Function at 0x4351d3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x34], ecx
push edi
inc esi
mov byte [ebp - 0x2d], dl
push esi
lea ecx, [ebp - 0xf4]
call fcn.00434e60
xor ebx, ebx
mov dword [ebp - 0xc], ebx
jmp 0x43520e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xf4]
mov dword [eax + ecx*4], 0xa8ea
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x4351fb
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x435229
push ebx
push esi
push 0x1ed8
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x435246
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
lea ecx, [ebp - 0xf4]
call fcn.00434f32
mov dword [ebp - 0xc], 0xfffffffc
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x435268
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0xfffffffffffffff7
mov dword [ebp - 0xc], ebx
pop eax
jmp 0x43527b
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x435281
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x10
jg 0x435270
mov dword [ebp - 0x10], 0x5596960f
mov dword [ebp - 0x14], 0x96a53086
mov dword [ebp - 0x28], 0xf7b1466a
mov dword [ebp - 0x20], 0x7d5b
push 3
mov dword [ebp - 0xc], ebx
pop ecx
cmp dword [ebp - 0xc], ecx
jge 0x4352bd
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa4], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x4352a8
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x43533f
mov dword [ebp - 4], eax
mov ecx, 0xf5ac3d6c
mov dword [ebp - 0x1c], 0x867a7bf7
mov dword [ebp - 0x2c], 0xfda6c2e3
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 4]
sbb ecx, ecx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa4], ecx
cmp ecx, dword [ebp - 0x10]
jle 0x435307
cmp dword [ebp - 0x14], ebx
jne 0x43530a
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x2c], ebx
jne 0x43533c
dec dword [ebp - 0x10]
push 0xfffffffffffffff7
pop eax
jns 0x4352c9
push 3
pop ecx
mov dword [ebp - 0x10], ebx
jmp 0x4353b5
mov dword [ebp - 0xc], ecx
xor ecx, ecx
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, 0x8fbd
mov eax, dword [ebp - 0x10]
setl cl
xor edx, edx
cmp ecx, 0x151d
push 3
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, ecx
mov eax, dword [ebp - 0x9c]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0xa4], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
pop ecx
setg dl
mov dword [ebp - 0x1c], edx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe6
jl 0x435344
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], ebx
jmp 0x4353d4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x58], 0x13b9
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x4353c6
mov dword [ebp - 4], ebx
jmp 0x4353ec
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x3c], 0x8d4081c2
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x4353de
mov edi, dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], ebx
jl 0x43559e
push 3
pop esi
mov dword [ebp - 0x10], 0x751c76d7
mov dword [ebp - 0xc], 0xa7e9f21c
mov dword [ebp - 0x18], 0x1a1f
mov dword [ebp - 4], ebx
jmp 0x435431
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x10c], 0xfff6
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x435420
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x435564
push esi
lea ecx, [ebp - 0x80]
call fcn.00434e60
mov dword [ebp - 0x28], 0x21aa2910
mov dword [ebp - 4], ebx
jmp 0x435464
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x80]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x435457
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
push esi
mov ecx, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x58], ecx
lea eax, [ecx - 0x723d57d6]
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], 0x52bf3388
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
cmp eax, 0x84cb
mov eax, dword [ebp - 0x80]
setle cl
mov dword [eax], ecx
lea ecx, [ebp - 0x8c]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00434e60
mov dword [ebp - 4], ebx
jmp 0x4354ce
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x4354bf
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, 0x9425a33e
setle cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 6
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x8c]
imul edx, dword [eax]
mov eax, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x80]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xffffffff
setle al
xor ecx, ecx
cmp eax, 4
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x8c]
setg cl
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x8c]
setge dl
xor eax, eax
cmp edx, 7
setl al
sub eax, 0x6e4fa679
mov dword [ebp - 0x28], eax
call fcn.00434f32
lea ecx, [ebp - 0x80]
call fcn.00434f32
dec dword [ebp - 0x10]
push 3
pop esi
jns 0x435442
mov dword [ebp - 0x10], ebx
jmp 0x435590
mov dword [ebp - 0x18], ebx
jmp 0x435588
mov dword [ebp - 0xc], ebx
jmp 0x435580
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x43557d
call edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x435573
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x43556e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x435569
dec dword [ebp - 0x3c]
jns 0x435406
mov eax, dword [0x4bd5ec]
lea ecx, [ebp - 0x74]
mov ebx, dword [ebp + 8]
push 2
pop esi
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 4], 0xf0aa6e6f
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], 0x2530a9bc
push esi
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
call fcn.00434e60
mov dword [ebp - 0x14], 0x667120dd
xor eax, eax
mov dword [ebp - 0x10], 0x6a4137d6
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xc2fb
mov dword [ebp - 0x24], 0xa2f725dc
mov dword [ebp - 0xc], eax
jmp 0x435609
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x74]
mov dword [eax + ecx*4], 0x7f4039ee
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x4355f9
mov dword [ebp - 4], 0x91c5
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
sub eax, 5
neg eax
push 6
sbb eax, eax
xor edx, edx
inc eax
imul eax, eax, 0xffff
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 0x74]
setne dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 0x74]
pop eax
sub eax, dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x74]
cmp dword [eax], ecx
je 0x435699
cmp dword [ebp - 0xc], ecx
je 0x435699
xor eax, eax
inc eax
jmp 0x43569b
mov eax, ecx
xor ecx, ecx
cmp eax, 0x747c914a
sete cl
xor edx, edx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
sub ecx, 3
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esi + 4], ecx
lea ecx, [ebp - 0x74]
call fcn.00434f32
mov esi, dword [ebp - 0x28]
xor edx, edx
inc edx
cmp byte [ebp - 0x2d], 0
je 0x43599a
cmp esi, edx
jne 0x43599a
xor edx, edx
mov dword [ebp - 0x14], 0x2a1e9487
mov dword [ebp - 0xc], edx
jmp 0x435701
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4356f0
mov dword [ebp - 0x14], 0x7dd6
xor ecx, ecx
cmp dword [ebp - 0x14], edx
xor eax, eax
inc ecx
cmp ecx, 0xca4f
setg al
mov dword [ebp - 0xc0], eax
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x43572f
call edi
push 2
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0xdc]
pop edi
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x20], 0xfea1e173
mov dword [ebp - 0x20], 0xaf09d89c
push edi
mov dword [ebx + 8], 4
call fcn.00434e60
xor edx, edx
mov dword [ebp - 0x20], 0x53c4a2fb
mov dword [ebp - 4], edx
jmp 0x43577c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x114], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x43576f
mov dword [ebp - 4], edx
jmp 0x435799
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], 0x8d7ebc4
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x435786
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x4357b5
push edx
push edx
push 0x1432
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor edx, edx
cmp dword [ebp - 0x10], edx
je 0x4357e3
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x435985
push 0x16a9
push 0x11eb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x435985
mov dword [ebp - 0x2c], 0xe46c2e7c
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x38], 0x1af6658d
push edi
call fcn.00434e60
mov dword [ebp - 0x24], 0xa1d1
mov dword [ebp - 0x24], edi
xor edi, edi
mov dword [ebp - 0x24], 0x5d742cc3
inc edi
mov dword [ebp - 0x24], 0xfffffff8
xor edx, edx
mov dword [ebp - 0x24], 0x4f9f0102
mov dword [ebp - 0x24], 0x376a9523
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x24], 0x1b934971
mov dword [ebp - 0x24], 0x1029358d
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edx
jmp 0x435866
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], 0x7d8169b4
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x435853
mov dword [ebp - 4], edx
jmp 0x435882
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe8], 0xe75688af
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x435871
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0xb
jne 0x435925
push 3
xor ebx, ebx
pop esi
mov dword [ebp - 0xc], ebx
xor ecx, ecx
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x2c]
cmp eax, 0xfffffff7
setl cl
cmp ecx, 0xee1c9741
sbb eax, eax
xor edx, edx
neg eax
test eax, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 4], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
cmp eax, 0x7b36
setle cl
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
je 0x435899
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
inc dword [ebp - 0x18]
cmp edx, eax
jne 0x435948
mov ecx, edi
xor edx, edx
jmp 0x43594c
xor edx, edx
mov ecx, edx
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
imul eax, ecx
test eax, eax
je 0x435962
mov eax, edi
cmp dword [ebp - 0x20], edx
jne 0x435964
mov eax, edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x7520
jle 0x435973
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x20], 9
call fcn.00434f32
lea ecx, [ebp - 0xdc]
call fcn.00434f32
xor edx, edx
mov dword [ebx + 0xc], 0x4bd5ec
inc edx
mov dword [ebp - 0xc], 0xfff8
xor ecx, ecx
mov dword [ebp - 0x14], 8
push 3
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
pop edi
jmp 0x4359bf
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x54], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x4359b5
mov dword [ebp - 4], ecx
jmp 0x4359da
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x100], 0xb6454879
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x4359c9
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xc], edx
jge 0x4359f3
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp eax, 4
push 0xfffffffffffffff7
setne cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
neg ecx
pop eax
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
sbb edx, edx
neg edx
sub edx, 0xfffffffd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0xc]
setge cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
sub eax, 0x9ebe
jne 0x435a51
cmp dword [ebp - 0x4c], eax
je 0x435a54
xor eax, eax
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0x34], esi
jge 0x4363b9
push 3
pop esi
push esi
lea ecx, [ebp - 0x64]
mov edi, 0x4bd5f0
call fcn.00434e60
mov dword [ebp - 0x10], 0x46db5052
xor ebx, ebx
mov dword [ebp - 0x14], 0x57511ecb
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], esi
jge 0x435aa0
push 0xfffffffffffffff7
pop edx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x64]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x435a8f
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x435c8c
mov dword [ebp - 4], 7
xor edx, edx
mov dword [ebp - 0xc], 0xfffffffa
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x10]
je 0x435af7
cmp dword [ebp - 4], ebx
je 0x435af7
xor esi, esi
inc esi
mov ecx, esi
jmp 0x435afc
xor esi, esi
mov ecx, ebx
inc esi
xor eax, eax
cmp ecx, 0xa5b0
setne al
cmp eax, dword [ebp - 4]
jge 0x435b13
mov edx, esi
cmp dword [ebp - 4], ebx
jne 0x435b15
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, 0x2e5f
setl cl
cmp ecx, dword [ebp - 0x10]
je 0x435b3b
mov edx, ebx
cmp dword [ebp - 0x14], ebx
je 0x435b3d
mov edx, esi
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x64]
mov esi, dword [ebp - 0x64]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x10]
imul ecx, edx
xor edx, edx
mov dword [esi + edi*4], eax
mov eax, dword [ebp - 4]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + edi*4]
setl dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
setne dl
xor ebx, ebx
imul edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp edx, eax
setg bl
sub ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
neg ebx
sbb ebx, ebx
add ebx, 0x47578159
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setge cl
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
neg eax
sbb eax, eax
xor ebx, ebx
add eax, 0xfffffffa
cmp eax, dword [ebp - 0x10]
je 0x435bbe
mov eax, dword [ebp - 0x64]
cmp dword [eax + 8], ebx
je 0x435bbe
xor edi, edi
inc edi
mov ecx, edi
jmp 0x435bc3
xor edi, edi
mov ecx, ebx
inc edi
xor eax, eax
cmp ecx, 0xf15e
setle al
imul eax, dword [ebp - 0x10]
test eax, eax
je 0x435bec
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x435c68
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x435c68
mov dword [ebp - 0x1c], 0xf1fc5bff
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax + ecx*4]
imul ecx, dword [eax + edx*4]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, edi
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x64]
setg cl
mov dword [eax + esi*4], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xc]
test eax, eax
setle cl
cmp ecx, 0x12777fc3
jl 0x435c39
mov ecx, edi
cmp dword [ebp - 0x1c], ebx
jne 0x435c3b
mov ecx, ebx
mov eax, dword [ebp - 0xc]
sub ecx, eax
inc ecx
cmp ecx, dword [ebp - 0xc]
jg 0x435c4d
mov eax, edi
cmp dword [ebp - 4], ebx
jne 0x435c4f
mov eax, ebx
mov dword [ebp - 0xc], eax
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x435c68
push ebx
push 0xf56
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x435c7e
push 0xa7b
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
dec dword [ebp - 0x10]
jns 0x435ab0
mov edi, 0x4bd5f0
lea ecx, [ebp - 0x64]
call fcn.00434f32
mov ebx, dword [ebp - 0x34]
test ebx, ebx
jle 0x43603a
xor esi, esi
lea ecx, [ebp - 0x48]
inc esi
push esi
call fcn.00434e60
mov dword [ebp - 0x18], 0xe4b28306
xor edx, edx
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x14], 6
mov dword [ebp - 0xc], 0x2715ee56
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x10], 0x7bde5156
mov dword [ebp - 0x1c], 0xddd0c6a3
mov dword [ebp - 4], edx
jmp 0x435cef
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x48]
mov dword [eax + ecx*4], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x435ce3
push 3
mov dword [ebp - 4], edx
pop ecx
jmp 0x435d0d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xbc], 0x3de467b4
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x435cfc
mov eax, dword [ebp - 0x48]
cmp dword [eax], edx
jne 0x435dca
mov eax, dword [ebp - 0xc]
xor ecx, ecx
test eax, eax
setns cl
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], 0x6a955fa9
mov ecx, dword [ebp - 0xb4]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
inc dword [ebp - 0xb4]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
mov ecx, esi
cmovle ecx, edx
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x48]
sub edx, 0x1f08
cmp edx, dword [eax]
setg cl
cmp ecx, 0xfff6
je 0x435d7f
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x435d81
mov edx, esi
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
sub ecx, eax
sub ecx, 0x870b
je 0x435da1
mov ecx, esi
cmp dword [ebp - 0x18], edx
jne 0x435da3
mov ecx, edx
mov eax, dword [ebp - 0x10]
add eax, ecx
cmp eax, 0xfffffff6
jne 0x435db4
mov eax, edx
cmp dword [ebp - 0x14], edx
je 0x435db6
mov eax, esi
mov ecx, 0xfffc
cmp ecx, eax
mov eax, dword [ebp - 0x48]
sbb ecx, ecx
neg ecx
cmp ecx, dword [eax]
mov eax, edx
jne 0x435dcc
mov eax, esi
xor ecx, ecx
mov dword [ebp - 0x18], 0xa810
test eax, eax
setne cl
xor eax, eax
cmp ecx, 0x1f84
setle al
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setle cl
xor edx, edx
cmp ecx, dword [eax]
jl 0x435e0f
mov ecx, edx
cmp dword [ebp - 0x14], edx
je 0x435e11
mov ecx, esi
mov eax, dword [ebp - 0x10]
imul eax, ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0xc], edx
je 0x435e26
mov eax, esi
cmp dword [ebp - 0x1c], edx
jne 0x435e28
mov eax, edx
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x48]
call fcn.00434f32
mov esi, dword [edi]
xor eax, eax
mov dword [ebp - 0xc], 0xfffffffc
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x435e50
push eax
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x10
jle 0x435e6d
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jne 0x435e6d
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x10
jg 0x435e5c
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x20], 0xfe7d8a87
mov dword [ebp - 0x20], 0xffffffff
push 2
call fcn.00434e60
xor edx, edx
inc edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], 0
jmp 0x435eac
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xb0]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x435e9d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x20], 0xab60e704
mov eax, dword [ebp - 0x38]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
setg dl
mov dword [eax + 4], edx
call fcn.00434f32
mov edx, dword [edi + 4]
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], 0x7858f9c2
mov dword [ebp - 0x20], 0xb4af
mov dword [ebp - 0xc], ecx
jmp 0x435f09
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x120], 0xfff9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x435ef8
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 2
jg 0x435f74
xor ebx, ebx
mov dword [ebp - 4], 0x5ce96b77
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jne 0x435f41
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], ebx
jne 0x435f4a
mov eax, ebx
jmp 0x435f4d
xor eax, eax
inc eax
cmp eax, dword [ebp - 4]
je 0x435f55
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
setle cl
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x435f1a
mov ebx, dword [ebp - 0x34]
xor ecx, ecx
add edi, 8
test edx, edx
jne 0x435f7e
add edi, 8
xor edx, edx
inc edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], 0x8c66
mov dword [ebp - 0x1c], 0xfe23a266
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x14], 0x7fa3dfad
mov dword [ebp - 0x20], 0x9ee491ba
mov dword [ebp - 0x20], 0xd8284a89
mov dword [ebp - 0xc], ecx
jmp 0x435fc0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x12c], 0x6ef3b063
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x435faf
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
je 0x435fd5
mov eax, edx
cmp dword [ebp - 0x2c], ecx
jne 0x435fd7
mov eax, ecx
cmp eax, dword [ebp - 0x1c]
jne 0x435fe1
cmp dword [ebp - 0x14], ecx
jne 0x435fe3
mov edx, ecx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, edx
setle cl
sub ecx, 0x946b43d2
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
je 0x436006
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x43602e
push 0xf7b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
add edi, esi
dec ebx
mov dword [ebp - 0x34], ebx
jne 0x435c9f
push 0xfffffffffffffff7
mov dword [ebp - 4], 3
pop eax
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 4], eax
jmp 0x4360be
mov dword [ebp - 0xc], 4
mov dword [ebp - 0xc], 0xffffffe5
jmp 0x4360a8
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x18], 0x12
cmp dword [ebp - 0x18], 0xffffffe7
je 0x4360a5
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x43609c
push 0x371
push 0xb96
push 0x1748
push 0x485
push eax
call dword [sym.imp.USER32.dll_SetRect]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe7
jne 0x436076
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x18
je 0x436060
mov eax, dword [ebp - 0xc]
xor ecx, ecx
test eax, eax
setg cl
mov dword [ebp - 0x20], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1d
jle 0x436050
mov esi, dword [edi]
xor ebx, ebx
mov dword [ebp - 0x20], 0x1a049fe3
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x4360de
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x4360f3
push ebx
push 0xc72
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov eax, dword [edi + 4]
xor edx, edx
mov dword [ebp - 4], 0x86bd
inc edx
mov dword [ebp - 0x18], 0x512a30a
xor ecx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 4]
cmp eax, edx
mov eax, dword [ebp - 4]
mov edx, 0x82f4f5cb
setle cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 4]
setge cl
xor edx, edx
imul ecx, ecx, 0x13b2
cmp ecx, eax
mov eax, dword [ebp - 4]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x18], ecx
inc edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0x4251b064
je 0x43617e
mov dword [ebp - 0x10], ebx
jmp 0x4361ef
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 0x54c3ebe1
mov dword [ebp - 0x20], 0x79a27342
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x4361b0
mov eax, edx
cmp dword [ebp - 0xc], ebx
jne 0x4361b2
mov eax, ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], ebx
je 0x4361bf
cmp dword [ebp - 4], ebx
jne 0x4361c6
mov ecx, ebx
cmp dword [ebp - 0x10], ebx
je 0x4361c8
mov ecx, edx
mov eax, dword [ebp - 0x10]
sub ecx, eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
neg ecx
push 3
sbb ecx, ecx
neg ecx
sub ecx, eax
add ecx, dword [ebp - 0x10]
pop eax
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov ecx, 0xe4a839bb
sub ecx, eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 4]
jg 0x436211
cmp dword [ebp - 0xc], ebx
jne 0x436211
mov edx, ebx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, dword [ebp - 4]
setne cl
xor ebx, ebx
cmp ecx, 0x236b
setl bl
sub ebx, 0x535b5b06
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, 0x7fcf
xor ebx, ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0xc], 0xc03342eb
mov dword [ebp - 0x20], 7
mov dword [ebp - 0xc], ebx
jmp 0x4362dc
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x14], ebx
jmp 0x436282
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe4], 0x3b1a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x436271
mov dword [ebp - 0x14], ebx
jmp 0x4362ac
cmp byte [ebp - 5], bl
je 0x4362a0
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0x20], ebx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe9
mov byte [ebp - 5], bl
jg 0x43628d
cmp byte [ebp - 5], bl
je 0x4362d9
push ebx
push 0x15b7
push 0x539
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffe
jge 0x436265
cmp dword [ebp - 0x2c], ebx
jne 0x4363b6
cmp byte [ebp - 0x2d], bl
je 0x4362ff
cmp dword [ebp - 0x28], 1
jne 0x4362ff
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edi + 0xc]
add edi, 0x10
push esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], edi
call fcn.004964a8
pop ecx
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x98]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], ebx
push eax
push esi
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
call fcn.00472b5d
mov edi, dword [ebp - 0x98]
mov ecx, ebx
test esi, esi
jle 0x43639e
mov ebx, dword [ebp - 0x1c]
mov eax, ecx
and eax, 0x80000001
jns 0x43635d
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x20]
add eax, ecx
add eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x38]
cdq
idiv esi
xor eax, eax
cmp word [edi + edx*2], ax
je 0x436389
xor ebx, ebx
lea eax, [edx + 1]
cdq
idiv esi
cmp word [edi + edx*2], bx
jne 0x43637a
mov ebx, dword [ebp - 0x1c]
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov al, byte [edx + ebx]
mov edx, dword [ebp - 0x2c]
mov byte [ecx + edx], al
inc ecx
cmp ecx, esi
jl 0x43634f
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
mov dword [ebx], esi
mov dword [ebx + 4], eax
test edi, edi
je 0x4363b9
push edi
call fcn.00497996
pop ecx
jmp 0x4363b9
mov ebx, dword [ebp + 8]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret