Function at 0x423cc2
Capabilities:
Connect pipe
Parse pe header
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x750
mov dword [ebp - 0x60], 0xbd085c9e
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x1b0], 0xbd52a284
mov dword [ebp - 0x140], 0xadf86095
mov dword [ebp - 0x1b8], 0xfffffffb
mov dword [ebp - 0x42c], 0x687e91c1
mov dword [ebp - 0x194], 0xffffffff
mov dword [ebp - 0x1c4], 0xaa435c52
mov dword [ebp - 0x4a0], 1
mov dword [ebp - 0x144], 0
jmp 0x423d38
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x423d54
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x15c], 0x69ed994a
jmp 0x423d2b
mov eax, 0x3153
test eax, eax
je 0x423eae
cmp dword [ebp - 0x60], 0
jne 0x423d76
cmp dword [ebp - 0x7c], 0
jne 0x423d76
and dword [ebp - 0x364], 0
jmp 0x423d80
mov dword [ebp - 0x364], 1
mov eax, dword [ebp - 0x364]
neg eax
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x140], eax
je 0x423db1
mov dword [ebp - 0x47c], 1
jmp 0x423db8
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x47c], eax
je 0x423dcf
mov dword [ebp - 0x484], 1
jmp 0x423dd6
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x484], eax
jl 0x423df9
cmp dword [ebp - 0x1b0], 0
jne 0x423df9
cmp dword [ebp - 0x7c], 0
jne 0x423df9
and dword [ebp - 0x48c], 0
jmp 0x423e03
mov dword [ebp - 0x48c], 1
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x48c], eax
jg 0x423e1a
mov dword [ebp - 0x494], 1
jmp 0x423e21
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0xfffb
ja 0x423e39
mov dword [ebp - 0x370], 1
jmp 0x423e40
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x1b8], eax
jg 0x423e63
mov dword [ebp - 0x1e8], 1
jmp 0x423e6a
and dword [ebp - 0x1e8], 0
imul eax, dword [ebp - 0x1e8], 0x8bee
cmp eax, 9
jge 0x423e85
mov dword [ebp - 0x41c], 1
jmp 0x423e8c
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
neg eax
cmp eax, 0x8ef34ea8
jbe 0x423ea7
mov dword [ebp - 0x1f0], 1
jmp 0x423eae
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x60], eax
jge 0x423ece
mov dword [ebp - 0x424], 1
jmp 0x423ed5
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
inc eax
cmp eax, dword [ebp - 0x42c]
jle 0x423ef5
or eax, 0xffffffff
je 0x423ef5
mov dword [ebp - 0x1f8], 1
jmp 0x423efc
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jne 0x423f29
cmp dword [ebp - 0x7c], 0
jne 0x423f29
cmp dword [ebp - 0x42c], 0
jne 0x423f29
and dword [ebp - 0x200], 0
jmp 0x423f33
mov dword [ebp - 0x200], 1
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x1c4], eax
jg 0x423f56
mov dword [ebp - 0x434], 1
jmp 0x423f5d
and dword [ebp - 0x434], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x434]
mov dword [ebp + eax - 0x15c], ecx
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x140], eax
jge 0x423f82
cmp dword [ebp - 0x7c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x15c], 0xd1a68408
ja 0x423fa1
mov dword [ebp - 0x208], 1
jmp 0x423fa8
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x208]
cmp eax, dword [ebp - 0x1b8]
jne 0x423fc6
mov dword [ebp - 0x43c], 1
jmp 0x423fcd
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x43c], eax
jne 0x423fe7
mov dword [ebp - 0x210], 1
jmp 0x423fee
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x210]
jg 0x424005
mov dword [ebp - 0x444], 1
jmp 0x42400c
and dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0x4174aa7f
jl 0x424024
mov dword [ebp - 0x218], 1
jmp 0x42402b
and dword [ebp - 0x218], 0
cmp dword [ebp - 0x218], 0xffffffff
jae 0x424040
mov dword [ebp - 0x44c], 1
jmp 0x424047
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 0x31fc
jge 0x42405f
mov dword [ebp - 0x220], 1
jmp 0x424066
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x4a0]
cmp dword [ebp - 0x220], eax
je 0x424080
mov dword [ebp - 0x454], 1
jmp 0x424087
and dword [ebp - 0x454], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x454]
mov dword [ebp + eax - 0x15c], ecx
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x650], 0xe2db58e4
mov byte [ebp - 0x9a], 0
movzx eax, byte [ebp - 0x9a]
test eax, eax
je 0x4240d7
push 0
push 0x22ae
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x4240f3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [ebp - 0x30], 0xc68ec0ae
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x138], 0
jmp 0x42411d
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x424139
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x684], 0xffffffff
jmp 0x424110
mov dword [ebp - 0x30], 0xfffffff5
jmp 0x424149
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffeb
jge 0x424267
mov dword [ebp - 0x150], 0x57b5bf2d
mov dword [ebp - 0x230], 6
cmp dword [ebp - 0x150], 0
jne 0x4241da
cmp dword [ebp - 0x150], 0
je 0x4241d1
cmp dword [ebp - 0x30], 0
jae 0x42418b
mov dword [ebp - 0x228], 1
jmp 0x424192
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x228], eax
je 0x4241a9
mov dword [ebp - 0x45c], 1
jmp 0x4241b0
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x4241da
and dword [ebp - 0x464], 0
jmp 0x4241e4
mov dword [ebp - 0x464], 1
cmp dword [ebp - 0x464], 0x31fadacd
jne 0x4241fc
mov dword [ebp - 0x238], 1
jmp 0x424203
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x238]
jle 0x42421a
mov dword [ebp - 0x46c], 1
jmp 0x424221
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x30]
imul ecx, dword [ebp - 0x46c], 0x393e
imul eax, ecx
cmp eax, dword [ebp - 0x30]
jle 0x424242
mov dword [ebp - 0x474], 1
jmp 0x424249
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
sub eax, dword [ebp - 0x150]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x684], eax
jmp 0x424142
mov dword [ebp - 0xa0], 0x14
jmp 0x424280
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xfffffff8
jle 0x4242a0
mov dword [ebp - 0x550], 0x7c629c4d
cmp dword [ebp - 0x550], 0
je 0x42429e
jmp 0x4242a0
jmp 0x424273
mov dword [ebp - 0xc], 0xffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x4c], 0xc437ffea
mov dword [ebp - 0xec], 0
jmp 0x4242ce
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 1
jge 0x4242ea
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x84], 0x5aba9a9
jmp 0x4242c1
mov eax, 0x73ff82f
test eax, eax
je 0x424416
cmp dword [ebp - 0xc], 0x1ec2
jge 0x42430c
mov dword [ebp - 0x244], 1
jmp 0x424313
and dword [ebp - 0x244], 0
cmp dword [ebp - 0x244], 3
jg 0x424328
mov dword [ebp - 0x36c], 1
jmp 0x42432f
and dword [ebp - 0x36c], 0
imul eax, dword [ebp - 0x36c], 0xfff9
cmp eax, dword [ebp - 0x10]
jne 0x42434a
mov dword [ebp - 0x24c], 1
jmp 0x424351
and dword [ebp - 0x24c], 0
cmp dword [ebp - 0x24c], 0xf0f
jne 0x424369
mov dword [ebp - 0x470], 1
jmp 0x424370
and dword [ebp - 0x470], 0
cmp dword [ebp - 0x470], 0xc5ec
jne 0x424388
mov dword [ebp - 0x254], 1
jmp 0x42438f
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x254]
jl 0x4243ac
cmp dword [ebp - 0x10], 0
je 0x4243ac
mov dword [ebp - 0x558], 1
jmp 0x4243b3
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jle 0x4243d0
mov dword [ebp - 0x560], 1
jmp 0x4243d7
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x678], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x10], eax
jle 0x424416
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x424416
mov dword [ebp - 0x568], 1
jmp 0x42441d
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0xc], 0xf9a4d91f
ja 0x42443b
mov dword [ebp - 0x378], 1
jmp 0x424442
and dword [ebp - 0x378], 0
cmp dword [ebp - 0x378], 0x59f8
jle 0x4244df
mov dword [ebp - 0x164], 0x8607f470
mov dword [ebp - 0x10], 0
jmp 0x42446c
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x424490
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x84], 0
je 0x42448e
jmp 0x424465
jmp 0x424465
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x164]
add ecx, 0x5278
cmp dword [ebp + eax - 0x84], ecx
jne 0x4244b7
mov dword [ebp - 0x19c], 1
jmp 0x4244be
and dword [ebp - 0x19c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x19c]
mov dword [ebp + eax - 0x84], ecx
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x4c], eax
jmp 0x4246bf
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x26c], 9
mov dword [ebp - 0x10], 0
jmp 0x424503
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x33
je 0x4246bf
cmp dword [ebp - 0x4c], 0
jne 0x42453d
mov dword [ebp - 0xc], 0
jmp 0x424523
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x424538
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
jmp 0x42451c
jmp 0x4246ac
mov dword [ebp - 0x264], 0xffff
mov dword [ebp - 0x380], 0x5881f6c9
mov dword [ebp - 0x4c], 0
jmp 0x424561
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jg 0x4246ac
mov dword [ebp - 0x16c], 0xe31b5465
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x84], 1
jne 0x42458e
mov dword [ebp - 0x25c], 1
jmp 0x424595
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x25c]
imul eax, dword [ebp - 0x264]
mov dword [ebp - 0x408], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x408]
mov dword [ebp + eax - 0x84], ecx
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x26c], 0
je 0x4245e1
xor eax, eax
inc eax
je 0x4245e1
mov dword [ebp - 0x450], 1
jmp 0x4245e8
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0
je 0x42461e
cmp dword [ebp - 0x26c], 0
je 0x42461e
mov dword [ebp - 0x274], 1
jmp 0x424625
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x450]
sub eax, 0x5285
cmp eax, dword [ebp - 0x274]
jge 0x424644
mov dword [ebp - 0x388], 1
jmp 0x42464b
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x11c]
sub eax, dword [ebp - 0x388]
mov ecx, dword [ebp - 0x4c]
add eax, dword [ebp + ecx*4 - 0x84]
cmp eax, 1
ja 0x424672
mov dword [ebp - 0x27c], 1
jmp 0x424679
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x27c], eax
jg 0x424690
mov dword [ebp - 0x410], 1
jmp 0x424697
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x410]
mov dword [ebp + eax*4 - 0x84], ecx
jmp 0x42455a
cmp dword [ebp - 0x11c], 0
je 0x4246ba
jmp 0x4244fc
jmp 0x4244fc
mov dword [ebp - 0xdc], 0xa3d7f191
mov dword [ebp - 0x14], 0
jmp 0x4246d9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x4246ef
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x570], 0xfffc
jmp 0x4246d2
mov dword [ebp - 0x14], 0
jmp 0x4246ff
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x424715
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d4], 0x7c7ce53d
jmp 0x4246f8
mov dword [ebp - 0x14], 0
jmp 0x424725
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x42473b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x578], 9
jmp 0x42471e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1d4], 0
jmp 0x424769
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1d4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d4], 0
jg 0x4248b7
mov dword [ebp - 0x58], 0x6f5a9c4c
mov dword [ebp - 0x6e8], 0
mov dword [ebp - 0x284], 0xfffffff9
mov dword [ebp - 0xf4], 0
jmp 0x4247b1
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x4247cd
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x6f0], 0x108531d1
jmp 0x4247a4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d4]
cmp dword [ebp + eax*4 - 0x570], 0
je 0x4247e9
jmp 0x4248b7
mov dword [ebp - 0x58], 0
jmp 0x4247f9
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x424872
mov dword [ebp - 0x134], 0xf0aa6e6f
mov dword [ebp - 0x134], 0
jmp 0x424822
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jg 0x424841
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x42483f
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
jmp 0x424815
mov byte [ebp - 0x98], 0
movzx eax, byte [ebp - 0x98]
test eax, eax
je 0x424870
push 0
push 0x22ae
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x4247f2
mov dword [ebp - 0x58], 0
jmp 0x424882
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jg 0x4248b2
mov dword [ebp - 0x6f8], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x578], 0x754320e3
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
jmp 0x42487b
jmp 0x42474e
mov dword [ebp - 0xdc], 1
jmp 0x4248d0
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jl 0x4248ed
mov eax, dword [ebp - 0xdc]
cmp dword [ebp + eax*4 - 0x1d4], 0
je 0x4248eb
jmp 0x4248ed
jmp 0x4248c3
mov eax, dword [ebp + 8]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0xd8], 0x42a1e948
mov dword [ebp - 0x390], 0xfffffffb
mov dword [ebp - 0x294], 0x43e
mov dword [ebp - 0x20], 0
jmp 0x424924
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x42493a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x490], 0xfb6f65e7
jmp 0x42491d
mov dword [ebp - 0x20], 0
jmp 0x42494a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x424960
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x690], 0x63d18804
jmp 0x424943
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0xd8]
neg eax
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x390], eax
jl 0x424994
mov dword [ebp - 0x28c], 1
jmp 0x42499b
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x28c]
jg 0x4249b5
mov dword [ebp - 0x548], 1
jmp 0x4249bc
and dword [ebp - 0x548], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x490], 0x1dfd9475
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x6cc], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x490]
mov dword [ebp + ecx - 0x690], eax
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x184]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x424b69
mov dword [ebp - 0xd4], 4
mov dword [ebp - 0x29c], 0xfffffffc
mov dword [ebp - 0x398], 0xbeab1d6a
mov dword [ebp - 0x51c], 4
mov dword [ebp - 0x38], 0
jmp 0x424a4c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x424a62
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1bc], 0xfffffffe
jmp 0x424a45
mov dword [ebp - 0x38], 0
jmp 0x424a72
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x424a88
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x738], 0xffffffff
jmp 0x424a6b
cmp dword [ebp - 0xd4], 0
je 0x424aa3
mov eax, 0x441a62a9
test eax, eax
jne 0x424aa3
and dword [ebp - 0x4ac], 0
jmp 0x424aad
mov dword [ebp - 0x4ac], 1
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0xd4]
add eax, dword [ebp - 0xd4]
imul eax, eax, 0x7c69
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x1bc]
sub eax, 0x9523
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x1bc]
cmp eax, 0xffffffff
jae 0x424b08
mov dword [ebp - 0x418], 1
jmp 0x424b0f
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x29c]
cmp eax, dword [ebp - 0x418]
jg 0x424b35
mov dword [ebp - 0x2a4], 1
jmp 0x424b3c
and dword [ebp - 0x2a4], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp + eax - 0x738], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc]
mov dword [ebp - 0x51c], eax
xor eax, eax
jmp 0x42702a
mov dword [ebp - 0xb0], 0x324ec2e0
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x4b4], 0xbb7a1405
mov dword [ebp - 0xb0], 0xfffffff1
jmp 0x424b9d
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x1b
jl 0x424d66
mov dword [ebp - 0xfc], 0
jmp 0x424bc3
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x424bdf
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x14c], 0xa715cc48
jmp 0x424bb6
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x6d4], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x14c]
cmp dword [ebp + eax - 0x14c], ecx
jl 0x424c13
mov dword [ebp - 0x3a0], 1
jmp 0x424c1a
and dword [ebp - 0x3a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
cmp dword [ebp - 0x3a0], eax
jge 0x424c3b
mov dword [ebp - 0x2ac], 1
jmp 0x424c42
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x2ac], eax
jne 0x424c5c
mov dword [ebp - 0x458], 1
jmp 0x424c63
and dword [ebp - 0x458], 0
mov dword [ebp - 0x5c], 1
mov eax, dword [ebp - 0x5c]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x14c]
mov edx, dword [ebp - 0x458]
sub edx, 0x9cc0
add ecx, edx
sub eax, ecx
cmp eax, 0xfffb
ja 0x424c9d
mov dword [ebp - 0x2b4], 1
jmp 0x424ca4
and dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2b4], 0x8e50
jne 0x424cbc
mov dword [ebp - 0x3a8], 1
jmp 0x424cc3
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x4b4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x14c], 0x487223b1
jl 0x424cee
mov dword [ebp - 0x564], 1
jmp 0x424cf5
and dword [ebp - 0x564], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x14c]
mov dword [ebp - 0x5dc], eax
mov eax, dword [ebp - 0x5c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x14c]
je 0x424d42
mov dword [ebp - 0x5c], 0
jmp 0x424d2a
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x424d40
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x14c], 1
jmp 0x424d23
jmp 0x424d61
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x424d61
push 0x20f
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
jmp 0x424b90
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x424d89
push 0
push 0
push 0x1d79
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x1a4], 0xf1a0734f
mov dword [ebp - 0x2cc], 0xfffffff8
mov dword [ebp - 0x2c4], 1
mov dword [ebp - 0x48], 0
jmp 0x424dd3
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x424de9
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x750], 0xe08a1101
jmp 0x424dcc
mov dword [ebp - 0x48], 0
jmp 0x424df9
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x424e0f
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x2bc], 0xd82c32b9
jmp 0x424df2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2bc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2bc], eax
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x174], eax
jle 0x424e44
mov dword [ebp - 0x420], 1
jmp 0x424e4b
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x174], eax
je 0x424e71
mov dword [ebp - 0x3b0], 1
jmp 0x424e78
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x2cc], eax
jge 0x424e9e
mov dword [ebp - 0x478], 1
jmp 0x424ea5
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x174]
cmp eax, dword [ebp - 0x478]
jne 0x424ebf
mov dword [ebp - 0x2d4], 1
jmp 0x424ec6
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0xb8]
cmp dword [eax], 0x4550
je 0x425358
mov dword [ebp - 0x4bc], 1
mov dword [ebp - 0x674], 2
mov dword [ebp - 0x5e4], 0x63a88e00
mov dword [ebp - 0x17c], 0xfffffffb
mov dword [ebp - 0x40], 0
jmp 0x424f1c
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x424f32
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x714], 1
jmp 0x424f15
mov dword [ebp - 0x40], 0
jmp 0x424f42
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x424f58
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x728], 0xd37ad43
jmp 0x424f3b
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x714]
cmp eax, dword [ebp - 0x17c]
jne 0x424f86
mov dword [ebp - 0x3b8], 1
jmp 0x424f8d
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x124], 0xffffffff
mov dword [ebp - 0x1c0], 0xffffffff
mov dword [ebp - 0x4c4], 1
mov dword [ebp - 0xc0], 0xdae89405
mov dword [ebp - 0x588], 0
mov dword [ebp - 0x4cc], 0x7828e972
mov dword [ebp - 0x53c], 0xe8dce9db
mov dword [ebp - 0x4d4], 5
mov dword [ebp - 0x24], 0
jmp 0x425000
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x425016
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x49c], 0xdd972c40
jmp 0x424ff9
mov dword [ebp - 0x24], 0
jmp 0x425026
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x42503c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x69c], 0x5fc1c575
jmp 0x42501f
mov eax, dword [ebp - 8]
cmp dword [ebp - 8], eax
je 0x425050
mov dword [ebp - 0x2dc], 1
jmp 0x425057
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
imul eax, dword [ebp - 8]
test eax, eax
jne 0x42507a
cmp dword [ebp - 8], 0
jne 0x42507a
cmp dword [ebp - 8], 0
jne 0x42507a
and dword [ebp - 0x534], 0
jmp 0x425084
mov dword [ebp - 0x534], 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x2dc], eax
jl 0x4250a4
mov dword [ebp - 0x428], 1
jmp 0x4250ab
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x428], eax
jle 0x4250c2
mov dword [ebp - 0x2e4], 1
jmp 0x4250c9
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x3c0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp + eax - 0x49c], ecx
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x3c0], eax
jg 0x42510b
mov dword [ebp - 0x2ec], 1
jmp 0x425112
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x2ec], eax
jge 0x42512f
cmp dword [ebp - 0x1c0], 0
jne 0x42512f
and dword [ebp - 0x460], 0
jmp 0x425139
mov dword [ebp - 0x460], 1
cmp dword [ebp - 0x460], 1
je 0x42514e
mov dword [ebp - 0x2f4], 1
jmp 0x425155
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x2f4], eax
jg 0x425178
mov eax, 0xb042
test eax, eax
je 0x425178
mov dword [ebp - 0x3c8], 1
jmp 0x42517f
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 8]
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c0]
cmp dword [ebp + eax - 0x49c], ecx
jle 0x4251a3
mov dword [ebp - 0x2fc], 1
jmp 0x4251aa
and dword [ebp - 0x2fc], 0
imul eax, dword [ebp - 0x2fc], 0xffffffff
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x69c]
jg 0x4251cc
mov dword [ebp - 0x430], 1
jmp 0x4251d3
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0xc0], 0x4c38d679
cmp dword [ebp - 0x588], 0
je 0x425207
cmp dword [ebp - 0xc0], 0
je 0x425207
mov dword [ebp - 0x304], 1
jmp 0x42520e
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x304]
imul eax, eax, 0x778d
cmp eax, dword [ebp - 0x4cc]
je 0x425234
mov dword [ebp - 0x3d0], 1
jmp 0x42523b
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
sub eax, dword [ebp - 8]
jne 0x425258
cmp dword [ebp - 0xc0], 0
jne 0x425258
and dword [ebp - 0x30c], 0
jmp 0x425262
mov dword [ebp - 0x30c], 1
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x30c]
cmp eax, dword [ebp - 0x53c]
je 0x425286
cmp dword [ebp - 0x4d4], 0
jne 0x425286
and dword [ebp - 0x488], 0
jmp 0x425290
mov dword [ebp - 0x488], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x49c]
cmp eax, dword [ebp - 0x488]
jge 0x4252b1
mov dword [ebp - 0x314], 1
jmp 0x4252b8
and dword [ebp - 0x314], 0
cmp dword [ebp - 0x314], 0xffff
ja 0x4252d0
mov dword [ebp - 0x3d8], 1
jmp 0x4252d7
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x3d8], eax
jg 0x4252ee
mov dword [ebp - 0x31c], 1
jmp 0x4252f5
and dword [ebp - 0x31c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x49c]
cmp eax, dword [ebp - 0x31c]
je 0x425316
mov dword [ebp - 0x438], 1
jmp 0x42531d
and dword [ebp - 0x438], 0
cmp dword [ebp - 0x438], 0
jl 0x425332
mov dword [ebp - 0x324], 1
jmp 0x425339
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x124], eax
xor eax, eax
jmp 0x42702a
mov dword [ebp - 0x5ec], 0x1124
mov dword [ebp - 0x67c], 0x1f2c29a
mov dword [ebp - 0x5cc], 0
mov dword [ebp - 0x6dc], 0xa654fddd
mov dword [ebp - 0x5fc], 0xfffffffb
mov dword [ebp - 0x3e0], 0x5fcc58a0
mov dword [ebp - 0x104], 0
jmp 0x4253ad
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jge 0x4253c9
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x688], 0x29ea4144
jmp 0x4253a0
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
lea eax, [ebp - 0x130]
push eax
push 1
push 0x3141
push 0x48cb
push 1
push 1
push 1
push dword [ebp - 0xb8]
call fcn.00418b2d
add esp, 0x20
mov dword [ebp - 0x56c], 0xe3245f1d
mov dword [ebp - 0x13c], 0
jmp 0x425420
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x42543c
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x720], 0xffff
jmp 0x425413
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x425459
push 0x2115
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x720]
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x130], 0
jne 0x42547c
xor eax, eax
jmp 0x42702a
mov dword [ebp - 0x64], 0x606de713
mov dword [ebp - 0x10c], 0
jmp 0x42549c
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x4254b8
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x604], 0x35568345
jmp 0x42548f
mov dword [ebp - 0x64], 0
jmp 0x4254c8
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x4254ec
mov byte [ebp - 0x97], 0
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x4254ea
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x4254c1
mov dword [ebp - 0x64], 0
jmp 0x4254fc
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 7
jg 0x42555e
mov dword [ebp - 0x12c], 3
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x425523
push 0x953
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x12c], 0
jmp 0x42553c
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xfffffff4
jle 0x42555c
mov dword [ebp - 0x4dc], 0x5625
cmp dword [ebp - 0x4dc], 0
je 0x42555a
jmp 0x42555c
jmp 0x42552f
jmp 0x4254f5
push 1
push 0x76c
push 1
push dword [ebp - 0xb8]
push dword [ebp - 0x184]
push 0x44fa
push 0x9db
push 0x706d
push 0x4a0f
push 0x69ba
push 0x3ea6
push 0xc66
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x272f
lea eax, [ebp - 0x130]
push eax
push 1
call fcn.00422983
add esp, 0x44
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xe4], 0x365dea31
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xac], 0x5a1448af
mov dword [ebp - 0xc8], 0x497d6a58
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x4ec], 0x33df555a
mov dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x18], 0x34d
je 0x425619
mov dword [ebp - 0x33c], 1
jmp 0x425620
and dword [ebp - 0x33c], 0
cmp dword [ebp - 0x18], 0
jne 0x4256b6
cmp dword [ebp - 0x18], 1
jne 0x42563c
mov dword [ebp - 0x32c], 1
jmp 0x425643
and dword [ebp - 0x32c], 0
cmp dword [ebp - 0x32c], 1
jb 0x425658
mov dword [ebp - 0x468], 1
jmp 0x42565f
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
sub eax, 0xae28de6
cmp eax, 0x13d8c537
je 0x42567d
mov dword [ebp - 0x334], 1
jmp 0x425684
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x334], eax
jle 0x42569b
mov dword [ebp - 0x3e8], 1
jmp 0x4256a2
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x3e8], eax
jge 0x4256b6
and dword [ebp - 0x440], 0
jmp 0x4256c0
mov dword [ebp - 0x440], 1
mov eax, dword [ebp - 0x33c]
add eax, dword [ebp - 0x440]
jne 0x4256dd
cmp dword [ebp - 0x18], 0
jne 0x4256dd
and dword [ebp - 0x544], 0
jmp 0x4256e7
mov dword [ebp - 0x544], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0xe4], 1
je 0x425705
mov dword [ebp - 0x344], 1
jmp 0x42570c
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x344]
jle 0x4259c6
mov dword [ebp - 0x54], 0xfffffff8
mov dword [ebp - 0x4e4], 0x26de0d61
mov dword [ebp - 0x114], 0xb389e767
mov dword [ebp - 0x260], 0xeedf2191
cmp dword [ebp - 0x54], 1
jge 0x425752
mov dword [ebp - 0x3f0], 1
jmp 0x425759
and dword [ebp - 0x3f0], 0
cmp dword [ebp - 0x3f0], 0x11de
jne 0x425771
mov dword [ebp - 0x34c], 1
jmp 0x425778
and dword [ebp - 0x34c], 0
cmp dword [ebp - 0x34c], 0x8b87
je 0x425790
mov dword [ebp - 0x480], 1
jmp 0x425797
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x480], eax
jl 0x4257b0
xor eax, eax
inc eax
jne 0x4257b0
and dword [ebp - 0x354], 0
jmp 0x4257ba
mov dword [ebp - 0x354], 1
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x354], eax
jg 0x4257d1
mov dword [ebp - 0x3f8], 1
jmp 0x4257d8
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
sub eax, 0xfffe
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
sub eax, 0xcac2
cmp eax, dword [ebp - 0x18]
jg 0x42581b
mov dword [ebp - 0x35c], 1
jmp 0x425822
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x694], eax
xor eax, eax
inc eax
cmp eax, 0xb868
jl 0x42585c
mov dword [ebp - 0x448], 1
jmp 0x425863
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xac], eax
jg 0x425886
mov dword [ebp - 0x1e0], 1
jmp 0x42588d
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x1e0], eax
je 0x4258a7
mov dword [ebp - 0x400], 1
jmp 0x4258ae
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0x400], eax
je 0x4258c8
mov dword [ebp - 0x23c], 1
jmp 0x4258cf
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x23c]
jle 0x4258e9
mov dword [ebp - 0x240], 1
jmp 0x4258f0
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x240], eax
jg 0x42590a
mov dword [ebp - 0x248], 1
jmp 0x425911
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x54], eax
jg 0x42592e
cmp dword [ebp - 0x114], 0
jne 0x42593b
xor eax, eax
jne 0x42593b
and dword [ebp - 0x250], 0
jmp 0x425945
mov dword [ebp - 0x250], 1
mov eax, dword [ebp - 0x260]
add eax, dword [ebp - 0x250]
cmp dword [ebp - 0xd0], eax
je 0x425965
mov dword [ebp - 0x258], 1
jmp 0x42596c
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x258]
jne 0x425983
mov dword [ebp - 0x268], 1
jmp 0x42598a
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x268], eax
jl 0x4259a4
mov dword [ebp - 0x584], 1
jmp 0x4259ab
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x614], eax
mov dword [ebp - 0x4ec], 1
jmp 0x425b87
mov dword [ebp - 0xe8], 0xae9a1548
mov dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x6e4], eax
or eax, 0xffffffff
cmp eax, 0x19de87a9
je 0x4259fc
mov dword [ebp - 0x278], 1
jmp 0x425a03
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x270]
cmp eax, dword [ebp - 0x278]
jge 0x425a1d
mov dword [ebp - 0x280], 1
jmp 0x425a24
and dword [ebp - 0x280], 0
cmp dword [ebp - 0x280], 0
je 0x425a39
mov dword [ebp - 0x288], 1
jmp 0x425a40
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x288], eax
jg 0x425a5a
mov dword [ebp - 0x290], 1
jmp 0x425a61
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x290]
sub eax, dword [ebp - 0xd0]
cmp eax, 0x70ddad4d
je 0x425a80
mov dword [ebp - 0x298], 1
jmp 0x425a87
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x298], eax
jg 0x425aa1
mov dword [ebp - 0x2a0], 1
jmp 0x425aa8
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x2a0], eax
jg 0x425ac2
mov dword [ebp - 0x2a8], 1
jmp 0x425ac9
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x2a8], eax
jge 0x425ae3
mov dword [ebp - 0x2b0], 1
jmp 0x425aea
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x2b0], eax
jne 0x425b04
mov dword [ebp - 0x54c], 1
jmp 0x425b0b
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x624], eax
mov dword [ebp - 0xe8], 0xfffffffc
mov eax, dword [ebp - 0x4f4]
cmp dword [ebp - 0xc8], eax
jne 0x425b53
mov dword [ebp - 0x2b8], 1
jmp 0x425b5a
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x2b8], eax
je 0x425b74
mov dword [ebp - 0x2c0], 1
jmp 0x425b7b
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0xac], eax
push 0x7ea1
push 0
push dword [ebp - 0xb8]
push 0
push 1
push 0x342e
push dword [ebp - 0x1c]
push 1
push dword [ebp + 8]
call fcn.00419735
add esp, 0x24
mov dword [ebp - 0x52c], 0
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x524], 0
mov dword [ebp - 0x520], 0
mov dword [ebp - 0x8c], 0x4081c290
mov dword [ebp - 0x6fc], 0x1639
mov dword [ebp - 0x8c], 3
jmp 0x425c02
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x425e06
mov dword [ebp - 0x18c], 5
mov dword [ebp - 0x4fc], 0x8d7d2a7e
mov dword [ebp - 0x62c], 0xafd47030
mov dword [ebp - 0x504], 0x22452a2c
mov dword [ebp - 0x1b4], 0xb51a
mov dword [ebp - 0xf0], 0
jmp 0x425c5a
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jge 0x425c76
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x744], 2
jmp 0x425c4d
mov eax, dword [ebp - 0x8c]
cmp dword [ebp + eax*4 - 0x52c], 0
je 0x425d99
mov dword [ebp - 0x2d8], 0x62f63069
mov dword [ebp - 0xf8], 0
jmp 0x425cad
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x425cc9
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x6a8], 0x4cbed562
jmp 0x425ca0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x52c]
mov dword [ebp - 0x6ac], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x52c], 0xbec0
je 0x425cfc
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x52c], 0
cmp dword [ebp - 0x2d8], 0
jle 0x425d11
mov dword [ebp - 0x2c8], 1
jmp 0x425d18
and dword [ebp - 0x2c8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp + eax - 0x6a8], ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x18c], eax
jg 0x425d51
mov dword [ebp - 0x2d0], 1
jmp 0x425d58
and dword [ebp - 0x2d0], 0
cmp dword [ebp - 0x2d0], 0xa335c22c
jne 0x425d7e
cmp dword [ebp - 0x8c], 0
je 0x425d7e
or eax, 0xffffffff
je 0x425d7e
mov dword [ebp - 0x574], 1
jmp 0x425d85
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x18c]
add eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x4fc], eax
jmp 0x425e01
mov dword [ebp - 0x6ec], 1
mov dword [ebp - 0x554], 0x737a30b9
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x425dc7
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x554]
cmp dword [ebp - 0x1b4], eax
je 0x425dee
mov dword [ebp - 0x2e0], 1
jmp 0x425df5
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x504], eax
jmp 0x425bf5
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x130]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x168], 0xfffffffc
mov dword [ebp - 0x63c], 0x5c62e089
mov dword [ebp - 0x4b0], 0
mov dword [ebp - 0x55c], 0
mov dword [ebp - 0x580], 0x96bb6454
mov dword [ebp - 0x160], 0x5f03
mov dword [ebp - 0x4a4], 0x4c2e3979
mov dword [ebp - 0x50], 0
jmp 0x425e71
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x425e87
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x1dc], 0x60477862
jmp 0x425e6a
mov dword [ebp - 0x50], 0
jmp 0x425e97
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x425ead
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x594], 0xfffffffd
jmp 0x425e90
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1dc], 0
jmp 0x425edb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1dc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1dc], 7
jg 0x426172
mov dword [ebp - 0x6b8], 3
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x514], 0xfffffff6
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x154], 0xffffffff
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x6c4], 1
mov dword [ebp - 0x654], 0
mov dword [ebp - 0xbc], 0x41ac3dc9
mov dword [ebp - 0x50c], 0x77509cb0
mov dword [ebp - 0x6d0], 0xffffffff
mov dword [ebp - 0x65c], 0xfffffffe
mov dword [ebp - 0x158], 0xfeb1ec6c
mov dword [ebp - 0x28], 0
jmp 0x425f81
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x425f97
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x6d8], 1
jmp 0x425f7a
mov dword [ebp - 0x28], 0
jmp 0x425fa7
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x425fbd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5ac], 0xfffffff9
jmp 0x425fa0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5ac]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x5ac], eax
mov dword [ebp - 0xbc], 0
jmp 0x425fef
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jg 0x42616d
mov dword [ebp - 0x100], 0
jmp 0x426015
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 2
jge 0x426031
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x6b4], 0xb09c821f
jmp 0x426008
mov dword [ebp - 0x580], 0x71081b2
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x594]
cmp dword [ebp - 0x50c], eax
jl 0x42605b
mov dword [ebp - 0x2e8], 1
jmp 0x426062
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x2e8], eax
je 0x42607c
mov dword [ebp - 0x2f0], 1
jmp 0x426083
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0xbc]
push 4
pop ecx
shl ecx, 1
mov edx, dword [ebp - 0x2f0]
sub edx, dword [ebp + ecx - 0x5ac]
add edx, dword [ebp - 0x55c]
cmp dword [ebp + eax*4 - 0x594], edx
jl 0x4260b6
mov dword [ebp - 0x2f8], 1
jmp 0x4260bd
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x2f8], eax
jne 0x4260d7
mov dword [ebp - 0x300], 1
jmp 0x4260de
and dword [ebp - 0x300], 0
imul eax, dword [ebp - 0x300], 0xcbc8
add eax, dword [ebp - 0x514]
cmp eax, 0xfffffffe
jle 0x426105
mov eax, 0xcf39
test eax, eax
jne 0x426105
and dword [ebp - 0x308], 0
jmp 0x42610f
mov dword [ebp - 0x308], 1
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x154], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6b4]
cmp dword [ebp - 0x154], eax
je 0x42613c
mov dword [ebp - 0x310], 1
jmp 0x426143
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
sub eax, dword [ebp - 0x310]
imul eax, eax, 0xc7e4
mov dword [ebp - 0x168], eax
jmp 0x425fe2
jmp 0x425ec0
cmp dword [ebp - 0x160], 0
jne 0x42618d
mov eax, 0x47e08a84
test eax, eax
jne 0x42618d
and dword [ebp - 0x57c], 0
jmp 0x426197
mov dword [ebp - 0x57c], 1
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x594], 0xfffb
cmp eax, dword [ebp - 0x160]
jle 0x4261bc
mov dword [ebp - 0x318], 1
jmp 0x4261c3
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x318], eax
jge 0x4261dd
mov dword [ebp - 0x4a8], 1
jmp 0x4261e4
and dword [ebp - 0x4a8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1dc]
mov dword [ebp - 0x664], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x594]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x4b0]
sub eax, dword [ebp - 0x168]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1dc], eax
cmp dword [ebp - 0x320], 0
je 0x426253
push 0x3888
push 0
push 0x7599
push dword [ebp - 0x1c]
push 0
push 0
push 0x3609
push dword [ebp - 0x320]
push 1
call fcn.0040bc80
add esp, 0x24
mov dword [ebp - 4], 0x1e87df2f
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x178], 0x1636717b
mov dword [ebp - 0x188], 0xb25
mov dword [ebp - 0x2c], 0
jmp 0x426288
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x42629b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x74], 0xf0ea
jmp 0x426281
mov dword [ebp - 0x2c], 0
jmp 0x4262ab
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x4262c1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x4c8], 0x5c5cc99c
jmp 0x4262a4
mov byte [ebp - 0x66], 0
movzx eax, byte [ebp - 0x66]
test eax, eax
je 0x4262ff
push 0x1988
push 0x1028
push 0x1f53
push 0x98
push 0x8a1
push 0x7c7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
mov dword [ebp - 4], 0
jmp 0x42630f
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jg 0x426798
mov dword [ebp - 0x4d0], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x74], 0
jne 0x42633c
mov dword [ebp - 0x330], 1
jmp 0x426343
and dword [ebp - 0x330], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x74]
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp - 4]
jl 0x42636a
mov dword [ebp - 0x328], 1
jmp 0x426371
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x74]
add eax, dword [ebp - 0x328]
cmp eax, 1
jle 0x42638f
mov dword [ebp - 0x338], 1
jmp 0x426396
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x330]
cmp eax, dword [ebp - 0x338]
jl 0x4263b0
mov dword [ebp - 0x4b8], 1
jmp 0x4263b7
and dword [ebp - 0x4b8], 0
mov eax, 0xfffa
cmp eax, 2
je 0x4263cd
mov dword [ebp - 0x340], 1
jmp 0x4263d4
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x74]
cmp dword [ebp - 0x340], eax
je 0x4263ef
mov dword [ebp - 0x4c0], 1
jmp 0x4263f6
and dword [ebp - 0x4c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x74]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x74]
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x5d8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x74]
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp - 4]
or ecx, 0xffffffff
sub ecx, dword [ebp + eax*4 - 0x74]
mov dword [ebp - 0x94], ecx
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x94], eax
je 0x426456
mov dword [ebp - 0x348], 1
jmp 0x42645d
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x74]
cmp eax, dword [ebp - 0x348]
jl 0x426478
mov dword [ebp - 0x350], 1
jmp 0x42647f
and dword [ebp - 0x350], 0
cmp dword [ebp - 0x350], 0x1e33ecdc
jg 0x4264b9
mov byte [ebp - 0x68], 0
movzx eax, byte [ebp - 0x68]
test eax, eax
je 0x4264b4
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0xf08
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
jmp 0x426786
mov dword [ebp - 0x3ac], 0xfffffffb
mov dword [ebp - 0x180], 7
mov dword [ebp - 0x108], 0
jmp 0x4264e6
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jge 0x426502
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0xc4], 0x96ad
jmp 0x4264d9
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x74], 0
jne 0x4265fa
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x74], 0
je 0x426530
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x74], 0
je 0x426530
mov dword [ebp - 0x360], 1
jmp 0x426537
and dword [ebp - 0x360], 0
cmp dword [ebp - 0x178], 0
jb 0x42654c
mov dword [ebp - 0x358], 1
jmp 0x426553
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x358], eax
jg 0x42656d
mov dword [ebp - 0x368], 1
jmp 0x426574
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x360]
cmp eax, dword [ebp - 0x368]
jne 0x42658e
mov dword [ebp - 0x374], 1
jmp 0x426595
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x180], eax
jge 0x4265b8
mov dword [ebp - 0x37c], 1
jmp 0x4265bf
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x37c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xc4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc4]
jl 0x4265f3
mov dword [ebp - 0x384], 1
jmp 0x4265fa
and dword [ebp - 0x384], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc4]
mov dword [ebp - 0x94], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc4], 0
je 0x426633
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x74], 5
jge 0x426633
mov dword [ebp - 0x170], 1
jmp 0x42663a
and dword [ebp - 0x170], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x170]
mov dword [ebp + eax - 0x4c8], ecx
cmp dword [ebp - 0x170], 0
jne 0x426668
cmp dword [ebp - 0x94], 0
jne 0x426668
and dword [ebp - 0x38c], 0
jmp 0x426672
mov dword [ebp - 0x38c], 1
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xd3e67b33
jae 0x42669c
cmp dword [ebp - 0x178], 0
jne 0x42669c
and dword [ebp - 0x394], 0
jmp 0x4266a6
mov dword [ebp - 0x394], 1
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x394]
cmp eax, 0xffffffff
jl 0x4266c1
mov dword [ebp - 0x39c], 1
jmp 0x4266c8
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
sub eax, 8
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x74]
test eax, eax
je 0x4266f5
mov eax, 0x20c2888a
test eax, eax
je 0x4266f5
mov dword [ebp - 0x3a4], 1
jmp 0x4266fc
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x180]
imul eax, dword [ebp - 0x94]
imul eax, dword [ebp - 0x3a4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc4]
jg 0x42672b
mov dword [ebp - 0x3b4], 1
jmp 0x426732
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3ac]
sub eax, dword [ebp - 0x3b4]
imul eax, eax, 6
cmp eax, 2
jae 0x426752
mov dword [ebp - 0x3bc], 1
jmp 0x426759
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x4d0]
cmp dword [ebp - 0x3bc], eax
jl 0x426773
mov dword [ebp - 0x3c4], 1
jmp 0x42677a
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x74], ecx
jmp 0x426308
push dword [ebp - 0x1c]
call fcn.0041459e
pop ecx
test eax, eax
jne 0x4267ac
xor eax, eax
jmp 0x42702a
mov dword [ebp - 0x118], 0x91a049fe
mov dword [ebp - 0x5e8], 1
mov dword [ebp - 0x110], 0
jmp 0x4267d9
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 1
jge 0x4267f5
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x3ec], 0xfffffff6
jmp 0x4267cc
mov dword [ebp - 0x118], 0
jmp 0x42680e
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x16
jg 0x4269a9
mov dword [ebp - 0x34], 0x68c0aa39
mov dword [ebp - 0x3dc], 0xf4aedf2
mov dword [ebp - 0x4e0], 1
mov dword [ebp - 0x34], 0
jmp 0x426846
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x4269a4
mov dword [ebp - 0x120], 0xffffffff
cmp dword [ebp - 0x34], 0
jne 0x42686c
mov dword [ebp - 0x3cc], 1
jmp 0x426873
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x3cc]
cmp eax, dword [ebp - 0x120]
je 0x4268b1
mov byte [ebp - 0x67], 0
movzx eax, byte [ebp - 0x67]
test eax, eax
je 0x4268af
push 0x439
push 0x2697
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
jmp 0x4268d2
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x4268d2
push 0
push 0x2317
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
cmp dword [ebp - 0x120], 0
jne 0x42694b
mov eax, dword [ebp - 0x3dc]
sub eax, dword [ebp - 0x34]
imul eax, eax, 0x5b75
cmp eax, 0xbd1a
jge 0x426901
push 2
pop eax
test eax, eax
jne 0x426901
and dword [ebp - 0x3d4], 0
jmp 0x42690b
mov dword [ebp - 0x3d4], 1
mov eax, dword [ebp - 0x3d4]
sub eax, dword [ebp - 0x120]
cmp eax, 0x6468
jne 0x42692a
mov dword [ebp - 0x3e4], 1
jmp 0x426931
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3dc]
add eax, dword [ebp - 0x3e4]
je 0x42694b
mov dword [ebp - 0x4d8], 1
jmp 0x426952
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x3ec]
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3f4]
mov dword [ebp + eax*4 - 0x3ec], ecx
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x3f4], eax
jl 0x42698c
mov dword [ebp - 0x3fc], 1
jmp 0x426993
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x4e0], eax
jmp 0x42683f
jmp 0x426801
push 1
push 0x6c10
push 1
push 1
push dword [ebp - 0x1c]
push 0
call fcn.00411d75
add esp, 0x18
mov dword [ebp - 0x1a8], 0xfffffffc
mov dword [ebp - 0x5f0], 0x5c62e089
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x4f8], 0
mov dword [ebp - 0x4e8], 0x96bb6454
mov dword [ebp - 0x1a0], 0x5f03
mov dword [ebp - 0x510], 0x4c2e3979
mov dword [ebp - 0x3c], 0
jmp 0x426a17
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x426a2d
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1cc], 0x60477862
jmp 0x426a10
mov dword [ebp - 0x3c], 0
jmp 0x426a3d
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x426a53
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x5a0], 0xfffffffd
jmp 0x426a36
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1cc], 0
jmp 0x426a81
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1cc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1cc], 7
jg 0x426d18
mov dword [ebp - 0x5f8], 3
mov dword [ebp - 0x600], 0
mov dword [ebp - 0x500], 0xfffffff6
mov dword [ebp - 0x608], 0
mov dword [ebp - 0x190], 0xffffffff
mov dword [ebp - 0x610], 0
mov dword [ebp - 0x618], 1
mov dword [ebp - 0x620], 0
mov dword [ebp - 0xcc], 0x41ac3dc9
mov dword [ebp - 0x4f0], 0x77509cb0
mov dword [ebp - 0x628], 0xffffffff
mov dword [ebp - 0x630], 0xfffffffe
mov dword [ebp - 0x198], 0xfeb1ec6c
mov dword [ebp - 0x44], 0
jmp 0x426b27
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x426b3d
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x638], 1
jmp 0x426b20
mov dword [ebp - 0x44], 0
jmp 0x426b4d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x426b63
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x5b8], 0xfffffff9
jmp 0x426b46
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5b8]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x5b8], eax
mov dword [ebp - 0xcc], 0
jmp 0x426b95
cmp dword [ebp - 0xcc], 2
jg 0x426d13
mov dword [ebp - 0x128], 0
jmp 0x426bbb
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jge 0x426bd7
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x6c0], 0xb09c821f
jmp 0x426bae
mov dword [ebp - 0x4e8], 0x71081b2
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5a0]
cmp dword [ebp - 0x4f0], eax
jl 0x426c01
mov dword [ebp - 0x404], 1
jmp 0x426c08
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x404], eax
je 0x426c22
mov dword [ebp - 0x40c], 1
jmp 0x426c29
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0xcc]
push 4
pop ecx
shl ecx, 1
mov edx, dword [ebp - 0x40c]
sub edx, dword [ebp + ecx - 0x5b8]
add edx, dword [ebp - 0x4f8]
cmp dword [ebp + eax*4 - 0x5a0], edx
jl 0x426c5c
jmp 0x426a66
cmp dword [ebp - 0x1a0], 0
jne 0x426d33
mov eax, 0x47e08a84
test eax, eax
jne 0x426d33
and dword [ebp - 0x508], 0
jmp 0x426d3d
mov dword [ebp - 0x508], 1
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x5a0], 0xfffb
cmp eax, dword [ebp - 0x1a0]
jle 0x426d62
mov dword [ebp - 0x1fc], 1
jmp 0x426d69
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x510]
cmp dword [ebp - 0x1fc], eax
jge 0x426d83
mov dword [ebp - 0x518], 1
jmp 0x426d8a
and dword [ebp - 0x518], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1cc]
mov dword [ebp - 0x640], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5a0]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x530]
sub eax, dword [ebp - 0x1a8]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1cc], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x426e1f
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x130]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x204], ecx
jne 0x426df0
xor eax, eax
jmp 0x42702a
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x204]
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 0
jne 0x426e15
xor eax, eax
jmp 0x42702a
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x10], 1
mov dword [ebp - 0xb4], 8
mov dword [ebp - 0xa8], 0x1654
mov dword [ebp - 0x5c8], 0xf90350d8
mov dword [ebp - 0x5c4], 0xf90350d8
mov dword [ebp - 0x5c0], 0xf90350d8
mov dword [ebp - 0x5bc], 0xf90350d8
mov dword [ebp - 0xb4], 0
jmp 0x426e74
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 7
jle 0x427009
mov dword [ebp - 0xa4], 0xc34eea2a
cmp dword [ebp - 0xb4], 0
jne 0x426f1b
cmp dword [ebp - 0xa4], 0
je 0x426eb6
cmp dword [ebp - 0xa4], 0
je 0x426eb6
mov dword [ebp - 0x21c], 1
jmp 0x426ebd
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], eax
jl 0x426ed7
mov dword [ebp - 0x20c], 1
jmp 0x426ede
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x20c]
jl 0x426ef8
mov dword [ebp - 0x214], 1
jmp 0x426eff
and dword [ebp - 0x214], 0
cmp dword [ebp - 0x214], 0
jg 0x426f14
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0xa4], 0
je 0x426ff2
mov dword [ebp - 0xe0], 0
jmp 0x426f4d
cmp dword [ebp - 0xe0], 1
jge 0x426f69
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x22c], 0x54c97515
jmp 0x426f40
mov dword [ebp - 0xa8], 0
jmp 0x426f82
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x427004
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x426e67
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x10], 0
je 0x42701d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x234], eax
jmp 0x427024
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x234]
mov esp, ebp
pop ebp
ret