Function at 0x4464e7
Capabilities:
Get graphical window text
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov dword [ebp - 8], 1
mov dword [ebp - 0x44], 0
mov dword [ebp - 0xec], 0xfffffffc
mov dword [ebp - 0x3c], 0xfffe
mov dword [ebp - 0x80], 0
jmp 0x44651f
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x446535
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1d0], 0x9a4d91f0
jmp 0x446518
mov eax, 0xbf03fd8e
test eax, eax
je 0x44656c
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 8]
jne 0x446558
mov dword [ebp - 0xd8], 1
jmp 0x44655f
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0xd8]
cmp dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2f0], eax
mov eax, 0x8d30
shl eax, 3
cmp eax, dword [ebp - 8]
jg 0x44658e
mov dword [ebp - 0x1c0], 1
jmp 0x446595
and dword [ebp - 0x1c0], 0
cmp dword [ebp - 0x1c0], 0xf4f88039
je 0x4465ad
mov dword [ebp - 0x1a0], 1
jmp 0x4465b4
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1a0], eax
jne 0x4467c6
push 1
lea ecx, [ebp - 0x294]
call fcn.0040fd61
mov dword [ebp - 0xc8], 0xc86695cd
mov dword [ebp - 0x200], 0xbcf59f89
mov dword [ebp - 0x20], 0
jmp 0x4465f4
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x446610
push dword [ebp - 0x20]
lea ecx, [ebp - 0x294]
call fcn.0040fe4f
mov dword [eax], 0xfffffff9
jmp 0x4465ed
mov dword [ebp - 0x20], 0
jmp 0x446620
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x446636
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x25c], 1
jmp 0x446619
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0xc8], 1
jne 0x446661
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x25c], 0
jne 0x446661
and dword [ebp - 0xb8], 0
jmp 0x44666b
mov dword [ebp - 0xb8], 1
cmp dword [ebp - 0xb8], 0
ja 0x446680
mov dword [ebp - 0x1a8], 1
jmp 0x446687
and dword [ebp - 0x1a8], 0
cmp dword [ebp - 0x1a8], 3
je 0x44669c
mov dword [ebp - 0x1e0], 1
jmp 0x4466a3
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2a8], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1d0]
cmp dword [ebp + eax - 0x1d0], ecx
jge 0x4466e2
mov dword [ebp - 0xc0], 1
jmp 0x4466e9
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc0], eax
jl 0x446700
mov dword [ebp - 0x1b0], 1
jmp 0x446707
and dword [ebp - 0x1b0], 0
cmp dword [ebp - 0x1b0], 0xffffffff
je 0x44671c
mov dword [ebp - 0x1b8], 1
jmp 0x446723
and dword [ebp - 0x1b8], 0
push 0
lea ecx, [ebp - 0x294]
call fcn.0040fe4f
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x1b8]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x1d0]
cmp eax, dword [ebp - 0xc8]
jge 0x44675f
mov dword [ebp - 0x18c], 1
jmp 0x446766
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x200], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25c]
cmp dword [ebp - 0x3c], eax
jge 0x446790
mov dword [ebp - 0x90], 1
jmp 0x446797
and dword [ebp - 0x90], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x90]
mov dword [ebp + eax - 0x1d0], ecx
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xec], eax
lea ecx, [ebp - 0x294]
call fcn.0040fe33
jmp 0x44684e
mov dword [ebp - 0x238], 2
mov dword [ebp - 0xdc], 0xbb6af833
mov dword [ebp - 0xdc], 0xffff
cmp dword [ebp - 0xdc], 0x31b54653
jle 0x4467fc
mov dword [ebp - 0x154], 1
jmp 0x446803
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x154]
jl 0x44681a
mov dword [ebp - 0xe4], 1
jmp 0x446821
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xe4], eax
jle 0x446838
mov dword [ebp - 0x1ac], 1
jmp 0x44683f
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x238]
add eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
dec eax
je 0x44692a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d0]
cmp dword [ebp - 0x44], eax
jne 0x446875
mov dword [ebp - 0x15c], 1
jmp 0x44687c
and dword [ebp - 0x15c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d0]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d0]
cmp dword [ebp - 0xec], eax
jge 0x4468b8
mov dword [ebp - 0xf4], 1
jmp 0x4468bf
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0x15c]
add eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x3c]
jle 0x4468dc
mov dword [ebp - 0x194], 1
jmp 0x4468e3
and dword [ebp - 0x194], 0
cmp dword [ebp - 0x194], 0xffffffff
jle 0x4468f8
mov dword [ebp - 0x240], 1
jmp 0x4468ff
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c8], eax
push 8
pop eax
test eax, eax
jne 0x44691e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1d0], 0
je 0x44692a
mov dword [ebp - 0xfc], 1
jmp 0x446931
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x44], eax
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x44775f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x50], 0xb3c6
push 4
lea ecx, [ebp - 0x27c]
call fcn.0040fd61
mov dword [ebp - 0x2d0], 0x9dd9
mov dword [ebp - 0x60], 0
jmp 0x44697d
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x446999
push dword [ebp - 0x60]
lea ecx, [ebp - 0x27c]
call fcn.0040fe4f
mov dword [eax], 9
jmp 0x446976
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x164], eax
push 2
lea ecx, [ebp - 0x27c]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x164]
mov dword [eax], ecx
cmp dword [ebp - 0x164], 0
je 0x446a1a
mov dword [ebp - 0x248], 0xe814
mov dword [ebp - 0x50], 0x13
jmp 0x4469da
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x3c
jg 0x446a18
mov dword [ebp - 0x1f8], 0x3843
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x1f8], eax
mov byte [ebp - 0x33], 0
movzx eax, byte [ebp - 0x33]
test eax, eax
je 0x446a16
push 0x129d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4469d3
jmp 0x446a4a
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x446a4a
push 0x98a
push 0
push 0
push 0x158a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
lea ecx, [ebp - 0x27c]
call fcn.0040fe33
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x2d8], 0xc6a5
mov byte [ebp - 0x37], 0
movzx eax, byte [ebp - 0x37]
test eax, eax
je 0x446a8f
push 0
push 0
push 0xf79
push 0x4be
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
mov byte [ebp - 0x2d], 0
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x446ab1
push 0
push 0
push 0x392
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x70], eax
push 1
lea ecx, [ebp - 0x1dc]
call fcn.0040fd61
mov dword [ebp - 0x1bc], 0x48f4a8fe
mov dword [ebp - 0x2e0], 0
mov dword [ebp - 0x22c], 0
push 4
lea ecx, [ebp - 0x288]
call fcn.0040fd61
mov dword [ebp - 0x23c], 0xfe4de5a8
mov dword [ebp - 0x2e8], 5
mov dword [ebp - 0x24], 0
jmp 0x446b16
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x446b32
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1dc]
call fcn.0040fe4f
mov dword [eax], 0xb26bdde0
jmp 0x446b0f
mov dword [ebp - 0x24], 0
jmp 0x446b42
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x446b5e
push dword [ebp - 0x24]
lea ecx, [ebp - 0x288]
call fcn.0040fe4f
mov dword [eax], 0xc2489102
jmp 0x446b3b
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x446b7e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040fe4f
and dword [eax], 0
jmp 0x446bb4
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040fe4f
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040fe4f
cmp dword [eax], 0xe
jl 0x446dbe
mov dword [ebp - 0x68], 0x816210b9
push 2
lea ecx, [ebp - 0x224]
call fcn.0040fd61
mov dword [ebp - 0x98], 0x2b7b
mov dword [ebp - 0x8c], 0
jmp 0x446c01
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x446c20
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x224]
call fcn.0040fe4f
and dword [eax], 0
jmp 0x446bf4
cmp dword [ebp - 0x68], 0
je 0x446c36
lea ecx, [ebp - 0x224]
call fcn.0040fe33
jmp 0x446dbe
mov eax, dword [ebp - 0x68]
add eax, 0x488d8706
jne 0x446c4f
cmp dword [ebp - 0x68], 0
jne 0x446c4f
and dword [ebp - 0x10c], 0
jmp 0x446c59
mov dword [ebp - 0x10c], 1
cmp dword [ebp - 0x22c], 0
jne 0x446c6e
mov dword [ebp - 0x1f4], 1
jmp 0x446c75
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x1bc], 0
je 0x446cb1
xor eax, eax
inc eax
je 0x446cb1
cmp dword [ebp - 0x23c], 0
je 0x446cb1
mov dword [ebp - 0x94], 1
jmp 0x446cb8
and dword [ebp - 0x94], 0
push 1
lea ecx, [ebp - 0x288]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x94], eax
je 0x446ce7
mov dword [ebp - 0x16c], 1
jmp 0x446cee
and dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x10c]
imul eax, dword [ebp - 0x16c]
test eax, eax
je 0x446d14
mov eax, 0xffff
test eax, eax
je 0x446d14
mov dword [ebp - 0x114], 1
jmp 0x446d1b
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0x114]
cmp eax, 7
jne 0x446d36
mov dword [ebp - 0x19c], 1
jmp 0x446d3d
and dword [ebp - 0x19c], 0
push 0
lea ecx, [ebp - 0x1dc]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x19c]
cmp ecx, dword [eax]
jge 0x446d60
mov dword [ebp - 0x11c], 1
jmp 0x446d67
and dword [ebp - 0x11c], 0
cmp dword [ebp - 0x11c], 0
jne 0x446d79
mov eax, 0x9ae8
test eax, eax
je 0x446d9a
push 0
lea ecx, [ebp - 0x224]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x446d98
lea ecx, [ebp - 0x224]
call fcn.0040fe33
jmp 0x446dbe
jmp 0x446dae
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x446dae
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
lea ecx, [ebp - 0x224]
call fcn.0040fe33
jmp 0x446b90
lea ecx, [ebp - 0x288]
call fcn.0040fe33
lea ecx, [ebp - 0x1dc]
call fcn.0040fe33
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x234], eax
push 2
lea ecx, [ebp - 0x308]
call fcn.0040fd61
mov dword [ebp - 0x88], 0xeef20fe6
mov dword [ebp - 0x2f8], 0xad4351cd
mov dword [ebp - 0x28], 0
jmp 0x446e11
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x446e2d
push dword [ebp - 0x28]
lea ecx, [ebp - 0x308]
call fcn.0040fe4f
mov dword [eax], 0x571177e8
jmp 0x446e0a
mov dword [ebp - 0x28], 0
jmp 0x446e3d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x446e53
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x330], 3
jmp 0x446e36
mov dword [ebp - 0x88], 0
jmp 0x446e6c
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jg 0x446e8e
mov dword [ebp - 0x174], 0xffffffff
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
jmp 0x446e5f
lea ecx, [ebp - 0x308]
call fcn.0040fe33
mov eax, dword [ebp - 0x70]
mov dword [eax], 0xfffffff2
jmp 0x446eaf
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x70]
mov dword [ecx], eax
mov eax, dword [ebp - 0x70]
cmp dword [eax], 0x10
jge 0x4475d7
mov eax, dword [ebp - 0x234]
mov dword [eax], 0x951ad386
mov dword [ebp - 4], 4
mov dword [ebp - 0x84], 0
jmp 0x446ee7
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x446f03
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xa8], 0x7862
jmp 0x446eda
mov dword [ebp - 4], 0
jmp 0x446f13
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jg 0x447030
mov dword [ebp - 0x204], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xa8]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xa8]
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xa8]
imul eax, dword [ebp - 4]
cmp eax, 0xf5bfb66f
je 0x446f7a
mov dword [ebp - 0x124], 1
jmp 0x446f81
and dword [ebp - 0x124], 0
cmp dword [ebp - 0x124], 0xb2c4
jle 0x446f9b
xor eax, eax
inc eax
jne 0x446f9b
and dword [ebp - 0x1b4], 0
jmp 0x446fa5
mov dword [ebp - 0x1b4], 1
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1b4], eax
jg 0x446fc6
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xa8], 0
jne 0x446fc6
and dword [ebp - 0x12c], 0
jmp 0x446fd0
mov dword [ebp - 0x12c], 1
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xa8]
cmp eax, dword [ebp - 0x12c]
jle 0x446fee
mov dword [ebp - 0x17c], 1
jmp 0x446ff5
and dword [ebp - 0x17c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xa8]
add eax, 0x66a7
cmp eax, dword [ebp - 0x17c]
jle 0x447018
mov dword [ebp - 0x134], 1
jmp 0x44701f
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x204], eax
jmp 0x446f0c
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x1c], 0x8a61928c
mov dword [ebp - 0x18], 0x9867f5d1
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x244], 0x1f9f8041
mov dword [ebp - 0x1c], 0
jmp 0x447063
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x11
jge 0x447366
mov dword [ebp - 0xc], 0x580849f8
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0x1c4], 0xfffffff9
mov dword [ebp - 0x210], 2
mov dword [ebp - 0x78], 0
jmp 0x4470a2
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x4470b5
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x10], 0x3099cfe0
jmp 0x44709b
mov dword [ebp - 0xc], 0
jmp 0x4470c5
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x447361
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0xa0], 0x509b
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0x2c], 0
jmp 0x4470fa
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x44735c
mov dword [ebp - 0x228], 0x49e3c8d3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp + ecx*4 - 0x10]
cmp dword [ebp + eax*4 - 0x10], ecx
jne 0x44712a
mov dword [ebp - 0x1a4], 1
jmp 0x447131
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x10]
cmp eax, dword [ebp - 0x1a4]
jl 0x44714c
mov dword [ebp - 0x13c], 1
jmp 0x447153
and dword [ebp - 0x13c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x13c], eax
jne 0x447172
xor eax, eax
jne 0x447172
and dword [ebp - 0x214], 0
jmp 0x44717c
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x10], 0
je 0x447198
cmp dword [ebp - 0xa0], 0
jne 0x4471a8
push 2
pop eax
test eax, eax
jne 0x4471a8
and dword [ebp - 0x184], 0
jmp 0x4471b2
mov dword [ebp - 0x184], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x184], eax
jl 0x4471c9
mov dword [ebp - 0x144], 1
jmp 0x4471d0
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0x144]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0x31defcec
jg 0x4471fa
mov dword [ebp - 0x14c], 1
jmp 0x447201
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x1c]
jne 0x44721b
mov dword [ebp - 0xc4], 1
jmp 0x447222
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xe0], eax
jne 0x447266
mov dword [ebp - 0xe8], 1
jmp 0x44726d
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0xe8], eax
jl 0x447287
mov dword [ebp - 0xf0], 1
jmp 0x44728e
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x2c], eax
jg 0x4472ab
mov dword [ebp - 0xf8], 1
jmp 0x4472b2
and dword [ebp - 0xf8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0xf8], eax
jne 0x4472d7
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x10], 0
jne 0x4472d7
and dword [ebp - 0x100], 0
jmp 0x4472e1
mov dword [ebp - 0x100], 1
cmp dword [ebp - 0x100], 0xc265
jge 0x447303
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x10], 0
je 0x447303
mov dword [ebp - 0x108], 1
jmp 0x44730a
and dword [ebp - 0x108], 0
cmp dword [ebp - 0x108], 8
jg 0x44731f
mov dword [ebp - 0x110], 1
jmp 0x447326
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x10]
sub eax, dword [ebp - 0x110]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x10]
mov dword [ebp - 0x228], eax
mov byte [ebp - 0x2e], 0
movzx eax, byte [ebp - 0x2e]
test eax, eax
je 0x447357
push 0
call dword [sym.imp.USER32.dll_CharNextW]
jmp 0x4470f3
jmp 0x4470be
jmp 0x44705c
mov dword [ebp - 0x4c], 0xb
jmp 0x447376
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffed
jle 0x44754f
mov dword [ebp - 0x148], 0x94ae9822
mov dword [ebp - 0x54], 0
jmp 0x44739a
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x4473b0
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x20c], 0xaa9b2235
jmp 0x447393
mov dword [ebp - 0x18], 0
jmp 0x4473c0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x44754a
mov dword [ebp - 0x140], 0xffffffff
mov dword [ebp - 0x230], 0xb1ec
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x1c], 0
jmp 0x4473f8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x447545
mov byte [ebp - 0x46], 0
movzx eax, byte [ebp - 0x46]
test eax, eax
je 0x44741f
push 0x191a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 9
pop eax
test eax, eax
je 0x44752d
cmp dword [ebp - 0x140], 0
jne 0x447441
xor eax, eax
inc eax
jne 0x447441
and dword [ebp - 0x118], 0
jmp 0x44744b
mov dword [ebp - 0x118], 1
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x118], eax
jge 0x447465
mov dword [ebp - 0x120], 1
jmp 0x44746c
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x20c]
imul eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x18]
jge 0x44748e
mov dword [ebp - 0x128], 1
jmp 0x447495
and dword [ebp - 0x128], 0
imul eax, dword [ebp - 0x128], 0xe3b6
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x80e1b4ad
je 0x4474bd
mov dword [ebp - 0x218], 1
jmp 0x4474c4
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x20c]
mov dword [ebp - 0x2c4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x20c]
sub eax, 0x2ffa
cmp eax, dword [ebp - 0x18]
jl 0x4474f7
mov dword [ebp - 0x138], 1
jmp 0x4474fe
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x148], eax
jge 0x447521
mov eax, 0xa01dc0bf
test eax, eax
je 0x44752d
mov dword [ebp - 0x150], 1
jmp 0x447534
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x244], eax
jmp 0x4473f1
jmp 0x4473b9
jmp 0x44736f
movzx eax, byte [ebp - 0x30]
test eax, eax
je 0x4475d2
mov dword [ebp - 0x2e4], 0xca63
mov byte [ebp - 0x32], 0
movzx eax, byte [ebp - 0x32]
test eax, eax
je 0x44757e
push 0
push 0
push 0x14a5
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov byte [ebp - 0x34], 0
movzx eax, byte [ebp - 0x34]
test eax, eax
je 0x4475be
push 0
push 0x213a
push 0x112b
push 0x183f
push 0x240f
push 0x235b
push 0x16cd
push 0xec7
push 0x2210
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x446ea4
mov dword [ebp - 0x14], 0
push 3
lea ecx, [ebp - 0x2a0]
call fcn.0040fd61
mov dword [ebp - 0x58], 0
jmp 0x4475fb
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x447617
push dword [ebp - 0x58]
lea ecx, [ebp - 0x2a0]
call fcn.0040fe4f
mov dword [eax], 0xb76eea53
jmp 0x4475f4
mov dword [ebp - 0x14], 0
jmp 0x447627
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1a
jle 0x447723
mov dword [ebp - 0x5c], 0
jmp 0x447641
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x447657
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x320], 1
jmp 0x44763a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x320], 0
je 0x4476c2
mov dword [ebp - 0x64], 0xf5cd53bc
mov dword [ebp - 0x64], 0
jmp 0x44767e
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xfffffff4
jg 0x4476c0
mov dword [ebp - 0x6c], 0x1328f6c7
mov dword [ebp - 0x6c], 3
jmp 0x44769b
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x4476be
mov byte [ebp - 0x36], 0
movzx eax, byte [ebp - 0x36]
test eax, eax
je 0x4476bc
push 0x1a70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x447694
jmp 0x447677
jmp 0x44771e
mov dword [ebp - 0x74], 0x941fc9a5
mov dword [ebp - 0x74], 0
jmp 0x4476d9
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 9
je 0x44771e
mov dword [ebp - 0x1e4], 0xfffffff7
mov byte [ebp - 0x2f], 0
movzx eax, byte [ebp - 0x2f]
test eax, eax
je 0x447713
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1e4], eax
jmp 0x4476d2
jmp 0x447620
mov dword [ebp - 0x14], 0
jmp 0x447733
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x44774f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2a0]
call fcn.0040fe4f
mov dword [eax], 0x3051ebf0
jmp 0x44772c
lea ecx, [ebp - 0x2a0]
call fcn.0040fe33
jmp 0x447a0f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1e8], eax
push 1
lea ecx, [ebp - 0xd4]
call fcn.0040fd61
mov dword [ebp - 0x168], 0xacc5d9b4
mov dword [ebp - 0x170], 0xfffffffd
mov dword [ebp - 0x178], 0x28fdeb77
mov dword [ebp - 0x190], 1
mov dword [ebp - 0xb4], 0xe9d60a22
mov dword [ebp - 0x2cc], 0xffffffff
mov dword [ebp - 0x7c], 0
jmp 0x4477c1
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x4477dd
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xd4]
call fcn.0040fe4f
mov dword [eax], 8
jmp 0x4477ba
push 0
lea ecx, [ebp - 0xd4]
call fcn.0040fe4f
cmp dword [eax], 0
jne 0x4477fb
mov dword [ebp - 0x158], 1
jmp 0x447802
and dword [ebp - 0x158], 0
push 0
lea ecx, [ebp - 0xd4]
call fcn.0040fe4f
mov eax, dword [eax]
cmp eax, dword [ebp - 0x158]
jg 0x447825
mov dword [ebp - 0x160], 1
jmp 0x44782c
and dword [ebp - 0x160], 0
push 0
lea ecx, [ebp - 0xd4]
call fcn.0040fe4f
push 0
lea ecx, [ebp - 0xd4]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x447869
push 0
lea ecx, [ebp - 0xd4]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x447869
mov dword [ebp - 0x180], 1
jmp 0x447870
and dword [ebp - 0x180], 0
push 0
lea ecx, [ebp - 0xd4]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x160]
sub ecx, dword [eax]
mov dword [ebp - 0x168], ecx
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
cmp eax, dword [ebp - 0x180]
jne 0x4478bd
mov dword [ebp - 0x188], 1
jmp 0x4478c4
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jne 0x4478eb
cmp dword [ebp - 0xb4], 0
jne 0x4478eb
and dword [ebp - 0x198], 0
jmp 0x4478f5
mov dword [ebp - 0x198], 1
cmp dword [ebp - 0x198], 0x56ee
je 0x44790d
mov dword [ebp - 0xb0], 1
jmp 0x447914
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], eax
lea ecx, [ebp - 0xd4]
call fcn.0040fe33
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x270], 5
mov dword [ebp - 0x26c], 5
mov dword [ebp - 0x268], 5
mov dword [ebp - 0x264], 5
lea ecx, [ebp - 0x99]
call fcn.0040fe5e
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x310]
call fcn.0040fe61
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x254]
call fcn.0040fe0d
push 0
lea ecx, [ebp - 0x254]
call fcn.0040fe4f
mov dword [eax], 0xf
jmp 0x4479cd
push 0
lea ecx, [ebp - 0x254]
call fcn.0040fe4f
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xbc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x254]
call fcn.0040fe4f
cmp dword [eax], 9
je 0x4479f8
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x4479f6
push 0x132a
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x4479a9
lea ecx, [ebp - 0x254]
call fcn.0040fe33
mov eax, dword [ebp - 0x1f0]
mov dword [eax], 0x10
mov esp, ebp
pop ebp
ret