Function at 0x424953
Capabilities:
Delete registry key
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push esi
mov esi, dword [sym.imp.GDI32.dll_RectVisible]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0xc], 0xa48bbca6
mov dword [ebp - 0x10], 0x3813
push 1
mov dword [ebp - 4], 0xf8de905f
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0xa1ec
pop ecx
mov dword [ebp - 0xc], 0xffffffef
cmp dword [ebp - 0xc], 0xfffffff2
push 0
mov byte [ebp - 0x3d], dl
pop eax
jl 0x424aa5
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x2c], 0x4f230135
mov dword [ebp - 0x2c], 0x9e071a05
mov dword [ebp - 0x18], 0x4ca77904
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0x9040c3f3
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x20], eax
jmp 0x4249ed
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x178], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x4249dc
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x45c8100c
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
add eax, 0x7af2
add eax, ecx
je 0x424a1e
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov dword [ebp - 0x16c], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0xeb9ae77a
mov eax, dword [ebp - 0x1c]
sbb edx, edx
neg edx
sub edx, 0xfffffff6
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], 0xffffffef
jmp 0x424a8c
xor eax, eax
mov dword [ebp - 0x38], 0x7c6d
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x424a7d
push eax
call edi
push eax
call ebx
push eax
call esi
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x15
jg 0x424a63
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff2
push 0
pop eax
push 1
pop ecx
jge 0x4249aa
cmp dword [ebp - 0x10], eax
je 0x424aad
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov edx, ecx
sub edx, eax
xor ecx, ecx
mov eax, dword [ebp - 4]
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0xc]
jg 0x424ad1
xor ecx, ecx
cmp dword [ebp - 0x10], ecx
jne 0x424ad3
xor edx, edx
mov eax, ecx
inc edx
jmp 0x424ad8
xor ecx, ecx
xor edx, edx
inc edx
mov eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xc], 0x43cdf98a
mov dword [ebp - 0x20], ecx
jmp 0x424af4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x120], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x424ae7
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
imul edx, eax
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0xc]
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0xc]
jne 0x424b21
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x11c], 0xfffffffd
mov eax, dword [ebp - 0xc]
sbb ecx, ecx
neg ecx
sub eax, ecx
imul eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x424b56
push eax
push eax
call edi
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
xor eax, eax
mov dword [ebp - 0xc], 0xa48bbca6
mov dword [ebp - 0x10], 0x3813
mov dword [ebp - 4], 0xf8de905f
mov dword [ebp - 0x30], 0xa1ec
mov dword [ebp - 0xc], 0xffffffef
cmp dword [ebp - 0xc], 0xfffffff2
jl 0x424c80
jmp 0x424b87
xor eax, eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x2c], 0x4f230135
mov dword [ebp - 0x2c], 0x9e071a05
mov dword [ebp - 0x18], 0x4ca77904
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0x9040c3f3
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x20], eax
jmp 0x424bce
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x150], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x424bbd
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x45c8100c
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
add eax, 0x7af2
add eax, ecx
je 0x424bff
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0xeb9ae77a
mov eax, dword [ebp - 0x1c]
sbb edx, edx
neg edx
sub edx, 0xfffffff6
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], 0xffffffef
jmp 0x424c6d
xor eax, eax
mov dword [ebp - 0x38], 0x7c6d
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x424c5e
push eax
call edi
push eax
call ebx
push eax
call esi
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x15
jg 0x424c44
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff2
jge 0x424b85
cmp dword [ebp - 0x10], 0
je 0x424c89
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
xor esi, esi
inc esi
xor ecx, ecx
mov edx, esi
sub edx, eax
mov eax, dword [ebp - 4]
cmp edx, eax
setg cl
xor edx, edx
cmp ecx, dword [ebp - 0xc]
jg 0x424cab
mov eax, edx
cmp dword [ebp - 0x10], edx
je 0x424cad
mov eax, esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0xc93b4e1
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x20], edx
jmp 0x424cd1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x60], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x424cc3
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x424ced
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
xor edx, edx
mov dword [ebp - 0x14], 0x19
jmp 0x424ec5
mov dword [ebp - 0xc], 0x4ebb0cb8
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x1c], edx
xor edx, edx
mov dword [ebp - 0x1c], 0xcecce005
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
cmp eax, ecx
setle dl
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
neg edx
mov dword [ebp - 0x60], eax
sbb edx, edx
imul eax, eax, 0xfff8
neg edx
xor ecx, ecx
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], edx
jne 0x424d4d
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], 0xd
cmp dword [ebp - 0x10], 0xfffffff0
jne 0x424ec2
mov dword [ebp - 0x28], 0xc1348862
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
sub edx, 0x9e62b560
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], ecx
mov ecx, 0xfffa
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
xor ebx, ebx
cmp ecx, 0xa34071e9
jb 0x424dbb
mov edx, esi
cmp dword [ebp - 0x28], ebx
jne 0x424dbd
mov edx, ebx
mov eax, dword [ebp - 0x60]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setge cl
imul edx, ecx, 0xdb0f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], 0x15
jmp 0x424ea8
mov dword [ebp - 4], 0x6128b293
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], ebx
jmp 0x424e0b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa0], 0xf76e5f37
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x424dfa
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
cmp eax, esi
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x28], 0x9e1d
jle 0x424e4c
mov edx, esi
cmp dword [ebp - 0x18], ebx
jne 0x424e4e
mov edx, ebx
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 4]
setl bl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
sete cl
xor edx, edx
cmp ebx, ecx
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 4]
setne bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor eax, eax
cmp ecx, 0x1f91351d
setle al
xor ebx, ebx
mov dword [ebp - 0xa0], eax
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x424ea5
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff4
jne 0x424deb
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff0
push 0
pop edx
je 0x424d64
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xc
jl 0x424cf9
mov esi, dword [0x48a5ec]
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x30], 0x2df
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], edx
jmp 0x424ef9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x80], 1
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x424eeb
mov dword [ebp - 0x24], 0x10
jmp 0x425020
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], edx
jl 0x42501d
mov dword [ebp - 4], edx
jmp 0x424f3f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xcc], 0xfffffff6
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x424f2e
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x424f5c
push 0x132c
push edx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor edx, edx
cmp dword [ebp - 0x10], edx
je 0x424f84
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x80]
test eax, eax
mov eax, dword [ebp - 0xc8]
setg cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xa9b03be4
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
add eax, edx
jne 0x424fd1
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x10]
neg ecx
push 0
sbb ecx, ecx
inc ecx
mov edx, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0x78]
add edx, ecx
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0xffffffff
mov ecx, dword [ebp - 0x10]
sbb eax, eax
xor edx, edx
inc eax
add ecx, eax
mov eax, dword [ebp - 0xcc]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
mov dword [ebp + eax*4 - 0x80], edx
dec dword [ebp - 0x10]
pop edx
jns 0x424f29
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff0
jle 0x424f0b
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], 0x99841b3c
mov dword [ebp - 0x14], 0xb9dd952e
mov dword [ebp - 0x28], 0xfffffffe
push 4
mov dword [ebp - 0x10], 1
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
mov dword [ebp - 4], edx
pop ecx
jmp 0x42506d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x188], 0x5a14e9c1
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x42505c
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 7
jge 0x42520d
xor esi, esi
inc esi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 4], edx
jmp 0x4250a8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xdc], 0xac1dea90
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x425097
dec dword [ebp - 0x1c]
je 0x425146
cmp dword [ebp - 0xc], edx
je 0x4250da
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
mov eax, esi
cmp dword [ebp - 0x20], edx
jne 0x4250dc
mov eax, edx
cmp eax, dword [ebp - 0x28]
jg 0x4250e4
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x20], edx
je 0x4250f8
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x10]
cmp dword [ebp - 0x18], eax
je 0x425146
mov dword [ebp - 0x10], edx
jmp 0x42513b
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xdc], edx
jne 0x4251fa
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xdc]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x42511e
jmp 0x4251fa
mov dword [ebp - 0x18], 0xdda102f3
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x425163
push 0x1406
call dword [sym.imp.USER32.dll_GetSysColor]
xor edx, edx
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], edx
jl 0x4251fa
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x425188
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xdc], 0xcf8314cd
jne 0x42519b
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
jg 0x4251af
mov ecx, esi
cmp dword [ebp - 0x24], edx
jne 0x4251b1
mov ecx, edx
mov eax, dword [ebp - 0x10]
push 0
mov edx, dword [ebp + eax*4 - 0xdc]
imul edx, ecx
neg edx
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0xdc]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x14], edx
dec dword [ebp - 0x10]
pop edx
jns 0x425173
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 7
push 4
pop ecx
jl 0x425082
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x10], edx
jmp 0x425232
mov dword [ebp - 0x18], 0x80eff2b3
dec dword [ebp - 0x18]
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x42522f
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor edx, edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x425212
xor ecx, ecx
inc ecx
cmp byte [ebp - 0x3d], 0
je 0x425341
cmp esi, ecx
jne 0x425341
mov eax, 0x469ad59e
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 4], edx
jmp 0x42527c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x108], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x42526f
mov dword [ebp - 0x98], edx
cmp dword [ebp - 0x98], edx
jg 0x4252bc
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x4252ab
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor edx, edx
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], edx
jle 0x42528f
xor ecx, ecx
inc ecx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x4252d4
push ecx
call edi
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0xc], 0xa48bbca6
mov dword [ebp - 0x30], 0xdc4b4e12
mov dword [ebx + 8], 4
mov dword [ebp - 4], edx
jmp 0x4252ff
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x104], 0x90a624cd
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x4252ee
mov dword [ebp - 0xc], edx
jmp 0x425316
mov dword [ebp - 0x18], 7
inc dword [ebp - 0x18]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x425309
mov dword [ebp - 0xc], 6
jmp 0x425334
mov dword [ebp - 0x38], 0x64fd9e2a
cmp dword [ebp - 0x38], edx
jne 0x42533a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x13
jne 0x425325
mov dword [ebx + 0xc], 0x48a5ec
mov esi, dword [ebp - 0x34]
cmp esi, dword [ebp - 0x2c]
jge 0x426149
mov dword [ebp - 0xc], 0xfffffffa
mov dword [ebp - 4], edx
jmp 0x42536a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb0], 0x6192
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x425359
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], edx
jl 0x4253af
mov dword [ebp - 4], 0xfffffffa
mov dword [ebp - 4], edx
jmp 0x425398
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x425395
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jle 0x425383
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xb0]
dec dword [ebp - 0xc]
jns 0x425377
xor ecx, ecx
inc ecx
mov dword [ebp - 0xc], edx
jmp 0x4253eb
mov dword [ebp - 4], ecx
mov dword [ebp - 4], 0x14
cmp dword [ebp - 4], 0xfffffffc
jne 0x4253e5
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x4253d9
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
xor edx, edx
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffffc
je 0x4253c4
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0xc]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe8
jne 0x4253b4
mov dword [ebp - 0x38], edx
mov ebx, 0x48a5f0
mov dword [ebp - 0x28], ebx
test esi, esi
jle 0x425aa7
mov dword [ebp - 0x10], 0xb9f9b31
mov dword [ebp - 4], 0x2e166580
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 4], 0xbe618b25
push 4
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 4], edx
pop esi
jmp 0x425443
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x168], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x425436
mov dword [ebp - 0x10], 0xe
cmp dword [ebp - 0x10], 8
jge 0x4255e2
xor ebx, ebx
mov dword [ebp - 0x14], 0xf1bf506e
mov dword [ebp - 4], 0x8319b885
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0xc], edx
jmp 0x425486
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x100], 0x7662b0a9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x425475
mov dword [ebp - 0xc], edx
jmp 0x42549d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x138], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x425490
mov dword [ebp - 0x14], 6
jmp 0x4254d5
mov byte [ebp - 5], dl
cmp byte [ebp - 5], bl
je 0x4254be
push edx
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], bl
je 0x4254d2
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
xor edx, edx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe5
jg 0x4254ac
cmp dword [ebp - 0x10], edx
jge 0x4254e8
lea ecx, [ebx + 1]
cmp dword [ebp - 4], edx
jne 0x4254ea
mov ecx, edx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 4]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
mov dword [ebp - 0x15c], edx
cmp edx, dword [ebp - 0x18]
jge 0x42554a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0xf4]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xfffffff7
mov ecx, 0x37bb
setl al
xor edx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub ecx, eax
mov eax, dword [ebp - 0xf4]
cmp ecx, 0x35718a84
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
add ecx, eax
mov dword [ebp - 0xfc], ecx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x20]
cmp edx, 0xfff9
jne 0x4255bd
xor edx, edx
cmp dword [ebp - 4], edx
je 0x4255bf
lea ecx, [ebx + 1]
jmp 0x4255c1
xor edx, edx
mov ecx, edx
xor eax, eax
cmp ecx, 0xfffb
sete al
mov dword [ebp - 0x130], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jl 0x42545b
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebx]
mov dword [ebp - 0xc], 5
mov dword [ebp - 4], 0xa75a592c
mov dword [ebp - 4], 0x8e045dce
mov dword [ebp - 0x24], 0xa71a6e48
mov dword [ebp - 0x20], esi
xor esi, esi
mov dword [ebp - 0x28], 0x2b500989
inc esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], 0x420ea1bc
mov dword [ebp - 0x30], 0xd56a4262
mov dword [ebp - 0x30], 0x4e630971
mov dword [ebp - 0x30], 0xc9257018
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x1c], 0x38fd2320
mov dword [ebp - 0x14], 0x16e8cfb9
mov dword [ebp - 0x10], 0xc30f141
mov dword [ebp - 0x30], 0x2d3f
mov dword [ebp - 4], edx
jmp 0x425669
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x64], 0x8aee5119
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x42565b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
neg ecx
cmp eax, dword [ebp - 0xc]
jl 0x425686
mov eax, esi
cmp dword [ebp - 0xc], edx
jne 0x425688
mov eax, edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], eax
jge 0x425697
mov ecx, esi
cmp dword [ebp - 4], edx
jne 0x425699
mov ecx, edx
mov eax, dword [ebp - 0xc]
add eax, ecx
xor ecx, ecx
cmp eax, 0xa6957688
setne cl
xor edx, edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0xfe2c
neg ecx
sbb ecx, ecx
add ecx, 0x56574b61
sub ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
test eax, eax
je 0x42572f
cmp dword [ebp - 0x14], ecx
jne 0x42572b
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xc], eax
jl 0x42570f
cmp dword [ebp - 0x18], ecx
jne 0x425714
cmp dword [ebp - 0x64], ecx
je 0x425717
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 4], eax
je 0x42572f
mov eax, esi
jmp 0x425731
mov eax, ecx
cmp eax, dword [ebp - 0x64]
jle 0x42573d
mov eax, esi
cmp dword [ebp - 0x1c], ecx
jne 0x42573f
mov eax, ecx
add eax, 0xfffffffc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ecx
je 0x42574d
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
push 4
mov dword [ebp - 0x20], 9
pop eax
mov dword [ebp - 0x1c], 0x13532fe2
add ebx, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ecx
jmp 0x42577f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x140], 3
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x42576e
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ecx
jl 0x4257a8
xor ebx, ebx
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x42579e
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
dec dword [ebp - 0x1c]
jns 0x42578f
mov ebx, dword [ebp - 0x28]
xor ecx, ecx
mov esi, dword [ebx]
xor edx, edx
mov dword [ebp - 0x14], 0x7ddc85f7
inc edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 3
jge 0x4257cc
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x12c], edx
inc dword [ebp - 4]
jmp 0x4257b7
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xffffffef
jge 0x4258a9
xor ebx, ebx
mov dword [ebp - 0x24], 0x46158d32
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], 0x96d402da
mov dword [ebp - 0x18], 0xc6f79b34
mov dword [ebp - 0x20], 0xb8d23212
mov dword [ebp - 0x24], ebx
jmp 0x42588e
mov dword [ebp - 0x18], 0x369b
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x30], 0x874acc01
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], 0xb78a
cmp dword [ebp - 0x1c], ebx
jne 0x42583c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x18], 0xfd03
test eax, eax
mov eax, ebx
je 0x42583e
mov eax, edx
mov ecx, dword [ebp - 4]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x14]
add ecx, 0x5c6a3f15
cmp ecx, eax
setl dl
xor eax, eax
mov dword [ebp - 0x128], edx
mov ecx, dword [ebp - 0x18]
imul ecx, edx
sub ecx, dword [ebp - 0x24]
cmp ecx, 7
setne al
xor edx, edx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x24]
inc edx
cmp dword [ebp - 0x24], edx
je 0x425802
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffef
jl 0x4257db
mov ebx, dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 0xc], ecx
add ebx, 4
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], 2
mov dword [ebp - 4], ecx
jmp 0x4258d9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xac], 0xc75d
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x4258c8
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x14], ecx
jne 0x4258ea
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x10], ecx
jne 0x425904
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xc]
mov ecx, 0xb5d16521
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xac]
sub ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add edx, ecx
xor ecx, ecx
cmp edx, eax
mov edx, 0xfff8
setle cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xac]
cmp eax, 0x2be2ff5
setge cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], 0x49a5c1b0
mov dword [ebp - 0x28], 0x32da3bb1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
cmp edx, eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], eax
jmp 0x4259b4
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4259b1
push 0x1f6d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
je 0x42598d
mov eax, dword [ebp - 0xa4]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
cmp eax, 1
setge cl
xor edx, edx
imul ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
cmp ecx, 3
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x24]
jl 0x4259f4
xor eax, eax
cmp dword [ebp - 0xa4], eax
jne 0x4259f4
mov ecx, eax
jmp 0x4259f7
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x8e66
mov ecx, 0xfc71
setge al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub ecx, eax
imul ecx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0x38d581ca
mov eax, 0xfffc
setne cl
cmp eax, ecx
mov eax, dword [ebp - 0xc]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, 0x2ccf58d9
setge al
add eax, 0x7069
mov dword [ebp - 0x28], eax
test esi, esi
jne 0x425a51
add ebx, 8
xor edx, edx
mov dword [ebp - 4], 0xfffffffe
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x425a72
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x425a86
mov dword [ebp - 0x30], 0x6e871d97
cmp dword [ebp - 0x30], edx
jne 0x425a8c
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff0
je 0x425a77
mov eax, dword [ebp - 0x38]
add ebx, edi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
inc eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x38], eax
cmp eax, dword [ebp - 0x34]
jl 0x425404
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 4], edx
jmp 0x425acb
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x158], 0x1713
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x425aba
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], edx
jl 0x425b3b
mov dword [ebp - 4], 0xe6e83846
mov dword [ebp - 0x30], 7
mov dword [ebp - 4], edx
jmp 0x425b00
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x10c], 0x1abe8f21
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x425aef
mov dword [ebp - 4], edx
jmp 0x425b31
mov dword [ebp - 0x34], ecx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x425b2b
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor ecx, ecx
xor edx, edx
inc ecx
dec dword [ebp - 0x34]
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jle 0x425b0a
dec dword [ebp - 0x1c]
jns 0x425adc
mov esi, dword [ebx]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x30], 0x731e7bf5
mov dword [ebp - 0x34], 0xaec51ac0
mov dword [ebp - 0x34], 0xecc33bab
mov dword [ebp - 0x34], 0xd700d1a0
mov dword [ebp - 0x18], 0x385e
mov dword [ebp - 0x34], 0xfff7
mov dword [ebp - 0x38], 0x312446b8
mov dword [ebp - 0x14], 0x5f713ec2
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xc], edx
jmp 0x425b91
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe8], 0x4e2db58e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x425b80
mov dword [ebp - 0xc], edx
jmp 0x425bad
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x110], 0x5631cd1a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x425b9c
push 2
mov dword [ebp - 0xc], edx
pop edi
jmp 0x425bfc
mov dword [ebp - 4], edx
jmp 0x425bcd
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x44], 0x197f0a2
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x425bbf
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], edi
jg 0x425bf9
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe8], ecx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], edi
jle 0x425bda
xor ecx, ecx
inc ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jle 0x425bba
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0xffffffe5
jge 0x425d84
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x34], 0xbd9b76fc
mov dword [ebp - 0x34], 0x59fb
mov dword [ebp - 0x10], edx
jmp 0x425c39
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbc], 0x35db5a26
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x425c28
mov dword [ebp - 0x10], edx
jmp 0x425c4d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x54], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x425c43
mov dword [ebp - 0x10], edx
jmp 0x425c69
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf0], 0xf82eddaa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x425c58
mov ecx, dword [ebp - 0x18]
xor esi, esi
mov eax, dword [ebp - 0xe4]
inc esi
inc dword [ebp - 0x18]
mov edi, esi
cmp eax, ecx
jle 0x425c85
mov edi, edx
cmp dword [ebp - 0x54], edx
je 0x425c8c
mov edx, esi
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
sub eax, 0x19b2
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x4c]
cmp edi, eax
setle cl
mov dword [ebp - 0x34], ecx
mov ecx, 0xb34d7aeb
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x50]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setne dl
sub edx, eax
je 0x425ce3
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xe4]
xor edx, edx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], 0x619fe
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setg dl
cmp edx, dword [ebp - 0x30]
jl 0x425d08
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
sub eax, 0x15d2bb39
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
jne 0x425d2c
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0xf0]
xor ecx, ecx
mov dword [ebp - 0x34], 0xffffffff
inc ecx
mov dword [ebp - 0x14], edx
jmp 0x425d6c
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x425d69
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor ecx, ecx
xor edx, edx
inc ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x425d46
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe5
push 2
pop edi
jl 0x425c0e
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edx
jmp 0x425d9a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x3c], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x425d8c
mov dword [ebp - 0xc], 0xffffffec
cmp dword [ebp - 0xc], 0x17
je 0x425ed2
jmp 0x425db5
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], 0xd9ba07e4
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0xc25
mov dword [ebp - 4], edx
jmp 0x425de3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x48], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x425dd9
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xc], eax
jle 0x425e57
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x3c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0
jne 0x425e1a
mov eax, dword [ebp - 0x24]
xor esi, esi
xor edx, edx
inc esi
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x3c]
imul ecx, eax, 0x91f9
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x3c]
neg edx
sbb edx, edx
inc edx
cmp edx, 3
jge 0x425e55
mov ecx, esi
xor edx, edx
jmp 0x425e59
xor edx, edx
mov ecx, edx
mov eax, dword [ebp - 0x3c]
sub ecx, eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xc], 0x4c116104
jne 0x425e75
cmp dword [ebp - 0x18], edx
jne 0x425e7d
cmp dword [ebp - 0x24], edx
jne 0x425e7d
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x48], edx
je 0x425e8e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
push 0
setge dl
mov dword [ebp - 0x3c], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x17
pop edx
jne 0x425db2
mov esi, dword [ebp - 0x20]
mov edi, dword [ebx + 4]
push 2
mov dword [ebp - 4], edx
pop ecx
jmp 0x425ee7
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x5c], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x425edd
mov dword [ebp - 0x5c], 0xffffffe7
jmp 0x425f23
mov dword [ebp - 4], 0xdce9d05b
mov dword [ebp - 4], edx
jmp 0x425f1a
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x425f17
push 0x221b
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 9
jle 0x425f01
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0x14
jne 0x425ef5
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x425f4b
push 0x170b
push 0x156f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor edx, edx
mov dword [ebp - 0x24], 0xbc75286e
add ebx, 8
mov dword [ebp - 0xc], 0xf55e00fe
xor ecx, ecx
inc ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x34], 0x2967684a
mov dword [ebp - 0x30], 0x94bf7d6
mov dword [ebp - 4], edx
jmp 0x425f86
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x74], 0xffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x425f78
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edx
jne 0x425f9a
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
imul eax, dword [ebp - 0xc], 0xb59
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x6c]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x6c]
jl 0x425fcf
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x6c]
cmp ecx, eax
mov ecx, dword [ebp - 0x6c]
setg dl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 7
setg al
xor ecx, ecx
cmp eax, 0x8fa
mov eax, dword [ebp - 0x6c]
setl cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x6c]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, dword [ebp - 0x6c]
jle 0x426037
cmp dword [ebp - 0x24], edx
jne 0x426037
xor ecx, ecx
mov eax, edx
inc ecx
jmp 0x42603c
xor ecx, ecx
inc ecx
mov eax, ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
sub eax, 0x6826c341
mov dword [ebp - 0x30], eax
test edi, edi
jne 0x426140
cmp byte [ebp - 0x3d], 0
je 0x426066
cmp dword [ebp - 0x2c], ecx
jne 0x426066
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
add dword [ecx + 8], eax
mov ecx, dword [ebp - 0x28]
push esi
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
add ecx, 8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], ecx
call fcn.004631c7
mov edi, eax
xor eax, eax
pop ecx
mov dword [ebp - 0xb4], eax
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0xb4]
push eax
push esi
mov dword [ebp - 0x34], edi
call fcn.00449616
xor edx, edx
test esi, esi
mov esi, dword [ebp - 0x8c]
mov ecx, edx
jle 0x426114
mov eax, ecx
and eax, 0x80000001
jns 0x4260cc
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, ebx
add eax, ecx
add eax, ebx
imul eax, dword [ebp - 0x30]
cdq
idiv dword [ebp - 0x20]
xor eax, eax
cmp word [esi + edx*2], ax
je 0x4260f8
xor edi, edi
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x20]
cmp word [esi + edx*2], di
jne 0x4260e8
mov edi, dword [ebp - 0x34]
xor eax, eax
inc eax
mov word [esi + edx*2], ax
mov eax, dword [ebp - 0x28]
mov al, byte [edx + eax]
mov byte [ecx + edi], al
inc ecx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
jl 0x4260be
xor edx, edx
jmp 0x426117
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebx + 4], edi
test esi, esi
je 0x426143
push esi
call fcn.004646b6
xor edx, edx
pop ecx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x84], edx
jmp 0x426143
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 4], 0xbac64a68
mov dword [ebp - 4], 0xd
jmp 0x426173
cmp byte [ebp + 0xb], 0
je 0x426170
push edx
push edx
push 0xe31
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffe3
mov byte [ebp + 0xb], dl
jge 0x426159
cmp byte [ebp + 0xb], 0
je 0x426192
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret