Function at 0x432df3
Capabilities:
Accept command line arguments
Delete directory
Modify service
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x38], ecx
push edi
inc esi
mov dword [ebp - 8], 5
push esi
lea ecx, [ebp - 0x88]
mov byte [ebp - 0x39], dl
call fcn.00432a80
push 3
lea ecx, [ebp - 0xe0]
call fcn.00432a80
mov dword [ebp - 0x10], 0x4322e7c6
xor eax, eax
mov dword [ebp - 0x18], 0x7a2d47e1
mov dword [ebp - 0x24], 0x6b01fe44
mov dword [ebp - 0x14], eax
jmp 0x432e57
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x88]
mov dword [ecx + edx*4], 0x6ec6e54e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x432e44
mov dword [ebp - 0x14], eax
jmp 0x432e74
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xe0]
mov dword [ecx + edx*4], 0x955a63a7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x432e61
mov edx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0x88]
mov dword [ecx], edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
imul edx, dword [ebp - 8], 0xf381
mov ecx, dword [ebp - 8]
cmp edx, ecx
setle bl
sub ebx, dword [ebp - 8]
add ebx, dword [ebp - 8]
sub ebx, dword [ebp - 8]
mov edi, dword [ebp - 0xe0]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [edi + 4], ebx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
je 0x432faa
mov dword [ebp - 0x24], 0xcb7be74f
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], 0xa5c12438
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x432f02
push eax
push 0x7f8
push 0xf7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
xor eax, eax
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x10]
sub edx, ecx
mov ecx, dword [ebp - 0x88]
mov dword [ecx], edx
dec dword [ebp - 0x10]
cmp edx, 0xd869e772
cmova esi, eax
xor edx, edx
cmp dword [edi + 4], eax
setne dl
xor ecx, ecx
cmp esi, edx
setge cl
sub ecx, 0x175d7278
jne 0x432f44
cmp dword [ebp - 0x10], eax
jne 0x432f44
xor esi, esi
mov edx, eax
inc esi
jmp 0x432f49
xor esi, esi
inc esi
mov edx, esi
xor ecx, ecx
cmp edx, 0x5f2f
setne cl
cmp esi, ecx
sbb ecx, ecx
neg ecx
cmp ecx, dword [ebp - 0x1c]
jl 0x432f66
mov ecx, eax
cmp dword [edi + 4], eax
je 0x432f68
mov ecx, esi
mov eax, dword [ebp - 0x18]
imul eax, ecx
xor ecx, ecx
imul eax, eax, 0x2614
cmp eax, 0x51f8
setg cl
sub ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0xd890
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
sub edx, 0x6d8b34f9
cmp edx, eax
setg cl
mov dword [ebp - 0x34], ecx
jmp 0x4330e0
push 4
lea ecx, [ebp - 0x158]
call fcn.00432a80
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa72c0]
lea ecx, [ebp - 0x1d8]
push ecx
xor eax, eax
lea ecx, [ebp - 0x1e8]
push ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xd4]
push eax
movdqu xmmword [ebp - 0x1e8], xmm0
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
call fcn.00432bc3
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x433015
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x158]
mov dword [ecx + edx*4], 3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x433002
mov dword [ebp - 0x14], eax
jmp 0x43302e
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x60], 0x3f861273
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x433020
mov esi, dword [ebp - 0x158]
xor edx, edx
or dword [esi + 8], 0xffffffff
mov ecx, dword [esi + 8]
test ecx, ecx
mov dword [ebp - 0x10], 0xffffffff
setne dl
test ecx, ecx
jne 0x433081
mov ecx, dword [ebp - 0x18]
mov edi, 0x67b2
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + 4], edi
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x60], edi
mov edi, dword [ecx]
imul ecx, dword [ebp - 0x24], 0x67b2
cmp ecx, edi
jg 0x433081
test edi, edi
jne 0x433081
mov edi, eax
jmp 0x433084
xor edi, edi
inc edi
xor ecx, ecx
cmp edi, 0x2f2f
setle cl
imul ecx, dword [esi + 8]
test ecx, ecx
je 0x43309c
cmp dword [ebp - 0x24], eax
jne 0x43309f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe0]
mov dword [eax + 8], edx
mov dword [ebp - 0x10], edx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 8]
cmp ecx, eax
lea ecx, [ebp - 0xd4]
setge dl
cmp edx, 0xc1b334fe
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
call fcn.00432b52
lea ecx, [ebp - 0x158]
call fcn.00432b52
xor esi, esi
inc esi
lea ecx, [ebp - 0xe0]
call fcn.00432b52
lea ecx, [ebp - 0x88]
call fcn.00432b52
mov dword [ebp - 0x10], 0xffffffff
xor eax, eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x10], 0x18
jmp 0x43312d
mov dword [ebp - 0x168], 0x6ca2cb51
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffee
je 0x433120
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x433145
push eax
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push 2
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x10], 3
pop edi
jmp 0x4331a0
push edi
lea ecx, [ebp - 0xbc]
call fcn.00432a80
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x43317e
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xbc]
mov dword [ecx + edx*4], 0xbacd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x43316b
mov ecx, dword [ebp - 0xbc]
cmp dword [ecx], eax
lea ecx, [ebp - 0xbc]
jne 0x4331a8
cmp dword [ebp - 0x10], eax
jne 0x4331a8
call fcn.00432b52
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x19
jne 0x433158
jmp 0x4331ad
call fcn.00432b52
push 9
pop eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x194]
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], esi
push esi
call fcn.00432a80
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4331df
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x194]
mov dword [ecx + edx*4], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4331cc
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xffffbad6
mov ecx, dword [ebp - 0x14]
setl dl
add ecx, 0xffff
imul edx, ecx
imul edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], eax
je 0x433210
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
jmp 0x4332a1
mov dword [ebp - 8], 0xffffffe9
jmp 0x433298
mov dword [ebp - 0x10], eax
jmp 0x433257
cmp byte [ebp - 9], 0
je 0x433254
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x228f
push 0x39a
push 0x1a65
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
mov byte [ebp - 9], al
jle 0x43322f
cmp byte [ebp - 9], 0
je 0x433295
push 0x26ab
push 0x1ef
push 0x2cf
push 0x16ad
push 0x250e
push 0x1a1d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffed
je 0x43322a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
je 0x433221
lea ecx, [ebp - 0x194]
call fcn.00432b52
mov ebx, dword [0x4b55ec]
xor eax, eax
mov dword [ebp - 0x14], 0x71c7
mov dword [ebp - 0x14], 0xa6847dfa
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], eax
jmp 0x43335e
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0xc1d6b3bf
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x4332fe
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x98], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4332ed
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x43331f
push eax
push 0x1dd6
push 0x4d9
call dword [sym.imp.GDI32.dll_CreatePen]
xor eax, eax
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
add ecx, edx
mov dword [ebp - 0x98], ecx
cmp ecx, 0x5d70512a
je 0x433345
mov edx, eax
cmp dword [ebp - 0x14], eax
je 0x433347
mov edx, esi
mov ecx, dword [ebp - 0x14]
imul ecx, edx
xor edx, edx
cmp ecx, 0xfffffff6
setl dl
add edx, 6
mov dword [ebp - 0x28], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe
jle 0x4332d7
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x24], 0xa9831117
mov dword [ebp - 0x10], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
jmp 0x43339e
mov dword [ebp - 0x28], 2
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jne 0x4333a4
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff5
jge 0x433389
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4333ba
push 0x22f3
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
cmp byte [ebp - 0x39], 0
je 0x433675
cmp ebx, esi
jne 0x433675
mov dword [ebp - 0x14], 5
xor ebx, ebx
mov dword [ebp - 0x18], 0xf8c7b5c6
mov dword [ebp - 8], 0x19c9214a
mov dword [ebp - 0x1c], 0x62858905
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
setl bl
mov dword [ebp - 0x18], ebx
imul ecx, dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x43341a
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x43341c
mov edx, esi
mov ecx, 0x33b48389
xor ebx, ebx
sub ecx, edx
cmp ecx, 0x5e314a5e
mov ecx, dword [ebp - 0x14]
setl bl
xor edx, edx
cmp ebx, ecx
setle dl
sub edx, 0xc6d
je 0x433461
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4335a2
push 0x17ed
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
jmp 0x4335a2
mov dword [ebp - 0x10], 0xd64ea33a
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
imul esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xfffffffd
mov ecx, dword [ebp - 0x10]
setne dl
xor ebx, ebx
cmp edx, esi
setle bl
xor edx, edx
cmp ecx, 0xfffffffa
setl dl
cmp ebx, edx
jg 0x43356b
mov dword [ebp - 0x24], 0x8552ad1
xor esi, esi
mov dword [ebp - 0x1c], 0xcedb1a73
inc esi
mov dword [ebp - 0x28], 0xa83b1d31
mov dword [ebp - 8], eax
jmp 0x43355f
mov dword [ebp - 0x18], 0x8481
xor edx, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xbb1dced
setg dl
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub edx, ecx
jne 0x4334ef
cmp dword [ebp - 8], eax
jne 0x4334ef
mov esi, eax
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
cmp esi, ecx
sete dl
xor esi, esi
sub edx, dword [ebp - 0x14]
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
inc esi
cmp edx, esi
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x10]
setge dl
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 0x28]
setge bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ecx, ecx
cmp edx, 4
setl cl
xor edx, edx
cmp ecx, 0x7c1ae2ef
setl dl
imul edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, dword [ebp - 0x18]
cmp edx, 0xdd31
setl cl
mov dword [ebp - 0x30], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x18
jl 0x4334c0
jmp 0x4335a2
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x433589
push 0x136a
push eax
push eax
push 0x5cc
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x43359f
push 0x3cf
call dword [sym.imp.USER32.dll_GetKeyboardType]
xor eax, eax
xor esi, esi
inc esi
mov dword [ebp - 0x1a8], 0xffffffff
mov dword [ebp - 0x1a4], 0xffffffff
mov dword [ebp - 0x1a0], 0xffffffff
mov dword [ebp - 0x19c], 0xffffffff
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x20], 0xeccce1e2
mov dword [ebp - 0x20], 0xd4351cdc
mov dword [ebp - 0x20], 0x23e64f14
mov dword [ebp - 0x20], 0x928fbc78
mov dword [ebp - 0x20], 0xfba1a4d6
mov dword [ebp - 0x20], 0xf680299
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x20], 0x895196ee
mov dword [ebp - 0x20], 0x8373b2c5
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0x62a96950
push 4
mov dword [ebp - 0x20], 0x694a61bf
pop edx
mov dword [ebp - 0x20], 0xffffffff
mov dword [edi + 8], edx
mov dword [ebp - 0x14], eax
jmp 0x433644
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x198], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x433637
mov dword [ebp - 0x14], eax
jmp 0x43365f
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x188], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x43364e
inc dword [ebp - 0x180]
mov ebx, dword [ebp - 0x34]
mov dword [edi + 0xc], 0x4b55ec
mov dword [ebp - 0x20], esi
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x433695
push 0x17c5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4336b0
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1355
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, dword [ebp - 0x38]
cmp esi, ebx
jge 0x434563
push 3
lea ecx, [ebp - 0x110]
call fcn.00432a80
mov dword [ebp - 0x14], 0xd1e1e87d
xor eax, eax
mov dword [ebp - 0x1c], 0x7374fd52
mov dword [ebp - 0x10], eax
jmp 0x4336f0
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x110]
mov dword [ecx + edx*4], 0xcff0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x4336dd
push 2
pop edi
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jl 0x433817
mov dword [ebp - 0x10], 0xf72d4ea6
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jg 0x4337f2
xor ebx, ebx
inc ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 8], eax
jmp 0x43373e
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x28], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x43372d
mov dword [ebp - 8], edi
cmp dword [ebp - 8], eax
jl 0x4337e6
mov dword [ebp - 0x18], 0xd4a5
cmp dword [ebp - 0x18], eax
jne 0x433765
mov ecx, dword [ebp - 0x18]
mov esi, eax
cmp dword [ebp - 8], ecx
jne 0x433767
mov esi, ebx
mov ecx, dword [ebp - 0x18]
xor edx, edx
test ecx, ecx
setle dl
cmp edx, dword [ebp - 8]
jne 0x43377d
mov edx, ebx
cmp dword [ebp - 0x18], eax
jne 0x43377f
mov edx, eax
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
imul ecx, edx
push 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x110]
cmp edx, dword [ecx]
mov ecx, dword [ebp - 0x18]
setle bl
imul ecx, ebx
sub ecx, 0xf0ef2f37
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp esi, ecx
mov ecx, dword [ebp - 0x10]
setge dl
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 0x18]
setl bl
xor edx, edx
cmp ebx, ecx
setne dl
xor ebx, ebx
add edx, dword [ebp - 8]
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp ecx, edx
setg bl
mov dword [ebp - 0x28], ebx
dec dword [ebp - 8]
pop ebx
jns 0x43374f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x433722
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x43380b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x433705
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
je 0x433844
mov ecx, dword [ebp - 0x1c]
mov edx, 0xa93f
sub edx, ecx
mov ecx, dword [ebp - 0x110]
cmp edx, dword [ecx + 4]
jne 0x433844
cmp dword [ecx], eax
je 0x433844
cmp dword [ebp - 0x1c], eax
je 0x433844
xor edi, edi
inc edi
mov edx, edi
jmp 0x433849
xor edi, edi
mov edx, eax
inc edi
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x1c]
setl bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x1c]
setne dl
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x433876
cmp dword [ebp - 0x1c], eax
je 0x433876
mov eax, edi
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x110]
call fcn.00432b52
mov dword [ebp - 0x14], 0xfffffffd
mov edi, 0x4b55f0
push 2
mov dword [ebp - 0x24], 0xffffffff
xor eax, eax
pop edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], eax
jmp 0x4338bf
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x17c], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x4338ae
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jge 0x433944
mov dword [ebp - 0x28], 0x5e08cccd
xor ebx, ebx
mov dword [ebp - 0x10], 0xdafbbd0a
mov dword [ebp - 8], 0x9acd4098
mov dword [ebp - 0x20], 0x80d68f98
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
inc edx
neg ecx
cmp ecx, edx
mov ecx, dword [ebp - 0x14]
setne bl
xor edx, edx
cmp ecx, ebx
setne dl
xor ebx, ebx
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp edx, ecx
setl bl
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
cmp ecx, 0xfffffffd
jge 0x433934
xor ecx, ecx
inc ecx
jmp 0x433936
mov ecx, eax
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x14]
js 0x4338cc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffec
jge 0x433985
xor ebx, ebx
inc ebx
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x1c], eax
jmp 0x433972
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x43396f
push eax
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x43395c
cmp dword [ebp - 0x28], eax
jne 0x433985
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffec
jl 0x433950
mov dword [ebp - 0x28], eax
test esi, esi
jle 0x4340cf
xor esi, esi
mov dword [ebp - 0x20], 0x2a42bbd4
inc esi
lea ecx, [ebp - 0xec]
push esi
call fcn.00432a80
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4339bb
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x4c], 0xb9f9b31
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4339ad
push 2
mov dword [ebp - 8], eax
pop ebx
jmp 0x4339d9
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xc8], 0xfffffffe
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4339c8
mov dword [ebp - 8], eax
jmp 0x4339ed
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x50], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4339e3
mov dword [ebp - 8], eax
jmp 0x433a0a
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0xa0cec519
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4339f7
mov dword [ebp - 0x4c], 0xffffffff
cmp dword [ebp - 0x4c], 0x15
je 0x433b6b
push ebx
lea ecx, [ebp - 0x104]
call fcn.00432a80
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], 0xe0d6
mov dword [ebp - 8], eax
jmp 0x433a50
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x104]
mov dword [ecx + edx*4], 0xe60b0cea
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x433a3d
mov dword [ebp - 8], eax
jmp 0x433a64
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x58], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x433a5a
mov dword [ebp - 8], eax
jmp 0x433a7f
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x208], 0x5dea311c
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x433a6e
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], esi
jg 0x433b50
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x10], 0x94fe874d
cmp dword [ebp - 0x24], eax
jne 0x433af9
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x50]
dec dword [ebp - 0x50]
cmp ecx, edx
mov ecx, esi
cmovge ecx, eax
cmp dword [ebp - 0x1fc], eax
je 0x433ac4
cmp dword [ebp - 0x200], eax
jne 0x433ac6
mov esi, eax
mov edx, 0x9820b275
cmp edx, ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, esi
mov ecx, dword [ebp - 0x30]
setg dl
xor ebx, ebx
cmp edx, 0x69d
setne bl
xor edx, edx
cmp ebx, ecx
setg dl
add edx, dword [ebp - 0x10]
neg edx
je 0x433af9
mov ecx, dword [ebp - 0xc4]
mov edi, dword [ebp - 0x54]
mov edx, dword [ebp - 0x54]
mov esi, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x104]
mov ecx, dword [ecx + edx*4]
xor edx, edx
mov dword [esi + edi*4], ecx
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx]
mov dword [ebp - 0xc8], ecx
mov ecx, dword [ebp - 0x24]
cmp dword [ebp - 0xc8], ecx
mov ecx, dword [ebp - 0xec]
setge dl
xor esi, esi
mov dword [ebp - 0x24], edx
inc esi
mov ecx, dword [ecx]
mov dword [ebp - 0x10], ecx
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], esi
jle 0x433a91
push 2
pop ebx
lea ecx, [ebp - 0x104]
call fcn.00432b52
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x15
jne 0x433a20
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0xec]
call fcn.00432b52
mov eax, dword [edi]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x18], 0xb26bdde0
mov dword [ebp - 0x10], eax
jmp 0x433b9a
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1cc], 0xb6318d58
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x433b89
mov dword [ebp - 0x18], 0xffffffe6
jmp 0x433bef
mov dword [ebp - 0x10], esi
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x433bcf
push 0x6c1
push eax
push 0x1b35
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x433bec
mov edx, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1cc], edx
dec dword [ebp - 0x10]
jns 0x433bd7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
je 0x433ba9
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x433c0f
push 0x20d0
push 0x226c
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
add edi, 4
lea ecx, [ebp - 0xb0]
push esi
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
mov dword [ebp - 8], 5
mov dword [ebp - 0x44], eax
call fcn.00432a80
push 3
lea ecx, [ebp - 0xf8]
call fcn.00432a80
mov dword [ebp - 0x10], 0x4322e7c6
xor eax, eax
mov dword [ebp - 0x1c], 0x7a2d47e1
mov dword [ebp - 0x30], 0x6b01fe44
mov dword [ebp - 0x14], eax
jmp 0x433c69
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xb0]
mov dword [ecx + edx*4], 0x6ec6e54e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x433c56
mov dword [ebp - 0x14], eax
jmp 0x433c86
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xf8]
mov dword [ecx + edx*4], 0x955a63a7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x433c73
mov edx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0xb0]
mov dword [ecx], edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
imul edx, dword [ebp - 8], 0xf381
mov ecx, dword [ebp - 8]
cmp edx, ecx
setle bl
sub ebx, dword [ebp - 8]
add ebx, dword [ebp - 8]
sub ebx, dword [ebp - 8]
mov edi, dword [ebp - 0xf8]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [edi + 4], ebx
je 0x433dba
mov dword [ebp - 0x14], 0xcb7be74f
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], 0xa5c12438
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x30], 0xffffffff
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x433d12
push eax
push 0x7f8
push 0xf7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
sub edx, ecx
mov ecx, dword [ebp - 0xb0]
mov dword [ecx], edx
dec dword [ebp - 0x10]
cmp edx, 0xd869e772
cmova esi, eax
xor edx, edx
cmp dword [edi + 4], eax
setne dl
xor ecx, ecx
cmp esi, edx
setge cl
sub ecx, 0x175d7278
jne 0x433d54
cmp dword [ebp - 0x10], eax
jne 0x433d54
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x433d59
xor ebx, ebx
inc ebx
mov edx, ebx
xor ecx, ecx
cmp edx, 0x5f2f
setne cl
cmp ebx, ecx
sbb ecx, ecx
neg ecx
cmp ecx, dword [ebp - 0x24]
jl 0x433d76
mov ecx, eax
cmp dword [edi + 4], eax
je 0x433d78
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
imul eax, ecx
xor ecx, ecx
imul eax, eax, 0x2614
cmp eax, 0x51f8
setg cl
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0xd890
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
sub edx, 0x6d8b34f9
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
jmp 0x433ef2
push 4
lea ecx, [ebp - 0x140]
call fcn.00432a80
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa72c0]
lea ecx, [ebp - 0x1e8]
push ecx
xor eax, eax
lea ecx, [ebp - 0x1f8]
push ecx
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0xa4]
push eax
movdqu xmmword [ebp - 0x1f8], xmm0
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
call fcn.00432bc3
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x433e25
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x140]
mov dword [ecx + edx*4], 3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x433e12
mov dword [ebp - 0x14], eax
jmp 0x433e3e
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x5c], 0x3f861273
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x433e30
mov esi, dword [ebp - 0x140]
xor ebx, ebx
or dword [esi + 8], 0xffffffff
mov ecx, dword [esi + 8]
test ecx, ecx
mov dword [ebp - 0x24], 0xffffffff
setne bl
test ecx, ecx
jne 0x433e91
mov ecx, dword [ebp - 0x1c]
mov edx, 0x67b2
mov ecx, dword [ebp - 0xa4]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 0xb0]
mov dword [ebp - 0x5c], edx
mov edx, dword [ecx]
imul ecx, dword [ebp - 0x30], 0x67b2
cmp ecx, edx
jg 0x433e91
test edx, edx
jne 0x433e91
mov edx, eax
jmp 0x433e96
xor ecx, ecx
lea edx, [ecx + 1]
xor ecx, ecx
cmp edx, 0x2f2f
setle cl
imul ecx, dword [esi + 8]
test ecx, ecx
je 0x433eae
cmp dword [ebp - 0x30], eax
jne 0x433eb1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf8]
xor edx, edx
mov dword [eax + 8], ebx
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 8]
cmp ecx, eax
lea ecx, [ebp - 0xa4]
setge dl
cmp edx, 0xc1b334fe
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
call fcn.00432b52
lea ecx, [ebp - 0x140]
call fcn.00432b52
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xf8]
call fcn.00432b52
lea ecx, [ebp - 0xb0]
call fcn.00432b52
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
push 2
add edi, 4
call fcn.00432a80
xor eax, eax
mov dword [ebp - 0x10], 0x4ffb871c
mov dword [ebp - 0x10], eax
jmp 0x433f3c
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x174]
mov dword [ecx + edx*4], 0xa684
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x433f29
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x433f54
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x433faf
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x433fac
push eax
push 0x1f3e
push 0x232e
push 0x1b38
push 0x2330
push 0x797
push 0x9c8
push 0x253b
push 0x1ba6
push 0x262d
push 0x7a6
push 0x1fce
push 0x181a
push 0xf8b
call dword [sym.imp.GDI32.dll_CreateFontA]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x433f59
lea ecx, [ebp - 0x174]
call fcn.00432b52
cmp dword [ebp - 0x44], 0
jne 0x433fc8
add edi, 8
xor esi, esi
lea ecx, [ebp - 0x11c]
mov dword [ebp - 8], esi
mov dword [ebp - 0x18], 0x94ff5452
push 4
mov dword [ebp - 0x30], 0x3799040c
mov dword [ebp - 0x24], esi
pop esi
push esi
call fcn.00432a80
xor eax, eax
mov dword [ebp - 0x44], 0xe80a7c6d
mov dword [ebp - 0x10], eax
jmp 0x43400a
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x11c]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x433ffb
mov ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xfffffff9
jb 0x43404a
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add ecx, 0xe071
imul ecx, dword [ebp - 8]
add ecx, dword [ebp - 8]
sub ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 8], ecx
jle 0x434047
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
cmp ecx, edx
mov ecx, dword [ebp - 0x24]
setl bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ebx, ebx
imul edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x11c]
cmp edx, 0xebf3
setl bl
mov dword [ecx + 0xc], ebx
mov dword [ebp - 0x44], ebx
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x4340aa
push eax
push eax
push 0x21de
push eax
push 0x155b
push eax
push 0xa42
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea ecx, [ebp - 0x11c]
call fcn.00432b52
add edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x28]
inc ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], ebx
cmp ebx, dword [ebp - 0x38]
jl 0x433990
xor eax, eax
jmp 0x4340d2
push 4
pop esi
mov ecx, dword [edi]
xor ebx, ebx
mov dword [ebp - 0x24], ecx
inc ebx
mov ecx, 0x847dfa86
add edi, esi
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], 0xdf860956
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x1c], 0x5950cfdf
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], eax
push ebx
mov dword [ebp - 0x18], edi
call fcn.00432a80
xor eax, eax
mov dword [ebp - 0x30], 0xae0c
mov dword [ebp - 0x10], eax
jmp 0x434141
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x128]
mov dword [ecx + edx*4], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x43412e
mov dword [ebp - 0x1c], eax
jmp 0x43428d
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x2c], 0xb6bd0d42
mov dword [ebp - 0x2c], 0xd55c59c3
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x434232
mov dword [ebp - 8], 0x86bd085
mov dword [ebp - 0x2c], 0x1dbdae4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jg 0x434229
mov dword [ebp - 0x2c], 5
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0xfffffff9
push esi
call fcn.00432a80
xor esi, esi
mov dword [ebp - 0x28], ebx
push 3
mov dword [ebp - 0x10], esi
pop esi
jmp 0x4341dd
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c0]
mov dword [eax + ecx*4], 0xe708bee6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4341ca
mov dword [ebp - 0x2c], 0x452a26f3
mov eax, dword [ebp - 0x14]
push 0xfffffffffffffff9
pop ecx
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x1c0]
dec dword [ebp - 0x28]
call fcn.00432b52
inc dword [ebp - 8]
push 0
pop eax
cmp dword [ebp - 8], esi
jle 0x4341a0
dec dword [ebp - 0x14]
jns 0x43417c
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x70]
neg ecx
jne 0x434272
mov edx, dword [ebp - 0x14]
xor ebx, ebx
add edx, dword [ebp - 0x44]
mov esi, eax
mov ecx, dword [ebp - 0x70]
cmp ecx, edx
mov ecx, dword [ebp - 0x30]
setle bl
sub ebx, ecx
mov ecx, dword [ebp - 0x1c]
cmp ebx, 0xfffffffa
sbb edx, edx
neg edx
sub edx, dword [ebp + ecx*4 - 0x70]
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
inc ebx
sub edx, dword [ebp - 0x38]
je 0x434274
mov esi, ebx
mov ecx, dword [ebp - 0x128]
xor edx, edx
cmp esi, dword [ecx]
mov ecx, dword [ebp - 0x20]
setge dl
imul ecx, edx
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x1c]
push 3
pop esi
cmp dword [ebp - 0x1c], esi
jle 0x43414e
mov dword [ebp - 0x1c], eax
jmp 0x4342ba
mov dword [ebp - 0x10], eax
jmp 0x4342b1
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x70], 0x43ad33dc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x4342a3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 8
jne 0x43429e
lea ecx, [ebp - 0x128]
call fcn.00432b52
push dword [ebp + 8]
mov edi, dword [edi]
lea ecx, [ebp - 0x208]
movdqa xmm0, xmmword [0xaa72b0]
xor eax, eax
push ecx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x10], esi
push ecx
mov dword [ebp - 0x38], 0xffffffff
lea ecx, [ebp - 0x94]
push eax
movdqu xmmword [ebp - 0x218], xmm0
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
call fcn.00432bc3
push ebx
lea ecx, [ebp - 0x14c]
call fcn.00432a80
mov dword [ebp - 0x20], 0xa7bf748b
lea ecx, [ebp - 0x134]
xor esi, esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x44], esi
push 4
call fcn.00432a80
xor eax, eax
mov dword [ebp - 0x28], 0xe2ff
mov dword [ebp - 8], eax
jmp 0x434358
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x40], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x43434e
mov dword [ebp - 8], eax
jmp 0x434375
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14c]
mov dword [ecx + edx*4], 0x955
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x434362
mov dword [ebp - 8], eax
jmp 0x434392
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], 0xf093
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x43437f
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
sub ecx, 3
mov esi, dword [ebp - 0x94]
cmp ecx, eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14c]
setl dl
xor ebx, ebx
add edx, dword [esi + 0xc]
add ecx, edx
neg ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
cmp dword [esi + 0xc], eax
mov edx, dword [ebp - 0x40]
setle bl
imul edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp ebx, eax
setl cl
xor eax, eax
cmp edx, ecx
setl al
xor edx, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
add ecx, eax
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x134]
setl dl
xor ecx, ecx
cmp edx, dword [eax]
setne cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x134]
call fcn.00432b52
lea ecx, [ebp - 0x14c]
call fcn.00432b52
lea ecx, [ebp - 0x94]
call fcn.00432b52
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x10], 0x5540d7f8
mov dword [ebp - 0x10], 0xf
cmp dword [ebp - 0x10], 0xffffffe4
jg 0x434475
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x43446c
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe4
jle 0x43445a
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x43448d
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test edi, edi
jne 0x43455c
cmp byte [ebp - 0x39], 0
mov ebx, dword [ebp - 0x24]
je 0x4344af
xor eax, eax
inc eax
cmp dword [ebp - 0x34], eax
jne 0x4344af
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x10]
add dword [ecx + 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 8]
add esi, 0xc
push ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], esi
call fcn.0048ec65
mov dword [ebp - 0x34], eax
xor eax, eax
pop ecx
mov dword [ebp - 0xc0], eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0xc0]
push eax
push ebx
call fcn.004699de
mov edi, dword [ebp - 0x7c]
xor ecx, ecx
mov esi, ecx
test ebx, ebx
jle 0x43453b
mov eax, esi
and eax, 0x80000001
jns 0x434505
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x20]
add eax, esi
add eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x2c]
jmp 0x43451a
lea eax, [edx + 1]
cdq
idiv ebx
cmp word [edi + edx*2], cx
jne 0x434517
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov eax, dword [ebp - 0x18]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x34]
mov byte [esi + edx], al
inc esi
cmp esi, ebx
jl 0x4344f7
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x34]
mov dword [ecx], ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x434561
push edi
call fcn.00490156
xor eax, eax
pop ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov edi, dword [ebp + 8]
jmp 0x434563
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 8], 0xe0648261
inc ebx
mov dword [ebp - 0x14], 0x5379
push ebx
lea ecx, [ebp - 0x1d8]
call fcn.00432a80
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x434595
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x48], 0xd77cccae
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x434587
mov dword [ebp - 8], eax
jmp 0x4345b2
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1d8]
mov dword [ecx + edx*4], 0xb5720603
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x43459f
mov dword [ebp - 8], 0xf
cmp dword [ebp - 8], 0xffffffee
jle 0x43469a
xor esi, esi
push 2
lea ecx, [ebp - 0x1b4]
call fcn.00432a80
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x20], 0xf3bd791f
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
push 2
pop edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0x75015e0c
mov dword [ebp - 0x20], 0xaf66
mov dword [ebp - 0x20], 0xd3e5c7d8
mov dword [ebp - 0x20], 0xbc46d767
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], esi
jmp 0x43463e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1b4]
mov dword [eax + ecx*4], 0x4c59cdc3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x43462b
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 8]
cmp eax, dword [ebp - 8]
jne 0x434652
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp eax, 0xc4e3
mov eax, dword [ebp - 8]
setge cl
xor edx, edx
cmp ecx, 0xf5e3
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x1b4]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], ebx
inc dword [ebp - 0x14]
call fcn.00432b52
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffee
jg 0x4345ca
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jg 0x434762
xor edi, edi
inc edi
mov dword [ebp - 0x38], 0x3231a295
mov dword [ebp - 0x34], 0xbc3393a3
mov dword [ebp - 0x20], 0x2d6a391d
mov dword [ebp - 0x14], eax
jmp 0x4346e8
mov dword [ebp - 0x10], 0xfffffffc
mov dword [ebp - 0x10], eax
jmp 0x4346e0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x48]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x48], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x4346cf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x4346c3
mov dword [ebp - 0x14], eax
jmp 0x43474e
mov dword [ebp - 0x28], 0x2fc3
mov dword [ebp - 0x34], 0xfffffff6
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x48], edi
cmp dword [ebp - 0x38], eax
je 0x434720
mov edx, dword [ebp - 0x28]
xor ebx, ebx
mov ecx, dword [ebp - 0x38]
cmp ecx, edx
mov ecx, dword [ebp - 8]
setge bl
mov dword [ebp + ecx*4 - 0x48], ebx
mov ecx, dword [ebp - 0x48]
xor ebx, ebx
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
cmp ecx, edx
push 9
setge bl
mov dword [ebp - 0x34], ebx
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 8]
pop edx
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x4346f2
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jle 0x4346a9
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x1d8]
call fcn.00432b52
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret