Function at 0x426ad1
Capabilities:
Create process on windows
Get keyboard layout
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
push ebx
mov dword [ebp - 0xc], 0xac204e2d
push esi
mov dword [ebp - 0x20], 0x1ba028ea
push edi
mov dword [ebp - 0x20], 0xfffffff7
xor edi, edi
inc edi
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x20], edi
xor eax, eax
mov dword [ebp - 0x30], 0x188753e1
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x30], 6
mov dword [ebp - 0xc], eax
jmp 0x426b32
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x426b2f
push eax
push 0x16cf
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x1b
jl 0x426b17
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp edx, ecx
setne bl
xor edx, edx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov esi, dword [ebp - 0xc]
imul esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp esi, ecx
setl dl
mov dword [ebp - 0x30], edx
imul ecx, dword [ebp - 0xc], 0xfffd
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x24], 0x35c5735e
mov dword [ebp - 0x24], 0x94b2ab76
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
jmp 0x426bb9
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xa0], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x426ba8
push 3
pop edx
mov dword [ebp - 0x18], eax
push 2
pop esi
cmp dword [ebp - 0x18], eax
jl 0x426c26
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], eax
jmp 0x426bee
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x214], 0x1d52aa0a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x426bdd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x426c21
mov dword [ebp - 0x30], 0xc35240ca
dec dword [ebp - 0x214]
mov dword [ebp - 0x14], eax
jmp 0x426c17
mov dword [ebp - 0x30], 0x6fda0246
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x426c0d
dec dword [ebp - 0x10]
jns 0x426bfb
dec dword [ebp - 0x18]
jns 0x426bcc
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x2c], 0xeb905d09
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x28], 0xe2efe8e
mov dword [ebp - 0x38], 0xaecaa705
mov dword [ebp - 0x14], eax
jmp 0x426c65
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xe4], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x426c54
push 8
mov dword [ebp - 0x18], eax
pop edx
jmp 0x426c92
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], eax
jmp 0x426c87
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x4f8], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x426c7a
dec dword [ebp - 0x1c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jne 0x426c72
mov ecx, dword [ebp - 0xe0]
cmp dword [ebp - 0xdc], eax
je 0x426d0d
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x2c]
test ecx, ecx
jne 0x426cb7
mov edx, eax
cmp dword [ebp - 0x30], eax
je 0x426cb9
mov edx, edi
mov ecx, dword [ebp - 0xdc]
sub edx, ecx
mov ecx, dword [ebp - 0x1c]
imul ecx, edx
add ecx, dword [ebp - 0x28]
jne 0x426ccf
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x38], edi
jl 0x426cd7
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x28]
cmp ecx, edx
setl bl
cmp ebx, dword [ebp - 0x1c]
jne 0x426cf9
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x426cfb
mov edx, edi
xor ecx, ecx
cmp edx, 0xffffffff
setne cl
cmp ecx, 0x133e
mov ecx, eax
jge 0x426d0f
mov ecx, edi
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xdc]
push esi
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
mov dword [ebp - 0xdc], ecx
lea ecx, [ebp - 0x398]
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], 0xac204e2d
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], 0xa2a4
mov dword [ebp - 0x24], 0x1d832937
mov dword [ebp - 0x24], 0x57478144
call fcn.0041796c
mov dword [ebp - 8], 0
jmp 0x426d8b
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x398]
mov dword [eax + ecx*4], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x426d7c
push 4
mov dword [ebp - 8], 0
pop ecx
jmp 0x426dad
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x428], 5
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x426d9c
dec dword [ebp - 0x424]
lea ecx, [ebp - 0x398]
call fcn.00417a3e
push 0xfffffffffffffff7
pop ebx
mov dword [ebp - 0x20], 0x1ba028ea
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0xc], 5
push esi
call fcn.0041796c
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], eax
jmp 0x426e00
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x334]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x426df0
cmp dword [ebp - 0xc], eax
jne 0x426e46
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp edx, ecx
mov ecx, dword [ebp - 0x334]
setle bl
imul edx, ebx, 0xdec9
mov dword [ecx], edx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
cmp ecx, edi
setl bl
xor edx, edx
sub ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
shl ebx, 3
cmp ebx, ecx
mov ecx, dword [ebp - 0xc]
setne dl
xor ebx, ebx
imul edx, edx, 0xfffffffd
cmp edx, ecx
mov ecx, dword [ebp - 0xc]
setl bl
xor edx, edx
cmp ebx, ecx
setg dl
sub edx, 0xc769
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0xc], 0xfffffff9
jmp 0x426f21
mov dword [ebp - 0x10], 0x2235
mov dword [ebp - 0x20], 0xc1846e97
mov dword [ebp - 0x14], eax
jmp 0x426eb8
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x4cc], 0x9f33d48
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x426ea7
cmp dword [ebp - 0x28], eax
je 0x426eef
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x20], eax
jne 0x426ed2
mov edx, eax
cmp dword [ebp - 0x10], eax
je 0x426ed4
mov edx, edi
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x10]
setge bl
xor edx, edx
cmp ebx, ecx
mov ecx, edi
setne dl
cmp dword [ebp - 0xc], edx
jle 0x426ef1
mov ecx, eax
xor edx, edx
cmp ecx, 0x585c2c1
mov ecx, dword [ebp - 0x10]
setge dl
xor ebx, ebx
cmp edx, ecx
setle bl
xor edx, edx
mov dword [ebp - 0x4cc], ebx
mov ecx, dword [ebp - 0x20]
sub ebx, ecx
mov ecx, dword [ebp - 0xc]
cmp ebx, ecx
setne dl
mov dword [ebp - 0x28], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x22
jle 0x426e94
lea ecx, [ebp - 0x334]
call fcn.00417a3e
mov dword [ebp - 0x24], 0x188753e1
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0x20], 0x5664
mov eax, 0x7412df3d
mov dword [ebp - 0x18], 0x4fc2285f
mov dword [ebp - 0x10], 0xf5872d9
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x28], 0xa5eafb5d
push 3
call fcn.0041796c
push edi
lea ecx, [ebp - 0x13c]
call fcn.0041796c
mov dword [ebp - 0x30], 0xb167
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x34], 0xe43c7d75
mov dword [ebp - 8], 0x17c927db
mov dword [ebp - 0x38], 0xf09d89c1
mov dword [ebp - 0x2c], 0x75688afc
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x3c], 0xc45603fb
push edi
call fcn.0041796c
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x426fe0
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x21c], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x426fd3
mov dword [ebp - 0xc], eax
jmp 0x426ffd
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x2d4]
mov dword [ecx + edx*4], 0xe13f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x426fea
mov dword [ebp - 0xc], eax
jmp 0x42701b
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x13c]
mov dword [ecx + edx*4], 0xffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x427008
mov dword [ebp - 0xc], eax
jmp 0x427034
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x370]
mov dword [ecx + edx*4], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x427025
mov ecx, dword [ebp - 0x13c]
push 4
pop edx
dec dword [ecx]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x218], ecx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x13c]
mov ecx, dword [ecx]
add ecx, 0xd29be1d9
mov dword [ebp - 0x90], ecx
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], eax
je 0x4270e8
mov ecx, dword [ebp - 0x13c]
cmp dword [ecx], eax
je 0x4270a3
mov edx, edi
cmp dword [ebp - 0x38], eax
jne 0x4270a5
mov edx, eax
mov ecx, dword [ebp - 0x28]
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 0x10]
setge bl
xor edx, edx
cmp ebx, ecx
setl dl
xor ecx, ecx
cmp edx, edi
mov edx, 0xc116104d
setge cl
add ecx, dword [ebp - 8]
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x9c], ecx
je 0x4270dc
mov ecx, edi
cmp dword [ebp - 0x28], eax
jne 0x4270de
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, edi
cmp dword [ebp - 0x18], eax
jne 0x4270ea
mov ecx, eax
imul ecx, ecx, 0xffff
test ecx, ecx
je 0x427191
push esi
lea ecx, [ebp - 0x2f8]
call fcn.0041796c
mov dword [ebp - 8], 0
cmp dword [ebp - 8], esi
jge 0x427127
push 4
pop edx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x2f8]
mov dword [eax + ecx*4], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x427113
mov dword [ebp - 8], 0
jmp 0x427141
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x190], 9
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x427130
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x2d4]
mov edx, dword [ebp - 0x18]
sub edx, dword [eax + 8]
mov eax, dword [ebp - 0x2f8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp dword [eax], 0x68f781be
setg cl
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0x2f8]
setle al
mov dword [ebp - 0x190], eax
dec dword [ebp - 0x2c]
call fcn.00417a3e
push 3
pop ebx
jmp 0x427231
mov dword [ebp - 0x1c], 0x128c85c7
mov dword [ebp - 0x20], 0x89d53c4a
push 3
mov dword [ebp - 0x30], 0xc5b2e90e
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x4271bf
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x1a8], 0xdfbf73ec
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x4271ae
mov dword [ebp - 0x1a0], 5
mov ecx, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
test ecx, ecx
jne 0x4271e7
mov ecx, dword [ebp - 0x1a4]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov esi, 0xf1df
mov ecx, dword [ebp - 0x98]
xor edx, edx
mov ecx, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 0x1a0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
sub esi, ecx
mov ecx, dword [ebp - 0x18]
cmp esi, ecx
setge dl
mov dword [ebp - 0x90], edx
mov ecx, dword [ebp - 0x24]
cmp dword [ebp - 0x218], edi
jl 0x42722b
cmp dword [ebp - 0x1c], eax
je 0x42722b
mov eax, edi
push 2
mov dword [ebp - 0x30], eax
pop esi
lea ecx, [ebp - 0x370]
call fcn.00417a3e
lea ecx, [ebp - 0x13c]
call fcn.00417a3e
lea ecx, [ebp - 0x2d4]
call fcn.00417a3e
mov dword [ebp - 0x20], 0xffffffff
xor eax, eax
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x3c], 0x425a33ed
mov dword [ebp - 8], eax
jmp 0x427286
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xf8], 0xfffffff7
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x427275
mov dword [ebp - 8], eax
jmp 0x42729d
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x20c], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x427290
mov esi, 0xafd47030
cmp dword [ebp - 0xf8], eax
je 0x4273c7
mov dword [ebp - 0x18], 0x880e033c
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], 0xcd021aa2
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x24], 0xffffffff
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x4272f8
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x427303
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0xf8]
xor ebx, ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
setg bl
sub ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xf4]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x24], ebx
xor ebx, ebx
cmp ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
setne bl
xor edx, edx
cmp ecx, ebx
setle dl
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
cmp esi, ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, edx
setne bl
xor ecx, ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ebp - 0x14]
neg edx
add edx, edx
cmp edx, 0x69376522
setl cl
xor ebx, ebx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp ecx, edx
mov ecx, dword [ebp - 0xf8]
setg bl
xor edx, edx
cmp ebx, ecx
setg dl
mov dword [ebp - 0x20c], edx
cmp edx, dword [ebp - 0x18]
jle 0x4273a9
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20c]
xor edx, edx
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x3c]
cmp ecx, edi
setl dl
mov dword [ebp - 0x24], edx
jmp 0x427403
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x4273e5
push 0x2055
push eax
push eax
push eax
push 0x8ad
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x4273fe
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x4273fb
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x4273ea
mov dword [ebp - 0x24], 6
mov esi, 0xfff8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1b
jge 0x4277dc
mov dword [ebp - 0xc], 0x4ddb
lea ecx, [ebp - 0x18c]
mov dword [ebp - 0x20], 0x380ee91b
mov dword [ebp - 0x28], 7
push edi
call fcn.0041796c
mov dword [ebp - 0x10], 8
xor eax, eax
mov dword [ebp - 0x24], 0x88f15ea3
mov dword [ebp - 0x14], eax
jmp 0x427465
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18c]
mov dword [ecx + edx*4], 0xb042
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x427452
cmp dword [ebp - 0xc], 0xfffffffc
jae 0x4274df
cmp dword [ebp - 0xc], eax
jne 0x4274df
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp ecx, edi
setl dl
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0xc]
jle 0x42749a
mov ecx, edi
cmp dword [ebp - 0xc], eax
jne 0x42749c
mov ecx, eax
mov dword [ebp - 0x28], ecx
xor ebx, ebx
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
cmp edx, ecx
setl bl
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18c]
cmp dword [ecx], eax
je 0x4274c2
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x10], eax
jne 0x4274df
mov ecx, dword [ebp - 0x18c]
mov edx, eax
cmp dword [ecx], eax
je 0x4274e1
mov edx, edi
mov ecx, dword [ebp - 0xc]
sub edx, ecx
jne 0x4274f2
mov ecx, dword [ebp - 0x18c]
cmp dword [ecx], eax
je 0x4274f4
mov eax, edi
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x18c]
call fcn.00417a3e
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x488]
xor eax, eax
push ecx
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x8c], eax
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x88], eax
push eax
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x84], eax
movdqu xmmword [ebp - 0x498], xmm0
call fcn.00419199
mov dword [ebp - 0x18], 0x81c2900
lea ecx, [ebp - 0x25c]
push edi
call fcn.0041796c
xor eax, eax
mov dword [ebp - 0x28], 0x9d07
mov dword [ebp - 0x14], eax
jmp 0x427575
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x25c]
mov dword [ecx + edx*4], 0x1b05
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x427562
push 3
pop ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x4276cd
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x24], edi
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x8c]
cmp dword [ecx + edx*4], esi
jbe 0x427631
mov dword [ebp - 0x10], 0xc38b
mov dword [ebp - 0x20], 0x7359b504
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x8c]
cmp dword [ecx + edx*4], eax
je 0x427624
cmp dword [ebp - 0x10], eax
jne 0x4275c8
mov edi, eax
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x8c]
add esi, dword [ecx + edx*4]
xor edx, edx
mov ecx, dword [ebp - 0x18]
cmp esi, ecx
setne dl
xor ebx, ebx
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x8c]
dec edx
cmp edx, dword [ecx + 4]
setg bl
xor ecx, ecx
cmp ebx, 5
setl cl
xor ebx, ebx
cmp ecx, 0xfffffff9
mov ecx, dword [ebp - 0x10]
setle bl
xor edx, edx
cmp ebx, ecx
sete dl
cmp edi, edx
jg 0x427621
xor edi, edi
inc edi
mov ecx, edi
jmp 0x427626
xor edi, edi
inc edi
mov ecx, eax
push 3
mov dword [ebp - 0x24], ecx
pop ebx
jmp 0x4276ba
mov dword [ebp - 0x1c], 0x1c9b
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], eax
jl 0x4276b5
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + esi*4], edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jg 0x4276b0
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x25c]
neg esi
sbb esi, esi
xor edx, edx
neg esi
mov dword [ecx], edi
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xc9ff7503
setne dl
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], eax
jne 0x427686
mov edi, eax
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp edi, ecx
mov ecx, dword [ebp - 0x1c]
push 1
sete dl
sub ecx, 0x8f0e
add edx, esi
sub ecx, edx
neg ecx
pop edi
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x42765a
dec dword [ebp - 0xc]
jns 0x427640
cmp dword [ebp - 0x1c], eax
jne 0x4276c8
dec dword [ebp - 0x18]
mov esi, 0xfff8
jns 0x427589
mov esi, 0xfff8
lea ecx, [ebp - 0x25c]
call fcn.00417a3e
lea ecx, [ebp - 0x8c]
call fcn.00417a3e
mov byte [ebp - 1], 0
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 0x20], 0x8144ad72
mov dword [ebp - 0x3c], 0xed1ad67a
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0x3498e64e
push ebx
call fcn.0041796c
mov dword [ebp - 0x34], 0x4677
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 0x14e76493
mov dword [ebp - 0xc], eax
jmp 0x427734
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x170], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x427727
mov dword [ebp - 0xc], eax
jmp 0x42774e
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1d8]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x42773e
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], 0xfffd
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x34]
jl 0x42776c
mov ecx, edi
cmp dword [ebp - 0x2c], eax
jne 0x42776e
mov ecx, eax
dec dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x1d8]
setne dl
mov ecx, dword [eax + 4]
sub ecx, edx
mov edx, dword [ebp - 0x170]
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
imul eax, ecx
lea ecx, [ebp - 0x1d8]
sub edx, eax
mov eax, dword [ebp - 0x1d8]
mov dword [eax + 8], edx
call fcn.00417a3e
cmp byte [ebp - 1], 0
je 0x4277cd
push 0
push 0x16cf
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1b
jl 0x42741c
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xc], 0xfffffff1
cmp dword [ebp - 0xc], 0x13
je 0x4278ab
mov dword [ebp - 0x10], 0xfffffff9
lea ecx, [ebp - 0x154]
push edi
call fcn.0041796c
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], eax
jmp 0x427820
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x154]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x427811
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0xc], ecx
jge 0x42783a
mov esi, eax
cmp dword [ebp - 0xc], eax
je 0x42783c
mov esi, edi
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp esi, ecx
setge dl
cmp dword [ebp - 0xc], edx
jge 0x42784e
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x154]
mov dword [ecx], 0xb77278fa
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jne 0x42786e
mov ecx, dword [ebp - 0x154]
cmp dword [ecx], eax
mov ecx, eax
je 0x427870
mov ecx, edi
mov eax, dword [ebp - 0xc]
sub ecx, eax
sub ecx, 0x2324015f
imul ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x154]
imul ecx, ecx, 0xfffffff6
mov dword [eax], ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x154]
call fcn.00417a3e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x13
jne 0x4277f0
xor eax, eax
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp edx, ecx
push 3
setne bl
xor edx, edx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov esi, dword [ebp - 8]
imul esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
cmp esi, ecx
setl dl
mov dword [ebp - 0x24], edx
imul ecx, dword [ebp - 8], 0xfffd
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x2ec]
mov dword [ebp - 0x18], 0x6df37d45
mov dword [ebp - 0x20], eax
call fcn.0041796c
mov dword [ebp - 0x20], 0xdca27289
xor eax, eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x14], eax
jmp 0x427944
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2ec]
mov dword [ecx + edx*4], 0xf58
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x427931
mov edi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x427969
push eax
push eax
push eax
push eax
push 0x1f26
push 1
push eax
push eax
push eax
push eax
call edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
imul esi, eax
dec edx
mov eax, dword [ebp - 0x2ec]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [eax], esi
mov eax, dword [ebp - 0x18]
cmp edx, eax
setl cl
xor edx, edx
imul eax, ecx, 0x2524
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov ecx, dword [ebp - 0x20]
setg dl
xor ebx, ebx
cmp edx, esi
setne bl
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ebx, ecx
lea ecx, [ebp - 0x2ec]
setle al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
call fcn.00417a3e
mov eax, dword [ebp - 0x58]
cmp dword [eax], 0
je 0x42ae15
push dword [eax]
push 0
push dword [eax + 4]
call fcn.0046df16
add esp, 0xc
push 6
pop ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], 5
push 2
pop esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x1c], 0x19
cmp dword [ebp - 0x1c], 5
jge 0x427a87
xor eax, eax
mov dword [ebp - 0x14], 5
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x427a54
push eax
push 0x1154
push 0x223e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x427a78
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x427a75
push eax
push eax
push eax
push eax
push 0x1f26
push 1
push eax
push eax
push eax
push eax
call edi
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x15
jl 0x427a59
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 5
jl 0x427a23
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg edx
neg edx
push 4
sbb edx, edx
xor ecx, ecx
sub eax, ebx
inc edx
cmp edx, eax
pop ebx
setle cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sete dl
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
jmp 0x427ae3
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x534], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x427ad6
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x427b02
push 0x5c8
push 0x1857
call dword [sym.imp.USER32.dll_SetCaretPos]
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x427b18
push eax
push eax
push 0x1c50
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
xor edi, edi
lea ecx, [ebp - 0x274]
inc edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x3c], 0xdbf4
mov dword [ebp - 0x30], 0xf402
mov dword [ebp - 0x28], 0xff74f57b
push edi
call fcn.0041796c
xor eax, eax
mov dword [ebp - 0x24], 0x4b505d01
mov dword [ebp - 8], eax
jmp 0x427b5a
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x3dc], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x427b4d
mov dword [ebp - 8], eax
jmp 0x427b73
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x274]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x427b64
mov dword [ebp - 0x1c], eax
jmp 0x427c2a
mov dword [ebp - 0x18], 0x70ade21
mov dword [ebp - 0x20], 0xc1dfe936
mov dword [ebp - 0x14], eax
jmp 0x427ba0
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xa4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x427b93
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x427c22
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ebx
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
push 4
mov ecx, dword [ebp + ecx*4 - 0x3dc]
imul ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
cmp edx, ecx
setg bl
imul edx, ebx, 0xf4f8
add edx, 3
imul edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx + edx*4]
xor edx, edx
cmp ecx, 0xfffffff7
setle dl
xor ebx, ebx
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
setg bl
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x24], ebx
mov ecx, dword [ebp - 0xa4]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
pop ebx
jle 0x427bae
cmp dword [ebp - 0x3c], eax
jne 0x427c34
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 5
jge 0x427b80
cmp dword [ebp - 0x3dc], eax
jne 0x427c74
mov eax, dword [ebp - 0x30]
xor edx, edx
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x274]
mov ecx, dword [ebp - 0x28]
mov dword [eax], 0xe256654e
mov eax, dword [ebp - 0x3dc]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], 6
lea ecx, [ebp - 0x274]
call fcn.00417a3e
mov dword [ebp - 0x34], 0xfffffffd
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x3c], 0x425a33ed
mov dword [ebp - 8], eax
jmp 0x427cb3
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x104], 0xfffffff7
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x427ca2
mov dword [ebp - 8], eax
jmp 0x427ccb
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1fc], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x427cbe
cmp dword [ebp - 0x104], eax
je 0x427df5
mov dword [ebp - 0x18], 0x880e033c
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], 0xcd021aa2
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x24], 0xffffffff
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x427d21
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x427d2c
mov ecx, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x104]
xor ebx, ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
setg bl
sub ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x100]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x24], ebx
xor ebx, ebx
cmp ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
setne bl
xor edx, edx
cmp ecx, ebx
setle dl
mov dword [ebp - 0x20], edx
mov edx, 0xafd47030
mov ecx, dword [ebp - 0x20]
cmp edx, ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, edx
setne bl
xor ecx, ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ebp - 0x14]
neg edx
add edx, edx
cmp edx, 0x69376522
setl cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x104]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x1fc], ecx
cmp ecx, dword [ebp - 0x18]
jle 0x427dd7
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1fc]
xor ecx, ecx
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
cmp eax, edi
setl cl
mov dword [ebp - 0x24], ecx
jmp 0x427e31
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x427e13
push 0x2055
push eax
push eax
push eax
push 0x8ad
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x427e2c
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x427e29
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x427e18
mov dword [ebp - 0x2c], 0xfffffffc
lea ecx, [ebp - 0x1b4]
push esi
call fcn.0041796c
xor eax, eax
mov dword [ebp - 0x18], 0x9bdba76a
mov dword [ebp - 0x14], eax
jmp 0x427e65
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1b4]
mov dword [ecx + edx*4], 0xfffffff7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x427e52
mov dword [ebp - 0x18], eax
jmp 0x427f13
mov dword [ebp - 0x14], eax
jmp 0x427e88
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x4c0], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x427e77
mov esi, dword [ebp - 0x18]
xor ebx, ebx
mov edx, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x18]
cmp dword [edx + esi*4], ecx
sete bl
mov dword [ebp - 0x4bc], ebx
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0x24], ebx
xor ebx, ebx
mov ecx, dword [edx + ecx*4]
cmp ecx, dword [edx + esi*4]
setl bl
cmp ebx, dword [ebp - 0x24]
je 0x427ee8
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x427f10
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
jmp 0x427f10
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], eax
jmp 0x427f0a
mov dword [ebp - 0x24], 0x7f451d52
xor ebx, ebx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
setle bl
mov dword [ebp - 0x24], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x10
jne 0x427ef0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x427e72
lea ecx, [ebp - 0x1b4]
call fcn.00417a3e
mov dword [ebp - 0x24], 0x35c5735e
mov dword [ebp - 8], 0xfffffffc
mov dword [ebp - 0x10], 0x65786371
mov dword [ebp - 0x28], edi
push 4
pop eax
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x427f61
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x44], 0xc3099cf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x427f53
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x427f82
push 0x1690
push eax
push eax
push 0x3d3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor eax, eax
cmp dword [ebp - 8], eax
je 0x427fa4
mov ecx, dword [ebp - 8]
mov edx, edi
mov dword [ebp - 0x10], 3
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
jmp 0x427fa6
mov edx, eax
xor ecx, ecx
cmp edx, 0xe7ad53a3
setne cl
xor ebx, ebx
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
cmp ecx, edx
mov esi, dword [ebp - 8]
setne bl
mov dword [ebp - 0x44], esi
mov ecx, dword [ebp - 8]
sub ebx, 0x711db608
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, ecx
setge dl
xor ecx, ecx
cmp edx, 0x95f7
setle cl
xor ebx, ebx
cmp esi, ecx
jg 0x428061
mov dword [ebp - 0x18], 0x9b95520
mov dword [ebp - 0x28], 0x4b13b106
mov dword [ebp - 0x20], 7
push 4
pop ecx
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x18]
cmp ecx, 8
mov ecx, dword [ebp - 0x18]
setge bl
xor edx, edx
cmp ecx, ebx
setge dl
xor ebx, ebx
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x44]
cmp ecx, edx
mov ecx, dword [ebp - 0x20]
setge bl
xor edx, edx
sub ebx, ecx
mov ecx, dword [ebp - 0x2c]
cmp ebx, ecx
setg dl
cmp dword [ebp - 0x44], edx
jl 0x428059
cmp dword [ebp - 0x28], eax
je 0x428059
mov eax, edi
mov dword [ebp - 0x14], eax
jmp 0x4280e8
mov dword [ebp - 0xc], 0xbbb30732
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov ecx, dword [ebp - 0xc]
setl bl
xor edx, edx
cmp ebx, ecx
sete dl
neg edx
mov dword [ebp - 0x44], edx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
neg edx
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
sete bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [ebp - 0x2c], edx
xor edx, edx
mov ecx, dword [ebp - 0xc]
cmp ecx, edi
setge dl
mov dword [ebp - 0xc], edx
mov dword [ebp - 0xc], 0x19
jmp 0x4280e2
mov dword [ebp - 8], eax
jmp 0x4280da
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x44], 6
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4280cc
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffb
jl 0x4280c7
push 2
pop ebx
mov dword [ebp - 0x24], 0x94b2ab76
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x24], 0xfffffff8
push ebx
call fcn.0041796c
mov dword [ebp - 8], edi
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x3c], 0x68da
push edi
call fcn.0041796c
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x42813f
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x16c]
mov dword [ecx + edx*4], 0xfffffffe
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x42812c
mov dword [ebp - 8], eax
jmp 0x42815c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret