Function at 0x4028ad
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x27c
push ebx
xor ebx, ebx
mov dword [esp + 0x2c], edx
inc ebx
mov dword [esp + 0x3c], ecx
push esi
mov dword [esp + 0x10], ebx
push edi
mov dword [esp + 0x14], 0
jmp 0x4028e8
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x268], 0xc85f70ad
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x4028d5
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 3
mov dword [esp + 0x18], 0
pop esi
jmp 0x40293e
mov byte [esp + 0x27], 0
cmp byte [esp + 0x27], 0
je 0x402923
push 0xd76
push 0xaa5
push 0x399
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov byte [esp + 0x27], 0
cmp byte [esp + 0x27], 0
je 0x40293a
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_SetMenu]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x402902
push esi
lea ecx, [esp + 0x190]
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x10], 0xe2236432
mov dword [esp + 0x14], eax
jmp 0x402977
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18c]
mov dword [ecx + edx*4], 0xb9b55bb2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x402961
push 2
mov dword [esp + 0x14], eax
pop esi
cmp dword [esp + 0x10], esi
jg 0x4029ee
mov dword [esp + 0x14], eax
jmp 0x40299f
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x12c], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x402990
mov ecx, dword [esp + 0x10]
xor ebx, ebx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
mov ecx, dword [esp + 0x18c]
setge bl
push 2
mov dword [ecx + esi*4], ebx
mov dword [esp + 0x130], eax
pop esi
cmp dword [esp + 0x12c], eax
jne 0x4029eb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x40298a
xor ebx, ebx
inc ebx
lea ecx, [esp + 0x18c]
call fcn.00401a1f
mov dword [esp + 0x28], 0xac204e2d
xor eax, eax
mov dword [esp + 0x38], 0x4111d018
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x28], 0xfffffff3
cmp dword [esp + 0x28], 6
jne 0x402ac9
mov dword [esp + 0x14], ebx
mov dword [esp + 0x3c], 0x6e3e
mov dword [esp + 0x14], eax
jmp 0x402a45
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x50], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x402a39
mov dword [esp + 0x14], eax
jmp 0x402a86
mov byte [esp + 0x27], al
cmp byte [esp + 0x27], 0
je 0x402a82
push 0x73f
push 0x2408
push 0x23d1
push 0xf22
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
xor eax, eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], eax
jle 0x402a51
mov ecx, dword [esp + 0x28]
xor edx, edx
cmp ecx, 0xfdc8
setne dl
xor ecx, ecx
cmp edx, 0x74a5
setl cl
add ecx, dword [esp + 0x28]
mov dword [esp + 0x38], ecx
jne 0x402ab4
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x38], ebx
inc dword [esp + 0x28]
jmp 0x402a1c
mov byte [esp + 0x27], al
cmp byte [esp + 0x27], 0
je 0x402ade
push eax
push eax
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
xor eax, eax
mov dword [esp + 0x14], 7
mov dword [esp + 0x10], eax
jmp 0x402afc
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x58], 0x3342eb9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x402aec
mov dword [esp + 0x10], eax
jmp 0x402b1b
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x10c], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x402b08
mov dword [esp + 0x5c], eax
cmp dword [esp + 0x5c], 0x10
je 0x402c7e
mov dword [esp + 0x10], 0xa205
mov dword [esp + 0x18], ebx
mov dword [esp + 0x30], 0x2fd17ba7
mov dword [esp + 0x14], eax
jmp 0x402b5d
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x1cc], 0xb7e80d68
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x402b4a
mov ecx, dword [esp + 0x5c]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, esi
je 0x402c07
push dword [esp + 0x50]
movdqa xmm0, xmmword [0xa76f70]
lea ecx, [esp + 0x210]
push ecx
lea ecx, [esp + 0x204]
mov dword [esp + 0x108], eax
push ecx
push eax
lea ecx, [esp + 0x110]
mov dword [esp + 0x114], eax
movdqu xmmword [esp + 0x20c], xmm0
mov dword [esp + 0x118], eax
call fcn.00401a81
inc dword [esp + 0x30]
mov dword [esp + 0x10], 0xfffffffa
cmp dword [esp + 0x10], 0x31
jne 0x402bf9
xor esi, esi
mov dword [esp + 0x18], esi
jmp 0x402be4
cmp dword [esp + 0x110], esi
jne 0x402beb
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x402bd7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x31
je 0x402bd1
push 2
pop esi
lea ecx, [esp + 0x100]
call fcn.00401a1f
jmp 0x402c6c
mov dword [esp + 0x18], 0x13
jmp 0x402c65
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], eax
jl 0x402c61
mov dword [esp + 0x10], eax
jmp 0x402c3f
mov byte [esp + 0x27], al
cmp byte [esp + 0x27], 0
je 0x402c3b
push 0x427
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor eax, eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x402c21
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + ecx*4 + 0x1cc]
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x10c], edx
dec dword [esp + 0x14]
jns 0x402c1b
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x402c11
inc dword [esp + 0x5c]
cmp dword [esp + 0x5c], 0x10
push 0
pop eax
jne 0x402b30
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], 0xd526d2e8
mov dword [esp + 0x14], 0xfffffff7
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0x6c56d20a
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x5691f3a4
mov dword [esp + 0x18], eax
jmp 0x402cc3
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x134], 0x8cae2fe8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x402cb0
mov dword [esp + 0x18], eax
jmp 0x402cdf
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x88], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x402cd0
mov dword [esp + 0x18], eax
jmp 0x402cfe
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x124], 0x4ed09eb
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x402ceb
cmp dword [esp + 0x10], eax
je 0x402d85
xor edx, edx
mov dword [esp + 0x138], 8
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x138]
cmp ecx, 0xab79
setg dl
mov dword [esp + 0x14], edx
xor edx, edx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x138]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp ecx, 6
mov ecx, dword [esp + 0x10]
setle dl
cmp edx, ebx
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
mov esi, ebx
setg dl
mov dword [esp + 0x20], edx
xor edx, edx
mov ecx, dword [esp + 0x20]
cmp ecx, 0x44d5
setge dl
sub edx, 0x2aba
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x10]
jne 0x402d87
mov esi, eax
mov ecx, dword [esp + 0x10]
xor edx, edx
cmp esi, ecx
setl dl
sub edx, dword [esp + 0x10]
sub edx, dword [esp + 0x10]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x88], edx
mov ecx, dword [esp + 0x124]
mov dword [esp + 0x2c], ecx
mov ecx, 0x86ff5291
mov dword [esp + 0x88], ecx
cmp dword [esp + 0x10], ecx
je 0x402e06
mov ecx, dword [esp + 0x138]
xor ebx, ebx
cmp ecx, 0xffffffff
mov ecx, dword [esp + 0x38]
setle bl
xor edx, edx
cmp ecx, ebx
setg dl
mov dword [esp + 0x138], edx
mov dword [esp + 0x2c], edx
mov ecx, dword [esp + 0x88]
cmp dword [esp + 0x2c], ecx
je 0x402dfc
mov ecx, dword [esp + 0x128]
mov ecx, dword [esp + 0x88]
xor ebx, ebx
inc ebx
cmp dword [esp + 0x2c], eax
je 0x402e20
mov byte [esp + 0x27], al
cmp byte [esp + 0x27], 0
je 0x402e7c
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
jmp 0x402e7c
mov dword [esp + 0x10], eax
jmp 0x402e75
mov dword [esp + 0x20], 3
cmp dword [esp + 0x20], eax
jl 0x402e71
mov dword [esp + 0x14], 3
cmp dword [esp + 0x14], eax
jl 0x402e6b
mov byte [esp + 0x27], al
cmp byte [esp + 0x27], 0
je 0x402e65
push 0x2390
push 0x245
call edi
push eax
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetMessageA]
xor eax, eax
dec dword [esp + 0x14]
jns 0x402e42
dec dword [esp + 0x20]
jns 0x402e34
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x402e26
mov dword [esp + 0x20], 0xfffffffb
xor eax, eax
mov dword [esp + 0x28], 0xbb35b689
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
jmp 0x402eab
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0xb8], 0x1857497f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x402e98
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
add ecx, dword [esp + 0x28]
je 0x402ee4
cmp dword [esp + 0x10], eax
je 0x402ee4
mov byte [esp + 0x27], al
cmp byte [esp + 0x27], al
je 0x402f37
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x402f37
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], eax
jl 0x402f37
mov dword [esp + 0x20], eax
jmp 0x402f17
mov dword [esp + 0x28], eax
jmp 0x402f0d
mov ecx, dword [esp + 0x28]
mov dword [esp + ecx*4 + 0xb8], 0x1eb7e595
inc dword [esp + 0x28]
cmp dword [esp + 0x28], ebx
jl 0x402efa
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jle 0x402ef4
mov byte [esp + 0x27], al
cmp byte [esp + 0x27], 0
je 0x402f31
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
dec dword [esp + 0x10]
jns 0x402eee
mov dword [esp + 0x14], 0
jmp 0x402f54
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x278], 0xc85f70ad
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x402f41
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x18], 0
cmp dword [esp + 0x18], 0xffffffea
jge 0x4030f3
push 2
lea ecx, [esp + 0xa0]
call fcn.0040194d
mov dword [esp + 0x14], 0x1e19e95d
xor eax, eax
mov dword [esp + 0x30], 0x1210cbed
mov dword [esp + 0x14], eax
jmp 0x402fb6
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x9c]
mov dword [ecx + edx*4], 0xfffffffa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x402fa0
mov byte [esp + 0x27], al
cmp byte [esp + 0x27], al
je 0x402fcf
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
mov ecx, dword [esp + 0x9c]
xor edx, edx
cmp edx, dword [ecx]
sbb ecx, ecx
xor ebx, ebx
neg ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
sub edx, 0x7a76fa48
cmp ecx, edx
mov ecx, dword [esp + 0x18]
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0x9c]
setne dl
xor ebx, ebx
cmp edx, dword [ecx]
setle bl
xor edx, edx
cmp ebx, dword [ecx + 4]
setge dl
sub edx, 0xc3ad3b31
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x642e40c1
setge cl
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x2c], eax
je 0x40304a
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], eax
jmp 0x4030c7
xor edx, edx
mov dword [esp + 0x10], eax
inc edx
jmp 0x403063
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x54], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x403053
mov dword [esp + 0x10], eax
jmp 0x40307f
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x68], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x40306f
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov ecx, eax
cmp dword [esp + 0x54], eax
je 0x403097
mov ecx, edx
mov dword [esp + 0x2c], ecx
xor ebx, ebx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x30], edx
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x14]
cmp edx, ecx
setne bl
xor ecx, ecx
test ebx, ebx
sets cl
mov dword [esp + 0x68], ecx
cmp dword [esp + 0x68], eax
jne 0x4030e4
lea ecx, [esp + 0x9c]
call fcn.00401a1f
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffea
jl 0x402f7a
jmp 0x4030f0
lea ecx, [esp + 0x9c]
call fcn.00401a1f
xor ebx, ebx
inc ebx
mov dword [esp + 0x2c], 0
cmp dword [esp + 0x2c], 3
push 5
pop ecx
jg 0x4038e9
jmp 0x40310e
xor ebx, ebx
inc ebx
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xd0], ecx
mov dword [esp + 0xd4], ecx
mov dword [esp + 0xd8], ecx
mov dword [esp + 0x10], 0x1c1ec2db
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x38], 7
mov dword [esp + 0x38], 0xf1a969ac
mov dword [esp + 0x38], 0xf0ebf903
mov dword [esp + 0x10], 0
jmp 0x4031b8
mov dword [esp + 0x38], ebx
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + eax*4 + 0xcc]
mov eax, dword [esp + 0x10]
test eax, eax
sets cl
xor eax, eax
cmp ecx, edx
setge al
xor ecx, ecx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0xcc]
test eax, eax
mov eax, dword [esp + 0x10]
setne cl
xor edx, edx
mov eax, dword [esp + eax*4 + 0xcc]
cmp eax, ecx
mov eax, dword [esp + 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x38], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x40315c
push 3
lea ecx, [esp + 0xb0]
call fcn.0040194d
mov dword [esp + 0x30], 0x61d594d0
xor eax, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], eax
jmp 0x4031f7
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xac]
mov dword [ecx + edx*4], 0xfffffffc
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x4031e1
mov esi, dword [esp + 0xac]
lea edi, [esi + 8]
cmp dword [edi], eax
je 0x40321f
mov ecx, dword [esp + 0x30]
mov edx, ebx
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0xac]
jmp 0x403221
mov edx, eax
xor ecx, ecx
cmp edx, dword [edi]
setl cl
xor edx, edx
cmp ecx, 0xfffffff9
setge dl
add edx, dword [esi + 4]
add edx, dword [edi]
jne 0x40323d
mov ecx, eax
cmp dword [esi], eax
je 0x40323f
mov ecx, ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x20], eax
jmp 0x40325f
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xac]
mov dword [eax + ecx*4], 0x5ebec5ec
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x403249
lea ecx, [esp + 0xac]
call fcn.00401a1f
xor eax, eax
mov byte [esp + 0x1f], al
mov dword [esp + 0x14], 0xc68ec0ae
mov dword [esp + 0x14], 0x19
jmp 0x4032f8
mov dword [esp + 0x20], 0xfffffff7
mov dword [esp + 0x20], 0xffffffe3
jmp 0x4032ed
mov dword [esp + 0x28], 0x7a00f47a
cmp dword [esp + 0x14], eax
jne 0x4032f4
mov dword [esp + 0x28], 0xf
cmp dword [esp + 0x28], eax
jge 0x4032e9
mov byte [esp + 0x27], al
cmp byte [esp + 0x27], 0
je 0x4032e3
push 0x16b4
push 0x195d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
dec dword [esp + 0x28]
js 0x4032b8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x11
jl 0x40329c
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff7
jg 0x40328a
mov byte [esp + 0x27], al
cmp byte [esp + 0x27], 0
je 0x403314
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
cmp byte [esp + 0x1f], 0
je 0x4034ca
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], 0x4f16efa4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], eax
jmp 0x403341
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x60], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x403335
mov dword [esp + 0x20], eax
jmp 0x4034a3
mov dword [esp + 0x18], 9
lea ecx, [esp + 0xe8]
push 4
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x28], eax
jmp 0x403385
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0xe8]
mov dword [ecx + edx*4], 0xe4145c17
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 4
jl 0x40336f
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x4033ad
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
xor eax, eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
jg 0x403493
mov edi, dword [esp + 0xe8]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [edi + 8], eax
cmp dword [esp + ecx*4 + 0x60], eax
jne 0x4033db
mov esi, eax
cmp dword [esp + 0x18], eax
je 0x4033dd
mov esi, ebx
mov ecx, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esp + ecx*4 + 0x60]
cmp ecx, esi
setne dl
sub edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add edx, dword [esp + ecx*4 + 0x60]
je 0x403438
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + ecx*4 + 0x60]
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x60], edx
mov dword [esp + 0x10], eax
jmp 0x40342f
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x40342b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x35
jne 0x403410
jmp 0x403485
mov dword [esp + 0x10], eax
jmp 0x403448
cmp dword [esp + 0x14], eax
jne 0x40344f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x33
jge 0x40343e
mov dword [esp + 0x14], 0x19
jmp 0x40347e
mov dword [esp + 0x10], eax
jmp 0x403473
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0xe8]
cmp dword [ecx + edx*4], eax
jne 0x40347a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x40345f
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffffa
je 0x403459
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x4033c2
lea ecx, [esp + 0xe8]
call fcn.00401a1f
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x403351
mov eax, dword [esp + 0x20]
push 0xd76
push 0xaa5
push 0x399
mov dword [esp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 9
pop esi
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x1a4]
push 2
call fcn.0040194d
mov dword [esp + 0x28], esi
xor eax, eax
mov dword [esp + 0x30], 0xf093d7f2
mov dword [esp + 0x14], eax
jmp 0x403509
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1a4]
mov dword [ecx + edx*4], 6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x4034f3
mov ecx, dword [esp + 0x10]
mov edx, 0x958a95cd
mov edi, dword [esp + 0x1a4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
sub edx, dword [edi + 4]
add ecx, edx
mov dword [edi + 4], ecx
mov dword [esp + 0x10], 0xffffffe8
jmp 0x403645
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x18], 0xcdf1
mov dword [esp + 0x14], 3
mov dword [esp + 0x30], 0xfffffff7
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x40358a
push 0xc1c
push eax
push eax
push eax
push eax
push 0x1679
push 0x9c5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
xor eax, eax
mov ecx, dword [esp + 0x10]
neg ecx
je 0x403639
inc dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], eax
je 0x403602
cmp dword [esp + 0x30], eax
jne 0x4035b5
mov esi, eax
cmp dword [edi + 4], eax
je 0x4035b7
mov esi, ebx
mov ecx, dword [esp + 0x28]
xor edx, edx
cmp esi, ecx
setle dl
mov dword [edi + 4], edx
cmp edx, dword [esp + 0x14]
je 0x4035cf
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov esi, ebx
mov ecx, dword [esp + 0x14]
sub ecx, 3
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
imul ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x403604
mov esi, eax
mov ecx, dword [esp + 0x20]
mov edx, 0xaf5bfb66
cmp edx, ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, esi
mov ecx, dword [esp + 0x10]
setge dl
xor ebx, ebx
cmp edx, ecx
setle bl
sub ebx, dword [esp + 0x10]
add ebx, dword [esp + 0x20]
je 0x403636
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x40363b
xor ebx, ebx
inc ebx
mov ecx, eax
neg ecx
mov dword [esp + 0x30], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffef
jl 0x40353d
lea ecx, [esp + 0x1a4]
call fcn.00401a1f
mov byte [esp + 0x1f], 0
cmp byte [esp + 0x1f], 0
je 0x4038d7
mov dword [esp + 0x18], 0xbac64a68
mov dword [esp + 0x18], 0xffffffe5
jmp 0x4036a0
mov byte [esp + 0x1f], 0
cmp byte [esp + 0x1f], 0
je 0x40369c
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetParent]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff3
jne 0x40367e
push 3
mov dword [esp + 0x1c], 7
pop esi
jmp 0x4038bd
mov dword [esp + 0x10], 0x2daab72b
xor edx, edx
mov dword [esp + 0x28], 0xfffffffe
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp eax, ecx
setne dl
add edx, dword [esp + 0x28]
cmp edx, dword [esp + 0x10]
jge 0x40388b
mov dword [esp + 0x30], 6
mov dword [esp + 0x38], 8
mov dword [esp + 0x28], 0x14
cmp dword [esp + 0x28], 0x23
jne 0x4038b9
xor ebx, ebx
inc ebx
push esi
lea ecx, [esp + 0x1b4]
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x40374f
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x40], 0xb780
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x40373f
mov dword [esp + 0x10], eax
jmp 0x40376d
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1b0]
mov dword [ecx + edx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x40375b
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], eax
jg 0x40386e
mov ecx, 0xad33dc28
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1bc], ecx
mov dword [esp + 0x1c0], ecx
mov dword [esp + 0x1c4], ecx
mov dword [esp + 0x1c8], ecx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], eax
jg 0x403860
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + ecx*4 + 0x40]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + ecx*4 + 0x40]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + ecx*4 + 0x40]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + ecx*4 + 0x40]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x1c8], edx
mov ecx, dword [esp + 0x28]
add ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x72679f1a
mov ecx, dword [esp + 0x18]
setle dl
xor ebx, ebx
cmp edx, ecx
setg bl
sub ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1b0]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ecx], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jle 0x4037b4
xor ebx, ebx
mov ecx, 0xad33dc28
inc ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jle 0x403786
lea ecx, [esp + 0x1b0]
call fcn.00401a1f
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x23
je 0x40372a
jmp 0x4038b9
mov dword [esp + 0x38], 0xd1dd
xor edx, edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
dec ecx
add eax, ecx
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
cmp eax, ecx
setne dl
mov dword [esp + 0x14], edx
dec dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x4036b7
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 3
push 5
pop ecx
jle 0x40310b
push dword [esp + 0x50]
movdqa xmm0, xmmword [0xa76f90]
lea eax, [esp + 0x220]
and dword [esp + 0x80], 0
lea ecx, [esp + 0x80]
and dword [esp + 0x84], 0
and dword [esp + 0x88], 0
push eax
lea eax, [esp + 0x214]
push eax
push 0
movdqu xmmword [esp + 0x21c], xmm0
call fcn.00401a81
xor esi, esi
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], 3
jg 0x403a67
mov edi, dword [esp + 0x7c]
xor ebx, ebx
inc ebx
mov dword [esp + 0x30], 0xe779066
lea ecx, [esp + 0x144]
push 3
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x403982
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x48], 0xa955a63a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x403972
mov dword [esp + 0x10], eax
jmp 0x4039a4
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x144]
mov dword [ecx + edx*4], 8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x40398e
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x7c]
cmp dword [ecx + edx*4], eax
je 0x4039c4
mov esi, ebx
cmp dword [esp + 0x48], eax
jne 0x4039c6
mov esi, eax
mov edx, dword [esp + 0x18]
xor ebx, ebx
mov ecx, dword [esp + 0x7c]
cmp dword [ecx + edx*4], esi
mov ecx, 0xeec80f21
setl bl
xor edx, edx
sub ecx, ebx
cmp ecx, 0x6fdd8fb8
setne dl
cmp edx, dword [esp + 0x30]
jne 0x4039f2
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x48]
xor edx, edx
mov ecx, dword [esp + 0x48]
imul ecx, dword [esp + 0x48], 0xd365
cmp ecx, dword [edi + 4]
mov ecx, 0xffff
setle dl
cmp ecx, edx
sbb ecx, ecx
neg ecx
cmp ecx, 0xc36544d1
ja 0x403a35
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x7c]
cmp dword [ecx + edx*4], eax
jne 0x403a35
cmp dword [esp + 0x18], eax
jne 0x403a35
xor ebx, ebx
inc ebx
jmp 0x403a3a
xor ebx, ebx
inc ebx
mov eax, ebx
imul ecx, eax, 0xfff9
mov eax, dword [esp + 0x144]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x144]
call fcn.00401a1f
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x403954
xor esi, esi
lea ecx, [esp + 0x7c]
call fcn.00401a1f
push 0x51c7
push dword [esp + 0x48]
lea eax, [esp + 0xb0]
push 0x7caf
push dword [esp + 0x40]
push 0x2aea
push 0x7a19
push esi
push 0x5b39
push eax
push 0x4c52
push 0x6a32
call fcn.0040a9a1
add esp, 0x2c
lea ecx, [esp + 0x168]
push 2
pop ebx
push ebx
call fcn.0040194d
push dword [esp + 0x50]
movdqa xmm0, xmmword [0xa76f60]
lea eax, [esp + 0x240]
push eax
lea eax, [esp + 0x234]
mov dword [esp + 0x3c], 0xfffffff8
push eax
mov dword [esp + 0x40], 0xfffffff7
lea ecx, [esp + 0xe8]
mov dword [esp + 0x40], 0xc857617c
push esi
movdqu xmmword [esp + 0x23c], xmm0
mov dword [esp + 0xec], esi
mov dword [esp + 0xf0], esi
mov dword [esp + 0xf4], esi
call fcn.00401a81
mov dword [esp + 0x34], 0x44bd1a6f
lea ecx, [esp + 0x1dc]
push 4
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], eax
jmp 0x403b53
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x168]
mov dword [ecx + edx*4], 0x2124f84b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x403b3d
xor edx, edx
mov dword [esp + 0x18], eax
inc edx
jmp 0x403b71
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x98], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x403b62
mov dword [esp + 0x18], eax
jmp 0x403b90
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1dc]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x403b7d
mov ecx, dword [esp + 0x168]
mov esi, dword [ecx + 4]
mov edi, dword [ecx]
xor ecx, ecx
cmp esi, edi
setne cl
xor edx, edx
cmp esi, ecx
setle dl
xor ecx, ecx
cmp edx, 0x591b68de
setle cl
dec ecx
add ecx, esi
je 0x403bcc
test edi, edi
je 0x403bcc
xor edi, edi
inc edi
mov eax, edi
jmp 0x403bcf
xor edi, edi
inc edi
mov dword [esp + 0x98], eax
lea ecx, [esp + 0x1dc]
inc dword [esp + 0x30]
call fcn.00401a1f
lea ecx, [esp + 0xdc]
call fcn.00401a1f
lea ecx, [esp + 0x168]
call fcn.00401a1f
mov dword [esp + 0x10], 0xa149cec7
lea ecx, [esp + 0xf4]
mov dword [esp + 0x14], 0x1658a600
mov dword [esp + 0x2c], 0x45beac3e
push edi
call fcn.0040194d
mov dword [esp + 0x28], 4
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 0xe61175c8
push 3
mov dword [esp + 0x24], 0x69e1d621
mov dword [esp + 0x1c], eax
pop esi
jmp 0x403c5d
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x1f0], 0xca3c0bf9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x403c4a
mov dword [esp + 0x18], eax
jmp 0x403c7f
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xf4]
mov dword [ecx + edx*4], 0x3b03c3fa
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x403c69
mov dword [esp + 0x18], eax
jmp 0x403c9e
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x90], 0x78dfce24
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x403c8b
mov ecx, dword [esp + 0x14]
inc dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
inc dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
imul ecx, dword [esp + 0x94]
dec dword [esp + 0x94]
test ecx, ecx
jne 0x403cd6
mov edx, eax
cmp dword [esp + 0x94], eax
je 0x403cd8
mov edx, edi
mov dword [esp + 0x30], edi
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0xf4]
mov dword [esp + 0x1f0], edx
mov dword [esp + 0x30], edx
xor edx, edx
cmp dword [ecx], eax
sete dl
xor ebx, ebx
imul ecx, edx, 0x7afc
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x30]
cmp ecx, edx
mov ecx, dword [esp + 0x10]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0x28]
setg dl
xor ebx, ebx
cmp edx, ecx
setle bl
add ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0xf4]
add ebx, dword [ecx]
xor ecx, ecx
cmp ebx, 0x74484a86
setl cl
mov dword [esp + 0x10], ecx
mov dword [esp + 0x20], eax
jmp 0x403d61
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1f0], 0x293e35f2
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x403d4e
lea ecx, [esp + 0xf4]
call fcn.00401a1f
push dword [esp + 0x50]
movdqa xmm0, xmmword [0xa76f90]
lea eax, [esp + 0x230]
push eax
xor esi, esi
lea eax, [esp + 0x224]
push eax
push esi
lea ecx, [esp + 0x80]
mov dword [esp + 0x80], esi
movdqu xmmword [esp + 0x22c], xmm0
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], esi
call fcn.00401a81
mov dword [esp + 0x20], 4
xor eax, eax
mov dword [esp + 0x10], 0x979cd329
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x44], 0xfffffffc
push 3
pop esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], 0x3a1a91f1
mov dword [esp + 0x30], 0xbc8977b4
mov dword [esp + 0x2c], eax
jmp 0x403e0e
mov ecx, dword [esp + 0x2c]
mov dword [esp + ecx*4 + 0xbc], 0x262954f6
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], edi
jl 0x403dfb
mov ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, 0xebf495e3
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, 0xd8b9
setne dl
sub edx, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
cmp edx, ecx
setle bl
xor ecx, ecx
cmp ebx, 0xe52d
setne cl
sub ecx, dword [esp + 0x20]
cmp ecx, 0x2a43
jle 0x403e6e
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], eax
jne 0x403ea5
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x404017
push 0xf2b
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x404015
push esi
lea ecx, [esp + 0xc4]
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x403ed0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc0]
mov dword [ecx + edx*4], 0x79cc099a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x403eba
push 2
mov dword [esp + 0x14], eax
pop ebx
jmp 0x403ef2
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x23c], 0x15e1b460
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x403edf
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
jg 0x403ff7
mov ecx, 0x49f0dc4b
mov dword [esp + 0x2c], 0x7eb23672
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], ecx
mov dword [esp + 0x11c], ecx
mov dword [esp + 0x120], ecx
mov dword [esp + 0x14], 0x22cbd4da
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0xc0]
mov edx, dword [edx + esi*4]
mov esi, dword [esp + 0x10]
sub edx, ecx
mov ecx, dword [esp + 0xc0]
add esi, edx
mov ecx, dword [ecx]
neg ecx
sub esi, ecx
neg esi
sbb esi, esi
inc esi
cmp esi, dword [esp + 0x2c]
je 0x403f75
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc0]
xor edx, edx
mov dword [esp + 0x120], edi
cmp dword [ecx], edi
setg dl
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], eax
jl 0x403fe4
mov dword [esp + 0x2c], eax
jmp 0x403fb1
mov ecx, dword [esp + 0x2c]
mov dword [esp + ecx*4 + 0x244], 0xfffffffd
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 4
jl 0x403f9e
mov dword [esp + 0x14], eax
jmp 0x403fd4
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x118]
mov dword [esp + 0x24c], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x403fbe
dec dword [esp + 0x28]
dec dword [esp + 0x18]
jns 0x403f98
inc dword [esp + 0x10]
mov ecx, 0x49f0dc4b
cmp dword [esp + 0x10], ebx
jle 0x403f0b
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x404009
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc0]
call fcn.00401a1f
xor eax, eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
imul edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
sub ecx, edx
jne 0x404034
mov ecx, eax
cmp dword [esp + 0x30], eax
je 0x404036
mov ecx, edi
add ecx, 6
mov dword [esp + 0xbc], ecx
je 0x404046
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], edi
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
imul ecx, dword [esp + 0x20]
sub ecx, 9
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x28], edi
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x2c], eax
jmp 0x404090
mov ecx, dword [esp + 0x2c]
mov dword [esp + ecx*4 + 0x6c], 0xfffffffb
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], edi
jl 0x404080
mov dword [esp + 0x28], eax
jmp 0x4041e8
mov dword [esp + 0x10], 0x53aa9ac7
mov dword [esp + 0x10], eax
jmp 0x4041d9
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x2c], 0xc657e3b6
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], eax
jl 0x4041d5
mov dword [esp + 0x20], 0x6dad816f
xor edx, edx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*4 + 0x6c]
test ecx, ecx
sete dl
xor ebx, ebx
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
mov ecx, dword [esp + 0x34]
setge bl
sub ecx, ebx
cmp ecx, edi
jle 0x404106
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov edx, edi
dec dword [esp + 0x20]
xor ebx, ebx
mov ecx, dword [esp + 0x10]
sub edx, ecx
add edx, dword [esp + 0x20]
cmp edx, 0xffffffff
setg bl
xor ecx, ecx
cmp ebx, 0x6f62939
setge cl
cmp ecx, 0x1058
jge 0x40413d
mov esi, edi
cmp dword [esp + 0x10], eax
jne 0x40413f
mov esi, eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + ecx*4 + 0x6c]
mov ecx, dword [esp + 0x10]
sub esi, ecx
xor ecx, ecx
cmp esi, edx
setg cl
sub ecx, 0x1defcecb
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x2c], 0xfffffff3
jmp 0x4041c4
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x404187
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
xor eax, eax
mov dword [esp + 0x20], 0xfffffffd
jmp 0x4041b9
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4041b5
push 0x1ecb
push 0x15a3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
xor eax, eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 6
jne 0x404191
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0x16
jg 0x40416d
dec dword [esp + 0x14]
jns 0x4040ce
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1a
jle 0x4040b0
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xffffffff
je 0x40409f
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 3
jg 0x404745
mov edi, dword [esp + 0x70]
mov dword [esp + 0x14], 0xdce9
mov dword [esp + 0x10], 0x304b25b3
push 2
mov dword [esp + 0x24], 0x84902314
mov dword [esp + 0x30], eax
pop ebx
jmp 0x40423a
mov ecx, dword [esp + 0x2c]
mov dword [esp + ecx*4 + 0x1d4], 0x2c593c86
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], ebx
jl 0x404227
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x10], eax
jne 0x404283
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
add ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x14]
jne 0x404270
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jne 0x404283
cmp dword [esp + 0x14], eax
jne 0x404283
xor edx, edx
mov ecx, eax
inc edx
jmp 0x404288
xor edx, edx
inc edx
mov ecx, edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x20], 0xfffffffc
jmp 0x4042b5
mov dword [esp + 0x10], eax
jmp 0x4042ab
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x1d4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x40429c
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffff8
jl 0x404296
mov dword [esp + 0x38], 0xe779066
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x34], edx
mov dword [esp + 0x34], eax
push 3
pop ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x34], 7
push ecx
mov dword [esp + 0x38], 0x44555950
lea ecx, [esp + 0x19c]
mov dword [esp + 0x38], 0xfffffff7
call fcn.0040194d
xor esi, esi
mov dword [esp + 0x10], esi
jmp 0x40431f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x254], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x40430c
mov dword [esp + 0x10], esi
jmp 0x404341
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x198]
mov dword [eax + ecx*4], 0xfd9e2a8d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x40432b
mov eax, dword [esp + 0x198]
lea ecx, [esp + 0x198]
dec dword [eax]
mov dword [esp + 0x34], 0x3582f80c
call fcn.00401a1f
push 3
lea ecx, [esp + 0x154]
call fcn.0040194d
mov eax, 0xffff
mov dword [esp + 0x20], 0x24a8c6a5
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x180]
mov dword [esp + 0x3c], 0x9f5fa318
push ebx
call fcn.0040194d
xor eax, eax
xor esi, esi
mov dword [esp + 0x30], eax
inc esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x14], 0x5ee56e31
mov dword [esp + 0x28], eax
mov dword [esp + 0x34], 0x3aa9c1c7
mov dword [esp + 0x2c], eax
jmp 0x4043d3
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x180]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], ebx
jl 0x4043c0
mov dword [esp + 0x20], eax
jmp 0x4043fd
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4043f9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor eax, eax
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffe7
jl 0x4043df
cmp dword [esp + 0x20], eax
jne 0x40442a
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
inc dword [esp + 0x28]
cmp dword [esp + 0x3c], eax
jne 0x404424
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x30], eax
je 0x40442c
mov eax, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, 0xffff
cmp dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setg dl
xor ecx, ecx
cmp edx, 0xfffffff9
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x3c]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [esp + 0x34]
setg bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [esp + 0x180]
setle cl
cmp esi, ecx
sbb edx, edx
neg edx
sub edx, dword [eax + 4]
mov eax, dword [esp + 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
add ecx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x180]
call fcn.00401a1f
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4044c1
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x4c], 0xa955a63a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x4044b1
mov dword [esp + 0x28], 0x38a1f949
mov dword [esp + 0x30], 0xf6e229ed
mov dword [esp + 0x20], 0x66bc657e
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0x70e7ad53
cmp dword [esp + 0x28], eax
jne 0x404597
mov ecx, dword [esp + 0x28]
sub ecx, 5
mov dword [esp + 0x30], ecx
jne 0x40450a
cmp dword [esp + 0x30], eax
jne 0x40450a
mov esi, eax
mov ecx, dword [esp + 0x28]
xor edx, edx
cmp esi, ecx
setl dl
xor ebx, ebx
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x20]
cmp ecx, 0x6f9b
mov ecx, dword [esp + 0x28]
setl bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
sub ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x28]
neg ecx
sbb ecx, ecx
inc ecx
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0xfc65
setg cl
sub ecx, 4
jne 0x40456c
cmp dword [esp + 0x20], eax
jne 0x40456c
xor esi, esi
mov edx, eax
inc esi
jmp 0x404571
xor esi, esi
inc esi
mov edx, esi
mov ecx, dword [esp + 0x28]
imul ecx, edx
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], eax
jne 0x404597
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x4045ab
mov dword [esp + 0x34], 0xfffffff7
mov dword [esp + 0x3c], 0x84edc02
inc dword [esp + 0x3c]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0x19
jg 0x40466c
push 2
pop ebx
mov dword [esp + 0x2c], eax
jmp 0x4045d2
mov ecx, dword [esp + 0x2c]
mov dword [esp + ecx*4 + 0x25c], esi
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 3
jl 0x4045c3
mov dword [esp + 0x10], eax
jmp 0x4045f8
mov dword [esp + 0x10], eax
jmp 0x404688
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x150]
mov dword [ecx + edx*4], 8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x404672
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x70]
cmp dword [ecx + edx*4], eax
je 0x4046a6
lea ecx, [esp + 0x70]
call fcn.00401a1f
mov dword [esp + 0x28], 0x69fdf99f
lea ecx, [esp + 0x174]
mov dword [esp + 0x38], 0x2ea21e1d
mov dword [esp + 0x2c], 0xf4e1c2e9
mov dword [esp + 0x3c], 0xfffffffb
mov dword [esp + 0x34], 0xffffffff
push 3
call fcn.0040194d
xor esi, esi
mov dword [esp + 0x10], esi
jmp 0x40479e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x40478c
mov dword [esp + 0x10], esi
jmp 0x4047ba
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1e8], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x4047ab
mov dword [esp + 0x28], esi
cmp dword [esp + 0x28], 0xfffffff0
jne 0x404942
mov edi, dword [esp + 0x174]
mov dword [esp + 0x20], 0xfffffff7
lea ecx, [esp + 0x15c]
mov dword [esp + 0x14], esi
push 2
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x2c], eax
jmp 0x40480c
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x15c]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 2
jl 0x4047f9
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x404845
push 0x11fe
push eax
push eax
push 0x193a
push 0x8b3
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor eax, eax
mov ecx, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
cmp edx, ecx
setl bl
mov dword [esp + 0x2c], ebx
mov ecx, dword [esp + 0x2c]
cmp ecx, dword [esp + 0x14]
jge 0x40487f
cmp dword [esp + 0x20], eax
je 0x40487f
xor esi, esi
inc esi
mov ecx, esi
jmp 0x404884
xor esi, esi
mov ecx, eax
inc esi
xor ebx, ebx
cmp ecx, 2
mov ecx, dword [esp + 0x14]
setg bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ebx, ebx
cmp edx, 0x7142b622
setle bl
xor edx, edx
add ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
cmp ebx, ecx
setne dl
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], eax
jne 0x4048c3
mov edx, eax
cmp dword [esp + 0x20], eax
je 0x4048c5
mov edx, esi
mov ecx, dword [esp + 0x3c]
sub edx, ecx
inc edx
jne 0x4048d2
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x34], 0xffffffff
jl 0x4048f1
mov edx, esi
cmp dword [esp + 0x2c], eax
jne 0x4048f3
mov edx, eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x15c]
lea ecx, [esp + 0x15c]
setle dl
mov dword [eax + 4], edx
xor eax, eax
cmp edx, esi
mov dword [edi + 4], edx
setle al
mov dword [esp + 0x1e8], eax
call fcn.00401a1f
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xfffffff0
push 0
pop esi
je 0x4047d7
lea ecx, [esp + 0x174]
call fcn.00401a1f
mov eax, dword [esp + 0xa8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret