Function at 0x428d93
Capabilities:
Check os version
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
push ebx
push esi
mov dword [ebp - 0x10], 0x24a8c6a5
mov esi, ecx
push edi
mov dword [ebp - 0x20], 0xe55a4419
xor edi, edi
inc edi
mov byte [ebp - 0x25], dl
mov dword [ebp - 8], edi
xor edx, edx
mov dword [ebp - 0x14], 0x3927
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x18], 0x94592404
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], edx
jmp 0x428de8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x150], 0xa332e525
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x428dd7
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x10], edx
jmp 0x428e2a
mov dword [ebp - 4], 0x1d69f428
mov dword [ebp - 4], 0xffffffec
jmp 0x428e21
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x428e1e
push edx
push 0x744
push edx
push edx
call ebx
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x13
jne 0x428e09
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jg 0x428df9
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
inc eax
je 0x428ebe
push edi
lea ecx, [ebp - 0xe8]
call fcn.00428a20
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
jmp 0x428e8b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], 4
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x428e78
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xe8]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
cmp edx, eax
setle cl
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xe8]
call fcn.00428af2
jmp 0x428f43
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 8], edx
jmp 0x428f3d
mov dword [ebp - 0x14], 0xfffc
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 4], edx
jmp 0x428ef1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x100], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x428ee4
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
jne 0x428f30
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
push 0xfffffffffffffffa
pop ecx
sub ecx, eax
mov eax, edx
add ecx, dword [ebp - 0x1c]
je 0x428f32
mov eax, edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x14], edx
jne 0x428f43
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff0
jle 0x428ed1
mov edi, dword [0x4b59fc]
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x10], 0xb7c7ce53
push 3
mov dword [ebp - 0x34], edi
call fcn.00428a20
xor edx, edx
mov dword [ebp - 0x18], 0x2fbf3f07
mov dword [ebp - 0x10], edx
jmp 0x428f7c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x50], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x428f6e
mov dword [ebp - 0x10], edx
jmp 0x428f95
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x60], 0x5051
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x428f87
mov dword [ebp - 0x10], edx
jmp 0x428fb3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 0x72d50fa8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x428fa0
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], edx
jl 0x42905d
mov dword [ebp - 4], edx
jmp 0x428fdf
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x134], 0x120dd93b
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x428fce
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x50]
imul eax, dword [ebp - 0x10]
imul ecx, eax, 0x1fa4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x50], ecx
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
neg eax
sbb eax, eax
imul ecx, dword [ebp - 0x10]
neg eax
imul ecx, eax
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
dec dword [ebp - 0x10]
jns 0x428fc9
cmp dword [ebp - 0x5c], edx
je 0x429068
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x18], 6
ja 0x429078
cmp dword [ebp - 0x10], edx
je 0x429078
xor ecx, ecx
inc ecx
jmp 0x42907a
mov ecx, edx
mov eax, dword [ebp - 0xb8]
neg ecx
mov dword [eax], ecx
lea ecx, [ebp - 0xb8]
call fcn.00428af2
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
xor edx, edx
inc edx
cmp byte [ebp - 0x25], cl
je 0x4291d8
cmp edi, edx
jne 0x4291d8
mov dword [ebp - 8], 0x1e559696
mov dword [ebp - 0x18], 0xdc5336de
mov dword [ebp - 4], ecx
jmp 0x4290d4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x7c], 0xfffffffd
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x4290c6
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], ecx
jl 0x42910c
mov byte [ebp - 9], cl
cmp byte [ebp - 9], 0
je 0x429107
push ecx
push 0x1e3e
push 0x1a3e
push 0x1e0b
push 0xdcb
call dword [sym.imp.GDI32.dll_CreateBitmap]
xor ecx, ecx
dec dword [ebp - 8]
jns 0x4290e1
mov eax, dword [ebp - 8]
mov ecx, 0xa924c000
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 0x7c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov edx, dword [ebp + 8]
setl cl
cmp ecx, 0xc8f0d071
mov dword [edx + 8], 4
sbb eax, eax
neg eax
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0x5540d7f8
mov dword [ebp - 0x20], 0xd2ab60e7
mov dword [ebp - 4], ecx
jmp 0x42916c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x128], 0x9c213245
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x42915b
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0xfffffffb
jne 0x4291a5
xor ebx, ebx
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x429191
push 0x24d9
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffffb
je 0x42917d
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
je 0x4291b0
xor ecx, ecx
inc ecx
mov dword [ebp - 4], 0x5b3b9da4
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x128], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [edx + 0xc], 0x4b59fc
xor edx, edx
mov dword [ebp - 0x20], eax
inc edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], 0xa3d88101
mov dword [ebp - 0x24], 0xc6eb81f9
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x24], 0x42b8ffd0
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0x8880d0e
mov dword [ebp - 0x24], 0x1cdffa87
mov dword [ebp - 0x24], 0x2349124c
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x24], 0x203fca5e
mov dword [ebp - 0x24], 0xb48fe2d5
mov dword [ebp - 0x24], 0xd357e8f5
mov dword [ebp - 0x14], 0x8db0
mov dword [ebp - 4], ecx
jmp 0x42924c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x140], 0xfffffffa
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x42923b
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x19
je 0x429317
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ecx
jmp 0x429275
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x44], 0x78c3
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x429267
mov dword [ebp - 8], ecx
jmp 0x429291
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x178], 0x90ba5fc0
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x429280
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x10]
jne 0x4292ae
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x10]
jl 0x4292c9
mov eax, ecx
cmp dword [ebp - 0x40], ecx
je 0x4292cb
mov eax, edx
mov dword [ebp - 0x1c], eax
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
imul ecx, eax
mov eax, dword [ebp - 0x10]
push 0
cmp eax, ecx
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
cmp edx, eax
mov eax, dword [ebp - 0x10]
setge cl
sub ecx, eax
mov eax, 0xc19c5a65
cmp eax, ecx
pop ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x19
push 1
pop edx
jne 0x42925f
cmp esi, edi
jge 0x429e3f
xor edx, edx
mov eax, 0x5021c3a2
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
push 3
mov dword [ebp - 0x104], eax
mov dword [ebp - 4], ecx
pop edi
jmp 0x42935b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x16c], 0xfffffffb
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x42934a
mov dword [ebp - 0x20], 0xffffffff
cmp dword [ebp - 0x20], 0xffffffe5
je 0x4294a8
mov dword [ebp - 4], edx
mov dword [ebp - 4], ecx
jmp 0x429387
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x78], 0x236432a2
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x429379
mov dword [ebp - 0x78], ecx
cmp dword [ebp - 0x78], 0xf
jl 0x429454
xor ebx, ebx
push 4
lea ecx, [ebp - 0xc4]
call fcn.00428a20
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
jmp 0x4293c3
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc4]
mov dword [eax + ecx*4], 0x95010f7a
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x4293b0
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x4293e2
push ebx
push 0xa02
push 0xd35
call dword [sym.imp.GDI32.dll_CreatePen]
mov esi, dword [ebp - 0xc4]
mov dword [esi + 4], 0x11
mov dword [ebp - 8], 0x46ddcd16
mov dword [ebp - 8], ebx
jmp 0x429419
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x110], ebx
jne 0x42941e
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x429416
push ebx
call dword [sym.imp.COMDLG32.dll_FindTextW]
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x4293fb
mov dword [ebp - 8], ebx
jmp 0x42942c
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x18], eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffb
jge 0x429423
dec dword [esi + 4]
cmp dword [esi + 4], ebx
jg 0x4293ef
lea ecx, [ebp - 0xc4]
call fcn.00428af2
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], 0xf
jge 0x42939b
xor ecx, ecx
mov dword [ebp - 4], 0x14
jmp 0x429489
mov byte [ebp - 9], cl
cmp byte [ebp - 9], 0
je 0x429486
push 0xf6d
push 0x6b8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
xor ecx, ecx
dec dword [ebp - 4]
cmp dword [ebp - 4], 8
jle 0x42945d
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe5
push 1
pop edx
jne 0x429371
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0x24a8c6a5
mov edi, 0x4b5a00
mov dword [ebp - 0x20], 0xe55a4419
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], 0x3927
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x18], 0x94592404
mov dword [ebp - 4], ecx
jmp 0x4294e9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x160], 0xa332e525
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x4294d8
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 3
jle 0x429532
mov dword [ebp - 4], 0x1d69f428
mov dword [ebp - 4], 0xffffffec
jmp 0x429520
mov byte [ebp - 9], cl
cmp byte [ebp - 9], 0
je 0x42951d
push ecx
push 0x744
push ecx
push ecx
call ebx
xor ecx, ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x13
jne 0x429508
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jg 0x4294f8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
inc eax
je 0x4295c1
push edx
lea ecx, [ebp - 0xd0]
call fcn.00428a20
xor edx, edx
inc edx
xor ebx, ebx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], ebx
jmp 0x42958e
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], 4
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x42957b
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xd0]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
cmp edx, eax
setle cl
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xd0]
call fcn.00428af2
jmp 0x429646
mov dword [ebp - 0x1c], 0xfffffffa
xor ebx, ebx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 8], ebx
jmp 0x429640
mov dword [ebp - 0x14], 0xfffc
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 4], ebx
jmp 0x4295f6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xdc], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x4295e9
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xd8]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
jne 0x429633
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
push 0xfffffffffffffffa
pop ecx
sub ecx, eax
mov eax, ebx
add ecx, dword [ebp - 0x1c]
je 0x429635
mov eax, edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x14], ebx
jne 0x429646
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff0
jle 0x4295d6
test esi, esi
jle 0x429b3e
push 9
pop edx
mov dword [ebp - 4], 0xfffe
xor ecx, ecx
mov dword [ebp - 0x14], 0xffffffff
inc ecx
mov dword [ebp - 0x1c], 0x25b054db
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x20], ebx
jmp 0x42967f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x80], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x429675
mov byte [ebp - 9], bl
cmp byte [ebp - 9], 0
je 0x4296a2
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp ecx, eax
setl dl
imul edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
sub ecx, eax
xor eax, eax
cmp ecx, 0xfffffffb
setne al
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x4296d4
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
inc ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov esi, dword [edi]
mov dword [ebp - 0x80], eax
mov eax, 0xae77ddba
mov dword [ebp - 4], 0xfffffff7
mov dword [ebp - 0x10], 0x592c6eed
mov dword [ebp - 8], ecx
mov dword [ebp - 0x1c], 0x83ca3077
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], 0xfff7
mov dword [ebp - 0x1c], 0x2c25470e
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
jmp 0x42974c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x58], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x429742
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
test eax, eax
jne 0x4297f3
mov dword [ebp - 0x10], 0xc7104272
cmp dword [ebp - 0x10], ebx
je 0x4297e9
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 4]
cmp ecx, eax
setg dl
neg edx
cmp edx, dword [ebp - 4]
jg 0x42978c
cmp dword [ebp - 0x10], ebx
je 0x42978c
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x429791
xor ecx, ecx
mov eax, ebx
inc ecx
add eax, 6
jne 0x429799
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x10]
add eax, dword [ebp - 8]
mov eax, ecx
jne 0x4297ac
mov eax, ebx
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, 0x8aef2ed0
setge cl
xor edx, edx
sub eax, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
cmp eax, ecx
setle dl
xor ecx, ecx
mov dword [ebp - 0x1c], edx
inc ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x4297f5
mov eax, ecx
push 9
pop ecx
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 6
setle cl
xor eax, eax
cmp ecx, 0xfffffffa
setge al
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor ecx, ecx
add eax, 0xffff9f84
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x7de97ee8
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne bl
xor ecx, ecx
cmp ebx, eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x10], 0xffffffeb
cmp dword [ebp - 0x10], 0x17
jle 0x429952
push 1
lea ecx, [ebp - 0xa0]
call fcn.00428a20
xor edx, edx
inc edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], 0x6c132d45
mov dword [ebp - 0x1c], 0x70c30f14
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
jmp 0x4298ae
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa0]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x42989b
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
jl 0x429907
mov dword [ebp - 0x1c], 0x6c2cf376
mov dword [ebp - 0x1c], 0x8a086cc6
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x58], ecx
mov dword [ebp - 8], 0xfffffffc
jmp 0x4298fc
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x14], 0xc7bc
mov dword [ebp - 0x14], 0xffffffff
inc dword [eax]
inc dword [ebp - 0x1c]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffed
jle 0x4298e0
dec dword [ebp - 0x20]
jns 0x4298bb
cmp dword [ebp - 8], ebx
je 0x42993a
cmp dword [ebp - 0x18], ebx
jne 0x42992b
mov eax, dword [ebp - 0xa0]
cmp dword [eax], ebx
jne 0x429922
mov eax, ebx
cmp dword [ebp - 0x58], ebx
je 0x429924
mov eax, edx
cmp eax, dword [ebp - 0x18]
mov eax, ebx
jge 0x42992d
mov eax, edx
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 4]
mov eax, edx
cmp dword [ebp - 0x20], edx
jne 0x42993c
mov eax, ebx
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0xa0]
call fcn.00428af2
inc dword [ebp - 0x10]
jmp 0x429853
mov ecx, dword [edi + 4]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 0x2e1d
mov dword [ebp - 8], ebx
jmp 0x429975
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x188], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x429964
xor edx, edx
mov dword [ebp - 8], ebx
inc edx
jmp 0x429994
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x138], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x429983
dec dword [ebp - 0x18]
add edi, 8
test ecx, ecx
jne 0x4299a6
add edi, 8
push 3
lea ecx, [ebp - 0x6c]
call fcn.00428a20
mov dword [ebp - 8], 0xdada439b
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
jmp 0x4299cf
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x4299bf
mov dword [ebp - 8], 2
cmp dword [ebp - 8], ebx
jl 0x429b28
xor esi, esi
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x6c]
cmp dword [eax + ecx*4], ebx
je 0x429aa9
mov dword [ebp - 4], 0xb8faaaeb
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 2
jg 0x429ac6
mov dword [ebp - 0x18], ebx
xor ebx, ebx
mov dword [ebp - 0x18], 6
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + eax*4]
cmp eax, dword [ecx + edx*4]
mov eax, dword [ebp - 0x18]
setne bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x90611bc3
setne al
test eax, eax
jg 0x429a62
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], 0x7dfe
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x2c9a
mov eax, dword [ebp - 0x6c]
setge cl
xor ebx, ebx
push 0
cmp ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0x18]
setg bl
xor ecx, ecx
cmp eax, ebx
pop ebx
setl cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jle 0x429a1b
jmp 0x429ac6
mov byte [ebp - 9], bl
cmp byte [ebp - 9], 0
je 0x429ac6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6c]
inc edx
neg edx
sbb edx, edx
add edx, 0xfffffffd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [eax]
setne cl
test ecx, ecx
je 0x429afb
lea ecx, [esi + 1]
cmp dword [ebp - 0x14], ebx
jne 0x429afd
mov ecx, ebx
xor eax, eax
cmp ecx, 0x40c3
sete al
add eax, 0x5bf8
je 0x429b17
lea eax, [esi + 1]
cmp dword [ebp - 8], ebx
jne 0x429b19
mov eax, ebx
mov dword [ebp - 0x14], eax
dec dword [ebp - 8]
jns 0x4299e7
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x6c]
call fcn.00428af2
add edi, esi
dec dword [ebp - 0x2c]
push 9
pop edx
jne 0x429651
mov esi, dword [edi]
xor edx, edx
mov dword [ebp - 0x1c], 0x97a4
inc edx
mov dword [ebp - 0x24], edx
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0xaae4b9a7
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], ebx
jmp 0x429ba3
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xf4], 0xe74a
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x429b92
mov dword [ebp - 8], ebx
jmp 0x429bbc
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x38], 0xb467bb1a
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x429bae
cmp dword [ebp - 0x1c], ebx
je 0x429c38
cmp dword [ebp - 0x14], ebx
je 0x429bd9
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0xec]
jge 0x429bdf
mov eax, dword [ebp - 0x88]
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov eax, dword [ebp - 0x8c]
add eax, ecx
mov ecx, dword [ebp - 0x18]
add ecx, eax
jne 0x429c09
mov eax, ebx
cmp dword [ebp - 0x38], ebx
je 0x429c0b
mov eax, edx
cmp eax, edx
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf4]
cmp ecx, eax
mov eax, dword [ebp - 4]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
inc edx
mov eax, edx
cmp ecx, 0x8214d2fc
jae 0x429c3a
mov eax, ebx
mov ebx, dword [edi + 4]
xor ecx, ecx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ecx
jmp 0x429c6c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30], 0xfe387fb0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x429c5e
mov byte [ebp - 9], cl
cmp byte [ebp - 9], cl
je 0x429c89
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
xor ecx, ecx
cmp dword [ebp - 0x30], ecx
je 0x429d2b
mov dword [ebp - 0x14], 0x74b1b055
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x18], 0xaab56411
mov dword [ebp - 0x18], 0xe215169f
mov dword [ebp - 0x24], 0xe857b1a0
cmp dword [ebp - 0x14], ecx
jne 0x429ce7
cmp dword [ebp - 0x30], ecx
je 0x429ce7
imul eax, dword [ebp - 0x30], 0x69ac
test eax, eax
jne 0x429ce1
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
add eax, edx
jne 0x429ce1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setne dl
xor ecx, ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 9], cl
cmp byte [ebp - 9], cl
je 0x429d64
push ecx
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
jmp 0x429d64
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], ecx
jg 0x429d64
xor ebx, ebx
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x429d4b
push ebx
push 0x3f2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x429d59
call dword [sym.imp.USER32.dll_DestroyCaret]
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jle 0x429d35
mov ebx, dword [ebp - 0x24]
test ebx, ebx
jne 0x429e3f
cmp byte [ebp - 0x25], bl
je 0x429d80
cmp dword [ebp - 0x34], 1
jne 0x429d80
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [edi + 0xc]
add edi, 0x10
push esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], edi
call fcn.00483c7f
pop ecx
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0xac]
lea eax, [ebp - 0x84]
xor ebx, ebx
push eax
push esi
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
call fcn.00453faf
mov edi, dword [ebp - 0xac]
mov ecx, ebx
test esi, esi
jle 0x429e27
mov ebx, dword [ebp - 0x18]
mov eax, ecx
and eax, 0x80000001
jns 0x429de6
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x34]
add eax, ecx
add eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x38]
cdq
idiv esi
xor eax, eax
cmp word [edi + edx*2], ax
je 0x429e12
xor ebx, ebx
lea eax, [edx + 1]
cdq
idiv esi
cmp word [edi + edx*2], bx
jne 0x429e03
mov ebx, dword [ebp - 0x18]
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov al, byte [edx + ebx]
mov edx, dword [ebp - 0x1c]
mov byte [ecx + edx], al
inc ecx
cmp ecx, esi
jl 0x429dd8
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov dword [ebx], esi
mov dword [ebx + 4], eax
test edi, edi
je 0x429e42
push edi
call fcn.00486626
pop ecx
jmp 0x429e42
mov ebx, dword [ebp + 8]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret