Function at 0x428db4
Capabilities:
Clear file content
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov dword [ebp - 0xc], 6
mov dword [ebp - 0x1c], 0xe5a9864b
push ebx
mov dword [ebp - 0x1c], 0xfffffff8
xor ebx, ebx
mov dword [ebp - 0x1c], 0xfffffffd
mov byte [ebp - 0x39], dl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc], ebx
jmp 0x428df8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1b8], 0xd327cb3f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x428de7
push esi
push edi
push 2
mov dword [ebp - 0xc], ebx
pop edi
jmp 0x428e19
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1a8], 0xfffffff9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x428e08
push 3
pop edx
mov dword [ebp - 0xc], ebx
push 1
pop esi
cmp dword [ebp - 0xc], edx
jg 0x428ef6
mov edi, 0x78213af7
mov dword [ebp - 0x10], 0x7d214c40
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], ebx
jmp 0x428e58
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x100], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x428e47
mov dword [ebp - 0x10], ebx
jmp 0x428ebb
mov dword [ebp - 0x18], 0x7822e6e7
mov dword [ebp - 0x1c], 0xe3edfa83
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x1c], 0xb959c45c
mov dword [ebp - 0x1a0], edi
mov dword [ebp - 0x19c], edi
mov dword [ebp - 0x198], edi
mov dword [ebp - 0x194], edi
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x428eb5
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x428ead
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
dec dword [ebp - 0x18]
jns 0x428e9e
push 3
pop edx
dec dword [ebp - 0x34]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x428e62
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1b8], ecx
test ecx, ecx
jne 0x428ee1
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1a4], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jle 0x428e35
push 2
pop edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x14], 0x60d7
mov dword [ebp - 4], ebx
jmp 0x428f21
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x13c], 0xdc85
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x428f10
mov dword [ebp - 4], ebx
jmp 0x428f3d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x180], 0xe314
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x428f2c
mov dword [ebp - 4], ebx
jmp 0x428f58
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1c4], 0x9984333
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x428f47
mov dword [ebp - 4], ebx
jmp 0x429079
mov dword [ebp - 0xc], 0xab8c3ad3
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], 0x4cbf7762
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], ebx
jl 0x429024
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x28], 0x1a796d40
mov dword [ebp - 0x14], ebx
jmp 0x428faf
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0x13c]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x13c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x428f98
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
je 0x428fd4
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
push 3
mov eax, dword [ebp + eax*4 - 0x13c]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x13c]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c4], edx
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x13c]
cmp eax, edx
pop edx
setne cl
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0xc]
jns 0x428f85
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], ebx
jl 0x429076
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0xddfd
mov dword [ebp - 0x10], ebx
jmp 0x42904c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e8], 0xa7e1289e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x42903b
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x429071
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x34], ebx
inc dword [ebp - 0x34]
dec dword [ebp - 0x14]
jns 0x429059
dec dword [ebp - 0xc]
jns 0x42902c
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jle 0x428f65
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0xc], 0xfffffffb
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0x62cf9e8
mov dword [ebp - 0x1c], 0x6b6c7e7c
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x1c], 0xe21e5250
mov dword [ebp - 0x1c], 0x17092ff8
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0x15a0349b
mov dword [ebp - 0x1c], 0xed4033e2
mov dword [ebp - 0x20], 0x97e410f
mov dword [ebp - 4], ebx
jmp 0x4290e7
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xcc], 0x9984333
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x4290d6
mov dword [ebp - 4], ebx
jmp 0x4290fe
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x218], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x4290f1
mov dword [ebp - 4], ebx
jmp 0x429115
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x228], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x429108
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0x6ef6
setl al
xor ecx, ecx
cmp eax, 0xe8f
mov eax, dword [ebp - 0xc8]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc8]
setle dl
sub edx, eax
je 0x42918c
cmp dword [ebp - 0xc], ebx
je 0x42918c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], 0x52c58fb7
xor edx, edx
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
sete cl
xor edx, edx
cmp ecx, 0xd2e8
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], ebx
jg 0x4291d1
mov ecx, ebx
cmp dword [ebp - 0x18], ebx
je 0x4291d3
mov ecx, esi
mov eax, dword [ebp - 0xc4]
add eax, ecx
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x20]
mov dword [ebp - 0x18], 0x55261fc4
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0x9b3
push 3
mov dword [ebp - 0x38], 0x53ea3a72
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x429212
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xf8], 0x3342eb90
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x429201
mov dword [ebp - 0xc], ebx
jmp 0x42922d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xac], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x42921c
mov dword [ebp - 0xa4], ebx
jmp 0x429263
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x42924e
push 0x3a1
push ebx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov eax, dword [ebp - 0xa4]
cmp dword [ebp + eax*4 - 0xf8], ebx
jne 0x42926b
inc dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], edi
jle 0x42923a
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0xf4]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 9
jne 0x429296
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x18]
push 8
dec eax
cmp eax, 0xfffffffd
setg dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xf0]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0xf0]
setge cl
xor edx, edx
cmp ecx, 7
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, esi
sbb eax, eax
add eax, 0x6a5ad88f
mov dword [ebp - 0x38], eax
mov eax, dword [0x4955ec]
mov dword [ebp - 0x34], eax
pop eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x28], 0x72c25fcc
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x42932d
push 0x1e6e
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], ebx
jl 0x429397
mov dword [ebp - 0x18], 0x54fddd3f
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], ebx
jl 0x42937a
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x168]
inc eax
mov dword [ebp - 0x28], eax
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x429375
push ebx
push 0xfc0
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
dec dword [ebp - 0x18]
jns 0x429352
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x429392
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
dec dword [ebp - 0x10]
jns 0x42933f
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x10], 0xfb95c1f4
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x28], 0xa53ebff7
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
mov dword [ebp - 0x10], ecx
jmp 0x4293cf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x50], 0x7cb3f4f4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x4293c1
cmp dword [ebp - 0x50], ecx
je 0x4294cc
mov dword [ebp - 0xc], 0x8f5f4990
mov dword [ebp - 0x20], 0xb32e2659
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x50]
je 0x42947f
cmp dword [ebp - 0xc], ecx
je 0x429407
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0xc]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor edx, edx
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
add ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
add ecx, 3
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x50]
setle cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0xc]
cmp ecx, eax
sete dl
sub edx, 2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [ebp - 0x50]
je 0x429476
mov eax, esi
cmp dword [ebp - 0xc], ecx
jne 0x429478
mov eax, ecx
cmp eax, dword [ebp - 0xc]
mov eax, ecx
jge 0x429481
mov eax, esi
xor ecx, ecx
mov edi, 0xffff
cmp eax, edi
mov eax, dword [ebp - 0xc]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 9
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x28], ecx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x42959a
push 0x111e
push edx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x429598
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x14], 0x1d
jmp 0x429561
mov dword [ebp - 0x10], ecx
jmp 0x4294f5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x88], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x4294e4
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x429523
push ecx
push 0x114
push ecx
push 0x13ae
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
xor ecx, ecx
mov dword [ebp - 0x88], ecx
jmp 0x429555
mov dword [ebp - 0x10], ecx
jmp 0x429541
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1d0], 0x8325
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x429530
cmp dword [ebp - 0x1d0], ecx
jne 0x42955e
inc dword [ebp - 0x88]
cmp dword [ebp - 0x88], 9
jle 0x42952b
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
jne 0x4294df
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov dword [ebp - 0x10], eax
mov edi, 0xffff
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setg dl
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
xor edx, edx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x2c
jge 0x4295f4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x28], 0xec31937
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x18], 0xfffffff8
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setge cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x2c
jl 0x4295a3
xor edx, edx
cmp byte [ebp - 0x39], 0
je 0x429645
cmp dword [ebp - 0x34], esi
jne 0x429645
mov dword [ebp - 0x1c], 0x93b4e1a3
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x42961e
push edx
push 0xba5
push edx
call dword [sym.imp.GDI32.dll_GetRegionData]
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x429637
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
xor edx, edx
mov dword [ebx + 8], 4
mov dword [ebx + 0xc], 0x4955ec
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xc], edx
jmp 0x42965a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x6c], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x429650
mov dword [ebp - 0xc], edx
jmp 0x42966f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x5c], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x429665
mov dword [ebp - 0x68], edx
jmp 0x4297ad
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x10], edx
jmp 0x4296a7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x178], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x429696
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0xc
jg 0x4297aa
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], edx
jmp 0x4296d6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x110], 0xd1d89e17
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x4296c5
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff8
je 0x429760
cmp dword [ebp - 0x2c], edx
je 0x4296fa
mov eax, dword [ebp - 0x10c]
mov ecx, esi
inc dword [ebp - 0x10c]
jmp 0x4296fc
mov ecx, edx
mov eax, dword [ebp - 0x2c]
add eax, ecx
imul eax, dword [ebp - 0x68]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
sub eax, edi
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
cmp eax, 0xfa2e
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x5c]
setne bl
xor edx, edx
imul ebx, eax
mov eax, dword [ebp - 0x6c]
cmp ecx, eax
setne dl
cmp edx, ebx
jl 0x429751
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x178], edx
mov eax, edx
cmp dword [ebp - 0x14], edx
jle 0x429762
mov eax, esi
mov edx, dword [ebp - 0xc]
xor ecx, ecx
add edx, eax
mov eax, dword [ebp - 0xc]
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
jne 0x429780
cmp dword [ebp - 4], eax
je 0x429782
mov eax, esi
mov ecx, dword [ebp - 0x28]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x5c]
push 0
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setge dl
sub edx, eax
mov dword [ebp - 0x5c], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xc
pop edx
jle 0x4296ba
inc dword [ebp - 0x68]
cmp dword [ebp - 0x68], 5
jl 0x42967c
mov edi, dword [ebp - 0x30]
cmp edi, dword [ebp - 0x34]
jge 0x42a595
push 3
mov dword [ebp - 0xc], 0xfffffff7
pop ecx
mov dword [ebp - 0xc], 0xec0ae971
mov dword [ebp - 0xc], ecx
jmp 0x42982b
mov dword [ebp - 4], edx
mov dword [ebp - 4], 0xffffffe7
jmp 0x429822
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x10], edx
jmp 0x4297fe
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x190], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4297f1
mov dword [ebp - 0x14], edx
jmp 0x42981a
mov dword [ebp - 0x28], 0xb5bf
cmp dword [ebp - 0x14], edx
jne 0x42981f
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x429808
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jge 0x4297e5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xb
jge 0x4297d9
mov dword [ebp - 4], 0x7102d149
mov ebx, 0x4955f0
mov dword [ebp - 0x14], 0x579253a3
mov dword [ebp - 0x24], 0xfff9
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edx
jmp 0x429864
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x20c], 0xb96bc712
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x429853
cmp dword [ebp - 4], edx
je 0x429870
mov edx, esi
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], edx
je 0x42999d
mov dword [ebp - 0x2c], 0xd164
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x10], edx
jmp 0x4298d5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e0], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x4298c4
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
mov ecx, esi
sub ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
setg bl
xor edx, edx
cmp ecx, eax
push 2
setne dl
xor ecx, ecx
cmp edx, ebx
setg cl
xor eax, eax
cmp ecx, 0xb674
pop ecx
setge al
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edx
jmp 0x42995d
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x1c], 0x5ebb4ee0
mov dword [ebp - 0x1c], 0xb17c08a5
mov dword [ebp - 0x10], edx
jmp 0x429952
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x200], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x429941
inc dword [ebp - 0x24]
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jle 0x429924
mov ebx, 0x4955f0
mov dword [ebp - 0x28], edx
test edi, edi
jle 0x42a162
mov dword [ebp - 0x14], 0xfa20
mov dword [ebp - 0x24], 0x357f451d
mov dword [ebp - 0x38], 0xc56e
mov dword [ebp - 0x20], 0x908cdac3
push 3
mov dword [ebp - 0x24], 0x505ce4ec
mov dword [ebp - 4], edx
pop ecx
jmp 0x4299db
mov dword [ebp - 4], 2
cmp dword [ebp - 4], edx
jl 0x429967
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x4299c3
push edx
push edx
push 0xbc9
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
dec dword [ebp - 4]
jns 0x4299a9
jmp 0x429967
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd8], 0xad313dd3
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x4299ca
mov dword [ebp - 4], edx
jmp 0x4299ef
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x78], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x4299e5
mov dword [ebp - 0xd8], 0xffffffef
cmp dword [ebp - 0xd8], 0xffffffed
jle 0x429b1e
xor ebx, ebx
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 4], 0x5a27557b
mov dword [ebp - 0x18], 0x871d0c0b
mov dword [ebp - 0x10], ebx
jmp 0x429a3f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x104], 0xc4e7ccce
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x429a2e
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0xd8]
cmp eax, ecx
setle dl
mov dword [ebp - 0x2c], edx
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x104], ecx
mov eax, dword [ebp - 0x78]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
add eax, edx
xor edx, edx
imul ecx, eax, 0x73a1
mov eax, dword [ebp - 4]
cmp ecx, eax
setge dl
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
sub ecx, eax
imul ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x18]
jne 0x429a9a
mov eax, esi
cmp dword [ebp - 0x78], ebx
jne 0x429a9c
mov eax, ebx
xor edx, edx
cmp eax, 0xffff
sete dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x78], ecx
xor ecx, ecx
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xd8]
cmp eax, 0xeebcb174
mov eax, dword [ebp - 0x14]
setle cl
sub eax, dword [ebp - 0x14]
neg ecx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0xd8]
cmp dword [ebp - 0xd8], 0xffffffed
jg 0x429a0d
mov ebx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebx]
mov dword [ebp - 4], edx
push 2
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], edx
pop edi
jmp 0x429b46
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb4], 0xa4c924b5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x429b35
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x429b63
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xb0]
jle 0x429bb0
mov dword [ebp - 0x38], 0x374f
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
jmp 0x429bea
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0xfffffffb
jl 0x429bea
xor ebx, ebx
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x429bcb
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x429bde
push 0x10f8
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffb
jge 0x429bbb
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x14], 0xa80bfb3a
add ebx, 4
mov dword [ebp - 0x20], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x2c], 0x8f25
mov dword [ebp - 0x24], 0xdbcc772a
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
jmp 0x429c21
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x74], 0xbf25cbd9
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x429c13
mov dword [ebp - 4], ecx
jmp 0x429c3c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xec], 0xa0734f09
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x429c2b
mov dword [ebp - 4], ecx
jmp 0x429c58
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x124], 7
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x429c47
mov dword [ebp - 4], ecx
jmp 0x429c73
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe0], 0x4be495ee
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x429c62
mov dword [ebp - 0xe8], 0xffffffff
xor edx, edx
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xffffffff
setle al
xor edx, edx
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
xor ebx, ebx
cmp edx, 0xe4f1
setne bl
xor ecx, ecx
imul ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ebx, eax
setne cl
xor eax, eax
cmp dword [ebp - 0x38], ecx
setl al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6ce0
jl 0x429d80
mov dword [ebp - 0x24], edi
xor ebx, ebx
mov dword [ebp - 0x14], 0x17716e31
mov dword [ebp - 0x20], 0x30fa2e85
cmp dword [ebp - 0x70], ebx
je 0x429d62
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x70]
add ecx, eax
mov eax, dword [ebp - 0xdc]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
sub edx, eax
imul edx, dword [ebp - 0x120]
test edx, edx
jne 0x429d36
cmp dword [ebp - 0x20], ebx
jne 0x429d36
mov ecx, ebx
cmp dword [ebp - 0xe8], ebx
je 0x429d38
mov ecx, esi
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, ecx
add eax, eax
je 0x429d4a
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xe8], esi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setge dl
mov dword [ebp - 0x70], edx
jmp 0x429e6a
mov dword [ebp - 0x14], 0xc6a8
mov dword [ebp - 0x20], 0x226059bf
mov dword [ebp - 0x38], 0x905afb09
mov dword [ebp - 0x10], 0
jmp 0x429da8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x60], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x429d9e
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp eax, esi
setg dl
mov dword [ebp - 0x60], edx
cmp dword [ebp - 0x14], 0xa3d0676d
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0xdc]
setg bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor ebx, ebx
imul eax, ecx, 0xfffe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x60], ebx
jne 0x429e5d
cmp dword [ebp - 0x24], ebx
jle 0x429e0e
mov ecx, ebx
cmp dword [ebp - 0x60], ebx
je 0x429e10
mov ecx, esi
mov eax, dword [ebp - 0xe0]
xor edx, edx
imul eax, ecx
imul ecx, eax, 3
mov eax, dword [ebp - 0x60]
cmp ecx, eax
setle dl
cmp edx, esi
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 3
setg cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 0x773c
setg al
cmp eax, dword [ebp - 0xe8]
jle 0x429e59
mov ecx, esi
mov eax, dword [ebp - 0x60]
add eax, ecx
mov dword [ebp - 0xe8], eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebx]
mov dword [ebp - 0x10], 0xea5d6c05
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x429e8b
push 0x179b
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x10], 4
cmp dword [ebp - 0x10], 0x1d
jle 0x429ebb
mov dword [ebp - 0x14], 0x32667a87
mov dword [ebp - 0x20], 0x82c32b96
mov dword [ebp - 4], edx
jmp 0x42a186
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x148], 0xf99f
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x42a175
mov dword [ebp - 4], edx
jmp 0x42a1a2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x114], 9
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x42a191
push 2
mov dword [ebp - 0x14], edx
pop edi
jmp 0x42a223
mov dword [ebp - 0x1c], 0x6c619a80
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x58], 0x3cc9
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x148], edx
je 0x42a1e8
mov ecx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x148], ecx
imul eax, ecx, 0x15aa
mov ecx, esi
test eax, eax
jne 0x42a1ea
mov ecx, edx
xor eax, eax
cmp ecx, 0x507e
sete al
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add eax, 8
jne 0x42a20f
mov eax, edx
cmp dword [ebp - 0x58], edx
je 0x42a211
mov eax, esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x114], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x42a1af
mov eax, dword [ebx]
mov dword [ebp - 4], 0x59e57ad9
mov dword [ebp - 0x30], 0x31e7bf5c
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edx
jmp 0x42a262
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x170], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x42a251
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 4]
jge 0x42a277
cmp dword [ebp - 4], edx
jne 0x42a277
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], 0xfff6
sbb eax, eax
neg eax
cmp eax, dword [ebp - 4]
jle 0x42a292
cmp dword [ebp - 4], edx
je 0x42a294
mov edx, esi
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 4]
jle 0x42a2a6
mov eax, dword [ebp - 4]
mov dword [ebp - 0x170], 0x515fdc8d
mov ecx, 0xb143e95a
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], 7
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 4]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 4]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 4]
setge bl
xor ecx, ecx
cmp ebx, eax
mov ebx, dword [ebp - 0xc]
setle cl
mov dword [ebp - 0x30], ecx
xor ecx, ecx
imul eax, dword [ebp - 4], 0x1ac0
cmp eax, 0x8dd2
mov eax, dword [ebp - 4]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 4]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], 0x2c593c86
mov dword [ebp - 0x1c], 0x9dc86695
mov dword [ebp - 0xc], ecx
jmp 0x42a33f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x54], 0xf6f08421
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x42a331
mov dword [ebp - 0xc], ecx
jmp 0x42a357
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x80], 0xfff8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x42a349
mov byte [ebp - 5], cl
cmp byte [ebp - 5], cl
je 0x42a378
push esi
push ecx
push 0x1ee3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
mov ecx, dword [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 0x54]
sub ecx, eax
mov eax, dword [ebp - 0x80]
sub ecx, eax
mov eax, dword [ebp - 0x80]
sub ecx, eax
mov eax, dword [ebp - 0x54]
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x80]
mov edi, dword [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x154], esi
mov dword [ebp - 0x150], esi
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x1c], 0xf7e7308f
mov dword [ebp - 0x18], edx
jmp 0x42a3ee
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1d8], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x42a3dd
mov dword [ebp - 0x10], edx
jmp 0x42a44a
mov dword [ebp - 0x7c], 0x5ef8
mov dword [ebp - 0x7c], 0xe3f1571c
mov dword [ebp - 0x18], edx
jmp 0x42a41d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x18c], 0x44cacff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x42a40c
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp + eax*4 - 0x158], 0x11c1
mov eax, dword [ebp - 0x184]
cmp eax, esi
setg cl
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x42a3f9
mov dword [ebp - 0x18], 0xea5d6c05
add ebx, 8
mov byte [ebp - 5], dl
mov dword [ebp - 0xc], ebx
cmp byte [ebp - 5], dl
je 0x42a472
push 0x179b
call dword [sym.imp.USER32.dll_GetSysColorBrush]
xor edx, edx
mov dword [ebp - 0x18], 4
jmp 0x42a496
cmp dword [ebp - 0x18], 0x1d
jg 0x42a47b
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], 0x30a4ccfd
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x30], 0xb2f14481
mov dword [ebp - 0x7c], edx
push 4
mov dword [ebp - 0x34], esi
mov dword [ebp - 4], edx
pop edi
jmp 0x42a5ce
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1f8], 0xfffffff9
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x42a5bd
push 2
mov dword [ebp - 4], edx
pop ecx
jmp 0x42a5ec
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x12c], 0x8586
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x42a5db
mov dword [ebp - 4], edx
jmp 0x42a607
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa0], 0xd133f29c
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x42a5f6
mov dword [ebp - 0x1ec], edi
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x12c], esi
je 0x42a627
mov eax, edx
cmp dword [ebp - 0xa0], edx
je 0x42a629
mov eax, esi
mov ecx, 0x85024d8f
cmp ecx, eax
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov eax, dword [ebp - 0x34]
setg cl
xor edx, edx
cmp ecx, 0x40e7
mov ecx, esi
setle dl
dec dword [ebp - 0x34]
xor ebx, ebx
cmp eax, edx
jne 0x42a65d
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
imul eax, ecx
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x2c], ebx
jne 0x42a694
mov esi, ebx
mov eax, dword [ebp - 0x128]
xor edx, edx
cmp esi, eax
mov eax, dword [ebp - 0x30]
pop edi
setge dl
xor ecx, ecx
cmp edx, eax
pop esi
setl cl
sub ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ebx
jmp 0x42a6ca
mov dword [ebp - 0x1c], 0xe6f96354
cmp dword [ebp - 0x1c], ebx
jne 0x42a6d0
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff4
je 0x42a6bb
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret