Function at 0x415565
Capabilities:
Allocate thread local storage
Check os version
Create pipe
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x37c
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], 0x5bf2d3f5
push edi
mov byte [ebp - 5], dl
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x10], eax
jmp 0x415596
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x168], 0x76eea530
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x415585
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
neg edx
push 1
sbb edx, edx
xor ebx, ebx
add edx, 2
mov dword [ebp - 0x168], edx
mov ecx, dword [ebp - 4]
cmp edx, ecx
mov ecx, dword [ebp - 4]
setle bl
xor edx, edx
cmp ebx, ecx
pop edi
setl dl
sub edx, 0x1fad
sub edx, dword [ebp - 4]
neg edx
sbb edx, edx
inc edx
sub edx, 0xcb55
je 0x4155e6
mov ecx, edi
cmp dword [ebp - 0x168], eax
jne 0x4155e8
mov ecx, eax
push 3
pop ebx
cmp ecx, dword [ebp - 4]
jge 0x4156ab
push dword [ebp - 0x24]
movdqa xmm0, xmmword [0xaa48d0]
lea ecx, [ebp - 0x300]
push ecx
lea ecx, [ebp - 0x310]
mov dword [ebp - 0xc0], eax
push ecx
push eax
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xbc], eax
movdqu xmmword [ebp - 0x310], xmm0
mov dword [ebp - 0xb8], eax
call fcn.00414b1a
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x415699
mov dword [ebp - 0xc], 0x6eab3cf8
mov dword [ebp - 0xc], edi
cmp dword [ebp - 0xc], eax
jl 0x415696
mov esi, dword [ebp - 0xc0]
mov dword [ebp - 0x20], 0x243e5ec3
mov dword [ebp - 0x10], eax
jmp 0x41566c
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x8c], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x41565b
mov ecx, dword [ebp - 0x8c]
xor edx, edx
cmp ecx, 0x7128
setg dl
add edx, dword [esi + 4]
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0xc]
jns 0x41564f
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
je 0x41563a
lea ecx, [ebp - 0xc0]
call fcn.004134bd
jmp 0x4156bb
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], al
je 0x4156bd
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor eax, eax
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
je 0x4156d2
push eax
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
xor eax, eax
cmp byte [ebp - 5], 0
je 0x415a6f
mov dword [ebp - 0x18], 0x13b91020
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 4], eax
jmp 0x415700
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x358], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x4156ef
mov dword [ebp - 4], eax
jmp 0x415717
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x2dc], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x41570a
mov dword [ebp - 0x18], 7
cmp dword [ebp - 0x18], 0x11
jl 0x41585d
mov esi, 0xfffe
push ebx
lea ecx, [ebp - 0x138]
call fcn.004133eb
mov dword [ebp - 0x108], esi
xor eax, eax
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 4], eax
jmp 0x415777
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x138]
mov dword [ecx + edx*4], 6
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x415764
mov dword [ebp - 4], eax
jmp 0x415792
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x2f0], 0xca335c22
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x415781
mov ebx, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebx + 8]
shl ecx, 2
test ecx, ecx
je 0x4157b6
mov ecx, edi
cmp dword [ebp - 0x104], eax
jne 0x4157b8
mov ecx, eax
mov dword [ebp - 0x20], ecx
xor edx, edx
mov ecx, dword [ebp - 0x20]
cmp dword [ebx + 8], ecx
setle dl
mov dword [ebp - 0x2f0], edx
cmp dword [ebp - 0x104], eax
jne 0x4157d9
cmp dword [ebp - 0x20], eax
je 0x4157db
mov eax, edi
cmp eax, 0xe9f21c9b
mov eax, dword [ebp - 0x138]
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp dword [eax + 4], ecx
mov dword [ebp - 0x350], ecx
mov eax, dword [ebp - 0x18]
setg bl
inc ebx
neg ebx
sbb ebx, ebx
xor edx, edx
neg ebx
cmp ebx, eax
setne dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x104]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
sub ecx, eax
mov eax, dword [ebp - 0x18]
sub eax, ecx
lea ecx, [ebp - 0x138]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], 0xffffffff
call fcn.004134bd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x11
push 3
pop ebx
jge 0x415732
mov dword [ebp - 0x18], 0xc45c
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 0x10], 0xffffffff
push edi
call fcn.004133eb
push edi
lea ecx, [ebp - 0x2a0]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x1c], 0xbb5f37d7
mov dword [ebp - 4], eax
jmp 0x4158a4
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x2c4]
mov dword [ecx + edx*4], 0xfffffffd
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x415891
mov dword [ebp - 4], eax
jmp 0x4158c1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x2a0]
mov dword [ecx + edx*4], 5
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x4158ae
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x18]
jne 0x4158da
mov dword [ebp - 0x10], 0xb6318d58
jmp 0x415a40
mov dword [ebp - 4], 0xe4de
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x28], 0x9b93b3bb
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x2dcbded6
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0x8e11f317
mov dword [ebp - 0x24], 0xc03fdda7
push edi
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x41593a
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x288]
mov dword [ecx + edx*4], 0x386b9bdd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x415927
mov dword [ebp - 0x18], eax
jmp 0x415a28
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp ecx, edx
mov ecx, dword [ebp - 4]
setne bl
imul edx, ebx, 0x907
xor ebx, ebx
cmp edx, ecx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
setg bl
sub edx, ebx
neg edx
sbb edx, edx
add ecx, 2
inc edx
cmp ecx, edx
jle 0x415993
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
mov ecx, dword [ebp - 4]
setg dl
xor ebx, ebx
cmp edx, 0xffffffff
setle bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ecx, ecx
cmp edx, 0xd69b45c7
setne cl
xor ebx, ebx
imul ecx, dword [ebp - 0x20]
imul ecx, ecx, 0x56ee
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
setg bl
xor ecx, ecx
imul ebx, dword [ebp - 4]
cmp ebx, 0x3c444c9c
setne cl
xor ebx, ebx
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
cmp ecx, edx
setge bl
cmp ebx, 0x3836
jle 0x415a0e
mov esi, eax
cmp dword [ebp - 0x10], eax
je 0x415a10
mov esi, edi
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp esi, ecx
setle dl
sub edx, 0xfffffff9
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x28], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1f
jne 0x415947
dec dword [ebp - 0x1c]
lea ecx, [ebp - 0x288]
call fcn.004134bd
lea ecx, [ebp - 0x2a0]
call fcn.004134bd
lea ecx, [ebp - 0x2c4]
call fcn.004134bd
push 0
push 0x1965
push 0
push 0x11d1
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
jmp 0x417bd4
mov dword [ebp - 0x20], 0xe57b
mov dword [ebp - 0xc], 0xd76ce4a6
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], eax
jmp 0x415a96
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x88], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x415a85
mov ecx, dword [ebp - 0x20]
xor ebx, ebx
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x84]
cmp edx, ecx
setne bl
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], eax
je 0x415ac7
mov esi, edi
cmp dword [ebp - 0x20], eax
jne 0x415ac9
mov esi, eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, esi
setge dl
cmp edx, dword [ebp - 0x88]
jg 0x415b19
cmp dword [ebp - 0x84], eax
jne 0x415b19
mov dword [ebp - 0x28], 0xfffffffb
xor ebx, ebx
mov dword [ebp - 0x1c], 0xf81320f2
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
cmp edx, ecx
setne bl
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
cmp ecx, edx
setl bl
add ebx, 0xcd44
mov dword [ebp - 0xc], ebx
jmp 0x415b30
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x415b30
push 0xae5
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x415b45
push 0x1eaf
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0xc5416513
mov dword [ebp - 0x2c], 0x8dc509ca
mov dword [ebp - 0x2c], 0xb187b35f
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], 0xffffffea
jmp 0x415c6b
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x26c]
call fcn.004133eb
mov dword [ebp - 0x10], 0xf2d3f504
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 4], eax
jmp 0x415ba2
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x68], 0x36951ad3
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x415b94
mov dword [ebp - 4], eax
jmp 0x415bbf
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x26c]
mov dword [ecx + edx*4], 0x4aa0d722
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x415bac
mov dword [ebp - 0x64], eax
jmp 0x415bd6
mov dword [ebp - 0x24], 9
dec dword [ebp - 0x10]
dec dword [ebp - 0x64]
cmp dword [ebp - 0x64], 0xffffffe9
jge 0x415bc9
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x10], ecx
jle 0x415beb
mov esi, edi
cmp dword [ebp - 0x18], eax
jne 0x415bed
mov esi, eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0x43e2
setg cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp eax, esi
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x10]
je 0x415c19
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov ecx, dword [ebp - 0x26c]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ecx + 8], eax
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
setle bl
imul edx, ebx
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x26c]
call fcn.004134bd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
je 0x415b70
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
cmp dword [ebp - 0x14], eax
jge 0x415c8e
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x14]
js 0x415c83
mov dword [ebp - 0x10], 0xfffffff7
mov dword [ebp - 0x10], eax
jmp 0x415cab
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x2d0], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x415c9a
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], eax
jl 0x415cd6
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + ecx*4 - 0x2d0]
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x2d0], edx
dec dword [ebp - 0x10]
jns 0x415cbd
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x2c], 0x37186542
mov dword [ebp - 0x14], 0xb9f9b31
mov dword [ebp - 0x18], 0xd686a37b
mov dword [ebp - 0x14], 0xffffffe6
cmp dword [ebp - 0x14], 0xfffffff4
jle 0x415ea9
mov esi, 0xfffe
mov dword [ebp - 0x10], 0xc6f1bf50
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffffc
jne 0x415e78
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x20], esi
push 4
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x415d50
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1a0]
mov dword [ecx + edx*4], 0xe497d6a5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x415d3d
mov ecx, dword [ebp - 0x14]
add ecx, 0x5677ea35
je 0x415d7f
cmp dword [ebp - 0x10], eax
jne 0x415d75
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, edi
cmp dword [ebp - 0x20], eax
jne 0x415d81
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x1c], eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x415da4
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor eax, eax
mov ecx, dword [ebp - 4]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
je 0x415dc0
mov edx, edi
cmp dword [ebp - 0x14], eax
jne 0x415dc2
mov edx, eax
xor ecx, ecx
cmp edx, 0x643d
setne cl
shl ecx, 2
cmp ecx, dword [ebp - 0x18]
jg 0x415ddc
mov ecx, edi
cmp dword [ebp - 0xc], eax
jne 0x415dde
mov ecx, eax
mov ebx, dword [ebp - 0x1a0]
xor edx, edx
mov dword [ebp - 0x2c], ebx
cmp ecx, dword [ebx + 8]
mov ecx, dword [ebp - 0xc]
sete dl
imul ecx, edx
test ecx, ecx
je 0x415e00
mov ebx, edi
cmp dword [ebp - 0xc], eax
jne 0x415e02
mov ebx, eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp ecx, ebx
setge dl
imul edx, dword [ebp - 0x20]
cmp dword [ebp - 0xc], edx
jg 0x415e1a
cmp dword [ebp - 0x1c], eax
je 0x415e1c
mov eax, edi
xor ecx, ecx
cmp eax, 0xcda2
mov eax, dword [ebp - 0x10]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
sub edx, dword [eax + 8]
mov eax, dword [ebp - 4]
neg edx
sbb edx, edx
inc edx
add eax, edx
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
lea ecx, [ebp - 0x1a0]
setl dl
xor eax, eax
cmp edx, 0xe3b9
setne al
mov dword [ebp - 0x18], eax
call fcn.004134bd
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffc
je 0x415d1f
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x415e9c
push 0x2471
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff4
jg 0x415d04
mov dword [ebp - 0x14], 0x3580d416
mov dword [ebp - 0xc], 0xfffffff9
mov dword [ebp - 0x24], 0xf8b5
mov dword [ebp - 0x24], 0xb9dbea52
mov dword [ebp - 0x24], 0x92bd42ca
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x1c], 0xe76d238e
mov dword [ebp - 0x1c], 0x8ef068cd
mov dword [ebp - 4], 0xdedfc3e8
mov dword [ebp - 0x10], eax
jmp 0x415ef7
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x74], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x415eed
cmp dword [ebp - 0x6c], eax
je 0x415f46
mov ecx, dword [ebp - 0x6c]
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
mov esi, edi
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x6c]
cmp edx, ecx
mov edx, dword [ebp - 0x6c]
setg bl
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, ebx
setg cl
mov dword [ebp - 0x70], ecx
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
add ecx, 0xa95f4cb7
add ecx, edx
cmp ecx, 0xfc2e607d
ja 0x415f48
mov esi, eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, 0xfffb
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 4]
setne dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x20]
setne bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 4]
setg dl
mov dword [ebp - 0x2c], edx
xor edx, edx
cmp dword [ebp - 0x2c], ecx
setg dl
neg edx
cmp edx, dword [ebp - 4]
jg 0x415f89
mov esi, eax
cmp dword [ebp - 0x6c], eax
je 0x415f8b
mov esi, edi
mov ecx, dword [ebp - 4]
xor edx, edx
cmp esi, ecx
push 2
setg dl
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
pop ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], eax
jl 0x415fb9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x74], ecx
dec dword [ebp - 4]
jns 0x415fa6
push 3
pop esi
mov dword [ebp - 0x24], 0xe7b79f6a
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x1c], 0x48b1647c
push esi
call fcn.004133eb
push esi
lea ecx, [ebp - 0x80]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], eax
jmp 0x415ffc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x194]
mov dword [ecx + edx*4], 0xcff0
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x415fe9
mov dword [ebp - 4], eax
jmp 0x416016
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x80]
mov dword [ecx + edx*4], 0xd1e1e87d
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x416006
mov ecx, dword [ebp - 0x80]
mov dword [ecx], eax
mov dword [ebp - 0x1c], 7
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x28], 0xc70ab227
mov dword [ebp - 0x28], 0xfffffffd
push ebx
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x416057
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x254]
mov dword [ecx + edx*4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x416048
cmp dword [ebp - 0x1c], eax
jne 0x416073
mov ecx, dword [ebp - 0x80]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x194]
cmp dword [ecx + edx*4], eax
mov edx, eax
je 0x416075
mov edx, edi
mov ecx, dword [ebp - 0x1c]
dec edx
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x80]
setge bl
cmp edi, ebx
sbb edx, edx
xor ebx, ebx
neg edx
sub edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x80]
cmp dword [ecx], edx
setge bl
mov dword [ebp - 0x28], ebx
xor ebx, ebx
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x80]
cmp edx, dword [ecx]
mov ecx, dword [ebp - 0x254]
setle bl
mov dword [ecx], ebx
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x4160ce
push eax
push 0x1e40
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea ecx, [ebp - 0x254]
call fcn.004134bd
mov eax, dword [ebp - 0x80]
push 2
pop ebx
inc dword [eax]
cmp dword [eax], ebx
jle 0x416020
mov dword [ebp - 0x10], 0
jmp 0x41611b
mov dword [ebp - 0x2c], 0x1be360de
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x416118
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jne 0x4160f2
lea ecx, [ebp - 0x80]
call fcn.004134bd
lea ecx, [ebp - 0x194]
call fcn.004134bd
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x1b8]
push ebx
call fcn.004133eb
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0xf8]
mov dword [ebp - 4], 0xfc07e17f
push ebx
call fcn.004133eb
mov dword [ebp - 0x20], edi
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x2c], 0x46c8c5ce
mov dword [ebp - 0x24], 0xab136113
mov dword [ebp - 0x10], eax
jmp 0x416195
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xf8]
mov dword [ecx + edx*4], 0x23371247
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x416182
mov ecx, dword [ebp - 4]
xor edx, edx
mov ecx, dword [ebp - 0xf8]
mov dword [ecx], 0xfffffffe
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0xf8]
cmp dword [ecx], eax
setne dl
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 4]
cmp dword [ebp - 4], edi
jne 0x4161cf
cmp dword [ebp - 4], eax
je 0x4161d1
mov eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xf8]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 4]
imul eax, dword [ecx + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 4]
imul edx, eax, 0x7a23
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xf8]
call fcn.004134bd
mov dword [ebp - 0x20], 0x8700d35
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x28], 0xe5232406
mov dword [ebp - 0x2c], 0x1c08901f
mov dword [ebp - 0x10], 0xffffffff
push ebx
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x416262
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x260]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x416253
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], eax
jmp 0x416281
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x260]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x416272
lea ecx, [ebp - 0x260]
call fcn.004134bd
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4162a7
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1b8]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x416298
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x6db50520
mov dword [ebp - 0x24], 0x83c8fc55
push 0xfffffffffffffffd
pop ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xbc370782
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x1c], 0xfffffffa
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x4162fd
push 0x1381
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
xor eax, eax
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x20]
dec dword [ebp - 0x20]
add ecx, 0xc0e0752
je 0x416319
cmp dword [ebp - 0xc], eax
je 0x416319
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1b8]
push esi
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0x609c3fbb
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x416360
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2b8]
mov dword [ecx + edx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x416351
mov esi, edi
cmp dword [ebp - 0x10], eax
jne 0x41636e
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
setle dl
imul ecx, dword [ebp - 4], 0xbb09cedc
cmp ecx, edx
jl 0x4163da
mov dword [ebp - 0x28], 0x13e13a6c
mov dword [ebp - 0x1c], 0x628405ce
mov dword [ebp - 0x10], eax
jmp 0x4163ad
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x370], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x41639c
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
neg ecx
mov dword [ebp - 0x370], eax
sbb ecx, ecx
neg ecx
imul ecx, eax
mov dword [ebp - 4], ecx
jmp 0x41640e
mov dword [ebp - 4], 0xfffffff2
jmp 0x416408
mov dword [ebp - 0x10], eax
jmp 0x4163ff
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4163fc
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jg 0x4163e8
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffed
je 0x4163e3
lea ecx, [ebp - 0x2b8]
call fcn.004134bd
mov dword [ebp - 0x10], 0xb26bdde0
mov dword [ebp - 0x10], 0xfffffffa
jmp 0x416444
cmp dword [ebp - 0x10], 0
jne 0x41644a
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x416441
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff3
je 0x416429
xor eax, eax
mov byte [ebp - 5], al
push 8
pop esi
cmp byte [ebp - 5], al
je 0x416571
mov dword [ebp - 0x18], 0xa61928c1
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x41647e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], 0xffffffe9
jne 0x416554
push 3
pop esi
push esi
lea ecx, [ebp - 0x150]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x40], 2
mov dword [ebp - 4], eax
jmp 0x4164b7
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x150]
mov dword [ecx + edx*4], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x4164a8
mov dword [ebp - 4], eax
jmp 0x4164d2
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x34c], 0x9281c1d9
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x4164c1
cmp dword [ebp - 0x18], eax
je 0x4164df
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x150]
sub edx, dword [ecx]
mov dword [ebp - 0x40], edx
jne 0x4164f9
mov ecx, eax
cmp dword [ebp - 0x18], eax
je 0x4164fb
mov ecx, edi
xor eax, eax
cmp ecx, 0xfffffffb
setge al
cmp eax, 0xdb5cabfc
mov eax, dword [ebp - 0x150]
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x348], ecx
lea ecx, [ebp - 0x150]
call fcn.004134bd
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
je 0x41648e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0xbd9
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
lea ecx, [ebp - 0x1b8]
call fcn.004134bd
mov dword [ebp - 0x20], 9
lea ecx, [ebp - 0x1d0]
push 2
call fcn.004133eb
push 3
pop esi
push esi
lea ecx, [ebp - 0x218]
call fcn.004133eb
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
jmp 0x4165bc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1d0]
mov dword [ecx + edx*4], 0x14c405b4
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x4165a9
mov dword [ebp - 4], eax
jmp 0x4165da
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + edx*4], 0xdcba
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x4165c7
cmp dword [ebp - 0x20], eax
je 0x4165f5
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x416664
push eax
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x416664
mov dword [ebp - 0x28], 0x61f66568
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x10], eax
jmp 0x416615
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x48], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x41660b
mov ecx, dword [ebp - 0x218]
inc dword [ecx]
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0x48], eax
je 0x416642
cmp dword [ebp - 0x28], eax
je 0x41663a
mov ecx, dword [ebp - 0x1d0]
cmp dword [ecx + 4], eax
je 0x41663c
mov eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setl dl
mov dword [ebp - 0x48], edx
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edx
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x218]
call fcn.004134bd
lea ecx, [ebp - 0x1d0]
call fcn.004134bd
mov eax, dword [ebp - 0x38]
cmp byte [eax], 0
je 0x41689f
mov dword [ebp - 0x18], 0xf82d83d7
xor eax, eax
mov dword [ebp - 0x10], 0xd5467356
push 4
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], eax
pop edx
jmp 0x4166b6
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x5c], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x4166a8
mov dword [ebp - 4], eax
jmp 0x4166d1
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x160], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x4166c0
mov dword [ebp - 4], eax
jmp 0x4166ec
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x27c], 0x76fbfcc0
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x4166db
cmp dword [ebp - 0x50], eax
je 0x416769
cmp dword [ebp - 0x5c], eax
jne 0x41671d
cmp dword [ebp - 0x50], eax
jne 0x416707
mov esi, eax
cmp dword [ebp - 0x18], eax
je 0x416709
mov esi, edi
mov ecx, dword [ebp - 0x50]
xor edx, edx
cmp esi, ecx
setg dl
mov dword [ebp - 0x10], edx
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x41671f
mov edx, edi
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x160], edx
mov dword [ebp - 4], edx
xor edx, edx
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 0x54]
imul esi, ecx
mov ecx, dword [ebp - 0x50]
cmp esi, ecx
mov ecx, dword [ebp - 0x50]
setne dl
xor ebx, ebx
cmp edx, 0x6c0b
setne bl
sub ebx, 0x3ee6
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, ecx
mov dword [ebp - 0x270], ebx
mov ecx, dword [ebp - 0x18]
mov ecx, edi
jmp 0x41676b
mov ecx, eax
mov esi, dword [ebp - 0x54]
xor edx, edx
imul esi, ecx
mov ecx, dword [ebp - 0x18]
push 3
cmp esi, ecx
pop esi
setg dl
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x18], eax
jmp 0x41688c
mov dword [ebp - 0xc], 0x57e8f534
mov dword [ebp - 4], esi
cmp dword [ebp - 4], eax
jl 0x416889
mov dword [ebp - 0x14], 0x5375bb79
mov ecx, dword [ebp - 0x18]
cmp dword [ebp + ecx*4 - 0x5c], eax
je 0x416862
mov dword [ebp - 0x1c], 0xa8b036c8
mov dword [ebp - 0x10], eax
jmp 0x416857
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x160]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + ecx*4 - 0x160]
mov ecx, dword [ebp - 0xc]
neg ecx
cmp ecx, edx
mov ecx, dword [ebp - 0x18]
setne bl
xor edx, edx
mov dword [ebp + ecx*4 - 0x5c], ebx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x27c]
cmp ecx, 0x14c7c747
mov ecx, dword [ebp - 0x18]
sete dl
cmp edx, 0xffffffff
sbb edx, edx
neg edx
mov dword [ebp + ecx*4 - 0x27c], edx
jne 0x416828
mov ecx, dword [ebp - 0x18]
mov esi, eax
cmp dword [ebp + ecx*4 - 0x5c], eax
je 0x41682a
mov esi, edi
mov ecx, dword [ebp - 0x18]
xor edx, edx
push 3
mov ecx, dword [ebp + ecx*4 - 0x160]
sub esi, ecx
sub esi, dword [ebp - 0xc]
imul esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp esi, ecx
mov ecx, dword [ebp - 0x18]
pop esi
setg dl
mov dword [ebp + ecx*4 - 0x160], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x4167bf
jmp 0x416880
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x416880
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + ecx*4 - 0x27c]
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x5c], edx
dec dword [ebp - 0x14]
jns 0x41686a
dec dword [ebp - 4]
jns 0x41679c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x416789
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0xfffffffffffffffd
pop ebx
push dword [ebp - 0x24]
movdqa xmm0, xmmword [0xaa48e0]
lea ecx, [ebp - 0x310]
push ecx
xor eax, eax
lea ecx, [ebp - 0x320]
push ecx
push eax
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], eax
movdqu xmmword [ebp - 0x320], xmm0
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
call fcn.00414b1a
mov dword [ebp - 0x14], 0x184c506d
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x416961
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x10], eax
jmp 0x416957
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x9c]
cmp dword [edx + ecx*4], eax
jne 0x416916
cmp dword [edx + 0xc], 0xffffffff
mov esi, eax
jge 0x416918
mov esi, edi
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp esi, ecx
setg dl
cmp edx, 0x8659
je 0x41693a
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x9c]
cmp dword [ecx + edx*4], eax
mov ecx, eax
je 0x41693c
mov ecx, edi
mov dword [ebp - 0x38], ecx
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x416951
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
inc dword [ebp - 0x10]
push 3
pop esi
cmp dword [ebp - 0x10], esi
jle 0x416900
dec dword [ebp - 0x14]
jns 0x4168f4
lea ecx, [ebp - 0x9c]
call fcn.004134bd
mov dword [ebp - 0xc], edi
lea ecx, [ebp - 0xa8]
push esi
call fcn.004133eb
mov dword [ebp - 0x20], 0xd7d2
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x1c], 0xfffffffe
push edi
call fcn.004133eb
mov dword [ebp - 0x1c], 0x21c760fc
xor eax, eax
mov dword [ebp - 0x1c], 0xd777
mov dword [ebp - 4], eax
jmp 0x4169bd
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xa8]
mov dword [ecx + edx*4], 0x5934215e
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x4169aa
mov dword [ebp - 4], eax
jmp 0x4169d8
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xec], 0x69376522
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x4169c7
mov dword [ebp - 4], eax
jmp 0x4169f6
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x248]
mov dword [ecx + edx*4], 0xae5685e9
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x4169e3
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xa8]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ecx]
neg edx
sbb edx, edx
inc edx
dec edx
je 0x416a20
mov esi, edi
cmp dword [ebp - 0x20], eax
jne 0x416a22
mov esi, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, dword [ebp - 0xa8]
cmp esi, eax
push 0xfffffffffffffffa
setne cl
xor eax, eax
pop esi
add ecx, dword [edx + 8]
neg ecx
cmp ecx, esi
mov dword [ebp - 0xec], ecx
setle al
neg eax
cmp eax, dword [edx + 8]
jl 0x416a54
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x248]
setge dl
sub edx, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], edx
xor edx, edx
mov eax, dword [ebp - 0x1c]
sub eax, ecx
cmp eax, ecx
mov eax, dword [ebp - 0xa8]
setl dl
xor ecx, ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne cl
imul ecx, edx
imul eax, ecx, 0x6ea1
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xa8]
setne cl
sub ecx, dword [eax + 4]
mov dword [eax], ecx
lea ecx, [ebp - 0x248]
call fcn.004134bd
lea ecx, [ebp - 0xa8]
call fcn.004134bd
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x114]
push 2
call fcn.004133eb
mov dword [ebp - 0x18], 0x862f
lea ecx, [ebp - 0x200]
mov dword [ebp - 0x20], 0x5300ce3
mov dword [ebp - 0x38], 0xe26b5cfd
mov dword [ebp - 0x30], 0x5c7e4ddb
mov dword [ebp - 0xc], 0x255bb5fb
mov dword [ebp - 0x24], 0x1b09c821
mov dword [ebp - 0x24], 0x2da3bb1d
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], 0xfffffffb
push 3
call fcn.004133eb
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x14], 0
jmp 0x416b44
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x200]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x416b31
inc dword [ebp - 0x18]
mov dword [ebp - 0x18], 0
jmp 0x416cbe
mov dword [ebp - 4], 0x70ade21
lea ecx, [ebp - 0x230]
push 3
call fcn.004133eb
push edi
lea ecx, [ebp - 0x1e8]
call fcn.004133eb
mov dword [ebp - 0x1c], 0xe219
xor eax, eax
mov dword [ebp - 0x28], 0xc710
mov dword [ebp - 4], eax
jmp 0x416ba1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x230]
mov dword [ecx + edx*4], 0x367f
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x416b8e
mov dword [ebp - 4], eax
jmp 0x416bbf
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1e8]
mov dword [ecx + edx*4], 0x21b78cd9
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x416bac
mov dword [ebp - 4], 0xfffffff9
jmp 0x416c34
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], eax
jl 0x416c31
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x416bff
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x167e
push eax
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x20], eax
je 0x416c20
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x230]
cmp dword [ecx + edx*4], eax
mov edx, eax
je 0x416c22
mov edx, edi
xor ecx, ecx
cmp edx, ebx
setl cl
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x14]
jns 0x416bdc
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
je 0x416bcd
dec dword [ebp - 0x1c]
je 0x416c51
mov ecx, dword [ebp - 0x40]
xor edx, edx
cmp ecx, 3
setle dl
cmp edx, dword [ebp - 0x2c]
jl 0x416c51
mov ecx, dword [ebp - 0xc]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x1e8]
setge cl
mov dword [ebp - 0x28], ecx
mov esi, dword [eax]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
dec eax
neg eax
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x200]
setge cl
xor edx, edx
sub ecx, esi
cmp ecx, edi
lea ecx, [ebp - 0x1e8]
setl dl
add edx, esi
mov dword [eax], edx
call fcn.004134bd
lea ecx, [ebp - 0x230]
call fcn.004134bd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x3a
jle 0x416b59
lea ecx, [ebp - 0x200]
call fcn.004134bd
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0x90ac204e
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x38], 0x584e
mov dword [ebp - 0x30], 0x3f04e266
mov dword [ebp - 4], 0x13
cmp dword [ebp - 4], 0xffffffe9
jg 0x416dea
mov dword [ebp - 0xc], 0xf390197f
mov dword [ebp - 0x18], eax
jmp 0x416d1f
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x44], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x416d11
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], eax
jl 0x416de2
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x18], eax
jmp 0x416dd0
mov dword [ebp - 0x30], 0x2b90f998
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x416d6f
push 0x1be
push 0x1d1f
push 0x521
push 0xa39
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
xor eax, eax
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x44]
cmp ecx, 0x1e01
mov edx, dword [ebp - 0x18]
setg bl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, ebx
setge cl
xor ebx, ebx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + ecx*4 - 0x44]
mov ecx, dword [ebp - 4]
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
setle bl
xor edx, edx
add ebx, 0x8f01
cmp ebx, 0xfffffff7
setge dl
add edx, dword [ebp + ecx*4 - 0x44]
sub edx, 0xdd2cc910
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x30], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x416d42
dec dword [ebp - 0xc]
jns 0x416d30
dec dword [ebp - 4]
jmp 0x416cfb
cmp dword [ebp - 4], eax
jne 0x416dfd
mov ecx, 0x1ac8
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
cmp ecx, edx
mov ecx, dword [ebp - 0x38]
setne bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], 0xccdf
mov dword [ebp - 0xc], eax
jmp 0x416e54
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x114]
mov dword [ecx + edx*4], 0xd69f4288
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x416e41
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x24]
movdqa xmm0, xmmword [str._t_t_t_t]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x330]
push ecx
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x120], eax
push ecx
push eax
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x11c], eax
movdqu xmmword [ebp - 0x340], xmm0
mov dword [ebp - 0x118], eax
call fcn.00414b1a
mov dword [ebp - 0xc], 0xffffffff
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x30], edi
push 3
call fcn.004133eb
mov dword [ebp - 0xc], 0
jmp 0x416ed2
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x188]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x416ebf
mov dword [ebp - 0xc], 3
cmp dword [ebp - 0xc], 0
jl 0x416ef8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x188]
mov dword [eax], ecx
dec dword [ebp - 0xc]
jns 0x416ee5
lea ecx, [ebp - 0x188]
call fcn.004134bd
lea ecx, [ebp - 0x120]
call fcn.004134bd
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jg 0x417a93
jmp 0x416f20
mov dword [ebp - 4], 0x5bf2d3f5
mov dword [ebp - 0xc], eax
jmp 0x416f3d
lea ecx, [ebp - 0x114]
call fcn.004134bd
push dword [ebp - 0x24]
movdqa xmm0, xmmword [0xaa4880]
lea ecx, [ebp - 0x2f0]
push ecx
xor eax, eax
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x300]
mov dword [ebp - 0xd8], eax
push ecx
push eax
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0xd4], eax
movdqu xmmword [ebp - 0x300], xmm0
mov dword [ebp - 0xd0], eax
call fcn.00414b1a
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], 0xe19e95d1
jbe 0x417b05
mov edx, edi
cmp dword [ebp - 0x10], eax
jne 0x417b07
mov edx, eax
mov ecx, dword [ebp - 0xd8]
xor ebx, ebx
mov dword [ebp - 0x30], ecx
mov esi, dword [ecx + 4]
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov ecx, dword [ebp - 0x10]
setle bl
xor edx, edx
cmp ebx, ecx
setge dl
xor ecx, ecx
cmp edx, esi
setg cl
cmp ecx, 0x6d21
jge 0x417b3a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret