Function at 0x414543
Capabilities:
Compare security identifiers
Log keystrokes via polling
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x204
push ebx
push esi
push edi
xor eax, eax
mov dword [esp + 0xd4], edx
xor edi, edi
mov dword [esp + 0xd0], ecx
mov dword [esp + 0xc], eax
inc edi
jmp 0x41457e
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x98], 0x4fd3df75
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x41456b
mov dword [esp + 0x98], 7
jmp 0x4145ce
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], eax
jmp 0x4145ae
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0xe4], 0xfffffffb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x41459b
mov dword [esp + 0x14], 0xa4f402e3
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xe4], ecx
dec dword [esp + 0x98]
cmp dword [esp + 0x98], 0xfffffff1
jge 0x414591
mov dword [esp + 0x28], 0xad386cce
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x1c], 9
mov dword [esp + 0xc], eax
jmp 0x414609
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x1e8], 0xd53b
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x4145f6
mov esi, dword [esp + 0x28]
mov edx, 0x4bcd
mov dword [esp + 0x1e8], esi
xor ebx, ebx
mov ecx, dword [esp + 0x14]
sub edx, ecx
add edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
cmp edx, ecx
setge bl
xor edx, edx
add ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
neg ecx
cmp ecx, ebx
setle dl
xor ecx, ecx
cmp esi, edx
setle cl
imul ecx, ecx, 0xddd9
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x2f], al
cmp byte [esp + 0x2f], al
je 0x414673
push eax
push eax
push eax
push eax
push eax
push eax
push 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 2
pop ebx
push ebx
lea ecx, [esp + 0x194]
call fcn.0040f233
mov dword [esp + 0x88], 0
jmp 0x4146ac
mov ecx, dword [esp + 0x88]
mov eax, dword [esp + 0x190]
mov dword [eax + ecx*4], 0x9b55bb2c
inc dword [esp + 0x88]
cmp dword [esp + 0x88], ebx
jl 0x414690
mov eax, dword [esp + 0x190]
lea ecx, [esp + 0x190]
push 0xfffffffffffffffd
pop esi
mov dword [eax + 4], esi
call fcn.0040f305
mov dword [esp + 0x28], edi
lea ecx, [esp + 0x160]
push 4
call fcn.0040f233
mov dword [esp + 0x60], 0xd5e48d32
mov dword [esp + 0x100], 0xb91359a7
mov dword [esp + 0xe8], 0xffffffff
mov dword [esp + 0x24], 0xa53e
mov dword [esp + 0x60], 0x12
jmp 0x41488e
lea ecx, [esp + 0x144]
call fcn.0040f233
mov dword [esp + 0x58], 0xee7d214c
mov dword [esp + 0xcc], 0xa737
mov dword [esp + 0xf0], 0xec53312a
mov dword [esp + 0x84], 0
jmp 0x414766
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 0x683c8fc5
inc dword [esp + 0x84]
cmp dword [esp + 0x84], edi
jl 0x41474a
mov dword [esp + 0x58], 0
cmp dword [esp + 0x58], 0
jl 0x41487e
mov dword [esp + 0x54], 8
lea ecx, [esp + 0x178]
mov dword [esp + 0xd8], 0
mov dword [esp + 0xdc], 7
push ebx
call fcn.0040f233
xor eax, eax
mov dword [esp + 0x94], eax
jmp 0x4147d0
mov edx, dword [esp + 0x94]
mov ecx, dword [esp + 0x178]
mov dword [ecx + edx*4], esi
inc dword [esp + 0x94]
cmp dword [esp + 0x94], ebx
jl 0x4147b8
mov dword [esp + 0x54], eax
jmp 0x41480d
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x140]
cmp dword [ecx + edx*4], eax
jne 0x414813
mov byte [esp + 0x4d], al
cmp byte [esp + 0x4d], 0
je 0x414809
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
xor eax, eax
inc dword [esp + 0x54]
cmp dword [esp + 0x54], eax
jle 0x4147df
lea eax, [esp + 0xe8]
push eax
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x184]
push eax
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0xf8]
push eax
lea edx, [esp + 0x100]
lea ecx, [esp + 0x78]
call fcn.004114b8
add esp, 0x24
lea ecx, [esp + 0x178]
call fcn.0040f305
dec dword [esp + 0x58]
jns 0x414782
lea ecx, [esp + 0x140]
call fcn.0040f305
inc dword [esp + 0x60]
cmp dword [esp + 0x60], 0x15
push edi
jne 0x414713
mov dword [esp + 0x68], 0x6e58d020
lea ecx, [esp + 0x1bc]
call fcn.0040f233
xor eax, eax
mov dword [esp + 0x3c], eax
jmp 0x4148cc
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x1b8]
mov dword [ecx + edx*4], 0x5b57fd54
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], edi
jl 0x4148b6
mov dword [esp + 0x3c], eax
jmp 0x4148eb
mov ecx, dword [esp + 0x3c]
mov dword [esp + ecx*4 + 0xc4], 0x4c506d44
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], ebx
jl 0x4148d8
mov dword [esp + 0xc8], eax
cmp dword [esp + 0xc8], eax
jl 0x41498c
mov dword [esp + 0xa4], 5
lea ecx, [esp + 0x154]
push edi
call fcn.0040f233
xor eax, eax
mov dword [esp + 0x9c], eax
jmp 0x414944
mov edx, dword [esp + 0x9c]
mov ecx, dword [esp + 0x154]
mov dword [ecx + edx*4], 0x2c36544d
inc dword [esp + 0x9c]
cmp dword [esp + 0x9c], edi
jl 0x414928
mov dword [esp + 0xa4], eax
jmp 0x41496a
mov ecx, dword [esp + 0x154]
mov dword [ecx], 0xfef9d786
inc dword [esp + 0xa4]
cmp dword [esp + 0xa4], eax
jle 0x414956
lea ecx, [esp + 0x154]
call fcn.0040f305
dec dword [esp + 0xc8]
jns 0x414905
lea ecx, [esp + 0x1b8]
call fcn.0040f305
push 4
pop esi
push esi
lea ecx, [esp + 0x170]
call fcn.0040f233
xor eax, eax
mov dword [esp + 0x68], 0xa32b1cec
mov dword [esp + 0xac], eax
jmp 0x4149d4
mov edx, dword [esp + 0xac]
mov ecx, dword [esp + 0x16c]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0xac]
cmp dword [esp + 0xac], esi
jl 0x4149bb
mov dword [esp + 0x68], 3
cmp dword [esp + 0x68], eax
jl 0x414a30
mov dword [esp + 0x50], 0x48f69f7f
mov dword [esp + 0x50], eax
jmp 0x414a0f
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x16c]
mov dword [ecx + edx*4], 6
inc dword [esp + 0x50]
cmp dword [esp + 0x50], esi
jl 0x4149f9
mov byte [esp + 0x4a], al
cmp byte [esp + 0x4a], 0
je 0x414a2a
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
xor eax, eax
dec dword [esp + 0x68]
jns 0x4149eb
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0x16c]
mov dword [esp + 0x68], eax
call fcn.0040f305
lea eax, [esp + 0xe0]
mov edx, 0x7199
push 0
push eax
lea ecx, [esp + 0x168]
call fcn.004161af
pop ecx
pop ecx
push edi
lea ecx, [esp + 0x10c]
call fcn.0040f233
mov dword [esp + 0x5c], 0x61f
xor eax, eax
mov dword [esp + 0x24], 0xe0980db9
mov dword [esp + 0x80], eax
jmp 0x414aa5
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x108]
mov dword [ecx + edx*4], 0xfffffff9
inc dword [esp + 0x80]
cmp dword [esp + 0x80], edi
jl 0x414a89
mov ecx, dword [esp + 0x108]
xor edx, edx
cmp dword [ecx], eax
sete dl
mov dword [esp + 0x5c], edx
mov dword [esp + 0x5c], eax
jmp 0x414bc1
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
jmp 0x414ae2
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x200], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x414ad3
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], eax
jg 0x414bbd
mov dword [esp + 0xc], edi
mov dword [esp + 0xc], eax
jmp 0x414ba2
mov dword [esp + 0x78], eax
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x108]
mov esi, dword [esp + 0x108]
mov ecx, dword [ecx + edx*4]
mov dword [esi + edi*4], ecx
xor edi, edi
mov dword [esp + 0x20c], ecx
inc edi
mov dword [esp + 0x78], eax
cmp dword [esp + 0x78], 0xffffffe7
jge 0x414b9e
push 3
lea ecx, [esp + 0x188]
call fcn.0040f233
mov dword [esp + 0x114], edi
mov dword [esp + 0x18], 0
jmp 0x414b6d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], 0xab2a
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x414b57
mov eax, dword [esp + 0x184]
lea ecx, [esp + 0x184]
mov eax, dword [eax + 8]
mov dword [esp + 0x114], eax
call fcn.0040f305
dec dword [esp + 0x78]
cmp dword [esp + 0x78], 0xffffffe7
jl 0x414b38
xor eax, eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], eax
jle 0x414b03
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jle 0x414af6
push 4
pop esi
inc dword [esp + 0x5c]
cmp dword [esp + 0x5c], 0x16
jg 0x414ac9
lea ecx, [esp + 0x108]
call fcn.0040f305
push dword [esp + 0xe0]
movdqa xmm0, xmmword [0xa8bb20]
lea ecx, [esp + 0x1ec]
push ecx
xor eax, eax
lea ecx, [esp + 0x1e0]
push ecx
push eax
lea ecx, [esp + 0x128]
mov dword [esp + 0x128], eax
movdqu xmmword [esp + 0x1e8], xmm0
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
call fcn.004108a1
xor eax, eax
mov dword [esp + 0x10], 0x184c506d
mov dword [esp + 0x10], eax
jmp 0x414cb3
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], 0x64c9d8d9
mov dword [esp + 0x18], eax
jmp 0x414c59
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x1f4], 0x9c6fec1b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x414c46
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x118]
mov ecx, dword [edx]
mov dword [edx + esi*4], ecx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jne 0x414ca6
mov ecx, eax
cmp dword [esp + 0xc], eax
je 0x414ca8
mov ecx, edi
mov dword [esp + 0x1fc], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x414c34
lea ecx, [esp + 0x118]
call fcn.0040f305
xor eax, eax
mov dword [esp + 0x28], eax
jmp 0x415636
mov dword [esp + 0x38], 0x5ba77230
mov dword [esp + 0x20], eax
mov dword [esp + 0xb0], 0xe1d925b0
mov dword [esp + 0xa8], 9
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], 6
mov dword [esp + 0x6c], edi
mov dword [esp + 0x18], eax
jmp 0x414d20
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x1b0], 0xf9e6a012
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x414d0d
mov dword [esp + 0x20], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xa8], eax
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
neg edx
sbb edx, edx
inc edx
add ecx, edx
mov edx, dword [esp + 0x20]
add edx, ecx
xor ecx, ecx
neg edx
cmp edx, 0xbf5f
setge cl
xor ebx, ebx
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
cmp edx, ecx
mov ecx, dword [esp + 0xa8]
setg bl
xor edx, edx
cmp ecx, ebx
setge dl
imul ecx, dword [esp + 0xc], 0xcaea
sub ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
add edx, ecx
mov ecx, dword [esp + 0xa8]
cmp edx, ecx
setle bl
cmp ebx, dword [esp + 0x20]
jl 0x414db1
mov esi, eax
cmp dword [esp + 0xb0], eax
je 0x414db3
mov esi, edi
mov ecx, dword [esp + 0x20]
xor edx, edx
cmp esi, ecx
sete dl
mov dword [esp + 0xa8], edx
mov ecx, dword [esp + 0xa8]
neg ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x20]
jge 0x414ded
cmp dword [esp + 0xb0], eax
jne 0x414ded
mov ecx, eax
cmp dword [esp + 0x20], eax
je 0x414def
mov ecx, edi
mov edx, dword [esp + 0xb0]
sub edx, ecx
mov ecx, dword [esp + 0x1b0]
sub edx, ecx
mov ecx, dword [esp + 0x6c]
add ecx, edx
je 0x414e5a
mov byte [esp + 0x46], al
cmp byte [esp + 0x46], 0
je 0x414e25
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
mov byte [esp + 0x4e], al
cmp byte [esp + 0x4e], 0
je 0x414ec6
push eax
push eax
push eax
push 0xdef
push 0x1557
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
jmp 0x414ec6
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc], eax
jmp 0x414ebf
mov dword [esp + 0xc0], 9
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x6c], 0xfffffff9
jmp 0x414ead
mov dword [esp + 0x14], 0xfffffff7
mov dword [esp + 0x20], eax
jmp 0x414e9d
dec dword [esp + 0xc0]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jle 0x414e92
cmp dword [esp + 0x14], eax
jne 0x414eb4
inc dword [esp + 0x6c]
cmp dword [esp + 0x6c], 2
jl 0x414e84
dec dword [esp + 0xbc]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x18
jl 0x414e67
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], 3
jg 0x415303
jmp 0x414ed9
xor eax, eax
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], eax
jmp 0x414efa
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x90], 0xf782a183
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x414ee7
mov dword [esp + 0x10], eax
jmp 0x414f19
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x1a8], 0x1c03809d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x414f06
mov dword [esp + 0x10], eax
jmp 0x414f39
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x1c4], 0x1da7bc99
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x414f26
mov byte [esp + 0x48], al
cmp byte [esp + 0x48], 0
je 0x414f5a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
xor eax, eax
mov ecx, dword [esp + 0x90]
xor edx, edx
cmp ecx, 0x3717
setge dl
xor ecx, ecx
mov dword [esp + 0x1a8], edx
mov esi, dword [esp + 0x90]
add esi, 0x7540
cmp edx, 0x93ee3274
mov dword [esp + 0x1c4], esi
setne cl
xor edx, edx
cmp ecx, esi
mov ecx, dword [esp + 0x90]
mov esi, dword [esp + 0x90]
setle dl
add ecx, edx
sub esi, ecx
mov ecx, dword [esp + 0x90]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setne dl
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], 0x72a7
mov dword [esp + 0x14], 0xfffffffc
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], 0xfffffff6
mov dword [esp + 0x10], eax
jmp 0x414ff7
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x14c], 0xbca6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x414fe4
mov dword [esp + 0x10], eax
jmp 0x415017
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x1cc], 0xbcabebf3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x415004
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], eax
jl 0x4151c8
mov dword [esp + 0x1c], 0x1265ab3e
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], eax
jl 0x4151be
mov dword [esp + 0x7c], 0xfffffff8
mov dword [esp + 0x24], 0xfffffff7
mov dword [esp + 0x24], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], 0xfff6
mov dword [esp + 0x7c], edi
cmp dword [esp + 0x7c], eax
jl 0x4151b4
mov dword [esp + 0x10], 0x44555950
mov dword [esp + 0x10], eax
jmp 0x4150a0
mov dword [esp + 0x18], 0x3a18e418
mov ecx, dword [esp + 0x7c]
mov ecx, dword [esp + ecx*4 + 0x14c]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x415081
mov dword [esp + 0x10], eax
jmp 0x4151a0
mov dword [esp + 0xc], 0xc10977a1
mov dword [esp + 0x24], 0x4d996497
mov dword [esp + 0xc], edi
cmp dword [esp + 0xc], eax
jl 0x41519c
mov dword [esp + 0x18], 0xc383c67e
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], edi
jg 0x415192
mov dword [esp + 0x1d0], 0xd3ed
lea ecx, [esp + 0x134]
push 2
call fcn.0040f233
mov dword [esp + 0xa0], 0
jmp 0x41512d
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 0x3846f263
inc dword [esp + 0xa0]
cmp dword [esp + 0xa0], 2
jl 0x415111
mov esi, dword [esp + 0x134]
xor ecx, ecx
mov eax, dword [esp + 0x14c]
cmp dword [esi + 4], edi
setl cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setg bl
xor edx, edx
cmp ebx, eax
mov eax, dword [esp + 0xc]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [esp + 0x1c]
cmp dword [esp + 0x24], 0
mov dword [esi + 4], ecx
lea ecx, [esp + 0x134]
call fcn.0040f305
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x4150eb
xor eax, eax
dec dword [esp + 0xc]
jns 0x4150cd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x4150af
dec dword [esp + 0x7c]
jns 0x415073
dec dword [esp + 0x1c]
jns 0x415045
dec dword [esp + 0x14]
jns 0x41502b
lea ecx, [esp + 0x64]
push ecx
push eax
push 0x7785
call fcn.00417d94
add esp, 0xc
lea ecx, [esp + 0x128]
push edi
call fcn.0040f233
mov dword [esp + 0xc], 0x19adb821
xor eax, eax
mov dword [esp + 0x14], 0xe3ca3691
mov dword [esp + 0x24], 0x2fa5d872
mov dword [esp + 0x34], eax
jmp 0x41521e
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x128]
mov dword [ecx + edx*4], 0xfffffffe
inc dword [esp + 0x34]
cmp dword [esp + 0x34], edi
jl 0x415208
mov dword [esp + 0x34], eax
jmp 0x41523d
mov ecx, dword [esp + 0x34]
mov dword [esp + ecx*4 + 0x104], 0x6595ad33
inc dword [esp + 0x34]
cmp dword [esp + 0x34], edi
jl 0x41522a
mov ecx, dword [esp + 0x128]
cmp dword [ecx], 0xfffffff8
jne 0x415253
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
sub edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x128]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ecx]
neg edx
sbb edx, edx
add edx, 0xe5a9864c
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x128]
neg edx
sbb edx, edx
neg edx
sub edx, dword [ecx]
mov esi, dword [ecx]
neg edx
mov edi, dword [ecx]
sbb edx, edx
inc edx
mov dword [esp + 0x104], edx
add esi, edx
mov ecx, dword [esp + 0xc]
xor edx, edx
cmp esi, ecx
setle dl
xor ecx, ecx
cmp edx, 0x6e2c
setl cl
xor edx, edx
cmp ecx, edi
setge dl
add edx, edi
sub edx, dword [esp + 0xc]
mov dword [esp + 0x24], edx
mov byte [esp + 0x4c], al
cmp byte [esp + 0x4c], al
je 0x4152e5
push 0xa0b
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
lea ecx, [esp + 0x128]
call fcn.0040f305
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 3
push 1
pop edi
jle 0x414ed7
mov dword [esp + 0x8c], 0xfffffffc
lea ecx, [esp + 0x19c]
push edi
call fcn.0040f233
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x415335
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x19c]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x415323
mov dword [esp + 0x8c], eax
jmp 0x415356
mov ecx, dword [esp + 0x19c]
cmp dword [ecx], eax
jne 0x415360
inc dword [esp + 0x8c]
cmp dword [esp + 0x8c], 0x13
jge 0x415344
mov byte [esp + 0x2f], al
cmp byte [esp + 0x2f], al
je 0x415371
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
lea ecx, [esp + 0x19c]
call fcn.0040f305
xor eax, eax
mov dword [esp + 0x64], eax
cmp dword [esp + 0x64], 3
jg 0x41562f
push 2
lea ecx, [esp + 0xf8]
call fcn.0040f233
xor eax, eax
mov dword [esp + 0x30], eax
jmp 0x4153b4
mov ecx, dword [esp + 0x30]
mov dword [esp + ecx*4 + 0x70], 0x4e2d
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 2
jl 0x4153a4
mov dword [esp + 0x30], eax
jmp 0x4153d7
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0xf4]
mov dword [ecx + edx*4], 3
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 2
jl 0x4153c1
mov esi, dword [esp + 0xf4]
mov dword [esp + 0x24], esi
mov dword [esi + 4], eax
mov ecx, dword [esi + 4]
cmp dword [esp + ecx*4 + 0x70], eax
je 0x415473
mov ecx, dword [esi + 4]
cmp dword [esp + ecx*4 + 0x70], eax
jne 0x41540b
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], eax
cmp dword [esp + ecx*4 + 0x70], eax
je 0x41540f
mov dword [esp + 0x14], edi
mov edi, dword [esi + 4]
xor edx, edx
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + edi*4 + 0x70]
cmp edi, ecx
mov ecx, dword [esp + 0xf4]
setg dl
xor ebx, ebx
cmp dword [ecx], esi
mov esi, dword [esp + 0x24]
setge bl
sub ebx, edx
neg ebx
sbb ebx, ebx
inc ebx
cmp ebx, edi
jg 0x415448
cmp dword [esp + edi*4 + 0x70], eax
jne 0x415448
mov edi, eax
jmp 0x41544b
xor edi, edi
inc edi
mov ecx, dword [esi + 4]
sub edi, ecx
mov edx, dword [esp + ecx*4 + 0x70]
sub edi, edx
mov ecx, dword [esp + 0x74]
xor edx, edx
cmp edi, ecx
setge dl
sub edx, dword [esi + 4]
neg edx
sbb edx, edx
inc edx
cmp edx, 0xffffffff
jae 0x415473
xor edi, edi
inc edi
jmp 0x415475
mov edi, eax
mov ecx, dword [esi + 4]
xor edx, edx
mov ecx, dword [esp + ecx*4 + 0x70]
cmp edi, ecx
mov ecx, dword [esp + 0xf4]
setne dl
add edx, dword [ecx]
mov ecx, dword [esi + 4]
cmp edx, dword [esp + ecx*4 + 0x70]
jge 0x415529
mov byte [esp + 0x44], al
cmp byte [esp + 0x44], 0
je 0x4154d1
push eax
push 0x15c5
push eax
push eax
push 0xceb
push 0x204c
push 0x176
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
xor eax, eax
xor edi, edi
inc edi
cmp dword [esi + 4], eax
je 0x415594
mov dword [esp + 0x14], 0x559653e3
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], eax
jl 0x41559f
mov dword [esp + 0xec], edi
mov ecx, 0x34ab462a
mov dword [esp + 0x124], 0xffffffff
mov dword [esp + 0xec], ecx
mov dword [esp + 0x124], ecx
mov ecx, dword [esi + 4]
cmp dword [esp + ecx*4 + 0x70], eax
jne 0x41559f
dec dword [esp + 0x14]
jns 0x4154f3
jmp 0x41559f
xor edi, edi
mov dword [esp + 0x1c], eax
inc edi
jmp 0x415545
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0xb4], 0xc80ae7b1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x415532
mov dword [esp + 0xb4], edi
cmp dword [esp + 0xb4], eax
jl 0x4154d4
mov dword [esp + 0xb8], 0x6a6c65b0
inc dword [esp + 0xb8]
mov byte [esp + 0x45], al
cmp byte [esp + 0x45], 0
je 0x415586
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
xor eax, eax
dec dword [esp + 0xb4]
jns 0x41555f
jmp 0x4154d4
mov edx, dword [esp + 0x70]
mov ecx, dword [esi + 4]
mov dword [esp + ecx*4 + 0x70], edx
inc dword [esi + 4]
cmp dword [esi + 4], edi
jle 0x4153ec
mov byte [esp + 0x47], al
cmp byte [esp + 0x47], 0
je 0x4155c3
push eax
push 0x186
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea ecx, [esp + 0xf4]
call fcn.0040f305
mov dword [esp + 0x38], 0
jmp 0x4155f6
call fcn.00414446
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x160]
or dword [eax + ecx*4], 0xffffffff
call fcn.00414284
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 4
jl 0x4155d9
mov byte [esp + 0x49], 0
call fcn.004144ce
cmp byte [esp + 0x49], 0
je 0x41561e
call fcn.004141ab
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
inc dword [esp + 0x64]
cmp dword [esp + 0x64], 3
jle 0x41538e
xor eax, eax
inc dword [esp + 0x28]
push 2
pop ebx
cmp dword [esp + 0x28], 0x16
jg 0x414cd5
lea ecx, [esp + 0x160]
call fcn.0040f305
xor eax, eax
mov dword [esp + 0x14], 0xfffffffc
mov dword [esp + 0x28], eax
jmp 0x415670
mov ecx, dword [esp + 0x28]
mov dword [esp + ecx*4 + 0x1d4], 4
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edi
jl 0x41565d
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], eax
jl 0x4156cc
mov byte [esp + 0x4b], al
cmp byte [esp + 0x4b], 0
je 0x4156a6
push 0x26cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
xor eax, eax
mov byte [esp + 0x43], al
cmp byte [esp + 0x43], 0
je 0x4156c6
push eax
push 0x1316
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor eax, eax
dec dword [esp + 0x14]
jns 0x415680
mov byte [esp + 0x4f], al
cmp byte [esp + 0x4f], 0
je 0x4156e4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [esp + 0xd4]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0xd0]
mov esi, edx
mov edi, eax
call fcn.00414135
add eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret