Function at 0x4266c5
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
push ebx
push esi
push edi
mov byte [ebp - 0x2d], dl
xor edx, edx
push 2
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
pop esi
jmp 0x4266f2
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x10c], 0x5464
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4266e1
xor edi, edi
mov dword [ebp - 8], edx
inc edi
jmp 0x426710
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xbc], 0xfffffffc
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4266ff
mov eax, dword [ebp - 0x10c]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0xbc], eax
test eax, eax
je 0x426743
mov dword [ebp - 0x2c], 6
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xbc], eax
jmp 0x426771
mov byte [ebp - 1], dl
cmp byte [ebp - 1], dl
je 0x426771
push 0x2079
push 0x2505
push 0x1ce3
push 0x5e8
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
xor edx, edx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 8], edx
jmp 0x426794
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xe4], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x426787
mov dword [ebp - 8], edx
jmp 0x4267af
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1ac], 0x2ef703c5
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x42679e
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0xfffffffa
jne 0x42686d
mov dword [ebp - 0x14], 0x34111d01
mov dword [ebp - 0x2c], 0xffffffff
cmp dword [ebp - 0x18], edx
je 0x426829
cmp dword [ebp - 0xe4], 0xc422
jle 0x4267e8
mov esi, edx
cmp dword [ebp - 0x18], edx
je 0x4267ea
mov esi, edi
dec dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp eax, esi
push 0
setl cl
sub edx, ecx
mov ecx, edi
pop eax
sete al
mov dword [ebp - 0x1ac], edx
sub eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub eax, dword [ebp - 0xe0]
cmp eax, 0xffffffff
jne 0x42682b
mov ecx, edx
mov eax, edi
mov dword [ebp - 0x2c], 0x290b
sub eax, ecx
add eax, dword [ebp - 0x2c]
jne 0x426842
mov eax, edx
cmp dword [ebp - 0x14], edx
je 0x426844
mov eax, edi
mov dword [ebp - 0xe4], eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x42685d
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor edx, edx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffa
je 0x4267c2
push 2
pop esi
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x426881
push edx
push edx
push edx
call dword [sym.imp.USER32.dll_UnionRect]
xor edx, edx
mov dword [ebp - 8], 0x540d7f82
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], edx
jmp 0x4268a8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x150], 0xa772304b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x426897
mov dword [ebp - 8], 0xfffffff0
jmp 0x4268e0
mov dword [ebp - 0xc], 0xa4d073ff
cmp dword [ebp - 8], edx
jne 0x4268e5
mov dword [ebp - 0xc], edx
jmp 0x4268d8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x150], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x4268c7
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4268b6
mov dword [ebp - 8], edx
jmp 0x42699a
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], edx
jmp 0x426919
mov dword [ebp - 0xc], edx
jmp 0x42690b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xb8], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x4268fa
dec dword [ebp - 0xb8]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x4268f5
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], edx
jl 0x426997
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], edx
jl 0x426992
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x426940
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], edx
jl 0x42698d
mov dword [ebp - 0x14], 0x4f88039d
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], edx
jl 0x426988
mov dword [ebp - 0xc], 0xa945cb81
mov dword [ebp - 0xc], edx
jmp 0x42697e
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x42697b
push 0x140c
push edx
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor edx, edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jle 0x426963
dec dword [ebp - 0x14]
jns 0x426957
dec dword [ebp - 0x18]
jns 0x426948
dec dword [ebp - 0x10]
jns 0x42692e
dec dword [ebp - 0x1c]
jns 0x426926
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x4268ed
mov eax, dword [0x48a5ec]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x24], 0xd8cb4c23
mov dword [ebp - 0x24], 0x865425a8
mov dword [ebp - 0x24], 0x74c7af5a
mov dword [ebp - 0x24], 0xffffffff
push 9
mov dword [ebp - 0x10], 0xb16aac89
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], edx
pop esi
jmp 0x4269ea
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1c4], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4269dd
mov dword [ebp - 8], 0x10
jmp 0x426a0f
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x426a0c
push edx
push edx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
xor edx, edx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xe
jg 0x4269f9
mov dword [ebp - 8], 0xfffffffe
jmp 0x426a5a
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], 0xa5223fa3
mov dword [ebp - 0x24], 0xa29f5838
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0xc], edx
jmp 0x426a4f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x154], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x426a42
dec dword [ebp - 0x10]
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x426a1e
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], 0xfffa
push 2
mov dword [ebp - 0x1c], 0x9e86
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [ebp - 8], edx
pop ecx
jmp 0x426a91
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x50], 0x915a1369
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x426a83
mov dword [ebp - 8], edx
jmp 0x426aac
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa0], 0x48320013
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x426a9b
cmp dword [ebp - 0x4c], edx
jne 0x426ab9
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp eax, edi
mov eax, dword [ebp - 0x4c]
setge cl
imul eax, ecx
cmp eax, dword [ebp - 0x4c]
jl 0x426ad1
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 4
pop ecx
test eax, eax
je 0x426b26
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x426b03
push 0x1c75
push 0x1ab1
call dword [sym.imp.USER32.dll_SetCaretPos]
xor edx, edx
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x426c2f
push edx
push edx
push 0x461
push 0x220b
call ebx
push eax
call edi
jmp 0x426c2d
mov dword [ebp - 0x14], ecx
xor ebx, ebx
mov dword [ebp - 0x24], 0xf4442628
inc ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x24], 0xb35f1971
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0x8c2afe24
mov dword [ebp - 8], edx
jmp 0x426b6a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1b8], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x426b5d
mov dword [ebp - 8], edx
cmp dword [ebp - 8], ecx
jge 0x426b8f
mov edx, 0xffff
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x184], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x426b7d
mov eax, dword [ebp - 0x1b0]
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x28]
cmp eax, 0x277ed469
mov eax, dword [ebp - 0xc]
setne cl
imul esi, ecx
xor ecx, ecx
cmp eax, ebx
mov eax, dword [ebp - 0x4c]
setg cl
xor edx, edx
cmp ecx, esi
mov esi, dword [ebp + 8]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, 0xb5d2300b
sete cl
cmp eax, ecx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setg cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, 0x8150
setge cl
xor edx, edx
mov dword [ebp - 0x4c], ecx
dec dword [ebp - 0x178]
mov ecx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x18]
cmp eax, 1
setge dl
imul edx, ecx
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x9c], edx
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x1c], edx
inc ecx
cmp dword [ebp - 0x1c], ecx
jg 0x426d32
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0xc], edx
jmp 0x426c61
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xfc], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x426c54
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edx
jne 0x426c72
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xfc]
xor ecx, ecx
mov eax, dword [ebp - 0x9c]
cmp eax, 0xc11d
setge cl
cmp ecx, 0xffffffff
sbb eax, eax
xor ebx, ebx
lea ecx, [eax - 0x5669962a]
mov eax, dword [ebp - 0xf8]
mov edx, dword [ebp - 0xfc]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
sete bl
xor ecx, ecx
sub edx, ebx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x426cc4
xor eax, eax
cmp dword [ebp - 0xf4], eax
je 0x426cc7
xor eax, eax
inc eax
mov edx, dword [ebp - 0x9c]
sub edx, eax
mov eax, dword [ebp - 0xf4]
neg edx
push 0
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor edx, edx
sub ecx, 0xfff6
mov dword [ebp - 0x28], ecx
mov ecx, 0x55fd
mov eax, dword [ebp - 0x9c]
sub ecx, eax
mov eax, dword [ebp - 0x14]
add eax, ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
imul ecx, dword [ebp - 0x10], 0xc301
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
inc ecx
mov dword [ebp + eax*4 - 0xa0], edx
inc dword [ebp - 0x1c]
pop edx
cmp dword [ebp - 0x1c], ecx
jle 0x426c3e
cmp byte [ebp - 0x2d], 0
je 0x426f05
cmp dword [ebp - 0x2c], ecx
jne 0x426f05
mov dword [ebp - 8], edx
jmp 0x426d5b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x12c], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x426d4a
mov dword [ebp - 8], edx
jmp 0x426d74
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x60], 0xfe7d8a87
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x426d66
mov dword [ebp - 0x60], 3
cmp dword [ebp - 0x60], edx
jl 0x426ea0
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov edi, 0xffff
mov dword [ebp - 0x10], 0x8cca6991
mov dword [ebp - 0xc], edx
jmp 0x426daf
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x38], 0x73ff82ff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x426da1
mov dword [ebp - 0x38], 3
cmp dword [ebp - 0x38], edx
jl 0x426e65
mov dword [ebp - 0x28], 0xfffffffc
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x12c]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + eax*4 - 0x12c]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0x5c]
setg dl
sub edx, 0x5a8ccedb
neg edx
sbb edx, edx
inc edx
sub edx, eax
mov dword [ebp - 0x10], edx
xor edx, edx
mov ecx, dword [ebp - 0x128]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setne dl
mov ecx, dword [ebp + eax*4 - 0x12c]
mov eax, dword [ebp - 0x10]
sub ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0x5c]
add eax, ecx
mov ecx, dword [ebp - 0x38]
add ecx, eax
mov eax, dword [ebp - 0x12c]
cmp edi, ecx
sbb ecx, ecx
xor edx, edx
inc ecx
imul eax, ecx
mov dword [ebp - 0x28], eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], dl
je 0x426e5c
push 0x1195
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
xor edx, edx
dec dword [ebp - 0x38]
jns 0x426dc4
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x426e8e
push edx
push edx
push edx
push 0xb3a
push 0x1b3b
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor edx, edx
dec dword [ebp - 0x60]
push 1
pop ecx
jns 0x426d95
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov dword [ebp - 0x60], 0x10cbbbc2
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], 3
mov dword [esi + 8], 4
cmp dword [ebp - 0x10], edx
jl 0x426efe
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x426ef9
push 0x105d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor edx, edx
dec dword [ebp - 0x10]
jns 0x426edc
mov dword [esi + 0xc], 0x48a5ec
xor esi, esi
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 8], edx
inc esi
jmp 0x426f25
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x100], 0x4a8c6a53
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x426f14
mov dword [ebp - 8], edx
jmp 0x426f3c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x160], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x426f2f
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], edx
jl 0x426fc9
mov dword [ebp - 0x18], 0xb1891f78
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x10], 8
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x426f78
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
xor edx, edx
mov dword [ebp - 0x18], edx
jmp 0x426fbf
mov dword [ebp - 0x24], esi
mov ecx, 0x57392715
mov dword [ebp - 0x24], 0xd34caa8e
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + eax*4 - 0x100]
mov eax, dword [ebp - 0x18]
sub ecx, eax
add edx, ecx
mov dword [ebp - 0x28], edx
xor edx, edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
jne 0x426fb4
mov eax, edx
cmp dword [ebp - 0x158], edx
je 0x426fb6
mov eax, esi
mov dword [ebp - 0x15c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x426f7d
dec dword [ebp - 0x1c]
jns 0x426f4a
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], edx
jl 0x427045
mov dword [ebp - 0xc], edx
jmp 0x426fe4
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x58], 4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x426fd6
mov dword [ebp - 0x58], edx
cmp dword [ebp - 0x58], edx
jl 0x427040
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], edx
jl 0x42703b
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], edx
jl 0x427036
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x427031
push 0x1cb0
push 0x2040
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor edx, edx
dec dword [ebp - 0x10]
jns 0x42700f
dec dword [ebp - 0x14]
jns 0x427004
dec dword [ebp - 0x58]
jns 0x426ff1
dec dword [ebp - 0x1c]
jns 0x426fd1
mov ebx, dword [ebp - 0x20]
cmp ebx, dword [ebp - 0x2c]
jge 0x427dbb
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], 0x4f204795
mov dword [ebp - 0x24], 0x955a
mov dword [ebp - 0xc], edx
jmp 0x42707f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x138], 0x96f377cc
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x42706e
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setl dl
cmp edx, dword [ebp - 0x134]
je 0x4270aa
cmp dword [ebp - 0x10], 0
je 0x4270aa
mov edx, esi
jmp 0x4270ac
xor edx, edx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x138]
setg cl
sub ecx, eax
mov eax, dword [ebp - 0x134]
add eax, ecx
je 0x4270d1
mov dword [ebp - 0x28], 0xfffffff8
jmp 0x4270db
mov dword [ebp - 0x10], 0xdc6b79df
inc dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xa6de
mov esi, 0x48a5f0
xor edx, edx
mov dword [ebp - 0x24], 0x51328f6c
mov dword [ebp - 0x1c], esi
mov dword [ebp - 8], edx
jmp 0x427109
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x90], 0xd72276b8
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x4270f8
xor ecx, ecx
mov dword [ebp - 8], edx
inc ecx
jmp 0x427128
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb4], 0xfffffff9
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x427117
mov dword [ebp - 8], edx
jmp 0x427143
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa8], 0x393e75cb
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x427132
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0xa8]
dec dword [ebp - 0xa8]
sub ecx, eax
je 0x427164
xor eax, eax
inc eax
jmp 0x427166
mov eax, edx
cmp eax, dword [ebp - 0xb4]
jl 0x42719b
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 3
sbb eax, eax
inc eax
mov dword [ebp - 0x8c], eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], dl
je 0x4271ca
push edx
push edx
push 0x461
push 0x220b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor edx, edx
xor edi, edi
mov dword [ebp - 0x28], edx
inc edi
test ebx, ebx
jle 0x42776d
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 8], edx
jmp 0x4271fb
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xf0], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x4271ee
mov dword [ebp - 8], edx
jmp 0x427217
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1a0], 0x2ef703c5
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x427206
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0xfffffffa
jne 0x4272d5
mov dword [ebp - 0x10], 0x34111d01
mov dword [ebp - 0x14], 0xffffffff
cmp dword [ebp - 0x18], edx
je 0x427291
cmp dword [ebp - 0xf0], 0xc422
jle 0x427250
mov esi, edx
cmp dword [ebp - 0x18], edx
je 0x427252
mov esi, edi
dec dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, esi
push 0
setl cl
sub edx, ecx
mov ecx, edi
pop eax
sete al
mov dword [ebp - 0x1a0], edx
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub eax, dword [ebp - 0xec]
cmp eax, 0xffffffff
jne 0x427293
mov ecx, edx
mov eax, edi
mov dword [ebp - 0x14], 0x290b
sub eax, ecx
add eax, dword [ebp - 0x14]
jne 0x4272aa
mov eax, edx
cmp dword [ebp - 0x10], edx
je 0x4272ac
mov eax, edi
mov dword [ebp - 0xf0], eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x4272c5
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor edx, edx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffa
je 0x42722a
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x4272e9
push edx
push edx
push edx
call dword [sym.imp.USER32.dll_UnionRect]
xor edx, edx
mov ebx, dword [esi]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], 0xde2bbef7
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], edx
jmp 0x42730e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x168], 0x72d4ea68
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4272fd
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x427335
push edx
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov edi, dword [esi + 4]
dec eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 8], 0x5c8094a
mov dword [ebp - 0xc], edx
jmp 0x42735f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x88], 0x9f9b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x42734e
xor ecx, ecx
mov dword [ebp - 8], edx
inc ecx
cmp dword [ebp - 8], ecx
jg 0x427493
xor ebx, ebx
inc ebx
mov dword [ebp - 0xc], 0xafd94fe5
mov dword [ebp - 0x10], 0x275cf8b8
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0x643d4393
mov dword [ebp - 0xc], edx
jmp 0x427478
mov dword [ebp - 0x10], 0x99ea
or ecx, 0xffffffff
mov dword [ebp - 0x10], 0xfffffffc
mov dword [ebp - 0x10], 0x25d3c095
mov dword [ebp - 0x10], 0x13d8c537
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x88]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0xc]
sub ecx, eax
add ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0xc]
jg 0x4273da
mov eax, ebx
cmp dword [ebp - 8], edx
jne 0x4273dc
mov eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], edx
je 0x4273f5
mov eax, dword [ebp - 8]
mov ecx, ebx
cmp dword [ebp + eax*4 - 0x88], edx
jne 0x4273f7
mov ecx, edx
mov eax, dword [ebp - 8]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x88]
cmp ecx, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x88]
cmp edx, eax
setg cl
xor eax, eax
add ecx, dword [ebp - 8]
cmp ecx, 6
setle al
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
sub eax, 0x6de0d61a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jne 0x42743f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, 0xc1cc4929
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x88]
cmp ecx, eax
mov eax, dword [ebp - 8]
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, dword [ebp + eax*4 - 0x88]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], edx
jne 0x427481
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x42739a
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x427377
mov ebx, dword [ebp - 0x18]
xor ecx, ecx
inc ecx
add esi, 8
mov dword [ebp - 8], edx
jmp 0x4274ac
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x11c], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x42749b
mov dword [ebp - 8], edx
jmp 0x4274c5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x68], 0xfe7d8a87
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x4274b7
mov dword [ebp - 0x68], 3
cmp dword [ebp - 0x68], edx
jl 0x4275f0
mov ebx, 0xffff
mov dword [ebp - 0x10], 0x8cca6991
mov dword [ebp - 0xc], edx
jmp 0x4274fa
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x34], 0x73ff82ff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x4274ec
mov dword [ebp - 0x34], 3
cmp dword [ebp - 0x34], edx
jl 0x4275b4
mov dword [ebp - 0x10], 0xfffffffc
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x64]
setg dl
sub edx, 0x5a8ccedb
neg edx
sbb edx, edx
inc edx
sub edx, eax
mov dword [ebp - 0x10], edx
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x118]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x10]
sub ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0x64]
add eax, ecx
mov ecx, dword [ebp - 0x34]
add ecx, eax
mov eax, dword [ebp - 0x11c]
cmp ebx, ecx
sbb ecx, ecx
xor edx, edx
inc ecx
imul eax, ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], dl
je 0x4275ab
push 0x1195
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
xor edx, edx
dec dword [ebp - 0x34]
jns 0x42750f
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x4275e1
push edx
push edx
push edx
push 0xb3a
push 0x1b3b
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor edx, edx
dec dword [ebp - 0x68]
push 1
pop ecx
jns 0x4274e0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x68], 0x10cbbbc2
test edi, edi
jne 0x4275fe
add esi, 8
mov ecx, 0xffff
xor edi, edi
mov dword [ebp - 0x1c], ecx
inc edi
mov dword [ebp - 8], 0x570a50b5
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x18], 0x8f59172d
mov dword [ebp - 0x10], 0x467bb1a8
mov dword [ebp - 0x14], edx
jmp 0x427634
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x42762a
cmp dword [ebp - 0x3c], edx
je 0x427668
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
mov eax, 0xb0fe2cf4
neg ecx
sbb ecx, ecx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
neg ecx
imul eax, ecx
test eax, eax
je 0x427668
mov edx, edi
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
mov edx, 0xffff
setne cl
xor eax, eax
cmp ecx, 0x3bbb66ef
setle al
cmp edx, eax
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
neg ecx
sub ecx, eax
je 0x427692
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, dword [ebp - 8]
je 0x4276be
mov ecx, edi
cmp dword [ebp - 0xc], edx
jne 0x4276c0
mov ecx, edx
mov eax, dword [ebp - 0x18]
sub ecx, eax
xor eax, eax
cmp ecx, 0x9a9d
setl al
cmp eax, dword [ebp - 0x18]
jle 0x427706
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x427758
push 0x1641
push edx
push 0x2087
push 0x25d9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
xor edx, edx
jmp 0x427758
mov dword [ebp - 0xc], edx
jmp 0x427752
mov dword [ebp - 0x18], edx
jmp 0x42774a
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x3c], edx
jne 0x42774f
mov dword [ebp - 8], edx
cmp dword [ebp - 8], edx
jl 0x427747
mov dword [ebp - 0x1c], edx
jmp 0x427734
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3c], 0xfff8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x427726
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x3c], edx
jne 0x427747
dec dword [ebp - 8]
jns 0x427721
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x427710
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffed
jge 0x42770b
mov eax, dword [ebp - 0x28]
add esi, ebx
inc eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], eax
cmp eax, dword [ebp - 0x20]
jl 0x4271d8
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x74], edx
push 3
mov dword [ebp - 0xc], 0x83cc
pop ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0x3e87122a
push 2
mov dword [ebp - 0x24], 0x8c8a
mov dword [ebp - 8], edx
pop ecx
jmp 0x4277a6
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x70], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x42779c
mov dword [ebp - 8], edx
jmp 0x4277c1
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb0], 0x21fbb9cf
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x4277b0
mov dword [ebp - 0x80], edx
cmp dword [ebp - 0x80], edi
jg 0x4278fa
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], 0x7b6c411e
mov dword [ebp - 0x14], edx
jmp 0x4277f2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x104], 0x38770ce4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x4277e1
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp + eax*4 - 0x70]
cmp dword [ebp - 0x70], edx
je 0x42780f
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x10], edx
jne 0x427846
mov eax, dword [ebp - 0x80]
cmp dword [ebp + eax*4 - 0x70], edx
jne 0x427846
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x427860
push 0x457
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor edx, edx
jmp 0x427860
mov dword [ebp - 0x20], 7
mov eax, dword [ebp - 0x80]
cmp dword [ebp + eax*4 - 0x70], edx
jne 0x4278f4
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp + eax*4 - 0x70], edx
je 0x4278c9
mov eax, dword [ebp - 0x104]
xor ebx, ebx
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x80]
setg bl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x70]
cmp ebx, eax
mov eax, dword [ebp - 0xac]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xb0]
setl cl
cmp ecx, 0xb6749efe
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
xor edx, edx
cmp ecx, dword [ebp - 0xc]
mov ecx, edi
je 0x4278cb
mov ecx, edx
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp + eax*4 - 0x70]
imul eax, ecx
xor ecx, ecx
cmp eax, 0x45a9172c
setle cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], edi
jle 0x4277d2
push 2
pop ecx
push 3
pop ebx
mov edi, dword [esi]
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x20], 0x8fbfc75d
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x24], edi
mov dword [ebp - 8], edx
jmp 0x427923
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x44], 0xf57a7c20
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x427915
mov dword [ebp - 8], edx
jmp 0x42793a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x174], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x42792d
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], edx
je 0x427963
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
je 0x427963
xor eax, eax
inc eax
jmp 0x427965
mov eax, edx
mov edx, dword [ebp - 0x40]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x44]
cmp edx, eax
sete cl
xor ebx, ebx
cmp ecx, dword [ebp - 0x40]
jge 0x427986
cmp dword [ebp - 0x40], ebx
je 0x427986
xor edx, edx
inc edx
jmp 0x427988
mov edx, ebx
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x40]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setg cl
add eax, ecx
je 0x4279b2
cmp dword [ebp - 0x170], ebx
je 0x4279b2
xor eax, eax
inc eax
jmp 0x4279b4
mov eax, ebx
xor edx, edx
cmp eax, 0x4c638299
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setge cl
xor edx, edx
cmp ecx, 9
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setg bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor ebx, ebx
neg ecx
cmp ecx, dword [ebp - 0x10]
jle 0x4279f6
cmp dword [ebp - 0x44], ebx
jne 0x4279f6
mov edx, ebx
jmp 0x4279f9
xor edx, edx
inc edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x40]
jge 0x427a1a
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x427a27
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x427a27
mov dword [ebp - 0x20], 0x2e255bb5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
add esi, 4
xor ecx, ecx
mov dword [ebp - 0x1c], esi
inc ecx
mov esi, dword [esi]
mov dword [ebp - 0x14], 0xe05dae5a
mov dword [ebp - 0x18], 0xe5e53494
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], 0xfffffffc
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x28], 0xe86a6760
mov dword [ebp - 8], ebx
jmp 0x427a6e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x54], 0x389a9b8f
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x427a60
mov dword [ebp - 8], ebx
jmp 0x427a85
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x148], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x427a78
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x140]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xc], eax
imul eax, dword [ebp - 0x54], 0xb2455f2
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
sub edx, 0xe5a8
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov eax, dword [ebp - 0x10]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
neg ecx
jne 0x427ae8
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
xor edx, edx
inc edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jl 0x427b73
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x54], 0xffffffff
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x148]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x54], ecx
test ecx, ecx
je 0x427b40
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x427b6e
push 0x1f7e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
jmp 0x427b6b
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], ebx
jl 0x427b6e
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x427b66
push 0x2047
push ebx
push 0x497
call dword [sym.imp.KERNEL32.dll_OpenProcess]
dec dword [ebp - 0x18]
jns 0x427b4c
xor edx, edx
inc edx
dec dword [ebp - 0xc]
jns 0x427af9
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ecx
jmp 0x427b8f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], 0xc75b57fd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x427b81
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], 0xfffffff7
jl 0x427cd1
xor edi, edi
inc edi
mov dword [ebp - 8], 0xbd7b1c2a
mov dword [ebp - 0xc], 0x896e60be
mov dword [ebp - 8], ebx
jmp 0x427cac
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
jmp 0x427bd6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x98], 0x9949dfcf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x427bc5
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x427beb
call dword [sym.imp.USER32.dll_EndMenu]
mov dword [ebp - 0x98], ebx
jmp 0x427c9c
mov dword [ebp - 0x10], 0xc6fec1b1
mov dword [ebp - 0x20], 0xd574417f
cmp dword [ebp - 8], 0x86524f20
jne 0x427c5b
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x48]
je 0x427c1c
mov edx, edi
cmp dword [ebp - 8], ebx
jne 0x427c1e
mov edx, ebx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
add ecx, 0x4743
add eax, edx
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x98]
setl dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x28]
setne bl
xor ecx, ecx
cmp ebx, eax
sete cl
xor ebx, ebx
mov dword [ebp - 0xc], ecx
mov edx, ebx
mov eax, dword [ebp - 0xc]
jmp 0x427c5d
mov edx, edi
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, 0xfffffff8
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
cmp eax, 0x1723
setle cl
cmp ecx, dword [ebp - 0x28]
jge 0x427c8e
mov eax, edi
cmp dword [ebp - 0x48], ebx
jne 0x427c90
mov eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x48]
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], 9
jg 0x427bf6
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffa
jle 0x427bba
cmp dword [ebp - 0xc], ebx
jne 0x427cc8
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xfffffff7
jge 0x427ba4
mov edi, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
inc edx
test esi, esi
jne 0x427dc1
cmp byte [ebp - 0x2d], 0
je 0x427ced
cmp dword [ebp - 0x2c], edx
jne 0x427ced
mov edx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [edx + 8], eax
mov eax, dword [ecx]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 4]
add ecx, 8
push edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
call fcn.0046305b
pop ecx
mov ebx, eax
lea ecx, [ebp - 0xcc]
lea eax, [ebp - 0xe8]
mov dword [ebp - 0x28], ebx
xor esi, esi
push eax
push edi
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xc4], esi
call fcn.0044af9f
mov ecx, esi
mov esi, dword [ebp - 0xcc]
test edi, edi
jle 0x427d92
mov eax, ecx
and eax, 0x80000001
jns 0x427d51
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x24]
add eax, ecx
add eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x20]
cdq
idiv edi
xor eax, eax
cmp word [esi + edx*2], ax
je 0x427d7d
xor ebx, ebx
lea eax, [edx + 1]
cdq
idiv edi
cmp word [esi + edx*2], bx
jne 0x427d6e
mov ebx, dword [ebp - 0x28]
xor eax, eax
inc eax
mov word [esi + edx*2], ax
mov eax, dword [ebp - 0x1c]
mov al, byte [edx + eax]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jl 0x427d43
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [eax + 4], ebx
test esi, esi
je 0x427dbf
push esi
call fcn.00464546
xor ebx, ebx
pop ecx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
jmp 0x427dc1
xor ebx, ebx
jmp 0x427dc4
xor ebx, ebx
xor esi, esi
inc esi
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0xc], 0xac842f88
mov dword [ebp - 0x18], ebx
jmp 0x427f05
mov dword [ebp - 0x14], ebx
jmp 0x427df0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc0], 0x7689351f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x427ddf
cmp dword [ebp - 0x18], ebx
je 0x427ea8
mov dword [ebp - 0xdc], 0xffffffff
mov dword [ebp - 0xd8], 0xffffffff
mov dword [ebp - 0xd4], 0xffffffff
mov dword [ebp - 0xd0], 0xffffffff
mov dword [ebp - 0x24], 0x8ea5
mov dword [ebp - 0xd4], ebx
jmp 0x427e80
mov dword [ebp - 0x10], 0xd4dfbd6c
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x427e7a
mov dword [ebp - 0x14], 0xe81a7ecc
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x427e75
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x427e66
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xc0]
dec dword [ebp - 0x14]
jns 0x427e53
dec dword [ebp - 0x10]
jns 0x427e44
inc dword [ebp - 0xd4]
cmp dword [ebp - 0xd4], ebx
jle 0x427e35
cmp dword [ebp - 0x18], ebx
je 0x427e99
mov dword [ebp - 0xdc], 0xffffffff
jmp 0x427eb7
mov eax, dword [ebp - 0x24]
xor ecx, ecx
test eax, eax
sets cl
mov dword [ebp - 0xc], ecx
jmp 0x427eb7
mov dword [ebp - 0xc0], 0x3ac9d73d
cmp dword [ebp - 0x18], ebx
jne 0x427f02
mov dword [ebp - 0xc], 0xd
jmp 0x427efc
mov dword [ebp - 0x20], esi
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
mov dword [ebp - 0x20], edx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x427ef9
push 0x1957
push 0x267f
push 0x20a3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 5
jl 0x427ec0
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
jge 0x427dda
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret