Function at 0x424cc4
Capabilities:
Check os version
Enumerate gui resources
Get common file path
Get disk information
Get graphical window text
Get keyboard layout
Identify system language via api
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x222c
call fcn.0049c580
push ebx
push esi
push edi
xor eax, eax
mov byte [ebp - 0x71], dl
push 0xfffffffffffffffe
inc eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x40], eax
pop esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xe87f6fb8
mov dword [ebp - 0x24], 0xed7c6ae4
mov dword [ebp - 0x24], 0x403ca955
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x40], 0xfffffff9
cmp dword [ebp - 0x40], 0xb
push 4
pop ebx
je 0x424e7c
xor edi, edi
inc edi
push 2
lea ecx, [ebp - 0x880]
call fcn.0040fd61
mov dword [ebp - 0x24], 0xfffffffc
xor eax, eax
mov dword [ebp - 0x24], 0xdc6b79df
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xdd8fb8ce
mov dword [ebp - 0x10], eax
jmp 0x424d56
push dword [ebp - 0x10]
call fcn.0040fe4f
mov dword [eax], 0x6d444182
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
lea ecx, [ebp - 0x880]
jl 0x424d45
push edi
call fcn.0040fe4f
mov dword [eax], 0xc
jmp 0x424e3e
mov dword [ebp - 0x2c], 9
lea ecx, [ebp - 0xdfc]
mov dword [ebp - 0x24], 0xfffffff7
push ebx
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x424db1
push dword [ebp - 0x10]
lea ecx, [ebp - 0xdfc]
call fcn.0040fe4f
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x424d97
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x424e57
mov dword [ebp - 0x2c], 0xffffffee
jmp 0x424e1f
push ebx
lea ecx, [ebp - 0x143c]
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 0x48], 0xe7790660
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x424dfe
push dword [ebp - 0x10]
lea ecx, [ebp - 0x143c]
call fcn.0040fe4f
mov dword [eax], 0x5f5f996f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x424de0
xor eax, eax
inc dword [ebp - 0x48]
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x424e11
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ecx, [ebp - 0x143c]
call fcn.0040fe33
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x31
je 0x424dc3
lea ecx, [ebp - 0xdfc]
call fcn.0040fe33
push edi
lea ecx, [ebp - 0x880]
call fcn.0040fe4f
dec dword [eax]
push edi
lea ecx, [ebp - 0x880]
call fcn.0040fe4f
push 0xfffffffffffffff8
pop ecx
cmp dword [eax], ecx
je 0x424d73
jmp 0x424e62
lea ecx, [ebp - 0xdfc]
call fcn.0040fe33
lea ecx, [ebp - 0x880]
call fcn.0040fe33
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xb
jne 0x424d19
jmp 0x424e7f
xor edi, edi
inc edi
movdqa xmm0, xmmword [0xa97d70]
lea eax, [ebp - 0x1830]
push eax
lea eax, [ebp - 0x1840]
mov dword [ebp - 0x2c], 0x9d29be1d
push eax
lea ecx, [ebp - 0x2034]
movdqu xmmword [ebp - 0x1840], xmm0
call fcn.0040fe61
lea ecx, [ebp - 0x235]
mov esi, eax
call fcn.0040fe5e
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1054]
push dword [esi]
call fcn.0040fe0d
push 3
mov dword [ebp - 0x2c], 0xe0648261
xor eax, eax
pop esi
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
jl 0x424f4a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x424f07
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x114], 0xd9ba07e4
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x424ee9
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x114], esi
cmp dword [ebp - 0x114], eax
jl 0x424f45
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1054]
call fcn.0040fe4f
cmp dword [eax], 0
jne 0x424f43
xor eax, eax
lea ecx, [ebp - 0x1054]
push eax
call fcn.0040fe4f
cmp dword [eax], 0
jne 0x424f43
dec dword [ebp - 0x114]
jns 0x424f15
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x424ee1
lea ecx, [ebp - 0x1054]
call fcn.0040fe33
mov dword [ebp - 0xc], edi
lea ecx, [ebp - 0xafc]
mov dword [ebp - 0x48], 0xfc4f27d2
mov dword [ebp - 0x34], 0xffffffff
push ebx
call fcn.0040fd61
mov dword [ebp - 0x1c], ebx
xor eax, eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x10], eax
jmp 0x424f8c
push dword [ebp - 0x10]
call fcn.0040fe4f
mov dword [eax], edi
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xafc]
cmp dword [ebp - 0x10], ebx
jl 0x424f7f
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
push esi
call fcn.0040fe4f
mov eax, dword [ebp - 0xc]
sub eax, 0x9562
sub eax, dword [ebp - 0x48]
neg eax
push esi
sbb eax, eax
inc eax
cmp eax, edi
mov eax, dword [ebp - 0xc]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0xafc]
setg bl
call fcn.0040fe4f
xor ecx, ecx
test ebx, ebx
setne cl
mov dword [eax], ebx
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
cmp eax, ecx
jl 0x424fe8
mov eax, edi
jmp 0x424fea
xor eax, eax
cmp dword [ebp - 0xc], eax
jle 0x425000
push esi
lea ecx, [ebp - 0xafc]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x42500c
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x42500e
lea edx, [eax + 1]
jmp 0x425010
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edx, eax
mov eax, dword [ebp - 0x34]
sete cl
xor edx, edx
cmp ecx, 0x8be
setl dl
sub eax, edx
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x425047
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
lea ecx, [ebp - 0xafc]
call fcn.0040fe33
xor ebx, ebx
lea eax, [ebp - 0x1860]
inc ebx
lea ecx, [ebp - 0x1e7c]
mov dword [ebp - 0x2c], ebx
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0x188753e1
mov dword [ebp - 0x48], 7
push eax
mov dword [ebp - 0x1c], 0x9986e3e4
lea eax, [ebp - 0x1870]
mov dword [ebp - 0x30], 0xbf889e02
mov dword [ebp - 0x40], 0x2206dd2c
mov dword [ebp - 8], 0xa2ef703c
push eax
movdqu xmmword [ebp - 0x1870], xmm0
call fcn.0040fe61
lea ecx, [ebp - 0x22f]
mov esi, eax
call fcn.0040fe5e
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1a4]
push dword [esi]
call fcn.0040fe0d
mov dword [ebp - 0x28], 0xbf5cbf79
xor eax, eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x44], 0x88fefd6e
cmp dword [ebp - 0x2c], eax
je 0x42515b
cmp dword [ebp - 0x1c], eax
jne 0x42512b
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 8]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setg bl
xor ecx, ecx
cmp ebx, eax
setge cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
cmp eax, 2
setne cl
imul ecx, dword [ebp - 0x2c]
test ecx, ecx
jne 0x425128
xor eax, eax
jmp 0x42512d
xor ebx, ebx
inc ebx
mov eax, ebx
mov ecx, dword [ebp - 0x28]
add ecx, eax
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x28]
cmp eax, ecx
jge 0x42513f
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x1a4]
push 3
call fcn.0040fe4f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x1a4]
mov eax, dword [ebp - 0x1c]
push 2
call fcn.0040fe4f
mov ecx, dword [ebp - 0x44]
push 2
mov esi, dword [eax]
sub esi, ecx
lea ecx, [ebp - 0x1a4]
call fcn.0040fe4f
mov ecx, dword [ebp - 0x2c]
add ecx, esi
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 8], 3
cmp dword [ebp - 8], eax
jl 0x4252cb
jmp 0x42519f
xor eax, eax
mov dword [ebp - 0x3c], 0xffffffff
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x1c], eax
push dword [ebp - 8]
call fcn.0040fe4f
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
test eax, eax
setle cl
cmp ecx, 0xffffffff
sbb edx, edx
neg edx
inc edx
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x1a4]
push dword [ebp - 8]
call fcn.0040fe4f
push dword [ebp - 8]
lea ecx, [ebp - 0x1a4]
mov esi, eax
call fcn.0040fe4f
xor edx, edx
push 2
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x2c]
imul ecx, dword [esi]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1a4]
call fcn.0040fe4f
xor ebx, ebx
cmp dword [eax], ebx
je 0x425269
push dword [ebp - 8]
lea ecx, [ebp - 0x1a4]
call fcn.0040fe4f
cmp dword [eax], ebx
jne 0x425266
xor eax, eax
lea ecx, [ebp - 0x1a4]
push eax
call fcn.0040fe4f
mov eax, dword [ebp - 0x44]
push dword [ebp - 8]
lea ecx, [ebp - 0x1a4]
call fcn.0040fe4f
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x1a4]
push dword [ebp - 8]
call fcn.0040fe4f
mov edx, dword [ebp - 0x3c]
mov esi, eax
add edx, dword [ebp - 0x3c]
xor eax, eax
mov ecx, dword [ebp - 0x28]
cmp ecx, edx
setl al
xor ecx, ecx
cmp eax, 0x57094d04
mov eax, dword [ebp - 0x3c]
setne cl
xor edx, edx
cmp ecx, 0xffffffff
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setne bl
xor ecx, ecx
cmp ebx, eax
setne cl
mov dword [esi], ecx
dec dword [ebp - 8]
jns 0x42519d
lea ecx, [ebp - 0x1a4]
call fcn.0040fe33
movdqa xmm0, xmmword [0xa97d80]
lea eax, [ebp - 0x19e0]
push eax
lea eax, [ebp - 0x19f0]
mov dword [ebp - 0x40], 0xfd3df75d
push eax
lea ecx, [ebp - 0x1d1c]
movdqu xmmword [ebp - 0x19f0], xmm0
call fcn.0040fe61
lea ecx, [ebp - 0x239]
mov esi, eax
call fcn.0040fe5e
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1454]
push dword [esi]
call fcn.0040fe0d
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x425348
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1f6c], 0xf0ea
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x42532f
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x42536f
push 0xeef
push 0x1177
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_LineTo]
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x42537f
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 2
lea ecx, [ebp - 0x898]
call fcn.0040fd61
mov dword [ebp - 0x24], 0x7c4177fd
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff6
xor esi, esi
mov dword [ebp - 0x24], 0xffffffff
inc esi
mov dword [ebp - 0x24], 0xd4393632
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x4253f3
push dword [ebp - 8]
lea ecx, [ebp - 0x898]
call fcn.0040fe4f
mov dword [eax], 0x9b3198a8
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x4253d4
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x425417
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x4e8], esi
xor eax, eax
inc dword [ebp - 8]
inc eax
push eax
pop esi
cmp dword [ebp - 8], eax
jl 0x4253fb
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0x898]
call fcn.0040fe4f
mov dword [eax], 0x12
jmp 0x4255ad
mov dword [ebp - 8], 0x4fe5f36f
xor eax, eax
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x425464
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1560], 0xffffffff
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x425446
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x42547f
push eax
push eax
push 0x1cd8
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x42559f
mov dword [ebp - 0x2c], 0x23d1bca9
mov dword [ebp - 0x34], 0x6658069d
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x48], 0xf83bf0b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x4254cd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1570], 0xa94fe874
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x4254af
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x42556b
mov dword [ebp - 0x10], eax
jmp 0x4254ef
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x20b0], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x4254de
mov eax, dword [ebp - 8]
mov ecx, esi
sub ecx, eax
sub ecx, 0x1a80d1c1
neg ecx
sbb ecx, ecx
inc ecx
add ecx, 0x5e67df4e
jne 0x42551f
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x4e8], ecx
jne 0x42551f
xor eax, eax
jmp 0x425521
mov eax, esi
neg eax
xor ecx, ecx
cmp eax, 0x1de2
mov eax, dword [ebp - 0x2c]
setge cl
add eax, 0xffff5534
add eax, ecx
neg eax
sbb eax, eax
inc eax
sub eax, 0x4f2a
jne 0x425546
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
push 0
mov eax, dword [ebp + eax*4 - 0x4e8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x48]
dec dword [ebp - 0x2c]
pop eax
jns 0x4254d9
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x425596
push 0x135c
push 0xe89
push 0x203f
push 0xdf8
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
xor eax, eax
dec dword [ebp - 8]
jns 0x42548b
push eax
lea ecx, [ebp - 0x898]
call fcn.0040fe4f
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x898]
push eax
call fcn.0040fe4f
cmp dword [eax], 0xfffffffe
je 0x42542e
lea ecx, [ebp - 0x898]
call fcn.0040fe33
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x425dc3
movdqa xmm0, xmmword [0xa97d60]
lea eax, [ebp - 0x1880]
push eax
lea eax, [ebp - 0x1890]
push eax
lea ecx, [ebp - 0x1d2c]
movdqu xmmword [ebp - 0x1890], xmm0
call fcn.0040fe61
lea ecx, [ebp - 0x1ef]
mov esi, eax
call fcn.0040fe5e
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1b6c]
push dword [esi]
call fcn.0040fe0d
xor esi, esi
lea ecx, [ebp - 0x8b0]
inc esi
push esi
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x42565d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x8b0]
call fcn.0040fe4f
mov dword [eax], 0xfffffffe
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x425639
xor esi, esi
xor eax, eax
inc esi
push eax
lea ecx, [ebp - 0x8b0]
call fcn.0040fe4f
push 3
pop ebx
mov dword [eax], ebx
jmp 0x425697
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x425689
push eax
push 0x14ce
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
xor eax, eax
push eax
lea ecx, [ebp - 0x8b0]
call fcn.0040fe4f
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x8b0]
push eax
call fcn.0040fe4f
cmp dword [eax], 0
jge 0x425670
lea ecx, [ebp - 0x8b0]
call fcn.0040fe33
lea ecx, [ebp - 0x1b6c]
call fcn.0040fe33
mov dword [ebp - 0x2c], 0xffffffff
lea ecx, [ebp - 0x1724]
mov dword [ebp - 0x30], 0xe9d05ba7
mov dword [ebp - 0x3c], 0xfff8
mov dword [ebp - 0x2c], 0x9951ea66
mov dword [ebp - 0x28], esi
push 2
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x425716
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1724]
call fcn.0040fe4f
mov dword [eax], 0xdc86695c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x4256f7
xor eax, eax
mov dword [ebp - 0x30], 0x6fe7d8a8
cmp dword [ebp - 0x30], eax
jne 0x425734
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x3c]
jle 0x425734
xor eax, eax
jmp 0x425736
mov eax, esi
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x42575e
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x30]
test eax, eax
jne 0x42575e
mov edx, eax
jmp 0x425766
xor eax, eax
xor esi, esi
inc esi
lea edx, [eax + 1]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 0xf1e5
setl al
cmp eax, dword [ebp - 0x30]
jg 0x425789
mov dword [ebp - 0x2c], 0x5a8ccedb
jmp 0x4257ce
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x4257a5
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x4257a2
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x3b
jg 0x425790
mov dword [ebp - 0x28], eax
jmp 0x4257c9
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x4257c6
push 0xa71
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x4257b0
lea ecx, [ebp - 0x1724]
call fcn.0040fe33
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x42582d
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x4257f4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x42580d
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x48], 0x9b2cfb63
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jne 0x4257f9
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1454]
call fcn.0040fe4f
push 0
mov dword [eax], 0x937a3a11
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], 4
jl 0x4257e0
push 4
lea ecx, [ebp - 0x3ac]
call fcn.0040fd61
push ebx
lea ecx, [ebp - 0xe14]
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x425870
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1ab0], 0xdc85
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x425857
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x425894
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3ac]
call fcn.0040fe4f
mov dword [eax], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x425879
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x4258ad
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe14]
call fcn.0040fe4f
or dword [eax], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x425899
push 2
lea ecx, [ebp - 0x3ac]
call fcn.0040fe4f
and dword [eax], 0
jmp 0x4259a6
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x44], 0xbd697e78
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x425987
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
push 2
setl dl
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 0x44], edx
call fcn.0040fe4f
mov ecx, dword [ebp - 0x3c]
xor ebx, ebx
push esi
cmp dword [eax], ecx
lea ecx, [ebp - 0x3ac]
setne bl
call fcn.0040fe4f
push 2
lea ecx, [ebp - 0x3ac]
mov eax, dword [eax]
imul eax, ebx
mov dword [ebp - 0x48], eax
call fcn.0040fe4f
mov ecx, dword [ebp - 0x48]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0xe14]
setne bl
xor eax, eax
push eax
call fcn.0040fe4f
mov ecx, dword [ebp - 0x3c]
mov esi, eax
xor eax, eax
push 1
mov ecx, dword [ebp + ecx*4 - 0x1ab0]
sub ebx, ecx
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp + ecx*4 - 0x1ab0]
mov ecx, dword [ebp - 0x44]
cmp edx, ecx
setle al
sub eax, ebx
neg eax
sbb eax, eax
add eax, 0x2bcf69bf
neg eax
sbb eax, eax
inc eax
mov dword [esi], eax
dec dword [ebp - 0x3c]
pop esi
jns 0x4258e2
push 3
xor eax, eax
pop ebx
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x425997
push eax
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 2
lea ecx, [ebp - 0x3ac]
call fcn.0040fe4f
inc dword [eax]
push 2
lea ecx, [ebp - 0x3ac]
call fcn.0040fe4f
cmp dword [eax], ebx
jle 0x4258c7
lea ecx, [ebp - 0xe14]
call fcn.0040fe33
lea ecx, [ebp - 0x3ac]
call fcn.0040fe33
push esi
lea ecx, [ebp - 0xc78]
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 8], 0xfffffff7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x425a0f
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc78]
call fcn.0040fe4f
mov dword [eax], 0x24039b64
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x4259ee
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x425a3d
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], 0
je 0x425a3a
push 0xe37
push 0x9f0
push 0x9ef
call edi
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jle 0x425a14
mov dword [ebp - 8], 0xfffffffc
jmp 0x425a81
mov dword [ebp - 0xc], 0x73e7ed6f
mov eax, dword [ebp - 8]
xor eax, eax
push eax
call fcn.0040fe4f
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0xc78]
mov eax, dword [ebp - 0xc]
xor eax, eax
push eax
call fcn.0040fe4f
mov ecx, dword [ebp - 0xc]
xor edx, edx
cmp dword [eax], ecx
setne dl
mov dword [ebp - 0xc], edx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffed
lea ecx, [ebp - 0xc78]
jne 0x425a4b
call fcn.0040fe33
xor eax, eax
mov byte [ebp - 1], al
mov dword [ebp - 0x14], 0x4351cdcb
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x48], 8
mov dword [ebp - 0x48], 0xc8951bb3
mov dword [ebp - 0x34], 0x6353005
cmp dword [ebp - 0x14], eax
jne 0x425b1f
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jg 0x425adb
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x425adb
mov ecx, eax
jmp 0x425ae0
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
dec edx
neg edx
push 0xfffffffffffffffe
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
pop ecx
sub ecx, eax
jne 0x425b1f
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setne dl
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x4d], al
cmp byte [ebp - 0x4d], al
je 0x425b49
push eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
cmp byte [ebp - 1], 0
je 0x425dc0
mov dword [ebp - 8], 0xc93b4e1
lea ecx, [ebp - 0xbb8]
mov dword [ebp - 0x14], 0xc2a41b87
push 2
call fcn.0040fd61
mov dword [ebp - 0x10], 0xf9a325cf
lea ecx, [ebp - 0x11e0]
xor ebx, ebx
mov dword [ebp - 0x48], 0x106df3f1
inc ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0x686461d9
push 3
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x425bc0
push dword [ebp - 8]
lea ecx, [ebp - 0xbb8]
call fcn.0040fe4f
mov dword [eax], 0x23cb8e00
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x425ba1
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x425be4
push dword [ebp - 8]
lea ecx, [ebp - 0x11e0]
call fcn.0040fe4f
mov dword [eax], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x425bc9
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfffffff5
jne 0x425da0
jmp 0x425bf5
xor eax, eax
mov dword [ebp - 0xc], 0x67656540
mov dword [ebp - 0x10], eax
jmp 0x425c0f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x70], 5
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x425c01
mov eax, dword [ebp - 0x70]
xor edx, edx
mov eax, dword [ebp - 0x70]
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0x70]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0x5ebda184
jle 0x425c3a
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 8]
xor edx, edx
cmp eax, 0x1648
mov eax, dword [ebp - 8]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 0x59842251
jle 0x425c5c
mov eax, dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x70], eax
je 0x425c64
inc eax
mov edx, dword [ebp - 0x70]
xor ecx, ecx
imul edx, dword [ebp - 8]
imul edx, eax
mov eax, dword [ebp - 8]
cmp eax, edx
setl cl
xor eax, eax
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xbb8]
mov esi, dword [ebp - 0xc]
push eax
call fcn.0040fe4f
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
cmp eax, 0x61e4171b
setne cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
lea ecx, [ebp - 0xbb8]
setge dl
xor ebx, ebx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
cmp eax, 0x74dc
setl bl
xor eax, eax
push eax
call fcn.0040fe4f
xor esi, esi
inc esi
cmp ebx, esi
mov dword [eax], ebx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, esi
mov eax, dword [ebp - 0x70]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
add eax, edx
jne 0x425cff
cmp dword [ebp - 0x70], eax
je 0x425d01
mov eax, esi
mov dword [ebp - 0x48], eax
xor edx, edx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x70]
setle dl
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x14]
setg cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
push 2
setg cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setl dl
xor ebx, ebx
test edx, edx
sets bl
sub ebx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x70]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x70]
setg cl
xor ebx, ebx
cmp ecx, eax
lea ecx, [ebp - 0x11e0]
setle bl
call fcn.0040fe4f
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp ebx, ecx
sete dl
mov dword [eax], edx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff5
je 0x425bf3
lea ecx, [ebp - 0x11e0]
call fcn.0040fe33
lea ecx, [ebp - 0xbb8]
call fcn.0040fe33
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xffffffe8
jg 0x4255d9
lea ecx, [ebp - 0x1454]
call fcn.0040fe33
mov dword [ebp - 0x14], 0xb9f9b31
xor eax, eax
mov dword [ebp - 0x24], 0x85ffff32
mov esi, 0xfff9
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x24], 0x975a1448
mov dword [ebp - 0x24], 0x2cac2457
mov dword [ebp - 0x20], 0xbdbb389e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 6
jle 0x42607a
mov dword [ebp - 0x30], eax
xor ebx, ebx
mov dword [ebp - 0x24], 0xffffffff
inc ebx
mov dword [ebp - 0x24], 0xd2c643d4
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x425e4f
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd6c], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x425e3a
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x425e65
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1b84], 0xc86797b6
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x425e54
mov dword [ebp - 0x30], 0xffffffe3
jmp 0x426060
push 2
lea ecx, [ebp - 0x8c8]
call fcn.0040fd61
mov dword [ebp - 0x3c], 8
xor eax, eax
mov dword [ebp - 0xc], 0xea311c3f
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x425ec2
push dword [ebp - 8]
lea ecx, [ebp - 0x8c8]
call fcn.0040fe4f
mov dword [eax], 0xf6dd
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x425ea3
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x425ee0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1810], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x425ecb
xor eax, eax
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x425f9e
jmp 0x425ef0
xor eax, eax
mov dword [ebp - 0x44], 0xffff
lea ecx, [ebp - 0x8c8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], ebx
push dword [ebp - 0x3c]
call fcn.0040fe4f
mov edx, dword [ebp - 0xc]
mov esi, eax
sub edx, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x52a42bbd
setl cl
cmp ecx, 0xfffffffa
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub ecx, eax
mov eax, dword [ebp - 0x30]
cmp ecx, eax
lea ecx, [ebp - 0x8c8]
setle dl
xor eax, eax
cmp edx, 0xa3205f5
setne al
add eax, dword [esi]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
push dword [ebp - 0x3c]
call fcn.0040fe4f
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, ebx
setl cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x425f95
push eax
push eax
push 0x22fe
push 0x1731
push eax
call dword [sym.imp.USER32.dll_ModifyMenuW]
dec dword [ebp - 0x3c]
jns 0x425eee
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x8c8]
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
xor eax, eax
push eax
call fcn.0040fe4f
mov edx, dword [ebp - 0xd6c]
mov esi, eax
mov ecx, dword [ebp - 0x3c]
xor eax, eax
cmp ecx, edx
setg al
xor edx, edx
cmp eax, 0x1cd4
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, dword [esi]
lea ecx, [ebp - 0x8c8]
setg al
mov dword [ebp - 0x1b7c], eax
xor eax, eax
push eax
call fcn.0040fe4f
mov eax, dword [ebp - 0x1808]
xor edx, edx
mov ecx, dword [ebp - 0x1810]
mov eax, dword [ebp - 0xd6c]
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xdf100f83
sbb eax, eax
neg eax
add eax, 0x6cdf50b9
jne 0x42603a
cmp dword [ebp - 0x20], eax
jne 0x42603a
mov ecx, eax
jmp 0x426042
xor eax, eax
xor ebx, ebx
inc ebx
lea ecx, [eax + 1]
xor eax, eax
cmp ecx, 9
lea ecx, [ebp - 0x8c8]
setl al
mov dword [ebp - 0x34], eax
call fcn.0040fe33
inc dword [ebp - 0x30]
mov esi, 0xfff9
cmp dword [ebp - 0x30], 0xfffffff5
jle 0x425e77
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 6
push 0
pop eax
jg 0x425e16
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x34], 0xeec73f5c
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffef
je 0x4261d2
xor ebx, ebx
inc ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x34], 0xcb4e347
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x4261bb
push 2
lea ecx, [ebp - 0x988]
call fcn.0040fd61
mov dword [ebp - 0x34], 0xffffffff
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x48], 0x12ef314d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x426108
push dword [ebp - 8]
lea ecx, [ebp - 0x988]
call fcn.0040fe4f
mov dword [eax], 0x7e08
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x4260e9
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x42611e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1b9c], 0x8f27142b
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x42610d
push ebx
lea ecx, [ebp - 0x988]
call fcn.0040fe4f
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax]
je 0x42618e
push ebx
lea ecx, [ebp - 0x988]
call fcn.0040fe4f
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x988]
mov eax, dword [ebp - 0x34]
push ebx
call fcn.0040fe4f
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1b9c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x3c]
cmp esi, eax
mov eax, dword [ebp - 0x44]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
sub edx, 0xe311
je 0x42618e
mov eax, ebx
jmp 0x426190
xor eax, eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x44]
jle 0x4261a2
xor eax, eax
cmp dword [ebp - 0xc], eax
je 0x4261a4
mov eax, ebx
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x988]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
call fcn.0040fe33
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xf
jne 0x4260b9
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffef
jne 0x42609f
movdqa xmm0, xmmword [0xa97e10]
lea eax, [ebp - 0x18a0]
push eax
lea eax, [ebp - 0x18b0]
push eax
lea ecx, [ebp - 0x1f84]
movdqu xmmword [ebp - 0x18b0], xmm0
call fcn.0040fe61
lea ecx, [ebp - 0x212]
mov esi, eax
call fcn.0040fe5e
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x5a8]
push dword [esi]
call fcn.0040fe0d
push 3
mov dword [ebp - 0x14], 0xc6f1bf50
lea ecx, [ebp - 0x106c]
pop ebx
mov dword [ebp - 0x1c], 0x837aced4
mov dword [ebp - 0x1c], 0x13e458c4
mov dword [ebp - 0x48], 0xfffffff7
push ebx
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jge 0x426265
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xe2c], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x426251
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jge 0x42628b
push dword [ebp - 8]
lea ecx, [ebp - 0x106c]
call fcn.0040fe4f
mov dword [eax], 0xce6c1cc4
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x42626d
xor eax, eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x4263d0
jmp 0x42629b
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x4262be
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x146c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4262ad
mov ecx, dword [ebp - 0x146c]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
lea ecx, [ebp - 0x5a8]
setne dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x14]
call fcn.0040fe4f
lea ecx, [ebp - 0x5a8]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xe24]
add eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
push dword [ebp - 0x14]
call fcn.0040fe4f
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x5a8]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x456e
push dword [ebp - 0x14]
call fcn.0040fe4f
xor ecx, ecx
cmp dword [eax], ecx
sete cl
xor edx, edx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xe28]
mov eax, dword [ebp - 0xc]
add ecx, eax
mov eax, dword [ebp - 0x146c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
sub edx, 0xfffe
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x426369
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 0x106c]
xor eax, eax
push eax
call fcn.0040fe4f
lea ecx, [ebp - 0x5a8]
mov dword [eax], esi
mov eax, dword [ebp - 0xe28]
mov eax, dword [ebp - 0x34]
push dword [ebp - 0x14]
call fcn.0040fe4f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5a8]
mov esi, dword [eax]
dec esi
call fcn.0040fe4f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5a8]
mov edi, dword [eax]
imul edi, esi
call fcn.0040fe4f
xor ecx, ecx
cmp dword [eax], edi
setle cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x14]
jns 0x426299
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x106c]
call fcn.0040fe33
lea ecx, [ebp - 0x5a8]
call fcn.0040fe33
xor esi, esi
lea ecx, [ebp - 0xa60]
inc esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x48], 0xfc4f27d2
mov dword [ebp - 0x34], 0xffffffff
push 4
call fcn.0040fd61
push 4
pop ecx
mov dword [ebp - 0x1c], ecx
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x426433
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa60]
call fcn.0040fe4f
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x42641a
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0xa60]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
push ebx
call fcn.0040fe4f
mov eax, dword [ebp - 0xc]
sub eax, 0x9562
sub eax, dword [ebp - 0x48]
neg eax
push 3
sbb eax, eax
inc eax
cmp eax, esi
mov eax, dword [ebp - 0xc]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0xa60]
setg bl
call fcn.0040fe4f
xor ecx, ecx
test ebx, ebx
setne cl
mov dword [eax], ebx
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
cmp eax, ecx
jl 0x42648b
mov eax, esi
jmp 0x42648d
xor eax, eax
cmp dword [ebp - 0xc], eax
jle 0x4264a4
push 3
lea ecx, [ebp - 0xa60]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x4264b3
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x4264b5
xor esi, esi
lea edx, [eax + 1]
inc esi
jmp 0x4264b7
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
sete cl
xor edx, edx
cmp ecx, 0x8be
setl dl
sub eax, edx
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x4264e8
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
lea ecx, [ebp - 0xa60]
call fcn.0040fe33
push 2
pop ebx
push ebx
lea ecx, [ebp - 0x1644]
call fcn.0040fd61
mov dword [ebp - 0x18], 0x9841b3c6
xor eax, eax
mov dword [ebp - 0x1c], 0x45c17473
mov dword [ebp - 0x10], 3
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], 0xfffffff0
jmp 0x426569
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x426552
push 0xe37
push 0x9f0
push 0x9ef
call edi
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x426566
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 9
je 0x42652c
cmp dword [ebp - 0x18], eax
jne 0x426577
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 0xc002
setg cl
xor eax, eax
test ecx, ecx
setns al
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x4265a3
mov eax, esi
mov dword [ebp - 0x1c], 0x79b6
mov ecx, 0x5a51
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
sub ecx, eax
sub ecx, 0x901516ea
add ecx, dword [ebp - 0x18]
neg ecx
push 6
sbb ecx, ecx
xor eax, eax
inc ecx
cmp eax, ecx
pop edi
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x3a34
mov eax, dword [ebp - 0xc]
setg cl
inc eax
add ecx, eax
xor edx, edx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x18], 0xeef20fe6
mov dword [ebp - 0x24], 0x7fd5
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x42665b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x510], 0xfffffffb
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jl 0x42663d
xor esi, esi
xor eax, eax
inc esi
inc dword [ebp - 0x510]
mov dword [ebp - 0x24], 0xad4351cd
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x24], 0xf9b2cfb6
mov dword [ebp - 0x10], eax
jmp 0x426690
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x42668d
push eax
call dword [sym.imp.KERNEL32.dll_EncodePointer]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe8
je 0x42667b
mov dword [ebp - 0x30], 0xe9d05ba7
lea ecx, [ebp - 0x1638]
mov dword [ebp - 0x3c], 0xfff8
mov dword [ebp - 0x2c], 0x9951ea66
mov dword [ebp - 0x28], esi
push ebx
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x4266e2
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1638]
call fcn.0040fe4f
mov dword [eax], 0xdc86695c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4266c4
xor eax, eax
mov dword [ebp - 0x30], 0x6fe7d8a8
cmp dword [ebp - 0x30], eax
jne 0x426700
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x3c]
jle 0x426700
xor eax, eax
jmp 0x426702
mov eax, esi
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x42672a
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x30]
test eax, eax
jne 0x42672a
mov edx, eax
jmp 0x426732
xor eax, eax
xor esi, esi
inc esi
lea edx, [eax + 1]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 0xf1e5
setl al
cmp eax, dword [ebp - 0x30]
jg 0x426755
mov dword [ebp - 0x2c], 0x5a8ccedb
jmp 0x42679a
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x426771
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x42676e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x3b
jg 0x42675c
mov dword [ebp - 0x28], eax
jmp 0x426795
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x426792
push 0xa71
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x42677c
lea ecx, [ebp - 0x1638]
call fcn.0040fe33
mov dword [ebp - 0xc], edi
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x1c], 0xe008
mov dword [ebp - 0x34], 0x28405cef
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x4267dd
push 0x20
push 0x234a
push 0x2525
call edi
xor eax, eax
cmp dword [ebp - 0xc], eax
jne 0x426800
cmp dword [ebp - 0xc], esi
jne 0x4267ee
xor eax, eax
lea ecx, [eax + 1]
jmp 0x4267f0
mov ecx, eax
mov eax, dword [ebp - 0xc]
add eax, ecx
mov dword [ebp - 0x34], eax
jne 0x426800
xor eax, eax
mov ecx, eax
jmp 0x426805
xor eax, eax
lea ecx, [eax + 1]
xor eax, eax
cmp ecx, 0xfffffff7
setle al
xor ecx, ecx
cmp eax, 1
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, 0xb44cf59
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 8], eax
jmp 0x42685f
push dword [ebp - 8]
lea ecx, [ebp - 0x1644]
call fcn.0040fe4f
mov dword [eax], 0x571177e8
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x426848
push ebx
lea ecx, [ebp - 0x8e0]
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 0x30], 0xaabecba2
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jge 0x42689f
push dword [ebp - 8]
lea ecx, [ebp - 0x8e0]
call fcn.0040fe4f
mov dword [eax], 0x13dd33a4
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x426881
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jge 0x4268bf
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1320], 0x5062d7bc
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4268a7
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x30], eax
jg 0x426a68
mov dword [ebp - 8], 0x459eeda5
lea ecx, [ebp - 0x8e0]
mov eax, dword [ebp - 8]
xor eax, eax
push eax
call fcn.0040fe4f
xor ebx, ebx
lea ecx, [ebp - 0x8e0]
cmp dword [eax], ebx
setne bl
xor eax, eax
push eax
call fcn.0040fe4f
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 8]
sub esi, ebx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, esi
lea ecx, [ebp - 0x8e0]
setl dl
xor ebx, ebx
cmp edx, dword [eax]
setge bl
xor eax, eax
push eax
call fcn.0040fe4f
mov ecx, dword [ebp - 0x30]
sub ecx, ebx
sub ecx, dword [eax]
mov dword [ebp - 0x1320], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
sub eax, dword [ebp - 0x30]
je 0x426959
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x426a56
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
jmp 0x426a56
xor eax, eax
xor ebx, ebx
mov dword [ebp - 8], eax
inc ebx
jmp 0x426a4d
mov dword [ebp - 0x2c], 0x3659ea4d
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], eax
jl 0x426a4a
mov dword [ebp - 0x40], 0x22736378
mov dword [ebp - 0x40], eax
jmp 0x426a20
mov dword [ebp - 0x10], 0xfcc1031c
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x4269a0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x426a1d
movdqa xmm0, xmmword [0xa97d90]
lea eax, [ebp - 0x1a00]
push eax
lea eax, [ebp - 0x1a10]
push eax
lea ecx, [ebp - 0x1d6c]
movdqu xmmword [ebp - 0x1a10], xmm0
call fcn.0040fe61
lea ecx, [ebp - 0x249]
mov esi, eax
call fcn.0040fe5e
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1484]
push dword [esi]
call fcn.0040fe0d
push 3
lea ecx, [ebp - 0x1484]
call fcn.0040fe4f
lea ecx, [ebp - 0x1484]
mov dword [eax], 0x3ac25417
call fcn.0040fe33
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jle 0x4269a8
xor ebx, ebx
xor eax, eax
inc ebx
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
jle 0x426988
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x8e0]
call fcn.0040fe4f
cmp dword [eax], 0
jne 0x426a48
dec dword [ebp - 0x2c]
push 0
pop eax
jns 0x426979
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x426966
inc dword [ebp - 0x30]
xor eax, eax
inc eax
cmp dword [ebp - 0x30], eax
jle 0x4268ce
push 2
pop ebx
lea ecx, [ebp - 0x8e0]
call fcn.0040fe33
xor eax, eax
push 4
mov dword [ebp - 8], eax
pop esi
jmp 0x426a8e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x212c], 3
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x426a7d
push 3
lea ecx, [ebp - 0x2b4]
call fcn.0040fd61
mov dword [ebp - 8], 0x394643cd
xor eax, eax
mov dword [ebp - 0x48], 0x9942c3b0
mov dword [ebp - 0xc], 0x46c8c5ce
mov dword [ebp - 0x44], 0xab136113
mov dword [ebp - 0x24], 0x2854
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x426aea
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.0040fe4f
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x426ace
xor eax, eax
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], eax
jl 0x426cdc
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x34], 0xe10a3bdf
mov dword [ebp - 0x1c], 0xc3efc167
mov dword [ebp - 0x20], 0x50e28ab8
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x426b2b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], eax
jl 0x426cd0
xor ebx, ebx
mov dword [ebp - 0xc], 0xbda18461
inc ebx
mov dword [ebp - 0x10], 0xa043
push ebx
lea ecx, [ebp - 0x2b4]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x426b61
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push ebx
lea ecx, [ebp - 0x2b4]
call fcn.0040fe4f
push 2
lea ecx, [ebp - 0x2b4]
call fcn.0040fe4f
push 2
lea ecx, [ebp - 0x2b4]
call fcn.0040fe4f
cmp dword [eax], 0
jg 0x426b8f
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 0xc], eax
jne 0x426ba2
cmp dword [ebp - 0x3c], eax
jne 0x426ba2
mov esi, eax
jmp 0x426baa
xor eax, eax
xor ebx, ebx
inc ebx
lea esi, [eax + 1]
push dword [ebp - 8]
lea ecx, [ebp - 0x2b4]
call fcn.0040fe4f
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
add ecx, esi
cmp ecx, eax
setle dl
imul edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
sub edx, 0xfffffff7
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x213e
setg al
cmp eax, 0xcb8e
jl 0x426bf5
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x426bf7
mov eax, ebx
mov dword [ebp - 0x48], eax
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
setle cl
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0x2b4]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
push dword [ebp - 8]
call fcn.0040fe4f
push dword [ebp - 8]
lea ecx, [ebp - 0x2b4]
call fcn.0040fe4f
mov ecx, dword [ebp - 8]
xor edx, edx
cmp ecx, ebx
lea ecx, [ebp - 0x2b4]
push 2
setl dl
xor ebx, ebx
cmp edx, dword [eax]
setg bl
call fcn.0040fe4f
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x3c]
sub edx, ebx
xor ebx, ebx
cmp edx, ecx
setle bl
sub ebx, dword [eax]
neg ebx
sbb ebx, ebx
inc ebx
cmp ebx, dword [ebp - 0x44]
jge 0x426c6d
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x426c70
xor eax, eax
inc eax
mov ecx, 0xec7f5175
cmp ecx, eax
sbb eax, eax
neg eax
imul eax, eax, 0xe9d3
test eax, eax
jne 0x426c8e
cmp dword [ebp - 0x1c], eax
jne 0x426c8e
mov ecx, eax
jmp 0x426c93
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
push 0xfffffffffffffff8
setl dl
xor ecx, ecx
cmp eax, edx
pop eax
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
imul ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
dec dword [ebp - 0x3c]
jns 0x426b37
push 2
xor eax, eax
pop ebx
dec dword [ebp - 8]
jns 0x426af6
push 4
pop esi
lea ecx, [ebp - 0x2b4]
call fcn.0040fe33
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x4270b5
mov dword [ebp - 0x28], 0xfb0b0297
lea ecx, [ebp - 0x9a0]
mov dword [ebp - 0x3c], 0x78f3c34e
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x2c], 0xd42374b1
mov dword [ebp - 0x44], 0x95674643
push 3
call fcn.0040fd61
mov dword [ebp - 0x30], 8
xor eax, eax
mov dword [ebp - 0xc], 0xe333b8fb
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x426d53
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd38], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x426d3a
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x426d7b
push dword [ebp - 8]
lea ecx, [ebp - 0x9a0]
call fcn.0040fe4f
mov dword [eax], 0x4bd1
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x426d5c
xor eax, eax
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], eax
jl 0x426e67
xor edx, edx
mov esi, 0xe05243b9
inc edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x4fda7ef5
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x1c], 0x7515
mov dword [ebp - 0x10], eax
jmp 0x426dc2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x278], 0x5bfc
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x426db1
mov eax, dword [ebp - 0x28]
sub eax, 3
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0xd34]
test eax, eax
jne 0x426df8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x426df8
mov ecx, eax
jmp 0x426dfd
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp + eax*4 - 0xd38]
mov eax, dword [ebp - 0x3c]
imul edx, ecx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], eax
je 0x426e25
cmp dword [ebp - 0x14], eax
jne 0x426e2f
cmp dword [ebp - 0x2c], eax
jne 0x426e2f
xor edx, edx
inc edx
jmp 0x426e34
xor edx, edx
inc edx
mov eax, edx
dec dword [ebp - 0x278]
cmp esi, eax
mov ecx, dword [ebp - 0x278]
sbb eax, eax
inc eax
add eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
cmp ecx, eax
je 0x426e53
cmp dword [ebp - 0xd30], eax
je 0x426e89
push eax
lea ecx, [ebp - 0x9a0]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x426e87
xor eax, eax
lea esi, [eax + 1]
jmp 0x426e8b
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x9a0]
call fcn.0040fe4f
mov eax, dword [eax]
sub eax, 0x4bd4
cmp esi, eax
je 0x426ea5
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xd34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x426f53
mov dword [ebp - 0x30], 0x12
cmp dword [ebp - 0x30], 0x33
jne 0x426f2a
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x426f1e
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x1c0e
push 0x1abe
push 0xee
call ebx
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0xa84
push 0xf4e
push 0xd32
push 0x2eb
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x33
je 0x426ed2
push 2
pop ebx
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x426fe4
push eax
push 0x1186
push eax
push 0x1073
push 0xe3a
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x426fe4
mov dword [ebp - 0x2c], 0xfffd
mov dword [ebp - 0x10], eax
jmp 0x426f70
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x478], 0x17bb5c02
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jl 0x426f5f
mov dword [ebp - 0x14], 0x18
jmp 0x426f94
lea ecx, [ebp - 0x9a0]
call fcn.0040fe33
mov dword [ebp - 0x48], 0xffffffff
xor eax, eax
mov dword [ebp - 0x28], 0x8cff0ea7
push 4
mov dword [ebp - 0x10], eax
pop esi
cmp dword [ebp - 0x10], esi
jge 0x427022
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1dfc], 0x99d94b4b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x42700a
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x427034
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jle 0x426cf1
lea ecx, [ebp - 0x1644]
call fcn.0040fe33
mov dword [ebp - 0x24], 0x2eb90da1
lea ecx, [ebp - 0x149c]
push 3
mov dword [ebp - 0x24], 9
xor eax, eax
pop ebx
mov dword [ebp - 0x24], 0x4c3c69ae
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x72226312
push ebx
call fcn.0040fd61
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jge 0x427124
push dword [ebp - 8]
lea ecx, [ebp - 0x149c]
call fcn.0040fe4f
mov dword [eax], 0xfffffffb
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x427106
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jge 0x427144
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x18d0], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42712c
xor eax, eax
dec dword [ebp - 0x18c8]
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x427161
push 0x20
push 0x234a
push 0x2525
call edi
lea ecx, [ebp - 0x149c]
call fcn.0040fe33
xor esi, esi
lea ecx, [ebp - 0xacc]
inc esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x48], 0xfc4f27d2
mov dword [ebp - 0x34], 0xffffffff
push 4
call fcn.0040fd61
push 4
pop ecx
mov dword [ebp - 0x1c], ecx
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x4271b9
push dword [ebp - 0x10]
lea ecx, [ebp - 0xacc]
call fcn.0040fe4f
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x4271a0
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0xacc]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
push ebx
call fcn.0040fe4f
mov eax, dword [ebp - 0xc]
sub eax, 0x9562
sub eax, dword [ebp - 0x48]
neg eax
push 3
sbb eax, eax
inc eax
cmp eax, esi
mov eax, dword [ebp - 0xc]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0xacc]
setg bl
call fcn.0040fe4f
xor ecx, ecx
test ebx, ebx
setne cl
mov dword [eax], ebx
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
cmp eax, ecx
jl 0x427211
mov eax, esi
jmp 0x427213
xor eax, eax
cmp dword [ebp - 0xc], eax
jle 0x42722a
push 3
lea ecx, [ebp - 0xacc]
call fcn.0040fe4f
cmp dword [eax], 0
je 0x427239
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x42723b
xor esi, esi
lea edx, [eax + 1]
inc esi
jmp 0x42723d
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
sete cl
xor edx, edx
cmp ecx, 0x8be
setl dl
sub eax, edx
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x427272
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
lea ecx, [ebp - 0xacc]
call fcn.0040fe33
push 3
lea ecx, [ebp - 0x88c]
call fcn.0040fd61
push 2
pop ebx
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], eax
jmp 0x4272a8
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0x88c]
jl 0x427297