Function at 0x424f76
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov dword [ebp - 8], 0xac204e2d
xor eax, eax
mov dword [ebp - 0x28], 0x1ba028ea
inc eax
mov dword [ebp - 0x28], 0xfffffff7
push ebx
mov dword [ebp - 0x28], eax
xor eax, eax
push esi
mov dword [ebp - 0x24], 0x188753e1
push edi
mov dword [ebp - 0x28], 0xffffffff
mov edi, ecx
mov dword [ebp - 0x24], 6
mov byte [ebp - 0x39], dl
mov dword [ebp - 0x40], edi
mov dword [ebp - 8], eax
jmp 0x424fdc
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x424fd9
push eax
push 0x16cf
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1b
jl 0x424fc1
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp edx, ecx
push 3
setne bl
xor edx, edx
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x28], ecx
mov esi, dword [ebp - 8]
imul esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
cmp esi, ecx
setl dl
mov dword [ebp - 0x24], edx
imul ecx, dword [ebp - 8], 0xfffd
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x14], 0x6df37d45
mov dword [ebp - 0x28], eax
call fcn.0041796c
mov dword [ebp - 0x28], 0xdca27289
xor eax, eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0xc], eax
jmp 0x42507b
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14c]
mov dword [ecx + edx*4], 0xf58
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x425068
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x42509e
push eax
push eax
push eax
push eax
push 0x1f26
push 1
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
imul esi, eax
dec edx
mov eax, dword [ebp - 0x14c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
cmp edx, eax
setl cl
xor edx, edx
imul eax, ecx, 0x2524
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov ecx, dword [ebp - 0x28]
setg dl
xor ebx, ebx
cmp edx, esi
setne bl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ebx, ecx
lea ecx, [ebp - 0x14c]
setle al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
call fcn.00417a3e
mov dword [ebp - 0x20], 0xfffffffc
xor eax, eax
mov dword [ebp - 0x34], 0x35c5735e
xor esi, esi
mov dword [ebp - 0x34], 0x94b2ab76
inc esi
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xc], eax
jmp 0x42514e
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x1a4], 9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x42513d
mov dword [ebp - 0x20], eax
push 2
pop edx
cmp dword [ebp - 0x20], eax
jl 0x4251bc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x34], edx
mov dword [ebp - 0xc], eax
jmp 0x425184
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x140], 0x1d52aa0a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x425173
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x4251b7
mov dword [ebp - 0x24], 0xc35240ca
dec dword [ebp - 0x140]
mov dword [ebp - 0xc], eax
jmp 0x4251ad
mov dword [ebp - 0x24], 0x6fda0246
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jle 0x4251a3
dec dword [ebp - 0x1c]
jns 0x425191
dec dword [ebp - 0x20]
jns 0x42515e
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], 0xeb905d09
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x1c], 0xe2efe8e
mov dword [ebp - 0x30], 0xaecaa705
mov dword [ebp - 0xc], eax
jmp 0x4251fb
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x90], 7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4251ea
push 8
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x425229
mov dword [ebp - 0x34], esi
mov dword [ebp - 0xc], eax
jmp 0x42521e
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x220], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x425211
dec dword [ebp - 0x18]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jne 0x425209
mov ecx, dword [ebp - 0x8c]
cmp dword [ebp - 0x88], eax
je 0x4252a4
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x42524e
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x425250
mov edx, esi
mov ecx, dword [ebp - 0x88]
sub edx, ecx
mov ecx, dword [ebp - 0x18]
imul ecx, edx
add ecx, dword [ebp - 0x1c]
jne 0x425266
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x30], esi
jl 0x42526e
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x1c]
cmp ecx, edx
setl bl
cmp ebx, dword [ebp - 0x18]
jne 0x425290
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x425292
mov edx, esi
xor ecx, ecx
cmp edx, 0xffffffff
setne cl
cmp ecx, 0x133e
mov ecx, eax
jge 0x4252a6
mov ecx, esi
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x88]
push 2
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x18]
cmp edx, eax
pop ebx
setle cl
mov dword [ebp - 0x88], ecx
lea ecx, [ebp - 0x1b0]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x20], eax
mov eax, dword [0x47d4fc]
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0xa2a4
mov dword [ebp - 0x34], 0x1d832937
mov dword [ebp - 0x34], 0x57478144
push ebx
mov dword [ebp - 0x28], eax
call fcn.0041796c
mov dword [ebp - 0x18], 0
jmp 0x425326
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1b0]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x425317
push 4
mov dword [ebp - 0x18], 0
pop ecx
jmp 0x425348
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1fc], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x425337
dec dword [ebp - 0x1f8]
lea ecx, [ebp - 0x1b0]
call fcn.00417a3e
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x170]
xor eax, eax
mov dword [ebp - 8], 5
push ebx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.0041796c
xor eax, eax
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0xc], eax
jmp 0x42539f
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x170]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x42538f
cmp dword [ebp - 8], eax
jne 0x4253e5
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 0x170]
setle bl
imul edx, ebx, 0xdec9
mov dword [ecx], edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 8]
cmp ecx, 1
setl bl
xor edx, edx
sub ebx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
shl ebx, 3
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setne dl
xor ebx, ebx
imul edx, edx, 0xfffffffd
cmp edx, ecx
mov ecx, dword [ebp - 8]
setl bl
xor edx, edx
cmp ebx, ecx
setg dl
sub edx, 0xc769
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 8], 0xfffffff9
jmp 0x4254c7
mov dword [ebp - 0x1c], 0x2235
mov dword [ebp - 0x14], 0xc1846e97
mov dword [ebp - 0xc], eax
jmp 0x425458
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x218], 0x9f33d48
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x425447
cmp dword [ebp - 0x20], eax
je 0x425495
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], eax
jne 0x425474
cmp dword [ebp - 0x1c], eax
jne 0x425474
mov edx, eax
jmp 0x425477
xor edx, edx
inc edx
mov ecx, dword [ebp - 8]
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x1c]
setge bl
xor edx, edx
cmp ebx, ecx
setne dl
cmp dword [ebp - 8], edx
jg 0x425495
xor ecx, ecx
inc ecx
jmp 0x425497
mov ecx, eax
xor edx, edx
cmp ecx, 0x585c2c1
mov ecx, dword [ebp - 0x1c]
setge dl
xor ebx, ebx
cmp edx, ecx
setle bl
xor edx, edx
mov dword [ebp - 0x218], ebx
mov ecx, dword [ebp - 0x14]
sub ebx, ecx
mov ecx, dword [ebp - 8]
cmp ebx, ecx
setne dl
mov dword [ebp - 0x20], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x22
jle 0x425434
lea ecx, [ebp - 0x170]
call fcn.00417a3e
cmp byte [ebp - 0x39], 0
je 0x4256bc
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x28], ebx
jne 0x4256bc
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], 0xfffffff1
cmp dword [ebp - 0x18], 0x13
je 0x4255c6
mov dword [ebp - 0x1c], 0xfffffff9
lea ecx, [ebp - 0xcc]
push ebx
call fcn.0041796c
xor eax, eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0xc], eax
jmp 0x42553a
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xcc]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x42552b
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], ecx
jge 0x425554
mov esi, eax
cmp dword [ebp - 0x18], eax
je 0x425556
mov esi, ebx
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp esi, ecx
setge dl
cmp dword [ebp - 0x18], edx
jge 0x425568
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xcc]
mov dword [ecx], 0xb77278fa
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jne 0x425588
mov ecx, dword [ebp - 0xcc]
cmp dword [ecx], eax
mov ecx, eax
je 0x42558a
mov ecx, ebx
mov eax, dword [ebp - 0x18]
sub ecx, eax
sub ecx, 0x2324015f
imul ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
imul ecx, ecx, 0xfffffff6
mov dword [eax], ecx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0xcc]
call fcn.00417a3e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x13
jne 0x42550a
mov esi, dword [ebp + 8]
push 4
pop eax
mov dword [ebp - 8], 0x4ddb
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x1c], 0x380ee91b
mov dword [ebp - 0xc], 7
push ebx
mov dword [esi + 8], eax
call fcn.0041796c
mov dword [ebp - 0x1c], 8
xor eax, eax
mov dword [ebp - 0x24], 0x88f15ea3
mov dword [ebp - 0xc], eax
jmp 0x425615
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xd8]
mov dword [ecx + edx*4], 0xb042
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x425602
cmp dword [ebp - 8], 0xfffffffc
jae 0x425692
cmp dword [ebp - 8], eax
jne 0x425692
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ecx, ebx
setl dl
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 8]
jle 0x42564a
mov ecx, ebx
cmp dword [ebp - 8], eax
jne 0x42564c
mov ecx, eax
mov dword [ebp - 0xc], ecx
xor ebx, ebx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp edx, ecx
setl bl
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xd8]
cmp dword [ecx], eax
je 0x425672
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 8]
inc ebx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 0x1c], eax
jne 0x425692
mov ecx, dword [ebp - 0xd8]
mov edx, eax
cmp dword [ecx], eax
je 0x425694
mov edx, ebx
mov ecx, dword [ebp - 8]
sub edx, ecx
jne 0x4256a5
mov ecx, dword [ebp - 0xd8]
cmp dword [ecx], eax
je 0x4256a7
mov eax, ebx
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x24], eax
call fcn.00417a3e
mov dword [esi + 0xc], 0x47d4fc
mov dword [ebp - 0x14], 0x5664
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x20], 0x4fc2285f
mov eax, 0x7412df3d
mov dword [ebp - 0x1c], 0xf5872d9
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0xc], 0xa5eafb5d
push 3
call fcn.0041796c
xor esi, esi
lea ecx, [ebp - 0xe8]
inc esi
push esi
call fcn.0041796c
mov dword [ebp - 0x48], 0xb167
lea ecx, [ebp - 0x1dc]
mov dword [ebp - 0x18], 0xe43c7d75
mov dword [ebp - 0x24], 0x17c927db
mov dword [ebp - 0x44], 0xf09d89c1
mov dword [ebp - 0x30], 0x75688afc
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x38], 0xc45603fb
push esi
call fcn.0041796c
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x425756
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x138], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x425749
mov dword [ebp - 8], eax
jmp 0x425774
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x164]
mov dword [ecx + edx*4], 0xe13f
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x425761
mov dword [ebp - 8], eax
jmp 0x425792
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xe8]
mov dword [ecx + edx*4], 0xffff
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42577f
mov dword [ebp - 8], eax
jmp 0x4257ab
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1dc]
mov dword [ecx + edx*4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42579c
mov ecx, dword [ebp - 0xe8]
push 4
pop edx
dec dword [ecx]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x134], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0xe8]
mov ecx, dword [ecx]
add ecx, 0xd29be1d9
mov dword [ebp - 0x64], ecx
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
je 0x42584d
mov ecx, dword [ebp - 0xe8]
cmp dword [ecx], eax
je 0x42580b
mov edx, esi
cmp dword [ebp - 0x44], eax
jne 0x42580d
mov edx, eax
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 0x1c]
setge bl
xor edx, edx
cmp ebx, ecx
setl dl
xor ecx, ecx
cmp edx, esi
mov edx, 0xc116104d
setge cl
add ecx, dword [ebp - 0x24]
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x70], ecx
je 0x425841
mov ecx, esi
cmp dword [ebp - 0xc], eax
jne 0x425843
mov ecx, eax
mov dword [ebp - 0x20], ecx
mov ecx, esi
cmp dword [ebp - 0x20], eax
jne 0x42584f
mov ecx, eax
imul ecx, ecx, 0xffff
test ecx, ecx
je 0x4258f3
push 2
lea ecx, [ebp - 0x158]
call fcn.0041796c
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 2
jge 0x42588f
push 4
pop edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x158]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x42587a
mov dword [ebp - 0x18], 0
jmp 0x4258a9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdc], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x425898
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x164]
mov edx, dword [ebp - 0x20]
sub edx, dword [eax + 8]
mov eax, dword [ebp - 0x158]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp dword [eax], 0x68f781be
setg cl
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0x158]
setle al
mov dword [ebp - 0xdc], eax
dec dword [ebp - 0x30]
call fcn.00417a3e
jmp 0x42598b
mov dword [ebp - 0x14], 0x128c85c7
mov dword [ebp - 0x30], 0x89d53c4a
mov dword [ebp - 0x44], 0xc5b2e90e
mov dword [ebp - 0xc], eax
jmp 0x42591e
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xfc], 0xdfbf73ec
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x42590d
mov dword [ebp - 0xf4], 5
mov ecx, dword [ebp - 0x14]
dec dword [ebp - 0x14]
test ecx, ecx
jne 0x425947
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
mov esi, 0xf1df
mov ecx, dword [ebp - 0x6c]
xor edx, edx
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0xf4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
sub esi, ecx
mov ecx, dword [ebp - 0x20]
cmp esi, ecx
setge dl
xor esi, esi
mov dword [ebp - 0x64], edx
inc esi
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x134], esi
jl 0x425988
cmp dword [ebp - 0x14], eax
je 0x425988
mov eax, esi
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x1dc]
call fcn.00417a3e
lea ecx, [ebp - 0xe8]
call fcn.00417a3e
lea ecx, [ebp - 0x164]
call fcn.00417a3e
cmp edi, dword [ebp - 0x28]
jge 0x426915
push dword [ebp + 8]
lea ecx, [ebp - 0x1fc]
xor eax, eax
push ecx
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x60], eax
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x5c], eax
push eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x58], eax
movdqu xmmword [ebp - 0x20c], xmm0
call fcn.00419199
mov dword [ebp - 8], 0x81c2900
lea ecx, [ebp - 0x17c]
push esi
call fcn.0041796c
xor eax, eax
mov dword [ebp - 0x1c], 0x9d07
mov dword [ebp - 0xc], eax
jmp 0x425a19
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x17c]
mov dword [ecx + edx*4], 0x1b05
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x425a06
mov dword [ebp - 8], 3
mov ebx, 0xfff8
cmp dword [ebp - 8], eax
jl 0x425b67
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x2c], esi
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x60]
cmp dword [ecx + edx*4], ebx
jbe 0x425ac5
mov dword [ebp - 0x1c], 0xc38b
mov dword [ebp - 0x24], 0x7359b504
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x60]
cmp dword [ecx + edx*4], eax
je 0x425abb
mov edi, eax
cmp dword [ebp - 0x1c], eax
je 0x425a6a
mov edi, esi
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x60]
add esi, dword [ecx + edx*4]
xor edx, edx
mov ecx, dword [ebp - 8]
cmp esi, ecx
setne dl
xor ebx, ebx
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x60]
dec edx
cmp edx, dword [ecx + 4]
setg bl
xor ecx, ecx
cmp ebx, 5
setl cl
xor ebx, ebx
cmp ecx, 0xfffffff9
mov ecx, dword [ebp - 0x1c]
setle bl
xor edx, edx
cmp ebx, ecx
sete dl
xor esi, esi
inc esi
mov ecx, esi
cmp edi, edx
jle 0x425abd
mov ecx, eax
mov dword [ebp - 0x2c], ecx
jmp 0x425b56
mov dword [ebp - 0x18], 0x1c9b
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], eax
jl 0x425b51
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x60]
mov dword [ecx + esi*4], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x425b49
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x18]
mov edi, ebx
mov ecx, dword [ebp - 0x17c]
neg esi
sbb esi, esi
xor edx, edx
neg esi
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xc9ff7503
setne dl
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jne 0x425b21
mov edi, eax
mov ecx, dword [ebp - 8]
xor edx, edx
cmp edi, ecx
mov ecx, dword [ebp - 0x18]
sete dl
sub ecx, 0x8f0e
add edx, esi
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x425af3
dec dword [ebp - 0x14]
jns 0x425ad8
xor esi, esi
inc esi
cmp dword [ebp - 0x18], eax
jne 0x425b64
dec dword [ebp - 8]
mov ebx, 0xfff8
jns 0x425a33
mov edi, dword [ebp - 0x40]
lea ecx, [ebp - 0x17c]
call fcn.00417a3e
lea ecx, [ebp - 0x60]
call fcn.00417a3e
mov dword [ebp - 0x24], 0x8144ad72
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x38], 0xed1ad67a
mov ebx, 0x47d500
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x2c], 0x3498e64e
push 3
mov dword [ebp - 0x18], ebx
call fcn.0041796c
push 3
mov dword [ebp - 0x30], 0x4677
xor eax, eax
pop edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0x14e76493
mov dword [ebp - 8], eax
jmp 0x425bd3
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xec], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x425bc6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edx
jge 0x425bf6
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x108]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x425be0
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], 0xfffd
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x30]
jl 0x425c0f
mov ecx, esi
cmp dword [ebp - 0xc], eax
jne 0x425c11
mov ecx, eax
dec dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x108]
setne dl
mov ecx, dword [eax + 4]
sub ecx, edx
mov edx, dword [ebp - 0xec]
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
imul eax, ecx
lea ecx, [ebp - 0x108]
sub edx, eax
mov eax, dword [ebp - 0x108]
mov dword [eax + 8], edx
call fcn.00417a3e
test edi, edi
jle 0x42610b
push 2
lea ecx, [ebp - 0x1a0]
call fcn.0041796c
xor eax, eax
mov dword [ebp - 0xc], 7
mov dword [ebp - 0xc], eax
jmp 0x425c8e
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1a0]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x425c7e
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], eax
jl 0x425d53
mov dword [ebp - 0x20], 0x4f402e31
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x425d4a
mov dword [ebp - 0x1c], 0x144ad72d
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x425d3e
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x425d1d
push 0xbc0
push 0x2324
push 0xe67
push eax
push 0x118d
push 0x870
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1a2b
push 0xf34
push 0x1ad3
push 0x2272
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x425d39
push 0x363
push 0x2242
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x425cc2
mov ecx, dword [ebp - 0xc]
dec dword [ebp - 0x20]
jns 0x425cb3
dec dword [ebp - 0xc]
jns 0x425ca0
lea ecx, [ebp - 0x1a0]
call fcn.00417a3e
mov edi, dword [ebx]
push 4
pop edx
add ebx, edx
mov dword [ebp - 0x44], edi
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], eax
jmp 0x425d7f
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x23c], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x425d72
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x425d9e
push 0x5c8
push 0x1857
call dword [sym.imp.USER32.dll_SetCaretPos]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x425db4
push eax
push eax
push 0x1c50
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov esi, dword [ebx]
lea ecx, [ebp - 0x194]
xor eax, eax
inc eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x38], 0xdbf4
mov dword [ebp - 0x48], 0xf402
mov dword [ebp - 0x1c], 0xff74f57b
push eax
call fcn.0041796c
xor eax, eax
mov dword [ebp - 0x2c], 0x4b505d01
push 4
mov dword [ebp - 8], eax
pop edx
jmp 0x425dfb
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1d0], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x425dee
mov dword [ebp - 8], eax
jmp 0x425e14
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x194]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
xor edx, edx
inc edx
cmp dword [ebp - 8], edx
jl 0x425e05
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 5
jl 0x425ee6
push 4
pop edi
mov dword [ebp - 0x14], 0x70ade21
mov dword [ebp - 0x24], 0xc1dfe936
mov dword [ebp - 0xc], eax
jmp 0x425e4c
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x84], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x425e3f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x425ece
mov dword [ebp - 0x30], 5
xor ebx, ebx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], edi
mov ecx, dword [ebp - 0x14]
push 1
mov ecx, dword [ebp + ecx*4 - 0x1d0]
imul ecx, dword [ebp - 8]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
cmp edx, ecx
setg bl
imul edx, ebx, 0xf4f8
add edx, 3
imul edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx + edx*4]
xor edx, edx
cmp ecx, 0xfffffff7
setle dl
xor ebx, ebx
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
pop edx
setg bl
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebp - 0x84]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x425e5a
cmp dword [ebp - 0x38], eax
jne 0x425ee0
inc dword [ebp - 8]
cmp dword [ebp - 8], 5
jge 0x425e2c
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x44]
cmp dword [ebp - 0x1d0], eax
jne 0x425f26
mov eax, dword [ebp - 0x48]
xor edx, edx
add eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], 0xe256654e
mov eax, dword [ebp - 0x1d0]
cmp ecx, eax
mov eax, dword [ebp - 8]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], 6
lea ecx, [ebp - 0x194]
call fcn.00417a3e
push 4
pop eax
add ebx, eax
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x38], 0x425a33ed
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], eax
jmp 0x425f6c
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xb4], 0xfffffff7
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x425f5b
xor edx, edx
mov dword [ebp - 8], eax
inc edx
cmp dword [ebp - 8], 2
jge 0x425f8d
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x130], edx
inc dword [ebp - 8]
jmp 0x425f78
cmp dword [ebp - 0xb4], eax
je 0x4260b6
mov dword [ebp - 0x14], 0x880e033c
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x24], 0xcd021aa2
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x2c], 0xffffffff
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x425fde
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x425fe9
mov ecx, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb4]
xor ebx, ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
setg bl
sub ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xb0]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
cmp ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
setne bl
xor edx, edx
cmp ecx, ebx
setle dl
mov dword [ebp - 0x24], edx
mov edx, 0xafd47030
mov ecx, dword [ebp - 0x24]
cmp edx, ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
cmp ecx, edx
setne bl
xor ecx, ecx
mov dword [ebp - 0xc], ebx
mov edx, dword [ebp - 0xc]
neg edx
add edx, edx
cmp edx, 0x69376522
setl cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
cmp eax, ecx
mov eax, dword [ebp - 0xb4]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x130], ecx
cmp ecx, dword [ebp - 0x14]
jle 0x426094
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x130]
xor ecx, ecx
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
cmp eax, 1
mov ebx, dword [ebp - 0x18]
setl cl
mov dword [ebp - 0x2c], ecx
jmp 0x4260f3
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x4260d4
push 0x2055
push eax
push eax
push eax
push 0x8ad
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4260ed
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4260ea
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jle 0x4260d9
test esi, esi
jne 0x4260fa
add ebx, 8
add ebx, edi
dec dword [ebp - 0x40]
push 1
mov dword [ebp - 0x18], ebx
pop esi
jne 0x425c63
mov dword [ebp - 8], 0x86cce57b
xor eax, eax
push 4
mov dword [ebp - 0x14], 0x6e28
mov dword [ebp - 0xc], eax
pop edx
jmp 0x426131
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x80], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x426123
mov dword [ebp - 8], 0xa0256915
cmp dword [ebp - 8], eax
jne 0x42614f
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, eax
jmp 0x426151
mov ecx, esi
mov dword [ebp - 0x78], ecx
mov edi, dword [ebp - 0x78]
mov esi, dword [ebp - 0x78]
neg edi
mov ecx, dword [ebp - 0x74]
sbb edi, edi
add esi, 0x501bb0b
neg edi
neg esi
push 0xfffffffffffffffd
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
pop ecx
sete dl
cmp ecx, edx
mov ecx, dword [ebp - 0x14]
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setg dl
xor ecx, ecx
cmp edx, 0x7c5c6a81
setle cl
xor edx, edx
imul ecx, dword [ebp - 0x78]
cmp edi, ecx
mov ecx, dword [ebp - 8]
setne dl
sub edx, 0x99e68fc7
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0x78]
setge bl
xor edx, edx
add ebx, 0x2c7e
cmp ebx, ecx
setle dl
mov dword [ebp - 8], edx
cmp dword [ebp - 8], eax
je 0x4263ed
mov dword [ebp - 0x24], 0xffffffff
xor edi, edi
mov dword [ebp - 0x34], eax
inc edi
mov dword [ebp - 0x34], edi
push 3
mov dword [ebp - 0x30], 0xb862
mov dword [ebp - 0xc], eax
pop ebx
jmp 0x4261fe
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x22c], 9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x4261ed
mov dword [ebp - 8], eax
jmp 0x426371
mov dword [ebp - 0x2c], 0xa44bab92
mov dword [ebp - 0x38], 0x98c53483
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x42636e
push 2
lea ecx, [ebp - 0x114]
call fcn.0041796c
mov dword [ebp - 0xc], 0
jmp 0x42624e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x42623b
mov esi, dword [ebp - 0x114]
mov dword [esi], ebx
push edi
lea ecx, [ebp - 0x120]
call fcn.0041796c
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x426282
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x120]
mov dword [ecx + edx*4], 0xf0936a74
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x42626f
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x80]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
cmp ecx, edx
mov ecx, dword [ebp - 0x38]
setne bl
xor edx, edx
cmp ebx, ecx
setge dl
xor ecx, ecx
add edx, 0x138d7ef
cmp edx, 0x78356026
setne cl
xor ebx, ebx
cmp ecx, 0xfd57
mov ecx, dword [ebp - 0x14]
setle bl
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x80]
cmp ebx, ecx
mov ecx, dword [ebp - 0x14]
setl dl
cmp edx, dword [ebp + ecx*4 - 0x80]
jne 0x4262df
mov ecx, edi
cmp dword [ebp - 0x24], eax
jne 0x4262e1
mov ecx, eax
xor edx, edx
cmp ecx, 0x98a80146
mov ecx, dword [ebp - 8]
setne dl
mov dword [ebp + ecx*4 - 0x80], edx
mov ecx, dword [ebp - 0x120]
mov dword [ecx], edx
lea ecx, [ebp - 0x120]
cmp dword [esi + 4], eax
jne 0x42631b
call fcn.00417a3e
mov eax, dword [ebp - 0x114]
dec dword [eax]
jns 0x42625c
jmp 0x426320
call fcn.00417a3e
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x426352
push 0x150c
push 0x2431
push 0x168d
push 0x1b2d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
lea ecx, [ebp - 0x114]
call fcn.00417a3e
inc dword [ebp - 0x14]
push 3
pop ebx
cmp dword [ebp - 0x14], ebx
jle 0x426225
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x42620b
inc dword [ebp - 0x30]
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x18]
mov edi, dword [esi]
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x18], 0x19
cmp dword [ebp - 0x18], 5
mov dword [ebp - 0x1c], edi
jge 0x42644c
xor eax, eax
mov dword [ebp - 0xc], 5
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4263e8
push eax
push 0x1154
push 0x223e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x426439
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x78], ecx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x42637d
push eax
push eax
push eax
push eax
push 0x1f26
xor ebx, ebx
inc ebx
push ebx
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x426380
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x426436
push eax
push eax
push eax
push eax
push 0x1f26
push ebx
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x15
jl 0x426417
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 5
jl 0x4263b7
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
neg edx
push 4
sbb edx, edx
xor ecx, ecx
sub eax, 6
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sete dl
xor ecx, ecx
cmp edx, eax
pop eax
setle cl
add esi, eax
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x24], 0x7ddbf4d
mov dword [ebp - 0x14], 0x9552053
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], 0xfffffff2
cmp dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x18], esi
jle 0x4265df
mov edi, 0xfff8
push ebx
lea ecx, [ebp - 0xa8]
call fcn.0041796c
xor eax, eax
mov dword [ebp - 8], 0xde2167fa
mov dword [ebp - 0xc], eax
jmp 0x4264f1
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xa8]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x4264e2
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jg 0x426591
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x24], 0xf748bbe2
cmp dword [ecx], eax
je 0x426523
mov edx, dword [ebp - 8]
mov esi, ebx
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx + edx*4], eax
jne 0x426525
mov esi, eax
mov edx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx + edx*4], esi
setge bl
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
je 0x426541
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
push 1
sets dl
xor ebx, ebx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], 0xce3d
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx + edx*4], 1
setne bl
cmp edi, ebx
pop ebx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0xc], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jle 0x426502
mov dword [ebp - 0xc], eax
jmp 0x4265b8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x4265b5
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0xa8]
mov ecx, dword [edx + ecx*4]
mov dword [edx + esi*4], ecx
dec dword [ebp - 0x14]
jns 0x42659e
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffef
jle 0x426596
lea ecx, [ebp - 0xa8]
call fcn.00417a3e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffc
jg 0x4264c8
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
push 4
pop eax
mov ebx, dword [esi]
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x24], 0x611bc383
add esi, eax
mov dword [ebp - 0x2c], 0x9f3faa32
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0xc9a130df
mov dword [ebp - 0x14], 0xfffffffe
push 2
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], esi
call fcn.0041796c
xor edx, edx
mov dword [ebp - 0x44], 0x64a0f0c0
mov dword [ebp - 8], 0
inc edx
cmp dword [ebp - 8], 3
jge 0x42663c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x54], edx
inc dword [ebp - 8]
jmp 0x42662a
mov dword [ebp - 8], 0
jmp 0x426658
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c0]
mov dword [eax + ecx*4], 0x814b11f3
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x426645
push 4
mov dword [ebp - 8], 0
pop ecx
jmp 0x426677
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1ec], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x42666a
mov dword [ebp - 0x4c], 0x1b
cmp dword [ebp - 0x4c], 0xffffffec
je 0x426807
xor esi, esi
inc esi
push 0xfffffffffffffffc
pop ebx
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0x412894f
mov dword [ebp - 0x2c], 0xb3799040
mov dword [ebp - 0x2c], 0xb91ee4cf
mov dword [ebp - 0x2c], 0x7c44d996
push 3
call fcn.0041796c
mov dword [ebp - 0x38], ebx
xor eax, eax
mov dword [ebp - 0x48], 0x97e6
mov dword [ebp - 0x30], esi
mov dword [ebp - 0xc], 0xd782
mov dword [ebp - 8], eax
jmp 0x4266f2
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1b4], 0xbcabebf3
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4266e1
mov dword [ebp - 8], eax
jmp 0x42670f
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x188]
mov dword [ecx + edx*4], 0x627e80a7
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4266fc
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x40]
neg edx
sbb edx, edx
imul ecx, dword [ebp - 0x40]
xor ebx, ebx
lea edx, [edx*8 + 0x10]
cmp ecx, edx
setl bl
add ebx, dword [ebp - 0x4c]
mov dword [ebp - 0x24], ebx
xor ebx, ebx
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x4c]
cmp edx, ecx
mov ecx, dword [ebp - 0x24]
setl bl
xor edx, edx
cmp ebx, ecx
setge dl
mov dword [ebp - 0x2c], edx
dec dword [ebp - 0x30]
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
je 0x4267da
mov edx, dword [ebp - 0x38]
xor ebx, ebx
mov ecx, dword [ebp - 0x1e0]
cmp edx, ecx
mov ecx, dword [ebp - 0xc]
setne bl
inc dword [ebp - 0xc]
cmp ebx, ecx
cmovge esi, eax
cmp dword [ebp - 0x1e4], eax
jne 0x42678e
cmp dword [ebp - 0x44], eax
jne 0x42678e
mov edx, eax
jmp 0x426791
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x20]
xor ebx, ebx
cmp edx, ecx
setle bl
xor ecx, ecx
cmp esi, 0xfffffffb
setg cl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0x188]
setge dl
xor ebx, ebx
cmp edx, 0x6c21
setg bl
xor edx, edx
inc ebx
cmp ebx, dword [ecx]
mov ecx, dword [ebp - 0x48]
setge dl
mov dword [ebp - 0x2c], edx
xor edx, edx
cmp dword [ebp - 0x2c], ecx
setl dl
xor esi, esi
inc esi
neg edx
mov edx, esi
jne 0x4267dc
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x188]
call fcn.00417a3e
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xffffffec
jne 0x426690
mov ebx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x18]
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x426823
push 0x13fa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
lea ecx, [ebp - 0x1c0]
call fcn.00417a3e
test ebx, ebx
jne 0x426915
cmp byte [ebp - 0x39], bl
je 0x42684a
cmp dword [ebp - 0x28], 1
jne 0x42684a
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0x34], eax
push edi
mov eax, dword [esi]
add esi, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], esi
call fcn.0046e7ee
mov ebx, eax
xor eax, eax
pop ecx
mov dword [ebp - 0xf0], eax
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0xf0]
push eax
push edi
call fcn.00436ed2
xor ecx, ecx
test edi, edi
mov edi, dword [ebp - 0x9c]
mov esi, ecx
jle 0x4268e9
mov eax, esi
and eax, 0x80000001
jns 0x4268b0
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x34]
add eax, esi
add eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x2c]
jmp 0x4268c5
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x1c]
cmp word [edi + edx*2], cx
jne 0x4268c2
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov eax, dword [ebp - 0x18]
mov al, byte [edx + eax]
mov byte [esi + ebx], al
inc esi
mov eax, dword [ebp - 0x1c]
cmp esi, eax
jl 0x4268a2
jmp 0x4268ec
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], ebx
test edi, edi
je 0x42691a
push edi
call fcn.0046efa6
pop ecx
xor ecx, ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], ecx
jmp 0x42691a
mov esi, dword [ebp + 8]
xor ecx, ecx
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x34], 0x425a33ed
mov dword [ebp + 8], ecx
jmp 0x426944
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0xc0], 0xfffffff7
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x426933
xor edi, edi
mov dword [ebp + 8], ecx
inc edi
cmp dword [ebp + 8], 2
jge 0x426965
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x128], edi
inc dword [ebp + 8]
jmp 0x426950
cmp dword [ebp - 0xc0], ecx
je 0x426a8b
mov dword [ebp - 0x14], 0x880e033c
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x1c], edi
mov dword [ebp + 8], 0xcd021aa2
mov dword [ebp + 8], 9
mov dword [ebp + 8], 0xffffffff
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x4269b7
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor ecx, ecx
cmp dword [ebp - 0x14], ecx
jne 0x4269c2
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
xor ebx, ebx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setg bl
sub ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xbc]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp + 8], ebx
xor ebx, ebx
cmp eax, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
setne bl
xor edx, edx
cmp eax, ebx
setle dl
mov dword [ebp + 8], edx
mov edx, 0xafd47030
mov eax, dword [ebp + 8]
cmp edx, eax
sbb eax, eax
xor ebx, ebx
inc eax
mov dword [ebp + 8], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setne bl
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov edx, dword [ebp - 0x1c]
neg edx
add edx, edx
cmp edx, 0x69376522
setl al
xor edx, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0xc0]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x128], ecx
cmp ecx, dword [ebp - 0x14]
jle 0x426a6d
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x128]
xor ecx, ecx
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
cmp eax, edi
setl cl
mov dword [ebp + 8], ecx
jmp 0x426ac8
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x426aaa
push 0x2055
push ecx
push ecx
push ecx
push 0x8ad
push ecx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
jmp 0x426ac3
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x426ac0
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor ecx, ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x426aaf
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret