Function at 0x42f742
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Log keystrokes
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x34], ecx
inc edi
mov dword [ebp - 8], 0x801fc3ee
mov dword [ebp - 0x38], edi
lea ecx, [ebp - 0x100]
push edi
mov byte [ebp - 0x39], dl
call fcn.0042f3cf
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x42f787
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x100]
mov dword [ecx + edx*4], 0x83398963
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x42f774
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x42f7a7
push eax
push 0x74f
push 0xca9
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor eax, eax
cmp dword [ebp - 8], eax
je 0x42f7df
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 8]
setge bl
sub ebx, 0x5714ffd8
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, ecx
mov ecx, dword [ebp - 0x38]
setle dl
neg ecx
cmp ecx, edx
mov edx, edi
je 0x42f7e1
mov edx, eax
xor ecx, ecx
cmp edx, edi
push 0xfffffffffffffffd
setle cl
xor edx, edx
add ecx, dword [ebp - 8]
pop esi
cmp ecx, esi
mov ecx, dword [ebp - 8]
setle dl
xor ebx, ebx
cmp edx, ecx
setl bl
xor edx, edx
add ebx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ebx, ecx
setge dl
imul edx, dword [ebp - 8]
imul edx, dword [ebp - 8]
test edx, edx
je 0x42f81f
mov edx, edi
cmp dword [ebp - 8], eax
jne 0x42f821
mov edx, eax
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x100]
setne cl
mov dword [eax], ecx
lea ecx, [ebp - 0x100]
call fcn.0042f4a1
mov dword [ebp - 0x30], 0x70ad6f2e
xor eax, eax
mov dword [ebp - 0x10], 0xf89b5461
mov dword [ebp - 0x30], 0xfab8c3ad
mov dword [ebp - 0x18], 0xc58fb770
mov dword [ebp - 0x38], 0x8afa2faf
mov dword [ebp - 0xc], 0x2ee6d058
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x6eff3de0
mov dword [ebp - 0x1c], 0x97e780ca
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x20], 0xde9e8436
dec dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x38]
sub edx, ecx
mov ecx, dword [ebp - 0x18]
neg edx
push 0xfffffffffffffff6
sbb edx, edx
xor ebx, ebx
inc edx
cmp ecx, edx
mov ecx, dword [ebp - 0xc]
setne bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ecx, ecx
cmp edx, 0x28787d63
setle cl
add ecx, 0x6a3f
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], 0xfffffff8
mov dword [ebp - 0x18], 0xd34caa8e
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], eax
jmp 0x42f8ff
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x48], 0x4a8c6a53
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x42f8f1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x42f990
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov edx, dword [ebp + ecx*4 - 0x48]
mov ecx, dword [ebp - 8]
cmp ecx, edx
mov edx, dword [ebp - 8]
setge bl
cmp ebx, edi
sbb ecx, ecx
neg ecx
add ecx, 0x6b6c
sub edx, ecx
mov ecx, dword [ebp - 8]
neg edx
sbb edx, edx
inc edx
cmp dword [ebp + ecx*4 - 0x48], edx
jg 0x42f947
mov edx, eax
cmp dword [ebp - 8], eax
je 0x42f949
mov edx, edi
mov ecx, dword [ebp - 8]
xor ebx, ebx
imul ecx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x48]
mov ecx, dword [ebp - 0x18]
cmp ecx, edx
mov ecx, dword [ebp - 8]
setl bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setne dl
sub edx, dword [ebp + ecx*4 - 0x48]
mov ecx, dword [ebp - 8]
imul esi, edx, 0x9150
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x48]
cmp esi, ecx
setne dl
mov dword [ebp - 0x24], edx
dec dword [ebp - 8]
jns 0x42f910
push 3
mov dword [ebp - 0x24], eax
pop esi
jmp 0x42fa28
mov dword [ebp - 0x10], eax
jmp 0x42f9aa
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x68], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x42f9a0
mov ecx, dword [ebp - 0x64]
xor ebx, ebx
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x18]
cmp ecx, edx
mov ecx, dword [ebp - 0x48]
setl bl
xor edx, edx
add ebx, 0x7a832397
cmp ecx, ebx
mov ecx, dword [ebp - 8]
setne dl
xor ebx, ebx
cmp edx, ecx
sete bl
sub ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x64]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, ecx
mov ecx, dword [ebp - 0x64]
setle dl
sub edx, ecx
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x1c], edx
xor edx, edx
cmp dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x18]
setne dl
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 0x68]
setle bl
xor edx, edx
cmp ebx, ecx
setg dl
xor ecx, ecx
test edx, edx
setg cl
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1d
jle 0x42f99b
mov dword [ebp - 0x28], 0x2c03342e
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 8], 0x409884cb
mov dword [ebp - 0xc], 0x2ff1
mov dword [ebp - 0x30], 0xf8e3bf11
mov dword [ebp - 0x10], eax
jmp 0x42fa6b
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x160], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x42fa5a
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffeb
jge 0x42fb6d
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x2c], 0x263126ff
push edi
call fcn.0042f3cf
mov dword [ebp - 0x18], 0x165352f7
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0xdc630de2
mov dword [ebp - 0x10], eax
jmp 0x42fac8
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x154]
mov dword [ecx + edx*4], 0x9565e08c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x42fab5
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov dword [ebp - 0x160], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x28]
cmp edx, ecx
mov ecx, dword [ebp - 0x24]
setne bl
xor edx, edx
cmp ebx, edi
setl dl
add ecx, edx
je 0x42fb13
mov edx, edi
cmp dword [ebp - 0x2c], eax
jne 0x42fb15
mov edx, eax
mov ecx, dword [ebp - 0x38]
sub edx, ecx
add edx, dword [ebp - 0xc]
je 0x42fb26
mov edx, edi
cmp dword [ebp - 8], eax
jne 0x42fb28
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x154]
add ecx, edx
xor edx, edx
mov dword [eax], ecx
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
cmp eax, edi
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x154]
call fcn.0042f4a1
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffeb
push 0
pop eax
jl 0x42fa7d
mov dword [ebp - 8], eax
jmp 0x42fba8
mov dword [ebp - 0x20], 0x784865e5
cmp dword [ebp - 0x18], eax
je 0x42fb9a
cmp dword [ebp - 8], eax
jne 0x42fb96
cmp dword [ebp - 0x20], eax
je 0x42fb8e
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0xc], eax
je 0x42fb9a
mov edx, edi
jmp 0x42fb9c
mov edx, eax
mov ecx, dword [ebp - 0x20]
imul ecx, edx
mov dword [ebp - 0x20], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x14
jne 0x42fb72
mov ebx, dword [ebp + 8]
mov ecx, dword [0x4b19fc]
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x118]
push edi
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
call fcn.0042f3cf
xor esi, esi
mov dword [ebp - 0x30], 0x72d714f9
mov dword [ebp - 0x10], esi
jmp 0x42fbf2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 0x97f6af11
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x42fbdf
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x118]
mov dword [eax], esi
call fcn.0042f4a1
cmp byte [ebp - 0x39], 0
je 0x42fc9d
cmp dword [ebp - 0x38], edi
jne 0x42fc9d
mov dword [ebp - 0x30], 5
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x30], 0xd19ac196
push edi
mov dword [ebx + 8], 4
call fcn.0042f3cf
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0x67bb1a88
mov dword [ebp - 0x1c], 0x97312b94
mov dword [ebp - 8], esi
jmp 0x42fc69
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x164], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x42fc58
mov dword [ebp - 8], esi
jmp 0x42fc83
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x174]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x42fc73
dec dword [ebp - 0x1c]
lea ecx, [ebp - 0x174]
call fcn.0042f4a1
mov dword [ebx + 0xc], 0x4b19fc
mov ebx, dword [ebp - 0x38]
cmp dword [ebp - 0x34], ebx
jge 0x430a3b
push edi
lea ecx, [ebp - 0xe8]
call fcn.0042f3cf
push 0xfffffffffffffff6
pop esi
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], eax
jmp 0x42fcd5
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xe8]
mov dword [ecx + edx*4], 0x1713b910
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x42fcc2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x42fd1d
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xe8]
cmp dword [ecx + edx*4], eax
jne 0x42fd1d
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x42fd18
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1fa2
push 0x36d
push 0x1730
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x42fce2
lea ecx, [ebp - 0xe8]
call fcn.0042f4a1
mov dword [ebp - 0x2c], 0x506d
mov ebx, 0x4b1a00
mov dword [ebp - 0x20], 0xb1c2
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x24], 0xd670012a
mov dword [ebp - 8], 5
mov dword [ebp - 0x10], 0xd33b947
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], eax
jmp 0x42fd75
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xa8], 0xca4e8652
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x42fd64
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0x2c], ecx
jg 0x42fda2
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x42ff4b
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x42ff49
mov dword [ebp - 0x1c], 0xc25fa5fe
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x2c], 0xfffffff8
push 2
call fcn.0042f3cf
xor eax, eax
mov dword [ebp - 0xc], 0x1f3403ca
mov dword [ebp - 0x10], eax
jmp 0x42fddb
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xb4]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x42fdcb
cmp dword [ebp - 0x20], eax
je 0x42fdff
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
inc dword [ebp - 0xc]
cmp ecx, edx
jle 0x42fdff
cmp dword [ebp - 0x24], 0x91e6
jl 0x42fdff
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp edx, ecx
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0xb4]
setne bl
mov ecx, dword [ebp - 8]
add edx, ebx
mov dword [esi + 4], edx
add ecx, edx
je 0x42fe32
mov eax, dword [esi + 4]
mov dword [ebp - 0x10], eax
jmp 0x42ff39
push 3
pop ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], 0xffffffe6
jmp 0x42ff2f
mov dword [ebp - 0xc], 0x4c259dba
mov dword [ebp - 8], eax
jmp 0x42ff23
mov dword [ebp - 0x10], eax
jmp 0x42fe69
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1c4], 0xfff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x42fe58
mov dword [ebp - 0x18], eax
jmp 0x42fe8b
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + ecx*4 - 0xa8]
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0xa8], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x42fe74
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0xa8], 0x14e0d
jg 0x42fea5
cmp dword [ebp - 0xc], eax
je 0x42feac
mov ecx, edi
cmp dword [ebp - 0x1c], eax
jne 0x42feae
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 8]
push 3
mov ecx, dword [ebp + ecx*4 - 0xa8]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xa8]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
neg esi
sbb esi, esi
add esi, 0xc2b9bf63
neg esi
sbb esi, esi
xor edx, edx
inc esi
add esi, ebx
cmp ecx, esi
mov ecx, dword [ebp - 0x1c]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x10]
setne bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0xb4]
pop ebx
setg dl
neg edx
mov dword [ecx], edx
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0xa0]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c0], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x42fe53
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x42fe44
lea ecx, [ebp - 0xb4]
call fcn.0042f4a1
mov ebx, 0x4b1a00
xor eax, eax
cmp dword [ebp - 0x34], 0
mov dword [ebp - 0x10], eax
jle 0x4305a4
mov dword [ebp - 0x18], 0xb659d568
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x20], 0xa8bc07c2
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0xc], 0xae2fe817
push 2
call fcn.0042f3cf
push edi
lea ecx, [ebp - 0x148]
call fcn.0042f3cf
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x42ffa3
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x130]
mov dword [ecx + edx*4], 0x2a3062a4
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x42ff90
mov dword [ebp - 8], eax
jmp 0x42ffc1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x148]
mov dword [ecx + edx*4], 0x77722aba
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x42ffae
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], eax
je 0x42ffef
cmp dword [ebp - 0x18], eax
jne 0x42ffed
cmp dword [ebp - 0xc], eax
je 0x42ffef
mov ecx, edi
mov edx, dword [ebp - 0x18]
xor ebx, ebx
imul edx, dword [ebp - 0x18]
imul edx, ecx
mov ecx, dword [ebp - 0x18]
cmp ecx, edx
mov ecx, dword [ebp - 0x20]
setle bl
sub ebx, ecx
mov ecx, dword [ebp - 0x130]
mov dword [ecx + 4], ebx
jne 0x43001a
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x43001c
mov edx, edi
mov ecx, dword [ebp - 0x148]
mov dword [ecx], edx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x430042
push 0x6d1
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x148]
call fcn.0042f4a1
lea ecx, [ebp - 0x130]
call fcn.0042f4a1
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebx]
mov dword [ebp - 0x28], 0x39b6
mov dword [ebp - 0x18], 0xb743d837
mov dword [ebp - 0x2c], 0xd39c7c6f
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x43017c
mov dword [ebp - 0x24], 0x5751cfd1
mov dword [ebp - 0x2c], 0xc1de6fc6
cmp dword [ebp - 0x18], eax
jne 0x430186
mov dword [ebp - 0x28], eax
jmp 0x43016f
mov dword [ebp - 8], 0xca9869ec
mov dword [ebp - 0xc], eax
jmp 0x4300c1
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x168], 0xbd3aeb59
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x4300b0
mov dword [ebp - 8], 0xffffffec
jmp 0x430100
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x4300f7
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1fa2
push 0x36d
push 0x1730
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor eax, eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x11
jne 0x4300cf
mov dword [ebp - 8], 0xd
jmp 0x430166
mov dword [ebp - 0x2c], 0xdf7e4414
mov dword [ebp - 0x2c], 0x280643b8
mov dword [ebp - 0xc], eax
jmp 0x430133
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x1b4], 0xfffffffe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x430122
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x430163
mov dword [ebp - 0x1c], 0xfffffff7
inc dword [ebp - 0x1c]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x43015e
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x430141
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1c
jle 0x43010f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x11
jg 0x4300a4
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff4
jl 0x430085
add ebx, 4
lea ecx, [ebp - 0x124]
push edi
mov dword [ebp - 0x28], ebx
call fcn.0042f3cf
xor esi, esi
mov dword [ebp - 0x20], 0x3ca
mov dword [ebp - 8], esi
jmp 0x4301b9
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x124]
mov dword [eax + ecx*4], 0xd5464b5f
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4301a6
mov dword [ebp - 8], esi
jmp 0x4301d1
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x40], 3
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4301c3
mov dword [ebp - 8], esi
jmp 0x4301ec
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1ac], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4301db
mov dword [ebp - 0x40], esi
jmp 0x4302a7
mov dword [ebp - 0x1c], 0x4247
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x2c], 0x3650dfa0
push 3
call fcn.0042f3cf
mov dword [ebp - 0xc], esi
jmp 0x43022d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x43021a
cmp dword [ebp - 0x40], esi
jne 0x430240
cmp dword [ebp - 0x1c], esi
jne 0x430240
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
sub eax, 0x7f0de65a
cmp eax, 3
jge 0x430255
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
neg eax
inc eax
mov dword [ebp - 0x2c], eax
je 0x430271
mov eax, edi
cmp dword [ebp - 0x20], esi
jne 0x430273
mov eax, esi
xor ecx, ecx
cmp eax, 2
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10c]
lea ecx, [ebp - 0x10c]
setg dl
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1a8], edx
call fcn.0042f4a1
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jle 0x4301fa
lea ecx, [ebp - 0x124]
call fcn.0042f4a1
mov eax, dword [ebx]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0xbf8b243e
mov dword [ebp - 0x20], 0x534fd39e
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], 0x2300b631
mov dword [ebp - 0xc], eax
jmp 0x4302f4
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x50], 0x869b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4302e6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jne 0x4303d7
mov dword [ebp - 0xc], 0xd393
mov dword [ebp - 0xdc], edi
mov dword [ebp - 0xd8], edi
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0x1c], 0xc4dd
mov dword [ebp - 0x2c], 0xca4f0670
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
sub edx, 0x5542
dec dword [ebp - 0xc]
cmp edx, ecx
mov ecx, edi
cmove ecx, eax
imul esi, ecx, 0xfff7
mov ecx, dword [ebp - 8]
dec esi
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setge dl
imul edx, dword [ebp - 8]
test edx, edx
je 0x43036e
mov edx, edi
cmp dword [ebp - 8], eax
jne 0x430370
mov edx, eax
mov ecx, dword [ebp - 0xd0]
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x1c]
push 0xfffffffffffffff6
sete bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x4c]
mov esi, dword [ebp - 8]
setg dl
xor ebx, ebx
cmp edx, ecx
setg bl
sub esi, ebx
neg esi
sbb esi, esi
xor edx, edx
inc esi
mov dword [ebp - 0xd4], esi
mov ecx, dword [ebp - 0x1c]
cmp esi, ecx
pop ecx
setle dl
cmp ecx, edx
sbb ecx, ecx
xor edx, edx
neg ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x21fac6d1
cmp ecx, 0xbc69
setge dl
mov dword [ebp - 0x2c], edx
inc dword [ebp - 8]
je 0x430306
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [ebp - 0x4c]
jg 0x4303e6
mov esi, eax
cmp dword [ebp - 0x20], eax
je 0x4303e8
mov esi, edi
xor edx, edx
mov dword [ebp - 0xc], 0xd050b7f4
mov ecx, dword [ebp - 0x20]
cmp esi, ecx
mov ecx, dword [ebp - 0xc]
sete dl
mov dword [ebp - 0x2c], edx
xor edx, edx
cmp ecx, 0xfffffff7
mov ecx, dword [ebp - 0x50]
setne dl
xor ebx, ebx
cmp edx, dword [ebp - 0x2c]
setne bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x20]
setl dl
imul ecx, edx
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x4c]
add ecx, edx
mov edx, dword [ebp - 0x4c]
mov esi, dword [ebp - 8]
imul edx, ecx
mov ecx, dword [ebp - 0x50]
imul esi, edx
xor edx, edx
cmp esi, ecx
setge dl
cmp edx, dword [ebp - 0x4c]
je 0x43044c
cmp dword [ebp - 0x24], eax
je 0x43044c
mov eax, edi
mov ebx, dword [ebp - 0x28]
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0x2c], eax
add ebx, 4
push edi
call fcn.0042f3cf
xor esi, esi
mov dword [ebp - 0x20], 0x3ca
mov dword [ebp - 8], esi
jmp 0x430482
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xf4]
mov dword [eax + ecx*4], 0xd5464b5f
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x43046f
mov dword [ebp - 8], esi
jmp 0x43049a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x44], 3
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x43048c
mov dword [ebp - 8], esi
jmp 0x4304b5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1a0], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4304a4
mov dword [ebp - 0x44], esi
jmp 0x430570
mov dword [ebp - 0x1c], 0x4247
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x2c], 0x3650dfa0
push 3
call fcn.0042f3cf
mov dword [ebp - 0xc], esi
jmp 0x4304f6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x13c]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4304e3
cmp dword [ebp - 0x44], esi
jne 0x430509
cmp dword [ebp - 0x1c], esi
jne 0x430509
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
sub eax, 0x7f0de65a
cmp eax, 3
jge 0x43051e
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
neg eax
inc eax
mov dword [ebp - 0x2c], eax
je 0x43053a
mov eax, edi
cmp dword [ebp - 0x20], esi
jne 0x43053c
mov eax, esi
xor ecx, ecx
cmp eax, 2
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x13c]
lea ecx, [ebp - 0x13c]
setg dl
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x44]
sub edx, eax
mov dword [ebp - 0x19c], edx
call fcn.0042f4a1
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jle 0x4304c3
lea ecx, [ebp - 0xf4]
call fcn.0042f4a1
cmp dword [ebp - 0x18], esi
jne 0x43058c
add ebx, 8
add ebx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x10]
inc esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], esi
cmp esi, dword [ebp - 0x34]
jl 0x42ff58
xor eax, eax
mov dword [ebp - 8], 0x1c7bf0b9
mov dword [ebp - 0x18], 0xd5d7
mov dword [ebp - 0x24], 0xcfdf
mov dword [ebp - 8], 0x4a6847df
mov dword [ebp - 0x18], 0xfffffffe
cmp dword [ebp - 0x18], 0x12a30a4c
jle 0x4305d3
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
je 0x4306a4
mov dword [ebp - 0x24], 0xfffffffa
cmp dword [ebp - 0x24], 0x31
jg 0x4306e0
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa5830]
lea ecx, [ebp - 0x184]
push ecx
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x8c], eax
push ecx
push eax
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x88], eax
movdqu xmmword [ebp - 0x194], xmm0
mov dword [ebp - 0x84], eax
call fcn.0042f512
xor esi, esi
push 3
mov dword [ebp - 0x18], esi
pop edx
jmp 0x430682
mov dword [ebp - 8], esi
jmp 0x43067a
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x10], esi
jmp 0x430671
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], 0x5e42506e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x43065e
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jle 0x430656
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x430651
lea ecx, [ebp - 0x8c]
call fcn.0042f4a1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x31
push 0
pop eax
jle 0x430608
jmp 0x4306de
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x4306bc
push 0x22be
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x4306e0
push eax
push eax
push 0x48f
push 0xb29
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
xor eax, eax
mov ebx, dword [ebx]
mov dword [ebp - 8], 0x5c8094a
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x34], 0x822cb3a3
mov dword [ebp - 0x1c], 0x3e386939
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
jmp 0x430717
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x98], 9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x430706
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jg 0x4307aa
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x2c], 0xfffffff8
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0x98], eax
je 0x430753
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x20], ecx
mov ecx, edi
cmp dword [ebp - 0x20], eax
jne 0x430755
mov ecx, eax
mov dword [ebp - 0xc], ecx
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x98]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x98]
mov ecx, dword [ebp - 0x34]
cmp ecx, edi
mov ecx, dword [ebp - 0x20]
setge bl
xor edx, edx
cmp ebx, ecx
setg dl
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 8]
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x430729
mov ebx, dword [ebp - 0x10]
add dword [ebp - 0x28], 4
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x18], 0xfffffffe
push 3
call fcn.0042f3cf
mov dword [ebp - 0x30], 0xb6ea
xor eax, eax
mov dword [ebp - 0x10], 0x273d5943
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], eax
jmp 0x4307e7
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x80]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4307da
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x43080c
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffee
jne 0x4308aa
mov esi, dword [ebp - 0x80]
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x1c], 0x1ebf0ddd
mov dword [ebp - 0x34], 0xfffffffb
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
imul ecx, dword [esi + 8]
mov edx, dword [ebp - 0xc]
sub edx, ecx
mov ecx, dword [ebp - 0x80]
mov dword [ecx], edx
xor ecx, ecx
cmp edx, 0x75ff4442
sete cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
jmp 0x430897
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x430894
push eax
push 0x9e4
push 0x7f4
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1a
jl 0x430878
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
je 0x43081c
lea ecx, [ebp - 0x80]
call fcn.0042f4a1
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0xc0]
push 2
mov esi, dword [esi]
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0xc], 6
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x2c], 0xa5166941
mov dword [ebp - 0x1c], 0x7b5bf2d3
call fcn.0042f3cf
mov dword [ebp - 0x34], edi
xor eax, eax
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0xc], eax
jmp 0x43090b
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc0]
mov dword [ecx + edx*4], 0xc4d1454b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4308f8
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x430927
push eax
push 0x196e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc0]
mov dword [eax], ecx
lea ecx, [ebp - 0xc0]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
call fcn.0042f4a1
mov ecx, dword [ebp - 0x28]
test esi, esi
jne 0x430a39
cmp byte [ebp - 0x39], 0
je 0x43097f
cmp dword [ebp - 0x38], edi
jne 0x43097f
mov edx, dword [ebp + 8]
lea eax, [ebx + 0x10]
add dword [edx + 8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x30], eax
mov eax, dword [ecx + 8]
add ecx, 0xc
push ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
call fcn.0047f625
pop ecx
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x5c]
lea eax, [ebp - 0x90]
xor esi, esi
push eax
push ebx
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
call fcn.0045ebc8
mov ecx, esi
test ebx, ebx
jle 0x430a15
mov eax, ecx
and eax, 0x80000001
jns 0x4309d0
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x30]
add eax, ecx
add eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x2c]
cdq
idiv ebx
mov eax, dword [ebp - 0x5c]
cmp word [eax + edx*2], si
je 0x430a00
mov edi, eax
lea eax, [edx + 1]
cdq
idiv ebx
cmp word [edi + edx*2], si
jne 0x4309ee
mov eax, dword [ebp - 0x5c]
xor edi, edi
inc edi
mov word [eax + edx*2], di
mov eax, dword [ebp - 0x28]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x1c]
mov byte [ecx + edx], al
inc ecx
cmp ecx, ebx
jl 0x4309c2
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x5c]
mov dword [ecx], ebx
test eax, eax
je 0x430a3b
push eax
call fcn.00481fc6
pop ecx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
jmp 0x430a3b
xor esi, esi
mov dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 0xcc]
push edi
call fcn.0042f3cf
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa5840]
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x184]
mov dword [ebp - 0x74], esi
push eax
push esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x70], esi
movdqu xmmword [ebp - 0x184], xmm0
mov dword [ebp - 0x6c], esi
call fcn.0042f512
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x430a9b
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xcc]
mov dword [ecx + edx*4], 8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x430a88
mov edx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 8]
setne bl
neg ecx
cmp ecx, 5
sbb ecx, ecx
inc ecx
add ecx, ebx
cmp ecx, dword [ebp - 8]
jge 0x430ac6
cmp dword [ebp - 8], eax
jne 0x430ac6
mov edi, eax
mov ecx, dword [ebp - 0xcc]
xor ebx, ebx
mov dword [ecx], edi
mov ecx, dword [ebp - 8]
cmp edi, ecx
setle bl
xor edx, edx
sub ebx, 0x9725
imul ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0x74]
add ebx, 0xfff7
cmp ebx, 0xb6fd
setl dl
mov dword [ecx + 0xc], edx
mov dword [ebp - 8], eax
jmp 0x430b13
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0xcc]
mov ecx, dword [edx + ecx*4]
mov dword [edx + esi*4], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jle 0x430afe
lea ecx, [ebp - 0x74]
call fcn.0042f4a1
lea ecx, [ebp - 0xcc]
call fcn.0042f4a1
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret