Function at 0x422280
Capabilities:
Get common file path
Inspect section memory permissions
Persist via run registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x443f7b
mov eax, dword fs:[0]
push eax
sub esp, 0x9b0
mov eax, dword [0x451050]
xor eax, esp
mov dword [esp + 0x9a8], eax
push ebx
push esi
push edi
mov eax, dword [0x451050]
xor eax, esp
push eax
lea eax, [esp + 0x9c0]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
push 0x20019
xor edi, edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x422307
mov ecx, dword [esp + 0x14]
push eax
push eax
push eax
push eax
push 0x447ce8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4222fc
lea edi, [eax + 1]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, str.WinSnap.ini
lea esi, [esp + 0x60]
call fcn.00403ca0
mov dword [esp + 0x9c8], 0
mov eax, dword [esp + 0x64]
mov esi, 8
cmp dword [esp + 0x78], esi
jae 0x422333
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00406d20
push 0
push str.Version
mov edx, str.General
lea ecx, [esp + 0x4c]
mov byte [esp + 0x9d0], 1
call fcn.00406eb0
mov dword [esp + 0x18], eax
cmp eax, 0x12c
jb 0x4230e2
push 0x74751000
push str.Flags
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406f50
mov dword [0x452498], eax
test edi, edi
jne 0x422395
and dword [0x452498], 0xfffffdff
push 0x80000000
push str.Defaults
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406f50
push 0x20600100
push str.Effects
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x45249c], eax
call fcn.00406f50
push 0x1f4
push str.Delay
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524a0], eax
call fcn.00406eb0
push 0
mov edx, str.ShColor
lea ecx, [esp + 0x48]
mov dword [0x4524a4], eax
call fcn.004071a0
push 0x87
and eax, 0xffffff
push str.ShAngle
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x459f94], eax
call fcn.00406eb0
mov ecx, dword [0x459f88]
and ecx, 0x20000000
or ecx, 0x9fffffff
shr ecx, 0x1d
push ecx
push str.ShDistance
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524b0], eax
call fcn.00406eb0
mov edx, dword [0x459f88]
and edx, 0xefffffff
or edx, 0xcfffffff
shr edx, 0x1c
push edx
push str.ShSize
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524b4], eax
call fcn.00406eb0
mov dword [0x4524b8], eax
mov eax, dword [0x459f88]
and eax, 0x20000000
neg eax
sbb eax, eax
and eax, 5
add eax, 0x3c
push eax
push str.ShOpacity
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406eb0
push 0x50
push str.ReflPixels
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524bc], eax
call fcn.00406eb0
push 0x1e
push str.ReflPercent
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524d0], eax
call fcn.00406eb0
push 0
push str.ReflOffset
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524d4], eax
call fcn.00406eb0
mov dword [0x459f98], eax
push 0x28
push str.ReflOpacity
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406eb0
push 0xff
mov edx, str.OutColor
lea ecx, [esp + 0x48]
mov dword [0x4524d8], eax
call fcn.004071a0
push 2
and eax, 0xffffff
push str.Outline
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524ac], eax
call fcn.00406eb0
push 0xffffff
mov edx, str.BgColor
lea ecx, [esp + 0x48]
mov dword [0x4524c0], eax
call fcn.004071a0
push esi
and eax, 0xffffff
push str.Rotate
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524a8], eax
call fcn.00406eb0
push 0x32
push str.Scale
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524c4], eax
call fcn.00406eb0
push 0xf00140
push str.ScaleFit
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524c8], eax
call fcn.00406f50
push 0x2800
push str.StFlags
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524cc], eax
call fcn.00406f50
push 0x64
push str.StOpacity
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524e4], eax
call fcn.00406eb0
push 0xa0008
push str.StPosition1
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524e8], eax
call fcn.00406f50
push 0xc000c
push str.StPosition2
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524ec], eax
call fcn.00406f50
push str.General
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x4c]
push edx
mov edx, str._WINSNAP_WatermarksWinSnap.png
mov ecx, str.Stamp
mov dword [0x4524f0], eax
call fcn.004075b0
push 0xffffffffffffffff
push 0
mov ecx, 0x458770
mov byte [esp + 0x9d0], 2
call fcn.004038b0
mov byte [esp + 0x9c8], 1
cmp dword [esp + 0x38], esi
jb 0x422678
mov eax, dword [esp + 0x24]
push eax
call fcn.00434772
add esp, 4
push str.General
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x4c]
push edx
mov edx, 0x448a58
mov ecx, str.StText
call fcn.00406da0
push 0xffffffffffffffff
push 0
mov ecx, 0x458818
mov byte [esp + 0x9d0], 3
call fcn.004038b0
mov byte [esp + 0x9c8], 1
cmp dword [esp + 0x38], esi
jb 0x4226c7
mov eax, dword [esp + 0x24]
push eax
call fcn.00434772
add esp, 4
push str.General
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x4c]
push edx
mov edx, str.Arial
mov ecx, str.StTextFont
call fcn.00406da0
push 0xffffffffffffffff
push 0
mov ecx, 0x458834
mov byte [esp + 0x9d0], 4
call fcn.004038b0
mov byte [esp + 0x9c8], 1
cmp dword [esp + 0x38], esi
jb 0x422716
mov eax, dword [esp + 0x24]
push eax
call fcn.00434772
add esp, 4
push 0x1001c
push str.StTextStyle
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406f50
push 0xc0c0c0
push str.StTextColor
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524f8], eax
call fcn.00406f50
push 3
push str.AutoFormat
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524f4], eax
call fcn.00406eb0
push 0x55
push str.AutoFlags
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4524dc], eax
mov dword [0x4524fc], eax
call fcn.00406f50
push str.General
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x4c]
push edx
mov edx, str._WINSNAP_
mov ecx, str.AutoDir
mov dword [0x4524e0], eax
mov dword [0x452500], eax
call fcn.004075b0
push 0xffffffffffffffff
push 0
mov ecx, 0x45878c
mov byte [esp + 0x9d0], 5
call fcn.004038b0
mov byte [esp + 0x9c8], 1
cmp dword [esp + 0x38], esi
jb 0x4227dd
mov eax, dword [esp + 0x24]
push eax
call fcn.00434772
add esp, 4
push 0xffffffffffffffff
push 0
mov eax, 0x45878c
mov ecx, 0x4587e0
call fcn.004038b0
push str.General
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x4c]
push edx
mov edx, str.sshot__NUM_
mov ecx, str.AutoName
call fcn.00406da0
push 0xffffffffffffffff
push 0
mov ecx, 0x4587a8
mov byte [esp + 0x9d0], 6
call fcn.004038b0
mov byte [esp + 0x9c8], 1
cmp dword [esp + 0x38], esi
jb 0x42283f
mov eax, dword [esp + 0x24]
push eax
call fcn.00434772
add esp, 4
push str.General
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x4c]
push edx
mov edx, str.hstart.exe__NOCONSOLE__pngout.exe__q__IMGPATH__
mov ecx, str.RunOnSave
call fcn.00406da0
push 0xffffffffffffffff
push 0
mov ecx, 0x4587fc
mov byte [esp + 0x9d0], 7
call fcn.004038b0
mov byte [esp + 0x9c8], 1
cmp dword [esp + 0x38], esi
jb 0x42288e
mov eax, dword [esp + 0x24]
push eax
call fcn.00434772
add esp, 4
push 0
push str.RcFlags
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406f50
mov dword [0x45a258], eax
mov eax, dword [0x459f8c]
test eax, 0x2000000
je 0x4228c0
or dword [0x45a258], 0x20000000
jmp 0x42290a
test eax, 0x8000000
je 0x4228d1
and dword [0x45a258], 0xdfffffff
push 0
push str.RcPosX
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406eb0
push 0
push str.RcPosY
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x452434], eax
call fcn.00406eb0
mov dword [0x452438], eax
mov eax, dword [0x459f8c]
test eax, 0x1000000
je 0x42291d
or dword [0x45a258], 0x40000000
jmp 0x422962
test eax, 0x4000000
je 0x42292e
and dword [0x45a258], 0xbfffffff
push 0
push str.RcSizeX
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406eb0
push 0
push str.RcSizeY
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x45a24c], eax
call fcn.00406eb0
mov dword [0x45a250], eax
push 0x40000000
push str.ObjFlags
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406f50
xor ecx, ecx
push 0x2c
mov word [0x458400], cx
push str.CurModeHK
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x452484], eax
call fcn.00406f50
xor edx, edx
push 0x42c
and eax, 0xffff
or dword [0x458400], eax
mov word [0x458404], dx
push str.FullScreenHK
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406f50
and eax, 0xffff
or dword [0x458404], eax
push 0x22c
xor eax, eax
push str.ApplicationHK
mov edx, str.General
lea ecx, [esp + 0x4c]
mov word [0x458408], ax
call fcn.00406f50
xor ecx, ecx
push 0x12c
and eax, 0xffff
or dword [0x458408], eax
mov word [0x45840c], cx
push str.WindowHK
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406f50
xor edx, edx
push 0x62c
and eax, 0xffff
or dword [0x45840c], eax
mov word [0x458410], dx
push str.ObjectHK
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406f50
and eax, 0xffff
or dword [0x458410], eax
push 0x32c
xor eax, eax
push str.RegionHK
mov edx, str.General
lea ecx, [esp + 0x4c]
mov word [0x458414], ax
call fcn.00406f50
push 0
and eax, 0xffff
or dword [0x458414], eax
push str.PrintFlags
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406f50
push 0x3e8
push str.PrintMarginLeft
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x45a1ac], eax
call fcn.00406eb0
push 0x3e8
push str.PrintMarginTop
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x452444], eax
call fcn.00406eb0
push 0x3e8
mov dword [0x452448], eax
push str.PrintMarginRight
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406eb0
push 0x3e8
push str.PrintMarginBottom
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x45244c], eax
call fcn.00406eb0
push 0
push str.FlagsCap
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x452450], eax
call fcn.00406f50
push 0
push str.FixLeft
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x45868c], eax
call fcn.00406eb0
push 0
push str.FixTop
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x458690], eax
call fcn.00406eb0
push 0
push str.FixRight
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x458694], eax
call fcn.00406eb0
push 0
push str.FixBottom
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x458698], eax
call fcn.00406eb0
push 0
push str.FixDlgLeft
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x45869c], eax
call fcn.00406eb0
push 0
push str.FixDlgTop
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4586a0], eax
call fcn.00406eb0
push 0
push str.FixDlgRight
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4586a4], eax
call fcn.00406eb0
push 0
push str.FixDlgBottom
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4586a8], eax
call fcn.00406eb0
mov ecx, dword [0x459f88]
and ecx, 0x40000000
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, esi
push ecx
push str.FixRoundX
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4586ac], eax
call fcn.00406eb0
mov edx, dword [0x459f88]
shr edx, 0x1d
and edx, 2
or edx, 9
push edx
mov dword [0x4586b0], eax
push str.FixRoundY
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406eb0
push 0
push str.AdvTemplate
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x4586b4], eax
call fcn.00406eb0
push 0
push str.ConfigPage
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x45a2f8], eax
call fcn.00406eb0
test dword [0x452498], 0x40000
mov dword [0x4523bc], eax
je 0x422d0a
cmp dword [0x459fa8], 0
je 0x422ca2
cmp dword [0x459fac], 0
jne 0x422d0a
push 0xffffffffffffffff
push str.MainPosX
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406eb0
push 0xffffffffffffffff
push str.MainPosY
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x45250c], eax
call fcn.00406eb0
push 0
push str.MainWidth
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x452510], eax
call fcn.00406eb0
push 0
push str.MainHeight
mov edx, str.General
lea ecx, [esp + 0x4c]
mov dword [0x459fa8], eax
call fcn.00406eb0
mov dword [0x459fac], eax
push 0x50001
push str.MainActions
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406f50
push 6
mov dword [0x45251c], eax
call dword [sym.imp.USER32.dll_GetDialogBaseUnits]
movzx eax, ax
push eax
push 0x80
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
push str.PaneWidth
mov edx, str.General
lea ecx, [esp + 0x4c]
call fcn.00406eb0
mov dword [0x459fb8], eax
call fcn.00425160
lea eax, [esp + 0x7c]
call fcn.004242b0
push 0
push str.Count
mov edx, str.Tools
lea ecx, [esp + 0x4c]
mov byte [esp + 0x9d0], 8
call fcn.00406eb0
mov edi, eax
xor esi, esi
mov eax, edi
cmp edi, 0x14
jb 0x422d92
mov eax, 0x14
cmp esi, eax
jae 0x4240c9
push esi
push str.Title_u
mov ecx, 0x40
lea ebx, [esp + 0x13c]
call fcn.00401250
add esp, 8
push str.Tools
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x4c]
push edx
mov edx, 0x447354
mov ecx, ebx
call fcn.00406da0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x90]
mov byte [esp + 0x9d0], 9
call fcn.004038b0
mov eax, 8
mov byte [esp + 0x9c8], al
cmp dword [esp + 0x38], eax
jb 0x422e06
mov eax, dword [esp + 0x24]
push eax
call fcn.00434772
add esp, 4
push esi
push str.ExePath_u
mov ecx, 0x40
lea ebx, [esp + 0x13c]
call fcn.00401250
add esp, 8
push str.Tools
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x4c]
push edx
mov edx, 0x447354
mov ecx, ebx
call fcn.004075b0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xac]
mov byte [esp + 0x9d0], 0xa
call fcn.004038b0
mov eax, 8
mov byte [esp + 0x9c8], al
cmp dword [esp + 0x38], eax
jb 0x422e72
mov eax, dword [esp + 0x24]
push eax
call fcn.00434772
add esp, 4
push esi
push str.Param_u
mov ecx, 0x40
lea ebx, [esp + 0x13c]
call fcn.00401250
add esp, 8
push str.Tools
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x4c]
push edx
mov edx, 0x447354
mov ecx, ebx
call fcn.00406da0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xc8]
mov byte [esp + 0x9d0], 0xb
call fcn.004038b0
mov eax, 8
mov byte [esp + 0x9c8], al
cmp dword [esp + 0x38], eax
jb 0x422ede
mov eax, dword [esp + 0x24]
push eax
call fcn.00434772
add esp, 4
push esi
push str.Icon_u
mov ecx, 0x40
lea ebx, [esp + 0x13c]
call fcn.00401250
add esp, 8
push str.Tools
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x4c]
push edx
mov edx, 0x447354
mov ecx, ebx
call fcn.004075b0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xe4]
mov byte [esp + 0x9d0], 0xc
call fcn.004038b0
mov eax, 8
mov byte [esp + 0x9c8], al
cmp dword [esp + 0x38], eax
jb 0x422f4a
mov eax, dword [esp + 0x24]
push eax
call fcn.00434772
add esp, 4
push esi
push str.SaveDir_u
mov ecx, 0x40
lea ebx, [esp + 0x13c]
call fcn.00401250
add esp, 8
push str.Tools
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x4c]
push edx
mov edx, 0x447354
mov ecx, ebx
call fcn.004075b0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x100]
mov byte [esp + 0x9d0], 0xd
call fcn.004038b0
mov eax, 8
mov byte [esp + 0x9c8], al
cmp dword [esp + 0x38], eax
jb 0x422fb6
mov eax, dword [esp + 0x24]
push eax
call fcn.00434772
add esp, 4
push esi
push str.SaveName_u
mov ecx, 0x40
lea ebx, [esp + 0x13c]
call fcn.00401250
add esp, 8
push str.Tools
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x4c]
push edx
mov edx, 0x447354
mov ecx, ebx
call fcn.00406da0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x11c]
mov byte [esp + 0x9d0], 0xe
call fcn.004038b0
mov eax, 8
mov byte [esp + 0x9c8], al
cmp dword [esp + 0x38], eax
jb 0x423022
mov eax, dword [esp + 0x24]
push eax
call fcn.00434772
add esp, 4
push esi
push str.SaveFormat_u
mov ecx, 0x40
lea ebx, [esp + 0x13c]
call fcn.00401250
add esp, 8
push 0
mov ecx, ebx
push ecx
mov edx, str.Tools
lea ecx, [esp + 0x4c]
call fcn.00406eb0
push esi
push str.SaveAlpha_u
mov ecx, 0x40
mov dword [esp + 0x88], eax
call fcn.00401250
add esp, 8
push 0
mov edx, ebx
push edx
mov edx, str.Tools
lea ecx, [esp + 0x4c]
call fcn.00406f50
mov dword [esp + 0x18], eax
test eax, eax
jns 0x42308b
and eax, 0x7fffffff
jmp 0x423097
neg eax
sbb eax, eax
and eax, 0x1000000
add eax, 0x55
push esi
push str.Flags_u
mov ecx, 0x40
lea ebx, [esp + 0x13c]
mov dword [esp + 0x8c], eax
call fcn.00401250
add esp, 8
push 0
mov eax, ebx
push eax
mov edx, str.Tools
lea ecx, [esp + 0x4c]
call fcn.00406f50
lea ecx, [esp + 0x7c]
push ecx
mov dword [esp + 0x80], eax
call fcn.004250a0
inc esi
jmp 0x422d86
mov ecx, dword [0x459f88]
mov eax, ecx
and eax, 0x20000000
mov edi, eax
and ecx, 0xefffffff
xor edx, edx
or edi, 0x9fffffff
or ecx, 0xcfffffff
shr edi, 0x1d
shr ecx, 0x1c
neg eax
sbb eax, eax
and eax, 5
mov dword [0x4524b4], edi
add eax, 0x3c
mov dword [0x4524c4], esi
mov edi, 0x800
mov ebx, str.WatermarksWinSnap.png
lea esi, [esp + 0x20]
mov dword [esp + 0x14], edx
mov dword [0x452498], 0x74751000
mov dword [0x4524a0], 0x20600100
mov dword [0x4524a4], 0x1f4
mov dword [0x4524a8], 0xffffff
mov dword [0x459f94], edx
mov dword [0x4524ac], 0xff
mov dword [0x4524b0], 0x87
mov dword [0x4524b8], ecx
mov dword [0x4524bc], eax
mov dword [0x4524d0], 0x50
mov dword [0x4524d4], 0x1e
mov dword [0x459f98], edx
mov dword [0x4524d8], 0x28
mov dword [0x4524c0], 2
mov dword [0x4524c8], 0x32
mov dword [0x4524cc], 0xf00140
mov dword [0x4524e4], 0x2800
mov dword [0x4524e8], 0x64
mov dword [0x4524ec], 0xa0008
mov dword [0x4524f0], 0xc000c
mov dword [esp + 0x10], edi
call fcn.00403ca0
push 0xffffffffffffffff
push 0
mov ecx, 0x458770
mov byte [esp + 0x9d0], 0xf
call fcn.004038b0
mov byte [esp + 0x9c8], 1
cmp dword [esp + 0x38], 8
jb 0x423225
mov edx, dword [esp + 0x24]
push edx
call fcn.00434772
add esp, 4
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esp + 0x10], edi
test eax, eax
je 0x423289
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1b8]
push edx
push 0
push 0
push str.StText
push eax
call ebx
test eax, eax
jne 0x423289
lea eax, [esp + 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x423289
lea eax, [esp + 0x1b4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423270
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1b8]
jmp 0x423290
push 0xe
mov eax, 0x448a58
mov esi, 0x458818
call fcn.00403960
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], edi
test eax, eax
je 0x4232f9
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1b8]
push edx
push 0
push 0
push str.StTextFont
push eax
call ebx
test eax, eax
jne 0x4232f9
lea eax, [esp + 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4232f9
lea eax, [esp + 0x1b4]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4232e0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1b8]
jmp 0x423300
push 5
mov eax, str.Arial
mov esi, 0x458834
call fcn.00403960
mov eax, dword [esp + 0x14]
mov esi, 4
mov dword [esp + 0x10], esi
test eax, eax
je 0x423339
lea ecx, [esp + 0x10]
push ecx
push 0x4524f4
push 0
push 0
push str.StTextColor
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423343
mov dword [0x4524f4], 0xc0c0c0
mov dword [esp + 0x10], esi
test eax, eax
je 0x423369
lea edx, [esp + 0x10]
push edx
push 0x4524f8
push 0
push 0
push str.StTextStyle
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423373
mov dword [0x4524f8], 0x1001c
mov dword [esp + 0x10], esi
test eax, eax
je 0x423399
lea ecx, [esp + 0x10]
push ecx
push 0x4524dc
push 0
push 0
push str.AutoFormat
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4233a3
mov dword [0x4524dc], 3
mov edx, dword [0x4524dc]
mov dword [0x4524fc], edx
mov dword [esp + 0x10], esi
test eax, eax
je 0x4233d5
lea ecx, [esp + 0x10]
push ecx
push 0x4524e0
push 0
push 0
push str.AutoFlags
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4233df
mov dword [0x4524e0], 0x55
mov edx, dword [0x4524e0]
mov dword [0x452500], edx
mov dword [esp + 0x10], edi
test eax, eax
je 0x423422
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1b8]
push edx
push 0
push 0
push str.AutoDir
push eax
call ebx
test eax, eax
jne 0x423422
lea eax, [esp + 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x423447
mov edx, dword [0x459f80]
push 0
push 0x27
lea ecx, [esp + 0x1bc]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x423447
mov word [esp + 0x1b4], ax
lea eax, [esp + 0x1b4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423451
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1b8]
mov esi, 0x45878c
call fcn.00403960
push 0xffffffffffffffff
push 0
mov eax, esi
mov ecx, 0x4587e0
call fcn.004038b0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], edi
test eax, eax
je 0x4234e0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1b8]
push edx
push 0
push 0
push str.AutoName
push eax
call ebx
test eax, eax
jne 0x4234e0
lea eax, [esp + 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4234e0
lea eax, [esp + 0x1b4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4234c7
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1b8]
jmp 0x4234e7
push 0xb
mov eax, str.sshot__NUM_
mov esi, 0x4587a8
call fcn.00403960
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], edi
test eax, eax
je 0x42354f
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1b8]
push edx
push 0
push 0
push str.RunOnSave
push eax
call ebx
test eax, eax
jne 0x42354f
lea eax, [esp + 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x42354f
lea eax, [esp + 0x1b4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423536
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1b8]
jmp 0x423556
push 0x2f
mov eax, str.hstart.exe__NOCONSOLE__pngout.exe__q__IMGPATH__
mov esi, 0x4587fc
call fcn.00403960
mov eax, dword [esp + 0x14]
xor edi, edi
mov esi, 4
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x42358f
lea ecx, [esp + 0x10]
push ecx
push 0x45a258
push edi
push edi
push str.RcFlags
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423595
mov dword [0x45a258], edi
mov ecx, dword [0x459f8c]
test ecx, 0x2000000
je 0x4235af
or dword [0x45a258], 0x20000000
jmp 0x423615
test ecx, 0x8000000
je 0x4235c1
and dword [0x45a258], 0xdfffffff
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x4235e5
lea edx, [esp + 0x10]
push edx
push 0x452434
push edi
push edi
push str.RcPosX
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4235eb
mov dword [0x452434], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x42360f
lea ecx, [esp + 0x10]
push ecx
push 0x452438
push edi
push edi
push str.RcPosY
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423615
mov dword [0x452438], edi
mov ecx, dword [0x459f8c]
test ecx, 0x1000000
je 0x42362f
or dword [0x45a258], 0x40000000
jmp 0x423695
test ecx, 0x4000000
je 0x423641
and dword [0x45a258], 0xbfffffff
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423665
lea edx, [esp + 0x10]
push edx
push 0x45a24c
push edi
push edi
push str.RcSizeX
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x42366b
mov dword [0x45a24c], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x42368f
lea ecx, [esp + 0x10]
push ecx
push 0x45a250
push edi
push edi
push str.RcSizeY
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423695
mov dword [0x45a250], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x4236b9
lea edx, [esp + 0x10]
push edx
push 0x452484
push edi
push edi
push str.ObjFlags
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4236c3
mov dword [0x452484], 0x40000000
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x4236e7
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push str.CurModeHK
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4236ef
mov dword [esp + 0x18], 0x2c
movzx edx, word [esp + 0x18]
xor ecx, ecx
mov word [0x458400], cx
or dword [0x458400], edx
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423727
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push str.FullScreenHK
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x42372f
mov dword [esp + 0x18], 0x42c
movzx edx, word [esp + 0x18]
xor ecx, ecx
mov word [0x458404], cx
or dword [0x458404], edx
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423767
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push str.ApplicationHK
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x42376f
mov dword [esp + 0x18], 0x22c
movzx edx, word [esp + 0x18]
xor ecx, ecx
mov word [0x458408], cx
or dword [0x458408], edx
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x4237a7
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push str.WindowHK
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4237af
mov dword [esp + 0x18], 0x12c
movzx edx, word [esp + 0x18]
xor ecx, ecx
mov word [0x45840c], cx
or dword [0x45840c], edx
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x4237e7
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push str.ObjectHK
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4237ef
mov dword [esp + 0x18], 0x62c
movzx edx, word [esp + 0x18]
xor ecx, ecx
mov word [0x458410], cx
or dword [0x458410], edx
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423827
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push str.RegionHK
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x42382f
mov dword [esp + 0x18], 0x32c
movzx edx, word [esp + 0x18]
xor ecx, ecx
mov word [0x458414], cx
or dword [0x458414], edx
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423867
lea ecx, [esp + 0x10]
push ecx
push 0x45a1ac
push edi
push edi
push str.PrintFlags
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x42386d
mov dword [0x45a1ac], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423891
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x1c]
push ecx
push edi
push edi
push str.PrintMarginLeft
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423899
mov dword [esp + 0x18], 0x3e8
mov edx, dword [esp + 0x18]
mov dword [0x452444], edx
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x4238c7
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push str.PrintMarginTop
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4238cf
mov dword [esp + 0x18], 0x3e8
mov ecx, dword [esp + 0x18]
mov dword [0x452448], ecx
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x4238fd
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x1c]
push ecx
push edi
push edi
push str.PrintMarginRight
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423905
mov dword [esp + 0x18], 0x3e8
mov edx, dword [esp + 0x18]
mov dword [0x45244c], edx
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423933
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push str.PrintMarginBottom
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x42393b
mov dword [esp + 0x18], 0x3e8
mov ecx, dword [esp + 0x18]
mov dword [0x452450], ecx
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423969
lea edx, [esp + 0x10]
push edx
push 0x45868c
push edi
push edi
push str.FlagsCap
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x42396f
mov dword [0x45868c], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423993
lea ecx, [esp + 0x10]
push ecx
push 0x458690
push edi
push edi
push str.FixLeft
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423999
mov dword [0x458690], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x4239bd
lea edx, [esp + 0x10]
push edx
push 0x458694
push edi
push edi
push str.FixTop
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4239c3
mov dword [0x458694], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x4239e7
lea ecx, [esp + 0x10]
push ecx
push 0x458698
push edi
push edi
push str.FixRight
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x4239ed
mov dword [0x458698], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423a11
lea edx, [esp + 0x10]
push edx
push 0x45869c
push edi
push edi
push str.FixBottom
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423a17
mov dword [0x45869c], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423a3b
lea ecx, [esp + 0x10]
push ecx
push 0x4586a0
push edi
push edi
push str.FixDlgLeft
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423a41
mov dword [0x4586a0], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423a65
lea edx, [esp + 0x10]
push edx
push 0x4586a4
push edi
push edi
push str.FixDlgTop
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423a6b
mov dword [0x4586a4], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423a8f
lea ecx, [esp + 0x10]
push ecx
push 0x4586a8
push edi
push edi
push str.FixDlgRight
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423a95
mov dword [0x4586a8], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423ab9
lea edx, [esp + 0x10]
push edx
push 0x4586ac
push edi
push edi
push str.FixDlgBottom
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423abf
mov dword [0x4586ac], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423ae3
lea ecx, [esp + 0x10]
push ecx
push 0x4586b0
push edi
push edi
push str.FixRoundX
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423b03
mov ecx, dword [0x459f88]
mov edx, ecx
and edx, 0x40000000
neg edx
sbb edx, edx
and edx, 3
add edx, 8
mov dword [0x4586b0], edx
jmp 0x423b09
mov ecx, dword [0x459f88]
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423b33
lea ecx, [esp + 0x10]
push ecx
push 0x4586b4
push edi
push edi
push str.FixRoundY
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423b42
mov ecx, dword [0x459f88]
shr ecx, 0x1d
and ecx, 2
or ecx, 9
mov dword [0x4586b4], ecx
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423b66
lea edx, [esp + 0x10]
push edx
push 0x45a2f8
push edi
push edi
push str.AdvTemplate
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423b6c
mov dword [0x45a2f8], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423b90
lea ecx, [esp + 0x10]
push ecx
push 0x4523bc
push edi
push edi
push str.ConfigPage
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423b96
mov dword [0x4523bc], edi
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423bba
lea edx, [esp + 0x10]
push edx
push 0x45251c
push edi
push edi
push str.MainActions
push eax
call ebx
test eax, eax
mov eax, dword [esp + 0x14]
je 0x423bc4
mov dword [0x45251c], 0x50001
mov dword [esp + 0x10], esi
cmp eax, edi
je 0x423be4
lea ecx, [esp + 0x10]
push ecx
push 0x459fb8
push edi
push edi
push str.PaneWidth
push eax
call ebx
test eax, eax
je 0x423c00
push 6
call dword [sym.imp.USER32.dll_GetDialogBaseUnits]
movzx edx, ax
push edx
push 0x80
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [0x459fb8], eax
lea eax, [esp + 0x7c]
call fcn.004242b0
mov byte [esp + 0x9c8], 0x10
mov eax, dword [esp + 0x14]
mov dword [esp + 0x3c], 1
cmp eax, edi
je 0x423fea
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push edi
push str.Tools
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x423c44
mov dword [esp + 0x1c], edi
call fcn.00425160
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x423fd5
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x44]
push ecx
push edi
push edi
push str.Count
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x58], edi
call ebx
test eax, eax
jne 0x423fc8
xor edi, edi
mov dword [esp + 0x3c], edi
nop
mov eax, dword [esp + 0x40]
cmp eax, 0x14
jb 0x423c8e
mov eax, 0x14
cmp edi, eax
jae 0x423fc8
push edi
push str.Title_u
mov ecx, 0x40
lea ebx, [esp + 0x13c]
call fcn.00401250
add esp, 8
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x1b8]
push eax
push 0
push 0
mov ecx, ebx
push ecx
push edx
mov dword [esp + 0x28], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423fc8
lea eax, [esp + 0x1b4]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423cf0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1b8]
lea esi, [esp + 0x8c]
call fcn.00403960
push edi
push str.ExePath_u
mov ecx, 0x40
lea ebx, [esp + 0x13c]
call fcn.00401250
add esp, 8
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x1b8]
push ecx
push 0
push 0
mov edx, ebx
push edx
push eax
mov dword [esp + 0x28], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423fc8
lea eax, [esp + 0x1b4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423d66
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1b8]
lea esi, [esp + 0xa8]
call fcn.00403960
push edi
push str.Param_u
mov ecx, 0x40
lea ebx, [esp + 0x13c]
call fcn.00401250
add esp, 8
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1b8]
push edx
push 0
push 0
mov eax, ebx
push eax
push ecx
mov dword [esp + 0x28], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423fc8
lea edx, [esp + 0xc0]
push edx
lea eax, [esp + 0x1b8]
call fcn.004034d0
push edi
push str.Icon_u
mov ecx, 0x40
call fcn.00401250
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 8
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x1b8]
push ecx
push 0
push 0
mov edx, ebx
push edx
push eax
mov dword [esp + 0x28], 0x800
call esi
test eax, eax
jne 0x423fc8
lea ecx, [esp + 0xdc]
push ecx
lea eax, [esp + 0x1b8]
call fcn.004034d0
push edi
push str.SaveDir_u
mov ecx, 0x40
call fcn.00401250
add esp, 8
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x1b8]
push eax
push 0
push 0
mov ecx, ebx
push ecx
push edx
mov dword [esp + 0x28], 0x800
call esi
test eax, eax
jne 0x423fc8
lea eax, [esp + 0xf8]
push eax
lea eax, [esp + 0x1b8]
call fcn.004034d0
push edi
push str.SaveName_u
mov ecx, 0x40
call fcn.00401250
add esp, 8
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1b8]
push edx
push 0
push 0
mov eax, ebx
push eax
push ecx
mov dword [esp + 0x28], 0x800
call esi
test eax, eax
jne 0x423fc8
lea edx, [esp + 0x114]
push edx
lea eax, [esp + 0x1b8]
call fcn.004034d0
push edi
push str.SaveFormat_u
mov ecx, 0x40
call fcn.00401250
add esp, 8
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x84]
push ecx
push 0
push 0
mov edx, ebx
push edx
push eax
mov dword [esp + 0x28], 4
call esi
test eax, eax
jne 0x423fc8
push edi
push str.SaveAlpha_u
lea ecx, [eax + 0x40]
call fcn.00401250
add esp, 8
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
mov eax, ebx
push eax
push ecx
mov dword [esp + 0x28], 4
call esi
test eax, eax
jne 0x423fc8
mov eax, dword [esp + 0x18]
test eax, eax
jns 0x423f64
and eax, 0x7fffffff
jmp 0x423f70
neg eax
sbb eax, eax
and eax, 0x1000000
add eax, 0x55
push edi
push str.Flags_u
mov ecx, 0x40
lea ebx, [esp + 0x13c]
mov dword [esp + 0x8c], eax
call fcn.00401250
add esp, 8
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x80]
push eax
push 0
push 0
mov ecx, ebx
push ecx
push edx
mov dword [esp + 0x28], 4
call esi
test eax, eax
jne 0x423fc8
lea eax, [esp + 0x7c]
push eax
call fcn.004250a0
inc edi
jmp 0x423c80
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x3c], edi
je 0x4240c9
call fcn.00425160
push 0xd
mov eax, str.Edit_in_Paint
lea esi, [esp + 0x8c]
call fcn.00403960
push 0xb
mov eax, str.mspaint.exe
lea esi, [esp + 0xa8]
call fcn.00403960
push 9
mov eax, str._IMGPATH_
lea esi, [esp + 0xc4]
call fcn.00403960
push edi
mov eax, 0x447354
lea esi, [esp + 0xe0]
call fcn.00403960
push edi
push 0x27
lea eax, [esp + 0x1bc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jl 0x424079
lea eax, [esp + 0x1b4]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x424060
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1b8]
jmp 0x42407f
push edi
mov eax, 0x447354
lea esi, [esp + 0xfc]
call fcn.00403960
push 0xb
mov eax, str.sshot__NUM_
lea esi, [esp + 0x118]
mov dword [esp + 0x80], 0x80000000
call fcn.00403960
lea ecx, [esp + 0x7c]
push ecx
mov dword [esp + 0x84], 3
mov dword [esp + 0x88], 0x20000055
call fcn.004250a0
lea esi, [esp + 0x7c]
call fcn.00424310
mov ecx, dword [0x45a44c]
mov edi, dword [0x45a448]
sub ecx, edi
mov eax, 0xb60b60b7
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
xor ebx, ebx
test eax, eax
jle 0x424247
xor esi, esi
cmp ebx, eax
jb 0x42410e
call fcn.004344ed
mov edi, dword [0x45a448]
and dword [esi + edi + 8], 0x9fffffff
mov ecx, dword [0x45a44c]
mov edi, dword [0x45a448]
sub ecx, edi
mov eax, 0xb60b60b7
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x424146
call fcn.004344ed
mov edi, dword [0x45a448]
cmp dword [esi + edi + 0x24], 8
jb 0x424153
mov edi, dword [esi + edi + 0x10]
jmp 0x424157
lea edi, [esi + edi + 0x10]
push str.Save_to_Desktop
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, dword [0x45a44c]
mov edi, dword [0x45a448]
sub ecx, edi
test eax, eax
mov eax, 0xb60b60b7
jne 0x4241a1
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ebx, ecx
jb 0x424197
call fcn.004344ed
mov edi, dword [0x45a448]
or dword [esi + edi + 8], 0x40000000
jmp 0x424217
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x4241be
call fcn.004344ed
mov edi, dword [0x45a448]
cmp dword [esi + edi + 0x24], 8
jb 0x4241cb
mov edi, dword [esi + edi + 0x10]
jmp 0x4241cf
lea edi, [esi + edi + 0x10]
push str.Edit_in_Paint
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x424217
mov ecx, dword [0x45a44c]
mov edi, dword [0x45a448]
sub ecx, edi
mov eax, 0xb60b60b7
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ebx, ecx
jb 0x42420f
call fcn.004344ed
mov edi, dword [0x45a448]
or dword [esi + edi + 8], 0x20000000
mov ecx, dword [0x45a44c]
mov edi, dword [0x45a448]
sub ecx, edi
mov eax, 0xb60b60b7
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
add esi, 0xb4
cmp ebx, eax
jl 0x424101
mov esi, 8
cmp dword [esp + 0x5c], esi
jb 0x42425f
mov edx, dword [esp + 0x48]
push edx
call fcn.00434772
add esp, 4
xor eax, eax
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], 0
mov word [esp + 0x48], ax
cmp dword [esp + 0x78], esi
jb 0x424289
mov ecx, dword [esp + 0x64]
push ecx
call fcn.00434772
add esp, 4
mov ecx, dword [esp + 0x9c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x9a8]
xor ecx, esp
call fcn.00433c32
mov esp, ebp
pop ebp
ret