Function at 0x401000
Capabilities:
Allocate thread local storage
Create shortcut via ishelllink
Get common file path
Hide graphical window
Identify system language via api
Log keystrokes via polling
Write file on windows

Disassembly:
push 0x2a4
push 0
push 0x43f0b0
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x43f0b4], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x43f0b0], eax
call section..text
mov eax, 0x43d748
mov dword [0x43f100], eax
call fcn.0041cf20
call fcn.0041cdd0
call fcn.00416430
call fcn.00413f24
call fcn.00413e5f
call fcn.00413980
call fcn.0041201d
call fcn.00411ce8
call fcn.00411bba
call fcn.004118fe
call fcn.0041155b
call fcn.004106c6
call fcn.00410287
call fcn.0040f777
mov edx, dword [0x43f97c]
push edx
push edx
mov edx, dword [0x43f97c]
push edx
push edx
push str.extd
call fcn.004102b6
mov edx, dword [0x43d79c]
add dword [esp], edx
call fcn.0040d320
inc dword [0x43f97c]
mov edx, 0x43c01e
pop ecx
mov dword [0x43f97c], ecx
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4010e0
jmp 0x408027
call fcn.00410400
mov ebx, eax
and ebx, ebx
jle 0x408027
mov edx, dword [0x43f97c]
push edx
push edx
push 1
mov edx, dword [0x43f97c]
push edx
push edx
mov edx, dword [0x43f97c]
push edx
push edx
push 0
call fcn.004103b2
mov edx, dword [0x43d79c]
add dword [esp], edx
call fcn.0040d320
mov edx, dword [0x43d79c]
add dword [esp], edx
call fcn.0040d340
inc dword [0x43f97c]
mov edx, str._01
pop ecx
mov dword [0x43f97c], ecx
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x408027
mov edx, dword [0x43f97c]
push edx
push edx
push 0
call fcn.004103b2
push 0x43f0ec
call fcn.0041cfd0
mov edx, dword [0x43f97c]
push edx
push edx
push 1
call fcn.004103b2
push 0x43f17c
call fcn.0041cfd0
mov edx, dword [0x43f97c]
push edx
push edx
push 2
call fcn.004103b2
push 0x43f1e4
call fcn.0041cfd0
mov edx, dword [0x43f97c]
push edx
push edx
push 3
call fcn.004103b2
push 0x43f0f8
call fcn.0041cfd0
mov edx, dword [0x43f97c]
push edx
push edx
push 4
call fcn.004103b2
push 0x43f114
call fcn.0041cfd0
mov edx, dword [0x43f97c]
push edx
push edx
push 5
call fcn.004103b2
push 0x43f108
call fcn.0041cfd0
mov edx, dword [0x43f97c]
push edx
push edx
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f0ec]
call fcn.0040d320
mov edx, dword [0x43d79c]
add dword [esp], edx
call fcn.0040d3b0
inc dword [0x43f97c]
mov edx, str._addextension
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40128d
mov edx, dword [0x43f17c]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f0c8
call fcn.0041cfd0
push dword [0x43f1e4]
push dword [0x43f0c8]
call sub.SHLWAPI.DLL_PathAddExtensionA
mov edx, dword [0x43f0c8]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._aesdecode
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4013cc
push dword [0x43f17c]
push 0
call fcn.00416750
and eax, eax
je 0x4013c7
push 0
call fcn.00416800
mov dword [0x43f0d0], eax
mov ebx, dword [0x43f0d0]
and ebx, ebx
jle 0x4013bd
push dword [0x43f0d0]
call fcn.004139f0
mov dword [0x43f0d4], eax
push dword [0x43f0d0]
call fcn.004139f0
mov dword [0x43f0cc], eax
push dword [0x43f0d0]
push dword [0x43f0d4]
push 0
call fcn.00416860
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f0f8]
call fcn.0040d410
push eax
mov eax, dword [0x43f0f8]
push eax
call fcn.00417d10
push 0x43f1a4
call fcn.0041cfd0
mov dword [0x43f118], 0
push 9
push 0x43f118
push 0x100
mov eax, dword [0x43f1a4]
push eax
push 0
call fcn.00418000
push dword [0x43f0d0]
push dword [0x43f0cc]
push dword [0x43f0d4]
push 0
call fcn.004180b0
push 0
call fcn.004180e0
push dword [0x43f1e4]
push 1
call fcn.004165d0
and eax, eax
je 0x4013bd
push dword [0x43f0d0]
push dword [0x43f0cc]
push 1
call fcn.004168c0
push 1
call fcn.004163b0
push 0
call fcn.004163b0
jmp 0x407fd8
mov edx, str._aesencode
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40150b
push dword [0x43f17c]
push 0
call fcn.00416750
and eax, eax
je 0x401506
push 0
call fcn.00416800
mov dword [0x43f0d0], eax
mov ebx, dword [0x43f0d0]
and ebx, ebx
jle 0x4014fc
push dword [0x43f0d0]
call fcn.004139f0
mov dword [0x43f0d4], eax
push dword [0x43f0d0]
call fcn.004139f0
mov dword [0x43f0cc], eax
push dword [0x43f0d0]
push dword [0x43f0d4]
push 0
call fcn.00416860
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f0f8]
call fcn.0040d410
push eax
mov eax, dword [0x43f0f8]
push eax
call fcn.00417d10
push 0x43f1a4
call fcn.0041cfd0
mov dword [0x43f118], 0
push 0xa
push 0x43f118
push 0x100
mov eax, dword [0x43f1a4]
push eax
push 0
call fcn.00418000
push dword [0x43f0d0]
push dword [0x43f0cc]
push dword [0x43f0d4]
push 0
call fcn.004180b0
push 0
call fcn.004180e0
push dword [0x43f1e4]
push 1
call fcn.004165d0
and eax, eax
je 0x4014fc
push dword [0x43f0d0]
push dword [0x43f0cc]
push 1
call fcn.004168c0
push 1
call fcn.004163b0
push 0
call fcn.004163b0
jmp 0x407fd8
mov edx, str._ascii
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401571
mov edx, dword [0x43f97c]
push edx
push edx
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f97c]
push 1
push dword [0x43f17c]
call fcn.0040d340
mov edx, dword [0x43d79c]
add dword [esp], edx
call fcn.0040d440
pop dword [0x43f97c]
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._base64decode
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4016b2
push dword [0x43f17c]
call fcn.00415ba1
mov dword [0x43f150], eax
mov ebx, dword [0x43f150]
and ebx, ebx
jle 0x4016ad
push dword [0x43f150]
call fcn.004139f0
mov dword [0x43f144], eax
push dword [0x43f17c]
push 0
call fcn.00416750
and eax, eax
je 0x4016ad
mov edx, dword [0x43f97c]
push edx
push edx
push 0
call fcn.00416920
push 0x43f158
call fcn.0041cfd0
push dword [0x43f158]
call fcn.0040d410
mov dword [0x43f204], eax
push dword [0x43f158]
mov ebx, dword [0x43f144]
add ebx, dword [0x43f118]
push ebx
call fcn.00413a10
mov ebx, dword [0x43f118]
add ebx, dword [0x43f204]
mov dword [0x43f118], ebx
push 0
call fcn.00416a60
and eax, eax
je 0x4015d0
push 0
call fcn.004163b0
push dword [0x43f118]
call fcn.004139f0
mov dword [0x43f128], eax
push dword [0x43f118]
push dword [0x43f128]
push dword [0x43f118]
push dword [0x43f144]
call fcn.00418110
mov dword [0x43f14c], eax
cmp dword [0x43f14c], 0
je 0x4016ad
push dword [0x43f1e4]
push 1
call fcn.004165d0
and eax, eax
je 0x4016ad
push dword [0x43f14c]
push dword [0x43f128]
push 1
call fcn.004168c0
push 1
call fcn.004163b0
jmp 0x407fd8
mov edx, str._base64encode
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4018d4
push dword [0x43f17c]
call fcn.00415ba1
mov dword [0x43f150], eax
mov ebx, dword [0x43f150]
and ebx, ebx
jle 0x4018cf
push dword [0x43f17c]
push 0
call fcn.00416750
and eax, eax
je 0x4018cf
push dword [0x43f150]
call fcn.004139f0
mov dword [0x43f144], eax
push dword [0x43f150]
push dword [0x43f144]
push 0
call fcn.00416860
push 0
call fcn.004163b0
fild dword [0x43f150]
fmul dword [0x43d488]
fdiv dword [0x43d484]
fstp dword [0x43f140]
fld dword [0x43f140]
push eax
fistp dword [esp]
call fcn.004139f0
mov dword [0x43f128], eax
fld dword [0x43f140]
push eax
fistp dword [esp]
push dword [0x43f128]
push dword [0x43f150]
push dword [0x43f144]
call fcn.004183b0
mov dword [0x43f14c], eax
cmp dword [0x43f14c], 0
je 0x4018cf
push dword [0x43f1e4]
push 1
call fcn.004165d0
and eax, eax
je 0x4018cf
mov ebx, dword [0x43f14c]
cmp ebx, 0x4c
jge 0x4017f7
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f97c]
push dword [0x43f14c]
push dword [0x43f128]
call fcn.00413a40
inc dword [0x43f97c]
push 1
mov edx, dword [0x43d79c]
add dword [esp + 4], edx
call fcn.00416b00
pop dword [0x43f97c]
jmp 0x4018c5
mov dword [0x43f180], 0x4c
mov ebx, dword [0x43f118]
mov edi, dword [0x43f14c]
sub edi, dword [0x43f180]
cmp ebx, edi
jl 0x401868
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f97c]
mov ebx, dword [0x43f14c]
sub ebx, dword [0x43f180]
push ebx
mov ebx, dword [0x43f128]
add ebx, dword [0x43f118]
push ebx
call fcn.00413a40
inc dword [0x43f97c]
push 1
mov edx, dword [0x43d79c]
add dword [esp + 4], edx
call fcn.00416b00
pop dword [0x43f97c]
jmp 0x4018c5
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f97c]
push dword [0x43f180]
mov ebx, dword [0x43f128]
add ebx, dword [0x43f118]
push ebx
call fcn.00413a40
inc dword [0x43f97c]
push 1
mov edx, dword [0x43d79c]
add dword [esp + 4], edx
call fcn.00416b00
pop dword [0x43f97c]
mov ebx, dword [0x43f118]
add ebx, dword [0x43f180]
mov dword [0x43f118], ebx
jmp 0x401801
push 1
call fcn.004163b0
jmp 0x407fd8
mov edx, str._bin
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401912
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.0040d660
push edx
push eax
call fcn.0040d8c0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._browseforfile
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40196b
push dword [0x43f114]
call fcn.0040d660
mov dword [0x43f16c], eax
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f16c]
push dword [0x43f0f8]
push dword [0x43f1e4]
push dword [0x43f17c]
call fcn.0040fa7b
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._browseforfolder
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4019a8
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f1e4]
push dword [0x43f17c]
call fcn.0040fb03
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._changeexeicon
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4019fd
push dword [0x43f0f8]
push dword [0x43f1e4]
push dword [0x43f17c]
call fcn.00409404
mov dword [0x43f14c], eax
mov edx, dword [0x43f97c]
push edx
push edx
mov eax, dword [0x43f14c]
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._char
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401a61
mov edx, dword [0x43f97c]
push edx
push edx
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f97c]
push 1
push dword [0x43f17c]
call fcn.0040d340
mov edx, dword [0x43d79c]
add dword [esp], edx
call fcn.0040d660
pop dword [0x43f97c]
push eax
call fcn.0040d980
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._closewindow
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401ab3
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
cmp dword [0x43f1b4], 0
je 0x401aae
push 0
push 0
push 0x10
push dword [0x43f1b4]
call sub.USER32.DLL_SendMessageA
jmp 0x407fd8
mov edx, str._crc32
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401b10
push dword [0x43f17c]
push 0
call fcn.00416750
and eax, eax
je 0x401b0b
push 0
call fcn.004163b0
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.004185f0
cdq
push edx
push eax
call fcn.0040da80
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._disablewindow
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401b4f
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
push 0
push dword [0x43f1b4]
call sub.USER32.DLL_EnableWindow
jmp 0x407fd8
mov edx, str._download
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401ba3
call fcn.0041533b
push dword [0x43f1e4]
push dword [0x43f17c]
call fcn.004147f2
mov dword [0x43f14c], eax
mov edx, dword [0x43f97c]
push edx
push edx
mov eax, dword [0x43f14c]
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._downloadheader
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401cab
call fcn.0041533b
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.00414bb6
push 0x43f0e4
call fcn.0041cfd0
inc dword [0x43f1d8]
mov edx, dword [0x43f97c]
push edx
push edx
push 0x43c034
push dword [0x43f1d8]
push dword [0x43f0e4]
call fcn.0040db00
push 0x43f1d4
call fcn.0041cfd0
mov edx, dword [0x43f1fc]
push dword [0x43f97c]
call fcn.0041d050
mov edx, dword [0x43f1d4]
call fcn.0041d050
mov edx, 0x43d0bc
call fcn.0041d050
push 0x43f1fc
call fcn.0041cfd0
push dword [0x43f1d4]
mov edx, 0x43c01e
pop ecx
call fcn.0041cfa0
je 0x401bde
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f1fc]
call fcn.0040d320
push 0x43f0e4
call fcn.0041cfd0
push dword [0x43f1e4]
push 0xffffffff
call fcn.004165d0
mov dword [0x43f130], eax
cmp dword [0x43f130], 0
je 0x401ca6
push dword [0x43f0e4]
push dword [0x43f130]
call fcn.00416be0
push dword [0x43f130]
call fcn.004163b0
jmp 0x407fd8
mov edx, str._enablewindow
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401cea
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
push 1
push dword [0x43f1b4]
call sub.USER32.DLL_EnableWindow
jmp 0x407fd8
mov edx, str._findexecutable
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401d61
mov edx, dword [0x43f97c]
push edx
push edx
push 0x2800
call fcn.0040dc10
push 0x43f124
call fcn.0041cfd0
push dword [0x43f124]
push 0
push dword [0x43f17c]
call sub.SHELL32.DLL_FindExecutableA
mov dword [0x43f1a8], eax
mov ebx, dword [0x43f1a8]
cmp ebx, 0x20
jle 0x401d5c
mov edx, dword [0x43f124]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._flashconsole
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401ee7
lea ebp, [0x43f214]
mov dword [ebp], 0x14
call sub.KERNEL32.dll_GetConsoleWindow
mov dword [0x43f1c8], eax
push dword [0x43f17c]
call fcn.0040d660
push eax
lea ebp, [0x43f214]
pop dword [ebp + 0xc]
push dword [0x43f1e4]
call fcn.0040d660
push eax
pop dword [ebp + 0x10]
mov eax, dword [0x43f1c8]
mov dword [ebp + 4], eax
mov edx, dword [0x43f97c]
push edx
push edx
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f0f8]
call fcn.0040dc50
mov edx, dword [0x43d79c]
add dword [esp], edx
call fcn.0040d320
inc dword [0x43f97c]
mov edx, str.FLASHW_CAPTION
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401e0d
mov dword [0x43f1dc], 1
jmp 0x401e59
mov edx, str.FLASHW_TRAY
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401e2e
mov dword [0x43f1dc], 2
jmp 0x401e59
mov edx, str.FLASHW_ALL
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401e4f
mov dword [0x43f1dc], 3
jmp 0x401e59
mov dword [0x43f1dc], 3
pop dword [0x43f97c]
mov edx, dword [0x43f97c]
push edx
push edx
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f114]
call fcn.0040dc50
mov edx, dword [0x43d79c]
add dword [esp], edx
call fcn.0040d320
inc dword [0x43f97c]
mov edx, 0x43c130
pop ecx
mov dword [0x43f97c], ecx
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401ec9
mov dword [0x43f168], 0xc
mov ebx, dword [0x43f1dc]
or ebx, dword [0x43f168]
push ebx
lea ebp, [0x43f214]
pop dword [ebp + 8]
jmp 0x401ed8
push dword [0x43f1dc]
lea ebp, [0x43f214]
pop dword [ebp + 8]
push 0x43f214
call sub.USER32.DLL_FlashWindowEx
jmp 0x407fd8
mov edx, str._flashwindow
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40204d
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
cmp dword [0x43f1b4], 0
je 0x402048
lea ebp, [0x43f214]
mov dword [ebp], 0x14
push dword [0x43f1e4]
call fcn.0040d660
push eax
pop dword [ebp + 0xc]
push dword [0x43f0f8]
call fcn.0040d660
push eax
pop dword [ebp + 0x10]
mov eax, dword [0x43f1b4]
mov dword [ebp + 4], eax
mov edx, dword [0x43f97c]
push edx
push edx
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f114]
call fcn.0040dc50
mov edx, dword [0x43d79c]
add dword [esp], edx
call fcn.0040d320
inc dword [0x43f97c]
mov edx, str.FLASHW_CAPTION
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401fa5
mov dword [0x43f1dc], 1
jmp 0x401fd0
mov edx, str.FLASHW_TRAY
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x401fc6
mov dword [0x43f1dc], 2
jmp 0x401fd0
mov dword [0x43f1dc], 3
pop dword [0x43f97c]
mov edx, dword [0x43f97c]
push edx
push edx
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f108]
call fcn.0040dc50
mov edx, dword [0x43d79c]
add dword [esp], edx
call fcn.0040d320
inc dword [0x43f97c]
mov edx, 0x43c130
pop ecx
mov dword [0x43f97c], ecx
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x402028
mov dword [0x43f168], 0xc
mov ebx, dword [0x43f1dc]
or ebx, dword [0x43f168]
push ebx
lea ebp, [0x43f214]
pop dword [ebp + 8]
push 0x43f214
call sub.USER32.DLL_FlashWindowEx
jmp 0x407fd8
mov edx, str._getcursorposx
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x402086
mov edx, dword [0x43f97c]
push edx
push edx
call fcn.00417149
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getcursorposy
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4020bf
mov edx, dword [0x43f97c]
push edx
push edx
call fcn.0041715d
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getclipboardtext
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4020f0
mov edx, dword [0x43f97c]
push edx
push edx
call fcn.00417c28
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getdesktopheight
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x402133
call fcn.00417171
mov edx, dword [0x43f97c]
push edx
push edx
push 0
call fcn.004173a7
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getdesktopwidth
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x402176
call fcn.00417171
mov edx, dword [0x43f97c]
push edx
push edx
push 0
call fcn.004173cb
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getextension
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4021ad
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.00415ced
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getfilename
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4021e4
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.00415e2d
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getmimetype
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x402219
push dword [0x43f97c]
push dword [0x43f17c]
call fcn.004097ef
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getconsoletitle
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x402248
push dword [0x43f97c]
call fcn.0040ac7d
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getpath
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40227f
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.00415e3f
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getsystemlanguage
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40395d
call sub.KERNEL32.dll_GetSystemDefaultUILanguage
mov dword [0x43f0c4], eax
push dword [0x43f0c4]
mov ebx, 0x436
cmp ebx, dword [esp]
jne 0x4022c7
mov edx, str.Afrikaans
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x41c
cmp ebx, dword [esp]
jne 0x4022e6
mov edx, str.Albanian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x45e
cmp ebx, dword [esp]
jne 0x402305
mov edx, str.Amharic
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x1401
cmp ebx, dword [esp]
jne 0x402324
mov edx, str.Arabic___Algeria
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x3c01
cmp ebx, dword [esp]
jne 0x402343
mov edx, str.Arabic___Bahrain
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0xc01
cmp ebx, dword [esp]
jne 0x402362
mov edx, str.Arabic___Egypt
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x801
cmp ebx, dword [esp]
jne 0x402381
mov edx, str.Arabic___Iraq
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x2c01
cmp ebx, dword [esp]
jne 0x4023a0
mov edx, str.Arabic___Jordan
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x3401
cmp ebx, dword [esp]
jne 0x4023bf
mov edx, str.Arabic___Kuwait
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x3001
cmp ebx, dword [esp]
jne 0x4023de
mov edx, str.Arabic___Lebanon
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x1001
cmp ebx, dword [esp]
jne 0x4023fd
mov edx, str.Arabic___Libya
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x1801
cmp ebx, dword [esp]
jne 0x40241c
mov edx, str.Arabic___Morocco
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x2001
cmp ebx, dword [esp]
jne 0x40243b
mov edx, str.Arabic___Oman
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x4001
cmp ebx, dword [esp]
jne 0x40245a
mov edx, str.Arabic___Qatar
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x401
cmp ebx, dword [esp]
jne 0x402479
mov edx, str.Arabic___Saudi_Arabia
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x2801
cmp ebx, dword [esp]
jne 0x402498
mov edx, str.Arabic___Syria
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x1c01
cmp ebx, dword [esp]
jne 0x4024b7
mov edx, str.Arabic___Tunisia
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x3801
cmp ebx, dword [esp]
jne 0x4024d6
mov edx, str.Arabic___United_Arab_Emirates
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x2401
cmp ebx, dword [esp]
jne 0x4024f5
mov edx, str.Arabic___Yemen
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x42b
cmp ebx, dword [esp]
jne 0x402514
mov edx, str.Armenian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x44d
cmp ebx, dword [esp]
jne 0x402533
mov edx, str.Assamese
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x82c
cmp ebx, dword [esp]
jne 0x402552
mov edx, str.Azeri___Cyrillic
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x42c
cmp ebx, dword [esp]
jne 0x402571
mov edx, str.Azeri___Latin
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x42d
cmp ebx, dword [esp]
jne 0x402590
mov edx, str.Basque
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x423
cmp ebx, dword [esp]
jne 0x4025af
mov edx, str.Belarusian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x845
cmp ebx, dword [esp]
jne 0x4025ce
mov edx, str.Bengali___Bangladesh
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x445
cmp ebx, dword [esp]
jne 0x4025ed
mov edx, str.Bengali___India
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x141a
cmp ebx, dword [esp]
jne 0x40260c
mov edx, str.Bosnian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x402
cmp ebx, dword [esp]
jne 0x40262b
mov edx, str.Bulgarian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x455
cmp ebx, dword [esp]
jne 0x40264a
mov edx, str.Burmese
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x403
cmp ebx, dword [esp]
jne 0x402669
mov edx, str.Catalan
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x804
cmp ebx, dword [esp]
jne 0x402688
mov edx, str.Chinese___China
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0xc04
cmp ebx, dword [esp]
jne 0x4026a7
mov edx, str.Chinese___Hong_Kong_SAR
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x1404
cmp ebx, dword [esp]
jne 0x4026c6
mov edx, str.Chinese___Macau_SAR
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x1004
cmp ebx, dword [esp]
jne 0x4026e5
mov edx, str.Chinese___Singapore
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x404
cmp ebx, dword [esp]
jne 0x402704
mov edx, str.Chinese___Taiwan
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x41a
cmp ebx, dword [esp]
jne 0x402723
mov edx, str.Croatian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x405
cmp ebx, dword [esp]
jne 0x402742
mov edx, str.Czech
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x406
cmp ebx, dword [esp]
jne 0x402761
mov edx, str.Danish
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x465
cmp ebx, dword [esp]
jne 0x402780
mov edx, str.Divehi__Dhivehi__Maldivian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x813
cmp ebx, dword [esp]
jne 0x40279f
mov edx, str.Dutch___Belgium
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x413
cmp ebx, dword [esp]
jne 0x4027be
mov edx, str.Dutch___Netherlands
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x466
cmp ebx, dword [esp]
jne 0x4027dd
mov edx, 0x43cf23
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0xc09
cmp ebx, dword [esp]
jne 0x4027fc
mov edx, str.English___Australia
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x2809
cmp ebx, dword [esp]
jne 0x40281b
mov edx, str.English___Belize
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x1009
cmp ebx, dword [esp]
jne 0x40283a
mov edx, str.English___Canada
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x2409
cmp ebx, dword [esp]
jne 0x402859
mov edx, str.English___Caribbean
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x809
cmp ebx, dword [esp]
jne 0x402878
mov edx, str.English___Great_Britain
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x4009
cmp ebx, dword [esp]
jne 0x402897
mov edx, str.English___India
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x1809
cmp ebx, dword [esp]
jne 0x4028b6
mov edx, str.English___Ireland
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x2009
cmp ebx, dword [esp]
jne 0x4028d5
mov edx, str.English___Jamaica
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x1409
cmp ebx, dword [esp]
jne 0x4028f4
mov edx, str.English___New_Zealand
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x3409
cmp ebx, dword [esp]
jne 0x402913
mov edx, str.English___Phillippines
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x1c09
cmp ebx, dword [esp]
jne 0x402932
mov edx, str.English___Southern_Africa
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x2c09
cmp ebx, dword [esp]
jne 0x402951
mov edx, str.English___Trinidad
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x409
cmp ebx, dword [esp]
jne 0x402970
mov edx, str.English___United_States
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x3009
cmp ebx, dword [esp]
jne 0x40298f
mov edx, str.English___Zimbabwe
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x425
cmp ebx, dword [esp]
jne 0x4029ae
mov edx, str.Estonian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x438
cmp ebx, dword [esp]
jne 0x4029cd
mov edx, str.Faroese
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x429
cmp ebx, dword [esp]
jne 0x4029ec
mov edx, str.Farsi___Persian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x464
cmp ebx, dword [esp]
jne 0x402a0b
mov edx, str.Filipino
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x40b
cmp ebx, dword [esp]
jne 0x402a2a
mov edx, str.Finnish
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x80c
cmp ebx, dword [esp]
jne 0x402a49
mov edx, str.French___Belgium
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x2c0c
cmp ebx, dword [esp]
jne 0x402a68
mov edx, str.French___Cameroon
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0xc0c
cmp ebx, dword [esp]
jne 0x402a87
mov edx, str.French___Canada
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x240c
cmp ebx, dword [esp]
jne 0x402aa6
mov edx, str.French___Congo
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x300c
cmp ebx, dword [esp]
jne 0x402ac5
mov edx, str.French___Cote_dIvoire
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x40c
cmp ebx, dword [esp]
jne 0x402ae4
mov edx, str.French___France
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x140c
cmp ebx, dword [esp]
jne 0x402b03
mov edx, str.French___Luxembourg
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x340c
cmp ebx, dword [esp]
jne 0x402b22
mov edx, str.French___Mali
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x180c
cmp ebx, dword [esp]
jne 0x402b41
mov edx, str.French___Monaco
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x380c
cmp ebx, dword [esp]
jne 0x402b60
mov edx, 0x43c145
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x280c
cmp ebx, dword [esp]
jne 0x402b7f
mov edx, str.French___Senegal
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x100c
cmp ebx, dword [esp]
jne 0x402b9e
mov edx, str.French___Switzerland
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x1c0c
cmp ebx, dword [esp]
jne 0x402bbd
mov edx, str.French___West_Indies
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x462
cmp ebx, dword [esp]
jne 0x402bdc
mov edx, str.Frisian___Netherlands
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x42f
cmp ebx, dword [esp]
jne 0x402bfb
mov edx, str.FYRO_Macedonia
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x83c
cmp ebx, dword [esp]
jne 0x402c1a
mov edx, str.Gaelic___Ireland
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x43c
cmp ebx, dword [esp]
jne 0x402c39
mov edx, str.Gaelic___Scotland
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x456
cmp ebx, dword [esp]
jne 0x402c58
mov edx, str.Galician
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x437
cmp ebx, dword [esp]
jne 0x402c77
mov edx, str.Georgian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0xc07
cmp ebx, dword [esp]
jne 0x402c96
mov edx, str.German___Austria
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x407
cmp ebx, dword [esp]
jne 0x402cb5
mov edx, str.German___Germany
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x1407
cmp ebx, dword [esp]
jne 0x402cd4
mov edx, str.German___Liechtenstein
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x1007
cmp ebx, dword [esp]
jne 0x402cf3
mov edx, str.German___Luxembourg
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x807
cmp ebx, dword [esp]
jne 0x402d12
mov edx, str.German___Switzerland
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x408
cmp ebx, dword [esp]
jne 0x402d31
mov edx, str.Greek
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x474
cmp ebx, dword [esp]
jne 0x402d50
mov edx, str.Guarani___Paraguay
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x447
cmp ebx, dword [esp]
jne 0x402d6f
mov edx, str.Gujarati
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x40d
cmp ebx, dword [esp]
jne 0x402d8e
mov edx, str.Hebrew
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x4ff
cmp ebx, dword [esp]
jne 0x402dad
mov edx, str.HID__Human_Interface_Device_
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x439
cmp ebx, dword [esp]
jne 0x402dcc
mov edx, str.Hindi
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x40e
cmp ebx, dword [esp]
jne 0x402deb
mov edx, str.Hungarian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x40f
cmp ebx, dword [esp]
jne 0x402e0a
mov edx, str.Icelandic
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40393c
mov ebx, 0x470
cmp ebx, dword [esp]
jne 0x402e29
pop eax
mov edx, dword [0x43f170]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getspecialfolder
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x404233
mov edx, dword [0x43f97c]
push edx
push edx
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.0040dc50
mov edx, dword [0x43d79c]
add dword [esp], edx
call fcn.0040d320
inc dword [0x43f97c]
mov edx, str.ADMINTOOLS
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4039c9
mov dword [0x43f1dc], 0x30
jmp 0x40419b
mov edx, str.ALTSTARTUP
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4039ed
mov dword [0x43f1dc], 0x1d
jmp 0x40419b
mov edx, str.APPDATA
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403a11
mov dword [0x43f1dc], 0x1a
jmp 0x40419b
mov edx, str.BITBUCKET
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403a35
mov dword [0x43f1dc], 0xa
jmp 0x40419b
mov edx, str.CDBURN_AREA
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403a59
mov dword [0x43f1dc], 0x3b
jmp 0x40419b
mov edx, str.COMMON_ADMINTOOLS
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403a7d
mov dword [0x43f1dc], 0x2f
jmp 0x40419b
mov edx, str.COMMON_ALTSTARTUP
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403aa1
mov dword [0x43f1dc], 0x1e
jmp 0x40419b
mov edx, str.COMMON_APPDATA
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403ac5
mov dword [0x43f1dc], 0x23
jmp 0x40419b
mov edx, str.COMMON_DESKTOPDIRECTORY
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403ae9
mov dword [0x43f1dc], 0x19
jmp 0x40419b
mov edx, str.COMMON_DOCUMENTS
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403b0d
mov dword [0x43f1dc], 0x2e
jmp 0x40419b
mov edx, str.COMMON_FAVORITES
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403b31
mov dword [0x43f1dc], 0x1f
jmp 0x40419b
mov edx, str.COMMON_MUSIC
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403b55
mov dword [0x43f1dc], 0x35
jmp 0x40419b
mov edx, str.COMMON_OEM_LINKS
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403b79
mov dword [0x43f1dc], 0x3a
jmp 0x40419b
mov edx, str.COMMON_PICTURES
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403b9d
mov dword [0x43f1dc], 0x36
jmp 0x40419b
mov edx, str.COMMON_PROGRAMS
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403bc1
mov dword [0x43f1dc], 0x17
jmp 0x40419b
mov edx, str.COMMON_STARTMENU
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403be5
mov dword [0x43f1dc], 0x16
jmp 0x40419b
mov edx, str.COMMON_STARTUP
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403c09
mov dword [0x43f1dc], 0x18
jmp 0x40419b
mov edx, str.COMMON_TEMPLATES
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403c2d
mov dword [0x43f1dc], 0x2d
jmp 0x40419b
mov edx, str.COMMON_VIDEO
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403c51
mov dword [0x43f1dc], 0x37
jmp 0x40419b
mov edx, str.COMPUTERSNEARME
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403c75
mov dword [0x43f1dc], 0x3d
jmp 0x40419b
mov edx, str.CONNECTIONS
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403c99
mov dword [0x43f1dc], 0x31
jmp 0x40419b
mov edx, str.CONTROLS
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403cbd
mov dword [0x43f1dc], 3
jmp 0x40419b
mov edx, str.COOKIES
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403ce1
mov dword [0x43f1dc], 0x21
jmp 0x40419b
mov edx, str.DESKTOP
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403d05
mov dword [0x43f1dc], 0
jmp 0x40419b
mov edx, str.DESKTOPDIRECTORY
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403d29
mov dword [0x43f1dc], 0x10
jmp 0x40419b
mov edx, str.DRIVES
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403d4d
mov dword [0x43f1dc], 0x11
jmp 0x40419b
mov edx, str.FAVORITES
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403d71
mov dword [0x43f1dc], 6
jmp 0x40419b
mov edx, str.FONTS
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403d95
mov dword [0x43f1dc], 0x14
jmp 0x40419b
mov edx, str.HISTORY
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403db9
mov dword [0x43f1dc], 0x22
jmp 0x40419b
mov edx, str.INTERNET
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403ddd
mov dword [0x43f1dc], 1
jmp 0x40419b
mov edx, str.INTERNET_CACHE
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403e01
mov dword [0x43f1dc], 0x20
jmp 0x40419b
mov edx, str.LOCAL_APPDATA
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403e25
mov dword [0x43f1dc], 0x1c
jmp 0x40419b
mov edx, str.MYDOCUMENTS
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403e49
mov dword [0x43f1dc], 0xc
jmp 0x40419b
mov edx, str.MYMUSIC
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403e6d
mov dword [0x43f1dc], 0xd
jmp 0x40419b
mov edx, str.MYPICTURES
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403e91
mov dword [0x43f1dc], 0x27
jmp 0x40419b
mov edx, str.MYVIDEO
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403eb5
mov dword [0x43f1dc], 0xe
jmp 0x40419b
mov edx, str.NETHOOD
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403ed9
mov dword [0x43f1dc], 0x13
jmp 0x40419b
mov edx, str.NETWORK
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403efd
mov dword [0x43f1dc], 0x12
jmp 0x40419b
mov edx, str.PERSONAL
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403f21
mov dword [0x43f1dc], 5
jmp 0x40419b
mov edx, str.PRINTERS
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403f45
mov dword [0x43f1dc], 4
jmp 0x40419b
mov edx, str.PRINTHOOD
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403f69
mov dword [0x43f1dc], 0x1b
jmp 0x40419b
mov edx, str.PROFILE
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403f8d
mov dword [0x43f1dc], 0x28
jmp 0x40419b
mov edx, str.PROGRAM_FILES
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403fb1
mov dword [0x43f1dc], 0x26
jmp 0x40419b
mov edx, str.PROGRAM_FILESX86
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403fd5
mov dword [0x43f1dc], 0x2a
jmp 0x40419b
mov edx, str.PROGRAM_FILES_COMMON
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x403ff9
mov dword [0x43f1dc], 0x2b
jmp 0x40419b
mov edx, str.PROGRAM_FILES_COMMONX86
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40401d
mov dword [0x43f1dc], 0x2c
jmp 0x40419b
mov edx, str.PROGRAMS
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x404041
mov dword [0x43f1dc], 2
jmp 0x40419b
mov edx, str.RECENT
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x404065
mov dword [0x43f1dc], 8
jmp 0x40419b
mov edx, str.RESOURCES
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x404089
mov dword [0x43f1dc], 0x38
jmp 0x40419b
mov edx, str.RESOURCES_LOCALIZED
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4040ad
mov dword [0x43f1dc], 0x39
jmp 0x40419b
mov edx, str.SENDTO
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4040d1
mov dword [0x43f1dc], 9
jmp 0x40419b
mov edx, str.STARTMENU
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4040f5
mov dword [0x43f1dc], 0xb
jmp 0x40419b
mov edx, str.STARTUP
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x404119
mov dword [0x43f1dc], 7
jmp 0x40419b
mov edx, str.SYSTEM
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40413a
mov dword [0x43f1dc], 0x25
jmp 0x40419b
mov edx, str.SYSTEMX86
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40415b
mov dword [0x43f1dc], 0x29
jmp 0x40419b
mov edx, str.TEMPLATES
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40417c
mov dword [0x43f1dc], 0x15
jmp 0x40419b
mov edx, str.WINDOWS
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40419b
mov dword [0x43f1dc], 0x24
pop dword [0x43f97c]
cmp dword [0x43f1dc], 0
je 0x4041e3
mov edx, dword [0x43f97c]
push edx
push edx
push 0x1388
call fcn.0040dc10
push 0x43f10c
call fcn.0041cfd0
push 0
push dword [0x43f1dc]
push dword [0x43f10c]
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderPathA
jmp 0x4041f3
mov edx, 0x43c01e
lea ecx, [0x43f10c]
call fcn.0040d068
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f10c]
call fcn.0040d320
push 0x43f10c
call fcn.0041cfd0
push dword [0x43f10c]
mov edx, 0x43c01e
pop ecx
call fcn.0041cfa0
jne 0x40422e
push dword [0x43f10c]
call sub.SHLWAPI.DLL_PathAddBackslashA
jmp 0x407fd8
mov edx, str._gettickcount
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40426c
mov edx, dword [0x43f97c]
push edx
push edx
call sub.KERNEL32.dll_GetTickCount
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getcomputername
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40429d
mov edx, dword [0x43f97c]
push edx
push edx
call fcn.00415988
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getcpuname
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4042ce
mov edx, dword [0x43f97c]
push edx
push edx
call fcn.004159c3
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getuserlanguage
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4059ac
call sub.KERNEL32.dll_GetUserDefaultUILanguage
mov dword [0x43f0c4], eax
push dword [0x43f0c4]
mov ebx, 0x436
cmp ebx, dword [esp]
jne 0x404316
mov edx, str.Afrikaans
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x41c
cmp ebx, dword [esp]
jne 0x404335
mov edx, str.Albanian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x45e
cmp ebx, dword [esp]
jne 0x404354
mov edx, str.Amharic
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x1401
cmp ebx, dword [esp]
jne 0x404373
mov edx, str.Arabic___Algeria
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x3c01
cmp ebx, dword [esp]
jne 0x404392
mov edx, str.Arabic___Bahrain
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0xc01
cmp ebx, dword [esp]
jne 0x4043b1
mov edx, str.Arabic___Egypt
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x801
cmp ebx, dword [esp]
jne 0x4043d0
mov edx, str.Arabic___Iraq
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x2c01
cmp ebx, dword [esp]
jne 0x4043ef
mov edx, str.Arabic___Jordan
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x3401
cmp ebx, dword [esp]
jne 0x40440e
mov edx, str.Arabic___Kuwait
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x3001
cmp ebx, dword [esp]
jne 0x40442d
mov edx, str.Arabic___Lebanon
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x1001
cmp ebx, dword [esp]
jne 0x40444c
mov edx, str.Arabic___Libya
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x1801
cmp ebx, dword [esp]
jne 0x40446b
mov edx, str.Arabic___Morocco
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x2001
cmp ebx, dword [esp]
jne 0x40448a
mov edx, str.Arabic___Oman
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x4001
cmp ebx, dword [esp]
jne 0x4044a9
mov edx, str.Arabic___Qatar
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x401
cmp ebx, dword [esp]
jne 0x4044c8
mov edx, str.Arabic___Saudi_Arabia
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x2801
cmp ebx, dword [esp]
jne 0x4044e7
mov edx, str.Arabic___Syria
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x1c01
cmp ebx, dword [esp]
jne 0x404506
mov edx, str.Arabic___Tunisia
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x3801
cmp ebx, dword [esp]
jne 0x404525
mov edx, str.Arabic___United_Arab_Emirates
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x2401
cmp ebx, dword [esp]
jne 0x404544
mov edx, str.Arabic___Yemen
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x42b
cmp ebx, dword [esp]
jne 0x404563
mov edx, str.Armenian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x44d
cmp ebx, dword [esp]
jne 0x404582
mov edx, str.Assamese
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x82c
cmp ebx, dword [esp]
jne 0x4045a1
mov edx, str.Azeri___Cyrillic
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x42c
cmp ebx, dword [esp]
jne 0x4045c0
mov edx, str.Azeri___Latin
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x42d
cmp ebx, dword [esp]
jne 0x4045df
mov edx, str.Basque
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x423
cmp ebx, dword [esp]
jne 0x4045fe
mov edx, str.Belarusian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x845
cmp ebx, dword [esp]
jne 0x40461d
mov edx, str.Bengali___Bangladesh
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x445
cmp ebx, dword [esp]
jne 0x40463c
mov edx, str.Bengali___India
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x141a
cmp ebx, dword [esp]
jne 0x40465b
mov edx, str.Bosnian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x402
cmp ebx, dword [esp]
jne 0x40467a
mov edx, str.Bulgarian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x455
cmp ebx, dword [esp]
jne 0x404699
mov edx, str.Burmese
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x403
cmp ebx, dword [esp]
jne 0x4046b8
mov edx, str.Catalan
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x804
cmp ebx, dword [esp]
jne 0x4046d7
mov edx, str.Chinese___China
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0xc04
cmp ebx, dword [esp]
jne 0x4046f6
mov edx, str.Chinese___Hong_Kong_SAR
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x1404
cmp ebx, dword [esp]
jne 0x404715
mov edx, str.Chinese___Macau_SAR
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x1004
cmp ebx, dword [esp]
jne 0x404734
mov edx, str.Chinese___Singapore
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x404
cmp ebx, dword [esp]
jne 0x404753
mov edx, str.Chinese___Taiwan
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x41a
cmp ebx, dword [esp]
jne 0x404772
mov edx, str.Croatian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x405
cmp ebx, dword [esp]
jne 0x404791
mov edx, str.Czech
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x406
cmp ebx, dword [esp]
jne 0x4047b0
mov edx, str.Danish
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x465
cmp ebx, dword [esp]
jne 0x4047cf
mov edx, str.Divehi__Dhivehi__Maldivian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x813
cmp ebx, dword [esp]
jne 0x4047ee
mov edx, str.Dutch___Belgium
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x413
cmp ebx, dword [esp]
jne 0x40480d
mov edx, str.Dutch___Netherlands
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x466
cmp ebx, dword [esp]
jne 0x40482c
mov edx, 0x43cf23
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0xc09
cmp ebx, dword [esp]
jne 0x40484b
mov edx, str.English___Australia
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x2809
cmp ebx, dword [esp]
jne 0x40486a
mov edx, str.English___Belize
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x1009
cmp ebx, dword [esp]
jne 0x404889
mov edx, str.English___Canada
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x2409
cmp ebx, dword [esp]
jne 0x4048a8
mov edx, str.English___Caribbean
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x809
cmp ebx, dword [esp]
jne 0x4048c7
mov edx, str.English___Great_Britain
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x4009
cmp ebx, dword [esp]
jne 0x4048e6
mov edx, str.English___India
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x1809
cmp ebx, dword [esp]
jne 0x404905
mov edx, str.English___Ireland
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x2009
cmp ebx, dword [esp]
jne 0x404924
mov edx, str.English___Jamaica
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x1409
cmp ebx, dword [esp]
jne 0x404943
mov edx, str.English___New_Zealand
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x3409
cmp ebx, dword [esp]
jne 0x404962
mov edx, str.English___Phillippines
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x1c09
cmp ebx, dword [esp]
jne 0x404981
mov edx, str.English___Southern_Africa
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x2c09
cmp ebx, dword [esp]
jne 0x4049a0
mov edx, str.English___Trinidad
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x409
cmp ebx, dword [esp]
jne 0x4049bf
mov edx, str.English___United_States
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x3009
cmp ebx, dword [esp]
jne 0x4049de
mov edx, str.English___Zimbabwe
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x425
cmp ebx, dword [esp]
jne 0x4049fd
mov edx, str.Estonian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x438
cmp ebx, dword [esp]
jne 0x404a1c
mov edx, str.Faroese
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x429
cmp ebx, dword [esp]
jne 0x404a3b
mov edx, str.Farsi___Persian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x464
cmp ebx, dword [esp]
jne 0x404a5a
mov edx, str.Filipino
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x40b
cmp ebx, dword [esp]
jne 0x404a79
mov edx, str.Finnish
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x80c
cmp ebx, dword [esp]
jne 0x404a98
mov edx, str.French___Belgium
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x2c0c
cmp ebx, dword [esp]
jne 0x404ab7
mov edx, str.French___Cameroon
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0xc0c
cmp ebx, dword [esp]
jne 0x404ad6
mov edx, str.French___Canada
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x240c
cmp ebx, dword [esp]
jne 0x404af5
mov edx, str.French___Congo
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x300c
cmp ebx, dword [esp]
jne 0x404b14
mov edx, str.French___Cote_dIvoire
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x40c
cmp ebx, dword [esp]
jne 0x404b33
mov edx, str.French___France
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x140c
cmp ebx, dword [esp]
jne 0x404b52
mov edx, str.French___Luxembourg
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x340c
cmp ebx, dword [esp]
jne 0x404b71
mov edx, str.French___Mali
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x180c
cmp ebx, dword [esp]
jne 0x404b90
mov edx, str.French___Monaco
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x380c
cmp ebx, dword [esp]
jne 0x404baf
mov edx, 0x43c145
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x280c
cmp ebx, dword [esp]
jne 0x404bce
mov edx, str.French___Senegal
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x100c
cmp ebx, dword [esp]
jne 0x404bed
mov edx, str.French___Switzerland
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x1c0c
cmp ebx, dword [esp]
jne 0x404c0c
mov edx, str.French___West_Indies
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x462
cmp ebx, dword [esp]
jne 0x404c2b
mov edx, str.Frisian___Netherlands
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x42f
cmp ebx, dword [esp]
jne 0x404c4a
mov edx, str.FYRO_Macedonia
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x83c
cmp ebx, dword [esp]
jne 0x404c69
mov edx, str.Gaelic___Ireland
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x43c
cmp ebx, dword [esp]
jne 0x404c88
mov edx, str.Gaelic___Scotland
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x456
cmp ebx, dword [esp]
jne 0x404ca7
mov edx, str.Galician
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x437
cmp ebx, dword [esp]
jne 0x404cc6
mov edx, str.Georgian
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0xc07
cmp ebx, dword [esp]
jne 0x404ce5
mov edx, str.German___Austria
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x407
cmp ebx, dword [esp]
jne 0x404d04
mov edx, str.German___Germany
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x1407
cmp ebx, dword [esp]
jne 0x404d23
mov edx, str.German___Liechtenstein
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x1007
cmp ebx, dword [esp]
jne 0x404d42
mov edx, str.German___Luxembourg
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x807
cmp ebx, dword [esp]
jne 0x404d61
mov edx, str.German___Switzerland
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x408
cmp ebx, dword [esp]
jne 0x404d80
mov edx, str.Greek
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x474
cmp ebx, dword [esp]
jne 0x404d9f
mov edx, str.Guarani___Paraguay
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x447
cmp ebx, dword [esp]
jne 0x404dbe
mov edx, str.Gujarati
lea ecx, [0x43f170]
call fcn.0040d068
jmp 0x40598b
mov ebx, 0x40d
cmp ebx, dword [esp]
jne 0x404ddd
pop eax
mov edx, dword [0x43f170]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._getusername
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4059dd
mov edx, dword [0x43f97c]
push edx
push edx
call fcn.00415a00
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._hex
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x405a1b
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.0040d660
push edx
push eax
call fcn.0040da80
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._hideself
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x405a4f
call sub.KERNEL32.dll_GetConsoleWindow
mov dword [0x43f20c], eax
push 0
push dword [0x43f20c]
call sub.USER32.DLL_ShowWindow
jmp 0x407fd8
mov edx, str._hidewindow
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x405a97
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
cmp dword [0x43f1b4], 0
je 0x405a92
push 0
push dword [0x43f1b4]
call sub.USER32.DLL_ShowWindow
jmp 0x407fd8
mov edx, str._input
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x405ad2
call fcn.0041796d
and eax, eax
je 0x405acd
mov edx, dword [0x43f97c]
push edx
push edx
call dword [0x43d7a8]
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._inputbox
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x405b15
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f0f8]
push dword [0x43f1e4]
push dword [0x43f17c]
call fcn.004100b8
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._is64bit
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x405b58
call fcn.0040aa2e
mov dword [0x43f14c], eax
mov edx, dword [0x43f97c]
push edx
push edx
mov eax, dword [0x43f14c]
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._left
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x405b9b
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f1e4]
call fcn.0040d660
push eax
push dword [0x43f17c]
call fcn.0040d340
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._lowercase
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x405bd2
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.0040d3b0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._lzma
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x405ced
call fcn.004112d9
push dword [0x43f17c]
call fcn.00415ba1
mov dword [0x43f150], eax
mov ebx, dword [0x43f150]
and ebx, ebx
jle 0x405ce8
push dword [0x43f17c]
push 0
call fcn.00416750
and eax, eax
je 0x405ce8
push dword [0x43f150]
call fcn.004139f0
mov dword [0x43f144], eax
push dword [0x43f150]
push dword [0x43f144]
push 0
call fcn.00416860
push 0
call fcn.004163b0
mov ebx, dword [0x43f150]
add ebx, 0x200
push ebx
call fcn.004139f0
mov dword [0x43f128], eax
push 0x6c7a6d61
mov ebx, dword [0x43f150]
add ebx, 0x200
push ebx
push dword [0x43f128]
push dword [0x43f150]
push dword [0x43f144]
call fcn.004115e5
mov dword [0x43f14c], eax
cmp dword [0x43f14c], 0
je 0x405ce8
push dword [0x43f1e4]
push 1
call fcn.004165d0
and eax, eax
je 0x405ce8
push dword [0x43f14c]
push dword [0x43f128]
push 1
call fcn.004168c0
push dword [0x43f150]
push 1
call fcn.00416c60
push 1
call fcn.004163b0
jmp 0x407fd8
mov edx, str._makeadmin
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x405d42
push dword [0x43f0f8]
push dword [0x43f1e4]
push dword [0x43f17c]
call fcn.0040b2ad
mov dword [0x43f14c], eax
mov edx, dword [0x43f97c]
push edx
push edx
mov eax, dword [0x43f14c]
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._makeguid
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x405d71
push dword [0x43f97c]
call fcn.0040acef
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._makeshortcut
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x405f5c
mov edx, dword [0x43f17c]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f1d0
call fcn.0041cfd0
mov edx, dword [0x43f1e4]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f1e0
call fcn.0041cfd0
mov edx, dword [0x43f0f8]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f184
call fcn.0041cfd0
mov edx, dword [0x43f114]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f178
call fcn.0041cfd0
mov edx, dword [0x43f108]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f1a0
call fcn.0041cfd0
mov edx, dword [0x43f17c]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f15c
call fcn.0041cfd0
push 0
call sub.OLE32.DLL_CoInitialize
push 0x43f1b8
mov ebp, 0x43d77c
push ebp
push 1
push 0
mov ebp, 0x43d76c
push ebp
call sub.OLE32.DLL_CoCreateInstance
mov dword [0x43f1cc], eax
mov ebx, dword [0x43f1cc]
and ebx, ebx
jne 0x405f52
sub esp, 4
push dword [0x43f1d0]
mov eax, dword [0x43f1b8]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
add esp, 4
sub esp, 4
push dword [0x43f184]
mov eax, dword [0x43f1b8]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
add esp, 4
sub esp, 4
push dword [0x43f178]
mov eax, dword [0x43f1b8]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
add esp, 4
sub esp, 4
push dword [0x43f1a0]
mov eax, dword [0x43f1b8]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
add esp, 4
sub esp, 4
push dword [0x43f1d8]
push dword [0x43f15c]
mov eax, dword [0x43f1b8]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
add esp, 4
push 0x43f188
mov ebp, 0x43d78c
push ebp
mov eax, dword [0x43f1b8]
push eax
mov eax, dword [eax]
call dword [eax]
mov dword [0x43f1cc], eax
mov ebx, dword [0x43f1cc]
and ebx, ebx
jne 0x405f47
sub esp, 4
push 1
push dword [0x43f1e0]
call fcn.0041d0b0
push eax
mov dword [esp + 8], eax
mov eax, dword [0x43f188]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
push eax
push dword [esp + 4]
call fcn.0041d120
pop eax
add esp, 4
mov dword [0x43f1cc], eax
mov eax, dword [0x43f188]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [0x43f1b8]
push eax
mov eax, dword [eax]
call dword [eax + 8]
call sub.OLE32.DLL_CoUninitialize
jmp 0x407fd8
mov edx, str._maketoolwindow
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x405fc9
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
cmp dword [0x43f1b4], 0
je 0x405fc4
push 0
push dword [0x43f1b4]
call sub.USER32.DLL_ShowWindow
push pe_nt_image_headers32
push 0xffffffec
push dword [0x43f1b4]
call sub.USER32.DLL_SetWindowLongA
push 5
push dword [0x43f1b4]
call sub.USER32.DLL_ShowWindow
jmp 0x407fd8
mov edx, str._maskedinput
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406293
push 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov dword [0x43f20c], eax
mov edx, 0x43c032
lea ecx, [0x43f104]
call fcn.0040d068
mov edx, 0x43c0bb
lea ecx, [0x43f110]
call fcn.0040d068
mov edx, 0x43c034
lea ecx, [0x43f164]
call fcn.0040d068
call fcn.0041796d
and eax, eax
je 0x40628e
mov edx, dword [0x43f190]
xor ecx, ecx
call fcn.0041cfa0
jne 0x4060c8
push 0
push 0
push 1
mov eax, dword [0x43f164]
push eax
push dword [0x43f20c]
call sub.KERNEL32.dll_WriteFile
push 0
push 0
push dword [0x43f190]
call fcn.0040d410
push eax
mov eax, dword [0x43f190]
push eax
push dword [0x43f20c]
call sub.KERNEL32.dll_WriteFile
push 0
push 0
push 1
mov eax, dword [0x43f164]
push eax
push dword [0x43f20c]
call sub.KERNEL32.dll_WriteFile
push 0
push 0
push 1
mov eax, dword [0x43f164]
push eax
push dword [0x43f20c]
call sub.KERNEL32.dll_WriteFile
mov edx, dword [0x43f97c]
push edx
push edx
call dword [0x43d7ac]
push 0x43f198
call fcn.0041cfd0
push dword [0x43f198]
mov edx, 0x43c01e
pop ecx
call fcn.0041cfa0
jne 0x406242
push dword [0x43f198]
call fcn.0040d440
mov ebx, eax
cmp ebx, 0x20
jl 0x406125
push dword [0x43f198]
call fcn.0040d440
mov ebx, eax
cmp ebx, 0x80
jge 0x406125
mov eax, 1
jmp 0x406127
xor eax, eax
and eax, eax
je 0x406184
mov edx, dword [0x43f0dc]
push dword [0x43f97c]
call fcn.0041d050
mov edx, dword [0x43f97c]
push edx
push edx
push 1
push dword [0x43f198]
call fcn.0040d340
pop eax
push 0x43f0dc
call fcn.0041cfd0
push 0
push 0
push 1
mov eax, 0x43c0ea
push eax
push dword [0x43f20c]
call sub.KERNEL32.dll_WriteFile
jmp 0x406242
push dword [0x43f198]
call fcn.0040d440
mov ebx, eax
cmp ebx, 0x1b
jne 0x4061a0
jmp 0x408027
push dword [0x43f198]
call fcn.0040d440
mov ebx, eax
cmp ebx, 8
jne 0x406242
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f0dc]
call fcn.0040d410
mov ebx, eax
dec ebx
push ebx
push dword [0x43f0dc]
call fcn.0040d340
push 0x43f0dc
call fcn.0041cfd0
push 0
push 0
push 1
mov eax, dword [0x43f104]
push eax
push dword [0x43f20c]
call sub.KERNEL32.dll_WriteFile
push 0
push 0
push 1
mov eax, dword [0x43f110]
push eax
push dword [0x43f20c]
call sub.KERNEL32.dll_WriteFile
push 0
push 0
push 1
mov eax, dword [0x43f104]
push eax
push dword [0x43f20c]
call sub.KERNEL32.dll_WriteFile
mov edx, dword [0x43f97c]
push edx
push edx
push 1
push dword [0x43f198]
call fcn.0040d340
inc dword [0x43f97c]
mov edx, 0x43c056
pop ecx
mov dword [0x43f97c], ecx
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4060c8
push dword [0x43f0dc]
call dword [0x43d7b0]
call fcn.00417b46
jmp 0x407fd8
mov edx, str._maskedinputbox
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4062db
mov edx, dword [0x43f97c]
push edx
push edx
push 1
push dword [0x43f0f8]
push dword [0x43f1e4]
push dword [0x43f17c]
call fcn.0040fd77
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._maximizewindow
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40632d
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
cmp dword [0x43f1b4], 0
je 0x406328
push 0
push 0xf030
push 0x112
push dword [0x43f1b4]
call sub.USER32.DLL_PostMessageA
jmp 0x407fd8
mov edx, str._md5
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406382
push dword [0x43f17c]
push 0
call fcn.00416750
and eax, eax
je 0x40637d
push 0
call fcn.004163b0
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.00418810
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._mid
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4063c5
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f1e4]
call fcn.0040d660
push eax
push dword [0x43f17c]
call fcn.0040dd30
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._messagebox
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406420
push dword [0x43f0f8]
call fcn.0040d660
push eax
push dword [0x43f1e4]
push dword [0x43f17c]
call fcn.004100d2
mov dword [0x43f14c], eax
mov edx, dword [0x43f97c]
push edx
push edx
mov eax, dword [0x43f14c]
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._messageboxcheck
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40663f
push dword [0x43f0f8]
call fcn.0040d660
push edx
push eax
push 0
push 0
pop ebx
pop edi
cmp ebx, dword [esp]
jne 0x40645d
cmp edi, dword [esp + 4]
je 0x406461
xor eax, eax
jmp 0x406466
mov eax, 1
or eax, eax
je 0x406479
mov dword [0x43f1dc], 0
jmp 0x4065ac
push 0
push 4
pop ebx
pop edi
cmp ebx, dword [esp]
jne 0x406490
cmp edi, dword [esp + 4]
je 0x406494
xor eax, eax
jmp 0x406499
mov eax, 1
or eax, eax
je 0x4064ac
mov dword [0x43f1dc], 4
jmp 0x4065ac
push 0
push 1
pop ebx
pop edi
cmp ebx, dword [esp]
jne 0x4064c3
cmp edi, dword [esp + 4]
je 0x4064c7
xor eax, eax
jmp 0x4064cc
mov eax, 1
or eax, eax
je 0x4064df
mov dword [0x43f1dc], 1
jmp 0x4065ac
push 0
push 0x10
pop ebx
pop edi
cmp ebx, dword [esp]
jne 0x4064f6
cmp edi, dword [esp + 4]
je 0x4064fa
xor eax, eax
jmp 0x4064ff
mov eax, 1
or eax, eax
je 0x406512
mov dword [0x43f1dc], 0x10
jmp 0x4065ac
push 0
push 0x20
pop ebx
pop edi
cmp ebx, dword [esp]
jne 0x406529
cmp edi, dword [esp + 4]
je 0x40652d
xor eax, eax
jmp 0x406532
mov eax, 1
or eax, eax
je 0x406542
mov dword [0x43f1dc], 0x20
jmp 0x4065ac
push 0
push 0x30
pop ebx
pop edi
cmp ebx, dword [esp]
jne 0x406559
cmp edi, dword [esp + 4]
je 0x40655d
xor eax, eax
jmp 0x406562
mov eax, 1
or eax, eax
je 0x406572
mov dword [0x43f1dc], 0x30
jmp 0x4065ac
push 0
push 0x40
pop ebx
pop edi
cmp ebx, dword [esp]
jne 0x406589
cmp edi, dword [esp + 4]
je 0x40658d
xor eax, eax
jmp 0x406592
mov eax, 1
or eax, eax
je 0x4065a2
mov dword [0x43f1dc], 0x40
jmp 0x4065ac
mov dword [0x43f1dc], 0
add esp, 8
push str.shlwapi.dll
push 0
call fcn.00411be1
and eax, eax
je 0x40661b
push 0x43c132
push 0
call fcn.00411c1e
mov dword [0x43f208], eax
cmp dword [0x43f208], 0
je 0x406611
mov eax, dword [0x43f114]
push eax
push 0x43f138
push dword [0x43f1dc]
mov eax, dword [0x43f17c]
push eax
mov eax, dword [0x43f1e4]
push eax
push 0
push dword [0x43f208]
call fcn.00411c68
mov dword [0x43f14c], eax
push 0
call fcn.00411b23
mov edx, dword [0x43f97c]
push edx
push edx
mov eax, dword [0x43f14c]
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._minimizewindow
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406691
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
cmp dword [0x43f1b4], 0
je 0x40668c
push 0
push 0xf020
push 0x112
push dword [0x43f1b4]
call sub.USER32.DLL_PostMessageA
jmp 0x407fd8
mov edx, str._mouseclick
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406789
push dword [0x43f17c]
mov edx, 0x43c3c4
mov ecx, dword [esp]
call fcn.0041cfa0
je 0x4066d8
push 2
call fcn.0040aa62
push 4
call fcn.0040aa62
jmp 0x406783
mov edx, str._ldc
mov ecx, dword [esp]
call fcn.0041cfa0
je 0x406711
push 2
call fcn.0040aa62
push 4
call fcn.0040aa62
push 2
call fcn.0040aa62
push 4
call fcn.0040aa62
jmp 0x406783
mov edx, 0x43cb0b
mov ecx, dword [esp]
call fcn.0041cfa0
je 0x406736
push 8
call fcn.0040aa62
push 0x10
call fcn.0040aa62
jmp 0x406783
mov edx, str._rdc
mov ecx, dword [esp]
call fcn.0041cfa0
je 0x40676f
push 8
call fcn.0040aa62
push 0x10
call fcn.0040aa62
push 8
call fcn.0040aa62
push 0x10
call fcn.0040aa62
jmp 0x406783
push 2
call fcn.0040aa62
push 4
call fcn.0040aa62
pop eax
jmp 0x407fd8
mov edx, str._movewindow
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406823
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
push 0x43f228
push dword [0x43f1b4]
call sub.USER32.DLL_GetWindowRect
lea ebp, [0x43f228]
mov ebx, dword [ebp + 8]
sub ebx, dword [ebp]
mov dword [0x43f154], ebx
mov ebx, dword [ebp + 0xc]
sub ebx, dword [ebp + 4]
mov dword [0x43f134], ebx
push 0
push dword [0x43f134]
push dword [0x43f154]
push dword [0x43f0f8]
call fcn.0040d660
push eax
push dword [0x43f1e4]
call fcn.0040d660
push eax
push 0
push dword [0x43f1b4]
call sub.USER32.DLL_SetWindowPos
jmp 0x407fd8
mov edx, str._osversion
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406b9c
call fcn.00415a43
mov dword [0x43f12c], eax
push dword [0x43f12c]
mov ebx, 5
cmp ebx, dword [esp]
jne 0x40686b
mov edx, str.Windows_NT3
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, 0x14
cmp ebx, dword [esp]
jne 0x40688a
mov edx, str.Windows_NT4
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, 0xa
cmp ebx, dword [esp]
jne 0x4068a9
mov edx, str.Windows_95
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, 0x1e
cmp ebx, dword [esp]
jne 0x4068c8
mov edx, str.Windows_98
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, 0x28
cmp ebx, dword [esp]
jne 0x4068e7
mov edx, str.Windows_ME
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, 0x32
cmp ebx, dword [esp]
jne 0x406906
mov edx, str.Windows_2000
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, 0x3c
cmp ebx, dword [esp]
jne 0x406925
mov edx, str.Windows_XP
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, 0x41
cmp ebx, dword [esp]
jne 0x406944
mov edx, str.Windows_Server_2003
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, 0x4b
cmp ebx, dword [esp]
jne 0x406963
mov edx, str.Windows_Server_2008
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, 0x5f
cmp ebx, dword [esp]
jne 0x406982
mov edx, str.Windows_Server_2012
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, 0x55
cmp ebx, dword [esp]
jne 0x4069a1
mov edx, str.Windows_Server_2008_R2
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, 0x46
cmp ebx, dword [esp]
jne 0x4069c0
mov edx, str.Windows_Vista
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, 0x50
cmp ebx, dword [esp]
jne 0x4069df
mov edx, str.Windows_7
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, 0xc8
cmp ebx, dword [esp]
je 0x4069f7
mov ebx, 0x5a
cmp ebx, dword [esp]
jne 0x406b16
mov edx, str.Future_Windows_version
lea ecx, [0x43f0c8]
call fcn.0040d068
lea ebp, [0x43f238]
mov dword [ebp], 0x11c
push str.ntdll.dll
push 0xffffffff
call fcn.00411be1
mov dword [0x43f1e8], eax
cmp dword [0x43f1e8], 0
je 0x406aa9
push str.RtlGetVersion
push dword [0x43f1e8]
call fcn.00411c1e
mov dword [0x43f19c], eax
cmp dword [0x43f19c], 0
je 0x406a6c
push 0x43f238
push dword [0x43f19c]
call fcn.00411c4e
mov ebx, eax
and ebx, ebx
jne 0x406a6c
mov eax, 1
jmp 0x406a6e
xor eax, eax
and eax, eax
je 0x406a9e
lea ebp, [0x43f238]
mov eax, dword [ebp + 4]
mov dword [0x43f0fc], eax
mov eax, dword [ebp + 8]
mov dword [0x43f0f4], eax
mov eax, dword [ebp + 0xc]
mov dword [0x43f1b0], eax
movsx eax, byte [ebp + 0x11a]
push eax
pop dword [0x43f200]
push dword [0x43f1e8]
call fcn.00411b23
mov ebx, dword [0x43f0fc]
cmp ebx, 0xa
jne 0x406ae3
mov ebx, dword [0x43f200]
cmp ebx, 1
jne 0x406ad1
mov edx, str.Windows_10
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406ae1
mov edx, str.Windows_Server_2016
lea ecx, [0x43f0c8]
call fcn.0040d068
jmp 0x406b16
mov ebx, dword [0x43f0fc]
cmp ebx, 6
jne 0x406b00
mov ebx, dword [0x43f0f4]
cmp ebx, 2
jl 0x406b00
mov eax, 1
jmp 0x406b02
xor eax, eax
and eax, eax
je 0x406b16
mov edx, str.Windows_8
lea ecx, [0x43f0c8]
call fcn.0040d068
pop eax
mov edx, dword [0x43f97c]
push edx
push edx
push str.ProgramW6432
call fcn.004102b6
push 0x43f1bc
call fcn.0041cfd0
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f1bc]
call fcn.0040d320
pop eax
mov dword [0x43f97c], eax
add eax, dword [0x43d79c]
cmp byte [eax], 0
je 0x406b7c
mov edx, dword [0x43f0c8]
push dword [0x43f97c]
call fcn.0041d050
mov edx, str._64_Bit
call fcn.0041d050
push 0x43f0c8
call fcn.0041cfd0
mov edx, dword [0x43f0c8]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._play
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406c64
call fcn.0040e87d
and eax, eax
je 0x406c5f
push dword [0x43f17c]
push 0
call fcn.0040ea7e
and eax, eax
je 0x406c5f
push 0
call fcn.0040ed4a
push 1
push 0
call fcn.0040ed5a
mov dword [0x43f18c], eax
push 1
push 0
call fcn.0040eef4
mov dword [0x43f148], eax
mov ebx, dword [0x43f148]
cmp ebx, dword [0x43f18c]
jl 0x406c1c
jmp 0x406c5f
mov ebx, dword [0x43f148]
cmp ebx, dword [0x43f0e0]
jne 0x406c3f
mov ebx, dword [0x43f11c]
cmp ebx, 0x64
jle 0x406c37
jmp 0x406c5f
inc dword [0x43f11c]
jmp 0x406c53
mov eax, dword [0x43f148]
mov dword [0x43f0e0], eax
mov dword [0x43f11c], 0
push 0xa
call fcn.00415b36
jmp 0x406bf8
jmp 0x407fd8
mov edx, str._random
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406cb3
push dword [0x43f17c]
call fcn.0040d660
push eax
call fcn.004116d0
mov dword [0x43f14c], eax
mov edx, dword [0x43f97c]
push edx
push edx
mov eax, dword [0x43f14c]
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._rc4
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406d7d
push dword [0x43f17c]
push 3
call fcn.00416750
and eax, eax
je 0x406d78
push 3
call fcn.00416800
mov dword [0x43f0bc], eax
mov ebx, dword [0x43f0bc]
and ebx, ebx
jle 0x406d6e
push dword [0x43f0bc]
call fcn.004139f0
mov dword [0x43f0b8], eax
push dword [0x43f0bc]
push dword [0x43f0b8]
push 3
call fcn.00416860
push dword [0x43f0f8]
push dword [0x43f0bc]
push dword [0x43f0b8]
call fcn.00409000
push dword [0x43f1e4]
push 4
call fcn.004165d0
and eax, eax
je 0x406d6e
push dword [0x43f0bc]
push dword [0x43f0b8]
push 4
call fcn.004168c0
push 4
call fcn.004163b0
push 3
call fcn.004163b0
jmp 0x407fd8
mov edx, str._readpreferencevalue
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406dcd
push dword [0x43f17c]
call fcn.004109fb
and eax, eax
je 0x406dc8
mov edx, dword [0x43f97c]
push edx
push edx
push 0x43c01e
push dword [0x43f1e4]
call fcn.00410a09
push 0x43f10c
call fcn.0041cfd0
call fcn.00410b13
jmp 0x407fd8
mov edx, str._removeextension
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406e0d
push dword [0x43f17c]
call sub.SHLWAPI.DLL_PathRemoveExtensionA
mov edx, dword [0x43f17c]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._renameextension
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406e80
mov edx, dword [0x43f97c]
push edx
push edx
mov edx, 0x43c122
call fcn.0041d050
mov edx, dword [0x43f1e4]
call fcn.0041d050
inc dword [0x43f97c]
push dword [0x43f17c]
mov edx, dword [0x43d79c]
add dword [esp + 4], edx
call sub.SHLWAPI.DLL_PathRenameExtensionA
pop dword [0x43f97c]
mov edx, dword [0x43f17c]
push dword [0x43f97c]
call fcn.0041d050
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._resizewindow
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406efd
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
cmp dword [0x43f1b4], 0
je 0x406ef8
push 0
push dword [0x43f108]
call fcn.0040d660
push eax
push dword [0x43f114]
call fcn.0040d660
push eax
push dword [0x43f0f8]
call fcn.0040d660
push eax
push dword [0x43f1e4]
call fcn.0040d660
push eax
push 0
push dword [0x43f1b4]
call sub.USER32.DLL_SetWindowPos
jmp 0x407fd8
mov edx, str._right
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406f40
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f1e4]
call fcn.0040d660
push eax
push dword [0x43f17c]
call fcn.0040dd70
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._savefiledialog
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x406f99
push dword [0x43f114]
call fcn.0040d660
mov dword [0x43f16c], eax
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f16c]
push dword [0x43f0f8]
push dword [0x43f1e4]
push dword [0x43f17c]
call fcn.0040fa9d
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._screenshot
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407096
push 0
call sub.USER32.DLL_GetDC
mov dword [0x43f194], eax
push dword [0x43f194]
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [0x43f1f0], eax
push 0
call sub.USER32.DLL_GetSystemMetrics
mov dword [0x43f0d8], eax
push 1
call sub.USER32.DLL_GetSystemMetrics
mov dword [0x43f1f8], eax
push 0xc
push dword [0x43f194]
call sub.GDI32.DLL_GetDeviceCaps
mov dword [0x43f160], eax
push dword [0x43f1f8]
push dword [0x43f0d8]
push 0
call fcn.00411e50
mov dword [0x43f0c0], eax
push dword [0x43f0c0]
push dword [0x43f1f0]
call sub.GDI32.DLL_SelectObject
push 0xcc0020
push 0
push 0
push dword [0x43f194]
push dword [0x43f1f8]
push dword [0x43f0d8]
push 0
push 0
push dword [0x43f1f0]
call sub.GDI32.DLL_BitBlt
push dword [0x43f1f0]
call sub.GDI32.DLL_DeleteDC
push dword [0x43f194]
push 0
call sub.USER32.DLL_ReleaseDC
push dword [0x43f17c]
push 0
call fcn.00411f1e
jmp 0x407fd8
mov edx, str._sendkeys
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4071e5
push dword [0x43f17c]
call fcn.0040d410
mov dword [0x43f18c], eax
cmp dword [0x43f18c], 0
je 0x4071e0
mov dword [0x43f13c], 0
mov eax, dword [0x43f18c]
cmp eax, dword [0x43f13c]
jl 0x4071e0
mov ebx, dword [0x43f13c]
cmp ebx, dword [0x43f18c]
jge 0x4071d4
mov edx, dword [0x43f97c]
push edx
push edx
push 1
mov eax, dword [0x43f17c]
mov ebx, eax
add ebx, dword [0x43f13c]
push ebx
call fcn.00413a40
push 0x43f0c8
call fcn.0041cfd0
push dword [0x43f0c8]
call fcn.0040d440
push eax
call sub.USER32.DLL_VkKeyScanA
mov dword [0x43f1ac], eax
mov ebx, dword [0x43f1ac]
cmp ebx, 0x140
jle 0x407160
push 0
push 0
push 1
push 0xa0
call sub.USER32.DLL_keybd_event
push 0
push 0
push 1
push dword [0x43f1ac]
call sub.USER32.DLL_keybd_event
push 0
push 2
push 1
push dword [0x43f1ac]
call sub.USER32.DLL_keybd_event
mov ebx, dword [0x43f1ac]
cmp ebx, 0x140
jle 0x4071d4
push 0
push 0
push 1
push 0xa0
call sub.USER32.DLL_keybd_event
push 0
push 2
push 1
push 0xa0
call sub.USER32.DLL_keybd_event
inc dword [0x43f13c]
jno 0x4070d6
jmp 0x407fd8
mov edx, str._setforegroundwindow
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407228
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
cmp dword [0x43f1b4], 0
je 0x407223
push dword [0x43f1b4]
call sub.USER32.DLL_SetForegroundWindow
jmp 0x407fd8
mov edx, str._setleft
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40732e
push dword [0x43f1e4]
call fcn.0040d660
push edx
push eax
fild qword [esp]
pop eax
fstp dword [esp]
pop dword [0x43f140]
fld dword [0x43f140]
fcomp dword [0x43d48c]
fnstsw ax
test ah, 0x41
jne 0x407319
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f0f8]
call fcn.0040d320
push 0x43f174
call fcn.0041cfd0
push dword [0x43f174]
mov edx, 0x43c01e
pop ecx
call fcn.0041cfa0
jne 0x4072bb
push dword [0x43f174]
call fcn.0040d410
mov ebx, eax
cmp ebx, 1
jne 0x4072bb
mov eax, 1
jmp 0x4072bd
xor eax, eax
and eax, eax
je 0x4072f0
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f174]
fld dword [0x43f140]
push eax
fistp dword [esp]
push dword [0x43f17c]
call fcn.0040dde0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407317
mov edx, dword [0x43f97c]
push edx
push edx
fld dword [0x43f140]
push eax
fistp dword [esp]
push dword [0x43f17c]
call fcn.0040de90
push 0x43f10c
call fcn.0041cfd0
jmp 0x407329
mov edx, 0x43c01e
lea ecx, [0x43f10c]
call fcn.0040d068
jmp 0x407fd8
mov edx, str._setright
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407434
push dword [0x43f1e4]
call fcn.0040d660
push edx
push eax
fild qword [esp]
pop eax
fstp dword [esp]
pop dword [0x43f140]
fld dword [0x43f140]
fcomp dword [0x43d48c]
fnstsw ax
test ah, 0x41
jne 0x40741f
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f0f8]
call fcn.0040d320
push 0x43f174
call fcn.0041cfd0
push dword [0x43f174]
mov edx, 0x43c01e
pop ecx
call fcn.0041cfa0
jne 0x4073c1
push dword [0x43f174]
call fcn.0040d410
mov ebx, eax
cmp ebx, 1
jne 0x4073c1
mov eax, 1
jmp 0x4073c3
xor eax, eax
and eax, eax
je 0x4073f6
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f174]
fld dword [0x43f140]
push eax
fistp dword [esp]
push dword [0x43f17c]
call fcn.0040deb0
push 0x43f10c
call fcn.0041cfd0
jmp 0x40741d
mov edx, dword [0x43f97c]
push edx
push edx
fld dword [0x43f140]
push eax
fistp dword [esp]
push dword [0x43f17c]
call fcn.0040df60
push 0x43f10c
call fcn.0041cfd0
jmp 0x40742f
mov edx, 0x43c01e
lea ecx, [0x43f10c]
call fcn.0040d068
jmp 0x407fd8
mov edx, str._setwindowtitle
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40747d
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
cmp dword [0x43f1b4], 0
je 0x407478
mov eax, dword [0x43f1e4]
push eax
push dword [0x43f1b4]
call sub.USER32.DLL_SetWindowTextA
jmp 0x407fd8
mov edx, str._setconsoletransparency
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4074b8
call sub.KERNEL32.dll_GetConsoleWindow
mov dword [0x43f20c], eax
push dword [0x43f17c]
call fcn.0040d660
push eax
push dword [0x43f20c]
call fcn.00409faa
jmp 0x407fd8
mov edx, str._setwindowtransparency
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407507
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
cmp dword [0x43f1b4], 0
je 0x407502
push dword [0x43f1e4]
call fcn.0040d660
push eax
push dword [0x43f1b4]
call fcn.00409faa
jmp 0x407fd8
mov edx, str._sha1
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40755c
push dword [0x43f17c]
push 0
call fcn.00416750
and eax, eax
je 0x407557
push 0
call fcn.004163b0
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.00418a60
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._showself
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407590
call sub.KERNEL32.dll_GetConsoleWindow
mov dword [0x43f20c], eax
push 5
push dword [0x43f20c]
call sub.USER32.DLL_ShowWindow
jmp 0x407fd8
mov edx, str._showwindow
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4075d8
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
cmp dword [0x43f1b4], 0
je 0x4075d3
push 5
push dword [0x43f1b4]
call sub.USER32.DLL_ShowWindow
jmp 0x407fd8
mov edx, str._setclipboardtext
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4075fd
push dword [0x43f17c]
call fcn.00417c98
jmp 0x407fd8
mov edx, str._setcursor
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407634
push dword [0x43f1e4]
call fcn.0040d660
push eax
push dword [0x43f17c]
call fcn.0040d660
push eax
call sub.USER32.DLL_SetCursorPos
jmp 0x407fd8
mov edx, str._speak
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40772f
push dword [0x43f97c]
call fcn.0040b466
mov edx, dword [esp]
mov dword [0x43f97c], edx
mov edx, eax
call fcn.0041d050
push 0x43f0e8
call fcn.0041cfd0
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f97c]
push 0x43c10f
push 1
push dword [0x43f0e8]
call fcn.0040db00
mov edx, dword [0x43d79c]
add dword [esp], edx
call fcn.0040d660
pop dword [0x43f97c]
mov dword [0x43f1f4], eax
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f0e8]
call fcn.0040d410
mov ebx, eax
add ebx, 0xfffffffe
push ebx
push dword [0x43f0e8]
call fcn.0040dd70
push 0x43f0e8
call fcn.0041cfd0
mov edx, dword [0x43f97c]
push edx
push edx
push 0x43c10f
push 1
push dword [0x43f0e8]
call fcn.0040db00
push 0x43f1c0
call fcn.0041cfd0
push 0
push dword [0x43f1e4]
call fcn.0040d660
push eax
push 0x64
push dword [0x43f17c]
push dword [0x43f1c0]
call fcn.0040b02d
jmp 0x407fd8
mov edx, str._sleep
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40775a
push dword [0x43f17c]
call fcn.0040d660
push eax
call fcn.00415b36
jmp 0x407fd8
mov edx, str._strcount
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40779f
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f1e4]
push dword [0x43f17c]
call fcn.0040df80
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._strlen
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4077de
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.0040d410
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._strpos
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407828
mov edx, dword [0x43f97c]
push edx
push edx
push 0
push dword [0x43f1e4]
push dword [0x43f17c]
call fcn.0040e000
cdq
push edx
push eax
call fcn.0040d5d0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._strreplace
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40786b
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f0f8]
push dword [0x43f1e4]
push dword [0x43f17c]
call fcn.0040e380
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._strrev
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407913
push dword [0x43f17c]
call fcn.0040d410
push eax
fild dword [esp]
fstp dword [esp]
pop dword [0x43f140]
fld dword [0x43f140]
fcomp dword [0x43d48c]
fnstsw ax
test ah, 0x41
jne 0x40790e
fld dword [0x43f140]
push eax
fistp dword [esp]
pop dword [0x43f118]
mov eax, 1
cmp eax, dword [0x43f118]
jg 0x40790e
mov edx, dword [0x43f10c]
push dword [0x43f97c]
call fcn.0041d050
mov edx, dword [0x43f97c]
push edx
push edx
push 1
push dword [0x43f118]
push dword [0x43f17c]
call fcn.0040dcb0
pop eax
push 0x43f10c
call fcn.0041cfd0
dec dword [0x43f118]
jno 0x4078bf
jmp 0x407fd8
mov edx, str._strsplit
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x40797e
mov edx, dword [0x43f97c]
push edx
push edx
mov edx, dword [0x43f97c]
push edx
push edx
push 1
push dword [0x43f0f8]
call fcn.0040d340
inc dword [0x43f97c]
push dword [0x43f1e4]
call fcn.0040d660
push eax
push dword [0x43f17c]
mov edx, dword [0x43d79c]
add dword [esp + 8], edx
call fcn.0040db00
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._tempfile
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x4079cf
mov edx, dword [0x43f97c]
push edx
push edx
push 0x800
call fcn.0040dc10
push 0x43f10c
call fcn.0041cfd0
mov eax, dword [0x43f10c]
push eax
push 0
push 0x43c01e
push dword [0x43f17c]
call sub.KERNEL32.dll_GetTempFileNameA
jmp 0x407fd8
mov edx, str._trim
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407a7e
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f1e4]
call fcn.0040d320
push 0x43f174
call fcn.0041cfd0
push dword [0x43f174]
mov edx, 0x43c01e
pop ecx
call fcn.0041cfa0
jne 0x407a31
push dword [0x43f174]
call fcn.0040d410
mov ebx, eax
cmp ebx, 1
jne 0x407a31
mov eax, 1
jmp 0x407a33
xor eax, eax
and eax, eax
je 0x407a5c
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f174]
push dword [0x43f17c]
call fcn.0040d260
push 0x43f10c
call fcn.0041cfd0
jmp 0x407a79
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.0040d320
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._trimleft
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407b2d
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f1e4]
call fcn.0040d320
push 0x43f174
call fcn.0041cfd0
push dword [0x43f174]
mov edx, 0x43c01e
pop ecx
call fcn.0041cfa0
jne 0x407ae0
push dword [0x43f174]
call fcn.0040d410
mov ebx, eax
cmp ebx, 1
jne 0x407ae0
mov eax, 1
jmp 0x407ae2
xor eax, eax
and eax, eax
je 0x407b0b
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f174]
push dword [0x43f17c]
call fcn.0040e3b0
push 0x43f10c
call fcn.0041cfd0
jmp 0x407b28
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.0040e440
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._trimright
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407bdc
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f1e4]
call fcn.0040d320
push 0x43f174
call fcn.0041cfd0
push dword [0x43f174]
mov edx, 0x43c01e
pop ecx
call fcn.0041cfa0
jne 0x407b8f
push dword [0x43f174]
call fcn.0040d410
mov ebx, eax
cmp ebx, 1
jne 0x407b8f
mov eax, 1
jmp 0x407b91
xor eax, eax
and eax, eax
je 0x407bba
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f174]
push dword [0x43f17c]
call fcn.0040e460
push 0x43f10c
call fcn.0041cfd0
jmp 0x407bd7
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.0040e500
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._uppercase
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407c13
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.0040dc50
push 0x43f10c
call fcn.0041cfd0
jmp 0x407fd8
mov edx, str._unlzma
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407d6b
call fcn.004112d9
push dword [0x43f17c]
call fcn.00415ba1
mov dword [0x43f150], eax
mov ebx, dword [0x43f150]
cmp ebx, 4
jle 0x407d66
push dword [0x43f17c]
push 0
call fcn.00416750
and eax, eax
je 0x407d66
mov eax, dword [0x43f150]
cdq
push edx
push eax
add dword [esp], 0xfffffffc
adc dword [esp + 4], 0xffffffff
pop eax
pop edx
push edx
push eax
push 0
call fcn.00416cb0
push 0
call fcn.00416d10
push eax
fild dword [esp]
fstp dword [esp]
pop dword [0x43f140]
push 0
push 0
push 0
call fcn.00416cb0
mov ebx, dword [0x43f150]
add ebx, 0xfffffffc
push ebx
call fcn.004139f0
mov dword [0x43f144], eax
mov ebx, dword [0x43f150]
add ebx, 0xfffffffc
push ebx
push dword [0x43f144]
push 0
call fcn.00416860
push 0
call fcn.004163b0
fld dword [0x43f140]
push eax
fistp dword [esp]
call fcn.004139f0
mov dword [0x43f128], eax
push 0x6c7a6d61
fld dword [0x43f140]
push eax
fistp dword [esp]
push dword [0x43f128]
push dword [0x43f150]
push dword [0x43f144]
call fcn.00411612
mov dword [0x43f14c], eax
cmp dword [0x43f14c], 0
je 0x407d66
push dword [0x43f1e4]
push 1
call fcn.004165d0
and eax, eax
je 0x407d66
push dword [0x43f14c]
push dword [0x43f128]
push 1
call fcn.004168c0
push 1
call fcn.004163b0
jmp 0x407fd8
mov edx, str._unzip
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407da5
push 0
push 1
push dword [0x43f1e4]
push dword [0x43f17c]
call fcn.0040a178
mov dword [0x43f14c], eax
jmp 0x407fd8
mov edx, str._windowontop
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407e06
push dword [0x43f17c]
push 0
call sub.USER32.DLL_FindWindowA
mov dword [0x43f1b4], eax
cmp dword [0x43f1b4], 0
je 0x407e01
push 3
push 0
push 0
push 0
push 0
push 0xffffffff
push dword [0x43f1b4]
call sub.USER32.DLL_SetWindowPos
jmp 0x407fd8
mov edx, str._writepreferencevalue
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407ea4
push dword [0x43f17c]
push 0
call fcn.00416750
and eax, eax
je 0x407e49
push 0
call fcn.004163b0
mov dword [0x43f120], 0
jmp 0x407e53
mov dword [0x43f120], 1
mov ebx, dword [0x43f120]
cmp ebx, 1
jne 0x407e70
push dword [0x43f17c]
call fcn.00410b81
mov dword [0x43f148], eax
jmp 0x407e80
push dword [0x43f17c]
call fcn.004109fb
mov dword [0x43f148], eax
cmp dword [0x43f148], 0
je 0x407e9f
push dword [0x43f0f8]
push dword [0x43f1e4]
call fcn.00410b8f
call fcn.00410b13
jmp 0x407fd8
mov edx, str._zip
mov ecx, dword [esp]
add ecx, dword [0x43d79c]
call fcn.0041cfa0
je 0x407fce
push dword [0x43f1e4]
push 0
call fcn.00416750
and eax, eax
je 0x407eed
push 0
call fcn.004163b0
push dword [0x43f1e4]
call fcn.0040aafe
mov dword [0x43f134], eax
jmp 0x407efd
push dword [0x43f1e4]
call fcn.0040ac43
mov dword [0x43f134], eax
cmp dword [0x43f134], 0
je 0x407fcc
push dword [0x43f17c]
push 0
call fcn.00416750
and eax, eax
je 0x407f79
push 0
call fcn.004163b0
push dword [0x43f97c]
push 0
push 0xffffffff
mov edx, dword [0x43f97c]
push edx
push edx
push dword [0x43f17c]
call fcn.00415e2d
inc dword [0x43f97c]
push dword [0x43f17c]
push dword [0x43f134]
mov edx, dword [0x43d79c]
add dword [esp + 8], edx
call fcn.004099f6
pop dword [0x43f97c]
mov dword [0x43f14c], eax
jmp 0x407fbc
push 0x43cd78
push dword [0x43f17c]
push 0
call fcn.00415f5c
and eax, eax
je 0x407fbc
push 0
call fcn.00415f29
push 0
push 0xffffffff
push dword [0x43f17c]
push dword [0x43f134]
call fcn.0040b908
mov dword [0x43f14c], eax
push 0x43c01e
push dword [0x43f134]
call fcn.00409274
jmp 0x407fd8
mov dword [0x43f1ec], 1
pop dword [0x43f97c]
push 0xfffffff5
call sub.KERNEL32.dll_GetStdHandle
mov dword [0x43f150], eax
push dword [0x43f10c]
mov edx, 0x43c01e
pop ecx
call fcn.0041cfa0
jne 0x408027
push 0
push 0x43f118
push dword [0x43f10c]
call fcn.0040e520
push eax
mov eax, dword [0x43f10c]
push eax
push dword [0x43f150]
call sub.KERNEL32.dll_WriteFile
push 0
call fcn.00408046
call fcn.0041cf70
push dword [0x43f0b0]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess