Function at 0x420340
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Hide graphical window
Open clipboard
Read .ini file
Set file attributes
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a48
call fcn.0052a360
mov eax, dword [0x633754]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
movzx esi, ax
push edi
mov edi, esi
mov dword [ebp - 0x1a40], edi
mov eax, edi
cmp edi, 0x9c40
ja 0x4212bb
je 0x421293
sub eax, 0x4e20
cmp eax, 0x23
ja case.default.0x42038d
jmp dword [eax*4 + 0x42529c]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x835
push dword [0x64018c]
call esi
mov eax, dword [0x63c74c]
cmp eax, 1
jne 0x4203d7
push 0
push 0xf020
push 0x112
push ebx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne case.default.0x42038d
push 0
push 0
push 0x10
push ebx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 1
call fcn.0041d040
add esp, 0x10
test eax, eax
je case.default.0x42038d
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0
xor eax, eax
cmp dword [0x63c814], eax
push 0
push 0x919
push dword [0x64018c]
sete al
mov dword [0x63c814], eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
cmp dword [0x63c814], eax
pop edi
sete al
pop esi
mov dword [0x63c814], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x7d8
push dword [0x64018c]
call ebx
push 0
push 0
push 0x7d9
push dword [0x64018c]
mov esi, eax
mov dword [ebp - 0x1a40], esi
call ebx
push 0
push esi
push 0x876
push dword [0x64018c]
mov edi, eax
call ebx
push 0
mov esi, eax
push esi
push 0x877
push dword [0x64018c]
call ebx
push 0
push esi
push 0x850
push dword [0x64018c]
mov dword [ebp - 0x1a44], eax
call ebx
mov ecx, eax
mov eax, dword [ebp - 0x1a40]
cmp eax, edi
je 0x420514
push eax
push eax
push 0x870
push dword [0x64018c]
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0
push 0
cmp eax, dword [ebp - 0x1a44]
jne 0x420540
push 0x916
push dword [0x64018c]
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
cmp eax, ecx
jg 0x420564
push 0x95b
push dword [0x64018c]
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x91f
push dword [0x64018c]
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x7d8
push dword [0x64018c]
call ebx
push 0
push 0
push 0x7d9
push dword [0x64018c]
mov esi, eax
mov dword [ebp - 0x1a40], esi
call ebx
push 0
push esi
push 0x876
push dword [0x64018c]
mov edi, eax
call ebx
push 0
mov esi, eax
push esi
push 0x877
push dword [0x64018c]
call ebx
push 0
push esi
push 0x858
push dword [0x64018c]
mov dword [ebp - 0x1a44], eax
call ebx
mov ecx, eax
mov eax, dword [ebp - 0x1a40]
cmp eax, edi
jne 0x4204f2
push 0
push 0
cmp dword [ebp - 0x1a44], ecx
je 0x42062a
push 0x920
push dword [0x64018c]
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x922
push dword [0x64018c]
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x8d4
push dword [0x64018c]
call esi
push 0
push 1
push 0x84c
push dword [0x64018c]
call esi
push 0
push 0
push 0x917
push dword [0x64018c]
call esi
xor eax, eax
cmp dword [0x63c804], eax
push 0
sete al
push eax
push 0x84c
push dword [0x64018c]
call esi
push 0
push dword [0x63c7fc]
push 0x8d4
push dword [0x64018c]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x63c3c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.default.0x42038d
mov eax, dword [0x63c7ac]
cmp eax, 2
jne 0x4206ef
mov dword [0x5df770], 4
jmp 0x420710
cmp eax, 3
jne 0x420700
mov dword [0x5df770], 5
jmp 0x420710
cmp eax, 7
mov ecx, 6
cmove eax, ecx
mov dword [0x5df770], eax
push 0x63c3c0
lea eax, [ebp - 0x974]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x974]
push eax
push 0
push 1
push 0
push 0
call fcn.0041c8b0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x63c3c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.default.0x42038d
mov dword [0x5df770], 0
jmp 0x420710
push 0x63c3c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.default.0x42038d
mov dword [0x5df770], 1
jmp 0x420710
mov esi, dword [0x63c7a4]
push 0x63c3c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.default.0x42038d
push 0x63c3c0
lea eax, [ebp - 0x974]
mov dword [0x63c7a4], 1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x974]
push eax
push 0
push 1
push 0
push 0
call fcn.0041c8b0
add esp, 0x14
mov dword [0x63c7a4], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x63c3c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.default.0x42038d
mov esi, dword [0x639468]
lea eax, [ebp - 0x974]
mov edi, dword [0x63c79c]
push 0x63c3c0
push eax
mov dword [0x639468], 1
mov dword [0x63c79c], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x974]
push eax
push 0
push 1
push 0
push 0
call fcn.0041c8b0
add esp, 0x14
mov dword [0x63c79c], edi
mov dword [0x639468], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push dword [0x64018c]
call fcn.00429b80
add esp, 4
call fcn.0041c190
call fcn.0041c6a0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push dword [0x64018c]
call fcn.00429ba0
add esp, 4
call fcn.0041c190
call fcn.0041c6a0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push dword [0x64018c]
call fcn.00429bc0
add esp, 4
call fcn.0041c190
call fcn.0041c6a0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x200
lea eax, [ebp - 0x2cc]
push 0
push eax
call fcn.00546400
push 0x200
lea eax, [ebp - 0x4dc]
push 0
push eax
call fcn.00546400
movzx eax, byte [0x6394ba]
push 0x1ff
mov byte [ebp - 0x1a3c], al
lea eax, [ebp - 0x1a3b]
push 0
push eax
call fcn.00546400
movzx eax, byte [0x6394bb]
push 0x1ff
mov byte [ebp - 0x183c], al
lea eax, [ebp - 0x183b]
push 0
push eax
call fcn.00546400
movzx eax, byte [0x6394be]
push 0x5ff
mov byte [ebp - 0x163c], al
lea eax, [ebp - 0x163b]
push 0
push eax
call fcn.00546400
movzx eax, byte [0x6394bf]
push 0x5ff
mov byte [ebp - 0x103c], al
lea eax, [ebp - 0x103b]
push 0
push eax
call fcn.00546400
mov eax, dword [0x64018c]
add esp, 0x48
mov dword [ebp - 0xa24], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0xa3c], 0x200000
movups xmmword [ebp - 0xa38], xmm0
push 0x637260
push 0x100
push eax
push str._Date:_______Date:__Y__m__d__H:_M:_S__
push str.TimeStamp
push 0x5e01ac
mov dword [ebp - 0xa28], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x7c
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
test esi, esi
je 0x420a0e
lea ecx, [esi + 2]
push ecx
lea eax, [ebp - 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov word [esi], ax
mov esi, dword [sym.imp.SHLWAPI.dll_StrTrimW]
lea eax, [ebp - 0x2cc]
push 0x5e01c0
push eax
call esi
push 0x5e01c4
lea eax, [ebp - 0x4dc]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x2cc]
push eax
call esi
test eax, eax
je case.default.0x42038d
lea eax, [ebp - 0x4dc]
push eax
call esi
test eax, eax
je case.default.0x42038d
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x90]
mov dword [ebp - 0x30], eax
movzx eax, word [ebp - 0x92]
mov dword [ebp - 0x2c], eax
movzx eax, word [ebp - 0x94]
mov dword [ebp - 0x28], eax
movzx eax, word [ebp - 0x96]
mov dword [ebp - 0x24], eax
movzx eax, word [ebp - 0x9a]
dec eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x20], eax
movzx eax, word [ebp - 0x9c]
sub eax, 0x76c
mov dword [ebp - 0x1c], eax
movzx eax, word [ebp - 0x98]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
push eax
call fcn.00426c50
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x6dc]
push 0x100
push eax
call fcn.005621ee
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x14
push 0
push 0
push 0x859
push dword [0x64018c]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
push 0
push 0
push 0x200
lea eax, [ebp - 0x1a3c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2cc]
push eax
push 0
push edi
call esi
push 0
push 0
push 0x200
lea eax, [ebp - 0x183c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x6dc]
push eax
push 0
push edi
call esi
push 0
push 0
push 0x861
push dword [0x64018c]
call ebx
push 0
push 0
push 0x85f
push dword [0x64018c]
mov esi, eax
call ebx
push 1
cmp eax, esi
lea eax, [ebp - 0x1a3c]
push eax
push dword [0x64018c]
je 0x420b8d
call fcn.0040f950
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
call fcn.0040f550
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x200
lea eax, [ebp - 0x2cc]
push 0
push eax
call fcn.00546400
mov ax, word [0x6394ec]
push 0x206
mov word [ebp - 0x974], ax
lea eax, [ebp - 0x972]
push 0
push eax
call fcn.00546400
add esp, 0x18
lea eax, [ebp - 0x6dc]
mov edx, 0x4e2f
mov ecx, str.WebTemplate2
cmp si, dx
push 0x637260
push 0x100
push eax
push 0x6394f0
mov eax, 0x5e01c8
cmovne eax, ecx
push eax
push 0x5e0200
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je case.default.0x42038d
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x861
push dword [0x64018c]
call edi
push 0
push 0
push 0x85f
push dword [0x64018c]
mov esi, eax
call edi
sub esi, eax
lea ecx, [esi - 1]
cmp ecx, 0x1f3
ja case.default.0x42038d
push 0
push 0
push 0x871
push dword [0x64018c]
call edi
cmp eax, 0x200
jae case.default.0x42038d
lea eax, [ebp - 0x2cc]
push eax
push 0
push 0x871
push dword [0x64018c]
call edi
cmp esi, 0x200
jae 0x425297
push 0xd
lea eax, [ebp - 0x2cc]
mov byte [ebp + esi - 0x2cc], 0
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrA]
push eax
call esi
test eax, eax
je 0x420cb6
mov byte [eax], 0
push 0xa
lea eax, [ebp - 0x2cc]
push eax
call esi
test eax, eax
je 0x420cc8
mov byte [eax], 0
push 9
lea eax, [ebp - 0x2cc]
push eax
call esi
test eax, eax
je 0x420cda
mov byte [eax], 0
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je case.default.0x42038d
push 0
push 0
push 0x859
push dword [0x64018c]
call edi
mov edx, 0xfde9
xor ecx, ecx
push 0x200
cmp eax, edx
lea eax, [ebp - 0xe20]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2cc]
cmove ecx, edx
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x848
push 0x40
call edi
mov ebx, eax
lea eax, [ebp - 0xe20]
push eax
lea eax, [ebp - 0x6dc]
push eax
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalSize]
add esp, 0xc
push ebx
call esi
shr eax, 1
push eax
push ebx
call fcn.00416230
add esp, 8
push ebx
call esi
push eax
push 0x40
call edi
mov edi, eax
push edi
push ebx
push ebx
call fcn.004160a0
add esp, 0xc
push 0x63c3c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x420dab
push 0x63c3c0
lea eax, [ebp - 0x974]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x974]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x974]
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x48]
movlpd qword [ebp - 0x28], xmm0
push eax
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800000
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call esi
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
cmp dword [0x63c7e0], 0
jne 0x420e4e
push 0
push 0x19dd5
push 0x111
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
mov eax, 0x4e33
cmp si, ax
mov eax, dword [0x63c7dc]
jne 0x420e60
inc eax
jmp 0x420e61
dec eax
mov ecx, 0x1000
cmp eax, ecx
push 0
cmovl ecx, eax
xor eax, eax
test ecx, ecx
cmovg eax, ecx
push eax
push 0x939
push dword [0x64018c]
mov dword [0x63c7dc], eax
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0041c190
mov eax, dword [0x63c7dc]
pop edi
pop esi
mov dword [0x63c7d8], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push str.________
push 0x5e0218
push dword [0x64018c]
call fcn.0040c490
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x5e021c
push 0x5e0220
push dword [0x64018c]
call fcn.0040c490
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x5e0224
push 0x5e0228
push dword [0x64018c]
call fcn.0040c490
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x5e022c
push 0x5e0230
push dword [0x64018c]
call fcn.0040c490
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x5e0234
push 0x5e0238
push dword [0x64018c]
call fcn.0040c490
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x5e023c
push 0x5e0240
push dword [0x64018c]
call fcn.0040c490
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 1
push dword [0x64018c]
call fcn.00409f20
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0
push dword [0x64018c]
call fcn.00409f20
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x977
push ebx
call esi
cmp eax, 1
je case.default.0x42038d
push 0
push 0
push 0x7d9
push dword [0x64018c]
call esi
push 0
push 0
push 0x7d8
push dword [0x64018c]
mov edi, eax
call esi
cmp eax, edi
jle case.default.0x42038d
push edi
push eax
push 0x870
push dword [0x64018c]
call esi
push 0
push 0
push 0x95f
push dword [0x64018c]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x977
push ebx
call esi
cmp eax, 1
je case.default.0x42038d
push 0
push 0
push 0x7d9
push dword [0x64018c]
call esi
push 0
push 0
push 0x7d8
push dword [0x64018c]
mov edi, eax
call esi
cmp eax, edi
jge case.default.0x42038d
jmp 0x42103c
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x63c3c0
call edi
test eax, eax
je 0x4210d0
mov esi, 0x63c3c0
jmp 0x4210f0
push 0x20
lea eax, [ebp - 0x8c]
push eax
push 0x2713
push dword [0x640194]
call dword [sym.imp.USER32.dll_LoadStringW]
lea esi, [ebp - 0x8c]
push ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.default.0x42038d
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
call edi
lea eax, [eax*2 + 2]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
shr eax, 1
push eax
push dword [ebp - 0xc]
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x2c
push eax
push dword [0x640174]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
sub esi, eax
push dword [0x640174]
mov dword [ebp - 0x1a44], eax
sub edi, ecx
mov dword [ebp - 0x1a40], ecx
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x4211ac
test byte [ebp - 0x34], 2
je 0x4211b1
mov eax, 1
push eax
push edi
push esi
push dword [ebp - 0x1a40]
lea eax, [ebp - 0x2cc]
push dword [ebp - 0x1a44]
push 0x5e0244
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42224c
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
shr eax, 1
push eax
lea eax, [ebp - 0x2cc]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
call fcn.0041c4c0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push ebx
call fcn.00418f70
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x637260
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.default.0x42038d
call fcn.0041c0e0
push 0x637260
jmp 0x4212de
push 0x6394bc
push 0
push 0
push 1
push 0
call fcn.0041c8b0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
sub eax, 0x9c41
cmp eax, 0x2d3
ja case.default.0x42038d
movzx eax, byte [eax + 0x4255e4]
jmp dword [eax*4 + 0x42532c]
push 0
push 0
push 0
push 0
call fcn.0041c8b0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x2715
push eax
push dword [0x63c834]
push 0x63c3c0
push 0x2713
push dword [0x6391e8]
push dword [0x5df778]
push ebx
call fcn.00414670
add esp, 0x28
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
cmp dword [0x63c354], 0
jne 0x422020
mov eax, dword [0x63c350]
cmp eax, dword [0x63c34c]
jne 0x422020
push 0x6378a8
push dword [0x63789c]
xor eax, eax
jmp 0x4215bc
push 0x6378a8
push dword [0x63789c]
mov eax, 1
jmp 0x4215bc
call fcn.0041c4c0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0
jmp 0x4237cd
push 0x6379c0
push dword [0x64018c]
call fcn.0040ed30
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x6379c0
push dword [0x64018c]
call fcn.0040ef30
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052a352
mov esp, ebp
pop ebp
ret
push 0x80
push 0x6378a8
push dword [0x64018c]
call fcn.0040e9b0
add esp, 0xc
jmp 0x421ff8
push 0
push 0
push 0x861
push dword [0x64018c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x85f
push dword [0x64018c]
mov esi, eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub esi, eax
jne 0x424b68
push esi
push 0x19d77
push 0x111
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
call ebx
push esi
push esi
push 0x861
push dword [0x64018c]
call ebx
push 0
push 0
push 0x85f
push dword [0x64018c]
mov esi, eax
call ebx
sub esi, eax
jmp 0x424b6e
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esi - 1]
cmp eax, 0x1f3
ja case.default.0x42038d
push 0
push 0
push 0x871
push dword [0x64018c]
call ebx
cmp eax, 0x200
jge case.default.0x42038d
lea eax, [ebp - 0x2cc]
push eax
push 0
push 0x871
push dword [0x64018c]
call ebx
cmp esi, 0x200
jae 0x425297
push 0xa
lea eax, [ebp - 0x2cc]
mov byte [ebp + esi - 0x2cc], 0
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrA]
push eax
call esi
test eax, eax
je 0x424bda
mov byte [eax], 0
push 0xd
lea eax, [ebp - 0x2cc]
push eax
call esi
test eax, eax
je 0x424bec
mov byte [eax], 0
push 0
push 0
push 0x859
push dword [0x64018c]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x6379bc], eax
lea eax, [ebp - 0x2cc]
push eax
push 0x6379c0
call esi
mov eax, dword [0x6379bc]
cmp eax, 0xfde9
je 0x424c66
push 0x200
lea ecx, [ebp - 0xe20]
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x2cc]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0x600
push 0x637dc0
push 0xffffffffffffffff
lea eax, [ebp - 0xe20]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x424c74
lea eax, [ebp - 0x2cc]
push eax
push 0x637dc0
call esi
and dword [0x6389c0], 0xff9fffff
mov dword [0x6389c4], 0
sub edi, 0x4e31
je 0x423786
sub edi, 1
jne case.default.0x42038d
push 0
jmp 0x4237f5
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052a352
mov esp, ebp
pop ebp
ret
call fcn.0052a4ad
xchg esp, eax
add eax, dword [edx]
cld
add eax, dword [edx]
xor al, 4
inc edx
add byte [esp + eax + 0x42], bh
add byte [ebp + eax + 0x64a0042], al
inc edx
add dh, al
push es
inc edx
add byte [edi + eax + 0x42], cl
add byte [ebx + 7], ch
inc edx
add byte [edx - 0x10ffbdf9], cl
pop es
inc edx
add byte [edx + 8], ch
inc edx
add byte [ebp - 0x3fffbdf8], dl
or byte [edx], al
jmp 0x4252de
inc edx
add dh, bh
dec edx
inc edx
add dh, bh
dec edx
inc edx
add byte [edi], bl
push cs
inc edx
add byte [edi], bl
push cs
inc edx
add byte [ebp - 0x27ffbdf2], ch
push cs
inc edx
add byte [ebx], al
cmovb eax, dword [eax]
cmovb eax, dword cs:[eax]
pop ecx
cmovb eax, dword [eax]
test byte [edi], cl
inc edx
add byte [edi - 0x2dffbdf1], ch
cmovb eax, dword [eax]
and al, 0x48
inc edx
add ch, dh
cmovb eax, dword [eax]
outsd dx, dword [esi]
adc byte [edx], al
mov eax, 0x63004210
adc dword [edx], eax
pop eax
adc al, byte [edx]
je 0x42533c
inc edx
add cl, bl
adc al, byte [edx]
add dword [ebx], edx
inc edx
add dl, bh
adc eax, 0x14b50042
inc edx
add al, bl
adc al, 0x42
fcom dword [edx + eax*2]
add bl, bh
adc al, 0x42
add byte [esi], bl
adc eax, 0x1ada0042
inc edx
add dh, ah
sbb eax, dword [edx]
sbb dword [ebx], 0x42
add byte [edx], bh
sbb byte [edx], al
sub byte [edx + eax*2], bl
add byte [ecx + 0x1c], cl
inc edx
add bl, dh
sbb al, 0x42
add byte [ebx], ch
sbb eax, 0x1d750042
inc edx
add byte [ebx], ah
push ds
inc edx
add byte [ebx + 0x1e], bh
inc edx
add byte [edi + 0x1400421e], bl
add al, 0x42
add byte [0x3500421f], dl
and byte [edx], al
add dword [ecx], esp
inc edx
add byte [edx], ah
and dword [edx], eax
insb byte es:[edi], dx
and dword [edx], eax
lea esp, [ecx]
inc edx
add byte [ebp - 0x22ffbddf], dh
and dword [edx], eax
push ds
and al, byte [edx]
and al, byte fs:[edx]
mov esp, 0xfb004222
and al, byte [edx]
and esp, dword [ebx]
inc edx
add byte [ebp - 0x4affbddc], cl
and al, 0x42
add bh, dh
and al, 0x42
add byte [edi], bl
and eax, 0x26430042
inc edx
add bl, ch
inc edx
add byte [edi], cl
inc edx
add byte [0x55004227], ch
daa
inc edx
add byte [esi - 0x5bffbdd9], dl
daa
inc edx
add ah, cl
daa
inc edx
add ah, dh
daa
inc edx
add cl, dh
sub eax, dword [edx]
pop eax
sub al, 0x42
add byte [edx - 0x35ffbdd4], cl
sub al, 0x42
add byte [eax + ebp], bl
inc edx
add bh, al
sub byte [edx], al
inc edi
sub dword [edx], eax
xchg edi, eax
sub dword [edx], eax
jecxz 0x42542f
inc edx
add byte [edx], dl
sub al, byte [edx]
cmp eax, 0x6800422a
sub al, byte [edx]
xchg ebp, eax
sub al, byte [edx]
shr byte [edx], 0x42
add ch, ch
sub al, byte [edx]
imul byte [edx]
inc edx
add byte [ecx + 0x2b], ah
inc edx
add byte [eax], dh
sub eax, dword [edx]
loop 0x42545a
inc edx
add byte [ecx], al
sub eax, 0x2d200042
inc edx
add byte [eax], bh
sub eax, 0x2d500042
inc edx
add byte [eax + 0x2d], ch
inc edx
add byte [eax - 0x57ffbdd3], cl
sub eax, 0x2dc80042
inc edx
add al, ch
sub eax, 0x2e780042
inc edx
add ch, ah
inc edx
inc edx
add byte [edi + 0x57004230], al
xor dword [edx], eax
popal
xor al, byte [edx]
cmp al, 0x33
inc edx
add byte [ebx + esi + 0x42], dl
add byte [ebx + esi + 0x42], ch
add byte [ebx + esi + 0x339c0042], al
inc edx
add byte [ebx + esi + 0x33cc0042], dh
inc edx
add byte [ebx + 0x61004234], al
xor eax, 0x4afe0042
inc edx
add byte [eax], dl
inc edx
add byte [esi], bh
cmp byte [edx], al
nop
cmp byte [edx], al
sbb edi, dword [eax]
inc edx
add byte [ecx - 0x23ffbdc8], dh
cmp byte [edx], al
pop es
cmp dword [edx], eax
xor bh, byte [ecx]
inc edx
add byte [ebp + 0x39], bl
inc edx
add byte [ecx], dh
cmp eax, dword [edx]
push cs
inc edx
add cl, bl
inc eax
inc edx
add byte [eax], dl
inc ecx
inc edx
add byte [edi + 0x41], al
inc edx
add byte [ecx], ah
inc edx
inc edx
add cl, dl
inc edx
inc edx
add byte [eax + 0x3e], al
inc edx
add byte [eax + 0x3e], ch
inc edx
add byte [edx], al
inc ebx
inc edx
add byte [edx], ch
inc ebx
inc edx
add byte [edx + 0x43], dl
inc edx
add byte [edx + 0x3c], bl
inc edx
add byte [esi - 0x5cffbdc4], bl
cmp dword [edx], eax
mov bh, 0x3b
inc edx
add byte [ecx + 4], bl
inc edx
add byte [esi + 0x44004242], ch
inc esi
inc edx
add byte [eax + 0x44], ch
inc edx
add bl, ch
inc esi
inc edx
add byte [edi + 0x47], dh
inc edx
add byte [edx - 0x49ffbdb9], bl
inc esi
inc edx
add byte [edx - 0x38ffbdb8], ch
inc edi
inc edx
add dh, ah
inc edi
inc edx
add byte [0x24004248], al
dec eax
inc edx
add bl, bl
dec eax
inc edx
add al, bh
dec eax
inc edx
add byte [0x87004249], dl
dec eax
inc edx
add byte [ecx + 0x48], al
inc edx
add byte [eax + ecx*2 + 0x42], ah
add byte [edx + 0x43], bh
inc edx
add al, dh
inc ebx
inc edx
add byte [eax], bl
inc esp
inc edx
add byte [edx], dh
dec ecx
inc edx
add byte [ebp + 0x49], dl
inc edx
add byte [ecx + 0x40], dh
inc edx
add byte [edi - 0xaffbdc0], bh
inc edx
add byte [edi + edi + 0x3f830042], bh
inc edx
add byte [edx + 0x3f], cl
inc edx
add ch, dh
aas
inc edx
add byte [ebx], dh
inc eax
inc edx
add byte [edx - 0x48ffbdc2], ah
dec edx
inc edx
add dl, ah
dec edx
inc edx
add byte [esp + ecx*2 + 0x4ce00042], ah
inc edx
add byte [ecx*2 + 0x4d580042], bl
inc edx
add byte [ebp + ecx*2 + 0x4dd00042], dl
inc edx
add byte [esi + ecx*2], cl
inc edx
add byte [eax + 0x4e], cl
inc edx
add byte [esi + ecx*2 + 0x4ee00042], ah
inc edx
add byte [edi + ecx*2], bl
inc edx
add byte [eax + 0x4f], bl
inc edx
add byte [edi + ecx*2 + 0x4fd00042], dl
inc edx
add byte [eax + edx*2], cl
inc edx
add byte [eax + 0x50], cl
inc edx
add byte [eax + edx*2 + 0x50c00042], al
inc edx
add ah, bh
push eax
inc edx
add byte [edx + 0x51], bl
inc edx
add byte [esi - 0x2dffbdaf], dl
push ecx
inc edx
add byte [esi], cl
push edx
inc edx
add byte [esi + 0x52], al
inc edx
add byte [edx + edx*2 + 0x1000042], al
add al, byte [ebx]
add al, 5
push es
pop es
or byte [ecx], cl
or cl, byte [edx]
or ecx, dword [ecx + 0x11100f0e]
adc dl, byte [ebx]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
adc al, 0x14
adc al, 0x14
adc al, 0x14
adc eax, 0xadadad16
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
pop ss
pop ss
pop ss
sbb byte [ebp - 0x52525253], ch
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
sbb dword [edx], ebx
sbb ebx, dword [ebx + 0x21201f1e]
and ah, byte [ebx]
and al, 0x25
daa
sub byte [ecx], ch
sub ch, byte [ebx]
sub al, 0x2d
das
xor byte [ecx], dh
xor dh, byte [ebx]
xor al, 0x35
aaa
cmp byte [ecx], bh
cmp bh, byte [ebx]
cmp al, 0x3d
aas
inc eax
inc ecx
inc edx
inc ebx
inc esp
inc ebp
inc esi
inc edi
dec eax
dec ecx
dec edx
dec ebx
dec ebx
dec esp
dec esp
dec ebp
dec esi
dec edi
push eax
push ecx
push edx
push ebx
push esp
push ebp
push esi
push edi
pop eax
pop ecx
pop ecx
pop edx
pop ecx
pop ebx
pop ecx
pop ecx
pop esp
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
pop ebp
pop esi
pop edi
pushal
popal
bound esp, qword [ebx + 0x64]
push 0x6a69
imul ebp, dword [ebp + ebp*2 + 0x6e], 0x6f
jo 0x4257f9
jb 0x4257fd
je 0x425801
jbe 0x425805
js 0x425809
jp 0x42580d
jl 0x425811
jle 0x425815
add byte [ecx - 0x7a7b7c7e], 0x86
xchg dword [eax - 0x73747577], ecx
lea ecx, [esi - 0x6d6e6f71]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
xchg ebx, eax
xchg esp, eax
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
xchg ebp, eax
xchg esi, eax
xchg edi, eax
cwde
cdq
lcall 0xa09f, 0x9e9d9c9b
mov eax, dword [0x13a4a3a2]
movsd dword es:[edi], dword [esi]
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
test al, 0xa9
stosb byte es:[edi], al
stosd dword es:[edi], eax
lodsb al, byte [esi]
jb 0x4258d9
inc edx
add byte [esi + 0x1f], cl
inc edx
add byte [edi + 0x1f], dl
inc edx
add byte [eax + 0x1f], ah
inc edx
add byte [ecx + 0x1f], ch
inc edx
add dh, al
xor dword [edx], eax
mov byte [ecx], dh
inc edx
add byte [edx + esi], al
inc edx
add byte [edi - 0x1affbdcf], ah
xor dword [edx], eax
and esi, dword [edx]
inc edx
add byte [edx + 0x32], al
inc edx
add byte [edx + edx*2 + 0x1000042], al
add dword [ecx], eax
add byte [edx], al
add eax, dword [edi + eax]
xor dword [edx], eax
in eax, 0x31
inc edx
add byte [ebx], ah
xor al, byte [edx]
inc edx
xor al, byte [edx]
test byte [edx + 0x42], dl
add byte [eax], al
add dword [ecx], eax
add dword [eax], eax
add al, byte [ebx]
add al, 7
add byte [0x7020607], al
add byte [ecx], al
pop es
pop es
pop es
add byte [edi], al
pop es
add byte [edi], al
pop es
add eax, dword [edi]
pop es
pop es
pop es
pop es
add al, 7
pop es
pop es
pop es
pop es
pop es
pop es
pop es
add al, 7
pop es
pop es
pop es
add byte [edi], al
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
add al, 7
add byte [edi], al
add al, byte [edi]
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
add al, 7
pop es
pop es
add byte [edi], al
pop es
pop es
pop es
pop es
pop es
pop es
add byte [edi], al
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
add byte [edi], al
add byte [edi], al
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
add al, 0x90
nop
xor al, byte [edx]
out 0x32, al
inc edx
add byte [ebx + 0x11004232], bh
xor eax, dword [edx]
test byte [edx + 0x42], dl
add byte [eax], al
add byte [eax], al
add al, 4
add al, 4
add al, 4
add al, 4
add al, 1
add al, 4
add al, byte [esp + eax]
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 0
add al, 4
add al, 4
add byte [esp + eax], al
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add byte [esp + eax], al
add al, 4
add al, 4
add al, 4
add al, 4
add al, 2
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 3
add al, 0
nop
xchg byte [edi], dh
inc edx
add byte [ebp - 0x7bffbdb4], bl
push edx
inc edx
add byte [edx - 0x7bffbdc9], cl
push edx
inc edx
add bl, cl
aaa
inc edx
add bl, dh
aaa
inc edx
add byte [eax], dl
cmp al, byte [edx]
pop ss
cmp al, byte [edx]
push ds
cmp al, byte [edx]
xor byte [edx], bh
inc edx
add byte [ebp - 0x43ffbdc3], dh
cmp eax, 0x3dc30042
inc edx
add ch, dl
cmp eax, 0xcccc0042
int3