Function at 0x4273c0
Capabilities:
Create pipe
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x20], ecx
inc esi
mov dword [ebp - 8], 0x60477862
push esi
lea ecx, [ebp - 0x178]
mov byte [ebp - 0x2d], dl
call fcn.0042704d
xor ebx, ebx
mov dword [ebp - 0x10], ebx
jmp 0x427401
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], 0x11151c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4273ee
push edi
push 0xfffffffffffffffa
mov dword [ebp - 8], 0xffffffe7
pop edi
jmp 0x42746a
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x1c], esi
jmp 0x42744c
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x14
jl 0x427449
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x42743d
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jge 0x42742f
push 0xfffffffffffffff8
pop eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x42741f
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x427467
push ebx
push 0x12c2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
inc dword [ebp - 8]
push 0xfffffffffffffff8
pop eax
cmp dword [ebp - 8], edi
jle 0x427413
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
jl 0x4274a7
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x10], ebx
jmp 0x42749d
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x42749a
push 0x1638
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x427486
dec dword [ebp - 8]
jns 0x42747a
lea ecx, [ebp - 0x178]
call fcn.0042711f
push 2
pop edi
push edi
lea ecx, [ebp - 0x168]
call fcn.0042704d
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], ebx
jmp 0x4274dc
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], 3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x4274c9
mov dword [ebp - 4], esi
cmp dword [ebp - 4], ebx
jl 0x42755c
push 3
lea ecx, [ebp - 0x118]
call fcn.0042704d
mov dword [ebp - 0x10], ebx
jmp 0x42750e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 0x5f1dbecc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x4274fb
mov esi, dword [ebp - 0x118]
xor eax, eax
inc eax
mov dword [esi + 8], eax
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x42752f
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x427544
push ebx
push ebx
push 0x23f9
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
dec dword [esi + 8]
jns 0x427520
lea ecx, [ebp - 0x118]
call fcn.0042711f
dec dword [ebp - 4]
jns 0x4274e9
xor esi, esi
inc esi
lea ecx, [ebp - 0x168]
call fcn.0042711f
mov dword [ebp - 0x14], 0xa48bbca6
lea ecx, [ebp - 0xa4]
push esi
call fcn.0042704d
push 0xfffffffffffffff7
pop edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ebx
jmp 0x427594
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xa4]
mov dword [eax + ecx*4], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x427585
mov dword [ebp - 8], ebx
jmp 0x4275af
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x12c], 0xe70d5dd2
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x42759e
mov dword [ebp - 0x14], ebx
mov edi, 0x97e65fbc
jmp 0x427757
mov dword [ebp - 0x18], 0xfffffff9
lea ecx, [ebp - 0xec]
push esi
call fcn.0042704d
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], ebx
jmp 0x4275ee
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x4275df
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x427749
mov dword [ebp - 8], 0xaeb9ae77
mov dword [ebp - 0x28], 0xc9a130df
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
jg 0x4276a3
mov dword [ebp - 0x34], 6
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [esi + edi*4], eax
mov eax, dword [ebp - 0x18]
cmp eax, 5
mov eax, dword [ebp - 0x18]
setle cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0xec]
setg bl
xor edx, edx
sub ebx, dword [eax]
mov eax, dword [ebp - 8]
cmp ebx, eax
mov eax, dword [ebp - 8]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
xor ebx, ebx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp dword [esi + edi*4], eax
je 0x42768a
mov eax, dword [ebp - 0xec]
cmp dword [eax], ebx
je 0x42768a
xor esi, esi
inc esi
mov eax, esi
jmp 0x42768f
xor esi, esi
mov eax, ebx
inc esi
mov dword [ebp - 0x1c], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x427619
mov edi, 0x97e65fbc
mov dword [ebp - 0x28], 0xffffffeb
jmp 0x427736
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], ebx
jmp 0x427724
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x14], ebx
jne 0x4276f9
cmp dword [ebp - 0x10], 9
sbb eax, eax
inc eax
cmp edi, eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x14], eax
jle 0x4276d7
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
cmp eax, 0x56a759f3
setl cl
sub ecx, dword [ebp - 8]
imul ecx, dword [ebp - 4]
sub ecx, 9
jne 0x4276f9
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], 0xffffffed
jmp 0x42771b
mov dword [ebp - 0x34], 0x435d7d23
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xb
jne 0x42770b
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffe
je 0x4276b7
mov eax, dword [ebp - 4]
mov dword [ebp - 0x12c], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1a
jne 0x4276af
dec dword [ebp - 0x18]
jns 0x4275ff
lea ecx, [ebp - 0xec]
call fcn.0042711f
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
jl 0x4275c1
mov dword [ebp - 0x10], ebx
jmp 0x427786
mov dword [ebp - 0x14], ebx
jmp 0x42777e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa4]
mov dword [eax + ecx*4], 0xe64bfce9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x42776b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x427766
lea ecx, [ebp - 0xa4]
call fcn.0042711f
mov edi, dword [0x4b09fc]
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], ebx
push esi
mov dword [ebp - 0x34], edi
call fcn.0042704d
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0x7d4e0d3b
mov dword [ebp - 0x24], 0xb0fa
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x24], 0x64f5e99a
mov dword [ebp - 0x18], 0x15fbe5b5
mov dword [ebp - 4], ebx
jmp 0x4277ec
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x64]
mov dword [eax + ecx*4], 0xbfc75daa
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x4277dc
cmp dword [ebp - 0x14], ebx
je 0x427854
mov dword [ebp - 8], esi
xor edx, edx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, esi
mov eax, dword [ebp - 8]
setge dl
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 0xfffffffe
setle al
xor edx, edx
imul ecx, eax, 0x101e
mov eax, dword [ebp - 8]
add ecx, 0xddbf
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x64]
setge cl
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 8], 0x867a7bf7
jbe 0x427969
mov dword [ebp - 0x10], 0x4f57b17b
mov dword [ebp - 0x1c], 0x126315bf
mov dword [ebp - 0x28], 0x4eca
mov dword [ebp - 8], ebx
jmp 0x42795d
mov dword [ebp - 4], 9
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jg 0x42795a
mov dword [ebp - 0x2c], 0x79ab6733
inc dword [ebp - 4]
cmp dword [ebp - 0x1c], ebx
je 0x4278cf
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
dec ecx
cmp ecx, 0x199e
jl 0x4278cc
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x64]
cmp dword [eax + ecx*4], 0x88dfef28
jb 0x4278e5
mov ecx, esi
cmp dword [ebp - 4], ebx
jne 0x4278e7
mov ecx, ebx
mov eax, dword [ebp - 0x64]
push 1
cmp dword [eax], 0xffff
sbb esi, esi
inc esi
sub esi, ecx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x64]
sub esi, dword [eax]
mov eax, dword [ebp - 4]
sub esi, eax
mov eax, dword [ebp - 0x64]
cmp esi, dword [eax + edx*4]
pop esi
setg cl
xor eax, eax
cmp ecx, 0x8f5b
setle al
xor ebx, ebx
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ecx + edx*4]
mov eax, dword [ebp - 0x2c]
setl bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
xor ebx, ebx
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x427894
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x427881
jmp 0x42796f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jg 0x4279f3
push 9
pop eax
mov dword [ebp - 0x24], 0xbaf34c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x14be5697
mov dword [ebp - 0x24], 0x3e8228f8
mov dword [ebp - 0x24], 0x6f18880a
mov dword [ebp - 0x24], 0xd6ffba4b
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xf75fbd26
mov dword [ebp - 0x24], 0xbbd88186
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x24], 0xc049d9bb
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 2
jge 0x4279e8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x194], 0xe83987ed
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x4279ce
push 9
pop eax
inc dword [ebp - 0x18]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x42797a
lea ecx, [ebp - 0x64]
call fcn.0042711f
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0xb4]
xor eax, eax
mov dword [ebp - 0x14], 0xa48bbca6
push esi
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
call fcn.0042704d
xor edx, edx
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 8], edx
jmp 0x427a3f
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x427a2c
mov dword [ebp - 8], edx
jmp 0x427a5a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x150], 0xe70d5dd2
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x427a49
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0xfffffff3
jge 0x427c10
mov dword [ebp - 0x18], 0xfffffff9
lea ecx, [ebp - 0xd4]
push esi
call fcn.0042704d
mov dword [ebp - 0x1c], esi
xor edx, edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], edx
jmp 0x427a9c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xd4]
mov dword [eax + ecx*4], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x427a8d
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], edx
jl 0x427bf0
mov dword [ebp - 8], 0xaeb9ae77
mov dword [ebp - 0x28], 0xc9a130df
mov dword [ebp - 8], edx
jmp 0x427b3c
mov dword [ebp - 4], 6
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [esi + edi*4], eax
mov eax, dword [ebp - 0x18]
cmp eax, 5
mov eax, dword [ebp - 0x18]
setle cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0xd4]
setg bl
xor edx, edx
sub ebx, dword [eax]
mov eax, dword [ebp - 8]
cmp ebx, eax
mov eax, dword [ebp - 8]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp dword [esi + edi*4], eax
je 0x427b31
mov eax, dword [ebp - 0xd4]
cmp dword [eax], edx
je 0x427b31
xor esi, esi
inc esi
mov eax, esi
jmp 0x427b36
xor esi, esi
mov eax, edx
inc esi
mov dword [ebp - 0x1c], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jle 0x427ac0
mov dword [ebp - 0x28], 0xffffffeb
jmp 0x427bdd
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], edx
jmp 0x427bcb
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x14], edx
jne 0x427ba0
cmp dword [ebp - 0x2c], 9
mov ecx, 0x97e65fbc
sbb eax, eax
inc eax
cmp ecx, eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x14], eax
jle 0x427b7e
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
cmp eax, 0x56a759f3
setl cl
sub ecx, dword [ebp - 8]
imul ecx, dword [ebp - 4]
sub ecx, 9
jne 0x427ba0
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0xffffffed
jmp 0x427bc2
mov dword [ebp - 0x24], 0x435d7d23
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
jne 0x427bb2
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffe
je 0x427b59
mov eax, dword [ebp - 4]
mov dword [ebp - 0x150], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1a
jne 0x427b51
dec dword [ebp - 0x18]
jns 0x427aad
lea ecx, [ebp - 0xd4]
call fcn.0042711f
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
jl 0x427a6d
mov ebx, dword [ebp + 8]
xor edx, edx
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x2c], edx
jmp 0x427c35
mov dword [ebp - 0x14], edx
jmp 0x427c2d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 0xe64bfce9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x427c1a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jle 0x427c15
lea ecx, [ebp - 0xb4]
call fcn.0042711f
cmp byte [ebp - 0x2d], 0
je 0x427da4
cmp edi, esi
jne 0x427da4
mov dword [ebp - 4], 5
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0xf
jl 0x427c93
xor ebx, ebx
mov dword [ebp - 0x24], 0x95364446
mov dword [ebp - 0x24], esi
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x427c87
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xf
jge 0x427c6d
mov ebx, dword [ebp + 8]
push esi
lea ecx, [ebp - 0xf8]
mov dword [ebx + 8], 4
call fcn.0042704d
mov dword [ebp - 8], 0xfffffffa
mov dword [ebp - 0x24], 0x8376fbf
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x1c], 0xfca86293
mov dword [ebp - 4], 0
jmp 0x427cde
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0x1e29ea41
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x427ccb
mov eax, dword [ebp - 8]
xor edx, edx
cmp eax, esi
mov eax, dword [ebp - 8]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor ebx, ebx
cmp ecx, 0x5d64f689
setg bl
xor edx, edx
add ebx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, ebx
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 8], ecx
xor ecx, ecx
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x10]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xf8]
setl dl
mov dword [eax], esi
xor eax, eax
cmp edx, esi
setg al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp esi, eax
mov eax, dword [ebp - 0x1c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x1c]
jge 0x427d6e
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x427d8f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x427d8f
mov dword [ebp - 8], 0
jmp 0x427d8a
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0xb81f947f
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x427d77
lea ecx, [ebp - 0xf8]
call fcn.0042711f
mov ebx, dword [ebp + 8]
mov dword [ebx + 0xc], 0x4b09fc
mov dword [ebp - 0x18], 0x56915a13
lea ecx, [ebp - 0x138]
push esi
call fcn.0042704d
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x427dc8
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x38], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x427dbe
mov dword [ebp - 8], edx
jmp 0x427de5
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], 7
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x427dd2
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], edx
jg 0x427eb1
xor ebx, ebx
mov dword [ebp - 8], 0xfffffffc
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 5
mov dword [ebp - 0x24], 0xd6273d59
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
jl 0x427ea2
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x38], ebx
je 0x427e41
mov eax, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp + eax*4 - 0x38]
mov dword [ebp - 4], 0xfadacd7d
cmp dword [ebp - 4], ebx
jne 0x427e43
mov edx, ebx
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x38]
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 4]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0xacee
setl al
xor edx, edx
cmp eax, 0x2d3f
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 8]
setl cl
cmp dword [ebp + eax*4 - 0x38], ecx
jne 0x427e98
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x38], ebx
mov eax, ebx
je 0x427e9a
mov eax, esi
mov dword [ebp - 0x24], eax
dec dword [ebp - 8]
jns 0x427e23
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x427dff
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x138]
call fcn.0042711f
cmp dword [ebp - 0x20], edi
jge 0x428a95
xor edx, edx
mov dword [ebp - 0x10], 0x53b26bdd
mov dword [ebp - 0x10], edx
jmp 0x427f64
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], edx
jmp 0x427eee
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x10c], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x427ee1
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
xor ecx, ecx
imul eax, dword [ebp - 0x10c]
neg eax
cmp eax, 0xad9bacc5
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x1c]
sete cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
add edx, 0xffffcf87
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x24], edx
xor edx, edx
mov byte [ebp - 9], dl
cmp byte [ebp - 9], dl
je 0x427f61
push 0xaf3
call dword [sym.imp.USER32.dll_GetSysColorBrush]
xor edx, edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xa
jge 0x427ed6
mov dword [ebp - 0x10], 0x91a049fe
mov esi, 0x4b0a00
mov dword [ebp - 0x24], 9
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x427f97
push 0x25fb
call dword [sym.imp.KERNEL32.dll_TlsFree]
xor edx, edx
xor edi, edi
mov dword [ebp - 0x10], edx
inc edi
cmp dword [ebp - 0x10], 0xfffffff6
je 0x427fec
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 4], edx
jmp 0x427fbd
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x58], 0xfffffffe
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x427faf
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], edx
jl 0x427fe7
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x58], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x58]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x18]
jns 0x427fca
dec dword [ebp - 0x10]
jmp 0x427f9d
mov ebx, dword [ebp - 0x20]
test ebx, ebx
jle 0x428438
mov dword [ebp - 0x24], 0x9ff6
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x24], 0x632667a8
mov dword [ebp - 0x24], 0xcd795364
mov dword [ebp - 0x24], 0x485bf25c
mov dword [ebp - 0x24], 0xffffffff
push edi
call fcn.0042704d
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
jmp 0x428043
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x148]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x428030
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x148]
call fcn.0042711f
mov edi, dword [esi]
xor edx, edx
push 3
mov dword [ebp - 8], 0x33fcb50b
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edx
pop ecx
jmp 0x42807d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x104], 0xa8eac8b1
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x42806c
mov dword [ebp - 8], edx
jmp 0x428094
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x104], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x428087
mov dword [ebp - 8], 8
jmp 0x4280db
mov dword [ebp - 0x18], 0xe948708e
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], edx
jl 0x4280d8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x104]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x104], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x104]
dec dword [ebp - 0x18]
jns 0x4280b5
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff2
jge 0x4280a2
xor eax, eax
add esi, 4
inc eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xe64e6dc6
mov dword [ebp - 0x28], 0xed857289
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0xb
je 0x4281b4
xor edi, edi
inc edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x28], 0x925f321e
cmp dword [ebp - 0x10], edi
je 0x428126
cmp dword [ebp - 0x10], edx
je 0x428128
mov edx, edi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setg cl
xor ebx, ebx
sub ecx, 0x5ec41505
je 0x428143
mov ecx, edi
cmp dword [ebp - 0x1c], ebx
jne 0x428145
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x1c], ebx
je 0x42815c
mov esi, edi
cmp dword [ebp - 0x18], ebx
jne 0x42815e
mov esi, ebx
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp eax, esi
push 0
setg cl
xor eax, eax
cmp edx, ecx
pop edx
setg al
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x36fc75df
setl cl
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xb
jne 0x42810b
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [esi]
mov dword [ebp - 0x10], 0x5ed9
mov dword [ebp - 0x24], 0xe649f6d4
mov dword [ebp - 4], edx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x9c821f99
mov dword [ebp - 4], 0x21b78cd9
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], edx
mov dword [ebp - 4], 0xa1e2510a
mov dword [ebp - 4], 0xd911aca8
mov dword [ebp - 4], 0xc4ea
mov dword [ebp - 4], 0xb12a
mov dword [ebp - 8], edx
jmp 0x428218
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xbc], 7
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x428207
xor eax, eax
mov dword [ebp - 8], edx
inc eax
cmp dword [ebp - 8], eax
jge 0x428245
xor edi, edi
inc edi
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x16c], 0x5bfeb1ec
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x42822c
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0xc0de
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], 6
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xb8], edx
je 0x428278
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
test eax, eax
jne 0x42826f
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x18]
add esi, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0x30836b16
mov dword [ebp - 4], edx
jmp 0x4282bf
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x88], 1
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x4282ae
mov dword [ebp - 0x80], 0xfffffff3
cmp dword [ebp - 0x80], 0xfffffff1
jge 0x428317
xor ebx, ebx
inc ebx
mov dword [ebp - 4], 6
mov dword [ebp - 4], edx
jmp 0x4282f2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x18c], 0x7dd68876
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x4282e1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], edx
jl 0x42830b
mov dword [ebp - 0x1c], 0xf14c90d2
dec dword [ebp - 4]
jns 0x4282ff
dec dword [ebp - 0x80]
cmp dword [ebp - 0x80], 0xfffffff1
jl 0x4282d5
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0xfffffff9
jmp 0x428344
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], edx
jmp 0x42833b
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x88], edx
jne 0x428341
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x42832c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffb
jne 0x428320
test ecx, ecx
jne 0x428351
add esi, 8
mov dword [ebp - 0x10], 0x7ddc85f7
mov eax, 0x46158d32
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0xffffffe4
jg 0x428429
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], 0x7e780ca9
mov dword [ebp - 4], edx
jmp 0x4283a2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x3c], 0x52c58fb7
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x428394
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 3
jg 0x42841c
mov dword [ebp - 4], edx
jmp 0x4283c6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xc8], 0xfffffff7
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x4283b5
mov dword [ebp - 0xc0], edx
jmp 0x4283dd
mov dword [ebp - 0x24], edx
inc dword [ebp - 0xc0]
cmp dword [ebp - 0xc0], 3
jle 0x4283d4
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x428410
push edx
push 0x743
push 0x101d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor edx, edx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jle 0x4283b0
xor ecx, ecx
inc ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe4
jle 0x428388
add esi, edi
dec ebx
push 1
mov dword [ebp - 0x20], ebx
pop edi
jne 0x427ff7
mov dword [ebp - 0x20], 0xa8eac8b1
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x428470
push edx
push 0x1d2a
push 0x122f
push 0x229c
push 0x2419
push 0x12a0
push 0x1a52
push edx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor edx, edx
mov dword [ebp - 0x20], 0xffffffec
jmp 0x428493
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x428490
push 0x2200
push edx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor edx, edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
je 0x428479
mov edi, dword [esi]
xor ebx, ebx
mov dword [ebp - 0x28], 0x3ae35568
inc ebx
mov dword [ebp - 4], 0xc61c71bc
mov dword [ebp - 0x10], 0xa2a67f6a
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0x12
mov dword [ebp - 0x1c], edi
je 0x428633
push 0xfffffffffffffff8
pop edi
mov dword [ebp - 0x14], 0x3111738a
mov dword [ebp - 0x20], 0x6a07563f
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x20], edx
jmp 0x4284f1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x44], 0xeb90
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x4284e3
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], edx
jl 0x428597
mov dword [ebp - 4], 0x1324
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
jne 0x428589
cmp dword [ebp - 0x14], edx
jne 0x42853a
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x44], edx
jne 0x428529
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x44]
mov dword [ebp - 4], eax
mov eax, edx
cmp dword [ebp - 4], edx
je 0x42853c
mov eax, ebx
add eax, 0xfffffffa
jne 0x428544
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x44]
cmp eax, 0xe3e7
mov eax, dword [ebp - 0x10]
sete cl
cmp edi, eax
sbb eax, eax
xor edx, edx
neg eax
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x44]
cmp edx, eax
setle cl
xor edx, edx
imul eax, ecx, 0xde75
test eax, eax
jne 0x428589
mov eax, edx
cmp dword [ebp - 0x44], edx
je 0x42858b
mov eax, ebx
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x14]
jns 0x428503
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x10], edx
jne 0x4285b2
mov eax, edx
cmp dword [ebp - 0x44], edx
je 0x4285b4
mov eax, ebx
mov dword [ebp - 0x10], eax
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 4]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
add ecx, dword [ebp - 0x28]
jne 0x4285dc
mov eax, edx
cmp dword [ebp - 0x40], edx
je 0x4285de
mov eax, ebx
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x40]
sub ecx, eax
mov eax, dword [ebp - 0x28]
sub ecx, eax
je 0x428610
mov dword [ebp - 0x14], edx
jmp 0x428608
mov dword [ebp - 0x24], 0xb962
mov dword [ebp - 0x24], 0xffffffff
inc dword [ebp - 0x18]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
je 0x4285f4
jmp 0x428623
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x428623
push edx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor edx, edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x12
jne 0x4284c6
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 4], 0x7c8b166c
mov dword [ebp - 0x20], 2
mov dword [ebp - 8], edx
jmp 0x428654
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x70], 0xfff7
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x428646
mov dword [ebp - 8], edx
jmp 0x428669
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x54], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x42865f
mov dword [ebp - 0x50], 2
cmp dword [ebp - 0x50], edx
jl 0x428713
mov dword [ebp - 0x28], 0xc558bac0
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], edx
jl 0x42870a
mov dword [ebp - 0x24], 0x523dd972
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x4286ac
push edx
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x70], edx
jne 0x4286b8
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x28]
push 0
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 4]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0x3ca3
pop edx
setge al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x70]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x28]
jns 0x428692
dec dword [ebp - 0x50]
jns 0x42867f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x68]
neg eax
sbb eax, eax
neg ecx
neg eax
sub ecx, eax
mov eax, dword [ebp - 0x54]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
neg eax
jne 0x42873f
mov ecx, edx
cmp dword [ebp - 0x20], edx
je 0x428741
mov ecx, ebx
mov eax, dword [ebp - 4]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x50]
add ecx, eax
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov eax, dword [ebp - 0x6c]
mov ebx, dword [esi + 4]
sete dl
mov dword [ebp - 0x24], ebx
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 6
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0x1d
jg 0x428872
xor ebx, ebx
mov dword [ebp - 0x98], 0xffffffff
mov dword [ebp - 0x94], 0xffffffff
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x8c], 0xffffffff
mov dword [ebp - 0x8c], ebx
jmp 0x428836
mov dword [ebp - 0x18], 0xea6801fc
mov dword [ebp - 0x18], 8
jmp 0x4287d7
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x4287d4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x10
jg 0x4287c5
mov dword [ebp - 0x18], 0xffffffff
cmp dword [ebp - 0x18], 8
jne 0x428830
xor eax, eax
lea ecx, [ebp - 0x124]
inc eax
push eax
call fcn.0042704d
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x428814
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x124]
mov dword [eax + ecx*4], 0x21f1eb32
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x428801
mov eax, dword [ebp - 0x124]
lea ecx, [ebp - 0x124]
mov dword [eax], 0x1c
call fcn.0042711f
inc dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], 0x12
jg 0x4287b5
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x428862
push 0x1302
push 0xd5a
push ebx
push 0x69d
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1d
jle 0x428782
mov ebx, dword [ebp - 0x24]
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x428893
push 0x804
push 0x221
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
mov dword [ebp - 0x10], 0x9c4c8d3c
lea ecx, [ebp - 0xe0]
add esi, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x20], 0xffffffff
push 2
mov dword [ebp - 4], esi
call fcn.0042704d
mov dword [ebp - 0x24], 0xd1d2
xor edx, edx
push 0xfffffffffffffffe
mov dword [ebp - 0x20], 0xe91c8413
pop esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], edx
jmp 0x4288e5
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x4288d6
mov byte [ebp - 9], dl
cmp byte [ebp - 9], dl
je 0x428908
push 0x45d
push 0x212
push 0xb8c
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
add eax, 0x71ec5484
cmp eax, 0x91ba
setge cl
xor eax, eax
cmp ecx, edx
setne al
add eax, 0x53b1
cmp eax, edx
jle 0x42893f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xe0]
cmp dword [ecx], eax
mov esi, dword [ecx]
mov ecx, dword [ebp - 0x10]
setg dl
mov eax, dword [ebp - 0x20]
sub ecx, edx
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0xe0]
setg dl
add edx, esi
imul edx, esi
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
call fcn.0042711f
test ebx, ebx
jne 0x428a61
cmp byte [ebp - 0x2d], bl
je 0x4289a0
xor eax, eax
inc eax
cmp dword [ebp - 0x34], eax
jne 0x4289a0
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov ecx, dword [ebp - 4]
push edi
mov ebx, dword [ecx]
mov eax, dword [ecx + 4]
add ecx, 8
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], ecx
call fcn.0047e4f2
mov esi, dword [ebp - 0x1c]
mov edi, eax
xor eax, eax
pop ecx
mov dword [ebp - 0xa8], eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0xa8]
push eax
push esi
call fcn.00453db1
xor ecx, ecx
test esi, esi
mov esi, dword [ebp - 0x7c]
jle 0x428a3e
mov eax, ecx
and eax, 0x80000001
jns 0x4289f8
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, ebx
add eax, ecx
add eax, ebx
imul eax, dword [ebp - 0x24]
cdq
idiv dword [ebp - 0x1c]
xor eax, eax
cmp word [esi + edx*2], ax
je 0x428a24
xor ebx, ebx
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x1c]
cmp word [esi + edx*2], bx
jne 0x428a14
mov ebx, dword [ebp - 0x34]
xor eax, eax
inc eax
mov word [esi + edx*2], ax
mov eax, dword [ebp - 4]
mov al, byte [edx + eax]
mov byte [ecx + edi], al
inc ecx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
jl 0x4289ea
jmp 0x428a41
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebx + 4], edi
test esi, esi
je 0x428a64
push esi
call fcn.00480e96
pop ecx
xor ecx, ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
jmp 0x428a66
mov ebx, dword [ebp + 8]
xor ecx, ecx
xor esi, esi
inc esi
mov dword [ebp + 8], 0x6c05baf4
mov dword [ebp + 8], 0xfffffffb
mov dword [ebp + 8], ecx
mov dword [ebp + 8], 0x4074dd03
mov dword [ebp + 8], 0xa6e6f7fb
mov dword [ebp + 8], 0x54320e32
mov dword [ebp + 8], ecx
pop edi
jmp 0x428aaa
xor ecx, ecx
jmp 0x428a69
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x13c], 0xfffffffc
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x428a99
mov dword [ebp + 8], ecx
jmp 0x428ac5
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x15c], 0xfffffffa
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x428ab4
dec dword [ebp - 0x15c]
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x428af3
push 0x128c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret