Function at 0x402aaf
Capabilities:
Encrypt data using chaskey

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
push edi
cmp al, 0x53
mov eax, dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
mov dword [ebp - 4], eax
mov cl, byte [0x40f1b4]
mov eax, dword [0x40f1b0]
shr eax, cl
mov ecx, dword [0x40f1ac]
mov esi, 0x72fa53f3
xor ecx, eax
xor ecx, 0x5967
mov eax, 0x72fa5a94
sub eax, ecx
mov dword [ebp - 0x38], eax
jmp 0x402b5d
mov eax, dword [0x40f1c0]
mov ecx, dword [0x40f1bc]
xor eax, 0x2859
or ecx, eax
mov eax, dword [0x40f1b8]
imul eax, ecx
xor eax, 0x2eff2c4
mov dword [ebp - 0x28], eax
mov al, byte [0x40f1c6]
movzx ecx, al
mov al, byte [0x40f1c5]
movzx eax, al
cdq
idiv ecx
mov al, byte [0x40f1c4]
movzx eax, al
movzx ecx, dl
and eax, ecx
mov ecx, dword [ebp - 0x28]
mov cl, byte [ecx + 0x40f1c8]
shl eax, cl
mov byte [ebp - 0x29], al
mov eax, dword [0x40f19c]
mov ecx, dword [0x40f198]
shl eax, 8
xor eax, 0x1e90
sub eax, ecx
xor eax, 0x366f99
add dword [ebp - 0x38], eax
mov eax, dword [0x40f1a8]
mov ecx, dword [0x40f1a4]
add eax, 0x4fab
xor edx, edx
div ecx
mov ecx, dword [0x40f1a0]
mov eax, esi
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x38]
cmp ecx, eax
jbe 0x402af0
mov dword [ebp - 0x38], 0xfff7abfe
push ebx
dec edx
mov eax, dword [0x40d004]
mov dword [ebp - 0x28], 0xfff7abc2
mov eax, dword [eax]
cmp ebx, 0x193eb0ea
mov dword [ebp - 0x10], 0x4fb
mov ecx, dword [0x40f1cc]
mov eax, 0xffffa7ce
sub eax, ecx
mov ecx, dword [0x40f1d0]
add ecx, eax
imul ecx, ecx, 0x36e1
add ecx, 0x20ee366c
mov dword [ebp - 8], ecx
mov eax, dword [0x40f1d4]
mov esi, 0x2229
mov ecx, esi
xor edx, edx
div ecx
mov ecx, 0x79ee
jmp 0x402c22
movzx eax, byte [0x40f1d9]
mov dl, byte [0x40f1d8]
add al, dl
mov dl, 0xec
imul dl
xor edx, edx
mov edi, esi
and eax, 0xcc
mov byte [ebp - 0x29], al
mov eax, dword [ebp - 0x10]
and eax, 0x1307
sub eax, 0x5473
xor eax, 0xffffab91
sub dword [ebp - 8], eax
mov eax, dword [0x40f1d4]
div edi
and edx, ecx
lea eax, [edx + 0x176890cc]
mov edx, dword [ebp - 8]
cmp edx, eax
jae 0x402be7
mov edi, dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov dword [ebp - 8], edi
mov cl, byte [0x40f1e4]
mov eax, dword [0x40f1e0]
shr eax, cl
mov ecx, dword [0x40f1dc]
xor edx, edx
or eax, 0x35c0
div ecx
xor edx, edx
xor eax, 0x1af3
add dword [ebp - 8], eax
mov eax, dword [0x40f1ec]
mov ecx, dword [0x40f1e8]
or eax, 0xdec
div ecx
add eax, 0x17cf25fb
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 8]
call eax
mov byte [ebp - 0x29], 0xc3
mov ebx, 0x9fa2f7cd
mov byte [ebp - 0x29], 0xc3
mov al, byte [0x40f1f1]
mov cl, byte [0x40f1f0]
shl al, 7
movzx eax, al
cdq
movzx ecx, cl
idiv ecx
mov edx, 0x453a
xor eax, 0x50
mov byte [ebp - 0x29], al
mov dword [ebp - 0x10], 0xbe7
mov eax, dword [0x40f210]
mov ecx, dword [0x40f20c]
and eax, ecx
mov cl, byte [0x40f204]
shr edx, cl
mov ecx, dword [0x40f1fc]
mov esi, dword [0x40f208]
add esi, eax
mov eax, dword [0x40f200]
and eax, edx
xor eax, 0x130f9442
xor esi, 0x7a90fcc4
push esi
push eax
mov eax, dword [0x40f1f8]
shr ecx, 3
xor eax, ecx
xor eax, 0xaa6e1d9b
push eax
mov eax, dword [0x40f1f4]
mov ecx, dword [ebp - 0x10]
and eax, ecx
xor eax, 0xc6a96d9a
push eax
call fcn.0040bc51
mov word [ebp - 8], ax
cmp ch, 0x7d
mov eax, dword [ebp - 0x38]
mov ecx, dword [0x410ab0]
mov ecx, dword [ecx + 0x19c]
mov ebx, 0x2e321
xor eax, ebx
mov esi, 0xab721
add eax, esi
cmp dword [ecx], eax
je 0x4042d8
test byte [0x410b80], 1
jne 0x402d69
mov eax, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
or dword [0x410b80], 1
mov dword [0x410698], eax
mov eax, dword [ebp - 0x38]
xor eax, ebx
add eax, esi
mov dword [ebp - 0x24], eax
cmp dl, dh
mov ecx, dword [0x40f21c]
mov eax, dword [0x40f218]
shr ecx, 1
imul eax, ecx
mov ecx, dword [0x40f214]
or ecx, eax
mov dword [ebp - 4], ecx
movzx eax, word [0x40f220]
and eax, 0x6fc9
imul eax, eax, 0x6bd7
test byte [0x410b80], 2
mov word [ebp - 8], ax
mov dword [ebp - 8], 0xfff7abfe
jne 0x402dc7
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
or dword [0x410b80], 2
mov dword [0x410694], eax
mov eax, dword [ebp - 8]
xor eax, ebx
add eax, esi
mov dword [ebp - 8], eax
mov ax, word [0x40f228]
movzx eax, ax
cdq
mov ecx, 0x3eb8
idiv ecx
mov cl, byte [0x40f224]
push 0x40
movzx eax, dx
shr eax, cl
xor edx, edx
mov word [ebp - 0xc], ax
mov eax, dword [0x40f230]
mov ecx, dword [0x40f22c]
imul eax, eax, 0x15fc
shr eax, 0x16
and ecx, eax
pop eax
div ecx
mov edx, 0x4103
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ax, word [eax*2 + 0x40f238]
mov cx, word [0x40f234]
imul cx, dx
or ax, cx
mov cx, word [ebp - 0xc]
cmp cx, ax
jbe 0x402eaa
lahf
arpl bx, sp
mov bh, 0xc9
dec ecx
sbb eax, 0x3aac6335
int 0x32
pop esp
int 0x7f
in eax, 0
add byte [eax], al
push esi
add byte [eax], al
add byte [eax], dh
inc esi
sar byte [edi + 0x4b], 0x6d
jae 0x402ea3
jb 0x402e90
dec esi
pop eax
ja 0x402eb5
arpl word [ecx + 0x65], cx
popal
dec esi
js 0x402edb
cmp dword [eax + 0x77], edi
dec edx
dec esp
dec ebx
pop ebx
inc ebp
jae 0x402ea3
cmp dword [ebx + 0x79], esi
push 0x33374e72
aaa
push edx
je 0x402ee3
inc ebx
das
je 0x402ee6
dec esp
jo 0x402ef5
xor esi, dword [esp + ecx*2 + 0x57]
js 0x402ed8
xor ecx, dword [ecx + 0x52]
pop eax
dec esi
jp 0x402f07
jbe 0x402eec
pop edx
jnp 0x402ed5
je 0x402eec
push edx
cmp byte [edx + 0x56], ah
jb 0x402f0f
cmp dword [edx + 0x56], ebp
jae 0x402eed
push edx
cmp ch, byte [edi + 0x3a]
insd dword es:[edi], dx
arpl word [edi + eax*2], si
outsd dx, dword [esi]
cmp ch, byte [ebp + 0x63]
xor al, 0x47
mov cl, byte [0x40f244]
mov cl, byte [0x40f244]
mov eax, 0x6ae8
shl ax, cl
mov ecx, 0x64db
movzx eax, ax
cdq
idiv ecx
mov ecx, 0x5b7e
mov word [ebp - 0xc], dx
mov ax, word [0x40f248]
or ax, cx
mov cx, word [ebp - 0xc]
cmp cx, ax
jne 0x402f5a
hlt
enter 0x7c75, 0x2d
jp 0x402f2c
sub eax, 0x1f4a7a67
pop ds
add dh, byte [edx]
push ebp
push ebp
ficomp word [edx - 0xe8c7b30]
int1
sar byte [ebx], 1
add dword [eax], eax
add byte [eax], ah
add byte [eax], al
inc edx
pop edi
add byte [edx + 0x5f], al
in al, 0xd0
xor al, 0x61
jp 0x402f34
pop eax
cmp bh, byte ss:[ecx]
inc esi
cmp dword [eax + 0x47], ecx
pop ebx
dec edi
xor eax, 0x762f586f
imul esi, dword [0x59364c51], 0x69524845
xor eax, 0x6f643148
xor eax, 0x62773436
pop ecx
jo 0x402f66
push ecx
dec esp
pop ecx
inc ebp
dec eax
push edx
imul esi, dword [0x6f643148], 0x77343635
bound ebx, qword [ecx + 0x70]
inc edx
cmp dword fs:[ecx + ebp*2 + 0x68], eax
xor word [eax + 0x7b], bp
inc edx
jnp 0x402f70
jbe 0x402f64
dec edi
dec ecx
insb byte es:[edi], dx
xor ch, byte [ebp + 0x46]
insd dword es:[edi], dx
inc esi
inc edi
pop ecx
dec eax
bound ebp, qword [ebx + ecx*2 + 0x39]
jae 0x402fa9
xor ebp, dword [ebp + 0x6e]
push ecx
push ebx
dec edi
jns 0x402fbe
jnp 0x402fba
jo 0x402f94
pop ebx
pop ecx
jne 0x402fca
jp 0x402fa8
inc edi
imul esp, dword [ebp + 0x4a], 0x61
inc edx
jbe 0x402efc
mov eax, dword [0x410ab0]
mov ecx, dword [eax + 0x19c]
mov eax, dword [eax + 0x19c]
mov edx, dword [ebp - 8]
mov al, 0xa
inc ecx
add byte [ebx + 0x19c88], cl
add byte [ebx + 0x19c80], cl
add byte [ebx + 0x5f6f855], cl
sbb byte [ecx + eax + 0x558b0000], 0xf8
test byte [0x410b80], 4
mov eax, dword [eax]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x3c]
or byte [ebx], 0x41
add byte [ebx + ecx*4], al
add byte [ebx + 0x3c498b09], cl
lea eax, [eax + edx*8 + 0x78]
mov eax, dword [eax + ecx]
mov dword [ebp - 0x10], eax
jne 0x402f99
mov eax, dword [sym.imp.SHLWAPI.dll_PathParseIconLocationW]
or dword [0x410b80], 4
mov dword [0x410690], eax
mov ecx, dword [0x40f250]
mov eax, dword [0x40f24c]
xor edx, edx
div ecx
xor edx, 0x3a90
shr edx, 3
mov dword [ebp - 0xc], edx
mov ecx, dword [0x40f26c]
nop
cmp al, byte [eax]
add cl, al
ljmp 0xd8b
mov eax, dword [0x40f270]
xor edx, edx
div ecx
add byte [ebx], dh
sal bh, cl
int1
add edx, 0x2ea9ff63
mov dword [ebp - 8], edx
push ebp
clc
jmp 0x40302c
mov dword [ebp - 0x24], 1
mov eax, dword [0x40f278]
mov cl, byte [ebp - 0x24]
or eax, 0x4dc0
shr eax, cl
xor edx, edx
xor eax, 0x3fe3
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax*4 + 0x40f27c]
mov eax, dword [0x40f274]
div ecx
add eax, 0x60d9
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov cl, byte [eax*4 + 0x40f258]
mov edx, dword [0x40f254]
add edx, 0x1e5e
shl edx, cl
mov eax, 0x446d
shr edx, 8
sub eax, edx
add dword [ebp - 8], eax
mov ecx, dword [0x40f268]
mov eax, 0x3fa3
sub eax, ecx
mov cl, byte [0x40f264]
shr eax, cl
mov ecx, dword [ebp - 8]
or eax, 0x6ba5
add eax, 0x2ea9c1d4
cmp ecx, eax
jb 0x402fce
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x403115
mov al, byte [0x40f291]
movzx ecx, byte [0x40f290]
movzx eax, al
and ecx, eax
and ecx, 0x8b
mov byte [ebp - 0x31], cl
mov al, byte [0x40f292]
mov cl, 0x1c
imul cl
mov cl, byte [ebp - 0x31]
add al, 0x39
cmp cl, al
jbe 0x40408b
cmp ch, byte [edi + ecx - 0x64de7d4b]
adc al, 0xea
xor esi, edx
pop esp
xchg ecx, eax
ret
test byte [0x410b80], 8
jne 0x40312f
mov eax, dword [sym.imp.USER32.dll_DeleteMenu]
or dword [0x410b80], 8
mov dword [0x41068c], eax
mov dword [ebp - 0x24], 0x6d5b
mov eax, dword [ebp - 0x24]
add eax, 0x25
shl eax, 0x19
add dword [0x41068c], eax
mov dword [ebp - 0x24], 0x6a0a
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, 0x7951
div ecx
mov ecx, 0x730b
mov eax, edx
xor edx, edx
div ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x128], eax
mov eax, 0x1f37
or edx, 0x508e
xor edx, 0xd7f8d4d8
mov dword [ebp - 0x44], edx
mov ecx, dword [0x40f294]
xor edx, edx
div ecx
xor edx, edx
mov ecx, 0x3e57
or eax, 0x70fb
xor eax, 0xfd5b9e4e
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x120], eax
mov eax, dword [0x40f29c]
shl eax, 0x1d
div ecx
mov eax, dword [0x40f298]
and eax, edx
xor eax, 0x434
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax*4 + 0x40f2a0]
and eax, 0x6239
xor eax, 0x8d01fcb
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x40]
push dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x44]
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x110], eax
mov eax, dword [0x41068c]
call eax
mov dword [ebp - 0x34], 0x3e17
mov eax, dword [0x40f2b8]
add eax, 0x1cc4
push 9
pop ecx
xor edx, edx
div ecx
sub eax, 0xa80
mov dword [ebp - 0x2c], eax
mov eax, dword [0x40f2d4]
mov ecx, dword [0x40f2d0]
and eax, 0x3aed
imul ecx, eax
sub ecx, 0x66d8a80
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0xb8], 0x4021
mov dword [ebp - 0xb4], 0x276a
mov dword [ebp - 0xb0], 0x4efe
mov dword [ebp - 8], 0x1f62
mov dword [ebp - 0x24], 0x7344
mov eax, dword [0x40f2ec]
mov ecx, dword [0x40f2e8]
shr eax, 0xa
imul ecx, eax
xor ecx, 0xb00b4728
push ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
xor edx, edx
div ecx
mov eax, dword [0x40f2e4]
mov ecx, 0x8943a5c4
and edx, eax
mov eax, dword [0x40f2e0]
and eax, 3
shl eax, 0xd
sub eax, 0x463388aa
sub edx, 0x7b8d9193
push edx
push eax
mov eax, dword [0x40f2dc]
imul eax, eax, 0x1feac0
sub ecx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xb8]
push ecx
mov ecx, dword [0x40f2d8]
shr ecx, 0xb
and eax, ecx
imul eax, eax, 0x3c4285b7
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax*4 + 0x40f2c0]
mov ecx, dword [0x40f2bc]
and ecx, 0x3917
xor eax, ecx
sub eax, 0x7cbf0434
push eax
mov eax, dword [ebp - 0x34]
mov ecx, 0x753bdf19
sub ecx, eax
add ecx, dword [0x40f2b4]
push ecx
call fcn.0040b975
mov word [ebp - 8], ax
mov eax, dword [0x40f2f8]
mov ecx, dword [0x40f2f4]
or eax, 0x44b4
add eax, 0xffffc74a
add ecx, eax
xor ecx, 0x737d
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov al, byte [eax + 0x40f2fc]
mov cl, byte [0x40f2f1]
and al, cl
mov cl, byte [0x40f2f0]
shl al, 3
movzx eax, al
shr eax, cl
mov esi, 0x4608
mov byte [ebp - 0x29], al
mov ecx, dword [ebp - 0x10]
mov eax, dword [0x410ab0]
mov eax, dword [eax + 0x19c]
add ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0x73ec
mov eax, dword [ebp - 0x10]
xor eax, 0x2738
sub eax, 0x54d3
mov dword [ebp - 0x10], eax
mov eax, dword [0x40f318]
mov cl, byte [0x40f314]
add eax, 0xffffb255
shr eax, cl
mov ecx, 0x2e8
shr eax, 1
sub ecx, eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ax, word [eax*2 + 0x40f320]
movzx ecx, ax
mov ax, word [0x40f31c]
movzx eax, ax
cdq
idiv esi
xor edx, ecx
sub edx, 0xf6d7
mov word [ebp - 0xc], dx
mov ebx, 0x6802
mov esi, 0x7ade
jmp 0x4034ab
mov ax, word [0x40f32c]
mov cx, word [0x40f328]
and ax, cx
mov ecx, 0x8ba
sub ax, cx
mov cx, word [ebp - 0xc]
cmp cx, ax
jne 0x40348a
mov eax, dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 8], eax
mov eax, dword [0x40f330]
mov ecx, dword [ebp - 8]
shr eax, 0xc
lea eax, [ecx + eax - 3]
mov cl, byte [0x40f338]
mov dword [ebp - 8], eax
mov eax, dword [0x40f334]
shr eax, cl
xor edx, edx
mov ecx, 0x41af
div ecx
mov ecx, 0x5db
sub edx, 0x6218
xor edx, 0xffff9e1e
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0xe4], 0x22c3
mov dword [ebp - 0xe0], 0x23fd
mov dword [ebp - 0xdc], 0x12d2
mov dword [ebp - 0xd8], 0x2e36
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0xe4]
sub ecx, eax
and ecx, 0x6a04
add ecx, 0x342008a6
mov dword [ebp - 0x80], ecx
push dword [ebp - 0x80]
mov eax, dword [ebp - 8]
call eax
mov ax, word [0x40f300]
mov ecx, 0x6402
and ax, cx
add ecx, 0xfffffffd
sub ax, cx
movzx ecx, word [ebp - 0xc]
movzx eax, ax
add ecx, eax
mov word [ebp - 0xc], cx
mov ax, word [0x40f308]
mov ecx, dword [ebp - 0x10]
mov cx, word [ecx*2 + 0x40f30c]
mov dx, word [0x40f304]
sub ax, bx
and dx, ax
xor cx, dx
mov eax, esi
sub ax, cx
mov cx, word [ebp - 0xc]
cmp cx, ax
jne 0x4033d6
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0xc]
mov eax, dword [0x410ab0]
mov eax, dword [eax + 0x19c]
mov eax, dword [eax]
mov al, byte [ecx + eax]
mov byte [ebp - 0x2d], al
mov byte [ebp - 0x5d], 0xc3
mov eax, dword [0x40f33c]
add eax, 0x3351
xor edx, edx
mov ecx, 0x73a5
div ecx
mov eax, 0x3620
mov esi, 0x76d46dec
sub eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [0x40f354]
mov ecx, dword [0x40f350]
shl eax, 5
or ecx, eax
sub ecx, 0x4658
xor ecx, 0xa88f4
mov dword [ebp - 0xc], ecx
mov ecx, dword [0x40f360]
xor edx, edx
mov eax, 0x6d63
div ecx
mov ecx, dword [0x40f35c]
xor edx, edx
div ecx
mov cl, byte [0x40f358]
xor eax, eax
inc eax
shr edx, cl
sub eax, edx
mov dword [ebp - 8], eax
mov dword [ebp - 0xf4], 0xb
mov dword [ebp - 0xf0], 0x70f8
mov dword [ebp - 0xec], 0x3a61
mov dword [ebp - 0xe8], 0x79c8
mov dword [ebp - 0x24], 0x1a96
mov dword [ebp - 0x10], 0x2833
mov ecx, dword [0x40f378]
mov eax, dword [ebp - 0x10]
shl ecx, 0x1b
xor eax, ecx
xor edx, edx
mov ecx, 0x385b
div ecx
xor edx, 0x1303
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov cl, byte [ebp + eax*4 - 0xf4]
mov eax, 0xb3b
shr eax, cl
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x40f364]
imul eax, ecx
xor eax, 0x76d45172
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax*4 + 0x40f37c]
mov eax, dword [0x40f374]
xor edx, edx
div ecx
mov cl, byte [0x40f370]
shr eax, cl
mov ecx, dword [ebp - 0x24]
imul ecx, eax
mov eax, dword [ebp - 8]
xor ecx, esi
cmp eax, ecx
jb 0x403670
mov eax, dword [0x40f388]
mov ecx, 0xfffff665
sub ecx, eax
and ecx, 0x6b55
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax*4 + 0x40f344]
mov eax, dword [0x40f340]
add eax, 0x7682
or ecx, eax
xor edx, edx
mov eax, 0xfbfd
div ecx
xor edx, edx
sub dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax*4 + 0x40f37c]
mov eax, dword [0x40f374]
div ecx
mov cl, byte [0x40f370]
shr eax, cl
mov ecx, dword [ebp - 0x24]
imul ecx, eax
mov eax, dword [ebp - 8]
xor ecx, esi
cmp eax, ecx
jae 0x4035e1
mov eax, dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov byte [ebp - 0x29], 0x23
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x2a88
mov eax, dword [ebp - 0x10]
mov ecx, dword [0x40f390]
imul eax, ecx
mov ecx, dword [0x40f38c]
imul ecx, eax
mov eax, dword [ebp - 8]
lea eax, [eax + ecx - 0x3f040688]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call eax
mov dword [ebp - 0x10], 0x61c
mov eax, dword [ebp - 0x10]
mov ecx, dword [0x40f394]
imul eax, eax, 0x6941
or eax, 0x4028
xor edx, edx
div ecx
mov eax, 0x59f
mov ebx, 0x7ff
mov esi, 0x64f5
xor edx, 0x3b66
mov dword [ebp - 4], edx
mov word [ebp - 8], ax
mov eax, 0x5da2
mov word [ebp - 0x34], ax
mov ecx, dword [0x40f3b0]
xor edx, edx
mov eax, 0x4979
div ecx
mov ecx, dword [0x40f3ac]
xor edx, edx
add eax, 0x4a2c
or ecx, eax
mov eax, 0x287af
div ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ax, word [eax*2 + 0x40f3b4]
mov cx, word [0x40f3a8]
add ax, cx
movzx ecx, word [0x40f3a4]
and cx, ax
mov eax, 0x2a63
imul cx, ax
xor ecx, 0xcf3d
mov word [ebp - 0xc], cx
mov ax, word [ebp - 0x34]
mov cx, word [ebp - 0xc]
shr ax, 1
and ax, bx
add ax, si
cmp cx, ax
jae 0x403887
mov eax, dword [sym.imp.USER32.dll_CopyAcceleratorTableA]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0x997
mov eax, dword [0x40f3c4]
mov ecx, dword [ebp - 0x10]
imul eax, eax, 0x6b8a
or ecx, eax
mov eax, dword [0x40f3c0]
imul ecx, eax
mov eax, 0xc162c67a
sub eax, ecx
add dword [ebp - 0x24], eax
mov eax, dword [0x40f3c8]
and eax, 0x4215
imul eax, eax, 0x69e9
xor edx, edx
mov ecx, 0xda7dcd2
div ecx
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax*4 + 0x40f3d0]
mov eax, dword [0x40f3cc]
shl eax, 4
div ecx
mov ecx, 0x9290
xor edx, 0x7eb64bb2
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x10], 0x66bb
mov eax, dword [ebp - 0x10]
sub ecx, eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x88], eax
xor ecx, 0x2bd5
mov dword [ebp - 0x64], ecx
lea eax, [ebp - 0x88]
mov dword [ebp - 0x114], eax
mov eax, dword [0x40f3dc]
and eax, 0xb80
or eax, 0x7470
xor eax, 0x9ff09beb
shr eax, 2
mov dword [ebp - 0x94], eax
push dword [ebp - 0x94]
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x64]
push dword [ebp - 0x84]
call eax
mov eax, dword [ebp - 4]
mov ax, word [eax*2 + 0x40f39c]
movzx ecx, ax
mov ax, word [0x40f398]
mov dx, word [ebp - 8]
add ax, dx
mov edx, 0x399
add ax, dx
movzx eax, ax
cdq
idiv ecx
movzx ecx, word [ebp - 0xc]
sub edx, 0xeb7
movzx eax, dx
add ecx, eax
mov word [ebp - 0xc], cx
mov ax, word [ebp - 0x34]
mov cx, word [ebp - 0xc]
shr ax, 1
and ax, bx
add ax, si
cmp cx, ax
jb 0x403748
mov dword [ebp - 0x10], 0
mov cl, byte [0x40f3e8]
mov eax, dword [0x40f3e4]
shr eax, cl
mov cl, byte [0x40f3e0]
xor edx, edx
mov esi, 0x5dd0
shl eax, cl
xor eax, 0x70000
mov dword [ebp - 0x34], eax
mov ecx, dword [0x40f40c]
mov eax, dword [0x40f408]
imul ecx, eax
mov eax, dword [0x40f404]
and eax, ecx
mov ecx, 0x7d02
div ecx
xor edx, 0x12b58c42
mov dword [ebp - 8], edx
jmp 0x403947
mov eax, dword [0x40f410]
shr eax, 2
mov ecx, 0x4c6a
div ecx
mov ebx, 0x2381
xor edx, 0xef6
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], 0x1b1a
mov dword [ebp - 0x24], 7
mov eax, dword [ebp - 4]
mov al, byte [eax*4 + 0x40f414]
mov cl, byte [ebp - 0x24]
mov edx, dword [ebp - 0xc]
shl edx, cl
mov cl, al
shl edx, cl
sub edx, 0x448c
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x34]
mov cl, byte [eax*4 + 0x40f3f0]
mov eax, dword [0x40f3ec]
xor edx, edx
div ebx
imul edx, edx, 0x259c
shl edx, cl
xor edx, 0x26800001
add dword [ebp - 8], edx
mov eax, dword [0x40f400]
mov ecx, dword [0x40f3fc]
and eax, esi
xor edx, edx
div ecx
mov ecx, dword [ebp - 8]
xor edx, edx
add eax, 0x12b57fe3
cmp ecx, eax
jbe 0x4038d9
mov eax, dword [0x40f430]
shr eax, 4
sub eax, 0x6fe
mov dword [ebp - 0xc], eax
mov eax, dword [0x40f450]
mov ecx, 0x46c1
div ecx
mov eax, dword [0x40f44c]
or eax, edx
add eax, 0x53e64f71
mov dword [ebp - 8], eax
jmp 0x403a4b
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x24], eax
mov eax, dword [0x40f458]
mov ecx, dword [0x40f454]
xor eax, 0xa7e
shr eax, 1
imul ecx, eax
mov eax, dword [ebp - 0x24]
lea eax, [eax + ecx - 0xa3da990]
mov dword [ebp - 0x24], eax
mov eax, dword [0x40f460]
mov ecx, dword [0x40f45c]
or eax, 0x5c7c
add eax, 0xffff85b0
add ecx, eax
mov dword [ebp - 0xa0], ecx
mov eax, dword [0x40f468]
mov cl, byte [0x40f464]
add eax, 0x7e39
shr eax, cl
xor eax, 0x3f48
mov dword [ebp - 4], eax
mov eax, dword [0x40f46c]
and eax, 0x567b
sub eax, 0x2b37
xor eax, 0x6fc1f829
mov dword [ebp - 0x6c], eax
push dword [ebp - 0x6c]
lea eax, [ebp - 0x6c]
push dword [ebp - 4]
mov dword [ebp - 0x10c], eax
push dword [ebp - 0xa0]
mov eax, dword [ebp - 0x24]
call eax
mov eax, dword [0x40f42c]
mov cl, byte [0x40f428]
xor eax, 0x56bc
shr eax, cl
add eax, 0x1dd
xor eax, 0x1e3
add dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax*4 + 0x40f438]
mov eax, dword [0x40f434]
shr eax, 1
xor edx, edx
div ecx
mov ecx, dword [ebp - 8]
add eax, 0x53e665fa
cmp ecx, eax
jbe 0x40399a
mov al, byte [ebp - 0x2d]
test al, al
je 0x403d1b
bsr eax, ebx
movzx eax, byte [ebp - 0x2d]
add al, 0x32
mov ebx, 0x143b
mov esi, 0x3581
xor eax, 0xbe
mov byte [ebp - 0x2d], al
mov eax, 0x1272
mov word [ebp - 8], ax
mov ax, word [ebp - 8]
movzx eax, ax
or eax, 0x5000
shr eax, 0xa
xor eax, 0x3611
mov word [ebp - 0xc], ax
mov ax, word [0x40f478]
mov ecx, 0x6e98
add ax, cx
movzx eax, ax
cdq
mov ecx, ebx
idiv ecx
mov ax, word [ebp - 0xc]
xor edx, esi
cmp ax, dx
ja 0x403b41
mov cl, byte [0x40f484]
mov eax, dword [0x40f480]
shr eax, cl
mov cl, byte [0x40f47c]
or eax, 0x2c90
shl eax, cl
mov dword [ebp - 4], eax
movzx eax, word [0x40f474]
mov cx, word [0x40f470]
add ax, cx
movzx ecx, word [ebp - 0xc]
xor eax, 0x1318
shr eax, 1
and eax, 0x29cd
add ecx, eax
mov word [ebp - 0xc], cx
mov ax, word [0x40f478]
mov ecx, 0x6e98
add ax, cx
movzx eax, ax
cdq
mov ecx, ebx
idiv ecx
mov ax, word [ebp - 0xc]
xor edx, esi
cmp ax, dx
jbe 0x403ab7
movzx eax, byte [0x40f48d]
mov cl, 0x4a
imul cl
mov cl, byte [0x40f48c]
xor al, 0x5d
sub al, cl
add eax, 0xb3
mov byte [ebp - 0x31], al
mov al, byte [0x40f48b]
shr al, 2
mov cl, 0x3d
sub cl, al
mov al, byte [0x40f48a]
add al, cl
mov cl, byte [ebp - 0x31]
cmp cl, al
ja 0x403bd3
mov al, byte [0x40f490]
movzx ecx, al
mov al, byte [0x40f48f]
movzx eax, al
shr eax, cl
movzx ecx, byte [0x40f48e]
or ecx, eax
mov byte [ebp - 9], cl
mov al, byte [0x40f489]
movzx eax, al
cdq
push 0x1e
pop ecx
idiv ecx
mov al, byte [0x40f488]
movzx ecx, byte [ebp - 0x31]
add al, dl
add al, 6
movzx eax, al
add ecx, eax
mov byte [ebp - 0x31], cl
mov al, byte [0x40f48b]
shr al, 2
mov cl, 0x3d
sub cl, al
mov al, byte [0x40f48a]
add al, cl
mov cl, byte [ebp - 0x31]
cmp cl, al
jbe 0x403b5e
mov al, byte [ebp - 0x5d]
mov cl, byte [ebp - 0x2d]
cmp cl, al
jne 0x403c34
mov eax, dword [0x40f49c]
mov ecx, dword [0x40f498]
xor eax, ecx
mov ecx, dword [0x40f494]
sub eax, ecx
imul eax, eax, 0x1354
sub eax, 0x2f33b3c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ax, word [eax*2 + 0x40f4a4]
movzx ecx, ax
mov ax, word [0x40f4a0]
movzx eax, ax
shr eax, 7
shl eax, cl
mov word [ebp - 8], ax
mov eax, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], eax
jmp 0x403d1b
mov al, byte [ebp - 0x29]
mov cl, byte [ebp - 0x2d]
cmp cl, al
jne 0x403d1b
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 0x3f33
mov dword [ebp - 0x2c], 0xd5
mov dword [ebp - 0xc], 0x67fa
mov eax, dword [ebp - 4]
mov ecx, dword [0x40f4b4]
sub eax, 0x3259
and eax, ecx
add eax, 0x6d56da6
mov dword [ebp - 8], eax
jmp 0x403ced
mov dword [ebp - 0x24], edi
mov eax, dword [0x40f4c4]
and eax, 0x4a66
xor edx, edx
mov ecx, 0x28dc
div ecx
mov ecx, dword [0x40f4c0]
mov eax, edx
xor edx, edx
div ecx
mov cl, byte [0x40f4cc]
xor eax, 0x1786
add dword [ebp - 0x24], eax
mov eax, dword [0x40f4c8]
shr eax, cl
xor eax, 0x4421
or eax, 0x19da
sub eax, 0x4c350473
mov dword [ebp - 4], eax
push eax
mov eax, dword [ebp - 0x24]
call eax
mov ecx, dword [0x40f4b0]
mov eax, dword [0x40f4ac]
and ecx, 0x5c2f
add ecx, 0x4c7a
imul eax, ecx
xor edx, edx
mov ecx, 0x2e71c38
div ecx
sub dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x2c]
xor edx, edx
div ecx
mov cl, byte [0x40f4bc]
shl edx, cl
mov ecx, dword [0x40f4b8]
mov eax, edx
xor edx, edx
div ecx
mov ecx, dword [ebp - 8]
add eax, 0x6d5033a
cmp ecx, eax
jae 0x403c78
bsr edx, ebx
mov eax, dword [ebp - 0x10]
xor edx, edx
test eax, eax
je 0x403dfd
mov eax, dword [sym.imp.USER32.dll_DeleteMenu]
mov dword [ebp - 0x10], eax
mov eax, dword [0x40f4d0]
add eax, 0xba
shl eax, 0x18
add dword [ebp - 0x10], eax
mov eax, dword [0x40f4d8]
mov ecx, dword [0x40f4e0]
xor eax, ecx
mov ecx, dword [0x40f4dc]
xor ecx, eax
sub ecx, 0x7be9
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x40f4e4]
mov eax, 0xbc4
div ecx
mov ecx, dword [0x40f4d4]
xor edx, edx
and ecx, eax
and ecx, 0x6a6b
xor ecx, 0xb06083e4
mov dword [ebp - 0x70], ecx
mov cl, byte [0x40f4f8]
lea eax, [ebp - 0x70]
mov dword [ebp - 0x124], eax
mov eax, 0x186c
shl eax, cl
mov ecx, dword [0x40f4f4]
xor ecx, eax
sub ecx, 0x4654d3f4
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x28], 6
mov dword [ebp - 4], 0x6f1d
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 0x28]
or eax, 0x407f
shr eax, cl
mov ecx, dword [0x40f4fc]
div ecx
xor edx, 0x472604f6
mov dword [ebp - 0x98], edx
push dword [ebp - 0x98]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x9c]
push dword [ebp - 0x70]
call eax
jmp 0x405779
mov ecx, dword [0x40f514]
mov eax, dword [0x40f510]
sub eax, ecx
mov ecx, dword [0x40f50c]
div ecx
mov cl, byte [0x40f508]
mov ebx, 0xd0d
shl edx, cl
xor edx, 0xea000004
mov dword [ebp - 4], edx
mov eax, dword [0x40f534]
mov ecx, dword [0x40f538]
and eax, ecx
and eax, 0x277b
mov ecx, 0x153
sub ecx, eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [0x40f554]
mov eax, dword [0x40f55c]
mov edi, dword [0x40f530]
and ecx, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax*4 + 0x40f518]
mov eax, dword [0x40f504]
xor esi, eax
mov eax, dword [0x40f560]
xor edx, edx
div ebx
mov eax, dword [0x40f558]
and eax, ecx
and eax, 0x1d81
xor eax, 0x4d034af6
shr edi, 0xa
shr edx, 8
sub edx, 0x68285fab
push edx
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x40f540]
mov ecx, dword [0x40f53c]
shr ecx, 0xb
imul eax, ecx
mov ecx, dword [0x40f52c]
add eax, 0x34f3d079
push eax
xor edx, edx
mov eax, edi
div ecx
mov cl, byte [0x40f500]
shr esi, cl
sub esi, 0x446179dc
add edx, 0x6e7d8980
push edx
push esi
call fcn.0040bca1
mov dword [ebp - 4], eax
mov ecx, dword [0x40f578]
mov eax, dword [0x40f574]
xor edx, edx
div ecx
xor edx, edx
mov ecx, eax
mov eax, dword [0x40f570]
sub ecx, eax
mov eax, 0xffffc63c
div ecx
xor edx, edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0x5fd6
mov dword [ebp - 4], 0x1f58
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
or eax, ecx
mov ecx, dword [0x40f58c]
div ecx
xor edx, 0x5fdf
mov dword [ebp - 0x10], edx
mov eax, dword [0x40f5b0]
mov ecx, dword [0x40f5ac]
or eax, 0x74ea
sub eax, ecx
sub eax, 0x5816
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xc4], 0x79d7
mov dword [ebp - 0xc0], 0x19f5
mov dword [ebp - 0xbc], 0x1722
mov eax, dword [0x40f5c4]
mov ecx, dword [0x40f5c0]
and eax, ecx
mov ecx, dword [0x40f5bc]
or ecx, eax
sub ecx, 0x3def
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x4e1d
mov dword [ebp - 0x24], 4
mov eax, dword [0x40f5e4]
mov ecx, dword [ebp - 4]
imul eax, eax, 0x5362
mov ecx, dword [ecx*4 + 0x40f5cc]
mov edx, dword [0x40f5c8]
shr edx, 0xb
xor ecx, edx
mov edx, dword [ebp - 0x10]
mov esi, dword [edx*4 + 0x40f598]
mov edi, dword [0x40f594]
mov edx, 0x8e7dd3da
sub edx, esi
mov esi, dword [0x40f568]
add edi, edx
mov edx, 0xffffb8da
sub edx, esi
mov esi, dword [0x40f56c]
add esi, edx
mov edx, dword [0x40f5e0]
mov ebx, dword [ebp - 0x24]
xor edx, eax
mov eax, 0x35f50829
sub eax, edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
div ebx
xor edx, edx
add eax, dword [0x40f5dc]
shr eax, 1
sub eax, 0x26c5a98f
push eax
mov eax, dword [0x40f5b8]
add eax, ecx
xor eax, 0xdd2df1ad
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xc4]
mov ecx, dword [0x40f5b4]
imul eax, ecx
mov cl, byte [0x40f5a8]
imul eax, eax, 0x2d53
xor eax, 0xc386b0bf
push eax
mov eax, dword [0x40f5a4]
shl eax, cl
shr eax, 2
add eax, 0x6ab65458
push eax
mov eax, dword [0x40f590]
add eax, edi
push eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax*4 + 0x40f580]
mov eax, dword [0x40f57c]
mov edi, 0x3058
div edi
mov eax, 0x7071ee43
imul ecx, edx
xor ecx, 0x97c2f614
push ecx
mov cl, byte [0x40f564]
shl esi, cl
sub eax, esi
push eax
call fcn.0040bef5
mov dword [ebp - 4], eax
mov esi, 0xab721
mov ebx, 0x2e321
mov dword [ebp - 4], 0x19a3
mov eax, dword [0x40f5f8]
mov ecx, dword [0x40f5f4]
or eax, ecx
mov ecx, dword [0x40f5f0]
add eax, ecx
mov ecx, dword [0x40f5ec]
xor edx, edx
div ecx
mov eax, 0x4ddcf38a
mov edi, 0x5cb69a20
sub eax, edx
mov dword [ebp - 8], eax
jmp 0x404104
mov al, byte [0x40f609]
movzx ecx, al
mov eax, 0xb4
cdq
idiv ecx
mov ecx, 0xb8
movzx eax, al
cdq
idiv ecx
movzx ecx, byte [0x40f608]
movzx eax, dl
and ecx, eax
mov byte [ebp - 9], cl
mov eax, dword [ebp - 4]
mov cl, byte [0x40f5e8]
sub eax, 0x3164
shr eax, cl
xor eax, 0xffffe9
sub dword [ebp - 8], eax
mov ecx, dword [0x40f604]
mov eax, dword [0x40f600]
imul ecx, eax
mov eax, edi
sub eax, ecx
mov ecx, dword [0x40f5fc]
add eax, ecx
mov ecx, dword [ebp - 8]
cmp ecx, eax
ja 0x4040c2
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + 0x14]
xor eax, ebx
add eax, esi
cmp dword [ecx], eax
jae 0x4041f5
movzx eax, byte [0x40f60b]
movzx ecx, byte [0x40f60a]
and eax, 0x6c
xor ecx, eax
mov byte [ebp - 0x29], cl
mov al, byte [0x40f60d]
mov cl, byte [0x40f60c]
xor al, 0xb0
shr al, cl
mov cl, byte [ebp - 0x29]
cmp cl, al
jne 0x4041d7
dec ebx
sbb dh, byte [esi + 0x39]
push es
push 0x25
push edi
aas
nop
add dword [esi + 0x59254a1a], edx
inc byte [ecx]
add byte [eax], al
pop eax
add byte [eax], al
add al, bl
jno 0x404196
pop ecx
outsd dx, dword [esi]
push edi
push ecx
inc edi
push edx
push edx
push ebx
push eax
push eax
pop ebx
inc ebx
pop ebx
ja 0x4041db
jb 0x404204
dec edx
inc esp
cmp dword gs:[ebp + 0x45], edx
inc edx
ja 0x4041ec
dec eax
push 0x5b317a32
inc ebx
js 0x404217
imul ebp, dword [ebp + esi*2 + 0x4e], 0x72
ja 0x4041ff
push esi
das
xor eax, 0x71726674
dec ebx
inc esp
inc ebx
jns 0x4041ed
dec ebp
outsb dx, byte [esi]
pop edx
dec edx
dec edi
arpl word [esi + 0x70], bp
push ecx
popal
imul esi, dword [eax + 0x32], 0x32645731
jb 0x4041fa
inc esp
dec edi
push eax
arpl word [eax], si
push ecx
insb byte es:[edi], dx
pop ecx
inc ebp
pop ecx
dec eax
insb byte es:[di], dx
mov eax, dword [ebp - 0x28]
xor eax, ebx
mov ecx, 0xfff548df
sub ecx, eax
mov eax, dword [ebp + 0x14]
add dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
ret
add byte [ecx - 0x3f1603bb], cl
add byte [eax], al
add byte [ecx + 0x40f610], ah
mov dword [ebp - 4], eax
jmp 0x4042b5
mov eax, dword [0x40f610]
shr eax, 7
sub eax, 0x6fa0
outsd dx, dword [esi]
add byte [eax], al
mov dword [ebp - 4], eax
cld
mov eax, dword [0x40f61c]
mov ecx, dword [0x40f618]
add eax, 0x3173
xor edx, edx
div ecx
mov eax, dword [0x40f614]
mov ecx, dword [ebp - 4]
xor eax, edx
cmp ecx, eax
ja 0x40428f
stosd dword es:[edi], eax
iretd
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp + 0x14]
xor ecx, ebx
add ecx, esi
add dword [eax], ecx
test byte [0x410b80], 0x10
jne 0x4042b5
mov eax, dword [sym.imp.USER32.dll_InflateRect]
or dword [0x410b80], 0x10
mov dword [0x410688], eax
test byte [0x410b80], 0x20
jne 0x4043b2
mov eax, dword [sym.imp.USER32.dll_SwapMouseButton]
or dword [0x410b80], 0x20
mov dword [0x410684], eax
jmp 0x4043b2
cmp cx, dx
mov eax, dword [0x40e5a0]
mov dword [ebp + 0x14], eax
mov ax, word [0x40f624]
mov cl, byte [0x40f620]
movzx eax, ax
xor eax, 0x699b
shr eax, cl
mov edi, 0x4097
mov word [ebp - 0xc], ax
mov eax, dword [0x40f62c]
mov ecx, dword [0x40f628]
imul eax, eax, 0x9e6
or ecx, eax
xor ecx, 0x48751fb
mov dword [ebp - 4], ecx
mov eax, 0x7c0
mov word [ebp - 8], ax
mov eax, dword [ebp - 4]
mov cx, word [eax*2 + 0x40f630]
mov ax, word [ebp - 8]
movzx eax, ax
cdq
idiv edi
mov ax, word [ebp - 0xc]
or cx, dx
cmp ax, cx
jb 0x4043b2
add byte [esi - 0x77], ah
inc ebp
hlt
je 0x4042fd
dec edi
leave
invalid
mov dword [ebp - 0x34], 0x42b5
mov eax, dword [0x40f63c]
add eax, 0xa99
xor edx, edx
mov ecx, 0x7695
div ecx
mov edi, 0x762d9767
sub edx, 0x704b
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0xac], 6
mov dword [ebp - 0xa8], 0x3ca0
mov dword [ebp - 0xa4], 0x386c
mov ecx, dword [0x40f648]
mov eax, dword [0x40f644]
xor ecx, 0x3398
imul eax, ecx
mov cl, byte [0x40f640]
shl eax, cl
xor edx, edx
xor eax, 0x5bad8000
mov dword [ebp - 0x24], eax
mov eax, dword [0x40f654]
mov ecx, dword [0x40f650]
sub ecx, eax
and ecx, 0x5f3d
xor ecx, 0x4e12
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 0x41f2
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x40f658]
mov eax, dword [0x40f64c]
div ecx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx*4 + 0x40f668]
xor ecx, eax
add ecx, 0x44c11dfa
mov dword [ebp - 8], ecx
jmp 0x4044af
mov al, byte [0x40f679]
mov cl, byte [0x40f678]
add al, 0x7e
shl al, cl
xor edx, edx
movzx eax, al
shr eax, 2
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x2c]
mov cl, byte [ebp + eax*4 - 0xac]
mov eax, 0x124a
shl eax, cl
mov ecx, dword [ebp - 0x34]
and eax, ecx
mov ecx, dword [0x40f638]
div ecx
mov eax, 0x280
mov ecx, edx
xor edx, edx
div ecx
sub dword [ebp - 8], eax
mov eax, dword [0x40f674]
mov ecx, dword [ebp - 0x10]
add eax, 0x52af
imul ecx, eax
mov eax, dword [ebp - 8]
xor ecx, edi
cmp eax, ecx
ja 0x404469
cmp bx, cx
mov eax, dword [0x40e550]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
add eax, dword [ecx]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
xor eax, ebx
add eax, esi
cmp dword [ecx], eax
jne 0x4045aa
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x38]
xor eax, ebx
xor ecx, ebx
sub ecx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov eax, dword [0x40e550]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
add eax, dword [ecx]
push 0x73
mov dword [ebp - 0x10], eax
mov al, byte [0x40f67b]
mov cl, byte [0x40f67a]
imul cl
movzx eax, al
xor eax, 0x93
cdq
pop ecx
idiv ecx
mov byte [ebp - 0x29], dl
mov al, byte [0x40f67c]
mov cl, byte [ebp - 0x29]
sub al, 0x47
shr al, 2
add al, 0x35
cmp cl, al
jne 0x4045aa
jae 0x4045b4
das
cmp al, 0x62
cmp al, 0x2f
pushal
mov dword [0xdc92d498], eax
inc eax
outsd dx, dword [esi]
in eax, dx
lock add al, byte [eax]
add byte [ebp], cl
add byte [eax], al
lcall 0x4c66, 0x4eed666a
xor al, 0x62
dec esi
push esi
insb byte es:[edi], dx
inc edx
push esi
jae 0x40459a
imul edi, dword [ecx + 0x59], 0x2b
xor bl, byte [edx + 0x71]
push ecx
cmp byte [ecx], bh
push esi
xor eax, dword [edi + 0x6f]
pop eax
dec edi
jno 0x4045c5
js 0x4045e0
dec ebx
cmp byte [edx + 0x2b], dh
push esp
inc ebp
cmp dword [ebp + 0x6a], esp
popal
inc edi
xor al, 0x68
js 0x4045d3
cmp byte [ecx], ch
inc ebp
popal
cmp byte [edx + 0x5a], cl
dec esp
xor esi, dword [esi + 0x36]
push ebx
dec ecx
jne 0x404612
cmp byte [edx], dh
js 0x4045e7
sub esi, dword [edx]
dec ebp
cmp bh, byte [eax]
jbe 0x404611
push esp
mov eax, dword gs:[0x42011c]
mov eax, dword [sym.imp.USER32.dll_DdeQueryNextServer]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
test byte [0x410b74], 1
mov dword [ebp - 0x38], eax
mov eax, dword [0x410ab0]
mov esi, dword [eax + 0x19c]
jne 0x4045dd
invalid
mov al, 0x9c
add dword [eax], eax
add byte [ebp + 0x11], dh
mov eax, dword [sym.imp.SHLWAPI.dll_PathIsSameRootA]
or dword [0x410b74], 1
je 0x4045e0
inc ecx
add byte [ecx], al
mov dword [0x410658], eax
mov cl, byte [0x40ef06]
mov al, 0xe4
shl al, cl
out dx, eax
inc eax
add byte [eax - 0x751f2d1c], dh
or eax, 0x40ef05
mov cl, byte [0x40ef05]
movzx ecx, cl
movzx eax, al
cdq
idiv ecx
or dl, 0xb6
mov byte [ebp - 9], dl
mov al, byte [0x40ef07]
movzx eax, al
or eax, 0x3a
add eax, eax
mov byte [ebp - 9], al
mov dword [ebp - 0x24], 0xfff7abfe
idiv edi
dec dword [edx + 0x40ef080d]
add byte [eax + 0x2ab4], bh
mov cl, byte [0x40ef08]
mov eax, 0x2ab4
shl eax, cl
mov ecx, 0x2902
and eax, 0x3921
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [0x40ef1c]
mov ecx, dword [0x40ef18]
or eax, ecx
or eax, 0xaf4
mov ecx, 0x6ff9
sub ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x40ef20]
movzx ecx, al
mov al, byte [0x40ef15]
movzx eax, al
cdq
idiv ecx
mov ecx, 0xac
movzx eax, dl
shr eax, 3
sub ecx, eax
mov byte [ebp - 0x31], cl
mov al, byte [0x40ef26]
movzx eax, al
cdq
push 0x4a
pop ecx
idiv ecx
mov cl, byte [0x40ef25]
mov al, byte [ebp - 0x31]
shr dl, cl
xor dl, 0x86
cmp al, dl
jb 0x404702
mov eax, dword [0x40ef28]
xor edx, edx
mov ecx, 0xbd
div ecx
push 0x4a
sub edx, 0x5ca
mov dword [ebp - 4], edx
mov al, byte [0x40ef0d]
movzx ecx, al
mov al, byte [0x40ef0c]
movzx eax, al
cdq
idiv ecx
mov ecx, dword [ebp - 0x28]
mov cl, byte [ecx + 0x40ef10]
movzx ecx, cl
add al, 0x12
movzx eax, al
cdq
idiv ecx
movzx ecx, byte [ebp - 0x31]
sub al, 0x13
movzx eax, al
sub ecx, eax
mov byte [ebp - 0x31], cl
mov al, byte [0x40ef26]
movzx eax, al
cdq
pop ecx
idiv ecx
mov cl, byte [0x40ef25]
mov al, byte [ebp - 0x31]
shr dl, cl
xor dl, 0x86
cmp al, dl
jae 0x404672
mov eax, dword [sym.imp.USER32.dll_GetScrollInfo]
mov dword [ebp - 4], 0xfff7abc2
mov dword [ebp - 0x10], 0xfff4abfe
mov dword [ebp - 4], 0xfff7abc1
mov dword [ebp - 4], eax
mov ax, word [0x40ef30]
mov ecx, 0x71fd
imul ax, cx
mov cx, word [0x40ef2c]
movzx eax, ax
shr eax, 1
movzx ecx, cx
cdq
idiv ecx
mov word [ebp - 8], dx
mov eax, dword [0x40ef40]
mov cl, byte [0x40ef3c]
shr eax, 6
shr eax, cl
mov ecx, dword [0x40ef38]
and ecx, eax
add ecx, ecx
mov dword [ebp - 4], ecx
mov ax, word [0x40ef48]
movzx ecx, ax
mov ax, word [0x40ef44]
movzx eax, ax
cdq
idiv ecx
mov ecx, dword [ebp - 4]
mov cx, word [ecx*2 + 0x40ef4c]
imul cx, ax
movzx eax, cx
mov cx, word [0x40ef34]
movzx ecx, cx
cdq
idiv ecx
mov cx, word [ebp - 8]
cmp cx, ax
jne 0x404804
inc esp
jmp 0x85cd7285
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov ax, word [0x40ef54]
movzx ecx, ax
mov eax, 0x7e54
cdq
idiv ecx
mov ecx, 0x2f62
movzx eax, ax
cdq
idiv ecx
mov ecx, 0x7d87
movzx eax, dx
cdq
idiv ecx
mov word [ebp - 8], dx
mov eax, dword [0x40ef58]
add eax, 0x6fe4
shr eax, 4
imul eax, eax, 0x4ad8
sub eax, 0x2213f97
mov dword [ebp - 0x28], eax
mov eax, dword [0x40ef60]
mov ecx, dword [0x40ef5c]
imul eax, eax, 0x225
xor ecx, eax
xor ecx, 0x17b1
sub ecx, 0x7da6f4
mov dword [ebp - 4], ecx
mov eax, 0x152e
mov word [ebp - 0x7c], ax
mov eax, 0x1fa7
mov word [ebp - 0x7a], ax
mov eax, 0x5c30
mov word [ebp - 0x78], ax
mov eax, 0x4b42
mov word [ebp - 0x76], ax
mov eax, 0x266e
mov word [ebp - 0x74], ax
mov eax, dword [ebp - 4]
mov ax, word [eax*2 + 0x40ef68]
movzx ecx, ax
mov ax, word [0x40ef64]
mov edx, 0x62f1
and ax, dx
shl ax, cl
mov ecx, dword [ebp - 0x28]
mov cx, word [ebp + ecx*2 - 0x7c]
or cx, ax
mov ax, word [ebp - 8]
cmp ax, cx
jne 0x404935
retf 0x127e
mov al, byte [0x40ef73]
mov cl, byte [0x40ef72]
movzx eax, al
xor eax, 0x980
shr eax, 6
movzx ecx, cl
cdq
idiv ecx
add eax, 0x64
mov byte [ebp - 0x31], al
jmp 0x4049a1
mov eax, 0x6069
mov word [ebp - 0xc], ax
mov eax, 0x4659
mov word [ebp - 8], ax
movzx eax, word [ebp - 8]
movzx ecx, word [ebp - 0xc]
and eax, ecx
mov word [ebp - 8], ax
mov al, byte [0x40ef71]
movzx ecx, al
mov al, byte [0x40ef70]
shl al, cl
mov ecx, 0xca
sub al, 0x1e
movzx eax, al
cdq
idiv ecx
movzx ecx, byte [ebp - 0x31]
movzx eax, al
sub ecx, eax
mov byte [ebp - 0x31], cl
mov al, byte [0x40ef75]
mov cl, 0x1d
sub cl, al
mov al, byte [0x40ef74]
add al, cl
mov cl, byte [ebp - 0x31]
cmp cl, al
jne 0x404959
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov al, byte [0x40ef76]
movzx ecx, al
push 0x75
pop eax
cdq
idiv ecx
push 5
pop ecx
movzx eax, al
cdq
idiv ecx
mov byte [ebp - 0x29], al
mov al, byte [0x40ef78]
mov cl, byte [0x40ef77]
add al, cl
mov cl, byte [ebp - 0x29]
shr al, 6
cmp cl, al
jne 0x404a6a
push ecx
inc esi
adc byte [ecx - 0x12fa5306], bh
test dword [edx - 0x2d507b3e], edi
jne 0x404a3b
into
add eax, dword [eax]
add byte [ebp], bl
add byte [eax], al
scasd eax, dword es:[edi]
clc
imul edi, dword [edx], 0x56446773
imul edi, dword [ecx + 0x6c], 0x35
imul esi, dword [esi + 0x51], 0x6c677a31
cmp cl, byte [edx + 0x4f]
inc ebx
jns 0x404a88
bound edx, qword [ecx + 0x68]
xor dl, byte [edx + 0x56]
cmp dword [esi + 0x5b], eax
dec ecx
imul ebp, dword [eax + 0x53], 0x75
push ebx
xor al, 0x77
aaa
inc esp
js 0x404a8a
cmp dh, byte ss:[eax + 0x35]
aaa
arpl word [eax + 0x71], bp
pop eax
push edx
dec ebx
inc ebp
jnp 0x404a88
ja 0x404a91
inc ebx
dec ebp
jne 0x404a9a
push esp
push ebx
jae 0x404aa7
cmp dword [ebx + ecx*2 + 0x77], esp
arpl word [ebp + 0x6e], bp
xor byte [edx + 0x56], ah
ja 0x404a90
push eax
js 0x404a96
push 0x5a
push 0x6d
xor byte [ebp + 0x77], ah
dec edx
push ebx
xor ebx, dword [ecx - 0x60]
jp 0x404a5c
mov al, byte [0x40ef7a]
movzx eax, al
inc eax
add byte [edi], cl
mov dh, 0xc0
cdq
push 0x28
pop ecx
idiv ecx
push 0x3e
pop ecx
movzx eax, al
cdq
idiv ecx
movzx ecx, byte [0x40ef79]
mov dh, 0xd
jns 0x404a75
inc eax
add byte [edi], cl
mov dh, 0xc2
movzx eax, dl
ret 0xc803
add ecx, eax
mov byte [ebp - 0x29], cl
mov al, byte [0x40ef7b]
mov cl, 0x35
imul cl
mov cl, byte [ebp - 0x29]
jnp 0x404a82
inc eax
add byte [ecx - 0x751609cb], dh
xor eax, 0x4d8ae9f6
dec ebp
xlatb
sub al, 0x73
cmp cl, al
jne 0x404b19
lcall 0x4be9, 0x3a6bc91a
mov edx, 0x1270ac74
cli
xor dl, byte [eax]
sub eax, 0x42b
pop ebx
add byte [eax], al
add al, bh
cwde
pop es
sub eax, 0x51555454
xor dword [esp + eax*2], esi
push ecx
imul edi, dword [eax + 0x53], 0x534c4838
arpl word [edx + 0x6f], sp
jns 0x404b1d
jmp 0xacb504f7
push edx
cmp byte [ebx + 0x72], dl
ja 0x404b47
jno 0x404b41
xor byte [ebx + 0x54], cl
dec ebp
jbe 0x404b2b
xor al, 0x51
insb byte es:[edi], dx
inc edi
js 0x404b34
dec edi
dec ebx
jbe 0x404b23
jae 0x404b59
inc edx
popal
bound eax, qword [esi + 0x69]
xor byte [esi + 0x62], dl
dec eax
js 0x404b28
inc ecx
outsb dx, byte [esi]
xor byte [esi + 0x57], cl
xor byte [edi + 0x65], dl
dec edx
pop eax
push edx
xor eax, 0x30707438
xor ecx, dword [ecx + 0x65]
arpl word [esi + 0x30], bp
dec eax
jns 0x404b5a
jnp 0x404b41
outsd dx, dword [esi]
outsb dx, byte [esi]
jp 0x404b4b
insd dword es:[edi], dx
inc ebp
test byte [0x410b74], 2
test byte [0x410b74], 2
inc ecx
add byte [edx], al
jne 0x404b33
mov eax, dword [sym.imp.SHLWAPI.dll_IsCharSpaceW]
or dword [0x410b74], 2
mov eax, 0x83004200
or eax, 0x410b74
add ah, byte [ebx + 0x410654]
inc ecx
add byte [edx], al
mov dword [0x410654], eax
mov ecx, dword [0x40ef80]
or eax, 0x40ef80
mov eax, dword [0x40ef7c]
xor edx, edx
div ecx
int1
push 0x61
shr edx, 5
sub edx, 0xfe
add byte [eax], al
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], 0x2ba3
mov ecx, dword [ebp - 4]
cld
mov eax, dword [0x410654]
imul ecx, ecx, 0x27e4
sub eax, ecx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx*4 + 0x40ef84]
lea eax, [ecx + eax + 0x6ccb20c]
mov dword [0x410654], eax
mov eax, dword [0x410654]
call eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
xor eax, ebx
add eax, 0xab720
not eax
and eax, ecx
test byte [0x410b74], 4
mov dword [esi], eax
jne 0x404bb1
mov eax, dword [sym.imp.USER32.dll_CopyAcceleratorTableA]
or dword [0x410b74], 4
mov dword [0x410650], eax
mov eax, dword [0x40ef94]
and eax, 0x7936
xor edx, edx
mov ecx, 0x5cc3
div ecx
mov eax, dword [0x40ef90]
sub edx, eax
xor edx, 0xffffeb0f
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x40ef98]
xor edx, edx
mov eax, 0x48d6
div ecx
mov ecx, dword [0x40efb0]
mov eax, dword [0x40efac]
xor edx, 0xfffffffb
shl edx, 0x1a
add dword [0x410650], edx
xor edx, edx
div ecx
mov ecx, 0xb4000004
xor edx, edx
xor eax, 0xffffffe3
shl eax, 0x1a
sub ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x40efb8]
mov eax, dword [0x40efb4]
imul eax, eax, 0x25d3
div ecx
mov ecx, dword [0x40efa8]
xor edx, edx
sub eax, ecx
xor eax, 0x23be1fe7
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x28], 0x6c96
mov eax, dword [0x40efe0]
mov ecx, dword [0x40efdc]
and eax, ecx
mov cl, byte [0x40efd8]
shl eax, cl
mov ecx, dword [0x40efd4]
imul ecx, eax
sub ecx, 0x547cfffe
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x40efe4]
mov ecx, dword [0x40efd0]
and eax, ecx
mov ecx, dword [ebp - 0x28]
div ecx
mov ecx, dword [0x40efcc]
mov eax, edx
xor edx, edx
div ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x134], eax
sub edx, 0x901
mov dword [ebp - 0x58], edx
mov dword [ebp - 4], 4
mov eax, dword [0x40eff4]
mov ecx, dword [ebp - 4]
shr eax, 8
xor edx, edx
div ecx
xor eax, 0xcff5de54
push eax
push dword [ebp - 0x58]
mov dword [ebp - 4], eax
push dword [ebp - 0x54]
mov eax, dword [0x410650]
call eax
mov eax, dword [esi]
mov ax, word [eax]
mov word [ebp - 0xc], ax
mov eax, dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
mov dword [ebp - 4], eax
mov ax, word [ebp - 0xc]
mov ecx, 0xb58
sub ax, cx
add ecx, 0xffffffe8
xor ax, cx
mov cx, word [0x40e598]
cmp ax, cx
je 0x405484
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], esi
mov eax, dword [0x40f000]
mov ecx, dword [0x40effc]
or eax, ecx
mov cl, byte [0x40eff8]
add eax, 0xffffe4f0
shr eax, cl
push 3
pop ecx
xor edx, edx
sub eax, 0x21b
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x38], 0x14c1
mov dword [ebp - 4], 0x763
mov eax, dword [0x40f030]
mov esi, dword [ebp - 4]
imul eax, eax, 0x3930
div esi
imul edx, edx, 0x5693
sub edx, 0xf78c54
mov dword [ebp - 4], edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [0x40f04c]
mov eax, dword [0x40f048]
sub eax, ecx
mov ecx, dword [0x40f044]
xor edx, edx
div ecx
xor edx, edx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x40f034]
mov ecx, dword [0x40f02c]
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [0x40f01c]
mov ecx, 0xd3
div ecx
mov cl, byte [ebp - 0x28]
shr edi, cl
xor edx, edx
mov esi, eax
mov eax, 0x8d48c38d
sub eax, edi
push eax
mov eax, dword [0x40f040]
or eax, 0x5c86
imul eax, eax, 0x23f8
xor eax, 0xf049f443
push eax
mov eax, dword [ebp - 0x38]
xor eax, dword [ebp - 4]
mov ecx, dword [0x40f028]
and eax, ecx
mov cl, byte [0x40f024]
sub eax, 0x655fbd96
push eax
mov eax, dword [0x40f020]
shl eax, cl
mov ecx, 0x7881
div ecx
mov cl, byte [ebp - 8]
mov eax, dword [ebp - 0xc]
shr esi, cl
mov cl, byte [eax*4 + 0x40f008]
mov eax, dword [0x40f004]
sub eax, 0xb67
shr eax, cl
add esi, 0x1c709b8e
mov ecx, 0x57c3ebb2
sub ecx, eax
xor edx, 0xb645b0e2
push edx
push esi
push ecx
call fcn.0040c1a2
mov byte [ebp - 9], al
mov ecx, dword [0x40f050]
xor edx, edx
mov eax, 0x7324
div ecx
sub edx, 0x7320
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], 0x28a8
mov eax, dword [0x40f074]
mov edx, dword [0x40f068]
imul eax, eax, 0x261a
mov ecx, dword [0x40f080]
mov esi, dword [0x40f07c]
xor ecx, esi
mov esi, 0xf32230a
sub esi, ecx
mov ecx, dword [0x40f078]
xor ecx, 0x492c
sub ecx, 0x21e4244d
push esi
push ecx
mov cl, byte [0x40f070]
shr eax, cl
mov ecx, 0x9fc69d12
shl edx, 2
sub eax, 0x47e33c97
push eax
mov eax, dword [0x40f06c]
shr eax, 6
sub ecx, eax
mov eax, dword [ebp - 4]
xor eax, edx
and eax, 0x6bae
push ecx
xor eax, 0x9961d956
push eax
mov eax, dword [ebp - 0x28]
mov cl, byte [eax*4 + 0x40f054]
mov eax, 0x6562
shr eax, cl
mov ecx, 0xd61069d0
and eax, 0xfffffffc
sub ecx, eax
push ecx
call fcn.0040bb92
test byte [0x410b74], 8
mov dword [ebp - 4], eax
jne 0x404eff
mov eax, dword [sym.imp.KERNEL32.dll_LocalUnlock]
or dword [0x410b74], 8
mov dword [0x41064c], eax
movzx eax, word [0x40e598]
xor eax, 0xb40
add eax, 0xb58
mov word [0x40e598], ax
mov ecx, dword [0x40f088]
mov eax, 0x50f3
sub eax, ecx
mov ecx, dword [0x40f084]
shl eax, 0xe
xor ecx, eax
mov eax, 0xcf9388a
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [0x40f090]
add eax, dword [0x40f08c]
mov ecx, 0x84a
or eax, 0x3ff4
sub eax, 0x7ff3
mov dword [ebp - 8], eax
mov eax, dword [0x40f0bc]
sub ecx, eax
mov eax, dword [0x40f0b8]
or eax, ecx
mov ecx, dword [0x40f0b4]
imul ecx, eax
add ecx, 0xf57b04
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x108], 0x74d1
mov dword [ebp - 0x104], 0x57c6
mov dword [ebp - 0x100], 0x26f
mov dword [ebp - 0xfc], 0x52d2
mov dword [ebp - 0xf8], 0x3983
mov dword [ebp - 4], 0xd
mov cl, byte [ebp - 4]
mov eax, 0x5fb5
shr eax, cl
mov cl, byte [0x40f0c8]
xor edx, edx
shl eax, cl
mov ecx, dword [0x40f0c4]
lea eax, [ecx + eax + 0x7fff8159]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x108]
mov ecx, dword [0x40f0c0]
xor ecx, 0xffffc0a9
shl ecx, 0x11
lea eax, [eax + ecx - 0x6116d529]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax*4 + 0x40f0d4]
mov esi, dword [0x40f0d0]
mov eax, dword [0x40f0cc]
div esi
mov esi, 0x18fa
jmp 0x405074
mov al, byte [0x40f0e2]
mov cl, byte [0x40f0e1]
and al, 0xaf
sub al, cl
movzx ecx, byte [0x40f0e0]
movzx eax, al
xor ecx, eax
mov byte [ebp - 9], cl
mov eax, dword [ebp - 8]
mov ecx, dword [eax*4 + 0x40f094]
xor edx, edx
mov eax, 0x19ab
div ecx
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax*4 + 0x40f0a8]
push 0x65
pop eax
shr edx, cl
shr edx, 4
sub eax, edx
add dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax*4 + 0x40f0d4]
mov edi, dword [0x40f0d0]
mov eax, dword [0x40f0cc]
xor edx, edx
div edi
xor ecx, edx
xor ecx, esi
lea eax, [ecx + 0x7663659b]
mov ecx, dword [ebp - 0x38]
cmp ecx, eax
ja 0x405013
mov eax, dword [sym.imp.SHLWAPI.dll_PathIsRootW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
xor eax, ebx
add eax, 0xac721
mov dword [ebp - 0x2c], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathIsUNCServerA]
mov dword [ebp - 4], eax
mov eax, dword [0x40f0e8]
and eax, 0x395b
xor edx, edx
mov ecx, 0x6855
div ecx
push 0x1d
mov edi, 0x5851
mov esi, 0x81fc
xor edx, 0x2880
shr edx, 7
mov dword [ebp - 0x38], edx
mov ecx, dword [0x40f104]
mov eax, dword [0x40f100]
xor edx, edx
div ecx
mov cl, byte [0x40f0fc]
pop eax
shr edx, cl
mov ecx, 0x261b
sub eax, edx
mov dword [ebp - 0x28], eax
mov eax, dword [0x40f114]
xor eax, 0x73a2
shr eax, 1
sub ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx eax, word [eax*2 + str.CVS]
mov cx, word [0x40f110]
add ax, cx
mov ecx, 0x1d61
or ax, cx
mov ecx, 0x4cd0
sub ax, cx
add eax, 0x2893
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0x28]
mov cx, word [eax*2 + 0x40f108]
mov ax, word [0x40f0f8]
imul cx, ax
and cx, di
mov eax, esi
sub ax, cx
mov cx, word [ebp - 0xc]
cmp cx, ax
ja 0x4051f7
mov eax, dword [0x40f128]
mov ecx, dword [0x40f124]
or eax, ecx
mov ecx, dword [0x40f120]
xor edx, edx
div ecx
sub eax, 0x1c64
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ax, word [eax*2 + 0x40f134]
movzx ecx, word [0x40f130]
mov dx, word [0x40f12c]
imul cx, dx
movzx eax, ax
imul ecx, eax
mov word [ebp - 8], cx
mov eax, dword [ebp - 0x38]
mov ax, word [eax*2 + 0x40f0ec]
movzx ecx, ax
mov ax, word [0x40f0e4]
movzx eax, ax
cdq
idiv ecx
movzx ecx, word [ebp - 0xc]
shl edx, 2
movzx eax, dx
xor eax, 0x749
add ecx, eax
mov word [ebp - 0xc], cx
mov eax, dword [ebp - 0x28]
mov cx, word [eax*2 + 0x40f108]
mov ax, word [0x40f0f8]
imul cx, ax
and cx, di
mov eax, esi
sub ax, cx
mov cx, word [ebp - 0xc]
cmp cx, ax
jbe 0x40512e
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
mov edx, 0x1000
sub edx, ecx
add dword [eax], edx
mov dword [ebp - 0x28], 0x62fa
mov ecx, dword [0x40f144]
mov eax, dword [0x40f140]
add ecx, 0x7f9c
or eax, ecx
mov ecx, dword [0x40f13c]
xor edx, edx
div ecx
mov ecx, 0xd85d6e6e
xor edx, 0xc60
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x40f148]
xor eax, 0x446e
sub ecx, eax
mov eax, dword [ebp - 0x28]
or eax, 0x5beb
push ecx
add eax, 0xf27e12a
push eax
call fcn.0040c157
mov byte [ebp - 9], al
mov dword [ebp - 0x28], 0x5404
mov ecx, dword [0x40f174]
mov eax, dword [0x40f170]
add ecx, 0x2f95
and eax, ecx
mov ecx, dword [0x40f16c]
xor edx, edx
div ecx
mov eax, 0x7bdc
xor edx, 0xc87
mov dword [ebp - 4], edx
mov dword [ebp - 0xd4], 0x239e
mov dword [ebp - 0xd0], 0x52af
mov dword [ebp - 0xcc], 0x1a
mov dword [ebp - 0xc8], 0x6e6
mov esi, dword [0x40f17c]
mov ecx, dword [0x40f160]
imul esi, esi, 0x14f0
xor edx, edx
div ecx
xor edx, edx
mov edi, eax
mov eax, dword [ebp - 4]
mov al, byte [ebp + eax*4 - 0xd4]
mov cl, byte [0x40f178]
shr esi, cl
mov cl, al
mov eax, 0xc1be8df5
shl esi, cl
mov ecx, dword [0x40f168]
sub eax, esi
push eax
mov eax, 0x71d3
sub eax, ecx
mov ecx, 0x545bc
div ecx
xor edx, edx
mov ecx, 0x759a
xor eax, 0xb58f2313
push eax
mov eax, dword [0x40f164]
sub eax, 0x6459
or eax, 0x6b01
sub eax, 0x114d46d9
push eax
mov eax, dword [0x40f15c]
xor eax, edi
imul eax, eax, 0x12cd
add eax, 0x40a7e839
push eax
mov eax, dword [ebp - 0x28]
div ecx
mov eax, dword [0x40f158]
sub edx, eax
xor edx, 0x16993f30
push edx
call fcn.0040bf6c
mov byte [ebp - 9], al
mov al, byte [0x40f182]
shl al, 5
movzx eax, al
push 0x3a
cdq
pop ecx
idiv ecx
xor edx, 0x38
mov byte [ebp - 0x31], dl
mov al, byte [0x40f184]
mov cl, byte [0x40f183]
sub al, 0x25
shr al, cl
mov cl, 0x2d
sub cl, al
mov al, byte [ebp - 0x31]
cmp al, cl
jb 0x4053d7
mov ecx, dword [0x40f188]
xor edx, edx
mov eax, 0x5edc
div ecx
sub edx, 0x2bae
mov dword [ebp - 4], edx
mov al, byte [0x40f181]
mov cl, byte [0x40f180]
or al, 0xd2
and cl, al
sub cl, 0x46
movzx eax, cl
movzx ecx, byte [ebp - 0x31]
sub ecx, eax
mov byte [ebp - 0x31], cl
mov al, byte [0x40f184]
mov cl, byte [0x40f183]
sub al, 0x25
shr al, cl
mov cl, 0x2d
sub cl, al
mov al, byte [ebp - 0x31]
cmp al, cl
jae 0x40536d
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ax, word [eax]
mov word [ebp - 0xc], ax
mov ax, word [0x40e598]
mov cx, word [ebp - 0xc]
cmp cx, ax
je 0x4053f9
sbb ecx, ebx
jmp 0x405085
cmp bl, bh
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x28], eax
mov eax, dword [0x40f190]
mov cl, byte [0x40f18c]
and eax, 0x5c1d
shr eax, cl
xor eax, 0x60
add dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
call eax
movzx eax, word [0x40e598]
mov ecx, 0xb58
sub ax, cx
xor eax, 0xb40
test byte [0x410b74], 0x20
mov word [0x40e598], ax
jne 0x405454
mov eax, dword [sym.imp.SHLWAPI.dll_IsCharSpaceW]
or dword [0x410b74], 0x20
mov dword [0x410648], eax
mov eax, dword [0x40f194]
mov ecx, dword [0x410648]
add eax, 0x412d
imul eax, eax, 0x3f43
xor eax, 0x1fff
lea eax, [ecx + eax - 0x1bf5e90d]
mov dword [0x410648], eax
mov eax, dword [0x410648]
push 0x68
call eax
mov ecx, dword [0x40f688]
mov eax, dword [0x40f684]
add ecx, 0x5b86
imul eax, ecx
mov cl, byte [0x40f680]
shr eax, cl
mov cl, 0x36
sub eax, 0x12d
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x2d], 0xb
mov al, byte [0x40f691]
imul cl
movzx ecx, al
mov al, byte [0x40f690]
movzx eax, al
xor eax, ecx
cdq
mov ecx, 0xec
idiv ecx
sub edx, 0xa4
mov byte [ebp - 0x31], dl
jmp 0x4055c0
test byte [0x410b80], 0x40
jne 0x4054f2
mov eax, dword [sym.imp.USER32.dll_DeleteMenu]
or dword [0x410b80], 0x40
mov dword [0x410680], eax
mov eax, dword [0x40f698]
mov cl, byte [0x40f694]
xor eax, 0x7482
shr eax, cl
mov ecx, dword [0x410680]
lea eax, [ecx + eax - 0x1ca]
mov dword [0x410680], eax
mov eax, dword [0x40f6a4]
mov ecx, dword [0x40f6a0]
xor eax, ecx
mov cl, byte [0x40f69c]
shr eax, cl
mov ecx, 0x8fdc32f7
xor eax, 0x1b81a11b
mov dword [ebp - 0x8c], eax
mov eax, dword [0x40f6a8]
add eax, 0x4ded
or eax, 0x6b80
sub ecx, eax
mov dword [ebp - 0x90], ecx
mov eax, dword [0x40f6ac]
mov ecx, dword [0x40f6b0]
and eax, ecx
and eax, 0x498
sub eax, 0x406
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x40f6b8]
mov ecx, dword [0x40f6b4]
lea eax, [eax + ecx - 0x53f9d4f3]
mov dword [ebp - 0x68], eax
push dword [ebp - 0x68]
lea eax, [ebp - 0x68]
push dword [ebp - 0x90]
mov dword [ebp - 0x130], eax
push dword [ebp - 0x8c]
mov eax, dword [0x410680]
call eax
mov al, byte [0x40f67d]
add al, 8
xor al, 0x1c
mov cl, 0xe
imul cl
movzx ecx, byte [ebp - 0x31]
sub al, 0xb
movzx eax, al
add ecx, eax
mov byte [ebp - 0x31], cl
mov eax, dword [ebp - 0x28]
mov al, byte [eax + 0x40f68c]
mov cl, byte [ebp - 0x2d]
or cl, 0x35
imul cl
mov cl, byte [ebp - 0x31]
sub al, 0x47
cmp cl, al
jne 0x4054d8
mov eax, dword [0x40e594]
test eax, eax
je 0x4056ed
test byte [0x410b80], 0x80
jne 0x405608
mov eax, dword [sym.imp.KERNEL32.dll_FreeLibrary]
or dword [0x410b80], 0x80
mov dword [0x41067c], eax
mov eax, dword [ebp + 0x14]
and dword [eax], 0
mov eax, 0x100
test dword [0x410b80], eax
jne 0x40562b
or dword [0x410b80], eax
mov eax, dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [0x410678], eax
mov eax, dword [0x410ab0]
mov eax, dword [eax + 0x19c]
and dword [eax], 0
and eax, 0xbf62f631
dec dword [0x40e594]
mov eax, 0x7e09
mov word [ebp - 8], ax
mov ax, word [0x40f6c8]
mov ecx, 0x4b1e
add ax, cx
movzx eax, ax
shr eax, 2
add eax, 0x877a
mov word [ebp - 0x2c], ax
mov ax, word [0x40f6d0]
movzx eax, ax
mov edi, 0x5f5d
cdq
mov ecx, edi
idiv ecx
mov esi, 0x5544
mov ecx, 0xe40f
jmp 0x4056d5
movzx eax, byte [0x40f6d2]
xor eax, 0x1c
and eax, 0x7c
mov byte [ebp - 9], al
movzx eax, word [0x40f6c4]
mov edx, 0xff90
and ax, dx
mov edx, 0x80
imul ax, dx
mov dx, word [ebp - 8]
sub ax, dx
movzx edx, word [ebp - 0x2c]
mov ebx, edi
xor eax, 0x1f6
sub edx, eax
mov word [ebp - 0x2c], dx
mov ax, word [0x40f6d0]
movzx eax, ax
cdq
idiv ebx
mov ax, word [0x40f6cc]
and ax, dx
mov dx, word [ebp - 0x2c]
or ax, si
xor ax, cx
cmp dx, ax
jne 0x405689
cmp ebx, 0x44e4163
push dword [ebp + 0x14]
mov eax, 0x7e5274
push eax
push eax
push eax
call fcn.00402aaf
mov eax, dword [0x40f6d8]
xor eax, 0x7302
add eax, 0x33b85d6c
push eax
mov eax, dword [0x40f6d4]
push 3
pop ecx
xor edx, edx
div ecx
sub eax, 0x7631
xor eax, 0x7795b717
push eax
call fcn.0040c358
mov byte [ebp - 9], al
mov eax, 0x200
test dword [0x410b80], eax
jne 0x40574f
or dword [0x410b80], eax
mov eax, dword [sym.imp.SHLWAPI.dll_ChrCmpIA]
mov dword [0x410674], eax
mov ecx, dword [0x40f6dc]
xor edx, edx
mov eax, 0x88f
div ecx
push 0x71
push 0x6d
or eax, 0x39a8
xor eax, 0x39af
add dword [0x410674], eax
mov eax, dword [0x410674]
call eax
mov ecx, dword [0x40f6f0]
mov eax, 0x15ae
sub eax, ecx
mov cl, byte [0x40f6ec]
xor eax, 0x48f4
shr eax, cl
mov edx, 0x7f2f
mov edi, 0x1c18
mov esi, 0x734c
sub eax, 0x7fffc6
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ax, word [eax*2 + 0x40f6f8]
movzx ecx, ax
movzx eax, word [0x40f6f4]
and ax, dx
shl ax, cl
pop ebx
xor eax, 0x964e
mov word [ebp - 0xc], ax
mov cx, word [0x40f704]
mov ax, word [0x40f700]
and cx, di
xor ax, cx
mov cx, word [ebp - 0xc]
add ax, si
cmp cx, ax
jbe 0x405878
mov eax, dword [sym.imp.SHLWAPI.dll_ChrCmpIW]
mov dword [ebp - 0x28], eax
mov cl, byte [0x40f708]
mov eax, 0x1242
shl eax, cl
push 0x6f
push 0x62
or eax, 0xc36
sub eax, 0x6163
xor eax, 0x3fffaad3
add dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
call eax
mov ax, word [0x40f6e8]
movzx ecx, ax
mov ax, word [0x40f6e4]
shl ax, cl
mov cx, word [0x40f6e0]
add cx, ax
movzx eax, cx
movzx ecx, word [ebp - 0xc]
or eax, 0x703
xor eax, 0x376a
sub ecx, eax
mov word [ebp - 0xc], cx
mov cx, word [0x40f704]
mov ax, word [0x40f700]
and cx, di
xor ax, cx
mov cx, word [ebp - 0xc]
add ax, si
cmp cx, ax
ja 0x4057cf
mov eax, 0x400
pop edi
pop esi
test dword [0x410b80], eax
jne 0x405897
or dword [0x410b80], eax
mov eax, dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [0x410670], eax
mov eax, dword [0x40f710]
mov ecx, dword [0x40f70c]
add eax, 0xffff89cb
xor edx, edx
div ecx
mov ecx, dword [0x410670]
xor edx, edx
lea eax, [ecx + eax - 0x494]
mov dword [0x410670], eax
mov dword [ebp - 0x28], 0x7e9c
mov dword [ebp - 4], 0xe
mov ecx, dword [ebp - 4]
mov eax, 0x5580
div ecx
xor edx, edx
add eax, dword [0x40f714]
xor eax, 0x23a9
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x40f718]
mov eax, dword [ebp - 0x28]
div ecx
xor edx, edx
mov ecx, 0x4c74
div ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x118], eax
add edx, 0x5279e19d
mov dword [ebp - 0x18], edx
push dword [ebp - 0x18]
mov eax, dword [0x410670]
call eax
mov dword [ebp + 0x14], 0x92f9309
leave
ret 0x10