Function at 0x44eb81
Capabilities:
Create process on windows
Query or enumerate registry key
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov byte [ebp - 0x3d], dl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], edx
jmp 0x44eba8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x174], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x44eb97
push 4
mov dword [ebp - 4], edx
pop ecx
jmp 0x44ebc7
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xf4], 0x5252cb13
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x44ebb6
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDC]
push 2
pop esi
mov dword [ebp - 0xf4], edx
cmp dword [ebp - 0xf4], esi
jg 0x44ec98
mov dword [ebp - 0x28], 0x82eac453
mov dword [ebp - 0x1c], 0xfff9
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x44ec1a
push 0x555
push 0x1648
push edx
call dword [sym.imp.USER32.dll_DeleteMenu]
xor edx, edx
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], edx
jl 0x44ec83
mov eax, dword [ebp - 0xf4]
cmp dword [ebp + eax*4 - 0x174], edx
je 0x44ec59
mov dword [ebp - 0x14], 0x6c516535
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x14], edx
jmp 0x44ec51
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x174], 0xec7516a2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x44ec40
jmp 0x44ec7b
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x44ec7b
push 0x211d
push 0x123e
push edx
call ebx
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
xor edx, edx
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x28]
jns 0x44ec22
inc dword [ebp - 0xf4]
cmp dword [ebp - 0xf4], esi
jle 0x44ebf0
push 4
pop ecx
mov dword [ebp - 0x14], 0xba76aabe
mov dword [ebp - 0xc], edx
jmp 0x44ecb5
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1ac], 0xffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x44eca4
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 3
push 1
pop esi
jg 0x44ed6f
mov dword [ebp - 0x1c], 0x251c6076
mov dword [ebp - 0xc], edx
jmp 0x44ece4
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x50], 0xae8c9f36
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x44ecd6
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x44ed0e
push 0x22cb
push 0x45c
push 0x1bb2
call ebx
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
xor edx, edx
mov dword [ebp - 0x50], 3
cmp dword [ebp - 0x50], edx
jl 0x44ed5f
cmp dword [ebp - 0x14], edx
jne 0x44ed28
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x50]
push 0xfffffffffffffff7
pop ecx
sub ecx, eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x1ac]
add eax, ecx
xor ecx, ecx
cmp eax, 9
setl cl
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x44ed5a
push edx
push edx
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor edx, edx
dec dword [ebp - 0x50]
jns 0x44ed1a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x44ecca
push 4
pop ecx
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0x25004286
mov dword [ebp - 4], 0xb9a67b9c
mov dword [ebp - 0xc], 0x7ad
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x1c], 0xbe80
mov dword [ebp - 0x18], 0x9a2b441a
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x10], edx
jne 0x44edc6
mov eax, dword [ebp - 0x10]
mov ecx, edx
cmp eax, dword [ebp - 0x10]
je 0x44edc8
mov ecx, esi
xor eax, eax
cmp ecx, 0xd21b
setg al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
sub edx, eax
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setg dl
imul edx, dword [ebp - 4]
cmp edx, dword [ebp - 4]
jge 0x44ee12
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x14], edx
jne 0x44ee2b
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x10], edx
jne 0x44ee40
mov ecx, edx
cmp dword [ebp - 0xa0], edx
je 0x44ee42
mov ecx, esi
xor eax, eax
cmp ecx, 0xfffffffb
setle al
shl eax, 2
cmp eax, dword [ebp - 0xa0]
jne 0x44eec6
mov dword [ebp - 4], 0xb
jmp 0x44eebb
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], edx
jl 0x44eeb8
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x44ee89
push 0x24f9
push edx
push 0x16a6
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
xor edx, edx
mov dword [ebp - 0xc], edx
jmp 0x44eead
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x44eeaa
push 0x2063
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
xor edx, edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x44ee8e
dec dword [ebp - 0x18]
jns 0x44ee6a
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff2
jne 0x44ee5e
jmp 0x44ef83
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], 0x38aa138a
mov dword [ebp - 0x38], 0x819b53b3
mov dword [ebp - 0x44], 0x7322662b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], edx
jl 0x44ef83
mov dword [ebp - 0x28], 3
xor ebx, ebx
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x10]
push 0
mov ecx, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x30]
imul ecx, eax
mov dword [ebp - 0x98], ecx
test ecx, ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], 0xfffffffe
setne bl
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
sub edx, eax
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop edx
setl cl
xor eax, eax
add ecx, dword [ebp - 0x30]
cmp ebx, ecx
setl al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x44]
dec dword [ebp - 0x10]
jns 0x44eef4
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], 0x94d0
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0xc], edx
jmp 0x44efa8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xac], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x44ef9b
mov dword [ebp - 4], edx
jmp 0x44f09c
mov dword [ebp - 0x10], 0xb4e1265a
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], edx
jl 0x44f099
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x44efdf
push edx
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor edx, edx
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xac], edx
je 0x44f00b
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x44f090
push 0x100d
push edx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
xor edx, edx
jmp 0x44f090
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x10], 0xf3f6085e
jae 0x44f01e
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xac]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xac], edx
jne 0x44f03e
mov ecx, edx
cmp dword [ebp - 0x10], edx
je 0x44f040
mov ecx, esi
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xac], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xa4]
cmp eax, 0xe974
setg cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xac], esi
mov eax, dword [ebp - 0x10]
cmp eax, 0x6b379904
mov eax, dword [ebp - 0x10]
setl cl
xor edx, edx
cmp ecx, esi
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
xor esi, esi
xor edx, edx
mov dword [ebp - 0x2c], ecx
inc esi
dec dword [ebp - 0x10]
jns 0x44efcd
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jle 0x44efb6
mov eax, dword [0x4c4a0c]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x20], 0x5d0d658e
mov dword [ebp - 0x20], 0x2d2c87a7
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x1c], 0x2758
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x38], eax
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [ebp - 0xc], edx
jmp 0x44f103
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x18c], 0x3e13
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x44f0f2
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x44f11e
push 0x15fb
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setl dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jg 0x44f156
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x44f156
mov edx, eax
jmp 0x44f15b
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x18]
jle 0x44f177
cmp dword [ebp - 0x20], 0
je 0x44f177
xor eax, eax
lea edx, [eax + 1]
jmp 0x44f179
xor edx, edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x184]
imul eax, dword [ebp - 0x20]
cmp byte [ebp - 0x3d], 0
mov dword [ebp - 0x2c], eax
je 0x44f48b
xor edx, edx
inc edx
cmp dword [ebp - 0x38], edx
jne 0x44f48b
xor ecx, ecx
mov dword [ebp - 4], 0x91a049fe
mov dword [ebp - 0xc], ecx
jmp 0x44f1c5
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x68], 0xfffffff8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x44f1b7
mov dword [ebp - 4], ecx
jmp 0x44f28d
mov dword [ebp - 0x14], 0x22124f84
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xffffffe2
je 0x44f28a
mov dword [ebp - 0x1c], 0x6565
mov dword [ebp - 0x20], 4
mov dword [ebp - 0xc], ecx
jmp 0x44f211
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x17c], 0x54207647
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x44f200
cmp dword [ebp - 0x1c], ecx
je 0x44f271
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 4]
jl 0x44f22d
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x68]
xor edx, edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x17c], ecx
mov eax, dword [ebp - 0x68]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
sete dl
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
setge cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
dec ecx
je 0x44f26e
inc edx
mov ecx, edx
jmp 0x44f271
xor ecx, ecx
inc edx
mov eax, dword [ebp - 0x20]
imul eax, ecx
push 0
pop ecx
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe2
jne 0x44f1ed
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x12
jge 0x44f1d2
mov dword [ebp - 4], ecx
jmp 0x44f2d1
mov dword [ebp - 0xc], edx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], ecx
jg 0x44f2ce
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x44f2c3
push 0x18c9
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
xor ecx, ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jle 0x44f2a7
xor edx, edx
inc edx
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffe5
jle 0x44f29c
mov dword [ebp - 0x28], 0x146cdead
mov dword [ebp - 0xc], 0x8fa48a2b
mov dword [ebp - 0x24], 0x39d5b611
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x14], 0x32b7b88c
mov dword [ebp - 0x20], 0xff5ecce3
mov dword [ebp - 0x2c], 0x2ef7e291
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x3c], 0x8404d083
mov dword [ebp - 0x24], 0x936b
mov dword [ebp - 0x1c], 0x4a05a9ee
mov dword [ebp - 0x1c], 0xfff6
mov dword [ebp - 0x18], 0xffffffff
mov dword [esi + 8], 4
mov dword [ebp - 4], ecx
jmp 0x44f358
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xc8], 0x55f992db
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x44f347
mov dword [ebp - 4], ecx
jmp 0x44f371
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x54], 0xb643c8f4
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x44f363
dec dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x54]
setl dl
xor edi, edi
imul eax, edx
cmp eax, dword [ebp - 0x30]
jg 0x44f3ab
cmp dword [ebp - 0xc4], edi
je 0x44f3ab
xor eax, eax
lea edx, [eax + 1]
jmp 0x44f3ad
mov edx, edi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, 0xbbb531ea
sbb eax, eax
xor ecx, ecx
inc eax
inc ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc4]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
neg edx
cmp edx, 0x6b6f
jge 0x44f3f8
cmp dword [ebp - 0x30], edi
je 0x44f3f8
xor eax, eax
lea ecx, [eax + 1]
jmp 0x44f3fa
mov ecx, edi
xor eax, eax
cmp ecx, 1
setle al
cmp eax, dword [ebp - 0x5c]
jg 0x44f40f
cmp dword [ebp - 0x54], edi
jne 0x44f40f
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x2c]
add ecx, eax
mov eax, dword [ebp - 0x54]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0xc], ecx
dec dword [ebp - 0x1c]
jne 0x44f461
mov dword [ebp - 0x18], 0xc94a746
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
sub eax, edx
jne 0x44f461
mov eax, edi
jmp 0x44f464
xor eax, eax
inc eax
mov edx, dword [ebp - 0x54]
add eax, 8
sub edx, eax
mov dword [esi + 0xc], 0x4c4a0c
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
xor edx, edx
mov dword [ebp - 0xc], 0xe83c773
mov dword [ebp - 0xc], edx
jmp 0x44f4aa
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xb8], 0xfffffffe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x44f499
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x44f4c4
push edx
call ebx
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
xor edx, edx
push 2
pop ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], edx
jl 0x44f617
mov dword [ebp - 0x14], 0xbb11accb
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], edx
jl 0x44f60e
xor edi, edi
inc edi
mov dword [ebp - 0x28], 0xea5223fa
mov dword [ebp - 0x18], edx
jmp 0x44f4ff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4c], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x44f4f5
mov dword [ebp - 0x4c], edx
jmp 0x44f53f
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0xb8], edi
mov eax, dword [ebp - 0xc]
sbb ecx, ecx
inc ecx
mov dword [ebp + eax*4 - 0xb8], ecx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x44f539
push 0x1e8b
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindow]
xor edx, edx
inc dword [ebp - 0x4c]
push 2
pop ecx
cmp dword [ebp - 0x4c], ecx
jle 0x44f509
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], edx
jl 0x44f605
mov dword [ebp - 0x1c], 0x67bc620
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x18], edx
jmp 0x44f574
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x130], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x44f563
mov dword [ebp - 0x124], ecx
cmp dword [ebp - 0x124], edx
jl 0x44f5fc
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xb8]
cmp eax, edi
setg cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x124]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
cmp ecx, 0xd4d1
jne 0x44f5d1
mov eax, dword [ebp - 0x14]
mov ecx, edi
cmp dword [ebp + eax*4 - 0xb8], edx
jne 0x44f5d3
mov ecx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xb8]
neg eax
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, 0xe0f61949
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x124]
jns 0x44f588
push 2
pop ecx
dec dword [ebp - 0x28]
jns 0x44f550
dec dword [ebp - 0x14]
jns 0x44f4e9
dec dword [ebp - 0xc]
jns 0x44f4d3
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x34], eax
jge 0x4507d1
xor esi, esi
mov dword [ebp - 4], 0xfffffff9
mov dword [ebp - 4], edx
inc esi
jmp 0x44f63f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xc0], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x44f632
mov dword [ebp - 4], edx
jmp 0x44f656
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1c4], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x44f649
mov dword [ebp - 4], edx
jmp 0x44f6f1
mov dword [ebp - 0x10], 0x8999d94b
xor edx, edx
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x24], 0xc0f1fa6f
mov dword [ebp - 0x24], 0x1b5f7a0d
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x1c], 4
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 4]
je 0x44f6c5
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp dword [ebp - 4], edx
je 0x44f6d2
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
test eax, eax
setns cl
mov dword [ebp - 0x1bc], ecx
inc dword [ebp - 0x1c]
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffe4
je 0x44f664
mov dword [ebp - 4], edx
jmp 0x44f718
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x44f715
push edx
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
jle 0x44f700
mov dword [ebp - 0x18], 0x57fd5464
mov edi, 0x4c4a10
mov dword [ebp - 0x24], 0x9bfaead2
mov dword [ebp - 0xc], edx
jmp 0x44f747
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xdc], 0xd7b1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x44f736
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x44f766
push 0x149f
call ebx
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor edx, edx
mov dword [ebp - 0x18], edx
jmp 0x44f868
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], 0xb9c6fec1
mov dword [ebp - 0xc], edx
jmp 0x44f78b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x6c], 7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x44f77d
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 2
jg 0x44f845
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xdc], edx
je 0x44f7b6
mov eax, dword [ebp - 4]
dec eax
jne 0x44f7b8
mov esi, edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xdc]
cmp eax, 0x25f5f996
mov eax, dword [ebp - 4]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp esi, ecx
sete al
cmp eax, dword [ebp - 0xd4]
jle 0x44f945
mov dword [ebp - 0x1c], 0xffffffff
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xdc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov esi, dword [ebp + eax*4 - 0xdc]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setne dl
lea eax, [esi + edx]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x1c], eax
xor esi, esi
inc esi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
push 0
pop edx
jle 0x44f79d
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x44f865
push 0x12e5
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor edx, edx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffb
jge 0x44f76e
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x34], ebx
jle 0x44ff6a
mov dword [ebp - 0x10], 0xf4a8b108
mov eax, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x52280335
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x24], 0xa93f0451
cmp dword [ebp - 0x10], ebx
jne 0x44f8ac
mov eax, ebx
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
add ecx, eax
mov eax, dword [ebp - 0x10]
neg ecx
cmp ecx, eax
setg bl
sub ebx, 0xffff
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
add ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ebx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 4], ecx
xor ecx, ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp eax, 0x9c21
mov eax, dword [ebp - 0x10]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
imul ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x44fa65
mov dword [ebp - 0x14], ebx
jmp 0x44fa59
mov dword [ebp - 0xc], 0xb4743079
xor ecx, ecx
mov dword [ebp - 0x24], 0x86c8a81d
mov eax, dword [ebp - 0x20]
cmp eax, 0xfffffff7
mov dword [ebp - 0x6c], eax
setge cl
mov dword [ebp - 0xc], ecx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 2
jg 0x44f82c
xor esi, esi
inc esi
mov dword [ebp - 0x14], ecx
jmp 0x44f989
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x64], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x44f97b
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x44f9a2
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
xor ecx, ecx
inc dword [ebp - 0x64]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x44f976
jmp 0x44f82f
or eax, 0xffffffff
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xffffffe8
jg 0x44fa47
push 3
pop ecx
mov dword [ebp - 4], ebx
jmp 0x44f9f0
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x204], 0xfffffff7
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x44f9df
mov dword [ebp - 4], ebx
jmp 0x44fa0c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x138], 0x9d95921b
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x44f9fb
mov dword [ebp - 4], ebx
jmp 0x44fa33
mov dword [ebp - 0x10], ebx
jmp 0x44fa2b
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x204], ebx
jne 0x44fa30
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x44fa1c
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jle 0x44fa17
inc dword [ebp - 0x134]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
jle 0x44f9da
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x44fa56
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xd
je 0x44f9b3
jmp 0x44fa74
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x44fa74
push ebx
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov eax, dword [edi]
mov dword [ebp - 4], 0x8cff0ea7
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 0xfffffff6
cmp dword [ebp - 4], 0xffffffeb
mov dword [ebp - 0x58], eax
jge 0x44fbac
mov eax, 0xf8256a9e
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 4], ebx
jne 0x44fba9
mov dword [ebp - 0xc], 3
cmp dword [ebp - 0xc], ebx
jl 0x44fb9c
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x18], ebx
jmp 0x44fb05
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe0], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x44faf4
cmp dword [ebp - 4], ebx
je 0x44fb75
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x44fb21
mov edx, ebx
cmp dword [ebp - 4], ebx
je 0x44fb23
mov edx, esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x148]
xor eax, eax
cmp edx, 0xffd8
setle al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 4]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 4]
test ecx, ecx
je 0x44fb58
mov ecx, esi
cmp dword [ebp - 4], ebx
jne 0x44fb5a
mov ecx, ebx
mov eax, dword [ebp - 4]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 4]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, esi
setle cl
cmp ecx, 0xffffffff
jg 0x44fb77
mov edx, ebx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x148]
cmp eax, edx
setle cl
mov dword [ebp - 0xe0], ecx
dec dword [ebp - 0xc]
jns 0x44fae8
mov eax, 0xf8256a9e
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffeb
jl 0x44fab4
push 0xfffffffffffffffa
pop ecx
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0x120]
inc edx
mov esi, dword [edi + 4]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], ebx
jmp 0x44fbd6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1f4], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x44fbc9
mov dword [ebp - 0x18], 0xfffffff6
jmp 0x44fc0a
mov dword [ebp - 0xc], 0xeede0b40
mov dword [ebp - 0xc], ebx
jmp 0x44fc02
mov dword [ebp - 0x24], 0x7fbf2121
mov dword [ebp - 0x24], 0x3c891c55
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jne 0x44fbf1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1a
jle 0x44fbe5
mov dword [ebp - 4], 0xcea5d6c0
add edi, 8
mov dword [ebp - 0xc], ebx
jmp 0x44fc30
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x100], 0x66193fe6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x44fc1f
mov dword [ebp - 4], ebx
jmp 0x44fce3
mov dword [ebp - 0x14], 0xeede0b40
mov dword [ebp - 0x24], 0xfa4c8210
mov dword [ebp - 0x14], 0xffffffee
jmp 0x44fcd3
mov dword [ebp - 0x24], 5
mov dword [ebp - 0xc], ebx
jmp 0x44fc6e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x168], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x44fc61
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xd14c
setg al
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x164]
je 0x44fcad
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebp - 0x15c]
cmp eax, 0x97e7
push 0xfffffffffffffffa
setle cl
xor eax, eax
shl ecx, 3
test ecx, ecx
pop ecx
setle al
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 7
jle 0x44fc55
inc dword [ebp - 4]
push 0xfffffffffffffffa
pop ecx
cmp dword [ebp - 4], 0x1d
jg 0x44fc3e
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 4]
sub ecx, eax
je 0x44fdfa
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 4
jmp 0x44fdc7
or eax, 0xffffffff
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0xc], ebx
jmp 0x44fd3d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x48], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x44fd33
mov dword [ebp - 0x48], ebx
jmp 0x44fdbe
mov dword [ebp - 0xc], ebx
jmp 0x44fd5d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x108], 0xfffc
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x44fd4c
mov ecx, dword [ebp - 0x108]
xor edx, edx
mov eax, dword [ebp - 0xf8]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setg dl
mov dword [ebp + eax*4 - 0x100], edx
cmp edx, dword [ebp - 0x48]
jne 0x44fd8a
cmp dword [ebp - 0x20], ebx
je 0x44fdb0
mov eax, dword [ebp - 0x108]
add eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
je 0x44fdb0
cmp dword [ebp - 0xfc], ebx
je 0x44fdb0
xor edx, edx
inc edx
mov eax, edx
jmp 0x44fdb5
xor edx, edx
mov eax, ebx
inc edx
mov dword [ebp - 0x14c], eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 2
jle 0x44fd47
dec dword [ebp - 4]
cmp dword [ebp - 4], edx
jle 0x44fd13
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x44fe20
push ebx
push 0x26fb
push 0x80e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
jmp 0x44fe20
mov dword [ebp - 0x24], 0xafcb06a9
mov dword [ebp - 0x3c], 0xf2ba10f4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x44fe20
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test esi, esi
jne 0x44fe27
add edi, 8
mov dword [ebp - 0x10], 0x95ae
xor esi, esi
mov dword [ebp - 0x20], 4
inc esi
mov dword [ebp - 0x30], 0xfffffffb
xor edx, edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x24], 0xddc4ea3c
mov dword [ebp - 0x14], 0xfffffff8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], 0x101eb64d
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg bl
xor ecx, ecx
cmp ebx, eax
sete cl
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jne 0x44fec2
mov edx, ebx
cmp dword [ebp - 0x30], ebx
je 0x44fec4
mov edx, esi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], esi
ja 0x44ff12
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], 4
cmp dword [ebp - 0x28], ebx
je 0x44ff24
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x44ff36
push ebx
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
add edi, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x2c], eax
cmp eax, dword [ebp - 0x34]
jl 0x44f880
mov esi, dword [edi]
xor edx, edx
mov dword [ebp - 0x1c], 0xe0cf
inc edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0xc], ebx
jmp 0x44ff8f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x180], 0xfffd
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x44ff7e
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x44ffa8
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
xor edx, edx
inc edx
inc dword [ebp - 0x1c]
add edi, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x58], 0xcf94a228
mov dword [ebp - 0x44], 0xbf771356
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x20], 0xffffffff
push 2
mov dword [ebp - 0x5c], 0xfffffffe
mov dword [ebp - 0x30], edi
mov dword [ebp - 4], ebx
pop ecx
jmp 0x44fff3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x88], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x44ffe2
mov dword [ebp - 4], ebx
jmp 0x45000e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd0], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x44fffd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
je 0x450176
mov dword [ebp - 0x34], 0x65ab
mov dword [ebp - 4], ebx
jmp 0x45003f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x110], 0x8cccddd
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x45002e
mov dword [ebp - 4], ebx
jmp 0x450057
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x80], 6
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x450049
mov dword [ebp - 4], ebx
jmp 0x450072
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1b8], 0x828c040c
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x450061
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x80], eax
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xfffffff9
setl al
xor edx, edx
imul eax, dword [ebp - 0x10]
add eax, 4
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x10]
setle dl
neg eax
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x10]
setge cl
xor edx, edx
cmp ecx, 0x295a
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0xffffffff
setle dl
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl bl
sub ebx, 0xfffffff7
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 0x97a8d1d9
sbb eax, eax
neg eax
add eax, dword [ebp - 0x110]
je 0x450130
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x80]
neg eax
push 2
sbb eax, eax
xor edx, edx
neg eax
xor ecx, ecx
add eax, 0xdc630de2
inc edx
cmp eax, edx
mov dword [ebp - 0x1b4], eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x45016c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x80], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x45015e
jmp 0x450279
mov dword [ebp - 0x24], 0x5f5ab95d
mov dword [ebp - 0x24], 0xa6b3
mov dword [ebp - 0x24], 0xeaf5
mov dword [ebp - 0x24], 0xd03168f1
mov dword [ebp - 0x34], 0xfffd
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 4], ebx
jmp 0x4501b6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1d0], 0x99d012cd
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x4501a5
mov dword [ebp - 4], ebx
jmp 0x4501d2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1e4], 0xe0c42ef3
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x4501c1
mov dword [ebp - 0x10], ebx
jmp 0x45026f
mov dword [ebp - 0x20], 0xf0a86225
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0xc], ebx
jmp 0x450206
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1dc], 0x914d865e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4501f5
mov dword [ebp - 0x1c], 0x7d2ca1c
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xcc]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
imul eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
jg 0x450236
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c8]
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1dc], 0xb87b6ff5
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
neg ecx
inc edx
inc dword [ebp - 0x20]
cmp eax, ecx
mov eax, edx
jge 0x450267
mov eax, ebx
neg eax
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jge 0x4501df
cmp dword [ebp - 0xd0], ebx
je 0x4502b8
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x58]
je 0x450294
cmp dword [ebp - 0x2c], ebx
je 0x450294
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x44]
add eax, ecx
cmp eax, dword [ebp - 0x5c]
mov eax, edx
jne 0x4502ba
mov eax, ebx
mov edi, dword [edi]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0x79763266
mov dword [ebp - 0x10], 0x91e66c61
push 2
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x4502e9
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x90], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x4502dc
mov dword [ebp - 4], edx
cmp dword [ebp - 4], ebx
jl 0x450515
mov dword [ebp - 0x14], 5
xor ecx, ecx
mov dword [ebp - 0x20], 3
mov eax, dword [ebp - 4]
cmp eax, 0x9ebe1b0f
mov eax, dword [ebp - 4]
setl cl
mov dword [ebp + eax*4 - 0x90], ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 4]
sub eax, dword [ebp - 0x14]
je 0x450343
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x90]
cmp dword [ebp - 0x14], ebx
jne 0x45034a
mov ecx, ebx
cmp dword [ebp - 0x14], ebx
je 0x45034c
mov ecx, edx
mov eax, dword [ebp - 4]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 4]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x14]
jg 0x4504d0
xor eax, eax
mov dword [ebp - 0xc], 0xffffffff
inc eax
mov dword [ebp - 0x44], 0xbe495ee3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jl 0x4504dc
mov dword [ebp - 0x18], ebx
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x90]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xc]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0x4e401d93
je 0x4503e5
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x24], 0x442f2aa7
mov dword [ebp - 0x1c], 0xa1f1
dec dword [ebp - 0x1c]
jmp 0x4504c5
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov dword [ebp - 0x1c], 0xfffffffe
inc ecx
mov dword [ebp - 0x14], ebx
jmp 0x450405
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x4503f7
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x14], ecx
mov ecx, 0x87c631db
mov eax, dword [ebp - 0xc]
cmp ecx, eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
xor esi, esi
xor eax, eax
inc esi
cmp ecx, esi
setle al
xor edx, edx
imul ecx, eax, 6
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setne dl
neg edx
dec edx
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x60], edx
cmp edx, dword [ebp - 0x20]
jle 0x450477
mov edx, ebx
cmp dword [ebp - 0x18], ebx
je 0x450479
mov edx, esi
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 4]
jg 0x45048f
mov ecx, ebx
cmp dword [ebp - 0x60], ebx
je 0x450491
mov ecx, esi
mov eax, dword [ebp - 0x20]
imul eax, ecx
test eax, eax
je 0x4504a2
mov eax, esi
cmp dword [ebp - 0x14], ebx
jne 0x4504a4
mov eax, ebx
mov edx, dword [ebp - 0x44]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x18]
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x18]
jne 0x4504c0
mov eax, esi
cmp dword [ebp - 0x18], ebx
jne 0x4504c2
mov eax, ebx
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x10]
jns 0x450386
jmp 0x4504dc
mov dword [ebp - 0x24], 0x6e4c1c17
cmp dword [ebp - 0x24], ebx
jne 0x45050c
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x450500
push ebx
push 0xee8
push 0x24ae
push 0x1e59
push 0x1398
call dword [sym.imp.GDI32.dll_CreateBitmap]
dec dword [ebp - 4]
push 1
pop edx
jns 0x4502fa
mov esi, dword [ebp - 0x28]
xor edx, edx
push 2
inc edx
pop ecx
add dword [ebp - 0x30], 4
mov dword [ebp - 0x14], 0xe83c7730
mov dword [ebp - 0x1c], 0x72ba
mov dword [ebp - 0x24], 0xed0f12af
mov dword [ebp - 0x2c], 0x16511c25
mov dword [ebp - 0x24], 0x3925b974
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x3c], 0x46a6f4da
mov dword [ebp - 0x3c], 0xe1b460d5
mov dword [ebp - 0xc], ebx
jmp 0x450563
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xbc], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x450552
cmp dword [ebp - 0x14], edx
je 0x450636
mov dword [ebp - 0x20], 0x9dbe
mov dword [ebp - 0xc], 0xfffffffa
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
neg ecx
mov dword [ebp - 0x1c], 0xc9eb
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
cmp ecx, 0xc895
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setl cl
cmp dword [ebp - 0x14], ecx
jg 0x4505d2
cmp dword [ebp - 0x20], ebx
jne 0x4505d2
mov ecx, ebx
jmp 0x4505d7
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x20]
add ecx, 0x8700
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0xc], 0x1a
jmp 0x45062b
mov dword [ebp - 0x1c], 0xcc19
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x450625
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xdb8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x1c]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x1a
jne 0x450603
jmp 0x4506da
mov dword [ebp - 0x1c], 0xd77dfcc8
mov dword [ebp - 0x3c], 0x253674f9
push 6
pop eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], 0xd67
mov dword [ebp - 0xc], ebx
jmp 0x45066d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1ec], 0xc7a429ad
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x45065c
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
dec edx
cmp edx, eax
setle cl
cmp ecx, 0xf00f3bc9
ja 0x4506a0
cmp dword [ebp - 0x24], ebx
jne 0x4506ac
cmp dword [ebp - 0xbc], ebx
jne 0x4506ac
mov eax, ebx
jmp 0x4506af
xor eax, eax
inc eax
xor edx, edx
cmp eax, 0x2406
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x4506da
push 0xf3a
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x18], ebx
jmp 0x4506e9
mov dword [ebp - 0x24], 0xfeddd8d7
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
je 0x4506df
test edi, edi
jne 0x4507ca
cmp byte [ebp - 0x3d], 0
je 0x45070e
xor eax, eax
inc eax
cmp dword [ebp - 0x38], eax
jne 0x45070e
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
add dword [ecx + 8], eax
mov ecx, dword [ebp - 0x30]
push esi
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
add ecx, 8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], ecx
call fcn.00493417
mov edi, eax
xor eax, eax
pop ecx
mov dword [ebp - 0xe4], eax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0xe4]
push eax
push esi
mov dword [ebp - 0x3c], edi
call fcn.00477310
xor ecx, ecx
test esi, esi
mov esi, dword [ebp - 0x78]
jle 0x4507a9
mov eax, ecx
and eax, 0x80000001
jns 0x450763
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, ebx
add eax, ecx
add eax, ebx
imul eax, dword [ebp - 0x24]
cdq
idiv dword [ebp - 0x28]
xor eax, eax
cmp word [esi + edx*2], ax
je 0x45078f
xor edi, edi
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x28]
cmp word [esi + edx*2], di
jne 0x45077f
mov edi, dword [ebp - 0x3c]
xor eax, eax
inc eax
mov word [esi + edx*2], ax
mov eax, dword [ebp - 0x30]
mov al, byte [edx + eax]
mov byte [ecx + edi], al
inc ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
jl 0x450755
jmp 0x4507ac
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edi
test esi, esi
je 0x4507cf
push esi
call fcn.004949d6
xor ebx, ebx
pop ecx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov esi, dword [ebp + 8]
jmp 0x4507d3
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x28], 0xfffffff7
jmp 0x450808
cmp dword [ebp - 0x24], ebx
jne 0x45080e
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x450805
push 0x1cf8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff9
jge 0x4507ea
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret