Function at 0x42f0be
Capabilities:
Allocate thread local storage
Create pipe
Create process on windows
Enumerate gui resources
Get disk information
Get graphical window text
Get memory capacity
Modify service
Query or enumerate registry key
Read .ini file
Resume thread
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x26a8
call fcn.004a87d0
push ebx
xor eax, eax
mov dword [ebp - 0x28], 0xc03342eb
push esi
mov byte [ebp - 0x35], al
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov byte [ebp - 0x69], dl
mov dword [ebp - 0x60], ecx
cmp byte [ebp - 0x35], al
je 0x42f0f0
push eax
call edi
xor eax, eax
push 3
pop esi
push 1
mov dword [ebp - 0x28], eax
pop ebx
jmp 0x42f241
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0xe18], ecx
mov dword [ebp - 0xe14], ecx
mov dword [ebp - 0xe10], ecx
mov dword [ebp - 0xe0c], ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x42f13d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2258], 0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x42f125
xor eax, eax
mov dword [ebp - 0x14], 9
jmp 0x42f166
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x42f163
push eax
push 0x1965
push eax
push 0x11d1
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe2
je 0x42f146
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x42f23e
push 2
lea ecx, [ebp - 0xb00]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x40], 0xd1d9d65f
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x42f1b6
push dword [ebp - 0xc]
lea ecx, [ebp - 0xb00]
call fcn.004134d9
mov dword [eax], 0xa5f27a41
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x42f197
xor eax, eax
cmp dword [ebp - 0xe14], eax
je 0x42f1d9
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xb00]
mov eax, dword [ebp - 0x14]
push ebx
call fcn.004134d9
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xe0c]
mov eax, dword [ebp - 0xe10]
lea ecx, [ebp - 0xb00]
push ebx
call fcn.004134d9
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xb00]
xor eax, eax
push eax
call fcn.004134d9
mov dword [eax], ebx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x2254], ebx
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x42f228
push eax
push eax
push 0x1250
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea ecx, [ebp - 0xb00]
call fcn.004134bd
dec dword [ebp - 0x14]
jns 0x42f178
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x12
mov ecx, 0x22263126
jne 0x42f0fe
mov dword [ebp - 0x34], 9
lea ecx, [ebp - 0x1400]
push 2
call fcn.004133eb
push esi
lea ecx, [ebp - 0x1138]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x42f29d
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1400]
call fcn.004134d9
mov dword [eax], 0x14c405b4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x42f27e
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x42f2c3
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1138]
call fcn.004134d9
mov dword [eax], 0xdcba
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x42f2a5
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x42f2e1
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x42f389
push eax
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x42f389
mov dword [ebp - 0x48], 0x61f66568
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x42f316
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2d0], ebx
xor eax, eax
inc dword [ebp - 0xc]
inc eax
push eax
pop ebx
cmp dword [ebp - 0xc], eax
jl 0x42f2fa
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x1138]
call fcn.004134d9
inc dword [eax]
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ebp - 0x2d0], eax
je 0x42f353
cmp dword [ebp - 0x48], eax
je 0x42f34b
push ebx
lea ecx, [ebp - 0x1400]
call fcn.004134d9
cmp dword [eax], 0
jne 0x42f34b
xor eax, eax
jmp 0x42f34d
mov eax, ebx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1138]
mov eax, dword [ebp - 0x48]
xor eax, eax
push eax
call fcn.004134d9
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2d0]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setl dl
mov dword [ebp - 0x2d0], edx
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x1138]
call fcn.004134bd
lea ecx, [ebp - 0x1400]
call fcn.004134bd
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x170]
push esi
call fcn.004133eb
mov dword [ebp - 0x34], 0xd7d2
lea ecx, [ebp - 0xc60]
mov dword [ebp - 0x44], 0xfffffffe
push ebx
call fcn.004133eb
mov dword [ebp - 0x44], 0x21c760fc
xor eax, eax
mov dword [ebp - 0x44], 0xd777
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jge 0x42f401
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x170]
call fcn.004134d9
mov dword [eax], 0x5934215e
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x42f3e3
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x42f423
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xaac], 0x69376522
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jl 0x42f40a
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x42f43f
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xc60]
call fcn.004134d9
mov dword [eax], 0xae5685e9
inc dword [ebp - 0x3c]
xor eax, eax
inc eax
cmp dword [ebp - 0x3c], eax
jl 0x42f428
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x170]
xor eax, eax
push eax
call fcn.004134d9
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x170]
xor eax, eax
push eax
call fcn.004134d9
mov esi, eax
lea ecx, [ebp - 0x170]
xor eax, eax
push eax
call fcn.004134d9
mov esi, dword [esi]
lea ecx, [ebp - 0x170]
sub esi, dword [eax]
xor eax, eax
push eax
call fcn.004134d9
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp esi, ecx
sete dl
sub edx, dword [eax]
neg edx
sbb edx, edx
xor eax, eax
inc edx
dec edx
je 0x42f4ab
cmp dword [ebp - 0x34], eax
je 0x42f4ab
lea esi, [eax + 1]
jmp 0x42f4ad
mov esi, eax
push 2
lea ecx, [ebp - 0x170]
call fcn.004134d9
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
cmp esi, ecx
lea ecx, [ebp - 0x170]
push 2
setne bl
add ebx, dword [eax]
neg ebx
mov dword [ebp - 0xaac], ebx
call fcn.004134d9
xor ecx, ecx
cmp ebx, 0xfffffffa
setle cl
neg ecx
cmp ecx, dword [eax]
jl 0x42f4ef
mov eax, dword [ebp - 0xaac]
mov eax, dword [ebp - 0xaac]
lea ecx, [ebp - 0xc60]
mov dword [ebp - 0x44], eax
xor eax, eax
push eax
call fcn.004134d9
mov edx, dword [ebp - 0x44]
mov esi, eax
mov ecx, dword [ebp - 0x18]
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0xc60]
setge al
sub eax, dword [esi]
mov dword [ebp - 0x44], eax
xor eax, eax
push eax
call fcn.004134d9
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0xc60]
sub esi, dword [eax]
xor eax, eax
push eax
call fcn.004134d9
xor ecx, ecx
cmp esi, dword [eax]
setl cl
xor eax, eax
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x170]
push eax
call fcn.004134d9
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
cmp dword [eax], ecx
lea ecx, [ebp - 0x170]
setne bl
xor eax, eax
push eax
call fcn.004134d9
lea ecx, [ebp - 0x170]
mov eax, dword [eax]
imul eax, ebx
imul esi, eax, 0x6ea1
xor eax, eax
push eax
call fcn.004134d9
xor ebx, ebx
lea ecx, [ebp - 0x170]
cmp esi, dword [eax]
setne bl
xor eax, eax
inc eax
push eax
call fcn.004134d9
lea ecx, [ebp - 0x170]
sub ebx, dword [eax]
xor eax, eax
push eax
call fcn.004134d9
lea ecx, [ebp - 0xc60]
mov dword [eax], ebx
call fcn.004134bd
lea ecx, [ebp - 0x170]
call fcn.004134bd
xor eax, eax
inc eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], eax
mov eax, 0x31c587c7
mov dword [ebp - 0x17dc], eax
mov dword [ebp - 0x17d8], eax
mov dword [ebp - 0x17d4], eax
mov dword [ebp - 0x17d0], eax
mov dword [ebp - 0x44], 0x42ff18c9
push 2
mov dword [ebp - 0x44], 0xf4cc511e
mov dword [ebp - 0x40], 0x637b3047
pop esi
push esi
lea ecx, [ebp - 0x1658]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x42f63c
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1658]
call fcn.004134d9
mov dword [eax], 0xf6082f4e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x42f625
mov eax, dword [ebp - 0x424]
xor edx, edx
mov ecx, dword [ebp - 0x420]
mov eax, dword [ebp - 0x420]
cmp ecx, eax
mov ecx, dword [ebp - 0x420]
setle dl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x17d0], ecx
mov eax, dword [ebp - 0x428]
cmp ecx, eax
mov eax, dword [ebp - 0x420]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x420]
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x420]
mov eax, dword [ebp - 0x42c]
sub ecx, 0x4df8
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 0x10000
cmp ecx, eax
lea ecx, [ebp - 0x1658]
setg dl
xor ebx, ebx
mov dword [ebp - 0x44], edx
inc ebx
mov eax, dword [ebp - 0x420]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
push ebx
call fcn.004134d9
and dword [eax], 0
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x42f6f3
push 0x13f6
push eax
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
lea ecx, [ebp - 0x1658]
call fcn.004134bd
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], eax
jmp 0x42f887
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x4c], 0x1871
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x42f733
push eax
push eax
push 0x2202
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
mov dword [ebp - 0x30], 0x18
jmp 0x42f87a
mov dword [ebp - 0x18], 0xb5a5efa2
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x42f769
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x840], 0xc9f3690f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x42f751
xor eax, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x42f877
mov dword [ebp - 0x20], 0x94b2ab76
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x42f86e
mov dword [ebp - 0x14], 0xce55459e
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], 0x57bc7756
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x42f865
mov dword [ebp - 0x44], 0x1efdb7b2
xor ecx, ecx
mov dword [ebp - 0x187c], 0xf844ba92
mov dword [ebp - 0x1878], 0xf844ba92
mov dword [ebp - 0x1874], 0xf844ba92
mov dword [ebp - 0x1870], 0xf844ba92
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x840]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x840]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x840]
test eax, eax
mov dword [ebp - 0x44], 0x62d7bc3
setne cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ebx, ebx
cmp edx, eax
setle bl
mov dword [ebp - 0x187c], ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x840]
mov eax, dword [ebp - 0x14]
add eax, ebx
cmp eax, ecx
jg 0x42f848
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x42f84a
lea ecx, [eax + 1]
jmp 0x42f84c
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x30]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x14]
jns 0x42f7a5
xor ebx, ebx
xor eax, eax
inc ebx
dec dword [ebp - 0x20]
jns 0x42f788
dec dword [ebp - 0x18]
jns 0x42f775
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffec
jge 0x42f73f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xf
jle 0x42f70b
mov dword [ebp - 0x1c], 0xfffffffb
lea ecx, [ebp - 0x1150]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], 0xb74a71a6
push 4
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x42f8cd
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1150]
call fcn.004134d9
mov dword [eax], 0xfffffff8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x42f8b6
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
cmp eax, 0x8f59
setge cl
xor eax, eax
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x1150]
push eax
call fcn.004134d9
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x1150]
push 3
pop ebx
sub esi, dword [eax]
push ebx
call fcn.004134d9
mov ecx, dword [ebp - 0x1c]
sub ecx, esi
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x42f952
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x42f94f
push 0x636
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x42f939
lea ecx, [ebp - 0x1150]
call fcn.004134bd
push ebx
lea ecx, [ebp - 0x1180]
call fcn.004133eb
push 4
or eax, 0xffffffff
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x28], eax
pop esi
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x20], 0x13dce9d0
mov dword [ebp - 0x14], 0x951ea66e
push esi
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x42f9ba
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1168], 0x4b25b3b9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x42f9a2
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x42f9cc
push dword [ebp - 0x1c]
call fcn.004134d9
mov dword [eax], esi
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x824]
cmp dword [ebp - 0x1c], esi
jl 0x42f9bf
xor esi, esi
inc esi
push esi
call fcn.004134d9
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
dec dword [eax]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x28], 0x4d4e
jge 0x42fe92
xor eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x42fbc1
xor esi, esi
mov dword [ebp - 0x10], 0xfffffff7
inc esi
lea ecx, [ebp - 0x1418]
push esi
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x42fa58
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1418]
call fcn.004134d9
mov dword [eax], 0x5ca718ba
xor eax, eax
inc dword [ebp - 0xc]
inc eax
cmp dword [ebp - 0xc], eax
jl 0x42fa34
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], eax
jl 0x42fbb3
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x1168], 0
jne 0x42fb09
push dword [ebp - 0x28]
lea ecx, [ebp - 0x824]
call fcn.004134d9
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x824]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x28]
call fcn.004134d9
mov edx, dword [ebp - 0x1164]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [eax]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setne cl
cmp ecx, 0xf833
jle 0x42fac2
mov eax, dword [ebp - 0x30]
push esi
lea ecx, [ebp - 0x824]
call fcn.004134d9
mov edx, dword [ebp - 0x10]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp edx, ecx
setne al
cmp eax, 0x8a83a56c
mov eax, dword [ebp - 0x30]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [esi]
setge dl
cmp edx, 0x89be67e7
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
imul eax, ecx, 0x6221
test eax, eax
je 0x42fb0c
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x42fba7
jmp 0x42fb22
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x42fb38
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1918], 0x9364560f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x42fb27
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1164], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x1168], 0
je 0x42fb57
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x1418]
mov esi, dword [ebp - 0x18]
xor eax, eax
push eax
call fcn.004134d9
lea ecx, [ebp - 0x824]
mov dword [eax], esi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1914]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x28]
call fcn.004134d9
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, dword [eax]
setle dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x42fb20
dec dword [ebp - 0x28]
push 1
pop esi
jns 0x42fa68
lea ecx, [ebp - 0x1418]
call fcn.004134bd
dec dword [ebp - 0x14]
or eax, 0xffffffff
cmp dword [ebp - 0x14], eax
je 0x42fa14
xor esi, esi
inc esi
lea ecx, [ebp - 0x824]
call fcn.004134bd
push 3
lea ecx, [ebp - 0x28c]
call fcn.004133eb
mov dword [ebp - 0x44], 0xffff
xor edx, edx
mov dword [ebp - 0x10], 0x1e814b73
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x40], 0x9acf2579
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
setl dl
xor ecx, ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, 0xfffffff8
setg cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x18
jle 0x42fc4d
or esi, 0xffffffff
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x18
jg 0x42fc30
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x40], 0x3638ecf5
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x42fc79
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2198], 0xaed23b61
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x42fc60
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x42fc93
push eax
push 0x2234
push 0x401
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2190], eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
push 5
pop ecx
jge 0x42fcbf
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x23c4], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x42fcaa
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x42fcd1
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x42fce0
push eax
push eax
call ebx
xor eax, eax
push 3
mov dword [ebp - 0x28], eax
pop ebx
cmp dword [ebp - 0x28], ebx
jge 0x42fd09
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1180]
call fcn.004134d9
mov dword [eax], 0xcff0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x42fceb
xor eax, eax
mov dword [ebp - 0x1c], 0x9e3c
mov dword [ebp - 0x44], 0xa0b59785
mov dword [ebp - 0x44], 0x69b42c51
mov dword [ebp - 0x34], 0xb2f67ab
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x42fd59
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc00], 0
xor eax, eax
inc dword [ebp - 0xc]
inc eax
cmp dword [ebp - 0xc], eax
jl 0x42fd3b
xor esi, esi
xor eax, eax
inc esi
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x42fd69
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
push 6
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
add ecx, 2
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc00], eax
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
imul eax, eax, 6
pop ecx
push 5
sub eax, ecx
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x42fe23
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28c]
call fcn.004134d9
mov dword [eax], 0xd1e1e87d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x42fe05
xor eax, eax
mov dword [ebp - 0x28], 0xc03342eb
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x42fe38
push eax
call edi
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x12
je 0x42ffc7
mov edi, 0x22263126
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0xdd8], edi
mov dword [ebp - 0xdd4], edi
mov dword [ebp - 0xdd0], edi
mov dword [ebp - 0xdcc], edi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x42fe89
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2318], 0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x42fe71
xor eax, eax
mov dword [ebp - 0x14], 9
jmp 0x42fee2
mov dword [ebp - 0x20], 7
cmp dword [ebp - 0x20], 0xfffffff3
jne 0x42fbd0
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x42feb4
push eax
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff3
je 0x42fea5
jmp 0x42fbd0
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x42fedf
push eax
push 0x1965
push eax
push 0x11d1
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe2
je 0x42fec2
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x42ffba
push 2
lea ecx, [ebp - 0xb18]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x40], 0xd1d9d65f
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x42ff32
push dword [ebp - 0xc]
lea ecx, [ebp - 0xb18]
call fcn.004134d9
mov dword [eax], 0xa5f27a41
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x42ff13
xor eax, eax
cmp dword [ebp - 0xdd4], eax
je 0x42ff55
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xb18]
mov eax, dword [ebp - 0x14]
push esi
call fcn.004134d9
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xdcc]
mov eax, dword [ebp - 0xdd0]
lea ecx, [ebp - 0xb18]
push esi
call fcn.004134d9
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xb18]
xor eax, eax
push eax
call fcn.004134d9
mov dword [eax], esi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x2314], esi
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x42ffa4
push eax
push eax
push 0x1250
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea ecx, [ebp - 0xb18]
call fcn.004134bd
dec dword [ebp - 0x14]
jns 0x42fef4
xor eax, eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x12
jne 0x42fe4a
push eax
lea ecx, [ebp - 0x28c]
call fcn.004134d9
lea ecx, [ebp - 0x28c]
and dword [eax], 0
xor eax, eax
push eax
call fcn.004134d9
push 2
pop edi
cmp dword [eax], edi
jg 0x430ac3
mov dword [ebp - 0x24], 0xfffffffa
lea ecx, [ebp - 0x1dbc]
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x24], 0xf34fda0e
mov dword [ebp - 0x24], 0xfe77dd68
mov dword [ebp - 0x24], ebx
push ebx
call fcn.004133eb
mov dword [ebp - 0x24], 0xaf7f
lea ecx, [ebp - 0x1958]
xor eax, eax
mov dword [ebp - 0x44], 0x1e28
mov dword [ebp - 0x24], eax
or eax, 0xffffffff
mov dword [ebp - 0x24], eax
push esi
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x48], 0xbc98072f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x43006e
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1dbc]
call fcn.004134d9
mov dword [eax], 0xef6b8f3d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x430050
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x430084
push dword [ebp - 0x28]
call fcn.004134d9
mov dword [eax], 0x4a219909
inc dword [ebp - 0x28]
xor eax, eax
lea ecx, [ebp - 0x1958]
inc eax
cmp dword [ebp - 0x28], eax
jl 0x430073
dec dword [ebp - 0x44]
dec dword [ebp - 0x48]
call fcn.004134bd
lea ecx, [ebp - 0x1dbc]
call fcn.004134bd
mov dword [ebp - 0x3c], 7
or eax, 0xffffffff
mov dword [ebp - 0x1c], 0x9e3c
xor ebx, ebx
mov dword [ebp - 0x44], 0xa0b59785
inc ebx
mov dword [ebp - 0x44], 0x69b42c51
mov dword [ebp - 0x34], 0xb2f67ab
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x430103
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa94], 0
xor eax, eax
inc dword [ebp - 0xc]
inc eax
cmp dword [ebp - 0xc], eax
jl 0x4300e5
xor ebx, ebx
xor eax, eax
inc ebx
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x430113
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
push 6
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
add ecx, edi
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xa94], eax
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
imul eax, eax, 6
pop ecx
push 5
sub eax, ecx
pop ecx
cmp ecx, eax
lea ecx, [ebp - 0x1670]
push edi
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], 0xc70ab227
mov dword [ebp - 0x44], 0xfffffffd
call fcn.004133eb
movdqa xmm0, xmmword [0xaa48e0]
lea eax, [ebp - 0x1e10]
push eax
lea eax, [ebp - 0x1e20]
push eax
lea ecx, [ebp - 0x2374]
movdqu xmmword [ebp - 0x1e20], xmm0
call fcn.004134eb
lea ecx, [ebp - 0x381]
mov esi, eax
call fcn.004134e8
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xd08]
push dword [esi]
call fcn.00413497
mov dword [ebp - 0x20], 0x184c506d
xor eax, eax
push 3
mov dword [ebp - 0x40], eax
pop edi
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], eax
jl 0x4302c9
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jg 0x4302c0
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd08]
call fcn.004134d9
cmp dword [eax], 0
jne 0x43026b
xor eax, eax
lea ecx, [ebp - 0xd08]
push eax
call fcn.004134d9
push edi
lea ecx, [ebp - 0xd08]
call fcn.004134d9
cmp dword [eax], 0xffffffff
jl 0x43026b
xor eax, eax
mov edx, eax
jmp 0x430273
xor eax, eax
xor ebx, ebx
inc ebx
lea edx, [eax + 1]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0x8659
je 0x43029c
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd08]
call fcn.004134d9
cmp dword [eax], 0
jne 0x43029c
xor eax, eax
jmp 0x43029e
mov eax, ebx
mov dword [ebp - 0x40], eax
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x4302b2
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x430233
xor eax, eax
dec dword [ebp - 0x20]
jns 0x430220
lea ecx, [ebp - 0xd08]
call fcn.004134bd
push 6
mov dword [ebp - 0x14], 0xa61928c1
lea ecx, [ebp - 0x1778]
pop eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], 0x7e3b6f9b
mov dword [ebp - 0x2c], 0xd816f93b
mov dword [ebp - 0x44], 2
push ebx
call fcn.004133eb
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], 0x4763523e
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x430341
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1778]
call fcn.004134d9
push 5
pop edx
mov dword [eax], edx
xor eax, eax
inc dword [ebp - 0xc]
inc eax
cmp dword [ebp - 0xc], eax
jl 0x430319
xor ebx, ebx
xor eax, eax
inc ebx
or ecx, 0xffffffff
jmp 0x430344
push 5
pop edx
mov dword [ebp - 0x14], 0xc
jmp 0x4304ac
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], 0xbfc3938d
mov dword [ebp - 0x24], 0xfc657863
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0x30385d06
mov dword [ebp - 0x48], 0x1defcecb
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x4303a5
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x5f4], 0xfffa
xor eax, eax
inc dword [ebp - 0xc]
inc eax
cmp dword [ebp - 0xc], eax
jl 0x43038a
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x4304a6
mov dword [ebp - 0x10], 0x845d811f
mov ecx, 0x70e7ad53
mov dword [ebp - 0x12c8], ecx
mov dword [ebp - 0x12c4], ecx
mov dword [ebp - 0x12c0], ecx
mov dword [ebp - 0x12bc], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x4303ed
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x4303dd
cmp dword [ebp - 0x5f4], eax
jne 0x430479
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x12c0]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x20], eax
jne 0x43045e
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x430460
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x5f4]
setge dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x12c0]
jne 0x430469
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x430469
mov ecx, eax
jmp 0x43046e
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x43041a
mov ecx, eax
jmp 0x43041f
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x4c]
add eax, ecx
jne 0x430479
mov esi, eax
jmp 0x43047e
xor eax, eax
lea esi, [eax + 1]
push eax
lea ecx, [ebp - 0x1778]
call fcn.004134d9
mov ecx, dword [ebp - 0x48]
imul ecx, esi
mov dword [eax], ecx
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x4303b1
push 5
or ecx, 0xffffffff
pop edx
inc dword [ebp - 0x14]
push 1
pop ebx
cmp dword [ebp - 0x14], 0x11
jl 0x430350
lea ecx, [ebp - 0x1778]
call fcn.004134bd
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x4304e8
xor esi, esi
inc esi
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1670]
call fcn.004134d9
mov dword [eax], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4304cf
mov dword [ebp - 0x24], 0xfffffffa
lea ecx, [ebp - 0x1cd0]
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x24], 0xf34fda0e
mov dword [ebp - 0x24], 0xfe77dd68
mov dword [ebp - 0x24], edi
push edi
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x24], 0xaf7f
mov dword [ebp - 0x44], 0x1e28
lea ecx, [ebp - 0x1970]
mov dword [ebp - 0x24], eax
or eax, 0xffffffff
mov dword [ebp - 0x24], eax
xor eax, eax
inc eax
push eax
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x48], 0xbc98072f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x43056a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1cd0]
call fcn.004134d9
mov dword [eax], 0xef6b8f3d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x43054c
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x430580
push dword [ebp - 0x28]
call fcn.004134d9
mov dword [eax], 0x4a219909
inc dword [ebp - 0x28]
xor eax, eax
lea ecx, [ebp - 0x1970]
inc eax
cmp dword [ebp - 0x28], eax
jl 0x43056f
dec dword [ebp - 0x44]
dec dword [ebp - 0x48]
call fcn.004134bd
lea ecx, [ebp - 0x1cd0]
call fcn.004134bd
xor eax, eax
lea ecx, [ebp - 0x28c]
push eax
call fcn.004134d9
lea ecx, [ebp - 0x1180]
push dword [eax]
call fcn.004134d9
xor eax, eax
cmp dword [ebp - 0x3c], eax
jne 0x4305ea
push eax
lea ecx, [ebp - 0x28c]
call fcn.004134d9
lea ecx, [ebp - 0x1180]
push dword [eax]
call fcn.004134d9
cmp dword [eax], 0
jne 0x4305ea
xor eax, eax
mov edi, eax
jmp 0x4305ef
xor eax, eax
lea edi, [eax + 1]
push eax
lea ecx, [ebp - 0x28c]
call fcn.004134d9
mov ecx, dword [ebp - 0x3c]
lea edx, [edi - 1]
mov esi, eax
xor eax, eax
cmp edx, ecx
setge al
xor edi, edi
inc edi
cmp edi, eax
sbb ecx, ecx
neg ecx
sub ecx, dword [esi]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x28c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
xor eax, eax
push eax
call fcn.004134d9
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x28c]
setge dl
xor eax, eax
mov dword [ebp - 0x44], edx
push eax
call fcn.004134d9
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x1670]
setle bl
xor eax, eax
push eax
call fcn.004134d9
push edi
lea ecx, [ebp - 0x1430]
mov dword [eax], ebx
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edi
jge 0x430698
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1430]
call fcn.004134d9
or dword [eax], 0xffffffff
xor eax, eax
inc dword [ebp - 0xc]
inc eax
cmp dword [ebp - 0xc], eax
jl 0x430677
xor edi, edi
xor eax, eax
inc edi
push eax
lea ecx, [ebp - 0x1430]
call fcn.004134d9
and dword [eax], 0
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x4306c3
push eax
push eax
push eax
push eax
push eax
push eax
push 0xe1b
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x1430]
call fcn.004134bd
mov dword [ebp - 0x1c], 0xa61928c1
xor eax, eax
push 8
pop ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x4306f6
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 3
mov dword [ebp - 0x1c], ebx
pop ebx
cmp dword [ebp - 0x1c], 0xffffffe9
jne 0x4307f8
push ebx
lea ecx, [ebp - 0xb30]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x43073d
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb30]
call fcn.004134d9
mov dword [eax], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x430723
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x43075d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x21b0], 0x9281c1d9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x430745
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x430765
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xb30]
xor eax, eax
push eax
call fcn.004134d9
xor eax, eax
lea ecx, [ebp - 0xb30]
push eax
call fcn.004134d9
mov ecx, dword [ebp - 0x44]
sub ecx, dword [eax]
mov dword [ebp - 0x40], ecx
jne 0x430799
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x43079b
mov esi, eax
jmp 0x43079d
xor eax, eax
mov esi, edi
push eax
lea ecx, [ebp - 0xb30]
call fcn.004134d9
xor ecx, ecx
cmp esi, 0xfffffffb
setge cl
cmp ecx, 0xdb5cabfc
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x21ac], ecx
lea ecx, [ebp - 0xb30]
call fcn.004134bd
dec dword [ebp - 0x1c]
jmp 0x4306fc
xor eax, eax
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 0x35], al
push edi
call fcn.004133eb
mov dword [ebp - 0x44], 0xfffffffd
xor eax, eax
mov dword [ebp - 0x40], 0x36729694
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0xca3691f6
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edi
jge 0x43084c
push dword [ebp - 0xc]
lea ecx, [ebp - 0x4a8]
call fcn.004134d9
mov dword [eax], 0xd5e48d32
xor eax, eax
inc dword [ebp - 0xc]
inc eax
cmp dword [ebp - 0xc], eax
jl 0x43082b
xor eax, eax
push eax
lea ecx, [ebp - 0x4a8]
call fcn.004134d9
lea ecx, [ebp - 0x4a8]
and dword [eax], 0
xor eax, eax
push eax
call fcn.004134d9
push 2
pop edi
cmp dword [eax], 0xe
je 0x430952
mov dword [ebp - 0x18], 0x5f499006
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x4c], 0xb39523dd
mov dword [ebp - 0xc], eax
jmp 0x43089e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1ca4], 0xe0980db9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x43088d
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb edx, edx
neg edx
cmp edx, eax
setne cl
xor eax, eax
mov dword [ebp - 0x1ca0], ecx
lea ecx, [ebp - 0x4a8]
push eax
call fcn.004134d9
lea ecx, [ebp - 0x4a8]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
xor eax, eax
push eax
call fcn.004134d9
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [eax]
sub eax, ecx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x4a8]
setl dl
sub eax, edx
mov dword [ebp - 0x44], eax
xor eax, eax
push eax
call fcn.004134d9
mov edx, dword [ebp - 0x44]
sub edx, 0x5af9f7c8
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [eax]
setne cl
xor eax, eax
cmp ecx, 0xfffffff7
setg al
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x430952
push eax
lea ecx, [ebp - 0x4a8]
call fcn.004134d9
lea ecx, [ebp - 0x4a8]
inc dword [eax]
xor eax, eax
push eax
call fcn.004134d9
jmp 0x43086c
lea ecx, [ebp - 0x4a8]
call fcn.004134bd
cmp byte [ebp - 0x35], 0
je 0x430a8f
mov dword [ebp - 0x28], 0x324ec2e0
mov eax, 0x75761ac7
mov dword [ebp - 0x10], 0x9f6a
mov dword [ebp - 0x44], 0xb7a14055
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4309ad
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2120], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x4309a0
mov dword [ebp - 0x28], 0x11
jmp 0x430a59
xor eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 0xfffd
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x34], eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x4309f4
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x4309ed
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
cmp dword [ebp - 0x28], eax
jne 0x430a63
jmp 0x430a56
xor esi, esi
inc esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x430a18
lea esi, [eax + 1]
jmp 0x430a1a
mov esi, eax
mov dword [ebp - 0x10], 0xca8c
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
sub ecx, esi
sub ecx, dword [ebp - 0x28]
dec ecx
imul ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x430a56
push eax
call dword [sym.imp.COMDLG32.dll_FindTextW]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 7
jne 0x4309bf
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x430a7d
mov dword [ebp - 0x40], 0xfe511bd7
mov dword [ebp - 0x40], edi
inc dword [ebp - 0x2120]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x430a6a
push eax
push 0x1e40
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea ecx, [ebp - 0x1670]
call fcn.004134bd
xor eax, eax
lea ecx, [ebp - 0x28c]
push eax
call fcn.004134d9
lea ecx, [ebp - 0x28c]
inc dword [eax]
xor eax, eax
push eax
call fcn.004134d9
push 1
pop esi
cmp dword [eax], edi
jle 0x42ffef
lea eax, [ebp - 0x1e50]
mov dword [ebp - 0x24], 0x177e
push eax
lea eax, [ebp - 0x1e60]
mov dword [ebp - 0x24], esi
xorps xmm0, xmm0
lea ecx, [ebp - 0x232c]
push eax
movdqu xmmword [ebp - 0x1e60], xmm0
call fcn.004134eb
lea ecx, [ebp - 0x22a]
mov esi, eax
call fcn.004134e8
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x2270]
push dword [esi]
call fcn.00413497
xor eax, eax
mov dword [ebp - 0x24], 0x7909b792
inc eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x430b34
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2578], 0x9b389519
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x430b23
inc dword [ebp - 0x44]
lea ecx, [ebp - 0x2270]
call fcn.004134bd
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x431174
lea eax, [ebp - 0x1fd0]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x1fe0]
push eax
lea ecx, [ebp - 0x24b4]
movdqu xmmword [ebp - 0x1fe0], xmm0
call fcn.004134eb
lea ecx, [ebp - 0x22b]
mov esi, eax
call fcn.004134e8
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x7c4]
push dword [esi]
call fcn.00413497
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x430db6
jmp 0x430ba8
xor eax, eax
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x1c], 7
cmp dword [ebp - 0x44], eax
jne 0x430bc4
cmp dword [ebp - 0x10], eax
jne 0x430bc4
mov ecx, eax
jmp 0x430bc9
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x44]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
je 0x430d3f
xor ebx, ebx
lea ecx, [ebp - 0xc78]
inc ebx
push ebx
call fcn.004133eb
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jge 0x430c24
push dword [ebp - 0xc]
lea ecx, [ebp - 0xc78]
call fcn.004134d9
mov dword [eax], esi
xor eax, eax
inc dword [ebp - 0xc]
inc eax
cmp dword [ebp - 0xc], eax
jl 0x430c07
xor eax, eax
push 3
pop ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x430d32
jmp 0x430c37
xor eax, eax
mov dword [ebp - 0x44], 0xa3205f5a
lea ecx, [ebp - 0xc78]
push eax
mov dword [ebp - 0x40], eax
call fcn.004134d9
cmp dword [eax], 0
jne 0x430c6e
mov dword [ebp - 0x44], 0x37bd
mov eax, dword [ebp - 0x44]
neg eax
jne 0x430c6e
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x7c4]
call fcn.004134d9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x7c4]
call fcn.004134d9
xor ebx, ebx
lea ecx, [ebp - 0xc78]
cmp dword [eax], esi
setne bl
sub ebx, 0xbaf9eb11
neg ebx
sbb ebx, ebx
xor eax, eax
push eax
inc ebx
call fcn.004134d9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x7c4]
mov eax, dword [eax]
imul eax, ebx
xor ebx, ebx
cmp eax, 0x5e1bfeda
setle bl
call fcn.004134d9
xor ecx, ecx
cmp ebx, dword [eax]
setne cl
xor eax, eax
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xc78]
push eax
call fcn.004134d9
mov ecx, dword [ebp - 0x40]
xor ebx, ebx
push dword [ebp - 0x1c]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x7c4]
setg bl
call fcn.004134d9
push dword [ebp - 0x1c]
xor ecx, ecx
cmp dword [eax], ebx
setle cl
cmp ecx, 0x938d10fb
lea ecx, [ebp - 0x7c4]
sbb esi, esi
neg esi
call fcn.004134d9
xor ecx, ecx
cmp esi, dword [eax]
setge cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x430d23
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
dec dword [ebp - 0x1c]
push 0xffffffffffffffff
pop esi
jns 0x430c35
push 3
pop ebx
lea ecx, [ebp - 0xc78]
call fcn.004134bd
jmp 0x430dad
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x430d9d
mov dword [ebp - 0x34], 0xde0d6158
lea ecx, [ebp - 0x7c4]
mov dword [ebp - 0x40], 0x4a788afb
mov esi, dword [ebp - 0x34]
push dword [ebp - 0x10]
call fcn.004134d9
xor edx, edx
mov dword [eax], esi
mov eax, dword [ebp - 0x34]
cmp eax, esi
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x430d96
push 0x1c14
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
dec dword [ebp - 0x1c]
jns 0x430d47
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x430dad
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
dec dword [ebp - 0x10]
jns 0x430ba6
lea ecx, [ebp - 0x7c4]
call fcn.004134bd
mov dword [ebp - 0x2c], 0x1be360de
lea ecx, [ebp - 0x1988]
mov dword [ebp - 0x14], 0xd4e06482
push edi
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edi
jge 0x430e03
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1988]
call fcn.004134d9
mov dword [eax], 0x872d9ee1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x430de5
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1b
je 0x430e38
mov dword [ebp - 0x40], 0xe446df3
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x430e29
push eax
push 0x2545
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1b
push 0
pop eax
jne 0x430e0c
mov dword [ebp - 0x14], eax
jmp 0x430f12
mov dword [ebp - 0x10], 0xdc9ed9ba
lea ecx, [ebp - 0x1448]
push 4
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x430e7e
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1448]
call fcn.004134d9
mov dword [eax], 0xfffffffa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x430e5f
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1d
jle 0x430f04
xor ebx, ebx
inc ebx
push edi
lea ecx, [ebp - 0x978]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x430eaa
push dword [ebp - 0xc]
call fcn.004134d9
mov dword [eax], ebx
inc dword [ebp - 0xc]
lea ecx, [ebp - 0x978]
cmp dword [ebp - 0xc], edi
jl 0x430e9d
push ebx
call fcn.004134d9
and dword [eax], 0
jmp 0x430ee0
push edi
lea ecx, [ebp - 0x1448]
call fcn.004134d9
push ebx
lea ecx, [ebp - 0x978]
mov dword [eax], 0x6c2e7ccc
call fcn.004134d9
inc dword [eax]
push ebx
lea ecx, [ebp - 0x978]
call fcn.004134d9
cmp dword [eax], ebx
jle 0x430ec0
lea ecx, [ebp - 0x978]
call fcn.004134bd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1d
jg 0x430e8a
lea ecx, [ebp - 0x1448]
call fcn.004134bd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x12
jge 0x430e40
lea ecx, [ebp - 0x1988]
call fcn.004134bd
or esi, 0xffffffff
xor eax, eax
xor edi, edi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x28], eax
inc edi
cmp dword [ebp - 0x28], edi
jge 0x430f58
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xccc], 0
xor eax, eax
inc dword [ebp - 0x28]
inc eax
cmp dword [ebp - 0x28], eax
jl 0x430f3a
xor edi, edi
xor eax, eax
inc edi
push 3
mov dword [ebp - 0x28], eax
pop ebx
cmp dword [ebp - 0x28], ebx
jge 0x430f7b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x21c8], 0xfffffffc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x430f63
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x430f91
push 0x7a7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov eax, 0x63185299
mov dword [ebp - 0xccc], eax
mov dword [ebp - 0x21c8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], 0xbaf43b7c
mov dword [ebp - 0x10], 0xa8e97eed
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x1a
jmp 0x430ff2
mov dword [ebp - 0x10], 0xa
cmp dword [ebp - 0x10], 0xffffffeb
jl 0x430fef
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x430fe6
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffeb
jge 0x430fd4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jne 0x430fc5
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x43116e
push 6
pop eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0xb48]
mov eax, 0x9729cf30
mov dword [ebp - 0x181c], eax
mov dword [ebp - 0x1818], eax
mov dword [ebp - 0x1814], eax
mov dword [ebp - 0x1810], eax
mov dword [ebp - 0x44], 0x1eefb6f6
mov dword [ebp - 0x44], 0xe6c8cac3
push 4
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x431071
push dword [ebp - 0xc]
lea ecx, [ebp - 0xb48]
call fcn.004134d9
mov dword [eax], 0x8ed7c3b7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x431052
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x431087
push 0x1eaa
push eax
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xb48]
neg eax
push edi
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
mov esi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
imul esi, eax
call fcn.004134d9
mov ecx, 0x4faf5cab
mov dword [eax], esi
mov dword [ebp - 0x44], esi
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub ecx, eax
je 0x4310db
push edi
lea ecx, [ebp - 0xb48]
call fcn.004134d9
xor ebx, ebx
cmp dword [eax], ebx
je 0x4310db
xor eax, eax
xor edi, edi
inc edi
lea ecx, [eax + 1]
jmp 0x4310e1
xor eax, eax
xor ebx, ebx
mov ecx, eax
mov eax, dword [ebp - 0x28]
sub ecx, eax
je 0x4310ff
push edi
lea ecx, [ebp - 0xb48]
call fcn.004134d9
cmp dword [eax], ebx
je 0x4310ff
xor eax, eax
lea ecx, [eax + 1]
jmp 0x431103
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x1818], eax
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
add ecx, 4
inc eax
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, 0xcc90
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
xor ebx, ebx
add edx, 0x35b263d1
cmp edx, eax
setg bl
xor ecx, ecx
imul ebx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
cmp ebx, eax
setge cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xb48]
call fcn.004134bd
xor eax, eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 3
pop ebx
inc dword [ebp - 0x20]
push 2
pop edi
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jne 0x430b51
lea ecx, [ebp - 0x28c]
call fcn.004134bd
lea ecx, [ebp - 0x1180]
call fcn.004134bd
push 2
pop esi
push esi
lea ecx, [ebp - 0x1d74]
call fcn.004133eb
mov dword [ebp - 0x24], 0xf5f49900
xor eax, eax
mov dword [ebp - 0x10], 0xb4e76ab2
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x4311da
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1d74]
call fcn.004134d9
push 6
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x4311bd
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x4311f0
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x25f0], 0xfffffffb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x4311df
inc dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xb
jmp 0x431212
mov dword [ebp - 0x40], 0x8213af72
mov dword [ebp - 0x40], 0xdb959c45
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x21
jg 0x431201
lea ecx, [ebp - 0x1d74]
call fcn.004134bd
xor edi, edi
lea ecx, [ebp - 0x19a0]
inc edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x14], 0xd4e06482
push esi
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x431264
push dword [ebp - 0xc]
lea ecx, [ebp - 0x19a0]
call fcn.004134d9
mov dword [eax], 0x872d9ee1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x431246
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1b
je 0x431299
mov dword [ebp - 0x40], 0xe446df3
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x43128a
push eax
push 0x2545
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [ebp - 0x40]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1b
push 0
pop eax
jne 0x43126d
mov dword [ebp - 0x14], eax
jmp 0x43136c
mov dword [ebp - 0x10], 0xdc9ed9ba
lea ecx, [ebp - 0x1724]
push 4
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x4312df
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1724]
call fcn.004134d9
mov dword [eax], 0xfffffffa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x4312c0
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x431358
push esi
lea ecx, [ebp - 0x894]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x431304
push dword [ebp - 0xc]
call fcn.004134d9
mov dword [eax], edi
inc dword [ebp - 0xc]
lea ecx, [ebp - 0x894]
cmp dword [ebp - 0xc], esi
jl 0x4312f7
push edi
call fcn.004134d9
and dword [eax], 0
jmp 0x43133a
push esi
lea ecx, [ebp - 0x1724]
call fcn.004134d9
push edi
lea ecx, [ebp - 0x894]
mov dword [eax], 0x6c2e7ccc
call fcn.004134d9
inc dword [eax]
push edi
lea ecx, [ebp - 0x894]
call fcn.004134d9
cmp dword [eax], edi
jle 0x43131a
lea ecx, [ebp - 0x894]
call fcn.004134bd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1d
jg 0x4312e4
lea ecx, [ebp - 0x1724]
call fcn.004134bd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x12
jge 0x4312a1
lea ecx, [ebp - 0x19a0]
call fcn.004134bd
xor eax, eax
mov dword [ebp - 0x24], 0x77862fd4
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x4313ad
push 0x2471
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
xor eax, eax
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x4313bc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1c], 0xfc07e17f
lea ecx, [ebp - 0x4cc]
push esi
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x4313f7
push dword [ebp - 0xc]
lea ecx, [ebp - 0x4cc]
call fcn.004134d9
mov dword [eax], 0x4f01c089
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x4313d9
xor eax, eax
push eax
lea ecx, [ebp - 0x4cc]
call fcn.004134d9
cmp dword [eax], 0
je 0x43144e
mov dword [ebp - 0x18], 0x2159
lea ecx, [ebp - 0x4cc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
push edi
call fcn.004134d9
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x4cc]
setne dl
xor ebx, ebx
cmp edx, 0x2fd2
setge bl
xor eax, eax
push eax
call fcn.004134d9
push 3
mov dword [eax], ebx
pop ebx
jmp 0x4314c1
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jl 0x4314be
xor ebx, ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4cc]
call fcn.004134d9
cmp dword [eax], ebx
jne 0x43149e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4cc]
call fcn.004134d9
cmp dword [eax], ebx
je 0x43149e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4cc]
call fcn.004134d9
cmp dword [eax], ebx
je 0x43149e
xor eax, eax
xor ebx, ebx
mov esi, eax
jmp 0x4314a3
xor eax, eax
lea esi, [eax + 1]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4cc]
call fcn.004134d9
mov dword [eax], esi
dec dword [ebp - 0x10]
jns 0x431460
push 3
pop ebx
push 2
pop esi
xor edi, edi
inc edi
lea ecx, [ebp - 0x4cc]
call fcn.004134bd
push esi
lea ecx, [ebp - 0x5a4]
call fcn.004133eb
mov dword [ebp - 0x34], edi
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x10], 0x7ce5
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x10], eax
je 0x4315da
mov dword [ebp - 0x20], 0xe32cf41
mov dword [ebp - 0x34], 0x5a3d7f19
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x431518
push eax
push 0xc2
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 7
jne 0x4315ec
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x14], 0x1c94
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x431555
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2648], 0x6aed1d25
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x43153c
xor eax, eax
cmp dword [ebp - 0x18], eax
jge 0x431561
cmp dword [ebp - 0x10], eax
je 0x431561
mov eax, edi
imul eax, eax, 0x7fa3
add eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x20]
imul eax, eax, 0xad5b
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xc4c8
jle 0x4315a4
mov dword [ebp - 0x44], 0x551fa4c8
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setne dl
mov dword [ebp - 0x18], edx
inc dword [ebp - 0x44]
xor eax, eax
jmp 0x4315ab
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x4315ea
mov dword [ebp - 0x20], eax
jmp 0x4315c3
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x4315b0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
push 0
pop eax
je 0x431525
jmp 0x4315ea
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x4315ec
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
xor eax, eax
mov dword [ebp - 0x30], 0xfffffff6
lea ecx, [ebp - 0xd60]
mov dword [ebp - 0xc], eax
push ebx
call fcn.004133eb
mov dword [ebp - 0x44], 0x2d34caa8
lea ecx, [ebp - 0x1460]
push 4
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x43163e
push dword [ebp - 0x28]
lea ecx, [ebp - 0xd60]
call fcn.004134d9
mov dword [eax], 0x968939f5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x431620
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x431666
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1460]
call fcn.004134d9
mov dword [eax], 0x15ee56e3
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x431647
xor eax, eax
mov dword [ebp - 0xc], 0x4a8c6a53
lea ecx, [ebp - 0xd60]
push eax
call fcn.004134d9
mov ecx, dword [ebp - 0xc]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0xd60]
setg dl
xor eax, eax
test edx, edx
setle al
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
xor eax, eax
push eax
call fcn.004134d9
xor eax, eax
lea ecx, [ebp - 0xd60]
push eax
call fcn.004134d9
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x1460]
xor eax, eax
push eax
call fcn.004134d9
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, 0xaa810d1d
add ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x1460]
call fcn.004134bd
lea ecx, [ebp - 0xd60]
call fcn.004134bd
mov dword [ebp - 0x40], 0x46c8c5ce
xor eax, eax
mov dword [ebp - 0x24], 0xab136113
mov ecx, esi
mov dword [ebp - 0x44], 0xc3099cfe
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
sub ecx, eax
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], al
je 0x431744
push 0xc0c
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], 0x214c405b
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff0
jne 0x4318fc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x28], 0xe5a9864b
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
push 6
setge dl
xor ecx, ecx
cmp eax, edx
pop eax
setne cl
cmp ecx, eax
jbe 0x431802
mov dword [ebp - 0x48], 7
xor eax, eax
mov dword [ebp - 0x44], 0x1f6f49c2
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x28], eax
jne 0x4317b8
mov eax, dword [ebp - 0x20]
neg eax
jne 0x4317b8
xor eax, eax
mov edx, eax
jmp 0x4317bd
xor eax, eax
lea edx, [eax + 1]
cmp dword [ebp - 0x48], eax
je 0x4317d3
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x14]
je 0x4317d1
xor eax, eax
lea ecx, [eax + 1]
jmp 0x4317d5
xor eax, eax
mov ecx, eax
xor eax, eax
cmp edx, ecx
setne al
xor edx, edx
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
setne dl
xor eax, eax
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x28], eax
jne 0x4318f7
xor edi, edi
inc edi
jmp 0x4318e7
xor eax, eax
mov dword [ebp - 0x40], 0x58cdc14c
mov dword [ebp - 0x20], eax
jmp 0x4318dd
push esi
lea ecx, [ebp - 0x1ce8]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x431844
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1ce8]
call fcn.004134d9
and dword [eax], 0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x431829
xor eax, eax
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], eax
jl 0x4318c5
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x4318c0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edi
jge 0x43187f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xd8], edi
xor eax, eax
inc dword [ebp - 0xc]
inc eax
push eax
pop edi
cmp dword [ebp - 0xc], eax
jl 0x431863
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], edi
jg 0x4318a4
push 5
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], edi
inc dword [ebp - 0xd8]
cmp dword [ebp - 0xd8], edi
jle 0x431890
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
je 0x4318bb
push 0x236a
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x43185b
dec dword [ebp - 0x28]
jns 0x43184c
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x1ce8]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
call fcn.004134bd
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff6
jge 0x431813
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff0
push 0
pop eax
je 0x43175b
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jge 0x431922
push dword [ebp - 0xc]
lea ecx, [ebp - 0x5a4]
call fcn.004134d9
mov dword [eax], 0x23371247
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x431904
xor eax, eax
mov dword [ebp - 0x10], 0x2ee76f50
mov dword [ebp - 0x24], edi
push 4
mov dword [ebp - 0xc], eax
pop ecx
cmp dword [ebp - 0xc], ecx
jge 0x43194f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x24dc], 0xfffffff7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x431937
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ecx
jge 0x43196f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x24dc], 0xf89b5461
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x431957
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x5a4]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.004134d9
lea ecx, [ebp - 0x5a4]
mov dword [eax], 0xfffffffe
xor eax, eax
push eax
call fcn.004134d9
cmp dword [eax], 0
je 0x43199f
mov eax, dword [ebp - 0x1c]
xor eax, eax
lea ecx, [ebp - 0x5a4]
push eax
call fcn.004134d9
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x5a4]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.004134d9
xor ecx, ecx
push esi
cmp dword [eax], ecx
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x58c]
call fcn.004133eb
mov dword [ebp - 0x10], 0xcd89
lea ecx, [ebp - 0x1198]
mov dword [ebp - 0x44], 0x29b05364
push ebx
call fcn.004133eb
mov dword [ebp - 0x48], 0xf08a7cf5
xor eax, eax
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jge 0x431a28
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xac], 0
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x431a10
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], esi
jge 0x431a4e
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x58c]
call fcn.004134d9
mov dword [eax], 0x8f6c218e
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x431a30
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jge 0x431a6e
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x19b8], 0x39b9
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jl 0x431a56
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x431a8a
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1198]
call fcn.004134d9
mov dword [eax], 0xcc76bf08
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jl 0x431a73
mov ecx, dword [ebp - 0xa8]
xor edx, edx
mov eax, dword [ebp - 0xa8]
cmp ecx, eax
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa8]
setl dl
imul ecx, edx
xor edx, edx
push edi
cmp eax, ecx
lea ecx, [ebp - 0x58c]
setge dl
xor eax, eax
cmp edx, 0x81ff
setl al
xor ebx, ebx
cmp eax, 0xd409
setge bl
call fcn.004134d9
mov ecx, dword [ebp - 0xa8]
sub ecx, ebx
push 3
mov dword [eax], ecx
lea ecx, [ebp - 0x1688]
mov dword [ebp - 0x44], 0xed5ebae8
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x431b1a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x74], edi
xor eax, eax
inc dword [ebp - 0x28]
inc eax
push eax
pop edi
cmp dword [ebp - 0x28], eax
jl 0x431b01
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x431b42
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1688]
call fcn.004134d9
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x431b23
push eax
lea ecx, [ebp - 0x58c]
call fcn.004134d9
mov esi, eax
lea ecx, [ebp - 0x58c]
xor eax, eax
push eax
call fcn.004134d9
mov ecx, dword [eax]
mov dword [esi], ecx
test ecx, ecx
je 0x431bf2