Function at 0x40153c
Capabilities:
Allocate or change rwx memory
Get disk size
Get file attributes
Get file size
Log keystrokes via polling
Query environment variable
Terminate process

Disassembly:
push 8
push 0x8000
mov dword [0x43fc34], eax
push 0xf00
push 0
call sub.kernel32.dll_VirtualAlloc
mov edx, dword [0x43fc08]
sub eax, edi
cmp dword [0x43fa18], 0x3c
je 0x401584
mov edi, dword [0x43fd20]
mov eax, dword [0x43fc14]
mov cx, 2
mov di, 0x69
mov dword [0x43fa58], ecx
mov edx, dword [0x43fa84]
mov eax, dword [0x43fa1c]
call sub.kernel32.dll_GetProcessHeap
mov ecx, dword [0x43fc70]
sub eax, eax
cmp dword [0x43fc84], 0xbf
ja 0x4015c5
mov dword [0x43fa18], eax
mov edi, dword [0x43f9f4]
or eax, esi
xor edx, dword [0x43f9d8]
mov dword [0x43fb00], eax
mov dword [0x43fb5c], edx
mov dword [0x43fce0], eax
mov dword [0x43fb98], eax
push dword [0x43fc8c]
call sub.GDI32.DLL_GetTextAlign
mov eax, dword [0x43f998]
mov cx, 1
mov eax, dword [0x43fd44]
cmp eax, dword [0x43f998]
jg 0x401609
mov ecx, dword [0x43f99c]
mov eax, dword [0x43fd34]
sub eax, eax
xor ecx, eax
mov dword [0x43fb24], eax
mov dword [0x43fc08], eax
mov eax, dword [0x43fb40]
push 2
call sub.GDI32.DLL_GetBkColor
mov esi, dword [0x43fd90]
and edx, eax
cmp eax, esi
jb 0x40163a
mov esi, dword [0x43f9a0]
add eax, esi
mov eax, 2
mov dword [0x43faf0], edi
mov dword [0x43fc20], eax
mov dword [0x43fc3c], esi
mov dword [0x43fa88], eax
push eax
call sub.GDI32.DLL_GetBkColor
mov eax, dword [0x43fd8c]
add eax, edx
mov edi, dword [0x43f998]
mov edi, 4
cmp dword [0x43f998], eax
jb 0x40167a
mov eax, dword [0x43fb18]
mov ax, 0xce
add eax, ecx
mov dword [0x43fa94], edi
mov dword [0x43fa08], eax
mov dword [0x43fc1c], eax
mov dword [0x43fd2c], eax
push ecx
call sub.GDI32.DLL_GetTextAlign
mov esi, dword [0x43fd70]
add eax, esi
mov eax, dword [0x43faf0]
cmp edx, ecx
jg 0x4016b9
mov eax, dword [0x43f9d4]
mov eax, dword [0x43fc70]
mov eax, 0x20
mov ax, 0x1f
mov dword [0x43fa60], edi
mov dword [0x43fc28], eax
mov eax, dword [0x43f9ec]
mov dword [0x43f998], eax
sbb dword [0x43fb50], eax
push edx
call sub.GDI32.DLL_GetBkColor
sub eax, dword [0x43f998]
sub edi, eax
add eax, dword [0x43fa4c]
mov eax, 8
cmp dword [0x43fb38], 0xa8
ja 0x401708
mov dword [0x43fadc], edx
mov eax, dword [0x43fcdc]
or edx, dword [0x43fb3c]
mov si, 0xc3
mov dword [0x43fb88], eax
mov dword [0x43fc64], eax
call sub.kernel32.dll_GetProcessHeap
mov eax, dword [0x43fabc]
mov ax, 0x10
add edi, edi
cmp eax, ecx
jae 0x40173f
mov dword [0x43fb54], esi
mov eax, dword [0x43fb38]
sub edi, eax
mov ecx, dword [0x43fc80]
mov ecx, 1
mov dword [0x43f998], edi
mov dword [0x43fa70], eax
mov esi, dword [0x43fc30]
push dword [0x43fcf4]
call sub.GDI32.DLL_GetTextAlign
mov esi, dword [0x43fa04]
sub edx, eax
mov esi, dword [0x43f9d4]
test ecx, ecx
jg 0x401780
mov dword [0x43f9cc], ecx
mov edx, dword [0x43fd40]
add eax, eax
mov esi, dword [0x43fb3c]
mov dx, 0x95
mov dword [0x43fcf8], esi
mov dword [0x43f9e4], eax
mov dword [0x43fce4], eax
call sub.kernel32.dll_GetProcessHeap
mov eax, dword [0x43fadc]
mov esi, 4
mov eax, dword [0x43fb5c]
mov ecx, 0x84
cmp eax, dword [0x43fb20]
je 0x4017d2
mov edi, dword [0x43fbe4]
mov ax, 0x10
mov ecx, dword [0x43fa88]
mov dword [0x43fc14], ecx
mov dword [0x43f9c0], esi
mov edi, dword [0x43fc3c]
mov eax, dword [0x43fae0]
push 4
push 0x2000
push 0xa00
push 0
call sub.kernel32.dll_VirtualAlloc
mov eax, dword [0x43fd90]
mov ecx, 0xee
add esi, eax
test eax, eax
jb 0x40180f
mov dword [0x43fd18], esi
mov eax, dword [0x43f9f0]
mov eax, 0x8e
mov eax, dword [0x43fad8]
mov dword [0x43fb0c], eax
mov eax, dword [0x43f998]
push ecx
call sub.user32.dll_GetMenu
mov esi, dword [0x43fa70]
add esi, eax
mov eax, dword [0x43fb7c]
add edi, eax
cmp edi, eax
jb 0x401857
mov dword [0x43fc58], edi
mov dword [0x43fc5c], eax
mov edx, dword [0x43fb24]
mov ax, 0x20
mov edi, 0x80
mov dword [0x43fb90], eax
mov dword [0x43fc10], ecx
mov eax, dword [0x43fcfc]
mov eax, dword [0x43fd58]
push 0x40
call sub.GDI32.DLL_GetBkColor
mov eax, dword [0x43fb20]
sub eax, esi
mov eax, dword [0x43fd64]
mov ax, 1
cmp eax, dword [0x43fc3c]
jl 0x401890
mov dword [0x43f9cc], eax
add edi, dword [0x43fadc]
add edx, eax
sub eax, esi
mov dword [0x43fa1c], edi
add esi, eax
push esi
call sub.GDI32.DLL_GetTextAlign
mov eax, dword [0x43fcbc]
sub edx, eax
cmp eax, eax
jb 0x4018be
mov dword [0x43fa0c], edi
mov edi, dword [0x43fc1c]
mov edx, dword [0x43fd6c]
sub eax, edx
add ecx, eax
mov dword [0x43f9e0], eax
mov dword [0x43fb08], eax
mov ecx, dword [0x43fc64]
sub eax, eax
cmp dword [0x43fb44], eax
je 0x4018f6
mov edi, dword [0x43fc08]
mov cx, 0x40
mov eax, dword [0x43f998]
add eax, eax
mov dword [0x43f998], ecx
mov dword [0x43fad8], esi
mov dword [0x43fad0], ecx
push 0x8c
push dword fs:[0x30]
call sub.kernel32.dll_GetProcessHeap
or ecx, dword [0x43f998]
add eax, eax
mov eax, 4
cmp edi, 1
jb 0x401936
mov edx, dword [0x43fbcc]
mov ecx, dword [0x43fc68]
sub edx, esi
mov di, 0xe9
mov dword [0x43f9dc], eax
and ecx, dword [0x43f9b4]
mov dword [0x43fca8], ecx
mov esi, dword [0x43fc64]
push esi
call sub.user32.dll_GetMenu
mov eax, dword [0x43fa30]
mov ecx, 0x10
mov eax, dword [0x43fa74]
test eax, eax
jb 0x40197f
mov edi, dword [0x43fb5c]
mov ecx, dword [0x43fd58]
add esi, edi
adc eax, dword [0x43fd5c]
mov dword [0x43fa70], ecx
mov dword [0x43fc74], eax
mov dword [0x43fbf8], eax
or eax, dword [0x43fc14]
push eax
call sub.GDI32.DLL_GetBkColor
mov eax, dword [0x43fcc4]
and eax, eax
cmp ecx, 0
je 0x4019bc
mov esi, dword [0x43fd50]
mov eax, dword [0x43fa24]
mov eax, dword [0x43fd44]
add eax, eax
mov eax, dword [0x43fd64]
sub eax, eax
mov dword [0x43fcb4], edi
mov dword [0x43fa04], edx
mov edi, dword [0x43f9d8]
push 2
push 0x4000
mov dword [0x43fc3c], eax
push 0x200
push 0
call sub.kernel32.dll_VirtualAlloc
mov ecx, dword [0x43f9c0]
mov di, 0x81
mov esi, dword [0x43fd50]
cmp dword [0x43fa60], eax
ja 0x401a0c
mov esi, dword [0x43fc20]
sub eax, eax
mov edi, dword [0x43fc78]
mov dword [0x43fb84], edi
mov dword [0x43fb54], edi
mov edx, dword [0x43fa98]
mov eax, dword [0x43fd8c]
call sub.kernel32.dll_GetProcessHeap
mov eax, dword [0x43fab4]
mov edx, 2
add edx, edi
cmp esi, dword [0x43fadc]
ja 0x401a51
mov dword [0x43fbc0], esi
mov eax, dword [0x43f9e0]
mov ax, 0x40
mov ecx, dword [0x43f9dc]
add ecx, edx
mov dword [0x43fd14], eax
mov dword [0x43fa8c], eax
mov dword [0x43fc80], eax
mov dword [0x43f9c4], ecx
push 8
push 0x8000
push 0x500
push 0
call sub.kernel32.dll_VirtualAlloc
mov edi, dword [0x43fa2c]
sub ecx, eax
mov edx, dword [0x43fcd0]
cmp eax, 1
je 0x401ab0
mov dword [0x43fbb8], edx
mov eax, dword [0x43f998]
mov di, 0x40
mov edx, dword [0x43fd38]
add ecx, eax
mov dword [0x43fa54], eax
mov dword [0x43fc14], edx
mov dword [0x43f9f8], esi
mov ecx, dword [0x43fc30]
mov edi, dword [0x43fa74]
mov dword [0x43fd10], eax
push dword [0x43fa94]
call sub.user32.dll_GetMenu
mov eax, dword [0x43fd6c]
add esi, eax
mov eax, dword [0x43fd64]
add edx, edi
test eax, eax
ja 0x401af4
mov eax, dword [0x43fad8]
xor eax, dword [0x43faa4]
add ecx, eax
mov eax, dword [0x43fa74]
mov dword [0x43fb88], eax
mov dword [0x43f9ec], eax
mov eax, dword [0x43fd28]
mov dword [0x43fd40], edx
push edi
call sub.user32.dll_GetMenu
mov eax, dword [0x43fa48]
sub esi, eax
add eax, eax
cmp dword [0x43f9bc], 0x40
jae 0x401b32
mov eax, dword [0x43fa4c]
mov ecx, 0x7e
mov eax, dword [0x43fb1c]
sub esi, eax
mov dword [0x43fb44], eax
mov eax, dword [0x43fbc8]
mov eax, dword [0x43fb44]
push 4
push 0x4000
push 0x700
sub dword [0x43fb08], esi
push 0
call sub.kernel32.dll_VirtualAlloc
mov edx, dword [0x43fc50]
sub eax, ecx
mov eax, dword [0x43fc28]
sub edi, esi
cmp eax, 1
jb 0x401b84
mov eax, dword [0x43fd10]
mov edx, 0x20
mov dword [0x43fd64], esi
mov dword [0x43fd24], eax
mov dword [0x43fa30], eax
mov dword [0x43fae0], esi
mov eax, dword [0x43f99c]
sub eax, eax
push eax
call sub.GDI32.DLL_GetTextAlign
mov edi, dword [0x43fa2c]
add edx, ecx
add edx, eax
cmp eax, dword [0x43fa48]
jg 0x401bc4
mov eax, dword [0x43faa4]
mov eax, dword [0x43fc7c]
add ecx, edi
mov eax, dword [0x43fcdc]
mov ax, 4
mov dword [0x43fd8c], edi
mov dword [0x43fce0], edi
mov dword [0x43faf8], esi
mov esi, dword [0x43fb64]
push esi
call sub.GDI32.DLL_GetTextAlign
mov eax, dword [0x43fcf8]
xor esi, eax
mov ax, 4
cmp dword [0x43fd60], eax
jl 0x401c08
mov dword [0x43fbdc], eax
mov dword [0x43fae0], eax
or edi, dword [0x43fa7c]
add eax, eax
sub eax, eax
mov dword [0x43fb94], eax
mov dword [0x43fc34], edx
and ecx, dword [0x43fc00]
push 2
push 0x4000
mov dword [0x43f9bc], eax
push 0x900
push 0
call sub.kernel32.dll_VirtualAlloc
mov eax, dword [0x43fbe4]
mov ax, 0x40
cmp dword [0x43faac], eax
jl 0x401c5f
mov ecx, dword [0x43fc44]
mov esi, dword [0x43fc0c]
mov di, 0x20
mov esi, dword [0x43f998]
add edx, eax
mov dword [0x43f9cc], edi
mov dword [0x43fa34], eax
mov dword [0x43fba0], eax
mov dword [0x43fd34], eax
call sub.kernel32.dll_IsBadHugeReadPtr
cmp eax, 0
je 0x40226b
mov dword [0x43fa20], eax
push dword [0x43f998]
push dword [0x43f9f8]
push 0x78
sub eax, eax
push eax
call sub.user32.dll_GetKeyNameTextA
mov dword [0x43fa7c], eax
push dword [0x43f998]
push dword [0x43f998]
mov ecx, dword [0x43fd70]
add ecx, edi
push ecx
push edi
call sub.GDI32.DLL_SaveDC
mov edi, dword [0x43fca4]
sub eax, esi
mov edx, dword [0x43f9cc]
mov eax, 0xbe
test eax, eax
jae 0x401ce0
mov dword [0x43f9f8], edi
mov esi, dword [0x43fb18]
mov eax, 0xa8
mov dword [0x43fb8c], eax
mov esi, dword [0x43f9e4]
call sub.GDI32.DLL_SetPixel
mov edi, dword [0x43fa28]
mov ax, 0x84
sub esi, esi
test eax, eax
jbe 0x401d15
mov dword [0x43fbdc], ecx
and ecx, dword [0x43fa94]
mov eax, dword [0x43fb0c]
sub eax, eax
add eax, ecx
mov dword [0x43fb74], eax
mov esi, dword [0x43fb00]
call sub.kernel32.dll_GetFileType
mov edx, dword [0x43fc48]
mov edx, 0x10
cmp esi, 1
jae 0x401d4f
mov eax, dword [0x43fa18]
mov edx, dword [0x43fb98]
add edx, eax
mov eax, dword [0x43f9c4]
add eax, eax
mov dword [0x43fd60], eax
mov dword [0x43f9c8], esi
mov edi, dword [0x43fa14]
mov eax, dword [0x43f998]
mov eax, dword [0x43fbdc]
call sub.kernel32.dll_GetFileSize
push esi
push edx
sub eax, esi
push eax
mov di, 0x80
push edi
call sub.user32.dll_GetKeyState
mov ecx, dword [0x43fcf0]
sub ecx, esi
mov di, 0xe6
cmp esi, eax
ja 0x401da5
sub eax, dword [0x43fbac]
mov eax, dword [0x43fce0]
mov eax, dword [0x43fb44]
sub eax, ecx
mov edx, dword [0x43fc78]
mov dword [0x43fc50], eax
mov dword [0x43fc70], eax
mov dword [0x43fb8c], edx
or dword [0x43fbb0], eax
push esi
sub dword [0x43fa5c], 0xab
push 0x40
push dword [0x43fd1c]
push edi
call sub.user32.dll_GetFocus
push dword [0x43fa58]
mov eax, dword [0x43f998]
push eax
call sub.kernel32.dll_GetFullPathNameA
call sub.kernel32.dll_GetFileType
push eax
call sub.user32.dll_GetIconInfo
mov esi, dword [0x43fb18]
sub esi, edi
mov eax, dword [0x43fd3c]
cmp ecx, edi
jb 0x401e17
mov eax, dword [0x43fc3c]
mov eax, dword [0x43fbf4]
mov eax, 4
mov dword [0x43f9a4], edx
mov dword [0x43fa1c], edx
mov dword [0x43fbac], eax
mov edi, dword [0x43f998]
or dword [0x43fa48], edx
push dword [0x43fba4]
mov dx, 0x26
push edx
push edx
call sub.user32.dll_GetForegroundWindow
mov eax, 4
push eax
mov eax, dword [0x43fd28]
push eax
push 0x10
call sub.kernel32.dll_GetFileAttributesA
call sub.kernel32.dll_GetDiskFreeSpaceA
mov eax, dword [0x43fb54]
sub ecx, eax
mov eax, dword [0x43f9e8]
test ecx, ecx
jae 0x401e75
mov dword [0x43fa0c], eax
mov dword [0x43fc54], edi
mov eax, dword [0x43fb20]
mov ecx, 1
mov eax, dword [0x43fcc8]
mov dword [0x43fba8], eax
mov esi, dword [0x43fb40]
mov dword [0x43f998], eax
push eax
mov dword [0x43fc10], eax
push dword [0x43fc78]
push edi
push dword [0x43fbc4]
call sub.user32.dll_GetForegroundWindow
push edx
call sub.kernel32.dll_GetFileType
call sub.user32.dll_GetFocus
call sub.GDI32.DLL_SaveDC
mov eax, dword [0x43fc48]
add eax, eax
push eax
mov edx, dword [0x43fb88]
push edx
call sub.kernel32.dll_GetFullPathNameA
mov esi, dword [0x43fb84]
sub eax, eax
mov edx, dword [0x43f9cc]
mov si, 0xc
cmp dword [0x43fcc4], 1
je 0x401f01
mov dword [0x43fa2c], ecx
mov edx, dword [0x43fa60]
mov ax, 2
mov edi, dword [0x43fce0]
add edx, eax
sbb dword [0x43faf8], edx
mov dword [0x43fcd8], edi
mov dword [0x43fae0], esi
mov eax, dword [0x43fd20]
mov dword [0x43fb64], eax
push ecx
call sub.user32.dll_GetDlgItem
push eax
push 0xb0
push dword [0x43fd7c]
push 8
call sub.kernel32.dll_GetEnvironmentStrings
mov edx, dword [0x43f998]
add esi, eax
mov ax, 0xfc
cmp dword [0x43fd64], 0x15
jne 0x401f63
mov edi, dword [0x43fa20]
mov edx, dword [0x43fb7c]
add edx, eax
mov esi, dword [0x43f998]
mov dword [0x43fd1c], ecx
mov dword [0x43fa14], eax
mov dword [0x43f9a4], eax
mov esi, dword [0x43fb14]
mov dword [0x43fd18], eax
push esi
push esi
push dword [0x43fbe8]
call sub.user32.dll_GetKeyState
push dword [0x43fa1c]
push ecx
push 0x20
mov eax, dword [0x43fb0c]
push eax
call sub.kernel32.dll_GetFileSize
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
push 0x40
call sub.kernel32.dll_GetFileType
call sub.GDI32.DLL_SelectObject
call sub.kernel32.dll_GetFileType
push dword [0x43f998]
call sub.user32.dll_GetForegroundWindow
push edi
push 0x40
push dword [0x43fce4]
call sub.kernel32.dll_GetDiskFreeSpaceA
call sub.user32.dll_GetIconInfo
mov eax, dword [0x43fcd8]
add edx, ecx
mov eax, dword [0x43fa98]
cmp dword [0x43fb3c], 0x10
ja 0x401ff9
mov dword [0x43fa34], edi
mov esi, dword [0x43f9fc]
sub eax, esi
mov ecx, dword [0x43fc14]
mov dword [0x43f9dc], edx
mov eax, dword [0x43fa50]
mov dword [0x43fa90], edx
mov eax, dword [0x43fd88]
call sub.kernel32.dll_GetFileSize
mov dword [0x43fd14], esi
push 0x80
call sub.kernel32.dll_GetEnvironmentStrings
push dword [0x43fd70]
push edx
push dword [0x43fbf4]
call sub.user32.dll_GetDlgItem
mov edi, dword [0x43f998]
mov edi, 0x40
mov ecx, dword [0x43fcf8]
mov si, 0x20
cmp eax, 1
jne 0x402054
mov eax, dword [0x43fa18]
mov eax, 8
mov dword [0x43f998], ecx
mov dword [0x43f998], eax
mov eax, dword [0x43fc3c]
call sub.GDI32.DLL_SelectObject
call sub.user32.dll_GetForegroundWindow
mov esi, dword [0x43fb4c]
mov di, 0xb6
sub eax, eax
cmp dword [0x43fc1c], 0x40
jl 0x40208a
mov edx, dword [0x43fc70]
add ecx, edx
mov dword [0x43fd54], eax
mov dword [0x43f9a8], eax
mov dword [0x43fb14], esi
call sub.kernel32.dll_GetFullPathNameA
call sub.user32.dll_GetDlgItem
push dword [0x43fa44]
call sub.GDI32.DLL_RestoreDC
add eax, esi
push eax
mov edi, dword [0x43faa4]
push edi
call sub.GDI32.DLL_RestoreDC
mov esi, dword [0x43fa64]
sub esi, eax
mov eax, dword [0x43fab8]
cmp dword [0x43fbdc], eax
jb 0x4020e6
mov eax, dword [0x43fd88]
mov si, 0xa9
sub esi, eax
mov dword [0x43fa7c], edx
mov esi, dword [0x43fc3c]
mov dword [0x43f998], ecx
mov eax, dword [0x43fd74]
mov dword [0x43fcac], eax
push 1
push eax
call sub.GDI32.DLL_SaveDC
mov eax, dword [0x43f998]
sub eax, eax
add eax, eax
cmp edx, 0
jg 0x402125
mov dword [0x43f998], eax
mov eax, dword [0x43f9d0]
mov edx, dword [0x43fbc4]
mov di, 0xf3
mov edi, dword [0x43fa64]
mov dword [0x43fa4c], eax
mov dword [0x43fd94], edi
push edi
push ecx
mov dword [0x43fb44], eax
push 0x20
push edi
call sub.kernel32.dll_GetFullPathNameA
push esi
mov ecx, dword [0x43fa4c]
push ecx
push dword [0x43fc24]
call sub.kernel32.dll_GetFullPathNameA
mov cx, 0x28
push ecx
call sub.kernel32.dll_GetFileSize
push edi
sub esi, eax
push esi
mov edx, dword [0x43fc5c]
push edx
push ecx
call sub.kernel32.dll_GetFileAttributesA
mov ax, 0x40
push eax
push dword [0x43fc6c]
sub eax, edi
push eax
push 8
call sub.kernel32.dll_GetFullPathNameA
mov eax, dword [0x43fbd4]
push eax
call sub.user32.dll_GetIconInfo
sub ecx, eax
push ecx
push edx
push dword [0x43fc70]
push eax
call sub.user32.dll_GetForegroundWindow
mov ecx, dword [0x43fc1c]
mov ax, 8
sub eax, dword [0x43fd3c]
test ecx, ecx
jbe 0x4021c5
mov edi, dword [0x43f9f8]
mov edi, dword [0x43fc24]
add ecx, edi
mov eax, 0x5a
mov dword [0x43fa7c], edi
mov eax, dword [0x43f9c8]
push ecx
call sub.kernel32.dll_GetFileSize
mov edx, dword [0x43fa9c]
sub eax, edi
mov esi, dword [0x43fa64]
mov ecx, 0x40
cmp eax, 1
jl 0x40220f
mov dword [0x43fadc], eax
mov dword [0x43fb20], eax
mov edx, dword [0x43fc70]
add eax, esi
mov ax, 0x18
mov dword [0x43fbb4], edi
mov dword [0x43fa70], esi
mov eax, dword [0x43fc28]
or dword [0x43f998], 0x55555555
push eax
push eax
push eax
call sub.user32.dll_GetIconInfo
push dword [0x43fd84]
push edx
mov dword [0x43fbb8], edx
push dword [0x43fb7c]
push 0x20
call sub.kernel32.dll_GetEnvironmentStrings
mov edx, dword [0x43fa24]
mov dx, 0x10
push edx
push dword [0x43fc4c]
mov eax, dword [0x43fcf8]
push eax
call sub.kernel32.dll_GetFileType
push edi
push eax
push 0x80
call sub.kernel32.dll_GetFileAttributesA
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [0x43fa68]
mov eax, 0x20
mov eax, dword [0x43fd8c]
cmp ecx, 1
jbe 0x40229b
mov eax, dword [0x43fa28]
mov eax, dword [0x43fc20]
mov di, 1
add edx, esi
mov dword [0x43fd00], eax
mov edi, dword [0x43fc38]
mov eax, dword [0x43fa14]
mov ecx, dword [0x43faa4]
push ecx
call sub.GDI32.DLL_GetBkColor
mov edx, dword [0x43fb2c]
mov eax, 0x82
add esi, edi
cmp eax, esi
jbe 0x4022e8
mov dword [0x43fc40], eax
mov esi, dword [0x43fc94]
sub esi, dword [0x43fd94]
mov ecx, 4
mov edx, dword [0x43f9dc]
mov ax, 0x8f
mov dword [0x43fce0], eax
mov edi, dword [0x43fa58]
mov dword [0x43fc20], edx
mov eax, dword [0x43fd38]
add eax, eax
push eax
call sub.GDI32.DLL_GetBkColor
mov eax, dword [0x43fd20]
add eax, esi
mov edi, dword [0x43fc10]
cmp eax, eax
jae 0x40232f
mov dword [0x43fbd8], edi
mov edx, dword [0x43fb40]
mov eax, dword [0x43fc14]
sub eax, eax
mov edi, dword [0x43fa20]
mov dword [0x43facc], eax
mov dword [0x43fc54], eax
mov eax, dword [0x43fb08]
sub eax, edi
mov esi, dword [0x43fa04]
cmp dword [0x43f998], eax
jb 0x402354
mov eax, dword [0x43fb6c]
xor esi, esi
mov ax, 0x49
mov dword [0x43fc80], eax
mov eax, dword [0x43fcb4]
call fcn.00402b10
mov edi, dword [0x43fa00]
mov eax, 0x78
test eax, eax
jb 0x40238c
mov eax, dword [0x43f9f0]
mov eax, 0x80
mov eax, dword [0x43fabc]
mov dword [0x43fb7c], esi
mov dword [0x43fc5c], eax
mov dword [0x43fc6c], eax
mov edx, dword [0x43fb38]
call sub.kernel32.dll_GetProcessHeap
call fcn.0040147c
mov cx, 0x9e
push ecx
call sub.GDI32.DLL_GetBkColor
mov esi, dword [0x43fa58]
sub eax, eax
mov esi, dword [0x43f9f0]
sub eax, eax
cmp eax, 1
ja 0x4023ed
mov dword [0x43fd34], edi
mov dword [0x43fb94], esi
mov esi, dword [0x43fcd0]
sub edi, esi
mov edx, dword [0x43fa24]
sub eax, eax
mov dword [0x43fb8c], ecx
mov dword [0x43fa1c], eax
mov dword [0x43f998], edi
mov eax, dword [0x43faf4]
mov dword [0x43fcd8], eax
call fcn.004039e8
or esi, dword [0x43fab8]
push esi
call sub.GDI32.DLL_GetBkColor
mov ecx, dword [0x43fad0]
mov ax, 0x7a
mov eax, dword [0x43fb38]
mov eax, 0x40
cmp eax, edi
jae 0x40243c
mov dword [0x43fad8], eax
mov dword [0x43fc44], ecx
mov esi, dword [0x43fc10]
sub eax, edi
mov eax, dword [0x43fb88]
mov di, 0xcf
mov dword [0x43fc80], eax
mov eax, dword [0x43fa08]
mov esi, dword [0x43fc00]
call fcn.00401388
mov edx, dword [0x43fd54]
mov eax, 4
sub eax, dword [0x43f998]
cmp eax, dword [0x43fccc]
ja 0x402479
mov esi, dword [0x43f9d4]
mov eax, dword [0x43fb8c]
mov si, 0x40
mov dword [0x43fb18], eax
call sub.kernel32.dll_GetProcessHeap
call fcn.004032ec
sbb eax, dword [0x43f998]
mov ax, 0xe7
mov ecx, dword [0x43fbb8]
add eax, edi
cmp esi, 1
jg 0x4024ba
mov dword [0x43fa0c], eax
mov dword [0x43fce8], edi
mov eax, dword [0x43fbc4]
sub esi, eax
add edx, edi
add dword [0x43fca4], edx
mov edx, dword [0x43fd08]
mov edi, dword [0x43fc54]
push 0xe
call sub.GDI32.DLL_GetTextAlign
mov eax, dword [0x43f998]
sub eax, ecx
cmp esi, 0
jg 0x4024f3
mov eax, dword [0x43fa00]
mov ecx, 0x10
mov edi, dword [0x43fa2c]
mov eax, 0x80
mov dword [0x43fc0c], eax
mov dword [0x43fad8], esi
mov dword [0x43fb2c], eax
call fcn.0040109c
mov eax, dword [0x43fcf8]
sub esi, eax
cmp ecx, ecx
je 0x40252f
mov edx, dword [0x43fd4c]
mov edi, dword [0x43fcdc]
or edx, eax
mov eax, dword [0x43fd7c]
mov dword [0x43f9b8], eax
mov dword [0x43fa90], eax
mov eax, dword [0x43f998]
mov dword [0x43f998], eax
call sub.kernel32.dll_GetProcessHeap
mov edx, dword [0x43fbb0]
sub eax, ecx
add edx, ecx
cmp eax, eax
jg 0x40256a
mov dword [0x43fbf4], edx
mov eax, dword [0x43fc68]
xor eax, ecx
mov eax, dword [0x43fb4c]
mov dword [0x43fd14], eax
sbb dword [0x43fc70], eax
mov eax, dword [0x43fcf4]
mov dword [0x43fcd4], edi
mov ecx, dword [0x43fbe4]
mov eax, dword [0x43f998]
call fcn.00402b10
call fcn.00402c90
call fcn.00403754
mov edx, dword [0x43fd48]
sub eax, eax
xor ecx, dword [0x43fbc4]
mov ax, 0x40
cmp ecx, dword [0x43f9e8]
jl 0x4025cd
mov ecx, dword [0x43fd88]
mov esi, dword [0x43fc64]
mov eax, dword [0x43fa10]
sub esi, eax
mov ax, 0xe0
mov dword [0x43fbc0], edi
mov dword [0x43f9e4], ecx
mov dword [0x43fb7c], esi
mov dword [0x43f9e8], edx
mov edi, dword [0x43fd18]
mov eax, dword [0x43fca8]
add eax, ecx
mov edi, dword [0x43fd64]
mov ax, 0x2e
cmp eax, dword [0x43fcc4]
jge 0x402606
mov ecx, dword [0x43fabc]
add eax, eax
mov edi, dword [0x43fbcc]
add edi, ecx
mov dword [0x43fc70], eax
mov eax, dword [0x43fba8]
mov edx, dword [0x43faa4]
call fcn.00402b10
mov edx, dword [0x43fa4c]
mov ecx, 0x6f
mov eax, dword [0x43f99c]
cmp dword [0x43fcf0], eax
jne 0x402650
mov dword [0x43fa0c], edi
mov edi, dword [0x43fc58]
mov eax, 0xa4
mov eax, dword [0x43fa4c]
mov dword [0x43fc40], edx
mov dword [0x43f998], edi
mov eax, dword [0x43fd44]
push eax
call sub.GDI32.DLL_GetBkColor
call fcn.00403754
mov edx, dword [0x43fd3c]
mov ax, 0xde
mov edx, dword [0x43fc00]
mov ecx, 0x87
cmp dword [0x43f9d4], 0x20
jae 0x402697
mov eax, dword [0x43f9e0]
add edi, esi
mov eax, 0x1d
mov dword [0x43fa40], esi
mov dword [0x43f998], ecx
add eax, dword [0x43facc]
mov dword [0x43fd58], eax
mov dword [0x43fd00], edx
mov esi, dword [0x43f9e8]
add esi, eax
push esi
call sub.user32.dll_GetMenu
mov eax, dword [0x43fc78]
mov edi, 0xfc
cmp dword [0x43fb98], eax
jl 0x4026d5
mov dword [0x43fcd4], ecx
mov eax, dword [0x43fa68]
sub edx, eax
mov dword [0x43fcf4], edi
call fcn.00403754
mov esi, dword [0x43fb6c]
mov edi, 0x20
mov eax, dword [0x43fcb4]
cmp dword [0x43f9a4], eax
jne 0x402715
mov dword [0x43f9b8], edx
mov esi, dword [0x43f998]
mov eax, dword [0x43fa0c]
add eax, ecx
mov dword [0x43fa90], ecx
mov dword [0x43fa20], eax
mov eax, dword [0x43fbc4]
mov dword [0x43fd3c], eax
mov eax, dword [0x43fc34]
ret