Function at 0x4621dd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, ecx
push ebx
push esi
push edi
cmp dword [eax], 0
mov dword [ebp - 0x44], eax
je 0x463eb4
push dword [eax]
push 0
push dword [eax + 4]
call fcn.00425a6a
xor edi, edi
add esp, 0xc
inc edi
xor eax, eax
mov dword [ebp - 8], edi
mov dword [ebp - 8], eax
jmp 0x462224
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x264], 0xc85f70ad
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x462213
push 3
mov dword [ebp - 8], eax
pop esi
jmp 0x46226e
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], 0
je 0x462252
push 0xd76
push 0xaa5
push 0x399
call dword [sym.imp.KERNEL32.dll_HeapCreate]
xor eax, eax
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], 0
je 0x46226b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x462232
mov dword [ebp - 0x1c], 0xac204e2d
mov dword [ebp - 0x24], 0x4111d018
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], 0xfffffff3
jmp 0x462322
mov dword [ebp - 8], edi
mov dword [ebp - 0x2c], 0x6e3e
mov dword [ebp - 8], eax
jmp 0x4622ad
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x3c], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4622a3
mov dword [ebp - 8], eax
jmp 0x4622ed
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], 0
je 0x4622ea
push 0x73f
push 0x2408
push 0x23d1
push 0xf22
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jle 0x4622b7
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, 0xfdc8
setne dl
xor ecx, ecx
cmp edx, 0x74a5
setl cl
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
jne 0x462316
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 6
je 0x462294
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], 0
je 0x46233f
push eax
push eax
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
xor eax, eax
push 2
mov dword [ebp - 8], 7
mov dword [ebp - 4], eax
pop ebx
jmp 0x46235c
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x4c], 0x3342eb9
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x46234e
mov dword [ebp - 4], eax
jmp 0x462377
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x120], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x462366
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x10
je 0x4624a4
mov dword [ebp - 4], 0xa205
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x20], 0x2fd17ba7
mov dword [ebp - 8], eax
jmp 0x4623b0
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1c0], 0xb7e80d68
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x46239f
mov ecx, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, ebx
je 0x46243d
push dword [ebp - 0x3c]
movdqa xmm0, xmmword [0xa76f70]
lea ecx, [ebp - 0x1e8]
push ecx
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0xf8], eax
push ecx
push eax
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0xf4], eax
movdqu xmmword [ebp - 0x1f8], xmm0
mov dword [ebp - 0xf0], eax
call fcn.00401a81
inc dword [ebp - 0x20]
mov dword [ebp - 4], 0xfffffffa
jmp 0x46242a
mov dword [ebp - 0xc], 0
jmp 0x462422
cmp dword [ebp - 0x11c], 0
jne 0x462427
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x462416
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x31
je 0x46240d
lea ecx, [ebp - 0xf8]
call fcn.00401a1f
jmp 0x462494
mov dword [ebp - 0xc], 0x13
jmp 0x46248f
mov dword [ebp - 8], edi
cmp dword [ebp - 8], eax
jl 0x46248c
mov dword [ebp - 4], eax
jmp 0x46246e
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], 0
je 0x46246b
push 0x427
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor eax, eax
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jle 0x462453
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x1c0]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x120], edx
dec dword [ebp - 8]
jns 0x46244e
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x462446
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x10
push 0
pop eax
jne 0x462389
mov dword [ebp - 4], 0xd526d2e8
mov dword [ebp - 8], 0xfffffff7
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0x6c56d20a
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x5691f3a4
mov dword [ebp - 0xc], eax
jmp 0x4624dc
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x130], 0x8cae2fe8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x4624cb
mov dword [ebp - 0xc], eax
jmp 0x4624f1
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x7c], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x4624e7
mov dword [ebp - 0xc], eax
jmp 0x46250c
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x100], 0x4ed09eb
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x4624fb
cmp dword [ebp - 4], eax
je 0x462584
xor edx, edx
mov dword [ebp - 0x12c], 8
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x12c]
cmp ecx, 0xab79
setg dl
mov dword [ebp - 8], edx
xor edx, edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x12c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, 6
mov ecx, dword [ebp - 4]
setle dl
cmp edx, edi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
mov esi, edi
setg dl
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x44d5
setge dl
sub edx, 0x2aba
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 4]
jne 0x462586
mov esi, eax
mov ecx, dword [ebp - 4]
xor edx, edx
cmp esi, ecx
setl dl
sub edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x7c], edx
mov ecx, dword [ebp - 0x100]
mov dword [ebp - 0x18], ecx
mov ecx, 0x86ff5291
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 4], ecx
je 0x4625e9
mov ecx, dword [ebp - 0x12c]
xor ebx, ebx
cmp ecx, 0xffffffff
mov ecx, dword [ebp - 0x24]
setle bl
xor edx, edx
cmp ecx, ebx
setg dl
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x7c]
cmp dword [ebp - 0x18], ecx
je 0x4625e3
mov ecx, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x7c]
push 2
pop ebx
cmp dword [ebp - 0x18], eax
je 0x462600
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], 0
je 0x462651
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
jmp 0x462651
push 3
mov dword [ebp - 4], eax
pop ecx
jmp 0x46264c
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x462649
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], eax
jl 0x462644
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], 0
je 0x46263c
push 0x2390
push 0x245
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
xor eax, eax
dec dword [ebp - 8]
jns 0x462618
push 3
pop ecx
dec dword [ebp - 0x14]
jns 0x462610
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jle 0x462608
mov dword [ebp - 0x18], edi
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x1c], 0xbb35b689
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
jmp 0x46267d
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x98], 0x1857497f
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x46266c
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x1c]
je 0x4626ac
cmp dword [ebp - 4], eax
je 0x4626ac
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], al
je 0x4626f3
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x4626f3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], eax
jl 0x4626f3
mov dword [ebp - 0x14], eax
jmp 0x4626d7
mov dword [ebp - 0x1c], eax
jmp 0x4626cf
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x98], 0x1eb7e595
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x4626be
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x4626b9
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], 0
je 0x4626ee
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
dec dword [ebp - 4]
jns 0x4626b4
mov dword [ebp - 0xc], edi
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffea
jge 0x462855
push ebx
lea ecx, [ebp - 0x94]
call fcn.0040194d
mov dword [ebp - 8], 0x1e19e95d
xor eax, eax
mov dword [ebp - 0x20], 0x1210cbed
mov dword [ebp - 8], eax
jmp 0x462740
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x94]
mov dword [ecx + edx*4], 0xfffffffa
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x46272d
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], al
je 0x462755
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
mov ecx, dword [ebp - 0x94]
xor edx, edx
cmp edx, dword [ecx]
sbb ecx, ecx
xor ebx, ebx
neg ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub edx, 0x7a76fa48
cmp ecx, edx
mov ecx, dword [ebp - 0xc]
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x94]
setne dl
xor ebx, ebx
cmp edx, dword [ecx]
setle bl
xor edx, edx
cmp ebx, dword [ecx + 4]
setge dl
sub edx, 0xc3ad3b31
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x642e40c1
setge cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
je 0x4627c4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
jmp 0x46282b
mov dword [ebp - 4], eax
jmp 0x4627d7
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x40], 6
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x4627c9
mov dword [ebp - 4], eax
jmp 0x4627ef
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x68], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x4627e1
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov ecx, eax
cmp dword [ebp - 0x40], eax
je 0x462803
mov ecx, edi
mov dword [ebp - 0x18], ecx
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edi
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 8]
cmp edx, ecx
setne bl
xor ecx, ecx
test ebx, ebx
sets cl
mov dword [ebp - 0x68], ecx
cmp dword [ebp - 0x68], eax
jne 0x462848
lea ecx, [ebp - 0x94]
call fcn.00401a1f
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffea
push 2
pop ebx
jl 0x46270c
jmp 0x462853
lea ecx, [ebp - 0x94]
call fcn.00401a1f
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x46286b
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x274], 0xc85f70ad
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x46285a
push 5
pop ecx
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 4], 0x1c1ec2db
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x28], 0xf1a969ac
mov dword [ebp - 0x24], 0xf0ebf903
mov dword [ebp - 4], eax
jmp 0x462907
mov dword [ebp - 0x24], edi
xor edx, edx
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + ecx*4 - 0xc8]
mov ecx, dword [ebp - 4]
test ecx, ecx
sets dl
xor ecx, ecx
cmp edx, esi
setge cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0xc8]
test ecx, ecx
mov ecx, dword [ebp - 4]
setne dl
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0xc8]
cmp ecx, edx
mov ecx, dword [ebp - 4]
setg bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [ebp - 0x24], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jle 0x4628b4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x46309b
jmp 0x46291f
xor edi, edi
inc edi
mov dword [ebp - 8], 0xc68ec0ae
mov dword [ebp - 8], 0x19
jmp 0x462991
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x14], 0xffffffe3
jmp 0x462988
mov dword [ebp - 0x1c], 0x7a00f47a
cmp dword [ebp - 8], eax
jne 0x46298e
mov dword [ebp - 0x1c], 0xf
cmp dword [ebp - 0x1c], eax
jge 0x462985
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], 0
je 0x462980
push 0x16b4
push 0x195d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
dec dword [ebp - 0x1c]
js 0x462957
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x11
jl 0x46293f
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff7
jg 0x46292f
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], 0
je 0x4629aa
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0x4f16efa4
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
jmp 0x4629c9
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x54], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x4629bf
mov dword [ebp - 0x14], eax
jmp 0x462b06
mov dword [ebp - 0xc], 9
lea ecx, [ebp - 0xe0]
push 4
call fcn.0040194d
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x462a05
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xe0]
mov dword [ecx + edx*4], 0xe4145c17
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x4629f2
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], al
je 0x462a2a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edi
jg 0x462af8
mov edi, dword [ebp - 0xe0]
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 8], eax
cmp dword [ebp + ecx*4 - 0x54], eax
jne 0x462a55
mov esi, eax
cmp dword [ebp - 0xc], eax
je 0x462a57
mov esi, ebx
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x54]
cmp ecx, esi
setne dl
sub edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add edx, dword [ebp + ecx*4 - 0x54]
je 0x462aa8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + ecx*4 - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x54], edx
mov dword [ebp - 4], eax
jmp 0x462aa0
mov byte [ebp - 0xe], al
cmp byte [ebp - 0xe], 0
je 0x462a9d
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x35
jne 0x462a84
jmp 0x462ae9
mov dword [ebp - 4], eax
jmp 0x462ab5
cmp dword [ebp - 8], eax
jne 0x462abb
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x33
jge 0x462aad
mov dword [ebp - 8], 0x19
jmp 0x462ae3
mov dword [ebp - 4], eax
jmp 0x462ada
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xe0]
cmp dword [ecx + edx*4], eax
jne 0x462ae0
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jle 0x462ac9
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffa
je 0x462ac4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x462a3f
xor edi, edi
inc edi
lea ecx, [ebp - 0xe0]
call fcn.00401a1f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x4629d7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
cmp byte [ebp - 0xd], 0
je 0x462ca3
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x184]
push 2
call fcn.0040194d
mov dword [ebp - 0x1c], 9
xor eax, eax
mov dword [ebp - 0x20], 0xf093d7f2
mov dword [ebp - 8], eax
jmp 0x462b5b
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x184]
mov dword [ecx + edx*4], 6
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x462b48
mov ecx, dword [ebp - 4]
mov edx, 0x958a95cd
mov edi, dword [ebp - 0x184]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
sub edx, dword [edi + 4]
add ecx, edx
mov dword [edi + 4], ecx
mov dword [ebp - 4], 0xffffffe8
jmp 0x462c76
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0xc], 0xcdf1
mov dword [ebp - 8], 3
mov dword [ebp - 0x20], 0xfffffff7
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x462bd0
push 0xc1c
push eax
push eax
push eax
push eax
push 0x1679
push 0x9c5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
xor eax, eax
mov ecx, dword [ebp - 4]
neg ecx
je 0x462c6c
inc dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], eax
je 0x462c3e
cmp dword [ebp - 0x20], eax
jne 0x462bfa
cmp dword [edi + 4], eax
jne 0x462bfa
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x462bff
xor ebx, ebx
inc ebx
mov esi, ebx
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp esi, ecx
setle dl
mov dword [edi + 4], edx
cmp edx, dword [ebp - 8]
je 0x462c14
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov esi, ebx
mov ecx, dword [ebp - 8]
sub ecx, 3
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x462c40
mov esi, eax
mov ecx, dword [ebp - 0x14]
mov edx, 0xaf5bfb66
cmp edx, ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, esi
mov ecx, dword [ebp - 4]
setge dl
xor ebx, ebx
cmp edx, ecx
setle bl
sub ebx, dword [ebp - 4]
add ebx, dword [ebp - 0x14]
je 0x462c6c
xor ecx, ecx
inc ecx
jmp 0x462c6e
mov ecx, eax
neg ecx
mov dword [ebp - 0x20], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffef
jl 0x462b89
lea ecx, [ebp - 0x184]
call fcn.00401a1f
push 0xd76
push 0xaa5
push 0x399
call dword [sym.imp.KERNEL32.dll_HeapCreate]
xor edi, edi
inc edi
push 3
lea ecx, [ebp - 0xa4]
call fcn.0040194d
mov dword [ebp - 0x20], 0x61d594d0
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], eax
jmp 0x462cd4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xa4]
mov dword [ecx + edx*4], 0xfffffffc
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x462cc1
mov esi, dword [ebp - 0xa4]
lea edi, [esi + 8]
cmp dword [edi], eax
je 0x462cf8
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x20]
inc edx
mov esi, dword [ebp - 0xa4]
jmp 0x462cfa
mov edx, eax
xor ecx, ecx
cmp edx, dword [edi]
setl cl
xor edx, edx
cmp ecx, 0xfffffff9
setge dl
add edx, dword [esi + 4]
add edx, dword [edi]
jne 0x462d1b
cmp dword [esi], eax
jne 0x462d1b
xor esi, esi
mov ecx, eax
inc esi
jmp 0x462d20
xor esi, esi
inc esi
mov ecx, esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], eax
jmp 0x462d3b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa4]
mov dword [eax + ecx*4], 0x5ebec5ec
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x462d28
lea ecx, [ebp - 0xa4]
call fcn.00401a1f
mov byte [ebp - 0xe], 0
mov dword [ebp - 0xc], 0xbac64a68
mov dword [ebp - 0xc], 0xffffffe5
jmp 0x462d7f
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x462d7c
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetParent]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff3
jne 0x462d60
mov dword [ebp - 0xc], 7
jmp 0x462f42
mov dword [ebp - 4], 0x2daab72b
xor edx, edx
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
cmp eax, ecx
setne dl
add edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 4]
jge 0x462f19
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x1c], 0x14
jmp 0x462f0d
push 3
lea ecx, [ebp - 0x19c]
call fcn.0040194d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x462e0d
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x30], 0xb780
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x462dff
mov dword [ebp - 4], eax
jmp 0x462e26
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x19c]
mov dword [ecx + edx*4], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x462e17
mov dword [ebp - 4], eax
cmp dword [ebp - 4], eax
jg 0x462eff
mov ecx, 0xad33dc28
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1b8], ecx
mov dword [ebp - 0x1b4], ecx
mov dword [ebp - 0x1b0], ecx
mov dword [ebp - 0x1ac], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x462ef3
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x30]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp + ecx*4 - 0x30]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x30]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp + ecx*4 - 0x30]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x1ac], edx
mov ecx, dword [ebp - 0x1c]
add ecx, edx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x72679f1a
mov ecx, dword [ebp - 0xc]
setle dl
xor ebx, ebx
cmp edx, ecx
setg bl
sub ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x19c]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ecx], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x462e64
mov ecx, 0xad33dc28
inc dword [ebp - 4]
cmp dword [ebp - 4], eax
jle 0x462e3d
lea ecx, [ebp - 0x19c]
call fcn.00401a1f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x23
je 0x462deb
jmp 0x462f3f
mov dword [ebp - 0x24], 0xd1dd
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
dec ecx
add eax, ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
cmp eax, ecx
setne dl
mov dword [ebp - 8], edx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x462d91
cmp byte [ebp - 0xe], 0
je 0x46308b
push 2
lea ecx, [ebp - 0x1a8]
call fcn.0040194d
push dword [ebp - 0x3c]
movdqa xmm0, xmmword [0xa76f60]
lea ecx, [ebp - 0x1f8]
push ecx
xor eax, eax
mov dword [ebp - 0x28], 0xfffffff8
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x28], 0xfffffff7
push ecx
mov dword [ebp - 0x28], 0xc857617c
lea ecx, [ebp - 0xd4]
push eax
movdqu xmmword [ebp - 0x208], xmm0
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
call fcn.00401a81
mov dword [ebp - 0x28], 0x44bd1a6f
lea ecx, [ebp - 0x1d4]
push 4
call fcn.0040194d
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], eax
jmp 0x462fea
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1a8]
mov dword [ecx + edx*4], 0x2124f84b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x462fd7
mov dword [ebp - 0xc], eax
jmp 0x463002
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xa8], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x462ff5
mov dword [ebp - 0xc], eax
jmp 0x46301c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1d4]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x46300c
mov ecx, dword [ebp - 0x1a8]
mov esi, dword [ecx + 4]
mov edi, dword [ecx]
xor ecx, ecx
cmp esi, edi
setne cl
xor edx, edx
cmp esi, ecx
setle dl
xor ecx, ecx
cmp edx, 0x591b68de
setle cl
dec ecx
add ecx, esi
je 0x463052
test edi, edi
je 0x463052
xor eax, eax
inc eax
mov dword [ebp - 0xa8], eax
lea ecx, [ebp - 0x1d4]
inc dword [ebp - 0x20]
call fcn.00401a1f
lea ecx, [ebp - 0xd4]
call fcn.00401a1f
lea ecx, [ebp - 0x1a8]
call fcn.00401a1f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
push 0
pop eax
jle 0x46291c
push dword [ebp - 0x3c]
movdqa xmm0, xmmword [0xa76f90]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x74], eax
push ecx
push eax
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x70], eax
movdqu xmmword [ebp - 0x228], xmm0
mov dword [ebp - 0x6c], eax
call fcn.00401a81
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 3
jg 0x4631e0
mov edi, dword [ebp - 0x74]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x20], 0xe779066
lea ecx, [ebp - 0x13c]
push 3
call fcn.0040194d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x463115
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x38], 0xa955a63a
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x463107
mov dword [ebp - 4], eax
jmp 0x463132
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x13c]
mov dword [ecx + edx*4], 8
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x46311f
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x74]
cmp dword [ecx + edx*4], eax
je 0x46314d
mov esi, ebx
cmp dword [ebp - 0x38], eax
jne 0x46314f
mov esi, eax
mov edx, dword [ebp - 0xc]
xor ebx, ebx
mov ecx, dword [ebp - 0x74]
cmp dword [ecx + edx*4], esi
mov ecx, 0xeec80f21
setl bl
xor edx, edx
sub ecx, ebx
cmp ecx, 0x6fdd8fb8
setne dl
cmp edx, dword [ebp - 0x20]
jne 0x463177
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov ecx, dword [ebp - 0x38]
imul ecx, dword [ebp - 0x38], 0xd365
cmp ecx, dword [edi + 4]
mov ecx, 0xffff
setle dl
cmp ecx, edx
sbb ecx, ecx
neg ecx
cmp ecx, 0xc36544d1
ja 0x4631b4
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x74]
cmp dword [ecx + edx*4], eax
jne 0x4631b4
cmp dword [ebp - 0xc], eax
jne 0x4631b4
xor ebx, ebx
inc ebx
jmp 0x4631b9
xor ebx, ebx
inc ebx
mov eax, ebx
imul ecx, eax, 0xfff9
mov eax, dword [ebp - 0x13c]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x13c]
call fcn.00401a1f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x4630ec
lea ecx, [ebp - 0x74]
call fcn.00401a1f
mov edi, dword [ebp - 0x44]
push dword [edi + 4]
call fcn.00479706
pop ecx
xor esi, esi
mov dword [ebp - 4], 0xa149cec7
inc esi
mov dword [ebp - 8], 0x1658a600
mov dword [ebp - 0x18], 0x45beac3e
lea ecx, [ebp - 0xec]
push esi
call fcn.0040194d
mov dword [ebp - 0x1c], 4
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xe61175c8
mov dword [ebp - 0x14], 0x69e1d621
mov dword [ebp - 0xc], eax
jmp 0x463248
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x1e8], 0xca3c0bf9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x463237
mov dword [ebp - 0xc], eax
jmp 0x463266
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xec]
mov dword [ecx + edx*4], 0x3b03c3fa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x463253
mov dword [ebp - 0xc], eax
jmp 0x463281
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x84], 0x78dfce24
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x463270
mov ecx, dword [ebp - 8]
inc dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 8]
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 0x80]
dec dword [ebp - 0x80]
test ecx, ecx
jne 0x4632a8
mov edx, eax
cmp dword [ebp - 0x80], eax
je 0x4632aa
mov edx, esi
mov dword [ebp - 0x20], esi
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xec]
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x20], edx
xor edx, edx
push 3
cmp dword [ecx], eax
sete dl
xor ebx, ebx
imul ecx, edx, 0x7afc
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
cmp ecx, edx
mov ecx, dword [ebp - 4]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
cmp edx, ecx
setle bl
add ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xec]
add ebx, dword [ecx]
xor ecx, ecx
cmp ebx, 0x74484a86
pop ebx
setl cl
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
jmp 0x463325
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1e8], 0x293e35f2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x463314
lea ecx, [ebp - 0xec]
call fcn.00401a1f
mov dword [ebp - 0x14], 4
xor eax, eax
mov dword [ebp - 4], 0x979cd329
mov dword [ebp - 0xc], 0xfffffffe
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], 0x3a1a91f1
mov dword [ebp - 0x20], 0xbc8977b4
mov dword [ebp - 0x18], eax
jmp 0x46337a
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x88], 0x262954f6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x463369
mov ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, 0xebf495e3
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, 0xd8b9
setne dl
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
setle bl
xor ecx, ecx
cmp ebx, 0xe52d
setne cl
sub ecx, dword [ebp - 0x14]
cmp ecx, 0x2a43
jle 0x4633d1
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], eax
jne 0x463403
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x463549
push 0xf2b
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x463547
push 3
lea ecx, [ebp - 0xb8]
call fcn.0040194d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x46342a
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xb8]
mov dword [ecx + edx*4], 0x79cc099a
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x463417
push 2
mov dword [ebp - 4], eax
pop ebx
jmp 0x463449
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x230], 0x15e1b460
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x463438
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jg 0x46352c
mov ecx, 0x49f0dc4b
mov dword [ebp - 0x18], 0x7eb23672
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], ecx
mov dword [ebp - 8], 0x22cbd4da
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0xb8]
mov edx, dword [edx + esi*4]
mov esi, dword [ebp - 4]
sub edx, ecx
mov ecx, dword [ebp - 0xb8]
add esi, edx
mov ecx, dword [ecx]
neg ecx
sub esi, ecx
neg esi
sbb esi, esi
inc esi
cmp esi, dword [ebp - 0x18]
je 0x4634ba
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xb8]
xor esi, esi
inc esi
xor edx, edx
mov dword [ebp - 0x104], esi
cmp dword [ecx], esi
setg dl
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], eax
jl 0x46351b
mov dword [ebp - 0x18], eax
jmp 0x4634f1
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x240], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x4634e0
mov dword [ebp - 8], eax
jmp 0x46350e
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x238], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x4634fc
dec dword [ebp - 0x1c]
dec dword [ebp - 0xc]
jns 0x4634db
inc dword [ebp - 4]
mov ecx, 0x49f0dc4b
cmp dword [ebp - 4], ebx
jle 0x46345f
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x46353c
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0xb8]
call fcn.00401a1f
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
sub ecx, edx
jne 0x463561
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x463563
mov ecx, esi
add ecx, 6
mov dword [ebp - 0x88], ecx
je 0x463571
mov ecx, dword [ebp - 4]
movdqa xmm0, xmmword [0xa76f90]
mov dword [ebp - 0xc], esi
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x14]
push dword [ebp - 0x3c]
movdqu xmmword [ebp - 0x218], xmm0
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
sub ecx, 9
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x208]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x64]
call fcn.00401a81
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x4635e3
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x58], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x4635d5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x46372e
xor edi, edi
inc edi
mov dword [ebp - 4], 0x53aa9ac7
mov dword [ebp - 4], eax
jmp 0x463711
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x18], 0xc657e3b6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x46370e
mov dword [ebp - 0x14], 0x6dad816f
xor edx, edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x58]
test ecx, ecx
sete dl
xor ebx, ebx
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp edx, ecx
mov ecx, dword [ebp - 0x24]
setge bl
sub ecx, ebx
cmp ecx, edi
jle 0x463652
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, edi
dec dword [ebp - 0x14]
xor ebx, ebx
mov ecx, dword [ebp - 4]
sub edx, ecx
add edx, dword [ebp - 0x14]
cmp edx, 0xffffffff
setg bl
xor ecx, ecx
cmp ebx, 0x6f62939
setge cl
cmp ecx, 0x1058
jge 0x463684
mov esi, edi
cmp dword [ebp - 4], eax
jne 0x463686
mov esi, eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x58]
mov ecx, dword [ebp - 4]
sub esi, ecx
xor ecx, ecx
cmp esi, edx
setg cl
sub ecx, 0x1defcecb
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], 0xfffffff3
jmp 0x4636ff
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4636c8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffd
jmp 0x4636f6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4636f3
push 0x1ecb
push 0x15a3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 6
jne 0x4636d1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x16
jg 0x4636b0
dec dword [ebp - 8]
jns 0x463621
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jle 0x463607
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4635f8
mov edi, dword [ebp - 0x44]
xor esi, esi
inc esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jg 0x463c49
mov edi, dword [ebp - 0x64]
mov dword [ebp - 8], 0xdce9
mov dword [ebp - 4], 0x304b25b3
push 2
mov dword [ebp - 0x14], 0x84902314
mov dword [ebp - 0x18], eax
pop ebx
jmp 0x46376c
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x1c8], 0x2c593c86
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x46375b
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], eax
jne 0x4637a2
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 8]
jne 0x463796
mov ecx, dword [ebp - 4]
cmp dword [ebp - 4], eax
jne 0x4637a2
mov ecx, eax
cmp dword [ebp - 8], eax
je 0x4637a4
mov ecx, esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 0xfffffffc
jmp 0x4637ca
mov dword [ebp - 4], eax
jmp 0x4637c2
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x1c8], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x4637b5
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff8
jl 0x4637b0
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], eax
push 3
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 7
push ecx
mov dword [ebp - 0x28], 0x44555950
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x28], 0xfffffff7
call fcn.0040194d
mov dword [ebp - 4], 0
jmp 0x463821
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x248], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x463810
mov dword [ebp - 4], 0
jmp 0x463842
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], 0xfd9e2a8d
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x46382f
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x160]
dec dword [eax]
mov dword [ebp - 0x24], 0x3582f80c
call fcn.00401a1f
mov dword [ebp - 0x24], 0xe779066
lea ecx, [ebp - 0x190]
mov eax, 0xffff
mov dword [ebp - 0x14], 0x24a8c6a5
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0x9f5fa318
push ebx
call fcn.0040194d
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 8], 0x5ee56e31
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xac], 0x3aa9c1c7
mov dword [ebp - 0x18], eax
jmp 0x4638bc
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x190]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x4638ac
mov dword [ebp - 0x14], eax
jmp 0x4638e1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4638de
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe7
jl 0x4638c6
cmp dword [ebp - 0x14], eax
jne 0x463905
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x2c], eax
jne 0x463900
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x20], eax
je 0x463907
mov eax, esi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, 0xffff
cmp dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 4]
setg dl
xor ecx, ecx
cmp edx, 0xfffffff9
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0xac]
setg bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x190]
setle cl
cmp esi, ecx
sbb edx, edx
neg edx
sub edx, dword [eax + 4]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x190]
call fcn.00401a1f
push 3
lea ecx, [ebp - 0x178]
call fcn.0040194d
mov dword [ebp - 0x1c], 0x38a1f949
xor eax, eax
mov dword [ebp - 0x20], 0xf6e229ed
mov dword [ebp - 0x14], 0x66bc657e
mov dword [ebp - 4], esi
mov dword [ebp - 8], 0x70e7ad53
cmp dword [ebp - 0x1c], eax
jne 0x463a43
mov ecx, dword [ebp - 0x1c]
sub ecx, 5
mov dword [ebp - 0x20], ecx
jne 0x4639c4
cmp dword [ebp - 0x20], eax
jne 0x4639c4
mov esi, eax
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp esi, ecx
setl dl
xor ebx, ebx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x6f9b
mov ecx, dword [ebp - 0x1c]
setl bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0xfc65
setg cl
sub ecx, 4
jne 0x463a1d
cmp dword [ebp - 0x14], eax
jne 0x463a1d
xor esi, esi
mov edx, eax
inc esi
jmp 0x463a22
xor esi, esi
inc esi
mov edx, esi
mov ecx, dword [ebp - 0x1c]
imul ecx, edx
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], eax
jne 0x463a43
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x463a54
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor eax, eax
jmp 0x463a54
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x2c], 0x84edc02
inc dword [ebp - 0x2c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x19
jg 0x463afe
push 2
pop ebx
mov dword [ebp - 0x18], eax
jmp 0x463a76
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x254], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x463a69
mov dword [ebp - 4], eax
jmp 0x463a97
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x463a94
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor eax, eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x12
jg 0x463a81
mov dword [ebp - 0x14], eax
jmp 0x463aec
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x463ac3
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x463ae4
cmp dword [ebp - 4], ebx
jle 0x463ac8
cmp dword [ebp - 0x14], ebx
jle 0x463aa2
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x19
jle 0x463a64
mov dword [ebp - 4], eax
jmp 0x463b11
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x34], 0xa955a63a
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x463b03
mov dword [ebp - 4], eax
jmp 0x463b2e
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x178]
mov dword [ecx + edx*4], 8
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x463b1b
mov dword [ebp - 0x28], 0x4a6847df
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x463b8b
push eax
push 0x2584
push 0xe88
push 0x6bc
push 0x2037
push 0x24ad
push 0x2278
push 0x4f8
push 0x24a1
push 0x151c
push 0x19c7
push 0x19d7
push 0x848
push 0x42
call dword [sym.imp.GDI32.dll_CreateFontA]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x463b9d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x64]
cmp dword [ecx + edx*4], eax
je 0x463bb0
cmp dword [ebp - 0x34], eax
jne 0x463bb2
mov esi, eax
mov edx, dword [ebp - 0xc]
xor ebx, ebx
mov ecx, dword [ebp - 0x64]
cmp dword [ecx + edx*4], esi
mov ecx, 0xeec80f21
setl bl
xor edx, edx
sub ecx, ebx
cmp ecx, 0x6fdd8fb8
setne dl
cmp edx, dword [ebp - 0x24]
jne 0x463bda
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x34], 0xd365
cmp ecx, dword [edi + 4]
mov ecx, 0xffff
setle dl
cmp ecx, edx
sbb ecx, ecx
neg ecx
cmp ecx, 0xc36544d1
ja 0x463c17
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x64]
cmp dword [ecx + edx*4], eax
jne 0x463c17
xor esi, esi
inc esi
mov eax, esi
imul ecx, eax, 0xfff9
mov eax, dword [ebp - 0x178]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x178]
call fcn.00401a1f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
push 0
pop eax
jle 0x46373e
lea ecx, [ebp - 0x64]
call fcn.00401a1f
mov dword [ebp - 0x1c], 0x69fdf99f
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x24], 0x2ea21e1d
mov dword [ebp - 0x18], 0xf4e1c2e9
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x28], 0xffffffff
push 3
call fcn.0040194d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x463c97
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x154]
mov dword [ecx + edx*4], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x463c88
mov dword [ebp - 4], eax
jmp 0x463caf
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x1dc], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x463ca2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff0
jne 0x463e0d
mov esi, dword [ebp - 0x154]
mov dword [ebp - 0x14], 0xfffffff7
lea ecx, [ebp - 0x148]
mov dword [ebp - 8], eax
push 2
call fcn.0040194d
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x463cf6
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x148]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x463ce6
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x463d2c
push 0x11fe
push eax
push eax
push 0x193a
push 0x8b3
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor eax, eax
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
cmp edx, ecx
setl bl
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 8]
jge 0x463d5a
cmp dword [ebp - 0x14], eax
je 0x463d5a
xor ecx, ecx
inc ecx
jmp 0x463d5c
mov ecx, eax
xor ebx, ebx
cmp ecx, 2
mov ecx, dword [ebp - 8]
setg bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ebx, ebx
cmp edx, 0x7142b622
setle bl
xor edx, edx
add ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp ebx, ecx
setne dl
mov dword [ebp - 8], edx
cmp dword [ebp - 8], eax
jne 0x463d9a
cmp dword [ebp - 0x14], eax
jne 0x463d9a
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x463d9f
xor ebx, ebx
inc ebx
mov edx, ebx
mov ecx, dword [ebp - 0x2c]
sub edx, ecx
inc edx
jne 0x463daa
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x28], 0xffffffff
jl 0x463dc3
mov edx, ebx
cmp dword [ebp - 0x18], eax
jne 0x463dc5
mov edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x148]
lea ecx, [ebp - 0x148]
setle dl
mov dword [eax + 4], edx
xor eax, eax
cmp edx, ebx
mov dword [esi + 4], edx
setle al
mov dword [ebp - 0x1dc], eax
call fcn.00401a1f
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff0
push 0
pop eax
je 0x463cc8
lea ecx, [ebp - 0x154]
call fcn.00401a1f
and dword [edi + 4], 0
lea ecx, [ebp - 0x16c]
push 3
call fcn.0040194d
xor eax, eax
mov dword [ebp - 4], 0xe2236432
mov dword [ebp - 0x18], eax
jmp 0x463e4a
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x16c]
mov dword [ecx + edx*4], 0xb9b55bb2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x463e37
mov dword [ebp - 4], eax
jmp 0x463ea0
mov dword [ebp - 0x18], eax
jmp 0x463e67
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x118], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x463e5a
mov ecx, dword [ebp - 4]
xor ebx, ebx
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp edx, ecx
mov ecx, dword [ebp - 0x16c]
setge bl
mov dword [ecx + esi*4], ebx
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], eax
jne 0x463ea6
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jle 0x463e55
lea ecx, [ebp - 0x16c]
call fcn.00401a1f
and dword [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret