Function at 0x4049ee
Capabilities:
Check os version
Get common file path
Log keystrokes via polling
Query service status
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x37c
movdqa xmm0, xmmword [0xa76f90]
xor eax, eax
push ebx
push esi
push edi
mov dword [esp + 0x50], ecx
xor edi, edi
push dword [esp + 0x50]
lea ecx, [esp + 0x324]
mov dword [esp + 0x2c], 0xffffffff
push ecx
lea ecx, [esp + 0x318]
mov dword [esp + 0x54], edx
push ecx
inc edi
mov dword [esp + 0xa0], eax
mov dword [esp + 0x2c], edi
lea ecx, [esp + 0xa0]
mov dword [esp + 0x60], 0xebf9035
push eax
movdqu xmmword [esp + 0x320], xmm0
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
call fcn.00401a81
xor eax, eax
mov dword [esp + 0x44], 0xfffe
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], 0xffffffe6
jle 0x404cd7
mov esi, dword [esp + 0x94]
mov dword [esp + 0x40], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x30], 0x1b35d569
mov dword [esp + 0x3c], 0x2b058efa
mov dword [esp + 0x24], 0xef9953e8
mov dword [esp + 0x34], 0x7feae215
mov dword [esp + 0x38], 0xcaa5d732
mov dword [esp + 0x18], 0x87b8b0d5
mov dword [esp + 0x10], eax
jmp 0x404ad2
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xec], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x404ac3
mov dword [esp + 0x10], eax
jmp 0x404aeb
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x58], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x404adf
inc dword [esp + 0x18]
je 0x404b1f
mov edx, dword [esp + 0xf4]
xor ebx, ebx
mov ecx, dword [esp + 0x58]
cmp edx, ecx
mov edx, dword [esp + 0x94]
setg bl
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x28]
cmp dword [edx + 4], ecx
mov edx, edi
jge 0x404b21
mov edx, eax
mov ecx, dword [esp + 0x24]
sub edx, ecx
je 0x404b2d
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x1c], 0x36fe
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
neg edx
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, ecx
setl bl
imul ebx, dword [esp + 0x38]
sub ebx, dword [esi + 8]
neg ebx
sbb ebx, ebx
inc ebx
cmp ebx, 0x2646899d
jl 0x404c2f
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], 0xfffffff1
jmp 0x404bd5
mov dword [esp + 0x3c], 0xde33
mov dword [esp + 0x30], 0x8693c25
cmp dword [esp + 0x1c], eax
je 0x404bcb
cmp dword [esp + 0x10], eax
je 0x404ba5
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0xf4]
xor edx, edx
test ecx, ecx
mov ecx, dword [esp + 0x10]
setle dl
imul ecx, edx
sub ecx, dword [esp + 0x3c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x24]
mov ecx, edi
jge 0x404bcd
mov ecx, eax
mov dword [esp + 0x30], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x33
jl 0x404b79
mov ecx, dword [esp + 0x58]
xor ebx, ebx
mov dword [esp + 0xf4], 0xdb2a
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
setne bl
cmp ebx, 0xdb2a
jne 0x404c0a
cmp dword [esp + 0x38], eax
jne 0x404c0a
mov edx, eax
mov ecx, dword [esp + 0x18]
sub edx, ecx
jne 0x404c1d
mov edx, eax
cmp dword [esp + 0xf0], eax
je 0x404c1f
mov edx, edi
mov ecx, dword [esp + 0x44]
sub edx, ecx
dec edx
mov dword [esp + 0x3c], edx
jmp 0x404cc8
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 9
jl 0x404cc8
mov ebx, dword [esp + 0x94]
mov dword [esp + 0x38], 0xed7c6c5f
cmp dword [esp + 0xf0], eax
jne 0x404c66
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x58]
cmp dword [esp + 0x3c], eax
je 0x404c80
mov esi, edi
cmp dword [esp + 0x30], eax
jne 0x404c82
mov esi, eax
mov ecx, dword [esp + 0x38]
xor edx, edx
cmp ecx, esi
setle dl
xor ecx, ecx
sub edx, dword [esp + 0x1c]
cmp edx, dword [ebx + 4]
setg cl
xor edx, edx
cmp ecx, 0x60806af7
mov ecx, dword [esp + 0x58]
setne dl
sub edx, 0x5fca9972
mov dword [ebx + 4], edx
mov dword [esp + 0x20], 0xffffffff
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 9
jge 0x404c4d
mov esi, dword [esp + 0x40]
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xffffffe6
jg 0x404a89
lea ecx, [esp + 0x94]
call fcn.00401a1f
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0xa0]
push 4
call fcn.0040194d
mov dword [esp + 0x30], 5
lea ecx, [esp + 0x290]
mov dword [esp + 0x10], 0x16488a9
push 2
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x404d31
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xa0]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x404d1f
mov dword [esp + 0x10], eax
jmp 0x404d50
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x290]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x404d3e
cmp dword [esp + 0x28], eax
je 0x404d7a
mov dword [esp + 0x34], 6
mov dword [esp + 0x34], 0xfffffffb
mov dword [esp + 0x30], eax
inc dword [esp + 0x30]
jmp 0x404e2f
mov dword [esp + 0x1c], 0x149cec79
mov dword [esp + 0x20], eax
jmp 0x404d98
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x7c], 0x92eda8ed
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x404d88
mov ecx, dword [esp + 0xa0]
mov dword [ecx + 0xc], edi
mov dword [esp + 0x30], edi
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], eax
jmp 0x404e28
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xa0]
cmp dword [ecx + edx*4], eax
jge 0x404e1e
mov ecx, dword [esp + 0x10]
xor edx, edx
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x7c]
cmp ecx, 0xc9e4
mov ecx, dword [esp + 0xa0]
setle dl
xor ebx, ebx
cmp dword [ecx + esi*4], edx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xa0]
setne bl
mov dword [ecx + edx*4], ebx
lea ecx, [ebx - 0xff84]
cmp ecx, 0xfff6
mov ecx, eax
jne 0x404e20
mov ecx, edi
mov dword [esp + 0x30], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x404dca
mov dword [esp + 0x28], eax
jmp 0x404e54
mov ecx, dword [esp + 0x28]
xor edx, edx
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0xa0]
cmp dword [eax + ecx*4], 0xffffffff
sete dl
mov dword [eax + esi*4], edx
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
jle 0x404e35
lea ecx, [esp + 0x290]
call fcn.00401a1f
lea ecx, [esp + 0xa0]
call fcn.00401a1f
push 2
pop esi
push esi
lea ecx, [esp + 0x1b0]
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x24], 8
mov dword [esp + 0x20], eax
jmp 0x404ea5
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1ac]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x404e93
mov dword [esp + 0x24], eax
jmp 0x404eda
mov byte [esp + 0x2f], al
cmp byte [esp + 0x2f], 0
je 0x404ec6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor eax, eax
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1ac]
cmp dword [ecx + edx*4], eax
jne 0x404ee0
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edi
jle 0x404eb1
lea ecx, [esp + 0x1ac]
call fcn.00401a1f
mov dword [esp + 0x24], 0xac204e2d
lea ecx, [esp + 0x224]
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x20], 0xee39f3fa
mov dword [esp + 0x38], 0xf6085e07
mov dword [esp + 0x54], 0x13d0bb94
mov dword [esp + 0x34], 9
mov dword [esp + 0x30], 0xfff839e0
mov dword [esp + 0x40], edi
mov dword [esp + 0x1c], 0xfffa
push esi
call fcn.0040194d
mov dword [esp + 0x3c], 0xffffffff
xor eax, eax
mov dword [esp + 0x44], 0x633933b8
mov dword [esp + 0x10], eax
jmp 0x404f6c
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xac], 0xc9a130df
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x404f59
mov dword [esp + 0x10], eax
jmp 0x404f8a
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x224]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x404f78
mov dword [esp + 0x30], 0xbbca6318
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0xac], eax
je 0x404fad
mov ecx, edi
cmp dword [esp + 0x40], eax
jne 0x404faf
mov ecx, eax
dec dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
cmp ecx, 0x31e
mov ecx, dword [esp + 0x20]
setle dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0xac]
setg bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [esp + 0x224]
setne dl
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x1c]
add edx, dword [ecx + 4]
xor ecx, ecx
cmp edx, dword [esp + 0x40]
setge cl
sub ecx, 0xc6dd
cmp ecx, dword [esp + 0x3c]
jg 0x40500a
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x44]
mov ecx, dword [esp + 0xac]
mov ecx, dword [esp + 0x54]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0xb0], eax
lea ecx, [esp + 0x224]
call fcn.00401a1f
mov dword [esp + 0x40], 0x4111d018
lea ecx, [esp + 0xc8]
mov dword [esp + 0x24], 0x9714a025
push esi
call fcn.0040194d
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0x104]
push esi
call fcn.0040194d
mov dword [esp + 0x38], 0x211521fa
xor eax, eax
mov dword [esp + 0x20], 9
mov dword [esp + 0x28], 0xb862b336
mov dword [esp + 0x10], eax
jmp 0x4050a4
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc8]
mov dword [ecx + edx*4], 0xb5542afa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x40508e
mov dword [esp + 0x10], eax
jmp 0x4050c6
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x104]
mov dword [ecx + edx*4], 0xf4442628
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x4050b0
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0xc8]
mov ecx, dword [ecx]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0xc8]
mov ebx, dword [esp + 0x104]
mov dword [esp + 0x44], ebx
mov ecx, dword [esi + 4]
lea edx, [ecx + 0xc4dd]
sub edx, ecx
neg edx
sbb edx, edx
inc edx
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov dword [esi + 4], edx
mov dword [ebx + 4], edx
je 0x405129
mov ecx, edi
cmp dword [esi + 4], eax
jne 0x40512b
mov ecx, eax
mov edx, 0x7673ed13
cmp ecx, dword [esp + 0x38]
jle 0x405251
mov dword [esp + 0x24], 0xf509e13c
mov dword [esp + 0x18], eax
jmp 0x405157
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x84], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x405148
mov dword [esp + 0x18], eax
jmp 0x405173
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x70], 0x832a49e8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x405163
mov dword [esp + 0x18], eax
jmp 0x40518e
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x270], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x40517f
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
sub ecx, 0x53c8
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
cmp dword [esp + 0x24], eax
je 0x4051c2
mov ecx, dword [esp + 0x70]
mov ecx, dword [esp + 0x270]
mov dword [ebx + 4], edx
mov dword [esp + 0x84], edx
mov ecx, dword [esp + 0x270]
mov ecx, dword [esp + 0x104]
mov ecx, dword [ecx]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
inc ecx
imul ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4051fc
mov ecx, dword [esp + 0x84]
xor ecx, ecx
cmp dword [esi + 4], 0xfff8
sete cl
xor ebx, ebx
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x24]
imul edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x278]
cmp edx, ecx
mov ecx, dword [esp + 0x270]
setg bl
imul ecx, ebx
mov dword [esp + 0x28], ecx
mov byte [esp + 0x2f], al
cmp byte [esp + 0x2f], al
je 0x405437
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x405437
mov dword [esp + 0x1c], 0x6993
lea ecx, [esp + 0xbc]
push edi
call fcn.0040194d
mov dword [esp + 0x30], 8
lea ecx, [esp + 0x110]
push 4
call fcn.0040194d
mov dword [esp + 0x40], 0x9b3eeac6
xor eax, eax
mov dword [esp + 0x40], 0x4cddccf3
mov dword [esp + 0x18], eax
jmp 0x4052aa
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xbc]
mov dword [ecx + edx*4], 5
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x405294
mov dword [esp + 0x18], eax
jmp 0x4052c6
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x5c], 0xfffffff9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x4052b6
mov dword [esp + 0x18], eax
jmp 0x4052e8
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x110]
mov dword [ecx + edx*4], 0x4c1ce2a3
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x4052d2
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0xc8]
push 0xfffffffffffffff9
mov edx, dword [ecx]
mov ecx, dword [esp + 0xc0]
cmp edx, dword [ecx]
pop edx
setne bl
imul ecx, ebx, 0x5a44
cmp edx, ecx
mov ecx, dword [esp + 0x1c]
sbb edx, edx
xor ebx, ebx
neg edx
cmp ecx, edx
setge bl
sub ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0xbc]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [esp + 0x40], ebx
xor ebx, ebx
mov edx, dword [esp + 0x40]
cmp edx, dword [ecx]
mov ecx, dword [esp + 0x28]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0x1c]
setg dl
add ecx, 0x267fa09d
cmp ecx, edx
je 0x40536c
mov ecx, edi
cmp dword [esp + 0x28], eax
jne 0x40536e
mov ecx, eax
mov edx, dword [esp + 0x44]
xor ebx, ebx
mov dword [esp + 0x5c], ecx
cmp ecx, dword [edx + 4]
mov ecx, dword [esp + 0xbc]
setle bl
mov edx, dword [ecx]
mov ecx, dword [esp + 0x20]
sub ebx, ecx
xor ecx, ecx
cmp ebx, edx
setne cl
xor ebx, ebx
cmp ecx, 0x2b4d3a61
setge bl
sub ebx, edx
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x110]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
mov dword [ecx], ebx
mov dword [esp + 0x40], ebx
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x5c]
mov ecx, dword [esp + 0xbc]
cmp dword [ecx], eax
mov eax, dword [esp + 0x110]
setl dl
xor ecx, ecx
cmp edx, dword [eax + 8]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0xc8]
setg cl
sub ecx, 2
add edx, ecx
neg edx
mov eax, dword [eax]
sbb edx, edx
xor ecx, ecx
neg edx
imul eax, edx
cmp eax, dword [esi + 4]
setge cl
xor edx, edx
cmp ecx, 8
lea ecx, [esp + 0x110]
setne dl
xor eax, eax
cmp edx, 0xc366
setne al
mov dword [esp + 0x40], eax
call fcn.00401a1f
lea ecx, [esp + 0xbc]
call fcn.00401a1f
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x104]
mov dword [eax], ecx
lea ecx, [esp + 0x104]
call fcn.00401a1f
lea ecx, [esp + 0xc8]
call fcn.00401a1f
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x24], 0xfffffff3
cmp dword [esp + 0x24], 6
push 3
pop esi
jne 0x405cfb
mov dword [esp + 0x10], 0x69fdf99f
lea ecx, [esp + 0x248]
mov dword [esp + 0x30], 0x2ea21e1d
mov dword [esp + 0x1c], 0xf4e1c2e9
mov dword [esp + 0x3c], 0xfffffffb
mov dword [esp + 0x40], 0xffffffff
push esi
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4054c9
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x248]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x4054b7
mov dword [esp + 0x10], eax
jmp 0x4054e4
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x2cc], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x4054d5
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0xfffffff0
jne 0x405667
mov esi, dword [esp + 0x248]
mov dword [esp + 0x28], 0xfffffff7
lea ecx, [esp + 0x1c4]
mov dword [esp + 0x18], eax
push 2
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x20], eax
jmp 0x405536
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c4]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x405523
mov byte [esp + 0x2f], al
cmp byte [esp + 0x2f], al
je 0x40556f
push 0x11fe
push eax
push eax
push 0x193a
push 0x8b3
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor eax, eax
mov ecx, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
cmp ecx, edx
setl bl
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x1c], ecx
jge 0x4055a4
mov ecx, edi
cmp dword [esp + 0x28], eax
jne 0x4055a6
mov ecx, eax
xor ebx, ebx
cmp ecx, 2
mov ecx, dword [esp + 0x18]
setg bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ebx, ebx
cmp edx, 0x7142b622
setle bl
xor edx, edx
add ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
cmp ebx, ecx
setne dl
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], eax
jne 0x4055e5
mov edx, eax
cmp dword [esp + 0x28], eax
je 0x4055e7
mov edx, edi
mov ecx, dword [esp + 0x3c]
sub edx, ecx
inc edx
jne 0x4055f4
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x40], 0xffffffff
jl 0x405613
mov edx, edi
cmp dword [esp + 0x1c], eax
jne 0x405615
mov edx, eax
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x1c4]
lea ecx, [esp + 0x1c4]
setle dl
mov dword [eax + 4], edx
xor eax, eax
cmp edx, edi
mov dword [esi + 4], edx
setle al
mov dword [esp + 0x2cc], eax
call fcn.00401a1f
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff0
push 0
pop eax
je 0x405501
push 3
pop esi
lea ecx, [esp + 0x248]
call fcn.00401a1f
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x2d4]
mov dword [esp + 0x34], 0xa049fe38
mov dword [esp + 0x34], 0
mov dword [esp + 0x34], 0xfffffff8
mov dword [esp + 0x34], 0x4b811476
mov dword [esp + 0x34], 0xfffffff8
mov dword [esp + 0x34], 0x70cd5099
push 2
call fcn.0040194d
mov dword [esp + 0x30], 0xa1654207
xor eax, eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], eax
jmp 0x4056d8
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x37c], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x4056c9
mov dword [esp + 0x10], eax
jmp 0x4056f7
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2d4]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x4056e4
inc dword [esp + 0x30]
mov byte [esp + 0x2f], al
cmp byte [esp + 0x2f], al
je 0x405713
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
lea ecx, [esp + 0x2d4]
call fcn.00401a1f
mov dword [esp + 0x34], 0x6e3e
xor eax, eax
mov dword [esp + 0x20], 0x5c68ec0a
mov dword [esp + 0x20], eax
jmp 0x40576a
cmp byte [esp + 0x2f], 0
je 0x405752
push eax
push 0x1e90
push 0xb38
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor eax, eax
mov byte [esp + 0x2f], al
cmp byte [esp + 0x2f], 0
je 0x405766
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x1b
mov byte [esp + 0x2f], al
jge 0x405737
cmp byte [esp + 0x2f], 0
je 0x405791
push eax
push eax
push 0x1b5e
push 0x1b54
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
xor eax, eax
mov dword [esp + 0x20], eax
jmp 0x4057a6
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x29c], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x405797
mov dword [esp + 0x28], 0x3c69
lea ecx, [esp + 0x2a0]
push edi
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x20], eax
jmp 0x4057db
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x2a0]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x4057c9
dec dword [esp + 0x28]
mov dword [esp + 0x28], eax
jmp 0x40580b
mov byte [esp + 0x2f], al
cmp byte [esp + 0x2f], 0
je 0x405807
push eax
push 0x1f19
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x34
je 0x4057eb
lea ecx, [esp + 0x2a0]
call fcn.00401a1f
xor eax, eax
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], eax
jg 0x405c39
push esi
lea ecx, [esp + 0x1e0]
call fcn.0040194d
mov dword [esp + 0x38], edi
xor eax, eax
mov dword [esp + 0x178], 0x8fe24307
mov dword [esp + 0x17c], 0x8fe24307
mov dword [esp + 0x180], 0x8fe24307
mov dword [esp + 0x184], 0x8fe24307
mov dword [esp + 0x30], 0xfffb
mov dword [esp + 0x44], edi
mov dword [esp + 0x10], eax
jmp 0x405895
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1dc]
mov dword [ecx + edx*4], 0xd581
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x40587f
mov dword [esp + 0x10], eax
jmp 0x4058b4
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x354], 0xfffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x4058a1
mov esi, dword [esp + 0x1dc]
cmp dword [esi + 8], eax
jne 0x405913
xor edx, edx
cmp dword [esi + 4], eax
sete dl
xor ecx, ecx
test edx, edx
setle cl
xor ebx, ebx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x180], ecx
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
cmp ecx, edx
setl bl
xor ecx, ecx
cmp dword [esi + 8], ebx
setl cl
xor edx, edx
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x40], ecx
mov ecx, eax
setge dl
cmp dword [esi + 8], edx
jge 0x405915
mov ecx, edi
cmp ecx, dword [esp + 0x44]
jne 0x405924
cmp dword [esp + 0x180], eax
je 0x405926
mov eax, edi
mov dword [esp + 0x35c], eax
lea ecx, [esp + 0x1dc]
call fcn.00401a1f
mov byte [esp + 0x17], 0
lea ecx, [esp + 0x88]
push 2
call fcn.0040194d
mov dword [esp + 0x28], 7
lea ecx, [esp + 0x230]
mov dword [esp + 0x18], 0xfffffff7
mov dword [esp + 0x10], 0xa9bacde9
push 2
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x54], 0xf7c1ae2e
mov dword [esp + 0x18], eax
jmp 0x405998
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x88]
mov dword [ecx + edx*4], 0xb8c3
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x405982
mov dword [esp + 0x18], eax
jmp 0x4059b8
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x2f0], 0x835a23e8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x4059a5
mov dword [esp + 0x18], eax
jmp 0x4059d7
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x230]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x4059c5
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x40], ecx
cmp dword [ecx + 4], eax
jne 0x4059fb
mov ecx, dword [ecx]
mov dword [esp + 0x2fc], ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
add ecx, dword [esp + 0x28]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x230]
mov dword [ecx + 4], edx
mov dword [esp + 0x28], eax
jmp 0x405bd4
mov dword [esp + 0x1c], 0xfffffffc
mov dword [esp + 0x3c], 0x1e52
mov dword [esp + 0x30], 0x92ff8224
mov dword [esp + 0x30], 4
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], eax
jl 0x405bd0
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x88]
mov ecx, dword [ecx + edx*4]
xor edx, edx
inc ecx
cmp ecx, 9
mov ecx, dword [esp + 0x1c]
setg dl
xor ebx, ebx
test edx, edx
setle bl
xor edx, edx
cmp ebx, ecx
mov ebx, dword [esp + 0x40]
setl dl
xor ecx, ecx
cmp edx, dword [ebx + 4]
setl cl
xor ebx, ebx
imul edx, ecx, 0x3da5
mov ecx, dword [esp + 0x1c]
cmp edx, ecx
mov ecx, dword [esp + 0x88]
setne bl
xor edx, edx
cmp ebx, dword [ecx + esi*4]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
setle dl
mov dword [esp + 0x44], edx
xor ebx, ebx
mov edx, dword [esp + 0x88]
add ecx, dword [esp + 0x44]
cmp dword [edx + esi*4], ecx
mov ecx, dword [esp + 0x18]
setg bl
add ecx, ebx
je 0x405b1c
mov dword [esp + 0x18], eax
jmp 0x405b11
mov byte [esp + 0x2f], al
cmp byte [esp + 0x2f], 0
je 0x405b0d
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
xor eax, eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x405aeb
jmp 0x405bc6
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x44], 0xd55faf23
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x3c]
jne 0x405b48
mov dword [esp + 0x18], eax
cmp dword [esp + 0x28], eax
je 0x405b4c
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], 0x5f8f0b53
mov ecx, dword [esp + 0x38]
cmp dword [esp + 0x30], ecx
jl 0x405b76
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x88]
cmp dword [ecx + edx*4], eax
jne 0x405b76
mov ecx, eax
cmp dword [esp + 0x28], eax
je 0x405b78
mov ecx, edi
mov esi, dword [esp + 0x3c]
xor edx, edx
imul esi, ecx
mov ecx, dword [esp + 0x54]
cmp esi, ecx
setg dl
cmp edx, 0xadad2da0
ja 0x405b96
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
xor ebx, ebx
cmp dword [esp + 0x18], ebx
setle bl
xor edx, edx
cmp ecx, ebx
setne dl
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2f0]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x44], ecx
dec dword [esp + 0x10]
jns 0x405a59
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 9
jge 0x405a2b
lea ecx, [esp + 0x230]
call fcn.00401a1f
lea ecx, [esp + 0x88]
call fcn.00401a1f
cmp byte [esp + 0x17], 0
je 0x405c26
push 0x73f
push 0x2408
push 0x23d1
push 0xf22
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
inc dword [esp + 0x20]
xor eax, eax
push 3
pop esi
cmp dword [esp + 0x20], eax
jle 0x40582e
mov dword [esp + 0x280], 0x5bb2c213
mov dword [esp + 0x284], 0x5bb2c213
mov dword [esp + 0x288], 0x5bb2c213
mov dword [esp + 0x28c], 0x5bb2c213
mov dword [esp + 0x10], 0xa2768935
mov dword [esp + 0x10], eax
jmp 0x405cb0
mov dword [esp + 0x28], 0x5010f7a7
mov dword [esp + 0x28], eax
jmp 0x405ca6
mov dword [esp + 0x1c], edi
mov dword [esp + 0x1c], eax
jmp 0x405c9c
mov ecx, dword [esp + 0x28]
cmp dword [esp + ecx*4 + 0x280], eax
jne 0x405ca2
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jle 0x405c8b
inc dword [esp + 0x28]
cmp dword [esp + 0x28], esi
jle 0x405c81
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x405c73
mov ecx, dword [esp + 0x24]
xor edx, edx
cmp ecx, 0xfdc8
setne dl
xor ecx, ecx
cmp edx, 0x74a5
setl cl
add ecx, dword [esp + 0x24]
mov dword [esp + 0x40], ecx
jne 0x405cde
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x34], edi
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 6
je 0x40547a
jmp 0x405cfd
xor eax, eax
mov dword [esp + 0x24], 5
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], eax
jmp 0x405d22
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x330], 0xcd546735
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x405d0f
mov dword [esp + 0x24], eax
jmp 0x405dcd
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], 0xffffffff
cmp dword [esp + 0x24], eax
je 0x405db4
mov dword [esp + 0x34], 0xffffffff
xor ebx, ebx
mov dword [esp + 0x34], 0xc58a012e
mov dword [esp + 0x30], 9
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x28]
cmp ecx, edx
setne bl
mov dword [esp + 0x34], ebx
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x405dc9
push eax
push eax
push 0x2de
push 0x1d17
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jmp 0x405dc7
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x405dc9
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor eax, eax
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x1c
jge 0x405d31
mov dword [esp + 0x28], eax
jmp 0x405df1
mov ecx, dword [esp + 0x28]
mov dword [esp + ecx*4 + 0x330], 0x3876a47c
inc dword [esp + 0x28]
cmp dword [esp + 0x28], esi
jl 0x405dde
mov dword [esp + 0x20], 0xbe8e56f9
mov dword [esp + 0x1c], eax
jmp 0x405e15
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x74], 0x6bdde0bc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x405e05
mov dword [esp + 0x20], eax
jmp 0x405e89
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], 0xb7f37c04
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], eax
jl 0x405e60
mov dword [esp + 0x1c], eax
jmp 0x405e4c
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x300], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x405e3d
dec dword [esp + 0x304]
dec dword [esp + 0x24]
jns 0x405e37
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], eax
jl 0x405e85
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x405e7f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
xor eax, eax
dec dword [esp + 0x24]
jns 0x405e6a
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jle 0x405e21
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x405eb1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor eax, eax
mov byte [esp + 0x17], al
lea ecx, [esp + 0x1f4]
mov dword [esp + 0x34], 0xa5c62e08
mov dword [esp + 0x34], eax
mov dword [esp + 0x34], 0xfffffffe
push 4
mov dword [esp + 0x38], 0x1c3c39ba
pop ebx
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x34], ebx
mov dword [esp + 0x34], 0xa0d461e3
mov dword [esp + 0x34], eax
push edi
call fcn.0040194d
mov dword [esp + 0x10], 0
jmp 0x405f16
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x36c], 0x398
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x405f03
mov dword [esp + 0x10], 0
jmp 0x405f38
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1f4]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x405f26
mov eax, dword [esp + 0x370]
lea ecx, [esp + 0x1f4]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x1f4]
inc dword [eax]
call fcn.00401a1f
cmp byte [esp + 0x17], 0
je 0x40611e
push edi
lea ecx, [esp + 0xfc]
call fcn.0040194d
mov dword [esp + 0x38], edi
xor eax, eax
mov dword [esp + 0x3c], 7
mov dword [esp + 0x10], eax
jmp 0x405fa1
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xf8]
mov dword [ecx + edx*4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x405f8f
mov dword [esp + 0x10], eax
jmp 0x405fc0
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x33c], 0xfffffffc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x405fad
mov ecx, dword [esp + 0x38]
xor edx, edx
mov ecx, dword [esp + 0xf8]
cmp dword [ecx], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0xf8]
setl dl
sub eax, edx
sub eax, dword [ecx]
mov esi, dword [ecx]
xor ecx, ecx
imul edx, eax, 3
mov eax, dword [esp + 0x38]
cmp edx, eax
setle cl
xor eax, eax
add ecx, esi
cmp ecx, esi
setl al
add eax, esi
je 0x4060f1
push 2
lea ecx, [esp + 0x198]
call fcn.0040194d
mov dword [esp + 0x30], 0xfffffff7
lea ecx, [esp + 0x20c]
push edi
call fcn.0040194d
mov dword [esp + 0x34], 0xf6f6d779
mov dword [esp + 0x10], 0
jmp 0x40604f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x194]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x40603d
mov dword [esp + 0x10], 0
jmp 0x406076
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20c]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x406060
mov dword [esp + 0x30], edi
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x194]
push 0
sub ecx, dword [eax + 4]
mov eax, dword [esp + 0x210]
mov dword [eax], ecx
mov eax, dword [esp + 0xfc]
pop ecx
setne cl
mov edx, dword [eax]
imul ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 6
setg al
xor ecx, ecx
sub eax, edx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0x72b4
lea ecx, [esp + 0x20c]
setl al
mov dword [esp + 0x34], eax
call fcn.00401a1f
lea ecx, [esp + 0x194]
call fcn.00401a1f
jmp 0x406108
mov dword [esp + 0x38], 0x4b76fef6
dec dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x344], eax
lea ecx, [esp + 0xf8]
call fcn.00401a1f
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x1a0]
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x30], 0xfffffff8
push edi
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x28], 0xde574131
mov dword [esp + 0x1c], eax
jmp 0x406169
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1a0]
mov dword [ecx + edx*4], 0x858f9c25
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x406153
mov ecx, dword [esp + 0x38]
xor ebx, ebx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
mov ecx, dword [esp + 0x38]
setne bl
add ecx, 0xfffffff6
add ecx, ebx
sub ecx, dword [esp + 0x30]
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [esp + 0x10], ecx
jge 0x4061e3
mov dword [esp + 0x1c], eax
jmp 0x4061b3
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x2b4], 9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x4061a0
cmp dword [esp + 0x2c0], eax
jne 0x4061ca
mov ecx, dword [esp + 0x2c0]
mov edx, dword [esp + 0x2c0]
mov ecx, dword [esp + 0x1a0]
imul edx, dword [ecx]
neg edx
mov dword [esp + 0x30], edx
jmp 0x40623a
mov dword [esp + 0x34], 7
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], al
je 0x4061fd
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
cmp dword [esp + 0x38], eax
je 0x40622e
dec dword [esp + 0x28]
mov ecx, dword [esp + 0x34]
add ecx, dword [esp + 0x28]
je 0x40622e
mov dword [esp + 0x10], 0xfffffff5
jmp 0x406225
cmp dword [esp + 0x28], eax
jne 0x40623a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x22
je 0x40621b
jmp 0x40623a
mov dword [esp + 0x34], 0xb4af
mov dword [esp + 0x34], eax
mov dword [esp + 0x10], eax
jmp 0x406285
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x406259
push 0x19cb
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [esp + 0x28], eax
jmp 0x40627b
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x406277
push 0xea
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
inc dword [esp + 0x28]
cmp dword [esp + 0x28], eax
jle 0x40625f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jle 0x406240
lea ecx, [esp + 0x1a0]
call fcn.00401a1f
mov dword [esp + 0x24], 0xa72c25fc
lea ecx, [esp + 0x1b8]
mov dword [esp + 0x30], 0x2e1dfe00
push 2
call fcn.0040194d
mov dword [esp + 0x34], 0x874be76d
xor eax, eax
mov dword [esp + 0x40], 0xba4d3ec9
mov dword [esp + 0x40], 0xfffffffe
mov dword [esp + 0x1c], eax
jmp 0x4062eb
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1b8]
mov dword [ecx + edx*4], 0xfffffff6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x4062d5
mov ecx, dword [esp + 0x24]
xor edx, edx
mov dword [esp + 0x30], ecx
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x1b8]
mov dword [esp + 0x40], ecx
mov dword [ecx + 4], esi
mov ecx, dword [esp + 0x24]
cmp ecx, edi
setle dl
xor ebx, ebx
imul edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
add edx, esi
cmp edx, ecx
mov ecx, dword [esp + 0x24]
setne bl
xor edx, edx
cmp ebx, ecx
setle dl
cmp edx, 0x54fd
jge 0x406344
mov ecx, edi
cmp dword [esp + 0x34], eax
jne 0x406346
mov ecx, eax
cmp ecx, dword [esp + 0x24]
jle 0x406357
mov ecx, dword [esp + 0x40]
cmp dword [ecx + 4], eax
mov ecx, eax
je 0x406359
mov ecx, edi
mov eax, dword [esp + 0x24]
add eax, ecx
lea ecx, [esp + 0x1b8]
mov dword [esp + 0x40], eax
call fcn.00401a1f
xor eax, eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], eax
je 0x4063ee
push 2
mov dword [esp + 0x1c], eax
pop ebx
jmp 0x4063a9
mov dword [esp + 0x34], 0x6e6
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x4063a1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
xor eax, eax
mov ecx, dword [esp + 0x34]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jge 0x406384
mov dword [esp + 0x18], eax
jmp 0x4063e2
mov dword [esp + 0x34], 0x693e93
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x4063d4
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
cmp dword [esp + 0x34], eax
jne 0x4064cd
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 5
jl 0x4063b5
jmp 0x4064cd
push dword [esp + 0x74]
movdqa xmm0, xmmword [0xa76f30]
lea ecx, [esp + 0x334]
push ecx
lea ecx, [esp + 0x328]
mov dword [esp + 0xdc], eax
push ecx
push eax
lea ecx, [esp + 0xe4]
mov dword [esp + 0xe8], eax
movdqu xmmword [esp + 0x330], xmm0
mov dword [esp + 0xec], eax
call fcn.00401a81
xor eax, eax
mov dword [esp + 0x34], 0xd99ea7eb
mov dword [esp + 0x1c], eax
jmp 0x406451
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x60], edi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x406445
mov dword [esp + 0x18], 0xffffffff
jmp 0x4064b5
mov dword [esp + 0x30], edi
cmp dword [esp + 0x30], eax
je 0x406477
cmp dword [esp + 0x18], eax
je 0x406477
cmp dword [esp + 0x30], eax
jne 0x40647f
mov esi, eax
cmp dword [esp + 0x60], eax
je 0x406481
mov esi, edi
mov ecx, dword [esp + 0x60]
xor edx, edx
imul ecx, dword [esp + 0x60]
cmp ecx, 0xb0ae
mov ecx, dword [esp + 0xd4]
setne dl
xor ebx, ebx
cmp esi, edx
sete bl
mov dword [ecx], ebx
xor ecx, ecx
cmp ebx, 0xfffffffd
sete cl
mov dword [esp + 0x34], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 8
jl 0x406461
lea ecx, [esp + 0xd4]
call fcn.00401a1f
push 2
xor eax, eax
pop ebx
mov dword [esp + 0x20], 7
mov dword [esp + 0x10], eax
jmp 0x4064eb
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x68], 0x3342eb9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x4064db
push edi
lea ecx, [esp + 0x12c]
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x34], 0x4ddb
mov dword [esp + 0x1c], eax
jmp 0x406520
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x128]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x40650e
mov ecx, dword [esp + 0x128]
mov dword [ecx], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], eax
jmp 0x40654c
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x2ac], 0x5683c8fc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jl 0x406539
mov dword [esp + 0x20], eax
jmp 0x40656b
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x2ac], 0xd214c405
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jl 0x406558
mov ecx, dword [esp + 0x128]
inc dword [ecx]
cmp dword [ecx], 0x11
jl 0x40652f
lea ecx, [esp + 0x128]
call fcn.00401a1f
mov dword [esp + 0x10], 0
jmp 0x4065a8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x160], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x406595
mov dword [esp + 0x34], 0xe125d16d
lea ecx, [esp + 0x188]
push 4
call fcn.0040194d
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x4065e2
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x188]
mov dword [ecx + edx*4], 0xf4288a13
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x4065cc
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x188]
mov dword [ecx + 4], edx
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], al
je 0x40660e
push eax
push 0x20dd
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
lea ecx, [esp + 0x188]
call fcn.00401a1f
xor eax, eax
mov dword [esp + 0x6c], eax
cmp dword [esp + 0x6c], 0x10
je 0x406bf1
mov dword [esp + 0x10], 0x173bf38c
mov dword [esp + 0x20], 0xf0d3ecf0
mov dword [esp + 0x1c], 0x41b44adc
mov dword [esp + 0x34], 3
cmp dword [esp + 0x10], eax
je 0x406698
push dword [esp + 0x4c]
lea ecx, [esp + 0x4f]
push dword [esp + 0x54]
push ecx
push eax
call fcn.0040ac96
add esp, 0x10
lea ecx, [esp + 0x254]
push 9
pop esi
mov dword [esp + 0x10], esi
push ebx
call fcn.0040194d
mov dword [esp + 0x38], esi
mov dword [esp + 0x30], 0xf093d7f2
mov dword [esp + 0x1c], 0
jmp 0x406cbb