Function at 0x40106c
Capabilities:
Get session user name
Initialize winsock library
List user account groups
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x42207c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xff
xor ebx, ebx
lea eax, [ebp - 0x407]
push ebx
push eax
call fcn.0040b650
mov eax, dword [0x4249b0]
mov esi, dword [0x4249a0]
mov ecx, dword [0x4249b8]
mov dword [ebp - 0x408], eax
mov eax, dword [0x4249ac]
imul esi, eax
lea edx, [ecx + eax]
add esp, 0xc
cmp esi, edx
jne 0x4010e0
movzx edx, word [ebp - 0x458]
add eax, 0xfffffffa
imul edx, ecx
imul eax, dword [ebp - 0x458]
add eax, dword [0x4249a4]
add eax, edx
mov dword [0x4249a4], eax
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x308]
push eax
mov dword [ebp - 0x45c], 0x200
mov dword [ebp - 0x410], 0x41b518
mov dword [ebp - 0x40c], 0x41b524
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x454]
push eax
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x308]
push eax
push ebx
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
cmp dword [0x4249b8], ebx
je 0x40113b
cmp dword [0x4249b0], ebx
jne 0x401160
mov ecx, dword [ebp - 0x454]
push ebx
lea eax, [ebp - 0x308]
push eax
xor eax, eax
cmp dword [ecx + 0xc], 2
sete al
push dword [ebp + eax*4 - 0x410]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x454]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov ecx, dword [0x4249b0]
cmp ecx, ebx
je 0x40117e
cmp dword [0x4249b8], ebx
jne 0x4011d7
push ebx
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x460]
push eax
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
push ebx
call fcn.00407b76
push eax
call fcn.004079b8
pop ecx
pop ecx
push 0x41b53c
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleA]
call dword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [0x4249b0]
mov eax, dword [ebp - 0x458]
mov edi, dword [0x4249ac]
cmp eax, dword [0x4249b4]
jne 0x40121c
mov eax, ecx
lea esi, [edi + 4]
cdq
idiv esi
movzx edx, word [ebp - 0x454]
imul edx, dword [0x4249a4]
add edx, dword [0x4249b8]
xor esi, esi
imul edx, edi
sub edx, eax
imul edx, dword [ebp - 0x458]
mov dword [ebp - 0x458], edx
inc esi
mov eax, ecx
imul eax, dword [ebp - 0x464]
cmp dword [ebp - 0x458], eax
jne 0x401251
mov eax, dword [ebp - 0x458]
shr eax, 2
imul eax, dword [0x4249b8]
movzx ecx, cx
add eax, edi
add ecx, eax
imul ecx, dword [ebp - 0x458]
mov dword [ebp - 0x458], ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x308]
push eax
mov dword [ebp - 0x45c], 0x200
mov dword [ebp - 0x410], 0x41b540
mov dword [ebp - 0x40c], 0x41b54c
call edi
lea eax, [ebp - 0x454]
push eax
push esi
lea eax, [ebp - 0x308]
push eax
push ebx
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
cmp dword [0x4249b8], ebx
je 0x4012ab
cmp dword [0x4249b0], ebx
jne 0x4012d0
mov ecx, dword [ebp - 0x454]
push ebx
lea eax, [ebp - 0x308]
push eax
xor eax, eax
cmp dword [ecx + 0xc], 2
sete al
push dword [ebp + eax*4 - 0x410]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x454]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x308]
push eax
mov dword [ebp - 0x45c], 0x200
mov dword [ebp - 0x410], 0x41b564
mov dword [ebp - 0x40c], 0x41b570
call edi
lea eax, [ebp - 0x454]
push eax
push esi
lea eax, [ebp - 0x308]
push eax
push ebx
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
cmp dword [0x4249b8], ebx
je 0x401330
cmp dword [0x4249b0], ebx
jne 0x401355
mov ecx, dword [ebp - 0x454]
push ebx
lea eax, [ebp - 0x308]
push eax
xor eax, eax
cmp dword [ecx + 0xc], 2
sete al
push dword [ebp + eax*4 - 0x410]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x454]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
lea eax, [ebp - 0x298]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x401381
mov eax, dword [0x4249b0]
mov dword [0x4249a4], eax
push 6
push esi
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40139d
mov eax, dword [0x4249b0]
mov dword [0x4249a4], eax
push 2
pop eax
push ebx
mov word [ebp - 0x428], ax
call dword [sym.imp.WS2_32.dll_htonl]
push 0x6987
mov dword [ebp - 0x424], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x426], ax
push 0x10
lea eax, [ebp - 0x428]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x4013e0
mov dword [0x4249a4], ebx
push dword [0x4249b4]
call dword [sym.imp.IMM32.dll_ImmGetDefaultIMEWnd]
mov dword [ebp - 0x454], eax
cmp eax, ebx
jne 0x4013fc
mov dword [0x4249a0], ebx
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push 0x22
mov esi, 0x283
push esi
push dword [ebp - 0x454]
call edi
push ebx
push dword [0x4249a4]
push esi
push dword [ebp - 0x454]
call edi
test eax, eax
je 0x401433
push ebx
push 0x22
push esi
push dword [ebp - 0x454]
call edi
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x308]
push eax
mov dword [ebp - 0x45c], 0x200
mov dword [ebp - 0x410], 0x41b588
mov dword [ebp - 0x40c], 0x41b594
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x454]
push eax
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x308]
push eax
push ebx
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
cmp dword [0x4249b8], ebx
je 0x40148e
cmp dword [0x4249b0], ebx
jne 0x4014b3
mov ecx, dword [ebp - 0x454]
push ebx
lea eax, [ebp - 0x308]
push eax
xor eax, eax
cmp dword [ecx + 0xc], 2
sete al
push dword [ebp + eax*4 - 0x410]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x454]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
push esi
push ebx
lea eax, [ebp - 0x45c]
push eax
push 3
push 0x41b5ac
mov dword [ebp - 0x45c], ebx
call dword [sym.imp.SHELL32.dll_ExtractIconExA]
cmp eax, esi
je 0x4014e9
mov dword [0x4249a4], 2
push 0x20
pop edi
push 0x18
pop eax
push ebx
mov dword [ebp - 0x450], 0x28
mov dword [ebp - 0x44c], edi
mov dword [ebp - 0x448], edi
mov word [ebp - 0x444], si
mov word [ebp - 0x442], ax
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x42c], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push ebx
lea ecx, [ebp - 0x460]
push ecx
push ebx
lea ecx, [ebp - 0x450]
push ecx
push eax
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ecx, dword [0x4249b0]
mov eax, dword [0x4249b4]
lea esi, [eax + ecx*4]
mov eax, dword [0x4249a4]
add esi, dword [0x4249ac]
cdq
idiv esi
sub eax, ecx
add dword [ebp - 0x464], eax
mov eax, ecx
imul eax, dword [ebp - 0x464]
cmp dword [ebp - 0x458], eax
jne 0x4015b3
mov eax, dword [ebp - 0x458]
shr eax, 3
imul eax, dword [0x4249b8]
add eax, dword [0x4249ac]
movzx ecx, cx
add ecx, eax
imul ecx, dword [ebp - 0x458]
mov dword [ebp - 0x458], ecx
xor esi, esi
inc esi
push esi
push ebx
lea eax, [ebp - 0x45c]
push eax
push 3
push 0x41b5b8
mov dword [ebp - 0x45c], ebx
call dword [sym.imp.SHELL32.dll_ExtractIconExA]
cmp eax, esi
je 0x4015e0
mov dword [0x4249a4], 2
mov eax, esi
push 0x18
mov word [ebp - 0x444], ax
pop eax
push ebx
mov dword [ebp - 0x450], 0x28
mov dword [ebp - 0x44c], edi
mov dword [ebp - 0x448], edi
mov word [ebp - 0x442], ax
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x42c], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push ebx
lea ecx, [ebp - 0x460]
push ecx
push ebx
lea ecx, [ebp - 0x450]
push ecx
push eax
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov eax, dword [0x4249ac]
mov edi, dword [0x4249a0]
mov ecx, dword [0x4249b8]
imul edi, eax
lea edx, [ecx + eax]
cmp edi, edx
jne 0x401684
movzx edx, word [ebp - 0x458]
add eax, 0xfffffff9
imul eax, edx
imul eax, ecx
imul eax, dword [ebp - 0x458]
add dword [0x4249a4], eax
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.ole32.dll_CLSIDFromProgID]
lea eax, [ebp - 0x428]
push eax
push str.10.0
call edi
lea eax, [ebp - 0x418]
push eax
push 0x41b5d0
call edi
lea eax, [ebp - 0x438]
push eax
push 0x41b5d8
call edi
mov eax, dword [0x4249ac]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x45c]
push eax
push ebx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayAllocDescriptor]
mov eax, dword [0x4249ac]
cmp eax, ebx
je 0x40178b
push 0xc2
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push ebx
push eax
call fcn.0040b650
add esp, 0xc
push 0x62
lea eax, [ebp - 0xd0]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x408]
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x470]
push eax
push 0x800
push dword [ebp - 0x460]
lea eax, [ebp - 0xd0]
push esi
push eax
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x45c], ebx
call dword [sym.imp.NETAPI32.dll_NetGroupEnum]
mov edi, eax
cmp edi, 0xea
je 0x40178b
cmp edi, ebx
je 0x40178b
lea eax, [ebp - 0xd0]
push eax
push str._ls_n
call fcn.00407911
push edi
push 0x41b5ec
call fcn.00407911
add esp, 0x10
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x308]
push eax
mov dword [ebp - 0x45c], 0x200
mov dword [ebp - 0x410], str.admin
mov dword [ebp - 0x40c], str.privileges
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x454]
push eax
push esi
lea eax, [ebp - 0x308]
push eax
push ebx
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
cmp dword [0x4249b8], ebx
je 0x4017e3
cmp dword [0x4249b0], ebx
jne 0x401808
mov ecx, dword [ebp - 0x454]
push ebx
lea eax, [ebp - 0x308]
push eax
xor eax, eax
cmp dword [ecx + 0xc], 2
sete al
push dword [ebp + eax*4 - 0x410]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x454]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov eax, dword [ebp - 0x458]
cmp eax, dword [0x4249b4]
jne 0x401859
mov ecx, dword [0x4249ac]
mov eax, dword [0x4249b0]
cdq
lea edi, [ecx + 4]
idiv edi
movzx edx, word [ebp - 0x454]
imul edx, dword [0x4249a4]
add edx, dword [0x4249b8]
imul edx, ecx
sub edx, eax
imul edx, dword [ebp - 0x458]
mov dword [ebp - 0x458], edx
lea eax, [ebp - 0x454]
push eax
push esi
mov edi, 0x20008
push edi
mov dword [ebp - 0x454], ebx
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x4018aa
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3f0
jne 0x4018a4
lea eax, [ebp - 0x454]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4018aa
mov dword [0x4249a0], ebx
lea eax, [ebp - 0x40c]
push eax
push 4
push dword [ebp - 0x40c]
push 2
push dword [ebp - 0x454]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4018d1
mov dword [0x4249a4], ebx
mov ecx, dword [0x4249ac]
mov esi, dword [0x4249a0]
mov eax, dword [0x4249b8]
imul esi, ecx
lea edx, [eax + ecx]
cmp esi, edx
jne 0x40190d
movzx edx, word [ebp - 0x458]
imul edx, eax
lea eax, [ecx - 6]
imul eax, dword [ebp - 0x458]
add eax, dword [0x4249a4]
add eax, edx
mov dword [0x4249a4], eax
mov edi, dword [0x4249b0]
mov eax, edi
imul eax, dword [ebp - 0x464]
cmp dword [ebp - 0x458], eax
jne 0x401945
mov eax, dword [ebp - 0x458]
xor edx, edx
push 3
pop esi
div esi
movzx edx, di
imul eax, dword [0x4249b8]
add eax, ecx
add edx, eax
add dword [ebp - 0x458], edx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x470], ebx
cmp ecx, ebx
je 0x40196f
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov edi, dword [0x4249b0]
mov eax, edi
shl eax, 2
push eax
call fcn.0040787d
pop ecx
cmp edi, ebx
jne 0x4019a0
cmp dword [0x4249b4], ebx
je 0x4019a0
push eax
push dword [ebp - 0x470]
push dword [ebp - 0x468]
call dword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov edi, dword [0x4249b0]
mov eax, dword [0x4249b4]
mov dword [ebp - 0x45c], eax
mov esi, edi
mov dword [ebp - 0x46c], edi
cmp eax, ebx
jne 0x4019bd
mov dword [0x4249a4], ebx
push eax
call dword [sym.imp.IMM32.dll_ImmGetDefaultIMEWnd]
mov dword [ebp - 0x460], eax
cmp eax, ebx
jne 0x4019d4
mov dword [0x4249a0], ebx
xor edi, edi
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x448]
push eax
push 8
push 0x283
push dword [ebp - 0x460]
mov dword [ebp - 0x448], edi
mov dword [ebp - 0x444], 0x40
mov dword [ebp - 0x440], esi
call dword [sym.imp.USER32.dll_SendMessageA]
inc edi
cmp edi, 4
jb 0x4019d6
push 0xfe
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.0040b650
add esp, 0xc
push 0xff
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x45c]
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
jne 0x401a55
mov dword [0x4249a0], ebx
mov edi, dword [sym.imp.ole32.dll_OleCreate]
lea eax, [ebp - 0x460]
push eax
mov eax, dword [0x4249ac]
push eax
push eax
push ebx
push 1
push 0x41932c
push 0x41934c
call edi
mov esi, dword [sym.imp.ole32.dll_OleSetContainedObject]
push 1
push dword [ebp - 0x460]
call esi
lea eax, [ebp - 0x460]
push eax
mov eax, dword [0x4249ac]
push eax
push eax
push ebx
push 1
push 0x41932c
push 0x41934c
call edi
push 1
push dword [ebp - 0x460]
call esi
lea eax, [ebp - 0x454]
push eax
push 1
push 0x20008
mov dword [ebp - 0x454], ebx
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x401b04
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3f0
jne 0x401afe
lea eax, [ebp - 0x454]
push eax
push 0x20008
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x401b04
mov dword [0x4249a0], ebx
lea eax, [ebp - 0x40c]
push eax
push 4
push dword [ebp - 0x40c]
push 2
pop esi
push esi
push dword [ebp - 0x454]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x401b2d
mov dword [0x4249a4], ebx
mov ecx, dword [0x4249a4]
mov edx, dword [0x4249ac]
mov eax, dword [ebp - 0x454]
add eax, dword [ebp - 0x464]
add edx, ecx
imul edx, ecx
mov dword [ebp - 0x454], eax
cmp eax, edx
jne 0x401b74
mov edi, dword [0x4249b4]
mov eax, dword [0x4249b8]
shl edi, 3
xor edx, edx
div edi
add eax, dword [0x4249b0]
sub ecx, eax
mov dword [0x4249a4], ecx
push 1
push ebx
lea eax, [ebp - 0x460]
push eax
push 3
push str.shell32.dll
mov dword [ebp - 0x460], ebx
call dword [sym.imp.SHELL32.dll_ExtractIconExA]
cmp eax, 1
je 0x401b9c
mov dword [0x4249a4], esi
push 0x20
pop eax
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x448], eax
xor eax, eax
inc eax
push 0x18
mov word [ebp - 0x444], ax
pop eax
push ebx
mov dword [ebp - 0x450], 0x28
mov word [ebp - 0x442], ax
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x42c], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push ebx
lea ecx, [ebp - 0x40c]
push ecx
push ebx
lea ecx, [ebp - 0x450]
push ecx
push eax
call dword [sym.imp.GDI32.dll_CreateDIBSection]
cmp dword [0x4249ac], ebx
je 0x401ca6
xor eax, eax
push ebx
mov dword [ebp - 0x428], 0x2df01
mov word [ebp - 0x424], ax
mov dword [ebp - 0x422], 0xc00000
mov dword [ebp - 0x41e], ebx
mov word [ebp - 0x41a], 0x4600
mov dword [ebp - 0x418], 0x2df05
mov word [ebp - 0x414], ax
mov dword [ebp - 0x412], 0xc00000
mov dword [ebp - 0x40e], ebx
mov word [ebp - 0x40a], 0x4600
mov dword [ebp - 0x460], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x401ca6
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x418]
push eax
push 4
push ebx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x401ca6
call fcn.00407bd4
mov ecx, dword [0x4249a4]
mov eax, dword [0x4249ac]
mov edi, dword [0x4249b0]
add eax, ecx
imul eax, ecx
cmp dword [ebp - 0x454], eax
jne 0x401ce0
mov esi, dword [0x4249b4]
mov eax, dword [0x4249b8]
shl esi, 3
xor edx, edx
div esi
add eax, edi
sub ecx, eax
mov dword [0x4249a4], ecx
mov eax, edi
imul eax, dword [ebp - 0x464]
cmp dword [ebp - 0x458], eax
jne 0x401d16
mov eax, dword [ebp - 0x458]
push 3
xor edx, edx
pop ecx
div ecx
movzx ecx, di
imul eax, dword [0x4249b8]
add eax, dword [0x4249ac]
add ecx, eax
add dword [ebp - 0x458], ecx
xor eax, eax
mov dword [ebp - 0x440], ebx
lea edi, [ebp - 0x43c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x440]
push eax
push 0x18
push dword [0x4249ac]
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [0x4249b0]
shl eax, 2
push eax
call fcn.00406fa2
mov edi, dword [0x4249a4]
pop ecx
mov ecx, dword [0x4249ac]
lea eax, [edi + ecx]
imul eax, edi
cmp dword [ebp - 0x454], eax
mov eax, dword [0x4249b0]
jne 0x401d8f
mov esi, dword [0x4249b4]
mov eax, dword [0x4249b8]
xor edx, edx
lea esi, [esi + 4]
div esi
mov edx, eax
mov eax, dword [0x4249b0]
add edx, eax
sub edi, edx
mov dword [0x4249a4], edi
mov edx, eax
imul edx, dword [ebp - 0x464]
cmp dword [ebp - 0x458], edx
jne 0x401dc4
mov edx, dword [ebp - 0x458]
shr edx, 2
imul edx, dword [0x4249b8]
movzx esi, ax
add edx, ecx
add esi, edx
imul esi, dword [ebp - 0x458]
mov dword [ebp - 0x458], esi
mov edx, dword [ebp - 0x458]
cmp edx, dword [0x4249b4]
jne 0x401dff
cdq
lea esi, [ecx + 4]
idiv esi
mov esi, eax
mov eax, dword [0x4249b8]
imul eax, ecx
cdq
idiv dword [0x4249b0]
movzx edx, word [ebp - 0x454]
imul edx, ecx
add eax, edi
add eax, esi
add edx, eax
add dword [ebp - 0x458], edx
lea eax, [edi + ecx]
imul eax, edi
cmp dword [ebp - 0x454], eax
jne 0x401e3c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, dword [0x4249b4]
mov ecx, eax
mov eax, dword [0x4249b8]
imul ecx, dword [0x4249b0]
xor edx, edx
lea esi, [esi + 8]
div esi
add ecx, eax
sub dword [0x4249a4], ecx
mov ecx, dword [0x4249ac]
lea eax, [ebp - 0x460]
push eax
push ecx
push ecx
push ebx
push 1
push 0x41932c
push 0x41934c
call dword [sym.imp.ole32.dll_OleCreate]
push 1
push dword [ebp - 0x460]
call dword [sym.imp.ole32.dll_OleSetContainedObject]
mov eax, dword [0x4249ac]
cmp eax, ebx
je 0x401f06
xor eax, eax
push ebx
mov dword [ebp - 0x418], 0x2df01
mov word [ebp - 0x414], ax
mov dword [ebp - 0x412], 0xc00000
mov dword [ebp - 0x40e], ebx
mov word [ebp - 0x40a], 0x4600
mov dword [ebp - 0x428], 0x2df05
mov word [ebp - 0x424], ax
mov dword [ebp - 0x422], 0xc00000
mov dword [ebp - 0x41e], ebx
mov word [ebp - 0x41a], 0x4600
mov dword [ebp - 0x46c], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x401f01
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x428]
push eax
push 4
push ebx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x401f01
call fcn.00407bd4
mov eax, dword [0x4249ac]
mov esi, dword [0x4249a0]
mov ecx, dword [0x4249b8]
imul esi, eax
lea edx, [ecx + eax]
cmp esi, edx
jne 0x401f40
movzx edx, word [ebp - 0x458]
imul edx, ecx
lea ecx, [eax - 6]
imul ecx, dword [ebp - 0x458]
add ecx, dword [0x4249a4]
add ecx, edx
mov dword [0x4249a4], ecx
jmp 0x401f46
mov ecx, dword [0x4249a4]
add eax, ecx
imul eax, ecx
cmp dword [ebp - 0x454], eax
jne 0x401f80
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, dword [0x4249b4]
mov ecx, eax
mov eax, dword [0x4249b8]
mov edi, dword [0x4249b0]
xor edx, edx
imul ecx, edi
lea esi, [esi + 8]
div esi
add ecx, eax
sub dword [0x4249a4], ecx
jmp 0x401f86
mov edi, dword [0x4249b0]
mov eax, dword [0x4249b4]
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x468], edi
cmp eax, ebx
jne 0x401fa1
mov dword [0x4249a4], ebx
push eax
call dword [sym.imp.IMM32.dll_ImmGetDefaultIMEWnd]
mov dword [ebp - 0x470], eax
cmp eax, ebx
jne 0x401fb8
mov dword [0x4249a0], ebx
xor esi, esi
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x448]
push eax
push 8
push 0x283
push dword [ebp - 0x470]
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x444], 0x40
mov dword [ebp - 0x440], edi
call dword [sym.imp.USER32.dll_SendMessageA]
inc esi
cmp esi, 4
jb 0x401fba
push 0xfe
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.0040b650
add esp, 0xc
push 0xff
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x45c]
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
jne 0x402039
mov dword [0x4249a0], ebx
mov eax, dword [0x4249a4]
mov esi, dword [0x4249ac]
lea ecx, [eax + esi]
imul ecx, eax
cmp dword [ebp - 0x454], ecx
jne 0x402085
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, dword [0x4249b4]
mov esi, eax
mov eax, dword [0x4249b8]
mov ecx, dword [0x4249b0]
xor edx, edx
imul esi, ecx
lea edi, [edi + 8]
div edi
add esi, eax
sub dword [0x4249a4], esi
mov esi, dword [0x4249ac]
jmp 0x40208b
mov ecx, dword [0x4249b0]
cmp esi, ebx
je 0x40212d
xor eax, eax
push ebx
mov dword [ebp - 0x418], 0x2df01
mov word [ebp - 0x414], ax
mov dword [ebp - 0x412], 0xc00000
mov dword [ebp - 0x40e], ebx
mov word [ebp - 0x40a], 0x4600
mov dword [ebp - 0x428], 0x2df05
mov word [ebp - 0x424], ax
mov dword [ebp - 0x422], 0xc00000
mov dword [ebp - 0x41e], ebx
mov word [ebp - 0x41a], 0x4600
mov dword [ebp - 0x460], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x402121
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x428]
push eax
push 4
push ebx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x402121
call fcn.00407bd4
mov ecx, dword [0x4249b0]
mov esi, dword [0x4249ac]
mov eax, dword [0x4249b4]
lea edi, [eax + ecx*4]
mov eax, dword [0x4249a4]
cdq
add edi, esi
idiv edi
mov edx, eax
mov eax, dword [ebp - 0x464]
sub edx, ecx
add eax, edx
mov edx, dword [ebp - 0x454]
add edx, eax
mov eax, dword [0x4249a4]
lea edi, [eax + esi]
imul edi, eax
mov dword [ebp - 0x454], edx
cmp edx, edi
jne 0x402182
mov edi, dword [0x4249b4]
mov eax, dword [0x4249b8]
xor edx, edx
lea edi, [edi - 8]
div edi
add eax, ecx
sub dword [0x4249a4], eax
mov edx, dword [0x4249a0]
mov eax, dword [0x4249b8]
imul edx, esi
lea edi, [eax + esi]
cmp edx, edi
jne 0x4021ba
movzx edx, word [ebp - 0x458]
add esi, 0xfffffffc
imul edx, eax
imul esi, dword [ebp - 0x458]
add edx, esi
imul edx, dword [0x4249a4]
mov dword [0x4249a4], edx
mov eax, dword [0x4249b4]
mov dword [ebp - 0x468], eax
mov edi, ecx
mov dword [ebp - 0x46c], ecx
cmp eax, ebx
jne 0x4021d7
mov dword [0x4249a4], ebx
push eax
call dword [sym.imp.IMM32.dll_ImmGetDefaultIMEWnd]
mov dword [ebp - 0x45c], eax
cmp eax, ebx
jne 0x4021ee
mov dword [0x4249a0], ebx
xor esi, esi
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x448]
push eax
push 8
push 0x283
push dword [ebp - 0x45c]
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x444], 0x40
mov dword [ebp - 0x440], edi
call dword [sym.imp.USER32.dll_SendMessageA]
inc esi
cmp esi, 4
jb 0x4021f0
push 0xfe
lea eax, [ebp - 0x207]
push ebx
push eax
mov byte [ebp - 0x208], bl
call fcn.0040b650
add esp, 0xc
push 0xff
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x468]
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
jne 0x402273
xor edx, edx
mov dword [0x4249a0], edx
jmp 0x402279
mov edx, dword [0x4249a0]
mov eax, dword [0x4249a4]
mov ecx, dword [0x4249ac]
lea esi, [eax + ecx]
imul esi, eax
cmp dword [ebp - 0x454], esi
jne 0x4022d2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, dword [0x4249b4]
mov esi, dword [0x4249b8]
mov ecx, eax
xor edx, edx
imul ecx, dword [0x4249b0]
lea edi, [edi + 8]
mov eax, esi
div edi
mov edx, dword [0x4249a0]
add ecx, eax
mov eax, dword [0x4249a4]
sub eax, ecx
mov ecx, dword [0x4249ac]
mov dword [0x4249a4], eax
jmp 0x4022d8
mov esi, dword [0x4249b8]
cmp ecx, ebx
je 0x40235a
mov edi, eax
mov dword [ebp - 0x468], ecx
mov dword [ebp - 0x45c], edx
cmp edi, ebx
jl 0x40235a
mov ebx, dword [sym.imp.GDI32.dll_SetPixelV]
call fcn.004079ca
call fcn.004079ca
cdq
mov esi, 0xff
mov ecx, esi
idiv ecx
mov dword [ebp - 0x460], edx
call fcn.004079ca
cdq
idiv esi
movzx eax, byte [ebp - 0x460]
movzx esi, dl
shl esi, 8
or esi, eax
mov eax, dword [ebp - 0x468]
shl esi, 8
push esi
push dword [ebp - 0x45c]
add eax, edi
push eax
push dword [0x4249ac]
call ebx
mov eax, dword [ebp - 0x45c]
push esi
add eax, edi
push eax
push dword [ebp - 0x468]
push dword [0x4249ac]
call ebx
jmp 0x4022f4
imul edx, ecx
lea edi, [esi + ecx]
cmp edx, edi
jne 0x402383
movzx edx, word [ebp - 0x458]
imul edx, esi
lea esi, [ecx - 4]
imul esi, dword [ebp - 0x458]
add edx, esi
imul edx, eax
mov dword [0x4249a4], edx
cmp dword [0x4249b4], ebx
je 0x402404
mov eax, dword [0x4249b0]
mov edx, eax
neg edx
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x460], edx
mov dword [ebp - 0x464], edx
cmp edx, eax
jg 0x402404
mov ecx, dword [ebp - 0x460]
mov dword [ebp - 0x454], ecx
cmp ecx, eax
jg 0x4023f0
mov esi, dword [ebp - 0x464]
mov edi, eax
imul esi, esi
imul edi, eax
mov ecx, dword [ebp - 0x454]
imul ecx, ecx
add ecx, esi
cmp ecx, edi
jg 0x4023e2
call fcn.004079ca
mov eax, dword [ebp - 0x46c]
inc dword [ebp - 0x454]
cmp dword [ebp - 0x454], eax
jle 0x4023c8
inc dword [ebp - 0x464]
cmp dword [ebp - 0x464], eax
jle 0x4023aa
mov ecx, dword [0x4249ac]
xor eax, eax
mov dword [ebp - 0x440], ebx
lea edi, [ebp - 0x43c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x440]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [0x4249b0]
shl eax, 2
push eax
call fcn.00406fa2
pop ecx
cmp dword [0x4249b0], ebx
je 0x402446
cmp dword [0x4249b8], ebx
jne 0x40249d
push ebx
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x40c]
push eax
mov dword [ebp - 0x428], 1
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
push ebx
call fcn.00407b76
push eax
call fcn.004079b8
pop ecx
pop ecx
push 0x41b624
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleA]
call dword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406fad
leave
ret