esi
jmp 0x41c68a
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], 0x75c9
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], ebx
jl 0x41c677
mov dword [ebp + 0xc], esi
jmp 0x41c6a5
mov eax, dword [ebp + 0xc]
mov dword [ebp + eax*4 - 0x154], 0x99d94b4b
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 4
jl 0x41c694
mov eax, dword [ebp - 0xd8]
lea ecx, [ebp - 0xd8]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
inc dword [ebp - 0x10]
call fcn.00401f30
mov dword [ebp - 8], 0xffffffff
xor eax, eax
mov dword [ebp + 0xc], 0xdaa237f4
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp + 0xc], edi
mov dword [ebp + 0xc], 0x9235
mov dword [ebp + 0xc], eax
jmp 0x41c6fb
mov ecx, dword [ebp + 0xc]
mov dword [ebp + ecx*4 - 0x128], 0x131d
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 3
jl 0x41c6ea
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 8]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setle dl
cmp edi, edx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, 0xcee3
setne dl
cmp edx, 0xfffffffc
je 0x41c735
cmp dword [ebp - 8], eax
jne 0x41c737
mov edi, eax
mov ecx, dword [ebp - 8]
xor edx, edx
cmp edi, 0x58efa97f
setle dl
xor ebx, ebx
cmp edx, ecx
setge bl
xor edx, edx
add ebx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setl dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setg bl
xor edx, edx
cmp ebx, ecx
setge dl
add edx, dword [ebp - 8]
mov dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0xd2ae857b
mov ecx, dword [ebp - 8]
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, ecx
mov ecx, 0xffff
setle bl
cmp ecx, ebx
sbb esi, esi
neg esi
sub esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setle dl
imul edx, edx, 0x9ab8
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x387f
setle cl
mov dword [ebp + 0xc], ecx
mov dword [ebp - 8], eax
jmp 0x41c7de
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], 0
je 0x41c7db
push eax
push 0x22b9
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x41c7c4
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
test eax, eax
jns 0x41d02a
add eax, 0x100
js 0x41c7f1
mov dword [ecx], eax
jmp 0x41d02a
xor edi, edi
mov dword [ebp - 0x10], 0xf782
inc edi
lea ecx, [ebp - 0xc0]
push edi
call fcn.00401e5e
mov dword [ebp - 0xc], 0xb8561371
mov dword [ebp - 0x14], 0x68939f5f
mov dword [ebp - 0x20], 0x382e
mov dword [ebp + 0xc], 0
jmp 0x41c842
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], edi
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], edi
jl 0x41c833
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
test eax, eax
setle cl
inc ecx
je 0x41c85a
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc0]
or dword [eax], 0xffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 0
je 0x41c8ab
push 0x1c1f
push 0x223c
push 0x156d
push 0x261c
push 0xc83
push 0x12e4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
lea ecx, [ebp - 0xc0]
call fcn.00401f30
push 2
pop esi
push esi
lea ecx, [ebp - 0x104]
call fcn.00401e5e
xor eax, eax
push 4
mov dword [ebp + 0xc], eax
pop ebx
jmp 0x41c8dd
mov ecx, dword [ebp + 0xc]
mov dword [ebp + ecx*4 - 0x50], 0x2f4a8b10
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], ebx
jl 0x41c8cf
mov dword [ebp + 0xc], eax
jmp 0x41c8fa
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x104]
mov dword [ecx + edx*4], 0xffff
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], esi
jl 0x41c8e7
cmp dword [ebp - 0x4c], 0xfffffffa
jb 0x41c921
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], al
je 0x41c97d
push 0x5e2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x41c97d
push edi
lea ecx, [ebp - 0xe4]
call fcn.00401e5e
xor eax, eax
mov dword [ebp + 0xc], eax
jmp 0x41c947
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xe4]
mov dword [ecx + edx*4], 0xd4ea6801
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], edi
jl 0x41c934
mov ecx, dword [ebp - 0xe4]
mov dword [ecx], eax
cmp dword [ebp - 0x4c], eax
je 0x41c962
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
test eax, eax
setg cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0xe4]
call fcn.00401f30
lea ecx, [ebp - 0x104]
call fcn.00401f30
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp + 0xc], edi
mov dword [ebp + 0xc], eax
jmp 0x41c9a2
mov ecx, dword [ebp + 0xc]
mov dword [ebp + ecx*4 - 0x11c], eax
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], esi
jl 0x41c995
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 0xc], ecx
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], al
je 0x41c9c5
push edi
push 0x26df
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp + 0xc], 0xdf3d37a5
mov dword [ebp + 0xc], 0x5145
mov dword [ebp - 0xc], 0xffffffe6
cmp dword [ebp - 0xc], 0xfffffffc
jle 0x41ca9a
mov dword [ebp - 8], 9
cmp dword [ebp - 8], eax
je 0x41ca26
mov dword [ebp - 8], eax
jmp 0x41ca1e
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], 0
je 0x41ca1b
push 0x12ba
push eax
push 0x19cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 6
je 0x41c9f8
jmp 0x41ca8a
push edi
lea ecx, [ebp - 0x90]
call fcn.00401e5e
xor eax, eax
mov dword [ebp + 0xc], eax
jmp 0x41ca4c
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x90]
mov dword [ecx + edx*4], 0xfaafe30f
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], edi
jl 0x41ca39
mov dword [ebp - 8], eax
jmp 0x41ca64
mov ecx, dword [ebp - 0x90]
mov ecx, dword [ecx]
mov dword [ebp + 0xc], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x12
jne 0x41ca56
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], al
je 0x41ca7f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp - 0x90]
call fcn.00401f30
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffc
push 0
pop eax
jg 0x41c9e7
mov dword [ebp - 0xc], eax
jmp 0x41cab3
mov dword [ebp + 0xc], 0x9646
imul ecx, dword [ebp - 0xc], 0x10c1
mov dword [ebp + 0xc], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jg 0x41ca9f
cmp byte [ebp - 0x28], 0
je 0x41cd36
push esi
lea ecx, [ebp - 0x9c]
call fcn.00401e5e
xor eax, eax
mov dword [ebp + 0xc], eax
jmp 0x41cae8
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + edx*4], 5
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], esi
jl 0x41cad5
mov dword [ebp + 0xc], eax
jmp 0x41caff
mov ecx, dword [ebp + 0xc]
mov dword [ebp + ecx*4 - 0x164], eax
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], ebx
jl 0x41caf2
mov eax, dword [ebp - 0x9c]
lea ecx, [ebp - 0x9c]
mov dword [eax], 9
call fcn.00401f30
xor eax, eax
mov dword [ebp - 8], edi
push 3
mov dword [ebp + 0xc], eax
pop ebx
jmp 0x41cb39
mov ecx, dword [ebp + 0xc]
mov dword [ebp + ecx*4 - 0x134], 0x6310feca
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], ebx
jl 0x41cb28
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], al
je 0x41cb50
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
xor eax, eax
mov dword [ebp - 0xc], 0x67d50f82
mov dword [ebp - 8], eax
jmp 0x41cb81
inc dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0x41cb79
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], 0
je 0x41cb76
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x41cb64
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x41cb5c
mov dword [ebp + 0xc], 0xfffffffc
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], 0
je 0x41cb9f
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor eax, eax
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], 0
je 0x41cbb1
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x14], 0xb586fa66
mov dword [ebp - 0x20], 0x3758
mov dword [ebp + 0xc], eax
jmp 0x41cbd5
mov ecx, dword [ebp + 0xc]
mov dword [ebp + ecx*4 - 0x5c], eax
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], ebx
jl 0x41cbcb
mov dword [ebp - 0xc], 0xffffffff
jmp 0x41cd21
mov dword [ebp + 0xc], 0x88adae8c
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], esi
jg 0x41ccf4
mov dword [ebp - 8], 5
lea ecx, [ebp - 0xb4]
push edi
call fcn.00401e5e
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x41cc2d
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xb4]
mov dword [ecx + edx*4], 0xbda73a15
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x41cc1a
mov dword [ebp - 8], esi
cmp dword [ebp - 8], eax
jl 0x41ccdb
mov dword [ebp - 0x10], 0x37828451
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
cmp edx, ecx
mov ecx, dword [ebp - 0xc]
setge bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0xc]
setle dl
mov dword [ebp - 0x14], edx
xor edx, edx
cmp ecx, dword [ebp - 0x14]
setle dl
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x5c]
cmp ecx, esi
mov ecx, dword [ebp - 8]
setne dl
xor ebx, ebx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + ecx*4 - 0x5c]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ebp + ecx*4 - 0x5c]
cmp edx, ecx
setl bl
xor ecx, ecx
cmp dword [ebp - 0x14], 0xffffffff
setne cl
cmp ebx, ecx
je 0x41ccac
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 0x5c], 0xf844ba92
je 0x41ccbc
mov ecx, edi
cmp dword [ebp - 0x54], eax
jne 0x41ccbe
mov ecx, eax
mov edx, dword [ebp - 0xc]
imul edx, ecx
mov ecx, dword [ebp - 0xb4]
mov dword [ecx], edx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
dec dword [ebp - 8]
jns 0x41cc3e
lea ecx, [ebp - 0xb4]
call fcn.00401f30
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], esi
jle 0x41cc00
xor eax, eax
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], 0
je 0x41cd1e
push eax
push 0x18ae
push 0x2489
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 5
jne 0x41cbe6
mov eax, dword [ebp + 0x18]
add dword [eax], 6
jmp 0x41d02a
mov dword [ebp - 0xc], 0x477862fd
mov dword [ebp - 8], 0xffffffff
mov dword [ebp + 0xc], eax
jmp 0x41cd5a
mov ecx, dword [ebp + 0xc]
mov dword [ebp + ecx*4 - 0xec], 0x8c245e32
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], esi
jl 0x41cd49
mov dword [ebp - 0xc], eax
jmp 0x41ce4d
mov dword [ebp - 0x10], 0x955205
mov dword [ebp + 0xc], 0xbf748bbe
mov dword [ebp + 0xc], 0xfffffffc
mov dword [ebp + 0xc], eax
jmp 0x41cd8f
mov ecx, dword [ebp + 0xc]
mov dword [ebp + ecx*4 - 0x34], 0x9ba095a9
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], esi
jl 0x41cd81
mov ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, dword [ebp - 0xc]
jg 0x41cdb6
cmp dword [ebp - 8], eax
jne 0x41cdb6
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x10]
xor ebx, ebx
mov ecx, dword [ebp - 8]
cmp ecx, edx
setge bl
sub ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ecx, ebx
setle dl
mov dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], eax
je 0x41cde0
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x30]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x6d9e
setge cl
xor edx, edx
sub ecx, 0x4548
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp - 0x14], ecx
sete dl
xor ebx, ebx
imul edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x30]
cmp edx, 4
setne bl
xor edx, edx
cmp ebx, ecx
setg dl
xor ecx, ecx
cmp edx, 9
setne cl
mov dword [ebp - 0xec], ecx
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], 0
je 0x41ce4a
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 7
jg 0x41cd67
mov dword [ebp - 8], 0xdb2bc40e
lea ecx, [ebp - 0x84]
mov dword [ebp + 0xc], 0xd0d658ed
mov dword [ebp + 0xc], 0x3cb8e004
mov dword [ebp + 0xc], 0xfa3c9e4a
push 3
call fcn.00401e5e
xor eax, eax
mov dword [ebp + 0xc], eax
jmp 0x41ce9a
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x84]
mov dword [ecx + edx*4], 0xce005ab1
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 3
jl 0x41ce87
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], al
je 0x41ceb9
push eax
push 0x1ef7
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
mov ecx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0xc], eax
je 0x41cf00
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0xc], 0x1e707165
je 0x41ceda
mov ecx, edi
cmp dword [ebp - 8], eax
jne 0x41cedc
mov ecx, eax
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp + 0xc]
add ecx, 0x7f58
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 8]
jge 0x41cef5
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0xc], eax
jne 0x41cf07
mov ebx, eax
cmp dword [ebp - 8], eax
je 0x41cf09
mov ebx, edi
mov ecx, dword [ebp - 8]
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setge dl
xor ebx, ebx
cmp edx, 0xcb8ce3e
setle bl
xor edx, edx
cmp ebx, ecx
setge dl
mov dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], eax
je 0x41cf37
mov edx, edi
cmp dword [ebp - 8], eax
jne 0x41cf39
mov edx, eax
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
cmp ecx, eax
lea ecx, [ebp - 0x84]
setl dl
add edx, dword [ebp - 8]
mov eax, dword [ebp - 0x84]
mov dword [eax], edx
call fcn.00401f30
mov dword [ebp - 0xc], 0xe0cf
mov dword [ebp - 8], 0xd9532bb1
mov dword [ebp - 0x10], 9
mov dword [ebp + 0xc], 0x6718e503
mov dword [ebp - 0x2c], 0x3413f087
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x14], 0x366
mov dword [ebp - 0x20], 0x4067bc62
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [ebp - 8], eax
je 0x41d01c
mov edx, eax
cmp dword [ebp + 0xc], eax
je 0x41cfba
mov edx, edi
mov ecx, dword [ebp - 0xc]
add edx, 0xffff64d9
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
setg bl
sub ebx, dword [ebp - 8]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x2589d389
mov ecx, dword [ebp - 0x14]
setl dl
xor ebx, ebx
imul edx, edx, 0x511b
cmp edx, ecx
setle bl
xor ecx, ecx
cmp ebx, esi
setg cl
cmp dword [ebp - 8], ecx
jne 0x41d01e
mov edi, eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], edi
mov dword [eax], 0x11
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret