Function at 0x42b173
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
push ebx
push esi
push edi
xor eax, eax
mov byte [ebp - 0x31], dl
push 3
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], eax
pop esi
jmp 0x42b1a3
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1c8], 0xffff
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42b192
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42b1cb
push 0x112f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
xor eax, eax
push 2
pop edi
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x42b1f7
mov dword [ebp - 8], 7
mov dword [ebp - 8], edi
cmp dword [ebp - 8], eax
jl 0x42b1f2
cmp dword [ebp - 0x1c8], eax
jne 0x42b1f2
dec dword [ebp - 8]
jns 0x42b1e5
dec dword [ebp - 0x18]
jns 0x42b1d6
mov dword [ebp - 0x28], 0x399841b3
mov dword [ebp - 0x30], 0x4f16efa4
mov dword [ebp - 8], 0xb69b2e41
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 8], 0xa6ff609
mov dword [ebp - 0x28], 0xffffffe8
cmp dword [ebp - 0x28], 0xffffffe7
push 1
pop ebx
jle 0x42b29c
mov dword [ebp - 0x18], 0x865b49d5
xor edx, edx
mov dword [ebp - 0x24], 0x7e434392
mov esi, ebx
mov ecx, dword [ebp - 0x30]
cmp ecx, 0x4837182a
setge dl
cmp edx, 0xf9acf257
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], eax
jne 0x42b264
mov esi, eax
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp esi, ecx
sete dl
xor ecx, ecx
cmp edx, 0x29ed890f
setl cl
sub ecx, dword [ebp - 0x28]
jne 0x42b285
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x42b287
mov edx, ebx
mov ecx, dword [ebp - 0x24]
imul ecx, edx
mov dword [ebp - 8], ecx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe7
jg 0x42b22a
push 3
pop esi
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x124]
push edi
call fcn.0042ae00
xor eax, eax
mov dword [ebp - 0x1c], 0xcdb8faaa
mov dword [ebp - 8], eax
jmp 0x42b2c9
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x124]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x42b2b9
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x124]
mov dword [ecx + 4], edx
cmp dword [ecx], eax
je 0x42b2f6
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42b2f9
push eax
push eax
push 0x2240
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x42b2f9
mov dword [ebp - 0x1c], edx
lea ecx, [ebp - 0x124]
call fcn.0042aed2
push esi
lea ecx, [ebp - 0x130]
call fcn.0042ae00
mov dword [ebp - 0x18], 0x256915a1
xor eax, eax
mov dword [ebp - 0x20], 0xa57b
mov dword [ebp - 8], eax
jmp 0x42b335
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x130]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42b325
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x42b37d
mov dword [ebp - 8], 0xbf5cd53b
mov dword [ebp - 8], eax
jmp 0x42b373
mov dword [ebp - 0x24], 0x51328f6c
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], eax
jl 0x42b370
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x130]
cmp dword [ecx + edx*4], eax
jne 0x42b370
dec dword [ebp - 0x24]
jns 0x42b35d
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x42b34e
dec dword [ebp - 0x18]
jns 0x42b342
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42b38c
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea ecx, [ebp - 0x130]
call fcn.0042aed2
mov edi, dword [0x4a15ec]
xor eax, eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x1c], 0x9118158f
mov dword [ebp - 0x1c], 0x11e75876
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], 0xc894628a
mov dword [ebp - 0x20], 0x16845925
mov dword [ebp - 0x30], edi
mov dword [ebp - 8], eax
jmp 0x42b3e8
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x14c], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x42b3d7
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xb80b
setle dl
imul edx, dword [ebp - 0x14]
test edx, edx
jne 0x42b40d
mov ecx, dword [ebp - 0x14]
imul edx, dword [ebp - 0x14], 0x1860
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
setge bl
xor ecx, ecx
cmp ebx, 0x8c
setl cl
xor esi, esi
inc esi
cmp esi, ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [ebp - 0x148], ecx
mov ecx, dword [ebp - 0x148]
mov dword [ebp - 0x14c], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
setg bl
xor ecx, ecx
sub ebx, dword [ebp - 0x14]
imul ebx, dword [ebp - 0x14]
cmp ebx, esi
setle cl
xor ebx, ebx
cmp ecx, 0x7aa29676
setne bl
xor edx, edx
sub ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
cmp ebx, ecx
setne dl
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov esi, dword [ebp - 0x1c]
sub esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
sub esi, 0xe26a
neg esi
sbb esi, esi
xor edx, edx
add esi, 0x55069098
cmp esi, ecx
setl dl
xor ebx, ebx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
cmp edx, ecx
setg bl
xor edx, edx
imul ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
cmp ebx, ecx
mov ebx, dword [ebp + 8]
setg dl
mov dword [ebp - 0x1c], edx
xor edx, edx
mov dword [ebp - 0x18], 0xf6af1124
inc edx
mov dword [ebp - 0x20], 0xa75c19c5
mov dword [ebp - 0x20], 0xd3f46721
mov dword [ebp - 0x20], 0xa72c25fc
mov dword [ebp - 0x20], 0x2e1dfe00
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], 0x4e703026
mov dword [ebp - 0x20], 9
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x20], 0xa32fd2d1
mov ecx, 0xc38ec326
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x1c], 0xfc2e
mov dword [ebp - 0x18], 0xa
jmp 0x42b587
mov dword [ebp - 8], eax
jmp 0x42b576
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x9c], 0xfffffff6
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x42b565
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x9c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x13
jl 0x42b560
cmp byte [ebp - 0x31], al
je 0x42b729
cmp edi, edx
jne 0x42b729
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 8], eax
jmp 0x42b5bb
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xf4], 0xfffffff8
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x42b5aa
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x19
jl 0x42b600
mov dword [ebp - 0x1c], 0xddd1
mov dword [ebp - 0xf0], 0x13638ecf
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
dec esi
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setge dl
mov dword [ebp - 0xf0], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x19
jge 0x42b5ca
xor edx, edx
inc edx
mov dword [ebp - 0x10], eax
xor esi, esi
cmp dword [ebp - 0x10], edx
jg 0x42b698
mov eax, 0x31c587c7
mov dword [ebp - 0x20], 0xf4981ff2
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x20], 0x2ba7b7e8
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
push edx
call fcn.0042ae00
xor edx, edx
mov dword [ebp - 0x1c], 0x209c
mov dword [ebp - 8], esi
inc edx
jmp 0x42b671
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x170]
mov dword [eax + ecx*4], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x42b662
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x170]
call fcn.0042aed2
inc dword [ebp - 0x10]
xor edx, edx
inc edx
mov eax, 0x31c587c7
cmp dword [ebp - 0x10], edx
jle 0x42b613
mov dword [ebp - 0x20], 0xfffffff9
lea ecx, [ebp - 0x17c]
push edx
mov dword [ebx + 8], 4
call fcn.0042ae00
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x20], 0x9f42c60e
push 2
call fcn.0042ae00
xor edx, edx
mov dword [ebp - 0x10], esi
inc edx
jmp 0x42b6e0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x17c]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x42b6d1
mov dword [ebp - 0x10], esi
jmp 0x42b6f9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x42b6ea
mov eax, dword [ebp - 0x100]
lea ecx, [ebp - 0x100]
dec dword [eax]
call fcn.0042aed2
lea ecx, [ebp - 0x17c]
call fcn.0042aed2
xor edx, edx
mov dword [ebx + 0xc], 0x4a15ec
xor eax, eax
inc edx
push dword [ebp + 8]
movdqa xmm0, xmmword [0xa93870]
lea ecx, [ebp - 0x17c]
mov dword [ebp - 0x10], 0xe1757117
push ecx
mov dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 0x18c]
mov dword [ebp - 0x1c], 0xc694a61b
mov dword [ebp - 0x1c], 0xd6a56c37
push ecx
mov dword [ebp - 0x20], 0xffffffff
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], eax
push eax
movdqu xmmword [ebp - 0x18c], xmm0
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
call fcn.0042af43
xor esi, esi
mov dword [ebp - 0x18], 0x7af9ca3
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], 0xfffffff8
jne 0x42b843
xor edi, edi
inc edi
mov dword [ebp - 0x1c], 0x1f09a2b4
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x20], esi
mov dword [ebp - 8], esi
jmp 0x42b7d1
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x164], 0xfffffff7
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x42b7c0
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x15c]
cmp eax, ecx
mov eax, dword [ebp - 0x15c]
setge dl
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 8]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setle dl
mov dword [ebp - 0x1c], edx
inc dword [ebp - 0x18]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff8
je 0x42b7aa
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0xbc]
call fcn.0042aed2
mov ebx, dword [ebp - 0x2c]
cmp ebx, edi
jge 0x42c1cb
push dword [ebp + 8]
movdqa xmm0, xmmword [0xa93850]
lea ecx, [ebp - 0xe0]
xor eax, eax
mov dword [ebp - 0xe0], esi
inc eax
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0x18], eax
mov edi, 0x4a15f0
lea eax, [ebp - 0x18c]
mov dword [ebp - 0xd8], esi
push eax
lea eax, [ebp - 0x19c]
push eax
push esi
movdqu xmmword [ebp - 0x19c], xmm0
call fcn.0042af43
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1c
jge 0x42b927
xor ebx, ebx
inc ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 8], eax
jmp 0x42b8c7
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x5c], 0x876942a1
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x42b8b9
mov dword [ebp - 0x58], 3
cmp dword [ebp - 0x58], eax
jl 0x42b91b
xor esi, esi
push ebx
lea ecx, [ebp - 0x118]
call fcn.0042ae00
mov dword [ebp - 8], esi
jmp 0x42b8fc
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x118]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x42b8ec
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x118]
inc dword [eax]
call fcn.0042aed2
dec dword [ebp - 0x58]
jns 0x42b8db
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1c
jl 0x42b8b1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42b937
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0xe0]
call fcn.0042aed2
test ebx, ebx
jle 0x42bcc2
xor esi, esi
inc esi
mov dword [ebp - 8], 0xfffffff9
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0x7c8b166c
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x28], 0x32e26595
push esi
call fcn.0042ae00
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x10], esi
inc ecx
jmp 0x42b990
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3c], 0x7d21
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x42b982
mov dword [ebp - 0x10], esi
xor esi, esi
inc esi
jmp 0x42b9ac
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x42b99d
dec dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
sub ecx, 0xfffffffa
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 8], ecx
xor ecx, ecx
mov eax, dword [ebp - 8]
inc eax
imul eax, dword [ebp - 0x18]
cmp eax, 0x5b04
mov eax, dword [ebp - 0x10c]
setne cl
mov dword [eax], ecx
lea ecx, [ebp - 0x10c]
call fcn.0042aed2
mov ebx, dword [edi]
lea ecx, [ebp - 0x80]
push esi
mov dword [ebp - 0x20], ebx
call fcn.0042ae00
mov dword [ebp - 8], 0x86aeba4d
xor eax, eax
mov dword [ebp - 0x1c], 0x5467
mov dword [ebp - 0x18], 0xdd61fb9a
mov dword [ebp - 0x14], eax
jmp 0x42ba3a
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x80]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x42ba2d
mov dword [ebp - 0x14], eax
jmp 0x42ba51
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xb0], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x42ba44
mov dword [ebp - 0x14], eax
jmp 0x42ba69
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xa0], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x42ba5c
mov dword [ebp - 0xa8], eax
jmp 0x42ba88
mov edx, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x80]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], esi
jl 0x42ba76
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp eax, esi
setle cl
mov dword [ebp - 8], ecx
xor ecx, ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x80]
cmp dword [eax], esi
setl cl
mov dword [ebp - 0xa0], ecx
lea ecx, [ebp - 0x80]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
call fcn.0042aed2
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x74]
push dword [ebp + 8]
movdqa xmm0, xmmword [0xa93840]
xor esi, esi
mov dword [ebp - 0x14], eax
add edi, 8
lea eax, [ebp - 0x1ac]
mov dword [ebp - 0x74], esi
push eax
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x70], esi
push eax
push esi
movdqu xmmword [ebp - 0x1bc], xmm0
mov dword [ebp - 0x6c], esi
call fcn.0042af43
mov edx, dword [ebp - 0x74]
xor eax, eax
mov dword [ebp - 0x28], 0x90a624cd
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x18], 0xffffffff
cmp dword [edx + 8], eax
je 0x42bb29
cmp dword [edx], eax
je 0x42bb29
inc esi
mov ecx, esi
jmp 0x42bb2e
xor esi, esi
mov ecx, eax
inc esi
mov dword [edx + 8], ecx
mov dword [ebp - 0x28], 0x12
cmp dword [ebp - 0x28], 5
jge 0x42bc60
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x24], 0xb839bf5b
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42bb71
push 0x2120
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x42bc50
push esi
lea ecx, [ebp - 0xd4]
call fcn.0042ae00
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x42bba4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + edx*4], 0xfffffff6
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42bb91
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xd4]
cmp dword [ecx], eax
mov ecx, dword [ebp - 0x74]
setge dl
xor ebx, ebx
cmp edx, dword [ecx]
mov ecx, dword [ebp - 0x1c]
setg bl
sub ebx, ecx
je 0x42bbd8
cmp dword [ebp - 0x10], eax
je 0x42bbd8
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xd4]
cmp dword [ecx], 0xffffffff
sbb ecx, ecx
neg ecx
add ecx, 0x6c7b90da
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], eax
jmp 0x42bc31
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42bc2e
push 0x6a3
push eax
push 0x12c1
push 0x2281
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x42bbff
lea ecx, [ebp - 0xd4]
call fcn.0042aed2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x42bb7e
xor eax, eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 5
jl 0x42bb42
mov ebx, dword [ebp - 0x20]
lea ecx, [ebp - 0x74]
call fcn.0042aed2
cmp dword [ebp - 0x14], 0
jne 0x42bc71
add edi, 8
xor eax, eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42bc93
push eax
push eax
push 0x208f
push 0x1872
push eax
call dword [sym.imp.USER32.dll_ModifyMenuW]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42bcb7
push eax
push 0x1fc6
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
add edi, ebx
dec dword [ebp - 0x2c]
jne 0x42b94d
mov ebx, dword [edi]
xor eax, eax
mov dword [ebp - 0x10], 0x6af1124f
mov dword [ebp - 0x1c], 0x2e1dfe00
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x18], 0x665969a2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x17
mov dword [ebp - 8], ebx
jle 0x42be3f
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x14], 0xc326874b
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x18], eax
jmp 0x42bd1d
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x38], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x42bd0f
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
dec ecx
mov dword [ebp - 0x1c], ecx
je 0x42bd35
mov esi, ebx
cmp dword [ebp - 0x24], eax
jne 0x42bd37
mov esi, eax
imul ecx, dword [ebp - 0x2c], 0x7367
xor ebx, ebx
cmp ecx, 0x14f98caf
mov ecx, dword [ebp - 0x24]
setl bl
xor edx, edx
cmp ebx, ecx
setle dl
add edx, esi
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x28], eax
jne 0x42bdc9
cmp dword [ebp - 0x18], eax
je 0x42bdc6
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
sub esi, 0x61302d9c
neg esi
sbb esi, esi
add esi, 0xa8f777f4
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov ecx, dword [ebp - 0x14]
setle dl
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 0x24]
setg bl
xor edx, edx
cmp ebx, ecx
setg dl
imul edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x18]
jge 0x42bdb0
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
je 0x42bdbb
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x2c], ecx
jl 0x42bdc9
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x10], eax
jne 0x42bdda
cmp dword [ebp - 0x24], eax
jne 0x42bdda
mov esi, eax
jmp 0x42bddd
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp esi, ecx
setne dl
xor ebx, ebx
imul edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edx, ecx
setl bl
sub ebx, dword [ebp - 0x28]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x38], ebx
jne 0x42be08
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
cmp dword [ebp - 0x28], 0xfff7
je 0x42be5d
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42be2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor eax, eax
xor ebx, ebx
inc ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x17
jg 0x42bcf5
mov ebx, dword [ebp - 8]
push 2
lea ecx, [ebp - 0x158]
call fcn.0042ae00
xor eax, eax
mov dword [ebp - 0x2c], 0x667a876e
mov dword [ebp - 0x18], eax
jmp 0x42bf48
xor ebx, ebx
mov dword [ebp - 0x18], 0xfe49
mov dword [ebp - 0x14], eax
inc ebx
jmp 0x42be7d
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x98], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x42be6c
mov dword [ebp - 0x14], eax
jmp 0x42bebf
mov dword [ebp - 0x20], 0x348f6f7e
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42bea7
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x42beb3
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x42beb5
mov edx, ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x38], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x42be87
cmp dword [ebp - 0x38], eax
je 0x42bef8
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
neg ecx
imul ecx, ecx, 0x75ae
sub edx, ecx
jne 0x42bee5
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov esi, ebx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x2c], ecx
jg 0x42befa
mov esi, eax
neg esi
sub esi, 0xfb0f
neg esi
sbb esi, esi
xor edx, edx
inc esi
mov dword [ebp - 0x98], esi
mov ecx, dword [ebp - 0x18]
cmp esi, ecx
setne dl
xor ecx, ecx
cmp edx, 0xbda1
setne cl
sub ecx, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], ecx
jmp 0x42be2f
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x158]
mov dword [ecx + edx*4], 0xdf99ff60
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x42bf35
xor esi, esi
inc esi
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
jl 0x42bf76
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42bf71
push eax
push 0x12fe
push eax
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x42bf59
lea ecx, [ebp - 0x158]
call fcn.0042aed2
mov eax, dword [edi + 4]
mov dword [ebp - 0x20], 0x85299dad
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0xaeb9
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0x12
cmp dword [ebp - 0x18], 0xfffffff2
jl 0x42c012
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x42c012
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42c009
push 0x14c3
push 0x920
push eax
push eax
push 0xb98
push 0x25c3
push 0x1bb4
push 0x1532
push 0x2032
push 0x11b6
push 0xd37
push 0x1c09
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff2
jge 0x42bfb1
add edi, 8
mov dword [ebp - 0x1c], 0xffffffff
push 4
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0x2c], edi
call fcn.0042ae00
push 2
lea ecx, [ebp - 0xec]
call fcn.0042ae00
xor eax, eax
mov dword [ebp - 0x20], 0xf3d4
mov dword [ebp - 0x10], eax
jmp 0x42c05a
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc8]
mov dword [ecx + edx*4], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x42c047
mov dword [ebp - 0x10], eax
jmp 0x42c078
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xec]
mov dword [ecx + edx*4], 0xc12265e3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x42c065
mov ecx, dword [ebp - 0xc8]
mov edi, dword [ecx]
cmp dword [ebp - 0x1c], edi
jge 0x42c098
mov ecx, dword [ebp - 0xc8]
cmp dword [ecx + 4], eax
jne 0x42c098
mov esi, eax
mov ecx, dword [ebp - 0xec]
xor edx, edx
cmp dword [ecx], esi
sete dl
xor ecx, ecx
cmp edi, edx
sete cl
sub ecx, 0x2efdd87e
cmp ecx, 0xf72b5725
mov ecx, dword [ebp - 0x1c]
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, esi
setge dl
cmp edx, 0x665683c8
jl 0x42c0df
mov ecx, dword [ebp - 0xec]
cmp dword [ecx + 4], eax
je 0x42c0df
xor esi, esi
inc esi
mov eax, esi
jmp 0x42c0e2
xor esi, esi
inc esi
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x1c], eax
call fcn.0042aed2
lea ecx, [ebp - 0xc8]
call fcn.0042aed2
cmp dword [ebp - 0x24], 0
jne 0x42c1cb
cmp byte [ebp - 0x31], 0
je 0x42c119
cmp dword [ebp - 0x30], esi
jne 0x42c119
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x10]
add dword [ecx + 8], eax
mov ecx, dword [ebp - 0x2c]
push ebx
mov eax, dword [ecx]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 4]
add ecx, 8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
call fcn.00479e43
mov edi, dword [ebp - 8]
mov ebx, eax
xor eax, eax
pop ecx
mov dword [ebp - 0x84], eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.0045e624
xor esi, esi
test edi, edi
mov edi, dword [ebp - 0x54]
mov ecx, esi
jle 0x42c1ac
mov eax, ecx
and eax, 0x80000001
jns 0x42c173
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x20]
add eax, ecx
add eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x30]
jmp 0x42c188
lea eax, [edx + 1]
cdq
idiv dword [ebp - 8]
cmp word [edi + edx*2], si
jne 0x42c185
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov eax, dword [ebp - 0x2c]
mov al, byte [edx + eax]
mov byte [ecx + ebx], al
inc ecx
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x42c165
jmp 0x42c1af
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], ebx
test edi, edi
je 0x42c1cb
push edi
call fcn.0047b336
pop ecx
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
push 4
pop ebx
mov dword [ebp - 0x28], 0xca631852
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x10], 8
push ebx
call fcn.0042ae00
xor eax, eax
mov dword [ebp - 0x24], 0xed761e7f
inc eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 8], eax
jmp 0x42c20c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x68]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x42c200
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xb
je 0x42c3aa
push 3
pop ebx
push dword [ebp + 8]
movdqa xmm0, xmmword [0xa93870]
lea ecx, [ebp - 0x19c]
push ecx
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 0x14], 0x3e90a624
push ecx
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], eax
movdqu xmmword [ebp - 0x1ac], xmm0
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
call fcn.0042af43
mov dword [ebp - 0x1c], 0xd23c5ad0
xor esi, esi
mov dword [ebp - 0x30], 0xfffffff7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], esi
jmp 0x42c389
mov dword [ebp - 0x18], 0x6f26
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x20], 0x8f949145
push ebx
call fcn.0042ae00
xor eax, eax
mov dword [ebp - 0x2c], 0xe0ecf58a
mov dword [ebp - 8], eax
jmp 0x42c2b0
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x13c]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x42c2a1
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x42c378
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov edx, dword [ecx + edx*4]
mov ecx, dword [ebp - 0x48]
mov dword [ecx], edx
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x48]
cmp dword [ecx], 0xfffffff9
mov ecx, dword [ebp - 0x68]
setge dl
xor ebx, ebx
cmp edx, dword [ecx + esi*4]
mov esi, dword [ebp - 0x30]
setl bl
sub ebx, dword [ecx + edi*4]
mov ecx, dword [ebp - 0x14]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x20], ebx
xor ebx, ebx
cmp ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x68]
setge bl
xor edx, edx
cmp ebx, dword [ecx + esi*4]
setne dl
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jne 0x42c323
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x48]
cmp dword [ecx], eax
je 0x42c345
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x68]
cmp dword [ecx + edx*4], eax
je 0x42c345
xor ecx, ecx
lea edx, [ecx + 1]
jmp 0x42c347
mov edx, eax
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
cmp ecx, edx
setne bl
mov dword [ebp - 0x20], ebx
dec dword [ebp - 0x14]
jns 0x42c2c1
push 3
pop ebx
dec dword [ebp - 0x2c]
lea ecx, [ebp - 0x13c]
call fcn.0042aed2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x42c279
lea ecx, [ebp - 0x48]
call fcn.0042aed2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xb
push 0
pop eax
jne 0x42c221
mov dword [ebp - 0x10], eax
jmp 0x42c3d5
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42c3cf
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
mov ecx, dword [ebp - 0x28]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x13
jge 0x42c3af
lea ecx, [ebp - 0x68]
call fcn.0042aed2
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret