Function at 0x43a298
Capabilities:
Accept command line arguments
Create process on windows
Delete registry key
Get disk information
Get file system object information
Get graphical window text
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc48
xor eax, eax
mov byte [ebp - 0x65], dl
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0x2b79dc86
mov dword [ebp - 0x24], 0x4656e2e3
mov dword [ebp - 0x1c], 5
push ebx
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
push esi
push edi
mov dword [ebp - 0x6c], ecx
jge 0x43a2ed
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x16c], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x43a2d4
xor eax, eax
push 3
pop ebx
push 2
pop esi
push 1
mov dword [ebp - 0x28], eax
pop edi
jmp 0x43a3f8
mov dword [ebp - 0x10], 0xa772304b
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x43a3b3
push esi
lea ecx, [ebp - 0x49c]
call fcn.00416ef7
xor eax, eax
mov dword [ebp - 0x3c], 0xcedb7758
mov dword [ebp - 8], eax
jmp 0x43a33e
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x49c]
mov dword [eax + ecx*4], 0xc0272a72
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43a32b
mov ecx, dword [ebp - 0x49c]
mov dword [ecx + 4], ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x16c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x16c]
xor eax, eax
cmp dword [ecx + 4], eax
jne 0x43a36a
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x16c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x164]
dec dword [ecx + 4]
mov dword [ebp - 0x3c], edi
jns 0x43a34c
mov dword [ebp - 0x2c], 0xfffffff9
lea ecx, [ebp - 0x49c]
call fcn.00417267
dec dword [ebp - 0x10]
jns 0x43a311
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x43a3c5
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43a3f5
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x43a3f3
mov dword [ebp - 0x3c], 5
cmp dword [ebp - 0x3c], eax
je 0x43a3d9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
jmp 0x43a3f3
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43a3f5
push 0x2230
push 0x12a3
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x43a2fe
mov eax, dword [ebp - 0x160]
xor edx, edx
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x168]
push ebx
sub ecx, eax
mov eax, dword [ebp - 0x164]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x24]
dec eax
cmp eax, 6
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
lea ecx, [ebp - 0x604]
setge dl
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x1c], 0xced8f6ef
mov dword [ebp - 0x14], 0xe9c96c79
mov dword [ebp - 0x1c], 0xffffffff
call fcn.00416ef7
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x43a4b7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x45c], 0x9e923e64
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x43a49f
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x43a4d5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x604]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x43a4bf
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x43a4f5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x274], 0x388a0193
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x43a4dd
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x43a506
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x604]
cmp dword [eax + 8], edi
sete cl
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x604]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x274], eax
call fcn.00417267
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], 0xf6cbcb1a
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x1c], 0x846c8c5c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x43a580
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, edi
setl cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
sub eax, 0x90ae7359
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x28]
jl 0x43a5a8
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x43a5aa
mov ecx, edi
mov eax, dword [ebp - 0x28]
sub ecx, eax
je 0x43a67b
xor eax, eax
mov dword [ebp - 0x34], 0x3fa3
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x2d
jg 0x43a710
push esi
lea ecx, [ebp - 0x41c]
call fcn.00416ef7
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x43a5fb
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x41c]
mov dword [eax + ecx*4], 0xb136
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43a5e1
xor eax, eax
mov dword [ebp - 0x18], 0xfffffff5
jmp 0x43a648
mov dword [ebp - 8], eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x43a627
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x8d0], 0x540f213e
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x43a60f
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x43a63c
mov eax, dword [ebp - 0x41c]
inc dword [eax]
dec dword [ebp - 8]
jns 0x43a62f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], 0xfffffff7
jle 0x43a604
cmp dword [ebp - 0x18], 0
lea ecx, [ebp - 0x41c]
jne 0x43a671
call fcn.00417267
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x2d
jle 0x43a5cb
jmp 0x43a70e
call fcn.00417267
jmp 0x43a70e
mov dword [ebp - 0x1c], 0xb2b0
xor eax, eax
mov dword [ebp - 8], 0xfffffff7
cmp dword [ebp - 0x28], eax
je 0x43a6c5
cmp dword [ebp - 8], eax
jne 0x43a6b3
mov eax, dword [ebp - 0x18]
sub eax, 0xd71021f5
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
sub eax, 0xa
mov dword [ebp - 0x18], eax
jne 0x43a6b3
xor eax, eax
mov ecx, eax
jmp 0x43a6b5
mov ecx, edi
mov eax, dword [ebp - 0x1c]
sub ecx, eax
cmp ecx, dword [ebp - 8]
jle 0x43a6c3
mov edx, edi
jmp 0x43a6c7
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setg cl
cmp ecx, dword [ebp - 0x28]
jne 0x43a6fd
mov byte [ebp - 0x1d], 0
cmp byte [ebp - 0x1d], 0
je 0x43a70e
push 0x1cd9
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x43a70e
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x43a70e
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor eax, eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x434]
push esi
call fcn.00416ef7
mov dword [ebp - 0x14], edi
xor eax, eax
mov dword [ebp - 0x3c], 0xbc99
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x43a74b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4b4], 0x24a8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x43a733
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x43a76d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x434]
mov dword [eax + ecx*4], 0x6ce125d1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x43a753
xor eax, eax
mov esi, dword [ebp - 0x434]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
inc dword [esi + 4]
mov dword [ebp + eax*4 - 0x4b4], 0
cmp dword [esi + 4], ebx
jl 0x43a776
mov dword [ebp - 0x14], 0x19
jmp 0x43a882
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x6e0], eax
mov dword [ebp - 0x6dc], eax
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x10]
imul ecx, eax, 0xde46
mov eax, dword [ebp - 0x434]
cmp ecx, dword [eax]
jne 0x43a7e0
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x43a7e2
mov eax, edi
jmp 0x43a7e2
xor eax, eax
add eax, dword [esi + 4]
xor ebx, ebx
cmp eax, dword [esi + 4]
setle bl
sub ebx, 0x54981c58
neg ebx
sbb ebx, ebx
add ebx, 0x43dc315f
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
add ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp ebx, eax
setg dl
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4b4]
setle cl
imul eax, dword [ebp - 0x4b0]
cmp eax, ecx
jge 0x43a851
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x43a853
mov ecx, edi
jmp 0x43a855
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x10]
imul eax, ecx
xor ecx, ecx
cmp eax, 0xae45
setg cl
lea edx, [ecx - 0x264d9248]
xor ecx, ecx
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setl cl
mov dword [ebp - 0x6dc], ecx
dec dword [ebp - 0x14]
push 0xfffffffffffffffd
pop eax
cmp dword [ebp - 0x14], eax
jge 0x43a798
lea ecx, [ebp - 0x434]
call fcn.00417267
movdqa xmm0, xmmword [0xaaf870]
lea ecx, [ebp - 0x904]
push ecx
lea eax, [ebp - 0x8f4]
mov dword [ebp - 0x10], 0x2b79dc86
push eax
push ecx
mov dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 0xaa8]
movdqu xmmword [ebp - 0x904], xmm0
call fcn.00416f6a
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x43a8e9
push eax
push 0x1225
call dword [sym.imp.USER32.dll_ClientToScreen]
xor eax, eax
push 3
mov dword [ebp - 8], 0xffffffec
pop esi
cmp dword [ebp - 8], 0xffffffe2
jle 0x43a92e
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x43a929
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43a924
push eax
push 0x3ff
push 0x108c
call dword [sym.imp.GDI32.dll_CreatePen]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x43a908
dec dword [ebp - 8]
jmp 0x43a8f3
lea ecx, [ebp - 0xaa8]
call fcn.00417267
mov dword [ebp - 0x44], 0x4656e2e3
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x34], 0x8f3c34ee
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x14], 0xf
jmp 0x43a98e
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x43a988
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xac8], 0x68c0aa39
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x43a96f
xor eax, eax
inc dword [ebp - 0x1c]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jg 0x43a95f
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x780], eax
mov dword [ebp - 0x77c], eax
mov dword [ebp - 0x778], eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x780], eax
je 0x43aa07
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x3c], 0xa6e6f7fb
mov dword [ebp - 0x14], 0xffffffe4
cmp dword [ebp - 0x14], 0x16
je 0x43a9f0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
jne 0x43a9d9
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43aa5e
push eax
push 0x181f
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
jmp 0x43aa5e
push 4
lea ecx, [ebp - 0x670]
call fcn.00416ef7
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x43aa2a
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x670]
mov dword [eax + ecx*4], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x43aa1b
mov eax, dword [ebp - 0x670]
mov dword [eax + 0xc], 0x15
mov dword [ebp - 0x3c], 0x249a
cmp dword [ebp - 0x3c], 0
jne 0x43aa53
dec dword [eax + 0xc]
cmp dword [eax + 0xc], 0xe
jne 0x43aa3d
lea ecx, [ebp - 0x670]
call fcn.00417267
mov dword [ebp - 0x3c], 0xffffffff
lea ecx, [ebp - 0x98]
push esi
call fcn.00416ef7
mov dword [ebp - 0x28], 0xffffffff
xor eax, eax
mov dword [ebp - 0x3c], 0x11f64db2
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x43aaa3
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x98]
mov dword [eax + ecx*4], 0xff0ea75c
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43aa89
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43aac4
push eax
push 0x175
push 0x22d4
push 0xd9e
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], eax
jl 0x43acad
push edi
lea ecx, [ebp - 0x150]
call fcn.00416ef7
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x43aafa
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0xf72d4ea6
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x43aae7
mov eax, dword [ebp - 0x150]
mov dword [eax], 2
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jge 0x43ab26
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x5c], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x43ab15
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43ab39
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor eax, eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jg 0x43ac00
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x5c]
mov ebx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x150]
push 9
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
sub ecx, dword [eax + edx*4]
xor eax, eax
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x98]
add edx, ecx
pop ecx
imul edx, dword [esi + edi*4]
cmp edx, ecx
mov ecx, dword [ebp - 0x3c]
setl al
mov ecx, dword [ecx + 8]
sub ecx, eax
mov eax, dword [ebp - 0x150]
sub ecx, dword [eax]
cmp ecx, dword [esi + ebx*4]
jg 0x43abaf
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x98]
cmp dword [eax + ecx*4], 0
jne 0x43abaf
xor eax, eax
mov edx, eax
jmp 0x43abb2
xor edx, edx
inc edx
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
mov edi, dword [ebp - 0x5c]
mov ebx, dword [ebp - 0x5c]
mov esi, dword [ebp - 0x98]
push 9
cmp edx, dword [esi + eax*4]
pop eax
setge cl
cmp eax, ecx
mov eax, dword [ebp - 0x5c]
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [esi + edi*4]
cmp edx, eax
mov eax, dword [ebp - 0x98]
setl cl
mov dword [eax + ebx*4], ecx
mov eax, dword [ebp - 0x150]
cmp dword [eax], 0
jne 0x43ac06
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 2
jle 0x43ab4f
mov eax, dword [ebp - 0x150]
dec dword [eax]
push 1
pop edi
jns 0x43ab0b
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x150]
cmp eax, dword [ecx]
setne dl
mov dword [ecx], edx
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
lea eax, [edx - 0xd6ba]
mov edi, dword [ebp - 0x98]
xor edx, edx
cmp eax, dword [edi + ecx*4]
setg dl
xor ecx, ecx
cmp dword [edi + esi*4], edx
sete cl
xor eax, eax
cmp ecx, dword [edi + ebx*4]
setge al
cmp eax, dword [edi]
je 0x43ac74
mov eax, dword [ebp - 0x150]
cmp dword [eax], 0
jne 0x43ac74
xor eax, eax
xor edi, edi
mov esi, eax
inc edi
jmp 0x43ac79
xor edi, edi
inc edi
mov esi, edi
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x98]
mov eax, dword [ecx + eax*4]
sub eax, esi
add eax, 0x1f0ef2ed
imul eax, dword [ecx + edx*4]
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x3c], eax
call fcn.00417267
dec dword [ebp - 0x28]
jns 0x43aad4
push 3
pop esi
lea ecx, [ebp - 0x98]
call fcn.00417267
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x43acdc
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x18c], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x43acc3
xor eax, eax
mov dword [ebp - 0x14], 5
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x43acff
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb40], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43aceb
xor eax, eax
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], eax
jl 0x43ad4f
mov dword [ebp - 8], 0xede0b407
mov dword [ebp - 8], eax
jmp 0x43ad44
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43ad41
push 0x10c7
push 0x9e0
push 0x21e3
push 0x782
push 0x1b8a
call dword [sym.imp.GDI32.dll_Ellipse]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x43ad17
dec dword [ebp - 0x14]
jns 0x43ad0b
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
jg 0x43b9fb
mov dword [ebp - 0x28], 0x82062403
push 0xfffffffffffffff9
pop ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff1
jge 0x43aeff
mov dword [ebp - 0x3c], 0x60d2f38
mov dword [ebp - 0x14], 5
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], 0xa277ebd0
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x18], 0xac77
mov dword [ebp - 8], eax
jmp 0x43adcf
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x74], 0x9ab5c294
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x43adc1
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x30]
je 0x43ae11
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, 2
setg cl
mov dword [ebp - 0x1e0], ecx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], 0x25f8
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 8], eax
jl 0x43aeb6
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 8], 0xfffffffe
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0x90c37c50
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 8]
test eax, eax
je 0x43ae99
xor eax, eax
cmp dword [ebp - 0x1dc], eax
je 0x43ae9b
mov ecx, edi
jmp 0x43ae9d
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
jmp 0x43aeed
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x18], 0
jne 0x43aefd
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff1
push 0
pop eax
jl 0x43ad97
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43af1a
push 0xf0a
push 0x1023
call dword [sym.imp.GDI32.dll_RestoreDC]
xor eax, eax
mov dword [ebp - 0x28], 0xa772304b
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x43af4a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xba4], 0x82062403
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x43af31
xor eax, eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x43af68
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43af63
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x43af52
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x43b3a1
mov dword [ebp - 0x14], 0x13dd33a4
mov dword [ebp - 0x14], 0xffffffe3
jmp 0x43afcf
mov dword [ebp - 8], edi
mov dword [ebp - 8], 0xfffffff3
jmp 0x43afc6
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43afb1
push eax
push eax
push eax
push 0x91e
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43afc3
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffed
jl 0x43af98
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x43af8c
push 2
lea ecx, [ebp - 0x4e4]
call fcn.00416ef7
mov dword [ebp - 0x3c], 0xcedb7758
xor eax, eax
mov dword [ebp - 0x18], 0xae97
inc dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2a
jge 0x43b0a0
mov dword [ebp - 0x1c], 5
lea ecx, [ebp - 0x4cc]
push esi
call fcn.00416ef7
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x43b034
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x4cc]
mov dword [eax + ecx*4], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43b01e
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43b045
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
xor ecx, ecx
cmp edx, edi
setle cl
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4cc]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x4cc]
call fcn.00417267
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x2a
jl 0x43b001
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x43b0b8
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x4e4]
mov dword [eax + ecx*4], 0xc0272a72
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x43b0a5
mov edi, dword [ebp - 0x4e4]
xor ebx, ebx
inc ebx
mov dword [edi + 4], esi
push 2
lea ecx, [ebp - 0x428]
call fcn.00416ef7
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 0x3c], 0xbc99
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x43b103
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x61c], 0x24a8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x43b0eb
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x43b127
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x428]
mov dword [eax + ecx*4], 0x6ce125d1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x43b10c
xor eax, eax
mov esi, dword [ebp - 0x428]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
inc dword [esi + 4]
cmp dword [esi + 4], 3
mov dword [ebp + eax*4 - 0x61c], 0
jl 0x43b130
mov dword [ebp - 0x14], 0x19
jmp 0x43b243
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x720], eax
mov dword [ebp - 0x71c], eax
mov dword [ebp - 0x718], eax
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x10]
imul ecx, eax, 0xde46
mov eax, dword [ebp - 0x428]
cmp ecx, dword [eax]
jne 0x43b19b
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x43b19d
mov eax, ebx
jmp 0x43b19d
xor eax, eax
add eax, dword [esi + 4]
xor ebx, ebx
cmp eax, dword [esi + 4]
setle bl
sub ebx, 0x54981c58
neg ebx
sbb ebx, ebx
add ebx, 0x43dc315f
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
add ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp ebx, eax
setg dl
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x61c]
setle cl
imul eax, dword [ebp - 0x618]
cmp eax, ecx
jge 0x43b20f
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x43b211
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x43b216
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x10]
imul eax, ecx
xor ecx, ecx
cmp eax, 0xae45
setg cl
lea edx, [ecx - 0x264d9248]
xor ecx, ecx
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setl cl
mov dword [ebp - 0x71c], ecx
dec dword [ebp - 0x14]
push 0xfffffffffffffffd
pop eax
cmp dword [ebp - 0x14], eax
jge 0x43b153
lea ecx, [ebp - 0x428]
call fcn.00417267
mov dword [ebp - 0x24], 0x2263126f
xor eax, eax
mov dword [ebp - 0x14], 0x18e9
mov dword [ebp - 0x1c], 0x89bdd777
mov dword [ebp - 8], 4
mov dword [ebp - 0x3c], 0x5ab4d258
mov dword [ebp - 8], eax
jmp 0x43b295
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1e8], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x43b284
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1e4], ebx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x1e4]
sub edx, eax
mov dword [ebp - 0x1e4], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
setle cl
sub edx, ecx
neg edx
sbb edx, edx
inc eax
inc edx
add eax, edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x18c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x18c]
xor eax, eax
cmp dword [edi + 4], eax
jne 0x43b305
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
push 3
pop esi
mov eax, dword [ebp + eax*4 - 0x18c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x184]
dec dword [edi + 4]
mov dword [ebp - 0x3c], ebx
jns 0x43b0ca
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0xa876e6ba
mov dword [ebp - 0x34], 0x444696a4
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x43b37e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb70], 0xbeb7161a
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43b366
xor eax, eax
dec dword [ebp - 0x24]
lea ecx, [ebp - 0x4e4]
push 0xfffffffffffffff9
pop ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], ebx
call fcn.00417267
dec dword [ebp - 0x28]
push 0
pop eax
jns 0x43af7c
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x3c], 0x2466e9f0
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43b3c1
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffffa
jle 0x43b476
push esi
lea ecx, [ebp - 0x478]
call fcn.00416ef7
mov dword [ebp - 0x24], 0x8cf4c59c
xor eax, eax
mov dword [ebp - 0x1c], 0x7f4ea14c
mov dword [ebp - 0x24], 0xe13f5e3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x43b413
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x478]
mov dword [eax + ecx*4], 0x64dc
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43b3f9
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x43b424
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edi
xor eax, eax
cmp dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x478]
jne 0x43b442
cmp dword [ecx + 4], eax
je 0x43b444
mov eax, edi
xor edx, edx
cmp dword [ecx + 4], eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x478]
call fcn.00417267
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffa
jg 0x43b3ce
xor eax, eax
push 2
cmp dword [ebp - 0x28], eax
je 0x43b612
mov dword [ebp - 0x1c], 0x5546
lea ecx, [ebp - 0x4fc]
mov dword [ebp - 0x24], edi
call fcn.00416ef7
mov dword [ebp - 0x24], 0x1162f630
lea ecx, [ebp - 0x688]
push esi
call fcn.00416ef7
xor eax, eax
mov dword [ebp - 0x3c], 0x21c9b6cd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x43b4d4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2ac], 0xfffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x43b4bb
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x43b4f8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4fc]
mov dword [eax + ecx*4], 0x27359b50
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x43b4dd
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x43b51a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x688]
mov dword [eax + ecx*4], 0xabb75da2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x43b500
xor eax, eax
mov dword [ebp - 0x24], eax
or ecx, 0xffffffff
mov eax, dword [ebp - 0x24]
sub ecx, eax
add ecx, dword [ebp - 0x1c]
xor eax, eax
cmp ecx, 0x4c38b6b0
mov ecx, 0xdc2a82a1
setg al
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x4fc]
cmp ecx, dword [eax]
setne dl
xor ebx, ebx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], ebx
je 0x43b554
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2ac]
dec dword [ebp - 0x2ac]
mov eax, dword [ebp - 0x688]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
lea eax, [eax + ecx*2]
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x688]
call fcn.00417267
lea ecx, [ebp - 0x4fc]
call fcn.00417267
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x43b9ec
mov dword [ebp - 0x1c], 0x5c8094a
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0x6f6dd8d1
mov dword [ebp - 8], ebx
jmp 0x43b5bb
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x85c], 0x9b31
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x43b5aa
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x43b606
push esi
lea ecx, [ebp - 0x634]
call fcn.00416ef7
mov dword [ebp - 8], ebx
jmp 0x43b5e8
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x634]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43b5d9
mov eax, dword [ebp - 0x634]
lea ecx, [ebp - 0x634]
inc dword [eax + 4]
call fcn.00417267
dec dword [ebp - 0x1c]
jns 0x43b5c8
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x43b9ec
mov dword [ebp - 0x2c], 0xffffffff
lea ecx, [ebp - 0x874]
mov dword [ebp - 0x14], eax
call fcn.00416ef7
xor ebx, ebx
mov dword [ebp - 8], ebx
jmp 0x43b63d
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x874]
mov dword [eax + ecx*4], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x43b62e
mov dword [ebp - 0x2c], 0xfffffff4
jmp 0x43b6e1
mov dword [ebp - 0x1c], ebx
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add ecx, 0xf737
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp eax, 0xcc2fdcb
setle cl
sub edx, ecx
je 0x43b6ad
cmp dword [ebp - 0x1c], ebx
jne 0x43b6eb
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x43b6de
push 0x30a
push ebx
push 0xa80
push 0x158
push ebx
push 0x22c9
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
jmp 0x43b6de
mov dword [ebp - 0x24], 0x4ba8b35e
mov dword [ebp - 0x14], ebx
jmp 0x43b6d4
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x43b6cc
push 0x232c
call dword [sym.imp.GDI32.dll_GetStockObject]
cmp dword [ebp - 0x24], ebx
jne 0x43b6eb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x43b6b9
cmp dword [ebp - 0x24], ebx
jne 0x43b6eb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffa
je 0x43b64f
lea ecx, [ebp - 0x874]
call fcn.00417267
mov dword [ebp - 0x3c], 5
cmp dword [ebp - 0x3c], ebx
je 0x43b980
movdqa xmm0, xmmword [0xaaf8f0]
lea ecx, [ebp - 0x944]
push ecx
lea eax, [ebp - 0x934]
push eax
push ecx
lea ecx, [ebp - 0x7b0]
movdqu xmmword [ebp - 0x944], xmm0
call fcn.00416f6a
push 9
mov dword [ebp - 0x2c], 0xdbda7fe6
pop eax
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x10], eax
push 2
mov dword [ebp - 0x3c], 0xdb2097e6
mov dword [ebp - 8], ebx
pop esi
jmp 0x43b764
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x46c], 0xbca6
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43b753
mov ebx, dword [ebp - 0x7b0]
mov dword [ebp - 0x1c], ebx
mov dword [ebx + 8], edi
mov dword [ebp - 0x14], 0xfffffffe
lea ecx, [ebp - 0x240]
push esi
call fcn.00416ef7
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x43b7a2
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x240]
mov dword [eax + ecx*4], 0xed680444
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43b78f
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], edx
jl 0x43b8db
lea eax, [ebp - 0x760]
xor ebx, ebx
lea ecx, [ebp - 0x750]
movdqa xmm0, xmmword [str._b_b_b_b]
push ecx
push ecx
mov dword [ebp - 0x34], 0xfffffffb
lea ecx, [ebp - 0x8e0]
push eax
movdqu xmmword [ebp - 0x760], xmm0
call fcn.00416f6a
mov dword [ebp - 8], ebx
jmp 0x43b7fc
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xad0], 0x245c
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43b7eb
inc dword [ebp - 0x10]
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edi
jg 0x43b8b6
mov dword [ebp - 8], ebx
jmp 0x43b826
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x278], 0xfffffffb
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x43b815
mov eax, dword [ebp - 0x14]
push 4
pop edx
mov dword [ebp + eax*4 - 0x46c], edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x240]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x278], eax
cmp eax, edx
jne 0x43b858
mov edx, edi
cmp dword [ebp - 0x468], ebx
jne 0x43b85a
mov edx, ebx
mov edi, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, edx
mov esi, dword [ebp - 0x8e0]
mov eax, 0xd9964974
setl cl
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xbcab
mov eax, dword [ebp - 0x240]
setg cl
xor edx, edx
cmp dword [esi], ecx
setg dl
xor ecx, ecx
cmp dword [eax + edi*4], edx
setle cl
xor eax, eax
cmp ecx, 0x3b8c
setg al
xor edi, edi
mov dword [esi], eax
inc edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x43b810
push 2
pop esi
lea ecx, [ebp - 0x8e0]
call fcn.00417267
dec dword [ebp - 0x14]
lea eax, [ebp - 0x760]
lea ecx, [ebp - 0x750]
jns 0x43b7c1
mov ebx, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], edi
jg 0x43b956
xor ebx, ebx
push 9
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 8], ebx
jmp 0x43b901
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x8f4], 0xf4a1d2da
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x43b8f0
dec dword [ebp - 0x8f0]
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x240]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x10]
add ecx, 0x76d89b6a
cmp ecx, eax
mov eax, dword [ebp - 0x8f0]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x240]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x43b8e5
mov ebx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x240]
call fcn.00417267
dec dword [ebx + 8]
jns 0x43b775
lea ecx, [ebp - 0x7b0]
call fcn.00417267
mov eax, dword [ebp - 0x38]
push 3
mov dword [ebp - 0x10], eax
pop esi
jmp 0x43b9ec
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x43b9ec
mov dword [ebp - 0x14], 0x13dd33a4
mov dword [ebp - 0x14], 0xffffffe3
jmp 0x43b9d5
mov dword [ebp - 8], edi
mov dword [ebp - 8], 0xfffffff3
jmp 0x43b9cc
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x43b9ba
push ebx
push ebx
push ebx
push 0x91e
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x43b9c9
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffed
jl 0x43b9a4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff9
jle 0x43b998
push 0x2230
push 0x12a3
push ebx
call dword [sym.imp.GDI32.dll_PtInRegion]
inc dword [ebp - 0x38]
push 0
pop eax
cmp dword [ebp - 0x38], esi
jle 0x43ad62
mov dword [ebp - 8], 0x7e2799ac
xor ebx, ebx
mov dword [ebp - 0x24], 0x8872fa4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xa
jl 0x43ba5a
mov dword [ebp - 0x3c], 0x4d2edc75
mov dword [ebp - 0x14], 0xffff
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ebx
jmp 0x43ba4f
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x43ba4c
push 0x24f3
push 0x24c5
push ebx
push 0x1817
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1f
jl 0x43ba2d
inc dword [ebp - 8]
jmp 0x43ba0e
dec dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x188]
movdqa xmm0, xmmword [0xaaf850]
sub ecx, eax
mov eax, dword [ebp - 0x184]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sete dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x180]
mov eax, dword [ebp - 0x188]
mov eax, dword [ebp - 0x44]
dec eax
cmp eax, 6
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x40]
movdqu xmmword [ebp - 0xa44], xmm0
cmp ecx, eax
lea ecx, [ebp - 0xa44]
push ecx
lea eax, [ebp - 0xa34]
setge dl
mov dword [ebp - 0x3c], edx
push eax
mov dword [ebp - 0x18], 0xb1891f78
push ecx
mov dword [ebp - 0x24], 0x6ccb0362
lea ecx, [ebp - 0x7f8]
mov dword [ebp - 0x1c], ebx
call fcn.00416f6a
mov dword [ebp - 0x14], 0x1c443818
mov ecx, 0xa2ff3e14
mov dword [ebp - 0x1c], 0xbf7a
mov dword [ebp - 0x38], 0xe8236511
mov dword [ebp - 8], 0xa4045238
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x18], ebx
je 0x43bb53
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x7f8]
mov dword [eax + 4], ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
je 0x43bb50
cmp dword [ebp - 0x18], ebx
je 0x43bb50
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x18]
imul eax, ecx, 0xfffd
test eax, eax
je 0x43bb8a
mov eax, edi
cmp dword [ebp - 0x18], ebx
jne 0x43bb8c
mov eax, ebx
mov dword [ebp - 0x1c], eax
xor edx, edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setle dl
imul edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, 0x2502870b
add eax, edx
je 0x43bbaf
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
imul edx, dword [ebp - 0x38]
test edx, edx
je 0x43bbd1
mov ecx, edi
cmp dword [ebp - 8], ebx
jne 0x43bbd3
mov ecx, ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, ecx
imul eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 8]
je 0x43bc26
mov dword [ebp - 0x14], 0xe
jmp 0x43bc1e
mov dword [ebp - 0x38], ebx
jmp 0x43bc06
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x40], ebx
jne 0x43bc0b
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x43bbfb
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x43bc1b
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 8
jg 0x43bbf6
jmp 0x43bc8a
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 8], ebx
jmp 0x43bc43
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x898], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x43bc32
cmp dword [ebp - 0x14], 0x36352b72
jle 0x43bc55
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
test eax, eax
setns cl
sub ecx, dword [ebp - 0x14]
sub ecx, 0x5f26
neg ecx
sbb ecx, ecx
add ecx, 0xffff8f4a
neg ecx
sbb ecx, ecx
add ecx, 0xffff6a31
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x894], ecx
dec dword [ebp - 0x30]
mov dword [ebp - 0x18], ebx
jmp 0x43bcaf
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x43bcac
push 0x196e
push ebx
push ebx
push ebx
push ebx
push 0xef
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x43bc8f
lea ecx, [ebp - 0x7f8]
call fcn.00417267
mov dword [ebp - 0x34], 0xfffffff7
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x43bcdc
push ebx
push 0x1601
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x43bcec
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
movdqa xmm0, xmmword [0xaaf8e0]
lea ecx, [ebp - 0x964]
push ecx
lea eax, [ebp - 0x954]
push eax
push ecx
lea ecx, [ebp - 0x7c4]
movdqu xmmword [ebp - 0x964], xmm0
call fcn.00416f6a
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x30], ebx
jmp 0x43bd5d
mov dword [ebp - 0x14], 0xfffffffa
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x43bd3c
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov dword [ebp - 0x14], ebx
jmp 0x43bd55
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x7c4]
cmp dword [eax + ecx*4], ebx
jne 0x43bd5a
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x43bd41
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x43bd22
lea ecx, [ebp - 0x7c4]
call fcn.00417267
push edi
lea ecx, [ebp - 0x514]
call fcn.00416ef7
movdqa xmm0, xmmword [0xaaf880]
lea ecx, [ebp - 0x9e4]
push ecx
lea eax, [ebp - 0x9d4]
mov dword [ebp - 0x28], 0xb4ffb87
push eax
push ecx
lea ecx, [ebp - 0xa60]
movdqu xmmword [ebp - 0x9e4], xmm0
call fcn.00416f6a
mov dword [ebp - 8], ebx
jmp 0x43bdc2
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x514]
mov dword [eax + ecx*4], 0x64a6
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x43bdaf
mov dword [ebp - 0x28], ebx
jmp 0x43bde1
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x514]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x43bdcc
mov dword [ebp - 0x28], ebx
jmp 0x43be03
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x44], edi
mov eax, dword [ebp - 0x40]
add eax, 0x85c
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffeb
jl 0x43bdeb
lea ecx, [ebp - 0xa60]
call fcn.00417267
lea ecx, [ebp - 0x514]
call fcn.00417267
push 4
lea ecx, [ebp - 0x6a0]
call fcn.00416ef7
mov dword [ebp - 0x10], ebx
jmp 0x43be42
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2fc], 0x4504cd45
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x43be31
mov dword [ebp - 0x10], ebx
jmp 0x43be5f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6a0]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x43be4c
mov esi, dword [ebp - 0x6a0]
push 2
pop edx
mov dword [esi + 0xc], ebx
mov dword [ebp - 0x1c], 0xd568d526
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], ebx
jl 0x43beda
mov dword [ebp - 8], edx
mov dword [ebp - 8], ebx
jmp 0x43bebe
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x24], 0xaf072071
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x40], ebx
mov ecx, dword [ebp + eax*4 - 0x2fc]
mov eax, dword [esi + 0xc]
mov dword [ebp + eax*4 - 0x2fc], ecx
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jle 0x43be88
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x43bed5
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 2
pop edx
dec dword [ebp - 0x1c]
jns 0x43be80
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp + eax*4 - 0x2fc]
mov eax, dword [esi + 0xc]
inc dword [esi + 0xc]
mov dword [ebp + eax*4 - 0x2fc], ecx
cmp dword [esi + 0xc], edx
jle 0x43be71
lea ecx, [ebp - 0x6a0]
call fcn.00417267
push 3
pop esi
push esi
lea ecx, [ebp - 0xbc]
call fcn.00416ef7
mov dword [ebp - 0x14], 0xad313dd3
lea ecx, [ebp - 0x3ec]
mov dword [ebp - 0x30], 0x90f1
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], 0x4b2ab76d
mov dword [ebp - 0x40], 0x24ce5545
push 4
call fcn.00416ef7
mov dword [ebp - 0x44], 5
mov dword [ebp - 8], ebx
jmp 0x43bf5f
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x3ec]
mov dword [eax + ecx*4], 0x58528353
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x43bf4c
mov dword [ebp - 0x14], 0x14
cmp dword [ebp - 0x14], 0x1a
jge 0x43c06a
mov edi, dword [ebp - 0x3ec]
mov dword [ebp - 0x24], 0xffffffff
lea ecx, [ebp - 0x52c]
mov dword [ebp - 0x24], 0x735e4b78
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x34], 4
push esi
call fcn.00416ef7
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ebx
jmp 0x43bfcd
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x52c]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43bfba
cmp dword [ebp - 0x30], ebx
jne 0x43bfe8
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
test eax, eax
jne 0x43bfe8
xor ecx, ecx
mov esi, ebx
inc ecx
jmp 0x43bfed
xor ecx, ecx
inc ecx
mov esi, ecx
mov edx, dword [ebp - 0x52c]
mov eax, dword [edx + 4]
dec eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
imul eax, dword [edi + 8]
test eax, eax
jne 0x43c015
cmp dword [ebp - 0x3c], ebx
jne 0x43c015
mov ecx, ebx
xor eax, eax
cmp ecx, 2
setg al
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3ec]
cmp dword [eax], ebx
setle cl
xor eax, eax
cmp esi, ecx
setl al
mov dword [edx + 4], eax
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x43c04c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x52c]
call fcn.00417267
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
push 3
pop esi
jl 0x43bf7c
xor edi, edi
inc edi
lea ecx, [ebp - 0x3ec]
call fcn.00417267
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0xa4]
push esi
call fcn.00416ef7
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x40], 0x11f64db2
mov dword [ebp - 8], ebx
jmp 0x43c0ae
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xa4]
mov dword [eax + ecx*4], 0xff0ea75c
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43c09b
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x43c0d2
push ebx
push 0x175
push 0x22d4
push 0xd9e
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], ebx
jl 0x43c2ab
push edi
lea ecx, [ebp - 0x12c]
call fcn.00416ef7
mov dword [ebp - 8], ebx
jmp 0x43c106
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], 0xf72d4ea6
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x43c0f3
mov eax, dword [ebp - 0x12c]
mov dword [eax], 2
mov dword [ebp - 8], ebx
jmp 0x43c126
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x54], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x43c11c
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x43c13c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x54], ebx
cmp dword [ebp - 0x54], 2
jg 0x43c1ff
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x54]
mov edi, dword [ebp - 0x54]
mov ebx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x12c]
push 9
mov ecx, dword [eax]
mov eax, dword [ebp - 0xa4]
sub ecx, dword [eax + edx*4]
xor eax, eax
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0xa4]
add edx, ecx
pop ecx
imul edx, dword [esi + edi*4]
cmp edx, ecx
mov ecx, dword [ebp - 0x40]
setl al
mov ecx, dword [ecx + 8]
sub ecx, eax
mov eax, dword [ebp - 0x12c]
sub ecx, dword [eax]
cmp ecx, dword [esi + ebx*4]
jg 0x43c1ad
mov ecx, dword [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 0xa4]
cmp dword [eax + ecx*4], edx
je 0x43c1b0
xor edx, edx
inc edx
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov edi, dword [ebp - 0x54]
mov ebx, dword [ebp - 0x54]
mov esi, dword [ebp - 0xa4]
push 9
cmp edx, dword [esi + eax*4]
pop eax
setge cl
cmp eax, ecx
mov eax, dword [ebp - 0x54]
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [esi + edi*4]
cmp edx, eax
mov eax, dword [ebp - 0xa4]
setl cl
mov dword [eax + ebx*4], ecx
xor ebx, ebx
mov eax, dword [ebp - 0x12c]
cmp dword [eax], ebx
jne 0x43c205
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], 2
jle 0x43c152
mov eax, dword [ebp - 0x12c]
dec dword [eax]
push 1
pop edi
jns 0x43c117
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x12c]
cmp eax, dword [ecx]
setne dl
mov dword [ecx], edx
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
lea eax, [edx - 0xd6ba]
mov edi, dword [ebp - 0xa4]
xor edx, edx
cmp eax, dword [edi + ecx*4]
setg dl
xor ecx, ecx
cmp dword [edi + esi*4], edx
sete cl
xor eax, eax
cmp ecx, dword [edi + ebx*4]
setge al
xor ebx, ebx
cmp eax, dword [edi]
je 0x43c272
mov eax, dword [ebp - 0x12c]
cmp dword [eax], ebx
jne 0x43c272
xor edi, edi
mov esi, ebx
inc edi
jmp 0x43c277
xor edi, edi
inc edi
mov esi, edi
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ecx + eax*4]
sub eax, esi
add eax, 0x1f0ef2ed
imul eax, dword [ecx + edx*4]
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x40], eax
call fcn.00417267
dec dword [ebp - 0x28]
jns 0x43c0e2
push 3
pop esi
lea ecx, [ebp - 0xa4]
call fcn.00417267
movdqa xmm0, xmmword [0xaaf890]
lea ecx, [ebp - 0x984]
mov dword [ebp - 0x40], 0x11f64db2
lea eax, [ebp - 0x974]
mov dword [ebp - 0x14], 0x2c29a3df
mov dword [ebp - 0x24], 0xe1dfe009
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], ebx
push ecx
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x204], ebx
push eax
mov dword [ebp - 0x10], 0xfffffff9
push ecx
mov dword [ebp - 0x34], 0xfa55
lea ecx, [ebp - 0xac0]
mov dword [ebp - 8], 0x33ee6768
movdqu xmmword [ebp - 0x984], xmm0
call fcn.00416f6a
mov dword [ebp - 0x10], ebx
jmp 0x43c33b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1b0], 0xf1124f01
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x43c32a
mov dword [ebp - 0x10], ebx
jmp 0x43c356
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc34], 0x6e62
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x43c345
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x43c391
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x43c38c
push 0x1558
push 0x3bb
push 0x59f
push 0x2709
push 0x2077
call dword [sym.imp.GDI32.dll_Rectangle]
dec dword [ebp - 0x14]
jns 0x43c364
mov eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x1b0]
jle 0x43c427
mov dword [ebp - 0x34], 0x83d78398
lea ecx, [ebp - 0x804]
mov dword [ebp - 0x34], 0xb6bc3ec3
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x3773672
mov dword [ebp - 0x34], 0xffffffff
push edi
call fcn.00416ef7
mov dword [ebp - 0x24], 0x7cc7
mov dword [ebp - 0x40], 0xd0e101ea
mov dword [ebp - 0x10], ebx
jmp 0x43c3ee
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbd4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x43c3e1
mov dword [ebp - 0x10], ebx
jmp 0x43c40c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x804]
mov dword [eax + ecx*4], 0x22db785b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x43c3f9
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x804]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
call fcn.00417267
jmp 0x43c49e
mov dword [ebp - 8], ebx
jmp 0x43c43b
mov dword [ebp - 0x40], 0xffff
cmp dword [ebp - 0x40], ebx
jne 0x43c441
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x11
jg 0x43c42c
mov dword [ebp - 0x10], ebx
jmp 0x43c499
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x210]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x210], ecx
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x210], ebx
je 0x43c46c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x210]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x210]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setle dl
mov dword [ebp - 0x208], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x43c446
lea ecx, [ebp - 0xac0]
call fcn.00417267
mov dword [ebp - 8], ebx
jmp 0x43c4c1
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0xff0ea75c
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43c4ae
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 8], 0x1c
jmp 0x43c501
mov dword [ebp - 0x40], 0x91f7
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x43c4f7
push 0x2243
push ebx
push 0x139d
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 0x40], 0xd69f4288
dec dword [ebp - 8]
cmp dword [ebp - 8], 0x13
jne 0x43c4d6
mov byte [ebp - 9], bl
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], 0xf6cbcb1a
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x24], 0x846c8c5c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x28], ebx
je 0x43c545
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, edi
setl cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
sub eax, 0x90ae7359
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x28]
jl 0x43c56b
mov ecx, ebx
cmp dword [ebp - 0x18], ebx
je 0x43c56d
mov ecx, edi
mov eax, dword [ebp - 0x28]
sub ecx, eax
je 0x43c629
mov dword [ebp - 0x34], 0x3fa3
mov dword [ebp - 0x28], ebx
jmp 0x43c610
push 2
lea ecx, [ebp - 0x314]
call fcn.00416ef7
mov dword [ebp - 8], ebx
jmp 0x43c5ac
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x314]
mov dword [eax + ecx*4], 0xb136
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x43c599
mov dword [ebp - 0x18], 0xfffffff5
jmp 0x43c5f7
mov dword [ebp - 8], ebx
mov dword [ebp - 8], ebx
jmp 0x43c5d4
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x8bc], 0x540f213e
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x43c5c3
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
jl 0x43c5ee
mov eax, dword [ebp - 0x314]
inc dword [eax]
dec dword [ebp - 8]
jns 0x43c5e1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
jle 0x43c5bb
lea ecx, [ebp - 0x314]
cmp dword [ebp - 0x18], ebx
jne 0x43c61f
cmp dword [ebp - 0x28], 0x2d
jle 0x43c587
jmp 0x43c6ad
mov dword [ebp - 0x1c], 0xb2b0
mov dword [ebp - 0x24], 0xfffffff7
cmp dword [ebp - 0x28], ebx
je 0x43c669
cmp dword [ebp - 0x24], ebx
jne 0x43c65b
mov eax, dword [ebp - 0x18]
mov ecx, ebx
sub eax, 0xd71021f5
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x1c]
sub eax, 0xa
mov dword [ebp - 0x18], eax
je 0x43c65d
mov ecx, edi
mov eax, dword [ebp - 0x1c]
mov edx, edi
sub ecx, eax
cmp ecx, dword [ebp - 0x24]
jg 0x43c66b
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, edx
setg cl
cmp ecx, dword [ebp - 0x28]
mov byte [ebp - 0x1d], bl
jne 0x43c6a0
cmp byte [ebp - 0x1d], 0
je 0x43c6ad
push 0x1cd9
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x43c6ad
cmp byte [ebp - 0x1d], 0
je 0x43c6ad
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp byte [ebp - 9], 0
je 0x43c6c9
push ebx
push 0x175
push 0x22d4
push 0xd9e
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov dword [ebp - 0x14], 0xb3ae3556
lea ecx, [ebp - 0x404]
push esi
call fcn.00416ef7
mov dword [ebp - 0x44], 0xedda
mov dword [ebp - 0x24], 0xfc53d8b3
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 8], ebx
jmp 0x43c709
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x404]
mov dword [eax + ecx*4], 0xd711a53f
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43c6f6
mov dword [ebp - 0x14], 0x19
cmp dword [ebp - 0x14], 0xe
jg 0x43c875
mov esi, dword [ebp - 0x404]
mov dword [ebp - 0x24], 0xe93046aa
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 8], ebx
jmp 0x43c749
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xdc], 0x738ab659
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x43c738
cmp dword [ebp - 0x14], ebx
je 0x43c7a9
push 3
lea ecx, [ebp - 0x64c]
call fcn.00416ef7
mov dword [ebp - 0x40], 0xfffffffd
mov dword [ebp - 8], ebx
jmp 0x43c780
mov dword [ebp - 8], 0xbc1c234a
cmp dword [ebp - 8], 0xffffffff
jb 0x43c7fd
lea ecx, [ebp - 0x404]
call fcn.00417267
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x43d17f
jmp 0x43c895
push edi
lea ecx, [ebp - 0x15c]
call fcn.00416ef7
mov eax, 0x61928c17
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], ebx
jl 0x43c93b
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x1ac]
cmp dword [ebp - 0x1a4], 0x213ec752
jge 0x43c8ea
mov edx, ebx
cmp dword [ebp - 0x28], ebx
je 0x43c8ec
mov edx, edi
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x1ac]
mov eax, dword [ebp - 0x1a4]
add eax, edx
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x1a4]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
sete dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x1ac]
cmp eax, edx
mov eax, dword [ebp - 0x28]
setle cl
mov dword [ebp + eax*4 - 0x1ac], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1ac], ecx
dec dword [ebp - 0x28]
jns 0x43c8cd
mov byte [ebp - 9], bl
cmp byte [ebp - 9], 0
je 0x43c950
push ebx
push 0x11b5
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [ebp - 8], 0x8cff0ea7
mov dword [ebp - 0x40], 4
mov dword [ebp - 8], ebx
jmp 0x43c988
lea ecx, [ebp - 0xbc]
call fcn.00417267
push edi
lea ecx, [ebp - 0x664]
call fcn.00416ef7
push 0xfffffffffffffff6
pop esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xea0d0a06
mov dword [ebp - 0x10], ebx
jmp 0x43d1c2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x664]
mov dword [eax + ecx*4], 0xb26bdde0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x43d1af
mov dword [ebp - 0x10], ebx
jmp 0x43d1dd