Function at 0x443efa
Capabilities:
Get common file path
Get system information on windows
Log keystrokes via polling
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f4
push esi
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x90], 9
mov dword [ebp - 0x2cc], 0xffffffff
mov dword [ebp - 0x64], 1
cmp dword [ebp - 0x20], 0
je 0x443f3d
or eax, 0xffffffff
je 0x443f3d
mov dword [ebp - 0x148], 1
jmp 0x443f44
and dword [ebp - 0x148], 0
mov dword [ebp - 0x90], 0xd2f
cmp dword [ebp - 0x90], 0
jne 0x443f67
push 9
pop eax
test eax, eax
jne 0x443f67
and dword [ebp - 0x2d0], 0
jmp 0x443f71
mov dword [ebp - 0x2d0], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x90], eax
je 0x443f91
mov dword [ebp - 0x154], 1
jmp 0x443f98
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x154], eax
jne 0x443faf
mov dword [ebp - 0x2c4], 1
jmp 0x443fb6
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2cc], eax
jle 0x443fdc
mov dword [ebp - 0x208], 1
jmp 0x443fe3
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x208], eax
jne 0x444003
cmp dword [ebp - 0x90], 0
je 0x444003
mov dword [ebp - 0x2bc], 1
jmp 0x44400a
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x2bc]
add eax, 0x185a
cmp eax, 0x307b5ca9
jl 0x444028
mov dword [ebp - 0x2c0], 1
jmp 0x44402f
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0x2c0]
jg 0x444049
mov dword [ebp - 0x36c], 1
jmp 0x444050
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x64], 0xfffffffd
mov dword [ebp - 0x20], 0
jmp 0x444070
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x16
jl 0x444120
mov dword [ebp - 0x3b0], 1
mov dword [ebp - 0x3ac], 1
mov dword [ebp - 0x3a8], 1
mov dword [ebp - 0x3a4], 1
lea ecx, [ebp - 0x125]
call fcn.0040f330
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x3b0]
push eax
lea ecx, [ebp - 0x4bc]
call fcn.0040f333
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4a8]
call fcn.0040f2df
mov dword [ebp - 0x64], 0
jmp 0x4440e7
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jg 0x444110
mov byte [ebp - 0x3e], 0
movzx eax, byte [ebp - 0x3e]
test eax, eax
je 0x44410e
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x4440e0
lea ecx, [ebp - 0x4a8]
call fcn.0040f305
jmp 0x444069
movzx eax, byte [ebp + 0x38]
test eax, eax
je 0x445fd4
push 1
lea ecx, [ebp - 0xf8]
call fcn.0040f233
mov dword [ebp - 0x58], 0x19adb821
mov dword [ebp - 0x158], 0xe3ca3691
mov dword [ebp - 0x328], 0x2fa5d872
mov dword [ebp - 0x2c], 0
jmp 0x444164
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x444180
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xf8]
call fcn.0040f321
mov dword [eax], 0xfffffffe
jmp 0x44415d
mov dword [ebp - 0x2c], 0
jmp 0x444190
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x4441a6
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x374], 0x6595ad33
jmp 0x444189
push 0
lea ecx, [ebp - 0xf8]
call fcn.0040f321
cmp dword [eax], 0xfffffff8
jne 0x4441bc
cmp dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jne 0x4441d0
mov dword [ebp - 0x150], 1
jmp 0x4441d7
and dword [ebp - 0x150], 0
push 0
lea ecx, [ebp - 0xf8]
call fcn.0040f321
mov ecx, dword [ebp - 0x150]
cmp ecx, dword [eax]
jne 0x4441fa
mov dword [ebp - 0x210], 1
jmp 0x444201
and dword [ebp - 0x210], 0
push 0
lea ecx, [ebp - 0xf8]
call fcn.0040f321
push 0
lea ecx, [ebp - 0xf8]
call fcn.0040f321
mov eax, dword [ebp - 0x210]
sub eax, 0x1a5679b5
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x42c], eax
push 0
lea ecx, [ebp - 0xf8]
call fcn.0040f321
mov esi, eax
push 0
lea ecx, [ebp - 0xf8]
call fcn.0040f321
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x444266
mov dword [ebp - 0x270], 1
jmp 0x44426d
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x270], eax
je 0x444284
mov dword [ebp - 0x160], 1
jmp 0x44428b
and dword [ebp - 0x160], 0
push 0
lea ecx, [ebp - 0xf8]
call fcn.0040f321
mov ecx, dword [ebp - 0x160]
cmp ecx, dword [eax]
jne 0x4442ae
mov dword [ebp - 0x104], 1
jmp 0x4442b5
and dword [ebp - 0x104], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x104]
mov dword [ebp + eax - 0x374], ecx
push 0
lea ecx, [ebp - 0xf8]
call fcn.0040f321
mov ecx, dword [ebp - 0x104]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x58]
jg 0x4442ee
mov dword [ebp - 0x218], 1
jmp 0x4442f5
and dword [ebp - 0x218], 0
cmp dword [ebp - 0x218], 0x6e2c
jge 0x44430d
mov dword [ebp - 0x168], 1
jmp 0x444314
and dword [ebp - 0x168], 0
push 0
lea ecx, [ebp - 0xf8]
call fcn.0040f321
mov ecx, dword [ebp - 0x168]
cmp ecx, dword [eax]
jl 0x444337
mov dword [ebp - 0x2a0], 1
jmp 0x44433e
and dword [ebp - 0x2a0], 0
push 0
lea ecx, [ebp - 0xf8]
call fcn.0040f321
mov ecx, dword [ebp - 0x2a0]
add ecx, dword [eax]
sub ecx, dword [ebp - 0x58]
mov dword [ebp - 0x328], ecx
mov byte [ebp - 0x4c], 0
movzx eax, byte [ebp - 0x4c]
test eax, eax
je 0x44437e
push 0xa0b
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
lea ecx, [ebp - 0xf8]
call fcn.0040f305
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x70], 0xebb6748f
mov dword [ebp - 0x60], 0
jmp 0x4443cb
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xffffffea
jle 0x44475c
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x278], 0xffffffff
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x444420
mov dword [ebp - 0x170], 2
mov dword [ebp - 0x364], 1
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x364], eax
jmp 0x44473c
mov dword [ebp - 0x124], 0xfffffff6
mov dword [ebp - 0x11c], 0x8b4b72b4
mov dword [ebp - 0x18], 0x9b96bc71
mov dword [ebp - 0x94], 0
jmp 0x444454
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x444470
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x3c8], 0xf039d3cd
jmp 0x444447
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x30], 0
jne 0x444491
cmp dword [ebp - 0x124], 0
jne 0x444491
and dword [ebp - 0x220], 0
jmp 0x44449b
mov dword [ebp - 0x220], 1
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jne 0x4444bf
cmp dword [ebp - 0x60], 0
jne 0x4444bf
and dword [ebp - 0x178], 0
jmp 0x4444c9
mov dword [ebp - 0x178], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c8]
mov ecx, dword [ebp - 0x178]
lea eax, [ecx + eax - 1]
test eax, eax
je 0x4444f6
cmp dword [ebp - 0x30], 0
je 0x4444f6
mov dword [ebp - 0x10c], 1
jmp 0x4444fd
and dword [ebp - 0x10c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10c]
mov dword [ebp + eax - 0x3c8], ecx
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x444531
cmp dword [ebp - 0x278], 0
jne 0x444531
and dword [ebp - 0x180], 0
jmp 0x44453b
mov dword [ebp - 0x180], 1
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x180], eax
jl 0x444555
mov dword [ebp - 0x228], 1
jmp 0x44455c
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x44457a
mov eax, 0xd6cd5387
test eax, eax
jne 0x44458c
mov eax, 0xce404d46
test eax, eax
jne 0x44458c
and dword [ebp - 0x188], 0
jmp 0x444596
mov dword [ebp - 0x188], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x188], eax
jl 0x4445ad
mov dword [ebp - 0x2b8], 1
jmp 0x4445b4
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2b8], eax
jle 0x4445cb
mov dword [ebp - 0x190], 1
jmp 0x4445d2
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x190], eax
jge 0x4445e9
mov dword [ebp - 0x230], 1
jmp 0x4445f0
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x230]
cmp eax, 0x2e0c
jge 0x44460c
mov dword [ebp - 0x198], 1
jmp 0x444613
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x198], eax
jl 0x44462a
mov dword [ebp - 0x280], 1
jmp 0x444631
and dword [ebp - 0x280], 0
cmp dword [ebp - 0x280], 8
jb 0x444646
mov dword [ebp - 0x1a0], 1
jmp 0x44464d
and dword [ebp - 0x1a0], 0
cmp dword [ebp - 0x1a0], 0x9172c2e8
je 0x444665
mov dword [ebp - 0x238], 1
jmp 0x44466c
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x238]
jne 0x444683
mov dword [ebp - 0x1a8], 1
jmp 0x44468a
and dword [ebp - 0x1a8], 0
cmp dword [ebp - 0x1a8], 0x47b6
jle 0x4446a2
mov dword [ebp - 0x2f4], 1
jmp 0x4446a9
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x30], 1
jg 0x4446e2
mov dword [ebp - 0x2a8], 1
jmp 0x4446e9
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
sub eax, 7
cmp eax, dword [ebp - 0x18]
jle 0x444703
mov dword [ebp - 0x1b0], 1
jmp 0x44470a
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0
jmp 0x444726
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x44473c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3c8], 0x16cf0574
jmp 0x44471f
mov byte [ebp - 0x44], 0
movzx eax, byte [ebp - 0x44]
test eax, eax
je 0x444757
push 0x113f
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
jmp 0x4443c4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x3f0], 8
mov byte [ebp - 0x3a], 0
movzx eax, byte [ebp - 0x3a]
test eax, eax
je 0x444781
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov byte [ebp - 0x3b], 0
movzx eax, byte [ebp - 0x3b]
test eax, eax
je 0x4447a3
push 0
push 0
push 0x1e69
push 0x1ff6
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x49c], 1
mov dword [ebp - 0x460], 0xfffffffe
mov dword [ebp - 0x2e0], 8
mov dword [ebp - 0x448], 0x328129ec
mov dword [ebp - 0xbc], 0
jmp 0x4447ff
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x44481b
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x4e8], 0xe8ce6fc2
jmp 0x4447f2
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x44482d
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov dword [ebp - 0x2e0], 1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x9c], 0
jmp 0x444860
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x44487c
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x4b4], 0xeab3cf81
jmp 0x444853
mov byte [ebp - 0x3f], 0
movzx eax, byte [ebp - 0x3f]
test eax, eax
je 0x444899
push 1
push 0xfed
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jge 0x4448ad
mov dword [ebp - 0x240], 1
jmp 0x4448b4
and dword [ebp - 0x240], 0
cmp dword [ebp - 0xc], 0
je 0x4448d2
cmp dword [ebp - 0xc], 0
jne 0x4448c6
cmp dword [ebp - 0xc], 0
je 0x4448d2
mov dword [ebp - 0x350], 1
jmp 0x4448d9
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0xc], 0x3e75
je 0x444912
mov dword [ebp - 0x1b8], 1
jmp 0x444919
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x1b8]
jl 0x444933
mov dword [ebp - 0x288], 1
jmp 0x44493a
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x288], eax
jne 0x444951
mov dword [ebp - 0x1c0], 1
jmp 0x444958
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x1c0], eax
je 0x44496f
mov dword [ebp - 0x248], 1
jmp 0x444976
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x248], eax
jle 0x444993
cmp dword [ebp - 0xc], 0
je 0x444993
mov dword [ebp - 0x1c8], 1
jmp 0x44499a
and dword [ebp - 0x1c8], 0
cmp dword [ebp - 0x1c8], 0xfffffff7
ja 0x4449af
mov dword [ebp - 0x2c8], 1
jmp 0x4449b6
and dword [ebp - 0x2c8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp + eax - 0x4b4], ecx
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x30c], eax
push 1
lea ecx, [ebp - 0x3e0]
call fcn.0040f233
mov dword [ebp - 0xa4], 0xffffffff
mov dword [ebp - 0xdc], 0
jmp 0x444a0b
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jge 0x444a2d
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x3e0]
call fcn.0040f321
mov dword [eax], 0xaf11
jmp 0x4449fe
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x444a4f
push 0
push 0
push 0x225c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [ebp - 0xa4], 0
jmp 0x444a68
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jg 0x444afb
mov dword [ebp - 0xc4], 0xffffffff
mov byte [ebp - 0x43], 0
movzx eax, byte [ebp - 0x43]
test eax, eax
je 0x444a98
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [ebp - 0xc4], 0
jmp 0x444ab1
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jg 0x444af6
mov dword [ebp - 0x5c], 0x72159124
mov dword [ebp - 0x5c], 0
jmp 0x444ad1
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x444aed
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x3e0]
call fcn.0040f321
mov dword [eax], 1
jmp 0x444aca
mov dword [ebp - 0x5c], 7
jmp 0x444aa4
jmp 0x444a5b
lea ecx, [ebp - 0x3e0]
call fcn.0040f305
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x314], eax
push 2
lea ecx, [ebp - 0x3d4]
call fcn.0040f233
mov dword [ebp - 0x14], 0
jmp 0x444b2c
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x444b3f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x34], 0xfffffff7
jmp 0x444b25
mov dword [ebp - 0x14], 0
jmp 0x444b4f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x444b65
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x480], 0
jmp 0x444b48
mov dword [ebp - 0x14], 0
jmp 0x444b75
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x444b91
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3d4]
call fcn.0040f321
mov dword [eax], 0x98422518
jmp 0x444b6e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x34], 0
jmp 0x444bb6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x34], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0xd
jne 0x444d49
mov dword [ebp - 0x38], 0
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0x2e8], 0xfffffffd
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x38], 0
jne 0x444c00
cmp dword [ebp - 0x38], 0
jne 0x444c00
and dword [ebp - 0x1d0], 0
jmp 0x444c0a
mov dword [ebp - 0x1d0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
imul eax, dword [ebp - 0x1d0]
test eax, eax
jne 0x444c2f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x480], 0
je 0x444c3d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x480], 0
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0xac]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x38], 0
jne 0x444c8d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
jne 0x444c8d
push 6
pop eax
test eax, eax
jne 0x444c8d
and dword [ebp - 0x250], 0
jmp 0x444c97
mov dword [ebp - 0x250], 1
cmp dword [ebp - 0x250], 0xffffffff
je 0x444cac
mov dword [ebp - 0x1d8], 1
jmp 0x444cb3
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x1d8], eax
jne 0x444cda
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x480], 0
je 0x444cda
mov dword [ebp - 0x290], 1
jmp 0x444ce1
and dword [ebp - 0x290], 0
cmp dword [ebp - 0x290], 3
je 0x444cf6
mov dword [ebp - 0x1e0], 1
jmp 0x444cfd
and dword [ebp - 0x1e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e0]
sub ecx, dword [ebp + eax - 0x34]
mov dword [ebp - 0x258], ecx
push 0
lea ecx, [ebp - 0x3d4]
call fcn.0040f321
mov ecx, dword [ebp - 0x258]
mov dword [eax], ecx
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0xac], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
mov dword [ebp - 0x2e8], eax
jmp 0x444ba1
lea ecx, [ebp - 0x3d4]
call fcn.0040f305
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd4], 0xffffffe2
jmp 0x444d77
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x1a
jl 0x444dc5
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x444d9e
push 0x4fc
push 0xfee
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
mov byte [ebp - 0x47], 0
movzx eax, byte [ebp - 0x47]
test eax, eax
je 0x444dc3
push 0
push 0
push 0
push 0
push 0
push 0
push 0x208
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x444d6a
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x34c], eax
mov dword [ebp - 0x8c], 6
mov dword [ebp - 0x420], 0xb72b21a3
mov dword [ebp - 0x1e8], 0xfffffff7
mov dword [ebp - 0xb4], 0
jmp 0x444e08
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x444e24
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x4f4], 6
jmp 0x444dfb
mov dword [ebp - 0x8c], 0
jmp 0x444e3d
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jg 0x444e66
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x444e64
push 0x1e2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x444e30
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x138], 0x2d5e48d3
mov dword [ebp - 0x134], 0x2d5e48d3
mov dword [ebp - 0x130], 0x2d5e48d3
mov dword [ebp - 0x12c], 0x2d5e48d3
mov dword [ebp - 8], 0x52061f6
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x24], 0x391cb4e7
mov dword [ebp - 0x100], 0x1932e3ca
mov dword [ebp - 0x39c], 0x23edb395
mov dword [ebp - 0x398], 0x23edb395
mov dword [ebp - 0x394], 0x23edb395
mov dword [ebp - 0x390], 0x23edb395
lea ecx, [ebp - 0xf9]
call fcn.0040f330
push eax
lea eax, [ebp - 0x38c]
push eax
lea eax, [ebp - 0x39c]
push eax
lea ecx, [ebp - 0x4cc]
call fcn.0040f333
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3ec]
call fcn.0040f2df
mov dword [ebp - 0x370], 0xffffffff
mov dword [ebp - 0x300], 0x1f66
mov dword [ebp - 8], 3
jmp 0x444f47
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x445099
mov dword [ebp - 0x1f0], 0xfffffff9
mov dword [ebp - 0x200], 9
cmp dword [ebp - 0x68], 0
jne 0x444fc3
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x138]
cmp dword [ebp + eax*4 - 0x138], ecx
jl 0x444f9f
mov dword [ebp - 0x2b0], 1
jmp 0x444fa6
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x2b0]
sub eax, dword [ebp - 0x1f0]
add eax, dword [ebp - 0x200]
jne 0x444fc3
and dword [ebp - 0x260], 0
jmp 0x444fcd
mov dword [ebp - 0x260], 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x138]
imul ecx, dword [ebp - 0x260]
cmp dword [ebp + eax*4 - 0x138], ecx
jle 0x444ff6
mov dword [ebp - 0x114], 1
jmp 0x444ffd
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x138], ecx
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x114], eax
jl 0x445024
mov dword [ebp - 0x1f8], 1
jmp 0x44502b
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x44504d
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x44504d
mov dword [ebp - 0x298], 1
jmp 0x445054
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
imul eax, dword [ebp - 0x200]
mov dword [ebp - 0x268], eax
push 0
lea ecx, [ebp - 0x3ec]
call fcn.0040f321
mov ecx, dword [ebp - 0x268]
mov dword [eax], ecx
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x370], eax
jmp 0x444f40
mov dword [ebp - 0x24], 0
jmp 0x4450a9
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x4452a8
mov dword [ebp - 0x80], 0xfff8
mov dword [ebp - 8], 3
jmp 0x4450ca
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x44527e
mov byte [ebp - 0x4b], 0
movzx eax, byte [ebp - 0x4b]
test eax, eax
je 0x4450fb
push 0x1532
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, 0x10224968
test eax, eax
je 0x4451f5
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x68], eax
jle 0x44511c
mov dword [ebp - 0x2f8], 1
jmp 0x445123
and dword [ebp - 0x2f8], 0
cmp dword [ebp - 0x80], 0xefae07df
jne 0x44513e
cmp dword [ebp - 0x80], 0
je 0x44513e
mov dword [ebp - 0x140], 1
jmp 0x445145
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x140], eax
jg 0x44515c
mov dword [ebp - 0x338], 1
jmp 0x445163
and dword [ebp - 0x338], 0
xor eax, eax
inc eax
cmp eax, 1
je 0x445181
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x138], 0
jne 0x445181
and dword [ebp - 0x144], 0
jmp 0x44518b
mov dword [ebp - 0x144], 1
imul eax, dword [ebp - 0x144], 0x2987
test eax, eax
jb 0x4451a5
mov dword [ebp - 0x14c], 1
jmp 0x4451ac
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x138]
cmp dword [ebp - 0x14c], eax
je 0x4451cd
cmp dword [ebp - 0x80], 0
jne 0x4451cd
and dword [ebp - 0x13c], 0
jmp 0x4451d7
mov dword [ebp - 0x13c], 1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x138]
cmp eax, dword [ebp - 0x13c]
je 0x4451f5
mov dword [ebp - 0x15c], 1
jmp 0x4451fc
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x138]
cmp dword [ebp - 0x15c], eax
jl 0x44521a
mov dword [ebp - 0x164], 1
jmp 0x445221
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x300]
cmp dword [ebp - 0x164], eax
jg 0x44523b
mov dword [ebp - 0x16c], 1
jmp 0x445242
and dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x16c], eax
je 0x44525c
mov dword [ebp - 0x174], 1
jmp 0x445263
and dword [ebp - 0x174], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x3ec]
call fcn.0040f321
mov ecx, dword [ebp - 0x174]
mov dword [eax], ecx
jmp 0x4450c3
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x4452a3
push 0xfc5
push 0
push 0xea3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp 0x4450a2
lea ecx, [ebp - 0x3ec]
call fcn.0040f305
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x388], 0xfffffff7
mov dword [ebp - 0x384], 0xfffffff7
mov dword [ebp - 0x380], 0xfffffff7
mov dword [ebp - 0x37c], 0xfffffff7
lea ecx, [ebp - 0x11d]
call fcn.0040f330
push eax
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x388]
push eax
lea ecx, [ebp - 0x4dc]
call fcn.0040f333
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xec]
call fcn.0040f2df
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0x340], 0xffffffff
mov dword [ebp - 0x1b4], 0x87c4177f
mov dword [ebp - 0x10], 0
jmp 0x445347
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x4455f6
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0
jmp 0x445368
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x4454a9
mov dword [ebp - 0x88], 0
jmp 0x44538b
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x4453a7
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x308], 0xffffffff
jmp 0x44537e
mov byte [ebp - 0x4f], 0
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x4453bb
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec]
call fcn.0040f321
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x428], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec]
call fcn.0040f321
cmp dword [eax], 0x7aced45b
jne 0x4453f4
mov dword [ebp - 0x17c], 1
jmp 0x4453fb
and dword [ebp - 0x17c], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec]
call fcn.0040f321
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec]
call fcn.0040f321
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x17c]
jl 0x445431
mov dword [ebp - 0x184], 1
jmp 0x445438
and dword [ebp - 0x184], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec]
call fcn.0040f321
mov esi, dword [ebp - 0x184]
sub esi, dword [eax]
push 3
lea ecx, [ebp - 0xec]
call fcn.0040f321
cmp esi, dword [eax]
jl 0x44546b
mov dword [ebp - 0x18c], 1
jmp 0x445472
and dword [ebp - 0x18c], 0
cmp dword [ebp - 0x18c], 0xfffb
jae 0x44548a
mov dword [ebp - 0x194], 1
jmp 0x445491
and dword [ebp - 0x194], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x194]
mov dword [ebp + eax - 0x308], ecx
jmp 0x445361
cmp dword [ebp - 0x10], 0
jne 0x4454cd
push 0
lea ecx, [ebp - 0xec]
call fcn.0040f321
cmp dword [eax], 0xf876
je 0x4454cd
and dword [ebp - 0x19c], 0
jmp 0x4454d7
mov dword [ebp - 0x19c], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x19c], eax
jge 0x4454ee
mov dword [ebp - 0x1a4], 1
jmp 0x4454f5
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jne 0x445515
mov dword [ebp - 0x1ac], 1
jmp 0x44551c
and dword [ebp - 0x1ac], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec]
call fcn.0040f321
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec]
call fcn.0040f321
mov ecx, dword [ebp - 0x1ac]
sub ecx, dword [eax]
mov eax, dword [esi]
sub eax, ecx
imul eax, eax, 0x925d
mov ecx, dword [ebp - 0x28]
lea esi, [eax + ecx + 0xfff7]
push 1
lea ecx, [ebp - 0xec]
call fcn.0040f321
sub esi, dword [eax]
mov dword [ebp - 0x1b4], esi
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x1b4], eax
jle 0x445582
mov dword [ebp - 0x1bc], 1
jmp 0x445589
and dword [ebp - 0x1bc], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0xec]
call fcn.0040f321
mov esi, dword [eax]
add esi, dword [ebp - 0x1bc]
push 1
lea ecx, [ebp - 0xec]
call fcn.0040f321
add esi, dword [eax]
cmp esi, 0x874d
jne 0x4455c2
mov dword [ebp - 0x1c4], 1
jmp 0x4455c9
and dword [ebp - 0x1c4], 0
cmp dword [ebp - 0x1c4], 0xfff6
jne 0x4455e1
mov dword [ebp - 0x1cc], 1
jmp 0x4455e8
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x28], eax
jmp 0x445340
lea ecx, [ebp - 0xec]
call fcn.0040f305
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0xa0], 0x184c506d
mov dword [ebp - 0x98], 0
jmp 0x445630
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x44564c
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x4d4], 0xb57f
jmp 0x445623
mov dword [ebp - 0xa0], 1
jmp 0x445665
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x445684
mov byte [ebp - 0x4a], 0
movzx eax, byte [ebp - 0x4a]
test eax, eax
je 0x445682
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x445658
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x494], 8
mov dword [ebp - 0x490], 8
mov dword [ebp - 0x48c], 8
mov dword [ebp - 0x488], 8
mov byte [ebp - 0x3c], 0
movzx eax, byte [ebp - 0x3c]
test eax, eax
je 0x4456d1
push 0x2147
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov byte [ebp - 0x46], 0
movzx eax, byte [ebp - 0x46]
test eax, eax
je 0x4456ec
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x1c], 0xe8cff0ea
mov dword [ebp - 0x6c], 0xffd81438
mov dword [ebp - 0x108], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x1c], 0
jmp 0x44572a
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe3
jne 0x445779
mov dword [ebp - 0xa8], 0
jmp 0x445749
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x445765
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x40c], 0x8f8
jmp 0x44573c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x40c], 0
je 0x445777
jmp 0x445779
jmp 0x445723
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x1c], 0
je 0x44579a
cmp dword [ebp - 0x1c], 0
je 0x44579a
mov dword [ebp - 0x1d4], 1
jmp 0x4457a1
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x1c], eax
jle 0x4457eb
mov dword [ebp - 0x1dc], 1
jmp 0x4457f2
and dword [ebp - 0x1dc], 0
cmp dword [ebp - 0x1dc], 4
jne 0x445807
mov dword [ebp - 0x1e4], 1
jmp 0x44580e
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1e4], eax
jle 0x445825
mov dword [ebp - 0x348], 1
jmp 0x44582c
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x6c]
sub eax, 0xec58
cmp eax, 0xc57f
jge 0x445853
mov dword [ebp - 0x1ec], 1
jmp 0x44585a
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1ec], eax
jl 0x445871
mov dword [ebp - 0x320], 1
jmp 0x445878
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xb0], eax
jne 0x4458ac
mov byte [ebp - 0x39], 0
movzx eax, byte [ebp - 0x39]
test eax, eax
je 0x4458a7
push 0
push 0xd0f
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x445966
mov dword [ebp - 0x360], 0x4a6b2c4e
push 4
lea ecx, [ebp - 0x3bc]
call fcn.0040f233
mov dword [ebp - 0x2d8], 0x1636717b
mov dword [ebp - 0x84], 0
jmp 0x4458e6
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x445908
push dword [ebp - 0x84]
lea ecx, [ebp - 0x3bc]
call fcn.0040f321
mov dword [eax], 1
jmp 0x4458d9
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xfffffff7
je 0x445923
mov dword [ebp - 0x1f4], 1
jmp 0x44592a
and dword [ebp - 0x1f4], 0
imul eax, dword [ebp - 0x1f4], 0xa8db
mov dword [ebp - 0x1fc], eax
push 1
lea ecx, [ebp - 0x3bc]
call fcn.0040f321
mov ecx, dword [ebp - 0x1fc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x2d8], eax
lea ecx, [ebp - 0x3bc]
call fcn.0040f305
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0xc0], 0xfffffffc
mov dword [ebp - 0xb8], 0
jmp 0x445995
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x4459b1
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x4c4], 0
jmp 0x445988
mov byte [ebp - 0x4e], 0
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x4459cc
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [ebp - 0xc0], 0
jmp 0x4459e5
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jg 0x445a17
mov byte [ebp - 0x40], 0
movzx eax, byte [ebp - 0x40]
test eax, eax
je 0x445a15
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x4459d8
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x294], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x7c], 0xe1d925b0
mov dword [ebp - 0x74], 9
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x244], 6
mov dword [ebp - 0x78], 1
mov dword [ebp - 0xc8], 0
jmp 0x445a69
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x445a85
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x3f8], 0xf9e6a012
jmp 0x445a5c
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
jle 0x445aac
mov dword [ebp - 0x204], 1
jmp 0x445ab3
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x204]
jl 0x445aca
mov dword [ebp - 0x21c], 1
jmp 0x445ad1
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
jne 0x445ae5
mov dword [ebp - 0x20c], 1
jmp 0x445aec
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x20c]
neg eax
sub eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
cmp eax, 0xbf5f
jl 0x445b0d
mov dword [ebp - 0x214], 1
jmp 0x445b14
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x54], eax
imul eax, dword [ebp - 0x54], 0xcaea
cmp eax, dword [ebp - 4]
jne 0x445b35
mov dword [ebp - 0x224], 1
jmp 0x445b3c
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x21c]
add eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x74]
jg 0x445b59
mov dword [ebp - 0x22c], 1
jmp 0x445b60
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x22c], eax
jl 0x445b7a
cmp dword [ebp - 0x7c], 0
jne 0x445b7a
and dword [ebp - 0x234], 0
jmp 0x445b84
mov dword [ebp - 0x234], 1
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x234], eax
jne 0x445b9b
mov dword [ebp - 0x23c], 1
jmp 0x445ba2
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
neg eax
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x244], eax
jge 0x445bd6
cmp dword [ebp - 0x7c], 0
jne 0x445bd6
cmp dword [ebp - 4], 0
jne 0x445bd6
and dword [ebp - 0x24c], 0
jmp 0x445be0
mov dword [ebp - 0x24c], 1
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x24c]
sub ecx, dword [ebp - 0x78]
sub eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x3f8]
je 0x445c51
mov byte [ebp - 0x48], 0
movzx eax, byte [ebp - 0x48]
test eax, eax
je 0x445c1a
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 0x42], 0
movzx eax, byte [ebp - 0x42]
test eax, eax
je 0x445c4c
push 0
push 0
push 0
push 0xdef
push 0x1557
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x445ce9
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x54], 0
jmp 0x445c6b
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x18
jge 0x445ce9
mov dword [ebp - 0x254], 9
mov dword [ebp - 0x440], 0xffffffff
mov dword [ebp - 0x78], 0xfffffff9
jmp 0x445c95
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x445cd7
mov dword [ebp - 0x2ec], 0xfffffff7
mov dword [ebp - 4], 0
jmp 0x445cb5
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jg 0x445cca
mov eax, dword [ebp - 0x254]
dec eax
mov dword [ebp - 0x254], eax
jmp 0x445cae
cmp dword [ebp - 0x2ec], 0
je 0x445cd5
jmp 0x445cd7
jmp 0x445c8e
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
jmp 0x445c64
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x334], eax
mov dword [ebp - 0xd0], 0
jmp 0x445d0e
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jge 0x445d2a
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0xd8], 0x4fd3df75
jmp 0x445d01
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd8], 7
jmp 0x445d58
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd8], 0xfffffff1
jl 0x445dc9
mov dword [ebp - 0x264], 1
mov dword [ebp - 0xe0], 0
jmp 0x445d8b
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x445da7
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x2fc], 0xfffffffb
jmp 0x445d7e
mov dword [ebp - 0x264], 0xa4f402e3
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x264]
mov dword [ebp + eax - 0x2fc], ecx
jmp 0x445d3d
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x344], eax
push 0
mov ecx, dword [ebp - 0xcc]
call fcn.0040f321
push 0
mov ecx, dword [ebp - 0x31c]
call fcn.0040f321
cmp dword [eax], 0
jne 0x445ee1
mov eax, dword [ebp - 0x27c]
cmp dword [eax], 0
jne 0x445ea3
push 0
mov ecx, dword [ebp - 0xcc]
call fcn.0040f321
push 0
mov ecx, dword [ebp - 0xcc]
call fcn.0040f321
mov eax, dword [eax]
sub eax, 0xbd55
je 0x445e60
push 0
mov ecx, dword [ebp - 0xcc]
call fcn.0040f321
cmp dword [eax], 0
je 0x445e60
mov dword [ebp - 0x26c], 1
jmp 0x445e67
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
imul eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x294]
cmp eax, dword [ecx]
jne 0x445e8c
mov dword [ebp - 0x274], 1
jmp 0x445e93
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
cmp dword [ebp - 0x274], eax
je 0x445eba
mov eax, dword [ebp - 0x27c]
cmp dword [eax], 0
je 0x445eba
mov dword [ebp - 0x110], 1
jmp 0x445ec1
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x324]
mov ecx, dword [ebp - 0x110]
mov dword [eax], ecx
cmp dword [ebp - 0x110], 0
jne 0x445ee1
and dword [ebp - 0x284], 0
jmp 0x445eeb
mov dword [ebp - 0x284], 1
mov eax, dword [ebp - 0x32c]
mov ecx, dword [ebp - 0x284]
mov dword [eax], ecx
mov eax, dword [ebp - 0x334]
cmp dword [eax], 0
jg 0x445f10
mov dword [ebp - 0x28c], 1
jmp 0x445f17
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x28c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x294]
mov eax, dword [eax]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x2ac]
mov eax, dword [eax]
mov dword [ebp - 0x3fc], eax
push 2
mov ecx, dword [ebp - 0x29c]
call fcn.0040f321
push 2
mov ecx, dword [ebp - 0x29c]
call fcn.0040f321
cmp dword [eax], 0xffffffff
je 0x445f6c
mov dword [ebp - 0x2a4], 1
jmp 0x445f73
and dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 0xffffffff
jl 0x445f88
mov dword [ebp - 0x33c], 1
jmp 0x445f8f
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x2ac]
mov eax, dword [eax]
mov dword [ebp - 0x400], eax
mov eax, 0x2e26
test eax, eax
je 0x445fbd
mov eax, dword [ebp - 0x344]
cmp dword [eax], 0
je 0x445fbd
mov dword [ebp - 0x2b4], 1
jmp 0x445fc4
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x34c]
mov ecx, dword [ebp - 0x2b4]
mov dword [eax], ecx
jmp 0x44600f
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
movzx eax, byte [eax]
test eax, eax
je 0x44600f
push 0
push 0
push 0
push 0
push 0
push 0
push 0x208
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
pop esi
mov esp, ebp
pop ebp
ret