Function at 0x49d82b
Capabilities:
Query environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c0
push esi
push edi
mov dword [ebp - 0x34], ecx
mov edi, edx
mov dword [ebp - 0x10], 0xfffffff7
xor eax, eax
push 1
mov dword [ebp - 0x14], 0xa2fafd11
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], eax
pop esi
jmp 0x49d95a
mov dword [ebp - 0x18], 0x6158d32f
mov dword [ebp - 0xc], 0xad3b3152
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0xc], eax
jmp 0x49d880
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x110], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x49d873
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
je 0x49d901
mov dword [ebp - 8], 0xa9f8d19c
mov dword [ebp - 0x1c], 0xfffffff7
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49d8bd
push eax
push 0x2529
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x49d8c5
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x14]
jle 0x49d8dc
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
push 0
pop ecx
setl cl
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x110], ecx
jmp 0x49d957
mov dword [ebp - 0xc], 0xffffffe7
jmp 0x49d951
mov dword [ebp - 0x24], eax
jmp 0x49d920
mov ecx, dword [ebp - 0x24]
mov dword [ebp + ecx*4 - 0x110], 0xfffffffd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x49d90f
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49d94e
push eax
push 0x1207
push 0x7b8
push eax
push 0x466
push 0x1d8a
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x11
je 0x49d90a
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffe
jne 0x49d859
mov dword [ebp - 0x14], eax
jmp 0x49d971
cmp dword [ebp - 0x10], eax
jne 0x49d977
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffed
jg 0x49d969
mov dword [ebp - 0x14], 0xe76f5020
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x14], eax
jmp 0x49d99f
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x58], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x49d991
mov dword [ebp - 0x14], eax
jmp 0x49d9b8
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x48], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x49d9aa
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x49da90
mov dword [ebp - 8], esi
mov dword [ebp - 0x18], 4
mov dword [ebp - 8], eax
jmp 0x49d9eb
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x8c], 0xffff
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x49d9da
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49da02
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 0x14]
cmp dword [ebp + ecx*4 - 0x58], eax
je 0x49da21
mov ecx, dword [ebp - 0x58]
mov edi, eax
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 8], ecx
jl 0x49da23
mov edi, esi
mov ecx, dword [ebp - 0x14]
push 0
mov edx, dword [ebp + ecx*4 - 0x58]
mov ecx, dword [ebp - 0x14]
cmp ecx, edx
pop ecx
setle cl
xor edx, edx
dec ecx
cmp ecx, 0xcc4b
mov ecx, dword [ebp - 0x14]
push 0
setg dl
cmp ecx, edx
pop ecx
setl cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
push 1
pop esi
mov ecx, dword [ebp + ecx*4 - 0x58]
cmp dword [ebp - 0x18], ecx
setne dl
xor ecx, ecx
cmp edi, edx
setg cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp + ecx*4 - 0x58]
cmp dword [ebp - 0x18], ecx
setl dl
mov dword [ebp - 0x8c], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x49d9cb
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
jmp 0x49db37
mov dword [ebp - 0xc], 0x3c3d2146
mov dword [ebp - 0x18], 0xffffffff
mov ecx, dword [ebp - 0xc]
neg ecx
je 0x49dace
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, 0x2ddfdaf1
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x58]
mov ecx, esi
jne 0x49dad0
mov ecx, eax
add ecx, 0x4595a2e7
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xe128
je 0x49dae9
cmp dword [ebp - 0xc], eax
jne 0x49daeb
mov esi, eax
mov ecx, dword [ebp - 0x58]
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0xc]
setle dl
mov dword [ebp - 0x18], edx
xor edx, edx
cmp ecx, dword [ebp - 0x18]
setle dl
mov dword [ebp - 0x48], edx
test edx, edx
jne 0x49db1b
cmp dword [ebp - 0x48], eax
jne 0x49db1b
cmp dword [ebp - 0x58], eax
jne 0x49db1b
xor esi, esi
mov ecx, eax
inc esi
jmp 0x49db20
xor esi, esi
inc esi
mov ecx, esi
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x14], esi
jle 0x49db2f
mov ecx, eax
cmp dword [ebp - 0x48], eax
je 0x49db31
mov ecx, esi
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xb
jl 0x49da98
mov ecx, dword [0xac9450]
test cl, 1
jne 0x49dbc4
push eax
or ecx, esi
mov dword [0xac9410], eax
push eax
mov dword [0xac9450], ecx
mov dword [0xac9414], eax
call fcn.00403ce7
mov ecx, eax
mov dword [0xac942c], 0x3f800000
mov dword [0xac9410], ecx
xor eax, eax
mov dword [ebp - 0x7c], ecx
lea ecx, [ebp - 0x7c]
push ecx
push 0x10
push eax
mov dword [0xac9418], eax
mov ecx, 0xac9418
mov dword [0xac9420], eax
mov dword [0xac941c], eax
lea eax, [ebp - 0xec]
push eax
call fcn.00403a1d
push 0x4cc92a
mov dword [0xac9424], 7
mov dword [0xac9428], 8
call fcn.004b672f
pop ecx
xor eax, eax
mov dword [ebp - 0x10], esi
push 4
mov dword [ebp - 8], eax
pop esi
jmp 0x49dbe0
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x138], 0x29b
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x49dbcf
push 3
mov dword [ebp - 0x10], 0x4e2db58e
mov dword [ebp - 0x10], eax
pop edx
jmp 0x49dc65
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x49dc62
mov dword [ebp - 8], eax
jmp 0x49dc19
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xdc], 0xfffffffe
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x49dc08
mov dword [ebp - 0xd0], edx
cmp dword [ebp - 0xd0], eax
jl 0x49dc5d
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + ecx*4 - 0x138]
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x138], edx
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49dc52
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor eax, eax
dec dword [ebp - 0xd0]
jns 0x49dc2c
push 3
pop edx
dec dword [ebp - 0x1c]
jns 0x49dc03
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x49dbf4
imul ecx, dword [ebp - 0x34], 0x2710
add ecx, edi
xor edi, edi
mov dword [ebp - 0x40], ecx
inc edi
mov dword [ebp - 0x10], 0xb9f9b31
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0xd6158f87
mov dword [ebp - 0x20], 0x94fe874d
mov dword [ebp - 0x10], 0xffffffee
cmp dword [ebp - 0x10], 0xffffffec
jle 0x49dd30
mov dword [ebp - 0x14], 0xf1bf506e
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffe6
jmp 0x49dcd0
mov dword [ebp - 0x1c], 0xe932
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 9
je 0x49dcb9
cmp dword [ebp - 0x10], eax
jne 0x49dcde
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x10], ecx
jne 0x49dcf9
cmp dword [ebp - 0x18], eax
jne 0x49dcf9
cmp dword [ebp - 0x10], eax
jne 0x49dcf9
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
setns dl
mov dword [ebp - 0xc], edx
xor edx, edx
mov ecx, dword [ebp - 0xc]
cmp ecx, edi
setg dl
mov dword [ebp - 0x18], edx
dec dword [ebp - 0x10]
jmp 0x49dc98
lea eax, [ebp - 0x40]
push eax
call fcn.0049ec0e
push 2
pop edx
mov esi, dword [eax]
xor eax, eax
mov dword [ebp - 0xc], 0x68ec0ae9
mov dword [ebp - 0x24], edi
mov dword [ebp - 8], eax
jmp 0x49dd60
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x94], 0x41fc9a57
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x49dd4f
mov dword [ebp - 0xc], 0xffffffef
jmp 0x49de3b
mov dword [ebp - 0x1c], 0xf5cd53bc
mov dword [ebp - 0x14], 0x431fadac
mov dword [ebp - 0x18], 0x29a275ff
mov dword [ebp - 0x10], eax
jmp 0x49dd9c
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xe8], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x49dd8b
mov dword [ebp - 0x10], eax
jmp 0x49ddb8
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x104], 0x4a6f4440
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x49dda7
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x49ddf6
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x20], 0x276b87d0
mov dword [ebp - 8], eax
jmp 0x49dde9
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x174], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x49ddd8
inc dword [ebp - 0x14]
dec dword [ebp - 0x1c]
jns 0x49ddc5
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x94]
push 0xfffffffffffffffe
pop edx
sub edx, ecx
je 0x49de0f
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x90]
cmp edx, ecx
push 0
pop ecx
setge cl
push 2
mov dword [ebp - 0x100], ecx
inc dword [ebp - 0xc]
pop edx
cmp dword [ebp - 0xc], edx
jl 0x49dd71
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], eax
jl 0x49de63
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49de5e
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x49de4c
test esi, esi
je 0x49dfc2
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], 0x62d
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], eax
jmp 0x49de95
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xa8], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x49de84
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], eax
jl 0x49df3a
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
jmp 0x49dec0
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x194], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x49deaf
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xc]
sub edx, 0xfffffffd
neg edx
push 0
sbb edx, edx
add edx, 0x51d77f18
cmp edx, ecx
pop ecx
setl cl
cmp ecx, 0x1031
jne 0x49df08
mov ecx, edi
cmp dword [ebp - 0x18], eax
jne 0x49df0a
mov ecx, eax
mov edx, 0xa4bc4433
cmp edx, ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xfffffff7
jle 0x49df1c
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x188], ecx
dec dword [ebp - 0x24]
jns 0x49dea7
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], 0xfffffffe
mov dword [ebp + 8], edi
mov dword [ebp + 8], edi
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 8], ecx
mov dword [edx], esi
mov dword [ebp - 0xc], 0xc
jmp 0x49dfb5
mov dword [ebp + 8], eax
jmp 0x49df6d
mov ecx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0xfc], edi
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x49df60
mov dword [ebp + 8], eax
jmp 0x49df89
mov ecx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0xa0], 0x45625132
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x49df78
mov dword [ebp + 8], eax
jmp 0x49dfac
mov ecx, dword [ebp + 8]
mov ecx, dword [ebp + ecx*4 - 0xfc]
sub ecx, dword [ebp - 0xfc]
mov dword [ebp - 0xa0], ecx
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jle 0x49df93
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x30
jne 0x49df5b
mov eax, edx
jmp 0x49eb4c
mov ecx, dword [0xac9450]
test cl, 2
jne 0x49e04a
push eax
or ecx, 2
mov dword [0xac9430], eax
push eax
mov dword [0xac9450], ecx
mov dword [0xac9434], eax
call fcn.00403ce7
mov ecx, eax
mov dword [0xac944c], 0x3f800000
mov dword [0xac9430], ecx
xor eax, eax
mov dword [ebp - 0x88], ecx
lea ecx, [ebp - 0x88]
push ecx
push 0x10
push eax
mov dword [0xac9438], eax
mov ecx, 0xac9438
mov dword [0xac9440], eax
mov dword [0xac943c], eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00403a1d
push 0x4cc925
mov dword [0xac9444], 7
mov dword [0xac9448], 8
call fcn.004b672f
pop ecx
xorps xmm0, xmm0
xor eax, eax
movdqu xmmword [ebp - 0x68], xmm0
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x18], 0xb7d8cf4c
mov dword [ebp - 8], eax
jmp 0x49e074
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x164], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x49e067
dec dword [ebp - 0x18]
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x49e092
push 0x2402
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x34]
push eax
call fcn.0049ec70
mov esi, dword [eax]
xor eax, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], eax
jmp 0x49e0b5
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x3c], 0x24a8c6a5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x49e0a7
mov dword [ebp - 0x10], eax
jmp 0x49e0d1
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x15c], 0xdfe4b283
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x49e0c0
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x49e0ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x49e139
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], eax
jmp 0x49e10c
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x9c], 0x137b
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x49e0fb
mov dword [ebp - 0xc], eax
jmp 0x49e127
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x9c], 0x836c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x49e116
mov dword [ebp - 0x154], 8
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffef
jg 0x49e0f3
cmp byte [ebp + 0xc], 0
jne 0x49e14d
test esi, esi
jne 0x49e4a2
mov dword [ebp - 0x10], 0xf75d
mov dword [ebp - 0x14], 0x23498e64
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], 0xc7a8cf1d
mov dword [ebp - 8], eax
jmp 0x49e17b
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x184], 0x7d711e7b
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x49e16a
cmp dword [ebp - 0x10], eax
je 0x49e21b
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0xc], 0xfff6
mov dword [ebp - 8], eax
jmp 0x49e1ae
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xcc], 0xd1ad67a4
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x49e19d
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x49e1bf
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0xc]
xor edx, edx
mov esi, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x1c]
imul esi, ecx
mov ecx, dword [ebp - 0x1c]
cmp esi, ecx
setle dl
add edx, dword [ebp - 0x1c]
cmp dword [ebp - 0xc], edx
jg 0x49e1ea
mov ecx, eax
cmp dword [ebp - 0x184], eax
je 0x49e1ec
mov ecx, edi
mov eax, dword [ebp - 0xc8]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
sub ecx, 0x5dc6
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0xc8], ecx
jmp 0x49e22a
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49e22a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dl, byte [ebp + 0xc]
lea eax, [ebp - 0x1b0]
mov ecx, dword [ebp - 0x34]
push eax
call fcn.00479b3c
mov esi, eax
lea edi, [ebp - 0x68]
pop ecx
xor eax, eax
push 2
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0xc], 0x4543beb7
mov dword [ebp - 8], 0xec79cf18
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x18], 0x1d89e177
mov dword [ebp - 0x20], 0xf314d41b
mov dword [ebp - 0x14], eax
pop esi
jmp 0x49e292
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xb8], 0x734f094
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x49e281
push 3
mov dword [ebp - 0x14], eax
pop edx
jmp 0x49e2b0
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x144], 0x1d91
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x49e29f
mov dword [ebp - 0x14], eax
jmp 0x49e2cb
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x150], 0x48968f25
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x49e2ba
dec dword [ebp - 0x1c]
jne 0x49e2e5
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0xb4], ecx
test ecx, ecx
je 0x49e2f7
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
je 0x49e2f7
xor edi, edi
inc edi
mov edx, edi
jmp 0x49e2fc
xor edi, edi
mov edx, eax
inc edi
mov ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], eax
je 0x49e310
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x148]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub edx, ecx
mov dword [ebp - 0x18], edx
cmp byte [ebp + 0xc], al
je 0x49e49f
cmp dword [ebp - 0x60], eax
je 0x49e49f
mov dword [ebp - 0x1c], 0x9e57ad95
mov dword [ebp - 0x20], 0xb90f9986
mov dword [ebp - 8], eax
jmp 0x49e36f
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xc0], 0x4e2d
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x49e35e
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x49e3d3
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], 0xa5202749
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], eax
jl 0x49e3ce
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0xc0]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0xc0]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
sub edx, ecx
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], 4
dec dword [ebp - 0x10]
jns 0x49e38e
dec dword [ebp - 0x1c]
jns 0x49e37c
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x49e3f2
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
mov ecx, dword [ebp - 0x5c]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x18], 0x28f6c74a
mov dword [ebp - 0x20], 0xcd4431fa
mov dword [ebp - 0x18], 0xd393e75c
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
mov dword [edi + 4], ecx
je 0x49e439
push eax
push eax
push 0xa3d
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
je 0x49e44c
xor esi, esi
inc esi
jmp 0x49e44e
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
mov ecx, dword [ebp - 0x18]
setge dl
cmp ecx, edx
mov ecx, dword [ebp - 0x20]
push 0
pop edx
setle dl
cmp edx, ecx
mov edx, dword [ebp - 0x10]
push 0
pop ecx
setg cl
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
push 0
pop edx
setle dl
xor ecx, ecx
cmp edx, dword [ebp - 0x20]
setl cl
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x60]
mov dword [edi + 8], ecx
xor edi, edi
inc edi
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x20], 0xa7525d2d
push 4
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], eax
pop edx
jmp 0x49e4c9
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x78], 0xc93b4e1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x49e4bb
mov dword [ebp - 0x14], eax
jmp 0x49e4e0
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x98], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x49e4d3
mov dword [ebp - 0x14], eax
jmp 0x49e4fb
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x1c0], 0xc9cd49fc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x49e4ea
mov dword [ebp - 0x70], eax
jmp 0x49e591
mov dword [ebp - 8], 0xf759609c
mov dword [ebp - 8], eax
jmp 0x49e525
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1a0], 0xfffffff7
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x49e514
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x49e58e
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x20], 0x6bde64f6
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x49e586
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49e581
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x49e56f
inc dword [ebp - 0x18]
dec dword [ebp - 8]
jns 0x49e533
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x14
jge 0x49e508
mov ecx, dword [ebp - 0x70]
xor edx, edx
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0xc]
test ecx, ecx
mov ecx, dword [ebp - 0x70]
setg dl
add ecx, edx
mov edx, dword [ebp - 0xc]
add edx, ecx
mov dword [ebp - 0x74], edx
test esi, esi
jne 0x49e845
cmp dword [ebp - 0x68], esi
jle 0x49e845
mov edi, dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov dword [ebp - 0x20], 0xffff
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49e5ec
push 0x35e
push eax
call edi
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49e600
push eax
call esi
xor eax, eax
mov dword [ebp - 0x20], 0xffff
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49e61a
push 0x35e
push eax
call edi
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49e628
push eax
call esi
xor eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 8], 5
push 0x17
mov dword [ebp - 0x18], 0xd37ad43
mov dword [ebp - 8], 9
pop edi
jmp 0x49e671
mov dword [ebp - 0x20], 0xbecc
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49e66e
push eax
push eax
push eax
call esi
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jne 0x49e648
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 8], 5
mov dword [ebp - 0x18], 0xd37ad43
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], 9
jmp 0x49e6bc
mov dword [ebp - 0x20], 0xbecc
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49e6b9
push eax
push eax
push eax
call esi
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jne 0x49e693
mov edi, dword [ebp - 0x64]
mov dword [ebp - 0x20], 0x5d6c05ba
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49e6e0
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49e6fe
push 0x244a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
xor eax, eax
test edi, edi
je 0x49e83f
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xbd7b1c2a
mov dword [ebp - 0x20], 0x6b950ba1
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0
jmp 0x49e885
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x16c], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x49e874
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x68]
call fcn.004896ee
xor eax, eax
mov dword [ebp - 0xc], 0xfffffff6
mov dword [ebp - 0xc], eax
jmp 0x49e8e7
mov dword [ebp - 0x20], 0xfff9
cmp dword [ebp - 0xc], eax
je 0x49e8c0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x18], eax
jne 0x49e8e4
jmp 0x49e8d2
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49e8d2
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49e8e4
push eax
call dword [sym.imp.USER32.dll_CreateIconIndirect]
xor eax, eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffee
jg 0x49e8a4
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x49e904
push eax
push 0x1670
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
xor eax, eax
test esi, esi
je 0x49eab2
mov dword [ebp - 0x10], 0x3ae35568
mov dword [ebp - 0x20], 0x8d7cbae8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff2
jg 0x49e993
push 2
pop edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], eax
jmp 0x49e942
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xb0], 0x73eb905d
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x49e931
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], eax
jl 0x49e984
push dword [ebp - 0x28]
push esi
call fcn.00479a4d
mov esi, dword [ebp + 8]
mov dword [ebp + 8], 0xffffffff
mov dword [ebp - 0xc], 0x67fa5c62
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp + 8], 0xcc80fc3a
mov dword [esi], eax
xor eax, eax
mov dword [ebp + 8], 0xbfb66feb
pop ecx
mov dword [ebp - 0x1c], 2
pop ecx
mov dword [ebp + 8], eax
jmp 0x49e9e5
mov ecx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x84], 0x7862
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x49e9d4
mov dword [ebp + 8], eax
jmp 0x49ea00
mov esi, dword [ebp + 8]
mov dword [ebp + 8], 0x1ad386cc
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0xb87d0fa5
mov dword [ebp - 0xc], 0xeab3cf81
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], 0xffff
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 8]
cmp edx, ecx
push eax
pop ecx
setl cl
add ecx, 0xfffffe88
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, edi
setle dl
xor ecx, ecx
cmp edx, 0x780e
setl cl
imul ecx, ecx, 0x9e88
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0xc], 7
jmp 0x49eb44
mov byte [ebp + 0xb], al
cmp byte [ebp + 0xb], 0
je 0x49eb41
push 0x112f
push eax
push 0x26a6
push 0x4cf
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe8
je 0x49eb1e
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret