Function at 0x437ccc
Capabilities:
Get common file path
Modify service
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
push edi
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x18], 0x57d6
push 3
mov byte [ebp - 0x31], dl
call fcn.00437959
mov dword [ebp - 0x14], 0x1d5f49dc
xor edx, edx
inc edx
xor eax, eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], 0x1f13d464
mov dword [ebp - 0x24], 0x84bafc8d
mov dword [ebp - 0x38], eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x437d37
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1a4]
mov dword [ecx + edx*4], 0xfffffffb
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x437d1b
xor edx, edx
inc edx
mov dword [ebp - 8], eax
jmp 0x437d4a
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x78], 8
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x437d3c
cmp dword [ebp - 0x18], eax
je 0x437d5e
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x1a4]
mov dword [ebp - 0x74], esi
mov ecx, dword [ebp - 0x18]
cmp esi, ecx
mov ecx, dword [ebp - 0x1c]
setl dl
xor ebx, ebx
sub edx, 0x6f9cbb95
cmp edx, dword [edi + 4]
setne bl
sub ebx, ecx
je 0x437def
mov dword [ebp - 0x30], 0xac57
mov dword [ebp - 0x14], eax
jmp 0x437db2
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xc4], 0xe531
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x437da1
dec dword [ebp - 0xc4]
xor edx, edx
mov ecx, dword [ebp - 0x74]
cmp dword [edi + 4], eax
mov eax, dword [ebp - 0xc4]
setne dl
mov dword [ebp - 0x74], eax
imul ecx, dword [ebp - 0x10], 0x3212
sub ecx, eax
add ecx, edx
imul ecx, dword [ebp - 0xc4]
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0x10]
jmp 0x437e9d
mov dword [ebp - 0x1c], 0x9fa6
mov dword [ebp - 8], 0x1ab372c2
cmp dword [ebp - 0x14], eax
je 0x437e0b
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x74]
mov ecx, dword [ebp - 8]
cmp ecx, edx
mov ecx, dword [ebp - 0x1c]
setle bl
xor edx, edx
cmp ecx, ebx
setge dl
imul edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x18]
jne 0x437e97
xor edx, edx
inc edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], 0x307f0789
mov dword [ebp - 0x1c], 0x17
jmp 0x437e8f
mov dword [ebp - 0x14], eax
jmp 0x437e5a
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x44], 0x6c839c72
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x437e4c
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x24], 3
mov ecx, dword [ebp - 0x24]
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
push 1
setge dl
mov dword [ebp - 0x28], edx
dec dword [ebp - 0x1c]
pop edx
cmp dword [ebp - 0x1c], 0xfffffff9
je 0x437e47
jmp 0x437e9d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x74], eax
lea ecx, [ebp - 0x1a4]
call fcn.00437a2b
mov dword [ebp - 0x18], 0xfa42
xor eax, eax
mov dword [ebp - 0x38], 0xe356ec7e
mov dword [ebp - 0x30], 0x609d70ca
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xf039
mov dword [ebp - 0x30], 0xededc87a
mov dword [ebp - 0x24], 0x3068
mov dword [ebp - 0x14], eax
jmp 0x437ef4
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x1f4], 0xd585ed06
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x437ee3
mov ecx, dword [ebp - 0x18]
sub ecx, 0xbf9acf25
movdqa xmm0, xmmword [0xaa5fe0]
neg ecx
push dword [ebp + 8]
sbb ecx, ecx
xor ebx, ebx
inc ecx
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1f0], ecx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1ec]
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
setle bl
xor edx, edx
cmp ebx, ecx
lea ecx, [ebp - 0x214]
push ecx
sete dl
lea ecx, [ebp - 0x224]
push ecx
mov dword [ebp - 0x38], edx
lea ecx, [ebp - 0x118]
dec dword [ebp - 0x24]
push eax
movdqu xmmword [ebp - 0x224], xmm0
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
call fcn.00437a9c
xor ebx, ebx
lea ecx, [ebp - 0x18c]
inc ebx
push ebx
call fcn.00437959
mov dword [ebp - 0x18], 8
xor eax, eax
mov dword [ebp - 0x38], 0x462a77b6
mov dword [ebp - 8], eax
jmp 0x437fb2
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18c]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x437fa3
mov dword [ebp - 8], eax
jmp 0x437fcd
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1c8], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x437fbc
mov edi, dword [ebp - 0x118]
xor edx, edx
mov ecx, dword [ebp - 0x18c]
cmp dword [edi + 8], ebx
mov esi, dword [ecx]
setle dl
add edx, dword [edi + 0xc]
sub edx, esi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, esi
setg cl
cmp ecx, esi
je 0x438004
mov ecx, eax
cmp dword [edi], eax
je 0x438006
mov ecx, ebx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x18], eax
jmp 0x43801f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1c8], 0x883e731e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x43800e
lea ecx, [ebp - 0x18c]
call fcn.00437a2b
lea ecx, [ebp - 0x118]
call fcn.00437a2b
mov edi, dword [0x4b45ec]
xor eax, eax
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x14], 0x9f7c
mov dword [ebp - 0x24], 0x7fd074de
mov dword [ebp - 0x24], 0xecbfcf41
mov dword [ebp - 0x18], 0xe5f58cdc
mov dword [ebp - 0x38], edi
mov dword [ebp - 8], eax
jmp 0x43807f
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x94], 0xfffffffe
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x43806e
mov dword [ebp - 8], eax
jmp 0x43809a
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x12c], 0x6595ad33
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x438089
cmp dword [ebp - 0x1c], eax
jne 0x4380dd
cmp dword [ebp - 0x14], 0xd0c2b868
je 0x4380b2
cmp dword [ebp - 0x14], eax
je 0x4380b9
mov ecx, ebx
cmp dword [ebp - 0x1c], eax
jne 0x4380bb
mov ecx, eax
add ecx, 4
xor edx, edx
cmp ecx, 0xffffffff
mov esi, eax
setge dl
xor ecx, ecx
cmp edx, 0x3952
setl cl
mov dword [ebp - 0x94], ecx
test ecx, ecx
je 0x4380df
mov esi, ebx
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp esi, ecx
setl dl
xor ecx, ecx
cmp edx, ebx
setge cl
xor edx, edx
mov dword [ebp - 0x12c], ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x94]
cmp ecx, 0x4102
setle dl
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xfffffff6
setle dl
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], eax
jmp 0x438142
mov dword [ebp - 0x28], 0xffffffff
cmp dword [ebp - 0x28], eax
jne 0x438148
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
jl 0x438133
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
cmp byte [ebp - 0x31], al
je 0x4382d3
xor esi, esi
inc esi
cmp edi, esi
jne 0x4382d3
push 4
pop edi
push 3
lea ecx, [ebp - 0x128]
mov dword [ebx + 8], edi
call fcn.00437959
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x438197
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x128]
mov dword [ecx + edx*4], 0x313dd33a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x438184
mov dword [ebp - 0x10], eax
jmp 0x4381ac
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x64], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x4381a2
mov dword [ebp - 0x10], eax
jmp 0x4381c7
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x11c], 0xe1cc0e42
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4381b6
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jg 0x4382c1
mov edi, dword [ebp - 0x128]
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa6020]
lea ecx, [ebp - 0x1f4]
push ecx
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x14c], eax
push ecx
push eax
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x148], eax
movdqu xmmword [ebp - 0x204], xmm0
mov dword [ebp - 0x144], eax
call fcn.00437a9c
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x438236
push eax
push 0x10b1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov ecx, dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
je 0x438278
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
mov esi, dword [ebp - 0x58]
mov edx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x128]
mov dword [ecx + esi*4], edx
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x128]
cmp dword [ecx + edx*4], eax
je 0x438278
xor ecx, ecx
inc ecx
jmp 0x43827a
mov ecx, eax
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x24], 0xffffffff
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x43829d
push eax
push 0xd01
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x14c]
mov dword [edi + 4], eax
mov dword [ebp - 0x24], eax
call fcn.00437a2b
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 2
push 0
pop eax
jle 0x4381df
lea ecx, [ebp - 0x128]
call fcn.00437a2b
mov dword [ebx + 0xc], 0x4b45ec
push 4
lea ecx, [ebp - 0x1b0]
call fcn.00437959
xor eax, eax
mov dword [ebp - 8], 0x6942a1e9
mov dword [ebp - 8], eax
jmp 0x4382ff
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x198], 6
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4382ee
mov dword [ebp - 8], eax
jmp 0x43831d
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1b0]
mov dword [ecx + edx*4], 0xca4f833f
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x43830a
mov esi, dword [ebp - 0x1b0]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esi + 0xc], eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x43836d
push 0x2057
push eax
push 0x1447
push 0x147d
push 0x1653
push eax
push 0x1638
push 0x172f
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
xor eax, eax
inc dword [esi + 0xc]
cmp dword [esi + 0xc], 2
jle 0x438332
push 2
mov dword [ebp - 8], eax
pop esi
jmp 0x4383dd
mov dword [ebp - 0x18], 0x4caf14c9
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x438397
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x4383d5
mov dword [ebp - 0x14], 0x597a61ee
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], eax
jl 0x4383c8
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x198]
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x198], edx
dec dword [ebp - 0x14]
jns 0x4383af
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x198]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x43839c
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x43837e
lea ecx, [ebp - 0x1b0]
call fcn.00437a2b
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x40], eax
jge 0x439640
mov dword [ebp - 0x1c], 9
xor eax, eax
mov dword [ebp - 0x18], 0xb963ab19
mov dword [ebp - 0x20], 0x967268f5
mov dword [ebp - 0x3c], 0xffffffff
push 3
mov dword [ebp - 0x28], 0xf68d270c
mov dword [ebp - 8], eax
pop edx
jmp 0x438433
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xac], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x438426
mov dword [ebp - 8], eax
jmp 0x43844e
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x26c], 0xc242ea6a
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x43843d
mov dword [ebp - 0x1c], eax
jmp 0x438473
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x438470
push eax
push 0x2541
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x438458
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
jne 0x438529
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0xac], 0x93fe6966
mov ecx, dword [ebp - 0x1c]
sbb edx, edx
xor ebx, ebx
neg edx
inc ebx
imul ecx, edx
xor edx, edx
cmp ecx, ebx
setle dl
cmp edx, dword [ebp - 0x1c]
jl 0x4384bb
cmp dword [ebp - 0x18], eax
je 0x4384c2
mov ecx, dword [ebp - 0x1c]
mov esi, ebx
cmp dword [ebp - 0x18], eax
jne 0x4384c4
mov esi, eax
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0x18]
sete dl
xor ebx, ebx
cmp edx, ecx
setg bl
sub ebx, dword [ebp - 0x18]
sub ebx, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x1c]
neg ebx
sbb ebx, ebx
inc ebx
cmp ebx, 0xfff6
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, ecx
mov ecx, dword [ebp - 0xac]
sete bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0xa8]
setge dl
mov dword [ebp - 0x28], edx
xor edx, edx
cmp dword [ebp - 0x28], ecx
setne dl
xor ecx, ecx
cmp edx, 8
setne cl
cmp ecx, dword [ebp - 0x1c]
jle 0x438529
mov esi, eax
jmp 0x43852c
xor esi, esi
inc esi
mov ecx, dword [ebp - 0xac]
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0xa8]
setl dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x20]
setl bl
xor edx, edx
cmp ebx, ecx
setg dl
xor ecx, ecx
neg edx
cmp edx, 0xfffffff8
setne cl
xor edx, edx
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
cmp ecx, 6
setle dl
imul ecx, edx, 0xafcb
test ecx, ecx
je 0x438581
cmp dword [ebp - 0x3c], eax
je 0x438581
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x438584
xor ebx, ebx
inc ebx
push 2
pop esi
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x174]
push esi
mov dword [ebp - 0x1c], 0x4b45f0
call fcn.00437959
push esi
lea ecx, [ebp - 0x180]
call fcn.00437959
xor eax, eax
mov dword [ebp - 8], ebx
mov dword [ebp - 8], eax
jmp 0x4385c6
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x174]
mov dword [ecx + edx*4], 0x1177e8ed
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4385b3
mov dword [ebp - 8], eax
jmp 0x4385e3
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x180]
mov dword [ecx + edx*4], 0x20fe6e32
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4385d0
mov esi, dword [ebp - 0x180]
mov dword [esi + 4], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x14], eax
jmp 0x43866d
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], eax
jmp 0x438628
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x174]
mov ecx, dword [ecx + edx*4]
xor edx, edx
add ecx, 0x29989d22
cmp ecx, 0xba1a4d63
setne dl
mov dword [ebp - 8], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x438605
mov dword [ebp - 8], eax
jmp 0x438665
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x438650
push 0x210f
push 0x502
call edi
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x438662
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x438632
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x4385fd
inc dword [esi + 4]
cmp dword [esi + 4], ebx
jle 0x4385f1
lea ecx, [ebp - 0x180]
call fcn.00437a2b
lea ecx, [ebp - 0x174]
call fcn.00437a2b
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x40], eax
jle 0x439117
mov dword [ebp - 0x10], 0xfffffffe
lea ecx, [ebp - 0xd0]
push 3
call fcn.00437959
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 8], 0x41b6ba00
mov dword [ebp - 0x20], 0x5481f04f
mov dword [ebp - 0x14], eax
jmp 0x4386e1
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xd0]
mov dword [ecx + edx*4], 0x44198d72
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x4386ce
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xd0]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 0x10]
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x10]
add ecx, 0xbe92
cmp dword [ebp - 0x10], ecx
jge 0x438713
mov ecx, eax
cmp dword [ebp - 0x10], eax
je 0x438715
mov ecx, ebx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
sub esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov ecx, dword [ebp - 0x10]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x10]
setge bl
xor edx, edx
cmp ebx, ecx
setl dl
mov dword [ebp - 8], edx
mov dword [ebp - 8], 2
cmp dword [ebp - 8], eax
jl 0x438814
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x14], 0x6a332e52
mov dword [ebp - 0x20], 1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xd0]
cmp dword [ecx + edx*4], eax
je 0x438799
mov dword [ebp - 0x24], 0x71c2
cmp dword [ebp - 0x24], 0xfffffffb
jne 0x438799
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xd0]
mov esi, dword [ebp - 0xd0]
mov ecx, dword [ecx + edx*4]
mov dword [esi + edi*4], ecx
test ecx, ecx
jne 0x4387c1
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xee34d1cd
mov ecx, dword [ebp - 0x20]
setne bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xfff7
setne dl
mov dword [ebp - 0x20], edx
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x43880b
push eax
push 0x1fe9
push eax
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
xor eax, eax
dec dword [ebp - 8]
jns 0x438766
lea ecx, [ebp - 0xd0]
call fcn.00437a2b
mov ebx, dword [ebp - 0x1c]
xor edi, edi
inc edi
mov eax, dword [ebx]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x1ba80278
mov dword [ebp - 0x20], 0xdfa536ca
mov dword [ebp - 0x14], eax
jmp 0x43884c
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x70], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x438842
mov dword [ebp - 0x18], 0xffffffff
jmp 0x438a44
mov dword [ebp - 0x10], 7
mov dword [ebp - 8], 0xfffffff7
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x4389f6
mov dword [ebp - 0x3c], 0x16e31137
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x43889e
push eax
push eax
push 0x930
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x70]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp + ecx*4 - 0x70], eax
jne 0x4388c2
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x70]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x70]
mov ecx, dword [ebp - 0x10]
mov edx, 0xe018ebdb
mov ecx, dword [ebp + ecx*4 - 0x70]
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp + ecx*4 - 0x70], 0xfff9
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x70]
cmp edx, ecx
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, 0x22b60780
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
cmp ecx, 0xe9e5
setle dl
sub edx, 0xdfc1
cmp edx, dword [ebp - 0x10]
jle 0x438942
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4389ed
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x130b
push 0x1e56
push 0x1de3
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor eax, eax
jmp 0x4389ed
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x14], eax
jmp 0x43895f
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x10c], 2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x43894e
cmp dword [ebp - 0x10c], eax
je 0x438980
mov dword [ebp - 0x2c], 0xd41b
mov dword [ebp - 0x14], 0xfffffff6
inc dword [ebp - 0x14]
jmp 0x4389b9
mov dword [ebp - 0x2c], 0xffff
xor edx, edx
mov dword [ebp - 0x14], 0x9cc0f90
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x70]
imul ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp + ecx*4 - 0x70]
sub esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
cmp esi, ecx
setle dl
mov dword [ebp - 8], edx
cmp dword [ebp - 0x10c], eax
je 0x4389c4
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
cmp dword [ebp - 0x10], ecx
je 0x4389e8
mov ecx, eax
cmp dword [ebp - 0x24], eax
je 0x4389ea
mov ecx, edi
mov dword [ebp - 8], ecx
dec dword [ebp - 0x10]
jns 0x43887f
cmp dword [ebp - 0x20], eax
jne 0x438a11
mov esi, dword [ebp - 0x68]
xor edx, edx
mov ecx, dword [ebp - 0x10]
neg esi
cmp ecx, esi
mov ecx, eax
setl dl
cmp edx, dword [ebp - 0x10]
je 0x438a13
mov ecx, edi
cmp dword [ebp - 0x1c], ecx
je 0x438a1f
mov edx, edi
cmp dword [ebp - 0x18], eax
jne 0x438a21
mov edx, eax
xor ecx, ecx
neg edx
cmp edx, 9
setne cl
imul ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x8fb8
add ecx, 0x2e1fdc0
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffd
jne 0x43885e
mov dword [ebp - 0x10], 0xfffffff9
add ebx, 4
mov dword [ebp - 0x14], 0x280643b8
mov dword [ebp - 8], 0xc9dffbe5
mov dword [ebp - 0x18], 0xcbfb41ce
mov dword [ebp - 0x20], 0x8211abd
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x17
cmp dword [ebp - 0x10], 8
mov dword [ebp - 0x1c], ebx
jne 0x438c96
push dword [ebp + 8]
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x88], eax
push ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x84], eax
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x80], eax
push eax
lea ecx, [ebp - 0x88]
movdqu xmmword [ebp - 0x214], xmm0
call fcn.00437a9c
mov dword [ebp - 0x20], 0xb2f67ab
xor eax, eax
mov dword [ebp - 0x20], 0x7d69fdb8
mov dword [ebp - 8], eax
jmp 0x438afc
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1d8], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x438aef
mov dword [ebp - 8], eax
jmp 0x438b14
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x234], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x438b07
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jg 0x438c78
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], 0x25cceb8a
mov dword [ebp - 0x20], 0x2f548f9f
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, 0x717c264f
mov ecx, dword [ebp - 0x88]
setg dl
sub esi, edx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, dword [ecx + edi*4]
mov ecx, dword [ebp - 0x18]
setg dl
xor ebx, ebx
cmp edx, ecx
setg bl
sub ebx, dword [ebp - 0x14]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 7
jge 0x438b94
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], 0xffffffff
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor ecx, ecx
cmp dword [edx + 0xc], eax
mov edx, 0x869b92b2
sete cl
cmp edx, ecx
mov ecx, dword [ebp - 0x88]
sbb esi, esi
xor edx, edx
neg esi
add esi, dword [ecx]
mov ecx, dword [ebp - 0x20]
cmp ecx, esi
setl dl
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x1cc]
dec ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
je 0x438c52
mov dword [ebp - 0x24], 0xc59c
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x18], eax
jmp 0x438c4a
mov ecx, dword [ebp - 0x3c]
inc dword [ebp - 0x24]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp + ecx*4 - 0x1d8]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ecx + edx*4]
xor edx, edx
dec ecx
cmp ecx, esi
mov ecx, dword [ebp - 0x18]
setle dl
mov esi, dword [ebp + ecx*4 - 0x1d8]
imul esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x234]
sub esi, edx
sub esi, 0xd6f46937
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, esi
setg dl
mov dword [ebp - 0x20], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x438bf4
jmp 0x438c68
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x438c68
push 0xe63
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jle 0x438b30
xor edi, edi
inc edi
lea ecx, [ebp - 0x88]
call fcn.00437a2b
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
push 0
pop eax
je 0x438aa3
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebx]
xor esi, esi
mov dword [ebp - 0x18], eax
inc esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], 0x90b1c5ad
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], 0x33a9025b
mov dword [ebp - 0x14], eax
jmp 0x438ccf
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x140], 0x64d9248e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x438cbe
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
setl bl
cmp ebx, dword [ebp - 0x10]
jg 0x438cf7
mov ecx, eax
cmp dword [ebp - 0x10], eax
je 0x438cf9
mov ecx, esi
mov edx, 0xf37d437f
cmp edx, ecx
sbb ecx, ecx
neg ecx
cmp ecx, dword [ebp - 0x10]
je 0x438d11
cmp dword [ebp - 0x140], eax
jne 0x438d13
mov esi, eax
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, esi
mov ecx, dword [ebp - 0x140]
setne dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x140]
setle bl
xor edx, edx
cmp ebx, ecx
setle dl
cmp edx, 0xfffffffd
jl 0x438d42
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0x140]
sete bl
xor edx, edx
imul ebx, ecx
mov ecx, dword [ebp - 0x13c]
cmp ebx, ecx
sete dl
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
sub esi, ecx
mov ecx, dword [ebp - 8]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setg dl
cmp edx, dword [ebp - 8]
jg 0x438da1
cmp dword [ebp - 8], eax
jne 0x438da1
mov esi, eax
jmp 0x438da4
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x2c]
xor edx, edx
cmp esi, ecx
setle dl
xor esi, esi
mov dword [ebp - 0x20], edx
inc esi
mov dword [ebp - 0x10], 0xffffffed
cmp dword [ebp - 0x10], 0x1b
jg 0x438dd5
mov dword [ebp - 0x2c], esi
mov ecx, dword [ebp - 0x20]
sub ecx, 0xddd0
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x10]
jmp 0x438dbb
mov ebx, dword [ebp - 0x1c]
mov ecx, 0xa5d6c05b
mov dword [ebp - 0x168], ecx
add ebx, 4
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 0x10], eax
push 2
mov dword [ebp - 0x1c], ebx
call fcn.00437959
xor eax, eax
mov dword [ebp - 0x18], 0xec3203b
mov dword [ebp - 0x14], eax
jmp 0x438e2c
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1e4]
mov dword [ecx + edx*4], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x438e19
push 3
mov dword [ebp - 0x10], eax
pop edx
jmp 0x438ec9
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 8], eax
jmp 0x438e5d
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x260], 0x415d7249
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x438e4c
mov dword [ebp - 8], eax
jmp 0x438e75
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x7c], 0xd49598aa
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x438e67
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], eax
jl 0x438ec6
mov dword [ebp - 0x2c], 0x6e6f
mov dword [ebp - 0x2c], 0x21f90ef3
mov dword [ebp - 0x2c], 0xfffffffd
dec dword [ebp - 0x7c]
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x438ebe
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + ecx*4 - 0x168]
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x160], edx
mov ecx, dword [ebp - 0x18]
dec dword [ebp - 0x18]
jns 0x438ea2
dec dword [ebp - 0x14]
jns 0x438e82
push 3
pop edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x438e3d
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x438ee6
push 0xe5d
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x1e4]
call fcn.00437a2b
test edi, edi
jne 0x438efb
add ebx, 8
mov dword [ebp - 0x1c], ebx
push 4
lea ecx, [ebp - 0xe8]
call fcn.00437959
mov dword [ebp - 0x10], 9
xor eax, eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], esi
mov dword [ebp - 8], eax
jmp 0x438f30
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xe8]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x438f20
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x4390e2
mov dword [ebp - 8], 0x9a2b441a
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0xe8]
cmp dword [esi + edi*4], ecx
sete dl
xor ebx, ebx
imul ecx, edx, 0x2c57
mov dword [ebp - 8], ecx
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, edx
mov esi, dword [ebp - 0xe8]
setg bl
xor ecx, ecx
neg ebx
cmp dword [esi + edi*4], ebx
mov edi, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp dword [esi + edi*4], ecx
mov edi, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, dword [esi + edi*4]
mov edx, dword [ebp - 0x3c]
setg cl
cmp dword [esi + edx*4], ecx
jl 0x438fdf
mov dword [ebp - 8], eax
jmp 0x438fd4
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0xe8]
mov ecx, dword [edx + ecx*4]
mov dword [edx + esi*4], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jle 0x438fbf
jmp 0x4390d2
mov dword [ebp - 0x14], 0xffffffe7
jmp 0x4390c8
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa6020]
lea ecx, [ebp - 0x244]
push ecx
lea ecx, [ebp - 0x254]
mov dword [ebp - 0xf4], eax
push ecx
push eax
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xf0], eax
movdqu xmmword [ebp - 0x254], xmm0
mov dword [ebp - 0xec], eax
call fcn.00437a9c
mov dword [ebp - 0x2c], 0x50169ff9
xor eax, eax
mov dword [ebp - 8], 3
cmp dword [ebp - 8], eax
jl 0x4390a4
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xf4]
cmp dword [ecx], 1
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, 0xfffffff8
mov ecx, dword [ebp - 0xe8]
setl dl
cmp dword [ecx + esi*4], edx
jne 0x439078
mov dword [ebp - 0x2c], 0x9ca3eaa3
mov dword [ebp - 0x20], 0x877e0698
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ecx
jmp 0x43909f
mov dword [ebp - 0x20], 0x2b00
mov dword [ebp - 0x18], eax
jmp 0x439092
cmp dword [ebp - 0x18], 3
jle 0x439084
dec dword [ebp - 8]
jns 0x43903f
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x4390b7
push 0x1b3e
call dword [sym.imp.USER32.dll_GetKeyboardType]
lea ecx, [ebp - 0xf4]
call fcn.00437a2b
inc dword [ebp - 0x14]
push 0
pop eax
cmp dword [ebp - 0x14], 0xfffffff0
jle 0x438feb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x438f43
lea ecx, [ebp - 0xe8]
call fcn.00437a2b
add ebx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x28]
inc ebx
mov dword [ebp - 0x28], ebx
cmp ebx, dword [ebp - 0x40]
jge 0x439112
xor ebx, ebx
inc ebx
jmp 0x4386a2
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 8], 0x60477862
mov dword [ebp - 0x30], 0xbb5fb49a
mov dword [ebp - 0x14], eax
jmp 0x43913b
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xbc], 0xc62e0897
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x43912a
mov dword [ebp - 8], eax
jmp 0x439151
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jne 0x439157
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xf
je 0x439146
push 3
pop esi
mov dword [ebp - 8], esi
cmp dword [ebp - 8], eax
jl 0x4392bb
mov edi, 0xa4c63829
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], 0x20525c7e
mov dword [ebp - 0x18], eax
jmp 0x4392a9
mov dword [ebp - 0x14], 0xb95ae64
mov dword [ebp - 0x30], 0x97867a7b
mov dword [ebp - 0x1c0], edi
mov dword [ebp - 0x1bc], edi
mov dword [ebp - 0x1b8], edi
mov dword [ebp - 0x1b4], edi
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x439294
mov dword [ebp - 0x10], eax
jmp 0x4391c8
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x90], 0x6febfb2c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x4391b7
dec dword [ebp - 0x8c]
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0xbc]
neg ecx
cmp edx, ecx
jl 0x439261
mov ecx, dword [ebp - 0xbc]
mov esi, dword [ebp - 0x8c]
sub esi, ecx
mov ecx, dword [ebp - 0xb0]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, esi
mov esi, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x18]
setl dl
sub esi, edx
neg esi
mov ecx, dword [ebp + ecx*4 - 0xbc]
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
sete dl
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x14], eax
je 0x43923a
mov ecx, ebx
cmp dword [ebp - 0x90], eax
jne 0x43923c
mov ecx, eax
mov dword [ebp - 0x1b4], ecx
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
je 0x439254
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0xbc]
mov ecx, dword [ebp - 0x14]
mov esi, eax
cmp dword [ebp - 0xb0], eax
je 0x439263
mov esi, ebx
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0xbc]
cmp esi, ecx
setne dl
cmp edx, dword [ebp - 0x18]
jle 0x439283
mov ecx, eax
cmp dword [ebp - 0xb4], eax
je 0x439285
mov ecx, ebx
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x14]
jns 0x4391b2
push 3
pop esi
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4392a6
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x439180
dec dword [ebp - 8]
jns 0x43916b
mov esi, dword [ebp - 0x1c]
mov edi, dword [esi]
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x14], eax
jmp 0x4392f1
mov dword [ebp - 0x28], 0xa8b108f8
inc dword [ebp - 0x28]
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4392ee
push 0x306
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff1
jle 0x4392cc
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x43930a
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
add esi, 4
lea ecx, [ebp - 0x100]
push 3
mov dword [ebp - 0x1c], esi
call fcn.00437959
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x439337
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x100]
mov dword [ecx + edx*4], 0x313dd33a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x439324
mov dword [ebp - 0x10], eax
jmp 0x43934c
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x54], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x439342
mov dword [ebp - 0x10], eax
jmp 0x439368
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x104], 0xe1cc0e42
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x439357
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x439466
mov ebx, dword [ebp - 0x100]
jmp 0x439384
xor eax, eax
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa6020]
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x158], eax
push ecx
push eax
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x154], eax
movdqu xmmword [ebp - 0x244], xmm0
mov dword [ebp - 0x150], eax
call fcn.00437a9c
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x4393db
push eax
push 0x10b1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov ecx, dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
je 0x43941d
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov esi, dword [ebp - 0x48]
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x100]
mov dword [ecx + esi*4], edx
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x100]
cmp dword [ecx + edx*4], eax
je 0x43941d
xor ecx, ecx
inc ecx
jmp 0x43941f
mov ecx, eax
mov dword [ebp - 0x104], ecx
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x439442
push eax
push 0xd01
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x158]
mov dword [ebx + 4], eax
mov dword [ebp - 0x28], eax
call fcn.00437a2b
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 2
jle 0x439382
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x100]
call fcn.00437a2b
mov ebx, dword [esi]
lea ecx, [ebp - 0xdc]
add esi, 4
push 1
mov dword [ebp - 0x1c], esi
call fcn.00437959
mov dword [ebp - 8], 0x184c506d
xor eax, eax
mov dword [ebp - 0x28], 0x91e6
mov dword [ebp - 0x30], 0xe6286c8a
mov dword [ebp - 0x14], eax
jmp 0x4394b5
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xdc]
mov dword [ecx + edx*4], 0xfd54
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x4394a2
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x4394cc
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x439550
mov dword [ebp - 0x40], 0x1b16
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xdc]
mov esi, dword [ecx]
cmp esi, dword [ecx + edx*4]
jg 0x43952e
lea ecx, [esi - 1]
test ecx, ecx
je 0x4394f5
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0xdc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [edx + esi*4]
je 0x439513
cmp dword [ebp - 0x40], eax
je 0x439513
xor esi, esi
inc esi
jmp 0x439515
mov esi, eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ecx + edx*4]
imul ecx, esi
cmp ecx, dword [ebp - 8]
jge 0x43952e
cmp dword [ebp - 0x40], eax
jne 0x439531
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x28]
mov edx, dword [edx + esi*4]
sub edx, ecx
mov dword [ebp - 0x30], edx
dec dword [ebp - 8]
jns 0x4394d4
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0xdc]
call fcn.00437a2b
test ebx, ebx
jne 0x439644
cmp byte [ebp - 0x31], bl
je 0x439577
cmp dword [ebp - 0x38], 1
jne 0x439577
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [esi]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 4]
add esi, 8
push edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], esi
call fcn.0048cff8
mov dword [ebp - 0x38], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x130], eax
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x130]
push eax
push edi
call fcn.00472bc0
mov ebx, dword [ebp - 0xa0]
xor ecx, ecx
mov esi, ecx
test edi, edi
jle 0x439611
mov eax, esi
and eax, 0x80000001
jns 0x4395db
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x30]
add eax, esi
add eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x2c]
jmp 0x4395f0
lea eax, [edx + 1]
cdq
idiv edi
cmp word [ebx + edx*2], cx
jne 0x4395ed
xor eax, eax
inc eax
mov word [ebx + edx*2], ax
mov eax, dword [ebp - 0x1c]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x38]
mov byte [esi + edx], al
inc esi
cmp esi, edi
jl 0x4395cd
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x38]
mov dword [edx], edi
mov dword [edx + 4], eax
test ebx, ebx
je 0x439648
push ebx
call fcn.0048e4e6
pop ecx
xor ecx, ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
mov ebx, dword [ebp + 8]
jmp 0x43964a
xor ecx, ecx
jmp 0x43964a
xor ecx, ecx
jmp 0x43963b
mov ebx, edx
mov dword [ebp + 8], 0xf70ad6f2
inc dword [ebp + 8]
mov byte [ebp + 0xb], cl
je 0x439668
cmp byte [ebp + 0xb], 0
je 0x439675
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x439675
cmp byte [ebp + 0xb], 0
je 0x439675
push ecx
call dword [sym.imp.USER32.dll_CharUpperW]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret